@composio/client 2.0.0-rc.17 → 2.0.0-rc.19

package/dist/effect.mjs

@@ -1,79 +1,17 @@
-import { h as makeAPIErrorMessage, m as errorDetails, s as ComposioError } from "./error-D9cG225M.mjs";
-import { A as callerPlacedCredential, C as resolveIdentity, D as matchOperation, E as inspectDeprecation, F as mergeHeaders, M as parseHTTPURL, N as resolveHTTPURL, O as SCHEME_HEADERS, P as buildHeaders, S as assertNoReservedHeaders, T as inspectDeprecatedInputs, _ as schemeForRequest, a as TOO_MANY_REDIRECTS, c as buildURL, d as path, f as printableURL, g as safeJSON, h as rewriteForRedirect, i as REDIRECT_STATUSES, j as carriesCredentials, k as assertCredentialTransport, m as retryDelayMillis, n as generatedOperation, o as buildBody, r as OPAQUE_REDIRECT, s as buildRequestHeaders, t as GENERATED_OPERATIONS, v as shouldRetryResponse, w as VERSION, y as validatePositiveInteger } from "./generated-operations-D1e__yar.mjs";
-import { r as classifySuccessBody, t as GENERATED_DEPRECATED_INPUTS } from "./generated-deprecated-inputs--L5LHDO_.mjs";
-import { i as standardNextCursor, n as assertPageItems, r as isFinalCursor, t as assertCursorAdvanced } from "./pagination-rules-uMUdPq_7.mjs";
-import { Config, Context, Data, Effect, Exit, Layer, Match, Option, Predicate, Redacted, Result, Stream, Tracer } from "effect";
-import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import { h as makeAPIErrorMessage, m as errorDetails, s as ComposioError } from "./error-Bw7_G2NZ.mjs";
+import { B as SCHEME_HEADERS, C as resolveIdentity, D as inspectDeprecatedInputs, E as mergeHeaders, F as chooseCredential, H as carriesCredentials, I as credentialHeader, L as resolveAuth, M as assertRequiredOperationHeaders, N as authConstructors, O as inspectDeprecation, P as authFromCredentials, R as resolveScope, S as reservedHeaders, T as buildHeaders, U as parseHTTPURL, V as assertCredentialTransport, W as resolveHTTPURL, _ as shouldRetryResponse, a as TOO_MANY_REDIRECTS, c as buildURL, d as path, f as printableURL, g as safeJSON, h as rewriteForRedirect, i as REDIRECT_STATUSES, j as assertNoRemovedCredentialOptions, k as matchOperation, m as retryDelayMillis, n as generatedOperation, o as buildBody, r as OPAQUE_REDIRECT, s as buildRequestHeaders, t as GENERATED_OPERATIONS, v as validatePositiveInteger, w as VERSION, x as assertNoReservedHeaders, z as scopeForCall } from "./generated-operations-Dv7pAKDT.mjs";
+import { r as classifySuccessBody, t as GENERATED_DEPRECATED_INPUTS } from "./generated-deprecated-inputs-Dy_lBver.mjs";
+import { i as standardNextCursor, n as assertPageItems, r as isFinalCursor, t as assertCursorAdvanced } from "./pagination-rules-CMnBwktJ.mjs";
+import { Config, Context, Data, Effect, Exit, Layer, Match, Option, Predicate, Redacted, References, Result, Stream, Tracer } from "effect";
 import * as HttpClient from "effect/http/HttpClient";
 import * as Headers from "effect/http/Headers";
 import * as Schema from "effect/Schema";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
 import * as HttpBody from "effect/http/HttpBody";
 import { StatusCodeError, isHttpClientError } from "effect/http/HttpClientError";
 import * as HttpClientRequest from "effect/http/HttpClientRequest";
 import * as UrlParams from "effect/http/UrlParams";
 
-//#region src/effect/credentials.ts
-/**
-* How the Effect kernel holds credentials, and how it keeps them out of what
-* the transport records.
-*
-* Which credential a request carries, and where it may go, is decided by the
-* compat kernel's own functions (`../compat/credentials.ts`); nothing here
-* restates a rule. What is specific to this surface is the wrapping — a
-* credential is a `Redacted` for as long as the client holds it — and Effect's
-* redaction list, which knows `x-api-key` and not the other two schemes.
-*/
-const reveal = (credential) => credential === null ? null : Redacted.value(credential);
-/** The credentials in the plain form the compat functions take. Never stored. */
-const revealCredentials = (held) => ({
-	apiKey: reveal(held.apiKey),
-	userApiKey: reveal(held.userApiKey),
-	orgApiKey: reveal(held.orgApiKey)
-});
-const OPTION_HEADERS = {
-	apiKey: SCHEME_HEADERS.ApiKeyAuth,
-	userApiKey: SCHEME_HEADERS.UserApiKeyAuth,
-	orgApiKey: SCHEME_HEADERS.OrgApiKeyAuth
-};
-const CREDENTIAL_OPTIONS = Object.keys(OPTION_HEADERS);
-/** Whether the platform's `Headers` takes `value` under `name`. Its refusal quotes the value, so it stays here. */
-const isSendable = (name, value) => {
-	try {
-		new globalThis.Headers().set(name, value);
-		return true;
-	} catch {
-		return false;
-	}
-};
-/**
-* The option naming a credential no header can carry (an interior CR, LF or
-* NUL, or a character outside Latin-1), or `undefined` when all of them can be
-* sent. The answer is the option's name and never the value.
-*/
-const unsendableCredential = (held) => CREDENTIAL_OPTIONS.find((option) => {
-	const credential = held[option];
-	return credential !== null && !isSendable(OPTION_HEADERS[option], Redacted.value(credential));
-});
-const CREDENTIAL_HEADER_NAMES = Object.values(SCHEME_HEADERS);
-/** The extended list for each list seen, so a request does not rebuild it. */
-const extended = /* @__PURE__ */ new WeakMap();
-/**
-* Effect's redaction list with every credential header name on it, so a span
-* attribute or a rendering of the request made while the transport handles it
-* shows `<redacted>` for all three.
-*
-* The list in context is extended, not replaced: an application that added
-* names of its own keeps them.
-*/
-const withCredentialHeaderNames = (names) => {
-	const known = extended.get(names);
-	if (known !== void 0) return known;
-	const all = [...names, ...CREDENTIAL_HEADER_NAMES.filter((name) => !Headers.isRedactedName(name, names))];
-	extended.set(names, all);
-	return all;
-};
-
-//#endregion
 //#region src/effect/errors.ts
 /**
 * The failure model of the Effect surface: flat tagged errors, one per status
@@ -178,6 +116,67 @@ const isAPIError = (value) => kindOf(value) === "status";
 /** Whether a value is any error this surface produces. Structural, like {@link isAPIError}. */
 const isComposioError = (value) => kindOf(value) !== void 0;
 
+//#endregion
+//#region src/effect/credentials.ts
+/**
+* How the Effect kernel holds credentials, and how it keeps them out of what
+* the transport records.
+*
+* Which credential a request carries, and where it may go, is decided by the
+* compat kernel's own functions (`../compat/credentials.ts`); nothing here
+* restates a rule. What is specific to this surface is the wrapping — a
+* credential is a `Redacted` for as long as the client holds it — and Effect's
+* redaction list, which knows `x-api-key` and not the other two schemes.
+*/
+const reveal = (key) => typeof key === "string" ? key : Redacted.value(key);
+const EFFECT_CREDENTIAL = {
+	is: (value) => typeof value === "function" || typeof value === "string" || Redacted.isRedacted(value),
+	keyOf: (credential) => typeof credential === "function" ? void 0 : reveal(credential)
+};
+const hold = (credential) => {
+	if (typeof credential === "string") return Redacted.make(credential);
+	return credential;
+};
+const holdAuth = (auth) => ({
+	mode: auth.mode,
+	credentials: Object.fromEntries(Object.entries(auth.credentials).map(([scheme, credential]) => [scheme, hold(credential)]))
+});
+const providerFailed = () => new ConfigurationError({ message: "The `auth` credential provider failed." });
+const keyOf = (credential) => {
+	if (typeof credential !== "function") return Effect.succeed(reveal(credential));
+	return Effect.tryPromise({
+		try: async () => reveal(await credential()),
+		catch: providerFailed
+	});
+};
+/** The compat kernel's rule, with failures as `ConfigurationError`s that hold neither the provider's error nor a key. */
+const resolveCallCredential = (auth, baseURL, requestURL, operation, supplied) => {
+	const choice = chooseCredential(auth, baseURL, requestURL, operation, supplied);
+	if (choice === null) return Effect.succeed(null);
+	return Effect.flatMap(keyOf(choice.credential), (key) => Effect.try({
+		try: () => credentialHeader(choice.scheme, key),
+		catch: configurationErrorFrom
+	}));
+};
+const CREDENTIAL_HEADER_NAMES = Object.values(SCHEME_HEADERS);
+/** The extended list for each list seen, so a request does not rebuild it. */
+const extended = /* @__PURE__ */ new WeakMap();
+/**
+* Effect's redaction list with every credential header name on it, so a span
+* attribute or a rendering of the request made while the transport handles it
+* shows `<redacted>` for all three.
+*
+* The list in context is extended, not replaced: an application that added
+* names of its own keeps them.
+*/
+const withCredentialHeaderNames = (names) => {
+	const known = extended.get(names);
+	if (known !== void 0) return known;
+	const all = [...names, ...CREDENTIAL_HEADER_NAMES.filter((name) => !Headers.isRedactedName(name, names))];
+	extended.set(names, all);
+	return all;
+};
+
 //#endregion
 //#region src/effect/decode.ts
 /**
@@ -251,6 +250,45 @@ const responseIssues = (loaders, key, body) => {
 	}), (schema) => issuesOf(schema, body));
 };
 
+//#endregion
+//#region src/effect/pagination.ts
+/**
+* Cursor pagination as a `Stream`: the items of a standard `items` /
+* `next_cursor` operation, one page requested at a time and only when the
+* stream is pulled that far, so a consumer that stops — or is interrupted —
+* causes no further request.
+*
+* The cursor rules are the ones `./pagination` traverses by, called rather
+* than restated: an absent, null or empty `next_cursor` ends the stream, a
+* cursor the server repeats fails it, and so does a page-number envelope that
+* leaves `next_cursor` out before its last page.
+*/
+/**
+* One page's items and the position after it, or the reason the traversal
+* cannot go on. No request would change that reason, so it is a
+* {@link ConfigurationError} carrying the message `./pagination` throws.
+*/
+const advance = (page, seen) => Result.try({
+	try: () => {
+		const items = page.items;
+		assertPageItems(items);
+		const cursor = standardNextCursor(page);
+		if (isFinalCursor(cursor)) return [items, Option.none()];
+		assertCursorAdvanced(seen, cursor);
+		seen.add(cursor);
+		return [items, Option.some(cursor)];
+	},
+	catch: configurationErrorFrom
+});
+/**
+* The items of every page `fetchPage` returns, in order. `fetchPage` is first
+* called with no cursor, then with each `next_cursor` in turn.
+*/
+const cursorStream = (fetchPage) => Stream.suspend(() => {
+	const seen = /* @__PURE__ */ new Set();
+	return Stream.paginate(void 0, (cursor) => Effect.flatMap(fetchPage(cursor), (page) => Effect.fromResult(advance(page, seen))));
+});
+
 //#endregion
 //#region src/effect/deprecation.ts
 /**
@@ -262,27 +300,30 @@ const responseIssues = (loaders, key, body) => {
 * notice is a `Warn` record on Effect's logger, so the application's logger
 * and minimum log level decide what becomes of it.
 */
-const makeNoticeRecord = (mode) => ({
-	mode: mode ?? "warn",
-	seen: /* @__PURE__ */ new Set()
-});
+const NOTICE_ANNOTATION = "composio.client.notice";
+const DEPRECATION = "deprecation";
+const noticeAnnotation = (options) => options.fiber.getRef(References.CurrentLogAnnotations)[NOTICE_ANNOTATION];
+/** Whether a log record is one of this client's deprecation notices, for a `Logger` that drops or routes them. */
+const isDeprecationNotice = Predicate.mapInput((value) => value === DEPRECATION, noticeAnnotation);
+const logNotice = (message) => Effect.logWarning(message).pipe(Effect.annotateLogs(NOTICE_ANNOTATION, DEPRECATION));
 /** The compat inspectors report through a callback; this collects what one of them said. */
 const warnings = (inspect) => {
 	const messages = [];
 	inspect((message) => messages.push(message));
-	return messages.length === 0 ? Effect.void : Effect.forEach(messages, (message) => Effect.logWarning(message), { discard: true });
+	return messages.length === 0 ? Effect.void : Effect.forEach(messages, logNotice, { discard: true });
 };
 /**
 * The notice for inputs the spec marks deprecated, decided from the request
 * alone — so it is given before dispatch, whatever the transport then does.
+* `seen` is the client's (operation, notice) record, so one client warns once.
 */
-const noticeDeprecatedInputs = (record, input) => record.mode === "off" || input.operation === null ? Effect.void : Effect.suspend(() => warnings((warn) => inspectDeprecatedInputs({
+const noticeDeprecatedInputs = (seen, input) => input.operation === null ? Effect.void : Effect.suspend(() => warnings((warn) => inspectDeprecatedInputs({
 	operation: input.operation,
 	query: input.query,
 	body: input.body,
 	headers: input.headers(),
 	table: GENERATED_DEPRECATED_INPUTS,
-	seen: record.seen,
+	seen,
 	warn
 })));
 /**
@@ -290,7 +331,7 @@ const noticeDeprecatedInputs = (record, input) => record.mode === "off" || input
 * fields. Given for the response a call ends with, never for one that is
 * discarded and retried or for a hop of a redirect chain.
 */
-const noticeDeprecatedResponse = (record, input) => record.mode === "off" || input.headers["deprecation"] === void 0 ? Effect.void : Effect.suspend(() => warnings((warn) => inspectDeprecation({
+const noticeDeprecatedResponse = (seen, input) => Effect.suspend(() => warnings((warn) => inspectDeprecation({
 	response: {
 		headers: new globalThis.Headers(input.headers),
 		url: input.url
@@ -300,49 +341,10 @@ const noticeDeprecatedResponse = (record, input) => record.mode === "off" || inp
 	operation: input.operation ?? void 0,
 	baseURL: input.baseURL,
 	operations: GENERATED_OPERATIONS,
-	seen: record.seen,
+	seen,
 	warn
 })));
 
-//#endregion
-//#region src/effect/pagination.ts
-/**
-* Cursor pagination as a `Stream`: the items of a standard `items` /
-* `next_cursor` operation, one page requested at a time and only when the
-* stream is pulled that far, so a consumer that stops — or is interrupted —
-* causes no further request.
-*
-* The cursor rules are the ones `./pagination` traverses by, called rather
-* than restated: an absent, null or empty `next_cursor` ends the stream, a
-* cursor the server repeats fails it, and so does a page-number envelope that
-* leaves `next_cursor` out before its last page.
-*/
-/**
-* One page's items and the position after it, or the reason the traversal
-* cannot go on. No request would change that reason, so it is a
-* {@link ConfigurationError} carrying the message `./pagination` throws.
-*/
-const advance = (page, seen) => Result.try({
-	try: () => {
-		const items = page.items;
-		assertPageItems(items);
-		const cursor = standardNextCursor(page);
-		if (isFinalCursor(cursor)) return [items, Option.none()];
-		assertCursorAdvanced(seen, cursor);
-		seen.add(cursor);
-		return [items, Option.some(cursor)];
-	},
-	catch: configurationErrorFrom
-});
-/**
-* The items of every page `fetchPage` returns, in order. `fetchPage` is first
-* called with no cursor, then with each `next_cursor` in turn.
-*/
-const cursorStream = (fetchPage) => Stream.suspend(() => {
-	const seen = /* @__PURE__ */ new Set();
-	return Stream.paginate(void 0, (cursor) => Effect.flatMap(fetchPage(cursor), (page) => Effect.fromResult(advance(page, seen))));
-});
-
 //#endregion
 //#region src/effect/request.ts
 /**
@@ -380,10 +382,11 @@ const substitute = (template, params) => {
 	const statics = template.split(PLACEHOLDER);
 	return path(Object.assign(statics, { raw: statics }), ...params);
 };
-const hopHeaders = (prepared, hop) => buildRequestHeaders(prepared.headerConfig, { headers: prepared.callHeaders }, hop.url, hop.bodyHeaders, hop.withdrawn, prepared.scheme, prepared.callerPlaced);
-const prepare = (kernel, call) => {
+const hopHeaders = (prepared, hop) => buildRequestHeaders(prepared.headerConfig, { headers: prepared.callHeaders }, hop.url, hop.bodyHeaders, hop.withdrawn, prepared.call);
+const check = (kernel, call) => {
 	const callHeaders = call.headers();
-	assertNoReservedHeaders(callHeaders, kernel.identity, "headers");
+	assertNoReservedHeaders(callHeaders, kernel.reserved, "headers");
+	if (!call.recovered) assertRequiredOperationHeaders(call.operation, call.operationHeaders);
 	const path = call.path();
 	if (call.options?.timeout !== void 0) validatePositiveInteger("timeout", call.options.timeout);
 	const resolvedRetries = call.options?.maxRetries ?? kernel.maxRetries;
@@ -400,8 +403,7 @@ const prepare = (kernel, call) => {
 		query: call.query
 	});
 	const { body, bodyHeaders } = buildBody({ body: call.body });
-	const credentials = revealCredentials(kernel);
-	const shared = {
+	return {
 		method: call.method,
 		path,
 		label: printableURL(url, call.operation),
@@ -409,22 +411,33 @@ const prepare = (kernel, call) => {
 		query,
 		headerConfig: {
 			baseURL: kernel.baseURL,
-			credentials,
 			allowedHTTPOrigin: kernel.allowedHTTPOrigin,
 			userAgent: kernel.userAgent,
 			defaultHeaders: kernel.defaultHeaders,
 			identity: kernel.identity
 		},
 		callHeaders,
-		scheme: schemeForRequest({ credentials }, call.operation),
-		callerPlaced: callerPlacedCredential([kernel.defaultHeaders, callHeaders]),
+		scope: scopeForCall(kernel.scope, call.operationHeaders),
 		maxRetries,
 		timeout: call.options?.timeout ?? kernel.timeout,
-		schemas: decode ? kernel.schemas : void 0
+		schemas: decode ? kernel.schemas : void 0,
+		url,
+		body,
+		bodyHeaders
+	};
+};
+const withFirstHop = (checked, credential) => {
+	const { scope, url, body, bodyHeaders, ...rest } = checked;
+	const shared = {
+		...rest,
+		call: {
+			credential,
+			scope
+		}
 	};
 	const first = {
 		url,
-		method: call.method.toUpperCase(),
+		method: checked.method.toUpperCase(),
 		body,
 		bodyHeaders,
 		withdrawn: false,
@@ -438,6 +451,17 @@ const prepare = (kernel, call) => {
 		}
 	};
 };
+/** Checks the call, resolves its credential once for every attempt and hop, and builds its first hop. */
+const prepare = (kernel, call) => Effect.try({
+	try: () => check(kernel, call),
+	catch: configurationErrorFrom
+}).pipe(Effect.flatMap((checked) => Effect.map(resolveCallCredential(kernel.auth, kernel.baseURL, checked.url, call.operation, call.operationHeaders), (credential) => ({
+	checked,
+	credential
+}))), Effect.flatMap(({ checked, credential }) => Effect.try({
+	try: () => withFirstHop(checked, credential),
+	catch: configurationErrorFrom
+})));
 /**
 * Built from its parts rather than through `HttpClientRequest.make`: the URL
 * already carries its query, serialized by the compat rules, and must reach
@@ -721,11 +745,8 @@ const parse = (prepared, response, headers) => {
 		catch: () => invalidJSON(prepared, response)
 	}), (body) => validated(prepared, response, body)));
 };
-const dispatch = (kernel, call) => Effect.try({
-	try: () => prepare(kernel, call),
-	catch: configurationErrorFrom
-}).pipe(Effect.flatMap((prepared) => {
-	const noticed = call.recovered || prepared.operation?.hasDeprecatedInputs === true ? noticeDeprecatedInputs(kernel.notices, {
+const dispatch = (kernel, call) => prepare(kernel, call).pipe(Effect.flatMap((prepared) => {
+	const noticed = call.recovered || prepared.operation?.hasDeprecatedInputs === true ? noticeDeprecatedInputs(kernel.deprecationSeen, {
 		operation: prepared.operation,
 		query: prepared.query,
 		body: call.body,
@@ -734,8 +755,8 @@ const dispatch = (kernel, call) => Effect.try({
 	const exchanged = withRetries(kernel, prepared, 0);
 	return Effect.flatMap(noticed === void 0 ? exchanged : Effect.andThen(noticed, exchanged), (response) => {
 		const headers = response.headers;
-		if (kernel.notices.mode === "off" || headers["deprecation"] === void 0) return parse(prepared, response, headers);
-		return Effect.flatMap(noticeDeprecatedResponse(kernel.notices, {
+		if (headers["deprecation"] === void 0) return parse(prepared, response, headers);
+		return Effect.flatMap(noticeDeprecatedResponse(kernel.deprecationSeen, {
 			method: prepared.method,
 			path: prepared.path,
 			operation: prepared.operation,
@@ -756,6 +777,7 @@ const executeOperation = (kernel, operation, args, options) => dispatch(kernel,
 	query: args.query,
 	body: args.body,
 	headers: () => args.headers === void 0 ? options?.headers : mergeHeaders([args.headers, options?.headers]),
+	operationHeaders: args.operationHeaders,
 	operation,
 	recovered: false,
 	options
@@ -772,6 +794,7 @@ const executeRaw = (kernel, method, path, options) => dispatch(kernel, {
 	query: options?.query,
 	body: options?.body,
 	headers: () => options?.headers,
+	operationHeaders: void 0,
 	operation: matchOperation(method, path, GENERATED_OPERATIONS),
 	recovered: true,
 	options
@@ -1206,7 +1229,7 @@ const makeCli = (kernel) => ({
 		const { "x-user-api-key": xUserApiKey, ...body } = params;
 		return executeOperation(kernel, OP_CREATE_CODACT_FAILURE, {
 			body,
-			headers: { ...xUserApiKey != null ? { "x-user-api-key": xUserApiKey } : void 0 }
+			operationHeaders: { "x-user-api-key": xUserApiKey }
 		}, options);
 	},
 	createSession: (body = {}, options) => executeOperation(kernel, OP_CREATE_SESSION, { body }, options),
@@ -1337,9 +1360,9 @@ const makeOwner = (kernel) => ({ project: makeProject$2(kernel) });
 const OP_RESOLVE = generatedOperation("org.consumer.project.resolve");
 const makeProject$1 = (kernel) => ({ resolve: (params, options) => {
 	const { "x-user-api-key": xUserApiKey, "x-org-id": xOrgId } = params;
-	return executeOperation(kernel, OP_RESOLVE, { headers: {
-		...xUserApiKey != null ? { "x-user-api-key": xUserApiKey } : void 0,
-		...xOrgId != null ? { "x-org-id": xOrgId } : void 0
+	return executeOperation(kernel, OP_RESOLVE, { operationHeaders: {
+		"x-user-api-key": xUserApiKey,
+		"x-org-id": xOrgId
 	} }, options);
 } });
 
@@ -1352,9 +1375,9 @@ const makeConsumer = (kernel) => ({
 		const { "x-user-api-key": xUserApiKey, "x-org-id": xOrgId, ...query } = params;
 		return executeOperation(kernel, OP_LIST_CONNECTED_TOOLKITS, {
 			query,
-			headers: {
-				...xUserApiKey != null ? { "x-user-api-key": xUserApiKey } : void 0,
-				...xOrgId != null ? { "x-org-id": xOrgId } : void 0
+			operationHeaders: {
+				"x-user-api-key": xUserApiKey,
+				"x-org-id": xOrgId
 			}
 		}, options);
 	}
@@ -1473,58 +1496,58 @@ const createClientResources = (kernel) => ({
 //#region src/effect/client.ts
 /**
 * The Effect client: a `Context.Service`, layers that build it from the
-* `HttpClient` in context (or bring a fetch-backed one), and a plain
+* `HttpClient` in context, and a plain
 * constructor for callers who already hold one.
 *
 * Options are fixed at construction. Nothing here reads the environment except
 * {@link layerConfig}, which reads the `COMPOSIO_*` settings through Effect's
 * `Config` — so the `ConfigProvider` in context decides where they come from.
 */
+const Auth = authConstructors();
 var ComposioClient = class extends Context.Service()("@composio/client/effect/ComposioClient") {};
 const DEFAULT_BASE_URL = "https://backend.composio.dev";
 const DEFAULT_MAX_RETRIES = 2;
 const DEFAULT_TIMEOUT = 6e4;
-const hold = (credential) => {
-	if (credential === null || credential === void 0) return null;
-	return Redacted.isRedacted(credential) ? credential : Redacted.make(credential);
+const resolveAccess = (options, baseURL) => {
+	assertNoRemovedCredentialOptions(options);
+	const auth = resolveAuth(options.auth, EFFECT_CREDENTIAL);
+	const scope = resolveScope(options.scope);
+	const identity = resolveIdentity(options.identity);
+	const reserved = reservedHeaders(identity, {
+		auth: auth.mode !== "none",
+		scope: scope !== void 0
+	});
+	assertNoReservedHeaders(options.defaultHeaders, reserved, "defaultHeaders");
+	const allowedHTTPOrigin = options.allowInsecureHTTP ? parseHTTPURL(baseURL)?.origin ?? null : null;
+	assertCredentialTransport(baseURL, auth.mode !== "none", allowedHTTPOrigin);
+	return {
+		auth: holdAuth(auth),
+		scope,
+		identity,
+		reserved,
+		allowedHTTPOrigin
+	};
 };
 const resolveKernel = (options, httpClient) => {
 	const baseURL = options.baseURL || DEFAULT_BASE_URL;
 	if (options.decode === true && options.schemas === void 0) return Result.fail(new ConfigurationError({ message: SCHEMAS_MISSING }));
-	const identity = Result.try({
-		try: () => {
-			const resolved = resolveIdentity(options.identity);
-			assertNoReservedHeaders(options.defaultHeaders, resolved, "defaultHeaders");
-			return resolved;
-		},
+	const resolved = Result.try({
+		try: () => resolveAccess(options, baseURL),
 		catch: configurationErrorFrom
 	});
-	if (Result.isFailure(identity)) return Result.fail(identity.failure);
-	const kernel = {
+	if (Result.isFailure(resolved)) return Result.fail(resolved.failure);
+	return Result.succeed({
 		httpClient,
 		baseURL,
-		apiKey: hold(options.apiKey),
-		userApiKey: hold(options.userApiKey),
-		orgApiKey: hold(options.orgApiKey),
-		allowedHTTPOrigin: options.allowInsecureHTTP ? parseHTTPURL(baseURL)?.origin ?? null : null,
+		...resolved.success,
 		userAgent: `Composio/JS ${VERSION}`,
 		defaultHeaders: options.defaultHeaders,
-		identity: identity.success,
 		maxRetries: options.maxRetries ?? DEFAULT_MAX_RETRIES,
 		timeout: options.timeout ?? DEFAULT_TIMEOUT,
 		tracing: options.tracing ?? "off",
 		decode: options.decode ?? false,
 		schemas: options.schemas,
-		notices: makeNoticeRecord(options.deprecationNotices)
-	};
-	const unsendable = unsendableCredential(kernel);
-	if (unsendable !== void 0) return Result.fail(new ConfigurationError({ message: `The \`${unsendable}\` option cannot be sent as a header: it contains a line break, a NUL or a character outside Latin-1.` }));
-	return Result.try({
-		try: () => {
-			assertCredentialTransport(baseURL, revealCredentials(kernel), kernel.allowedHTTPOrigin);
-			return kernel;
-		},
-		catch: configurationErrorFrom
+		deprecationSeen: /* @__PURE__ */ new Set()
 	});
 };
 const fromKernel = (kernel) => ({
@@ -1559,43 +1582,45 @@ const make = (options, httpClient) => fromKernel(makeKernel(options, httpClient)
 * Provides the client from explicit options and the `HttpClient` in context.
 * Reads no environment variable.
 */
-const layer = (options = {}) => Layer.effect(ComposioClient, Effect.flatMap(HttpClient.HttpClient, (httpClient) => Effect.map(Effect.fromResult(resolveKernel(options, httpClient)), fromKernel)));
-/**
-* {@link layer} over a fetch-backed `HttpClient`, for an application that has
-* no transport of its own to supply. `fetch` is the platform's, or whatever
-* the `FetchHttpClient.Fetch` reference in context names.
-*/
-const layerFetch = (options = {}) => Layer.provide(layer(options), FetchHttpClient.layer);
-/** A setting as the compat client reads one: trimmed, and absent when empty. */
+const layer = (options) => Layer.effect(ComposioClient, Effect.flatMap(HttpClient.HttpClient, (httpClient) => Effect.map(Effect.fromResult(resolveKernel(options, httpClient)), fromKernel)));
+/** A setting as `Composio.fromEnv` reads one: trimmed, and absent when empty. */
 const setting = (name) => Config.map(Config.option(Config.String(name)), (value) => Option.getOrUndefined(Option.filter(Option.map(value, (text) => text.trim()), (text) => text !== "")));
+const trimmedKey = (key) => {
+	const trimmed = Redacted.value(key).trim();
+	if (trimmed === "") return Option.none();
+	return Option.some(Redacted.make(trimmed));
+};
+const secret = (name) => Config.map(Config.option(Config.Redacted(name)), (value) => Option.getOrUndefined(Option.flatMap(value, trimmedKey)));
 const settings = Config.all({
-	apiKey: setting("COMPOSIO_API_KEY"),
-	userApiKey: setting("COMPOSIO_USER_API_KEY"),
-	orgApiKey: setting("COMPOSIO_ORG_API_KEY"),
+	project: secret("COMPOSIO_API_KEY"),
+	user: secret("COMPOSIO_USER_API_KEY"),
+	organization: secret("COMPOSIO_ORG_API_KEY"),
 	baseURL: setting("COMPOSIO_BASE_URL"),
 	allowInsecureHTTP: setting("COMPOSIO_ALLOW_INSECURE_HTTP")
 });
 /**
-* Provides the client from the `COMPOSIO_*` settings — `COMPOSIO_API_KEY`,
-* `COMPOSIO_USER_API_KEY`, `COMPOSIO_ORG_API_KEY`, `COMPOSIO_BASE_URL` and
-* `COMPOSIO_ALLOW_INSECURE_HTTP=1` — read through the `ConfigProvider` in
-* context, which is the process environment unless the application says
-* otherwise. An option given here wins over its setting; `null` for a
-* credential means "none", whatever is configured.
+* Provides the client from the `COMPOSIO_*` settings through the
+* `ConfigProvider` in context, by `Composio.fromEnv`'s rules. Each override
+* replaces the setting it names.
 */
-const layerConfig = (options = {}) => Layer.effect(ComposioClient, Effect.gen(function* () {
+const layerConfig = (overrides = {}) => Layer.effect(ComposioClient, Effect.gen(function* () {
 	const httpClient = yield* HttpClient.HttpClient;
 	const env = yield* Effect.mapError(settings, () => new ConfigurationError({ message: "The COMPOSIO_* configuration could not be read." }));
+	const mapped = {
+		auth: authFromCredentials({
+			project: env.project,
+			user: env.user,
+			organization: env.organization
+		}),
+		baseURL: env.baseURL,
+		allowInsecureHTTP: env.allowInsecureHTTP === "1"
+	};
 	const kernel = yield* Effect.fromResult(resolveKernel({
-		...options,
-		apiKey: options.apiKey !== void 0 ? options.apiKey : env.apiKey,
-		userApiKey: options.userApiKey !== void 0 ? options.userApiKey : env.userApiKey,
-		orgApiKey: options.orgApiKey !== void 0 ? options.orgApiKey : env.orgApiKey,
-		baseURL: options.baseURL ?? env.baseURL,
-		allowInsecureHTTP: options.allowInsecureHTTP ?? env.allowInsecureHTTP === "1"
+		...mapped,
+		...overrides
 	}, httpClient));
 	return fromKernel(kernel);
 }));
 
 //#endregion
-export { APIConnectionError, APIConnectionTimeoutError, APIError, AuthenticationError, BadRequestError, ComposioClient, ConfigurationError, ConflictError, DecodeError, InternalServerError, NotFoundError, PermissionDeniedError, RateLimitError, UnprocessableEntityError, VERSION, isAPIError, isComposioError, layer, layerConfig, layerFetch, make };
+export { APIConnectionError, APIConnectionTimeoutError, APIError, Auth, AuthenticationError, BadRequestError, ComposioClient, ConfigurationError, ConflictError, DecodeError, InternalServerError, NotFoundError, PermissionDeniedError, RateLimitError, UnprocessableEntityError, VERSION, isAPIError, isComposioError, isDeprecationNotice, layer, layerConfig, make };

package/dist/{error-D9cG225M.mjs → error-Bw7_G2NZ.mjs}

@@ -51,7 +51,7 @@ var APIError = class APIError extends ComposioError {
 	* `errors[]` and `suggested_fix` are reachable without casting `error`.
 	*
 	* Not part of the Stainless surface: a sanctioned superset, like
-	* `ClientOptions.userApiKey`.
+	* `ClientOptions.identity`.
 	*/
 	details;
 	/**

package/dist/{files-BPKJXlpc.mjs → files-DRp_J4zH.mjs}

@@ -1,4 +1,4 @@
-import { b as withOperation, d as path, n as generatedOperation } from "./generated-operations-D1e__yar.mjs";
+import { d as path, n as generatedOperation, y as withOperation } from "./generated-operations-Dv7pAKDT.mjs";
 
 //#region src/compat/resources/tool-router/session/files.ts
 const OP_LIST = generatedOperation("toolRouter.session.files.list");

package/dist/{files-BjPFzRnM.mjs → files-ZxEVlE_y.mjs}

@@ -1,4 +1,4 @@
-import { b as withOperation, n as generatedOperation } from "./generated-operations-D1e__yar.mjs";
+import { n as generatedOperation, y as withOperation } from "./generated-operations-Dv7pAKDT.mjs";
 
 //#region src/compat/resources/files.ts
 const OP_LIST = generatedOperation("files.list");

package/dist/{generate-DDHNgbPS.mjs → generate-Du9XUrlx.mjs}

@@ -1,4 +1,4 @@
-import { b as withOperation, n as generatedOperation } from "./generated-operations-D1e__yar.mjs";
+import { n as generatedOperation, y as withOperation } from "./generated-operations-Dv7pAKDT.mjs";
 
 //#region src/compat/resources/mcp/generate.ts
 const OP_URL = generatedOperation("mcp.generate.url");

package/dist/{generated-deprecated-inputs--L5LHDO_.mjs → generated-deprecated-inputs-Dy_lBver.mjs}

@@ -1,5 +1,5 @@
-import { r as APIError } from "./error-D9cG225M.mjs";
-import { g as safeJSON, l as castToError } from "./generated-operations-D1e__yar.mjs";
+import { r as APIError } from "./error-Bw7_G2NZ.mjs";
+import { g as safeJSON, l as castToError } from "./generated-operations-Dv7pAKDT.mjs";
 
 //#region src/compat/api-promise.ts
 /**