@executor-js/plugin-openapi 0.0.2 → 0.1.0

package/dist/{chunk-ZZ7TQ4JC.js → chunk-RBE3CVB4.js}

@@ -561,934 +561,531 @@ var extract = Effect2.fn("OpenApi.extract")(function* (doc) {
   });
 });
 
-// src/sdk/invoke.ts
-import { Effect as Effect3, Layer, Option as Option3 } from "effect";
-import { HttpClient as HttpClient2, HttpClientRequest as HttpClientRequest2 } from "effect/unstable/http";
-var CONTAINER_KEYS = {
-  path: ["path", "pathParams", "params"],
-  query: ["query", "queryParams", "params"],
-  header: ["headers", "header"],
-  cookie: ["cookies", "cookie"]
-};
-var readParamValue = (args, param) => {
-  const direct = args[param.name];
-  if (direct !== void 0) return direct;
-  for (const key of CONTAINER_KEYS[param.location] ?? []) {
-    const container = args[key];
-    if (typeof container === "object" && container !== null && !Array.isArray(container)) {
-      const nested = container[param.name];
-      if (nested !== void 0) return nested;
-    }
-  }
-  return void 0;
+// src/sdk/preview.ts
+import { Effect as Effect3, Option as Option3 } from "effect";
+import { Schema as Schema3 } from "effect";
+var OAuth2Scopes = Schema3.Record(Schema3.String, Schema3.String);
+var OAuth2AuthorizationCodeFlow = class extends Schema3.Class(
+  "OAuth2AuthorizationCodeFlow"
+)({
+  authorizationUrl: Schema3.String,
+  tokenUrl: Schema3.String,
+  refreshUrl: Schema3.OptionFromOptional(Schema3.String),
+  scopes: OAuth2Scopes
+}) {
 };
-var resolvePath = Effect3.fn("OpenApi.resolvePath")(function* (pathTemplate, args, parameters) {
-  let resolved = pathTemplate;
-  for (const param of parameters) {
-    if (param.location !== "path") continue;
-    const value = readParamValue(args, param);
-    if (value === void 0 || value === null) {
-      if (param.required) {
-        return yield* new OpenApiInvocationError({
-          message: `Missing required path parameter: ${param.name}`,
-          statusCode: Option3.none()
-        });
-      }
-      continue;
-    }
-    resolved = resolved.replaceAll(`{${param.name}}`, encodeURIComponent(String(value)));
-  }
-  const remaining = [...resolved.matchAll(/\{([^{}]+)\}/g)].map((m) => m[1]).filter((v) => typeof v === "string");
-  for (const name of remaining) {
-    const value = args[name];
-    if (value !== void 0 && value !== null) {
-      resolved = resolved.replaceAll(`{${name}}`, encodeURIComponent(String(value)));
-    }
-  }
-  const unresolved = [...resolved.matchAll(/\{([^{}]+)\}/g)].map((m) => m[1]).filter((v) => typeof v === "string");
-  if (unresolved.length > 0) {
-    return yield* new OpenApiInvocationError({
-      message: `Unresolved path parameters: ${[...new Set(unresolved)].join(", ")}`,
-      statusCode: Option3.none()
-    });
-  }
-  return resolved;
-});
-var resolveHeaders = (headers, secrets) => {
-  const entries = Object.entries(headers);
-  const secretCount = entries.reduce(
-    (acc, [, value]) => typeof value === "string" ? acc : acc + 1,
-    0
-  );
-  return Effect3.gen(function* () {
-    const values = yield* Effect3.all(
-      entries.map(
-        ([name, value]) => typeof value === "string" ? Effect3.succeed({ name, value }) : secrets.get(value.secretId).pipe(
-          Effect3.mapError(
-            (err) => "_tag" in err && err._tag === "SecretOwnedByConnectionError" ? new OpenApiInvocationError({
-              message: `Failed to resolve secret "${value.secretId}" for header "${name}"`,
-              statusCode: Option3.none()
-            }) : err
-          ),
-          Effect3.flatMap(
-            (secret) => secret === null ? Effect3.fail(
-              new OpenApiInvocationError({
-                message: `Failed to resolve secret "${value.secretId}" for header "${name}"`,
-                statusCode: Option3.none()
-              })
-            ) : Effect3.succeed({
-              name,
-              value: value.prefix ? `${value.prefix}${secret}` : secret
-            })
-          )
-        )
-      ),
-      { concurrency: "unbounded" }
-    );
-    const resolved = {};
-    for (const { name, value } of values) resolved[name] = value;
-    return resolved;
-  }).pipe(
-    Effect3.withSpan("plugin.openapi.secret.resolve", {
-      attributes: {
-        "plugin.openapi.headers.total": entries.length,
-        "plugin.openapi.headers.secret_count": secretCount
-      }
-    })
-  );
+var OAuth2ClientCredentialsFlow = class extends Schema3.Class(
+  "OAuth2ClientCredentialsFlow"
+)({
+  tokenUrl: Schema3.String,
+  refreshUrl: Schema3.OptionFromOptional(Schema3.String),
+  scopes: OAuth2Scopes
+}) {
 };
-var applyHeaders = (request, headers) => {
-  let req = request;
-  for (const [name, value] of Object.entries(headers)) {
-    req = HttpClientRequest2.setHeader(req, name, value);
-  }
-  return req;
+var OAuth2Flows = class extends Schema3.Class("OAuth2Flows")({
+  authorizationCode: Schema3.OptionFromOptional(OAuth2AuthorizationCodeFlow),
+  clientCredentials: Schema3.OptionFromOptional(OAuth2ClientCredentialsFlow)
+}) {
 };
-var normalizeContentType = (ct) => ct?.split(";")[0]?.trim().toLowerCase() ?? "";
-var isJsonContentType = (ct) => {
-  const normalized = normalizeContentType(ct);
-  if (!normalized) return false;
-  return normalized === "application/json" || normalized.includes("+json") || normalized.includes("json");
+var SecurityScheme = class extends Schema3.Class("SecurityScheme")({
+  /** Key name in components.securitySchemes (e.g. "api_token") */
+  name: Schema3.String,
+  /** OpenAPI security scheme type */
+  type: Schema3.Literals(["http", "apiKey", "oauth2", "openIdConnect"]),
+  /** For type: "http" — e.g. "bearer", "basic" */
+  scheme: Schema3.OptionFromOptional(Schema3.String),
+  /** For type: "http" with scheme "bearer" — e.g. "JWT" */
+  bearerFormat: Schema3.OptionFromOptional(Schema3.String),
+  /** For type: "apiKey" — where the key goes */
+  in: Schema3.OptionFromOptional(Schema3.Literals(["header", "query", "cookie"])),
+  /** For type: "apiKey" — the header/query/cookie name */
+  headerName: Schema3.OptionFromOptional(Schema3.String),
+  description: Schema3.OptionFromOptional(Schema3.String),
+  /** For type: "oauth2" — declared flows (authorizationCode / clientCredentials only; implicit and password are deprecated). */
+  flows: Schema3.OptionFromOptional(OAuth2Flows),
+  /** For type: "openIdConnect" — the discovery URL. */
+  openIdConnectUrl: Schema3.OptionFromOptional(Schema3.String)
+}) {
 };
-var isFormUrlEncoded = (ct) => normalizeContentType(ct) === "application/x-www-form-urlencoded";
-var isMultipartFormData = (ct) => normalizeContentType(ct).startsWith("multipart/form-data");
-var isXmlContentType = (ct) => {
-  const normalized = normalizeContentType(ct);
-  if (!normalized) return false;
-  return normalized === "application/xml" || normalized === "text/xml" || normalized.endsWith("+xml");
+var AuthStrategy = class extends Schema3.Class("AuthStrategy")({
+  /** The security schemes required together for this strategy */
+  schemes: Schema3.Array(Schema3.String)
+}) {
 };
-var isTextContentType = (ct) => normalizeContentType(ct).startsWith("text/");
-var isOctetStream = (ct) => normalizeContentType(ct) === "application/octet-stream";
-var toUint8Array = (value) => {
-  if (value instanceof Uint8Array) return value;
-  if (value instanceof ArrayBuffer) return new Uint8Array(value);
-  if (ArrayBuffer.isView(value)) {
-    const view = value;
-    return new Uint8Array(view.buffer, view.byteOffset, view.byteLength);
-  }
-  if (Array.isArray(value) && value.every((v) => typeof v === "number")) {
-    return new Uint8Array(value);
-  }
-  return null;
+var HeaderPreset = class extends Schema3.Class("HeaderPreset")({
+  /** Human-readable label for the UI (e.g. "Bearer Token", "API Key + Email") */
+  label: Schema3.String,
+  /** Headers this strategy needs. Value is null when the user must provide it. */
+  headers: Schema3.Record(Schema3.String, Schema3.NullOr(Schema3.String)),
+  /** Which headers should be stored as secrets */
+  secretHeaders: Schema3.Array(Schema3.String)
+}) {
 };
-var toArrayBuffer = (bytes) => {
-  const copy = new ArrayBuffer(bytes.byteLength);
-  new Uint8Array(copy).set(bytes);
-  return copy;
+var OAuth2Preset = class extends Schema3.Class("OAuth2Preset")({
+  /** Human-readable label for the UI (e.g. "OAuth2 (Authorization Code) — oauth_app") */
+  label: Schema3.String,
+  /** The source security scheme this preset came from (components.securitySchemes key). */
+  securitySchemeName: Schema3.String,
+  /** Which OAuth2 flow this preset uses. */
+  flow: Schema3.Literals(["authorizationCode", "clientCredentials"]),
+  /** For authorizationCode: user-agent redirect URL (from the spec). */
+  authorizationUrl: Schema3.OptionFromOptional(Schema3.String),
+  /** Token endpoint to exchange the code / refresh. */
+  tokenUrl: Schema3.String,
+  /** Optional refresh endpoint if the spec declares one separately. */
+  refreshUrl: Schema3.OptionFromOptional(Schema3.String),
+  /** Declared scopes for this flow: `{ scope: description }`. */
+  scopes: Schema3.Record(Schema3.String, Schema3.String)
+}) {
 };
-var DEFAULT_FORM_STYLE = {
-  style: "form",
-  explode: true,
-  allowReserved: false
+var PreviewOperation = class extends Schema3.Class("PreviewOperation")({
+  operationId: Schema3.String,
+  method: HttpMethod,
+  path: Schema3.String,
+  summary: Schema3.OptionFromOptional(Schema3.String),
+  tags: Schema3.Array(Schema3.String),
+  deprecated: Schema3.Boolean
+}) {
 };
-var resolveStyleExplode = (e) => {
-  if (!e) return DEFAULT_FORM_STYLE;
-  return {
-    style: Option3.getOrElse(e.style, () => DEFAULT_FORM_STYLE.style),
-    explode: Option3.getOrElse(e.explode, () => DEFAULT_FORM_STYLE.explode),
-    allowReserved: Option3.getOrElse(e.allowReserved, () => DEFAULT_FORM_STYLE.allowReserved)
-  };
+var SpecPreview = class extends Schema3.Class("SpecPreview")({
+  title: Schema3.OptionFromOptional(Schema3.String),
+  version: Schema3.OptionFromOptional(Schema3.String),
+  /** Reuses ServerInfo from extraction */
+  servers: Schema3.Array(ServerInfo),
+  operationCount: Schema3.Number,
+  /** Lightweight operation list for the add-source UI */
+  operations: Schema3.Array(PreviewOperation),
+  tags: Schema3.Array(Schema3.String),
+  securitySchemes: Schema3.Array(SecurityScheme),
+  /** Valid auth strategies (each is a set of schemes used together) */
+  authStrategies: Schema3.Array(AuthStrategy),
+  /** Pre-built header presets derived from auth strategies */
+  headerPresets: Schema3.Array(HeaderPreset),
+  /** OAuth2 presets — one per (oauth2 scheme × supported flow) combination */
+  oauth2Presets: Schema3.Array(OAuth2Preset)
+}) {
 };
-var RESERVED_UNENCODED_RE = /[A-Za-z0-9\-._~:/?#[\]@!$&'()*+,;=]/;
-var encodeFormValue = (v, allowReserved) => {
-  const raw = typeof v === "object" && v !== null ? JSON.stringify(v) : String(v);
-  if (!allowReserved) return encodeURIComponent(raw);
-  let out = "";
-  for (const ch of raw) {
-    out += RESERVED_UNENCODED_RE.test(ch) ? ch : encodeURIComponent(ch);
+var stringRecord = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    if (typeof v === "string") out[k] = v;
   }
   return out;
 };
-var serializeFormUrlEncoded = (value, encoding) => {
-  const parts = [];
-  for (const [key, raw] of Object.entries(value)) {
-    if (raw === void 0 || raw === null) continue;
-    const { style, explode, allowReserved } = resolveStyleExplode(encoding?.[key]);
-    const encKey = encodeURIComponent(key);
-    if (Array.isArray(raw)) {
-      if (explode) {
-        for (const v of raw) {
-          parts.push(`${encKey}=${encodeFormValue(v, allowReserved)}`);
-        }
-      } else {
-        const sep = style === "spaceDelimited" ? " " : style === "pipeDelimited" ? "|" : ",";
-        parts.push(
-          `${encKey}=${encodeFormValue(
-            raw.map((v) => typeof v === "object" ? JSON.stringify(v) : String(v)).join(sep),
-            allowReserved
-          )}`
-        );
-      }
-      continue;
-    }
-    if (typeof raw === "object") {
-      const entries = Object.entries(raw).filter(
-        ([, v]) => v !== void 0 && v !== null
-      );
-      if (style === "deepObject") {
-        for (const [subkey, subval] of entries) {
-          parts.push(
-            `${encodeURIComponent(`${key}[${subkey}]`)}=${encodeFormValue(
-              subval,
-              allowReserved
-            )}`
-          );
-        }
-      } else if (explode) {
-        for (const [subkey, subval] of entries) {
-          parts.push(
-            `${encodeURIComponent(subkey)}=${encodeFormValue(subval, allowReserved)}`
-          );
-        }
-      } else {
-        const flat = entries.flatMap(([k, v]) => [
-          k,
-          typeof v === "object" ? JSON.stringify(v) : String(v)
-        ]);
-        parts.push(`${encKey}=${encodeFormValue(flat.join(","), allowReserved)}`);
-      }
-      continue;
+var extractFlows = (rawFlows) => {
+  if (!rawFlows || typeof rawFlows !== "object") return Option3.none();
+  const flows = rawFlows;
+  const parseFlow = (key) => flows[key];
+  let authorizationCode = Option3.none();
+  const authCodeRaw = parseFlow("authorizationCode");
+  if (authCodeRaw && typeof authCodeRaw === "object") {
+    const f = authCodeRaw;
+    const authUrl = typeof f.authorizationUrl === "string" ? f.authorizationUrl : null;
+    const tokenUrl = typeof f.tokenUrl === "string" ? f.tokenUrl : null;
+    if (authUrl && tokenUrl) {
+      authorizationCode = Option3.some(
+        new OAuth2AuthorizationCodeFlow({
+          authorizationUrl: authUrl,
+          tokenUrl,
+          refreshUrl: Option3.fromNullishOr(
+            typeof f.refreshUrl === "string" ? f.refreshUrl : void 0
+          ),
+          scopes: stringRecord(f.scopes)
+        })
+      );
     }
-    parts.push(`${encKey}=${encodeFormValue(raw, allowReserved)}`);
   }
-  return parts.join("&");
-};
-var coerceFormDataRecord = (value, encoding) => {
-  const out = {};
-  for (const [key, raw] of Object.entries(value)) {
-    if (raw === void 0 || raw === null) continue;
-    const partType = encoding?.[key] ? Option3.getOrUndefined(encoding[key].contentType) : void 0;
-    if (partType) {
-      const isJson = partType.startsWith("application/json") || partType.includes("+json");
-      const serialized = typeof raw === "string" ? raw : isJson ? JSON.stringify(raw) : typeof raw === "object" ? JSON.stringify(raw) : String(raw);
-      out[key] = new Blob([serialized], { type: partType });
-      continue;
-    }
-    if (typeof raw === "string" || typeof raw === "number" || typeof raw === "boolean" || raw instanceof Blob || typeof File !== "undefined" && raw instanceof File) {
-      out[key] = raw;
-      continue;
-    }
-    if (Array.isArray(raw)) {
-      out[key] = raw.map(
-        (v) => typeof v === "string" || typeof v === "number" || typeof v === "boolean" || v instanceof Blob || typeof File !== "undefined" && v instanceof File ? v : JSON.stringify(v)
+  let clientCredentials = Option3.none();
+  const ccRaw = parseFlow("clientCredentials");
+  if (ccRaw && typeof ccRaw === "object") {
+    const f = ccRaw;
+    const tokenUrl = typeof f.tokenUrl === "string" ? f.tokenUrl : null;
+    if (tokenUrl) {
+      clientCredentials = Option3.some(
+        new OAuth2ClientCredentialsFlow({
+          tokenUrl,
+          refreshUrl: Option3.fromNullishOr(
+            typeof f.refreshUrl === "string" ? f.refreshUrl : void 0
+          ),
+          scopes: stringRecord(f.scopes)
+        })
       );
-      continue;
-    }
-    const bytes = toUint8Array(raw);
-    if (bytes) {
-      out[key] = new Blob([toArrayBuffer(bytes)]);
-      continue;
     }
-    out[key] = JSON.stringify(raw);
   }
-  return out;
+  if (Option3.isNone(authorizationCode) && Option3.isNone(clientCredentials)) {
+    return Option3.none();
+  }
+  return Option3.some(new OAuth2Flows({ authorizationCode, clientCredentials }));
 };
-var applyRequestBody = (request, contentType, bodyValue, encoding) => {
-  if (isJsonContentType(contentType)) {
-    if (typeof bodyValue === "string") {
-      return HttpClientRequest2.bodyText(request, bodyValue, contentType);
+var extractSecuritySchemes = (rawSchemes, resolver) => Object.entries(rawSchemes).flatMap(([name, schemeOrRef]) => {
+  if (!schemeOrRef || typeof schemeOrRef !== "object") return [];
+  const resolved = resolver.resolve(
+    schemeOrRef
+  );
+  if (!resolved || typeof resolved !== "object") return [];
+  const scheme = resolved;
+  const type = scheme.type;
+  if (!["http", "apiKey", "oauth2", "openIdConnect"].includes(type)) return [];
+  return [
+    new SecurityScheme({
+      name,
+      type,
+      scheme: Option3.fromNullishOr(scheme.scheme),
+      bearerFormat: Option3.fromNullishOr(scheme.bearerFormat),
+      in: Option3.fromNullishOr(scheme.in),
+      headerName: Option3.fromNullishOr(scheme.name),
+      description: Option3.fromNullishOr(scheme.description),
+      flows: type === "oauth2" ? extractFlows(scheme.flows) : Option3.none(),
+      openIdConnectUrl: Option3.fromNullishOr(
+        scheme.openIdConnectUrl
+      )
+    })
+  ];
+});
+var buildHeaderPresets = (schemes, strategies) => {
+  const schemeMap = new Map(schemes.map((s) => [s.name, s]));
+  return strategies.flatMap((strategy) => {
+    const resolved = strategy.schemes.map((name) => schemeMap.get(name)).filter((s) => s !== void 0);
+    if (resolved.length === 0) return [];
+    const headers = {};
+    const secretHeaders = [];
+    const labelParts = [];
+    for (const scheme of resolved) {
+      if (scheme.type === "http" && Option3.getOrElse(scheme.scheme, () => "") === "bearer") {
+        headers["Authorization"] = null;
+        secretHeaders.push("Authorization");
+        labelParts.push("Bearer Token");
+      } else if (scheme.type === "http" && Option3.getOrElse(scheme.scheme, () => "") === "basic") {
+        headers["Authorization"] = null;
+        secretHeaders.push("Authorization");
+        labelParts.push("Basic Auth");
+      } else if (scheme.type === "apiKey" && Option3.getOrElse(scheme.in, () => "") === "header") {
+        const headerName = Option3.getOrElse(scheme.headerName, () => scheme.name);
+        headers[headerName] = null;
+        secretHeaders.push(headerName);
+        labelParts.push(scheme.name);
+      } else if (scheme.type === "apiKey") {
+        labelParts.push(`${scheme.name} (${Option3.getOrElse(scheme.in, () => "unknown")})`);
+      } else {
+        labelParts.push(scheme.name);
+      }
     }
-    return HttpClientRequest2.bodyJsonUnsafe(request, bodyValue);
-  }
-  if (isFormUrlEncoded(contentType)) {
-    if (typeof bodyValue === "string") {
-      return HttpClientRequest2.bodyText(request, bodyValue, contentType);
+    if (Object.keys(headers).length === 0 && resolved.length > 0) {
+      return [new HeaderPreset({ label: labelParts.join(" + "), headers: {}, secretHeaders: [] })];
     }
-    if (typeof bodyValue === "object" && bodyValue !== null && !Array.isArray(bodyValue)) {
-      const serialized = serializeFormUrlEncoded(
-        bodyValue,
-        encoding
+    return [new HeaderPreset({ label: labelParts.join(" + "), headers, secretHeaders })];
+  });
+};
+var buildOAuth2Presets = (schemes) => {
+  const presets = [];
+  for (const scheme of schemes) {
+    if (scheme.type !== "oauth2") continue;
+    if (Option3.isNone(scheme.flows)) continue;
+    const flows = scheme.flows.value;
+    if (Option3.isSome(flows.authorizationCode)) {
+      const flow = flows.authorizationCode.value;
+      presets.push(
+        new OAuth2Preset({
+          label: `OAuth2 Authorization Code \xB7 ${scheme.name}`,
+          securitySchemeName: scheme.name,
+          flow: "authorizationCode",
+          authorizationUrl: Option3.some(flow.authorizationUrl),
+          tokenUrl: flow.tokenUrl,
+          refreshUrl: flow.refreshUrl,
+          scopes: flow.scopes
+        })
       );
-      return HttpClientRequest2.bodyText(request, serialized, contentType);
-    }
-    return HttpClientRequest2.bodyUrlParams(
-      request,
-      bodyValue
-    );
-  }
-  if (isMultipartFormData(contentType)) {
-    if (bodyValue instanceof FormData) {
-      return HttpClientRequest2.bodyFormData(request, bodyValue);
     }
-    if (typeof bodyValue === "object" && bodyValue !== null) {
-      return HttpClientRequest2.bodyFormDataRecord(
-        request,
-        coerceFormDataRecord(bodyValue, encoding)
+    if (Option3.isSome(flows.clientCredentials)) {
+      const flow = flows.clientCredentials.value;
+      presets.push(
+        new OAuth2Preset({
+          label: `OAuth2 Client Credentials \xB7 ${scheme.name}`,
+          securitySchemeName: scheme.name,
+          flow: "clientCredentials",
+          authorizationUrl: Option3.none(),
+          tokenUrl: flow.tokenUrl,
+          refreshUrl: flow.refreshUrl,
+          scopes: flow.scopes
+        })
       );
     }
-    return HttpClientRequest2.bodyText(request, String(bodyValue), contentType);
-  }
-  if (isOctetStream(contentType)) {
-    const bytes2 = toUint8Array(bodyValue);
-    if (bytes2) return HttpClientRequest2.bodyUint8Array(request, bytes2, contentType);
-    if (typeof bodyValue === "string") {
-      return HttpClientRequest2.bodyText(request, bodyValue, contentType);
-    }
-    return HttpClientRequest2.bodyText(request, JSON.stringify(bodyValue), contentType);
-  }
-  if (isXmlContentType(contentType) || isTextContentType(contentType)) {
-    if (typeof bodyValue === "string") {
-      return HttpClientRequest2.bodyText(request, bodyValue, contentType);
-    }
-    const bytes2 = toUint8Array(bodyValue);
-    if (bytes2) return HttpClientRequest2.bodyUint8Array(request, bytes2, contentType);
-    return HttpClientRequest2.bodyText(request, JSON.stringify(bodyValue), contentType);
   }
-  if (typeof bodyValue === "string") {
-    return HttpClientRequest2.bodyText(request, bodyValue, contentType);
-  }
-  const bytes = toUint8Array(bodyValue);
-  if (bytes) return HttpClientRequest2.bodyUint8Array(request, bytes, contentType);
-  return HttpClientRequest2.bodyText(request, JSON.stringify(bodyValue), contentType);
+  return presets;
 };
-var invoke = Effect3.fn("OpenApi.invoke")(function* (operation, args, resolvedHeaders, sourceQueryParams = {}) {
-  const client = yield* HttpClient2.HttpClient;
-  yield* Effect3.annotateCurrentSpan({
-    "http.method": operation.method.toUpperCase(),
-    "http.route": operation.pathTemplate,
-    "plugin.openapi.method": operation.method.toUpperCase(),
-    "plugin.openapi.path_template": operation.pathTemplate,
-    "plugin.openapi.headers.resolved_count": Object.keys(resolvedHeaders).length
-  });
-  const resolvedPath = yield* resolvePath(operation.pathTemplate, args, operation.parameters);
-  const path = resolvedPath.startsWith("/") ? resolvedPath : `/${resolvedPath}`;
-  let request = HttpClientRequest2.make(operation.method.toUpperCase())(path);
-  for (const [name, value] of Object.entries(sourceQueryParams)) {
-    request = HttpClientRequest2.setUrlParam(request, name, value);
-  }
-  for (const param of operation.parameters) {
-    if (param.location !== "query") continue;
-    const value = readParamValue(args, param);
-    if (value === void 0 || value === null) continue;
-    request = HttpClientRequest2.setUrlParam(request, param.name, String(value));
-  }
-  for (const param of operation.parameters) {
-    if (param.location !== "header") continue;
-    const value = readParamValue(args, param);
-    if (value === void 0 || value === null) continue;
-    request = HttpClientRequest2.setHeader(request, param.name, String(value));
-  }
-  if (Option3.isSome(operation.requestBody)) {
-    const rb = operation.requestBody.value;
-    const bodyValue = args.body ?? args.input;
-    if (bodyValue !== void 0) {
-      const contentsOpt = Option3.getOrUndefined(rb.contents);
-      const requestedCt = typeof args.contentType === "string" ? args.contentType : void 0;
-      const selected = contentsOpt && requestedCt ? contentsOpt.find((c) => c.contentType === requestedCt) : void 0;
-      const chosenCt = selected?.contentType ?? rb.contentType;
-      const chosenEncoding = selected ? Option3.getOrUndefined(selected.encoding) : contentsOpt && contentsOpt[0] ? Option3.getOrUndefined(contentsOpt[0].encoding) : void 0;
-      request = applyRequestBody(request, chosenCt, bodyValue, chosenEncoding);
-    }
+var collectTags = (result) => {
+  const tagSet = /* @__PURE__ */ new Set();
+  for (const op of result.operations) {
+    for (const tag of op.tags) tagSet.add(tag);
   }
-  request = applyHeaders(request, resolvedHeaders);
-  const response = yield* client.execute(request).pipe(
-    Effect3.mapError(
-      (err) => new OpenApiInvocationError({
-        message: `HTTP request failed: ${err.message}`,
-        statusCode: Option3.none(),
-        cause: err
-      })
-    )
+  return [...tagSet].sort();
+};
+var previewSpec = Effect3.fn("OpenApi.previewSpec")(function* (input) {
+  const specText = yield* resolveSpecText(input);
+  const doc = yield* parse(specText);
+  const result = yield* extract(doc);
+  const resolver = new DocResolver(doc);
+  const securitySchemes = extractSecuritySchemes(
+    doc.components?.securitySchemes ?? {},
+    resolver
   );
-  const status = response.status;
-  yield* Effect3.annotateCurrentSpan({
-    "http.status_code": status
-  });
-  const responseHeaders = { ...response.headers };
-  const contentType = response.headers["content-type"] ?? null;
-  const mapBodyError = Effect3.mapError(
-    (err) => new OpenApiInvocationError({
-      message: `Failed to read response body: ${err.message ?? String(err)}`,
-      statusCode: Option3.some(status),
-      cause: err
-    })
+  const rawSecurity = doc.security ?? [];
+  const declaredStrategies = rawSecurity.map(
+    (entry) => new AuthStrategy({ schemes: Object.keys(entry) })
   );
-  const responseBody = status === 204 ? null : isJsonContentType(contentType) ? yield* response.json.pipe(
-    Effect3.catch(() => response.text),
-    mapBodyError
-  ) : yield* response.text.pipe(mapBodyError);
-  const ok = status >= 200 && status < 300;
-  return new InvocationResult({
-    status,
-    headers: responseHeaders,
-    data: ok ? responseBody : null,
-    error: ok ? null : responseBody
+  const authStrategies = declaredStrategies.length > 0 ? declaredStrategies : securitySchemes.map((scheme) => new AuthStrategy({ schemes: [scheme.name] }));
+  return new SpecPreview({
+    title: result.title,
+    version: result.version,
+    servers: result.servers,
+    operationCount: result.operations.length,
+    operations: result.operations.map(
+      (op) => new PreviewOperation({
+        operationId: op.operationId,
+        method: op.method,
+        path: op.pathTemplate,
+        summary: op.summary,
+        tags: op.tags,
+        deprecated: op.deprecated
+      })
+    ),
+    tags: collectTags(result),
+    securitySchemes,
+    authStrategies,
+    headerPresets: buildHeaderPresets(securitySchemes, authStrategies),
+    oauth2Presets: buildOAuth2Presets(securitySchemes)
   });
 });
-var invokeWithLayer = (operation, args, baseUrl, resolvedHeaders, sourceQueryParams, httpClientLayer) => {
-  const clientWithBaseUrl = baseUrl ? Layer.effect(
-    HttpClient2.HttpClient,
-    Effect3.map(
-      Effect3.service(HttpClient2.HttpClient),
-      HttpClient2.mapRequest(HttpClientRequest2.prependUrl(baseUrl))
-    )
-  ).pipe(Layer.provide(httpClientLayer)) : httpClientLayer;
-  return invoke(operation, args, resolvedHeaders, sourceQueryParams).pipe(
-    Effect3.provide(clientWithBaseUrl),
-    Effect3.withSpan("plugin.openapi.invoke", {
-      attributes: {
-        "plugin.openapi.method": operation.method.toUpperCase(),
-        "plugin.openapi.path_template": operation.pathTemplate,
-        "plugin.openapi.base_url": baseUrl
-      }
-    })
-  );
-};
-var REQUIRE_APPROVAL = /* @__PURE__ */ new Set(["post", "put", "patch", "delete"]);
-var annotationsForOperation = (method, pathTemplate) => {
-  const m = method.toLowerCase();
-  if (!REQUIRE_APPROVAL.has(m)) return {};
-  return {
-    requiresApproval: true,
-    approvalDescription: `${method.toUpperCase()} ${pathTemplate}`
-  };
-};
 
-// src/sdk/preview.ts
-import { Effect as Effect4, Option as Option4 } from "effect";
-import { Schema as Schema3 } from "effect";
-var OAuth2Scopes = Schema3.Record(Schema3.String, Schema3.String);
-var OAuth2AuthorizationCodeFlow = class extends Schema3.Class(
-  "OAuth2AuthorizationCodeFlow"
-)({
-  authorizationUrl: Schema3.String,
-  tokenUrl: Schema3.String,
-  refreshUrl: Schema3.OptionFromOptional(Schema3.String),
-  scopes: OAuth2Scopes
-}) {
-};
-var OAuth2ClientCredentialsFlow = class extends Schema3.Class(
-  "OAuth2ClientCredentialsFlow"
+// src/sdk/store.ts
+import { Effect as Effect4, Schema as Schema4 } from "effect";
+import {
+  defineSchema,
+  ScopeId as ScopeId2,
+  StorageError
+} from "@executor-js/sdk/core";
+var openapiSchema = defineSchema({
+  openapi_source: {
+    fields: {
+      id: { type: "string", required: true },
+      scope_id: { type: "string", required: true, index: true },
+      name: { type: "string", required: true },
+      spec: { type: "string", required: true },
+      // Origin URL the spec was fetched from. Set when `addSpec` was
+      // invoked with an http(s) URL; null when the caller passed raw
+      // spec text. Drives `canRefresh` on the core source row and
+      // is the address re-fetched on `refreshSource`.
+      source_url: { type: "string", required: false },
+      base_url: { type: "string", required: false },
+      headers: { type: "json", required: false },
+      query_params: { type: "json", required: false },
+      oauth2: { type: "json", required: false },
+      invocation_config: { type: "json", required: true }
+    }
+  },
+  openapi_operation: {
+    fields: {
+      id: { type: "string", required: true },
+      scope_id: { type: "string", required: true, index: true },
+      source_id: { type: "string", required: true, index: true },
+      binding: { type: "json", required: true }
+    }
+  },
+  openapi_source_binding: {
+    fields: {
+      id: { type: "string", required: true },
+      source_id: { type: "string", required: true, index: true },
+      source_scope_id: { type: "string", required: true, index: true },
+      // Intentionally NOT named `scope_id`: this row is visible across
+      // scope stacks and is filtered manually by source/target scope.
+      // The target scope is credential ownership data, not adapter row
+      // ownership. Source owners must be able to delete all descendant
+      // bindings when a shared source is removed.
+      target_scope_id: { type: "string", required: true, index: true },
+      slot: { type: "string", required: true, index: true },
+      value: { type: "json", required: true },
+      created_at: { type: "date", required: true },
+      updated_at: { type: "date", required: true }
+    }
+  }
+});
+var StoredSourceSchema = class extends Schema4.Class(
+  "OpenApiStoredSource"
 )({
-  tokenUrl: Schema3.String,
-  refreshUrl: Schema3.OptionFromOptional(Schema3.String),
-  scopes: OAuth2Scopes
-}) {
-};
-var OAuth2Flows = class extends Schema3.Class("OAuth2Flows")({
-  authorizationCode: Schema3.OptionFromOptional(OAuth2AuthorizationCodeFlow),
-  clientCredentials: Schema3.OptionFromOptional(OAuth2ClientCredentialsFlow)
+  namespace: Schema4.String,
+  name: Schema4.String,
+  config: Schema4.Struct({
+    spec: Schema4.String,
+    sourceUrl: Schema4.optional(Schema4.String),
+    baseUrl: Schema4.optional(Schema4.String),
+    namespace: Schema4.optional(Schema4.String),
+    headers: Schema4.optional(
+      Schema4.Record(Schema4.String, ConfiguredHeaderValue)
+    ),
+    queryParams: Schema4.optional(
+      Schema4.Record(Schema4.String, HeaderValue)
+    ),
+    specFetchCredentials: Schema4.optional(
+      Schema4.Struct({
+        headers: Schema4.optional(
+          Schema4.Record(Schema4.String, HeaderValue)
+        ),
+        queryParams: Schema4.optional(
+          Schema4.Record(Schema4.String, HeaderValue)
+        )
+      })
+    ),
+    // Canonical source-owned OAuth config. Concrete client credentials
+    // and connection ids live in OpenAPI-owned scoped binding rows.
+    oauth2: Schema4.optional(OAuth2SourceConfig)
+  })
 }) {
 };
-var SecurityScheme = class extends Schema3.Class("SecurityScheme")({
-  /** Key name in components.securitySchemes (e.g. "api_token") */
-  name: Schema3.String,
-  /** OpenAPI security scheme type */
-  type: Schema3.Literals(["http", "apiKey", "oauth2", "openIdConnect"]),
-  /** For type: "http" — e.g. "bearer", "basic" */
-  scheme: Schema3.OptionFromOptional(Schema3.String),
-  /** For type: "http" with scheme "bearer" — e.g. "JWT" */
-  bearerFormat: Schema3.OptionFromOptional(Schema3.String),
-  /** For type: "apiKey" — where the key goes */
-  in: Schema3.OptionFromOptional(Schema3.Literals(["header", "query", "cookie"])),
-  /** For type: "apiKey" — the header/query/cookie name */
-  headerName: Schema3.OptionFromOptional(Schema3.String),
-  description: Schema3.OptionFromOptional(Schema3.String),
-  /** For type: "oauth2" — declared flows (authorizationCode / clientCredentials only; implicit and password are deprecated). */
-  flows: Schema3.OptionFromOptional(OAuth2Flows),
-  /** For type: "openIdConnect" — the discovery URL. */
-  openIdConnectUrl: Schema3.OptionFromOptional(Schema3.String)
-}) {
+var encodeBinding = Schema4.encodeSync(OperationBinding);
+var decodeBinding = Schema4.decodeUnknownSync(OperationBinding);
+var decodeOAuth2 = Schema4.decodeUnknownSync(OAuth2Auth);
+var encodeOAuth2SourceConfig = Schema4.encodeSync(OAuth2SourceConfig);
+var encodeSourceBindingValue = Schema4.encodeSync(OpenApiSourceBindingValue);
+var decodeSourceBindingValue = Schema4.decodeUnknownSync(
+  OpenApiSourceBindingValue
+);
+var asJsonObject = (value) => {
+  if (value == null) return {};
+  if (typeof value === "string")
+    return JSON.parse(value);
+  return value;
 };
-var AuthStrategy = class extends Schema3.Class("AuthStrategy")({
-  /** The security schemes required together for this strategy */
-  schemes: Schema3.Array(Schema3.String)
-}) {
+var toJsonRecord = (value) => value;
+var toConfiguredHeaderBinding = (value) => new ConfiguredHeaderBinding({
+  kind: "binding",
+  slot: String(value.slot ?? ""),
+  ...typeof value.prefix === "string" ? { prefix: value.prefix } : {}
+});
+var decodeHeaders = (value) => {
+  if (value == null) return {};
+  if (typeof value === "string")
+    return JSON.parse(value);
+  return value;
 };
-var HeaderPreset = class extends Schema3.Class("HeaderPreset")({
-  /** Human-readable label for the UI (e.g. "Bearer Token", "API Key + Email") */
-  label: Schema3.String,
-  /** Headers this strategy needs. Value is null when the user must provide it. */
-  headers: Schema3.Record(Schema3.String, Schema3.NullOr(Schema3.String)),
-  /** Which headers should be stored as secrets */
-  secretHeaders: Schema3.Array(Schema3.String)
-}) {
+var slugifySlotPart = (value) => value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "default";
+var headerBindingSlot = (headerName) => `header:${slugifySlotPart(headerName)}`;
+var oauth2ClientIdSlot = (securitySchemeName) => `oauth2:${slugifySlotPart(securitySchemeName)}:client-id`;
+var oauth2ClientSecretSlot = (securitySchemeName) => `oauth2:${slugifySlotPart(securitySchemeName)}:client-secret`;
+var oauth2ConnectionSlot = (securitySchemeName) => `oauth2:${slugifySlotPart(securitySchemeName)}:connection`;
+var normalizeStoredHeaders = (value) => {
+  const raw = decodeHeaders(value);
+  const headers = {};
+  const legacy = {};
+  for (const [name, header] of Object.entries(raw)) {
+    if (typeof header === "string") {
+      headers[name] = header;
+      legacy[name] = header;
+      continue;
+    }
+    if (header && typeof header === "object" && "kind" in header && header.kind === "binding") {
+      headers[name] = toConfiguredHeaderBinding(header);
+      continue;
+    }
+    legacy[name] = header;
+    headers[name] = new ConfiguredHeaderBinding({
+      kind: "binding",
+      slot: headerBindingSlot(name),
+      prefix: header.prefix
+    });
+  }
+  return { headers, legacy };
 };
-var OAuth2Preset = class extends Schema3.Class("OAuth2Preset")({
-  /** Human-readable label for the UI (e.g. "OAuth2 (Authorization Code) — oauth_app") */
-  label: Schema3.String,
-  /** The source security scheme this preset came from (components.securitySchemes key). */
-  securitySchemeName: Schema3.String,
-  /** Which OAuth2 flow this preset uses. */
-  flow: Schema3.Literals(["authorizationCode", "clientCredentials"]),
-  /** For authorizationCode: user-agent redirect URL (from the spec). */
-  authorizationUrl: Schema3.OptionFromOptional(Schema3.String),
-  /** Token endpoint to exchange the code / refresh. */
-  tokenUrl: Schema3.String,
-  /** Optional refresh endpoint if the spec declares one separately. */
-  refreshUrl: Schema3.OptionFromOptional(Schema3.String),
-  /** Declared scopes for this flow: `{ scope: description }`. */
-  scopes: Schema3.Record(Schema3.String, Schema3.String)
-}) {
-};
-var PreviewOperation = class extends Schema3.Class("PreviewOperation")({
-  operationId: Schema3.String,
-  method: HttpMethod,
-  path: Schema3.String,
-  summary: Schema3.OptionFromOptional(Schema3.String),
-  tags: Schema3.Array(Schema3.String),
-  deprecated: Schema3.Boolean
-}) {
-};
-var SpecPreview = class extends Schema3.Class("SpecPreview")({
-  title: Schema3.OptionFromOptional(Schema3.String),
-  version: Schema3.OptionFromOptional(Schema3.String),
-  /** Reuses ServerInfo from extraction */
-  servers: Schema3.Array(ServerInfo),
-  operationCount: Schema3.Number,
-  /** Lightweight operation list for the add-source UI */
-  operations: Schema3.Array(PreviewOperation),
-  tags: Schema3.Array(Schema3.String),
-  securitySchemes: Schema3.Array(SecurityScheme),
-  /** Valid auth strategies (each is a set of schemes used together) */
-  authStrategies: Schema3.Array(AuthStrategy),
-  /** Pre-built header presets derived from auth strategies */
-  headerPresets: Schema3.Array(HeaderPreset),
-  /** OAuth2 presets — one per (oauth2 scheme × supported flow) combination */
-  oauth2Presets: Schema3.Array(OAuth2Preset)
-}) {
-};
-var stringRecord = (value) => {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-  const out = {};
-  for (const [k, v] of Object.entries(value)) {
-    if (typeof v === "string") out[k] = v;
+var normalizeStoredOAuth2 = (value) => {
+  if (value == null) return {};
+  const parsed = typeof value === "string" ? JSON.parse(value) : value;
+  if (parsed && typeof parsed === "object" && "connectionSlot" in parsed) {
+    return {
+      oauth2: Schema4.decodeUnknownSync(OAuth2SourceConfig)(parsed)
+    };
   }
-  return out;
+  const legacy = decodeOAuth2(parsed);
+  return {
+    legacy,
+    oauth2: new OAuth2SourceConfig({
+      kind: "oauth2",
+      securitySchemeName: legacy.securitySchemeName,
+      flow: legacy.flow,
+      tokenUrl: legacy.tokenUrl,
+      authorizationUrl: legacy.authorizationUrl,
+      clientIdSlot: oauth2ClientIdSlot(legacy.securitySchemeName),
+      clientSecretSlot: legacy.clientSecretSecretId ? oauth2ClientSecretSlot(legacy.securitySchemeName) : null,
+      connectionSlot: oauth2ConnectionSlot(legacy.securitySchemeName),
+      scopes: [...legacy.scopes]
+    })
+  };
 };
-var extractFlows = (rawFlows) => {
-  if (!rawFlows || typeof rawFlows !== "object") return Option4.none();
-  const flows = rawFlows;
-  const parseFlow = (key) => flows[key];
-  let authorizationCode = Option4.none();
-  const authCodeRaw = parseFlow("authorizationCode");
-  if (authCodeRaw && typeof authCodeRaw === "object") {
-    const f = authCodeRaw;
-    const authUrl = typeof f.authorizationUrl === "string" ? f.authorizationUrl : null;
-    const tokenUrl = typeof f.tokenUrl === "string" ? f.tokenUrl : null;
-    if (authUrl && tokenUrl) {
-      authorizationCode = Option4.some(
-        new OAuth2AuthorizationCodeFlow({
-          authorizationUrl: authUrl,
-          tokenUrl,
-          refreshUrl: Option4.fromNullishOr(
-            typeof f.refreshUrl === "string" ? f.refreshUrl : void 0
-          ),
-          scopes: stringRecord(f.scopes)
+var makeDefaultOpenapiStore = ({
+  adapter,
+  scopes
+}) => {
+  const scopeIds = scopes.map((scope) => scope.id);
+  const scopePrecedence = /* @__PURE__ */ new Map();
+  scopeIds.forEach((scope, index) => scopePrecedence.set(scope, index));
+  const scopeRank = (scopeId) => scopePrecedence.get(scopeId) ?? Infinity;
+  const encodeSyntheticRowIdPart = (value) => encodeURIComponent(value);
+  const sourceBindingRowId = (sourceId, sourceScopeId, slot, scopeId) => [
+    "openapi-source-binding",
+    encodeSyntheticRowIdPart(sourceScopeId),
+    encodeSyntheticRowIdPart(sourceId),
+    encodeSyntheticRowIdPart(slot),
+    encodeSyntheticRowIdPart(scopeId)
+  ].join("::");
+  const rowToSourceBinding = (row) => new OpenApiSourceBindingRef({
+    sourceId: row.source_id,
+    sourceScopeId: ScopeId2.make(row.source_scope_id),
+    scopeId: ScopeId2.make(row.target_scope_id),
+    slot: row.slot,
+    value: decodeSourceBindingValue(asJsonObject(row.value)),
+    createdAt: row.created_at instanceof Date ? row.created_at : new Date(row.created_at),
+    updatedAt: row.updated_at instanceof Date ? row.updated_at : new Date(row.updated_at)
+  });
+  const validateBindingTarget = (params) => Effect4.gen(function* () {
+    if (!scopeIds.includes(params.sourceScope)) {
+      return yield* Effect4.fail(
+        new StorageError({
+          message: `OpenAPI source binding references source scope "${params.sourceScope}" which is not in the executor's scope stack [${scopeIds.join(", ")}].`,
+          cause: void 0
         })
       );
     }
-  }
-  let clientCredentials = Option4.none();
-  const ccRaw = parseFlow("clientCredentials");
-  if (ccRaw && typeof ccRaw === "object") {
-    const f = ccRaw;
-    const tokenUrl = typeof f.tokenUrl === "string" ? f.tokenUrl : null;
-    if (tokenUrl) {
-      clientCredentials = Option4.some(
-        new OAuth2ClientCredentialsFlow({
-          tokenUrl,
-          refreshUrl: Option4.fromNullishOr(
-            typeof f.refreshUrl === "string" ? f.refreshUrl : void 0
-          ),
-          scopes: stringRecord(f.scopes)
+    if (!scopeIds.includes(params.targetScope)) {
+      return yield* Effect4.fail(
+        new StorageError({
+          message: `OpenAPI source binding targets scope "${params.targetScope}" which is not in the executor's scope stack [${scopeIds.join(", ")}].`,
+          cause: void 0
         })
       );
     }
-  }
-  if (Option4.isNone(authorizationCode) && Option4.isNone(clientCredentials)) {
-    return Option4.none();
-  }
-  return Option4.some(new OAuth2Flows({ authorizationCode, clientCredentials }));
-};
-var extractSecuritySchemes = (rawSchemes, resolver) => Object.entries(rawSchemes).flatMap(([name, schemeOrRef]) => {
-  if (!schemeOrRef || typeof schemeOrRef !== "object") return [];
-  const resolved = resolver.resolve(
-    schemeOrRef
-  );
-  if (!resolved || typeof resolved !== "object") return [];
-  const scheme = resolved;
-  const type = scheme.type;
-  if (!["http", "apiKey", "oauth2", "openIdConnect"].includes(type)) return [];
-  return [
-    new SecurityScheme({
-      name,
-      type,
-      scheme: Option4.fromNullishOr(scheme.scheme),
-      bearerFormat: Option4.fromNullishOr(scheme.bearerFormat),
-      in: Option4.fromNullishOr(scheme.in),
-      headerName: Option4.fromNullishOr(scheme.name),
-      description: Option4.fromNullishOr(scheme.description),
-      flows: type === "oauth2" ? extractFlows(scheme.flows) : Option4.none(),
-      openIdConnectUrl: Option4.fromNullishOr(
-        scheme.openIdConnectUrl
-      )
-    })
-  ];
-});
-var buildHeaderPresets = (schemes, strategies) => {
-  const schemeMap = new Map(schemes.map((s) => [s.name, s]));
-  return strategies.flatMap((strategy) => {
-    const resolved = strategy.schemes.map((name) => schemeMap.get(name)).filter((s) => s !== void 0);
-    if (resolved.length === 0) return [];
-    const headers = {};
-    const secretHeaders = [];
-    const labelParts = [];
-    for (const scheme of resolved) {
-      if (scheme.type === "http" && Option4.getOrElse(scheme.scheme, () => "") === "bearer") {
-        headers["Authorization"] = null;
-        secretHeaders.push("Authorization");
-        labelParts.push("Bearer Token");
-      } else if (scheme.type === "http" && Option4.getOrElse(scheme.scheme, () => "") === "basic") {
-        headers["Authorization"] = null;
-        secretHeaders.push("Authorization");
-        labelParts.push("Basic Auth");
-      } else if (scheme.type === "apiKey" && Option4.getOrElse(scheme.in, () => "") === "header") {
-        const headerName = Option4.getOrElse(scheme.headerName, () => scheme.name);
-        headers[headerName] = null;
-        secretHeaders.push(headerName);
-        labelParts.push(scheme.name);
-      } else if (scheme.type === "apiKey") {
-        labelParts.push(`${scheme.name} (${Option4.getOrElse(scheme.in, () => "unknown")})`);
-      } else {
-        labelParts.push(scheme.name);
-      }
-    }
-    if (Object.keys(headers).length === 0 && resolved.length > 0) {
-      return [new HeaderPreset({ label: labelParts.join(" + "), headers: {}, secretHeaders: [] })];
-    }
-    return [new HeaderPreset({ label: labelParts.join(" + "), headers, secretHeaders })];
-  });
-};
-var buildOAuth2Presets = (schemes) => {
-  const presets = [];
-  for (const scheme of schemes) {
-    if (scheme.type !== "oauth2") continue;
-    if (Option4.isNone(scheme.flows)) continue;
-    const flows = scheme.flows.value;
-    if (Option4.isSome(flows.authorizationCode)) {
-      const flow = flows.authorizationCode.value;
-      presets.push(
-        new OAuth2Preset({
-          label: `OAuth2 Authorization Code \xB7 ${scheme.name}`,
-          securitySchemeName: scheme.name,
-          flow: "authorizationCode",
-          authorizationUrl: Option4.some(flow.authorizationUrl),
-          tokenUrl: flow.tokenUrl,
-          refreshUrl: flow.refreshUrl,
-          scopes: flow.scopes
+    const source = yield* adapter.findOne({
+      model: "openapi_source",
+      where: [
+        { field: "id", value: params.sourceId },
+        { field: "scope_id", value: params.sourceScope }
+      ]
+    });
+    if (!source) {
+      return yield* Effect4.fail(
+        new StorageError({
+          message: `OpenAPI source "${params.sourceId}" does not exist at scope "${params.sourceScope}"`,
+          cause: void 0
         })
       );
     }
-    if (Option4.isSome(flows.clientCredentials)) {
-      const flow = flows.clientCredentials.value;
-      presets.push(
-        new OAuth2Preset({
-          label: `OAuth2 Client Credentials \xB7 ${scheme.name}`,
-          securitySchemeName: scheme.name,
-          flow: "clientCredentials",
-          authorizationUrl: Option4.none(),
-          tokenUrl: flow.tokenUrl,
-          refreshUrl: flow.refreshUrl,
-          scopes: flow.scopes
+    if (scopeRank(params.targetScope) > scopeRank(params.sourceScope)) {
+      return yield* Effect4.fail(
+        new StorageError({
+          message: `OpenAPI source bindings for "${params.sourceId}" cannot be written at outer scope "${params.targetScope}" because the base source lives at "${params.sourceScope}"`,
+          cause: void 0
         })
       );
     }
-  }
-  return presets;
-};
-var collectTags = (result) => {
-  const tagSet = /* @__PURE__ */ new Set();
-  for (const op of result.operations) {
-    for (const tag of op.tags) tagSet.add(tag);
-  }
-  return [...tagSet].sort();
-};
-var previewSpec = Effect4.fn("OpenApi.previewSpec")(function* (input) {
-  const specText = yield* resolveSpecText(input);
-  const doc = yield* parse(specText);
-  const result = yield* extract(doc);
-  const resolver = new DocResolver(doc);
-  const securitySchemes = extractSecuritySchemes(
-    doc.components?.securitySchemes ?? {},
-    resolver
-  );
-  const rawSecurity = doc.security ?? [];
-  const declaredStrategies = rawSecurity.map(
-    (entry) => new AuthStrategy({ schemes: Object.keys(entry) })
-  );
-  const authStrategies = declaredStrategies.length > 0 ? declaredStrategies : securitySchemes.map((scheme) => new AuthStrategy({ schemes: [scheme.name] }));
-  return new SpecPreview({
-    title: result.title,
-    version: result.version,
-    servers: result.servers,
-    operationCount: result.operations.length,
-    operations: result.operations.map(
-      (op) => new PreviewOperation({
-        operationId: op.operationId,
-        method: op.method,
-        path: op.pathTemplate,
-        summary: op.summary,
-        tags: op.tags,
-        deprecated: op.deprecated
-      })
-    ),
-    tags: collectTags(result),
-    securitySchemes,
-    authStrategies,
-    headerPresets: buildHeaderPresets(securitySchemes, authStrategies),
-    oauth2Presets: buildOAuth2Presets(securitySchemes)
-  });
-});
-
-// src/sdk/store.ts
-import { Effect as Effect5, Schema as Schema4 } from "effect";
-import {
-  defineSchema,
-  ScopeId as ScopeId2,
-  StorageError
-} from "@executor-js/sdk/core";
-var openapiSchema = defineSchema({
-  openapi_source: {
-    fields: {
-      id: { type: "string", required: true },
-      scope_id: { type: "string", required: true, index: true },
-      name: { type: "string", required: true },
-      spec: { type: "string", required: true },
-      // Origin URL the spec was fetched from. Set when `addSpec` was
-      // invoked with an http(s) URL; null when the caller passed raw
-      // spec text. Drives `canRefresh` on the core source row and
-      // is the address re-fetched on `refreshSource`.
-      source_url: { type: "string", required: false },
-      base_url: { type: "string", required: false },
-      headers: { type: "json", required: false },
-      query_params: { type: "json", required: false },
-      oauth2: { type: "json", required: false },
-      invocation_config: { type: "json", required: true }
-    }
-  },
-  openapi_operation: {
-    fields: {
-      id: { type: "string", required: true },
-      scope_id: { type: "string", required: true, index: true },
-      source_id: { type: "string", required: true, index: true },
-      binding: { type: "json", required: true }
-    }
-  },
-  openapi_source_binding: {
-    fields: {
-      id: { type: "string", required: true },
-      source_id: { type: "string", required: true, index: true },
-      source_scope_id: { type: "string", required: true, index: true },
-      // Intentionally NOT named `scope_id`: this row is visible across
-      // scope stacks and is filtered manually by source/target scope.
-      // The target scope is credential ownership data, not adapter row
-      // ownership. Source owners must be able to delete all descendant
-      // bindings when a shared source is removed.
-      target_scope_id: { type: "string", required: true, index: true },
-      slot: { type: "string", required: true, index: true },
-      value: { type: "json", required: true },
-      created_at: { type: "date", required: true },
-      updated_at: { type: "date", required: true }
-    }
-  }
-});
-var StoredSourceSchema = class extends Schema4.Class(
-  "OpenApiStoredSource"
-)({
-  namespace: Schema4.String,
-  name: Schema4.String,
-  config: Schema4.Struct({
-    spec: Schema4.String,
-    sourceUrl: Schema4.optional(Schema4.String),
-    baseUrl: Schema4.optional(Schema4.String),
-    namespace: Schema4.optional(Schema4.String),
-    headers: Schema4.optional(
-      Schema4.Record(Schema4.String, ConfiguredHeaderValue)
-    ),
-    queryParams: Schema4.optional(
-      Schema4.Record(Schema4.String, HeaderValue)
-    ),
-    specFetchCredentials: Schema4.optional(
-      Schema4.Struct({
-        headers: Schema4.optional(
-          Schema4.Record(Schema4.String, HeaderValue)
-        ),
-        queryParams: Schema4.optional(
-          Schema4.Record(Schema4.String, HeaderValue)
-        )
-      })
-    ),
-    // Canonical source-owned OAuth config. Concrete client credentials
-    // and connection ids live in OpenAPI-owned scoped binding rows.
-    oauth2: Schema4.optional(OAuth2SourceConfig)
-  })
-}) {
-};
-var encodeBinding = Schema4.encodeSync(OperationBinding);
-var decodeBinding = Schema4.decodeUnknownSync(OperationBinding);
-var decodeOAuth2 = Schema4.decodeUnknownSync(OAuth2Auth);
-var encodeOAuth2SourceConfig = Schema4.encodeSync(OAuth2SourceConfig);
-var encodeSourceBindingValue = Schema4.encodeSync(OpenApiSourceBindingValue);
-var decodeSourceBindingValue = Schema4.decodeUnknownSync(
-  OpenApiSourceBindingValue
-);
-var asJsonObject = (value) => {
-  if (value == null) return {};
-  if (typeof value === "string")
-    return JSON.parse(value);
-  return value;
-};
-var toJsonRecord = (value) => value;
-var toConfiguredHeaderBinding = (value) => new ConfiguredHeaderBinding({
-  kind: "binding",
-  slot: String(value.slot ?? ""),
-  ...typeof value.prefix === "string" ? { prefix: value.prefix } : {}
-});
-var decodeHeaders = (value) => {
-  if (value == null) return {};
-  if (typeof value === "string")
-    return JSON.parse(value);
-  return value;
-};
-var slugifySlotPart = (value) => value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "default";
-var headerBindingSlot = (headerName) => `header:${slugifySlotPart(headerName)}`;
-var oauth2ClientIdSlot = (securitySchemeName) => `oauth2:${slugifySlotPart(securitySchemeName)}:client-id`;
-var oauth2ClientSecretSlot = (securitySchemeName) => `oauth2:${slugifySlotPart(securitySchemeName)}:client-secret`;
-var oauth2ConnectionSlot = (securitySchemeName) => `oauth2:${slugifySlotPart(securitySchemeName)}:connection`;
-var normalizeStoredHeaders = (value) => {
-  const raw = decodeHeaders(value);
-  const headers = {};
-  const legacy = {};
-  for (const [name, header] of Object.entries(raw)) {
-    if (typeof header === "string") {
-      headers[name] = header;
-      legacy[name] = header;
-      continue;
-    }
-    if (header && typeof header === "object" && "kind" in header && header.kind === "binding") {
-      headers[name] = toConfiguredHeaderBinding(header);
-      continue;
-    }
-    legacy[name] = header;
-    headers[name] = new ConfiguredHeaderBinding({
-      kind: "binding",
-      slot: headerBindingSlot(name),
-      prefix: header.prefix
-    });
-  }
-  return { headers, legacy };
-};
-var normalizeStoredOAuth2 = (value) => {
-  if (value == null) return {};
-  const parsed = typeof value === "string" ? JSON.parse(value) : value;
-  if (parsed && typeof parsed === "object" && "connectionSlot" in parsed) {
-    return {
-      oauth2: Schema4.decodeUnknownSync(OAuth2SourceConfig)(parsed)
-    };
-  }
-  const legacy = decodeOAuth2(parsed);
-  return {
-    legacy,
-    oauth2: new OAuth2SourceConfig({
-      kind: "oauth2",
-      securitySchemeName: legacy.securitySchemeName,
-      flow: legacy.flow,
-      tokenUrl: legacy.tokenUrl,
-      authorizationUrl: legacy.authorizationUrl,
-      clientIdSlot: oauth2ClientIdSlot(legacy.securitySchemeName),
-      clientSecretSlot: legacy.clientSecretSecretId ? oauth2ClientSecretSlot(legacy.securitySchemeName) : null,
-      connectionSlot: oauth2ConnectionSlot(legacy.securitySchemeName),
-      scopes: [...legacy.scopes]
-    })
-  };
-};
-var makeDefaultOpenapiStore = ({
-  adapter,
-  scopes
-}) => {
-  const scopeIds = scopes.map((scope) => scope.id);
-  const scopePrecedence = /* @__PURE__ */ new Map();
-  scopeIds.forEach((scope, index) => scopePrecedence.set(scope, index));
-  const scopeRank = (scopeId) => scopePrecedence.get(scopeId) ?? Infinity;
-  const encodeSyntheticRowIdPart = (value) => encodeURIComponent(value);
-  const sourceBindingRowId = (sourceId, sourceScopeId, slot, scopeId) => [
-    "openapi-source-binding",
-    encodeSyntheticRowIdPart(sourceScopeId),
-    encodeSyntheticRowIdPart(sourceId),
-    encodeSyntheticRowIdPart(slot),
-    encodeSyntheticRowIdPart(scopeId)
-  ].join("::");
-  const rowToSourceBinding = (row) => new OpenApiSourceBindingRef({
-    sourceId: row.source_id,
-    sourceScopeId: ScopeId2.make(row.source_scope_id),
-    scopeId: ScopeId2.make(row.target_scope_id),
-    slot: row.slot,
-    value: decodeSourceBindingValue(asJsonObject(row.value)),
-    createdAt: row.created_at instanceof Date ? row.created_at : new Date(row.created_at),
-    updatedAt: row.updated_at instanceof Date ? row.updated_at : new Date(row.updated_at)
-  });
-  const validateBindingTarget = (params) => Effect5.gen(function* () {
-    if (!scopeIds.includes(params.sourceScope)) {
-      return yield* Effect5.fail(
-        new StorageError({
-          message: `OpenAPI source binding references source scope "${params.sourceScope}" which is not in the executor's scope stack [${scopeIds.join(", ")}].`,
-          cause: void 0
-        })
-      );
-    }
-    if (!scopeIds.includes(params.targetScope)) {
-      return yield* Effect5.fail(
-        new StorageError({
-          message: `OpenAPI source binding targets scope "${params.targetScope}" which is not in the executor's scope stack [${scopeIds.join(", ")}].`,
-          cause: void 0
-        })
-      );
-    }
-    const source = yield* adapter.findOne({
-      model: "openapi_source",
-      where: [
-        { field: "id", value: params.sourceId },
-        { field: "scope_id", value: params.sourceScope }
-      ]
-    });
-    if (!source) {
-      return yield* Effect5.fail(
-        new StorageError({
-          message: `OpenAPI source "${params.sourceId}" does not exist at scope "${params.sourceScope}"`,
-          cause: void 0
-        })
-      );
-    }
-    if (scopeRank(params.targetScope) > scopeRank(params.sourceScope)) {
-      return yield* Effect5.fail(
-        new StorageError({
-          message: `OpenAPI source bindings for "${params.sourceId}" cannot be written at outer scope "${params.targetScope}" because the base source lives at "${params.sourceScope}"`,
-          cause: void 0
-        })
-      );
-    }
-    return source;
+    return source;
   });
   const rowToSource = (row) => {
     const normalizedHeaders = normalizeStoredHeaders(row.headers);
@@ -1520,7 +1117,7 @@ var makeDefaultOpenapiStore = ({
       typeof row.binding === "string" ? JSON.parse(row.binding) : row.binding
     )
   });
-  const deleteSource = (namespace, scope, options) => Effect5.gen(function* () {
+  const deleteSource = (namespace, scope, options) => Effect4.gen(function* () {
     yield* adapter.deleteMany({
       model: "openapi_operation",
       where: [
@@ -1546,7 +1143,7 @@ var makeDefaultOpenapiStore = ({
     }
   });
   return {
-    upsertSource: (input, operations) => Effect5.gen(function* () {
+    upsertSource: (input, operations) => Effect4.gen(function* () {
       yield* deleteSource(input.namespace, input.scope);
       yield* adapter.create({
         model: "openapi_source",
@@ -1590,7 +1187,7 @@ var makeDefaultOpenapiStore = ({
         });
       }
     }),
-    updateSourceMeta: (namespace, scope, patch) => Effect5.gen(function* () {
+    updateSourceMeta: (namespace, scope, patch) => Effect4.gen(function* () {
       const existingRow = yield* adapter.findOne({
         model: "openapi_source",
         where: [
@@ -1636,24 +1233,24 @@ var makeDefaultOpenapiStore = ({
         { field: "id", value: namespace },
         { field: "scope_id", value: scope }
       ]
-    }).pipe(Effect5.map((row) => row ? rowToSource(row) : null)),
-    listSources: () => adapter.findMany({ model: "openapi_source" }).pipe(Effect5.map((rows) => rows.map(rowToSource))),
+    }).pipe(Effect4.map((row) => row ? rowToSource(row) : null)),
+    listSources: () => adapter.findMany({ model: "openapi_source" }).pipe(Effect4.map((rows) => rows.map(rowToSource))),
     getOperationByToolId: (toolId, scope) => adapter.findOne({
       model: "openapi_operation",
       where: [
         { field: "id", value: toolId },
         { field: "scope_id", value: scope }
       ]
-    }).pipe(Effect5.map((row) => row ? rowToOperation(row) : null)),
+    }).pipe(Effect4.map((row) => row ? rowToOperation(row) : null)),
     listOperationsBySource: (sourceId, scope) => adapter.findMany({
       model: "openapi_operation",
       where: [
         { field: "source_id", value: sourceId },
         { field: "scope_id", value: scope }
       ]
-    }).pipe(Effect5.map((rows) => rows.map(rowToOperation))),
+    }).pipe(Effect4.map((rows) => rows.map(rowToOperation))),
     removeSource: (namespace, scope) => deleteSource(namespace, scope, { includeBindings: true }),
-    listSourceBindings: (sourceId, sourceScope) => Effect5.gen(function* () {
+    listSourceBindings: (sourceId, sourceScope) => Effect4.gen(function* () {
       yield* validateBindingTarget({
         sourceId,
         sourceScope,
@@ -1673,7 +1270,7 @@ var makeDefaultOpenapiStore = ({
         (a, b) => scopeRank(a.target_scope_id) - scopeRank(b.target_scope_id)
       ).map(rowToSourceBinding);
     }),
-    resolveSourceBinding: (sourceId, sourceScope, slot) => Effect5.gen(function* () {
+    resolveSourceBinding: (sourceId, sourceScope, slot) => Effect4.gen(function* () {
       yield* validateBindingTarget({
         sourceId,
         sourceScope,
@@ -1695,7 +1292,7 @@ var makeDefaultOpenapiStore = ({
       )[0];
       return row ? rowToSourceBinding(row) : null;
     }),
-    setSourceBinding: (input) => Effect5.gen(function* () {
+    setSourceBinding: (input) => Effect4.gen(function* () {
       yield* validateBindingTarget({
         sourceId: input.sourceId,
         sourceScope: input.sourceScope,
@@ -1707,60 +1304,689 @@ var makeDefaultOpenapiStore = ({
         input.slot,
         input.scope
       );
-      const now = /* @__PURE__ */ new Date();
-      yield* adapter.delete({
-        model: "openapi_source_binding",
-        where: [{ field: "id", value: id }]
-      });
-      yield* adapter.create({
-        model: "openapi_source_binding",
-        data: {
-          id,
-          source_id: input.sourceId,
-          source_scope_id: input.sourceScope,
-          target_scope_id: input.scope,
-          slot: input.slot,
-          value: toJsonRecord(encodeSourceBindingValue(input.value)),
-          created_at: now,
-          updated_at: now
-        },
-        forceAllowId: true
-      });
-      return new OpenApiSourceBindingRef({
-        sourceId: input.sourceId,
-        sourceScopeId: input.sourceScope,
-        scopeId: input.scope,
-        slot: input.slot,
-        value: input.value,
-        createdAt: now,
-        updatedAt: now
-      });
-    }),
-    removeSourceBinding: (sourceId, sourceScope, slot, scope) => Effect5.gen(function* () {
-      yield* validateBindingTarget({
-        sourceId,
-        sourceScope,
-        targetScope: scope
-      });
-      yield* adapter.delete({
-        model: "openapi_source_binding",
-        where: [
-          {
-            field: "id",
-            value: sourceBindingRowId(sourceId, sourceScope, slot, scope)
-          }
-        ]
-      });
+      const now = /* @__PURE__ */ new Date();
+      yield* adapter.delete({
+        model: "openapi_source_binding",
+        where: [{ field: "id", value: id }]
+      });
+      yield* adapter.create({
+        model: "openapi_source_binding",
+        data: {
+          id,
+          source_id: input.sourceId,
+          source_scope_id: input.sourceScope,
+          target_scope_id: input.scope,
+          slot: input.slot,
+          value: toJsonRecord(encodeSourceBindingValue(input.value)),
+          created_at: now,
+          updated_at: now
+        },
+        forceAllowId: true
+      });
+      return new OpenApiSourceBindingRef({
+        sourceId: input.sourceId,
+        sourceScopeId: input.sourceScope,
+        scopeId: input.scope,
+        slot: input.slot,
+        value: input.value,
+        createdAt: now,
+        updatedAt: now
+      });
+    }),
+    removeSourceBinding: (sourceId, sourceScope, slot, scope) => Effect4.gen(function* () {
+      yield* validateBindingTarget({
+        sourceId,
+        sourceScope,
+        targetScope: scope
+      });
+      yield* adapter.delete({
+        model: "openapi_source_binding",
+        where: [
+          {
+            field: "id",
+            value: sourceBindingRowId(sourceId, sourceScope, slot, scope)
+          }
+        ]
+      });
+    })
+  };
+};
+
+// src/sdk/invoke.ts
+import { Effect as Effect5, Layer, Option as Option4 } from "effect";
+import { HttpClient as HttpClient2, HttpClientRequest as HttpClientRequest2 } from "effect/unstable/http";
+var CONTAINER_KEYS = {
+  path: ["path", "pathParams", "params"],
+  query: ["query", "queryParams", "params"],
+  header: ["headers", "header"],
+  cookie: ["cookies", "cookie"]
+};
+var readParamValue = (args, param) => {
+  const direct = args[param.name];
+  if (direct !== void 0) return direct;
+  for (const key of CONTAINER_KEYS[param.location] ?? []) {
+    const container = args[key];
+    if (typeof container === "object" && container !== null && !Array.isArray(container)) {
+      const nested = container[param.name];
+      if (nested !== void 0) return nested;
+    }
+  }
+  return void 0;
+};
+var resolvePath = Effect5.fn("OpenApi.resolvePath")(function* (pathTemplate, args, parameters) {
+  let resolved = pathTemplate;
+  for (const param of parameters) {
+    if (param.location !== "path") continue;
+    const value = readParamValue(args, param);
+    if (value === void 0 || value === null) {
+      if (param.required) {
+        return yield* new OpenApiInvocationError({
+          message: `Missing required path parameter: ${param.name}`,
+          statusCode: Option4.none()
+        });
+      }
+      continue;
+    }
+    resolved = resolved.replaceAll(`{${param.name}}`, encodeURIComponent(String(value)));
+  }
+  const remaining = [...resolved.matchAll(/\{([^{}]+)\}/g)].map((m) => m[1]).filter((v) => typeof v === "string");
+  for (const name of remaining) {
+    const value = args[name];
+    if (value !== void 0 && value !== null) {
+      resolved = resolved.replaceAll(`{${name}}`, encodeURIComponent(String(value)));
+    }
+  }
+  const unresolved = [...resolved.matchAll(/\{([^{}]+)\}/g)].map((m) => m[1]).filter((v) => typeof v === "string");
+  if (unresolved.length > 0) {
+    return yield* new OpenApiInvocationError({
+      message: `Unresolved path parameters: ${[...new Set(unresolved)].join(", ")}`,
+      statusCode: Option4.none()
+    });
+  }
+  return resolved;
+});
+var resolveHeaders = (headers, secrets) => {
+  const entries = Object.entries(headers);
+  const secretCount = entries.reduce(
+    (acc, [, value]) => typeof value === "string" ? acc : acc + 1,
+    0
+  );
+  return Effect5.gen(function* () {
+    const values = yield* Effect5.all(
+      entries.map(
+        ([name, value]) => typeof value === "string" ? Effect5.succeed({ name, value }) : secrets.get(value.secretId).pipe(
+          Effect5.mapError(
+            (err) => "_tag" in err && err._tag === "SecretOwnedByConnectionError" ? new OpenApiInvocationError({
+              message: `Failed to resolve secret "${value.secretId}" for header "${name}"`,
+              statusCode: Option4.none()
+            }) : err
+          ),
+          Effect5.flatMap(
+            (secret) => secret === null ? Effect5.fail(
+              new OpenApiInvocationError({
+                message: `Failed to resolve secret "${value.secretId}" for header "${name}"`,
+                statusCode: Option4.none()
+              })
+            ) : Effect5.succeed({
+              name,
+              value: value.prefix ? `${value.prefix}${secret}` : secret
+            })
+          )
+        )
+      ),
+      { concurrency: "unbounded" }
+    );
+    const resolved = {};
+    for (const { name, value } of values) resolved[name] = value;
+    return resolved;
+  }).pipe(
+    Effect5.withSpan("plugin.openapi.secret.resolve", {
+      attributes: {
+        "plugin.openapi.headers.total": entries.length,
+        "plugin.openapi.headers.secret_count": secretCount
+      }
+    })
+  );
+};
+var applyHeaders = (request, headers) => {
+  let req = request;
+  for (const [name, value] of Object.entries(headers)) {
+    req = HttpClientRequest2.setHeader(req, name, value);
+  }
+  return req;
+};
+var normalizeContentType = (ct) => ct?.split(";")[0]?.trim().toLowerCase() ?? "";
+var isJsonContentType = (ct) => {
+  const normalized = normalizeContentType(ct);
+  if (!normalized) return false;
+  return normalized === "application/json" || normalized.includes("+json") || normalized.includes("json");
+};
+var isFormUrlEncoded = (ct) => normalizeContentType(ct) === "application/x-www-form-urlencoded";
+var isMultipartFormData = (ct) => normalizeContentType(ct).startsWith("multipart/form-data");
+var isXmlContentType = (ct) => {
+  const normalized = normalizeContentType(ct);
+  if (!normalized) return false;
+  return normalized === "application/xml" || normalized === "text/xml" || normalized.endsWith("+xml");
+};
+var isTextContentType = (ct) => normalizeContentType(ct).startsWith("text/");
+var isOctetStream = (ct) => normalizeContentType(ct) === "application/octet-stream";
+var toUint8Array = (value) => {
+  if (value instanceof Uint8Array) return value;
+  if (value instanceof ArrayBuffer) return new Uint8Array(value);
+  if (ArrayBuffer.isView(value)) {
+    const view = value;
+    return new Uint8Array(view.buffer, view.byteOffset, view.byteLength);
+  }
+  if (Array.isArray(value) && value.every((v) => typeof v === "number")) {
+    return new Uint8Array(value);
+  }
+  return null;
+};
+var toArrayBuffer = (bytes) => {
+  const copy = new ArrayBuffer(bytes.byteLength);
+  new Uint8Array(copy).set(bytes);
+  return copy;
+};
+var DEFAULT_FORM_STYLE = {
+  style: "form",
+  explode: true,
+  allowReserved: false
+};
+var resolveStyleExplode = (e) => {
+  if (!e) return DEFAULT_FORM_STYLE;
+  return {
+    style: Option4.getOrElse(e.style, () => DEFAULT_FORM_STYLE.style),
+    explode: Option4.getOrElse(e.explode, () => DEFAULT_FORM_STYLE.explode),
+    allowReserved: Option4.getOrElse(e.allowReserved, () => DEFAULT_FORM_STYLE.allowReserved)
+  };
+};
+var RESERVED_UNENCODED_RE = /[A-Za-z0-9\-._~:/?#[\]@!$&'()*+,;=]/;
+var encodeFormValue = (v, allowReserved) => {
+  const raw = typeof v === "object" && v !== null ? JSON.stringify(v) : String(v);
+  if (!allowReserved) return encodeURIComponent(raw);
+  let out = "";
+  for (const ch of raw) {
+    out += RESERVED_UNENCODED_RE.test(ch) ? ch : encodeURIComponent(ch);
+  }
+  return out;
+};
+var serializeFormUrlEncoded = (value, encoding) => {
+  const parts = [];
+  for (const [key, raw] of Object.entries(value)) {
+    if (raw === void 0 || raw === null) continue;
+    const { style, explode, allowReserved } = resolveStyleExplode(encoding?.[key]);
+    const encKey = encodeURIComponent(key);
+    if (Array.isArray(raw)) {
+      if (explode) {
+        for (const v of raw) {
+          parts.push(`${encKey}=${encodeFormValue(v, allowReserved)}`);
+        }
+      } else {
+        const sep = style === "spaceDelimited" ? " " : style === "pipeDelimited" ? "|" : ",";
+        parts.push(
+          `${encKey}=${encodeFormValue(
+            raw.map((v) => typeof v === "object" ? JSON.stringify(v) : String(v)).join(sep),
+            allowReserved
+          )}`
+        );
+      }
+      continue;
+    }
+    if (typeof raw === "object") {
+      const entries = Object.entries(raw).filter(
+        ([, v]) => v !== void 0 && v !== null
+      );
+      if (style === "deepObject") {
+        for (const [subkey, subval] of entries) {
+          parts.push(
+            `${encodeURIComponent(`${key}[${subkey}]`)}=${encodeFormValue(
+              subval,
+              allowReserved
+            )}`
+          );
+        }
+      } else if (explode) {
+        for (const [subkey, subval] of entries) {
+          parts.push(
+            `${encodeURIComponent(subkey)}=${encodeFormValue(subval, allowReserved)}`
+          );
+        }
+      } else {
+        const flat = entries.flatMap(([k, v]) => [
+          k,
+          typeof v === "object" ? JSON.stringify(v) : String(v)
+        ]);
+        parts.push(`${encKey}=${encodeFormValue(flat.join(","), allowReserved)}`);
+      }
+      continue;
+    }
+    parts.push(`${encKey}=${encodeFormValue(raw, allowReserved)}`);
+  }
+  return parts.join("&");
+};
+var coerceFormDataRecord = (value, encoding) => {
+  const out = {};
+  for (const [key, raw] of Object.entries(value)) {
+    if (raw === void 0 || raw === null) continue;
+    const partType = encoding?.[key] ? Option4.getOrUndefined(encoding[key].contentType) : void 0;
+    if (partType) {
+      const isJson = partType.startsWith("application/json") || partType.includes("+json");
+      const serialized = typeof raw === "string" ? raw : isJson ? JSON.stringify(raw) : typeof raw === "object" ? JSON.stringify(raw) : String(raw);
+      out[key] = new Blob([serialized], { type: partType });
+      continue;
+    }
+    if (typeof raw === "string" || typeof raw === "number" || typeof raw === "boolean" || raw instanceof Blob || typeof File !== "undefined" && raw instanceof File) {
+      out[key] = raw;
+      continue;
+    }
+    if (Array.isArray(raw)) {
+      out[key] = raw.map(
+        (v) => typeof v === "string" || typeof v === "number" || typeof v === "boolean" || v instanceof Blob || typeof File !== "undefined" && v instanceof File ? v : JSON.stringify(v)
+      );
+      continue;
+    }
+    const bytes = toUint8Array(raw);
+    if (bytes) {
+      out[key] = new Blob([toArrayBuffer(bytes)]);
+      continue;
+    }
+    out[key] = JSON.stringify(raw);
+  }
+  return out;
+};
+var applyRequestBody = (request, contentType, bodyValue, encoding) => {
+  if (isJsonContentType(contentType)) {
+    if (typeof bodyValue === "string") {
+      return HttpClientRequest2.bodyText(request, bodyValue, contentType);
+    }
+    return HttpClientRequest2.bodyJsonUnsafe(request, bodyValue);
+  }
+  if (isFormUrlEncoded(contentType)) {
+    if (typeof bodyValue === "string") {
+      return HttpClientRequest2.bodyText(request, bodyValue, contentType);
+    }
+    if (typeof bodyValue === "object" && bodyValue !== null && !Array.isArray(bodyValue)) {
+      const serialized = serializeFormUrlEncoded(
+        bodyValue,
+        encoding
+      );
+      return HttpClientRequest2.bodyText(request, serialized, contentType);
+    }
+    return HttpClientRequest2.bodyUrlParams(
+      request,
+      bodyValue
+    );
+  }
+  if (isMultipartFormData(contentType)) {
+    if (bodyValue instanceof FormData) {
+      return HttpClientRequest2.bodyFormData(request, bodyValue);
+    }
+    if (typeof bodyValue === "object" && bodyValue !== null) {
+      return HttpClientRequest2.bodyFormDataRecord(
+        request,
+        coerceFormDataRecord(bodyValue, encoding)
+      );
+    }
+    return HttpClientRequest2.bodyText(request, String(bodyValue), contentType);
+  }
+  if (isOctetStream(contentType)) {
+    const bytes2 = toUint8Array(bodyValue);
+    if (bytes2) return HttpClientRequest2.bodyUint8Array(request, bytes2, contentType);
+    if (typeof bodyValue === "string") {
+      return HttpClientRequest2.bodyText(request, bodyValue, contentType);
+    }
+    return HttpClientRequest2.bodyText(request, JSON.stringify(bodyValue), contentType);
+  }
+  if (isXmlContentType(contentType) || isTextContentType(contentType)) {
+    if (typeof bodyValue === "string") {
+      return HttpClientRequest2.bodyText(request, bodyValue, contentType);
+    }
+    const bytes2 = toUint8Array(bodyValue);
+    if (bytes2) return HttpClientRequest2.bodyUint8Array(request, bytes2, contentType);
+    return HttpClientRequest2.bodyText(request, JSON.stringify(bodyValue), contentType);
+  }
+  if (typeof bodyValue === "string") {
+    return HttpClientRequest2.bodyText(request, bodyValue, contentType);
+  }
+  const bytes = toUint8Array(bodyValue);
+  if (bytes) return HttpClientRequest2.bodyUint8Array(request, bytes, contentType);
+  return HttpClientRequest2.bodyText(request, JSON.stringify(bodyValue), contentType);
+};
+var invoke = Effect5.fn("OpenApi.invoke")(function* (operation, args, resolvedHeaders, sourceQueryParams = {}) {
+  const client = yield* HttpClient2.HttpClient;
+  yield* Effect5.annotateCurrentSpan({
+    "http.method": operation.method.toUpperCase(),
+    "http.route": operation.pathTemplate,
+    "plugin.openapi.method": operation.method.toUpperCase(),
+    "plugin.openapi.path_template": operation.pathTemplate,
+    "plugin.openapi.headers.resolved_count": Object.keys(resolvedHeaders).length
+  });
+  const resolvedPath = yield* resolvePath(operation.pathTemplate, args, operation.parameters);
+  const path = resolvedPath.startsWith("/") ? resolvedPath : `/${resolvedPath}`;
+  let request = HttpClientRequest2.make(operation.method.toUpperCase())(path);
+  for (const [name, value] of Object.entries(sourceQueryParams)) {
+    request = HttpClientRequest2.setUrlParam(request, name, value);
+  }
+  for (const param of operation.parameters) {
+    if (param.location !== "query") continue;
+    const value = readParamValue(args, param);
+    if (value === void 0 || value === null) continue;
+    request = HttpClientRequest2.setUrlParam(request, param.name, String(value));
+  }
+  for (const param of operation.parameters) {
+    if (param.location !== "header") continue;
+    const value = readParamValue(args, param);
+    if (value === void 0 || value === null) continue;
+    request = HttpClientRequest2.setHeader(request, param.name, String(value));
+  }
+  if (Option4.isSome(operation.requestBody)) {
+    const rb = operation.requestBody.value;
+    const bodyValue = args.body ?? args.input;
+    if (bodyValue !== void 0) {
+      const contentsOpt = Option4.getOrUndefined(rb.contents);
+      const requestedCt = typeof args.contentType === "string" ? args.contentType : void 0;
+      const selected = contentsOpt && requestedCt ? contentsOpt.find((c) => c.contentType === requestedCt) : void 0;
+      const chosenCt = selected?.contentType ?? rb.contentType;
+      const chosenEncoding = selected ? Option4.getOrUndefined(selected.encoding) : contentsOpt && contentsOpt[0] ? Option4.getOrUndefined(contentsOpt[0].encoding) : void 0;
+      request = applyRequestBody(request, chosenCt, bodyValue, chosenEncoding);
+    }
+  }
+  request = applyHeaders(request, resolvedHeaders);
+  const response = yield* client.execute(request).pipe(
+    Effect5.mapError(
+      (err) => new OpenApiInvocationError({
+        message: `HTTP request failed: ${err.message}`,
+        statusCode: Option4.none(),
+        cause: err
+      })
+    )
+  );
+  const status = response.status;
+  yield* Effect5.annotateCurrentSpan({
+    "http.status_code": status
+  });
+  const responseHeaders = { ...response.headers };
+  const contentType = response.headers["content-type"] ?? null;
+  const mapBodyError = Effect5.mapError(
+    (err) => new OpenApiInvocationError({
+      message: `Failed to read response body: ${err.message ?? String(err)}`,
+      statusCode: Option4.some(status),
+      cause: err
+    })
+  );
+  const responseBody = status === 204 ? null : isJsonContentType(contentType) ? yield* response.json.pipe(
+    Effect5.catch(() => response.text),
+    mapBodyError
+  ) : yield* response.text.pipe(mapBodyError);
+  const ok = status >= 200 && status < 300;
+  return new InvocationResult({
+    status,
+    headers: responseHeaders,
+    data: ok ? responseBody : null,
+    error: ok ? null : responseBody
+  });
+});
+var invokeWithLayer = (operation, args, baseUrl, resolvedHeaders, sourceQueryParams, httpClientLayer) => {
+  const clientWithBaseUrl = baseUrl ? Layer.effect(
+    HttpClient2.HttpClient,
+    Effect5.map(
+      Effect5.service(HttpClient2.HttpClient),
+      HttpClient2.mapRequest(HttpClientRequest2.prependUrl(baseUrl))
+    )
+  ).pipe(Layer.provide(httpClientLayer)) : httpClientLayer;
+  return invoke(operation, args, resolvedHeaders, sourceQueryParams).pipe(
+    Effect5.provide(clientWithBaseUrl),
+    Effect5.withSpan("plugin.openapi.invoke", {
+      attributes: {
+        "plugin.openapi.method": operation.method.toUpperCase(),
+        "plugin.openapi.path_template": operation.pathTemplate,
+        "plugin.openapi.base_url": baseUrl
+      }
     })
+  );
+};
+var REQUIRE_APPROVAL = /* @__PURE__ */ new Set(["post", "put", "patch", "delete"]);
+var annotationsForOperation = (method, pathTemplate) => {
+  const m = method.toLowerCase();
+  if (!REQUIRE_APPROVAL.has(m)) return {};
+  return {
+    requiresApproval: true,
+    approvalDescription: `${method.toUpperCase()} ${pathTemplate}`
   };
 };
 
 // src/sdk/plugin.ts
-import { Effect as Effect6, Option as Option5, Schema as Schema5 } from "effect";
+import { Effect as Effect7, Option as Option5, Schema as Schema6 } from "effect";
 import { FetchHttpClient } from "effect/unstable/http";
+
+// src/api/group.ts
+import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+import { Schema as Schema5 } from "effect";
+import { ScopeId as ScopeId3, SecretBackedValue as SecretBackedValue2 } from "@executor-js/sdk/core";
+import { InternalError } from "@executor-js/api";
+var DomainErrors = [
+  InternalError,
+  OpenApiParseError,
+  OpenApiExtractionError,
+  OpenApiOAuthError
+];
+var ScopeIdParam = {
+  scopeId: ScopeId3
+};
+var SourceParams = {
+  scopeId: ScopeId3,
+  namespace: Schema5.String
+};
+var SourceBindingParams = {
+  scopeId: ScopeId3,
+  namespace: Schema5.String,
+  sourceScopeId: ScopeId3
+};
+var SpecFetchCredentialsPayload = Schema5.Struct({
+  headers: Schema5.optional(Schema5.Record(Schema5.String, SecretBackedValue2)),
+  queryParams: Schema5.optional(Schema5.Record(Schema5.String, SecretBackedValue2))
+});
+var AddSpecPayload = Schema5.Struct({
+  spec: Schema5.String,
+  specFetchCredentials: Schema5.optional(SpecFetchCredentialsPayload),
+  name: Schema5.optional(Schema5.String),
+  baseUrl: Schema5.optional(Schema5.String),
+  namespace: Schema5.optional(Schema5.String),
+  headers: Schema5.optional(Schema5.Record(Schema5.String, Schema5.Unknown)),
+  queryParams: Schema5.optional(Schema5.Record(Schema5.String, SecretBackedValue2)),
+  oauth2: Schema5.optional(Schema5.Union([OAuth2Auth, OAuth2SourceConfig]))
+});
+var PreviewSpecPayload = Schema5.Struct({
+  spec: Schema5.String,
+  specFetchCredentials: Schema5.optional(SpecFetchCredentialsPayload)
+});
+var UpdateSourcePayload = Schema5.Struct({
+  name: Schema5.optional(Schema5.String),
+  baseUrl: Schema5.optional(Schema5.String),
+  headers: Schema5.optional(Schema5.Record(Schema5.String, Schema5.Unknown)),
+  queryParams: Schema5.optional(Schema5.Record(Schema5.String, SecretBackedValue2)),
+  // Set after a successful re-authenticate to refresh the source's
+  // stored OAuth2 metadata.
+  oauth2: Schema5.optional(Schema5.Union([OAuth2Auth, OAuth2SourceConfig]))
+});
+var UpdateSourceResponse = Schema5.Struct({
+  updated: Schema5.Boolean
+});
+var RemoveBindingPayload = Schema5.Struct({
+  sourceId: Schema5.String,
+  sourceScope: ScopeId3,
+  slot: Schema5.String,
+  scope: ScopeId3
+});
+var AddSpecResponse = Schema5.Struct({
+  toolCount: Schema5.Number,
+  namespace: Schema5.String
+});
+var OpenApiGroup = HttpApiGroup.make("openapi").add(
+  HttpApiEndpoint.post("previewSpec", "/scopes/:scopeId/openapi/preview", {
+    params: ScopeIdParam,
+    payload: PreviewSpecPayload,
+    success: SpecPreview,
+    error: DomainErrors
+  })
+).add(
+  HttpApiEndpoint.post("addSpec", "/scopes/:scopeId/openapi/specs", {
+    params: ScopeIdParam,
+    payload: AddSpecPayload,
+    success: AddSpecResponse,
+    error: DomainErrors
+  })
+).add(
+  HttpApiEndpoint.get("getSource", "/scopes/:scopeId/openapi/sources/:namespace", {
+    params: SourceParams,
+    success: Schema5.NullOr(StoredSourceSchema),
+    error: DomainErrors
+  })
+).add(
+  HttpApiEndpoint.patch("updateSource", "/scopes/:scopeId/openapi/sources/:namespace", {
+    params: SourceParams,
+    payload: UpdateSourcePayload,
+    success: UpdateSourceResponse,
+    error: DomainErrors
+  })
+).add(
+  HttpApiEndpoint.get(
+    "listSourceBindings",
+    "/scopes/:scopeId/openapi/sources/:namespace/base/:sourceScopeId/bindings",
+    {
+      params: SourceBindingParams,
+      success: Schema5.Array(OpenApiSourceBindingRef),
+      error: DomainErrors
+    }
+  )
+).add(
+  HttpApiEndpoint.post("setSourceBinding", "/scopes/:scopeId/openapi/source-bindings", {
+    params: ScopeIdParam,
+    payload: OpenApiSourceBindingInputSchema,
+    success: OpenApiSourceBindingRef,
+    error: DomainErrors
+  })
+).add(
+  HttpApiEndpoint.post(
+    "removeSourceBinding",
+    "/scopes/:scopeId/openapi/source-bindings/remove",
+    {
+      params: ScopeIdParam,
+      payload: RemoveBindingPayload,
+      success: Schema5.Struct({ removed: Schema5.Boolean }),
+      error: DomainErrors
+    }
+  )
+);
+
+// src/api/handlers.ts
+import { HttpApiBuilder } from "effect/unstable/httpapi";
+import { Context, Effect as Effect6 } from "effect";
+import { addGroup, capture } from "@executor-js/api";
+var OpenApiExtensionService = class extends Context.Service()("OpenApiExtensionService") {
+};
+var ExecutorApiWithOpenApi = addGroup(OpenApiGroup);
+var OpenApiHandlers = HttpApiBuilder.group(
+  ExecutorApiWithOpenApi,
+  "openapi",
+  (handlers) => handlers.handle(
+    "previewSpec",
+    ({ payload }) => capture(
+      Effect6.gen(function* () {
+        const ext = yield* OpenApiExtensionService;
+        return yield* ext.previewSpec({
+          spec: payload.spec,
+          specFetchCredentials: payload.specFetchCredentials
+        });
+      })
+    )
+  ).handle(
+    "addSpec",
+    ({ params: path, payload }) => capture(
+      Effect6.gen(function* () {
+        const ext = yield* OpenApiExtensionService;
+        const result = yield* ext.addSpec({
+          spec: payload.spec,
+          specFetchCredentials: payload.specFetchCredentials,
+          scope: path.scopeId,
+          name: payload.name,
+          baseUrl: payload.baseUrl,
+          namespace: payload.namespace,
+          headers: payload.headers,
+          queryParams: payload.queryParams,
+          oauth2: payload.oauth2
+        });
+        return {
+          toolCount: result.toolCount,
+          namespace: result.sourceId
+        };
+      })
+    )
+  ).handle(
+    "getSource",
+    ({ params: path }) => capture(
+      Effect6.gen(function* () {
+        const ext = yield* OpenApiExtensionService;
+        const source = yield* ext.getSource(path.namespace, path.scopeId);
+        return source ? new StoredSourceSchema({
+          namespace: source.namespace,
+          name: source.name,
+          config: source.config
+        }) : null;
+      })
+    )
+  ).handle(
+    "updateSource",
+    ({ params: path, payload }) => capture(
+      Effect6.gen(function* () {
+        const ext = yield* OpenApiExtensionService;
+        yield* ext.updateSource(path.namespace, path.scopeId, {
+          name: payload.name,
+          baseUrl: payload.baseUrl,
+          headers: payload.headers,
+          queryParams: payload.queryParams,
+          oauth2: payload.oauth2
+        });
+        return { updated: true };
+      })
+    )
+  ).handle(
+    "listSourceBindings",
+    ({ params: path }) => capture(
+      Effect6.gen(function* () {
+        const ext = yield* OpenApiExtensionService;
+        return yield* ext.listSourceBindings(path.namespace, path.sourceScopeId);
+      })
+    )
+  ).handle(
+    "setSourceBinding",
+    ({ payload }) => capture(
+      Effect6.gen(function* () {
+        const ext = yield* OpenApiExtensionService;
+        return yield* ext.setSourceBinding(new OpenApiSourceBindingInput(payload));
+      })
+    )
+  ).handle(
+    "removeSourceBinding",
+    ({ payload }) => capture(
+      Effect6.gen(function* () {
+        const ext = yield* OpenApiExtensionService;
+        yield* ext.removeSourceBinding(
+          payload.sourceId,
+          payload.sourceScope,
+          payload.slot,
+          payload.scope
+        );
+        return { removed: true };
+      })
+    )
+  )
+);
+
+// src/sdk/plugin.ts
 import {
   ConnectionId as ConnectionId2,
-  ScopeId as ScopeId3,
+  ScopeId as ScopeId4,
   SecretId as SecretId2,
   SourceDetectionResult,
   definePlugin,
@@ -1894,25 +2120,25 @@ var compileToolDefinitions = (operations) => {
 };
 
 // src/sdk/plugin.ts
-var PreviewSpecInputSchema = Schema5.Struct({
-  spec: Schema5.String,
-  specFetchCredentials: Schema5.optional(
-    Schema5.Struct({
-      headers: Schema5.optional(Schema5.Record(Schema5.String, HeaderValue)),
-      queryParams: Schema5.optional(Schema5.Record(Schema5.String, HeaderValue))
+var PreviewSpecInputSchema = Schema6.Struct({
+  spec: Schema6.String,
+  specFetchCredentials: Schema6.optional(
+    Schema6.Struct({
+      headers: Schema6.optional(Schema6.Record(Schema6.String, HeaderValue)),
+      queryParams: Schema6.optional(Schema6.Record(Schema6.String, HeaderValue))
     })
   )
 });
-var AddSourceInputSchema = Schema5.Struct({
-  spec: Schema5.String,
-  baseUrl: Schema5.optional(Schema5.String),
-  namespace: Schema5.optional(Schema5.String),
-  headers: Schema5.optional(Schema5.Record(Schema5.String, HeaderValue)),
-  queryParams: Schema5.optional(Schema5.Record(Schema5.String, HeaderValue)),
-  specFetchCredentials: Schema5.optional(
-    Schema5.Struct({
-      headers: Schema5.optional(Schema5.Record(Schema5.String, HeaderValue)),
-      queryParams: Schema5.optional(Schema5.Record(Schema5.String, HeaderValue))
+var AddSourceInputSchema = Schema6.Struct({
+  spec: Schema6.String,
+  baseUrl: Schema6.optional(Schema6.String),
+  namespace: Schema6.optional(Schema6.String),
+  headers: Schema6.optional(Schema6.Record(Schema6.String, HeaderValue)),
+  queryParams: Schema6.optional(Schema6.Record(Schema6.String, HeaderValue)),
+  specFetchCredentials: Schema6.optional(
+    Schema6.Struct({
+      headers: Schema6.optional(Schema6.Record(Schema6.String, HeaderValue)),
+      queryParams: Schema6.optional(Schema6.Record(Schema6.String, HeaderValue))
     })
   )
 });
@@ -2034,7 +2260,7 @@ var canonicalizeOAuth2 = (oauth2) => {
     bindings
   };
 };
-var resolveEffectiveSourceConfig = (ctx, base) => Effect6.gen(function* () {
+var resolveEffectiveSourceConfig = (ctx, base) => Effect7.gen(function* () {
   const rank = new Map(ctx.scopes.map((scope, index) => [scope.id, index]));
   const baseRank = rank.get(base.scope) ?? Infinity;
   let fallback = null;
@@ -2068,7 +2294,7 @@ var resolveEffectiveSourceConfig = (ctx, base) => Effect6.gen(function* () {
     oauth2Source: base.config.oauth2 ? base : fallback
   };
 });
-var resolveConfiguredHeaders = (ctx, params) => Effect6.gen(function* () {
+var resolveConfiguredHeaders = (ctx, params) => Effect7.gen(function* () {
   const resolved = {};
   for (const [name, value] of Object.entries(params.headers)) {
     if (typeof value === "string") {
@@ -2082,7 +2308,7 @@ var resolveConfiguredHeaders = (ctx, params) => Effect6.gen(function* () {
     );
     if (binding?.value.kind === "secret") {
       const secret = yield* ctx.secrets.get(binding.value.secretId).pipe(
-        Effect6.mapError(
+        Effect7.mapError(
           (err) => "_tag" in err && err._tag === "SecretOwnedByConnectionError" ? new OpenApiOAuthError({
             message: `Secret not found for header "${name}"`
           }) : err
@@ -2103,8 +2329,8 @@ var resolveConfiguredHeaders = (ctx, params) => Effect6.gen(function* () {
     const legacy = params.legacyHeaders?.[name];
     if (legacy) {
       const fallback = yield* resolveHeaders({ [name]: legacy }, ctx.secrets).pipe(
-        Effect6.map((headers) => headers[name]),
-        Effect6.mapError(
+        Effect7.map((headers) => headers[name]),
+        Effect7.mapError(
           (err) => err instanceof OpenApiOAuthError ? err : new OpenApiOAuthError({ message: err.message })
         )
       );
@@ -2127,12 +2353,12 @@ var resolveHeaderValues = (ctx, values) => resolveSecretBackedMap({
     message: `Secret not found for "${name}"`
   }) : err
 }).pipe(
-  Effect6.mapError(
+  Effect7.mapError(
     (err) => "_tag" in err && err._tag === "SecretOwnedByConnectionError" ? new OpenApiOAuthError({ message: "Secret resolution failed" }) : err
   ),
-  Effect6.map((resolved) => resolved ?? {})
+  Effect7.map((resolved) => resolved ?? {})
 );
-var resolveOAuthConnectionId = (ctx, params) => Effect6.gen(function* () {
+var resolveOAuthConnectionId = (ctx, params) => Effect7.gen(function* () {
   const binding = yield* ctx.storage.resolveSourceBinding(
     params.sourceId,
     params.sourceScope,
@@ -2147,7 +2373,7 @@ var resolveOAuthConnectionId = (ctx, params) => Effect6.gen(function* () {
   const legacyConnection = yield* ctx.connections.get(params.legacyOAuth2.connectionId);
   return legacyConnection ? params.legacyOAuth2.connectionId : null;
 });
-var resolveSpecFetchCredentials = (ctx, credentials) => Effect6.gen(function* () {
+var resolveSpecFetchCredentials = (ctx, credentials) => Effect7.gen(function* () {
   if (!credentials) return void 0;
   return {
     headers: yield* resolveHeaderValues(ctx, credentials.headers),
@@ -2174,7 +2400,7 @@ var toOpenApiSourceConfig = (namespace, config) => {
 var isHttpUrl = (s) => s.startsWith("http://") || s.startsWith("https://");
 var openApiPlugin = definePlugin((options) => {
   const httpClientLayer = options?.httpClientLayer ?? FetchHttpClient.layer;
-  const rebuildSource = (ctx, input) => Effect6.gen(function* () {
+  const rebuildSource = (ctx, input) => Effect7.gen(function* () {
     const doc = yield* parse(input.specText);
     const result = yield* extract(doc);
     const namespace = input.namespace ?? Option5.getOrElse(result.title, () => "api").toLowerCase().replace(/[^a-z0-9]+/g, "_");
@@ -2211,7 +2437,7 @@ var openApiPlugin = definePlugin((options) => {
       binding: toBinding(def)
     }));
     yield* ctx.transaction(
-      Effect6.gen(function* () {
+      Effect7.gen(function* () {
         yield* ctx.storage.upsertSource(storedSource, storedOps);
         yield* ctx.core.sources.register({
           id: namespace,
@@ -2236,8 +2462,8 @@ var openApiPlugin = definePlugin((options) => {
           yield* ctx.storage.setSourceBinding(
             new OpenApiSourceBindingInput({
               sourceId: namespace,
-              sourceScope: ScopeId3.make(input.scope),
-              scope: ScopeId3.make(input.scope),
+              sourceScope: ScopeId4.make(input.scope),
+              scope: ScopeId4.make(input.scope),
               slot: binding.slot,
               value: binding.value
             })
@@ -2254,7 +2480,7 @@ var openApiPlugin = definePlugin((options) => {
     );
     return { sourceId: namespace, toolCount: definitions.length };
   });
-  const refreshSourceInternal = (ctx, sourceId, scope) => Effect6.gen(function* () {
+  const refreshSourceInternal = (ctx, sourceId, scope) => Effect7.gen(function* () {
     const existing = yield* ctx.storage.getSource(sourceId, scope);
     if (!existing) return;
     const effective = yield* resolveEffectiveSourceConfig(ctx, existing);
@@ -2266,7 +2492,7 @@ var openApiPlugin = definePlugin((options) => {
       resolvedConfig.specFetchCredentials
     );
     const specText = yield* resolveSpecText(sourceUrl, credentials).pipe(
-      Effect6.provide(httpClientLayer)
+      Effect7.provide(httpClientLayer)
     );
     yield* rebuildSource(ctx, {
       specText,
@@ -2283,13 +2509,14 @@ var openApiPlugin = definePlugin((options) => {
   });
   return {
     id: "openapi",
+    packageName: "@executor-js/plugin-openapi",
     schema: openapiSchema,
     storage: (deps) => makeDefaultOpenapiStore(deps),
     extension: (ctx) => {
-      const addSpecInternal = (config) => Effect6.gen(function* () {
+      const addSpecInternal = (config) => Effect7.gen(function* () {
         const credentials = yield* resolveSpecFetchCredentials(ctx, config.specFetchCredentials);
         const specText = yield* resolveSpecText(config.spec, credentials).pipe(
-          Effect6.provide(httpClientLayer)
+          Effect7.provide(httpClientLayer)
         );
         return yield* rebuildSource(ctx, {
           specText,
@@ -2306,27 +2533,27 @@ var openApiPlugin = definePlugin((options) => {
       });
       const configFile = options?.configFile;
       return {
-        previewSpec: (input) => Effect6.gen(function* () {
+        previewSpec: (input) => Effect7.gen(function* () {
           const previewInput = typeof input === "string" ? { spec: input } : input;
           const credentials = yield* resolveSpecFetchCredentials(
             ctx,
             previewInput.specFetchCredentials
           );
           const specText = yield* resolveSpecText(previewInput.spec, credentials).pipe(
-            Effect6.provide(httpClientLayer)
+            Effect7.provide(httpClientLayer)
           );
-          return yield* previewSpec(specText).pipe(Effect6.provide(httpClientLayer));
+          return yield* previewSpec(specText).pipe(Effect7.provide(httpClientLayer));
         }),
-        addSpec: (config) => Effect6.gen(function* () {
+        addSpec: (config) => Effect7.gen(function* () {
           const result = yield* addSpecInternal(config);
           if (configFile) {
             yield* configFile.upsertSource(toOpenApiSourceConfig(result.sourceId, config));
           }
           return result;
         }),
-        removeSpec: (namespace, scope) => Effect6.gen(function* () {
+        removeSpec: (namespace, scope) => Effect7.gen(function* () {
           yield* ctx.transaction(
-            Effect6.gen(function* () {
+            Effect7.gen(function* () {
               yield* ctx.storage.removeSource(namespace, scope);
               yield* ctx.core.sources.unregister(namespace);
             })
@@ -2335,7 +2562,7 @@ var openApiPlugin = definePlugin((options) => {
             yield* configFile.removeSource(namespace);
           }
         }),
-        getSource: (namespace, scope) => Effect6.gen(function* () {
+        getSource: (namespace, scope) => Effect7.gen(function* () {
           const source = yield* ctx.storage.getSource(namespace, scope);
           if (!source) return null;
           const effective = yield* resolveEffectiveSourceConfig(ctx, source);
@@ -2344,7 +2571,7 @@ var openApiPlugin = definePlugin((options) => {
             config: effective.config
           };
         }),
-        updateSource: (namespace, scope, input) => Effect6.gen(function* () {
+        updateSource: (namespace, scope, input) => Effect7.gen(function* () {
           const existing = yield* ctx.storage.getSource(namespace, scope);
           if (!existing) return;
           const canonicalHeaders = input.headers !== void 0 ? canonicalizeHeaders(input.headers) : existing.legacy?.headers ? canonicalizeHeaders(existing.legacy.headers) : null;
@@ -2361,8 +2588,8 @@ var openApiPlugin = definePlugin((options) => {
               yield* ctx.storage.setSourceBinding(
                 new OpenApiSourceBindingInput({
                   sourceId: namespace,
-                  sourceScope: ScopeId3.make(scope),
-                  scope: ScopeId3.make(scope),
+                  sourceScope: ScopeId4.make(scope),
+                  scope: ScopeId4.make(scope),
                   slot: binding.slot,
                   value: binding.value
                 })
@@ -2432,17 +2659,17 @@ var openApiPlugin = definePlugin((options) => {
         ]
       }
     ],
-    invokeTool: ({ ctx, toolRow, args }) => Effect6.gen(function* () {
+    invokeTool: ({ ctx, toolRow, args }) => Effect7.gen(function* () {
       const toolScope = toolRow.scope_id;
       const op = yield* ctx.storage.getOperationByToolId(toolRow.id, toolScope);
       if (!op) {
-        return yield* Effect6.fail(
+        return yield* Effect7.fail(
           new Error(`No OpenAPI operation found for tool "${toolRow.id}"`)
         );
       }
       const source = yield* ctx.storage.getSource(op.sourceId, toolScope);
       if (!source) {
-        return yield* Effect6.fail(new Error(`No OpenAPI source found for "${op.sourceId}"`));
+        return yield* Effect7.fail(new Error(`No OpenAPI source found for "${op.sourceId}"`));
       }
       const effective = yield* resolveEffectiveSourceConfig(ctx, source);
       const config = effective.config;
@@ -2451,9 +2678,9 @@ var openApiPlugin = definePlugin((options) => {
         sourceScope: effective.headersSource.scope,
         headers: config.headers ?? {},
         legacyHeaders: effective.headersSource.legacy?.headers
-      }).pipe(Effect6.mapError((err) => new Error(err.message)));
+      }).pipe(Effect7.mapError((err) => new Error(err.message)));
       const resolvedQueryParams = yield* resolveHeaderValues(ctx, config.queryParams).pipe(
-        Effect6.mapError((err) => new Error(err.message))
+        Effect7.mapError((err) => new Error(err.message))
       );
       if (config.oauth2) {
         const connectionId = yield* resolveOAuthConnectionId(ctx, {
@@ -2463,12 +2690,12 @@ var openApiPlugin = definePlugin((options) => {
           legacyOAuth2: effective.oauth2Source.legacy?.oauth2
         });
         if (!connectionId) {
-          return yield* Effect6.fail(
+          return yield* Effect7.fail(
             new Error(`OAuth configuration for "${op.sourceId}" is missing a connection binding`)
           );
         }
         const accessToken = yield* ctx.connections.accessToken(connectionId).pipe(
-          Effect6.mapError(
+          Effect7.mapError(
             (err) => new Error(
               `OAuth connection resolution failed: ${"message" in err ? err.message : String(err)}`
             )
@@ -2486,14 +2713,14 @@ var openApiPlugin = definePlugin((options) => {
       );
       return result;
     }),
-    resolveAnnotations: ({ ctx, sourceId, toolRows }) => Effect6.gen(function* () {
+    resolveAnnotations: ({ ctx, sourceId, toolRows }) => Effect7.gen(function* () {
       const scopes = /* @__PURE__ */ new Set();
       for (const row of toolRows) {
         scopes.add(row.scope_id);
       }
-      const entries = yield* Effect6.forEach(
+      const entries = yield* Effect7.forEach(
         [...scopes],
-        (scope) => Effect6.gen(function* () {
+        (scope) => Effect7.gen(function* () {
           const ops = yield* ctx.storage.listOperationsBySource(sourceId, scope);
           const byId = /* @__PURE__ */ new Map();
           for (const op of ops) byId.set(op.toolId, op.binding);
@@ -2519,22 +2746,22 @@ var openApiPlugin = definePlugin((options) => {
     // when `canRefresh: true`, so a raw-text source reaching here
     // means stale UI state, which is worth surfacing to the caller.
     refreshSource: ({ ctx, sourceId, scope }) => refreshSourceInternal(ctx, sourceId, scope),
-    detect: ({ url }) => Effect6.gen(function* () {
+    detect: ({ url }) => Effect7.gen(function* () {
       const trimmed = url.trim();
       if (!trimmed) return null;
-      const parsed = yield* Effect6.try({
+      const parsed = yield* Effect7.try({
         try: () => new URL(trimmed),
         catch: (error) => error
-      }).pipe(Effect6.option);
+      }).pipe(Effect7.option);
       if (Option5.isNone(parsed)) return null;
       const specText = yield* resolveSpecText(trimmed).pipe(
-        Effect6.provide(httpClientLayer),
-        Effect6.catch(() => Effect6.succeed(null))
+        Effect7.provide(httpClientLayer),
+        Effect7.catch(() => Effect7.succeed(null))
       );
       if (specText === null) return null;
-      const doc = yield* parse(specText).pipe(Effect6.catch(() => Effect6.succeed(null)));
+      const doc = yield* parse(specText).pipe(Effect7.catch(() => Effect7.succeed(null)));
       if (!doc) return null;
-      const result = yield* extract(doc).pipe(Effect6.catch(() => Effect6.succeed(null)));
+      const result = yield* extract(doc).pipe(Effect7.catch(() => Effect7.succeed(null)));
       if (!result) return null;
       const namespace = Option5.getOrElse(result.title, () => "api").toLowerCase().replace(/[^a-z0-9]+/g, "_");
       const name = Option5.getOrElse(result.title, () => namespace);
@@ -2545,7 +2772,15 @@ var openApiPlugin = definePlugin((options) => {
         name,
         namespace
       });
-    })
+    }),
+    // HTTP transport. `OpenApiHandlers` is the existing late-binding
+    // Layer that requires `OpenApiExtensionService`; the host satisfies
+    // it via the spec's `extensionService` Tag — at boot for local
+    // (`composePluginHandlers(plugins, executor)`), per-request for
+    // cloud (`providePluginExtensions(plugins)(executor)`).
+    routes: () => OpenApiGroup,
+    handlers: () => OpenApiHandlers,
+    extensionService: OpenApiExtensionService
   };
 });
 
@@ -2581,10 +2816,6 @@ export {
   InvocationConfig,
   InvocationResult,
   extract,
-  resolveHeaders,
-  invoke,
-  invokeWithLayer,
-  annotationsForOperation,
   OAuth2AuthorizationCodeFlow,
   OAuth2ClientCredentialsFlow,
   OAuth2Flows,
@@ -2597,6 +2828,10 @@ export {
   previewSpec,
   openapiSchema,
   makeDefaultOpenapiStore,
+  resolveHeaders,
+  invoke,
+  invokeWithLayer,
+  annotationsForOperation,
   openApiPlugin
 };
-//# sourceMappingURL=chunk-ZZ7TQ4JC.js.map
+//# sourceMappingURL=chunk-RBE3CVB4.js.map