@composio/client 2.0.0-rc.17 → 2.0.0-rc.19

package/dist/{generated-operations-D1e__yar.mjs → generated-operations-Dv7pAKDT.mjs}

@@ -1,78 +1,5 @@
-import { i as APIUserAbortError, n as APIConnectionTimeoutError, s as ComposioError, t as APIConnectionError } from "./error-D9cG225M.mjs";
+import { i as APIUserAbortError, n as APIConnectionTimeoutError, s as ComposioError, t as APIConnectionError } from "./error-Bw7_G2NZ.mjs";
 
-//#region src/compat/headers.ts
-const hasEntries = (value) => typeof value === "object" && value !== null && "append" in value && typeof value.append === "function" && "delete" in value && typeof value.delete === "function" && "entries" in value && typeof value.entries === "function" && "get" in value && typeof value.get === "function";
-const isHeaders = (value) => value instanceof Headers || hasEntries(value);
-const isNullableHeadersLike = (headers) => {
-	if (!("values" in headers) || !isHeaders(headers.values) || !("nulls" in headers)) return false;
-	const nulls = headers.nulls;
-	return typeof nulls === "object" && nulls !== null && Symbol.iterator in nulls;
-};
-/**
-* Iterates every supported input while preserving explicit deletions. Plain
-* objects replace an older value for a key; tuple inputs append duplicate
-* values, matching the published client.
-*/
-function* iterateHeaders(headers) {
-	if (!headers) return;
-	if (isNullableHeadersLike(headers)) {
-		yield* headers.values.entries();
-		for (const name of headers.nulls) yield [name, null];
-		return;
-	}
-	const shouldReplace = !isHeaders(headers) && !Array.isArray(headers);
-	const entries = isHeaders(headers) ? headers.entries() : Array.isArray(headers) ? headers : Object.entries(headers);
-	for (const entry of entries) {
-		const name = entry[0];
-		if (typeof name !== "string") throw new TypeError("expected header name to be a string");
-		const rawValue = entry[1];
-		const values = Array.isArray(rawValue) ? rawValue : [rawValue];
-		let replaced = false;
-		for (const value of values) {
-			if (value === void 0) continue;
-			if (shouldReplace && !replaced) {
-				replaced = true;
-				yield [name, null];
-			}
-			yield [name, value];
-		}
-	}
-}
-/** Merge sources while retaining names explicitly deleted by the last source. */
-const mergeHeaders = (sources) => {
-	const values = new Headers();
-	const nulls = /* @__PURE__ */ new Set();
-	for (const source of sources) {
-		if (!source) continue;
-		const seen = /* @__PURE__ */ new Set();
-		for (const [name, value] of iterateHeaders(source)) {
-			const lowerName = name.toLowerCase();
-			if (!seen.has(lowerName)) {
-				values.delete(name);
-				seen.add(lowerName);
-			}
-			if (value === null) {
-				values.delete(name);
-				nulls.add(lowerName);
-			} else {
-				values.append(name, value);
-				nulls.delete(lowerName);
-			}
-		}
-	}
-	return {
-		values,
-		nulls
-	};
-};
-/** Merge sources into the native header collection sent to fetch. */
-const buildHeaders = (sources) => mergeHeaders(sources).values;
-/** Every header name a source mentions, lowercased, a `null` deletion included. */
-function* headerNames(headers) {
-	for (const [name] of iterateHeaders(headers)) yield name.toLowerCase();
-}
-
-//#endregion
 //#region src/compat/credentials.ts
 /**
 * The credential transport boundary.
@@ -94,8 +21,8 @@ function* headerNames(headers) {
 *    caller opts into with `allowInsecureHTTP` or
 *    `COMPOSIO_ALLOW_INSECURE_HTTP=1`.
 *    Enforced by {@link assertCredentialTransport} at construction and again
-*    by {@link credentialForRequest} at dispatch, because `apiKey` and
-*    `baseURL` are both public mutable fields on the client.
+*    by {@link credentialForRequest} at dispatch, because `baseURL` is a
+*    public mutable field on the client.
 * 2. **The credential is attached only to requests whose origin matches the
 *    configured API origin.** {@link credentialForRequest} returns `null`
 *    off-origin, and the header is simply not sent.
@@ -158,70 +85,25 @@ const SCHEME_HEADERS = {
 };
 /** The scheme a request authenticates with when its operation names none. */
 const DEFAULT_SCHEME = "ApiKeyAuth";
-const valueFor = (scheme, credentials) => scheme === "ApiKeyAuth" ? credentials.apiKey : scheme === "UserApiKeyAuth" ? credentials.userApiKey : credentials.orgApiKey;
 /**
-* Whether anything beyond the project key is configured — the condition that
-* makes per-operation selection able to change an outcome at all.
-*
-* Load-bearing rather than an optimization. With only `apiKey` set, every
-* branch of {@link selectScheme} lands on `ApiKeyAuth`: it wins wherever it is
-* an accepted alternative, and where it is not, the alternative is unconfigured
-* and the fallback is `ApiKeyAuth` again. So the client that every existing
-* caller constructs never consults the operation table, and "an `apiKey`-only
-* client emits byte-identical requests on all 104 operations" is a property of
-* the code shape rather than a claim tests have to keep re-establishing.
-*/
-const hasAlternateCredential = (credentials) => credentials.userApiKey !== null || credentials.orgApiKey !== null;
-/**
-* Which credential a request declaring `schemes` should carry.
-*
-* **Exactly one, always** — and the API says so itself. Measured against
-* production on 2026-08-06, `GET /toolkits` answers 200 for `x-api-key` alone
-* and 200 for `x-user-api-key` alone, and answers both together with
-* `401 HTTP_Unauthorized`:
-*
-* > Multiple authentication modes were provided. Provide exactly one
-* > authentication mode per request. Provided: ApiKeyAuth via x-api-key,
-* > UserApiKeyAuth via x-user-api-key.
-*
-* The platform names the schemes by their OpenAPI names, so this is the same
-* vocabulary `security` is written in rather than a coincidence of headers. It
-* holds for `x-api-key` + `x-org-api-key` too, and on an operation that accepts
-* only one of them. There is therefore no additive "send the user key as well"
-* model available, and the choice has to be made per request rather than
-* accumulated.
-*
-* The precedence exists to make the change free where it must be free:
-*
-* 1. **`ApiKeyAuth` wins wherever the operation accepts it** and an `apiKey` is
-*    configured — 85 of the 104 operations, every wire byte preserved.
-* 2. Otherwise the first scheme the operation names that this client both
-*    recognizes *and* holds a credential for. That is what makes the 16
-*    `UserApiKeyAuth`-only and `OrgApiKeyAuth`-only operations reachable.
-* 3. Otherwise `ApiKeyAuth`, which is what this client did before any of this
-*    existed. A `UserApiKeyAuth`-only operation called by a client with no user
-*    key still sends `x-api-key` and still fails the same way — which is what
-*    keeps `cli.realtime.auth` and `cli.realtime.credentials` pinned against
-*    the Stainless oracle in `test/unit/differential-wire.test.ts`.
-*
-* Rule 3 is also where a scheme name this client does not know lands. Three of
-* them exist: `security` references `no_auth` (3 operations) and
-* `workbench_access_key` (1) and `components.securitySchemes` declares neither.
-* Those four operations receive `x-api-key` today and are differentially
-* pinned doing so, so resolving an unknown name to "no credential" would be a
-* wire change made on the strength of a spec defect. A later generator pass
-* must not "fix" that.
+* `Auth.auto`'s choice for an operation declaring `schemes`: `ApiKeyAuth`
+* wherever the operation accepts it and a project key is held, else the first
+* declared scheme that is held, else `ApiKeyAuth`. An undeclared scheme name
+* (`no_auth`, `workbench_access_key`) falls through to `ApiKeyAuth`, as every
+* release before rc.18 sent. A request may carry only one credential: the API
+* answers two with a 401.
 */
-const selectScheme = (schemes, credentials) => {
+const selectScheme = (schemes, held) => {
 	if (schemes === void 0 || schemes.length === 0) return DEFAULT_SCHEME;
-	if (schemes.includes(DEFAULT_SCHEME) && credentials.apiKey !== null) return DEFAULT_SCHEME;
+	if (schemes.includes(DEFAULT_SCHEME) && held(DEFAULT_SCHEME)) return DEFAULT_SCHEME;
 	for (const scheme of schemes) {
 		if (!Object.hasOwn(SCHEME_HEADERS, scheme)) continue;
 		const known = scheme;
-		if (valueFor(known, credentials) !== null) return known;
+		if (held(known)) return known;
 	}
 	return DEFAULT_SCHEME;
 };
+const schemeOfHeader = (name) => Object.keys(SCHEME_HEADERS).find((scheme) => SCHEME_HEADERS[scheme] === name);
 /**
 * What counts as loopback, pinned rather than assumed. `localhost` is not the
 * whole set:
@@ -275,9 +157,7 @@ const resolveHTTPURL = (target, base) => {
 /** Whether a credential may be sent to this origin at all. */
 const isCredentialSafeOrigin = (url, allowedHTTPOrigin = null) => url.protocol === "https:" || url.protocol === "http:" && (isLoopbackHostname(url.hostname) || allowedHTTPOrigin !== null && url.origin === allowedHTTPOrigin);
 const LOOPBACK_DESCRIPTION = "localhost, *.localhost, 127.0.0.0/8, [::1]";
-const insecureOriginMessage = (baseURL) => `Refusing to send a Composio API credential to ${baseURL}: a credentialed API origin must use HTTPS. By default, plain http:// is permitted only for loopback development endpoints (${LOOPBACK_DESCRIPTION}). Pass an https:// baseURL, use environment: 'local', set allowInsecureHTTP: true (or COMPOSIO_ALLOW_INSECURE_HTTP=1) for the configured development origin, or construct the client without credentials.`;
-/** Whether the client holds anything at all that rule 1 has to protect. */
-const anyCredential = (credentials) => credentials.apiKey !== null || hasAlternateCredential(credentials);
+const insecureOriginMessage = (baseURL) => `Refusing to send a Composio API credential to ${baseURL}: a credentialed API origin must use HTTPS. By default, plain http:// is permitted only for loopback development endpoints (${LOOPBACK_DESCRIPTION}). Pass an https:// or loopback baseURL, set allowInsecureHTTP: true (or COMPOSIO_ALLOW_INSECURE_HTTP=1) for the configured development origin, or construct the client without credentials.`;
 /**
 * Rule 1 at construction time: a client that holds a credential must be
 * pointed at an origin that can carry one. Knowable before any request is
@@ -286,13 +166,9 @@ const anyCredential = (credentials) => credentials.apiKey !== null || hasAlterna
 * A `baseURL` that is not an absolute http(s) URL fails the same way — a
 * credential cannot be sent over a scheme this client does not speak, and the
 * alternative is a `TypeError` from `new URL()` one layer down.
-*
-* Every configured credential counts, not just `apiKey`: which one a given
-* request carries is decided per operation, so a client holding *any* of them
-* is a client that can put one on the wire.
 */
-const assertCredentialTransport = (baseURL, credentials, allowedHTTPOrigin = null) => {
-	if (!anyCredential(credentials)) return;
+const assertCredentialTransport = (baseURL, credentialed, allowedHTTPOrigin = null) => {
+	if (!credentialed) return;
 	const url = parseHTTPURL(baseURL);
 	if (url === null || !isCredentialSafeOrigin(url, allowedHTTPOrigin)) throw new ComposioError(insecureOriginMessage(baseURL));
 };
@@ -300,7 +176,7 @@ const assertCredentialTransport = (baseURL, credentials, allowedHTTPOrigin = nul
 * The credential this request may carry, or `null` for none.
 *
 * Rules 1 and 2 at dispatch time. Both re-checks are load-bearing rather than
-* belt-and-braces: `apiKey` and `baseURL` are public mutable fields, so the
+* belt-and-braces: `baseURL` is a public mutable field, so the
 * construction-time check can be invalidated by an assignment, and the request
 * URL is *not* guaranteed to sit on the configured origin. `buildURL`
 * concatenates `baseURL + path` and the escape hatch (`client.get(path)`)
@@ -314,18 +190,14 @@ const assertCredentialTransport = (baseURL, credentials, allowedHTTPOrigin = nul
 * with credentials, so that one dies at the transport instead. httpx has no
 * such objection, which is why the Python port checks the same thing.)
 */
-const credentialForRequest = (baseURL, scheme, credentials, requestURL, allowedHTTPOrigin = null) => {
-	const value = valueFor(scheme, credentials);
-	if (value === null) return null;
+const credentialForRequest = (baseURL, credential, requestURL, allowedHTTPOrigin = null) => {
+	if (credential === null) return null;
 	const base = parseHTTPURL(baseURL);
 	const target = parseHTTPURL(requestURL);
 	if (base === null || target === null) return null;
 	if (base.origin !== target.origin) return null;
 	if (!isCredentialSafeOrigin(target, allowedHTTPOrigin)) throw new ComposioError(insecureOriginMessage(baseURL));
-	return {
-		name: SCHEME_HEADERS[scheme],
-		value
-	};
+	return credential;
 };
 /**
 * Whether two absolute http(s) URLs share an origin, by the same test
@@ -337,34 +209,6 @@ const sameOrigin = (a, b) => {
 	return origin !== void 0 && origin === parseHTTPURL(b)?.origin;
 };
 /**
-* The credential headers a *caller* can place that are not the one this client
-* attaches — `x-api-key` is excluded because a caller setting it is overriding
-* the client's own value in the same slot, which is pinned Stainless behaviour,
-* not a second credential.
-*/
-const FOREIGN_CREDENTIAL_HEADERS = ["x-user-api-key", "x-org-api-key"];
-/**
-* Whether the caller has placed a credential of their own, in which case the
-* client must not add one beside it.
-*
-* Not a courtesy: this API answers a request carrying two credential headers
-* with `401 HTTP_Unauthorized`, so attaching `x-api-key` next to a caller's
-* `x-user-api-key` does not weaken the call, it *breaks* it. Three released
-* methods make that reachable without any `defaultHeaders` at all —
-* `cli.createCodactFailure`, `org.consumer.project.resolve` and
-* `org.consumer.listConnectedToolkits` declare `x-user-api-key` as a `required`
-* header parameter, which the generator folds into their params object. Calling
-* them the way their signature asks for returned 401 until this rule existed.
-*
-* Header merging is replayed rather than approximated, because a later source
-* may carry `null` to delete what an earlier one set (`buildHeaders`).
-*/
-const callerPlacedCredential = (sources) => {
-	if (!sources.some(Boolean)) return false;
-	const headers = buildHeaders(sources);
-	return FOREIGN_CREDENTIAL_HEADERS.some((name) => headers.has(name));
-};
-/**
 * Header names that carry a credential and must not survive an origin change.
 *
 * The first three are what `fetch` itself would have stripped had it been
@@ -437,6 +281,188 @@ const withdrawCredentials = (headers) => {
 */
 const carriesCredentials = (headers) => CREDENTIAL_HEADERS.some((name) => headers.has(name));
 
+//#endregion
+//#region src/compat/auth.ts
+const NONE = Object.freeze({ mode: "none" });
+const authConstructors = () => Object.freeze({
+	none: () => NONE,
+	project: (credential) => Object.freeze({
+		mode: "project",
+		credential
+	}),
+	user: (credential) => Object.freeze({
+		mode: "user",
+		credential
+	}),
+	organization: (credential) => Object.freeze({
+		mode: "organization",
+		credential
+	}),
+	auto: (credentials) => Object.freeze({
+		mode: "auto",
+		credentials: Object.freeze({ ...credentials })
+	})
+});
+const Auth = authConstructors();
+const FIXED_MODES = [
+	"project",
+	"user",
+	"organization"
+];
+const SCHEME_OF_MODE = {
+	project: "ApiKeyAuth",
+	user: "UserApiKeyAuth",
+	organization: "OrgApiKeyAuth"
+};
+const isFixedMode = (mode) => FIXED_MODES.includes(mode);
+/** One credential is that fixed mode, several is `auto`, none is `none`. Shared by `fromEnv` and `layerConfig`. */
+const authFromCredentials = (credentials) => {
+	const auth = authConstructors();
+	const [first, ...rest] = FIXED_MODES.filter((mode) => credentials[mode] !== void 0);
+	if (first === void 0) return auth.none();
+	if (rest.length > 0) return auth.auto(credentials);
+	return auth[first](credentials[first]);
+};
+const isSendable = (value, name = "x-api-key") => {
+	try {
+		new globalThis.Headers().set(name, value);
+		return true;
+	} catch {
+		return false;
+	}
+};
+const isUsableKey = (key) => typeof key === "string" && /\S/.test(key) && isSendable(key);
+const unusableKeyError = (source) => new ComposioError(`${source} is not a usable key: it must be a string with a non-whitespace character and no line break, NUL or character outside Latin-1.`);
+const holdCredential = (value, option, kind) => {
+	if (!kind.is(value)) throw new ComposioError(`\`${option}\` must be a key or a function that returns one.`);
+	const key = kind.keyOf(value);
+	if (key !== void 0 && !isUsableKey(key)) throw unusableKeyError(`\`${option}\``);
+	return value;
+};
+const holdAuto = (given, kind) => {
+	const credentials = {};
+	for (const mode of FIXED_MODES) {
+		const value = given?.[mode];
+		if (value !== void 0) credentials[SCHEME_OF_MODE[mode]] = holdCredential(value, `auth.credentials.${mode}`, kind);
+	}
+	if (Object.keys(credentials).length === 0) throw new ComposioError("`Auth.auto` needs at least one of `project`, `user` and `organization`.");
+	return credentials;
+};
+const MIGRATION = "Pass `auth`: `Auth.project(key)`, `Auth.user(key)`, `Auth.organization(key)`, `Auth.auto({ project, user, organization })` or `Auth.none()`.";
+const resolveAuth = (auth, kind) => {
+	const value = auth;
+	const mode = value?.mode;
+	if (mode === void 0) throw new ComposioError(`\`auth\` is required. ${MIGRATION}`);
+	if (mode === "none") return {
+		mode,
+		credentials: {}
+	};
+	if (mode === "auto") return {
+		mode,
+		credentials: holdAuto(value?.credentials, kind)
+	};
+	if (!isFixedMode(mode)) throw new ComposioError(`\`auth.mode\` must be 'none', 'project', 'user', 'organization' or 'auto'. ${MIGRATION}`);
+	return {
+		mode,
+		credentials: { [SCHEME_OF_MODE[mode]]: holdCredential(value?.credential, "auth.credential", kind) }
+	};
+};
+const REMOVED_OPTIONS = {
+	apiKey: "Auth.project(key)",
+	userApiKey: "Auth.user(key)",
+	orgApiKey: "Auth.organization(key)"
+};
+const assertNoRemovedCredentialOptions = (options) => {
+	for (const [option, replacement] of Object.entries(REMOVED_OPTIONS)) {
+		if (!Object.hasOwn(options, option)) continue;
+		throw new ComposioError(`The \`${option}\` option was removed in 2.0.0-rc.18. Pass \`auth: ${replacement}\` instead, or \`Auth.auto({ ... })\` for per-operation selection.`);
+	}
+};
+const CREDENTIAL_HEADER_NAMES = Object.values(SCHEME_HEADERS);
+const SCOPE_HEADER_NAMES = ["x-org-id", "x-project-id"];
+const isScopeId = (value) => typeof value === "string" && value !== "" && value === value.trim() && isSendable(value, "x-org-id");
+const scopeId = (field, value) => {
+	if (value === void 0) return void 0;
+	if (!isScopeId(value)) throw new ComposioError(`\`scope.${field}\` must be a non-empty string with no surrounding whitespace.`);
+	return value;
+};
+const resolveScope = (scope) => {
+	if (scope === void 0) return void 0;
+	if (typeof scope !== "object" || scope === null) throw new ComposioError("`scope` must be an object with an `organizationId`, a `projectId`, or both.");
+	const { organizationId, projectId } = scope;
+	const headers = {};
+	const org = scopeId("organizationId", organizationId);
+	const project = scopeId("projectId", projectId);
+	if (org !== void 0) headers["x-org-id"] = org;
+	if (project !== void 0) headers["x-project-id"] = project;
+	if (Object.keys(headers).length === 0) throw new ComposioError("`scope` must name an `organizationId`, a `projectId`, or both.");
+	return headers;
+};
+const assertRequiredOperationHeaders = (operation, supplied) => {
+	for (const name of operation?.requiredHeaders ?? []) {
+		if (supplied?.[name] != null) continue;
+		throw new ComposioError(`\`${operation?.chain.join(".")}\` requires the \`${name}\` parameter.`);
+	}
+};
+const scopeForCall = (configured, supplied) => {
+	const merged = { ...configured };
+	for (const name of SCOPE_HEADER_NAMES) {
+		const value = supplied?.[name];
+		if (value == null) continue;
+		const current = configured?.[name];
+		if (current !== void 0 && current !== value) throw new ComposioError(`The \`${name}\` parameter disagrees with the client's \`scope\`. Derive a client with \`withOptions({ scope })\` to address another one.`);
+		merged[name] = value;
+	}
+	return merged;
+};
+const operationCredential = (supplied) => {
+	for (const [name, value] of Object.entries(supplied ?? {})) {
+		const scheme = schemeOfHeader(name);
+		if (scheme !== void 0 && value != null) return {
+			scheme,
+			credential: value
+		};
+	}
+};
+const configuredScheme = (auth, operation) => {
+	if (auth.mode === "none") return void 0;
+	if (auth.mode === "auto") return selectScheme(operation?.schemes, (scheme) => auth.credentials[scheme] !== void 0);
+	return SCHEME_OF_MODE[auth.mode];
+};
+/**
+* The credential one call carries: an operation credential replaces `auth`,
+* and a fixed mode never reads the operation table. `null` off the API origin.
+*/
+const chooseCredential = (auth, baseURL, requestURL, operation, supplied) => {
+	if (!sameOrigin(baseURL, requestURL)) return null;
+	const own = operationCredential(supplied);
+	if (own !== void 0) return own;
+	const scheme = configuredScheme(auth, operation);
+	if (scheme === void 0) return null;
+	const credential = auth.credentials[scheme];
+	return credential === void 0 ? null : {
+		scheme,
+		credential
+	};
+};
+const credentialHeader = (scheme, key) => {
+	const name = SCHEME_HEADERS[scheme];
+	if (!isUsableKey(key)) throw unusableKeyError(`The \`${name}\` credential`);
+	return {
+		name,
+		value: key
+	};
+};
+const providerFailed = (cause) => {
+	const error = new ComposioError("The `auth` credential provider failed.");
+	Object.defineProperty(error, "cause", {
+		value: cause,
+		configurable: true,
+		writable: true
+	});
+	return error;
+};
+
 //#endregion
 //#region src/compat/deprecation.ts
 /**
@@ -907,9 +933,82 @@ const inspectDeprecatedInputs = ({ operation, query, body, headers, table, seen,
 	}
 };
 
+//#endregion
+//#region src/compat/headers.ts
+const hasEntries = (value) => typeof value === "object" && value !== null && "append" in value && typeof value.append === "function" && "delete" in value && typeof value.delete === "function" && "entries" in value && typeof value.entries === "function" && "get" in value && typeof value.get === "function";
+const isHeaders = (value) => value instanceof Headers || hasEntries(value);
+const isNullableHeadersLike = (headers) => {
+	if (!("values" in headers) || !isHeaders(headers.values) || !("nulls" in headers)) return false;
+	const nulls = headers.nulls;
+	return typeof nulls === "object" && nulls !== null && Symbol.iterator in nulls;
+};
+/**
+* Iterates every supported input while preserving explicit deletions. Plain
+* objects replace an older value for a key; tuple inputs append duplicate
+* values, matching the published client.
+*/
+function* iterateHeaders(headers) {
+	if (!headers) return;
+	if (isNullableHeadersLike(headers)) {
+		yield* headers.values.entries();
+		for (const name of headers.nulls) yield [name, null];
+		return;
+	}
+	const shouldReplace = !isHeaders(headers) && !Array.isArray(headers);
+	const entries = isHeaders(headers) ? headers.entries() : Array.isArray(headers) ? headers : Object.entries(headers);
+	for (const entry of entries) {
+		const name = entry[0];
+		if (typeof name !== "string") throw new TypeError("expected header name to be a string");
+		const rawValue = entry[1];
+		const values = Array.isArray(rawValue) ? rawValue : [rawValue];
+		let replaced = false;
+		for (const value of values) {
+			if (value === void 0) continue;
+			if (shouldReplace && !replaced) {
+				replaced = true;
+				yield [name, null];
+			}
+			yield [name, value];
+		}
+	}
+}
+/** Merge sources while retaining names explicitly deleted by the last source. */
+const mergeHeaders = (sources) => {
+	const values = new Headers();
+	const nulls = /* @__PURE__ */ new Set();
+	for (const source of sources) {
+		if (!source) continue;
+		const seen = /* @__PURE__ */ new Set();
+		for (const [name, value] of iterateHeaders(source)) {
+			const lowerName = name.toLowerCase();
+			if (!seen.has(lowerName)) {
+				values.delete(name);
+				seen.add(lowerName);
+			}
+			if (value === null) {
+				values.delete(name);
+				nulls.add(lowerName);
+			} else {
+				values.append(name, value);
+				nulls.delete(lowerName);
+			}
+		}
+	}
+	return {
+		values,
+		nulls
+	};
+};
+/** Merge sources into the native header collection sent to fetch. */
+const buildHeaders = (sources) => mergeHeaders(sources).values;
+/** Every header name a source mentions, lowercased, a `null` deletion included. */
+function* headerNames(headers) {
+	for (const [name] of iterateHeaders(headers)) yield name.toLowerCase();
+}
+
 //#endregion
 //#region src/version.ts
-const VERSION = "2.0.0-rc.17";
+const VERSION = "2.0.0-rc.19";
 
 //#endregion
 //#region src/compat/identity.ts
@@ -1061,18 +1160,32 @@ const resolveIdentity = (identity) => {
 		reserved: IDENTITY_RESERVED
 	};
 };
+/** Credential names are reserved while `auth` is not `none`, routing ids while `scope` is set. */
+const reservedHeaders = (identity, configured) => {
+	const reserved = /* @__PURE__ */ new Map();
+	for (const name of identity.reserved) reserved.set(name, PACKAGE_RESERVED.has(name) ? "client" : "identity");
+	if (configured.auth) for (const name of CREDENTIAL_HEADER_NAMES) reserved.set(name, "auth");
+	if (configured.scope) for (const name of SCOPE_HEADER_NAMES) reserved.set(name, "scope");
+	return reserved;
+};
+const REMEDY = {
+	client: " Pass `identity` to describe the calling product.",
+	identity: "",
+	auth: " Configure the credential through `auth`; derive a client with `withOptions({ auth })` for another one.",
+	scope: " Configure the organization and project through `scope`; derive a client with `withOptions({ scope })` for another one."
+};
 /**
-* Refuses a generic header source that names an identity header, whether it
+* Refuses a generic header source that names a reserved header, whether it
 * sets one or deletes one with `null`. Constructor validation runs it over
 * `defaultHeaders`; request validation over a call's `headers`, before any
 * network work.
 */
-const assertNoReservedHeaders = (headers, identity, option) => {
+const assertNoReservedHeaders = (headers, reserved, option) => {
 	if (!headers) return;
 	for (const name of headerNames(headers)) {
-		if (!identity.reserved.has(name)) continue;
-		const owner = PACKAGE_RESERVED.has(name) ? "the client" : "`identity`";
-		throw new ComposioError(`The \`${name}\` header is set by ${owner} and cannot be passed in \`${option}\`.` + (owner === "`identity`" ? "" : " Pass `identity` to describe the calling product."));
+		const owner = reserved.get(name);
+		if (owner === void 0) continue;
+		throw new ComposioError(`The \`${name}\` header is set by ${owner === "client" ? "the client" : `\`${owner}\``} and cannot be passed in \`${option}\`.${REMEDY[owner]}`);
 	}
 };
 
@@ -1142,20 +1255,25 @@ const createFetchTransport = (options = {}) => {
 * regression that measures fine and reports nothing.
 */
 const OPERATION = Symbol("composio.operation");
+/** The owned header parameters (`x-user-api-key`, `x-org-id`) a generated call supplied. */
+const OPERATION_HEADERS = Symbol("composio.operationHeaders");
 /**
-* Attach a generated call's operation to the options bag it dispatches with.
+* Attach a generated call's operation, and its owned header parameters, to
+* the options bag it dispatches with.
 *
 * Called with the freshly built literal — never with the caller's own object —
 * and *after* the caller's options have been spread into it, so a caller
 * cannot pre-empt the descriptor: the write happens last, and the key it
 * writes to is not one a caller can name.
 */
-const withOperation = (operation, options) => {
+const withOperation = (operation, options, headers) => {
 	options[OPERATION] = operation;
+	if (headers !== void 0) options[OPERATION_HEADERS] = headers;
 	return options;
 };
 /** The operation a generated call recorded, or `undefined` for a raw one. */
 const readOperation = (options) => options[OPERATION];
+const readOperationHeaders = (options) => options[OPERATION_HEADERS];
 /** A request label safe to print: dynamic path values and URL secrets are excluded. */
 const printableURL = (url, operation) => `${new URL(url).origin}${operation?.path ?? "/<custom>"}`;
 const emitLog = (config, level, message, metadata) => {
@@ -1418,24 +1536,27 @@ const kernelInternals = { sleep };
 * The headers for one hop, built fresh from the URL that hop is going to.
 *
 * This is where rule 3 mostly stops needing machinery of its own: the
-* credential is re-derived per hop from the *request* URL rather than carried
-* along from the last one, so a hop that leaves the configured API origin
-* simply does not get a key. `withdrawn` covers what that cannot — the
+* credential is re-checked per hop against the *request* URL rather than
+* carried along from the last one, so a hop that leaves the configured API
+* origin simply does not get a key. `withdrawn` covers what that cannot — the
 * caller's own credential headers, which are legitimate on the URL the caller
 * chose and are dropped once the *server* has chosen one.
 *
-* The client's identity headers follow the same per-hop rule: they describe
-* this client to its own API, so a hop off the configured origin (a presigned
-* storage URL, a redirect target) goes without them.
+* The client's identity and scope headers follow the same per-hop rule: they
+* describe this client to its own API, so a hop off the configured origin (a
+* presigned storage URL, a redirect target) goes without them.
 */
-const buildRequestHeaders = (config, options, requestURL, bodyHeaders, withdrawn, scheme, callerPlaced) => {
-	const credential = withdrawn || callerPlaced ? null : credentialForRequest(config.baseURL, scheme, config.credentials, requestURL, config.allowedHTTPOrigin);
-	const identity = sameOrigin(config.baseURL, requestURL) ? config.identity.headers : void 0;
+const buildRequestHeaders = (config, options, requestURL, bodyHeaders, withdrawn, call) => {
+	const credential = withdrawn ? null : credentialForRequest(config.baseURL, call.credential, requestURL, config.allowedHTTPOrigin);
+	const own = sameOrigin(config.baseURL, requestURL);
+	const identity = own ? config.identity.headers : void 0;
+	const scope = own ? call.scope : void 0;
 	if (!withdrawn && bodyHeaders === void 0 && !config.defaultHeaders && !options.headers && options.idempotencyKey === void 0) {
 		const direct = new Headers({
 			...identity,
 			accept: "application/json",
-			"user-agent": config.userAgent
+			"user-agent": config.userAgent,
+			...scope
 		});
 		if (credential !== null) direct.set(credential.name, credential.value);
 		return direct;
@@ -1448,6 +1569,7 @@ const buildRequestHeaders = (config, options, requestURL, bodyHeaders, withdrawn
 			"user-agent": config.userAgent
 		},
 		credential === null ? void 0 : { [credential.name]: credential.value },
+		scope,
 		config.defaultHeaders,
 		bodyHeaders,
 		options.headers
@@ -1455,28 +1577,25 @@ const buildRequestHeaders = (config, options, requestURL, bodyHeaders, withdrawn
 	if (withdrawn) withdrawCredentials(headers);
 	return headers;
 };
-/**
-* The credential class this logical request authenticates with, decided once
-* from the operation the *caller* invoked.
-*
-* Deliberately not re-derived per redirect hop. A hop's URL was chosen by the
-* server, so matching it back to a template would let the server's choice
-* change which of the caller's credentials goes out; the operation the caller
-* asked for is the honest answer for the whole chain, and rule 3 already
-* withdraws everything once a hop leaves the origin.
-*
-* `operation` is the match `makeRequest` already computed for the static
-* deprecated-input check, threaded in rather than re-derived: the two
-* features need the same fact, so `matchOperation` runs once per logical call
-* regardless of which of them a given client configuration actually uses.
-* With only `apiKey` set the scheme answer is still `ApiKeyAuth` down every
-* branch of {@link selectScheme}, so an existing caller's requests stay
-* byte-identical by construction; what changed is that the match itself is no
-* longer skippable, because the deprecated-input warning needs it too.
-*/
-const schemeForRequest = (config, operation) => {
-	if (!hasAlternateCredential(config.credentials)) return "ApiKeyAuth";
-	return selectScheme(operation?.schemes, config.credentials);
+const callProvider = (provider, header) => {
+	let key;
+	try {
+		key = provider();
+	} catch (cause) {
+		throw providerFailed(cause);
+	}
+	if (typeof key === "string") return header(key);
+	return Promise.resolve(key).then(header, (cause) => {
+		throw providerFailed(cause);
+	});
+};
+/** Synchronous unless a provider has to be awaited, so a string key goes out in the turn the call starts. */
+const resolveCallCredential = (config, requestURL, operation, supplied) => {
+	const choice = chooseCredential(config.auth, config.baseURL, requestURL, operation, supplied);
+	if (choice === null) return null;
+	const header = (key) => credentialHeader(choice.scheme, key);
+	if (typeof choice.credential === "string") return header(choice.credential);
+	return callProvider(choice.credential, header);
 };
 /**
 * One attempt: the request, plus however many redirects it takes to land on a
@@ -1494,15 +1613,14 @@ const schemeForRequest = (config, operation) => {
 * rewrite), and the query, which is left to the `Location` URL because the
 * server picked it.
 */
-const dispatchWithRedirects = async (config, options, initialURL, initialBody, initialBodyHeaders, signal, scheme) => {
+const dispatchWithRedirects = async (config, options, initialURL, initialBody, initialBodyHeaders, signal, call) => {
 	let url = initialURL;
 	let method = options.method.toUpperCase();
 	let body = initialBody;
 	let bodyHeaders = initialBodyHeaders;
 	let withdrawn = false;
-	const callerPlaced = callerPlacedCredential([config.defaultHeaders, options.headers]);
 	for (let hop = 0;; hop++) {
-		const headers = buildRequestHeaders(config, options, url, bodyHeaders, withdrawn, scheme, callerPlaced);
+		const headers = buildRequestHeaders(config, options, url, bodyHeaders, withdrawn, call);
 		const delegated = hop === 0 && !carriesCredentials(headers);
 		const init = {
 			method,
@@ -1547,7 +1665,7 @@ const dispatchWithRedirects = async (config, options, initialURL, initialBody, i
 * which is what `deprecation.ts` resolves relative `Link` targets against.
 */
 async function makeRequest(config, options) {
-	assertNoReservedHeaders(options.headers, config.identity, "headers");
+	assertNoReservedHeaders(options.headers, config.reserved, "headers");
 	if (options.timeout !== void 0) validatePositiveInteger("timeout", options.timeout);
 	const maxRetries = options.maxRetries ?? config.maxRetries;
 	validatePositiveInteger("maxRetries", maxRetries);
@@ -1563,7 +1681,14 @@ async function makeRequest(config, options) {
 		url: printableURL(url, operation),
 		maxAttempts: maxRetries + 1
 	};
-	const scheme = schemeForRequest(config, operation);
+	const supplied = readOperationHeaders(options);
+	assertRequiredOperationHeaders(threaded ?? null, supplied);
+	const scope = scopeForCall(config.scope, supplied);
+	const credential = resolveCallCredential(config, url, operation, supplied);
+	const call = {
+		scope,
+		credential: credential instanceof Promise ? await credential : credential
+	};
 	if (config.onRequest !== void 0 && (threaded === void 0 || threaded.hasDeprecatedInputs === true)) config.onRequest(operation, query, options.body, buildHeaders([config.defaultHeaders, options.headers]));
 	for (let numRetries = 0;; numRetries++) {
 		if (userSignal?.aborted) throw new APIUserAbortError();
@@ -1581,7 +1706,7 @@ async function makeRequest(config, options) {
 		const timer = setTimeout(abort, timeout);
 		let result;
 		try {
-			result = await dispatchWithRedirects(config, options, url, body, bodyHeaders, controller.signal, scheme);
+			result = await dispatchWithRedirects(config, options, url, body, bodyHeaders, controller.signal, call);
 		} catch (cause) {
 			if (cause instanceof ComposioError) {
 				if (attemptLog !== void 0) emitLog(config, "info", "Request failed", {
@@ -1841,7 +1966,8 @@ const GENERATED_OPERATIONS = [
 			"consumer",
 			"listConnectedToolkits"
 		],
-		schemes: ["UserApiKeyAuth"]
+		schemes: ["UserApiKeyAuth"],
+		requiredHeaders: ["x-user-api-key", "x-org-id"]
 	},
 	{
 		method: "get",
@@ -2106,7 +2232,8 @@ const GENERATED_OPERATIONS = [
 		method: "post",
 		path: "/api/v3.1/cli/codact_failures",
 		chain: ["cli", "createCodactFailure"],
-		schemes: ["UserApiKeyAuth"]
+		schemes: ["UserApiKeyAuth"],
+		requiredHeaders: ["x-user-api-key"]
 	},
 	{
 		method: "post",
@@ -2238,7 +2365,8 @@ const GENERATED_OPERATIONS = [
 			"project",
 			"resolve"
 		],
-		schemes: ["UserApiKeyAuth"]
+		schemes: ["UserApiKeyAuth"],
+		requiredHeaders: ["x-user-api-key", "x-org-id"]
 	},
 	{
 		method: "post",
@@ -2478,4 +2606,4 @@ const generatedOperation = (chainKey) => {
 };
 
 //#endregion
-export { callerPlacedCredential as A, resolveIdentity as C, matchOperation as D, inspectDeprecation as E, mergeHeaders as F, parseHTTPURL as M, resolveHTTPURL as N, SCHEME_HEADERS as O, buildHeaders as P, assertNoReservedHeaders as S, inspectDeprecatedInputs as T, schemeForRequest as _, TOO_MANY_REDIRECTS as a, withOperation as b, buildURL as c, path as d, printableURL as f, safeJSON as g, rewriteForRedirect as h, REDIRECT_STATUSES as i, carriesCredentials as j, assertCredentialTransport as k, castToError as l, retryDelayMillis as m, generatedOperation as n, buildBody as o, readOperation as p, OPAQUE_REDIRECT as r, buildRequestHeaders as s, GENERATED_OPERATIONS as t, makeRequest as u, shouldRetryResponse as v, VERSION as w, createFetchTransport as x, validatePositiveInteger as y };
+export { Auth as A, SCHEME_HEADERS as B, resolveIdentity as C, inspectDeprecatedInputs as D, mergeHeaders as E, chooseCredential as F, carriesCredentials as H, credentialHeader as I, resolveAuth as L, assertRequiredOperationHeaders as M, authConstructors as N, inspectDeprecation as O, authFromCredentials as P, resolveScope as R, reservedHeaders as S, buildHeaders as T, parseHTTPURL as U, assertCredentialTransport as V, resolveHTTPURL as W, shouldRetryResponse as _, TOO_MANY_REDIRECTS as a, createFetchTransport as b, buildURL as c, path as d, printableURL as f, safeJSON as g, rewriteForRedirect as h, REDIRECT_STATUSES as i, assertNoRemovedCredentialOptions as j, matchOperation as k, castToError as l, retryDelayMillis as m, generatedOperation as n, buildBody as o, readOperation as p, OPAQUE_REDIRECT as r, buildRequestHeaders as s, GENERATED_OPERATIONS as t, makeRequest as u, validatePositiveInteger as v, VERSION as w, assertNoReservedHeaders as x, withOperation as y, scopeForCall as z };