@composio/client 2.0.0-rc.1 → 2.0.0-rc.11

package/dist/{request-DwPfYYNF.mjs → generated-operations-CWhusMPU.mjs}

@@ -1,75 +1,72 @@
-//#region src/compat/error.ts
+import { i as APIUserAbortError, n as APIConnectionTimeoutError, s as ComposioError, t as APIConnectionError } from "./error-DLB1uKM3.mjs";
+
+//#region src/compat/headers.ts
+const hasEntries = (value) => typeof value === "object" && value !== null && "append" in value && typeof value.append === "function" && "delete" in value && typeof value.delete === "function" && "entries" in value && typeof value.entries === "function" && "get" in value && typeof value.get === "function";
+const isHeaders = (value) => value instanceof Headers || hasEntries(value);
+const isNullableHeadersLike = (headers) => {
+	if (!("values" in headers) || !isHeaders(headers.values) || !("nulls" in headers)) return false;
+	const nulls = headers.nulls;
+	return typeof nulls === "object" && nulls !== null && Symbol.iterator in nulls;
+};
 /**
-* Stainless-compatible error hierarchy.
-*
-* Downstream code does `instanceof` checks and reads `status` / `error` /
-* `headers` on these classes (see docs/research/drop-in-contract.md §4), so
-* both the class names and the inheritance chain are part of the drop-in
-* contract: `BadRequestError extends APIError extends ComposioError extends Error`.
+* Iterates every supported input while preserving explicit deletions. Plain
+* objects replace an older value for a key; tuple inputs append duplicate
+* values, matching the published client.
 */
-var ComposioError = class extends Error {};
-var APIError = class APIError extends ComposioError {
-	/** HTTP status for the response that caused the error. */
-	status;
-	/** HTTP headers of the response that caused the error. */
-	headers;
-	/** JSON body of the response that caused the error. */
-	error;
-	constructor(status, error, message, headers) {
-		super(APIError.makeMessage(status, error, message));
-		this.status = status;
-		this.headers = headers;
-		this.error = error;
-	}
-	static makeMessage(status, error, message) {
-		const errorMessage = error?.message;
-		const msg = errorMessage ? typeof errorMessage === "string" ? errorMessage : JSON.stringify(errorMessage) : error ? JSON.stringify(error) : message;
-		if (status && msg) return `${status} ${msg}`;
-		if (status) return `${status} status code (no body)`;
-		if (msg) return msg;
-		return "(no status code or body)";
-	}
-	static generate(status, errorResponse, message, headers) {
-		if (!status || !headers) return new APIConnectionError({
-			message,
-			cause: errorResponse
-		});
-		const error = errorResponse;
-		if (status === 400) return new BadRequestError(status, error, message, headers);
-		if (status === 401) return new AuthenticationError(status, error, message, headers);
-		if (status === 403) return new PermissionDeniedError(status, error, message, headers);
-		if (status === 404) return new NotFoundError(status, error, message, headers);
-		if (status === 409) return new ConflictError(status, error, message, headers);
-		if (status === 422) return new UnprocessableEntityError(status, error, message, headers);
-		if (status === 429) return new RateLimitError(status, error, message, headers);
-		if (status >= 500) return new InternalServerError(status, error, message, headers);
-		return new APIError(status, error, message, headers);
-	}
-};
-var APIUserAbortError = class extends APIError {
-	constructor({ message } = {}) {
-		super(void 0, void 0, message ?? "Request was aborted.", void 0);
+function* iterateHeaders(headers) {
+	if (!headers) return;
+	if (isNullableHeadersLike(headers)) {
+		yield* headers.values.entries();
+		for (const name of headers.nulls) yield [name, null];
+		return;
 	}
-};
-var APIConnectionError = class extends APIError {
-	constructor({ message, cause }) {
-		super(void 0, void 0, message ?? "Connection error.", void 0);
-		if (cause) this.cause = cause;
+	const shouldReplace = !isHeaders(headers) && !Array.isArray(headers);
+	const entries = isHeaders(headers) ? headers.entries() : Array.isArray(headers) ? headers : Object.entries(headers);
+	for (const entry of entries) {
+		const name = entry[0];
+		if (typeof name !== "string") throw new TypeError("expected header name to be a string");
+		const rawValue = entry[1];
+		const values = Array.isArray(rawValue) ? rawValue : [rawValue];
+		let replaced = false;
+		for (const value of values) {
+			if (value === void 0) continue;
+			if (shouldReplace && !replaced) {
+				replaced = true;
+				yield [name, null];
+			}
+			yield [name, value];
+		}
 	}
-};
-var APIConnectionTimeoutError = class extends APIConnectionError {
-	constructor({ message } = {}) {
-		super({ message: message ?? "Request timed out." });
+}
+/** Merge sources while retaining names explicitly deleted by the last source. */
+const mergeHeaders = (sources) => {
+	const values = new Headers();
+	const nulls = /* @__PURE__ */ new Set();
+	for (const source of sources) {
+		if (!source) continue;
+		const seen = /* @__PURE__ */ new Set();
+		for (const [name, value] of iterateHeaders(source)) {
+			const lowerName = name.toLowerCase();
+			if (!seen.has(lowerName)) {
+				values.delete(name);
+				seen.add(lowerName);
+			}
+			if (value === null) {
+				values.delete(name);
+				nulls.add(lowerName);
+			} else {
+				values.append(name, value);
+				nulls.delete(lowerName);
+			}
+		}
 	}
+	return {
+		values,
+		nulls
+	};
 };
-var BadRequestError = class extends APIError {};
-var AuthenticationError = class extends APIError {};
-var PermissionDeniedError = class extends APIError {};
-var NotFoundError = class extends APIError {};
-var ConflictError = class extends APIError {};
-var UnprocessableEntityError = class extends APIError {};
-var RateLimitError = class extends APIError {};
-var InternalServerError = class extends APIError {};
+/** Merge sources into the native header collection sent to fetch. */
+const buildHeaders = (sources) => mergeHeaders(sources).values;
 
 //#endregion
 //#region src/compat/credentials.ts
@@ -89,8 +86,9 @@ var InternalServerError = class extends APIError {};
 *    decides which one that is. See wayfinder ticket 48 and §4 of
 *    `docs/research/drop-in-contract.md`.
 * 1. **A credentialed API origin must use HTTPS.** Plain `http:` is permitted
-*    only for loopback development endpoints — which is exactly what the
-*    sanctioned `environment: 'local'` default (`http://localhost:9900`) is.
+*    only for loopback development endpoints, or for the exact origin a
+*    caller opts into with `allowInsecureHTTP` or
+*    `COMPOSIO_ALLOW_INSECURE_HTTP=1`.
 *    Enforced by {@link assertCredentialTransport} at construction and again
 *    by {@link credentialForRequest} at dispatch, because `apiKey` and
 *    `baseURL` are both public mutable fields on the client.
@@ -257,10 +255,23 @@ const parseHTTPURL = (value) => {
 		return null;
 	}
 };
+/**
+* The URL `target` names, resolved against `base`, when it lands on http(s);
+* `null` when it cannot be parsed or names a scheme this client does not
+* speak. The one spelling of "resolve against a base, http(s) only" — the
+* redirect follower and the deprecation link resolver both need exactly this.
+*/
+const resolveHTTPURL = (target, base) => {
+	try {
+		return parseHTTPURL(new URL(target, base).href);
+	} catch {
+		return null;
+	}
+};
 /** Whether a credential may be sent to this origin at all. */
-const isCredentialSafeOrigin = (url) => url.protocol === "https:" || url.protocol === "http:" && isLoopbackHostname(url.hostname);
+const isCredentialSafeOrigin = (url, allowedHTTPOrigin = null) => url.protocol === "https:" || url.protocol === "http:" && (isLoopbackHostname(url.hostname) || allowedHTTPOrigin !== null && url.origin === allowedHTTPOrigin);
 const LOOPBACK_DESCRIPTION = "localhost, *.localhost, 127.0.0.0/8, [::1]";
-const insecureOriginMessage = (baseURL) => `Refusing to send a Composio API credential to ${baseURL}: a credentialed API origin must use HTTPS. Plain http:// is permitted only for loopback development endpoints (${LOOPBACK_DESCRIPTION}). Pass an https:// baseURL, use environment: 'local', or construct the client without credentials.`;
+const insecureOriginMessage = (baseURL) => `Refusing to send a Composio API credential to ${baseURL}: a credentialed API origin must use HTTPS. By default, plain http:// is permitted only for loopback development endpoints (${LOOPBACK_DESCRIPTION}). Pass an https:// baseURL, use environment: 'local', set allowInsecureHTTP: true (or COMPOSIO_ALLOW_INSECURE_HTTP=1) for the configured development origin, or construct the client without credentials.`;
 /** Whether the client holds anything at all that rule 1 has to protect. */
 const anyCredential = (credentials) => credentials.apiKey !== null || hasAlternateCredential(credentials);
 /**
@@ -276,10 +287,10 @@ const anyCredential = (credentials) => credentials.apiKey !== null || hasAlterna
 * request carries is decided per operation, so a client holding *any* of them
 * is a client that can put one on the wire.
 */
-const assertCredentialTransport = (baseURL, credentials) => {
+const assertCredentialTransport = (baseURL, credentials, allowedHTTPOrigin = null) => {
 	if (!anyCredential(credentials)) return;
 	const url = parseHTTPURL(baseURL);
-	if (url === null || !isCredentialSafeOrigin(url)) throw new ComposioError(insecureOriginMessage(baseURL));
+	if (url === null || !isCredentialSafeOrigin(url, allowedHTTPOrigin)) throw new ComposioError(insecureOriginMessage(baseURL));
 };
 /**
 * The credential this request may carry, or `null` for none.
@@ -299,20 +310,29 @@ const assertCredentialTransport = (baseURL, credentials) => {
 * with credentials, so that one dies at the transport instead. httpx has no
 * such objection, which is why the Python port checks the same thing.)
 */
-const credentialForRequest = (baseURL, scheme, credentials, requestURL) => {
+const credentialForRequest = (baseURL, scheme, credentials, requestURL, allowedHTTPOrigin = null) => {
 	const value = valueFor(scheme, credentials);
 	if (value === null) return null;
 	const base = parseHTTPURL(baseURL);
 	const target = parseHTTPURL(requestURL);
 	if (base === null || target === null) return null;
 	if (base.origin !== target.origin) return null;
-	if (!isCredentialSafeOrigin(target)) throw new ComposioError(insecureOriginMessage(baseURL));
+	if (!isCredentialSafeOrigin(target, allowedHTTPOrigin)) throw new ComposioError(insecureOriginMessage(baseURL));
 	return {
 		name: SCHEME_HEADERS[scheme],
 		value
 	};
 };
 /**
+* Whether two absolute http(s) URLs share an origin, by the same test
+* {@link credentialForRequest} applies. An unparseable side is never the same
+* origin as anything. Python's `same_origin` is the twin.
+*/
+const sameOrigin = (a, b) => {
+	const origin = parseHTTPURL(a)?.origin;
+	return origin !== void 0 && origin === parseHTTPURL(b)?.origin;
+};
+/**
 * The credential headers a *caller* can place that are not the one this client
 * attaches — `x-api-key` is excluded because a caller setting it is overriding
 * the client's own value in the same slot, which is pinned Stainless behaviour,
@@ -336,18 +356,9 @@ const FOREIGN_CREDENTIAL_HEADERS = ["x-user-api-key", "x-org-api-key"];
 * may carry `null` to delete what an earlier one set (`buildHeaders`).
 */
 const callerPlacedCredential = (sources) => {
-	const placed = /* @__PURE__ */ new Set();
-	for (const source of sources) {
-		if (!source) continue;
-		for (const [name, value] of Object.entries(source)) {
-			const header = name.toLowerCase();
-			if (!FOREIGN_CREDENTIAL_HEADERS.includes(header)) continue;
-			if (value === void 0) continue;
-			if (value === null) placed.delete(header);
-			else placed.add(header);
-		}
-	}
-	return placed.size > 0;
+	if (!sources.some(Boolean)) return false;
+	const headers = buildHeaders(sources);
+	return FOREIGN_CREDENTIAL_HEADERS.some((name) => headers.has(name));
 };
 /**
 * Header names that carry a credential and must not survive an origin change.
@@ -425,6 +436,32 @@ const carriesCredentials = (headers) => CREDENTIAL_HEADERS.some((name) => header
 //#endregion
 //#region src/compat/deprecation.ts
 /**
+* Runtime deprecation notices, read off the response.
+*
+* The server announces a deprecated operation with three standard fields:
+*
+* - `Deprecation` (RFC 9745) — an Item Structured Field whose value is a Date
+*   (RFC 9651 §3.3.7): an `@` followed by integer seconds since the Unix
+*   epoch, e.g. `Deprecation: @1688169599`.
+* - `Sunset` (RFC 8594) — an HTTP-date, e.g. `Sunset: Sat, 31 Dec 2018
+*   23:59:59 GMT`, naming the date the operation stops being served.
+* - `Link` (RFC 8288) — `rel="deprecation"` points at human-readable notes
+*   (RFC 9745 registers that relation); `rel="successor-version"` (RFC 5829)
+*   points at the replacement resource, which this module maps back to a
+*   public client chain when it can.
+*
+* The authoring-time half of the same contract already exists: an operation
+* the input schema marks `deprecated: true` reaches the generated method as a
+* `@deprecated` annotation. This is the runtime half, and the two are
+* independent — a notice fires because the *server* said so, never because the
+* committed snapshot did, so it stays correct between spec syncs.
+*
+* Everything here is defensive by construction. A deprecation notice is
+* advisory; it must never break a live call, so a field that is oversized,
+* carries control characters, or simply does not parse is dropped rather than
+* raised.
+*/
+/**
 * Field-size ceiling. A deprecation notice is decoration on a response that
 * has already been paid for, so an oversized field is dropped rather than
 * parsed — there is no message worth building out of 2 KiB of `Link`.
@@ -633,14 +670,7 @@ const parseLinkField = (value) => {
 	}
 	return links;
 };
-const httpURL = (target, baseURL) => {
-	try {
-		const url = new URL(target, baseURL);
-		return url.protocol === "http:" || url.protocol === "https:" ? url : null;
-	} catch {
-		return null;
-	}
-};
+const httpURL = (target, baseURL) => resolveHTTPURL(target, baseURL);
 /**
 * A successor is only followed as far as *naming* it, and only when it lands
 * on the API this client is configured against.
@@ -686,6 +716,20 @@ const parseDeprecation = (headers, contextURL, baseURL) => {
 	};
 };
 const pathSegments = (path) => (path.split(/[?#]/, 1)[0] ?? "").split("/").filter((segment) => segment !== "");
+/**
+* Template segments, keyed by descriptor so the cache holds only entries the
+* operations table (or a test's stand-in for it) is still keeping alive. The
+* table is module-level and immutable, so every logical call re-split the same
+* 104 templates for nothing once the match became unconditional.
+*/
+const templateSegments = /* @__PURE__ */ new WeakMap();
+const segmentsOf = (operation) => {
+	const cached = templateSegments.get(operation);
+	if (cached !== void 0) return cached;
+	const segments = pathSegments(operation.path);
+	templateSegments.set(operation, segments);
+	return segments;
+};
 const isTemplateParam = (segment) => segment.startsWith("{") && segment.endsWith("}");
 /**
 * The operation a dispatched request belongs to, recovered from the path it
@@ -699,17 +743,20 @@ const isTemplateParam = (segment) => segment.startsWith("{") && segment.endsWith
 * (`/toolkits/{slug}` against `/toolkits/categories`) the literal wins, which
 * is the same most-specific-first rule the server routes by.
 *
-* **Known limit of recovering identity from the path.** Two accessors can emit
-* byte-identical requests — `client.toolkits.retrieve('categories')` and
+* **Known limit of recovering identity from the path**, and who still pays
+* it. Two accessors can emit byte-identical requests —
+* `client.toolkits.retrieve('categories')` and
 * `client.toolkits.retrieveCategories()` both dispatch
 * `GET /api/v3.1/toolkits/categories` — so nothing observable distinguishes
-* them here and the literal sibling is always the one named. The warning text
-* can therefore name the sibling rather than the accessor the caller wrote,
-* and the warn-once record is charged to that same sibling. This is
-* inherent to reverse-matching, not a bug in the matcher: the only fix is to
-* thread operation identity through dispatch, which this design deliberately
-* declined (wayfinder ticket 34). The affected pairs are few and the
-* consequence is a misnamed advisory, never a wrong call.
+* them here and the literal sibling is always the one named. That is inherent
+* to reverse-matching, not a bug in the matcher.
+*
+* Generated calls no longer reach this function at all: each one carries its
+* own descriptor through dispatch (`withOperation` in `request.ts`), so
+* `toolkits.retrieve('categories')` is now named as itself. What is left here
+* is the escape hatch — `client.get('/api/v3.1/toolkits/categories')` — whose
+* identity genuinely is not knowable before runtime, and for which naming the
+* literal sibling remains the honest answer.
 */
 const matchOperation = (method, path, operations) => {
 	const segments = pathSegments(path);
@@ -717,7 +764,7 @@ const matchOperation = (method, path, operations) => {
 	let bestLiterals = -1;
 	for (const operation of operations) {
 		if (operation.method !== method) continue;
-		const template = pathSegments(operation.path);
+		const template = segmentsOf(operation);
 		if (template.length !== segments.length) continue;
 		let literals = 0;
 		let matched = true;
@@ -792,10 +839,10 @@ const noticeKey = (notice) => [
 * same `Response` to `asResponse()`, `withResponse()` and the parsed path
 * alike.
 */
-const inspectDeprecation = ({ response, method, path, baseURL, operations, seen, warn }) => {
+const inspectDeprecation = ({ response, method, path, operation: known, baseURL, operations, seen, warn }) => {
 	const notice = parseDeprecation(response.headers, response.url || baseURL, baseURL);
 	if (notice === null) return;
-	const operation = matchOperation(method, path, operations);
+	const operation = known ?? matchOperation(method, path, operations);
 	const key = `${operation === null ? `${method} ${pathSegments(path).join("/")}` : operation.chain.join(".")}${KEY_SEPARATOR}${noticeKey(notice)}`;
 	if (seen.has(key)) return;
 	if (seen.size >= MAX_TRACKED_NOTICES) return;
@@ -804,10 +851,176 @@ const inspectDeprecation = ({ response, method, path, baseURL, operations, seen,
 	const subject = operation === null ? `${method.toUpperCase()} ${path}` : chainLabel(operation.chain);
 	warn(formatDeprecationWarning(subject, notice, successorChain));
 };
+/**
+* The keys a value map will actually carry on the wire. Both serializers drop
+* an entry whose value is `undefined` outright — `JSON.stringify` for a body
+* property, `stringifyQuery` for a query entry — while `null` is sent (JSON
+* `null`, or `key=`), so only `undefined` reads as "not sent". `bodyKeys`
+* relies on the same rule for its half of the surface.
+*/
+const presentKeys = (values) => new Set(Object.entries(values).filter(([, value]) => value !== void 0).map(([key]) => key));
+/**
+* The keys `body` will actually carry on the wire, at its top level, when it
+* is a plain object — `presentKeys` over it, narrowed to objects: a resource
+* method always passes an object (even an omitted optional body arrives as
+* `{}`), so this covers every real call; a non-object `body` (the raw escape
+* hatch dispatching something else entirely) has no top-level keys to check.
+*/
+const bodyKeys = (body) => typeof body === "object" && body !== null && !Array.isArray(body) ? presentKeys(body) : /* @__PURE__ */ new Set();
+/**
+* The static parameter-level warning: fires when the client sends an input
+* the committed spec marks `deprecated: true`, decided entirely from the
+* request the caller is about to send. Unlike `inspectDeprecation`, this
+* needs no response — it runs before dispatch, so a connection failure never
+* swallows it.
+*
+* One notice per (operation, sorted set of deprecated wire names present) per
+* client instance, but every input in that set is named in its own `warn`
+* call — the once-only key only suppresses an exact-repeat call, it does not
+* collapse several inputs on one call into a single message.
+*/
+const inspectDeprecatedInputs = ({ operation, query, body, headers, table, seen, warn }) => {
+	if (operation === null) return;
+	const declared = table.get(operation.chain.join("."));
+	if (declared === void 0 || declared.length === 0) return;
+	const queryKeys = presentKeys(query);
+	const bodyKeySet = bodyKeys(body);
+	const present = declared.filter((input) => {
+		if (input.in === "query") return queryKeys.has(input.wire);
+		if (input.in === "body") return bodyKeySet.has(input.wire);
+		return headers.has(input.wire);
+	});
+	if (present.length === 0) return;
+	const wireSet = [...new Set(present.map((input) => input.wire))].sort();
+	const key = `param${KEY_SEPARATOR}${operation.chain.join(".")}${KEY_SEPARATOR}${wireSet.join(",")}`;
+	if (seen.has(key)) return;
+	if (seen.size >= MAX_TRACKED_NOTICES) return;
+	seen.add(key);
+	const subject = chainLabel(operation.chain);
+	for (const input of present) {
+		const clause = input.replacementWire === null ? "" : ` Use \`${input.replacementWire}\` instead.`;
+		warn(`Composio: the \`${input.wire}\` parameter of ${subject} is deprecated.${clause}`);
+	}
+};
+
+//#endregion
+//#region src/version.ts
+const VERSION = "2.0.0-rc.11";
+
+//#endregion
+//#region src/compat/telemetry.ts
+/**
+* The runtime label and version, first match wins. Workers and Vercel Edge are
+* checked before Node because `nodejs_compat` and edge polyfills can expose
+* `process.versions.node`; neither reports a version, so a polyfilled Node
+* version is never sent as theirs.
+*/
+const detectRuntime = () => {
+	const g = globalThis;
+	if (g.Bun !== void 0) return ["bun", g.Bun.version];
+	if (g.Deno !== void 0) return ["deno", g.Deno.version?.deno];
+	if (g.navigator?.userAgent === "Cloudflare-Workers" || g.caches !== void 0 && g.WebSocketPair !== void 0) return ["cloudflare", void 0];
+	if (g.EdgeRuntime !== void 0) return ["vercel_edge", void 0];
+	if (typeof process !== "undefined" && process.versions?.node) return ["nodejs", process.versions.node];
+	if (typeof g.ServiceWorkerGlobalScope === "function" && globalThis instanceof g.ServiceWorkerGlobalScope) return ["service_worker", void 0];
+	if (g.WorkerGlobalScope !== void 0 && typeof g.importScripts === "function") return ["web_worker", void 0];
+	if (g.navigator?.product === "ReactNative") return ["react_native", void 0];
+	if (g.window !== void 0 && g.document !== void 0) return ["browser", void 0];
+	return ["unknown", void 0];
+};
+/** Caller headers override these defaults, including the calling SDK's identity. */
+const clientTelemetryHeaders = () => {
+	const [runtime, version] = detectRuntime();
+	const headers = {
+		"x-client-provenance": "@composio/client",
+		"x-client-version": VERSION,
+		"x-client-library": "@composio/client",
+		"x-client-library-version": VERSION,
+		"x-client-language": "typescript",
+		"x-client-runtime": runtime,
+		"x-runtime": runtime
+	};
+	if (version) headers["x-runtime-version"] = version;
+	return headers;
+};
 
 //#endregion
 //#region src/compat/request.ts
 /**
+* Where a generated call records *which operation it is*.
+*
+* A resource method knows its own identity at code-generation time, and until
+* now threw it away: dispatch carried only a method and a substituted path, so
+* the kernel recovered the operation by matching that path back against all
+* 104 templates on every single request (`matchOperation`). Recovery is still
+* the right answer for an escape-hatch `client.get('/api/v3.1/…')`, whose
+* identity genuinely is not knowable until runtime — but for a generated call
+* it re-derives a fact the call site already had.
+*
+* The channel is a module-private symbol rather than a `RequestOptions`
+* property, because `RequestOptions` is the Stainless options bag and its
+* shape is the product (`test/types/*.test-d.ts` pins it structurally). A
+* symbol key is invisible to that pinning, to `Object.keys`, to
+* `JSON.stringify`, and to every serializer in this file — the descriptor
+* reaches the kernel without becoming part of any public type or any byte on
+* the wire.
+*
+* It is deliberately *enumerable*: `client.get()` re-spreads the options bag
+* into `request()`, and object spread copies enumerable own symbols. A
+* non-enumerable definition would silently drop the descriptor there and
+* degrade every generated call back to matching, which is exactly the kind of
+* regression that measures fine and reports nothing.
+*/
+const OPERATION = Symbol("composio.operation");
+/**
+* Attach a generated call's operation to the options bag it dispatches with.
+*
+* Called with the freshly built literal — never with the caller's own object —
+* and *after* the caller's options have been spread into it, so a caller
+* cannot pre-empt the descriptor: the write happens last, and the key it
+* writes to is not one a caller can name.
+*/
+const withOperation = (operation, options) => {
+	options[OPERATION] = operation;
+	return options;
+};
+/** The operation a generated call recorded, or `undefined` for a raw one. */
+const readOperation = (options) => options[OPERATION];
+/** A request label safe to print: dynamic path values and URL secrets are excluded. */
+const printableURL = (url, operation) => `${new URL(url).origin}${operation?.path ?? "/<custom>"}`;
+const emitLog = (config, level, message, metadata) => {
+	try {
+		config.onLog?.(level, message, metadata);
+	} catch {}
+};
+const monotonicMillis = () => globalThis.performance?.now?.() ?? Date.now();
+const elapsedMillis = (startedAt) => Math.max(0, monotonicMillis() - startedAt);
+/**
+* Settle a dispatch when its signal aborts even if a custom transport ignores
+* the signal. The transport promise keeps a rejection handler after abort so
+* a late failure cannot become an unhandled rejection.
+*/
+const settleOnAbort = (promise, signal) => new Promise((resolve, reject) => {
+	let settled = false;
+	const cleanup = () => signal.removeEventListener("abort", onAbort);
+	const finish = (settle, value) => {
+		if (settled) return;
+		settled = true;
+		cleanup();
+		settle(value);
+	};
+	const fail = (reason) => {
+		if (settled) return;
+		settled = true;
+		cleanup();
+		reject(reason);
+	};
+	const onAbort = () => fail(/* @__PURE__ */ new Error("Request aborted"));
+	promise.then((value) => finish(resolve, value), fail);
+	signal.addEventListener("abort", onAbort, { once: true });
+	if (signal.aborted) onAbort();
+});
+/**
 * Percent-encode everything that isn't a RFC-3986 pchar, leaving safe chars
 * (unreserved / sub-delims / ":" / "@") readable.
 */
@@ -865,23 +1078,10 @@ const buildURL = (config, options) => {
 	};
 	const search = stringifyQuery(query);
 	if (search) url.search = search;
-	return url.toString();
-};
-/**
-* Merges header sources in Stainless precedence order (later wins); a `null`
-* value deletes the header, `undefined` leaves it untouched.
-*/
-const buildHeaders = (sources) => {
-	const headers = new Headers();
-	for (const source of sources) {
-		if (!source) continue;
-		for (const [name, value] of Object.entries(source)) {
-			if (value === void 0) continue;
-			if (value === null) headers.delete(name);
-			else headers.set(name, value);
-		}
-	}
-	return headers;
+	return {
+		url: url.toString(),
+		query
+	};
 };
 /**
 * JSON body encoding. A resource method always passes the `body` key when its
@@ -1009,28 +1209,35 @@ const TOO_MANY_REDIRECTS = `The API redirected more than ${MAX_REDIRECTS} times;
 const OPAQUE_REDIRECT = "The API responded with a redirect that this runtime will not let the client read (an opaque redirect, in a browser). Redirects are followed only where the response can be inspected, because a credential must never cross an origin change.";
 const isOpaqueRedirect = (response) => response.type === "opaqueredirect";
 /**
-* Fetch's own method rewrite (§4.4 "HTTP-redirect fetch", step 13): a 303
-* turns any non-GET into a GET, and a 301/302 does the same to a POST — both
-* dropping the body. 307 and 308 preserve the method and the body, which is
-* what they exist for. Following by hand means reproducing this, or a caller's
-* POST silently becomes a POST to somewhere it was never sent before.
-*/
-/**
 * The `Location` a hop points at, resolved against the URL it arrived on, or
 * `null` when there is nothing followable there — unparseable, or a scheme
 * this client does not speak (`data:`, `file:`, an app link). `null` hands the
 * 3xx back as the response it is, which is what `fetch` does with a `Location`
 * it cannot use.
 */
-const resolveLocation = (location, from) => {
-	try {
-		return parseHTTPURL(new URL(location, from).href);
-	} catch {
-		return null;
-	}
-};
+const resolveLocation = (location, from) => resolveHTTPURL(location, from);
+/**
+* Fetch's own method rewrite (§4.4 "HTTP-redirect fetch", step 13): a 303
+* turns any non-GET into a GET, and a 301/302 does the same to a POST — both
+* dropping the body. 307 and 308 preserve the method and the body, which is
+* what they exist for. Following by hand means reproducing this, or a caller's
+* POST silently becomes a POST to somewhere it was never sent before.
+*/
 const rewriteForRedirect = (status, method) => status === 303 && method !== "GET" && method !== "HEAD" || (status === 301 || status === 302) && method === "POST";
-const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const sleep = (ms, signal) => {
+	if (signal?.aborted) return Promise.reject(new APIUserAbortError());
+	return new Promise((resolve, reject) => {
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(new APIUserAbortError());
+		};
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+};
 /**
 * Indirection over `sleep` so kernel tests can capture retry delays instead
 * of waiting them out on the wall clock. Internal seam only — deliberately
@@ -1047,11 +1254,27 @@ const kernelInternals = { sleep };
 * simply does not get a key. `withdrawn` covers what that cannot — the
 * caller's own credential headers, which are legitimate on the URL the caller
 * chose and are dropped once the *server* has chosen one.
+*
+* The client's identity headers follow the same per-hop rule: they describe
+* this client to its own API, so a hop off the configured origin (a presigned
+* storage URL, a redirect target) goes without them.
 */
-const buildRequestHeaders = (config, options, requestURL, bodyHeaders, withdrawn, scheme) => {
-	const credential = withdrawn || callerPlacedCredential([config.defaultHeaders, options.headers]) ? null : credentialForRequest(config.baseURL, scheme, config.credentials, requestURL);
+const buildRequestHeaders = (config, options, requestURL, bodyHeaders, withdrawn, scheme, callerPlaced) => {
+	const credential = withdrawn || callerPlaced ? null : credentialForRequest(config.baseURL, scheme, config.credentials, requestURL, config.allowedHTTPOrigin);
+	const identity = sameOrigin(config.baseURL, requestURL) ? clientTelemetryHeaders() : void 0;
+	if (!withdrawn && bodyHeaders === void 0 && !config.defaultHeaders && !options.headers && options.idempotencyKey === void 0) {
+		const direct = new Headers({
+			...identity,
+			accept: "application/json",
+			"user-agent": config.userAgent
+		});
+		if (credential !== null) direct.set(credential.name, credential.value);
+		return direct;
+	}
 	const headers = buildHeaders([
+		{ "idempotency-key": options.idempotencyKey },
 		{
+			...identity,
 			accept: "application/json",
 			"user-agent": config.userAgent
 		},
@@ -1073,15 +1296,18 @@ const buildRequestHeaders = (config, options, requestURL, bodyHeaders, withdrawn
 * asked for is the honest answer for the whole chain, and rule 3 already
 * withdraws everything once a hop leaves the origin.
 *
-* The table is skipped outright unless a second credential is configured. With
-* only `apiKey` set the answer is `ApiKeyAuth` down every branch of
-* {@link selectScheme}, so an existing caller pays nothing for a feature they
-* do not use, and their requests are byte-identical by construction rather
-* than by assertion.
+* `operation` is the match `makeRequest` already computed for the static
+* deprecated-input check, threaded in rather than re-derived: the two
+* features need the same fact, so `matchOperation` runs once per logical call
+* regardless of which of them a given client configuration actually uses.
+* With only `apiKey` set the scheme answer is still `ApiKeyAuth` down every
+* branch of {@link selectScheme}, so an existing caller's requests stay
+* byte-identical by construction; what changed is that the match itself is no
+* longer skippable, because the deprecated-input warning needs it too.
 */
-const schemeForRequest = (config, options) => {
+const schemeForRequest = (config, operation) => {
 	if (!hasAlternateCredential(config.credentials)) return "ApiKeyAuth";
-	return selectScheme(matchOperation(options.method, options.path, config.operations ?? [])?.schemes, config.credentials);
+	return selectScheme(operation?.schemes, config.credentials);
 };
 /**
 * One attempt: the request, plus however many redirects it takes to land on a
@@ -1106,10 +1332,11 @@ const dispatchWithRedirects = async (config, options, initialURL, initialBody, i
 	let body = initialBody;
 	let bodyHeaders = initialBodyHeaders;
 	let withdrawn = false;
+	const callerPlaced = callerPlacedCredential([config.defaultHeaders, options.headers]);
 	for (let hop = 0;; hop++) {
-		const headers = buildRequestHeaders(config, options, url, bodyHeaders, withdrawn, scheme);
+		const headers = buildRequestHeaders(config, options, url, bodyHeaders, withdrawn, scheme, callerPlaced);
 		const delegated = hop === 0 && !carriesCredentials(headers);
-		const response = await config.fetch.call(void 0, url, {
+		const init = {
 			method,
 			headers,
 			...body !== void 0 ? { body } : {},
@@ -1117,7 +1344,8 @@ const dispatchWithRedirects = async (config, options, initialURL, initialBody, i
 			...options.fetchOptions,
 			redirect: delegated ? "follow" : "manual",
 			signal
-		});
+		};
+		const response = config.transport === void 0 ? await config.fetch.call(void 0, url, init) : await settleOnAbort(config.transport.send(new Request(url, init)), signal);
 		if (delegated) return response;
 		if (isOpaqueRedirect(response)) throw new APIConnectionError({ message: OPAQUE_REDIRECT });
 		if (!REDIRECT_STATUSES.has(response.status)) return response;
@@ -1156,13 +1384,29 @@ async function makeRequest(config, options) {
 	const maxRetries = options.maxRetries ?? config.maxRetries;
 	validatePositiveInteger("maxRetries", maxRetries);
 	const timeout = options.timeout ?? config.timeout;
-	const url = buildURL(config, options);
+	const { url, query } = buildURL(config, options);
 	const { body, bodyHeaders } = buildBody(options);
 	const userSignal = options.signal ?? void 0;
-	const scheme = schemeForRequest(config, options);
+	const method = options.method.toUpperCase();
+	const threaded = readOperation(options);
+	const operation = threaded ?? matchOperation(options.method, options.path, config.operations ?? []);
+	const requestLog = config.onLog === void 0 ? void 0 : {
+		method,
+		url: printableURL(url, operation),
+		maxAttempts: maxRetries + 1
+	};
+	const scheme = schemeForRequest(config, operation);
+	if (config.onRequest !== void 0 && (threaded === void 0 || threaded.hasDeprecatedInputs === true)) config.onRequest(operation, query, options.body, buildHeaders([config.defaultHeaders, options.headers]));
 	for (let numRetries = 0;; numRetries++) {
 		if (userSignal?.aborted) throw new APIUserAbortError();
+		const attempt = numRetries + 1;
 		const retriesRemaining = maxRetries - numRetries;
+		const startedAt = requestLog === void 0 ? 0 : monotonicMillis();
+		const attemptLog = requestLog === void 0 ? void 0 : {
+			...requestLog,
+			attempt
+		};
+		if (attemptLog !== void 0) emitLog(config, "debug", "Sending request", attemptLog);
 		const controller = new AbortController();
 		const abort = () => controller.abort();
 		userSignal?.addEventListener("abort", abort, { once: true });
@@ -1171,25 +1415,68 @@ async function makeRequest(config, options) {
 		try {
 			result = await dispatchWithRedirects(config, options, url, body, bodyHeaders, controller.signal, scheme);
 		} catch (cause) {
-			if (cause instanceof ComposioError) throw cause;
+			if (cause instanceof ComposioError) {
+				if (attemptLog !== void 0) emitLog(config, "info", "Request failed", {
+					...attemptLog,
+					durationMs: elapsedMillis(startedAt),
+					errorType: cause.constructor.name
+				});
+				throw cause;
+			}
 			result = castToError(cause);
 		} finally {
 			clearTimeout(timer);
 			userSignal?.removeEventListener("abort", abort);
 		}
 		if (result instanceof Error) {
-			if (userSignal?.aborted) throw new APIUserAbortError();
+			if (userSignal?.aborted) {
+				if (attemptLog !== void 0) emitLog(config, "info", "Request failed", {
+					...attemptLog,
+					durationMs: elapsedMillis(startedAt),
+					errorType: APIUserAbortError.name
+				});
+				throw new APIUserAbortError();
+			}
 			const isTimeout = controller.signal.aborted || /timed? ?out/i.test(String(result) + ("cause" in result ? String(result.cause) : ""));
+			const errorType = isTimeout ? APIConnectionTimeoutError.name : APIConnectionError.name;
+			if (attemptLog !== void 0) emitLog(config, "info", "Request failed", {
+				...attemptLog,
+				durationMs: elapsedMillis(startedAt),
+				errorType
+			});
 			if (retriesRemaining > 0) {
-				await kernelInternals.sleep(retryDelayMillis(numRetries));
+				const delayMs = retryDelayMillis(numRetries);
+				if (attemptLog !== void 0) emitLog(config, "info", "Retrying request", {
+					...attemptLog,
+					nextAttempt: attempt + 1,
+					retriesRemaining,
+					delayMs,
+					reason: isTimeout ? "timeout" : "transport"
+				});
+				await kernelInternals.sleep(delayMs, userSignal);
 				continue;
 			}
 			if (isTimeout) throw new APIConnectionTimeoutError();
 			throw new APIConnectionError({ cause: result });
 		}
+		if (attemptLog !== void 0) emitLog(config, "info", "Received response", {
+			...attemptLog,
+			status: result.status,
+			outcome: result.ok ? "success" : "http_error",
+			durationMs: elapsedMillis(startedAt)
+		});
 		if (!result.ok && retriesRemaining > 0 && shouldRetryResponse(result)) {
 			result.body?.cancel().catch(() => void 0);
-			await kernelInternals.sleep(retryDelayMillis(numRetries, result.headers));
+			const delayMs = retryDelayMillis(numRetries, result.headers);
+			if (attemptLog !== void 0) emitLog(config, "info", "Retrying request", {
+				...attemptLog,
+				nextAttempt: attempt + 1,
+				retriesRemaining,
+				delayMs,
+				reason: "response",
+				status: result.status
+			});
+			await kernelInternals.sleep(delayMs, userSignal);
 			continue;
 		}
 		if (config.onResponse !== void 0) try {
@@ -1200,4 +1487,826 @@ async function makeRequest(config, options) {
 }
 
 //#endregion
-export { PermissionDeniedError as _, inspectDeprecation as a, APIConnectionTimeoutError as c, AuthenticationError as d, BadRequestError as f, NotFoundError as g, InternalServerError as h, safeJSON as i, APIError as l, ConflictError as m, makeRequest as n, assertCredentialTransport as o, ComposioError as p, path as r, APIConnectionError as s, castToError as t, APIUserAbortError as u, RateLimitError as v, UnprocessableEntityError as y };
+//#region src/compat/generated-operations.ts
+const GENERATED_OPERATIONS = [
+	{
+		method: "delete",
+		path: "/api/v3.1/auth_configs/{nanoid}",
+		chain: ["authConfigs", "delete"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/connected_accounts/{nanoid}",
+		chain: ["connectedAccounts", "delete"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/custom/toolkits/{slug}",
+		chain: ["custom", "deleteToolkit"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/mcp/servers/{serverId}/instances/{instanceId}",
+		chain: ["mcp", "deleteInstance"]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/mcp/{id}",
+		chain: ["mcp", "delete"]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/org/owner/project/{nano_id}",
+		chain: [
+			"org",
+			"owner",
+			"project",
+			"delete"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/tool_router/session/{session_id}",
+		chain: [
+			"toolRouter",
+			"session",
+			"delete"
+		]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/trigger_instances/manage/{triggerId}",
+		chain: [
+			"triggerInstances",
+			"manage",
+			"delete"
+		],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/webhook_subscriptions/{id}",
+		chain: ["webhookSubscriptions", "delete"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/auth/session/info",
+		chain: [
+			"auth",
+			"session",
+			"retrieveInfo"
+		],
+		schemes: ["UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/auth_configs",
+		chain: ["authConfigs", "list"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/auth_configs/{nanoid}",
+		chain: ["authConfigs", "retrieve"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/cli/get-session",
+		chain: ["cli", "getSession"],
+		schemes: ["no_auth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/cli/realtime/credentials",
+		chain: [
+			"cli",
+			"realtime",
+			"credentials"
+		],
+		schemes: ["UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/connected_accounts",
+		chain: ["connectedAccounts", "list"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/connected_accounts/{nanoid}",
+		chain: ["connectedAccounts", "retrieve"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/files/list",
+		chain: ["files", "list"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/internal/action_execution/fields",
+		chain: [
+			"logs",
+			"tools",
+			"listFields"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/internal/action_execution/log/{id}",
+		chain: [
+			"logs",
+			"tools",
+			"retrieve"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/internal/trigger/log/{id}",
+		chain: [
+			"logs",
+			"triggers",
+			"retrieve"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/keyring/transfer_keys",
+		chain: ["keyring", "listTransferKeys"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/logs/tool_execution/{id}",
+		chain: ["logs", "retrieveToolExecution"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/mcp/app/{appKey}",
+		chain: ["mcp", "retrieveApp"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/mcp/servers",
+		chain: ["mcp", "list"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/mcp/servers/{serverId}/instances",
+		chain: ["mcp", "listInstances"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/mcp/{id}",
+		chain: ["mcp", "retrieve"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/org/consumer/connected_toolkits",
+		chain: [
+			"org",
+			"consumer",
+			"listConnectedToolkits"
+		],
+		schemes: ["UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/org/list",
+		chain: ["org", "list"],
+		schemes: ["UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/org/owner/project/list",
+		chain: [
+			"org",
+			"owner",
+			"project",
+			"list"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/org/owner/project/{nano_id}",
+		chain: [
+			"org",
+			"owner",
+			"project",
+			"retrieve"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/org/project/list",
+		chain: [
+			"org",
+			"project",
+			"list"
+		],
+		schemes: ["UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/session_configs",
+		chain: ["sessionConfigs", "list"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/session_configs/{session_config_id}",
+		chain: ["sessionConfigs", "retrieve"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tool_router/session/{session_id}",
+		chain: [
+			"toolRouter",
+			"session",
+			"retrieve"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tool_router/session/{session_id}/config_history",
+		chain: [
+			"toolRouter",
+			"session",
+			"configHistory"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tool_router/session/{session_id}/mounts/{mount_id}/items",
+		chain: [
+			"toolRouter",
+			"session",
+			"files",
+			"list"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tool_router/session/{session_id}/toolkits",
+		chain: [
+			"toolRouter",
+			"session",
+			"toolkits"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tool_router/session/{session_id}/tools",
+		chain: [
+			"toolRouter",
+			"session",
+			"tools"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/toolkits",
+		chain: ["toolkits", "list"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/toolkits/categories",
+		chain: ["toolkits", "retrieveCategories"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/toolkits/changelog",
+		chain: ["toolkits", "retrieveChangelog"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/toolkits/{slug}",
+		chain: ["toolkits", "retrieve"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/toolkits/{toolkit_slug}/scopes/grant_context",
+		chain: ["toolkits", "retrieveScopesGrantContext"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tools",
+		chain: ["tools", "list"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tools/enum",
+		chain: ["tools", "retrieveEnum"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tools/{tool_slug}",
+		chain: ["tools", "retrieve"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/trigger_instances/active",
+		chain: ["triggerInstances", "listActive"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/triggers_types",
+		chain: ["triggersTypes", "list"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/triggers_types/list/enum",
+		chain: ["triggersTypes", "retrieveEnum"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/triggers_types/{slug}",
+		chain: ["triggersTypes", "retrieve"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/webhook_endpoints",
+		chain: ["webhookEndpoints", "list"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/webhook_endpoints/{nano_id}",
+		chain: ["webhookEndpoints", "retrieve"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/webhook_subscriptions",
+		chain: ["webhookSubscriptions", "list"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/webhook_subscriptions/event_types",
+		chain: ["webhookSubscriptions", "listEventTypes"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/webhook_subscriptions/{id}",
+		chain: ["webhookSubscriptions", "retrieve"]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/auth_configs/{nanoid}",
+		chain: ["authConfigs", "update"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/auth_configs/{nanoid}/{status}",
+		chain: ["authConfigs", "updateStatus"]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/connected_accounts/{nanoId}/status",
+		chain: ["connectedAccounts", "updateStatus"]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/connected_accounts/{nanoid}",
+		chain: ["connectedAccounts", "patch"]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/mcp/{id}",
+		chain: ["mcp", "update"]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/tool_router/session/{session_id}",
+		chain: [
+			"toolRouter",
+			"session",
+			"patch"
+		]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/trigger_instances/manage/{triggerId}",
+		chain: [
+			"triggerInstances",
+			"manage",
+			"update"
+		],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/webhook_endpoints/{nano_id}",
+		chain: ["webhookEndpoints", "update"]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/webhook_subscriptions/{id}",
+		chain: ["webhookSubscriptions", "update"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/api_key_revocation",
+		chain: ["apiKeyRevocation", "create"],
+		schemes: ["no_auth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/auth_configs",
+		chain: ["authConfigs", "create"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/cli/codact_failures",
+		chain: ["cli", "createCodactFailure"],
+		schemes: ["UserApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/cli/create-session",
+		chain: ["cli", "createSession"],
+		schemes: ["no_auth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/cli/realtime/auth",
+		chain: [
+			"cli",
+			"realtime",
+			"auth"
+		],
+		schemes: ["UserApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/connected_accounts",
+		chain: ["connectedAccounts", "create"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/connected_accounts/complete_auth",
+		chain: ["connectedAccounts", "completeAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/connected_accounts/link",
+		chain: ["link", "create"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/connected_accounts/{nanoid}/refresh",
+		chain: ["connectedAccounts", "refresh"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/connected_accounts/{nanoid}/revoke",
+		chain: ["connectedAccounts", "revoke"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/custom/toolkits/sync",
+		chain: ["custom", "sync"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/custom/toolkits/upsert",
+		chain: ["custom", "upsert"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/files/upload/request",
+		chain: ["files", "createPresignedURL"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/internal/action_execution/logs",
+		chain: [
+			"logs",
+			"tools",
+			"list"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/internal/trigger/logs",
+		chain: [
+			"logs",
+			"triggers",
+			"list"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/logs/tool_execution",
+		chain: ["logs", "createToolExecution"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/mcp/servers",
+		chain: ["mcp", "create"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/mcp/servers/custom",
+		chain: [
+			"mcp",
+			"custom",
+			"create"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/mcp/servers/generate",
+		chain: [
+			"mcp",
+			"generate",
+			"url"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/mcp/servers/{serverId}/instances",
+		chain: ["mcp", "createInstance"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/org/clanker/create_claim",
+		chain: [
+			"org",
+			"clanker",
+			"createClaim"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/org/consumer/project/resolve",
+		chain: [
+			"org",
+			"consumer",
+			"project",
+			"resolve"
+		],
+		schemes: ["UserApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/org/owner/project/new",
+		chain: [
+			"org",
+			"owner",
+			"project",
+			"create"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/org/owner/project/{nano_id}/regenerate_api_key",
+		chain: [
+			"org",
+			"owner",
+			"project",
+			"regenerateAPIKey"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/org/usage/summary",
+		chain: [
+			"org",
+			"usage",
+			"retrieveSummary"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/org/usage/{entity_type}",
+		chain: [
+			"org",
+			"usage",
+			"retrieve"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/project/usage/summary",
+		chain: [
+			"project",
+			"usage",
+			"retrieveSummary"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/project/usage/{entity_type}",
+		chain: [
+			"project",
+			"usage",
+			"retrieve"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session",
+		chain: [
+			"toolRouter",
+			"session",
+			"create"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/attach",
+		chain: [
+			"toolRouter",
+			"session",
+			"attach"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/execute",
+		chain: [
+			"toolRouter",
+			"session",
+			"execute"
+		],
+		schemes: ["ApiKeyAuth", "workbench_access_key"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/execute_meta",
+		chain: [
+			"toolRouter",
+			"session",
+			"executeMeta"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/link",
+		chain: [
+			"toolRouter",
+			"session",
+			"link"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/mounts/{mount_id}/delete",
+		chain: [
+			"toolRouter",
+			"session",
+			"files",
+			"delete"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/mounts/{mount_id}/download_url",
+		chain: [
+			"toolRouter",
+			"session",
+			"files",
+			"createDownloadURL"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/mounts/{mount_id}/upload_url",
+		chain: [
+			"toolRouter",
+			"session",
+			"files",
+			"createUploadURL"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/proxy_execute",
+		chain: [
+			"toolRouter",
+			"session",
+			"proxyExecute"
+		],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/search",
+		chain: [
+			"toolRouter",
+			"session",
+			"search"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/toolkits/multi",
+		chain: ["toolkits", "retrieveMulti"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/toolkits/{toolkit_slug}/scopes/recommended",
+		chain: ["toolkits", "recommendScopes"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tools/execute/proxy",
+		chain: ["tools", "proxy"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tools/execute/{tool_slug}",
+		chain: ["tools", "execute"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tools/execute/{tool_slug}/input",
+		chain: ["tools", "getInput"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tools/scopes/required",
+		chain: ["tools", "retrieveRequiredScopes"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/trigger_instances/{slug}/upsert",
+		chain: ["triggerInstances", "upsert"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/webhook_endpoints",
+		chain: ["webhookEndpoints", "create"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/webhook_endpoints/{nano_id}",
+		chain: ["webhookEndpoints", "replace"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/webhook_subscriptions",
+		chain: ["webhookSubscriptions", "create"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/webhook_subscriptions/{id}/rotate_secret",
+		chain: ["webhookSubscriptions", "rotateSecret"]
+	}
+];
+/**
+* The same descriptors, indexed by public chain — what a generated resource
+* resolves its own operation from at module load, so the kernel reads
+* identity off the call instead of recovering it from the URL.
+*
+* Built from the array rather than emitted a second time, so the two indexes
+* hold the *same objects* and cannot drift apart.
+*/
+const GENERATED_OPERATIONS_BY_KEY = new Map(GENERATED_OPERATIONS.map((operation) => [operation.chain.join("."), operation]));
+/**
+* The descriptor a generated method dispatches with. A miss is a generator
+* defect, not a runtime condition, so it fails at import time rather than
+* silently degrading that method back to path matching.
+*/
+const generatedOperation = (chainKey) => {
+	const operation = GENERATED_OPERATIONS_BY_KEY.get(chainKey);
+	if (operation === void 0) throw new Error(`generated-operations: no operation for chain '${chainKey}'`);
+	return operation;
+};
+
+//#endregion
+export { path as a, withOperation as c, inspectDeprecation as d, assertCredentialTransport as f, makeRequest as i, VERSION as l, mergeHeaders as m, generatedOperation as n, readOperation as o, parseHTTPURL as p, castToError as r, safeJSON as s, GENERATED_OPERATIONS as t, inspectDeprecatedInputs as u };