@composio/client 2.0.0-rc.16 → 2.0.0-rc.18

package/dist/effect.mjs

@@ -1,7 +1,7 @@
-import { h as makeAPIErrorMessage, m as errorDetails, s as ComposioError } from "./error-D9cG225M.mjs";
-import { A as parseHTTPURL, C as inspectDeprecatedInputs, D as assertCredentialTransport, E as SCHEME_HEADERS, M as buildHeaders, N as mergeHeaders, O as callerPlacedCredential, S as VERSION, T as matchOperation, _ as schemeForRequest, a as TOO_MANY_REDIRECTS, c as buildURL, d as path, f as printableURL, g as safeJSON, h as rewriteForRedirect, i as REDIRECT_STATUSES, j as resolveHTTPURL, k as carriesCredentials, m as retryDelayMillis, n as generatedOperation, o as buildBody, r as OPAQUE_REDIRECT, s as buildRequestHeaders, t as GENERATED_OPERATIONS, v as shouldRetryResponse, w as inspectDeprecation, y as validatePositiveInteger } from "./generated-operations-DrhN6W_k.mjs";
-import { r as classifySuccessBody, t as GENERATED_DEPRECATED_INPUTS } from "./generated-deprecated-inputs-B6o8D8ub.mjs";
-import { i as standardNextCursor, n as assertPageItems, r as isFinalCursor, t as assertCursorAdvanced } from "./pagination-rules-uMUdPq_7.mjs";
+import { h as makeAPIErrorMessage, m as errorDetails, s as ComposioError } from "./error-Bw7_G2NZ.mjs";
+import { B as unusableKeyError, C as resolveIdentity, D as inspectDeprecatedInputs, E as mergeHeaders, F as chooseCredential, G as resolveHTTPURL, H as assertCredentialTransport, I as isUsableKey, K as sameOrigin, L as resolveAuth, M as assertRequiredOperationHeaders, N as authConstructors, O as inspectDeprecation, P as authFromCredentials, R as resolveScope, S as reservedHeaders, T as buildHeaders, U as carriesCredentials, V as SCHEME_HEADERS, W as parseHTTPURL, _ as shouldRetryResponse, a as TOO_MANY_REDIRECTS, c as buildURL, d as path, f as printableURL, g as safeJSON, h as rewriteForRedirect, i as REDIRECT_STATUSES, j as assertNoRemovedCredentialOptions, k as matchOperation, m as retryDelayMillis, n as generatedOperation, o as buildBody, q as schemeHeader, r as OPAQUE_REDIRECT, s as buildRequestHeaders, t as GENERATED_OPERATIONS, v as validatePositiveInteger, w as VERSION, x as assertNoReservedHeaders, z as scopeForCall } from "./generated-operations-DKgGT6Dg.mjs";
+import { r as classifySuccessBody, t as GENERATED_DEPRECATED_INPUTS } from "./generated-deprecated-inputs-zx6ml908.mjs";
+import { i as standardNextCursor, n as assertPageItems, r as isFinalCursor, t as assertCursorAdvanced } from "./pagination-rules-CMnBwktJ.mjs";
 import { Config, Context, Data, Effect, Exit, Layer, Match, Option, Predicate, Redacted, Result, Stream, Tracer } from "effect";
 import * as FetchHttpClient from "effect/http/FetchHttpClient";
 import * as HttpClient from "effect/http/HttpClient";
@@ -12,68 +12,6 @@ import { StatusCodeError, isHttpClientError } from "effect/http/HttpClientError"
 import * as HttpClientRequest from "effect/http/HttpClientRequest";
 import * as UrlParams from "effect/http/UrlParams";
 
-//#region src/effect/credentials.ts
-/**
-* How the Effect kernel holds credentials, and how it keeps them out of what
-* the transport records.
-*
-* Which credential a request carries, and where it may go, is decided by the
-* compat kernel's own functions (`../compat/credentials.ts`); nothing here
-* restates a rule. What is specific to this surface is the wrapping — a
-* credential is a `Redacted` for as long as the client holds it — and Effect's
-* redaction list, which knows `x-api-key` and not the other two schemes.
-*/
-const reveal = (credential) => credential === null ? null : Redacted.value(credential);
-/** The credentials in the plain form the compat functions take. Never stored. */
-const revealCredentials = (held) => ({
-	apiKey: reveal(held.apiKey),
-	userApiKey: reveal(held.userApiKey),
-	orgApiKey: reveal(held.orgApiKey)
-});
-const OPTION_HEADERS = {
-	apiKey: SCHEME_HEADERS.ApiKeyAuth,
-	userApiKey: SCHEME_HEADERS.UserApiKeyAuth,
-	orgApiKey: SCHEME_HEADERS.OrgApiKeyAuth
-};
-const CREDENTIAL_OPTIONS = Object.keys(OPTION_HEADERS);
-/** Whether the platform's `Headers` takes `value` under `name`. Its refusal quotes the value, so it stays here. */
-const isSendable = (name, value) => {
-	try {
-		new globalThis.Headers().set(name, value);
-		return true;
-	} catch {
-		return false;
-	}
-};
-/**
-* The option naming a credential no header can carry (an interior CR, LF or
-* NUL, or a character outside Latin-1), or `undefined` when all of them can be
-* sent. The answer is the option's name and never the value.
-*/
-const unsendableCredential = (held) => CREDENTIAL_OPTIONS.find((option) => {
-	const credential = held[option];
-	return credential !== null && !isSendable(OPTION_HEADERS[option], Redacted.value(credential));
-});
-const CREDENTIAL_HEADER_NAMES = Object.values(SCHEME_HEADERS);
-/** The extended list for each list seen, so a request does not rebuild it. */
-const extended = /* @__PURE__ */ new WeakMap();
-/**
-* Effect's redaction list with every credential header name on it, so a span
-* attribute or a rendering of the request made while the transport handles it
-* shows `<redacted>` for all three.
-*
-* The list in context is extended, not replaced: an application that added
-* names of its own keeps them.
-*/
-const withCredentialHeaderNames = (names) => {
-	const known = extended.get(names);
-	if (known !== void 0) return known;
-	const all = [...names, ...CREDENTIAL_HEADER_NAMES.filter((name) => !Headers.isRedactedName(name, names))];
-	extended.set(names, all);
-	return all;
-};
-
-//#endregion
 //#region src/effect/errors.ts
 /**
 * The failure model of the Effect surface: flat tagged errors, one per status
@@ -178,6 +116,88 @@ const isAPIError = (value) => kindOf(value) === "status";
 /** Whether a value is any error this surface produces. Structural, like {@link isAPIError}. */
 const isComposioError = (value) => kindOf(value) !== void 0;
 
+//#endregion
+//#region src/effect/credentials.ts
+/**
+* How the Effect kernel holds credentials, and how it keeps them out of what
+* the transport records.
+*
+* Which credential a request carries, and where it may go, is decided by the
+* compat kernel's own functions (`../compat/credentials.ts`); nothing here
+* restates a rule. What is specific to this surface is the wrapping — a
+* credential is a `Redacted` for as long as the client holds it — and Effect's
+* redaction list, which knows `x-api-key` and not the other two schemes.
+*/
+const isEffectCredential = (value) => typeof value === "string" || typeof value === "function" || Redacted.isRedacted(value);
+/** The key inside a credential that is one, and `undefined` for a provider. */
+const keyOf = (credential) => typeof credential === "string" ? credential : Redacted.isRedacted(credential) ? Redacted.value(credential) : void 0;
+/** Refuses a key no header can carry. The error names the option and never the value. */
+const checkEffectKey = (credential, option) => {
+	const key = keyOf(credential);
+	if (key !== void 0 && !isUsableKey("ApiKeyAuth", key)) throw unusableKeyError(`\`${option}\``);
+};
+/** Wraps every key `auth` holds, so the kernel never keeps one in the clear. */
+const holdAuth = (auth) => ({
+	mode: auth.mode,
+	credentials: Object.fromEntries(Object.entries(auth.credentials).map(([scheme, credential]) => [scheme, typeof credential === "function" ? credential : Redacted.isRedacted(credential) ? credential : Redacted.make(credential)]))
+});
+const reveal = (key) => typeof key === "string" ? key : Redacted.value(key);
+const providerFailed = () => new ConfigurationError({ message: "The `auth` credential provider failed." });
+/**
+* The credential one call carries, its provider asked at most once and before
+* any network work; the rule is the compat kernel's `resolveCallCredential`.
+* A configured credential is asked for only when the call starts on the API
+* origin. A provider that fails, or returns something no header can carry,
+* fails the call with a `ConfigurationError` that holds neither the
+* provider's error nor the value.
+*/
+const resolveCallCredential = (auth, baseURL, operation, supplied, requestURL) => Effect.suspend(() => {
+	let choice;
+	try {
+		choice = chooseCredential(auth, operation, supplied);
+	} catch (cause) {
+		return Effect.fail(configurationErrorFrom(cause));
+	}
+	if (choice === null) return Effect.succeed(null);
+	const name = schemeHeader(choice.scheme);
+	if (choice.kind === "operation") return Effect.succeed({
+		name,
+		value: choice.key
+	});
+	if (!sameOrigin(baseURL, requestURL)) return Effect.succeed(null);
+	const credential = choice.credential;
+	if (typeof credential !== "function") return Effect.succeed({
+		name,
+		value: Redacted.value(credential)
+	});
+	const scheme = choice.scheme;
+	return Effect.tryPromise({
+		try: async () => reveal(await credential()),
+		catch: providerFailed
+	}).pipe(Effect.flatMap((key) => isUsableKey(scheme, key) ? Effect.succeed({
+		name,
+		value: key
+	}) : Effect.fail(configurationErrorFrom(unusableKeyError("The key the `auth` credential provider returned")))));
+});
+const CREDENTIAL_HEADER_NAMES = Object.values(SCHEME_HEADERS);
+/** The extended list for each list seen, so a request does not rebuild it. */
+const extended = /* @__PURE__ */ new WeakMap();
+/**
+* Effect's redaction list with every credential header name on it, so a span
+* attribute or a rendering of the request made while the transport handles it
+* shows `<redacted>` for all three.
+*
+* The list in context is extended, not replaced: an application that added
+* names of its own keeps them.
+*/
+const withCredentialHeaderNames = (names) => {
+	const known = extended.get(names);
+	if (known !== void 0) return known;
+	const all = [...names, ...CREDENTIAL_HEADER_NAMES.filter((name) => !Headers.isRedactedName(name, names))];
+	extended.set(names, all);
+	return all;
+};
+
 //#endregion
 //#region src/effect/decode.ts
 /**
@@ -380,9 +400,11 @@ const substitute = (template, params) => {
 	const statics = template.split(PLACEHOLDER);
 	return path(Object.assign(statics, { raw: statics }), ...params);
 };
-const hopHeaders = (prepared, hop) => buildRequestHeaders(prepared.headerConfig, { headers: prepared.callHeaders }, hop.url, hop.bodyHeaders, hop.withdrawn, prepared.scheme, prepared.callerPlaced);
-const prepare = (kernel, call) => {
+const hopHeaders = (prepared, hop) => buildRequestHeaders(prepared.headerConfig, { headers: prepared.callHeaders }, hop.url, hop.bodyHeaders, hop.withdrawn, prepared.call);
+const check = (kernel, call) => {
 	const callHeaders = call.headers();
+	assertNoReservedHeaders(callHeaders, kernel.reserved, "headers");
+	if (!call.recovered) assertRequiredOperationHeaders(call.operation, call.operationHeaders);
 	const path = call.path();
 	if (call.options?.timeout !== void 0) validatePositiveInteger("timeout", call.options.timeout);
 	const resolvedRetries = call.options?.maxRetries ?? kernel.maxRetries;
@@ -399,8 +421,7 @@ const prepare = (kernel, call) => {
 		query: call.query
 	});
 	const { body, bodyHeaders } = buildBody({ body: call.body });
-	const credentials = revealCredentials(kernel);
-	const shared = {
+	return {
 		method: call.method,
 		path,
 		label: printableURL(url, call.operation),
@@ -408,35 +429,59 @@ const prepare = (kernel, call) => {
 		query,
 		headerConfig: {
 			baseURL: kernel.baseURL,
-			credentials,
 			allowedHTTPOrigin: kernel.allowedHTTPOrigin,
 			userAgent: kernel.userAgent,
-			defaultHeaders: kernel.defaultHeaders
+			defaultHeaders: kernel.defaultHeaders,
+			identity: kernel.identity
 		},
 		callHeaders,
-		scheme: schemeForRequest({ credentials }, call.operation),
-		callerPlaced: callerPlacedCredential([kernel.defaultHeaders, callHeaders]),
+		scope: scopeForCall(kernel.scope, call.operationHeaders),
 		maxRetries,
 		timeout: call.options?.timeout ?? kernel.timeout,
-		schemas: decode ? kernel.schemas : void 0
-	};
-	const first = {
+		schemas: decode ? kernel.schemas : void 0,
 		url,
-		method: call.method.toUpperCase(),
 		body,
-		bodyHeaders,
-		withdrawn: false,
-		index: 0
-	};
-	return {
-		...shared,
-		first: {
-			...first,
-			headers: hopHeaders(shared, first)
-		}
+		bodyHeaders
 	};
 };
 /**
+* A call resolved against the client: checked, its credential resolved once
+* (a provider is asked here, and its key reused by every attempt and hop),
+* and its first hop built. Whatever fails here is the caller's setup, never
+* the network, and is not retried.
+*/
+const prepare = (kernel, call) => Effect.flatMap(Effect.try({
+	try: () => check(kernel, call),
+	catch: configurationErrorFrom
+}), (checked) => Effect.flatMap(resolveCallCredential(kernel.auth, kernel.baseURL, call.operation, call.operationHeaders, checked.url), (credential) => Effect.try({
+	try: () => {
+		const { scope, url, body, bodyHeaders, ...rest } = checked;
+		const shared = {
+			...rest,
+			call: {
+				credential,
+				scope
+			}
+		};
+		const first = {
+			url,
+			method: call.method.toUpperCase(),
+			body,
+			bodyHeaders,
+			withdrawn: false,
+			index: 0
+		};
+		return {
+			...shared,
+			first: {
+				...first,
+				headers: hopHeaders(shared, first)
+			}
+		};
+	},
+	catch: configurationErrorFrom
+})));
+/**
 * Built from its parts rather than through `HttpClientRequest.make`: the URL
 * already carries its query, serialized by the compat rules, and must reach
 * the transport as that exact string. The body goes out as the same JSON text
@@ -719,10 +764,7 @@ const parse = (prepared, response, headers) => {
 		catch: () => invalidJSON(prepared, response)
 	}), (body) => validated(prepared, response, body)));
 };
-const dispatch = (kernel, call) => Effect.try({
-	try: () => prepare(kernel, call),
-	catch: configurationErrorFrom
-}).pipe(Effect.flatMap((prepared) => {
+const dispatch = (kernel, call) => prepare(kernel, call).pipe(Effect.flatMap((prepared) => {
 	const noticed = call.recovered || prepared.operation?.hasDeprecatedInputs === true ? noticeDeprecatedInputs(kernel.notices, {
 		operation: prepared.operation,
 		query: prepared.query,
@@ -754,6 +796,7 @@ const executeOperation = (kernel, operation, args, options) => dispatch(kernel,
 	query: args.query,
 	body: args.body,
 	headers: () => args.headers === void 0 ? options?.headers : mergeHeaders([args.headers, options?.headers]),
+	operationHeaders: args.operationHeaders,
 	operation,
 	recovered: false,
 	options
@@ -770,6 +813,7 @@ const executeRaw = (kernel, method, path, options) => dispatch(kernel, {
 	query: options?.query,
 	body: options?.body,
 	headers: () => options?.headers,
+	operationHeaders: void 0,
 	operation: matchOperation(method, path, GENERATED_OPERATIONS),
 	recovered: true,
 	options
@@ -1204,7 +1248,7 @@ const makeCli = (kernel) => ({
 		const { "x-user-api-key": xUserApiKey, ...body } = params;
 		return executeOperation(kernel, OP_CREATE_CODACT_FAILURE, {
 			body,
-			headers: { ...xUserApiKey != null ? { "x-user-api-key": xUserApiKey } : void 0 }
+			operationHeaders: { "x-user-api-key": xUserApiKey }
 		}, options);
 	},
 	createSession: (body = {}, options) => executeOperation(kernel, OP_CREATE_SESSION, { body }, options),
@@ -1335,9 +1379,9 @@ const makeOwner = (kernel) => ({ project: makeProject$2(kernel) });
 const OP_RESOLVE = generatedOperation("org.consumer.project.resolve");
 const makeProject$1 = (kernel) => ({ resolve: (params, options) => {
 	const { "x-user-api-key": xUserApiKey, "x-org-id": xOrgId } = params;
-	return executeOperation(kernel, OP_RESOLVE, { headers: {
-		...xUserApiKey != null ? { "x-user-api-key": xUserApiKey } : void 0,
-		...xOrgId != null ? { "x-org-id": xOrgId } : void 0
+	return executeOperation(kernel, OP_RESOLVE, { operationHeaders: {
+		"x-user-api-key": xUserApiKey,
+		"x-org-id": xOrgId
 	} }, options);
 } });
 
@@ -1350,9 +1394,9 @@ const makeConsumer = (kernel) => ({
 		const { "x-user-api-key": xUserApiKey, "x-org-id": xOrgId, ...query } = params;
 		return executeOperation(kernel, OP_LIST_CONNECTED_TOOLKITS, {
 			query,
-			headers: {
-				...xUserApiKey != null ? { "x-user-api-key": xUserApiKey } : void 0,
-				...xOrgId != null ? { "x-org-id": xOrgId } : void 0
+			operationHeaders: {
+				"x-user-api-key": xUserApiKey,
+				"x-org-id": xOrgId
 			}
 		}, options);
 	}
@@ -1478,24 +1522,48 @@ const createClientResources = (kernel) => ({
 * {@link layerConfig}, which reads the `COMPOSIO_*` settings through Effect's
 * `Config` — so the `ConfigProvider` in context decides where they come from.
 */
+/**
+* The constructors of {@link Auth}, the same as the root entry's: `Auth.project(key)`,
+* `Auth.user(key)`, `Auth.organization(key)`, `Auth.auto({ ... })` and
+* `Auth.none()`. A key may be a string, a `Redacted<string>`, or a function
+* that returns either.
+*/
+const Auth = authConstructors();
 var ComposioClient = class extends Context.Service()("@composio/client/effect/ComposioClient") {};
 const DEFAULT_BASE_URL = "https://backend.composio.dev";
 const DEFAULT_MAX_RETRIES = 2;
 const DEFAULT_TIMEOUT = 6e4;
-const hold = (credential) => {
-	if (credential === null || credential === void 0) return null;
-	return Redacted.isRedacted(credential) ? credential : Redacted.make(credential);
-};
 const resolveKernel = (options, httpClient) => {
 	const baseURL = options.baseURL || DEFAULT_BASE_URL;
 	if (options.decode === true && options.schemas === void 0) return Result.fail(new ConfigurationError({ message: SCHEMAS_MISSING }));
-	const kernel = {
+	const resolved = Result.try({
+		try: () => {
+			assertNoRemovedCredentialOptions(options);
+			const auth = resolveAuth(options.auth, isEffectCredential, checkEffectKey);
+			const scope = resolveScope(options.scope);
+			const identity = resolveIdentity(options.identity);
+			const reserved = reservedHeaders(identity, {
+				auth: auth.mode !== "none",
+				scope: scope !== void 0
+			});
+			assertNoReservedHeaders(options.defaultHeaders, reserved, "defaultHeaders");
+			const allowedHTTPOrigin = options.allowInsecureHTTP ? parseHTTPURL(baseURL)?.origin ?? null : null;
+			assertCredentialTransport(baseURL, auth.mode !== "none", allowedHTTPOrigin);
+			return {
+				auth: holdAuth(auth),
+				scope,
+				identity,
+				reserved,
+				allowedHTTPOrigin
+			};
+		},
+		catch: configurationErrorFrom
+	});
+	if (Result.isFailure(resolved)) return Result.fail(resolved.failure);
+	return Result.succeed({
 		httpClient,
 		baseURL,
-		apiKey: hold(options.apiKey),
-		userApiKey: hold(options.userApiKey),
-		orgApiKey: hold(options.orgApiKey),
-		allowedHTTPOrigin: options.allowInsecureHTTP ? parseHTTPURL(baseURL)?.origin ?? null : null,
+		...resolved.success,
 		userAgent: `Composio/JS ${VERSION}`,
 		defaultHeaders: options.defaultHeaders,
 		maxRetries: options.maxRetries ?? DEFAULT_MAX_RETRIES,
@@ -1504,15 +1572,6 @@ const resolveKernel = (options, httpClient) => {
 		decode: options.decode ?? false,
 		schemas: options.schemas,
 		notices: makeNoticeRecord(options.deprecationNotices)
-	};
-	const unsendable = unsendableCredential(kernel);
-	if (unsendable !== void 0) return Result.fail(new ConfigurationError({ message: `The \`${unsendable}\` option cannot be sent as a header: it contains a line break, a NUL or a character outside Latin-1.` }));
-	return Result.try({
-		try: () => {
-			assertCredentialTransport(baseURL, revealCredentials(kernel), kernel.allowedHTTPOrigin);
-			return kernel;
-		},
-		catch: configurationErrorFrom
 	});
 };
 const fromKernel = (kernel) => ({
@@ -1528,8 +1587,9 @@ const fromKernel = (kernel) => ({
 * are built over it, and it is not part of the entry's exports.
 *
 * @throws {ConfigurationError} when a credentialed origin is not HTTPS, a
-*   credential cannot be sent as a header, or the client is to decode and was
-*   given no schemas.
+*   credential cannot be sent as a header, `identity` is invalid or
+*   `defaultHeaders` names an identity header, or the client is to decode and
+*   was given no schemas.
 */
 const makeKernel = (options, httpClient) => Result.getOrThrow(resolveKernel(options, httpClient));
 /**
@@ -1537,51 +1597,66 @@ const makeKernel = (options, httpClient) => Result.getOrThrow(resolveKernel(opti
 * Reads no environment variable.
 *
 * @throws {ConfigurationError} when a credentialed origin is not HTTPS, a
-*   credential cannot be sent as a header, or the client is to decode and was
-*   given no schemas.
+*   credential cannot be sent as a header, `identity` is invalid or
+*   `defaultHeaders` names an identity header, or the client is to decode and
+*   was given no schemas.
 */
 const make = (options, httpClient) => fromKernel(makeKernel(options, httpClient));
 /**
 * Provides the client from explicit options and the `HttpClient` in context.
 * Reads no environment variable.
 */
-const layer = (options = {}) => Layer.effect(ComposioClient, Effect.flatMap(HttpClient.HttpClient, (httpClient) => Effect.map(Effect.fromResult(resolveKernel(options, httpClient)), fromKernel)));
+const layer = (options) => Layer.effect(ComposioClient, Effect.flatMap(HttpClient.HttpClient, (httpClient) => Effect.map(Effect.fromResult(resolveKernel(options, httpClient)), fromKernel)));
 /**
 * {@link layer} over a fetch-backed `HttpClient`, for an application that has
 * no transport of its own to supply. `fetch` is the platform's, or whatever
 * the `FetchHttpClient.Fetch` reference in context names.
 */
-const layerFetch = (options = {}) => Layer.provide(layer(options), FetchHttpClient.layer);
-/** A setting as the compat client reads one: trimmed, and absent when empty. */
+const layerFetch = (options) => Layer.provide(layer(options), FetchHttpClient.layer);
+/** A setting as `Composio.fromEnv` reads one: trimmed, and absent when empty. */
 const setting = (name) => Config.map(Config.option(Config.String(name)), (value) => Option.getOrUndefined(Option.filter(Option.map(value, (text) => text.trim()), (text) => text !== "")));
+/** A key, read as `Redacted` and kept that way: trimmed, and absent when empty. */
+const secret = (name) => Config.map(Config.option(Config.Redacted(name)), (value) => Option.getOrUndefined(Option.flatMap(value, (key) => {
+	const trimmed = Redacted.value(key).trim();
+	return trimmed === "" ? Option.none() : Option.some(Redacted.make(trimmed));
+})));
 const settings = Config.all({
-	apiKey: setting("COMPOSIO_API_KEY"),
-	userApiKey: setting("COMPOSIO_USER_API_KEY"),
-	orgApiKey: setting("COMPOSIO_ORG_API_KEY"),
+	project: secret("COMPOSIO_API_KEY"),
+	user: secret("COMPOSIO_USER_API_KEY"),
+	organization: secret("COMPOSIO_ORG_API_KEY"),
 	baseURL: setting("COMPOSIO_BASE_URL"),
 	allowInsecureHTTP: setting("COMPOSIO_ALLOW_INSECURE_HTTP")
 });
 /**
-* Provides the client from the `COMPOSIO_*` settings — `COMPOSIO_API_KEY`,
-* `COMPOSIO_USER_API_KEY`, `COMPOSIO_ORG_API_KEY`, `COMPOSIO_BASE_URL` and
-* `COMPOSIO_ALLOW_INSECURE_HTTP=1` — read through the `ConfigProvider` in
-* context, which is the process environment unless the application says
-* otherwise. An option given here wins over its setting; `null` for a
-* credential means "none", whatever is configured.
+* Provides the client from the `COMPOSIO_*` settings, read through the
+* `ConfigProvider` in context, which is the process environment unless the
+* application says otherwise. `COMPOSIO_API_KEY`, `COMPOSIO_USER_API_KEY` and
+* `COMPOSIO_ORG_API_KEY` become `auth` by the rule `Composio.fromEnv` applies
+* (one set: that fixed mode; several: `Auth.auto`; none: `Auth.none()`), each
+* key `Redacted` throughout; `COMPOSIO_BASE_URL` and
+* `COMPOSIO_ALLOW_INSECURE_HTTP=1` are read too. `COMPOSIO_ORG_ID` and
+* `COMPOSIO_PROJECT_ID` are not: `scope` is an argument. An option given here
+* replaces the whole setting it names, so `{ auth: Auth.none() }` means none
+* whatever is configured.
 */
-const layerConfig = (options = {}) => Layer.effect(ComposioClient, Effect.gen(function* () {
+const layerConfig = (overrides = {}) => Layer.effect(ComposioClient, Effect.gen(function* () {
 	const httpClient = yield* HttpClient.HttpClient;
 	const env = yield* Effect.mapError(settings, () => new ConfigurationError({ message: "The COMPOSIO_* configuration could not be read." }));
+	const mapped = {
+		auth: authFromCredentials({
+			project: env.project,
+			user: env.user,
+			organization: env.organization
+		}),
+		...env.baseURL !== void 0 ? { baseURL: env.baseURL } : {},
+		...env.allowInsecureHTTP === "1" ? { allowInsecureHTTP: true } : {}
+	};
 	const kernel = yield* Effect.fromResult(resolveKernel({
-		...options,
-		apiKey: options.apiKey !== void 0 ? options.apiKey : env.apiKey,
-		userApiKey: options.userApiKey !== void 0 ? options.userApiKey : env.userApiKey,
-		orgApiKey: options.orgApiKey !== void 0 ? options.orgApiKey : env.orgApiKey,
-		baseURL: options.baseURL ?? env.baseURL,
-		allowInsecureHTTP: options.allowInsecureHTTP ?? env.allowInsecureHTTP === "1"
+		...mapped,
+		...overrides
 	}, httpClient));
 	return fromKernel(kernel);
 }));
 
 //#endregion
-export { APIConnectionError, APIConnectionTimeoutError, APIError, AuthenticationError, BadRequestError, ComposioClient, ConfigurationError, ConflictError, DecodeError, InternalServerError, NotFoundError, PermissionDeniedError, RateLimitError, UnprocessableEntityError, VERSION, isAPIError, isComposioError, layer, layerConfig, layerFetch, make };
+export { APIConnectionError, APIConnectionTimeoutError, APIError, Auth, AuthenticationError, BadRequestError, ComposioClient, ConfigurationError, ConflictError, DecodeError, InternalServerError, NotFoundError, PermissionDeniedError, RateLimitError, UnprocessableEntityError, VERSION, isAPIError, isComposioError, layer, layerConfig, layerFetch, make };

package/dist/{error-D9cG225M.mjs → error-Bw7_G2NZ.mjs}

@@ -51,7 +51,7 @@ var APIError = class APIError extends ComposioError {
 	* `errors[]` and `suggested_fix` are reachable without casting `error`.
 	*
 	* Not part of the Stainless surface: a sanctioned superset, like
-	* `ClientOptions.userApiKey`.
+	* `ClientOptions.identity`.
 	*/
 	details;
 	/**

package/dist/{files-Cw6ulQZy.mjs → files-CeBs4ZE1.mjs}

@@ -1,4 +1,4 @@
-import { b as withOperation, d as path, n as generatedOperation } from "./generated-operations-DrhN6W_k.mjs";
+import { d as path, n as generatedOperation, y as withOperation } from "./generated-operations-DKgGT6Dg.mjs";
 
 //#region src/compat/resources/tool-router/session/files.ts
 const OP_LIST = generatedOperation("toolRouter.session.files.list");

package/dist/{files-RPz_Fvnz.mjs → files-DLRmNLRD.mjs}

@@ -1,4 +1,4 @@
-import { b as withOperation, n as generatedOperation } from "./generated-operations-DrhN6W_k.mjs";
+import { n as generatedOperation, y as withOperation } from "./generated-operations-DKgGT6Dg.mjs";
 
 //#region src/compat/resources/files.ts
 const OP_LIST = generatedOperation("files.list");

package/dist/{generate-DZXuXtYM.mjs → generate-16uLPwUU.mjs}

@@ -1,4 +1,4 @@
-import { b as withOperation, n as generatedOperation } from "./generated-operations-DrhN6W_k.mjs";
+import { n as generatedOperation, y as withOperation } from "./generated-operations-DKgGT6Dg.mjs";
 
 //#region src/compat/resources/mcp/generate.ts
 const OP_URL = generatedOperation("mcp.generate.url");

package/dist/{generated-deprecated-inputs-B6o8D8ub.mjs → generated-deprecated-inputs-zx6ml908.mjs}

@@ -1,5 +1,5 @@
-import { r as APIError } from "./error-D9cG225M.mjs";
-import { g as safeJSON, l as castToError } from "./generated-operations-DrhN6W_k.mjs";
+import { r as APIError } from "./error-Bw7_G2NZ.mjs";
+import { g as safeJSON, l as castToError } from "./generated-operations-DKgGT6Dg.mjs";
 
 //#region src/compat/api-promise.ts
 /**