@executor-js/plugin-openapi 0.1.0 → 1.4.20

package/dist/EditOpenApiSource-I4NIGIIJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/react/EditOpenApiSource.tsx"],"sourcesContent":["import { useEffect, useMemo, useRef, useState } from \"react\";\nimport { useAtomSet, useAtomValue } from \"@effect/atom-react\";\nimport * as Exit from \"effect/Exit\";\nimport * as Option from \"effect/Option\";\nimport * as Schema from \"effect/Schema\";\nimport * as AsyncResult from \"effect/unstable/reactivity/AsyncResult\";\n\nimport { connectionsAtom, sourceAtom, startOAuth } from \"@executor-js/react/api/atoms\";\nimport { useScope, useScopeStack, useUserScope } from \"@executor-js/react/api/scope-context\";\nimport { connectionWriteKeys, sourceWriteKeys } from \"@executor-js/react/api/reactivity-keys\";\nimport { Button } from \"@executor-js/react/components/button\";\nimport { CopyButton } from \"@executor-js/react/components/copy-button\";\nimport {\n  CardStack,\n  CardStackContent,\n  CardStackEntry,\n  CardStackEntryContent,\n  CardStackEntryDescription,\n  CardStackEntryField,\n  CardStackEntryTitle,\n} from \"@executor-js/react/components/card-stack\";\nimport { FilterTabs } from \"@executor-js/react/components/filter-tabs\";\nimport { Input } from \"@executor-js/react/components/input\";\nimport { sourceWriteKeys as openApiWriteKeys } from \"@executor-js/react/api/reactivity-keys\";\nimport { ConnectionId, ScopeId, SecretId } from \"@executor-js/sdk/core\";\nimport { useSecretPickerSecrets } from \"@executor-js/react/plugins/use-secret-picker-secrets\";\nimport {\n  oauthCallbackUrl,\n  useOAuthPopupFlow,\n  type OAuthCompletionPayload,\n} from \"@executor-js/react/plugins/oauth-sign-in\";\nimport {\n  effectiveCredentialBindingForScope,\n  exactCredentialBindingForScope,\n  isConnectionCredentialBindingValue,\n  isSecretCredentialBindingValue,\n} from \"@executor-js/react/plugins/credential-bindings\";\nimport { SecretCredentialSlotBindings } from \"@executor-js/react/plugins/credential-slot-bindings\";\n\nimport {\n  openApiSourceAtom,\n  openApiSourceBindingsAtom,\n  removeOpenApiSourceBinding,\n  setOpenApiSourceBinding,\n  updateOpenApiSource,\n} from \"./atoms\";\nimport { OpenApiSourceDetailsFields } from \"./OpenApiSourceDetailsFields\";\nimport {\n  OPENAPI_OAUTH_CALLBACK_PATH,\n  OPENAPI_OAUTH_POPUP_NAME,\n  inferOAuthIssuerUrl,\n  resolveOAuthUrl,\n} from \"./AddOpenApiSource\";\nimport { oauth2ClientSecretSlot } from \"../sdk/store\";\nimport {\n  OAuth2SourceConfig,\n  OpenApiSourceBindingInput,\n  type OpenApiSourceBindingRef,\n} from \"../sdk/types\";\n\nconst ErrorMessage = Schema.Struct({ message: Schema.String });\nconst decodeErrorMessage = Schema.decodeUnknownOption(ErrorMessage);\n\nconst errorMessageFromExit = (exit: Exit.Exit<unknown, unknown>, fallback: string): string =>\n  Option.match(Option.flatMap(Exit.findErrorOption(exit), decodeErrorMessage), {\n    onNone: () => fallback,\n    onSome: ({ message }) => message,\n  });\n\ntype SlotDef =\n  | {\n      readonly kind: \"secret\";\n      readonly slot: string;\n      readonly label: string;\n      readonly hint?: string;\n    }\n  | {\n      readonly kind: \"oauth2\";\n      readonly slot: string;\n      readonly label: string;\n    };\n\nconst slugify = (value: string): string =>\n  value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\") || \"default\";\n\nconst shortHash = (value: string): string => {\n  let hash = 0x811c9dc5;\n  for (let i = 0; i < value.length; i++) {\n    hash ^= value.charCodeAt(i);\n    hash = Math.imul(hash, 0x01000193);\n  }\n  return (hash >>> 0).toString(36).slice(0, 6);\n};\n\nconst openApiOAuthConnectionId = (\n  sourceId: string,\n  securitySchemeName: string,\n  targetScope: ScopeId,\n): ConnectionId =>\n  ConnectionId.make(\n    `openapi-oauth-${slugify(sourceId)}-${slugify(securitySchemeName)}-${shortHash(targetScope)}`,\n  );\n\nconst effectiveClientSecretSlot = (oauth2: {\n  readonly securitySchemeName: string;\n  readonly clientSecretSlot: string | null;\n}): string => oauth2.clientSecretSlot ?? oauth2ClientSecretSlot(oauth2.securitySchemeName);\n\nexport default function EditOpenApiSource(props: {\n  readonly sourceId: string;\n  readonly onSave: () => void;\n}) {\n  const displayScope = useScope();\n  const scopeStack = useScopeStack();\n  const userScope = useUserScope();\n  const sourceSummaryResult = useAtomValue(sourceAtom(props.sourceId, displayScope));\n  const sourceSummary =\n    AsyncResult.isSuccess(sourceSummaryResult) && sourceSummaryResult.value\n      ? sourceSummaryResult.value\n      : null;\n  const sourceScopeId = sourceSummary?.scopeId ?? displayScope;\n  const sourceScope = ScopeId.make(sourceScopeId);\n  const scopeRanks = useMemo(\n    () => new Map(scopeStack.map((scope, index) => [scope.id, index] as const)),\n    [scopeStack],\n  );\n\n  const sourceResult = useAtomValue(openApiSourceAtom(sourceScope, props.sourceId));\n  const bindingsResult = useAtomValue(\n    openApiSourceBindingsAtom(displayScope, props.sourceId, sourceScope),\n  );\n  const connectionsResult = useAtomValue(connectionsAtom(displayScope));\n  const secretList = useSecretPickerSecrets();\n\n  const doUpdate = useAtomSet(updateOpenApiSource, { mode: \"promiseExit\" });\n  const doSetBinding = useAtomSet(setOpenApiSourceBinding, {\n    mode: \"promiseExit\",\n  });\n  const doRemoveBinding = useAtomSet(removeOpenApiSourceBinding, {\n    mode: \"promiseExit\",\n  });\n  const doStartOAuth = useAtomSet(startOAuth, { mode: \"promiseExit\" });\n  const oauth = useOAuthPopupFlow<OAuthCompletionPayload>({\n    popupName: OPENAPI_OAUTH_POPUP_NAME,\n    popupBlockedMessage: \"OAuth popup was blocked by the browser\",\n    startErrorMessage: \"Failed to connect OAuth\",\n  });\n\n  const source =\n    AsyncResult.isSuccess(sourceResult) && sourceResult.value ? sourceResult.value : null;\n  const bindingRows: readonly OpenApiSourceBindingRef[] = AsyncResult.isSuccess(bindingsResult)\n    ? bindingsResult.value\n    : [];\n  const connections = AsyncResult.isSuccess(connectionsResult) ? connectionsResult.value : [];\n  const oauth2RedirectUrl = oauthCallbackUrl(OPENAPI_OAUTH_CALLBACK_PATH);\n\n  const [name, setName] = useState(source?.name ?? \"\");\n  const [baseUrl, setBaseUrl] = useState(source?.config.baseUrl ?? \"\");\n  const [sourceSaveState, setSourceSaveState] = useState<\"idle\" | \"saving\" | \"saved\">(\"idle\");\n  const [error, setError] = useState<string | null>(null);\n  const [busyKey, setBusyKey] = useState<string | null>(null);\n  const [pendingOAuthConnection, setPendingOAuthConnection] = useState<{\n    readonly scopeId: ScopeId;\n    readonly slot: string;\n    readonly connectionId: string;\n  } | null>(null);\n  const [loadedSourceKey, setLoadedSourceKey] = useState<string | null>(null);\n  const [selectedOAuthTokenScope, setSelectedOAuthTokenScope] = useState<string>(\n    userScope !== sourceScopeId ? userScope : sourceScopeId,\n  );\n  const [oauth2AuthorizationUrl, setOAuth2AuthorizationUrl] = useState(\n    source?.config.oauth2?.authorizationUrl ?? \"\",\n  );\n  const [oauth2TokenUrl, setOAuth2TokenUrl] = useState(source?.config.oauth2?.tokenUrl ?? \"\");\n  const [oauth2EndpointsSaveState, setOAuth2EndpointsSaveState] = useState<\n    \"idle\" | \"saving\" | \"saved\"\n  >(\"idle\");\n  const editIdentity = useMemo(\n    () => ({\n      name,\n      namespace: props.sourceId,\n      setName,\n      setNamespace: () => {},\n      reset: () => {},\n    }),\n    [name, props.sourceId],\n  );\n  const sourceSaveSeq = useRef(0);\n  const oauth2EndpointsSaveSeq = useRef(0);\n\n  useEffect(() => {\n    setSelectedOAuthTokenScope(userScope !== sourceScopeId ? userScope : sourceScopeId);\n  }, [sourceScopeId, userScope]);\n\n  useEffect(() => {\n    if (!source) return;\n    const sourceKey = `${sourceScopeId}:${source.namespace}`;\n    if (loadedSourceKey === sourceKey) return;\n    setName(source.name);\n    setBaseUrl(source.config.baseUrl ?? \"\");\n    setOAuth2AuthorizationUrl(source.config.oauth2?.authorizationUrl ?? \"\");\n    setOAuth2TokenUrl(source.config.oauth2?.tokenUrl ?? \"\");\n    setOAuth2EndpointsSaveState(\"idle\");\n    setSourceSaveState(\"idle\");\n    setLoadedSourceKey(sourceKey);\n  }, [loadedSourceKey, source, sourceScopeId]);\n\n  useEffect(() => {\n    if (!source) return;\n    const sourceKey = `${sourceScopeId}:${source.namespace}`;\n    if (loadedSourceKey !== sourceKey) return;\n\n    const nextName = name.trim();\n    const nextBaseUrl = baseUrl.trim();\n    const currentName = source.name;\n    const currentBaseUrl = source.config.baseUrl ?? \"\";\n    if ((nextName || currentName) === currentName && nextBaseUrl === currentBaseUrl) {\n      return;\n    }\n\n    const timeout = window.setTimeout(() => {\n      const seq = ++sourceSaveSeq.current;\n      setSourceSaveState(\"saving\");\n      setError(null);\n      void (async () => {\n        const exit = await doUpdate({\n          params: { scopeId: displayScope, namespace: props.sourceId },\n          payload: {\n            sourceScope,\n            name: nextName || undefined,\n            baseUrl: nextBaseUrl || undefined,\n          },\n          reactivityKeys: openApiWriteKeys,\n        });\n        if (sourceSaveSeq.current !== seq) return;\n        if (Exit.isFailure(exit)) {\n          setSourceSaveState(\"idle\");\n          setError(errorMessageFromExit(exit, \"Failed to save source details\"));\n          return;\n        }\n        setSourceSaveState(\"saved\");\n        window.setTimeout(() => {\n          if (sourceSaveSeq.current === seq) setSourceSaveState(\"idle\");\n        }, 1600);\n      })();\n    }, 600);\n\n    return () => window.clearTimeout(timeout);\n  }, [\n    baseUrl,\n    displayScope,\n    doUpdate,\n    loadedSourceKey,\n    name,\n    props.sourceId,\n    source,\n    sourceScope,\n    sourceScopeId,\n  ]);\n\n  const secretSlots = useMemo(() => {\n    if (!source) return [] as SlotDef[];\n    const slots: SlotDef[] = [];\n    for (const [headerName, value] of Object.entries(source.config.headers ?? {})) {\n      if (typeof value === \"string\") continue;\n      slots.push({\n        kind: \"secret\",\n        slot: value.slot,\n        label: headerName,\n        hint: value.prefix ? `Prefix: ${value.prefix}` : undefined,\n      });\n    }\n    if (source.config.oauth2) {\n      const clientSecretSlot = effectiveClientSecretSlot(source.config.oauth2);\n      slots.push({\n        kind: \"secret\",\n        slot: source.config.oauth2.clientIdSlot,\n        label: \"Client ID\",\n      });\n      slots.push({\n        kind: \"secret\",\n        slot: clientSecretSlot,\n        label: \"Client Secret\",\n        hint:\n          source.config.oauth2.flow === \"authorizationCode\"\n            ? \"Optional for public PKCE clients\"\n            : undefined,\n      });\n      slots.push({\n        kind: \"oauth2\",\n        slot: source.config.oauth2.connectionSlot,\n        label:\n          source.config.oauth2.flow === \"clientCredentials\"\n            ? \"OAuth Client Credentials\"\n            : \"OAuth Authorization Code\",\n      });\n    }\n    return slots;\n  }, [source]);\n\n  const credentialScopes = useMemo(() => {\n    const entries = [{ scopeId: ScopeId.make(sourceScopeId), label: \"Organization\" }];\n    if (userScope !== sourceScopeId) {\n      entries.unshift({ scopeId: ScopeId.make(userScope), label: \"Personal\" });\n    } else {\n      entries[0] = {\n        scopeId: ScopeId.make(sourceScopeId),\n        label: \"Credentials\",\n      };\n    }\n    return entries;\n  }, [sourceScopeId, userScope]);\n  const credentialScopeOptions = useMemo(\n    () =>\n      credentialScopes.map((entry) => ({\n        scopeId: entry.scopeId,\n        label: entry.label,\n        description:\n          entry.label === \"Personal\"\n            ? \"Saved only for your account.\"\n            : \"Shared with everyone who can use this source.\",\n      })),\n    [credentialScopes],\n  );\n  const organizationCredentialScope =\n    credentialScopes.find((entry) => entry.label === \"Organization\") ?? credentialScopes[0]!;\n  const personalCredentialScope =\n    credentialScopes.find((entry) => entry.label === \"Personal\") ?? null;\n  const secretBindingScopes =\n    personalCredentialScope &&\n    personalCredentialScope.scopeId !== organizationCredentialScope.scopeId\n      ? [organizationCredentialScope, personalCredentialScope]\n      : [organizationCredentialScope];\n  const activeOAuthTokenScope =\n    credentialScopes.find((entry) => entry.scopeId === selectedOAuthTokenScope) ??\n    credentialScopes[0]!;\n  const activeOAuthTokenScopeId = activeOAuthTokenScope.scopeId;\n  const activeOAuthTokenScopeLabel = activeOAuthTokenScope.label;\n\n  if (!source) {\n    return (\n      <div className=\"space-y-3\">\n        <h1 className=\"text-xl font-semibold text-foreground\">Edit OpenAPI Source</h1>\n        <p className=\"text-sm text-muted-foreground\">Loading configuration…</p>\n      </div>\n    );\n  }\n\n  const setSecretBinding = async (\n    targetScope: ScopeId,\n    slot: string,\n    secretId: string,\n    secretScope: ScopeId,\n  ) => {\n    const inputKey = `${targetScope}:${slot}`;\n    const trimmed = secretId.trim();\n    if (!trimmed) return;\n    setBusyKey(inputKey);\n    setError(null);\n    const exit = await doSetBinding({\n      params: { scopeId: displayScope },\n      payload: OpenApiSourceBindingInput.make({\n        sourceId: props.sourceId,\n        sourceScope,\n        scope: targetScope,\n        slot,\n        value: {\n          kind: \"secret\",\n          secretId: SecretId.make(trimmed),\n          secretScopeId: secretScope,\n        },\n      }),\n      reactivityKeys: sourceWriteKeys,\n    });\n    if (Exit.isFailure(exit)) {\n      setError(errorMessageFromExit(exit, \"Failed to save credential binding\"));\n    }\n    setBusyKey(null);\n  };\n\n  const clearBinding = async (targetScope: ScopeId, slot: string) => {\n    setBusyKey(`${targetScope}:${slot}:clear`);\n    setError(null);\n    const exit = await doRemoveBinding({\n      params: { scopeId: displayScope },\n      payload: {\n        sourceId: props.sourceId,\n        sourceScope,\n        slot,\n        scope: targetScope,\n      },\n      reactivityKeys: sourceWriteKeys,\n    });\n    if (Exit.isFailure(exit)) {\n      setError(errorMessageFromExit(exit, \"Failed to clear credential binding\"));\n    }\n    setBusyKey(null);\n  };\n\n  const connectOAuth = async (targetScope: ScopeId) => {\n    const oauth2 = source.config.oauth2;\n    if (!oauth2) return;\n    const clientIdBinding = effectiveCredentialBindingForScope(\n      bindingRows,\n      oauth2.clientIdSlot,\n      targetScope,\n      scopeRanks,\n    );\n    const clientSecretSlot = effectiveClientSecretSlot(oauth2);\n    const clientSecretBinding = effectiveCredentialBindingForScope(\n      bindingRows,\n      clientSecretSlot,\n      targetScope,\n      scopeRanks,\n    );\n    if (!clientIdBinding || !isSecretCredentialBindingValue(clientIdBinding.value)) {\n      setError(\"Client ID must be bound before connecting\");\n      return;\n    }\n    const clientIdSecretId = clientIdBinding.value.secretId;\n    if (\n      oauth2.flow === \"clientCredentials\" &&\n      (!clientSecretBinding || !isSecretCredentialBindingValue(clientSecretBinding.value))\n    ) {\n      setError(\"Client secret must be bound before connecting\");\n      return;\n    }\n    const clientSecretValue =\n      oauth2.flow === \"clientCredentials\" &&\n      clientSecretBinding &&\n      isSecretCredentialBindingValue(clientSecretBinding.value)\n        ? clientSecretBinding.value\n        : null;\n\n    const existingConnection = exactCredentialBindingForScope(\n      bindingRows,\n      oauth2.connectionSlot,\n      targetScope,\n    );\n    const connectionId =\n      existingConnection && isConnectionCredentialBindingValue(existingConnection.value)\n        ? existingConnection.value.connectionId\n        : openApiOAuthConnectionId(props.sourceId, oauth2.securitySchemeName, targetScope);\n\n    setBusyKey(`${targetScope}:${oauth2.connectionSlot}:connect`);\n    setPendingOAuthConnection({\n      scopeId: targetScope,\n      slot: oauth2.connectionSlot,\n      connectionId: connectionId,\n    });\n    setError(null);\n    const failConnect = (message: string) => {\n      setError(message);\n      setPendingOAuthConnection(null);\n      setBusyKey(null);\n    };\n    const displayName = source.name;\n    const tokenUrl = resolveOAuthUrl(oauth2.tokenUrl, source.config.baseUrl ?? \"\");\n    if (oauth2.flow === \"clientCredentials\") {\n      const startOAuthExit = await doStartOAuth({\n        params: { scopeId: targetScope },\n        payload: {\n          endpoint: tokenUrl,\n          redirectUrl: tokenUrl,\n          connectionId: connectionId,\n          tokenScope: targetScope,\n          strategy: {\n            kind: \"client-credentials\",\n            tokenEndpoint: tokenUrl,\n            clientIdSecretId,\n            clientSecretSecretId: clientSecretValue!.secretId,\n            scopes: [...oauth2.scopes],\n          },\n          pluginId: \"openapi\",\n          identityLabel: `${displayName} OAuth`,\n        },\n      });\n      if (Exit.isFailure(startOAuthExit)) {\n        failConnect(errorMessageFromExit(startOAuthExit, \"Failed to connect OAuth\"));\n        return;\n      }\n      const response = startOAuthExit.value;\n      if (!response.completedConnection) {\n        failConnect(\"Unexpected OAuth response\");\n        return;\n      }\n      const setBindingExit = await doSetBinding({\n        params: { scopeId: displayScope },\n        payload: OpenApiSourceBindingInput.make({\n          sourceId: props.sourceId,\n          sourceScope,\n          scope: targetScope,\n          slot: oauth2.connectionSlot,\n          value: {\n            kind: \"connection\",\n            connectionId: ConnectionId.make(response.completedConnection.connectionId),\n          },\n        }),\n        reactivityKeys: [...sourceWriteKeys, ...connectionWriteKeys],\n      });\n      if (Exit.isFailure(setBindingExit)) {\n        failConnect(errorMessageFromExit(setBindingExit, \"Failed to connect OAuth\"));\n        return;\n      }\n      setPendingOAuthConnection(null);\n      setBusyKey(null);\n      return;\n    }\n\n    const authorizationUrl = resolveOAuthUrl(\n      oauth2.authorizationUrl ?? \"\",\n      source.config.baseUrl ?? \"\",\n    );\n    const issuerUrl = oauth2.issuerUrl ?? inferOAuthIssuerUrl(authorizationUrl);\n    const startOAuthExit = await doStartOAuth({\n      params: { scopeId: targetScope },\n      payload: {\n        endpoint: authorizationUrl,\n        connectionId,\n        tokenScope: targetScope,\n        redirectUrl: oauth2RedirectUrl,\n        strategy: {\n          kind: \"authorization-code\",\n          authorizationEndpoint: authorizationUrl,\n          tokenEndpoint: tokenUrl,\n          issuerUrl,\n          clientIdSecretId,\n          clientSecretSecretId:\n            clientSecretBinding && isSecretCredentialBindingValue(clientSecretBinding.value)\n              ? clientSecretBinding.value.secretId\n              : null,\n          scopes: [...oauth2.scopes],\n        },\n        pluginId: \"openapi\",\n        identityLabel: `${displayName} OAuth`,\n      },\n    });\n    if (Exit.isFailure(startOAuthExit)) {\n      failConnect(errorMessageFromExit(startOAuthExit, \"Failed to connect OAuth\"));\n      return;\n    }\n    const response = startOAuthExit.value;\n    if (response.authorizationUrl === null) {\n      failConnect(\"Unexpected OAuth response\");\n      return;\n    }\n\n    await oauth.openAuthorization({\n      tokenScope: targetScope,\n      run: async () => ({\n        sessionId: response.sessionId,\n        authorizationUrl: response.authorizationUrl,\n      }),\n      onSuccess: async (result) => {\n        const setBindingExit = await doSetBinding({\n          params: { scopeId: displayScope },\n          payload: OpenApiSourceBindingInput.make({\n            sourceId: props.sourceId,\n            sourceScope,\n            scope: targetScope,\n            slot: oauth2.connectionSlot,\n            value: {\n              kind: \"connection\",\n              connectionId: ConnectionId.make(result.connectionId),\n            },\n          }),\n          reactivityKeys: [...sourceWriteKeys, ...connectionWriteKeys],\n        });\n        if (Exit.isFailure(setBindingExit)) {\n          failConnect(errorMessageFromExit(setBindingExit, \"Failed to connect OAuth\"));\n          return;\n        }\n        setPendingOAuthConnection(null);\n        setBusyKey(null);\n      },\n      onError: (message) => {\n        setError(message);\n        setPendingOAuthConnection(null);\n        setBusyKey(null);\n      },\n    });\n  };\n\n  return (\n    <div className=\"space-y-6\">\n      <div>\n        <h1 className=\"text-xl font-semibold text-foreground\">OpenAPI Source</h1>\n      </div>\n\n      <OpenApiSourceDetailsFields\n        title=\"Source Details\"\n        description=\"Name and base URL save automatically.\"\n        identity={editIdentity}\n        baseUrl={baseUrl}\n        onBaseUrlChange={setBaseUrl}\n        specUrl={source.config.sourceUrl ?? \"\"}\n        onSpecUrlChange={() => {}}\n        specUrlDisabled\n        namespaceReadOnly\n        saveState={sourceSaveState}\n        footer={\n          source.config.oauth2\n            ? `Authentication Template: OAuth2 ${source.config.oauth2.flow}`\n            : Object.keys(source.config.headers ?? {}).length > 0\n              ? `Authentication Template: ${Object.keys(source.config.headers ?? {}).length} header binding${\n                  Object.keys(source.config.headers ?? {}).length === 1 ? \"\" : \"s\"\n                }`\n              : \"Authentication Template: None\"\n        }\n      />\n\n      <CardStack>\n        <CardStackContent className=\"border-t-0\">\n          <CardStackEntry>\n            <CardStackEntryContent>\n              <CardStackEntryTitle>Secrets</CardStackEntryTitle>\n            </CardStackEntryContent>\n          </CardStackEntry>\n\n          <SecretCredentialSlotBindings\n            slots={secretSlots.filter((slot) => slot.kind === \"secret\")}\n            bindingScopes={secretBindingScopes}\n            bindingRows={bindingRows}\n            scopeRanks={scopeRanks}\n            secrets={secretList}\n            sourceId={props.sourceId}\n            sourceName={source.name}\n            credentialScopeOptions={credentialScopeOptions}\n            busyKey={busyKey}\n            onSetSecretBinding={setSecretBinding}\n            onClearBinding={clearBinding}\n          />\n\n          {source.config.oauth2 &&\n            (() => {\n              const oauth2 = source.config.oauth2;\n              const trimmedAuthUrl = oauth2AuthorizationUrl.trim();\n              const trimmedTokenUrl = oauth2TokenUrl.trim();\n              const savedAuthUrl = oauth2.authorizationUrl ?? \"\";\n              const isAuthCode = oauth2.flow === \"authorizationCode\";\n              const endpointsDirty =\n                (isAuthCode && trimmedAuthUrl !== savedAuthUrl) ||\n                trimmedTokenUrl !== oauth2.tokenUrl;\n              const saving = oauth2EndpointsSaveState === \"saving\";\n              const tokenUrlMissing = trimmedTokenUrl.length === 0;\n              const authUrlMissing = isAuthCode && trimmedAuthUrl.length === 0;\n              const canSave = endpointsDirty && !saving && !tokenUrlMissing && !authUrlMissing;\n\n              const saveOAuth2Endpoints = async () => {\n                const seq = ++oauth2EndpointsSaveSeq.current;\n                setOAuth2EndpointsSaveState(\"saving\");\n                setError(null);\n                const exit = await doUpdate({\n                  params: { scopeId: displayScope, namespace: props.sourceId },\n                  payload: {\n                    sourceScope,\n                    oauth2: OAuth2SourceConfig.make({\n                      kind: \"oauth2\",\n                      securitySchemeName: oauth2.securitySchemeName,\n                      flow: oauth2.flow,\n                      tokenUrl: trimmedTokenUrl,\n                      authorizationUrl: isAuthCode ? trimmedAuthUrl || null : null,\n                      issuerUrl: oauth2.issuerUrl ?? null,\n                      clientIdSlot: oauth2.clientIdSlot,\n                      clientSecretSlot: oauth2.clientSecretSlot,\n                      connectionSlot: oauth2.connectionSlot,\n                      scopes: [...oauth2.scopes],\n                    }),\n                  },\n                  reactivityKeys: openApiWriteKeys,\n                });\n                if (oauth2EndpointsSaveSeq.current !== seq) return;\n                if (Exit.isFailure(exit)) {\n                  setOAuth2EndpointsSaveState(\"idle\");\n                  setError(errorMessageFromExit(exit, \"Failed to save OAuth endpoints\"));\n                  return;\n                }\n                setOAuth2EndpointsSaveState(\"saved\");\n                window.setTimeout(() => {\n                  if (oauth2EndpointsSaveSeq.current === seq) {\n                    setOAuth2EndpointsSaveState(\"idle\");\n                  }\n                }, 1600);\n              };\n\n              const exact = exactCredentialBindingForScope(\n                bindingRows,\n                oauth2.connectionSlot,\n                activeOAuthTokenScopeId,\n              );\n              const binding =\n                exact ??\n                effectiveCredentialBindingForScope(\n                  bindingRows,\n                  oauth2.connectionSlot,\n                  activeOAuthTokenScopeId,\n                  scopeRanks,\n                );\n              const connectionBinding =\n                binding && isConnectionCredentialBindingValue(binding.value) ? binding.value : null;\n              const connection = connectionBinding\n                ? connections.find((entry) => entry.id === connectionBinding.connectionId)\n                : null;\n              const bindingScopeId = connectionBinding && binding ? binding.scopeId : null;\n              const isConnecting =\n                busyKey === `${activeOAuthTokenScopeId}:${oauth2.connectionSlot}:connect`;\n              const isPendingOAuthConnection =\n                pendingOAuthConnection?.scopeId === activeOAuthTokenScopeId &&\n                pendingOAuthConnection !== null &&\n                pendingOAuthConnection.slot === oauth2.connectionSlot;\n              const isConnected = connection !== null && connection !== undefined;\n              const statusText =\n                isConnecting || isPendingOAuthConnection\n                  ? \"Saving OAuth connection...\"\n                  : connectionBinding && bindingScopeId\n                    ? connection\n                      ? bindingScopeId === activeOAuthTokenScopeId\n                        ? `Connected in ${activeOAuthTokenScopeLabel.toLowerCase()} as ${\n                            connection.identityLabel ?? connection.id\n                          }`\n                        : `Using organization connection ${\n                            connection.identityLabel ?? connection.id\n                          }`\n                      : bindingScopeId === activeOAuthTokenScopeId\n                        ? `Saved connection is missing in ${activeOAuthTokenScopeLabel.toLowerCase()}`\n                        : \"Organization connection is missing\"\n                    : `No ${activeOAuthTokenScopeLabel.toLowerCase()} connection`;\n              const connectDisabled = isConnecting || endpointsDirty || saving;\n\n              return (\n                <>\n                  <CardStackEntry>\n                    <CardStackEntryContent>\n                      <CardStackEntryTitle>OAuth Endpoints</CardStackEntryTitle>\n                      <CardStackEntryDescription>\n                        Override the URLs from the OpenAPI spec when a provider publishes the wrong\n                        values.\n                      </CardStackEntryDescription>\n                    </CardStackEntryContent>\n                    <div className=\"flex items-center gap-2\">\n                      {oauth2EndpointsSaveState !== \"idle\" && (\n                        <span className=\"text-xs text-muted-foreground\">\n                          {saving ? \"Saving…\" : \"Saved\"}\n                        </span>\n                      )}\n                      <Button\n                        size=\"sm\"\n                        onClick={() => void saveOAuth2Endpoints()}\n                        disabled={!canSave}\n                      >\n                        Save\n                      </Button>\n                    </div>\n                  </CardStackEntry>\n                  {isAuthCode && (\n                    <CardStackEntryField label=\"Authorization URL\">\n                      <Input\n                        value={oauth2AuthorizationUrl}\n                        onChange={(e) =>\n                          setOAuth2AuthorizationUrl((e.target as HTMLInputElement).value)\n                        }\n                        className=\"font-mono text-sm\"\n                      />\n                    </CardStackEntryField>\n                  )}\n                  <CardStackEntryField label=\"Token URL\">\n                    <Input\n                      value={oauth2TokenUrl}\n                      onChange={(e) => setOAuth2TokenUrl((e.target as HTMLInputElement).value)}\n                      className=\"font-mono text-sm\"\n                    />\n                  </CardStackEntryField>\n                  <CardStackEntryField label=\"Redirect URL\">\n                    <div className=\"space-y-1.5\">\n                      <div className=\"flex items-center gap-1 rounded-md border border-border bg-background/50 px-2.5 py-1.5 font-mono text-[11px]\">\n                        <span className=\"truncate flex-1 text-foreground\">{oauth2RedirectUrl}</span>\n                        <CopyButton value={oauth2RedirectUrl} />\n                      </div>\n                      <p className=\"text-xs text-muted-foreground\">\n                        Add this to your OAuth app&apos;s allowed redirects.\n                      </p>\n                    </div>\n                  </CardStackEntryField>\n                  {credentialScopes.length > 1 && (\n                    <CardStackEntry>\n                      <CardStackEntryContent>\n                        <CardStackEntryTitle>OAuth token</CardStackEntryTitle>\n                        <CardStackEntryDescription>\n                          Choose where the signed-in OAuth token is saved.\n                        </CardStackEntryDescription>\n                      </CardStackEntryContent>\n                      <FilterTabs\n                        tabs={credentialScopes.map((entry) => ({\n                          value: entry.scopeId,\n                          label: entry.label,\n                        }))}\n                        value={activeOAuthTokenScopeId}\n                        onChange={setSelectedOAuthTokenScope}\n                      />\n                    </CardStackEntry>\n                  )}\n                  <CardStackEntryField label=\"OAuth Connection\">\n                    <div className=\"space-y-2\">\n                      <div className=\"text-sm text-muted-foreground\">{statusText}</div>\n                      <Button\n                        size=\"sm\"\n                        onClick={() => void connectOAuth(activeOAuthTokenScopeId)}\n                        disabled={connectDisabled}\n                      >\n                        {isConnecting ? \"Connecting…\" : isConnected ? \"Reconnect\" : \"Connect\"}\n                      </Button>\n                      {endpointsDirty && (\n                        <p className=\"text-xs text-muted-foreground\">\n                          Save endpoint changes before reconnecting.\n                        </p>\n                      )}\n                    </div>\n                  </CardStackEntryField>\n                </>\n              );\n            })()}\n        </CardStackContent>\n      </CardStack>\n\n      {error && (\n        <div className=\"rounded-lg border border-destructive/30 bg-destructive/5 px-3 py-2\">\n          <p className=\"text-sm text-destructive\">{error}</p>\n        </div>\n      )}\n\n      <div className=\"flex items-center justify-start border-t border-border pt-4\">\n        <Button variant=\"ghost\" onClick={props.onSave}>\n          Back\n        </Button>\n      </div>\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,WAAW,SAAS,QAAQ,gBAAgB;AACrD,SAAS,YAAY,oBAAoB;AACzC,YAAY,UAAU;AACtB,YAAY,YAAY;AACxB,YAAY,YAAY;AACxB,YAAY,iBAAiB;AAE7B,SAAS,iBAAiB,YAAY,kBAAkB;AACxD,SAAS,UAAU,eAAe,oBAAoB;AACtD,SAAS,qBAAqB,uBAAuB;AACrD,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AACtB,SAAS,mBAAmB,wBAAwB;AACpD,SAAS,cAAc,SAAS,gBAAgB;AAChD,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAoC;AAoTvC,SAqYU,UApYR,KADF;AA7RN,IAAM,eAAsB,cAAO,EAAE,SAAgB,cAAO,CAAC;AAC7D,IAAM,qBAA4B,2BAAoB,YAAY;AAElE,IAAM,uBAAuB,CAAC,MAAmC,aACxD,aAAa,eAAa,qBAAgB,IAAI,GAAG,kBAAkB,GAAG;AAAA,EAC3E,QAAQ,MAAM;AAAA,EACd,QAAQ,CAAC,EAAE,QAAQ,MAAM;AAC3B,CAAC;AAeH,IAAM,UAAU,CAAC,UACf,MACG,KAAK,EACL,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE,KAAK;AAEhC,IAAM,YAAY,CAAC,UAA0B;AAC3C,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,YAAQ,MAAM,WAAW,CAAC;AAC1B,WAAO,KAAK,KAAK,MAAM,QAAU;AAAA,EACnC;AACA,UAAQ,SAAS,GAAG,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC;AAC7C;AAEA,IAAM,2BAA2B,CAC/B,UACA,oBACA,gBAEA,aAAa;AAAA,EACX,iBAAiB,QAAQ,QAAQ,CAAC,IAAI,QAAQ,kBAAkB,CAAC,IAAI,UAAU,WAAW,CAAC;AAC7F;AAEF,IAAM,4BAA4B,CAAC,WAGrB,OAAO,oBAAoB,uBAAuB,OAAO,kBAAkB;AAE1E,SAAR,kBAAmC,OAGvC;AACD,QAAM,eAAe,SAAS;AAC9B,QAAM,aAAa,cAAc;AACjC,QAAM,YAAY,aAAa;AAC/B,QAAM,sBAAsB,aAAa,WAAW,MAAM,UAAU,YAAY,CAAC;AACjF,QAAM,gBACQ,sBAAU,mBAAmB,KAAK,oBAAoB,QAC9D,oBAAoB,QACpB;AACN,QAAM,gBAAgB,eAAe,WAAW;AAChD,QAAM,cAAc,QAAQ,KAAK,aAAa;AAC9C,QAAM,aAAa;AAAA,IACjB,MAAM,IAAI,IAAI,WAAW,IAAI,CAAC,OAAO,UAAU,CAAC,MAAM,IAAI,KAAK,CAAU,CAAC;AAAA,IAC1E,CAAC,UAAU;AAAA,EACb;AAEA,QAAM,eAAe,aAAa,kBAAkB,aAAa,MAAM,QAAQ,CAAC;AAChF,QAAM,iBAAiB;AAAA,IACrB,0BAA0B,cAAc,MAAM,UAAU,WAAW;AAAA,EACrE;AACA,QAAM,oBAAoB,aAAa,gBAAgB,YAAY,CAAC;AACpE,QAAM,aAAa,uBAAuB;AAE1C,QAAM,WAAW,WAAW,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACxE,QAAM,eAAe,WAAW,yBAAyB;AAAA,IACvD,MAAM;AAAA,EACR,CAAC;AACD,QAAM,kBAAkB,WAAW,4BAA4B;AAAA,IAC7D,MAAM;AAAA,EACR,CAAC;AACD,QAAM,eAAe,WAAW,YAAY,EAAE,MAAM,cAAc,CAAC;AACnE,QAAM,QAAQ,kBAA0C;AAAA,IACtD,WAAW;AAAA,IACX,qBAAqB;AAAA,IACrB,mBAAmB;AAAA,EACrB,CAAC;AAED,QAAM,SACQ,sBAAU,YAAY,KAAK,aAAa,QAAQ,aAAa,QAAQ;AACnF,QAAM,cAA8D,sBAAU,cAAc,IACxF,eAAe,QACf,CAAC;AACL,QAAM,cAA0B,sBAAU,iBAAiB,IAAI,kBAAkB,QAAQ,CAAC;AAC1F,QAAM,oBAAoB,iBAAiB,2BAA2B;AAEtE,QAAM,CAAC,MAAM,OAAO,IAAI,SAAS,QAAQ,QAAQ,EAAE;AACnD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,QAAQ,OAAO,WAAW,EAAE;AACnE,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,SAAsC,MAAM;AAC1F,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAwB,IAAI;AAC1D,QAAM,CAAC,wBAAwB,yBAAyB,IAAI,SAIlD,IAAI;AACd,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,SAAwB,IAAI;AAC1E,QAAM,CAAC,yBAAyB,0BAA0B,IAAI;AAAA,IAC5D,cAAc,gBAAgB,YAAY;AAAA,EAC5C;AACA,QAAM,CAAC,wBAAwB,yBAAyB,IAAI;AAAA,IAC1D,QAAQ,OAAO,QAAQ,oBAAoB;AAAA,EAC7C;AACA,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,SAAS,QAAQ,OAAO,QAAQ,YAAY,EAAE;AAC1F,QAAM,CAAC,0BAA0B,2BAA2B,IAAI,SAE9D,MAAM;AACR,QAAM,eAAe;AAAA,IACnB,OAAO;AAAA,MACL;AAAA,MACA,WAAW,MAAM;AAAA,MACjB;AAAA,MACA,cAAc,MAAM;AAAA,MAAC;AAAA,MACrB,OAAO,MAAM;AAAA,MAAC;AAAA,IAChB;AAAA,IACA,CAAC,MAAM,MAAM,QAAQ;AAAA,EACvB;AACA,QAAM,gBAAgB,OAAO,CAAC;AAC9B,QAAM,yBAAyB,OAAO,CAAC;AAEvC,YAAU,MAAM;AACd,+BAA2B,cAAc,gBAAgB,YAAY,aAAa;AAAA,EACpF,GAAG,CAAC,eAAe,SAAS,CAAC;AAE7B,YAAU,MAAM;AACd,QAAI,CAAC,OAAQ;AACb,UAAM,YAAY,GAAG,aAAa,IAAI,OAAO,SAAS;AACtD,QAAI,oBAAoB,UAAW;AACnC,YAAQ,OAAO,IAAI;AACnB,eAAW,OAAO,OAAO,WAAW,EAAE;AACtC,8BAA0B,OAAO,OAAO,QAAQ,oBAAoB,EAAE;AACtE,sBAAkB,OAAO,OAAO,QAAQ,YAAY,EAAE;AACtD,gCAA4B,MAAM;AAClC,uBAAmB,MAAM;AACzB,uBAAmB,SAAS;AAAA,EAC9B,GAAG,CAAC,iBAAiB,QAAQ,aAAa,CAAC;AAE3C,YAAU,MAAM;AACd,QAAI,CAAC,OAAQ;AACb,UAAM,YAAY,GAAG,aAAa,IAAI,OAAO,SAAS;AACtD,QAAI,oBAAoB,UAAW;AAEnC,UAAM,WAAW,KAAK,KAAK;AAC3B,UAAM,cAAc,QAAQ,KAAK;AACjC,UAAM,cAAc,OAAO;AAC3B,UAAM,iBAAiB,OAAO,OAAO,WAAW;AAChD,SAAK,YAAY,iBAAiB,eAAe,gBAAgB,gBAAgB;AAC/E;AAAA,IACF;AAEA,UAAM,UAAU,OAAO,WAAW,MAAM;AACtC,YAAM,MAAM,EAAE,cAAc;AAC5B,yBAAmB,QAAQ;AAC3B,eAAS,IAAI;AACb,YAAM,YAAY;AAChB,cAAM,OAAO,MAAM,SAAS;AAAA,UAC1B,QAAQ,EAAE,SAAS,cAAc,WAAW,MAAM,SAAS;AAAA,UAC3D,SAAS;AAAA,YACP;AAAA,YACA,MAAM,YAAY;AAAA,YAClB,SAAS,eAAe;AAAA,UAC1B;AAAA,UACA,gBAAgB;AAAA,QAClB,CAAC;AACD,YAAI,cAAc,YAAY,IAAK;AACnC,YAAS,eAAU,IAAI,GAAG;AACxB,6BAAmB,MAAM;AACzB,mBAAS,qBAAqB,MAAM,+BAA+B,CAAC;AACpE;AAAA,QACF;AACA,2BAAmB,OAAO;AAC1B,eAAO,WAAW,MAAM;AACtB,cAAI,cAAc,YAAY,IAAK,oBAAmB,MAAM;AAAA,QAC9D,GAAG,IAAI;AAAA,MACT,GAAG;AAAA,IACL,GAAG,GAAG;AAEN,WAAO,MAAM,OAAO,aAAa,OAAO;AAAA,EAC1C,GAAG;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,cAAc,QAAQ,MAAM;AAChC,QAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,UAAM,QAAmB,CAAC;AAC1B,eAAW,CAAC,YAAY,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,WAAW,CAAC,CAAC,GAAG;AAC7E,UAAI,OAAO,UAAU,SAAU;AAC/B,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,MAAM,MAAM;AAAA,QACZ,OAAO;AAAA,QACP,MAAM,MAAM,SAAS,WAAW,MAAM,MAAM,KAAK;AAAA,MACnD,CAAC;AAAA,IACH;AACA,QAAI,OAAO,OAAO,QAAQ;AACxB,YAAM,mBAAmB,0BAA0B,OAAO,OAAO,MAAM;AACvE,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,MAAM,OAAO,OAAO,OAAO;AAAA,QAC3B,OAAO;AAAA,MACT,CAAC;AACD,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,QACN,OAAO;AAAA,QACP,MACE,OAAO,OAAO,OAAO,SAAS,sBAC1B,qCACA;AAAA,MACR,CAAC;AACD,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,MAAM,OAAO,OAAO,OAAO;AAAA,QAC3B,OACE,OAAO,OAAO,OAAO,SAAS,sBAC1B,6BACA;AAAA,MACR,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,mBAAmB,QAAQ,MAAM;AACrC,UAAM,UAAU,CAAC,EAAE,SAAS,QAAQ,KAAK,aAAa,GAAG,OAAO,eAAe,CAAC;AAChF,QAAI,cAAc,eAAe;AAC/B,cAAQ,QAAQ,EAAE,SAAS,QAAQ,KAAK,SAAS,GAAG,OAAO,WAAW,CAAC;AAAA,IACzE,OAAO;AACL,cAAQ,CAAC,IAAI;AAAA,QACX,SAAS,QAAQ,KAAK,aAAa;AAAA,QACnC,OAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT,GAAG,CAAC,eAAe,SAAS,CAAC;AAC7B,QAAM,yBAAyB;AAAA,IAC7B,MACE,iBAAiB,IAAI,CAAC,WAAW;AAAA,MAC/B,SAAS,MAAM;AAAA,MACf,OAAO,MAAM;AAAA,MACb,aACE,MAAM,UAAU,aACZ,iCACA;AAAA,IACR,EAAE;AAAA,IACJ,CAAC,gBAAgB;AAAA,EACnB;AACA,QAAM,8BACJ,iBAAiB,KAAK,CAAC,UAAU,MAAM,UAAU,cAAc,KAAK,iBAAiB,CAAC;AACxF,QAAM,0BACJ,iBAAiB,KAAK,CAAC,UAAU,MAAM,UAAU,UAAU,KAAK;AAClE,QAAM,sBACJ,2BACA,wBAAwB,YAAY,4BAA4B,UAC5D,CAAC,6BAA6B,uBAAuB,IACrD,CAAC,2BAA2B;AAClC,QAAM,wBACJ,iBAAiB,KAAK,CAAC,UAAU,MAAM,YAAY,uBAAuB,KAC1E,iBAAiB,CAAC;AACpB,QAAM,0BAA0B,sBAAsB;AACtD,QAAM,6BAA6B,sBAAsB;AAEzD,MAAI,CAAC,QAAQ;AACX,WACE,qBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,QAAG,WAAU,yCAAwC,iCAAmB;AAAA,MACzE,oBAAC,OAAE,WAAU,iCAAgC,yCAAsB;AAAA,OACrE;AAAA,EAEJ;AAEA,QAAM,mBAAmB,OACvB,aACA,MACA,UACA,gBACG;AACH,UAAM,WAAW,GAAG,WAAW,IAAI,IAAI;AACvC,UAAM,UAAU,SAAS,KAAK;AAC9B,QAAI,CAAC,QAAS;AACd,eAAW,QAAQ;AACnB,aAAS,IAAI;AACb,UAAM,OAAO,MAAM,aAAa;AAAA,MAC9B,QAAQ,EAAE,SAAS,aAAa;AAAA,MAChC,SAAS,0BAA0B,KAAK;AAAA,QACtC,UAAU,MAAM;AAAA,QAChB;AAAA,QACA,OAAO;AAAA,QACP;AAAA,QACA,OAAO;AAAA,UACL,MAAM;AAAA,UACN,UAAU,SAAS,KAAK,OAAO;AAAA,UAC/B,eAAe;AAAA,QACjB;AAAA,MACF,CAAC;AAAA,MACD,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAS,eAAU,IAAI,GAAG;AACxB,eAAS,qBAAqB,MAAM,mCAAmC,CAAC;AAAA,IAC1E;AACA,eAAW,IAAI;AAAA,EACjB;AAEA,QAAM,eAAe,OAAO,aAAsB,SAAiB;AACjE,eAAW,GAAG,WAAW,IAAI,IAAI,QAAQ;AACzC,aAAS,IAAI;AACb,UAAM,OAAO,MAAM,gBAAgB;AAAA,MACjC,QAAQ,EAAE,SAAS,aAAa;AAAA,MAChC,SAAS;AAAA,QACP,UAAU,MAAM;AAAA,QAChB;AAAA,QACA;AAAA,QACA,OAAO;AAAA,MACT;AAAA,MACA,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAS,eAAU,IAAI,GAAG;AACxB,eAAS,qBAAqB,MAAM,oCAAoC,CAAC;AAAA,IAC3E;AACA,eAAW,IAAI;AAAA,EACjB;AAEA,QAAM,eAAe,OAAO,gBAAyB;AACnD,UAAM,SAAS,OAAO,OAAO;AAC7B,QAAI,CAAC,OAAQ;AACb,UAAM,kBAAkB;AAAA,MACtB;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA;AAAA,IACF;AACA,UAAM,mBAAmB,0BAA0B,MAAM;AACzD,UAAM,sBAAsB;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,mBAAmB,CAAC,+BAA+B,gBAAgB,KAAK,GAAG;AAC9E,eAAS,2CAA2C;AACpD;AAAA,IACF;AACA,UAAM,mBAAmB,gBAAgB,MAAM;AAC/C,QACE,OAAO,SAAS,wBACf,CAAC,uBAAuB,CAAC,+BAA+B,oBAAoB,KAAK,IAClF;AACA,eAAS,+CAA+C;AACxD;AAAA,IACF;AACA,UAAM,oBACJ,OAAO,SAAS,uBAChB,uBACA,+BAA+B,oBAAoB,KAAK,IACpD,oBAAoB,QACpB;AAEN,UAAM,qBAAqB;AAAA,MACzB;AAAA,MACA,OAAO;AAAA,MACP;AAAA,IACF;AACA,UAAM,eACJ,sBAAsB,mCAAmC,mBAAmB,KAAK,IAC7E,mBAAmB,MAAM,eACzB,yBAAyB,MAAM,UAAU,OAAO,oBAAoB,WAAW;AAErF,eAAW,GAAG,WAAW,IAAI,OAAO,cAAc,UAAU;AAC5D,8BAA0B;AAAA,MACxB,SAAS;AAAA,MACT,MAAM,OAAO;AAAA,MACb;AAAA,IACF,CAAC;AACD,aAAS,IAAI;AACb,UAAM,cAAc,CAAC,YAAoB;AACvC,eAAS,OAAO;AAChB,gCAA0B,IAAI;AAC9B,iBAAW,IAAI;AAAA,IACjB;AACA,UAAM,cAAc,OAAO;AAC3B,UAAM,WAAW,gBAAgB,OAAO,UAAU,OAAO,OAAO,WAAW,EAAE;AAC7E,QAAI,OAAO,SAAS,qBAAqB;AACvC,YAAMA,kBAAiB,MAAM,aAAa;AAAA,QACxC,QAAQ,EAAE,SAAS,YAAY;AAAA,QAC/B,SAAS;AAAA,UACP,UAAU;AAAA,UACV,aAAa;AAAA,UACb;AAAA,UACA,YAAY;AAAA,UACZ,UAAU;AAAA,YACR,MAAM;AAAA,YACN,eAAe;AAAA,YACf;AAAA,YACA,sBAAsB,kBAAmB;AAAA,YACzC,QAAQ,CAAC,GAAG,OAAO,MAAM;AAAA,UAC3B;AAAA,UACA,UAAU;AAAA,UACV,eAAe,GAAG,WAAW;AAAA,QAC/B;AAAA,MACF,CAAC;AACD,UAAS,eAAUA,eAAc,GAAG;AAClC,oBAAY,qBAAqBA,iBAAgB,yBAAyB,CAAC;AAC3E;AAAA,MACF;AACA,YAAMC,YAAWD,gBAAe;AAChC,UAAI,CAACC,UAAS,qBAAqB;AACjC,oBAAY,2BAA2B;AACvC;AAAA,MACF;AACA,YAAM,iBAAiB,MAAM,aAAa;AAAA,QACxC,QAAQ,EAAE,SAAS,aAAa;AAAA,QAChC,SAAS,0BAA0B,KAAK;AAAA,UACtC,UAAU,MAAM;AAAA,UAChB;AAAA,UACA,OAAO;AAAA,UACP,MAAM,OAAO;AAAA,UACb,OAAO;AAAA,YACL,MAAM;AAAA,YACN,cAAc,aAAa,KAAKA,UAAS,oBAAoB,YAAY;AAAA,UAC3E;AAAA,QACF,CAAC;AAAA,QACD,gBAAgB,CAAC,GAAG,iBAAiB,GAAG,mBAAmB;AAAA,MAC7D,CAAC;AACD,UAAS,eAAU,cAAc,GAAG;AAClC,oBAAY,qBAAqB,gBAAgB,yBAAyB,CAAC;AAC3E;AAAA,MACF;AACA,gCAA0B,IAAI;AAC9B,iBAAW,IAAI;AACf;AAAA,IACF;AAEA,UAAM,mBAAmB;AAAA,MACvB,OAAO,oBAAoB;AAAA,MAC3B,OAAO,OAAO,WAAW;AAAA,IAC3B;AACA,UAAM,YAAY,OAAO,aAAa,oBAAoB,gBAAgB;AAC1E,UAAM,iBAAiB,MAAM,aAAa;AAAA,MACxC,QAAQ,EAAE,SAAS,YAAY;AAAA,MAC/B,SAAS;AAAA,QACP,UAAU;AAAA,QACV;AAAA,QACA,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,UAAU;AAAA,UACR,MAAM;AAAA,UACN,uBAAuB;AAAA,UACvB,eAAe;AAAA,UACf;AAAA,UACA;AAAA,UACA,sBACE,uBAAuB,+BAA+B,oBAAoB,KAAK,IAC3E,oBAAoB,MAAM,WAC1B;AAAA,UACN,QAAQ,CAAC,GAAG,OAAO,MAAM;AAAA,QAC3B;AAAA,QACA,UAAU;AAAA,QACV,eAAe,GAAG,WAAW;AAAA,MAC/B;AAAA,IACF,CAAC;AACD,QAAS,eAAU,cAAc,GAAG;AAClC,kBAAY,qBAAqB,gBAAgB,yBAAyB,CAAC;AAC3E;AAAA,IACF;AACA,UAAM,WAAW,eAAe;AAChC,QAAI,SAAS,qBAAqB,MAAM;AACtC,kBAAY,2BAA2B;AACvC;AAAA,IACF;AAEA,UAAM,MAAM,kBAAkB;AAAA,MAC5B,YAAY;AAAA,MACZ,KAAK,aAAa;AAAA,QAChB,WAAW,SAAS;AAAA,QACpB,kBAAkB,SAAS;AAAA,MAC7B;AAAA,MACA,WAAW,OAAO,WAAW;AAC3B,cAAM,iBAAiB,MAAM,aAAa;AAAA,UACxC,QAAQ,EAAE,SAAS,aAAa;AAAA,UAChC,SAAS,0BAA0B,KAAK;AAAA,YACtC,UAAU,MAAM;AAAA,YAChB;AAAA,YACA,OAAO;AAAA,YACP,MAAM,OAAO;AAAA,YACb,OAAO;AAAA,cACL,MAAM;AAAA,cACN,cAAc,aAAa,KAAK,OAAO,YAAY;AAAA,YACrD;AAAA,UACF,CAAC;AAAA,UACD,gBAAgB,CAAC,GAAG,iBAAiB,GAAG,mBAAmB;AAAA,QAC7D,CAAC;AACD,YAAS,eAAU,cAAc,GAAG;AAClC,sBAAY,qBAAqB,gBAAgB,yBAAyB,CAAC;AAC3E;AAAA,QACF;AACA,kCAA0B,IAAI;AAC9B,mBAAW,IAAI;AAAA,MACjB;AAAA,MACA,SAAS,CAAC,YAAY;AACpB,iBAAS,OAAO;AAChB,kCAA0B,IAAI;AAC9B,mBAAW,IAAI;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SACE,qBAAC,SAAI,WAAU,aACb;AAAA,wBAAC,SACC,8BAAC,QAAG,WAAU,yCAAwC,4BAAc,GACtE;AAAA,IAEA;AAAA,MAAC;AAAA;AAAA,QACC,OAAM;AAAA,QACN,aAAY;AAAA,QACZ,UAAU;AAAA,QACV;AAAA,QACA,iBAAiB;AAAA,QACjB,SAAS,OAAO,OAAO,aAAa;AAAA,QACpC,iBAAiB,MAAM;AAAA,QAAC;AAAA,QACxB,iBAAe;AAAA,QACf,mBAAiB;AAAA,QACjB,WAAW;AAAA,QACX,QACE,OAAO,OAAO,SACV,mCAAmC,OAAO,OAAO,OAAO,IAAI,KAC5D,OAAO,KAAK,OAAO,OAAO,WAAW,CAAC,CAAC,EAAE,SAAS,IAChD,4BAA4B,OAAO,KAAK,OAAO,OAAO,WAAW,CAAC,CAAC,EAAE,MAAM,kBACzE,OAAO,KAAK,OAAO,OAAO,WAAW,CAAC,CAAC,EAAE,WAAW,IAAI,KAAK,GAC/D,KACA;AAAA;AAAA,IAEV;AAAA,IAEA,oBAAC,aACC,+BAAC,oBAAiB,WAAU,cAC1B;AAAA,0BAAC,kBACC,8BAAC,yBACC,8BAAC,uBAAoB,qBAAO,GAC9B,GACF;AAAA,MAEA;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,YAAY,OAAO,CAAC,SAAS,KAAK,SAAS,QAAQ;AAAA,UAC1D,eAAe;AAAA,UACf;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,UAAU,MAAM;AAAA,UAChB,YAAY,OAAO;AAAA,UACnB;AAAA,UACA;AAAA,UACA,oBAAoB;AAAA,UACpB,gBAAgB;AAAA;AAAA,MAClB;AAAA,MAEC,OAAO,OAAO,WACZ,MAAM;AACL,cAAM,SAAS,OAAO,OAAO;AAC7B,cAAM,iBAAiB,uBAAuB,KAAK;AACnD,cAAM,kBAAkB,eAAe,KAAK;AAC5C,cAAM,eAAe,OAAO,oBAAoB;AAChD,cAAM,aAAa,OAAO,SAAS;AACnC,cAAM,iBACH,cAAc,mBAAmB,gBAClC,oBAAoB,OAAO;AAC7B,cAAM,SAAS,6BAA6B;AAC5C,cAAM,kBAAkB,gBAAgB,WAAW;AACnD,cAAM,iBAAiB,cAAc,eAAe,WAAW;AAC/D,cAAM,UAAU,kBAAkB,CAAC,UAAU,CAAC,mBAAmB,CAAC;AAElE,cAAM,sBAAsB,YAAY;AACtC,gBAAM,MAAM,EAAE,uBAAuB;AACrC,sCAA4B,QAAQ;AACpC,mBAAS,IAAI;AACb,gBAAM,OAAO,MAAM,SAAS;AAAA,YAC1B,QAAQ,EAAE,SAAS,cAAc,WAAW,MAAM,SAAS;AAAA,YAC3D,SAAS;AAAA,cACP;AAAA,cACA,QAAQ,mBAAmB,KAAK;AAAA,gBAC9B,MAAM;AAAA,gBACN,oBAAoB,OAAO;AAAA,gBAC3B,MAAM,OAAO;AAAA,gBACb,UAAU;AAAA,gBACV,kBAAkB,aAAa,kBAAkB,OAAO;AAAA,gBACxD,WAAW,OAAO,aAAa;AAAA,gBAC/B,cAAc,OAAO;AAAA,gBACrB,kBAAkB,OAAO;AAAA,gBACzB,gBAAgB,OAAO;AAAA,gBACvB,QAAQ,CAAC,GAAG,OAAO,MAAM;AAAA,cAC3B,CAAC;AAAA,YACH;AAAA,YACA,gBAAgB;AAAA,UAClB,CAAC;AACD,cAAI,uBAAuB,YAAY,IAAK;AAC5C,cAAS,eAAU,IAAI,GAAG;AACxB,wCAA4B,MAAM;AAClC,qBAAS,qBAAqB,MAAM,gCAAgC,CAAC;AACrE;AAAA,UACF;AACA,sCAA4B,OAAO;AACnC,iBAAO,WAAW,MAAM;AACtB,gBAAI,uBAAuB,YAAY,KAAK;AAC1C,0CAA4B,MAAM;AAAA,YACpC;AAAA,UACF,GAAG,IAAI;AAAA,QACT;AAEA,cAAM,QAAQ;AAAA,UACZ;AAAA,UACA,OAAO;AAAA,UACP;AAAA,QACF;AACA,cAAM,UACJ,SACA;AAAA,UACE;AAAA,UACA,OAAO;AAAA,UACP;AAAA,UACA;AAAA,QACF;AACF,cAAM,oBACJ,WAAW,mCAAmC,QAAQ,KAAK,IAAI,QAAQ,QAAQ;AACjF,cAAM,aAAa,oBACf,YAAY,KAAK,CAAC,UAAU,MAAM,OAAO,kBAAkB,YAAY,IACvE;AACJ,cAAM,iBAAiB,qBAAqB,UAAU,QAAQ,UAAU;AACxE,cAAM,eACJ,YAAY,GAAG,uBAAuB,IAAI,OAAO,cAAc;AACjE,cAAM,2BACJ,wBAAwB,YAAY,2BACpC,2BAA2B,QAC3B,uBAAuB,SAAS,OAAO;AACzC,cAAM,cAAc,eAAe,QAAQ,eAAe;AAC1D,cAAM,aACJ,gBAAgB,2BACZ,+BACA,qBAAqB,iBACnB,aACE,mBAAmB,0BACjB,gBAAgB,2BAA2B,YAAY,CAAC,OACtD,WAAW,iBAAiB,WAAW,EACzC,KACA,iCACE,WAAW,iBAAiB,WAAW,EACzC,KACF,mBAAmB,0BACjB,kCAAkC,2BAA2B,YAAY,CAAC,KAC1E,uCACJ,MAAM,2BAA2B,YAAY,CAAC;AACtD,cAAM,kBAAkB,gBAAgB,kBAAkB;AAE1D,eACE,iCACE;AAAA,+BAAC,kBACC;AAAA,iCAAC,yBACC;AAAA,kCAAC,uBAAoB,6BAAe;AAAA,cACpC,oBAAC,6BAA0B,iGAG3B;AAAA,eACF;AAAA,YACA,qBAAC,SAAI,WAAU,2BACZ;AAAA,2CAA6B,UAC5B,oBAAC,UAAK,WAAU,iCACb,mBAAS,iBAAY,SACxB;AAAA,cAEF;AAAA,gBAAC;AAAA;AAAA,kBACC,MAAK;AAAA,kBACL,SAAS,MAAM,KAAK,oBAAoB;AAAA,kBACxC,UAAU,CAAC;AAAA,kBACZ;AAAA;AAAA,cAED;AAAA,eACF;AAAA,aACF;AAAA,UACC,cACC,oBAAC,uBAAoB,OAAM,qBACzB;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,cACP,UAAU,CAAC,MACT,0BAA2B,EAAE,OAA4B,KAAK;AAAA,cAEhE,WAAU;AAAA;AAAA,UACZ,GACF;AAAA,UAEF,oBAAC,uBAAoB,OAAM,aACzB;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,cACP,UAAU,CAAC,MAAM,kBAAmB,EAAE,OAA4B,KAAK;AAAA,cACvE,WAAU;AAAA;AAAA,UACZ,GACF;AAAA,UACA,oBAAC,uBAAoB,OAAM,gBACzB,+BAAC,SAAI,WAAU,eACb;AAAA,iCAAC,SAAI,WAAU,gHACb;AAAA,kCAAC,UAAK,WAAU,mCAAmC,6BAAkB;AAAA,cACrE,oBAAC,cAAW,OAAO,mBAAmB;AAAA,eACxC;AAAA,YACA,oBAAC,OAAE,WAAU,iCAAgC,6DAE7C;AAAA,aACF,GACF;AAAA,UACC,iBAAiB,SAAS,KACzB,qBAAC,kBACC;AAAA,iCAAC,yBACC;AAAA,kCAAC,uBAAoB,yBAAW;AAAA,cAChC,oBAAC,6BAA0B,8DAE3B;AAAA,eACF;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,MAAM,iBAAiB,IAAI,CAAC,WAAW;AAAA,kBACrC,OAAO,MAAM;AAAA,kBACb,OAAO,MAAM;AAAA,gBACf,EAAE;AAAA,gBACF,OAAO;AAAA,gBACP,UAAU;AAAA;AAAA,YACZ;AAAA,aACF;AAAA,UAEF,oBAAC,uBAAoB,OAAM,oBACzB,+BAAC,SAAI,WAAU,aACb;AAAA,gCAAC,SAAI,WAAU,iCAAiC,sBAAW;AAAA,YAC3D;AAAA,cAAC;AAAA;AAAA,gBACC,MAAK;AAAA,gBACL,SAAS,MAAM,KAAK,aAAa,uBAAuB;AAAA,gBACxD,UAAU;AAAA,gBAET,yBAAe,qBAAgB,cAAc,cAAc;AAAA;AAAA,YAC9D;AAAA,YACC,kBACC,oBAAC,OAAE,WAAU,iCAAgC,wDAE7C;AAAA,aAEJ,GACF;AAAA,WACF;AAAA,MAEJ,GAAG;AAAA,OACP,GACF;AAAA,IAEC,SACC,oBAAC,SAAI,WAAU,sEACb,8BAAC,OAAE,WAAU,4BAA4B,iBAAM,GACjD;AAAA,IAGF,oBAAC,SAAI,WAAU,+DACb,8BAAC,UAAO,SAAQ,SAAQ,SAAS,MAAM,QAAQ,kBAE/C,GACF;AAAA,KACF;AAEJ;","names":["startOAuthExit","response"]}

package/dist/OpenApiSourceSummary-CM46DB4L.js

@@ -0,0 +1,122 @@
+import {
+  openApiSourceAtom,
+  openApiSourceBindingsAtom
+} from "./chunk-GFQUEZUW.js";
+import {
+  oauth2ClientSecretSlot
+} from "./chunk-E7PZ2QGD.js";
+
+// src/react/OpenApiSourceSummary.tsx
+import { useAtomValue } from "@effect/atom-react";
+import * as AsyncResult from "effect/unstable/reactivity/AsyncResult";
+import { connectionsAtom, sourceAtom } from "@executor-js/react/api/atoms";
+import { Badge } from "@executor-js/react/components/badge";
+import { useScope, useScopeStack, useUserScope } from "@executor-js/react/api/scope-context";
+import { ScopeId } from "@executor-js/sdk/core";
+import {
+  SourceCredentialNotice,
+  SourceCredentialStatusBadge,
+  missingSourceCredentialLabels
+} from "@executor-js/react/plugins/source-credential-status";
+
+// src/sdk/credential-status.ts
+var scopeRank = (ranks, scopeId) => ranks.get(scopeId) ?? Number.MAX_SAFE_INTEGER;
+var effectiveBindingForScope = (rows, slot, targetScope, ranks) => rows.filter(
+  (row) => row.slot === slot && scopeRank(ranks, row.scopeId) >= scopeRank(ranks, targetScope)
+).sort((a, b) => scopeRank(ranks, a.scopeId) - scopeRank(ranks, b.scopeId))[0] ?? null;
+
+// src/react/OpenApiSourceSummary.tsx
+import { jsx } from "react/jsx-runtime";
+function OAuthBadge() {
+  return /* @__PURE__ */ jsx(Badge, { variant: "secondary", children: "OAuth" });
+}
+function CheckingCredentialsBadge() {
+  return /* @__PURE__ */ jsx(
+    Badge,
+    {
+      variant: "outline",
+      className: "border-border bg-muted/50 text-[10px] text-muted-foreground",
+      children: "Checking credentials"
+    }
+  );
+}
+var effectiveClientSecretSlot = (oauth2) => oauth2.clientSecretSlot ?? oauth2ClientSecretSlot(oauth2.securitySchemeName);
+var sourceCredentialSlots = (source) => {
+  const slots = [];
+  for (const [name, value] of Object.entries(source.config.headers ?? {})) {
+    if (typeof value !== "string") slots.push({ kind: "secret", slot: value.slot, label: name });
+  }
+  for (const [name, value] of Object.entries(source.config.queryParams ?? {})) {
+    if (typeof value !== "string") slots.push({ kind: "secret", slot: value.slot, label: name });
+  }
+  const oauth2 = source.config.oauth2;
+  if (oauth2) {
+    slots.push({ kind: "secret", slot: oauth2.clientIdSlot, label: "Client ID" });
+    slots.push({
+      kind: "secret",
+      slot: effectiveClientSecretSlot(oauth2),
+      label: "Client Secret"
+    });
+    slots.push({
+      kind: "connection",
+      slot: oauth2.connectionSlot,
+      label: oauth2.flow === "clientCredentials" ? "OAuth client connection" : "OAuth sign-in"
+    });
+  }
+  return slots;
+};
+function OpenApiSourceSummary(props) {
+  const displayScope = useScope();
+  const userScope = useUserScope();
+  const scopeStack = useScopeStack();
+  const summaryResult = useAtomValue(sourceAtom(props.sourceId, displayScope));
+  const sourceScopeId = AsyncResult.isSuccess(summaryResult) && summaryResult.value?.scopeId ? summaryResult.value.scopeId : displayScope;
+  const sourceResult = useAtomValue(openApiSourceAtom(ScopeId.make(sourceScopeId), props.sourceId));
+  const bindingsResult = useAtomValue(
+    openApiSourceBindingsAtom(displayScope, props.sourceId, ScopeId.make(sourceScopeId))
+  );
+  const connectionsResult = useAtomValue(connectionsAtom(displayScope));
+  const source = AsyncResult.isSuccess(sourceResult) && sourceResult.value ? sourceResult.value : null;
+  if (!source) return null;
+  const oauth2 = source.config.oauth2;
+  const bindingsLoaded = AsyncResult.isSuccess(bindingsResult);
+  const connectionsLoaded = AsyncResult.isSuccess(connectionsResult);
+  if (!bindingsLoaded) {
+    return props.variant === "panel" ? null : /* @__PURE__ */ jsx(CheckingCredentialsBadge, {});
+  }
+  const bindings = AsyncResult.isSuccess(bindingsResult) ? bindingsResult.value : [];
+  if (oauth2 && !connectionsLoaded) {
+    return props.variant === "panel" ? null : /* @__PURE__ */ jsx(CheckingCredentialsBadge, {});
+  }
+  const connections = AsyncResult.isSuccess(connectionsResult) ? connectionsResult.value : [];
+  const liveConnectionIds = new Set(connections.map((connection) => connection.id));
+  const scopeRanks = new Map(scopeStack.map((scope, index) => [scope.id, index]));
+  const credentialTargetScope = userScope;
+  const missing = missingSourceCredentialLabels({
+    slots: sourceCredentialSlots(source),
+    bindings,
+    targetScope: credentialTargetScope,
+    scopeRanks,
+    liveConnectionIds
+  });
+  if (props.variant === "panel") {
+    return /* @__PURE__ */ jsx(SourceCredentialNotice, { missing, onAction: props.onAction });
+  }
+  if (missing.length > 0) return /* @__PURE__ */ jsx(SourceCredentialStatusBadge, { missing });
+  if (!oauth2) return null;
+  const connectionBinding = effectiveBindingForScope(
+    bindings,
+    oauth2.connectionSlot,
+    credentialTargetScope,
+    scopeRanks
+  );
+  const connectionId = connectionBinding && connectionBinding.value.kind === "connection" ? connectionBinding.value.connectionId : null;
+  if (connectionId && connections.some((connection) => connection.id === connectionId)) {
+    return /* @__PURE__ */ jsx(SourceCredentialStatusBadge, { missing: [] });
+  }
+  return /* @__PURE__ */ jsx(OAuthBadge, {});
+}
+export {
+  OpenApiSourceSummary as default
+};
+//# sourceMappingURL=OpenApiSourceSummary-CM46DB4L.js.map

package/dist/OpenApiSourceSummary-CM46DB4L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/react/OpenApiSourceSummary.tsx","../src/sdk/credential-status.ts"],"sourcesContent":["import { useAtomValue } from \"@effect/atom-react\";\nimport * as AsyncResult from \"effect/unstable/reactivity/AsyncResult\";\n\nimport { connectionsAtom, sourceAtom } from \"@executor-js/react/api/atoms\";\nimport { Badge } from \"@executor-js/react/components/badge\";\nimport { useScope, useScopeStack, useUserScope } from \"@executor-js/react/api/scope-context\";\nimport { ScopeId } from \"@executor-js/sdk/core\";\nimport {\n  SourceCredentialNotice,\n  SourceCredentialStatusBadge,\n  missingSourceCredentialLabels,\n  type SourceCredentialSlot,\n} from \"@executor-js/react/plugins/source-credential-status\";\n\nimport { openApiSourceAtom, openApiSourceBindingsAtom } from \"./atoms\";\nimport { effectiveBindingForScope } from \"../sdk/credential-status\";\nimport { oauth2ClientSecretSlot, type StoredSourceSchemaType } from \"../sdk/store\";\n\nfunction OAuthBadge() {\n  return <Badge variant=\"secondary\">OAuth</Badge>;\n}\n\nfunction CheckingCredentialsBadge() {\n  return (\n    <Badge\n      variant=\"outline\"\n      className=\"border-border bg-muted/50 text-[10px] text-muted-foreground\"\n    >\n      Checking credentials\n    </Badge>\n  );\n}\n\nconst effectiveClientSecretSlot = (oauth2: {\n  readonly securitySchemeName: string;\n  readonly clientSecretSlot: string | null;\n}): string => oauth2.clientSecretSlot ?? oauth2ClientSecretSlot(oauth2.securitySchemeName);\n\nconst sourceCredentialSlots = (source: StoredSourceSchemaType): readonly SourceCredentialSlot[] => {\n  const slots: SourceCredentialSlot[] = [];\n  for (const [name, value] of Object.entries(source.config.headers ?? {})) {\n    if (typeof value !== \"string\") slots.push({ kind: \"secret\", slot: value.slot, label: name });\n  }\n  for (const [name, value] of Object.entries(source.config.queryParams ?? {})) {\n    if (typeof value !== \"string\") slots.push({ kind: \"secret\", slot: value.slot, label: name });\n  }\n  const oauth2 = source.config.oauth2;\n  if (oauth2) {\n    slots.push({ kind: \"secret\", slot: oauth2.clientIdSlot, label: \"Client ID\" });\n    slots.push({\n      kind: \"secret\",\n      slot: effectiveClientSecretSlot(oauth2),\n      label: \"Client Secret\",\n    });\n    slots.push({\n      kind: \"connection\",\n      slot: oauth2.connectionSlot,\n      label: oauth2.flow === \"clientCredentials\" ? \"OAuth client connection\" : \"OAuth sign-in\",\n    });\n  }\n  return slots;\n};\n\n// The entry row already renders name + id + kind, so this summary\n// component only contributes extras — specifically, an OAuth status\n// badge when the source has OAuth2 configured. Non-OAuth sources\n// render nothing.\nexport default function OpenApiSourceSummary(props: {\n  sourceId: string;\n  variant?: \"badge\" | \"panel\";\n  onAction?: () => void;\n}) {\n  const displayScope = useScope();\n  const userScope = useUserScope();\n  const scopeStack = useScopeStack();\n  const summaryResult = useAtomValue(sourceAtom(props.sourceId, displayScope));\n  const sourceScopeId =\n    AsyncResult.isSuccess(summaryResult) && summaryResult.value?.scopeId\n      ? summaryResult.value.scopeId\n      : displayScope;\n  const sourceResult = useAtomValue(openApiSourceAtom(ScopeId.make(sourceScopeId), props.sourceId));\n  const bindingsResult = useAtomValue(\n    openApiSourceBindingsAtom(displayScope, props.sourceId, ScopeId.make(sourceScopeId)),\n  );\n  const connectionsResult = useAtomValue(connectionsAtom(displayScope));\n\n  const source =\n    AsyncResult.isSuccess(sourceResult) && sourceResult.value ? sourceResult.value : null;\n\n  if (!source) return null;\n  const oauth2 = source.config.oauth2;\n  const bindingsLoaded = AsyncResult.isSuccess(bindingsResult);\n  const connectionsLoaded = AsyncResult.isSuccess(connectionsResult);\n  if (!bindingsLoaded) {\n    return props.variant === \"panel\" ? null : <CheckingCredentialsBadge />;\n  }\n\n  const bindings = AsyncResult.isSuccess(bindingsResult) ? bindingsResult.value : [];\n  if (oauth2 && !connectionsLoaded) {\n    return props.variant === \"panel\" ? null : <CheckingCredentialsBadge />;\n  }\n  const connections = AsyncResult.isSuccess(connectionsResult) ? connectionsResult.value : [];\n  const liveConnectionIds = new Set(connections.map((connection) => connection.id));\n  const scopeRanks = new Map(scopeStack.map((scope, index) => [scope.id, index] as const));\n  const credentialTargetScope = userScope;\n  const missing = missingSourceCredentialLabels({\n    slots: sourceCredentialSlots(source),\n    bindings,\n    targetScope: credentialTargetScope,\n    scopeRanks,\n    liveConnectionIds,\n  });\n\n  if (props.variant === \"panel\") {\n    return <SourceCredentialNotice missing={missing} onAction={props.onAction} />;\n  }\n\n  if (missing.length > 0) return <SourceCredentialStatusBadge missing={missing} />;\n\n  if (!oauth2) return null;\n  const connectionBinding = effectiveBindingForScope(\n    bindings,\n    oauth2.connectionSlot,\n    credentialTargetScope,\n    scopeRanks,\n  );\n  const connectionId =\n    connectionBinding && connectionBinding.value.kind === \"connection\"\n      ? connectionBinding.value.connectionId\n      : null;\n\n  if (connectionId && connections.some((connection) => connection.id === connectionId)) {\n    return <SourceCredentialStatusBadge missing={[]} />;\n  }\n\n  return <OAuthBadge />;\n}\n","import type { ConnectionId, ScopeId } from \"@executor-js/sdk/core\";\n\nimport { oauth2ClientSecretSlot } from \"./store\";\nimport type { ConfiguredHeaderValue, OpenApiSourceBindingValue } from \"./types\";\n\nexport type BindingRowForCredentialStatus = {\n  readonly slot: string;\n  readonly scopeId: ScopeId;\n  readonly value: OpenApiSourceBindingValue;\n};\n\nexport type SourceForCredentialStatus = {\n  readonly config: {\n    readonly headers?: Record<string, ConfiguredHeaderValue>;\n    readonly oauth2?: {\n      readonly securitySchemeName: string;\n      readonly flow: \"authorizationCode\" | \"clientCredentials\";\n      readonly clientIdSlot: string;\n      readonly clientSecretSlot: string | null;\n      readonly connectionSlot: string;\n    };\n  };\n};\n\nconst scopeRank = (ranks: ReadonlyMap<string, number>, scopeId: ScopeId): number =>\n  ranks.get(scopeId) ?? Number.MAX_SAFE_INTEGER;\n\nexport const effectiveBindingForScope = (\n  rows: readonly BindingRowForCredentialStatus[],\n  slot: string,\n  targetScope: ScopeId,\n  ranks: ReadonlyMap<string, number>,\n): BindingRowForCredentialStatus | null =>\n  rows\n    .filter(\n      (row) => row.slot === slot && scopeRank(ranks, row.scopeId) >= scopeRank(ranks, targetScope),\n    )\n    .sort((a, b) => scopeRank(ranks, a.scopeId) - scopeRank(ranks, b.scopeId))[0] ?? null;\n\nconst hasSecretBinding = (\n  rows: readonly BindingRowForCredentialStatus[],\n  slot: string,\n  targetScope: ScopeId,\n  ranks: ReadonlyMap<string, number>,\n) => effectiveBindingForScope(rows, slot, targetScope, ranks)?.value.kind === \"secret\";\n\nconst hasConnectionBinding = (\n  rows: readonly BindingRowForCredentialStatus[],\n  slot: string,\n  targetScope: ScopeId,\n  ranks: ReadonlyMap<string, number>,\n  liveConnectionIds?: ReadonlySet<string>,\n) => {\n  const binding = effectiveBindingForScope(rows, slot, targetScope, ranks);\n  if (binding?.value.kind !== \"connection\") return false;\n  return liveConnectionIds ? liveConnectionIds.has(binding.value.connectionId) : true;\n};\n\nconst effectiveClientSecretSlot = (oauth2: {\n  readonly securitySchemeName: string;\n  readonly clientSecretSlot: string | null;\n}): string => oauth2.clientSecretSlot ?? oauth2ClientSecretSlot(oauth2.securitySchemeName);\n\nexport function missingCredentialLabels(\n  source: SourceForCredentialStatus,\n  bindings: readonly BindingRowForCredentialStatus[],\n  targetScope: ScopeId,\n  ranks: ReadonlyMap<string, number>,\n  options?: {\n    readonly liveConnectionIds?: ReadonlySet<string> | readonly ConnectionId[];\n  },\n): string[] {\n  const missing: string[] = [];\n  const rawLiveConnectionIds = options?.liveConnectionIds;\n  const liveConnectionIds = rawLiveConnectionIds\n    ? rawLiveConnectionIds instanceof Set\n      ? rawLiveConnectionIds\n      : new Set(rawLiveConnectionIds)\n    : undefined;\n\n  for (const [headerName, value] of Object.entries(source.config.headers ?? {})) {\n    if (typeof value === \"string\") continue;\n    if (!hasSecretBinding(bindings, value.slot, targetScope, ranks)) {\n      missing.push(headerName);\n    }\n  }\n\n  const oauth2 = source.config.oauth2;\n  if (!oauth2) return missing;\n\n  if (!hasSecretBinding(bindings, oauth2.clientIdSlot, targetScope, ranks)) {\n    missing.push(\"Client ID\");\n  }\n\n  const clientSecretSlot = effectiveClientSecretSlot(oauth2);\n  if (!hasSecretBinding(bindings, clientSecretSlot, targetScope, ranks)) {\n    missing.push(\"Client Secret\");\n  }\n\n  if (\n    !hasConnectionBinding(bindings, oauth2.connectionSlot, targetScope, ranks, liveConnectionIds)\n  ) {\n    missing.push(oauth2.flow === \"clientCredentials\" ? \"OAuth client connection\" : \"OAuth sign-in\");\n  }\n\n  return missing;\n}\n"],"mappings":";;;;;;;;;AAAA,SAAS,oBAAoB;AAC7B,YAAY,iBAAiB;AAE7B,SAAS,iBAAiB,kBAAkB;AAC5C,SAAS,aAAa;AACtB,SAAS,UAAU,eAAe,oBAAoB;AACtD,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;;;ACYP,IAAM,YAAY,CAAC,OAAoC,YACrD,MAAM,IAAI,OAAO,KAAK,OAAO;AAExB,IAAM,2BAA2B,CACtC,MACA,MACA,aACA,UAEA,KACG;AAAA,EACC,CAAC,QAAQ,IAAI,SAAS,QAAQ,UAAU,OAAO,IAAI,OAAO,KAAK,UAAU,OAAO,WAAW;AAC7F,EACC,KAAK,CAAC,GAAG,MAAM,UAAU,OAAO,EAAE,OAAO,IAAI,UAAU,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK;;;ADlB5E;AADT,SAAS,aAAa;AACpB,SAAO,oBAAC,SAAM,SAAQ,aAAY,mBAAK;AACzC;AAEA,SAAS,2BAA2B;AAClC,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAQ;AAAA,MACR,WAAU;AAAA,MACX;AAAA;AAAA,EAED;AAEJ;AAEA,IAAM,4BAA4B,CAAC,WAGrB,OAAO,oBAAoB,uBAAuB,OAAO,kBAAkB;AAEzF,IAAM,wBAAwB,CAAC,WAAoE;AACjG,QAAM,QAAgC,CAAC;AACvC,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,WAAW,CAAC,CAAC,GAAG;AACvE,QAAI,OAAO,UAAU,SAAU,OAAM,KAAK,EAAE,MAAM,UAAU,MAAM,MAAM,MAAM,OAAO,KAAK,CAAC;AAAA,EAC7F;AACA,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,eAAe,CAAC,CAAC,GAAG;AAC3E,QAAI,OAAO,UAAU,SAAU,OAAM,KAAK,EAAE,MAAM,UAAU,MAAM,MAAM,MAAM,OAAO,KAAK,CAAC;AAAA,EAC7F;AACA,QAAM,SAAS,OAAO,OAAO;AAC7B,MAAI,QAAQ;AACV,UAAM,KAAK,EAAE,MAAM,UAAU,MAAM,OAAO,cAAc,OAAO,YAAY,CAAC;AAC5E,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,MAAM,0BAA0B,MAAM;AAAA,MACtC,OAAO;AAAA,IACT,CAAC;AACD,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,MAAM,OAAO;AAAA,MACb,OAAO,OAAO,SAAS,sBAAsB,4BAA4B;AAAA,IAC3E,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAMe,SAAR,qBAAsC,OAI1C;AACD,QAAM,eAAe,SAAS;AAC9B,QAAM,YAAY,aAAa;AAC/B,QAAM,aAAa,cAAc;AACjC,QAAM,gBAAgB,aAAa,WAAW,MAAM,UAAU,YAAY,CAAC;AAC3E,QAAM,gBACQ,sBAAU,aAAa,KAAK,cAAc,OAAO,UACzD,cAAc,MAAM,UACpB;AACN,QAAM,eAAe,aAAa,kBAAkB,QAAQ,KAAK,aAAa,GAAG,MAAM,QAAQ,CAAC;AAChG,QAAM,iBAAiB;AAAA,IACrB,0BAA0B,cAAc,MAAM,UAAU,QAAQ,KAAK,aAAa,CAAC;AAAA,EACrF;AACA,QAAM,oBAAoB,aAAa,gBAAgB,YAAY,CAAC;AAEpE,QAAM,SACQ,sBAAU,YAAY,KAAK,aAAa,QAAQ,aAAa,QAAQ;AAEnF,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,SAAS,OAAO,OAAO;AAC7B,QAAM,iBAA6B,sBAAU,cAAc;AAC3D,QAAM,oBAAgC,sBAAU,iBAAiB;AACjE,MAAI,CAAC,gBAAgB;AACnB,WAAO,MAAM,YAAY,UAAU,OAAO,oBAAC,4BAAyB;AAAA,EACtE;AAEA,QAAM,WAAuB,sBAAU,cAAc,IAAI,eAAe,QAAQ,CAAC;AACjF,MAAI,UAAU,CAAC,mBAAmB;AAChC,WAAO,MAAM,YAAY,UAAU,OAAO,oBAAC,4BAAyB;AAAA,EACtE;AACA,QAAM,cAA0B,sBAAU,iBAAiB,IAAI,kBAAkB,QAAQ,CAAC;AAC1F,QAAM,oBAAoB,IAAI,IAAI,YAAY,IAAI,CAAC,eAAe,WAAW,EAAE,CAAC;AAChF,QAAM,aAAa,IAAI,IAAI,WAAW,IAAI,CAAC,OAAO,UAAU,CAAC,MAAM,IAAI,KAAK,CAAU,CAAC;AACvF,QAAM,wBAAwB;AAC9B,QAAM,UAAU,8BAA8B;AAAA,IAC5C,OAAO,sBAAsB,MAAM;AAAA,IACnC;AAAA,IACA,aAAa;AAAA,IACb;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,MAAM,YAAY,SAAS;AAC7B,WAAO,oBAAC,0BAAuB,SAAkB,UAAU,MAAM,UAAU;AAAA,EAC7E;AAEA,MAAI,QAAQ,SAAS,EAAG,QAAO,oBAAC,+BAA4B,SAAkB;AAE9E,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,OAAO;AAAA,IACP;AAAA,IACA;AAAA,EACF;AACA,QAAM,eACJ,qBAAqB,kBAAkB,MAAM,SAAS,eAClD,kBAAkB,MAAM,eACxB;AAEN,MAAI,gBAAgB,YAAY,KAAK,CAAC,eAAe,WAAW,OAAO,YAAY,GAAG;AACpF,WAAO,oBAAC,+BAA4B,SAAS,CAAC,GAAG;AAAA,EACnD;AAEA,SAAO,oBAAC,cAAW;AACrB;","names":[]}

package/dist/api/group.d.ts

@@ -1,10 +1,7 @@
 import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
 import { Schema } from "effect";
-import { InternalError } from "@executor-js/api";
+import { InternalError } from "@executor-js/sdk/core";
 import { OpenApiParseError, OpenApiExtractionError, OpenApiOAuthError } from "../sdk/errors";
-import { SpecPreview } from "../sdk/preview";
-import { StoredSourceSchema } from "../sdk/store";
-import { OAuth2Auth, OAuth2SourceConfig, OpenApiSourceBindingRef } from "../sdk/types";
 export declare const OpenApiGroup: HttpApiGroup.HttpApiGroup<"openapi", HttpApiEndpoint.HttpApiEndpoint<"previewSpec", "POST", "/scopes/:scopeId/openapi/preview", HttpApiEndpoint.StringTree<Schema.Struct<{
     scopeId: Schema.brand<Schema.String, "ScopeId">;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
@@ -19,9 +16,73 @@ export declare const OpenApiGroup: HttpApiGroup.HttpApiGroup<"openapi", HttpApiE
             readonly prefix: Schema.optional<Schema.String>;
         }>]>>>;
     }>>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<typeof SpecPreview>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"addSpec", "POST", "/scopes/:scopeId/openapi/specs", HttpApiEndpoint.StringTree<Schema.Struct<{
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly title: Schema.OptionFromOptional<Schema.String>;
+    readonly version: Schema.OptionFromOptional<Schema.String>;
+    readonly servers: Schema.$Array<Schema.Struct<{
+        readonly url: Schema.String;
+        readonly description: Schema.OptionFromOptional<Schema.String>;
+        readonly variables: Schema.OptionFromOptional<Schema.$Record<Schema.String, Schema.Struct<{
+            readonly default: Schema.String;
+            readonly enum: Schema.OptionFromOptional<Schema.$Array<Schema.String>>;
+            readonly description: Schema.OptionFromOptional<Schema.String>;
+        }>>>;
+    }>>;
+    readonly operationCount: Schema.Number;
+    readonly operations: Schema.$Array<Schema.Struct<{
+        readonly operationId: Schema.String;
+        readonly method: Schema.Literals<readonly ["get", "put", "post", "delete", "patch", "head", "options", "trace"]>;
+        readonly path: Schema.String;
+        readonly summary: Schema.OptionFromOptional<Schema.String>;
+        readonly tags: Schema.$Array<Schema.String>;
+        readonly deprecated: Schema.Boolean;
+    }>>;
+    readonly tags: Schema.$Array<Schema.String>;
+    readonly securitySchemes: Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly type: Schema.Literals<readonly ["http", "apiKey", "oauth2", "openIdConnect"]>;
+        readonly scheme: Schema.OptionFromOptional<Schema.String>;
+        readonly bearerFormat: Schema.OptionFromOptional<Schema.String>;
+        readonly in: Schema.OptionFromOptional<Schema.Literals<readonly ["header", "query", "cookie"]>>;
+        readonly headerName: Schema.OptionFromOptional<Schema.String>;
+        readonly description: Schema.OptionFromOptional<Schema.String>;
+        readonly flows: Schema.OptionFromOptional<Schema.Struct<{
+            readonly authorizationCode: Schema.OptionFromOptional<Schema.Struct<{
+                readonly authorizationUrl: Schema.String;
+                readonly tokenUrl: Schema.String;
+                readonly refreshUrl: Schema.OptionFromOptional<Schema.String>;
+                readonly scopes: Schema.$Record<Schema.String, Schema.String>;
+            }>>;
+            readonly clientCredentials: Schema.OptionFromOptional<Schema.Struct<{
+                readonly tokenUrl: Schema.String;
+                readonly refreshUrl: Schema.OptionFromOptional<Schema.String>;
+                readonly scopes: Schema.$Record<Schema.String, Schema.String>;
+            }>>;
+        }>>;
+        readonly openIdConnectUrl: Schema.OptionFromOptional<Schema.String>;
+    }>>;
+    readonly authStrategies: Schema.$Array<Schema.Struct<{
+        readonly schemes: Schema.$Array<Schema.String>;
+    }>>;
+    readonly headerPresets: Schema.$Array<Schema.Struct<{
+        readonly label: Schema.String;
+        readonly headers: Schema.$Record<Schema.String, Schema.NullOr<Schema.String>>;
+        readonly secretHeaders: Schema.$Array<Schema.String>;
+    }>>;
+    readonly oauth2Presets: Schema.$Array<Schema.Struct<{
+        readonly label: Schema.String;
+        readonly securitySchemeName: Schema.String;
+        readonly flow: Schema.Literals<readonly ["authorizationCode", "clientCredentials"]>;
+        readonly authorizationUrl: Schema.OptionFromOptional<Schema.String>;
+        readonly tokenUrl: Schema.String;
+        readonly refreshUrl: Schema.OptionFromOptional<Schema.String>;
+        readonly scopes: Schema.$Record<Schema.String, Schema.String>;
+    }>>;
+}>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"addSpec", "POST", "/scopes/:scopeId/openapi/specs", HttpApiEndpoint.StringTree<Schema.Struct<{
     scopeId: Schema.brand<Schema.String, "ScopeId">;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
+    readonly credentialTargetScope: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
     readonly spec: Schema.String;
     readonly specFetchCredentials: Schema.optional<Schema.Struct<{
         readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
@@ -36,37 +97,165 @@ export declare const OpenApiGroup: HttpApiGroup.HttpApiGroup<"openapi", HttpApiE
     readonly name: Schema.optional<Schema.String>;
     readonly baseUrl: Schema.optional<Schema.String>;
     readonly namespace: Schema.optional<Schema.String>;
-    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.Struct<{
         readonly secretId: Schema.String;
         readonly prefix: Schema.optional<Schema.String>;
-    }>]>>>;
-    readonly oauth2: Schema.optional<Schema.Union<readonly [typeof OAuth2Auth, typeof OAuth2SourceConfig]>>;
+        readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
+        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+    }>, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly secretId: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly kind: Schema.Literal<"binding">;
+        readonly slot: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>]>>>;
+    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.Struct<{
+        readonly secretId: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+        readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
+        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+    }>, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly secretId: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly kind: Schema.Literal<"binding">;
+        readonly slot: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>]>>>;
+    readonly oauth2: Schema.optional<Schema.Struct<{
+        readonly kind: Schema.Literal<"oauth2">;
+        readonly securitySchemeName: Schema.String;
+        readonly flow: Schema.Literals<readonly ["authorizationCode", "clientCredentials"]>;
+        readonly tokenUrl: Schema.String;
+        readonly authorizationUrl: Schema.NullOr<Schema.String>;
+        readonly issuerUrl: Schema.optional<Schema.NullOr<Schema.String>>;
+        readonly clientIdSlot: Schema.String;
+        readonly clientSecretSlot: Schema.NullOr<Schema.String>;
+        readonly connectionSlot: Schema.String;
+        readonly scopes: Schema.$Array<Schema.String>;
+    }>>;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly toolCount: Schema.Number;
     readonly namespace: Schema.String;
 }>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"getSource", "GET", "/scopes/:scopeId/openapi/sources/:namespace", HttpApiEndpoint.StringTree<Schema.Struct<{
     scopeId: Schema.brand<Schema.String, "ScopeId">;
     namespace: Schema.String;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.NullOr<typeof StoredSourceSchema>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"updateSource", "PATCH", "/scopes/:scopeId/openapi/sources/:namespace", HttpApiEndpoint.StringTree<Schema.Struct<{
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.NullOr<Schema.Struct<{
+    readonly namespace: Schema.String;
+    readonly scope: Schema.String;
+    readonly name: Schema.String;
+    readonly config: Schema.Struct<{
+        readonly spec: Schema.String;
+        readonly sourceUrl: Schema.optional<Schema.String>;
+        readonly baseUrl: Schema.optional<Schema.String>;
+        readonly namespace: Schema.optional<Schema.String>;
+        readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+            readonly kind: Schema.Literal<"binding">;
+            readonly slot: Schema.String;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>]>>>;
+        readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+            readonly kind: Schema.Literal<"binding">;
+            readonly slot: Schema.String;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>]>>>;
+        readonly specFetchCredentials: Schema.optional<Schema.Struct<{
+            readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+                readonly kind: Schema.Literal<"binding">;
+                readonly slot: Schema.String;
+                readonly prefix: Schema.optional<Schema.String>;
+            }>]>>>;
+            readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+                readonly kind: Schema.Literal<"binding">;
+                readonly slot: Schema.String;
+                readonly prefix: Schema.optional<Schema.String>;
+            }>]>>>;
+        }>>;
+        readonly oauth2: Schema.optional<Schema.Struct<{
+            readonly kind: Schema.Literal<"oauth2">;
+            readonly securitySchemeName: Schema.String;
+            readonly flow: Schema.Literals<readonly ["authorizationCode", "clientCredentials"]>;
+            readonly tokenUrl: Schema.String;
+            readonly authorizationUrl: Schema.NullOr<Schema.String>;
+            readonly issuerUrl: Schema.optional<Schema.NullOr<Schema.String>>;
+            readonly clientIdSlot: Schema.String;
+            readonly clientSecretSlot: Schema.NullOr<Schema.String>;
+            readonly connectionSlot: Schema.String;
+            readonly scopes: Schema.$Array<Schema.String>;
+        }>>;
+    }>;
+}>>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"updateSource", "PATCH", "/scopes/:scopeId/openapi/sources/:namespace", HttpApiEndpoint.StringTree<Schema.Struct<{
     scopeId: Schema.brand<Schema.String, "ScopeId">;
     namespace: Schema.String;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly sourceScope: Schema.brand<Schema.String, "ScopeId">;
     readonly name: Schema.optional<Schema.String>;
     readonly baseUrl: Schema.optional<Schema.String>;
-    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
-    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.Struct<{
+        readonly secretId: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+        readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
+        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+    }>, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly secretId: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly kind: Schema.Literal<"binding">;
+        readonly slot: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>]>>>;
+    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.Struct<{
         readonly secretId: Schema.String;
         readonly prefix: Schema.optional<Schema.String>;
-    }>]>>>;
-    readonly oauth2: Schema.optional<Schema.Union<readonly [typeof OAuth2Auth, typeof OAuth2SourceConfig]>>;
+        readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
+        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+    }>, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly secretId: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly kind: Schema.Literal<"binding">;
+        readonly slot: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>]>>>;
+    readonly credentialTargetScope: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+    readonly oauth2: Schema.optional<Schema.Struct<{
+        readonly kind: Schema.Literal<"oauth2">;
+        readonly securitySchemeName: Schema.String;
+        readonly flow: Schema.Literals<readonly ["authorizationCode", "clientCredentials"]>;
+        readonly tokenUrl: Schema.String;
+        readonly authorizationUrl: Schema.NullOr<Schema.String>;
+        readonly issuerUrl: Schema.optional<Schema.NullOr<Schema.String>>;
+        readonly clientIdSlot: Schema.String;
+        readonly clientSecretSlot: Schema.NullOr<Schema.String>;
+        readonly connectionSlot: Schema.String;
+        readonly scopes: Schema.$Array<Schema.String>;
+    }>>;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly updated: Schema.Boolean;
 }>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"listSourceBindings", "GET", "/scopes/:scopeId/openapi/sources/:namespace/base/:sourceScopeId/bindings", HttpApiEndpoint.StringTree<Schema.Struct<{
     scopeId: Schema.brand<Schema.String, "ScopeId">;
     namespace: Schema.String;
     sourceScopeId: Schema.brand<Schema.String, "ScopeId">;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.$Array<typeof OpenApiSourceBindingRef>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"setSourceBinding", "POST", "/scopes/:scopeId/openapi/source-bindings", HttpApiEndpoint.StringTree<Schema.Struct<{
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.$Array<Schema.Struct<{
+    readonly sourceId: Schema.String;
+    readonly sourceScopeId: Schema.brand<Schema.String, "ScopeId">;
+    readonly scopeId: Schema.brand<Schema.String, "ScopeId">;
+    readonly slot: Schema.String;
+    readonly value: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"secret">;
+        readonly secretId: Schema.brand<Schema.String, "SecretId">;
+        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"connection">;
+        readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"text">;
+        readonly text: Schema.String;
+    }>]>;
+    readonly createdAt: Schema.Date;
+    readonly updatedAt: Schema.Date;
+}>>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"setSourceBinding", "POST", "/scopes/:scopeId/openapi/source-bindings", HttpApiEndpoint.StringTree<Schema.Struct<{
     scopeId: Schema.brand<Schema.String, "ScopeId">;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly sourceId: Schema.String;
@@ -76,6 +265,23 @@ export declare const OpenApiGroup: HttpApiGroup.HttpApiGroup<"openapi", HttpApiE
     readonly value: Schema.Union<readonly [Schema.Struct<{
         readonly kind: Schema.Literal<"secret">;
         readonly secretId: Schema.brand<Schema.String, "SecretId">;
+        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"connection">;
+        readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"text">;
+        readonly text: Schema.String;
+    }>]>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly sourceId: Schema.String;
+    readonly sourceScopeId: Schema.brand<Schema.String, "ScopeId">;
+    readonly scopeId: Schema.brand<Schema.String, "ScopeId">;
+    readonly slot: Schema.String;
+    readonly value: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"secret">;
+        readonly secretId: Schema.brand<Schema.String, "SecretId">;
+        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
     }>, Schema.Struct<{
         readonly kind: Schema.Literal<"connection">;
         readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
@@ -83,7 +289,9 @@ export declare const OpenApiGroup: HttpApiGroup.HttpApiGroup<"openapi", HttpApiE
         readonly kind: Schema.Literal<"text">;
         readonly text: Schema.String;
     }>]>;
-}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<typeof OpenApiSourceBindingRef>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"removeSourceBinding", "POST", "/scopes/:scopeId/openapi/source-bindings/remove", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly createdAt: Schema.Date;
+    readonly updatedAt: Schema.Date;
+}>>, HttpApiEndpoint.Json<typeof InternalError | typeof OpenApiParseError | typeof OpenApiExtractionError | typeof OpenApiOAuthError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"removeSourceBinding", "POST", "/scopes/:scopeId/openapi/source-bindings/remove", HttpApiEndpoint.StringTree<Schema.Struct<{
     scopeId: Schema.brand<Schema.String, "ScopeId">;
 }>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
     readonly sourceId: Schema.String;