@vess-id/ai-identity 0.14.0 → 0.15.0

package/dist/index.js

@@ -164,6 +164,7 @@ __export(index_exports, {
   sha256Hex: () => sha256Hex,
   signJWT: () => signJWT,
   signRequest: () => signRequest,
+  validateActionInput: () => validateActionInput,
   validateRegistryObject: () => validateRegistryObject,
   vcStatusToCredentialStatus: () => vcStatusToCredentialStatus,
   verifyJWT: () => verifyJWT,
@@ -2926,6 +2927,13 @@ var GrantResourceType = /* @__PURE__ */ ((GrantResourceType2) => {
   GrantResourceType2["JIRA_PROJECT"] = "jira:project";
   GrantResourceType2["JIRA_BOARD"] = "jira:board";
   GrantResourceType2["JIRA_ISSUE"] = "jira:issue";
+  GrantResourceType2["HUBSPOT_OBJECT"] = "hubspot:object";
+  GrantResourceType2["HUBSPOT_PROPERTY"] = "hubspot:property";
+  GrantResourceType2["HUBSPOT_SCHEMA"] = "hubspot:schema";
+  GrantResourceType2["HUBSPOT_ASSOCIATION"] = "hubspot:association";
+  GrantResourceType2["HUBSPOT_ENGAGEMENT"] = "hubspot:engagement";
+  GrantResourceType2["HUBSPOT_WORKFLOW"] = "hubspot:workflow";
+  GrantResourceType2["HUBSPOT_ACCOUNT"] = "hubspot:account";
   GrantResourceType2["OS_SECRET"] = "os:secret";
   GrantResourceType2["ANY"] = "*";
   return GrantResourceType2;
@@ -4259,6 +4267,7 @@ var CANONICAL_PROVIDERS = [
   "gmail",
   "calendar",
   "jira",
+  "hubspot",
   "os"
 ];
 var PROVIDER_ALIASES = {};
@@ -4502,6 +4511,15 @@ var DummyVpVerifier = class {
 var ACTION_REGISTRY = {
   registry_version: "2025-09-28",
   actions: [
+    // ─── Resource binding principle (high-risk CREATE actions) ───
+    // A high-risk CREATE action's target_bindings.resource_id MUST bind to the
+    // container/parent that already exists at approval + invoke time — never to
+    // the not-yet-created resource's id (which does not exist until after the
+    // call and is absent from input_schema). Cedar must resolve the resource at
+    // evaluation time, and the server enforces a specific non-wildcard target,
+    // so an unresolvable binding makes the action impossible to approve.
+    // Examples: slack.message.post → channel, jira.issue.create → projectKey,
+    // hubspot objects.batchCreate → objectType, engagements.create → type.
     // ─── Slack Actions ───
     {
       action: "slack.message.post",
@@ -4701,15 +4719,21 @@ var ACTION_REGISTRY = {
       required_relations: ["editor", "act_as"],
       required_scopes: ["repo", "write:issues"],
       capability: "github.issues.triage",
+      // Schema mirrors the server contract (GitHubConnectorAdapter
+      // getSupportedActions inputSchema — packages/api/src/tool/adapters/
+      // github.adapter.ts): owner/repo are required params.
       input_schema: {
         type: "object",
         properties: {
+          owner: { type: "string", minLength: 1, description: "Repository owner (username or organization)" },
+          repo: { type: "string", minLength: 1, description: "Repository name" },
           title: { type: "string", minLength: 1 },
           body: { type: "string" },
           labels: { type: "array", items: { type: "string" } },
-          assignees: { type: "array", items: { type: "string" } }
+          assignees: { type: "array", items: { type: "string" } },
+          milestone: { type: "integer", minimum: 1, description: "Milestone number to associate with the issue" }
         },
-        required: ["title"],
+        required: ["owner", "repo", "title"],
         additionalProperties: false
       },
       constraints: { rate_bucket: "github.write" },
@@ -4726,9 +4750,13 @@ var ACTION_REGISTRY = {
       required_relations: ["viewer", "editor", "admin", "owner"],
       required_scopes: ["repo", "read:issues"],
       capability: "github.read.basic",
+      // Schema mirrors the server contract (GitHubConnectorAdapter):
+      // owner/repo are required params.
       input_schema: {
         type: "object",
         properties: {
+          owner: { type: "string", minLength: 1, description: "Repository owner (username or organization)" },
+          repo: { type: "string", minLength: 1, description: "Repository name" },
           state: { type: "string", enum: ["open", "closed", "all"] },
           labels: { type: "string" },
           sort: { type: "string", enum: ["created", "updated", "comments"] },
@@ -4736,6 +4764,7 @@ var ACTION_REGISTRY = {
           per_page: { type: "integer", minimum: 1, maximum: 100 },
           page: { type: "integer", minimum: 1 }
         },
+        required: ["owner", "repo"],
         additionalProperties: false
       },
       constraints: { rate_bucket: "github.read" },
@@ -4752,12 +4781,17 @@ var ACTION_REGISTRY = {
       required_relations: ["viewer", "editor", "admin", "owner"],
       required_scopes: ["repo", "read:issues"],
       capability: "github.read.basic",
+      // Schema mirrors the server contract (GitHubConnectorAdapter):
+      // owner/repo required, camelCase issueNumber (the adapter reads
+      // params.issueNumber — snake_case issue_number was a drift).
       input_schema: {
         type: "object",
         properties: {
-          issue_number: { type: "integer", minimum: 1 }
+          owner: { type: "string", minLength: 1, description: "Repository owner (username or organization)" },
+          repo: { type: "string", minLength: 1, description: "Repository name" },
+          issueNumber: { type: "integer", minimum: 1, description: "Issue number" }
         },
-        required: ["issue_number"],
+        required: ["owner", "repo", "issueNumber"],
         additionalProperties: false
       },
       constraints: { rate_bucket: "github.read" },
@@ -4774,17 +4808,22 @@ var ACTION_REGISTRY = {
       required_relations: ["editor", "act_as"],
       required_scopes: ["repo", "write:issues"],
       capability: "github.issues.triage",
+      // Schema mirrors the server contract (GitHubConnectorAdapter):
+      // owner/repo required, camelCase issueNumber (the adapter reads
+      // params.issueNumber — snake_case issue_number was a drift).
       input_schema: {
         type: "object",
         properties: {
-          issue_number: { type: "integer", minimum: 1 },
+          owner: { type: "string", minLength: 1, description: "Repository owner (username or organization)" },
+          repo: { type: "string", minLength: 1, description: "Repository name" },
+          issueNumber: { type: "integer", minimum: 1, description: "Issue number to update" },
           title: { type: "string" },
           body: { type: "string" },
           state: { type: "string", enum: ["open", "closed"] },
           labels: { type: "array", items: { type: "string" } },
           assignees: { type: "array", items: { type: "string" } }
         },
-        required: ["issue_number"],
+        required: ["owner", "repo", "issueNumber"],
         additionalProperties: false
       },
       constraints: { rate_bucket: "github.write" },
@@ -5076,7 +5115,9 @@ var ACTION_REGISTRY = {
             }
           },
           attendees: { type: "array", description: "List of attendee objects with email field", items: { type: "object", properties: { email: { type: "string" } } } },
-          location: { type: "string", description: "Event location" }
+          location: { type: "string", description: "Event location" },
+          addMeet: { type: "boolean", description: "Opt-in: attach a Google Meet link (default: false)" },
+          meetRequestId: { type: "string", description: "Stable idempotency key for the Meet request (used only when addMeet is true)" }
         },
         required: ["summary", "start", "end"],
         additionalProperties: false
@@ -5124,7 +5165,9 @@ var ACTION_REGISTRY = {
             }
           },
           attendees: { type: "array", description: "List of attendee objects with email field", items: { type: "object", properties: { email: { type: "string" } } } },
-          location: { type: "string", description: "Event location" }
+          location: { type: "string", description: "Event location" },
+          addMeet: { type: "boolean", description: "Opt-in: attach a Google Meet link (default: false)" },
+          meetRequestId: { type: "string", description: "Stable idempotency key for the Meet request (used only when addMeet is true)" }
         },
         required: ["eventId"],
         additionalProperties: false
@@ -5332,7 +5375,13 @@ var ACTION_REGISTRY = {
         properties: {
           projectKey: { type: "string", minLength: 1 },
           summary: { type: "string", minLength: 1 },
-          description: { type: "string" },
+          description: {
+            oneOf: [
+              { type: "string", description: "Plain text description." },
+              { type: "object", description: 'ADF document object for rich formatting: {type:"doc", version:1, content:[...]}.' }
+            ],
+            description: 'Issue description. Pass a plain string, OR an ADF document object ({type:"doc",version:1,content:[...]}) for rich formatting (headings, lists, code, links).'
+          },
           issueTypeName: { type: "string", minLength: 1, description: "Issue type name (default: Task)" },
           priority: { type: "string" },
           assigneeAccountId: { type: "string" },
@@ -5360,7 +5409,13 @@ var ACTION_REGISTRY = {
         properties: {
           issueIdOrKey: { type: "string", minLength: 1 },
           summary: { type: "string" },
-          description: { type: "string" },
+          description: {
+            oneOf: [
+              { type: "string", description: "Plain text description." },
+              { type: "object", description: 'ADF document object for rich formatting: {type:"doc", version:1, content:[...]}.' }
+            ],
+            description: 'Issue description. Pass a plain string, OR an ADF document object ({type:"doc",version:1,content:[...]}) for rich formatting (headings, lists, code, links).'
+          },
           priority: { type: "string" },
           assigneeAccountId: { type: "string" },
           labels: { type: "array", items: { type: "string" } }
@@ -5408,7 +5463,13 @@ var ACTION_REGISTRY = {
         type: "object",
         properties: {
           issueIdOrKey: { type: "string", minLength: 1 },
-          body: { type: "string", minLength: 1 }
+          body: {
+            oneOf: [
+              { type: "string", minLength: 1, description: "Plain text comment body." },
+              { type: "object", description: 'ADF document object for rich formatting: {type:"doc", version:1, content:[...]}.' }
+            ],
+            description: 'Comment body. Pass a plain string, OR an ADF document object ({type:"doc",version:1,content:[...]}) for rich formatting (headings, lists, code, links).'
+          }
         },
         required: ["issueIdOrKey", "body"],
         additionalProperties: false
@@ -5664,6 +5725,665 @@ var ACTION_REGISTRY = {
         resource_id: { source: "param", param: "command" }
       },
       version: "1.0.0"
+    },
+    // ─── HubSpot CRM Objects (objectType 汎用) ───
+    // 公式 MCP (@hubspot/mcp-server) のツール集合を写像。object 系は objectType
+    // パラメータ化された汎用エンドポイント。scope は objectType ごとに HubSpot 側で
+    // 実行時強制されるため、required_scopes には代表 scope を宣言する (実際の許可範囲は
+    // DEFAULT_SCOPES の固定 union)。
+    {
+      action: "hubspot.crm.objects.list",
+      resource_type: "hubspot:object",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.objects.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type (e.g. contacts, companies, deals) or custom object type ID" },
+          limit: { type: "integer", minimum: 1, maximum: 100 },
+          after: { type: "string" },
+          properties: { type: "array", items: { type: "string" } },
+          archived: { type: "boolean" }
+        },
+        required: ["objectType"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmObject"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "objectType" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.objects.search",
+      resource_type: "hubspot:object",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.objects.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          query: { type: "string", maxLength: 3e3 },
+          filterGroups: { type: "array" },
+          properties: { type: "array", items: { type: "string" } },
+          sorts: { type: "array", items: { type: "string" } },
+          limit: { type: "integer", minimum: 1, maximum: 100 },
+          after: { type: "string" }
+        },
+        required: ["objectType"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmObject"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "objectType" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.objects.batchRead",
+      resource_type: "hubspot:object",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.objects.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          inputs: {
+            type: "array",
+            minItems: 1,
+            items: { type: "object", properties: { id: { type: "string" } }, required: ["id"], additionalProperties: false }
+          },
+          properties: { type: "array", items: { type: "string" } },
+          idProperty: { type: "string" }
+        },
+        required: ["objectType", "inputs"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmObject"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "objectType" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.objects.batchCreate",
+      resource_type: "hubspot:object",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["crm.objects.contacts.write"],
+      capability: "hubspot.crm.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          inputs: {
+            type: "array",
+            minItems: 1,
+            items: {
+              type: "object",
+              properties: { properties: { type: "object" }, associations: { type: "array" } },
+              required: ["properties"],
+              additionalProperties: false
+            }
+          }
+        },
+        required: ["objectType", "inputs"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.write" },
+      effects: ["Create:CrmObject"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "objectType" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.objects.batchUpdate",
+      resource_type: "hubspot:object",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["crm.objects.contacts.write"],
+      capability: "hubspot.crm.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          inputs: {
+            type: "array",
+            minItems: 1,
+            items: {
+              type: "object",
+              properties: { id: { type: "string" }, properties: { type: "object" } },
+              required: ["id", "properties"],
+              additionalProperties: false
+            }
+          }
+        },
+        required: ["objectType", "inputs"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.write" },
+      effects: ["Update:CrmObject"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "objectType" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.schemas.get",
+      resource_type: "hubspot:schema",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.schemas.custom.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {},
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmSchema"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "objectType", required: false }
+      },
+      version: "1.0.0"
+    },
+    // ─── HubSpot Properties ───
+    {
+      action: "hubspot.crm.properties.list",
+      resource_type: "hubspot:property",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.schemas.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          archived: { type: "boolean" }
+        },
+        required: ["objectType"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmProperty"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "objectType" } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.properties.get",
+      resource_type: "hubspot:property",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.schemas.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          propertyName: { type: "string", description: "Internal property name" }
+        },
+        required: ["objectType", "propertyName"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmProperty"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "objectType" } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.properties.create",
+      resource_type: "hubspot:property",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["crm.schemas.contacts.write"],
+      capability: "hubspot.crm.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          name: { type: "string" },
+          label: { type: "string" },
+          type: { type: "string" },
+          fieldType: { type: "string" },
+          groupName: { type: "string" },
+          description: { type: "string" },
+          options: { type: "array" }
+        },
+        required: ["objectType", "name", "label", "type", "fieldType", "groupName"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.write" },
+      effects: ["Create:CrmProperty"],
+      risk: "high",
+      target_bindings: { resource_id: { source: "param", param: "objectType" } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.properties.update",
+      resource_type: "hubspot:property",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["crm.schemas.contacts.write"],
+      capability: "hubspot.crm.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          propertyName: { type: "string" },
+          label: { type: "string" },
+          type: { type: "string" },
+          fieldType: { type: "string" },
+          groupName: { type: "string" },
+          description: { type: "string" },
+          options: { type: "array" }
+        },
+        required: ["objectType", "propertyName"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.write" },
+      effects: ["Update:CrmProperty"],
+      risk: "high",
+      target_bindings: { resource_id: { source: "param", param: "objectType" } },
+      version: "1.0.0"
+    },
+    // ─── HubSpot Associations (v4) ───
+    {
+      action: "hubspot.crm.associations.list",
+      resource_type: "hubspot:association",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.objects.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string" },
+          objectId: { type: "string" },
+          toObjectType: { type: "string" },
+          after: { type: "string" },
+          limit: { type: "integer", minimum: 1, maximum: 100 }
+        },
+        required: ["objectType", "objectId", "toObjectType"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmAssociation"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "objectType" } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.associations.getDefinitions",
+      resource_type: "hubspot:association",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.objects.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          fromObjectType: { type: "string" },
+          toObjectType: { type: "string" }
+        },
+        required: ["fromObjectType", "toObjectType"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmAssociation"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "fromObjectType" } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.associations.batchCreate",
+      resource_type: "hubspot:association",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["crm.objects.contacts.write"],
+      capability: "hubspot.crm.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          fromObjectType: { type: "string" },
+          toObjectType: { type: "string" },
+          inputs: { type: "array", minItems: 1 }
+        },
+        required: ["fromObjectType", "toObjectType", "inputs"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.write" },
+      effects: ["Create:CrmAssociation"],
+      risk: "high",
+      target_bindings: { resource_id: { source: "param", param: "fromObjectType" } },
+      version: "1.0.0"
+    },
+    // ─── HubSpot Engagements (legacy v1: NOTE / TASK) ───
+    {
+      action: "hubspot.crm.engagements.get",
+      resource_type: "hubspot:engagement",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.objects.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: { engagementId: { type: "string" } },
+        required: ["engagementId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmEngagement"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "engagementId" } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.engagements.create",
+      resource_type: "hubspot:engagement",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["crm.objects.contacts.write"],
+      capability: "hubspot.crm.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          type: { type: "string", enum: ["NOTE", "TASK"] },
+          ownerId: { type: "number" },
+          timestamp: { type: "number" },
+          associations: { type: "object" },
+          metadata: { type: "object" }
+        },
+        required: ["type", "ownerId", "metadata"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.write" },
+      effects: ["Create:CrmEngagement"],
+      risk: "high",
+      // Bind to the engagement type (NOTE/TASK) as the container that exists at
+      // call time, consistent with other create actions (see CREATE-binding note above).
+      target_bindings: { resource_id: { source: "param", param: "type" } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.engagements.update",
+      resource_type: "hubspot:engagement",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["crm.objects.contacts.write"],
+      capability: "hubspot.crm.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          engagementId: { type: "string" },
+          ownerId: { type: "number" },
+          timestamp: { type: "number" },
+          associations: { type: "object" },
+          metadata: { type: "object" }
+        },
+        required: ["engagementId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.write" },
+      effects: ["Update:CrmEngagement"],
+      risk: "high",
+      target_bindings: { resource_id: { source: "param", param: "engagementId" } },
+      version: "1.0.0"
+    },
+    // ─── HubSpot Workflows (automation v4 flows, read-only) ───
+    {
+      action: "hubspot.automation.workflows.list",
+      resource_type: "hubspot:workflow",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["automation"],
+      capability: "hubspot.automation.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          after: { type: "string" },
+          limit: { type: "integer", minimum: 1, maximum: 100 }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:Workflow"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "flowId", required: false } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.automation.workflows.get",
+      resource_type: "hubspot:workflow",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["automation"],
+      capability: "hubspot.automation.read",
+      input_schema: {
+        type: "object",
+        properties: { flowId: { type: "string" } },
+        required: ["flowId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:Workflow"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "flowId" } },
+      version: "1.0.0"
+    },
+    // ─── HubSpot Account / utility ───
+    {
+      action: "hubspot.account.userDetails.get",
+      resource_type: "hubspot:account",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["oauth"],
+      capability: "hubspot.account.read",
+      input_schema: {
+        type: "object",
+        properties: {},
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:Account"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "hubId", required: false } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.account.link.get",
+      resource_type: "hubspot:account",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      // Pure URL builder; nominal base scope (always granted) keeps it
+      // grantable and satisfies the registry's minItems:1 contract.
+      required_scopes: ["oauth"],
+      capability: "hubspot.account.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          portalId: { type: "string" },
+          uiDomain: { type: "string" },
+          pageRequests: { type: "array", minItems: 1 }
+        },
+        required: ["portalId", "uiDomain", "pageRequests"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:Account"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "portalId" } },
+      version: "1.0.0"
+    },
+    // ─── Agent Inbox Actions (internal) ───
+    // Inbox actions back the Agent Inbox MCP tools (task delegation between
+    // agents/people). They are internal (no external OAuth provider), so they
+    // carry a single nominal base scope `inbox` to satisfy the registry
+    // meta-schema's `minItems: 1` (same pattern as hubspot.account.link.get).
+    {
+      action: "inbox.send",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          to: { type: "string", minLength: 1, description: "Recipient (user id / handle) the task request is sent to" },
+          taskType: { type: "string", minLength: 1, description: "Type of task being requested" },
+          payload: { type: "object", description: "Task-specific payload data" },
+          message: { type: "string", description: "Optional human-readable message" }
+        },
+        required: ["to", "taskType", "payload"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Create:InboxItem"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "to" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.respond",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          id: { type: "string", minLength: 1, description: "Inbox item id being responded to" },
+          action: { type: "string", enum: ["accept", "decline", "counter"], description: "Response action" },
+          data: { type: "object", description: "Optional response data (e.g. counter-proposal)" }
+        },
+        required: ["id", "action"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Update:InboxItem"],
+      // high (not medium): an agent-mediated response (MCP invoke) must always
+      // go through human approval — the Phase 1 "always confirm" guarantee made
+      // enforceable. target_bindings below binds the concrete inbox item id so
+      // the high-risk approval has a specific resource constraint (the public
+      // /scheduling/:token link flow does NOT go through this gate — it calls
+      // InboxService.respond directly, system-key-signed).
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "id" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.check",
+      resource_type: "inbox:item",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["inbox"],
+      capability: "inbox.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          types: { type: "array", items: { type: "string" }, description: "Filter by task types" },
+          status: { type: "string", description: "Filter by item status" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.read" },
+      effects: ["Read:InboxItem"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "id", required: false }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.checkByToken",
+      resource_type: "inbox:item",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["inbox"],
+      capability: "inbox.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          token: { type: "string", minLength: 1, description: "Opaque access token for a single inbox item" }
+        },
+        required: ["token"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.read" },
+      effects: ["Read:InboxItem"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "token" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.complete",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          id: { type: "string", minLength: 1, description: "Inbox item id being completed" },
+          result: { type: "object", description: "Result payload for the completed task" }
+        },
+        required: ["id", "result"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Update:InboxItem"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "id" }
+      },
+      version: "1.0.0"
+    },
+    // ─── Scheduling Actions (internal) ───
+    // scheduling.request is a meeting-time negotiation façade over inbox.send.
+    // Candidate slots are computed LLM-side from the user calendar; the server
+    // only validates them. Like the inbox actions it is internal (no external
+    // OAuth provider), so it carries the single nominal base scope `inbox`.
+    // Spec: docs/specs/2026-06-10-inbox-intent-routing-design.md §2.1
+    {
+      action: "scheduling.request",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          to: { type: "string", minLength: 1, description: "Counterpart (user id / email) to negotiate a meeting time with" },
+          topic: { type: "string", minLength: 1, description: "Meeting topic shown to the counterpart" },
+          durationMinutes: { type: "integer", minimum: 5, maximum: 480, description: "Meeting length in minutes" },
+          candidates: {
+            type: "array",
+            minItems: 1,
+            maxItems: 10,
+            description: "Candidate slots computed by the agent from the user calendar (LLM-side computation; the server only validates)",
+            items: {
+              type: "object",
+              properties: {
+                start: { type: "string", description: "ISO 8601 start" },
+                end: { type: "string", description: "ISO 8601 end" }
+              },
+              required: ["start", "end"],
+              additionalProperties: false
+            }
+          },
+          message: { type: "string", description: "Optional human-readable message" }
+        },
+        required: ["to", "topic", "durationMinutes", "candidates"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Create:InboxItem"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "to" }
+      },
+      version: "1.0.0"
     }
   ],
   capabilities: [
@@ -5732,10 +6452,140 @@ var ACTION_REGISTRY = {
       description: "Create, update, delete Jira issues, and manage issue links",
       includes: ["jira.issue.create", "jira.issue.update", "jira.issue.delete", "jira.comment.create", "jira.issue.transition", "jira.issuelink.create", "jira.issuelink.delete"],
       version: "1.0.0"
+    },
+    {
+      capability: "inbox.write",
+      description: "Send and respond to agent inbox tasks",
+      includes: ["inbox.send", "inbox.respond", "inbox.complete", "scheduling.request"],
+      version: "1.0.0"
+    },
+    {
+      capability: "inbox.read",
+      description: "Read agent inbox tasks",
+      includes: ["inbox.check", "inbox.checkByToken"],
+      version: "1.0.0"
     }
   ]
 };
 
+// src/registry/action-input-validator.ts
+var SCHEMA_INDEX = (() => {
+  const map = /* @__PURE__ */ new Map();
+  for (const a of ACTION_REGISTRY.actions) {
+    if (a && typeof a.action === "string" && a.input_schema) {
+      map.set(a.action, a.input_schema);
+    }
+  }
+  return map;
+})();
+function describeExpectedShape(schema) {
+  const props = schema.properties ?? {};
+  const required = Array.isArray(schema.required) ? schema.required : [];
+  const requiredSet = new Set(required);
+  const parts = [];
+  const orderedKeys = [
+    ...required.filter((k) => k in props),
+    ...Object.keys(props).filter((k) => !requiredSet.has(k))
+  ];
+  for (const key of orderedKeys) {
+    const prop = props[key] || {};
+    const optionalMark = requiredSet.has(key) ? "" : "?";
+    const enumVals = Array.isArray(prop.enum) ? prop.enum : void 0;
+    if (enumVals && enumVals.length > 0) {
+      const rendered = enumVals.map((v) => typeof v === "string" ? `'${v}'` : String(v)).join(" | ");
+      parts.push(`${key}${optionalMark}: ${rendered}`);
+    } else {
+      parts.push(`${key}${optionalMark}`);
+    }
+  }
+  return `{ ${parts.join(", ")} }`;
+}
+function matchesType(value, type) {
+  if (!type) return true;
+  switch (type) {
+    case "string":
+      return typeof value === "string";
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+    case "number":
+      return typeof value === "number";
+    case "boolean":
+      return typeof value === "boolean";
+    case "array":
+      return Array.isArray(value);
+    case "object":
+      return typeof value === "object" && value !== null && !Array.isArray(value);
+    default:
+      return true;
+  }
+}
+function validateActionInput(action, params) {
+  const schema = SCHEMA_INDEX.get(action);
+  if (!schema) {
+    return { valid: true };
+  }
+  const props = schema.properties ?? {};
+  const required = Array.isArray(schema.required) ? schema.required : [];
+  const additionalProps = schema.additionalProperties;
+  const safeParams = params && typeof params === "object" && !Array.isArray(params) ? params : {};
+  const missing = [];
+  const unknown = [];
+  const enumErrors = [];
+  const typeErrors = [];
+  for (const key of required) {
+    if (!(key in safeParams) || safeParams[key] === void 0 || safeParams[key] === null) {
+      missing.push(key);
+    }
+  }
+  if (additionalProps === false) {
+    for (const key of Object.keys(safeParams)) {
+      if (!(key in props)) {
+        unknown.push(key);
+      }
+    }
+  }
+  for (const key of Object.keys(props)) {
+    if (!(key in safeParams)) continue;
+    const value = safeParams[key];
+    if (value === void 0 || value === null) continue;
+    const prop = props[key] || {};
+    const enumVals = Array.isArray(prop.enum) ? prop.enum : void 0;
+    if (enumVals && enumVals.length > 0) {
+      if (!enumVals.includes(value)) {
+        enumErrors.push(key);
+        continue;
+      }
+    }
+    if (!matchesType(value, prop.type)) {
+      typeErrors.push(key);
+    }
+  }
+  if (missing.length === 0 && unknown.length === 0 && enumErrors.length === 0 && typeErrors.length === 0) {
+    return { valid: true };
+  }
+  const segments = [];
+  if (missing.length > 0) {
+    segments.push(`missing required parameter(s) [${missing.join(", ")}]`);
+  }
+  if (unknown.length > 0) {
+    segments.push(`unknown parameter(s) [${unknown.join(", ")}]`);
+  }
+  if (enumErrors.length > 0) {
+    const details = enumErrors.map((key) => {
+      const enumVals = props[key]?.enum || [];
+      const rendered = enumVals.map((v) => typeof v === "string" ? `'${v}'` : String(v)).join(" | ");
+      return `${key} (allowed: ${rendered})`;
+    }).join(", ");
+    segments.push(`invalid value for enum parameter(s) [${details}]`);
+  }
+  if (typeErrors.length > 0) {
+    const details = typeErrors.map((key) => `${key} (expected ${props[key]?.type})`).join(", ");
+    segments.push(`wrong type for parameter(s) [${details}]`);
+  }
+  const message = `${action}: ${segments.join("; ")}. Expected shape: ${describeExpectedShape(schema)}`;
+  return { valid: false, errors: [message] };
+}
+
 // src/registry/resource-types.ts
 var RESOURCE_TYPES = {
   // Slack
@@ -5757,6 +6607,14 @@ var RESOURCE_TYPES = {
   JIRA_BOARD: "jira:board",
   JIRA_ISSUE: "jira:issue",
   JIRA_SPRINT: "jira:sprint",
+  // HubSpot
+  HUBSPOT_OBJECT: "hubspot:object",
+  HUBSPOT_PROPERTY: "hubspot:property",
+  HUBSPOT_SCHEMA: "hubspot:schema",
+  HUBSPOT_ASSOCIATION: "hubspot:association",
+  HUBSPOT_ENGAGEMENT: "hubspot:engagement",
+  HUBSPOT_WORKFLOW: "hubspot:workflow",
+  HUBSPOT_ACCOUNT: "hubspot:account",
   // OS (local)
   OS_SECRET: "os:secret",
   OS_PROCESS: "os:process",
@@ -5783,6 +6641,13 @@ var LEGACY_RESOURCE_TYPE_MAP = {
   "jira:board": RESOURCE_TYPES.JIRA_BOARD,
   "jira:issue": RESOURCE_TYPES.JIRA_ISSUE,
   "jira:sprint": RESOURCE_TYPES.JIRA_SPRINT,
+  "hubspot:object": RESOURCE_TYPES.HUBSPOT_OBJECT,
+  "hubspot:property": RESOURCE_TYPES.HUBSPOT_PROPERTY,
+  "hubspot:schema": RESOURCE_TYPES.HUBSPOT_SCHEMA,
+  "hubspot:association": RESOURCE_TYPES.HUBSPOT_ASSOCIATION,
+  "hubspot:engagement": RESOURCE_TYPES.HUBSPOT_ENGAGEMENT,
+  "hubspot:workflow": RESOURCE_TYPES.HUBSPOT_WORKFLOW,
+  "hubspot:account": RESOURCE_TYPES.HUBSPOT_ACCOUNT,
   "os:secret": RESOURCE_TYPES.OS_SECRET,
   "os:process": RESOURCE_TYPES.OS_PROCESS,
   // Legacy formats with old provider prefixes
@@ -6133,6 +6998,56 @@ var ACTION_DISPLAY_CONFIGS = {
     displayFields: [
       { key: "linkId", label: "Link" }
     ]
+  },
+  // ─── Agent Inbox ───
+  "inbox.send": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.to) parts.push(`To: ${p.to}`);
+      if (p.taskType) parts.push(`Task: ${p.taskType}`);
+      return parts.join(", ");
+    },
+    displayFields: [
+      { key: "to", label: "To" },
+      { key: "taskType", label: "Task" },
+      { key: "message", label: "Message" }
+    ]
+  },
+  "inbox.respond": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.action) parts.push(String(p.action));
+      if (p.id) parts.push(`#${p.id}`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "id", label: "Item" },
+      { key: "action", label: "Action" }
+    ]
+  },
+  "inbox.check": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.status) parts.push(`Status: ${p.status}`);
+      if (Array.isArray(p.types) && p.types.length > 0) parts.push(`Types: ${p.types.join(", ")}`);
+      return parts.join(", ");
+    },
+    displayFields: [
+      { key: "status", label: "Status" },
+      { key: "types", label: "Types" }
+    ]
+  },
+  "inbox.checkByToken": {
+    summaryTemplate: (p) => p.token ? `Token: ${p.token}` : "",
+    displayFields: [
+      { key: "token", label: "Token" }
+    ]
+  },
+  "inbox.complete": {
+    summaryTemplate: (p) => p.id ? `Complete #${p.id}` : "",
+    displayFields: [
+      { key: "id", label: "Item" }
+    ]
   }
 };
 function truncate(text, maxLength) {
@@ -6836,6 +7751,7 @@ var version = "0.0.1";
   sha256Hex,
   signJWT,
   signRequest,
+  validateActionInput,
   validateRegistryObject,
   vcStatusToCredentialStatus,
   verifyJWT,