EXTENSIONS

ASCII-armored OpenPGP private key operations via the local gpg binary — inspect, extend expiry, sign-and-verify, upload to keyserver. Runs each invocation against an ephemeral GNUPGHOME so the host keyring is never touched. Auto-detects raw armored or base64-encoded armored key material on import (works around vault providers that strip newlines from multi-line field values).

Take a single base OCI image identifier and emit its security-patched counterpart under the HiveMQ naming convention (<registry>/<namespace>/<flattened>:<tag>-hivemq-patched-<date>). A pure logic model (`plan` generates the security-upgrade Dockerfile + derives the re-homed target; `verify` asserts the expected fixed package versions) plus a bundled workflow that orchestrates a container CLI wrapper around it: plan, build the multi-arch image, verify the expected versions on every platform of it, then push. Two workflow variants ship: the Apple @hivemq/container engine (self-hosted macOS) and @hivemq/docker (standard Linux/GitHub-hosted runners). Motivated by PLT-941 (openssl CVE-2026-45447): own the patch cadence instead of waiting on upstream base rebuilds. Registry credentials are injected from a swamp vault at run time and never persisted in a committed instance.

GitHub pull-request and file-commit operations. Octokit-backed PR creation, merging, and fan-out across repos, plus gh-CLI-backed commitFile (branch creation + single-file commit) and openPullRequest (PR opening from an existing head→base pair) for one-shot file updates without a local checkout or token. dryRun supported on commitFile and openPullRequest.

Thin swamp wrapper around the `docker` CLI. Image-lifecycle subset: `build` (single-platform, locally runnable), `run`, `buildInspectPlatforms` (build each arch single-arch with `buildx --load` + run an inspection command, capturing all output in one `inspected` resource — the verify-before-push primitive), `login`, and `buildx build --push` (multi-arch build + push). Each method mirrors a `docker` subcommand so workflows can drive the build/run/publish lifecycle without bespoke shell steps.

A declared fleet of base OCI images we keep security-patched. The whole job — what to patch (`source` = registry/repository/tag), how (`patch`, default: apply all pending security updates), where to publish (`destination` = repository/tag under a run-time `registry`), and what to assert (`expect`, optional version floor) — lives in the model instance's `globalArguments.images`, so a single `swamp model method run <instance> patch --input registry=<registry[/namespace]>` builds, verifies, and pushes every image. The destination registry is the `registry` arg (or `globalArguments.registry`), so one instance retargets to a different registry per run. No workflow. Verify is foreknowledge-free (asserts no security updates remain pending on every platform), which fits a scheduled cadence; an optional per-image `expect` adds a version floor. Composes the pure logic of @hivemq/oci/image/patch and the buildx wrapper of @hivemq/docker; it is the only one of the three that drives buildx. Motivated by PLT-941 (openssl CVE-2026-45447): own the patch cadence instead of waiting on upstream base rebuilds.

Azure infrastructure management via az CLI — 43 model types covering compute, networking, data, security, RBAC, Azure Policy, Defender for Cloud, Entra directory, monitoring, DNS, DevOps, Azure AI Foundry (accounts, model deployments, projects, quota), AI Search, Cosmos DB, PostgreSQL Flexible Server, Static Web Apps, Service Bus, Event Grid, Recovery Services, Log Analytics, subscription-wide topology with Mermaid diagrams and cost estimation, actual-spend cost analysis and waste auditing via Cost Management/Resource Graph/Advisor, and the Azure AI Vision Face REST API for identity-aware room services.

Git repository operations for swamp workflows. Wraps the git CLI

Read, write, and delete secrets stored in AWS Secrets Manager, with support

Ask TypeSafe's System One models (Jev) typed questions from swamp and

Observe and directly synchronize local Reolink camera clocks.

Snyk Projects — project listing, attributes, relationships, and target management

Datadog Security Signals — signal search, triage, and archiving

Datadog Events — event search and submission

Agent-guided organization design simulation model inspired by the Curious

Document-to-knowledge ingestion pipeline powered by Firecrawl's anydoc.

Datadog Security Rules — detection rule CRUD and management

Unified daily operator briefing report. A workflow-scope report over the

Guides teams through applying Domain-Driven Design to existing projects.

Datadog On-Call — on-call schedules, escalation policies, and routing

Agile threat modeling as an agent-guided concept model.

Datadog DORA Metrics — deployment frequency, lead time, MTTR, and change failure rate

Datadog Monitors — monitor definitions, muting, status, and downtime management

Datadog Metrics — metric queries, submissions, tag configurations, and metadata

Datadog Downtimes — scheduled downtime management for monitors