@composio/client 2.0.0-rc.2 → 2.0.0-rc.21

package/dist/{request-zLX87M09.mjs → generated-operations-BNRn8az6.mjs}

@@ -1,145 +1,5 @@
-//#region src/compat/error.ts
-/**
-* Stainless-compatible error hierarchy.
-*
-* Downstream code does `instanceof` checks and reads `status` / `error` /
-* `headers` on these classes (see docs/research/drop-in-contract.md §4), so
-* both the class names and the inheritance chain are part of the drop-in
-* contract: `BadRequestError extends APIError extends ComposioError extends Error`.
-*/
-var ComposioError = class extends Error {};
-var APIError = class APIError extends ComposioError {
-	/** HTTP status for the response that caused the error. */
-	status;
-	/** HTTP headers of the response that caused the error. */
-	headers;
-	/** JSON body of the response that caused the error. */
-	error;
-	constructor(status, error, message, headers) {
-		super(APIError.makeMessage(status, error, message));
-		this.status = status;
-		this.headers = headers;
-		this.error = error;
-	}
-	static makeMessage(status, error, message) {
-		const errorMessage = error?.message;
-		const msg = errorMessage ? typeof errorMessage === "string" ? errorMessage : JSON.stringify(errorMessage) : error ? JSON.stringify(error) : message;
-		if (status && msg) return `${status} ${msg}`;
-		if (status) return `${status} status code (no body)`;
-		if (msg) return msg;
-		return "(no status code or body)";
-	}
-	static generate(status, errorResponse, message, headers) {
-		if (!status || !headers) return new APIConnectionError({
-			message,
-			cause: errorResponse
-		});
-		const error = errorResponse;
-		if (status === 400) return new BadRequestError(status, error, message, headers);
-		if (status === 401) return new AuthenticationError(status, error, message, headers);
-		if (status === 403) return new PermissionDeniedError(status, error, message, headers);
-		if (status === 404) return new NotFoundError(status, error, message, headers);
-		if (status === 409) return new ConflictError(status, error, message, headers);
-		if (status === 422) return new UnprocessableEntityError(status, error, message, headers);
-		if (status === 429) return new RateLimitError(status, error, message, headers);
-		if (status >= 500) return new InternalServerError(status, error, message, headers);
-		return new APIError(status, error, message, headers);
-	}
-};
-var APIUserAbortError = class extends APIError {
-	constructor({ message } = {}) {
-		super(void 0, void 0, message ?? "Request was aborted.", void 0);
-	}
-};
-var APIConnectionError = class extends APIError {
-	constructor({ message, cause }) {
-		super(void 0, void 0, message ?? "Connection error.", void 0);
-		if (cause) this.cause = cause;
-	}
-};
-var APIConnectionTimeoutError = class extends APIConnectionError {
-	constructor({ message } = {}) {
-		super({ message: message ?? "Request timed out." });
-	}
-};
-var BadRequestError = class extends APIError {};
-var AuthenticationError = class extends APIError {};
-var PermissionDeniedError = class extends APIError {};
-var NotFoundError = class extends APIError {};
-var ConflictError = class extends APIError {};
-var UnprocessableEntityError = class extends APIError {};
-var RateLimitError = class extends APIError {};
-var InternalServerError = class extends APIError {};
-
-//#endregion
-//#region src/compat/headers.ts
-const hasEntries = (value) => typeof value === "object" && value !== null && "append" in value && typeof value.append === "function" && "delete" in value && typeof value.delete === "function" && "entries" in value && typeof value.entries === "function" && "get" in value && typeof value.get === "function";
-const isHeaders = (value) => value instanceof Headers || hasEntries(value);
-const isNullableHeadersLike = (headers) => {
-	if (!("values" in headers) || !isHeaders(headers.values) || !("nulls" in headers)) return false;
-	const nulls = headers.nulls;
-	return typeof nulls === "object" && nulls !== null && Symbol.iterator in nulls;
-};
-/**
-* Iterates every supported input while preserving explicit deletions. Plain
-* objects replace an older value for a key; tuple inputs append duplicate
-* values, matching the published client.
-*/
-function* iterateHeaders(headers) {
-	if (!headers) return;
-	if (isNullableHeadersLike(headers)) {
-		yield* headers.values.entries();
-		for (const name of headers.nulls) yield [name, null];
-		return;
-	}
-	const shouldReplace = !isHeaders(headers) && !Array.isArray(headers);
-	const entries = isHeaders(headers) ? headers.entries() : Array.isArray(headers) ? headers : Object.entries(headers);
-	for (const entry of entries) {
-		const name = entry[0];
-		if (typeof name !== "string") throw new TypeError("expected header name to be a string");
-		const rawValue = entry[1];
-		const values = Array.isArray(rawValue) ? rawValue : [rawValue];
-		let replaced = false;
-		for (const value of values) {
-			if (value === void 0) continue;
-			if (shouldReplace && !replaced) {
-				replaced = true;
-				yield [name, null];
-			}
-			yield [name, value];
-		}
-	}
-}
-/** Merge sources while retaining names explicitly deleted by the last source. */
-const mergeHeaders = (sources) => {
-	const values = new Headers();
-	const nulls = /* @__PURE__ */ new Set();
-	for (const source of sources) {
-		const seen = /* @__PURE__ */ new Set();
-		for (const [name, value] of iterateHeaders(source)) {
-			const lowerName = name.toLowerCase();
-			if (!seen.has(lowerName)) {
-				values.delete(name);
-				seen.add(lowerName);
-			}
-			if (value === null) {
-				values.delete(name);
-				nulls.add(lowerName);
-			} else {
-				values.append(name, value);
-				nulls.delete(lowerName);
-			}
-		}
-	}
-	return {
-		values,
-		nulls
-	};
-};
-/** Merge sources into the native header collection sent to fetch. */
-const buildHeaders = (sources) => mergeHeaders(sources).values;
+import { i as APIUserAbortError, n as APIConnectionTimeoutError, s as ComposioError, t as APIConnectionError } from "./error-Bw7_G2NZ.mjs";
 
-//#endregion
 //#region src/compat/credentials.ts
 /**
 * The credential transport boundary.
@@ -154,14 +14,15 @@ const buildHeaders = (sources) => mergeHeaders(sources).values;
 *    measured property of the API (two credential headers on one request is a
 *    401, even where either alone is a 200), so the four rules below are all
 *    stated about *the* credential a request carries, and {@link selectScheme}
-*    decides which one that is. See wayfinder ticket 48 and §4 of
+*    decides which one that is. See §4 of
 *    `docs/research/drop-in-contract.md`.
 * 1. **A credentialed API origin must use HTTPS.** Plain `http:` is permitted
-*    only for loopback development endpoints — which is exactly what the
-*    sanctioned `environment: 'local'` default (`http://localhost:9900`) is.
+*    only for loopback development endpoints, or for the exact origin a
+*    caller opts into with `allowInsecureHTTP` or
+*    `COMPOSIO_ALLOW_INSECURE_HTTP=1`.
 *    Enforced by {@link assertCredentialTransport} at construction and again
-*    by {@link credentialForRequest} at dispatch, because `apiKey` and
-*    `baseURL` are both public mutable fields on the client.
+*    by {@link credentialForRequest} at dispatch, because `baseURL` is a
+*    public mutable field on the client.
 * 2. **The credential is attached only to requests whose origin matches the
 *    configured API origin.** {@link credentialForRequest} returns `null`
 *    off-origin, and the header is simply not sent.
@@ -207,7 +68,7 @@ const buildHeaders = (sources) => mergeHeaders(sources).values;
 * Deliberate, and sanctioned by the design record: the published Stainless
 * client enforces none of this. Redirect *following* is no longer part of the
 * divergence — both clients follow — but what rides along on the hop is. See
-* §4 of `docs/research/drop-in-contract.md` and wayfinder ticket 40.
+* §4 of `docs/research/drop-in-contract.md`.
 */
 /**
 * The three credential classes this API accepts, and the header each one puts
@@ -224,70 +85,25 @@ const SCHEME_HEADERS = {
 };
 /** The scheme a request authenticates with when its operation names none. */
 const DEFAULT_SCHEME = "ApiKeyAuth";
-const valueFor = (scheme, credentials) => scheme === "ApiKeyAuth" ? credentials.apiKey : scheme === "UserApiKeyAuth" ? credentials.userApiKey : credentials.orgApiKey;
 /**
-* Whether anything beyond the project key is configured — the condition that
-* makes per-operation selection able to change an outcome at all.
-*
-* Load-bearing rather than an optimization. With only `apiKey` set, every
-* branch of {@link selectScheme} lands on `ApiKeyAuth`: it wins wherever it is
-* an accepted alternative, and where it is not, the alternative is unconfigured
-* and the fallback is `ApiKeyAuth` again. So the client that every existing
-* caller constructs never consults the operation table, and "an `apiKey`-only
-* client emits byte-identical requests on all 104 operations" is a property of
-* the code shape rather than a claim tests have to keep re-establishing.
+* `Auth.auto`'s choice for an operation declaring `schemes`: `ApiKeyAuth`
+* wherever the operation accepts it and a project key is held, else the first
+* declared scheme that is held, else `ApiKeyAuth`. An undeclared scheme name
+* (`no_auth`, `workbench_access_key`) falls through to `ApiKeyAuth`, as every
+* release before rc.18 sent. A request may carry only one credential: the API
+* answers two with a 401.
 */
-const hasAlternateCredential = (credentials) => credentials.userApiKey !== null || credentials.orgApiKey !== null;
-/**
-* Which credential a request declaring `schemes` should carry.
-*
-* **Exactly one, always** — and the API says so itself. Measured against
-* production on 2026-08-06, `GET /toolkits` answers 200 for `x-api-key` alone
-* and 200 for `x-user-api-key` alone, and answers both together with
-* `401 HTTP_Unauthorized`:
-*
-* > Multiple authentication modes were provided. Provide exactly one
-* > authentication mode per request. Provided: ApiKeyAuth via x-api-key,
-* > UserApiKeyAuth via x-user-api-key.
-*
-* The platform names the schemes by their OpenAPI names, so this is the same
-* vocabulary `security` is written in rather than a coincidence of headers. It
-* holds for `x-api-key` + `x-org-api-key` too, and on an operation that accepts
-* only one of them. There is therefore no additive "send the user key as well"
-* model available, and the choice has to be made per request rather than
-* accumulated.
-*
-* The precedence exists to make the change free where it must be free:
-*
-* 1. **`ApiKeyAuth` wins wherever the operation accepts it** and an `apiKey` is
-*    configured — 85 of the 104 operations, every wire byte preserved.
-* 2. Otherwise the first scheme the operation names that this client both
-*    recognizes *and* holds a credential for. That is what makes the 16
-*    `UserApiKeyAuth`-only and `OrgApiKeyAuth`-only operations reachable.
-* 3. Otherwise `ApiKeyAuth`, which is what this client did before any of this
-*    existed. A `UserApiKeyAuth`-only operation called by a client with no user
-*    key still sends `x-api-key` and still fails the same way — which is what
-*    keeps `cli.realtime.auth` and `cli.realtime.credentials` pinned against
-*    the Stainless oracle in `test/unit/differential-wire.test.ts`.
-*
-* Rule 3 is also where a scheme name this client does not know lands. Three of
-* them exist: `security` references `no_auth` (3 operations) and
-* `workbench_access_key` (1) and `components.securitySchemes` declares neither.
-* Those four operations receive `x-api-key` today and are differentially
-* pinned doing so, so resolving an unknown name to "no credential" would be a
-* wire change made on the strength of a spec defect. A later generator pass
-* must not "fix" that.
-*/
-const selectScheme = (schemes, credentials) => {
+const selectScheme = (schemes, held) => {
 	if (schemes === void 0 || schemes.length === 0) return DEFAULT_SCHEME;
-	if (schemes.includes(DEFAULT_SCHEME) && credentials.apiKey !== null) return DEFAULT_SCHEME;
+	if (schemes.includes(DEFAULT_SCHEME) && held(DEFAULT_SCHEME)) return DEFAULT_SCHEME;
 	for (const scheme of schemes) {
 		if (!Object.hasOwn(SCHEME_HEADERS, scheme)) continue;
 		const known = scheme;
-		if (valueFor(known, credentials) !== null) return known;
+		if (held(known)) return known;
 	}
 	return DEFAULT_SCHEME;
 };
+const schemeOfHeader = (name) => Object.keys(SCHEME_HEADERS).find((scheme) => SCHEME_HEADERS[scheme] === name);
 /**
 * What counts as loopback, pinned rather than assumed. `localhost` is not the
 * whole set:
@@ -339,11 +155,9 @@ const resolveHTTPURL = (target, base) => {
 	}
 };
 /** Whether a credential may be sent to this origin at all. */
-const isCredentialSafeOrigin = (url) => url.protocol === "https:" || url.protocol === "http:" && isLoopbackHostname(url.hostname);
+const isCredentialSafeOrigin = (url, allowedHTTPOrigin = null) => url.protocol === "https:" || url.protocol === "http:" && (isLoopbackHostname(url.hostname) || allowedHTTPOrigin !== null && url.origin === allowedHTTPOrigin);
 const LOOPBACK_DESCRIPTION = "localhost, *.localhost, 127.0.0.0/8, [::1]";
-const insecureOriginMessage = (baseURL) => `Refusing to send a Composio API credential to ${baseURL}: a credentialed API origin must use HTTPS. Plain http:// is permitted only for loopback development endpoints (${LOOPBACK_DESCRIPTION}). Pass an https:// baseURL, use environment: 'local', or construct the client without credentials.`;
-/** Whether the client holds anything at all that rule 1 has to protect. */
-const anyCredential = (credentials) => credentials.apiKey !== null || hasAlternateCredential(credentials);
+const insecureOriginMessage = (baseURL) => `Refusing to send a Composio API credential to ${baseURL}: a credentialed API origin must use HTTPS. By default, plain http:// is permitted only for loopback development endpoints (${LOOPBACK_DESCRIPTION}). Pass an https:// or loopback baseURL, set allowInsecureHTTP: true (or COMPOSIO_ALLOW_INSECURE_HTTP=1) for the configured development origin, or construct the client without credentials.`;
 /**
 * Rule 1 at construction time: a client that holds a credential must be
 * pointed at an origin that can carry one. Knowable before any request is
@@ -352,21 +166,17 @@ const anyCredential = (credentials) => credentials.apiKey !== null || hasAlterna
 * A `baseURL` that is not an absolute http(s) URL fails the same way — a
 * credential cannot be sent over a scheme this client does not speak, and the
 * alternative is a `TypeError` from `new URL()` one layer down.
-*
-* Every configured credential counts, not just `apiKey`: which one a given
-* request carries is decided per operation, so a client holding *any* of them
-* is a client that can put one on the wire.
 */
-const assertCredentialTransport = (baseURL, credentials) => {
-	if (!anyCredential(credentials)) return;
+const assertCredentialTransport = (baseURL, credentialed, allowedHTTPOrigin = null) => {
+	if (!credentialed) return;
 	const url = parseHTTPURL(baseURL);
-	if (url === null || !isCredentialSafeOrigin(url)) throw new ComposioError(insecureOriginMessage(baseURL));
+	if (url === null || !isCredentialSafeOrigin(url, allowedHTTPOrigin)) throw new ComposioError(insecureOriginMessage(baseURL));
 };
 /**
 * The credential this request may carry, or `null` for none.
 *
 * Rules 1 and 2 at dispatch time. Both re-checks are load-bearing rather than
-* belt-and-braces: `apiKey` and `baseURL` are public mutable fields, so the
+* belt-and-braces: `baseURL` is a public mutable field, so the
 * construction-time check can be invalidated by an assignment, and the request
 * URL is *not* guaranteed to sit on the configured origin. `buildURL`
 * concatenates `baseURL + path` and the escape hatch (`client.get(path)`)
@@ -380,45 +190,23 @@ const assertCredentialTransport = (baseURL, credentials) => {
 * with credentials, so that one dies at the transport instead. httpx has no
 * such objection, which is why the Python port checks the same thing.)
 */
-const credentialForRequest = (baseURL, scheme, credentials, requestURL) => {
-	const value = valueFor(scheme, credentials);
-	if (value === null) return null;
+const credentialForRequest = (baseURL, credential, requestURL, allowedHTTPOrigin = null) => {
+	if (credential === null) return null;
 	const base = parseHTTPURL(baseURL);
 	const target = parseHTTPURL(requestURL);
 	if (base === null || target === null) return null;
 	if (base.origin !== target.origin) return null;
-	if (!isCredentialSafeOrigin(target)) throw new ComposioError(insecureOriginMessage(baseURL));
-	return {
-		name: SCHEME_HEADERS[scheme],
-		value
-	};
+	if (!isCredentialSafeOrigin(target, allowedHTTPOrigin)) throw new ComposioError(insecureOriginMessage(baseURL));
+	return credential;
 };
 /**
-* The credential headers a *caller* can place that are not the one this client
-* attaches — `x-api-key` is excluded because a caller setting it is overriding
-* the client's own value in the same slot, which is pinned Stainless behaviour,
-* not a second credential.
+* Whether two absolute http(s) URLs share an origin, by the same test
+* {@link credentialForRequest} applies. An unparseable side is never the same
+* origin as anything. Python's `same_origin` is the twin.
 */
-const FOREIGN_CREDENTIAL_HEADERS = ["x-user-api-key", "x-org-api-key"];
-/**
-* Whether the caller has placed a credential of their own, in which case the
-* client must not add one beside it.
-*
-* Not a courtesy: this API answers a request carrying two credential headers
-* with `401 HTTP_Unauthorized`, so attaching `x-api-key` next to a caller's
-* `x-user-api-key` does not weaken the call, it *breaks* it. Three released
-* methods make that reachable without any `defaultHeaders` at all —
-* `cli.createCodactFailure`, `org.consumer.project.resolve` and
-* `org.consumer.listConnectedToolkits` declare `x-user-api-key` as a `required`
-* header parameter, which the generator folds into their params object. Calling
-* them the way their signature asks for returned 401 until this rule existed.
-*
-* Header merging is replayed rather than approximated, because a later source
-* may carry `null` to delete what an earlier one set (`buildHeaders`).
-*/
-const callerPlacedCredential = (sources) => {
-	const headers = buildHeaders(sources);
-	return FOREIGN_CREDENTIAL_HEADERS.some((name) => headers.has(name));
+const sameOrigin = (a, b) => {
+	const origin = parseHTTPURL(a)?.origin;
+	return origin !== void 0 && origin === parseHTTPURL(b)?.origin;
 };
 /**
 * Header names that carry a credential and must not survive an origin change.
@@ -434,9 +222,9 @@ const callerPlacedCredential = (sources) => {
 *
 * `x-user-api-key` and `x-org-api-key` are the spec's other two credential
 * schemes (`UserApiKeyAuth`, `OrgApiKeyAuth`), and they belong here for the same
-* reason `x-api-key` does — the kernel attaches all three (wayfinder ticket 48)
+* reason `x-api-key` does — the kernel attaches all three
 * and a caller can place the latter two directly besides. They were listed here
-* one ticket *before* the attachment work, because omitting them cost more than
+* *before* the attachment work, because omitting them cost more than
 * a missed withdrawal: {@link carriesCredentials} answered `false` for a request
 * carrying only one of them, so `request.ts` classified it as credential-free
 * and handed the whole chain to `fetch` at `redirect: 'follow'` — the exact leak
@@ -493,6 +281,188 @@ const withdrawCredentials = (headers) => {
 */
 const carriesCredentials = (headers) => CREDENTIAL_HEADERS.some((name) => headers.has(name));
 
+//#endregion
+//#region src/compat/auth.ts
+const NONE = Object.freeze({ mode: "none" });
+const authConstructors = () => Object.freeze({
+	none: () => NONE,
+	project: (credential) => Object.freeze({
+		mode: "project",
+		credential
+	}),
+	user: (credential) => Object.freeze({
+		mode: "user",
+		credential
+	}),
+	organization: (credential) => Object.freeze({
+		mode: "organization",
+		credential
+	}),
+	auto: (credentials) => Object.freeze({
+		mode: "auto",
+		credentials: Object.freeze({ ...credentials })
+	})
+});
+const Auth = authConstructors();
+const FIXED_MODES = [
+	"project",
+	"user",
+	"organization"
+];
+const SCHEME_OF_MODE = {
+	project: "ApiKeyAuth",
+	user: "UserApiKeyAuth",
+	organization: "OrgApiKeyAuth"
+};
+const isFixedMode = (mode) => FIXED_MODES.includes(mode);
+/** One credential is that fixed mode, several is `auto`, none is `none`. Shared by `fromEnv` and `layerConfig`. */
+const authFromCredentials = (credentials) => {
+	const auth = authConstructors();
+	const [first, ...rest] = FIXED_MODES.filter((mode) => credentials[mode] !== void 0);
+	if (first === void 0) return auth.none();
+	if (rest.length > 0) return auth.auto(credentials);
+	return auth[first](credentials[first]);
+};
+const isSendable = (value, name = "x-api-key") => {
+	try {
+		new globalThis.Headers().set(name, value);
+		return true;
+	} catch {
+		return false;
+	}
+};
+const isUsableKey = (key) => typeof key === "string" && /\S/.test(key) && isSendable(key);
+const unusableKeyError = (source) => new ComposioError(`${source} is not a usable key: it must be a string with a non-whitespace character and no line break, NUL or character outside Latin-1.`);
+const holdCredential = (value, option, kind) => {
+	if (!kind.is(value)) throw new ComposioError(`\`${option}\` must be a key or a function that returns one.`);
+	const key = kind.keyOf(value);
+	if (key !== void 0 && !isUsableKey(key)) throw unusableKeyError(`\`${option}\``);
+	return value;
+};
+const holdAuto = (given, kind) => {
+	const credentials = {};
+	for (const mode of FIXED_MODES) {
+		const value = given?.[mode];
+		if (value !== void 0) credentials[SCHEME_OF_MODE[mode]] = holdCredential(value, `auth.credentials.${mode}`, kind);
+	}
+	if (Object.keys(credentials).length === 0) throw new ComposioError("`Auth.auto` needs at least one of `project`, `user` and `organization`.");
+	return credentials;
+};
+const MIGRATION = "Pass `auth`: `Auth.project(key)`, `Auth.user(key)`, `Auth.organization(key)`, `Auth.auto({ project, user, organization })` or `Auth.none()`.";
+const resolveAuth = (auth, kind) => {
+	const value = auth;
+	const mode = value?.mode;
+	if (mode === void 0) throw new ComposioError(`\`auth\` is required. ${MIGRATION}`);
+	if (mode === "none") return {
+		mode,
+		credentials: {}
+	};
+	if (mode === "auto") return {
+		mode,
+		credentials: holdAuto(value?.credentials, kind)
+	};
+	if (!isFixedMode(mode)) throw new ComposioError(`\`auth.mode\` must be 'none', 'project', 'user', 'organization' or 'auto'. ${MIGRATION}`);
+	return {
+		mode,
+		credentials: { [SCHEME_OF_MODE[mode]]: holdCredential(value?.credential, "auth.credential", kind) }
+	};
+};
+const REMOVED_OPTIONS = {
+	apiKey: "Auth.project(key)",
+	userApiKey: "Auth.user(key)",
+	orgApiKey: "Auth.organization(key)"
+};
+const assertNoRemovedCredentialOptions = (options) => {
+	for (const [option, replacement] of Object.entries(REMOVED_OPTIONS)) {
+		if (!Object.hasOwn(options, option)) continue;
+		throw new ComposioError(`The \`${option}\` option was removed in 2.0.0-rc.18. Pass \`auth: ${replacement}\` instead, or \`Auth.auto({ ... })\` for per-operation selection.`);
+	}
+};
+const CREDENTIAL_HEADER_NAMES = Object.values(SCHEME_HEADERS);
+const SCOPE_HEADER_NAMES = ["x-org-id", "x-project-id"];
+const isScopeId = (value) => typeof value === "string" && value !== "" && value === value.trim() && isSendable(value, "x-org-id");
+const scopeId = (field, value) => {
+	if (value === void 0) return void 0;
+	if (!isScopeId(value)) throw new ComposioError(`\`scope.${field}\` must be a non-empty string with no surrounding whitespace.`);
+	return value;
+};
+const resolveScope = (scope) => {
+	if (scope === void 0) return void 0;
+	if (typeof scope !== "object" || scope === null) throw new ComposioError("`scope` must be an object with an `organizationId`, a `projectId`, or both.");
+	const { organizationId, projectId } = scope;
+	const headers = {};
+	const org = scopeId("organizationId", organizationId);
+	const project = scopeId("projectId", projectId);
+	if (org !== void 0) headers["x-org-id"] = org;
+	if (project !== void 0) headers["x-project-id"] = project;
+	if (Object.keys(headers).length === 0) throw new ComposioError("`scope` must name an `organizationId`, a `projectId`, or both.");
+	return headers;
+};
+const assertRequiredOperationHeaders = (operation, supplied) => {
+	for (const name of operation?.requiredHeaders ?? []) {
+		if (supplied?.[name] != null) continue;
+		throw new ComposioError(`\`${operation?.chain.join(".")}\` requires the \`${name}\` parameter.`);
+	}
+};
+const scopeForCall = (configured, supplied) => {
+	const merged = { ...configured };
+	for (const name of SCOPE_HEADER_NAMES) {
+		const value = supplied?.[name];
+		if (value == null) continue;
+		const current = configured?.[name];
+		if (current !== void 0 && current !== value) throw new ComposioError(`The \`${name}\` parameter disagrees with the client's \`scope\`. Derive a client with \`withOptions({ scope })\` to address another one.`);
+		merged[name] = value;
+	}
+	return merged;
+};
+const operationCredential = (supplied) => {
+	for (const [name, value] of Object.entries(supplied ?? {})) {
+		const scheme = schemeOfHeader(name);
+		if (scheme !== void 0 && value != null) return {
+			scheme,
+			credential: value
+		};
+	}
+};
+const configuredScheme = (auth, operation) => {
+	if (auth.mode === "none") return void 0;
+	if (auth.mode === "auto") return selectScheme(operation?.schemes, (scheme) => auth.credentials[scheme] !== void 0);
+	return SCHEME_OF_MODE[auth.mode];
+};
+/**
+* The credential one call carries: an operation credential replaces `auth`,
+* and a fixed mode never reads the operation table. `null` off the API origin.
+*/
+const chooseCredential = (auth, baseURL, requestURL, operation, supplied) => {
+	if (!sameOrigin(baseURL, requestURL)) return null;
+	const own = operationCredential(supplied);
+	if (own !== void 0) return own;
+	const scheme = configuredScheme(auth, operation);
+	if (scheme === void 0) return null;
+	const credential = auth.credentials[scheme];
+	return credential === void 0 ? null : {
+		scheme,
+		credential
+	};
+};
+const credentialHeader = (scheme, key) => {
+	const name = SCHEME_HEADERS[scheme];
+	if (!isUsableKey(key)) throw unusableKeyError(`The \`${name}\` credential`);
+	return {
+		name,
+		value: key
+	};
+};
+const providerFailed = (cause) => {
+	const error = new ComposioError("The `auth` credential provider failed.");
+	Object.defineProperty(error, "cause", {
+		value: cause,
+		configurable: true,
+		writable: true
+	});
+	return error;
+};
+
 //#endregion
 //#region src/compat/deprecation.ts
 /**
@@ -803,17 +773,20 @@ const isTemplateParam = (segment) => segment.startsWith("{") && segment.endsWith
 * (`/toolkits/{slug}` against `/toolkits/categories`) the literal wins, which
 * is the same most-specific-first rule the server routes by.
 *
-* **Known limit of recovering identity from the path.** Two accessors can emit
-* byte-identical requests — `client.toolkits.retrieve('categories')` and
+* **Known limit of recovering identity from the path**, and who still pays
+* it. Two accessors can emit byte-identical requests —
+* `client.toolkits.retrieve('categories')` and
 * `client.toolkits.retrieveCategories()` both dispatch
 * `GET /api/v3.1/toolkits/categories` — so nothing observable distinguishes
-* them here and the literal sibling is always the one named. The warning text
-* can therefore name the sibling rather than the accessor the caller wrote,
-* and the warn-once record is charged to that same sibling. This is
-* inherent to reverse-matching, not a bug in the matcher: the only fix is to
-* thread operation identity through dispatch, which this design deliberately
-* declined (wayfinder ticket 34). The affected pairs are few and the
-* consequence is a misnamed advisory, never a wrong call.
+* them here and the literal sibling is always the one named. That is inherent
+* to reverse-matching, not a bug in the matcher.
+*
+* Generated calls no longer reach this function at all: each one carries its
+* own descriptor through dispatch (`withOperation` in `request.ts`), so
+* `toolkits.retrieve('categories')` is now named as itself. What is left here
+* is the escape hatch — `client.get('/api/v3.1/toolkits/categories')` — whose
+* identity genuinely is not knowable before runtime, and for which naming the
+* literal sibling remains the honest answer.
 */
 const matchOperation = (method, path, operations) => {
 	const segments = pathSegments(path);
@@ -896,10 +869,10 @@ const noticeKey = (notice) => [
 * same `Response` to `asResponse()`, `withResponse()` and the parsed path
 * alike.
 */
-const inspectDeprecation = ({ response, method, path, baseURL, operations, seen, warn }) => {
+const inspectDeprecation = ({ response, method, path, operation: known, baseURL, operations, seen, warn }) => {
 	const notice = parseDeprecation(response.headers, response.url || baseURL, baseURL);
 	if (notice === null) return;
-	const operation = matchOperation(method, path, operations);
+	const operation = known ?? matchOperation(method, path, operations);
 	const key = `${operation === null ? `${method} ${pathSegments(path).join("/")}` : operation.chain.join(".")}${KEY_SEPARATOR}${noticeKey(notice)}`;
 	if (seen.has(key)) return;
 	if (seen.size >= MAX_TRACKED_NOTICES) return;
@@ -960,8 +933,347 @@ const inspectDeprecatedInputs = ({ operation, query, body, headers, table, seen,
 	}
 };
 
+//#endregion
+//#region src/compat/headers.ts
+const hasEntries = (value) => typeof value === "object" && value !== null && "append" in value && typeof value.append === "function" && "delete" in value && typeof value.delete === "function" && "entries" in value && typeof value.entries === "function" && "get" in value && typeof value.get === "function";
+const isHeaders = (value) => value instanceof Headers || hasEntries(value);
+const isNullableHeadersLike = (headers) => {
+	if (!("values" in headers) || !isHeaders(headers.values) || !("nulls" in headers)) return false;
+	const nulls = headers.nulls;
+	return typeof nulls === "object" && nulls !== null && Symbol.iterator in nulls;
+};
+/**
+* Iterates every supported input while preserving explicit deletions. Plain
+* objects replace an older value for a key; tuple inputs append duplicate
+* values, matching the published client.
+*/
+function* iterateHeaders(headers) {
+	if (!headers) return;
+	if (isNullableHeadersLike(headers)) {
+		yield* headers.values.entries();
+		for (const name of headers.nulls) yield [name, null];
+		return;
+	}
+	const shouldReplace = !isHeaders(headers) && !Array.isArray(headers);
+	const entries = isHeaders(headers) ? headers.entries() : Array.isArray(headers) ? headers : Object.entries(headers);
+	for (const entry of entries) {
+		const name = entry[0];
+		if (typeof name !== "string") throw new TypeError("expected header name to be a string");
+		const rawValue = entry[1];
+		const values = Array.isArray(rawValue) ? rawValue : [rawValue];
+		let replaced = false;
+		for (const value of values) {
+			if (value === void 0) continue;
+			if (shouldReplace && !replaced) {
+				replaced = true;
+				yield [name, null];
+			}
+			yield [name, value];
+		}
+	}
+}
+/** Merge sources while retaining names explicitly deleted by the last source. */
+const mergeHeaders = (sources) => {
+	const values = new Headers();
+	const nulls = /* @__PURE__ */ new Set();
+	for (const source of sources) {
+		if (!source) continue;
+		const seen = /* @__PURE__ */ new Set();
+		for (const [name, value] of iterateHeaders(source)) {
+			const lowerName = name.toLowerCase();
+			if (!seen.has(lowerName)) {
+				values.delete(name);
+				seen.add(lowerName);
+			}
+			if (value === null) {
+				values.delete(name);
+				nulls.add(lowerName);
+			} else {
+				values.append(name, value);
+				nulls.delete(lowerName);
+			}
+		}
+	}
+	return {
+		values,
+		nulls
+	};
+};
+/** Merge sources into the native header collection sent to fetch. */
+const buildHeaders = (sources) => mergeHeaders(sources).values;
+/** Every header name a source mentions, lowercased, a `null` deletion included. */
+function* headerNames(headers) {
+	for (const [name] of iterateHeaders(headers)) yield name.toLowerCase();
+}
+
+//#endregion
+//#region src/version.ts
+const VERSION = "2.0.0-rc.21";
+
+//#endregion
+//#region src/compat/identity.ts
+/**
+* The runtime keys `std-env` detects, in its order, each with the label this
+* client sends as `x-client-runtime`. Ported from std-env 4.3.0
+* (https://github.com/unjs/std-env, MIT) rather than imported: std-env reads
+* `process.env` when it is imported, which throws under Deno without
+* `--allow-env`, and this needs only the runtime check.
+*
+* The labels are the ones released clients already send and the platform
+* already normalizes (`nodejs`, `cloudflare`, `vercel_edge`, ...), so a
+* dashboard groups old and new traffic together. Edge runtimes come before
+* Node because `nodejs_compat` and edge polyfills expose `process.versions.node`.
+*/
+const RUNTIMES = [
+	[
+		"netlify",
+		"netlify",
+		(g) => "Netlify" in g
+	],
+	[
+		"edge-light",
+		"vercel_edge",
+		(g) => "EdgeRuntime" in g
+	],
+	[
+		"workerd",
+		"cloudflare",
+		(g) => g.navigator?.userAgent === "Cloudflare-Workers"
+	],
+	[
+		"fastly",
+		"fastly",
+		(g) => "fastly" in g
+	],
+	[
+		"deno",
+		"deno",
+		(g) => "Deno" in g
+	],
+	[
+		"bun",
+		"bun",
+		(g) => "Bun" in g
+	],
+	[
+		"node",
+		"nodejs",
+		(g) => Boolean(g.process?.versions?.node)
+	]
+];
+/**
+* The runtime label and its version. The version is `process.versions[key]`,
+* which Node, Bun and Deno each set for themselves; an edge runtime reports
+* none, so a polyfilled Node version is never sent as its own.
+*/
+const detectRuntime = () => {
+	const g = globalThis;
+	for (const [key, label, detect] of RUNTIMES) if (detect(g)) return [label, g.process?.versions?.[key]];
+	return ["unknown", void 0];
+};
+/** The library sending the request. Never caller-settable, with or without an identity. */
+const PACKAGE_HEADERS = [
+	"x-client-library",
+	"x-client-library-version",
+	"x-client-language"
+];
+/**
+* The calling product and its runtime. Reserved once a client has an
+* `identity`; without one they default to the package and stay
+* caller-settable, which is how a wrapper identified itself before `identity`.
+*/
+const PRODUCT_HEADERS = [
+	"x-client-provenance",
+	"x-client-version",
+	"x-sdk-version",
+	"x-source",
+	"x-framework",
+	"x-runtime",
+	"x-client-runtime",
+	"x-runtime-version"
+];
+const PACKAGE_RESERVED = new Set(PACKAGE_HEADERS);
+const IDENTITY_RESERVED = /* @__PURE__ */ new Set([...PACKAGE_HEADERS, ...PRODUCT_HEADERS]);
+/** Printable ASCII with no leading or trailing whitespace: what every runtime's `Headers` sends unchanged. */
+const HEADER_SAFE = /^[\x21-\x7e](?:[\x20-\x7e]*[\x21-\x7e])?$/;
+const IDENTITY_FIELDS = [
+	"product",
+	"version",
+	"source",
+	"framework",
+	"runtime"
+];
+const REQUIRED_FIELDS = /* @__PURE__ */ new Set(["product", "version"]);
+const validateIdentity = (identity) => {
+	if (typeof identity !== "object" || identity === null) throw new ComposioError("`identity` must be an object with a `product` and a `version`.");
+	const fields = identity;
+	for (const field of IDENTITY_FIELDS) {
+		const value = fields[field];
+		if (value === void 0 && !REQUIRED_FIELDS.has(field)) continue;
+		if (typeof value !== "string" || !HEADER_SAFE.test(value)) throw new ComposioError(`\`identity.${field}\` must be a non-empty string of printable ASCII with no leading or trailing whitespace.`);
+	}
+	return identity;
+};
+/**
+* Validates `identity` and resolves the headers it owns, once per client.
+*
+* Without an identity the client reports itself, as it always has. With one,
+* the product fields replace the package's; the runtime the package detected
+* stays in `x-client-runtime` and `x-runtime-version` either way, since
+* `identity.runtime` is the legacy `x-runtime` label and the platform does not
+* read the two as aliases.
+*/
+const resolveIdentity = (identity) => {
+	const [runtime, runtimeVersion] = detectRuntime();
+	const library = {
+		"x-client-library": "@composio/client",
+		"x-client-library-version": VERSION,
+		"x-client-language": "typescript",
+		"x-client-runtime": runtime
+	};
+	if (identity === void 0) {
+		const headers = {
+			"x-client-provenance": "@composio/client",
+			"x-client-version": VERSION,
+			...library,
+			"x-runtime": runtime
+		};
+		if (runtimeVersion) headers["x-runtime-version"] = runtimeVersion;
+		return {
+			headers,
+			reserved: PACKAGE_RESERVED
+		};
+	}
+	const valid = validateIdentity(identity);
+	const headers = {
+		"x-client-provenance": valid.product,
+		"x-client-version": valid.version,
+		...library,
+		"x-runtime": valid.runtime ?? runtime
+	};
+	if (runtimeVersion) headers["x-runtime-version"] = runtimeVersion;
+	headers["x-sdk-version"] = valid.version;
+	if (valid.source !== void 0) headers["x-source"] = valid.source;
+	if (valid.framework !== void 0) headers["x-framework"] = valid.framework;
+	return {
+		headers,
+		reserved: IDENTITY_RESERVED
+	};
+};
+/** Credential names are reserved while `auth` is not `none`, routing ids while `scope` is set. */
+const reservedHeaders = (identity, configured) => {
+	const reserved = /* @__PURE__ */ new Map();
+	for (const name of identity.reserved) reserved.set(name, PACKAGE_RESERVED.has(name) ? "client" : "identity");
+	if (configured.auth) for (const name of CREDENTIAL_HEADER_NAMES) reserved.set(name, "auth");
+	if (configured.scope) for (const name of SCOPE_HEADER_NAMES) reserved.set(name, "scope");
+	return reserved;
+};
+const REMEDY = {
+	client: " Pass `identity` to describe the calling product.",
+	identity: "",
+	auth: " Configure the credential through `auth`; derive a client with `withOptions({ auth })` for another one.",
+	scope: " Configure the organization and project through `scope`; derive a client with `withOptions({ scope })` for another one."
+};
+/**
+* Refuses a generic header source that names a reserved header, whether it
+* sets one or deletes one with `null`. Constructor validation runs it over
+* `defaultHeaders`; request validation over a call's `headers`, before any
+* network work.
+*/
+const assertNoReservedHeaders = (headers, reserved, option) => {
+	if (!headers) return;
+	for (const name of headerNames(headers)) {
+		const owner = reserved.get(name);
+		if (owner === void 0) continue;
+		throw new ComposioError(`The \`${name}\` header is set by ${owner === "client" ? "the client" : `\`${owner}\``} and cannot be passed in \`${option}\`.${REMEDY[owner]}`);
+	}
+};
+
+//#endregion
+//#region src/compat/transport.ts
+const KERNEL_OWNED_KEYS = [
+	"method",
+	"headers",
+	"body",
+	"signal",
+	"redirect"
+];
+const assertSafeDefaults = (defaults) => {
+	if (defaults === void 0) return;
+	const owned = KERNEL_OWNED_KEYS.find((key) => key in defaults);
+	if (owned !== void 0) throw new TypeError(`Fetch transport defaults cannot set kernel-owned '${owned}'`);
+};
+/**
+* Where the kernel leaves the `RequestInit` it built a `Request` from, so a
+* fetch-backed transport can call `fetch(url, init)` with the original body
+* and headers rather than `fetch(request)`. The two are the same HTTP
+* exchange; the difference is what a caller watching `fetch` sees, and every
+* consumer that stubs `globalThis.fetch` reads `calls[i][1].headers`, the
+* shape the client has sent since 0.1.x. A `Request` built elsewhere carries
+* no init and is sent as it is.
+*/
+const kernelInit = Symbol("composio.kernelInit");
+/** Creates a transport backed by the supplied or global fetch function. */
+const createFetchTransport = (options = {}) => {
+	assertSafeDefaults(options.defaults);
+	const fetchImplementation = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	return { send: (request) => {
+		const init = request[kernelInit];
+		if (init === void 0) return fetchImplementation(request, options.defaults);
+		return fetchImplementation(request.url, {
+			...options.defaults,
+			...init
+		});
+	} };
+};
+
 //#endregion
 //#region src/compat/request.ts
+/**
+* Where a generated call records *which operation it is*.
+*
+* A resource method knows its own identity at code-generation time, and until
+* now threw it away: dispatch carried only a method and a substituted path, so
+* the kernel recovered the operation by matching that path back against all
+* 104 templates on every single request (`matchOperation`). Recovery is still
+* the right answer for an escape-hatch `client.get('/api/v3.1/…')`, whose
+* identity genuinely is not knowable until runtime — but for a generated call
+* it re-derives a fact the call site already had.
+*
+* The channel is a module-private symbol rather than a `RequestOptions`
+* property, because `RequestOptions` is the Stainless options bag and its
+* shape is the product (`test/types/*.test-d.ts` pins it structurally). A
+* symbol key is invisible to that pinning, to `Object.keys`, to
+* `JSON.stringify`, and to every serializer in this file — the descriptor
+* reaches the kernel without becoming part of any public type or any byte on
+* the wire.
+*
+* It is deliberately *enumerable*: `client.get()` re-spreads the options bag
+* into `request()`, and object spread copies enumerable own symbols. A
+* non-enumerable definition would silently drop the descriptor there and
+* degrade every generated call back to matching, which is exactly the kind of
+* regression that measures fine and reports nothing.
+*/
+const OPERATION = Symbol("composio.operation");
+/** The owned header parameters (`x-user-api-key`, `x-org-id`) a generated call supplied. */
+const OPERATION_HEADERS = Symbol("composio.operationHeaders");
+/**
+* Attach a generated call's operation, and its owned header parameters, to
+* the options bag it dispatches with.
+*
+* Called with the freshly built literal — never with the caller's own object —
+* and *after* the caller's options have been spread into it, so a caller
+* cannot pre-empt the descriptor: the write happens last, and the key it
+* writes to is not one a caller can name.
+*/
+const withOperation = (operation, options, headers) => {
+	options[OPERATION] = operation;
+	if (headers !== void 0) options[OPERATION_HEADERS] = headers;
+	return options;
+};
+/** The operation a generated call recorded, or `undefined` for a raw one. */
+const readOperation = (options) => options[OPERATION];
+const readOperationHeaders = (options) => options[OPERATION_HEADERS];
 /** A request label safe to print: dynamic path values and URL secrets are excluded. */
 const printableURL = (url, operation) => `${new URL(url).origin}${operation?.path ?? "/<custom>"}`;
 const emitLog = (config, level, message, metadata) => {
@@ -972,6 +1284,31 @@ const emitLog = (config, level, message, metadata) => {
 const monotonicMillis = () => globalThis.performance?.now?.() ?? Date.now();
 const elapsedMillis = (startedAt) => Math.max(0, monotonicMillis() - startedAt);
 /**
+* Settle a dispatch when its signal aborts even if a custom transport ignores
+* the signal. The transport promise keeps a rejection handler after abort so
+* a late failure cannot become an unhandled rejection.
+*/
+const settleOnAbort = (promise, signal) => new Promise((resolve, reject) => {
+	let settled = false;
+	const cleanup = () => signal.removeEventListener("abort", onAbort);
+	const finish = (settle, value) => {
+		if (settled) return;
+		settled = true;
+		cleanup();
+		settle(value);
+	};
+	const fail = (reason) => {
+		if (settled) return;
+		settled = true;
+		cleanup();
+		reject(reason);
+	};
+	const onAbort = () => fail(/* @__PURE__ */ new Error("Request aborted"));
+	promise.then((value) => finish(resolve, value), fail);
+	signal.addEventListener("abort", onAbort, { once: true });
+	if (signal.aborted) onAbort();
+});
+/**
 * Percent-encode everything that isn't a RFC-3986 pchar, leaving safe chars
 * (unreserved / sub-delims / ":" / "@") readable.
 */
@@ -995,7 +1332,7 @@ const path = (statics, ...params) => {
 * empty values, and plain-object values expanded qs-style into bracket
 * notation (`toolkit_versions[github]=v1`, the whole key percent-encoded) —
 * pinned differentially against Stainless via `tools.retrieve`'s object
-* `toolkit_versions` param (wayfinder ticket 23).
+* `toolkit_versions` param.
 */
 const stringifyQuery = (query) => {
 	const parts = [];
@@ -1024,7 +1361,6 @@ const buildURL = (config, options) => {
 	const url = new URL(base + joined);
 	const query = {
 		...Object.fromEntries(url.searchParams),
-		...config.defaultQuery,
 		...options.query
 	};
 	const search = stringifyQuery(query);
@@ -1125,7 +1461,7 @@ const REDIRECT_STATUSES = /* @__PURE__ */ new Set([
 * kernel refuses is one the platform would have refused too.
 */
 const MAX_REDIRECTS = 20;
-const TOO_MANY_REDIRECTS = `The API redirected more than ${MAX_REDIRECTS} times; the chain was abandoned.`;
+const TOO_MANY_REDIRECTS = `The API redirected more than ${20} times; the chain was abandoned.`;
 /**
 * The one environment-dependent behavior in the kernel, stated rather than
 * degraded into — and narrowed to the case where safety cannot be proved.
@@ -1154,7 +1490,7 @@ const TOO_MANY_REDIRECTS = `The API redirected more than ${MAX_REDIRECTS} times;
 * What is left is a *credentialed* request that redirects in a browser. It
 * gets a named error rather than a silent leak — and on this API that is very
 * nearly unreachable: the only redirects the platform serves are same-origin
-* edge normalizations (wayfinder ticket 40 records the recon), and `buildURL`
+* edge normalizations, and `buildURL`
 * cannot construct a URL that triggers one.
 */
 const OPAQUE_REDIRECT = "The API responded with a redirect that this runtime will not let the client read (an opaque redirect, in a browser). Redirects are followed only where the response can be inspected, because a credential must never cross an origin change.";
@@ -1200,20 +1536,40 @@ const kernelInternals = { sleep };
 * The headers for one hop, built fresh from the URL that hop is going to.
 *
 * This is where rule 3 mostly stops needing machinery of its own: the
-* credential is re-derived per hop from the *request* URL rather than carried
-* along from the last one, so a hop that leaves the configured API origin
-* simply does not get a key. `withdrawn` covers what that cannot — the
+* credential is re-checked per hop against the *request* URL rather than
+* carried along from the last one, so a hop that leaves the configured API
+* origin simply does not get a key. `withdrawn` covers what that cannot — the
 * caller's own credential headers, which are legitimate on the URL the caller
 * chose and are dropped once the *server* has chosen one.
+*
+* The client's identity and scope headers follow the same per-hop rule: they
+* describe this client to its own API, so a hop off the configured origin (a
+* presigned storage URL, a redirect target) goes without them.
 */
-const buildRequestHeaders = (config, options, requestURL, bodyHeaders, withdrawn, scheme, callerPlaced) => {
-	const credential = withdrawn || callerPlaced ? null : credentialForRequest(config.baseURL, scheme, config.credentials, requestURL);
+const buildRequestHeaders = (config, options, requestURL, bodyHeaders, withdrawn, call) => {
+	const credential = withdrawn ? null : credentialForRequest(config.baseURL, call.credential, requestURL, config.allowedHTTPOrigin);
+	const own = sameOrigin(config.baseURL, requestURL);
+	const identity = own ? config.identity.headers : void 0;
+	const scope = own ? call.scope : void 0;
+	if (!withdrawn && bodyHeaders === void 0 && !config.defaultHeaders && !options.headers && options.idempotencyKey === void 0) {
+		const direct = new Headers({
+			...identity,
+			accept: "application/json",
+			"user-agent": config.userAgent,
+			...scope
+		});
+		if (credential !== null) direct.set(credential.name, credential.value);
+		return direct;
+	}
 	const headers = buildHeaders([
+		{ "idempotency-key": options.idempotencyKey },
 		{
+			...identity,
 			accept: "application/json",
 			"user-agent": config.userAgent
 		},
 		credential === null ? void 0 : { [credential.name]: credential.value },
+		scope,
 		config.defaultHeaders,
 		bodyHeaders,
 		options.headers
@@ -1221,28 +1577,25 @@ const buildRequestHeaders = (config, options, requestURL, bodyHeaders, withdrawn
 	if (withdrawn) withdrawCredentials(headers);
 	return headers;
 };
-/**
-* The credential class this logical request authenticates with, decided once
-* from the operation the *caller* invoked.
-*
-* Deliberately not re-derived per redirect hop. A hop's URL was chosen by the
-* server, so matching it back to a template would let the server's choice
-* change which of the caller's credentials goes out; the operation the caller
-* asked for is the honest answer for the whole chain, and rule 3 already
-* withdraws everything once a hop leaves the origin.
-*
-* `operation` is the match `makeRequest` already computed for the static
-* deprecated-input check, threaded in rather than re-derived: the two
-* features need the same fact, so `matchOperation` runs once per logical call
-* regardless of which of them a given client configuration actually uses.
-* With only `apiKey` set the scheme answer is still `ApiKeyAuth` down every
-* branch of {@link selectScheme}, so an existing caller's requests stay
-* byte-identical by construction; what changed is that the match itself is no
-* longer skippable, because the deprecated-input warning needs it too.
-*/
-const schemeForRequest = (config, operation) => {
-	if (!hasAlternateCredential(config.credentials)) return "ApiKeyAuth";
-	return selectScheme(operation?.schemes, config.credentials);
+const callProvider = (provider, header) => {
+	let key;
+	try {
+		key = provider();
+	} catch (cause) {
+		throw providerFailed(cause);
+	}
+	if (typeof key === "string") return header(key);
+	return Promise.resolve(key).then(header, (cause) => {
+		throw providerFailed(cause);
+	});
+};
+/** Synchronous unless a provider has to be awaited, so a string key goes out in the turn the call starts. */
+const resolveCallCredential = (config, requestURL, operation, supplied) => {
+	const choice = chooseCredential(config.auth, config.baseURL, requestURL, operation, supplied);
+	if (choice === null) return null;
+	const header = (key) => credentialHeader(choice.scheme, key);
+	if (typeof choice.credential === "string") return header(choice.credential);
+	return callProvider(choice.credential, header);
 };
 /**
 * One attempt: the request, plus however many redirects it takes to land on a
@@ -1258,28 +1611,26 @@ const schemeForRequest = (config, operation) => {
 * Everything the server chose is re-derived rather than carried: the headers
 * (see `buildRequestHeaders`), the method and body (fetch's own 301/302/303
 * rewrite), and the query, which is left to the `Location` URL because the
-* server picked it. `config.defaultQuery` is applied to the URL the caller
-* asked for, not to the one it was sent to.
+* server picked it.
 */
-const dispatchWithRedirects = async (config, options, initialURL, initialBody, initialBodyHeaders, signal, scheme) => {
+const dispatchWithRedirects = async (config, options, initialURL, initialBody, initialBodyHeaders, signal, call) => {
 	let url = initialURL;
 	let method = options.method.toUpperCase();
 	let body = initialBody;
 	let bodyHeaders = initialBodyHeaders;
 	let withdrawn = false;
-	const callerPlaced = callerPlacedCredential([config.defaultHeaders, options.headers]);
 	for (let hop = 0;; hop++) {
-		const headers = buildRequestHeaders(config, options, url, bodyHeaders, withdrawn, scheme, callerPlaced);
+		const headers = buildRequestHeaders(config, options, url, bodyHeaders, withdrawn, call);
 		const delegated = hop === 0 && !carriesCredentials(headers);
-		const response = await config.fetch.call(void 0, url, {
+		const init = {
 			method,
 			headers,
 			...body !== void 0 ? { body } : {},
-			...config.fetchOptions,
-			...options.fetchOptions,
 			redirect: delegated ? "follow" : "manual",
 			signal
-		});
+		};
+		const request = Object.assign(new Request(url, init), { [kernelInit]: init });
+		const response = await settleOnAbort(config.transport.send(request), signal);
 		if (delegated) return response;
 		if (isOpaqueRedirect(response)) throw new APIConnectionError({ message: OPAQUE_REDIRECT });
 		if (!REDIRECT_STATUSES.has(response.status)) return response;
@@ -1287,7 +1638,7 @@ const dispatchWithRedirects = async (config, options, initialURL, initialBody, i
 		if (location === null) return response;
 		const target = resolveLocation(location, url);
 		if (target === null) return response;
-		if (hop >= MAX_REDIRECTS) throw new APIConnectionError({ message: TOO_MANY_REDIRECTS });
+		if (hop >= 20) throw new APIConnectionError({ message: TOO_MANY_REDIRECTS });
 		response.body?.cancel().catch(() => void 0);
 		if (target.origin !== new URL(url).origin) withdrawn = true;
 		if (rewriteForRedirect(response.status, method)) {
@@ -1308,12 +1659,13 @@ const dispatchWithRedirects = async (config, options, initialURL, initialBody, i
 *
 * Redirects are followed inside an attempt by `dispatchWithRedirects`, so the
 * single response exit below still fires `onResponse` **once per logical
-* call** rather than once per hop — the once-per-call guarantee ticket 34
-* built the deprecation interceptor on. The `Response` handed back is the
+* call** rather than once per hop — the once-per-call guarantee the
+* deprecation interceptor is built on. The `Response` handed back is the
 * final hop's, so `response.url` is still "the URL this response came from",
 * which is what `deprecation.ts` resolves relative `Link` targets against.
 */
 async function makeRequest(config, options) {
+	assertNoReservedHeaders(options.headers, config.reserved, "headers");
 	if (options.timeout !== void 0) validatePositiveInteger("timeout", options.timeout);
 	const maxRetries = options.maxRetries ?? config.maxRetries;
 	validatePositiveInteger("maxRetries", maxRetries);
@@ -1322,14 +1674,22 @@ async function makeRequest(config, options) {
 	const { body, bodyHeaders } = buildBody(options);
 	const userSignal = options.signal ?? void 0;
 	const method = options.method.toUpperCase();
-	const operation = matchOperation(options.method, options.path, config.operations ?? []);
+	const threaded = readOperation(options);
+	const operation = threaded ?? matchOperation(options.method, options.path, config.operations ?? []);
 	const requestLog = config.onLog === void 0 ? void 0 : {
 		method,
 		url: printableURL(url, operation),
 		maxAttempts: maxRetries + 1
 	};
-	const scheme = schemeForRequest(config, operation);
-	config.onRequest?.(operation, query, options.body, buildHeaders([config.defaultHeaders, options.headers]));
+	const supplied = readOperationHeaders(options);
+	assertRequiredOperationHeaders(threaded ?? null, supplied);
+	const scope = scopeForCall(config.scope, supplied);
+	const credential = resolveCallCredential(config, url, operation, supplied);
+	const call = {
+		scope,
+		credential: credential instanceof Promise ? await credential : credential
+	};
+	if (config.onRequest !== void 0 && (threaded === void 0 || threaded.hasDeprecatedInputs === true)) config.onRequest(operation, query, options.body, buildHeaders([config.defaultHeaders, options.headers]));
 	for (let numRetries = 0;; numRetries++) {
 		if (userSignal?.aborted) throw new APIUserAbortError();
 		const attempt = numRetries + 1;
@@ -1346,7 +1706,7 @@ async function makeRequest(config, options) {
 		const timer = setTimeout(abort, timeout);
 		let result;
 		try {
-			result = await dispatchWithRedirects(config, options, url, body, bodyHeaders, controller.signal, scheme);
+			result = await dispatchWithRedirects(config, options, url, body, bodyHeaders, controller.signal, call);
 		} catch (cause) {
 			if (cause instanceof ComposioError) {
 				if (attemptLog !== void 0) emitLog(config, "info", "Request failed", {
@@ -1420,4 +1780,830 @@ async function makeRequest(config, options) {
 }
 
 //#endregion
-export { InternalServerError as _, inspectDeprecatedInputs as a, RateLimitError as b, mergeHeaders as c, APIError as d, APIUserAbortError as f, ConflictError as g, ComposioError as h, safeJSON as i, APIConnectionError as l, BadRequestError as m, makeRequest as n, inspectDeprecation as o, AuthenticationError as p, path as r, assertCredentialTransport as s, castToError as t, APIConnectionTimeoutError as u, NotFoundError as v, UnprocessableEntityError as x, PermissionDeniedError as y };
+//#region src/compat/generated-operations.ts
+const GENERATED_OPERATIONS = [
+	{
+		method: "delete",
+		path: "/api/v3.1/auth_configs/{nanoid}",
+		chain: ["authConfigs", "delete"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/connected_accounts/{nanoid}",
+		chain: ["connectedAccounts", "delete"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/custom/toolkits/{slug}",
+		chain: ["custom", "deleteToolkit"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/mcp/servers/{serverId}/instances/{instanceId}",
+		chain: ["mcp", "deleteInstance"]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/mcp/{id}",
+		chain: ["mcp", "delete"]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/org/owner/project/{nano_id}",
+		chain: [
+			"org",
+			"owner",
+			"project",
+			"delete"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/tool_router/session/{session_id}",
+		chain: [
+			"toolRouter",
+			"session",
+			"delete"
+		]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/trigger_instances/manage/{triggerId}",
+		chain: [
+			"triggerInstances",
+			"manage",
+			"delete"
+		],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "delete",
+		path: "/api/v3.1/webhook_subscriptions/{id}",
+		chain: ["webhookSubscriptions", "delete"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/auth/session/info",
+		chain: [
+			"auth",
+			"session",
+			"retrieveInfo"
+		],
+		schemes: ["UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/auth_configs",
+		chain: ["authConfigs", "list"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/auth_configs/{nanoid}",
+		chain: ["authConfigs", "retrieve"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/cli/get-session",
+		chain: ["cli", "getSession"],
+		schemes: ["no_auth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/cli/realtime/credentials",
+		chain: [
+			"cli",
+			"realtime",
+			"credentials"
+		],
+		schemes: ["UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/connected_accounts",
+		chain: ["connectedAccounts", "list"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/connected_accounts/{nanoid}",
+		chain: ["connectedAccounts", "retrieve"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/files/list",
+		chain: ["files", "list"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/internal/action_execution/fields",
+		chain: [
+			"logs",
+			"tools",
+			"listFields"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/internal/action_execution/log/{id}",
+		chain: [
+			"logs",
+			"tools",
+			"retrieve"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/internal/trigger/log/{id}",
+		chain: [
+			"logs",
+			"triggers",
+			"retrieve"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/keyring/transfer_keys",
+		chain: ["keyring", "listTransferKeys"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/logs/tool_execution/{id}",
+		chain: ["logs", "retrieveToolExecution"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/mcp/app/{appKey}",
+		chain: ["mcp", "retrieveApp"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/mcp/servers",
+		chain: ["mcp", "list"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/mcp/servers/{serverId}/instances",
+		chain: ["mcp", "listInstances"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/mcp/{id}",
+		chain: ["mcp", "retrieve"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/org/consumer/connected_toolkits",
+		chain: [
+			"org",
+			"consumer",
+			"listConnectedToolkits"
+		],
+		schemes: ["UserApiKeyAuth"],
+		requiredHeaders: ["x-user-api-key", "x-org-id"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/org/list",
+		chain: ["org", "list"],
+		schemes: ["UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/org/owner/project/list",
+		chain: [
+			"org",
+			"owner",
+			"project",
+			"list"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/org/owner/project/{nano_id}",
+		chain: [
+			"org",
+			"owner",
+			"project",
+			"retrieve"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/org/project/list",
+		chain: [
+			"org",
+			"project",
+			"list"
+		],
+		schemes: ["UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/session_configs",
+		chain: ["sessionConfigs", "list"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/session_configs/{session_config_id}",
+		chain: ["sessionConfigs", "retrieve"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tool_router/session/{session_id}",
+		chain: [
+			"toolRouter",
+			"session",
+			"retrieve"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tool_router/session/{session_id}/config_history",
+		chain: [
+			"toolRouter",
+			"session",
+			"configHistory"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tool_router/session/{session_id}/mounts/{mount_id}/items",
+		chain: [
+			"toolRouter",
+			"session",
+			"files",
+			"list"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tool_router/session/{session_id}/toolkits",
+		chain: [
+			"toolRouter",
+			"session",
+			"toolkits"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tool_router/session/{session_id}/tools",
+		chain: [
+			"toolRouter",
+			"session",
+			"tools"
+		]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/toolkits",
+		chain: ["toolkits", "list"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/toolkits/categories",
+		chain: ["toolkits", "retrieveCategories"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/toolkits/changelog",
+		chain: ["toolkits", "retrieveChangelog"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/toolkits/{slug}",
+		chain: ["toolkits", "retrieve"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/toolkits/{toolkit_slug}/scopes/grant_context",
+		chain: ["toolkits", "retrieveScopesGrantContext"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tools",
+		chain: ["tools", "list"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tools/enum",
+		chain: ["tools", "retrieveEnum"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/tools/{tool_slug}",
+		chain: ["tools", "retrieve"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/trigger_instances/active",
+		chain: ["triggerInstances", "listActive"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/triggers_types",
+		chain: ["triggersTypes", "list"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/triggers_types/list/enum",
+		chain: ["triggersTypes", "retrieveEnum"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/triggers_types/{slug}",
+		chain: ["triggersTypes", "retrieve"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/webhook_endpoints",
+		chain: ["webhookEndpoints", "list"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/webhook_endpoints/{nano_id}",
+		chain: ["webhookEndpoints", "retrieve"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/webhook_subscriptions",
+		chain: ["webhookSubscriptions", "list"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/webhook_subscriptions/event_types",
+		chain: ["webhookSubscriptions", "listEventTypes"]
+	},
+	{
+		method: "get",
+		path: "/api/v3.1/webhook_subscriptions/{id}",
+		chain: ["webhookSubscriptions", "retrieve"]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/auth_configs/{nanoid}",
+		chain: ["authConfigs", "update"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/auth_configs/{nanoid}/{status}",
+		chain: ["authConfigs", "updateStatus"]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/connected_accounts/{nanoId}/status",
+		chain: ["connectedAccounts", "updateStatus"]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/connected_accounts/{nanoid}",
+		chain: ["connectedAccounts", "patch"]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/mcp/{id}",
+		chain: ["mcp", "update"]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/tool_router/session/{session_id}",
+		chain: [
+			"toolRouter",
+			"session",
+			"patch"
+		]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/trigger_instances/manage/{triggerId}",
+		chain: [
+			"triggerInstances",
+			"manage",
+			"update"
+		],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/webhook_endpoints/{nano_id}",
+		chain: ["webhookEndpoints", "update"]
+	},
+	{
+		method: "patch",
+		path: "/api/v3.1/webhook_subscriptions/{id}",
+		chain: ["webhookSubscriptions", "update"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/api_key_revocation",
+		chain: ["apiKeyRevocation", "create"],
+		schemes: ["no_auth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/auth_configs",
+		chain: ["authConfigs", "create"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/cli/codact_failures",
+		chain: ["cli", "createCodactFailure"],
+		schemes: ["UserApiKeyAuth"],
+		requiredHeaders: ["x-user-api-key"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/cli/create-session",
+		chain: ["cli", "createSession"],
+		schemes: ["no_auth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/cli/realtime/auth",
+		chain: [
+			"cli",
+			"realtime",
+			"auth"
+		],
+		schemes: ["UserApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/connected_accounts",
+		chain: ["connectedAccounts", "create"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/connected_accounts/complete_auth",
+		chain: ["connectedAccounts", "completeAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/connected_accounts/link",
+		chain: ["link", "create"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/connected_accounts/{nanoid}/refresh",
+		chain: ["connectedAccounts", "refresh"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/connected_accounts/{nanoid}/revoke",
+		chain: ["connectedAccounts", "revoke"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/custom/toolkits/sync",
+		chain: ["custom", "sync"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/custom/toolkits/upsert",
+		chain: ["custom", "upsert"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/files/upload/request",
+		chain: ["files", "createPresignedURL"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/internal/action_execution/logs",
+		chain: [
+			"logs",
+			"tools",
+			"list"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/internal/trigger/logs",
+		chain: [
+			"logs",
+			"triggers",
+			"list"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/logs/tool_execution",
+		chain: ["logs", "createToolExecution"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/mcp/servers",
+		chain: ["mcp", "create"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/mcp/servers/custom",
+		chain: [
+			"mcp",
+			"custom",
+			"create"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/mcp/servers/generate",
+		chain: [
+			"mcp",
+			"generate",
+			"url"
+		],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/mcp/servers/{serverId}/instances",
+		chain: ["mcp", "createInstance"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/org/clanker/create_claim",
+		chain: [
+			"org",
+			"clanker",
+			"createClaim"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/org/consumer/project/resolve",
+		chain: [
+			"org",
+			"consumer",
+			"project",
+			"resolve"
+		],
+		schemes: ["UserApiKeyAuth"],
+		requiredHeaders: ["x-user-api-key", "x-org-id"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/org/owner/project/new",
+		chain: [
+			"org",
+			"owner",
+			"project",
+			"create"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/org/owner/project/{nano_id}/regenerate_api_key",
+		chain: [
+			"org",
+			"owner",
+			"project",
+			"regenerateAPIKey"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/org/usage/summary",
+		chain: [
+			"org",
+			"usage",
+			"retrieveSummary"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/org/usage/{entity_type}",
+		chain: [
+			"org",
+			"usage",
+			"retrieve"
+		],
+		schemes: ["OrgApiKeyAuth"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/project/usage/summary",
+		chain: [
+			"project",
+			"usage",
+			"retrieveSummary"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/project/usage/{entity_type}",
+		chain: [
+			"project",
+			"usage",
+			"retrieve"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session",
+		chain: [
+			"toolRouter",
+			"session",
+			"create"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/attach",
+		chain: [
+			"toolRouter",
+			"session",
+			"attach"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/execute",
+		chain: [
+			"toolRouter",
+			"session",
+			"execute"
+		],
+		schemes: ["ApiKeyAuth", "workbench_access_key"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/execute_meta",
+		chain: [
+			"toolRouter",
+			"session",
+			"executeMeta"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/link",
+		chain: [
+			"toolRouter",
+			"session",
+			"link"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/mounts/{mount_id}/delete",
+		chain: [
+			"toolRouter",
+			"session",
+			"files",
+			"delete"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/mounts/{mount_id}/download_url",
+		chain: [
+			"toolRouter",
+			"session",
+			"files",
+			"createDownloadURL"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/mounts/{mount_id}/upload_url",
+		chain: [
+			"toolRouter",
+			"session",
+			"files",
+			"createUploadURL"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/proxy_execute",
+		chain: [
+			"toolRouter",
+			"session",
+			"proxyExecute"
+		],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tool_router/session/{session_id}/search",
+		chain: [
+			"toolRouter",
+			"session",
+			"search"
+		]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/toolkits/multi",
+		chain: ["toolkits", "retrieveMulti"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/toolkits/{toolkit_slug}/scopes/recommended",
+		chain: ["toolkits", "recommendScopes"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tools/execute/proxy",
+		chain: ["tools", "proxy"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tools/execute/{tool_slug}",
+		chain: ["tools", "execute"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tools/execute/{tool_slug}/input",
+		chain: ["tools", "getInput"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/tools/scopes/required",
+		chain: ["tools", "retrieveRequiredScopes"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/trigger_instances/{slug}/upsert",
+		chain: ["triggerInstances", "upsert"],
+		schemes: ["ApiKeyAuth", "UserApiKeyAuth"],
+		hasDeprecatedInputs: true
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/webhook_endpoints",
+		chain: ["webhookEndpoints", "create"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/webhook_endpoints/{nano_id}",
+		chain: ["webhookEndpoints", "replace"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/webhook_subscriptions",
+		chain: ["webhookSubscriptions", "create"]
+	},
+	{
+		method: "post",
+		path: "/api/v3.1/webhook_subscriptions/{id}/rotate_secret",
+		chain: ["webhookSubscriptions", "rotateSecret"]
+	}
+];
+/**
+* The same descriptors, indexed by public chain — what a generated resource
+* resolves its own operation from at module load, so the kernel reads
+* identity off the call instead of recovering it from the URL.
+*
+* Built from the array rather than emitted a second time, so the two indexes
+* hold the *same objects* and cannot drift apart.
+*/
+const GENERATED_OPERATIONS_BY_KEY = new Map(GENERATED_OPERATIONS.map((operation) => [operation.chain.join("."), operation]));
+/**
+* The descriptor a generated method dispatches with. A miss is a generator
+* defect, not a runtime condition, so it fails at import time rather than
+* silently degrading that method back to path matching.
+*/
+const generatedOperation = (chainKey) => {
+	const operation = GENERATED_OPERATIONS_BY_KEY.get(chainKey);
+	if (operation === void 0) throw new Error(`generated-operations: no operation for chain '${chainKey}'`);
+	return operation;
+};
+
+//#endregion
+export { Auth as A, SCHEME_HEADERS as B, resolveIdentity as C, inspectDeprecatedInputs as D, mergeHeaders as E, chooseCredential as F, carriesCredentials as H, credentialHeader as I, resolveAuth as L, assertRequiredOperationHeaders as M, authConstructors as N, inspectDeprecation as O, authFromCredentials as P, resolveScope as R, reservedHeaders as S, buildHeaders as T, parseHTTPURL as U, assertCredentialTransport as V, resolveHTTPURL as W, shouldRetryResponse as _, TOO_MANY_REDIRECTS as a, createFetchTransport as b, buildURL as c, path as d, printableURL as f, safeJSON as g, rewriteForRedirect as h, REDIRECT_STATUSES as i, assertNoRemovedCredentialOptions as j, matchOperation as k, castToError as l, retryDelayMillis as m, generatedOperation as n, buildBody as o, readOperation as p, OPAQUE_REDIRECT as r, buildRequestHeaders as s, GENERATED_OPERATIONS as t, makeRequest as u, validatePositiveInteger as v, VERSION as w, assertNoReservedHeaders as x, withOperation as y, scopeForCall as z };