@vess-id/ai-identity 0.17.0 → 0.19.0

package/dist/index.mjs

@@ -4006,7 +4006,7 @@ function validateRegistryObject(registry) {
   for (const a of typed.actions) {
     if (a.input_schema) {
       try {
-        const local = new Ajv({ strict: true, allErrors: true });
+        const local = new Ajv({ strict: true, allErrors: true, allowUnionTypes: true });
         addFormats(local);
         const compiled = local.compile(a.input_schema);
         if (compiled.errors?.length) {
@@ -7572,472 +7572,1513 @@ var ACTION_REGISTRY = {
       target_bindings: { resource_id: { source: "param", param: "portalId" } },
       version: "1.0.0"
     },
-    // ─── Agent Inbox Actions (internal) ───
-    // Inbox actions back the Agent Inbox MCP tools (task delegation between
-    // agents/people). They are internal (no external OAuth provider), so they
-    // carry a single nominal base scope `inbox` to satisfy the registry
-    // meta-schema's `minItems: 1` (same pattern as hubspot.account.link.get).
+    // ─── Linear Actions ───
     {
-      action: "inbox.send",
-      resource_type: "inbox:item",
-      required_relations: ["editor", "act_as"],
-      required_scopes: ["inbox"],
-      capability: "inbox.write",
+      action: "linear.issue.list",
+      resource_type: "linear:issue",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
       input_schema: {
         type: "object",
         properties: {
-          to: { type: "string", minLength: 1, description: "Recipient (user id / handle) the task request is sent to" },
-          taskType: { type: "string", minLength: 1, description: "Type of task being requested" },
-          payload: { type: "object", description: "Task-specific payload data" },
-          message: { type: "string", description: "Optional human-readable message" }
+          teamId: { type: "string", description: "Filter by team ID" },
+          assigneeId: { type: "string", description: "Filter by assignee user ID" },
+          assigneeMe: { type: "boolean", description: "If true, filter issues assigned to the authenticated user" },
+          stateId: { type: "string", description: "Filter by workflow state ID" },
+          priority: { type: "number", minimum: 0, maximum: 4, description: "0=No priority, 1=Urgent, 2=High, 3=Medium, 4=Low" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of issues to return (default 50)" }
         },
-        required: ["to", "taskType", "payload"],
         additionalProperties: false
       },
-      constraints: { rate_bucket: "inbox.write" },
-      effects: ["Create:InboxItem"],
-      risk: "high",
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:IssueList"],
+      risk: "low",
       target_bindings: {
-        resource_id: { source: "param", param: "to" }
+        resource_id: { source: "param", param: "teamId", required: false }
       },
       version: "1.0.0"
     },
     {
-      action: "inbox.respond",
-      resource_type: "inbox:item",
-      required_relations: ["editor", "act_as"],
-      required_scopes: ["inbox"],
-      capability: "inbox.write",
+      action: "linear.issue.read",
+      resource_type: "linear:issue",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
       input_schema: {
         type: "object",
         properties: {
-          id: { type: "string", minLength: 1, description: "Inbox item id being responded to" },
-          action: { type: "string", enum: ["accept", "decline", "counter"], description: "Response action" },
-          data: { type: "object", description: "Optional response data (e.g. counter-proposal)" }
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier (e.g. ENG-123)" }
         },
-        required: ["id", "action"],
+        required: ["issueId"],
         additionalProperties: false
       },
-      constraints: { rate_bucket: "inbox.write" },
-      effects: ["Update:InboxItem"],
-      // high (not medium): an agent-mediated response (MCP invoke) must always
-      // go through human approval — the Phase 1 "always confirm" guarantee made
-      // enforceable. target_bindings below binds the concrete inbox item id so
-      // the high-risk approval has a specific resource constraint (the public
-      // /scheduling/:token link flow does NOT go through this gate — it calls
-      // InboxService.respond directly, system-key-signed).
-      risk: "high",
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:Issue"],
+      risk: "low",
       target_bindings: {
-        resource_id: { source: "param", param: "id" }
+        resource_id: { source: "param", param: "issueId" }
       },
       version: "1.0.0"
     },
     {
-      action: "inbox.check",
-      resource_type: "inbox:item",
+      action: "linear.issue.search",
+      resource_type: "linear:issue",
       required_relations: ["viewer", "editor", "admin", "owner"],
-      required_scopes: ["inbox"],
-      capability: "inbox.read",
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
       input_schema: {
         type: "object",
         properties: {
-          types: { type: "array", items: { type: "string" }, description: "Filter by task types" },
-          status: { type: "string", description: "Filter by item status" }
+          query: { type: "string", minLength: 1, description: "Full-text search query" },
+          teamId: { type: "string", description: "Restrict search to a specific team" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of results (default 50)" }
         },
+        required: ["query"],
         additionalProperties: false
       },
-      constraints: { rate_bucket: "inbox.read" },
-      effects: ["Read:InboxItem"],
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:IssueList"],
       risk: "low",
       target_bindings: {
-        resource_id: { source: "param", param: "id", required: false }
+        resource_id: { source: "param", param: "teamId", required: false }
       },
       version: "1.0.0"
     },
     {
-      action: "inbox.checkByToken",
-      resource_type: "inbox:item",
-      required_relations: ["viewer", "editor", "admin", "owner"],
-      required_scopes: ["inbox"],
-      capability: "inbox.read",
+      action: "linear.issue.create",
+      resource_type: "linear:issue",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["issues:create"],
+      capability: "linear.write.basic",
       input_schema: {
         type: "object",
         properties: {
-          token: { type: "string", minLength: 1, description: "Opaque access token for a single inbox item" }
+          teamId: { type: "string", minLength: 1, description: "Team ID to create the issue in" },
+          title: { type: "string", minLength: 1, description: "Issue title" },
+          description: { type: "string", description: "Issue description (Markdown)" },
+          assigneeId: { type: "string", description: "Assignee user ID" },
+          stateId: { type: "string", description: "Workflow state ID" },
+          priority: { type: "number", minimum: 0, maximum: 4, description: "0=No priority, 1=Urgent, 2=High, 3=Medium, 4=Low" },
+          labelIds: { type: "array", items: { type: "string" }, description: "Label IDs to attach" }
         },
-        required: ["token"],
+        required: ["teamId", "title"],
         additionalProperties: false
       },
-      constraints: { rate_bucket: "inbox.read" },
-      effects: ["Read:InboxItem"],
-      risk: "low",
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Create:Issue"],
+      risk: "high",
       target_bindings: {
-        resource_id: { source: "param", param: "token" }
+        resource_id: { source: "param", param: "teamId" }
       },
       version: "1.0.0"
     },
     {
-      action: "inbox.complete",
-      resource_type: "inbox:item",
+      action: "linear.issue.update",
+      resource_type: "linear:issue",
       required_relations: ["editor", "act_as"],
-      required_scopes: ["inbox"],
-      capability: "inbox.write",
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
       input_schema: {
         type: "object",
         properties: {
-          id: { type: "string", minLength: 1, description: "Inbox item id being completed" },
-          result: { type: "object", description: "Result payload for the completed task" }
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier (e.g. ENG-123)" },
+          title: { type: "string", description: "New title" },
+          description: { type: "string", description: "New description (Markdown)" },
+          assigneeId: { type: "string", description: "Assignee user ID (null to unassign)" },
+          stateId: { type: "string", description: "Workflow state ID" },
+          priority: { type: "number", minimum: 0, maximum: 4, description: "0=No priority, 1=Urgent, 2=High, 3=Medium, 4=Low" },
+          labelIds: { type: "array", items: { type: "string" }, description: "New set of label IDs" }
         },
-        required: ["id", "result"],
+        required: ["issueId"],
         additionalProperties: false
       },
-      constraints: { rate_bucket: "inbox.write" },
-      effects: ["Update:InboxItem"],
-      risk: "low",
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Issue"],
+      risk: "high",
       target_bindings: {
-        resource_id: { source: "param", param: "id" }
+        resource_id: { source: "param", param: "issueId" }
       },
       version: "1.0.0"
     },
-    // ─── Scheduling Actions (internal) ───
-    // scheduling.request is a meeting-time negotiation façade over inbox.send.
-    // Candidate slots may be supplied two ways (server-side EXCLUSIVE — exactly
-    // one): (a) `candidates` — the agent computes them LLM-side from the user
-    // calendar and the server validates + freebusy-filters them, or (b)
-    // `candidateWindow` — the agent hands the server a { start, end } window and
-    // the server generates busy-free candidates from the sender's Google
-    // Calendar. Like the inbox actions it is internal (no external OAuth
-    // provider), so it carries the single nominal base scope `inbox`.
-    //
-    // NOTE: the candidates/candidateWindow exclusivity is expressed here as
-    // `oneOf` for documentation + the deep JSON-Schema authorities, but the SDK's
-    // hand-written `validateActionInput` is a SHALLOW shape gate that does NOT
-    // interpret `oneOf` (neither key is in top-level `required`). The exclusivity
-    // (exactly one of candidates/candidateWindow) is ENFORCED server-side in
-    // SchedulingRequestService — see that service for the 400s on both-given /
-    // both-missing.
-    // Spec: docs/specs/2026-06-10-inbox-intent-routing-design.md §2.1
     {
-      action: "scheduling.request",
-      resource_type: "inbox:item",
+      action: "linear.comment.create",
+      resource_type: "linear:comment",
       required_relations: ["editor", "act_as"],
-      required_scopes: ["inbox"],
-      capability: "inbox.write",
+      required_scopes: ["comments:create"],
+      capability: "linear.write.basic",
       input_schema: {
         type: "object",
         properties: {
-          to: { type: "string", minLength: 1, description: "Counterpart (user id / email) to negotiate a meeting time with" },
-          topic: { type: "string", minLength: 1, description: "Meeting topic shown to the counterpart" },
-          durationMinutes: { type: "integer", minimum: 5, maximum: 480, description: "Meeting length in minutes" },
-          candidates: {
-            type: "array",
-            minItems: 1,
-            maxItems: 10,
-            description: "Explicit candidate slots computed by the agent from the user calendar. The server validates them AND (when Google Calendar is connected) filters out any that conflict with the sender's calendar. Mutually exclusive with candidateWindow \u2014 supply exactly one.",
-            items: {
-              type: "object",
-              properties: {
-                start: { type: "string", description: "ISO 8601 start" },
-                end: { type: "string", description: "ISO 8601 end" }
-              },
-              required: ["start", "end"],
-              additionalProperties: false
-            }
-          },
-          candidateWindow: {
-            type: "object",
-            description: "A { start, end } search window (ISO 8601, span \u2264 62 days). The server generates busy-free candidate slots from the sender's Google Calendar within it. Mutually exclusive with candidates \u2014 supply exactly one. Requires a connected Google Calendar.",
-            properties: {
-              start: { type: "string", description: "ISO 8601 window start" },
-              end: { type: "string", description: "ISO 8601 window end" }
-            },
-            required: ["start", "end"],
-            additionalProperties: false
-          },
-          hold: {
-            type: "boolean",
-            description: "When true (or omitted, when the sender's delegation policy has holds enabled), tentatively hold the offered slots on the sender's calendar as [\u4EEE] events until the counterpart responds or the request expires. Pass false to skip holds for this request. Only takes effect when the sender has an enabled scheduling delegation policy."
-          },
-          message: { type: "string", description: "Optional human-readable message" }
+          issueId: { type: "string", minLength: 1, description: "Issue ID to comment on" },
+          body: { type: "string", minLength: 1, description: "Comment body (Markdown)" }
         },
-        // candidates / candidateWindow are intentionally NOT in `required`: the
-        // exclusive-choice is documented via `oneOf` and enforced server-side.
-        // Each oneOf branch re-declares its property locally (empty `properties`
-        // entry) so AJV strict mode (`strictRequired`) sees the required key as
-        // defined within the branch scope — the value shape itself is validated
-        // by the top-level `properties` above.
-        required: ["to", "topic", "durationMinutes"],
-        oneOf: [
-          { required: ["candidates"], properties: { candidates: {} } },
-          { required: ["candidateWindow"], properties: { candidateWindow: {} } }
-        ],
+        required: ["issueId", "body"],
         additionalProperties: false
       },
-      constraints: { rate_bucket: "inbox.write" },
-      effects: ["Create:InboxItem"],
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Create:Comment"],
       risk: "high",
       target_bindings: {
-        resource_id: { source: "param", param: "to" }
+        resource_id: { source: "param", param: "issueId" }
       },
       version: "1.0.0"
-    }
-  ],
-  capabilities: [
-    {
-      capability: "slack.messaging.basic",
-      description: "Post, update, and delete messages in channels",
-      includes: ["slack.message.post", "slack.message.update", "slack.message.delete"],
-      version: "1.0.0"
-    },
-    {
-      capability: "slack.read.basic",
-      description: "Read channels, messages, and user info",
-      includes: ["slack.channel.read", "slack.user.read", "slack.message.read", "slack.message.read_paginated", "slack.batch.read"],
-      version: "1.0.0"
     },
     {
-      capability: "github.read.basic",
-      description: "Read issues, pull requests and repository contents from repositories",
-      includes: ["github.issue.list", "github.issue.read", "github.pr.list", "github.pr.read", "github.pr.files.list", "github.pr.review.list", "github.pr.search", "github.repo.search", "github.repo.collaborator.list", "github.content.get", "github.tree.get", "github.branch.list", "github.commit.get", "github.commit.list", "github.commit.search", "github.tag.list", "github.release.list", "github.release.getLatest", "github.release.getByTag", "github.code.search", "github.issue.search", "github.issue.types.list", "github.label.get", "github.label.list", "github.workflow.get", "github.workflow.list", "github.workflow.jobLogs.get", "github.repo.starred.list", "github.user.me.get", "github.org.teams.list", "github.team.members.list", "github.user.search", "github.notification.list", "github.notification.get", "github.gist.get", "github.gist.list"],
+      action: "linear.comment.list",
+      resource_type: "linear:comment",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID to list comments for" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of comments (default 50)" }
+        },
+        required: ["issueId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:CommentList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
       version: "1.0.0"
     },
     {
-      capability: "github.issues.triage",
-      description: "Create and update issues, post issue comments, manage sub-issues and labels",
-      includes: ["github.issue.create", "github.issue.update", "github.issue.comment.create", "github.issue.subissue.write", "github.label.write"],
+      action: "linear.project.list",
+      resource_type: "linear:project",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          teamId: { type: "string", description: "Filter by team ID" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of projects (default 50)" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:ProjectList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId", required: false }
+      },
       version: "1.0.0"
     },
     {
-      capability: "github.pulls.write",
-      description: "Create, update, merge, and review pull requests",
-      includes: ["github.pr.create", "github.pr.update", "github.pr.merge", "github.pr.review.create", "github.pr.comment.reply", "github.pr.branch.update"],
+      action: "linear.project.read",
+      resource_type: "linear:project",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          projectId: { type: "string", minLength: 1, description: "Project ID" }
+        },
+        required: ["projectId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:Project"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "projectId" }
+      },
       version: "1.0.0"
     },
     {
-      capability: "github.repos.write",
-      description: "\u30EA\u30DD\u30B8\u30C8\u30EA\u306E\u4F5C\u6210\u30FB\u30D5\u30A9\u30FC\u30AF\u30FB\u30D5\u30A1\u30A4\u30EB\u66F4\u65B0\u30FB\u30D6\u30E9\u30F3\u30C1\u4F5C\u6210\u30FB\u30EF\u30FC\u30AF\u30D5\u30ED\u30FC\u5B9F\u884C\u30FB\u30B9\u30BF\u30FC\u64CD\u4F5C",
-      includes: ["github.repo.create", "github.repo.fork", "github.content.createOrUpdate", "github.content.delete", "github.branch.create", "github.workflow.run", "github.repo.star", "github.repo.unstar"],
+      action: "linear.team.list",
+      resource_type: "linear:team",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of teams (default 50)" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:TeamList"],
+      risk: "low",
+      // No teamId parameter: this action lists ALL accessible teams — intentionally
+      // not scoped to a single team. required:false signals that missing resource
+      // binding is expected (not an omission), consistent with slack.channel.read.
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId", required: false }
+      },
       version: "1.0.0"
     },
     {
-      capability: "github.notifications.write",
-      description: "\u901A\u77E5\u306E\u65E2\u8AAD\u5316\u30FB\u30B9\u30EC\u30C3\u30C9/\u30EA\u30DD\u30B8\u30C8\u30EA\u306E\u8CFC\u8AAD\u8A2D\u5B9A",
-      includes: ["github.notification.markRead", "github.notification.markAllRead", "github.notification.subscription.set", "github.notification.repoSubscription.set"],
+      action: "linear.workflowState.list",
+      resource_type: "linear:workflowState",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          teamId: { type: "string", description: "Filter by team ID" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of workflow states to return (default 50)" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:WorkflowStateList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId", required: false }
+      },
       version: "1.0.0"
     },
     {
-      capability: "github.gists.write",
-      description: "Gist \u306E\u4F5C\u6210\u30FB\u66F4\u65B0",
-      includes: ["github.gist.create", "github.gist.update"],
+      action: "linear.viewer.read",
+      resource_type: "linear:viewer",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {},
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:Viewer"],
+      risk: "low",
+      // No parameters: this action reads the currently authenticated user — there is
+      // no resource to scope to. required:false signals intentional exemption, not
+      // omission, consistent with the slack.channel.read precedent.
+      target_bindings: {
+        resource_id: { source: "param", param: "viewerId", required: false }
+      },
       version: "1.0.0"
     },
     {
-      capability: "gmail.read.basic",
-      description: "Read and search Gmail messages and labels",
-      includes: ["gmail.message.search", "gmail.message.read", "gmail.label.read", "gmail.batch.read"],
+      action: "linear.label.list",
+      resource_type: "linear:label",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          teamId: { type: "string", description: "Filter labels by team ID" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of labels to return (default 50)" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:LabelList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId", required: false }
+      },
       version: "1.0.0"
     },
     {
-      capability: "gmail.compose",
-      description: "Send emails and create drafts via Gmail",
-      includes: ["gmail.message.send", "gmail.draft.create"],
+      action: "linear.user.list",
+      resource_type: "linear:team",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          teamId: { type: "string", description: "Filter by team ID (lists team members only)" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of users to return (default 50)" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:UserList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId", required: false }
+      },
       version: "1.0.0"
     },
     {
-      capability: "gmail.manage",
-      description: "Trash and permanently delete Gmail messages",
-      includes: ["gmail.message.trash", "gmail.message.delete"],
+      action: "linear.issue.archive",
+      resource_type: "linear:issue",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier to archive (e.g. ENG-123)" }
+        },
+        required: ["issueId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Archive:Issue"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
       version: "1.0.0"
     },
     {
-      capability: "calendar.read.basic",
-      description: "Read and list Google Calendar events, and check free/busy availability",
-      includes: ["calendar.event.list", "calendar.event.read", "calendar.freebusy"],
+      action: "linear.project.create",
+      resource_type: "linear:project",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          name: { type: "string", minLength: 1, description: "Project name" },
+          teamIds: { type: "array", items: { type: "string" }, minItems: 1, description: "Team IDs to associate with the project (at least one required)" },
+          teamId: { type: "string", description: "Primary team ID (first element of teamIds; used for authorization scope)" },
+          description: { type: "string", description: "Project description (Markdown)" },
+          statusId: { type: "string", description: "Project status ID. Note: this is a ProjectStatus ID, not a WorkflowState ID. ProjectStatus can be retrieved via the Linear API projectStatuses query." },
+          startDate: { type: "string", description: "Start date (ISO 8601, e.g. 2024-01-01)" },
+          targetDate: { type: "string", description: "Target completion date (ISO 8601)" }
+        },
+        required: ["name", "teamIds"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Create:Project"],
+      risk: "high",
+      target_bindings: {
+        // teamId はスキーマの scalar フィールド (teamIds[0] の alias)。
+        // teamId が明示指定されている場合はそれを使い、未指定の場合は
+        // fallback_param: 'teamIds' で teamIds[0] にフォールバック（resolver は
+        // 配列の first element を自動的にスカラーに変換する）。
+        // extractResources も同じ優先順位 (teamId → teamIds[0]) で解決するため
+        // 両者のバインドが常に一致する。required:true で高リスク CREATE の
+        // resource binding 必須契約を明示 (teamIds は minItems:1 なので常に解決する)。
+        resource_id: { source: "param", param: "teamId", fallback_param: "teamIds", required: true }
+      },
       version: "1.0.0"
     },
     {
-      capability: "calendar.write",
-      description: "Create, update, and delete Google Calendar events",
-      includes: ["calendar.event.create", "calendar.event.update", "calendar.event.delete"],
+      action: "linear.project.update",
+      resource_type: "linear:project",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          projectId: { type: "string", minLength: 1, description: "Project ID to update" },
+          name: { type: "string", description: "New project name" },
+          description: { type: "string", description: "New project description (Markdown)" },
+          statusId: { type: "string", description: "New project status ID. Note: this is a ProjectStatus ID, not a WorkflowState ID." },
+          startDate: { type: "string", description: "New start date (ISO 8601)" },
+          targetDate: { type: "string", description: "New target date (ISO 8601)" }
+        },
+        required: ["projectId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Project"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "projectId" }
+      },
       version: "1.0.0"
     },
+    // ─── Linear Comment ops ───
     {
-      capability: "jira.read.basic",
-      description: "Read Jira issues, projects, boards, sprints, issue link types, and users",
-      includes: ["jira.project.read", "jira.board.read", "jira.sprint.read", "jira.issue.list", "jira.issue.search", "jira.worklog.read", "jira.issue.read", "jira.batch.read", "jira.comment.read", "jira.transition.list", "jira.issuelinktype.list", "jira.user.search"],
+      action: "linear.comment.update",
+      resource_type: "linear:comment",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["comments:create"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          commentId: { type: "string", minLength: 1, description: "Comment ID to update" },
+          body: { type: "string", minLength: 1, description: "New comment body (Markdown)" }
+        },
+        required: ["commentId", "body"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Comment"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "commentId" }
+      },
       version: "1.0.0"
     },
     {
-      capability: "jira.write.basic",
-      description: "Create, update, delete Jira issues, manage issue links, and add/delete comments",
-      includes: ["jira.issue.create", "jira.issue.update", "jira.issue.delete", "jira.comment.create", "jira.comment.delete", "jira.issue.transition", "jira.issuelink.create", "jira.issuelink.delete"],
+      action: "linear.comment.delete",
+      resource_type: "linear:comment",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          commentId: { type: "string", minLength: 1, description: "Comment ID to delete" }
+        },
+        required: ["commentId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Delete:Comment"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "commentId" }
+      },
       version: "1.0.0"
     },
     {
-      capability: "inbox.write",
-      description: "Send and respond to agent inbox tasks",
-      includes: ["inbox.send", "inbox.respond", "inbox.complete", "scheduling.request"],
+      action: "linear.comment.resolve",
+      resource_type: "linear:comment",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          commentId: { type: "string", minLength: 1, description: "Comment ID to resolve" }
+        },
+        required: ["commentId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Comment"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "commentId" }
+      },
       version: "1.0.0"
     },
     {
-      capability: "inbox.read",
-      description: "Read agent inbox tasks",
-      includes: ["inbox.check", "inbox.checkByToken"],
+      action: "linear.comment.unresolve",
+      resource_type: "linear:comment",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          commentId: { type: "string", minLength: 1, description: "Comment ID to unresolve" }
+        },
+        required: ["commentId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Comment"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "commentId" }
+      },
       version: "1.0.0"
-    }
-  ]
-};
-
-// src/registry/resource-type-labels.ts
-var RESOURCE_TYPE_LABELS = {
-  "github:repo": "\u5BFE\u8C61\u30EA\u30DD\u30B8\u30C8\u30EA",
-  "github:org": "\u5BFE\u8C61\u7D44\u7E54"
-};
-
-// src/registry/action-input-validator.ts
-var SCHEMA_INDEX = (() => {
-  const map = /* @__PURE__ */ new Map();
-  for (const a of ACTION_REGISTRY.actions) {
-    if (a && typeof a.action === "string" && a.input_schema) {
-      map.set(a.action, a.input_schema);
-    }
-  }
-  return map;
-})();
-function describeExpectedShape(schema) {
-  const props = schema.properties ?? {};
-  const required = Array.isArray(schema.required) ? schema.required : [];
-  const requiredSet = new Set(required);
-  const parts = [];
-  const orderedKeys = [
-    ...required.filter((k) => k in props),
-    ...Object.keys(props).filter((k) => !requiredSet.has(k))
-  ];
-  for (const key of orderedKeys) {
-    const prop = props[key] || {};
-    const optionalMark = requiredSet.has(key) ? "" : "?";
-    const enumVals = Array.isArray(prop.enum) ? prop.enum : void 0;
-    if (enumVals && enumVals.length > 0) {
-      const rendered = enumVals.map((v) => typeof v === "string" ? `'${v}'` : String(v)).join(" | ");
-      parts.push(`${key}${optionalMark}: ${rendered}`);
-    } else {
-      parts.push(`${key}${optionalMark}`);
-    }
-  }
-  return `{ ${parts.join(", ")} }`;
-}
-function matchesType(value, type) {
-  if (!type) return true;
-  switch (type) {
-    case "string":
-      return typeof value === "string";
-    case "integer":
-      return typeof value === "number" && Number.isInteger(value);
-    case "number":
-      return typeof value === "number";
-    case "boolean":
-      return typeof value === "boolean";
-    case "array":
-      return Array.isArray(value);
-    case "object":
-      return typeof value === "object" && value !== null && !Array.isArray(value);
-    default:
-      return true;
-  }
-}
-function validateActionInput(action, params) {
-  const schema = SCHEMA_INDEX.get(action);
-  if (!schema) {
-    return { valid: true };
-  }
-  const props = schema.properties ?? {};
-  const required = Array.isArray(schema.required) ? schema.required : [];
-  const additionalProps = schema.additionalProperties;
-  const safeParams = params && typeof params === "object" && !Array.isArray(params) ? params : {};
-  const missing = [];
-  const unknown = [];
-  const enumErrors = [];
-  const typeErrors = [];
-  for (const key of required) {
-    if (!(key in safeParams) || safeParams[key] === void 0 || safeParams[key] === null) {
-      missing.push(key);
-    }
-  }
-  if (additionalProps === false) {
-    for (const key of Object.keys(safeParams)) {
-      if (!(key in props)) {
-        unknown.push(key);
-      }
-    }
-  }
-  for (const key of Object.keys(props)) {
-    if (!(key in safeParams)) continue;
-    const value = safeParams[key];
-    if (value === void 0 || value === null) continue;
-    const prop = props[key] || {};
-    const enumVals = Array.isArray(prop.enum) ? prop.enum : void 0;
-    if (enumVals && enumVals.length > 0) {
-      if (!enumVals.includes(value)) {
-        enumErrors.push(key);
-        continue;
-      }
-    }
-    if (!matchesType(value, prop.type)) {
-      typeErrors.push(key);
-    }
-  }
-  if (missing.length === 0 && unknown.length === 0 && enumErrors.length === 0 && typeErrors.length === 0) {
-    return { valid: true };
-  }
-  const segments = [];
-  if (missing.length > 0) {
-    segments.push(`missing required parameter(s) [${missing.join(", ")}]`);
-  }
-  if (unknown.length > 0) {
-    segments.push(`unknown parameter(s) [${unknown.join(", ")}]`);
-  }
-  if (enumErrors.length > 0) {
-    const details = enumErrors.map((key) => {
-      const enumVals = props[key]?.enum || [];
-      const rendered = enumVals.map((v) => typeof v === "string" ? `'${v}'` : String(v)).join(" | ");
-      return `${key} (allowed: ${rendered})`;
-    }).join(", ");
-    segments.push(`invalid value for enum parameter(s) [${details}]`);
-  }
-  if (typeErrors.length > 0) {
-    const details = typeErrors.map((key) => `${key} (expected ${props[key]?.type})`).join(", ");
-    segments.push(`wrong type for parameter(s) [${details}]`);
-  }
-  const message = `${action}: ${segments.join("; ")}. Expected shape: ${describeExpectedShape(schema)}`;
-  return { valid: false, errors: [message] };
-}
-
-// src/registry/resource-types.ts
-var RESOURCE_TYPES = {
-  // Slack
-  SLACK_CHANNEL: "slack:channel",
-  SLACK_USER: "slack:user",
-  SLACK_WORKSPACE: "slack:workspace",
-  // GitHub
-  GITHUB_REPO: "github:repo",
-  GITHUB_ORG: "github:org",
-  GITHUB_ISSUE: "github:issue",
-  // Google Drive
-  GOOGLE_DRIVE_FILE: "google:drive:file",
-  GOOGLE_DRIVE_FOLDER: "google:drive:folder",
-  // Gmail
-  GMAIL_THREAD: "gmail:thread",
-  GMAIL_LABEL: "gmail:label",
-  // Jira
-  JIRA_PROJECT: "jira:project",
-  JIRA_BOARD: "jira:board",
-  JIRA_ISSUE: "jira:issue",
-  JIRA_SPRINT: "jira:sprint",
-  // HubSpot
-  HUBSPOT_OBJECT: "hubspot:object",
-  HUBSPOT_PROPERTY: "hubspot:property",
-  HUBSPOT_SCHEMA: "hubspot:schema",
-  HUBSPOT_ASSOCIATION: "hubspot:association",
+    },
+    // ─── Linear Issue ops ───
+    {
+      action: "linear.issue.unarchive",
+      resource_type: "linear:issue",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier to unarchive (e.g. ENG-123)" }
+        },
+        required: ["issueId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Issue"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.issue.addLabel",
+      resource_type: "linear:issue",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier" },
+          labelId: { type: "string", minLength: 1, description: "Label ID to add" }
+        },
+        required: ["issueId", "labelId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Issue"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.issue.removeLabel",
+      resource_type: "linear:issue",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier" },
+          labelId: { type: "string", minLength: 1, description: "Label ID to remove" }
+        },
+        required: ["issueId", "labelId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Issue"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.issue.subscribe",
+      resource_type: "linear:issue",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier to subscribe to" }
+        },
+        required: ["issueId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Issue"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.issue.delete",
+      resource_type: "linear:issue",
+      required_relations: ["admin", "owner", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier to permanently delete" }
+        },
+        required: ["issueId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Delete:Issue"],
+      risk: "critical",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    // ─── Linear Issue Relations ───
+    {
+      action: "linear.issueRelation.create",
+      resource_type: "linear:issueRelation",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID to create a relation from" },
+          relatedIssueId: { type: "string", minLength: 1, description: "Related issue ID" },
+          type: { type: "string", enum: ["blocks", "duplicate", "related", "similar"], description: "Relation type" }
+        },
+        required: ["issueId", "relatedIssueId", "type"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Create:IssueRelation"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.issueRelation.list",
+      resource_type: "linear:issueRelation",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID to list relations for" }
+        },
+        required: ["issueId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:IssueRelationList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.issueRelation.delete",
+      resource_type: "linear:issueRelation",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          relationId: { type: "string", minLength: 1, description: "Issue relation ID to delete" }
+        },
+        required: ["relationId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Delete:IssueRelation"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "relationId" }
+      },
+      version: "1.0.0"
+    },
+    // ─── Linear Cycles ───
+    {
+      action: "linear.cycle.list",
+      resource_type: "linear:cycle",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          teamId: { type: "string", description: "Filter by team ID" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of cycles to return (default 50)" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:CycleList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId", required: false }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.cycle.read",
+      resource_type: "linear:cycle",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          cycleId: { type: "string", minLength: 1, description: "Cycle ID" }
+        },
+        required: ["cycleId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:Cycle"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "cycleId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.cycle.create",
+      resource_type: "linear:cycle",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          teamId: { type: "string", minLength: 1, description: "Team ID to create the cycle in" },
+          name: { type: "string", description: "Cycle name" },
+          startsAt: { type: "string", minLength: 1, description: "Cycle start date (ISO 8601)" },
+          endsAt: { type: "string", minLength: 1, description: "Cycle end date (ISO 8601)" },
+          description: { type: "string", description: "Cycle description" }
+        },
+        required: ["teamId", "startsAt", "endsAt"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Create:Cycle"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.cycle.update",
+      resource_type: "linear:cycle",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          cycleId: { type: "string", minLength: 1, description: "Cycle ID to update" },
+          name: { type: "string", description: "New cycle name" },
+          startsAt: { type: "string", description: "New start date (ISO 8601)" },
+          endsAt: { type: "string", description: "New end date (ISO 8601)" },
+          description: { type: "string", description: "New description" },
+          completedAt: { type: "string", description: "Completion date (ISO 8601) or null to unset" }
+        },
+        required: ["cycleId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Cycle"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "cycleId" }
+      },
+      version: "1.0.0"
+    },
+    // ─── Linear Labels ───
+    {
+      action: "linear.label.create",
+      resource_type: "linear:label",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          name: { type: "string", minLength: 1, description: "Label name" },
+          color: { type: "string", description: "Label color (hex, e.g. #FF0000)" },
+          description: { type: "string", description: "Label description" },
+          teamId: { type: "string", description: "Team ID to scope the label to (omit for workspace-level label)" }
+        },
+        required: ["name"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Create:Label"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId", required: false }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.label.update",
+      resource_type: "linear:label",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          labelId: { type: "string", minLength: 1, description: "Label ID to update" },
+          name: { type: "string", description: "New label name" },
+          color: { type: "string", description: "New label color (hex)" },
+          description: { type: "string", description: "New description" }
+        },
+        required: ["labelId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Label"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "labelId" }
+      },
+      version: "1.0.0"
+    },
+    // ─── Linear Attachments ───
+    {
+      action: "linear.attachment.create",
+      resource_type: "linear:attachment",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID to attach to" },
+          title: { type: "string", minLength: 1, description: "Attachment title" },
+          url: { type: "string", minLength: 1, description: "Attachment URL" },
+          subtitle: { type: "string", description: "Attachment subtitle" }
+        },
+        required: ["issueId", "title", "url"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Create:Attachment"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.attachment.list",
+      resource_type: "linear:attachment",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID to list attachments for" }
+        },
+        required: ["issueId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:AttachmentList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.attachment.delete",
+      resource_type: "linear:attachment",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          attachmentId: { type: "string", minLength: 1, description: "Attachment ID to delete" }
+        },
+        required: ["attachmentId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Delete:Attachment"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "attachmentId" }
+      },
+      version: "1.0.0"
+    },
+    // ─── Agent Inbox Actions (internal) ───
+    // Inbox actions back the Agent Inbox MCP tools (task delegation between
+    // agents/people). They are internal (no external OAuth provider), so they
+    // carry a single nominal base scope `inbox` to satisfy the registry
+    // meta-schema's `minItems: 1` (same pattern as hubspot.account.link.get).
+    {
+      action: "inbox.send",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          to: { type: "string", minLength: 1, description: "Recipient (user id / handle) the task request is sent to" },
+          taskType: { type: "string", minLength: 1, description: "Type of task being requested" },
+          payload: { type: "object", description: "Task-specific payload data" },
+          message: { type: "string", description: "Optional human-readable message" }
+        },
+        required: ["to", "taskType", "payload"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Create:InboxItem"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "to" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.respond",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          id: { type: "string", minLength: 1, description: "Inbox item id being responded to" },
+          action: { type: "string", enum: ["accept", "decline", "counter"], description: "Response action" },
+          data: { type: "object", description: "Optional response data (e.g. counter-proposal)" }
+        },
+        required: ["id", "action"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Update:InboxItem"],
+      // high (not medium): an agent-mediated response (MCP invoke) must always
+      // go through human approval — the Phase 1 "always confirm" guarantee made
+      // enforceable. target_bindings below binds the concrete inbox item id so
+      // the high-risk approval has a specific resource constraint (the public
+      // /scheduling/:token link flow does NOT go through this gate — it calls
+      // InboxService.respond directly, system-key-signed).
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "id" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.check",
+      resource_type: "inbox:item",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["inbox"],
+      capability: "inbox.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          types: { type: "array", items: { type: "string" }, description: "Filter by task types" },
+          status: { type: "string", description: "Filter by item status" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.read" },
+      effects: ["Read:InboxItem"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "id", required: false }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.checkByToken",
+      resource_type: "inbox:item",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["inbox"],
+      capability: "inbox.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          token: { type: "string", minLength: 1, description: "Opaque access token for a single inbox item" }
+        },
+        required: ["token"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.read" },
+      effects: ["Read:InboxItem"],
+      risk: "low",
+      target_bindings: {
+        // inbox.checkByToken authenticates via the opaque HMAC token itself —
+        // the token IS the authorization credential and must NOT appear in logs
+        // or API error responses (resolvedResourceId surfaces on resource mismatch).
+        // This action is dispatched before requireActor() so it bypasses the
+        // normal grant-mediated authz path entirely.  We deliberately bind to a
+        // context key that the runtime never populates so that resource_id always
+        // resolves to null and the secret token never reaches resolvedResourceId.
+        resource_id: { source: "context", key: "inbox_item_id" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.complete",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          id: { type: "string", minLength: 1, description: "Inbox item id being completed" },
+          result: { type: "object", description: "Result payload for the completed task" }
+        },
+        required: ["id", "result"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Update:InboxItem"],
+      // low: inbox.complete marks an inbox item as done by the owning agent —
+      // this is an internal state update on the agent's own task list, not an
+      // external-facing write that needs human approval. (inbox.send / inbox.respond
+      // are high because they create messages visible to other people.)
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "id" }
+      },
+      version: "1.0.0"
+    },
+    // ─── Scheduling Actions (internal) ───
+    // scheduling.request is a meeting-time negotiation façade over inbox.send.
+    // Candidate slots may be supplied two ways (server-side EXCLUSIVE — exactly
+    // one): (a) `candidates` — the agent computes them LLM-side from the user
+    // calendar and the server validates + freebusy-filters them, or (b)
+    // `candidateWindow` — the agent hands the server a { start, end } window and
+    // the server generates busy-free candidates from the sender's Google
+    // Calendar. Like the inbox actions it is internal (no external OAuth
+    // provider), so it carries the single nominal base scope `inbox`.
+    //
+    // NOTE: the candidates/candidateWindow exclusivity is expressed here as
+    // `oneOf` for documentation + the deep JSON-Schema authorities, but the SDK's
+    // hand-written `validateActionInput` is a SHALLOW shape gate that does NOT
+    // interpret `oneOf` (neither key is in top-level `required`). The exclusivity
+    // (exactly one of candidates/candidateWindow) is ENFORCED server-side in
+    // SchedulingRequestService — see that service for the 400s on both-given /
+    // both-missing.
+    // Spec: docs/specs/2026-06-10-inbox-intent-routing-design.md §2.1
+    {
+      action: "scheduling.request",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          to: { type: "string", minLength: 1, description: "Counterpart (user id / email) to negotiate a meeting time with" },
+          topic: { type: "string", minLength: 1, description: "Meeting topic shown to the counterpart" },
+          durationMinutes: { type: "integer", minimum: 5, maximum: 480, description: "Meeting length in minutes" },
+          candidates: {
+            type: "array",
+            minItems: 1,
+            maxItems: 10,
+            description: "Explicit candidate slots computed by the agent from the user calendar. The server validates them AND (when Google Calendar is connected) filters out any that conflict with the sender's calendar. Mutually exclusive with candidateWindow \u2014 supply exactly one.",
+            items: {
+              type: "object",
+              properties: {
+                start: { type: "string", description: "ISO 8601 start" },
+                end: { type: "string", description: "ISO 8601 end" }
+              },
+              required: ["start", "end"],
+              additionalProperties: false
+            }
+          },
+          // candidateWindow is `{start,end}` OR an ARRAY of `{start,end}` ranges
+          // (multi-range). We declare `type: ['object', 'array']` — the SDK
+          // shallow validator (matchesType) does not handle an ARRAY of types
+          // (its switch is on a single string), so it hits `default: return true`
+          // and passes BOTH the single object and the array form (B-1 — an array
+          // must NOT be rejected before reaching the server). The union type also
+          // keeps the AJV strict-mode meta-schema happy (a `required`/`properties`
+          // subschema needs SOME type). The nested `properties`/`required` below
+          // describe the object form for the deep JSON-Schema authorities; the
+          // array element shape and the deep constraints (ISO, start<end, ≤5
+          // ranges, ≤62-day total span) are validated server-side in
+          // SchedulingRequestService.validateWindowRanges.
+          candidateWindow: {
+            type: ["object", "array"],
+            description: 'A search window OR an ARRAY of search windows the server fills with busy-free candidate slots from the sender\'s Google Calendar. Each range is `{ start, end }` (ISO 8601) \u2014 an independent contiguous interval the server searches within, spreading candidates across ranges. "\u5E73\u65E5\u5348\u5F8C" = one range per business day (Mon 13-18 / Tue 13-18 / \u2026); "\u6708\u66DC\u5348\u524D or \u6728\u66DC\u5348\u5F8C" = two ranges. A single contiguous span = one range. Max 5 ranges, total span \u2264 62 days. Mutually exclusive with candidates \u2014 supply exactly one. Requires a connected Google Calendar.',
+            properties: {
+              start: { type: "string", description: "ISO 8601 range start" },
+              end: { type: "string", description: "ISO 8601 range end" }
+            },
+            required: ["start", "end"],
+            additionalProperties: false
+          },
+          hold: {
+            type: "boolean",
+            description: "When true (or omitted, when the sender's delegation policy has holds enabled), tentatively hold the offered slots on the sender's calendar as [\u4EEE] events until the counterpart responds or the request expires. Pass false to skip holds for this request. Only takes effect when the sender has an enabled scheduling delegation policy."
+          },
+          message: { type: "string", description: "Optional human-readable message" }
+        },
+        // candidates / candidateWindow are intentionally NOT in `required`: the
+        // exclusive-choice is documented via `oneOf` and enforced server-side.
+        // Each oneOf branch re-declares its property locally (empty `properties`
+        // entry) so AJV strict mode (`strictRequired`) sees the required key as
+        // defined within the branch scope — the value shape itself is validated
+        // by the top-level `properties` above.
+        required: ["to", "topic", "durationMinutes"],
+        oneOf: [
+          { required: ["candidates"], properties: { candidates: {} } },
+          { required: ["candidateWindow"], properties: { candidateWindow: {} } }
+        ],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Create:InboxItem"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "to" }
+      },
+      version: "1.0.0"
+    },
+    // ─── PR-R2 (design §3.2): the raw booking executor's ONE new action ───
+    // The booking agent submits its scheduling proposal through a REAL PEP
+    // crossing instead of a managed custom_tool. Registered here in R2; the
+    // adapter dispatch case lands in R3.
+    //
+    // 🔴 risk: 'high' is deliberate and must NOT be downgraded. Every writing
+    // sibling (inbox.send / inbox.respond / scheduling.request) is high, and
+    // inbox.respond's own comment states that agent-mediated responses must
+    // always go through human approval. The approval basis here is the
+    // visitor's explicit "AIで日程調整する" click (or the flag-gated OIDC
+    // auto-consent), captured at mint time as a first-class ApprovalToken
+    // ledger row — NOT an absence of approval.
+    //
+    // 🪤 target_bindings.resource_id binds the BARE `itemId`. It must equal
+    // canonicalResourceId('scheduling.submit_response', { itemId }) exactly.
+    // A prefixed value (e.g. 'inbox:item/<id>') does not match the approval
+    // assertion at invoke time and the call SILENTLY falls through to
+    // auth_required (202) — no error surfaces, which is why the api side
+    // carries a preflight-parity spec asserting three-way equality
+    // (migration grant resource == assertion resource_id == invoke-time
+    // canonicalResourceId).
+    {
+      action: "scheduling.submit_response",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          itemId: { type: "string", minLength: 1, description: "The inbox item the proposal answers" },
+          decision: { type: "string", enum: ["propose", "decline"], description: "Whether the agent proposes slots or declines" },
+          slots: {
+            type: "array",
+            maxItems: 10,
+            description: "Proposed candidate slots (empty for a decline)",
+            items: {
+              type: "object",
+              properties: {
+                start: { type: "string", description: "ISO 8601 start" },
+                end: { type: "string", description: "ISO 8601 end" }
+              },
+              required: ["start", "end"],
+              additionalProperties: false
+            }
+          },
+          recommendedSlotIndex: { type: ["integer", "null"], description: "Index into slots of the recommended option, or null" },
+          recommendationReason: { type: "string", description: "Short rationale shown to the visitor" }
+        },
+        required: ["itemId", "decision"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Update:InboxItem"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "itemId" }
+      },
+      version: "1.0.0"
+    }
+  ],
+  capabilities: [
+    {
+      capability: "slack.messaging.basic",
+      description: "Post, update, and delete messages in channels",
+      includes: ["slack.message.post", "slack.message.update", "slack.message.delete"],
+      version: "1.0.0"
+    },
+    {
+      capability: "slack.read.basic",
+      description: "Read channels, messages, and user info",
+      includes: ["slack.channel.read", "slack.user.read", "slack.message.read", "slack.message.read_paginated", "slack.batch.read"],
+      version: "1.0.0"
+    },
+    {
+      capability: "github.read.basic",
+      description: "Read issues, pull requests and repository contents from repositories",
+      includes: ["github.issue.list", "github.issue.read", "github.pr.list", "github.pr.read", "github.pr.files.list", "github.pr.review.list", "github.pr.search", "github.repo.search", "github.repo.collaborator.list", "github.content.get", "github.tree.get", "github.branch.list", "github.commit.get", "github.commit.list", "github.commit.search", "github.tag.list", "github.release.list", "github.release.getLatest", "github.release.getByTag", "github.code.search", "github.issue.search", "github.issue.types.list", "github.label.get", "github.label.list", "github.workflow.get", "github.workflow.list", "github.workflow.jobLogs.get", "github.repo.starred.list", "github.user.me.get", "github.org.teams.list", "github.team.members.list", "github.user.search", "github.notification.list", "github.notification.get", "github.gist.get", "github.gist.list"],
+      version: "1.0.0"
+    },
+    {
+      capability: "github.issues.triage",
+      description: "Create and update issues, post issue comments, manage sub-issues and labels",
+      includes: ["github.issue.create", "github.issue.update", "github.issue.comment.create", "github.issue.subissue.write", "github.label.write"],
+      version: "1.0.0"
+    },
+    {
+      capability: "github.pulls.write",
+      description: "Create, update, merge, and review pull requests",
+      includes: ["github.pr.create", "github.pr.update", "github.pr.merge", "github.pr.review.create", "github.pr.comment.reply", "github.pr.branch.update"],
+      version: "1.0.0"
+    },
+    {
+      capability: "github.repos.write",
+      description: "\u30EA\u30DD\u30B8\u30C8\u30EA\u306E\u4F5C\u6210\u30FB\u30D5\u30A9\u30FC\u30AF\u30FB\u30D5\u30A1\u30A4\u30EB\u66F4\u65B0\u30FB\u30D6\u30E9\u30F3\u30C1\u4F5C\u6210\u30FB\u30EF\u30FC\u30AF\u30D5\u30ED\u30FC\u5B9F\u884C\u30FB\u30B9\u30BF\u30FC\u64CD\u4F5C",
+      includes: ["github.repo.create", "github.repo.fork", "github.content.createOrUpdate", "github.content.delete", "github.branch.create", "github.workflow.run", "github.repo.star", "github.repo.unstar"],
+      version: "1.0.0"
+    },
+    {
+      capability: "github.notifications.write",
+      description: "\u901A\u77E5\u306E\u65E2\u8AAD\u5316\u30FB\u30B9\u30EC\u30C3\u30C9/\u30EA\u30DD\u30B8\u30C8\u30EA\u306E\u8CFC\u8AAD\u8A2D\u5B9A",
+      includes: ["github.notification.markRead", "github.notification.markAllRead", "github.notification.subscription.set", "github.notification.repoSubscription.set"],
+      version: "1.0.0"
+    },
+    {
+      capability: "github.gists.write",
+      description: "Gist \u306E\u4F5C\u6210\u30FB\u66F4\u65B0",
+      includes: ["github.gist.create", "github.gist.update"],
+      version: "1.0.0"
+    },
+    {
+      capability: "gmail.read.basic",
+      description: "Read and search Gmail messages and labels",
+      includes: ["gmail.message.search", "gmail.message.read", "gmail.label.read", "gmail.batch.read"],
+      version: "1.0.0"
+    },
+    {
+      capability: "gmail.compose",
+      description: "Send emails and create drafts via Gmail",
+      includes: ["gmail.message.send", "gmail.draft.create"],
+      version: "1.0.0"
+    },
+    {
+      capability: "gmail.manage",
+      description: "Trash and permanently delete Gmail messages",
+      includes: ["gmail.message.trash", "gmail.message.delete"],
+      version: "1.0.0"
+    },
+    {
+      capability: "calendar.read.basic",
+      description: "Read and list Google Calendar events, and check free/busy availability",
+      includes: ["calendar.event.list", "calendar.event.read", "calendar.freebusy"],
+      version: "1.0.0"
+    },
+    {
+      capability: "calendar.write",
+      description: "Create, update, and delete Google Calendar events",
+      includes: ["calendar.event.create", "calendar.event.update", "calendar.event.delete"],
+      version: "1.0.0"
+    },
+    {
+      capability: "jira.read.basic",
+      description: "Read Jira issues, projects, boards, sprints, issue link types, and users",
+      includes: ["jira.project.read", "jira.board.read", "jira.sprint.read", "jira.issue.list", "jira.issue.search", "jira.worklog.read", "jira.issue.read", "jira.batch.read", "jira.comment.read", "jira.transition.list", "jira.issuelinktype.list", "jira.user.search"],
+      version: "1.0.0"
+    },
+    {
+      capability: "jira.write.basic",
+      description: "Create, update, delete Jira issues, manage issue links, and add/delete comments",
+      includes: ["jira.issue.create", "jira.issue.update", "jira.issue.delete", "jira.comment.create", "jira.comment.delete", "jira.issue.transition", "jira.issuelink.create", "jira.issuelink.delete"],
+      version: "1.0.0"
+    },
+    {
+      capability: "inbox.write",
+      description: "Send and respond to agent inbox tasks",
+      includes: ["inbox.send", "inbox.respond", "inbox.complete", "scheduling.request", "scheduling.submit_response"],
+      version: "1.0.0"
+    },
+    {
+      capability: "inbox.read",
+      description: "Read agent inbox tasks",
+      includes: ["inbox.check", "inbox.checkByToken"],
+      version: "1.0.0"
+    },
+    {
+      capability: "linear.read.basic",
+      description: "Read Linear issues, comments, projects, teams, workflow states, labels, users, viewer info, issue relations, cycles, and attachments",
+      includes: [
+        "linear.issue.list",
+        "linear.issue.read",
+        "linear.issue.search",
+        "linear.comment.list",
+        "linear.project.list",
+        "linear.project.read",
+        "linear.team.list",
+        "linear.workflowState.list",
+        "linear.viewer.read",
+        "linear.label.list",
+        "linear.user.list",
+        "linear.issueRelation.list",
+        "linear.cycle.list",
+        "linear.cycle.read",
+        "linear.attachment.list"
+      ],
+      version: "1.0.0"
+    },
+    {
+      capability: "linear.write.basic",
+      description: "Create, update, archive, delete Linear issues, comments, projects, labels, cycles, attachments, and issue relations",
+      includes: [
+        "linear.issue.create",
+        "linear.issue.update",
+        "linear.comment.create",
+        "linear.issue.archive",
+        "linear.project.create",
+        "linear.project.update",
+        "linear.comment.update",
+        "linear.comment.delete",
+        "linear.comment.resolve",
+        "linear.comment.unresolve",
+        "linear.issue.unarchive",
+        "linear.issue.addLabel",
+        "linear.issue.removeLabel",
+        "linear.issue.subscribe",
+        "linear.issue.delete",
+        "linear.issueRelation.create",
+        "linear.issueRelation.delete",
+        "linear.cycle.create",
+        "linear.cycle.update",
+        "linear.label.create",
+        "linear.label.update",
+        "linear.attachment.create",
+        "linear.attachment.delete"
+      ],
+      version: "1.0.0"
+    }
+  ]
+};
+
+// src/registry/resource-type-labels.ts
+var RESOURCE_TYPE_LABELS = {
+  "github:repo": "\u5BFE\u8C61\u30EA\u30DD\u30B8\u30C8\u30EA",
+  "github:org": "\u5BFE\u8C61\u7D44\u7E54"
+};
+
+// src/registry/action-input-validator.ts
+var SCHEMA_INDEX = (() => {
+  const map = /* @__PURE__ */ new Map();
+  for (const a of ACTION_REGISTRY.actions) {
+    if (a && typeof a.action === "string" && a.input_schema) {
+      map.set(a.action, a.input_schema);
+    }
+  }
+  return map;
+})();
+function describeExpectedShape(schema) {
+  const props = schema.properties ?? {};
+  const required = Array.isArray(schema.required) ? schema.required : [];
+  const requiredSet = new Set(required);
+  const parts = [];
+  const orderedKeys = [
+    ...required.filter((k) => k in props),
+    ...Object.keys(props).filter((k) => !requiredSet.has(k))
+  ];
+  for (const key of orderedKeys) {
+    const prop = props[key] || {};
+    const optionalMark = requiredSet.has(key) ? "" : "?";
+    const enumVals = Array.isArray(prop.enum) ? prop.enum : void 0;
+    if (enumVals && enumVals.length > 0) {
+      const rendered = enumVals.map((v) => typeof v === "string" ? `'${v}'` : String(v)).join(" | ");
+      parts.push(`${key}${optionalMark}: ${rendered}`);
+    } else {
+      parts.push(`${key}${optionalMark}`);
+    }
+  }
+  return `{ ${parts.join(", ")} }`;
+}
+function matchesType(value, type) {
+  if (!type) return true;
+  switch (type) {
+    case "string":
+      return typeof value === "string";
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+    case "number":
+      return typeof value === "number";
+    case "boolean":
+      return typeof value === "boolean";
+    case "array":
+      return Array.isArray(value);
+    case "object":
+      return typeof value === "object" && value !== null && !Array.isArray(value);
+    default:
+      return true;
+  }
+}
+function validateActionInput(action, params) {
+  const schema = SCHEMA_INDEX.get(action);
+  if (!schema) {
+    return { valid: true };
+  }
+  const props = schema.properties ?? {};
+  const required = Array.isArray(schema.required) ? schema.required : [];
+  const additionalProps = schema.additionalProperties;
+  const safeParams = params && typeof params === "object" && !Array.isArray(params) ? params : {};
+  const missing = [];
+  const unknown = [];
+  const enumErrors = [];
+  const typeErrors = [];
+  for (const key of required) {
+    if (!(key in safeParams) || safeParams[key] === void 0 || safeParams[key] === null) {
+      missing.push(key);
+    }
+  }
+  if (additionalProps === false) {
+    for (const key of Object.keys(safeParams)) {
+      if (!(key in props)) {
+        unknown.push(key);
+      }
+    }
+  }
+  for (const key of Object.keys(props)) {
+    if (!(key in safeParams)) continue;
+    const value = safeParams[key];
+    if (value === void 0 || value === null) continue;
+    const prop = props[key] || {};
+    const enumVals = Array.isArray(prop.enum) ? prop.enum : void 0;
+    if (enumVals && enumVals.length > 0) {
+      if (!enumVals.includes(value)) {
+        enumErrors.push(key);
+        continue;
+      }
+    }
+    if (!matchesType(value, prop.type)) {
+      typeErrors.push(key);
+    }
+  }
+  if (missing.length === 0 && unknown.length === 0 && enumErrors.length === 0 && typeErrors.length === 0) {
+    return { valid: true };
+  }
+  const segments = [];
+  if (missing.length > 0) {
+    segments.push(`missing required parameter(s) [${missing.join(", ")}]`);
+  }
+  if (unknown.length > 0) {
+    segments.push(`unknown parameter(s) [${unknown.join(", ")}]`);
+  }
+  if (enumErrors.length > 0) {
+    const details = enumErrors.map((key) => {
+      const enumVals = props[key]?.enum || [];
+      const rendered = enumVals.map((v) => typeof v === "string" ? `'${v}'` : String(v)).join(" | ");
+      return `${key} (allowed: ${rendered})`;
+    }).join(", ");
+    segments.push(`invalid value for enum parameter(s) [${details}]`);
+  }
+  if (typeErrors.length > 0) {
+    const details = typeErrors.map((key) => `${key} (expected ${props[key]?.type})`).join(", ");
+    segments.push(`wrong type for parameter(s) [${details}]`);
+  }
+  const message = `${action}: ${segments.join("; ")}. Expected shape: ${describeExpectedShape(schema)}`;
+  return { valid: false, errors: [message] };
+}
+
+// src/registry/resource-types.ts
+var RESOURCE_TYPES = {
+  // Slack
+  SLACK_CHANNEL: "slack:channel",
+  SLACK_USER: "slack:user",
+  SLACK_WORKSPACE: "slack:workspace",
+  // GitHub
+  GITHUB_REPO: "github:repo",
+  GITHUB_ORG: "github:org",
+  GITHUB_ISSUE: "github:issue",
+  // Google Drive
+  GOOGLE_DRIVE_FILE: "google:drive:file",
+  GOOGLE_DRIVE_FOLDER: "google:drive:folder",
+  // Gmail
+  GMAIL_THREAD: "gmail:thread",
+  GMAIL_LABEL: "gmail:label",
+  // Jira
+  JIRA_PROJECT: "jira:project",
+  JIRA_BOARD: "jira:board",
+  JIRA_ISSUE: "jira:issue",
+  JIRA_SPRINT: "jira:sprint",
+  // HubSpot
+  HUBSPOT_OBJECT: "hubspot:object",
+  HUBSPOT_PROPERTY: "hubspot:property",
+  HUBSPOT_SCHEMA: "hubspot:schema",
+  HUBSPOT_ASSOCIATION: "hubspot:association",
   HUBSPOT_ENGAGEMENT: "hubspot:engagement",
   HUBSPOT_WORKFLOW: "hubspot:workflow",
   HUBSPOT_ACCOUNT: "hubspot:account",
@@ -8258,188 +9299,773 @@ var ACTION_DISPLAY_CONFIGS = {
   "slack.message.post": {
     summaryTemplate: (p) => {
       const parts = [];
-      if (p.channel) parts.push(p.channel + ":");
-      if (p.text) parts.push(String(p.text));
+      if (p.channel) parts.push(p.channel + ":");
+      if (p.text) parts.push(String(p.text));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "channel", label: "Channel" },
+      { key: "text", label: "Message" }
+    ]
+  },
+  "gmail.message.send": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.to) parts.push(`To: ${p.to}`);
+      if (p.subject) parts.push(`Subject: ${p.subject}`);
+      return parts.join(", ");
+    },
+    displayFields: [
+      { key: "to", label: "To" },
+      { key: "subject", label: "Subject" },
+      { key: "body", label: "Body" }
+    ]
+  },
+  "gmail.draft.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.to) parts.push(`To: ${p.to}`);
+      if (p.subject) parts.push(`Subject: ${p.subject}`);
+      return parts.join(", ");
+    },
+    displayFields: [
+      { key: "to", label: "To" },
+      { key: "subject", label: "Subject" },
+      { key: "body", label: "Body" }
+    ]
+  },
+  "calendar.event.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.summary) parts.push(p.summary);
+      if (p.start) parts.push(`(${formatCalendarTime(p.start)})`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "summary", label: "Event" },
+      { key: "start", label: "Start" },
+      { key: "end", label: "End" },
+      { key: "attendees", label: "Attendees" }
+    ]
+  },
+  "calendar.event.update": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.summary) parts.push(p.summary);
+      if (p.start) parts.push(`(${formatCalendarTime(p.start)})`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "summary", label: "Event" },
+      { key: "start", label: "Start" },
+      { key: "end", label: "End" },
+      { key: "attendees", label: "Attendees" }
+    ]
+  },
+  "jira.issue.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      const projectKey = jiraField(
+        p,
+        ["projectKey", "project"],
+        "project",
+        (v) => typeof v === "string" ? v : v?.key
+      );
+      const summary = jiraField(p, ["summary"], "summary");
+      if (projectKey) parts.push(`${projectKey}:`);
+      if (summary) parts.push(summary);
+      return parts.join(" ");
+    },
+    // AIDENTITY-54: nested `fields.X` 形式と top-level canonical の両方を
+    // 拾えるよう extract を使う。assignee は null (unassign) も表示。
+    // legacy alias (project / issuetype 等) も top-level 候補に含めて後方互換を保つ。
+    displayFields: [
+      {
+        label: "Project",
+        extract: (p) => jiraField(
+          p,
+          ["projectKey", "project"],
+          "project",
+          (v) => typeof v === "string" ? v : v?.key
+        )
+      },
+      {
+        label: "Type",
+        extract: (p) => jiraField(
+          p,
+          ["issueTypeName", "issueType", "issuetype"],
+          "issuetype",
+          (v) => typeof v === "string" ? v : v?.name
+        )
+      },
+      { label: "Summary", extract: (p) => jiraField(p, ["summary"], "summary") },
+      { label: "Description", extract: (p) => jiraField(p, ["description"], "description") },
+      {
+        label: "Priority",
+        extract: (p) => jiraField(
+          p,
+          ["priority"],
+          "priority",
+          (v) => typeof v === "string" ? v : v?.name
+        )
+      },
+      { label: "Assignee", extract: extractJiraAssigneeDisplay },
+      { label: "Labels", extract: (p) => jiraField(p, ["labels"], "labels") }
+    ]
+  },
+  "jira.issue.update": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      const key = p.issueIdOrKey ?? p.issueKey;
+      const summary = jiraField(p, ["summary"], "summary");
+      if (key) parts.push(`${key}:`);
+      if (summary) parts.push(summary);
+      return parts.join(" ");
+    },
+    displayFields: [
+      // canonical は issueIdOrKey、agent が issueKey で送ってくる旧仕様も拾う。
+      { label: "Issue", extract: (p) => p.issueIdOrKey ?? p.issueKey },
+      { label: "Summary", extract: (p) => jiraField(p, ["summary"], "summary") },
+      { label: "Description", extract: (p) => jiraField(p, ["description"], "description") },
+      {
+        label: "Priority",
+        extract: (p) => jiraField(
+          p,
+          ["priority"],
+          "priority",
+          (v) => typeof v === "string" ? v : v?.name
+        )
+      },
+      // AIDENTITY-54: top-level alias (string / object) と null (unassign) も解決。
+      { label: "Assignee", extract: extractJiraAssigneeDisplay },
+      { label: "Labels", extract: (p) => jiraField(p, ["labels"], "labels") }
+    ]
+  },
+  // AIDENTITY-65: comment 本体は string と ADF document の両方を受けるため、
+  // detail 表示の ADF 描画は formatValueFull 側に任せて key 指定で OK。
+  "jira.comment.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueIdOrKey) parts.push(`${p.issueIdOrKey}:`);
+      if (p.body) parts.push(typeof p.body === "string" ? p.body : "[ADF]");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueIdOrKey", label: "Issue" },
+      { key: "body", label: "Comment" }
+    ]
+  },
+  // AIDENTITY-66: 破壊的操作なので「どの issue のどの comment を消すか」を明示する
+  // (jira.issue.delete / jira.issuelink.delete と同じ destructive 表現の方針)。
+  "jira.comment.delete": {
+    summaryTemplate: (p) => {
+      const issue = p.issueIdOrKey ?? p.issueKey;
+      const commentId = p.commentId ?? p.id;
+      if (issue && commentId) return `Delete comment ${commentId} on ${issue}`;
+      if (commentId) return `Delete comment ${commentId}`;
+      return "";
+    },
+    displayFields: [
+      { label: "Issue", extract: (p) => p.issueIdOrKey ?? p.issueKey },
+      { label: "Comment", extract: (p) => p.commentId ?? p.id }
+    ]
+  },
+  // AIDENTITY-65: API enricher が 'Link' label を upsert で書き換える。
+  "jira.issuelink.delete": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.linkId) parts.push(`Delete link ${p.linkId}`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "linkId", label: "Link" }
+    ]
+  },
+  // ─── HubSpot ───
+  "hubspot.crm.objects.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.objectType) parts.push(String(p.objectType));
+      parts.push("list");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "objectType", label: "Object Type" },
+      { key: "limit", label: "Limit" },
+      { key: "properties", label: "Properties" }
+    ]
+  },
+  "hubspot.crm.objects.search": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.objectType) parts.push(String(p.objectType));
+      if (p.query) parts.push(`"${String(p.query)}"`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "objectType", label: "Object Type" },
+      { key: "query", label: "Query" },
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "hubspot.crm.objects.batchRead": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.objectType) parts.push(String(p.objectType));
+      if (Array.isArray(p.inputs)) parts.push(`(${p.inputs.length} items)`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "objectType", label: "Object Type" },
+      { key: "inputs", label: "Records" }
+    ]
+  },
+  "hubspot.crm.objects.batchCreate": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.objectType) parts.push(String(p.objectType));
+      if (Array.isArray(p.inputs)) parts.push(`create ${p.inputs.length}`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "objectType", label: "Object Type" },
+      { key: "inputs", label: "Records" }
+    ]
+  },
+  "hubspot.crm.objects.batchUpdate": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.objectType) parts.push(String(p.objectType));
+      if (Array.isArray(p.inputs)) parts.push(`update ${p.inputs.length}`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "objectType", label: "Object Type" },
+      { key: "inputs", label: "Records" }
+    ]
+  },
+  "hubspot.crm.properties.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.objectType) parts.push(String(p.objectType));
+      parts.push("properties list");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "objectType", label: "Object Type" }
+    ]
+  },
+  "hubspot.crm.properties.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.objectType) parts.push(String(p.objectType));
+      if (p.name) parts.push(String(p.name));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "objectType", label: "Object Type" },
+      { key: "name", label: "Property Name" },
+      { key: "label", label: "Label" },
+      { key: "type", label: "Type" }
+    ]
+  },
+  "hubspot.crm.engagements.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.type) parts.push(String(p.type));
+      parts.push("engagement");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "type", label: "Type" },
+      { key: "metadata", label: "Metadata" }
+    ]
+  },
+  "hubspot.automation.workflows.list": {
+    summaryTemplate: (_p) => "List workflows",
+    displayFields: [
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "hubspot.account.userDetails.get": {
+    summaryTemplate: (_p) => "Get HubSpot account details",
+    displayFields: []
+  },
+  "hubspot.account.link.get": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.portalId) parts.push(`portal:${p.portalId}`);
+      if (Array.isArray(p.pageRequests)) parts.push(`(${p.pageRequests.length} links)`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "portalId", label: "Portal ID" },
+      { key: "pageRequests", label: "Page Requests" }
+    ]
+  },
+  // ─── Linear ───
+  "linear.issue.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      if (p.title) parts.push(String(p.title));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "title", label: "Title" },
+      { key: "description", label: "Description" },
+      { key: "stateId", label: "State" },
+      { key: "assigneeId", label: "Assignee" },
+      { key: "priority", label: "Priority" },
+      { key: "labelIds", label: "Labels" }
+    ]
+  },
+  "linear.issue.update": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      if (p.title) parts.push(String(p.title));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueId", label: "Issue" },
+      { key: "title", label: "Title" },
+      { key: "description", label: "Description" },
+      { key: "stateId", label: "State" },
+      { key: "assigneeId", label: "Assignee" },
+      { key: "priority", label: "Priority" },
+      { key: "labelIds", label: "Labels" }
+    ]
+  },
+  "linear.comment.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      if (p.body) parts.push(String(p.body));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueId", label: "Issue" },
+      { key: "body", label: "Comment" }
+    ]
+  },
+  "linear.issue.archive": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      parts.push("Archive");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueId", label: "Issue" }
+    ]
+  },
+  "linear.label.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      parts.push("List labels");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "linear.user.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      parts.push("List users");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "linear.project.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamIds) parts.push(`${Array.isArray(p.teamIds) ? p.teamIds.join(",") : String(p.teamIds)}:`);
+      if (p.name) parts.push(String(p.name));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamIds", label: "Teams" },
+      { key: "name", label: "Name" },
+      { key: "description", label: "Description" },
+      { key: "statusId", label: "Status ID" },
+      { key: "startDate", label: "Start Date" },
+      { key: "targetDate", label: "Target Date" }
+    ]
+  },
+  "linear.project.update": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.projectId) parts.push(`${p.projectId}:`);
+      if (p.name) parts.push(String(p.name));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "projectId", label: "Project" },
+      { key: "name", label: "Name" },
+      { key: "description", label: "Description" },
+      { key: "statusId", label: "Status ID" },
+      { key: "startDate", label: "Start Date" },
+      { key: "targetDate", label: "Target Date" }
+    ]
+  },
+  // ─── Linear Comment ops ───
+  "linear.comment.update": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.commentId) parts.push(`${p.commentId}:`);
+      parts.push("Update comment");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "commentId", label: "Comment" },
+      { key: "body", label: "Body" }
+    ]
+  },
+  "linear.comment.delete": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.commentId) parts.push(`Delete comment ${p.commentId}`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "commentId", label: "Comment" }
+    ]
+  },
+  "linear.comment.resolve": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.commentId) parts.push(`${p.commentId}:`);
+      parts.push("Resolve comment");
       return parts.join(" ");
     },
     displayFields: [
-      { key: "channel", label: "Channel" },
-      { key: "text", label: "Message" }
+      { key: "commentId", label: "Comment" }
     ]
   },
-  "gmail.message.send": {
+  "linear.comment.unresolve": {
     summaryTemplate: (p) => {
       const parts = [];
-      if (p.to) parts.push(`To: ${p.to}`);
-      if (p.subject) parts.push(`Subject: ${p.subject}`);
-      return parts.join(", ");
+      if (p.commentId) parts.push(`${p.commentId}:`);
+      parts.push("Unresolve comment");
+      return parts.join(" ");
     },
     displayFields: [
-      { key: "to", label: "To" },
-      { key: "subject", label: "Subject" },
-      { key: "body", label: "Body" }
+      { key: "commentId", label: "Comment" }
     ]
   },
-  "gmail.draft.create": {
+  // ─── Linear Issue ops ───
+  "linear.issue.unarchive": {
     summaryTemplate: (p) => {
       const parts = [];
-      if (p.to) parts.push(`To: ${p.to}`);
-      if (p.subject) parts.push(`Subject: ${p.subject}`);
-      return parts.join(", ");
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      parts.push("Unarchive");
+      return parts.join(" ");
     },
     displayFields: [
-      { key: "to", label: "To" },
-      { key: "subject", label: "Subject" },
-      { key: "body", label: "Body" }
+      { key: "issueId", label: "Issue" }
     ]
   },
-  "calendar.event.create": {
+  "linear.issue.addLabel": {
     summaryTemplate: (p) => {
       const parts = [];
-      if (p.summary) parts.push(p.summary);
-      if (p.start) parts.push(`(${formatCalendarTime(p.start)})`);
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      if (p.labelId) parts.push(`Add label ${p.labelId}`);
       return parts.join(" ");
     },
     displayFields: [
-      { key: "summary", label: "Event" },
-      { key: "start", label: "Start" },
-      { key: "end", label: "End" },
-      { key: "attendees", label: "Attendees" }
+      { key: "issueId", label: "Issue" },
+      { key: "labelId", label: "Label" }
     ]
   },
-  "calendar.event.update": {
+  "linear.issue.removeLabel": {
     summaryTemplate: (p) => {
       const parts = [];
-      if (p.summary) parts.push(p.summary);
-      if (p.start) parts.push(`(${formatCalendarTime(p.start)})`);
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      if (p.labelId) parts.push(`Remove label ${p.labelId}`);
       return parts.join(" ");
     },
     displayFields: [
-      { key: "summary", label: "Event" },
-      { key: "start", label: "Start" },
-      { key: "end", label: "End" },
-      { key: "attendees", label: "Attendees" }
+      { key: "issueId", label: "Issue" },
+      { key: "labelId", label: "Label" }
     ]
   },
-  "jira.issue.create": {
+  "linear.issue.subscribe": {
     summaryTemplate: (p) => {
       const parts = [];
-      const projectKey = jiraField(
-        p,
-        ["projectKey", "project"],
-        "project",
-        (v) => typeof v === "string" ? v : v?.key
-      );
-      const summary = jiraField(p, ["summary"], "summary");
-      if (projectKey) parts.push(`${projectKey}:`);
-      if (summary) parts.push(summary);
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      parts.push("Subscribe");
       return parts.join(" ");
     },
-    // AIDENTITY-54: nested `fields.X` 形式と top-level canonical の両方を
-    // 拾えるよう extract を使う。assignee は null (unassign) も表示。
-    // legacy alias (project / issuetype 等) も top-level 候補に含めて後方互換を保つ。
     displayFields: [
-      {
-        label: "Project",
-        extract: (p) => jiraField(
-          p,
-          ["projectKey", "project"],
-          "project",
-          (v) => typeof v === "string" ? v : v?.key
-        )
-      },
-      {
-        label: "Type",
-        extract: (p) => jiraField(
-          p,
-          ["issueTypeName", "issueType", "issuetype"],
-          "issuetype",
-          (v) => typeof v === "string" ? v : v?.name
-        )
-      },
-      { label: "Summary", extract: (p) => jiraField(p, ["summary"], "summary") },
-      { label: "Description", extract: (p) => jiraField(p, ["description"], "description") },
-      {
-        label: "Priority",
-        extract: (p) => jiraField(
-          p,
-          ["priority"],
-          "priority",
-          (v) => typeof v === "string" ? v : v?.name
-        )
-      },
-      { label: "Assignee", extract: extractJiraAssigneeDisplay },
-      { label: "Labels", extract: (p) => jiraField(p, ["labels"], "labels") }
+      { key: "issueId", label: "Issue" }
     ]
   },
-  "jira.issue.update": {
+  "linear.issue.delete": {
     summaryTemplate: (p) => {
       const parts = [];
-      const key = p.issueIdOrKey ?? p.issueKey;
-      const summary = jiraField(p, ["summary"], "summary");
-      if (key) parts.push(`${key}:`);
-      if (summary) parts.push(summary);
+      if (p.issueId) parts.push(`Delete issue ${p.issueId}`);
       return parts.join(" ");
     },
     displayFields: [
-      // canonical は issueIdOrKey、agent が issueKey で送ってくる旧仕様も拾う。
-      { label: "Issue", extract: (p) => p.issueIdOrKey ?? p.issueKey },
-      { label: "Summary", extract: (p) => jiraField(p, ["summary"], "summary") },
-      { label: "Description", extract: (p) => jiraField(p, ["description"], "description") },
-      {
-        label: "Priority",
-        extract: (p) => jiraField(
-          p,
-          ["priority"],
-          "priority",
-          (v) => typeof v === "string" ? v : v?.name
-        )
-      },
-      // AIDENTITY-54: top-level alias (string / object) と null (unassign) も解決。
-      { label: "Assignee", extract: extractJiraAssigneeDisplay },
-      { label: "Labels", extract: (p) => jiraField(p, ["labels"], "labels") }
+      { key: "issueId", label: "Issue" }
     ]
   },
-  // AIDENTITY-65: comment 本体は string と ADF document の両方を受けるため、
-  // detail 表示の ADF 描画は formatValueFull 側に任せて key 指定で OK。
-  "jira.comment.create": {
+  // ─── Linear Issue Relations ───
+  "linear.issueRelation.create": {
     summaryTemplate: (p) => {
       const parts = [];
-      if (p.issueIdOrKey) parts.push(`${p.issueIdOrKey}:`);
-      if (p.body) parts.push(typeof p.body === "string" ? p.body : "[ADF]");
+      if (p.issueId) parts.push(`${p.issueId}`);
+      if (p.type) parts.push(String(p.type));
+      if (p.relatedIssueId) parts.push(String(p.relatedIssueId));
       return parts.join(" ");
     },
     displayFields: [
-      { key: "issueIdOrKey", label: "Issue" },
-      { key: "body", label: "Comment" }
+      { key: "issueId", label: "Issue" },
+      { key: "type", label: "Relation Type" },
+      { key: "relatedIssueId", label: "Related Issue" }
     ]
   },
-  // AIDENTITY-66: 破壊的操作なので「どの issue のどの comment を消すか」を明示する
-  // (jira.issue.delete / jira.issuelink.delete と同じ destructive 表現の方針)。
-  "jira.comment.delete": {
+  "linear.issueRelation.list": {
     summaryTemplate: (p) => {
-      const issue = p.issueIdOrKey ?? p.issueKey;
-      const commentId = p.commentId ?? p.id;
-      if (issue && commentId) return `Delete comment ${commentId} on ${issue}`;
-      if (commentId) return `Delete comment ${commentId}`;
-      return "";
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      parts.push("List relations");
+      return parts.join(" ");
     },
     displayFields: [
-      { label: "Issue", extract: (p) => p.issueIdOrKey ?? p.issueKey },
-      { label: "Comment", extract: (p) => p.commentId ?? p.id }
+      { key: "issueId", label: "Issue" }
     ]
   },
-  // AIDENTITY-65: API enricher が 'Link' label を upsert で書き換える。
-  "jira.issuelink.delete": {
+  "linear.issueRelation.delete": {
     summaryTemplate: (p) => {
       const parts = [];
-      if (p.linkId) parts.push(`Delete link ${p.linkId}`);
+      if (p.relationId) parts.push(`Delete relation ${p.relationId}`);
       return parts.join(" ");
     },
     displayFields: [
-      { key: "linkId", label: "Link" }
+      { key: "relationId", label: "Relation" }
+    ]
+  },
+  // ─── Linear Cycles ───
+  "linear.cycle.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      parts.push("List cycles");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "linear.cycle.read": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.cycleId) parts.push(`${p.cycleId}:`);
+      parts.push("Read cycle");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "cycleId", label: "Cycle" }
+    ]
+  },
+  "linear.cycle.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      if (p.name) parts.push(String(p.name));
+      else if (p.startsAt) parts.push(`Cycle ${p.startsAt}`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "name", label: "Name" },
+      { key: "startsAt", label: "Starts At" },
+      { key: "endsAt", label: "Ends At" }
+    ]
+  },
+  "linear.cycle.update": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.cycleId) parts.push(`${p.cycleId}:`);
+      if (p.name) parts.push(String(p.name));
+      else parts.push("Update cycle");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "cycleId", label: "Cycle" },
+      { key: "name", label: "Name" },
+      { key: "startsAt", label: "Starts At" },
+      { key: "endsAt", label: "Ends At" }
+    ]
+  },
+  // ─── Linear Labels ───
+  "linear.label.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.name) parts.push(String(p.name));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "name", label: "Name" },
+      { key: "color", label: "Color" },
+      { key: "teamId", label: "Team" }
+    ]
+  },
+  "linear.label.update": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.labelId) parts.push(`${p.labelId}:`);
+      if (p.name) parts.push(String(p.name));
+      else parts.push("Update label");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "labelId", label: "Label" },
+      { key: "name", label: "Name" },
+      { key: "color", label: "Color" }
+    ]
+  },
+  // ─── Linear Attachments ───
+  "linear.attachment.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      if (p.title) parts.push(String(p.title));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueId", label: "Issue" },
+      { key: "title", label: "Title" },
+      { key: "url", label: "URL" }
+    ]
+  },
+  "linear.attachment.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      parts.push("List attachments");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueId", label: "Issue" }
+    ]
+  },
+  "linear.attachment.delete": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.attachmentId) parts.push(`Delete attachment ${p.attachmentId}`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "attachmentId", label: "Attachment" }
+    ]
+  },
+  // ─── Linear read actions (登録漏れ補完) ───
+  "linear.issue.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      parts.push("List issues");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "assigneeId", label: "Assignee" },
+      { key: "stateId", label: "State" },
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "linear.issue.read": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      parts.push("Read issue");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueId", label: "Issue" }
+    ]
+  },
+  "linear.issue.search": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      if (p.query) parts.push(String(p.query));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "query", label: "Query" },
+      { key: "teamId", label: "Team" },
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "linear.comment.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      parts.push("List comments");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueId", label: "Issue" }
+    ]
+  },
+  "linear.project.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      parts.push("List projects");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "linear.project.read": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.projectId) parts.push(`${p.projectId}:`);
+      parts.push("Read project");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "projectId", label: "Project" }
+    ]
+  },
+  "linear.team.list": {
+    summaryTemplate: (_p) => "List teams",
+    displayFields: [
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "linear.workflowState.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      parts.push("List workflow states");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "limit", label: "Limit" }
     ]
   },
+  "linear.viewer.read": {
+    summaryTemplate: (_p) => "Read viewer (current user)",
+    displayFields: []
+  },
   // AIDENTITY-83: email / displayName から accountId を解決する read action。
   "jira.user.search": {
     summaryTemplate: (p) => {
@@ -8462,7 +10088,8 @@ var ACTION_DISPLAY_CONFIGS = {
     displayFields: [
       { key: "to", label: "To" },
       { key: "taskType", label: "Task" },
-      { key: "message", label: "Message" }
+      { key: "message", label: "Message" },
+      { key: "payload", label: "Payload" }
     ]
   },
   "inbox.respond": {
@@ -8490,15 +10117,40 @@ var ACTION_DISPLAY_CONFIGS = {
     ]
   },
   "inbox.checkByToken": {
-    summaryTemplate: (p) => p.token ? `Token: ${p.token}` : "",
-    displayFields: [
-      { key: "token", label: "Token" }
-    ]
+    // token is an opaque access credential — never render it in summaries or display fields.
+    summaryTemplate: (_p) => "Check inbox by token",
+    displayFields: []
   },
   "inbox.complete": {
     summaryTemplate: (p) => p.id ? `Complete #${p.id}` : "",
     displayFields: [
-      { key: "id", label: "Item" }
+      { key: "id", label: "Item" },
+      { key: "result", label: "Result" }
+    ]
+  },
+  "scheduling.request": {
+    summaryTemplate: (p) => p.topic ? `Request scheduling: ${p.topic}` : "Request scheduling",
+    displayFields: [
+      { key: "to", label: "To" },
+      { key: "topic", label: "Topic" },
+      { key: "durationMinutes", label: "Duration (min)" },
+      { key: "candidates", label: "Candidates" },
+      { key: "message", label: "Message" }
+    ]
+  },
+  // PR-R2 (design §3.2), registry checklist B. This action is risk:'high', so
+  // its summary/displayFields are what a human actually reads in the approval
+  // and audit surfaces — the string is user-facing, not decoration. Names the
+  // item being answered (the counterpart anchor available on this action's
+  // params) the way scheduling.request names its topic.
+  "scheduling.submit_response": {
+    summaryTemplate: (p) => p.decision === "decline" ? `Decline the scheduling request for item ${p.itemId ?? "(unknown)"}` : `Submit a scheduling proposal for item ${p.itemId ?? "(unknown)"}`,
+    displayFields: [
+      { key: "itemId", label: "Inbox item" },
+      { key: "decision", label: "Decision" },
+      { key: "slots", label: "Proposed slots" },
+      { key: "recommendedSlotIndex", label: "Recommended index" },
+      { key: "recommendationReason", label: "Reason" }
     ]
   }
 };
@@ -8806,7 +10458,7 @@ function isWriteAction(action) {
   if (!meta) {
     return true;
   }
-  const writeEffectPrefixes = ["Create:", "Update:", "Delete:", "Write:", "Execute:", "Merge:", "Run:"];
+  const writeEffectPrefixes = ["Create:", "Update:", "Delete:", "Write:", "Execute:", "Merge:", "Run:", "Archive:"];
   if (meta.effects?.some((e) => writeEffectPrefixes.some((p) => e.startsWith(p)))) {
     return true;
   }