@vess-id/ai-identity 0.14.0 → 0.15.1

package/dist/index.js

@@ -164,6 +164,7 @@ __export(index_exports, {
   sha256Hex: () => sha256Hex,
   signJWT: () => signJWT,
   signRequest: () => signRequest,
+  validateActionInput: () => validateActionInput,
   validateRegistryObject: () => validateRegistryObject,
   vcStatusToCredentialStatus: () => vcStatusToCredentialStatus,
   verifyJWT: () => verifyJWT,
@@ -2926,6 +2927,13 @@ var GrantResourceType = /* @__PURE__ */ ((GrantResourceType2) => {
   GrantResourceType2["JIRA_PROJECT"] = "jira:project";
   GrantResourceType2["JIRA_BOARD"] = "jira:board";
   GrantResourceType2["JIRA_ISSUE"] = "jira:issue";
+  GrantResourceType2["HUBSPOT_OBJECT"] = "hubspot:object";
+  GrantResourceType2["HUBSPOT_PROPERTY"] = "hubspot:property";
+  GrantResourceType2["HUBSPOT_SCHEMA"] = "hubspot:schema";
+  GrantResourceType2["HUBSPOT_ASSOCIATION"] = "hubspot:association";
+  GrantResourceType2["HUBSPOT_ENGAGEMENT"] = "hubspot:engagement";
+  GrantResourceType2["HUBSPOT_WORKFLOW"] = "hubspot:workflow";
+  GrantResourceType2["HUBSPOT_ACCOUNT"] = "hubspot:account";
   GrantResourceType2["OS_SECRET"] = "os:secret";
   GrantResourceType2["ANY"] = "*";
   return GrantResourceType2;
@@ -4259,6 +4267,7 @@ var CANONICAL_PROVIDERS = [
   "gmail",
   "calendar",
   "jira",
+  "hubspot",
   "os"
 ];
 var PROVIDER_ALIASES = {};
@@ -4502,6 +4511,15 @@ var DummyVpVerifier = class {
 var ACTION_REGISTRY = {
   registry_version: "2025-09-28",
   actions: [
+    // ─── Resource binding principle (high-risk CREATE actions) ───
+    // A high-risk CREATE action's target_bindings.resource_id MUST bind to the
+    // container/parent that already exists at approval + invoke time — never to
+    // the not-yet-created resource's id (which does not exist until after the
+    // call and is absent from input_schema). Cedar must resolve the resource at
+    // evaluation time, and the server enforces a specific non-wildcard target,
+    // so an unresolvable binding makes the action impossible to approve.
+    // Examples: slack.message.post → channel, jira.issue.create → projectKey,
+    // hubspot objects.batchCreate → objectType, engagements.create → type.
     // ─── Slack Actions ───
     {
       action: "slack.message.post",
@@ -4701,15 +4719,21 @@ var ACTION_REGISTRY = {
       required_relations: ["editor", "act_as"],
       required_scopes: ["repo", "write:issues"],
       capability: "github.issues.triage",
+      // Schema mirrors the server contract (GitHubConnectorAdapter
+      // getSupportedActions inputSchema — packages/api/src/tool/adapters/
+      // github.adapter.ts): owner/repo are required params.
       input_schema: {
         type: "object",
         properties: {
+          owner: { type: "string", minLength: 1, description: "Repository owner (username or organization)" },
+          repo: { type: "string", minLength: 1, description: "Repository name" },
           title: { type: "string", minLength: 1 },
           body: { type: "string" },
           labels: { type: "array", items: { type: "string" } },
-          assignees: { type: "array", items: { type: "string" } }
+          assignees: { type: "array", items: { type: "string" } },
+          milestone: { type: "integer", minimum: 1, description: "Milestone number to associate with the issue" }
         },
-        required: ["title"],
+        required: ["owner", "repo", "title"],
         additionalProperties: false
       },
       constraints: { rate_bucket: "github.write" },
@@ -4726,9 +4750,13 @@ var ACTION_REGISTRY = {
       required_relations: ["viewer", "editor", "admin", "owner"],
       required_scopes: ["repo", "read:issues"],
       capability: "github.read.basic",
+      // Schema mirrors the server contract (GitHubConnectorAdapter):
+      // owner/repo are required params.
       input_schema: {
         type: "object",
         properties: {
+          owner: { type: "string", minLength: 1, description: "Repository owner (username or organization)" },
+          repo: { type: "string", minLength: 1, description: "Repository name" },
           state: { type: "string", enum: ["open", "closed", "all"] },
           labels: { type: "string" },
           sort: { type: "string", enum: ["created", "updated", "comments"] },
@@ -4736,6 +4764,7 @@ var ACTION_REGISTRY = {
           per_page: { type: "integer", minimum: 1, maximum: 100 },
           page: { type: "integer", minimum: 1 }
         },
+        required: ["owner", "repo"],
         additionalProperties: false
       },
       constraints: { rate_bucket: "github.read" },
@@ -4752,12 +4781,17 @@ var ACTION_REGISTRY = {
       required_relations: ["viewer", "editor", "admin", "owner"],
       required_scopes: ["repo", "read:issues"],
       capability: "github.read.basic",
+      // Schema mirrors the server contract (GitHubConnectorAdapter):
+      // owner/repo required, camelCase issueNumber (the adapter reads
+      // params.issueNumber — snake_case issue_number was a drift).
       input_schema: {
         type: "object",
         properties: {
-          issue_number: { type: "integer", minimum: 1 }
+          owner: { type: "string", minLength: 1, description: "Repository owner (username or organization)" },
+          repo: { type: "string", minLength: 1, description: "Repository name" },
+          issueNumber: { type: "integer", minimum: 1, description: "Issue number" }
         },
-        required: ["issue_number"],
+        required: ["owner", "repo", "issueNumber"],
         additionalProperties: false
       },
       constraints: { rate_bucket: "github.read" },
@@ -4774,17 +4808,22 @@ var ACTION_REGISTRY = {
       required_relations: ["editor", "act_as"],
       required_scopes: ["repo", "write:issues"],
       capability: "github.issues.triage",
+      // Schema mirrors the server contract (GitHubConnectorAdapter):
+      // owner/repo required, camelCase issueNumber (the adapter reads
+      // params.issueNumber — snake_case issue_number was a drift).
       input_schema: {
         type: "object",
         properties: {
-          issue_number: { type: "integer", minimum: 1 },
+          owner: { type: "string", minLength: 1, description: "Repository owner (username or organization)" },
+          repo: { type: "string", minLength: 1, description: "Repository name" },
+          issueNumber: { type: "integer", minimum: 1, description: "Issue number to update" },
           title: { type: "string" },
           body: { type: "string" },
           state: { type: "string", enum: ["open", "closed"] },
           labels: { type: "array", items: { type: "string" } },
           assignees: { type: "array", items: { type: "string" } }
         },
-        required: ["issue_number"],
+        required: ["owner", "repo", "issueNumber"],
         additionalProperties: false
       },
       constraints: { rate_bucket: "github.write" },
@@ -5076,7 +5115,9 @@ var ACTION_REGISTRY = {
             }
           },
           attendees: { type: "array", description: "List of attendee objects with email field", items: { type: "object", properties: { email: { type: "string" } } } },
-          location: { type: "string", description: "Event location" }
+          location: { type: "string", description: "Event location" },
+          addMeet: { type: "boolean", description: "Opt-in: attach a Google Meet link (default: false)" },
+          meetRequestId: { type: "string", description: "Stable idempotency key for the Meet request (used only when addMeet is true)" }
         },
         required: ["summary", "start", "end"],
         additionalProperties: false
@@ -5124,7 +5165,9 @@ var ACTION_REGISTRY = {
             }
           },
           attendees: { type: "array", description: "List of attendee objects with email field", items: { type: "object", properties: { email: { type: "string" } } } },
-          location: { type: "string", description: "Event location" }
+          location: { type: "string", description: "Event location" },
+          addMeet: { type: "boolean", description: "Opt-in: attach a Google Meet link (default: false)" },
+          meetRequestId: { type: "string", description: "Stable idempotency key for the Meet request (used only when addMeet is true)" }
         },
         required: ["eventId"],
         additionalProperties: false
@@ -5332,7 +5375,13 @@ var ACTION_REGISTRY = {
         properties: {
           projectKey: { type: "string", minLength: 1 },
           summary: { type: "string", minLength: 1 },
-          description: { type: "string" },
+          description: {
+            oneOf: [
+              { type: "string", description: "Plain text description." },
+              { type: "object", description: 'ADF document object for rich formatting: {type:"doc", version:1, content:[...]}.' }
+            ],
+            description: 'Issue description. Pass a plain string, OR an ADF document object ({type:"doc",version:1,content:[...]}) for rich formatting (headings, lists, code, links).'
+          },
           issueTypeName: { type: "string", minLength: 1, description: "Issue type name (default: Task)" },
           priority: { type: "string" },
           assigneeAccountId: { type: "string" },
@@ -5360,7 +5409,13 @@ var ACTION_REGISTRY = {
         properties: {
           issueIdOrKey: { type: "string", minLength: 1 },
           summary: { type: "string" },
-          description: { type: "string" },
+          description: {
+            oneOf: [
+              { type: "string", description: "Plain text description." },
+              { type: "object", description: 'ADF document object for rich formatting: {type:"doc", version:1, content:[...]}.' }
+            ],
+            description: 'Issue description. Pass a plain string, OR an ADF document object ({type:"doc",version:1,content:[...]}) for rich formatting (headings, lists, code, links).'
+          },
           priority: { type: "string" },
           assigneeAccountId: { type: "string" },
           labels: { type: "array", items: { type: "string" } }
@@ -5408,7 +5463,13 @@ var ACTION_REGISTRY = {
         type: "object",
         properties: {
           issueIdOrKey: { type: "string", minLength: 1 },
-          body: { type: "string", minLength: 1 }
+          body: {
+            oneOf: [
+              { type: "string", minLength: 1, description: "Plain text comment body." },
+              { type: "object", description: 'ADF document object for rich formatting: {type:"doc", version:1, content:[...]}.' }
+            ],
+            description: 'Comment body. Pass a plain string, OR an ADF document object ({type:"doc",version:1,content:[...]}) for rich formatting (headings, lists, code, links).'
+          }
         },
         required: ["issueIdOrKey", "body"],
         additionalProperties: false
@@ -5422,6 +5483,34 @@ var ACTION_REGISTRY = {
       },
       version: "1.0.0"
     },
+    {
+      // AIDENTITY-66: delete a comment from a Jira issue. high-risk destructive
+      // write — mirrors jira.issue.delete (admin/owner/act_as) but resource_type
+      // は jira.comment.create と同じ jira:project (issue から project を derive)。
+      action: "jira.comment.delete",
+      resource_type: "jira:project",
+      required_relations: ["admin", "owner", "act_as"],
+      required_scopes: ["write:jira-work"],
+      capability: "jira.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueIdOrKey: { type: "string", minLength: 1 },
+          commentId: { type: "string", minLength: 1, description: "Comment id (from jira.comment.read)" }
+        },
+        required: ["issueIdOrKey", "commentId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "jira.write" },
+      effects: ["Delete:Comment"],
+      // high: deleting a comment is irreversible and visible to all project members,
+      // consistent with jira.issue.delete / jira.comment.create.
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueIdOrKey", fallback_param: "issueKey", derive: "project_key" }
+      },
+      version: "1.0.0"
+    },
     {
       action: "jira.comment.read",
       resource_type: "jira:project",
@@ -5587,6 +5676,42 @@ var ACTION_REGISTRY = {
       },
       version: "1.0.0"
     },
+    {
+      // AIDENTITY-83: email / displayName から accountId を解決する read action。
+      // query は resource id ではなく検索語なので target_bindings は付けず
+      // (jira.project.read 等の unscoped read と同様)、type-only match で評価する。
+      action: "jira.user.search",
+      resource_type: "jira:user",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read:jira-user"],
+      capability: "jira.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          query: {
+            type: "string",
+            minLength: 1,
+            description: "Matched against displayName and emailAddress (prefix match). Pass an email address to resolve its accountId."
+          },
+          maxResults: {
+            type: "integer",
+            minimum: 1,
+            maximum: 50,
+            description: "Max users to return (default 10)"
+          }
+        },
+        required: ["query"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "jira.read" },
+      effects: ["Read:User"],
+      risk: "low",
+      // query は resource id ではないので unscoped。required: false で type-only match。
+      target_bindings: {
+        resource_id: { source: "param", param: "query", required: false }
+      },
+      version: "1.0.0"
+    },
     // ─── OS Actions (Local) ───
     {
       action: "os.secret.read",
@@ -5664,6 +5789,665 @@ var ACTION_REGISTRY = {
         resource_id: { source: "param", param: "command" }
       },
       version: "1.0.0"
+    },
+    // ─── HubSpot CRM Objects (objectType 汎用) ───
+    // 公式 MCP (@hubspot/mcp-server) のツール集合を写像。object 系は objectType
+    // パラメータ化された汎用エンドポイント。scope は objectType ごとに HubSpot 側で
+    // 実行時強制されるため、required_scopes には代表 scope を宣言する (実際の許可範囲は
+    // DEFAULT_SCOPES の固定 union)。
+    {
+      action: "hubspot.crm.objects.list",
+      resource_type: "hubspot:object",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.objects.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type (e.g. contacts, companies, deals) or custom object type ID" },
+          limit: { type: "integer", minimum: 1, maximum: 100 },
+          after: { type: "string" },
+          properties: { type: "array", items: { type: "string" } },
+          archived: { type: "boolean" }
+        },
+        required: ["objectType"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmObject"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "objectType" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.objects.search",
+      resource_type: "hubspot:object",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.objects.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          query: { type: "string", maxLength: 3e3 },
+          filterGroups: { type: "array" },
+          properties: { type: "array", items: { type: "string" } },
+          sorts: { type: "array", items: { type: "string" } },
+          limit: { type: "integer", minimum: 1, maximum: 100 },
+          after: { type: "string" }
+        },
+        required: ["objectType"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmObject"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "objectType" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.objects.batchRead",
+      resource_type: "hubspot:object",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.objects.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          inputs: {
+            type: "array",
+            minItems: 1,
+            items: { type: "object", properties: { id: { type: "string" } }, required: ["id"], additionalProperties: false }
+          },
+          properties: { type: "array", items: { type: "string" } },
+          idProperty: { type: "string" }
+        },
+        required: ["objectType", "inputs"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmObject"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "objectType" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.objects.batchCreate",
+      resource_type: "hubspot:object",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["crm.objects.contacts.write"],
+      capability: "hubspot.crm.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          inputs: {
+            type: "array",
+            minItems: 1,
+            items: {
+              type: "object",
+              properties: { properties: { type: "object" }, associations: { type: "array" } },
+              required: ["properties"],
+              additionalProperties: false
+            }
+          }
+        },
+        required: ["objectType", "inputs"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.write" },
+      effects: ["Create:CrmObject"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "objectType" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.objects.batchUpdate",
+      resource_type: "hubspot:object",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["crm.objects.contacts.write"],
+      capability: "hubspot.crm.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          inputs: {
+            type: "array",
+            minItems: 1,
+            items: {
+              type: "object",
+              properties: { id: { type: "string" }, properties: { type: "object" } },
+              required: ["id", "properties"],
+              additionalProperties: false
+            }
+          }
+        },
+        required: ["objectType", "inputs"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.write" },
+      effects: ["Update:CrmObject"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "objectType" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.schemas.get",
+      resource_type: "hubspot:schema",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.schemas.custom.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {},
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmSchema"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "objectType", required: false }
+      },
+      version: "1.0.0"
+    },
+    // ─── HubSpot Properties ───
+    {
+      action: "hubspot.crm.properties.list",
+      resource_type: "hubspot:property",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.schemas.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          archived: { type: "boolean" }
+        },
+        required: ["objectType"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmProperty"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "objectType" } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.properties.get",
+      resource_type: "hubspot:property",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.schemas.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          propertyName: { type: "string", description: "Internal property name" }
+        },
+        required: ["objectType", "propertyName"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmProperty"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "objectType" } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.properties.create",
+      resource_type: "hubspot:property",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["crm.schemas.contacts.write"],
+      capability: "hubspot.crm.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          name: { type: "string" },
+          label: { type: "string" },
+          type: { type: "string" },
+          fieldType: { type: "string" },
+          groupName: { type: "string" },
+          description: { type: "string" },
+          options: { type: "array" }
+        },
+        required: ["objectType", "name", "label", "type", "fieldType", "groupName"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.write" },
+      effects: ["Create:CrmProperty"],
+      risk: "high",
+      target_bindings: { resource_id: { source: "param", param: "objectType" } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.properties.update",
+      resource_type: "hubspot:property",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["crm.schemas.contacts.write"],
+      capability: "hubspot.crm.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string", description: "CRM object type or custom object type ID" },
+          propertyName: { type: "string" },
+          label: { type: "string" },
+          type: { type: "string" },
+          fieldType: { type: "string" },
+          groupName: { type: "string" },
+          description: { type: "string" },
+          options: { type: "array" }
+        },
+        required: ["objectType", "propertyName"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.write" },
+      effects: ["Update:CrmProperty"],
+      risk: "high",
+      target_bindings: { resource_id: { source: "param", param: "objectType" } },
+      version: "1.0.0"
+    },
+    // ─── HubSpot Associations (v4) ───
+    {
+      action: "hubspot.crm.associations.list",
+      resource_type: "hubspot:association",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.objects.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          objectType: { type: "string" },
+          objectId: { type: "string" },
+          toObjectType: { type: "string" },
+          after: { type: "string" },
+          limit: { type: "integer", minimum: 1, maximum: 100 }
+        },
+        required: ["objectType", "objectId", "toObjectType"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmAssociation"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "objectType" } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.associations.getDefinitions",
+      resource_type: "hubspot:association",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.objects.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          fromObjectType: { type: "string" },
+          toObjectType: { type: "string" }
+        },
+        required: ["fromObjectType", "toObjectType"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmAssociation"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "fromObjectType" } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.associations.batchCreate",
+      resource_type: "hubspot:association",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["crm.objects.contacts.write"],
+      capability: "hubspot.crm.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          fromObjectType: { type: "string" },
+          toObjectType: { type: "string" },
+          inputs: { type: "array", minItems: 1 }
+        },
+        required: ["fromObjectType", "toObjectType", "inputs"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.write" },
+      effects: ["Create:CrmAssociation"],
+      risk: "high",
+      target_bindings: { resource_id: { source: "param", param: "fromObjectType" } },
+      version: "1.0.0"
+    },
+    // ─── HubSpot Engagements (legacy v1: NOTE / TASK) ───
+    {
+      action: "hubspot.crm.engagements.get",
+      resource_type: "hubspot:engagement",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["crm.objects.contacts.read"],
+      capability: "hubspot.crm.read",
+      input_schema: {
+        type: "object",
+        properties: { engagementId: { type: "string" } },
+        required: ["engagementId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:CrmEngagement"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "engagementId" } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.engagements.create",
+      resource_type: "hubspot:engagement",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["crm.objects.contacts.write"],
+      capability: "hubspot.crm.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          type: { type: "string", enum: ["NOTE", "TASK"] },
+          ownerId: { type: "number" },
+          timestamp: { type: "number" },
+          associations: { type: "object" },
+          metadata: { type: "object" }
+        },
+        required: ["type", "ownerId", "metadata"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.write" },
+      effects: ["Create:CrmEngagement"],
+      risk: "high",
+      // Bind to the engagement type (NOTE/TASK) as the container that exists at
+      // call time, consistent with other create actions (see CREATE-binding note above).
+      target_bindings: { resource_id: { source: "param", param: "type" } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.crm.engagements.update",
+      resource_type: "hubspot:engagement",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["crm.objects.contacts.write"],
+      capability: "hubspot.crm.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          engagementId: { type: "string" },
+          ownerId: { type: "number" },
+          timestamp: { type: "number" },
+          associations: { type: "object" },
+          metadata: { type: "object" }
+        },
+        required: ["engagementId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.write" },
+      effects: ["Update:CrmEngagement"],
+      risk: "high",
+      target_bindings: { resource_id: { source: "param", param: "engagementId" } },
+      version: "1.0.0"
+    },
+    // ─── HubSpot Workflows (automation v4 flows, read-only) ───
+    {
+      action: "hubspot.automation.workflows.list",
+      resource_type: "hubspot:workflow",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["automation"],
+      capability: "hubspot.automation.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          after: { type: "string" },
+          limit: { type: "integer", minimum: 1, maximum: 100 }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:Workflow"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "flowId", required: false } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.automation.workflows.get",
+      resource_type: "hubspot:workflow",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["automation"],
+      capability: "hubspot.automation.read",
+      input_schema: {
+        type: "object",
+        properties: { flowId: { type: "string" } },
+        required: ["flowId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:Workflow"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "flowId" } },
+      version: "1.0.0"
+    },
+    // ─── HubSpot Account / utility ───
+    {
+      action: "hubspot.account.userDetails.get",
+      resource_type: "hubspot:account",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["oauth"],
+      capability: "hubspot.account.read",
+      input_schema: {
+        type: "object",
+        properties: {},
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:Account"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "hubId", required: false } },
+      version: "1.0.0"
+    },
+    {
+      action: "hubspot.account.link.get",
+      resource_type: "hubspot:account",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      // Pure URL builder; nominal base scope (always granted) keeps it
+      // grantable and satisfies the registry's minItems:1 contract.
+      required_scopes: ["oauth"],
+      capability: "hubspot.account.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          portalId: { type: "string" },
+          uiDomain: { type: "string" },
+          pageRequests: { type: "array", minItems: 1 }
+        },
+        required: ["portalId", "uiDomain", "pageRequests"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "hubspot.read" },
+      effects: ["Read:Account"],
+      risk: "low",
+      target_bindings: { resource_id: { source: "param", param: "portalId" } },
+      version: "1.0.0"
+    },
+    // ─── Agent Inbox Actions (internal) ───
+    // Inbox actions back the Agent Inbox MCP tools (task delegation between
+    // agents/people). They are internal (no external OAuth provider), so they
+    // carry a single nominal base scope `inbox` to satisfy the registry
+    // meta-schema's `minItems: 1` (same pattern as hubspot.account.link.get).
+    {
+      action: "inbox.send",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          to: { type: "string", minLength: 1, description: "Recipient (user id / handle) the task request is sent to" },
+          taskType: { type: "string", minLength: 1, description: "Type of task being requested" },
+          payload: { type: "object", description: "Task-specific payload data" },
+          message: { type: "string", description: "Optional human-readable message" }
+        },
+        required: ["to", "taskType", "payload"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Create:InboxItem"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "to" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.respond",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          id: { type: "string", minLength: 1, description: "Inbox item id being responded to" },
+          action: { type: "string", enum: ["accept", "decline", "counter"], description: "Response action" },
+          data: { type: "object", description: "Optional response data (e.g. counter-proposal)" }
+        },
+        required: ["id", "action"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Update:InboxItem"],
+      // high (not medium): an agent-mediated response (MCP invoke) must always
+      // go through human approval — the Phase 1 "always confirm" guarantee made
+      // enforceable. target_bindings below binds the concrete inbox item id so
+      // the high-risk approval has a specific resource constraint (the public
+      // /scheduling/:token link flow does NOT go through this gate — it calls
+      // InboxService.respond directly, system-key-signed).
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "id" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.check",
+      resource_type: "inbox:item",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["inbox"],
+      capability: "inbox.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          types: { type: "array", items: { type: "string" }, description: "Filter by task types" },
+          status: { type: "string", description: "Filter by item status" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.read" },
+      effects: ["Read:InboxItem"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "id", required: false }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.checkByToken",
+      resource_type: "inbox:item",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["inbox"],
+      capability: "inbox.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          token: { type: "string", minLength: 1, description: "Opaque access token for a single inbox item" }
+        },
+        required: ["token"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.read" },
+      effects: ["Read:InboxItem"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "token" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.complete",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          id: { type: "string", minLength: 1, description: "Inbox item id being completed" },
+          result: { type: "object", description: "Result payload for the completed task" }
+        },
+        required: ["id", "result"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Update:InboxItem"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "id" }
+      },
+      version: "1.0.0"
+    },
+    // ─── Scheduling Actions (internal) ───
+    // scheduling.request is a meeting-time negotiation façade over inbox.send.
+    // Candidate slots are computed LLM-side from the user calendar; the server
+    // only validates them. Like the inbox actions it is internal (no external
+    // OAuth provider), so it carries the single nominal base scope `inbox`.
+    // Spec: docs/specs/2026-06-10-inbox-intent-routing-design.md §2.1
+    {
+      action: "scheduling.request",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          to: { type: "string", minLength: 1, description: "Counterpart (user id / email) to negotiate a meeting time with" },
+          topic: { type: "string", minLength: 1, description: "Meeting topic shown to the counterpart" },
+          durationMinutes: { type: "integer", minimum: 5, maximum: 480, description: "Meeting length in minutes" },
+          candidates: {
+            type: "array",
+            minItems: 1,
+            maxItems: 10,
+            description: "Candidate slots computed by the agent from the user calendar (LLM-side computation; the server only validates)",
+            items: {
+              type: "object",
+              properties: {
+                start: { type: "string", description: "ISO 8601 start" },
+                end: { type: "string", description: "ISO 8601 end" }
+              },
+              required: ["start", "end"],
+              additionalProperties: false
+            }
+          },
+          message: { type: "string", description: "Optional human-readable message" }
+        },
+        required: ["to", "topic", "durationMinutes", "candidates"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Create:InboxItem"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "to" }
+      },
+      version: "1.0.0"
     }
   ],
   capabilities: [
@@ -5723,19 +6507,149 @@ var ACTION_REGISTRY = {
     },
     {
       capability: "jira.read.basic",
-      description: "Read Jira issues, projects, boards, sprints, and issue link types",
-      includes: ["jira.project.read", "jira.board.read", "jira.sprint.read", "jira.issue.list", "jira.issue.search", "jira.worklog.read", "jira.issue.read", "jira.batch.read", "jira.comment.read", "jira.transition.list", "jira.issuelinktype.list"],
+      description: "Read Jira issues, projects, boards, sprints, issue link types, and users",
+      includes: ["jira.project.read", "jira.board.read", "jira.sprint.read", "jira.issue.list", "jira.issue.search", "jira.worklog.read", "jira.issue.read", "jira.batch.read", "jira.comment.read", "jira.transition.list", "jira.issuelinktype.list", "jira.user.search"],
       version: "1.0.0"
     },
     {
       capability: "jira.write.basic",
-      description: "Create, update, delete Jira issues, and manage issue links",
-      includes: ["jira.issue.create", "jira.issue.update", "jira.issue.delete", "jira.comment.create", "jira.issue.transition", "jira.issuelink.create", "jira.issuelink.delete"],
+      description: "Create, update, delete Jira issues, manage issue links, and add/delete comments",
+      includes: ["jira.issue.create", "jira.issue.update", "jira.issue.delete", "jira.comment.create", "jira.comment.delete", "jira.issue.transition", "jira.issuelink.create", "jira.issuelink.delete"],
+      version: "1.0.0"
+    },
+    {
+      capability: "inbox.write",
+      description: "Send and respond to agent inbox tasks",
+      includes: ["inbox.send", "inbox.respond", "inbox.complete", "scheduling.request"],
+      version: "1.0.0"
+    },
+    {
+      capability: "inbox.read",
+      description: "Read agent inbox tasks",
+      includes: ["inbox.check", "inbox.checkByToken"],
       version: "1.0.0"
     }
   ]
 };
 
+// src/registry/action-input-validator.ts
+var SCHEMA_INDEX = (() => {
+  const map = /* @__PURE__ */ new Map();
+  for (const a of ACTION_REGISTRY.actions) {
+    if (a && typeof a.action === "string" && a.input_schema) {
+      map.set(a.action, a.input_schema);
+    }
+  }
+  return map;
+})();
+function describeExpectedShape(schema) {
+  const props = schema.properties ?? {};
+  const required = Array.isArray(schema.required) ? schema.required : [];
+  const requiredSet = new Set(required);
+  const parts = [];
+  const orderedKeys = [
+    ...required.filter((k) => k in props),
+    ...Object.keys(props).filter((k) => !requiredSet.has(k))
+  ];
+  for (const key of orderedKeys) {
+    const prop = props[key] || {};
+    const optionalMark = requiredSet.has(key) ? "" : "?";
+    const enumVals = Array.isArray(prop.enum) ? prop.enum : void 0;
+    if (enumVals && enumVals.length > 0) {
+      const rendered = enumVals.map((v) => typeof v === "string" ? `'${v}'` : String(v)).join(" | ");
+      parts.push(`${key}${optionalMark}: ${rendered}`);
+    } else {
+      parts.push(`${key}${optionalMark}`);
+    }
+  }
+  return `{ ${parts.join(", ")} }`;
+}
+function matchesType(value, type) {
+  if (!type) return true;
+  switch (type) {
+    case "string":
+      return typeof value === "string";
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+    case "number":
+      return typeof value === "number";
+    case "boolean":
+      return typeof value === "boolean";
+    case "array":
+      return Array.isArray(value);
+    case "object":
+      return typeof value === "object" && value !== null && !Array.isArray(value);
+    default:
+      return true;
+  }
+}
+function validateActionInput(action, params) {
+  const schema = SCHEMA_INDEX.get(action);
+  if (!schema) {
+    return { valid: true };
+  }
+  const props = schema.properties ?? {};
+  const required = Array.isArray(schema.required) ? schema.required : [];
+  const additionalProps = schema.additionalProperties;
+  const safeParams = params && typeof params === "object" && !Array.isArray(params) ? params : {};
+  const missing = [];
+  const unknown = [];
+  const enumErrors = [];
+  const typeErrors = [];
+  for (const key of required) {
+    if (!(key in safeParams) || safeParams[key] === void 0 || safeParams[key] === null) {
+      missing.push(key);
+    }
+  }
+  if (additionalProps === false) {
+    for (const key of Object.keys(safeParams)) {
+      if (!(key in props)) {
+        unknown.push(key);
+      }
+    }
+  }
+  for (const key of Object.keys(props)) {
+    if (!(key in safeParams)) continue;
+    const value = safeParams[key];
+    if (value === void 0 || value === null) continue;
+    const prop = props[key] || {};
+    const enumVals = Array.isArray(prop.enum) ? prop.enum : void 0;
+    if (enumVals && enumVals.length > 0) {
+      if (!enumVals.includes(value)) {
+        enumErrors.push(key);
+        continue;
+      }
+    }
+    if (!matchesType(value, prop.type)) {
+      typeErrors.push(key);
+    }
+  }
+  if (missing.length === 0 && unknown.length === 0 && enumErrors.length === 0 && typeErrors.length === 0) {
+    return { valid: true };
+  }
+  const segments = [];
+  if (missing.length > 0) {
+    segments.push(`missing required parameter(s) [${missing.join(", ")}]`);
+  }
+  if (unknown.length > 0) {
+    segments.push(`unknown parameter(s) [${unknown.join(", ")}]`);
+  }
+  if (enumErrors.length > 0) {
+    const details = enumErrors.map((key) => {
+      const enumVals = props[key]?.enum || [];
+      const rendered = enumVals.map((v) => typeof v === "string" ? `'${v}'` : String(v)).join(" | ");
+      return `${key} (allowed: ${rendered})`;
+    }).join(", ");
+    segments.push(`invalid value for enum parameter(s) [${details}]`);
+  }
+  if (typeErrors.length > 0) {
+    const details = typeErrors.map((key) => `${key} (expected ${props[key]?.type})`).join(", ");
+    segments.push(`wrong type for parameter(s) [${details}]`);
+  }
+  const message = `${action}: ${segments.join("; ")}. Expected shape: ${describeExpectedShape(schema)}`;
+  return { valid: false, errors: [message] };
+}
+
 // src/registry/resource-types.ts
 var RESOURCE_TYPES = {
   // Slack
@@ -5757,6 +6671,14 @@ var RESOURCE_TYPES = {
   JIRA_BOARD: "jira:board",
   JIRA_ISSUE: "jira:issue",
   JIRA_SPRINT: "jira:sprint",
+  // HubSpot
+  HUBSPOT_OBJECT: "hubspot:object",
+  HUBSPOT_PROPERTY: "hubspot:property",
+  HUBSPOT_SCHEMA: "hubspot:schema",
+  HUBSPOT_ASSOCIATION: "hubspot:association",
+  HUBSPOT_ENGAGEMENT: "hubspot:engagement",
+  HUBSPOT_WORKFLOW: "hubspot:workflow",
+  HUBSPOT_ACCOUNT: "hubspot:account",
   // OS (local)
   OS_SECRET: "os:secret",
   OS_PROCESS: "os:process",
@@ -5783,6 +6705,13 @@ var LEGACY_RESOURCE_TYPE_MAP = {
   "jira:board": RESOURCE_TYPES.JIRA_BOARD,
   "jira:issue": RESOURCE_TYPES.JIRA_ISSUE,
   "jira:sprint": RESOURCE_TYPES.JIRA_SPRINT,
+  "hubspot:object": RESOURCE_TYPES.HUBSPOT_OBJECT,
+  "hubspot:property": RESOURCE_TYPES.HUBSPOT_PROPERTY,
+  "hubspot:schema": RESOURCE_TYPES.HUBSPOT_SCHEMA,
+  "hubspot:association": RESOURCE_TYPES.HUBSPOT_ASSOCIATION,
+  "hubspot:engagement": RESOURCE_TYPES.HUBSPOT_ENGAGEMENT,
+  "hubspot:workflow": RESOURCE_TYPES.HUBSPOT_WORKFLOW,
+  "hubspot:account": RESOURCE_TYPES.HUBSPOT_ACCOUNT,
   "os:secret": RESOURCE_TYPES.OS_SECRET,
   "os:process": RESOURCE_TYPES.OS_PROCESS,
   // Legacy formats with old provider prefixes
@@ -6006,7 +6935,7 @@ var ACTION_DISPLAY_CONFIGS = {
     summaryTemplate: (p) => {
       const parts = [];
       if (p.summary) parts.push(p.summary);
-      if (p.start) parts.push(`(${formatValue(p.start)})`);
+      if (p.start) parts.push(`(${formatCalendarTime(p.start)})`);
       return parts.join(" ");
     },
     displayFields: [
@@ -6020,7 +6949,7 @@ var ACTION_DISPLAY_CONFIGS = {
     summaryTemplate: (p) => {
       const parts = [];
       if (p.summary) parts.push(p.summary);
-      if (p.start) parts.push(`(${formatValue(p.start)})`);
+      if (p.start) parts.push(`(${formatCalendarTime(p.start)})`);
       return parts.join(" ");
     },
     displayFields: [
@@ -6110,7 +7039,7 @@ var ACTION_DISPLAY_CONFIGS = {
     ]
   },
   // AIDENTITY-65: comment 本体は string と ADF document の両方を受けるため、
-  // formatValue 側の ADF ハンドリング (extractFirstAdfText) に任せて key 指定で OK。
+  // detail 表示の ADF 描画は formatValueFull 側に任せて key 指定で OK。
   "jira.comment.create": {
     summaryTemplate: (p) => {
       const parts = [];
@@ -6123,6 +7052,21 @@ var ACTION_DISPLAY_CONFIGS = {
       { key: "body", label: "Comment" }
     ]
   },
+  // AIDENTITY-66: 破壊的操作なので「どの issue のどの comment を消すか」を明示する
+  // (jira.issue.delete / jira.issuelink.delete と同じ destructive 表現の方針)。
+  "jira.comment.delete": {
+    summaryTemplate: (p) => {
+      const issue = p.issueIdOrKey ?? p.issueKey;
+      const commentId = p.commentId ?? p.id;
+      if (issue && commentId) return `Delete comment ${commentId} on ${issue}`;
+      if (commentId) return `Delete comment ${commentId}`;
+      return "";
+    },
+    displayFields: [
+      { label: "Issue", extract: (p) => p.issueIdOrKey ?? p.issueKey },
+      { label: "Comment", extract: (p) => p.commentId ?? p.id }
+    ]
+  },
   // AIDENTITY-65: API enricher が 'Link' label を upsert で書き換える。
   "jira.issuelink.delete": {
     summaryTemplate: (p) => {
@@ -6133,24 +7077,99 @@ var ACTION_DISPLAY_CONFIGS = {
     displayFields: [
       { key: "linkId", label: "Link" }
     ]
+  },
+  // AIDENTITY-83: email / displayName から accountId を解決する read action。
+  "jira.user.search": {
+    summaryTemplate: (p) => {
+      if (p.query) return `Search users: ${String(p.query)}`;
+      return "";
+    },
+    displayFields: [
+      { key: "query", label: "Query" },
+      { key: "maxResults", label: "Max Results" }
+    ]
+  },
+  // ─── Agent Inbox ───
+  "inbox.send": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.to) parts.push(`To: ${p.to}`);
+      if (p.taskType) parts.push(`Task: ${p.taskType}`);
+      return parts.join(", ");
+    },
+    displayFields: [
+      { key: "to", label: "To" },
+      { key: "taskType", label: "Task" },
+      { key: "message", label: "Message" }
+    ]
+  },
+  "inbox.respond": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.action) parts.push(String(p.action));
+      if (p.id) parts.push(`#${p.id}`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "id", label: "Item" },
+      { key: "action", label: "Action" }
+    ]
+  },
+  "inbox.check": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.status) parts.push(`Status: ${p.status}`);
+      if (Array.isArray(p.types) && p.types.length > 0) parts.push(`Types: ${p.types.join(", ")}`);
+      return parts.join(", ");
+    },
+    displayFields: [
+      { key: "status", label: "Status" },
+      { key: "types", label: "Types" }
+    ]
+  },
+  "inbox.checkByToken": {
+    summaryTemplate: (p) => p.token ? `Token: ${p.token}` : "",
+    displayFields: [
+      { key: "token", label: "Token" }
+    ]
+  },
+  "inbox.complete": {
+    summaryTemplate: (p) => p.id ? `Complete #${p.id}` : "",
+    displayFields: [
+      { key: "id", label: "Item" }
+    ]
   }
 };
 function truncate(text, maxLength) {
   if (text.length <= maxLength) return text;
   return text.slice(0, maxLength - 3) + "...";
 }
-function formatValue(value) {
+function formatCalendarTime(value) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const obj = value;
+    if (obj.dateTime) {
+      return obj.timeZone ? `${obj.dateTime} (${obj.timeZone})` : String(obj.dateTime);
+    }
+    if (obj.date) return String(obj.date);
+  }
+  return String(value);
+}
+function formatValueFull(value) {
   if (value === void 0) return "";
   if (value === null) return "(unset)";
   if (Array.isArray(value)) {
-    return value.map((item) => {
+    const parts = value.map((item) => {
       if (item && typeof item === "object") {
         const email = item.email;
         if (email) return String(email);
-        return JSON.stringify(item);
+        return JSON.stringify(item, null, 2);
       }
       return String(item);
-    }).join(", ");
+    });
+    const hasMultiline = parts.some((p) => p.includes("\n"));
+    const joinedShort = parts.join(", ");
+    if (hasMultiline || joinedShort.length > 80) return parts.join("\n");
+    return joinedShort;
   }
   if (typeof value === "object") {
     const obj = value;
@@ -6159,33 +7178,118 @@ function formatValue(value) {
     }
     if (obj.date) return String(obj.date);
     if (obj.type === "doc" && Array.isArray(obj.content)) {
-      const firstText = extractFirstAdfText(obj.content);
-      if (firstText) {
-        const moreCount = obj.content.length - 1;
-        const more = moreCount > 0 ? ` \u2026 (+${moreCount} block${moreCount > 1 ? "s" : ""})` : "";
-        return `${firstText}${more}`;
-      }
-      return "(ADF document)";
+      const rendered = renderAdfDocument(obj.content).trim();
+      if (rendered) return rendered;
+      if (obj.content.length > 0) return JSON.stringify(value, null, 2);
+      return "";
     }
-    return JSON.stringify(value);
+    return JSON.stringify(value, null, 2);
   }
   return String(value);
 }
-function extractFirstAdfText(nodes) {
+function renderAdfDocument(nodes, indent = "") {
+  const lines = [];
   for (const node of nodes) {
     if (!node || typeof node !== "object") continue;
     const n = node;
-    if (n.type === "paragraph" || n.type === "heading") {
-      const inner = n.content ?? [];
-      for (const child of inner) {
-        if (child && typeof child === "object") {
-          const c = child;
-          if (c.type === "text" && typeof c.text === "string") return c.text;
+    const type = n.type;
+    const content = n.content ?? [];
+    switch (type) {
+      case "paragraph": {
+        lines.push(indent + renderAdfInline(content));
+        break;
+      }
+      case "heading": {
+        const level = Number(n.attrs?.level) || 1;
+        lines.push(indent + "#".repeat(level) + " " + renderAdfInline(content));
+        break;
+      }
+      case "bulletList":
+      case "orderedList": {
+        const ordered = type === "orderedList";
+        let orderedCounter = 0;
+        content.forEach((item) => {
+          if (!item || typeof item !== "object") return;
+          const li = item;
+          const liContent = li.content ?? [];
+          orderedCounter++;
+          const marker = ordered ? `${orderedCounter}. ` : "- ";
+          const inner = renderAdfDocument(liContent, indent + "  ");
+          const innerLines = inner.split("\n");
+          const firstTrimmed = innerLines.length > 0 ? innerLines[0].slice((indent + "  ").length) : "";
+          lines.push(indent + marker + firstTrimmed);
+          for (let i = 1; i < innerLines.length; i++) lines.push(innerLines[i]);
+        });
+        break;
+      }
+      case "codeBlock": {
+        lines.push(indent + renderAdfInline(content));
+        break;
+      }
+      case "blockquote": {
+        const inner = renderAdfDocument(content, indent);
+        if (inner) {
+          for (const l of inner.split("\n")) lines.push(indent + "> " + l.slice(indent.length));
         }
+        break;
+      }
+      case "panel": {
+        const panelType = n.attrs?.panelType;
+        if (panelType) lines.push(indent + `[panel:${String(panelType)}]`);
+        const panelInner = renderAdfDocument(content, indent);
+        if (panelInner) lines.push(panelInner);
+        break;
+      }
+      case "rule": {
+        lines.push(indent + "---");
+        break;
+      }
+      default: {
+        if (content.length > 0) {
+          const inner = renderAdfDocument(content, indent);
+          if (inner) lines.push(inner);
+        } else {
+          const inline = renderAdfInline([n]);
+          if (inline) lines.push(indent + inline);
+        }
+        break;
       }
     }
   }
-  return "";
+  return lines.join("\n");
+}
+function renderAdfInline(nodes) {
+  let out = "";
+  for (const node of nodes) {
+    if (!node || typeof node !== "object") continue;
+    const n = node;
+    const attrs = n.attrs ?? {};
+    switch (n.type) {
+      case "text":
+        if (typeof n.text === "string") out += n.text;
+        break;
+      case "hardBreak":
+        out += "\n";
+        break;
+      case "mention":
+        out += String(attrs.text ?? attrs.id ?? "@mention");
+        break;
+      case "emoji":
+        out += String(attrs.text ?? attrs.shortName ?? "");
+        break;
+      case "inlineCard":
+        out += String(attrs.url ?? "");
+        break;
+      default:
+        if (Array.isArray(n.content)) {
+          out += renderAdfInline(n.content);
+        } else if (typeof attrs.text === "string") {
+          out += attrs.text;
+        }
+        break;
+    }
+  }
+  return out;
 }
 var ACTION_PARAMS_MAX_SIZE = 1e4;
 function generateActionSummary(action, params, maxLength = 50) {
@@ -6209,11 +7313,11 @@ function generateActionParamsDisplay(action, params) {
     return config.displayFields.map((f) => {
       const raw = f.extract ? f.extract(params) : f.key ? params[f.key] : void 0;
       return { label: f.label, raw };
-    }).filter((item) => item.raw !== void 0).map((item) => ({ label: item.label, value: formatValue(item.raw) }));
+    }).filter((item) => item.raw !== void 0).map((item) => ({ label: item.label, value: formatValueFull(item.raw) }));
   }
-  return Object.entries(params).filter(([, v]) => v !== void 0 && v !== null).slice(0, 3).map(([key, val]) => ({
+  return Object.entries(params).filter(([, v]) => v !== void 0 && v !== null).map(([key, val]) => ({
     label: key,
-    value: formatValue(val)
+    value: formatValueFull(val)
   }));
 }
 
@@ -6836,6 +7940,7 @@ var version = "0.0.1";
   sha256Hex,
   signJWT,
   signRequest,
+  validateActionInput,
   validateRegistryObject,
   vcStatusToCredentialStatus,
   verifyJWT,