@executor-js/plugin-mcp 1.5.6 → 1.5.8

package/dist/{chunk-6OEQZ72N.js → chunk-3H5Y7JCQ.js}

@@ -38,9 +38,22 @@ var McpOAuthError = class extends Schema.TaggedErrorClass()(
 
 // src/sdk/types.ts
 import { Effect, Option, Schema as Schema2 } from "effect";
+import {
+  ApiKeyAuthMethod,
+  ApiKeyAuthTemplate,
+  NoneAuthMethod,
+  apiKeyMethodFromAuthTemplate,
+  isApiKeyAuthTemplate,
+  normalizeAuthMethodSlugs
+} from "@executor-js/sdk/http-auth";
 var McpRemoteTransport = Schema2.Literals(["streamable-http", "sse", "auto"]);
 var McpTransport = Schema2.Literals(["streamable-http", "sse", "stdio", "auto"]);
-var McpAuthTemplate = Schema2.Union([
+var McpOAuthMethod = Schema2.Struct({
+  slug: Schema2.String,
+  kind: Schema2.Literal("oauth2")
+});
+var McpAuthMethod = Schema2.Union([NoneAuthMethod, ApiKeyAuthMethod, McpOAuthMethod]);
+var McpAuthShorthand = Schema2.Union([
   Schema2.Struct({ kind: Schema2.Literal("none") }),
   Schema2.Struct({
     kind: Schema2.Literal("header"),
@@ -49,6 +62,46 @@ var McpAuthTemplate = Schema2.Union([
   }),
   Schema2.Struct({ kind: Schema2.Literal("oauth2") })
 ]);
+var mcpAuthMethodFromShorthand = (auth) => {
+  if (auth.kind === "header") {
+    return {
+      slug: "header",
+      kind: "apikey",
+      placements: [
+        {
+          carrier: "header",
+          name: auth.headerName,
+          ...auth.prefix !== void 0 ? { prefix: auth.prefix } : {}
+        }
+      ]
+    };
+  }
+  return { slug: auth.kind, kind: auth.kind };
+};
+var McpAuthMethodInput = Schema2.Union([
+  Schema2.Struct({ slug: Schema2.optional(Schema2.String), kind: Schema2.Literal("none") }),
+  Schema2.Struct({ slug: Schema2.optional(Schema2.String), kind: Schema2.Literal("oauth2") }),
+  // Credential methods are authored request-shaped — the ONE apikey input
+  // dialect: `{ type: "apiKey", headers: { Authorization: ["Bearer ",
+  // variable("token")] }, queryParams: { … } }`. Stored configs and the
+  // catalog read as canonical placements; `apiKeyAuthTemplateFromMethod`
+  // serializes them back for read-modify-write flows.
+  ApiKeyAuthTemplate
+]);
+var defaultMcpAuthSlug = (method) => {
+  if (method.kind !== "apikey") return method.kind;
+  if (method.placements.length === 1) {
+    return method.placements[0].carrier === "header" ? "header" : "query";
+  }
+  return "apikey";
+};
+var expandMcpAuthMethodInputs = (methods) => methods.map(
+  (method) => isApiKeyAuthTemplate(method) ? apiKeyMethodFromAuthTemplate(method) : method
+);
+var normalizeMcpAuthMethods = (methods) => normalizeAuthMethodSlugs(
+  expandMcpAuthMethodInputs(methods),
+  defaultMcpAuthSlug
+);
 var StringMap = Schema2.Record(Schema2.String, Schema2.String);
 var McpRemoteIntegrationConfig = Schema2.Struct({
   transport: Schema2.Literal("remote"),
@@ -63,8 +116,9 @@ var McpRemoteIntegrationConfig = Schema2.Struct({
   queryParams: Schema2.optional(StringMap),
   /** Static headers sent on every request (non-credential) */
   headers: Schema2.optional(StringMap),
-  /** Auth template — how the connection's value is rendered onto requests */
-  auth: McpAuthTemplate
+  /** Declared auth methods — how a connection's values are rendered onto
+   *  requests. A connection's `template` picks one by slug. */
+  authenticationTemplate: Schema2.Array(McpAuthMethod)
 });
 var McpStdioIntegrationConfig = Schema2.Struct({
   transport: Schema2.Literal("stdio"),
@@ -82,12 +136,7 @@ var McpIntegrationConfig = Schema2.Union([
   McpStdioIntegrationConfig
 ]);
 var decodeIntegrationConfig = Schema2.decodeUnknownOption(McpIntegrationConfig);
-var parseMcpIntegrationConfig = (config) => {
-  if (typeof config === "object" && config !== null && "transport" in config && config.transport === "remote" && !("auth" in config)) {
-    return Option.getOrNull(decodeIntegrationConfig({ ...config, auth: { kind: "none" } }));
-  }
-  return Option.getOrNull(decodeIntegrationConfig(config));
-};
+var parseMcpIntegrationConfig = (config) => Option.getOrNull(decodeIntegrationConfig(config));
 var McpToolAnnotations = Schema2.Struct({
   title: Schema2.optional(Schema2.String),
   readOnlyHint: Schema2.optional(Schema2.Boolean),
@@ -113,7 +162,12 @@ export {
   McpOAuthError,
   McpRemoteTransport,
   McpTransport,
-  McpAuthTemplate,
+  McpAuthMethod,
+  McpAuthShorthand,
+  mcpAuthMethodFromShorthand,
+  McpAuthMethodInput,
+  expandMcpAuthMethodInputs,
+  normalizeMcpAuthMethods,
   McpRemoteIntegrationConfig,
   McpStdioIntegrationConfig,
   McpIntegrationConfig,
@@ -121,4 +175,4 @@ export {
   McpToolAnnotations,
   McpToolBinding
 };
-//# sourceMappingURL=chunk-6OEQZ72N.js.map
+//# sourceMappingURL=chunk-3H5Y7JCQ.js.map

package/dist/chunk-3H5Y7JCQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/errors.ts","../src/sdk/types.ts"],"sourcesContent":["// MCP plugin tagged errors. Each carries an `HttpApiSchema` annotation so\n// it can be `.addError(...)` directly on the API group — handlers return\n// these and HttpApi encodes them as 4xx responses with a typed body. No\n// per-handler sanitisation step.\n\nimport { Schema } from \"effect\";\n\nexport class McpConnectionError extends Schema.TaggedErrorClass<McpConnectionError>()(\n  \"McpConnectionError\",\n  {\n    transport: Schema.String,\n    message: Schema.String,\n  },\n  { httpApiStatus: 400 },\n) {}\n\nexport class McpToolDiscoveryError extends Schema.TaggedErrorClass<McpToolDiscoveryError>()(\n  \"McpToolDiscoveryError\",\n  {\n    stage: Schema.Literals([\"connect\", \"list_tools\"]),\n    message: Schema.String,\n  },\n  { httpApiStatus: 400 },\n) {}\n\nexport class McpInvocationError extends Schema.TaggedErrorClass<McpInvocationError>()(\n  \"McpInvocationError\",\n  {\n    toolName: Schema.String,\n    message: Schema.String,\n  },\n  { httpApiStatus: 400 },\n) {}\n\nexport class McpOAuthError extends Schema.TaggedErrorClass<McpOAuthError>()(\n  \"McpOAuthError\",\n  {\n    message: Schema.String,\n  },\n  { httpApiStatus: 400 },\n) {}\n","import { Effect, Option, Schema } from \"effect\";\nimport {\n  ApiKeyAuthMethod,\n  ApiKeyAuthTemplate,\n  NoneAuthMethod,\n  apiKeyMethodFromAuthTemplate,\n  isApiKeyAuthTemplate,\n  normalizeAuthMethodSlugs,\n} from \"@executor-js/sdk/http-auth\";\n\n// ---------------------------------------------------------------------------\n// MCP plugin v2 data model.\n//\n// An MCP integration is one server. Its `config` blob (opaque to core, stored\n// on the integration row) carries everything needed to dial the server plus\n// the declared auth methods describing how a connection's resolved credential\n// values are applied to the request. A connection IS the credential: at\n// execute time core resolves the connection's values through its provider\n// (refreshing OAuth tokens), and the plugin renders them onto the request per\n// the method the connection binds (D11).\n// ---------------------------------------------------------------------------\n\n// ---------------------------------------------------------------------------\n// Transport / remote transport\n// ---------------------------------------------------------------------------\n\nexport const McpRemoteTransport = Schema.Literals([\"streamable-http\", \"sse\", \"auto\"]);\nexport type McpRemoteTransport = typeof McpRemoteTransport.Type;\n\n/** All transport types (used in the connector layer) */\nexport const McpTransport = Schema.Literals([\"streamable-http\", \"sse\", \"stdio\", \"auto\"]);\nexport type McpTransport = typeof McpTransport.Type;\n\n// ---------------------------------------------------------------------------\n// Auth methods — the shared placements vocabulary (`@executor-js/sdk/http-auth`)\n// plus MCP's own oauth variant. An integration declares zero or more methods,\n// each with a stable `slug` a connection binds against (`connection.template`),\n// mirroring the OpenAPI/GraphQL `authenticationTemplate` arrays.\n//\n//   none   — no credential (open server)\n//   apikey — render the connection's values through the method's header/query\n//            placements (one credential input per distinct placement\n//            `variable`; servers like ui.sh authenticate via a `?token=`\n//            query placement, and a method may mix carriers — e.g. a bearer\n//            header plus a team-id query param)\n//   oauth2 — the value is an OAuth access token, applied as a Bearer header\n//            via the MCP SDK's OAuthClientProvider. MCP oauth carries no\n//            stored endpoints: metadata is discovered live at connect time.\n// ---------------------------------------------------------------------------\n\nexport const McpOAuthMethod = Schema.Struct({\n  slug: Schema.String,\n  kind: Schema.Literal(\"oauth2\"),\n});\nexport type McpOAuthMethod = typeof McpOAuthMethod.Type;\n\nexport const McpAuthMethod = Schema.Union([NoneAuthMethod, ApiKeyAuthMethod, McpOAuthMethod]);\nexport type McpAuthMethod = typeof McpAuthMethod.Type;\n\n/** Single-method `auth` shorthand on `addServer` — agent convenience for the\n *  common cases. Normalized into `authenticationTemplate` at the boundary;\n *  never stored. */\nexport const McpAuthShorthand = Schema.Union([\n  Schema.Struct({ kind: Schema.Literal(\"none\") }),\n  Schema.Struct({\n    kind: Schema.Literal(\"header\"),\n    headerName: Schema.String,\n    prefix: Schema.optional(Schema.String),\n  }),\n  Schema.Struct({ kind: Schema.Literal(\"oauth2\") }),\n]);\nexport type McpAuthShorthand = typeof McpAuthShorthand.Type;\n\n/** Expand the `auth` shorthand into a declared method. Slugs match what the\n *  shorthand has always produced (`none` / `header` / `oauth2`) so existing\n *  connections bound to them keep matching. */\nexport const mcpAuthMethodFromShorthand = (auth: McpAuthShorthand): McpAuthMethod => {\n  if (auth.kind === \"header\") {\n    return {\n      slug: \"header\",\n      kind: \"apikey\",\n      placements: [\n        {\n          carrier: \"header\",\n          name: auth.headerName,\n          ...(auth.prefix !== undefined ? { prefix: auth.prefix } : {}),\n        },\n      ],\n    };\n  }\n  return { slug: auth.kind, kind: auth.kind };\n};\n\n/** Input variant of `McpAuthMethod` — callers (UI, agents) may omit the slug;\n *  `normalizeMcpAuthMethods` backfills it. */\nexport const McpAuthMethodInput = Schema.Union([\n  Schema.Struct({ slug: Schema.optional(Schema.String), kind: Schema.Literal(\"none\") }),\n  Schema.Struct({ slug: Schema.optional(Schema.String), kind: Schema.Literal(\"oauth2\") }),\n  // Credential methods are authored request-shaped — the ONE apikey input\n  // dialect: `{ type: \"apiKey\", headers: { Authorization: [\"Bearer \",\n  // variable(\"token\")] }, queryParams: { … } }`. Stored configs and the\n  // catalog read as canonical placements; `apiKeyAuthTemplateFromMethod`\n  // serializes them back for read-modify-write flows.\n  ApiKeyAuthTemplate,\n]);\nexport type McpAuthMethodInput = typeof McpAuthMethodInput.Type;\n\n/** The expansion target: input arms with the dialect resolved to canonical\n *  placements (slug still optional — backfill is a separate pass). */\nexport type McpCanonicalAuthMethodInput =\n  | Exclude<McpAuthMethodInput, ApiKeyAuthTemplate>\n  | (Omit<ApiKeyAuthMethod, \"slug\"> & { readonly slug?: string });\n\n/** The default slug for a slug-less input method. Carrier-derived for the\n *  single-placement apikey cases (`header` / `query`) — the slugs those\n *  methods have always had — so the shorthand, UI, and migration paths all\n *  converge on the same names. */\nconst defaultMcpAuthSlug = (method: McpCanonicalAuthMethodInput): string => {\n  if (method.kind !== \"apikey\") return method.kind;\n  if (method.placements.length === 1) {\n    return method.placements[0]!.carrier === \"header\" ? \"header\" : \"query\";\n  }\n  return \"apikey\";\n};\n\n/** Expand request-shaped dialect entries into canonical placements; canonical\n *  entries pass through. Slug backfill is the caller's concern\n *  (`normalizeMcpAuthMethods` for declare flows, `mergeAuthTemplates` for the\n *  custom-method merge). */\nexport const expandMcpAuthMethodInputs = (\n  methods: readonly McpAuthMethodInput[],\n): readonly McpCanonicalAuthMethodInput[] =>\n  methods.map(\n    (method): McpCanonicalAuthMethodInput =>\n      isApiKeyAuthTemplate(method)\n        ? (apiKeyMethodFromAuthTemplate(method) as McpCanonicalAuthMethodInput)\n        : (method as McpCanonicalAuthMethodInput),\n  );\n\n/** Assign each method a stable slug: a caller-provided one wins, otherwise a\n *  kind/carrier-derived default, suffixed `_2`, `_3`, … on collision. The\n *  request-shaped dialect is expanded to canonical placements first. */\nexport const normalizeMcpAuthMethods = (\n  methods: readonly McpAuthMethodInput[],\n): readonly McpAuthMethod[] =>\n  normalizeAuthMethodSlugs(\n    expandMcpAuthMethodInputs(methods),\n    defaultMcpAuthSlug,\n  ) as readonly McpAuthMethod[];\n\n// ---------------------------------------------------------------------------\n// Integration config — the opaque blob stored on the integration row. A\n// discriminated union on transport.\n// ---------------------------------------------------------------------------\n\nconst StringMap = Schema.Record(Schema.String, Schema.String);\n\nexport const McpRemoteIntegrationConfig = Schema.Struct({\n  transport: Schema.Literal(\"remote\"),\n  /** The MCP server endpoint URL */\n  endpoint: Schema.String,\n  /** Transport preference for this remote server */\n  remoteTransport: McpRemoteTransport.pipe(\n    Schema.optionalKey,\n    Schema.withConstructorDefault(Effect.succeed(\"auto\" as const)),\n  ),\n  /** Static query params appended to the endpoint URL (non-credential) */\n  queryParams: Schema.optional(StringMap),\n  /** Static headers sent on every request (non-credential) */\n  headers: Schema.optional(StringMap),\n  /** Declared auth methods — how a connection's values are rendered onto\n   *  requests. A connection's `template` picks one by slug. */\n  authenticationTemplate: Schema.Array(McpAuthMethod),\n});\nexport type McpRemoteIntegrationConfig = typeof McpRemoteIntegrationConfig.Type;\n\nexport const McpStdioIntegrationConfig = Schema.Struct({\n  transport: Schema.Literal(\"stdio\"),\n  /** The command to run */\n  command: Schema.String,\n  /** Arguments to the command */\n  args: Schema.optional(Schema.Array(Schema.String)),\n  /** Environment variables */\n  env: Schema.optional(StringMap),\n  /** Working directory */\n  cwd: Schema.optional(Schema.String),\n});\nexport type McpStdioIntegrationConfig = typeof McpStdioIntegrationConfig.Type;\n\nexport const McpIntegrationConfig = Schema.Union([\n  McpRemoteIntegrationConfig,\n  McpStdioIntegrationConfig,\n]);\nexport type McpIntegrationConfig = typeof McpIntegrationConfig.Type;\n\nconst decodeIntegrationConfig = Schema.decodeUnknownOption(McpIntegrationConfig);\n\n/** Parse an opaque integration `config` blob into a typed MCP config, or null\n *  if it isn't this plugin's (canonical) shape. Pre-canonical stored shapes\n *  are rewritten by the one-off config migration (`migrate-config.ts`), not\n *  decoded here — runtime code knows only the canonical model. */\nexport const parseMcpIntegrationConfig = (config: unknown): McpIntegrationConfig | null =>\n  Option.getOrNull(decodeIntegrationConfig(config));\n\n// ---------------------------------------------------------------------------\n// Tool annotations — upstream MCP ToolAnnotations we honour (destructiveHint\n// drives requiresApproval).\n// ---------------------------------------------------------------------------\n\nexport const McpToolAnnotations = Schema.Struct({\n  title: Schema.optional(Schema.String),\n  readOnlyHint: Schema.optional(Schema.Boolean),\n  destructiveHint: Schema.optional(Schema.Boolean),\n  idempotentHint: Schema.optional(Schema.Boolean),\n  openWorldHint: Schema.optional(Schema.Boolean),\n});\nexport type McpToolAnnotations = typeof McpToolAnnotations.Type;\n\n// ---------------------------------------------------------------------------\n// Tool binding — maps a persisted (sanitized) tool name back to its real MCP\n// tool name and upstream annotations, persisted per-connection so invokeTool\n// can dial the server with the correct name.\n// ---------------------------------------------------------------------------\n\nexport const McpToolBinding = Schema.Struct({\n  /** Sanitized, address-safe tool name (the `<tool>` address segment). */\n  toolId: Schema.String,\n  /** The real MCP tool name as advertised by the server. */\n  toolName: Schema.String,\n  description: Schema.NullOr(Schema.String),\n  inputSchema: Schema.optional(Schema.Unknown),\n  outputSchema: Schema.optional(Schema.Unknown),\n  annotations: Schema.optional(McpToolAnnotations),\n});\nexport type McpToolBinding = typeof McpToolBinding.Type;\n"],"mappings":";AAKA,SAAS,cAAc;AAEhB,IAAM,qBAAN,cAAiC,OAAO,iBAAqC;AAAA,EAClF;AAAA,EACA;AAAA,IACE,WAAW,OAAO;AAAA,IAClB,SAAS,OAAO;AAAA,EAClB;AAAA,EACA,EAAE,eAAe,IAAI;AACvB,EAAE;AAAC;AAEI,IAAM,wBAAN,cAAoC,OAAO,iBAAwC;AAAA,EACxF;AAAA,EACA;AAAA,IACE,OAAO,OAAO,SAAS,CAAC,WAAW,YAAY,CAAC;AAAA,IAChD,SAAS,OAAO;AAAA,EAClB;AAAA,EACA,EAAE,eAAe,IAAI;AACvB,EAAE;AAAC;AAEI,IAAM,qBAAN,cAAiC,OAAO,iBAAqC;AAAA,EAClF;AAAA,EACA;AAAA,IACE,UAAU,OAAO;AAAA,IACjB,SAAS,OAAO;AAAA,EAClB;AAAA,EACA,EAAE,eAAe,IAAI;AACvB,EAAE;AAAC;AAEI,IAAM,gBAAN,cAA4B,OAAO,iBAAgC;AAAA,EACxE;AAAA,EACA;AAAA,IACE,SAAS,OAAO;AAAA,EAClB;AAAA,EACA,EAAE,eAAe,IAAI;AACvB,EAAE;AAAC;;;ACxCH,SAAS,QAAQ,QAAQ,UAAAA,eAAc;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAkBA,IAAM,qBAAqBA,QAAO,SAAS,CAAC,mBAAmB,OAAO,MAAM,CAAC;AAI7E,IAAM,eAAeA,QAAO,SAAS,CAAC,mBAAmB,OAAO,SAAS,MAAM,CAAC;AAoBhF,IAAM,iBAAiBA,QAAO,OAAO;AAAA,EAC1C,MAAMA,QAAO;AAAA,EACb,MAAMA,QAAO,QAAQ,QAAQ;AAC/B,CAAC;AAGM,IAAM,gBAAgBA,QAAO,MAAM,CAAC,gBAAgB,kBAAkB,cAAc,CAAC;AAMrF,IAAM,mBAAmBA,QAAO,MAAM;AAAA,EAC3CA,QAAO,OAAO,EAAE,MAAMA,QAAO,QAAQ,MAAM,EAAE,CAAC;AAAA,EAC9CA,QAAO,OAAO;AAAA,IACZ,MAAMA,QAAO,QAAQ,QAAQ;AAAA,IAC7B,YAAYA,QAAO;AAAA,IACnB,QAAQA,QAAO,SAASA,QAAO,MAAM;AAAA,EACvC,CAAC;AAAA,EACDA,QAAO,OAAO,EAAE,MAAMA,QAAO,QAAQ,QAAQ,EAAE,CAAC;AAClD,CAAC;AAMM,IAAM,6BAA6B,CAAC,SAA0C;AACnF,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,MAAM;AAAA,MACN,YAAY;AAAA,QACV;AAAA,UACE,SAAS;AAAA,UACT,MAAM,KAAK;AAAA,UACX,GAAI,KAAK,WAAW,SAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,QAC7D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,MAAM,KAAK,MAAM,MAAM,KAAK,KAAK;AAC5C;AAIO,IAAM,qBAAqBA,QAAO,MAAM;AAAA,EAC7CA,QAAO,OAAO,EAAE,MAAMA,QAAO,SAASA,QAAO,MAAM,GAAG,MAAMA,QAAO,QAAQ,MAAM,EAAE,CAAC;AAAA,EACpFA,QAAO,OAAO,EAAE,MAAMA,QAAO,SAASA,QAAO,MAAM,GAAG,MAAMA,QAAO,QAAQ,QAAQ,EAAE,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtF;AACF,CAAC;AAaD,IAAM,qBAAqB,CAAC,WAAgD;AAC1E,MAAI,OAAO,SAAS,SAAU,QAAO,OAAO;AAC5C,MAAI,OAAO,WAAW,WAAW,GAAG;AAClC,WAAO,OAAO,WAAW,CAAC,EAAG,YAAY,WAAW,WAAW;AAAA,EACjE;AACA,SAAO;AACT;AAMO,IAAM,4BAA4B,CACvC,YAEA,QAAQ;AAAA,EACN,CAAC,WACC,qBAAqB,MAAM,IACtB,6BAA6B,MAAM,IACnC;AACT;AAKK,IAAM,0BAA0B,CACrC,YAEA;AAAA,EACE,0BAA0B,OAAO;AAAA,EACjC;AACF;AAOF,IAAM,YAAYA,QAAO,OAAOA,QAAO,QAAQA,QAAO,MAAM;AAErD,IAAM,6BAA6BA,QAAO,OAAO;AAAA,EACtD,WAAWA,QAAO,QAAQ,QAAQ;AAAA;AAAA,EAElC,UAAUA,QAAO;AAAA;AAAA,EAEjB,iBAAiB,mBAAmB;AAAA,IAClCA,QAAO;AAAA,IACPA,QAAO,uBAAuB,OAAO,QAAQ,MAAe,CAAC;AAAA,EAC/D;AAAA;AAAA,EAEA,aAAaA,QAAO,SAAS,SAAS;AAAA;AAAA,EAEtC,SAASA,QAAO,SAAS,SAAS;AAAA;AAAA;AAAA,EAGlC,wBAAwBA,QAAO,MAAM,aAAa;AACpD,CAAC;AAGM,IAAM,4BAA4BA,QAAO,OAAO;AAAA,EACrD,WAAWA,QAAO,QAAQ,OAAO;AAAA;AAAA,EAEjC,SAASA,QAAO;AAAA;AAAA,EAEhB,MAAMA,QAAO,SAASA,QAAO,MAAMA,QAAO,MAAM,CAAC;AAAA;AAAA,EAEjD,KAAKA,QAAO,SAAS,SAAS;AAAA;AAAA,EAE9B,KAAKA,QAAO,SAASA,QAAO,MAAM;AACpC,CAAC;AAGM,IAAM,uBAAuBA,QAAO,MAAM;AAAA,EAC/C;AAAA,EACA;AACF,CAAC;AAGD,IAAM,0BAA0BA,QAAO,oBAAoB,oBAAoB;AAMxE,IAAM,4BAA4B,CAAC,WACxC,OAAO,UAAU,wBAAwB,MAAM,CAAC;AAO3C,IAAM,qBAAqBA,QAAO,OAAO;AAAA,EAC9C,OAAOA,QAAO,SAASA,QAAO,MAAM;AAAA,EACpC,cAAcA,QAAO,SAASA,QAAO,OAAO;AAAA,EAC5C,iBAAiBA,QAAO,SAASA,QAAO,OAAO;AAAA,EAC/C,gBAAgBA,QAAO,SAASA,QAAO,OAAO;AAAA,EAC9C,eAAeA,QAAO,SAASA,QAAO,OAAO;AAC/C,CAAC;AASM,IAAM,iBAAiBA,QAAO,OAAO;AAAA;AAAA,EAE1C,QAAQA,QAAO;AAAA;AAAA,EAEf,UAAUA,QAAO;AAAA,EACjB,aAAaA,QAAO,OAAOA,QAAO,MAAM;AAAA,EACxC,aAAaA,QAAO,SAASA,QAAO,OAAO;AAAA,EAC3C,cAAcA,QAAO,SAASA,QAAO,OAAO;AAAA,EAC5C,aAAaA,QAAO,SAAS,kBAAkB;AACjD,CAAC;","names":["Schema"]}

package/dist/{chunk-HSJWIVME.js → chunk-6BJ6MZF7.js}

@@ -2,14 +2,18 @@ import {
   mcpPresets
 } from "./chunk-TW44CBXJ.js";
 import {
-  McpAuthTemplate,
+  McpAuthMethodInput,
+  McpAuthShorthand,
   McpConnectionError,
   McpInvocationError,
   McpRemoteTransport,
   McpToolAnnotations,
   McpToolDiscoveryError,
+  expandMcpAuthMethodInputs,
+  mcpAuthMethodFromShorthand,
+  normalizeMcpAuthMethods,
   parseMcpIntegrationConfig
-} from "./chunk-6OEQZ72N.js";
+} from "./chunk-3H5Y7JCQ.js";
 
 // src/sdk/manifest.ts
 import { Option, Schema } from "effect";
@@ -96,10 +100,18 @@ import {
   definePlugin,
   IntegrationAlreadyExistsError,
   IntegrationSlug,
+  mergeAuthTemplates,
   tool,
   ToolResult,
   ToolName
-} from "@executor-js/sdk/core";
+} from "@executor-js/sdk";
+import {
+  TOKEN_VARIABLE,
+  describeApiKeyAuthMethod,
+  describeNoneAuthMethod,
+  renderAuthPlacements,
+  requiredPlacementVariables
+} from "@executor-js/sdk/http-auth";
 
 // src/sdk/connection.ts
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -242,7 +254,7 @@ import {
   ElicitationId,
   FormElicitation,
   UrlElicitation
-} from "@executor-js/sdk/core";
+} from "@executor-js/sdk";
 var ArgsRecord = Schema2.Record(Schema2.String, Schema2.Unknown);
 var decodeArgsRecord = Schema2.decodeUnknownOption(ArgsRecord);
 var argsRecord = (value) => Option2.getOrElse(decodeArgsRecord(value), () => ({}));
@@ -563,7 +575,9 @@ var legacyOAuthClientSlugCandidates = (slug, integration) => {
 var oauthClientKey = (owner, slug) => `${owner}:${String(slug)}`;
 var legacyMcpClientMatches = (client, candidates, config) => {
   if (!candidates.has(String(client.slug))) return false;
-  if (!config || config.transport !== "remote" || config.auth.kind !== "oauth2") return false;
+  if (!config || config.transport !== "remote" || !config.authenticationTemplate.some((method) => method.kind === "oauth2")) {
+    return false;
+  }
   return client.grant === "authorization_code" && (client.resource ?? null) === config.endpoint;
 };
 var McpStampSchema = Schema4.Struct({
@@ -592,8 +606,11 @@ var McpRemoteServerInputSchema = Schema4.Struct({
   headers: Schema4.optional(Schema4.Record(Schema4.String, Schema4.String)),
   queryParams: Schema4.optional(Schema4.Record(Schema4.String, Schema4.String)),
   slug: Schema4.optional(Schema4.String),
-  /** How a connection's value is applied to requests. Defaults to none. */
-  auth: Schema4.optional(McpAuthTemplate)
+  /** Declared auth methods a connection can be applied through. */
+  authenticationTemplate: Schema4.optional(Schema4.Array(McpAuthMethodInput)),
+  /** Single-method shorthand (legacy callers). Ignored when
+   *  `authenticationTemplate` is present. Defaults to none. */
+  auth: Schema4.optional(McpAuthShorthand)
 });
 var McpStdioServerInputSchema = Schema4.Struct({
   transport: Schema4.Literal("stdio"),
@@ -611,6 +628,10 @@ var McpAddServerInputSchema = Schema4.Union([
 var McpAddServerOutputSchema = Schema4.Struct({
   slug: Schema4.String
 });
+var McpConfigureAuthInputSchema = Schema4.Struct({
+  authenticationTemplate: Schema4.Array(McpAuthMethodInput),
+  mode: Schema4.optional(Schema4.Literals(["merge", "replace"]))
+});
 var McpProbeEndpointInputSchema = Schema4.Struct({
   endpoint: Schema4.String,
   headers: Schema4.optional(Schema4.Record(Schema4.String, Schema4.String)),
@@ -666,7 +687,7 @@ var toIntegrationConfig = (input) => {
     remoteTransport: input.remoteTransport ?? "auto",
     queryParams: input.queryParams,
     headers: input.headers,
-    auth: input.auth ?? { kind: "none" }
+    authenticationTemplate: input.authenticationTemplate ? normalizeMcpAuthMethods(input.authenticationTemplate) : [mcpAuthMethodFromShorthand(input.auth ?? { kind: "none" })]
   };
 };
 var McpCallToolResultJsonSchema = z.toJSONSchema(CallToolResultSchema);
@@ -764,7 +785,15 @@ var makeOAuthProvider = (accessToken) => ({
   saveDiscoveryState: () => void 0,
   discoveryState: () => void 0
 });
-var buildConnectorInput = (config, value, allowStdio) => {
+var selectAuthMethod = (config, templateSlug) => {
+  const methods = config.authenticationTemplate;
+  if (templateSlug !== null) {
+    const match = methods.find((method) => method.slug === templateSlug);
+    if (match) return match;
+  }
+  return methods.length === 1 ? methods[0] : void 0;
+};
+var buildConnectorInput = (config, values, templateSlug, allowStdio) => {
   if (config.transport === "stdio") {
     if (!allowStdio) {
       return Effect5.fail(
@@ -783,18 +812,22 @@ var buildConnectorInput = (config, value, allowStdio) => {
     });
   }
   const headers = { ...config.headers ?? {} };
+  const queryParams = { ...config.queryParams ?? {} };
   let authProvider;
-  const auth = config.auth;
-  if (auth.kind === "header" && value !== null) {
-    headers[auth.headerName] = auth.prefix ? `${auth.prefix}${value}` : value;
-  } else if (auth.kind === "oauth2" && value !== null) {
-    authProvider = makeOAuthProvider(value);
+  const auth = selectAuthMethod(config, templateSlug);
+  if (auth?.kind === "apikey") {
+    const rendered = renderAuthPlacements(auth.placements, values);
+    Object.assign(headers, rendered.headers);
+    Object.assign(queryParams, rendered.queryParams);
+  } else if (auth?.kind === "oauth2") {
+    const token = values[TOKEN_VARIABLE];
+    if (token != null) authProvider = makeOAuthProvider(token);
   }
   return Effect5.succeed({
     transport: "remote",
     endpoint: config.endpoint,
     remoteTransport: config.remoteTransport ?? "auto",
-    queryParams: config.queryParams && Object.keys(config.queryParams).length > 0 ? config.queryParams : void 0,
+    queryParams: Object.keys(queryParams).length > 0 ? queryParams : void 0,
     headers: Object.keys(headers).length > 0 ? headers : void 0,
     authProvider
   });
@@ -802,40 +835,19 @@ var buildConnectorInput = (config, value, allowStdio) => {
 var describeMcpAuthMethods = (record) => {
   const config = parseMcpIntegrationConfig(record.config);
   if (!config || config.transport === "stdio") return [];
-  const auth = config.auth;
-  if (auth.kind === "none") {
-    return [
-      {
-        id: "none",
-        label: "No authentication",
-        kind: "none",
-        template: "none"
-      }
-    ];
-  }
-  if (auth.kind === "header") {
-    return [
-      {
-        id: "header",
-        label: "API key (header)",
-        kind: "apikey",
-        template: "header",
-        placements: [{ carrier: "header", name: auth.headerName, prefix: auth.prefix ?? "" }]
-      }
-    ];
-  }
-  if (auth.kind === "oauth2") {
-    return [
-      {
-        id: "oauth2",
+  return config.authenticationTemplate.map((method) => {
+    if (method.kind === "apikey") return describeApiKeyAuthMethod(method);
+    if (method.kind === "oauth2") {
+      return {
+        id: method.slug,
         label: "OAuth",
         kind: "oauth",
-        template: "oauth2",
+        template: method.slug,
         oauth: { discoveryUrl: config.endpoint, supportsDynamicRegistration: true }
-      }
-    ];
-  }
-  return [];
+      };
+    }
+    return describeNoneAuthMethod(method.slug);
+  });
 };
 var describeMcpIntegrationDisplay = (record) => {
   const config = parseMcpIntegrationConfig(record.config);
@@ -1050,12 +1062,34 @@ var mcpPlugin = definePlugin((options) => {
           attributes: { "mcp.integration.slug": slug }
         })
       );
+      const configureAuth = (slug, input) => Effect5.gen(function* () {
+        const record = yield* ctx.core.integrations.get(slugFrom(slug));
+        const current = record ? parseMcpIntegrationConfig(record.config) : null;
+        if (!current || current.transport === "stdio") {
+          return [];
+        }
+        const merged = input.mode === "replace" ? normalizeMcpAuthMethods(input.authenticationTemplate) : mergeAuthTemplates(
+          current.authenticationTemplate,
+          expandMcpAuthMethodInputs(
+            input.authenticationTemplate
+          )
+        );
+        yield* ctx.core.integrations.update(slugFrom(slug), {
+          config: { ...current, authenticationTemplate: merged }
+        });
+        return merged;
+      }).pipe(
+        Effect5.withSpan("mcp.plugin.configure_auth", {
+          attributes: { "mcp.integration.slug": slug }
+        })
+      );
       return {
         probeEndpoint,
         addServer,
         removeServer,
         getServer,
-        configureServer
+        configureServer,
+        configureAuth
       };
     },
     // -----------------------------------------------------------------------
@@ -1066,11 +1100,18 @@ var mcpPlugin = definePlugin((options) => {
     // Discovery failures (auth not ready, server down) yield an empty tool set
     // rather than failing — the connection still lands and can be refreshed.
     // -----------------------------------------------------------------------
-    resolveTools: ({ config, connection, getValue }) => Effect5.gen(function* () {
+    resolveTools: ({ config, connection, template, getValues }) => Effect5.gen(function* () {
       const parsed = parseMcpIntegrationConfig(config);
       if (!parsed) return { tools: [] };
-      const value = yield* getValue().pipe(Effect5.orElseSucceed(() => null));
-      const built = yield* buildConnectorInput(parsed, value, allowStdio).pipe(
+      const values = yield* getValues().pipe(
+        Effect5.orElseSucceed(() => ({}))
+      );
+      const built = yield* buildConnectorInput(
+        parsed,
+        values,
+        template === null ? null : String(template),
+        allowStdio
+      ).pipe(
         Effect5.map((ci) => createMcpConnector(ci)),
         Effect5.result
       );
@@ -1104,9 +1145,26 @@ var mcpPlugin = definePlugin((options) => {
         });
       }
       const transport = parsed.transport === "stdio" ? "stdio" : parsed.remoteTransport ?? "auto";
+      if (parsed.transport === "remote") {
+        const method = selectAuthMethod(parsed, String(credential.template));
+        if (method?.kind === "apikey") {
+          const missing = requiredPlacementVariables(method.placements).filter(
+            (variable) => credential.values[variable] == null
+          );
+          if (missing.length > 0) {
+            return authToolFailure({
+              code: "connection_value_missing",
+              message: `Connection has no resolvable credential value for input(s): ${missing.join(", ")}. Re-create the connection with the required value(s).`,
+              source: { id: String(credential.integration) },
+              credential: { kind: "upstream", label: String(credential.connection) }
+            });
+          }
+        }
+      }
       const connector = yield* buildConnectorInput(
         parsed,
-        credential.value,
+        credential.values,
+        String(credential.template),
         allowStdio
       ).pipe(Effect5.map((ci) => createMcpConnector(ci)));
       const raw = yield* invokeMcpTool({
@@ -1295,4 +1353,4 @@ export {
   userFacingProbeMessage,
   mcpPlugin
 };
-//# sourceMappingURL=chunk-HSJWIVME.js.map
+//# sourceMappingURL=chunk-6BJ6MZF7.js.map