@rafads/plugin-openapi 1.5.38

package/dist/chunk-HTHEUUJA.js

@@ -0,0 +1,2873 @@
+import {
+  decodeOpenApiIntegrationConfig,
+  parseEntry,
+  parseHead,
+  parseSmallComponents,
+  renderAuthTemplate,
+  requiredTemplateVariables,
+  structuralSplit
+} from "./chunk-R7TVM3XD.js";
+import {
+  OpenApiExtractionError,
+  OpenApiInvocationError,
+  OpenApiParseError
+} from "./chunk-CXFO6TLJ.js";
+
+// src/sdk/parse.ts
+import { Duration, Effect, Schema } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/unstable/http";
+import { JSON_SCHEMA, load as parseYamlDocument } from "js-yaml";
+var OpenApiExtractionErrorFromParse = class extends OpenApiExtractionError {
+};
+var fetchSpecText = Effect.fn("OpenApi.fetchSpecText")(function* (url, credentials) {
+  const client = yield* HttpClient.HttpClient;
+  const requestUrl = new URL(url);
+  for (const [name, value] of Object.entries(credentials?.queryParams ?? {})) {
+    requestUrl.searchParams.set(name, value);
+  }
+  let request = HttpClientRequest.get(requestUrl.toString()).pipe(
+    HttpClientRequest.setHeader("Accept", "application/json, application/yaml, text/yaml, */*")
+  );
+  for (const [name, value] of Object.entries(credentials?.headers ?? {})) {
+    request = HttpClientRequest.setHeader(request, name, value);
+  }
+  const response = yield* client.execute(request).pipe(
+    Effect.timeout(Duration.seconds(60)),
+    Effect.mapError(
+      (_cause) => new OpenApiParseError({
+        message: "Failed to fetch OpenAPI document"
+      })
+    )
+  );
+  if (response.status < 200 || response.status >= 300) {
+    return yield* new OpenApiParseError({
+      message: `Failed to fetch OpenAPI document: HTTP ${response.status}`
+    });
+  }
+  const specText = yield* response.text.pipe(
+    Effect.mapError(
+      (_cause) => new OpenApiParseError({
+        message: "Failed to read OpenAPI document body"
+      })
+    )
+  );
+  return specText;
+});
+var resolveSpecText = (input, credentials) => input.startsWith("http://") || input.startsWith("https://") ? fetchSpecText(input, credentials) : Effect.succeed(input);
+var parse = Effect.fn("OpenApi.parse")(function* (text) {
+  const api = yield* parseTextToObject(text);
+  if (!isOpenApi3(api)) {
+    return yield* new OpenApiExtractionErrorFromParse({
+      message: "Only OpenAPI 3.x documents are supported. Swagger 2.x documents should be converted first."
+    });
+  }
+  return api;
+});
+var isOpenApi3 = (doc) => "openapi" in doc && typeof doc.openapi === "string" && doc.openapi.startsWith("3.");
+var parseTextToObject = (text) => Effect.gen(function* () {
+  const trimmed = text.trim();
+  if (trimmed.length === 0) {
+    return yield* new OpenApiParseError({
+      message: "OpenAPI document is empty"
+    });
+  }
+  const parsed = yield* parseJsonLike(trimmed).pipe(
+    Effect.mapError(
+      () => new OpenApiParseError({
+        message: "Failed to parse OpenAPI document"
+      })
+    )
+  );
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return yield* new OpenApiParseError({
+      message: "OpenAPI document must parse to an object"
+    });
+  }
+  return parsed;
+});
+var parseJsonText = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Unknown));
+var parseJsonLike = (text) => {
+  const parseYaml = Effect.try({
+    try: () => parseYamlDocument(text, { json: true, schema: JSON_SCHEMA }),
+    catch: () => "YamlParseFailed"
+  });
+  if (!text.startsWith("{") && !text.startsWith("[")) return parseYaml;
+  return parseJsonText(text).pipe(Effect.catch(() => parseYaml));
+};
+
+// src/sdk/openapi-utils.ts
+var DocResolver = class {
+  constructor(doc) {
+    this.doc = doc;
+  }
+  doc;
+  /** Resolve a value that might be a $ref, returning the resolved object */
+  resolve(value) {
+    if (isRef(value)) {
+      const resolved = this.resolvePointer(value.$ref);
+      return resolved;
+    }
+    return value;
+  }
+  resolvePointer(ref) {
+    if (!ref.startsWith("#/")) return null;
+    const segments = ref.slice(2).split("/");
+    let current = this.doc;
+    for (const segment of segments) {
+      if (typeof current !== "object" || current === null) return null;
+      current = current[segment];
+    }
+    return current;
+  }
+};
+var isRef = (value) => typeof value === "object" && value !== null && "$ref" in value;
+var substituteUrlVariables = (url, values) => {
+  let out = url;
+  for (const [name, value] of Object.entries(values)) {
+    out = out.replaceAll(`{${name}}`, value);
+  }
+  return out;
+};
+var resolveServerUrl = (templateUrl, variables, overrides) => {
+  const values = {};
+  for (const [name, v] of Object.entries(variables ?? {})) values[name] = v.default;
+  for (const [name, value] of Object.entries(overrides)) {
+    if (value) values[name] = value;
+  }
+  return substituteUrlVariables(templateUrl, values);
+};
+var declaredContents = (content) => {
+  if (!content) return [];
+  return Object.entries(content).map(([mediaType, media]) => ({ mediaType, media }));
+};
+var preferredContent = (content) => {
+  const first = declaredContents(content)[0];
+  return first ? first : void 0;
+};
+var preferredResponseContent = (content) => {
+  if (!content) return void 0;
+  const entries = Object.entries(content);
+  const pick = entries.find(([mt]) => mt === "application/json") ?? entries.find(([mt]) => mt.toLowerCase().includes("+json")) ?? entries.find(([mt]) => mt.toLowerCase().includes("json")) ?? entries[0];
+  return pick ? { mediaType: pick[0], media: pick[1] } : void 0;
+};
+var normalizeMediaType = (mediaType) => mediaType?.split(";")[0]?.trim().toLowerCase() ?? "";
+var NDJSON_MEDIA_TYPES = /* @__PURE__ */ new Set([
+  "application/stream+json",
+  "application/x-ndjson",
+  "application/jsonl"
+]);
+var isNdjsonMediaType = (mediaType) => NDJSON_MEDIA_TYPES.has(normalizeMediaType(mediaType));
+var ndjsonArrayOutputSchema = (lineSchema) => ({
+  type: "array",
+  items: lineSchema,
+  description: "Parsed NDJSON stream: one array item per line. The stream may be truncated (`x-executor-stream: truncated` response header); a body that is not valid NDJSON is returned as the raw string instead."
+});
+
+// src/sdk/types.ts
+import { Schema as Schema2 } from "effect";
+import { AuthTemplateSlug } from "@rafads/sdk/shared";
+import {
+  apiKeyMethodFromAuthTemplate,
+  isApiKeyAuthTemplate
+} from "@rafads/sdk/http-auth";
+import { TOKEN_VARIABLE } from "@rafads/sdk/http-auth";
+var normalizeOpenApiAuthInputs = (inputs) => inputs.map((input) => {
+  if (!isApiKeyAuthTemplate(input)) {
+    return { ...input, slug: AuthTemplateSlug.make(input.slug) };
+  }
+  const method = apiKeyMethodFromAuthTemplate(input);
+  return { ...method, slug: method.slug ?? "" };
+});
+var OperationId = Schema2.String.pipe(Schema2.brand("OperationId"));
+var HttpMethod = Schema2.Literals([
+  "get",
+  "put",
+  "post",
+  "delete",
+  "patch",
+  "head",
+  "options",
+  "trace"
+]);
+var ParameterLocation = Schema2.Literals(["path", "query", "header", "cookie"]);
+var OperationParameter = Schema2.Struct({
+  name: Schema2.String,
+  location: ParameterLocation,
+  required: Schema2.Boolean,
+  schema: Schema2.OptionFromOptional(Schema2.Unknown),
+  style: Schema2.OptionFromOptional(Schema2.String),
+  explode: Schema2.OptionFromOptional(Schema2.Boolean),
+  allowReserved: Schema2.OptionFromOptional(Schema2.Boolean),
+  description: Schema2.OptionFromOptional(Schema2.String)
+});
+var EncodingObject = Schema2.Struct({
+  contentType: Schema2.OptionFromOptional(Schema2.String),
+  style: Schema2.OptionFromOptional(Schema2.String),
+  explode: Schema2.OptionFromOptional(Schema2.Boolean),
+  allowReserved: Schema2.OptionFromOptional(Schema2.Boolean)
+});
+var MediaBinding = Schema2.Struct({
+  contentType: Schema2.String,
+  schema: Schema2.OptionFromOptional(Schema2.Unknown),
+  encoding: Schema2.OptionFromOptional(Schema2.Record(Schema2.String, EncodingObject))
+});
+var OperationRequestBody = Schema2.Struct({
+  required: Schema2.Boolean,
+  /** Default media type — first declared in spec order (not JSON-first).
+   *  Used when the caller does not override via the tool's `contentType` arg. */
+  contentType: Schema2.String,
+  /** Schema of the default media type. Kept for backward compat with stored
+   *  bindings from before `contents` was added. */
+  schema: Schema2.OptionFromOptional(Schema2.Unknown),
+  /** All declared media types in spec order. Populated by `extract.ts`
+   *  going forward; older persisted bindings may have this unset and will
+   *  fall back to `{contentType, schema}`. */
+  contents: Schema2.OptionFromOptional(Schema2.Array(MediaBinding))
+});
+var OperationFileHint = Schema2.Struct({
+  kind: Schema2.Literals(["binaryResponse", "byteField"]),
+  mimeType: Schema2.OptionFromOptional(Schema2.String),
+  dataField: Schema2.OptionFromOptional(Schema2.String),
+  sizeField: Schema2.OptionFromOptional(Schema2.String),
+  encoding: Schema2.OptionFromOptional(Schema2.Literals(["base64", "base64url"]))
+});
+var OperationResponseBody = Schema2.Struct({
+  contentType: Schema2.String,
+  schema: Schema2.OptionFromOptional(Schema2.Unknown),
+  fileHint: Schema2.OptionFromOptional(OperationFileHint)
+});
+var ServerVariable = Schema2.Struct({
+  default: Schema2.String,
+  enum: Schema2.OptionFromOptional(Schema2.Array(Schema2.String)),
+  description: Schema2.OptionFromOptional(Schema2.String)
+});
+var ServerInfo = Schema2.Struct({
+  url: Schema2.String,
+  description: Schema2.OptionFromOptional(Schema2.String),
+  variables: Schema2.OptionFromOptional(Schema2.Record(Schema2.String, ServerVariable))
+});
+var ExtractedOperation = Schema2.Struct({
+  operationId: OperationId,
+  toolPath: Schema2.OptionFromOptional(Schema2.String),
+  method: HttpMethod,
+  servers: Schema2.Array(ServerInfo),
+  pathTemplate: Schema2.String,
+  summary: Schema2.OptionFromOptional(Schema2.String),
+  description: Schema2.OptionFromOptional(Schema2.String),
+  tags: Schema2.Array(Schema2.String),
+  parameters: Schema2.Array(OperationParameter),
+  requestBody: Schema2.OptionFromOptional(OperationRequestBody),
+  responseBody: Schema2.OptionFromOptional(OperationResponseBody),
+  inputSchema: Schema2.OptionFromOptional(Schema2.Unknown),
+  outputSchema: Schema2.OptionFromOptional(Schema2.Unknown),
+  deprecated: Schema2.Boolean,
+  /** OAuth scope requirements from `security`, alternatives preserved: each
+   *  inner array is one acceptable Security Requirement Object's scope set
+   *  (sorted, deduped); the outer array is an OR across alternatives. An
+   *  absent operation `security` inherits the document default; an explicit
+   *  `security: []` (auth disabled) and a scope-less declaration both omit
+   *  the field. */
+  requiredScopeAlternatives: Schema2.optional(Schema2.Array(Schema2.Array(Schema2.String)))
+});
+var ExtractionResult = Schema2.Struct({
+  title: Schema2.OptionFromOptional(Schema2.String),
+  /** The spec's `info.description` — the author's own summary of the API. */
+  description: Schema2.OptionFromOptional(Schema2.String),
+  version: Schema2.OptionFromOptional(Schema2.String),
+  servers: Schema2.Array(ServerInfo),
+  operations: Schema2.Array(ExtractedOperation)
+});
+var OperationBinding = Schema2.Struct({
+  method: HttpMethod,
+  servers: Schema2.optional(Schema2.Array(ServerInfo)),
+  pathTemplate: Schema2.String,
+  parameters: Schema2.Array(OperationParameter),
+  requestBody: Schema2.OptionFromOptional(OperationRequestBody),
+  responseBody: Schema2.OptionFromOptional(OperationResponseBody),
+  /** Declared OAuth scope alternatives (see
+   *  ExtractedOperation.requiredScopeAlternatives), persisted with the
+   *  binding so the invoke path can annotate a scope-insufficient rejection
+   *  with exactly what the operation needs. Optional so bindings stored
+   *  before this field existed keep decoding. */
+  requiredScopeAlternatives: Schema2.optional(Schema2.Array(Schema2.Array(Schema2.String)))
+});
+var InvocationResult = Schema2.Struct({
+  status: Schema2.Number,
+  headers: Schema2.Record(Schema2.String, Schema2.String),
+  data: Schema2.NullOr(Schema2.Unknown),
+  error: Schema2.NullOr(Schema2.Unknown)
+});
+
+// src/sdk/extract.ts
+import { Effect as Effect2, Option as Option2 } from "effect";
+
+// src/sdk/definitions.ts
+import { Option } from "effect";
+var splitWords = (value) => value.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z0-9]+)/g, "$1 $2").replace(/[^a-zA-Z0-9]+/g, " ").trim().split(/\s+/).filter((part) => part.length > 0);
+var normalizeWord = (value) => value.toLowerCase();
+var toCamelCase = (value) => {
+  const words = splitWords(value).map(normalizeWord);
+  if (words.length === 0) return "tool";
+  const [first, ...rest] = words;
+  return `${first}${rest.map((p) => `${p[0]?.toUpperCase() ?? ""}${p.slice(1)}`).join("")}`;
+};
+var toPascalCase = (value) => {
+  const camel = toCamelCase(value);
+  return `${camel[0]?.toUpperCase() ?? ""}${camel.slice(1)}`;
+};
+var VERSION_SEGMENT_REGEX = /^v\d+(?:[._-]\d+)?$/i;
+var IGNORED_PATH_SEGMENTS = /* @__PURE__ */ new Set(["api"]);
+var pathSegmentsFromTemplate = (pathTemplate) => pathTemplate.split("/").map((s) => s.trim()).filter((s) => s.length > 0);
+var isPathParameterSegment = (segment) => segment.startsWith("{") && segment.endsWith("}");
+var normalizeGroupSegment = (value) => {
+  const candidate = value?.trim();
+  if (!candidate) return null;
+  return toCamelCase(candidate);
+};
+var deriveVersionSegment = (pathTemplate) => pathSegmentsFromTemplate(pathTemplate).map((s) => s.toLowerCase()).find((s) => VERSION_SEGMENT_REGEX.test(s));
+var derivePathGroup = (pathTemplate) => {
+  for (const segment of pathSegmentsFromTemplate(pathTemplate)) {
+    const lower = segment.toLowerCase();
+    if (VERSION_SEGMENT_REGEX.test(lower)) continue;
+    if (IGNORED_PATH_SEGMENTS.has(lower)) continue;
+    if (isPathParameterSegment(segment)) continue;
+    return normalizeGroupSegment(segment) ?? "root";
+  }
+  return "root";
+};
+var splitOperationIdSegments = (value) => value.split(/[/.]+/).map((s) => s.trim()).filter((s) => s.length > 0);
+var deriveLeafSeed = (operationId, group) => {
+  const segments = splitOperationIdSegments(operationId);
+  if (segments.length > 1) {
+    const [first, ...rest] = segments;
+    if ((normalizeGroupSegment(first) ?? first) === group && rest.length > 0) {
+      return rest.join(" ");
+    }
+  }
+  return operationId;
+};
+var fallbackLeafSeed = (method, pathTemplate, group) => {
+  const relevantSegments = pathSegmentsFromTemplate(pathTemplate).filter((s) => !VERSION_SEGMENT_REGEX.test(s.toLowerCase())).filter((s) => !IGNORED_PATH_SEGMENTS.has(s.toLowerCase())).filter((s) => !isPathParameterSegment(s)).map((s) => normalizeGroupSegment(s) ?? s).filter((s) => s !== group);
+  const segmentSuffix = relevantSegments.map((s) => toPascalCase(s)).join("");
+  return `${method}${segmentSuffix || "Operation"}`;
+};
+var deriveLeaf = (operationId, method, pathTemplate, group) => {
+  const preferred = toCamelCase(deriveLeafSeed(operationId, group));
+  if (preferred.length > 0 && preferred !== group) return preferred;
+  return toCamelCase(fallbackLeafSeed(method, pathTemplate, group));
+};
+var resolveCollisions = (definitions) => {
+  const staged = definitions.map((d) => ({ ...d }));
+  const applyFactory = (items, factory) => {
+    const byPath = /* @__PURE__ */ new Map();
+    for (const item of items) {
+      const bucket = byPath.get(item.toolPath) ?? [];
+      bucket.push(item);
+      byPath.set(item.toolPath, bucket);
+    }
+    for (const bucket of byPath.values()) {
+      if (bucket.length < 2) continue;
+      for (const d of bucket) {
+        d.toolPath = factory(d);
+      }
+    }
+  };
+  applyFactory(
+    staged,
+    (d) => d.versionSegment ? `${d.group}.${d.versionSegment}.${d.leaf}` : d.toolPath
+  );
+  applyFactory(staged, (d) => {
+    const prefix = d.versionSegment ? `${d.group}.${d.versionSegment}` : d.group;
+    return `${prefix}.${d.leaf}${toPascalCase(d.method)}`;
+  });
+  applyFactory(staged, (d) => {
+    const prefix = d.versionSegment ? `${d.group}.${d.versionSegment}` : d.group;
+    return `${prefix}.${d.leaf}${toPascalCase(d.method)}${d.operationHash.slice(0, 8)}`;
+  });
+  return staged.map((d) => ({
+    toolPath: d.toolPath,
+    group: d.group,
+    leaf: d.leaf,
+    operationIndex: d.operationIndex
+  }));
+};
+var stableHash = (value) => {
+  const str = JSON.stringify(value, Object.keys(value).sort());
+  let hash = 0;
+  for (let i = 0; i < str.length; i++) {
+    hash = (hash << 5) - hash + str.charCodeAt(i) | 0;
+  }
+  return Math.abs(hash).toString(36).padStart(8, "0");
+};
+var planToolPaths = (inputs) => {
+  const raw = inputs.map((op, index) => {
+    const operationId = op.operationId;
+    const operationHash = stableHash({
+      method: op.method,
+      path: op.pathTemplate,
+      operationId
+    });
+    const versionSegment = deriveVersionSegment(op.pathTemplate);
+    if (op.explicitToolPath) {
+      const [group2 = "root", ...leafParts] = op.explicitToolPath.split(".").filter(Boolean);
+      const leaf2 = leafParts.join(".") || group2;
+      return {
+        toolPath: op.explicitToolPath,
+        group: group2,
+        leaf: leaf2,
+        versionSegment,
+        method: op.method,
+        operationHash,
+        operationIndex: index
+      };
+    }
+    const group = normalizeGroupSegment(op.tag0) ?? derivePathGroup(op.pathTemplate);
+    const leaf = deriveLeaf(operationId, op.method, op.pathTemplate, group);
+    return {
+      toolPath: `${group}.${leaf}`,
+      group,
+      leaf,
+      versionSegment,
+      method: op.method,
+      operationHash,
+      operationIndex: index
+    };
+  });
+  return resolveCollisions(raw).sort((a, b) => a.toolPath.localeCompare(b.toolPath));
+};
+var compileToolDefinitions = (operations) => {
+  const plans = planToolPaths(
+    operations.map((op) => ({
+      operationId: op.operationId,
+      explicitToolPath: Option.getOrUndefined(op.toolPath),
+      method: op.method,
+      pathTemplate: op.pathTemplate,
+      tag0: op.tags[0]
+    }))
+  );
+  return plans.map((plan) => ({
+    toolPath: plan.toolPath,
+    group: plan.group,
+    leaf: plan.leaf,
+    operationIndex: plan.operationIndex,
+    operation: operations[plan.operationIndex]
+  }));
+};
+
+// src/sdk/extract.ts
+var HTTP_METHODS = [
+  "get",
+  "put",
+  "post",
+  "delete",
+  "patch",
+  "head",
+  "options",
+  "trace"
+];
+var VALID_PARAM_LOCATIONS = /* @__PURE__ */ new Set(["path", "query", "header", "cookie"]);
+var extractParameters = (pathItem, operation, r) => {
+  const merged = /* @__PURE__ */ new Map();
+  for (const raw of pathItem.parameters ?? []) {
+    const p = r.resolve(raw);
+    if (!p) continue;
+    merged.set(`${p.in}:${p.name}`, p);
+  }
+  for (const raw of operation.parameters ?? []) {
+    const p = r.resolve(raw);
+    if (!p) continue;
+    merged.set(`${p.in}:${p.name}`, p);
+  }
+  return [...merged.values()].filter((p) => VALID_PARAM_LOCATIONS.has(p.in)).map(
+    (p) => OperationParameter.make({
+      name: p.name,
+      location: p.in,
+      required: p.in === "path" ? true : p.required === true,
+      schema: Option2.fromNullishOr(p.schema),
+      style: Option2.fromNullishOr(p.style),
+      explode: Option2.fromNullishOr(p.explode),
+      allowReserved: Option2.fromNullishOr("allowReserved" in p ? p.allowReserved : void 0),
+      description: Option2.fromNullishOr(p.description)
+    })
+  );
+};
+var buildEncodingRecord = (encoding) => {
+  if (!encoding) return void 0;
+  const out = {};
+  for (const [prop, raw] of Object.entries(encoding)) {
+    if (typeof raw !== "object" || raw === null) continue;
+    const e = raw;
+    out[prop] = EncodingObject.make({
+      contentType: Option2.fromNullishOr(e.contentType),
+      style: Option2.fromNullishOr(e.style),
+      explode: Option2.fromNullishOr(e.explode),
+      allowReserved: Option2.fromNullishOr(e.allowReserved)
+    });
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+};
+var extractRequestBody = (operation, r) => {
+  if (!operation.requestBody) return void 0;
+  const body = r.resolve(operation.requestBody);
+  if (!body) return void 0;
+  const contents = declaredContents(body.content).map(
+    ({ mediaType, media }) => MediaBinding.make({
+      contentType: mediaType,
+      schema: Option2.fromNullishOr(media.schema),
+      encoding: Option2.fromNullishOr(
+        buildEncodingRecord(media.encoding)
+      )
+    })
+  );
+  if (contents.length === 0) return void 0;
+  const defaultContent = contents[0];
+  return OperationRequestBody.make({
+    required: body.required === true,
+    contentType: defaultContent.contentType,
+    schema: defaultContent.schema,
+    contents: Option2.some(contents)
+  });
+};
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var stringType = (schema) => schema.type === "string" || Array.isArray(schema.type) && schema.type.includes("string");
+var numericType = (schema) => schema.type === "integer" || schema.type === "number" || Array.isArray(schema.type) && (schema.type.includes("integer") || schema.type.includes("number"));
+var normalizedMediaType = (mediaType) => mediaType.split(";")[0]?.trim().toLowerCase() ?? "";
+var isJsonMediaType = (mediaType) => {
+  const normalized = normalizedMediaType(mediaType);
+  return normalized === "application/json" || normalized.includes("+json") || normalized.includes("json");
+};
+var binaryStringSchema = (schema) => stringType(schema) && (schema.format === "binary" || schema.format === "byte");
+var base64EncodingFromDescription = (schema) => typeof schema.description === "string" && /base64url|base64-url|url[- ]safe/i.test(schema.description) ? "base64url" : "base64";
+var detectFileHint = (schema, mediaType, r) => {
+  const resolved = isRecord(schema) ? r.resolve(schema) : null;
+  if (!resolved) return void 0;
+  if (!isJsonMediaType(mediaType) && binaryStringSchema(resolved)) {
+    return OperationFileHint.make({
+      kind: "binaryResponse",
+      mimeType: Option2.some(mediaType),
+      dataField: Option2.none(),
+      sizeField: Option2.none(),
+      encoding: Option2.none()
+    });
+  }
+  if (!isJsonMediaType(mediaType)) return void 0;
+  const properties = resolved.properties;
+  if (!isRecord(properties)) return void 0;
+  const data = properties.data;
+  const dataSchema = isRecord(data) ? r.resolve(data) : null;
+  if (!dataSchema || !binaryStringSchema(dataSchema)) return void 0;
+  const size = properties.size;
+  const sizeSchema = isRecord(size) ? r.resolve(size) : null;
+  const sizeField = sizeSchema && numericType(sizeSchema) ? "size" : void 0;
+  return OperationFileHint.make({
+    kind: "byteField",
+    mimeType: Option2.some("application/octet-stream"),
+    dataField: Option2.some("data"),
+    sizeField: sizeField ? Option2.some(sizeField) : Option2.none(),
+    encoding: Option2.some(base64EncodingFromDescription(dataSchema))
+  });
+};
+var extractResponseBody = (operation, r) => {
+  if (!operation.responses) return void 0;
+  const entries = Object.entries(operation.responses);
+  const preferred = [
+    ...entries.filter(([s]) => /^2\d\d$/.test(s)).sort(([a], [b]) => a.localeCompare(b)),
+    ...entries.filter(([s]) => /^2xx$/i.test(s)),
+    ...entries.filter(([s]) => s === "default")
+  ];
+  for (const [, ref] of preferred) {
+    const resp = r.resolve(ref);
+    if (!resp) continue;
+    const content = preferredResponseContent(resp.content);
+    if (content?.media.schema) {
+      return OperationResponseBody.make({
+        contentType: content.mediaType,
+        schema: Option2.some(content.media.schema),
+        fileHint: Option2.fromNullishOr(detectFileHint(content.media.schema, content.mediaType, r))
+      });
+    }
+  }
+  return void 0;
+};
+var outputSchemaFromResponseBody = (responseBody) => {
+  const schema = Option2.getOrUndefined(responseBody.schema);
+  if (schema === void 0) return void 0;
+  return isNdjsonMediaType(responseBody.contentType) ? ndjsonArrayOutputSchema(schema) : schema;
+};
+var buildServerInputProperty = (servers) => {
+  const variableDefs = {};
+  for (const server of servers) {
+    for (const [name, v] of Object.entries(Option2.getOrUndefined(server.variables) ?? {})) {
+      if (!(name in variableDefs)) variableDefs[name] = v;
+    }
+  }
+  const hasMultiple = servers.length > 1;
+  const variableNames = Object.keys(variableDefs);
+  if (!hasMultiple && variableNames.length === 0) return void 0;
+  const properties = {};
+  if (hasMultiple) {
+    properties.url = {
+      type: "string",
+      enum: servers.map((server) => server.url),
+      default: servers[0].url,
+      description: "Which of the spec's servers to send the request to."
+    };
+  }
+  if (variableNames.length > 0) {
+    properties.variables = {
+      type: "object",
+      additionalProperties: false,
+      properties: Object.fromEntries(
+        Object.entries(variableDefs).map(([name, v]) => [
+          name,
+          {
+            type: "string",
+            default: v.default,
+            ...Option2.isSome(v.enum) ? { enum: v.enum.value } : {},
+            ...Option2.isSome(v.description) ? { description: v.description.value } : {}
+          }
+        ])
+      ),
+      description: "Values for the server URL `{variables}`; spec defaults apply when omitted."
+    };
+  }
+  return {
+    type: "object",
+    additionalProperties: false,
+    properties,
+    description: "Optional host selection and server-URL variables for this request."
+  };
+};
+var buildInputSchema = (parameters, requestBody, servers) => {
+  const properties = {};
+  const required = [];
+  let requiredBodyAlternatives;
+  for (const param of parameters) {
+    properties[param.name] = Option2.getOrElse(param.schema, () => ({ type: "string" }));
+    if (param.required) required.push(param.name);
+  }
+  const serverProperty = buildServerInputProperty(servers);
+  if (serverProperty && !("server" in properties)) properties.server = serverProperty;
+  if (requestBody) {
+    const contents = Option2.getOrUndefined(requestBody.contents);
+    const defaultIsOctetStream = requestBody.contentType.split(";")[0]?.trim().toLowerCase() === "application/octet-stream";
+    const acceptsOctetStream = defaultIsOctetStream || contents?.some(
+      (content) => content.contentType.split(";")[0]?.trim().toLowerCase() === "application/octet-stream"
+    ) === true;
+    const acceptsBody = !defaultIsOctetStream || contents?.some(
+      (content) => content.contentType.split(";")[0]?.trim().toLowerCase() !== "application/octet-stream"
+    ) === true;
+    if (acceptsBody) {
+      properties.body = Option2.getOrElse(requestBody.schema, () => ({ type: "object" }));
+    }
+    if (acceptsOctetStream) {
+      properties.bodyBase64 = {
+        type: "string",
+        contentEncoding: "base64",
+        contentMediaType: "application/octet-stream",
+        description: "Base64-encoded bytes for application/octet-stream request bodies. When contentType is omitted, this selects application/octet-stream."
+      };
+    }
+    if (requestBody.required) {
+      if (acceptsOctetStream && acceptsBody) {
+        requiredBodyAlternatives = [{ required: ["body"] }, { required: ["bodyBase64"] }];
+      } else {
+        required.push(acceptsOctetStream ? "bodyBase64" : "body");
+      }
+    }
+    if (contents && contents.length > 1) {
+      properties.contentType = {
+        type: "string",
+        enum: contents.map((c) => c.contentType),
+        default: requestBody.contentType,
+        description: "Content-Type for the request body. Declared media types for this operation, in spec order."
+      };
+    }
+  }
+  if (Object.keys(properties).length === 0) return void 0;
+  return {
+    type: "object",
+    properties,
+    ...required.length > 0 ? { required } : {},
+    ...requiredBodyAlternatives ? { anyOf: requiredBodyAlternatives } : {},
+    additionalProperties: false
+  };
+};
+var deriveOperationId = (method, pathTemplate, operation) => operation.operationId ?? (`${method}_${pathTemplate.replace(/[^a-zA-Z0-9]+/g, "_")}`.replace(/^_+|_+$/g, "") || `${method}_operation`);
+var explicitToolPath = (operation) => {
+  const value = operation["x-executor-toolPath"];
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+};
+var explicitPathTemplate = (operation) => {
+  const value = operation["x-executor-pathTemplate"];
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+};
+var extractServerList = (servers) => (servers ?? []).flatMap((server) => {
+  if (!server.url) return [];
+  const serverVariables = server.variables;
+  const vars = serverVariables ? Object.fromEntries(
+    Object.entries(serverVariables).flatMap(([name, v]) => {
+      if (v.default === void 0 || v.default === null) return [];
+      const enumValues = Array.isArray(v.enum) ? v.enum.filter((x) => typeof x === "string") : void 0;
+      return [
+        [
+          name,
+          ServerVariable.make({
+            default: String(v.default),
+            enum: enumValues && enumValues.length > 0 ? Option2.some(enumValues) : Option2.none(),
+            description: Option2.fromNullishOr(v.description)
+          })
+        ]
+      ];
+    })
+  ) : void 0;
+  return [
+    ServerInfo.make({
+      url: server.url,
+      description: Option2.fromNullishOr(server.description),
+      variables: vars && Object.keys(vars).length > 0 ? Option2.some(vars) : Option2.none()
+    })
+  ];
+});
+var extractServers = (doc) => extractServerList(doc.servers);
+var operationServers = (pathItem, operation, docServers) => {
+  const operationLevel = extractServerList(operation.servers);
+  if (operationLevel.length > 0) return operationLevel;
+  const pathLevel = extractServerList(pathItem.servers);
+  if (pathLevel.length > 0) return pathLevel;
+  return docServers;
+};
+var securityScopeAlternatives = (operation, documentSecurity) => {
+  const security = operation.security !== void 0 ? operation.security : documentSecurity;
+  if (!Array.isArray(security) || security.length === 0) return void 0;
+  const alternatives = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const requirement of security) {
+    if (requirement === null || typeof requirement !== "object") continue;
+    const scopes = /* @__PURE__ */ new Set();
+    for (const schemeScopes of Object.values(requirement)) {
+      if (!Array.isArray(schemeScopes)) continue;
+      for (const scope of schemeScopes) {
+        if (typeof scope === "string" && scope.trim().length > 0) scopes.add(scope);
+      }
+    }
+    if (scopes.size === 0) continue;
+    const alternative = [...scopes].sort();
+    const key = alternative.join(" ");
+    if (seen.has(key)) continue;
+    seen.add(key);
+    alternatives.push(alternative);
+  }
+  return alternatives.length > 0 ? alternatives : void 0;
+};
+var documentSecurityOf = (doc) => doc !== null && typeof doc === "object" && !Array.isArray(doc) ? doc.security : void 0;
+var extract = Effect2.fn("OpenApi.extract")(function* (doc) {
+  const paths = doc.paths;
+  if (!paths) {
+    return yield* new OpenApiExtractionError({
+      message: "OpenAPI document has no paths defined"
+    });
+  }
+  const r = new DocResolver(doc);
+  const docServers = extractServers(doc);
+  const operations = [];
+  for (const [pathTemplate, pathItem] of Object.entries(paths).sort(
+    ([a], [b]) => a.localeCompare(b)
+  )) {
+    if (!pathItem) continue;
+    for (const method of HTTP_METHODS) {
+      const operation = pathItem[method];
+      if (!operation) continue;
+      const parameters = extractParameters(pathItem, operation, r);
+      const requestBody = extractRequestBody(operation, r);
+      const responseBody = extractResponseBody(operation, r);
+      const servers = operationServers(pathItem, operation, docServers);
+      const inputSchema = buildInputSchema(parameters, requestBody, servers);
+      const outputSchema = responseBody ? outputSchemaFromResponseBody(responseBody) : void 0;
+      const tags = (operation.tags ?? []).filter((t) => t.trim().length > 0);
+      const operationPathTemplate = explicitPathTemplate(operation) ?? pathTemplate;
+      const requiredScopeAlternatives = securityScopeAlternatives(
+        operation,
+        documentSecurityOf(doc)
+      );
+      operations.push(
+        ExtractedOperation.make({
+          operationId: OperationId.make(deriveOperationId(method, pathTemplate, operation)),
+          toolPath: Option2.fromNullishOr(explicitToolPath(operation)),
+          method,
+          servers,
+          pathTemplate: operationPathTemplate,
+          summary: Option2.fromNullishOr(operation.summary),
+          description: Option2.fromNullishOr(operation.description),
+          tags,
+          parameters,
+          requestBody: Option2.fromNullishOr(requestBody),
+          responseBody: Option2.fromNullishOr(responseBody),
+          inputSchema: Option2.fromNullishOr(inputSchema),
+          outputSchema: Option2.fromNullishOr(outputSchema),
+          deprecated: operation.deprecated === true,
+          ...requiredScopeAlternatives ? { requiredScopeAlternatives } : {}
+        })
+      );
+    }
+  }
+  return ExtractionResult.make({
+    title: Option2.fromNullishOr(doc.info?.title),
+    description: Option2.fromNullishOr(doc.info?.description),
+    version: Option2.fromNullishOr(doc.info?.version),
+    servers: docServers,
+    operations
+  });
+});
+var streamOperationBindings = (doc, chunkSize, onChunk) => Effect2.gen(function* () {
+  const paths = doc.paths;
+  if (!paths) {
+    return yield* new OpenApiExtractionError({
+      message: "OpenAPI document has no paths defined"
+    });
+  }
+  const r = new DocResolver(doc);
+  const docServers = extractServers(doc);
+  const inputs = [];
+  const opRefs = [];
+  for (const [pathTemplate, pathItem] of Object.entries(paths).sort(
+    ([a], [b]) => a.localeCompare(b)
+  )) {
+    if (!pathItem) continue;
+    for (const method of HTTP_METHODS) {
+      const operation = pathItem[method];
+      if (!operation) continue;
+      const resolvedPathTemplate = explicitPathTemplate(operation) ?? pathTemplate;
+      const tags = (operation.tags ?? []).filter((t) => t.trim().length > 0);
+      inputs.push({
+        operationId: deriveOperationId(method, pathTemplate, operation),
+        explicitToolPath: explicitToolPath(operation),
+        method,
+        pathTemplate: resolvedPathTemplate,
+        tag0: tags[0]
+      });
+      opRefs.push({ pathItem, operation, method, pathTemplate: resolvedPathTemplate });
+    }
+  }
+  const plans = planToolPaths(inputs);
+  let chunk = [];
+  for (const plan of plans) {
+    const ref = opRefs[plan.operationIndex];
+    const parameters = extractParameters(ref.pathItem, ref.operation, r);
+    const requestBody = extractRequestBody(ref.operation, r);
+    const responseBody = extractResponseBody(ref.operation, r);
+    const servers = operationServers(ref.pathItem, ref.operation, docServers);
+    const requiredScopeAlternatives = securityScopeAlternatives(
+      ref.operation,
+      documentSecurityOf(doc)
+    );
+    chunk.push({
+      toolName: plan.toolPath,
+      description: ref.operation.description ?? ref.operation.summary ?? `${ref.method.toUpperCase()} ${ref.pathTemplate}`,
+      binding: OperationBinding.make({
+        method: ref.method,
+        servers,
+        pathTemplate: ref.pathTemplate,
+        parameters,
+        requestBody: Option2.fromNullishOr(requestBody),
+        responseBody: Option2.fromNullishOr(responseBody),
+        ...requiredScopeAlternatives ? { requiredScopeAlternatives } : {}
+      })
+    });
+    if (chunk.length >= chunkSize) {
+      yield* onChunk(chunk);
+      chunk = [];
+    }
+  }
+  if (chunk.length > 0) yield* onChunk(chunk);
+  return { toolCount: plans.length, toolNames: plans.map((plan) => plan.toolPath) };
+}).pipe(Effect2.withSpan("OpenApi.streamOperationBindings"));
+var isPathItemValue = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var streamOperationBindingsFromStructure = (structure, options, onChunk) => Effect2.gen(function* () {
+  const { chunkSize, keepPathItem } = options;
+  const keptPathItem = (range) => {
+    const entry = parseEntry(structure.text, range, 2);
+    if (!entry) return null;
+    const [path, rawValue] = entry;
+    if (!isPathItemValue(rawValue)) return null;
+    if (!keepPathItem) return [path, rawValue];
+    const kept = keepPathItem(path, rawValue);
+    return kept ? [path, kept] : null;
+  };
+  const inputs = [];
+  for (const range of structure.pathItems) {
+    const kept = keptPathItem(range);
+    if (!kept) continue;
+    const [path, pathItem] = kept;
+    for (const method of HTTP_METHODS) {
+      const operation = pathItem[method];
+      if (!operation) continue;
+      const resolvedPathTemplate = explicitPathTemplate(operation) ?? path;
+      const tags = (operation.tags ?? []).filter((t) => t.trim().length > 0);
+      inputs.push({
+        operationId: deriveOperationId(method, path, operation),
+        explicitToolPath: explicitToolPath(operation),
+        method,
+        pathTemplate: resolvedPathTemplate,
+        tag0: tags[0]
+      });
+    }
+  }
+  const plans = planToolPaths(inputs);
+  const planByOpIndex = new Array(inputs.length);
+  for (const plan of plans) planByOpIndex[plan.operationIndex] = plan;
+  const resolverDoc = {
+    ...parseHead(structure),
+    paths: {},
+    components: parseSmallComponents(structure)
+  };
+  const r = new DocResolver(resolverDoc);
+  const docServers = extractServers(resolverDoc);
+  let opIndex = 0;
+  let chunk = [];
+  for (const range of structure.pathItems) {
+    const kept = keptPathItem(range);
+    if (!kept) continue;
+    const [path, pathItem] = kept;
+    for (const method of HTTP_METHODS) {
+      const operation = pathItem[method];
+      if (!operation) continue;
+      const plan = planByOpIndex[opIndex];
+      opIndex += 1;
+      if (!plan) continue;
+      const resolvedPathTemplate = explicitPathTemplate(operation) ?? path;
+      const parameters = extractParameters(pathItem, operation, r);
+      const requestBody = extractRequestBody(operation, r);
+      const responseBody = extractResponseBody(operation, r);
+      const servers = operationServers(pathItem, operation, docServers);
+      const requiredScopeAlternatives = securityScopeAlternatives(
+        operation,
+        documentSecurityOf(resolverDoc)
+      );
+      chunk.push({
+        toolName: plan.toolPath,
+        description: operation.description ?? operation.summary ?? `${method.toUpperCase()} ${resolvedPathTemplate}`,
+        binding: OperationBinding.make({
+          method,
+          servers,
+          pathTemplate: resolvedPathTemplate,
+          parameters,
+          requestBody: Option2.fromNullishOr(requestBody),
+          responseBody: Option2.fromNullishOr(responseBody),
+          ...requiredScopeAlternatives ? { requiredScopeAlternatives } : {}
+        })
+      });
+      if (chunk.length >= chunkSize) {
+        yield* onChunk(chunk);
+        chunk = [];
+      }
+    }
+  }
+  if (chunk.length > 0) yield* onChunk(chunk);
+  return { toolCount: plans.length, toolNames: plans.map((plan) => plan.toolPath) };
+}).pipe(Effect2.withSpan("OpenApi.streamOperationBindingsFromStructure"));
+
+// src/sdk/invoke.ts
+import { Effect as Effect3, Exit, Fiber, Layer, Option as Option3, Schema as Schema3, Stream } from "effect";
+import { HttpClient as HttpClient2, HttpClientRequest as HttpClientRequest2 } from "effect/unstable/http";
+var CONTAINER_KEYS = {
+  path: ["path", "pathParams", "params"],
+  query: ["query", "queryParams", "params"],
+  header: ["headers", "header"],
+  cookie: ["cookies", "cookie"]
+};
+var readParamValue = (args, param) => {
+  const direct = args[param.name];
+  if (direct !== void 0) return direct;
+  for (const key of CONTAINER_KEYS[param.location] ?? []) {
+    const container = args[key];
+    if (typeof container === "object" && container !== null && !Array.isArray(container)) {
+      const nested = container[param.name];
+      if (nested !== void 0) return nested;
+    }
+  }
+  return void 0;
+};
+var primitiveToString = (value) => typeof value === "object" && value !== null ? JSON.stringify(value) : String(value);
+var RESERVED_UNENCODED_RE = /[A-Za-z0-9\-._~:/?#[\]@!$&'()*+,;=]/;
+var encodeReservedAware = (raw, allowReserved) => {
+  if (!allowReserved) return encodeURIComponent(raw);
+  let out = "";
+  for (const ch of raw) {
+    out += RESERVED_UNENCODED_RE.test(ch) ? ch : encodeURIComponent(ch);
+  }
+  return out;
+};
+var queryParamValues = (value, param) => {
+  if (value === void 0 || value === null) return [];
+  if (!Array.isArray(value)) return [primitiveToString(value)];
+  const style = Option3.getOrUndefined(param.style) ?? "form";
+  const explode = Option3.getOrElse(param.explode, () => true);
+  if (explode) return value.map(primitiveToString);
+  const separator = style === "spaceDelimited" ? " " : style === "pipeDelimited" ? "|" : ",";
+  return [value.map(primitiveToString).join(separator)];
+};
+var resolvePath = Effect3.fn("OpenApi.resolvePath")(function* (pathTemplate, args, parameters) {
+  let resolved = pathTemplate;
+  for (const param of parameters) {
+    if (param.location !== "path") continue;
+    const value = readParamValue(args, param);
+    if (value === void 0 || value === null) {
+      if (param.required) {
+        return yield* new OpenApiInvocationError({
+          message: `Missing required path parameter: ${param.name}`,
+          statusCode: Option3.none()
+        });
+      }
+      continue;
+    }
+    const encoded = encodeReservedAware(
+      String(value),
+      Option3.getOrElse(param.allowReserved, () => false)
+    );
+    resolved = resolved.replaceAll(`{${param.name}}`, encoded);
+    resolved = resolved.replaceAll(`{+${param.name}}`, encoded);
+  }
+  const remaining = [...resolved.matchAll(/\{([^{}]+)\}/g)].map((m) => m[1]).filter((v) => typeof v === "string");
+  for (const name of remaining) {
+    const value = args[name];
+    if (value !== void 0 && value !== null) {
+      resolved = resolved.replaceAll(`{${name}}`, encodeURIComponent(String(value)));
+    }
+  }
+  const unresolved = [...resolved.matchAll(/\{([^{}]+)\}/g)].map((m) => m[1]).filter((v) => typeof v === "string");
+  if (unresolved.length > 0) {
+    return yield* new OpenApiInvocationError({
+      message: `Unresolved path parameters: ${[...new Set(unresolved)].join(", ")}`,
+      statusCode: Option3.none()
+    });
+  }
+  return resolved;
+});
+var DEFAULT_USER_AGENT = "executor";
+var applyHeaders = (request, headers) => {
+  let req = request;
+  for (const [name, value] of Object.entries(headers)) {
+    req = HttpClientRequest2.setHeader(req, name, value);
+  }
+  return req;
+};
+var normalizeContentType = (ct) => ct?.split(";")[0]?.trim().toLowerCase() ?? "";
+var STREAM_MAX_BYTES = 1e6;
+var STREAM_MAX_MS = 1e4;
+var RESPONSE_HEADERS_TIMEOUT_MS = 11e4;
+var StreamCapReached = class extends Error {
+  _tag = "StreamCapReached";
+};
+var formatTimeout = (timeoutMs) => timeoutMs % 1e3 === 0 ? `${timeoutMs / 1e3}s` : `${timeoutMs}ms`;
+var responseHeadersTimeoutMessage = (timeoutMs) => `Upstream returned no response headers within ${formatTimeout(timeoutMs)}. The endpoint may be a live stream with no data to send (for example, runtime logs of an idle deployment); the request was aborted. Retry when the resource has activity, or use a non-streaming endpoint.`;
+var STREAMING_RESPONSE_CONTENT_TYPES = /* @__PURE__ */ new Set([...NDJSON_MEDIA_TYPES, "text/event-stream"]);
+var isStreamingResponseContentType = (ct) => STREAMING_RESPONSE_CONTENT_TYPES.has(normalizeContentType(ct));
+var isJsonContentType = (ct) => {
+  const normalized = normalizeContentType(ct);
+  if (!normalized) return false;
+  return normalized === "application/json" || normalized.includes("+json") || normalized.includes("json");
+};
+var isFormUrlEncoded = (ct) => normalizeContentType(ct) === "application/x-www-form-urlencoded";
+var isMultipartFormData = (ct) => normalizeContentType(ct).startsWith("multipart/form-data");
+var isXmlContentType = (ct) => {
+  const normalized = normalizeContentType(ct);
+  if (!normalized) return false;
+  return normalized === "application/xml" || normalized === "text/xml" || normalized.endsWith("+xml");
+};
+var isTextContentType = (ct) => normalizeContentType(ct).startsWith("text/");
+var isOctetStream = (ct) => normalizeContentType(ct) === "application/octet-stream";
+var decodeJsonLine = Schema3.decodeUnknownExit(Schema3.fromJsonString(Schema3.Unknown));
+var parseStreamingJsonLines = (text, truncated) => {
+  const lines = text.split(/\r?\n/);
+  let lastNonEmptyIndex = -1;
+  for (let index = lines.length - 1; index >= 0; index--) {
+    const line = lines[index];
+    if (line !== void 0 && line.trim() !== "") {
+      lastNonEmptyIndex = index;
+      break;
+    }
+  }
+  const rows = [];
+  for (let index = 0; index < lines.length; index++) {
+    const line = lines[index];
+    if (line === void 0 || line.trim() === "") continue;
+    const parsed = decodeJsonLine(line);
+    if (Exit.isSuccess(parsed)) {
+      rows.push(parsed.value);
+      continue;
+    }
+    if (truncated && index === lastNonEmptyIndex) continue;
+    return text;
+  }
+  return rows;
+};
+var decodeStreamingResponseBody = (contentType, text, truncated) => isNdjsonMediaType(contentType) ? parseStreamingJsonLines(text, truncated) : text;
+var collectStreamingBody = (stream, contentType, caps = {}) => Effect3.gen(function* () {
+  const maxBytes = caps.maxBytes ?? STREAM_MAX_BYTES;
+  const maxMs = caps.maxMs ?? STREAM_MAX_MS;
+  const chunks = [];
+  let bytes = 0;
+  let truncated = false;
+  const startedAt = Date.now();
+  const runFork = Effect3.runForkWith(yield* Effect3.context());
+  const completedExitOption = yield* Effect3.callback(
+    (resume, signal) => {
+      let settled = false;
+      const collectEffect = stream.pipe(
+        Stream.timeout(maxMs),
+        Stream.runForEach(
+          (chunk) => Effect3.gen(function* () {
+            const remaining = maxBytes - bytes;
+            if (remaining <= 0) {
+              truncated = true;
+              return yield* Effect3.fail(new StreamCapReached());
+            }
+            if (chunk.byteLength > remaining) {
+              chunks.push(chunk.subarray(0, remaining));
+              bytes += remaining;
+              truncated = true;
+              return yield* Effect3.fail(new StreamCapReached());
+            }
+            chunks.push(chunk);
+            bytes += chunk.byteLength;
+            if (bytes >= maxBytes) {
+              truncated = true;
+              return yield* Effect3.fail(new StreamCapReached());
+            }
+          })
+        ),
+        Effect3.catch(
+          (error) => error instanceof StreamCapReached ? Effect3.void : Effect3.fail(error)
+        ),
+        Effect3.exit,
+        Effect3.tap(
+          (exit) => Effect3.sync(() => {
+            if (settled) return;
+            settled = true;
+            clearTimeout(timer);
+            resume(Effect3.succeed(Option3.some(exit)));
+          })
+        )
+      );
+      const fiber = runFork(collectEffect);
+      const interrupt = () => {
+        runFork(Fiber.interrupt(fiber));
+      };
+      const timer = setTimeout(() => {
+        if (settled) return;
+        settled = true;
+        truncated = true;
+        interrupt();
+        resume(Effect3.succeed(Option3.none()));
+      }, maxMs + 1e3);
+      signal.addEventListener("abort", interrupt, { once: true });
+      return Effect3.sync(() => {
+        clearTimeout(timer);
+        signal.removeEventListener("abort", interrupt);
+        if (!settled) interrupt();
+      });
+    }
+  );
+  if (Option3.isSome(completedExitOption) && Exit.isFailure(completedExitOption.value)) {
+    return yield* Effect3.failCause(completedExitOption.value.cause);
+  }
+  if (Option3.isNone(completedExitOption)) truncated = true;
+  const durationMs = Date.now() - startedAt;
+  if (durationMs >= maxMs) truncated = true;
+  const collected = new Uint8Array(bytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    collected.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  const text = new TextDecoder("utf-8").decode(collected);
+  return {
+    data: decodeStreamingResponseBody(contentType, text, truncated),
+    headers: {
+      "x-executor-stream": truncated ? "truncated" : "complete",
+      "x-executor-stream-bytes": String(bytes),
+      "x-executor-stream-duration-ms": String(durationMs)
+    }
+  };
+});
+var bytesToBase64 = (bytes) => {
+  let binary = "";
+  const chunkSize = 32768;
+  for (let i = 0; i < bytes.length; i += chunkSize) {
+    binary += String.fromCharCode(...bytes.subarray(i, i + chunkSize));
+  }
+  return btoa(binary);
+};
+var normalizeBase64 = (value, encoding) => {
+  const compact = value.replace(/\s/g, "");
+  const alphabet = encoding === "base64url" ? compact.replace(/-/g, "+").replace(/_/g, "/") : compact;
+  const remainder = alphabet.length % 4;
+  return remainder === 0 ? alphabet : `${alphabet}${"=".repeat(4 - remainder)}`;
+};
+var byteLengthFromBase64 = (base64) => {
+  const compact = base64.replace(/\s/g, "");
+  const padding = compact.endsWith("==") ? 2 : compact.endsWith("=") ? 1 : 0;
+  return Math.max(0, Math.floor(compact.length * 3 / 4) - padding);
+};
+var isGenericMimeType = (mimeType) => normalizeContentType(mimeType) === "application/octet-stream";
+var startsWithBytes = (bytes, prefix) => prefix.every((byte, index) => bytes[index] === byte);
+var isLikelyUtf8Text = (bytes) => {
+  if (bytes.length === 0) return false;
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return false;
+  }
+  let suspicious = 0;
+  for (let index = 0; index < text.length; index += 1) {
+    const code = text.charCodeAt(index);
+    const allowedControl = code === 9 || code === 10 || code === 12 || code === 13;
+    if (code === 0) return false;
+    if (code < 32 && !allowedControl) suspicious += 1;
+  }
+  return suspicious / Math.max(1, text.length) <= 0.02;
+};
+var sniffMimeType = (bytes) => {
+  if (startsWithBytes(bytes, [255, 216, 255])) return "image/jpeg";
+  if (startsWithBytes(bytes, [137, 80, 78, 71, 13, 10, 26, 10])) {
+    return "image/png";
+  }
+  if (startsWithBytes(bytes, [71, 73, 70, 56, 55, 97]) || startsWithBytes(bytes, [71, 73, 70, 56, 57, 97])) {
+    return "image/gif";
+  }
+  if (startsWithBytes(bytes, [82, 73, 70, 70]) && bytes[8] === 87 && bytes[9] === 69 && bytes[10] === 66 && bytes[11] === 80) {
+    return "image/webp";
+  }
+  if (startsWithBytes(bytes, [37, 80, 68, 70, 45])) return "application/pdf";
+  if (startsWithBytes(bytes, [80, 75, 3, 4]) || startsWithBytes(bytes, [80, 75, 5, 6]) || startsWithBytes(bytes, [80, 75, 7, 8])) {
+    return "application/zip";
+  }
+  if (isLikelyUtf8Text(bytes)) return "text/plain";
+  return null;
+};
+var bytesFromBase64Prefix = (base64) => {
+  const prefix = base64.slice(0, Math.min(base64.length, 64));
+  const binary = atob(prefix);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
+};
+var sniffMimeTypeFromBase64 = (base64) => sniffMimeType(bytesFromBase64Prefix(base64));
+var base64ToUint8Array = (value) => {
+  let binary = "";
+  try {
+    binary = atob(normalizeBase64(value, "base64"));
+  } catch {
+    return null;
+  }
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
+};
+var decodeBase64Body = (value) => {
+  const bytes = base64ToUint8Array(value);
+  return bytes ? { ok: true, bytes } : { ok: false };
+};
+var toUint8Array = (value) => {
+  if (value instanceof Uint8Array) return value;
+  if (value instanceof ArrayBuffer) return new Uint8Array(value);
+  if (ArrayBuffer.isView(value)) {
+    const view = value;
+    return new Uint8Array(view.buffer, view.byteOffset, view.byteLength);
+  }
+  if (Array.isArray(value) && value.every((v) => typeof v === "number")) {
+    return new Uint8Array(value);
+  }
+  return null;
+};
+var readNestedBodyBase64 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.prototype.hasOwnProperty.call(value, "bodyBase64") ? value.bodyBase64 : void 0;
+var readHintString = (option, fallback) => Option3.getOrElse(option, () => fallback);
+var readHintMimeType = (hint, fallback) => Option3.getOrElse(hint.mimeType, () => fallback);
+var readHintEncoding = (hint) => Option3.getOrElse(hint.encoding, () => "base64");
+var fileFromByteField = (body, hint) => {
+  if (typeof body !== "object" || body === null || Array.isArray(body)) return null;
+  const record = body;
+  const dataField = readHintString(hint.dataField, "data");
+  const rawData = record[dataField];
+  if (typeof rawData !== "string") return null;
+  const data = normalizeBase64(rawData, readHintEncoding(hint));
+  const sizeField = Option3.getOrUndefined(hint.sizeField);
+  const byteLength = sizeField && typeof record[sizeField] === "number" ? record[sizeField] : byteLengthFromBase64(data);
+  const hintedMimeType = readHintMimeType(hint, "application/octet-stream");
+  return {
+    _tag: "ToolFile",
+    mimeType: isGenericMimeType(hintedMimeType) ? sniffMimeTypeFromBase64(data) ?? hintedMimeType : hintedMimeType,
+    encoding: "base64",
+    data,
+    byteLength
+  };
+};
+var fileFromBinaryBytes = (bytes, hint, contentType) => {
+  const hintedMimeType = contentType ?? readHintMimeType(hint, "application/octet-stream");
+  return {
+    _tag: "ToolFile",
+    mimeType: isGenericMimeType(hintedMimeType) ? sniffMimeType(bytes) ?? hintedMimeType : hintedMimeType,
+    encoding: "base64",
+    data: bytesToBase64(bytes),
+    byteLength: bytes.byteLength
+  };
+};
+var toArrayBuffer = (bytes) => {
+  const copy = new ArrayBuffer(bytes.byteLength);
+  new Uint8Array(copy).set(bytes);
+  return copy;
+};
+var DEFAULT_FORM_STYLE = {
+  style: "form",
+  explode: true,
+  allowReserved: false
+};
+var resolveStyleExplode = (e) => {
+  if (!e) return DEFAULT_FORM_STYLE;
+  return {
+    style: Option3.getOrElse(e.style, () => DEFAULT_FORM_STYLE.style),
+    explode: Option3.getOrElse(e.explode, () => DEFAULT_FORM_STYLE.explode),
+    allowReserved: Option3.getOrElse(e.allowReserved, () => DEFAULT_FORM_STYLE.allowReserved)
+  };
+};
+var encodeFormValue = (v, allowReserved) => {
+  const raw = typeof v === "object" && v !== null ? JSON.stringify(v) : String(v);
+  return encodeReservedAware(raw, allowReserved);
+};
+var serializeFormUrlEncoded = (value, encoding) => {
+  const parts = [];
+  for (const [key, raw] of Object.entries(value)) {
+    if (raw === void 0 || raw === null) continue;
+    const { style, explode, allowReserved } = resolveStyleExplode(encoding?.[key]);
+    const encKey = encodeURIComponent(key);
+    if (Array.isArray(raw)) {
+      if (explode) {
+        for (const v of raw) {
+          parts.push(`${encKey}=${encodeFormValue(v, allowReserved)}`);
+        }
+      } else {
+        const sep = style === "spaceDelimited" ? " " : style === "pipeDelimited" ? "|" : ",";
+        parts.push(
+          `${encKey}=${encodeFormValue(
+            raw.map((v) => typeof v === "object" ? JSON.stringify(v) : String(v)).join(sep),
+            allowReserved
+          )}`
+        );
+      }
+      continue;
+    }
+    if (typeof raw === "object") {
+      const entries = Object.entries(raw).filter(
+        ([, v]) => v !== void 0 && v !== null
+      );
+      if (style === "deepObject") {
+        for (const [subkey, subval] of entries) {
+          parts.push(
+            `${encodeURIComponent(`${key}[${subkey}]`)}=${encodeFormValue(subval, allowReserved)}`
+          );
+        }
+      } else if (explode) {
+        for (const [subkey, subval] of entries) {
+          parts.push(`${encodeURIComponent(subkey)}=${encodeFormValue(subval, allowReserved)}`);
+        }
+      } else {
+        const flat = entries.flatMap(([k, v]) => [
+          k,
+          typeof v === "object" ? JSON.stringify(v) : String(v)
+        ]);
+        parts.push(`${encKey}=${encodeFormValue(flat.join(","), allowReserved)}`);
+      }
+      continue;
+    }
+    parts.push(`${encKey}=${encodeFormValue(raw, allowReserved)}`);
+  }
+  return parts.join("&");
+};
+var coerceFormDataRecord = (value, encoding) => {
+  const out = {};
+  for (const [key, raw] of Object.entries(value)) {
+    if (raw === void 0 || raw === null) continue;
+    const partType = encoding?.[key] ? Option3.getOrUndefined(encoding[key].contentType) : void 0;
+    if (partType) {
+      const isJson = partType.startsWith("application/json") || partType.includes("+json");
+      const serialized = typeof raw === "string" ? raw : isJson ? JSON.stringify(raw) : typeof raw === "object" ? JSON.stringify(raw) : String(raw);
+      out[key] = new Blob([serialized], { type: partType });
+      continue;
+    }
+    if (typeof raw === "string" || typeof raw === "number" || typeof raw === "boolean" || raw instanceof Blob || typeof File !== "undefined" && raw instanceof File) {
+      out[key] = raw;
+      continue;
+    }
+    if (Array.isArray(raw)) {
+      out[key] = raw.map(
+        (v) => typeof v === "string" || typeof v === "number" || typeof v === "boolean" || v instanceof Blob || typeof File !== "undefined" && v instanceof File ? v : JSON.stringify(v)
+      );
+      continue;
+    }
+    const bytes = toUint8Array(raw);
+    if (bytes) {
+      out[key] = new Blob([toArrayBuffer(bytes)]);
+      continue;
+    }
+    out[key] = JSON.stringify(raw);
+  }
+  return out;
+};
+var applyRequestBody = (request, contentType, bodyValue, encoding) => {
+  if (isJsonContentType(contentType)) {
+    if (typeof bodyValue === "string") {
+      return HttpClientRequest2.bodyText(request, bodyValue, contentType);
+    }
+    return HttpClientRequest2.bodyJsonUnsafe(request, bodyValue);
+  }
+  if (isFormUrlEncoded(contentType)) {
+    if (typeof bodyValue === "string") {
+      return HttpClientRequest2.bodyText(request, bodyValue, contentType);
+    }
+    if (typeof bodyValue === "object" && bodyValue !== null && !Array.isArray(bodyValue)) {
+      const serialized = serializeFormUrlEncoded(bodyValue, encoding);
+      return HttpClientRequest2.bodyText(request, serialized, contentType);
+    }
+    return HttpClientRequest2.bodyUrlParams(
+      request,
+      bodyValue
+    );
+  }
+  if (isMultipartFormData(contentType)) {
+    if (bodyValue instanceof FormData) {
+      return HttpClientRequest2.bodyFormData(request, bodyValue);
+    }
+    if (typeof bodyValue === "object" && bodyValue !== null) {
+      return HttpClientRequest2.bodyFormDataRecord(
+        request,
+        coerceFormDataRecord(bodyValue, encoding)
+      );
+    }
+    return HttpClientRequest2.bodyText(request, String(bodyValue), contentType);
+  }
+  if (isOctetStream(contentType)) {
+    const bytes2 = toUint8Array(bodyValue);
+    if (bytes2) return HttpClientRequest2.bodyUint8Array(request, bytes2, contentType);
+    if (typeof bodyValue === "string") {
+      return HttpClientRequest2.bodyText(request, bodyValue, contentType);
+    }
+    return HttpClientRequest2.bodyText(request, JSON.stringify(bodyValue), contentType);
+  }
+  if (isXmlContentType(contentType) || isTextContentType(contentType)) {
+    if (typeof bodyValue === "string") {
+      return HttpClientRequest2.bodyText(request, bodyValue, contentType);
+    }
+    const bytes2 = toUint8Array(bodyValue);
+    if (bytes2) return HttpClientRequest2.bodyUint8Array(request, bytes2, contentType);
+    return HttpClientRequest2.bodyText(request, JSON.stringify(bodyValue), contentType);
+  }
+  if (typeof bodyValue === "string") {
+    return HttpClientRequest2.bodyText(request, bodyValue, contentType);
+  }
+  const bytes = toUint8Array(bodyValue);
+  if (bytes) return HttpClientRequest2.bodyUint8Array(request, bytes, contentType);
+  return HttpClientRequest2.bodyText(request, JSON.stringify(bodyValue), contentType);
+};
+var acceptedArgumentNames = (operation) => {
+  const accepted = /* @__PURE__ */ new Set();
+  for (const param of operation.parameters) {
+    accepted.add(param.name);
+    for (const container of CONTAINER_KEYS[param.location] ?? []) accepted.add(container);
+  }
+  for (const match of operation.pathTemplate.matchAll(/\{([^{}]+)\}/g)) {
+    if (match[1]) accepted.add(match[1]);
+  }
+  if (Option3.isSome(operation.requestBody)) {
+    const requestBody = operation.requestBody.value;
+    const contents = Option3.getOrUndefined(requestBody.contents);
+    accepted.add("body");
+    accepted.add("input");
+    if (isOctetStream(requestBody.contentType) || contents?.some((content) => isOctetStream(content.contentType))) {
+      accepted.add("bodyBase64");
+    }
+    if (contents && contents.length > 1) accepted.add("contentType");
+  }
+  const servers = operation.servers ?? [];
+  const hasServerVariables = servers.some(
+    (server) => Object.keys(Option3.getOrUndefined(server.variables) ?? {}).length > 0
+  );
+  if (servers.length > 1 || hasServerVariables) accepted.add("server");
+  return [...accepted];
+};
+var buildRequest = Effect3.fn("OpenApi.buildRequest")(function* (operation, args, resolvedHeaders, integrationQueryParams = {}) {
+  const accepted = acceptedArgumentNames(operation);
+  const acceptedSet = new Set(accepted);
+  const unknown = Object.keys(args).filter((name) => !acceptedSet.has(name));
+  if (unknown.length > 0) {
+    const label = unknown.length === 1 ? "Unknown argument" : "Unknown arguments";
+    const names = unknown.map((name) => JSON.stringify(name)).join(", ");
+    const acceptedMessage = accepted.length > 0 ? `This operation accepts: ${accepted.join(", ")}.` : "This operation accepts no arguments.";
+    return yield* new OpenApiInvocationError({
+      message: `${label} ${names}. ${acceptedMessage}`,
+      statusCode: Option3.none(),
+      reason: "unknown_arguments"
+    });
+  }
+  const resolvedPath = yield* resolvePath(operation.pathTemplate, args, operation.parameters);
+  const path = resolvedPath.startsWith("/") ? resolvedPath : `/${resolvedPath}`;
+  let request = HttpClientRequest2.make(operation.method.toUpperCase())(path);
+  request = HttpClientRequest2.setHeader(request, "User-Agent", DEFAULT_USER_AGENT);
+  for (const [name, value] of Object.entries(integrationQueryParams)) {
+    request = HttpClientRequest2.setUrlParam(request, name, value);
+  }
+  for (const param of operation.parameters) {
+    if (param.location !== "query") continue;
+    const value = readParamValue(args, param);
+    for (const paramValue of queryParamValues(value, param)) {
+      request = HttpClientRequest2.appendUrlParam(request, param.name, paramValue);
+    }
+  }
+  for (const param of operation.parameters) {
+    if (param.location !== "header") continue;
+    const value = readParamValue(args, param);
+    if (value === void 0 || value === null) continue;
+    request = HttpClientRequest2.setHeader(request, param.name, String(value));
+  }
+  const cookieValues = [];
+  for (const param of operation.parameters) {
+    if (param.location !== "cookie") continue;
+    const value = readParamValue(args, param);
+    if (value === void 0 || value === null) continue;
+    cookieValues.push(`${param.name}=${primitiveToString(value)}`);
+  }
+  if (Option3.isSome(operation.requestBody)) {
+    const rb = operation.requestBody.value;
+    const contentsOpt = Option3.getOrUndefined(rb.contents);
+    const requestedCt = typeof args.contentType === "string" ? args.contentType : void 0;
+    const octetStreamContent = contentsOpt?.find((c) => isOctetStream(c.contentType));
+    const bodyAcceptsOctetStream = Boolean(octetStreamContent) || isOctetStream(rb.contentType);
+    const hasBodyBase64 = Object.prototype.hasOwnProperty.call(args, "bodyBase64");
+    const bodyBase64Raw = args.bodyBase64;
+    const bodyBase64 = typeof bodyBase64Raw === "string" ? decodeBase64Body(bodyBase64Raw) : void 0;
+    if (hasBodyBase64 && typeof bodyBase64Raw !== "string") {
+      return yield* new OpenApiInvocationError({
+        message: "`bodyBase64` must be a base64 string",
+        statusCode: Option3.none()
+      });
+    }
+    if (bodyBase64?.ok === false) {
+      return yield* new OpenApiInvocationError({
+        message: "`bodyBase64` is not valid base64",
+        statusCode: Option3.none()
+      });
+    }
+    if (bodyBase64?.ok === true && !bodyAcceptsOctetStream) {
+      return yield* new OpenApiInvocationError({
+        message: "`bodyBase64` requires an application/octet-stream request body",
+        statusCode: Option3.none()
+      });
+    }
+    if (bodyBase64?.ok === true && requestedCt && !isOctetStream(requestedCt)) {
+      return yield* new OpenApiInvocationError({
+        message: "`bodyBase64` requires an application/octet-stream contentType",
+        statusCode: Option3.none()
+      });
+    }
+    const rawBodyValue = args.body ?? args.input;
+    const nestedBodyBase64Raw = readNestedBodyBase64(rawBodyValue);
+    const hasNestedBodyBase64 = nestedBodyBase64Raw !== void 0;
+    const nestedBodyBase64 = typeof nestedBodyBase64Raw === "string" ? decodeBase64Body(nestedBodyBase64Raw) : void 0;
+    if (hasNestedBodyBase64 && typeof nestedBodyBase64Raw !== "string") {
+      return yield* new OpenApiInvocationError({
+        message: "`body.bodyBase64` must be a base64 string",
+        statusCode: Option3.none()
+      });
+    }
+    if (nestedBodyBase64?.ok === false) {
+      return yield* new OpenApiInvocationError({
+        message: "`body.bodyBase64` is not valid base64",
+        statusCode: Option3.none()
+      });
+    }
+    if (nestedBodyBase64?.ok === true && !bodyAcceptsOctetStream) {
+      return yield* new OpenApiInvocationError({
+        message: "`body.bodyBase64` requires an application/octet-stream request body",
+        statusCode: Option3.none()
+      });
+    }
+    if (nestedBodyBase64?.ok === true && requestedCt && !isOctetStream(requestedCt)) {
+      return yield* new OpenApiInvocationError({
+        message: "`body.bodyBase64` requires an application/octet-stream contentType",
+        statusCode: Option3.none()
+      });
+    }
+    const binaryBody = bodyBase64?.ok === true ? bodyBase64 : nestedBodyBase64;
+    const bodyValue = binaryBody?.ok === true ? binaryBody.bytes : rawBodyValue;
+    if (rb.required && bodyValue === void 0) {
+      return yield* new OpenApiInvocationError({
+        message: bodyAcceptsOctetStream ? "Missing required request body: provide `bodyBase64`" : "Missing required request body",
+        statusCode: Option3.none()
+      });
+    }
+    if (bodyValue !== void 0) {
+      const selected = binaryBody?.ok === true && octetStreamContent ? octetStreamContent : contentsOpt && requestedCt ? contentsOpt.find((c) => c.contentType === requestedCt) : void 0;
+      const chosenCt = binaryBody?.ok === true && !octetStreamContent && isOctetStream(rb.contentType) ? rb.contentType : selected?.contentType ?? rb.contentType;
+      if (isOctetStream(chosenCt) && typeof bodyValue !== "string" && toUint8Array(bodyValue) === null) {
+        return yield* new OpenApiInvocationError({
+          message: "application/octet-stream request body must be bytes; provide `bodyBase64`",
+          statusCode: Option3.none()
+        });
+      }
+      const chosenEncoding = selected ? Option3.getOrUndefined(selected.encoding) : contentsOpt && contentsOpt[0] ? Option3.getOrUndefined(contentsOpt[0].encoding) : void 0;
+      request = applyRequestBody(request, chosenCt, bodyValue, chosenEncoding);
+    }
+  }
+  request = applyHeaders(request, resolvedHeaders);
+  if (cookieValues.length > 0) {
+    const existingCookie = request.headers.cookie;
+    const serializedCookies = cookieValues.join("; ");
+    request = HttpClientRequest2.setHeader(
+      request,
+      "Cookie",
+      existingCookie ? `${existingCookie}; ${serializedCookies}` : serializedCookies
+    );
+  }
+  return request;
+});
+var invoke = Effect3.fn("OpenApi.invoke")(function* (operation, args, resolvedHeaders, integrationQueryParams = {}, options = {}) {
+  const client = yield* HttpClient2.HttpClient;
+  yield* Effect3.annotateCurrentSpan({
+    "http.method": operation.method.toUpperCase(),
+    "http.route": operation.pathTemplate,
+    "plugin.openapi.method": operation.method.toUpperCase(),
+    "plugin.openapi.path_template": operation.pathTemplate,
+    "plugin.openapi.headers.resolved_count": Object.keys(resolvedHeaders).length
+  });
+  const request = yield* buildRequest(operation, args, resolvedHeaders, integrationQueryParams);
+  const responseHeadersTimeoutMs = options.responseHeadersTimeoutMs ?? RESPONSE_HEADERS_TIMEOUT_MS;
+  const runFork = Effect3.runForkWith(yield* Effect3.context());
+  const responseExitOption = yield* Effect3.callback((resume, signal) => {
+    let settled = false;
+    const responseEffect = client.execute(request).pipe(
+      Effect3.mapError(
+        (err) => new OpenApiInvocationError({
+          message: "HTTP request failed",
+          statusCode: Option3.none(),
+          cause: err
+        })
+      ),
+      Effect3.exit,
+      Effect3.tap(
+        (exit) => Effect3.sync(() => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          resume(Effect3.succeed(Option3.some(exit)));
+        })
+      )
+    );
+    const fiber = runFork(responseEffect);
+    const interrupt = () => {
+      runFork(Fiber.interrupt(fiber));
+    };
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      interrupt();
+      resume(Effect3.succeed(Option3.none()));
+    }, responseHeadersTimeoutMs);
+    signal.addEventListener("abort", interrupt, { once: true });
+    return Effect3.sync(() => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", interrupt);
+      if (!settled) interrupt();
+    });
+  });
+  if (Option3.isNone(responseExitOption)) {
+    return yield* new OpenApiInvocationError({
+      message: responseHeadersTimeoutMessage(responseHeadersTimeoutMs),
+      statusCode: Option3.none(),
+      reason: "response_headers_timeout"
+    });
+  }
+  const responseExit = responseExitOption.value;
+  if (Exit.isFailure(responseExit)) return yield* Effect3.failCause(responseExit.cause);
+  const response = responseExit.value;
+  const status = response.status;
+  yield* Effect3.annotateCurrentSpan({
+    "http.status_code": status
+  });
+  const responseHeaders = { ...response.headers };
+  const contentType = response.headers["content-type"] ?? null;
+  const mapBodyError = Effect3.mapError(
+    (err) => new OpenApiInvocationError({
+      message: "Failed to read response body",
+      statusCode: Option3.some(status),
+      cause: err
+    })
+  );
+  const responseBodyBinding = Option3.getOrUndefined(operation.responseBody);
+  const fileHint = responseBodyBinding ? Option3.getOrUndefined(responseBodyBinding.fileHint) : void 0;
+  const ok = status >= 200 && status < 300;
+  const streamingBody = ok && status !== 204 && fileHint?.kind !== "binaryResponse" && isStreamingResponseContentType(contentType) ? yield* collectStreamingBody(response.stream, contentType).pipe(mapBodyError) : null;
+  if (streamingBody) {
+    Object.assign(responseHeaders, streamingBody.headers);
+  }
+  const responseBody = status === 204 ? null : ok && fileHint?.kind === "binaryResponse" ? fileFromBinaryBytes(
+    new Uint8Array(yield* response.arrayBuffer.pipe(mapBodyError)),
+    fileHint,
+    contentType
+  ) : streamingBody ? streamingBody.data : isJsonContentType(contentType) ? yield* response.json.pipe(
+    Effect3.catch(() => response.text),
+    mapBodyError
+  ) : yield* response.text.pipe(mapBodyError);
+  const dataBody = ok && fileHint?.kind === "byteField" ? fileFromByteField(responseBody, fileHint) ?? responseBody : responseBody;
+  return InvocationResult.make({
+    status,
+    headers: responseHeaders,
+    data: ok ? dataBody : null,
+    error: ok ? null : responseBody
+  });
+});
+var resolveRequestHost = (servers, serverArg, baseUrl) => {
+  if (baseUrl) return baseUrl;
+  if (servers.length === 0) return "";
+  const arg = typeof serverArg === "object" && serverArg !== null && !Array.isArray(serverArg) ? serverArg : {};
+  const chosen = servers.find((server) => server.url === arg.url) ?? servers[0];
+  const overrides = {};
+  if (typeof arg.variables === "object" && arg.variables !== null) {
+    for (const [name, value] of Object.entries(arg.variables)) {
+      if (value != null && value !== "") overrides[name] = String(value);
+    }
+  }
+  return resolveServerUrl(chosen.url, Option3.getOrUndefined(chosen.variables), overrides);
+};
+var invokeWithLayer = (operation, args, baseUrl, resolvedHeaders, integrationQueryParams, httpClientLayer, options = {}) => {
+  const effectiveBaseUrl = resolveRequestHost(operation.servers ?? [], args.server, baseUrl);
+  const clientWithBaseUrl = effectiveBaseUrl ? Layer.effect(
+    HttpClient2.HttpClient,
+    Effect3.map(
+      Effect3.service(HttpClient2.HttpClient),
+      HttpClient2.mapRequest(HttpClientRequest2.prependUrl(effectiveBaseUrl))
+    )
+  ).pipe(Layer.provide(httpClientLayer)) : httpClientLayer;
+  return invoke(operation, args, resolvedHeaders, integrationQueryParams, options).pipe(
+    Effect3.provide(clientWithBaseUrl),
+    // `invoke` annotates http.status_code on ITS span (`OpenApi.invoke`,
+    // via Effect.fn) — annotateCurrentSpan inside it never reaches this
+    // wrapper span. Stamp the status here too so queries against
+    // `plugin.openapi.invoke` see the upstream outcome directly.
+    Effect3.tap((result) => Effect3.annotateCurrentSpan({ "http.status_code": result.status })),
+    Effect3.withSpan("plugin.openapi.invoke", {
+      attributes: {
+        "plugin.openapi.method": operation.method.toUpperCase(),
+        "plugin.openapi.path_template": operation.pathTemplate,
+        "plugin.openapi.base_url": effectiveBaseUrl
+      }
+    })
+  );
+};
+var REQUIRE_APPROVAL = /* @__PURE__ */ new Set(["post", "put", "patch", "delete"]);
+var annotationsForOperation = (method, pathTemplate) => {
+  const m = method.toLowerCase();
+  if (!REQUIRE_APPROVAL.has(m)) return {};
+  return {
+    requiresApproval: true,
+    approvalDescription: `${method.toUpperCase()} ${pathTemplate}`
+  };
+};
+
+// src/sdk/backing.ts
+import { Effect as Effect4, Option as Option4, Schema as Schema4 } from "effect";
+import {
+  ToolFileJsonSchema,
+  ToolName,
+  ToolResult,
+  authToolFailure,
+  classifyHttpStatus,
+  detectInsufficientScope,
+  sortHealthCheckCandidatesByIdentity,
+  extractIdentity,
+  extractResponseFields,
+  projectResponseFields
+} from "@rafads/sdk/core";
+var STRINGIFIED_BODY_CAP = 1024;
+var UpstreamMessageBody = Schema4.Struct({ message: Schema4.String });
+var UpstreamErrorMessageBody = Schema4.Struct({ errorMessage: Schema4.String });
+var UpstreamNestedErrorBody = Schema4.Struct({ error: UpstreamMessageBody });
+var UpstreamErrorsArrayBody = Schema4.Struct({
+  errors: Schema4.Array(
+    Schema4.Struct({
+      detail: Schema4.optional(Schema4.String),
+      message: Schema4.optional(Schema4.String),
+      title: Schema4.optional(Schema4.String)
+    })
+  )
+});
+var UpstreamDescriptionBody = Schema4.Struct({
+  detail: Schema4.optional(Schema4.String),
+  title: Schema4.optional(Schema4.String),
+  description: Schema4.optional(Schema4.String)
+});
+var decodeUpstreamMessageBody = Schema4.decodeUnknownOption(UpstreamMessageBody);
+var decodeUpstreamErrorMessageBody = Schema4.decodeUnknownOption(UpstreamErrorMessageBody);
+var decodeUpstreamNestedErrorBody = Schema4.decodeUnknownOption(UpstreamNestedErrorBody);
+var decodeUpstreamErrorsArrayBody = Schema4.decodeUnknownOption(UpstreamErrorsArrayBody);
+var decodeUpstreamDescriptionBody = Schema4.decodeUnknownOption(UpstreamDescriptionBody);
+var clampedStringify = (value) => {
+  let s;
+  try {
+    s = JSON.stringify(value);
+  } catch {
+    s = String(value);
+  }
+  return s.length > STRINGIFIED_BODY_CAP ? `${s.slice(0, STRINGIFIED_BODY_CAP)}\u2026` : s;
+};
+var firstNonEmpty = (...values) => values.find((value) => value !== void 0 && value.length > 0);
+var extractOpenApiUpstreamMessage = (body, status) => {
+  if (typeof body === "string") {
+    return body.length > 0 ? body : `Upstream returned HTTP ${status}`;
+  }
+  const nested = Option4.getOrUndefined(decodeUpstreamNestedErrorBody(body));
+  const messageBody = Option4.getOrUndefined(decodeUpstreamMessageBody(body));
+  const errorMessageBody = Option4.getOrUndefined(decodeUpstreamErrorMessageBody(body));
+  const errorsBody = Option4.getOrUndefined(decodeUpstreamErrorsArrayBody(body));
+  const descriptionBody = Option4.getOrUndefined(decodeUpstreamDescriptionBody(body));
+  const arrayMessage = errorsBody?.errors.map(
+    ({
+      detail,
+      message: upstreamMessage,
+      title
+    }) => firstNonEmpty(detail, upstreamMessage, title)
+  ).find((message2) => message2 !== void 0);
+  const message = firstNonEmpty(
+    nested?.error.message,
+    messageBody?.message,
+    errorMessageBody?.errorMessage,
+    arrayMessage,
+    descriptionBody?.detail,
+    descriptionBody?.title,
+    descriptionBody?.description
+  );
+  if (message !== void 0) return message;
+  if (body !== null && typeof body === "object") {
+    return clampedStringify(body);
+  }
+  return `Upstream returned HTTP ${status}`;
+};
+var openApiAuthToolFailure = (failure) => authToolFailure({
+  code: failure.code,
+  message: failure.message,
+  integration: { id: failure.integration, scope: failure.owner },
+  credential: {
+    kind: failure.credentialKind,
+    ...failure.credentialLabel ? { label: failure.credentialLabel } : {}
+  },
+  ...failure.status !== void 0 ? { status: failure.status } : {},
+  ...failure.details !== void 0 ? {
+    upstream: {
+      ...failure.status !== void 0 ? { status: failure.status } : {},
+      details: failure.details
+    }
+  } : {}
+});
+var normalizeOpenApiRefs = (node) => {
+  if (node == null || typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    let changed2 = false;
+    const out = node.map((item) => {
+      const n = normalizeOpenApiRefs(item);
+      if (n !== item) changed2 = true;
+      return n;
+    });
+    return changed2 ? out : node;
+  }
+  const obj = node;
+  if (typeof obj.$ref === "string") {
+    const match = obj.$ref.match(/^#\/components\/schemas\/(.+)$/);
+    if (match) return { ...obj, $ref: `#/$defs/${match[1]}` };
+    return obj;
+  }
+  let changed = false;
+  const result = {};
+  for (const [k, v] of Object.entries(obj)) {
+    const n = normalizeOpenApiRefs(v);
+    if (n !== v) changed = true;
+    result[k] = n;
+  }
+  return changed ? result : obj;
+};
+var toBinding = (def) => OperationBinding.make({
+  method: def.operation.method,
+  servers: def.operation.servers,
+  pathTemplate: def.operation.pathTemplate,
+  parameters: [...def.operation.parameters],
+  requestBody: def.operation.requestBody,
+  responseBody: def.operation.responseBody,
+  ...def.operation.requiredScopeAlternatives ? { requiredScopeAlternatives: def.operation.requiredScopeAlternatives } : {}
+});
+var descriptionFor = (def) => {
+  const op = def.operation;
+  return Option4.getOrElse(
+    op.description,
+    () => Option4.getOrElse(op.summary, () => `${op.method.toUpperCase()} ${op.pathTemplate}`)
+  );
+};
+var FILE_OUTPUT_HINT = `Returns a ToolFile: the file bytes already decoded into { _tag: "ToolFile", mimeType, encoding, data, byteLength }. To display or forward it, pass the result's data straight to emit(result.data). Do not rebuild the envelope or read upstream fields like size.`;
+var withFileEmitHint = (description, returnsFile) => returnsFile ? `${description}
+
+${FILE_OUTPUT_HINT}` : description;
+var compileOpenApiDocument = (doc) => Effect4.gen(function* () {
+  const result = yield* extract(doc);
+  const hoistedDefs = {};
+  if (doc.components?.schemas) {
+    for (const [k, v] of Object.entries(doc.components.schemas)) {
+      hoistedDefs[k] = normalizeOpenApiRefs(v);
+    }
+  }
+  return {
+    definitions: compileToolDefinitions(result.operations),
+    hoistedDefs,
+    title: Option4.getOrUndefined(result.title),
+    description: Option4.getOrUndefined(result.description)
+  };
+});
+var compileOpenApiSpec = (specText) => Effect4.gen(function* () {
+  const doc = yield* parse(specText);
+  return yield* compileOpenApiDocument(doc);
+});
+var COMPILED_SPEC_CACHE_CAPACITY = 4;
+var compiledSpecCache = /* @__PURE__ */ new Map();
+var compileOpenApiSpecCached = (specHash, specText) => Effect4.gen(function* () {
+  if (specHash == null) return yield* compileOpenApiSpec(specText);
+  const hit = compiledSpecCache.get(specHash);
+  if (hit !== void 0) {
+    compiledSpecCache.delete(specHash);
+    compiledSpecCache.set(specHash, hit);
+    return hit;
+  }
+  const compiled = yield* compileOpenApiSpec(specText);
+  compiledSpecCache.set(specHash, compiled);
+  while (compiledSpecCache.size > COMPILED_SPEC_CACHE_CAPACITY) {
+    const oldest = compiledSpecCache.keys().next().value;
+    if (oldest === void 0) break;
+    compiledSpecCache.delete(oldest);
+  }
+  return compiled;
+});
+var openApiToolDefsFromCompiled = (compiled) => compiled.definitions.map((def) => {
+  const returnsFile = Option4.match(def.operation.responseBody, {
+    onNone: () => false,
+    onSome: (responseBody) => Option4.isSome(responseBody.fileHint)
+  });
+  return {
+    name: ToolName.make(def.toolPath),
+    description: withFileEmitHint(descriptionFor(def), returnsFile),
+    inputSchema: normalizeOpenApiRefs(Option4.getOrUndefined(def.operation.inputSchema)),
+    outputSchema: returnsFile ? ToolFileJsonSchema : normalizeOpenApiRefs(Option4.getOrUndefined(def.operation.outputSchema)),
+    annotations: annotationsForOperation(def.operation.method, def.operation.pathTemplate)
+  };
+});
+var openApiStoredOperationsFromCompiled = (integration, compiled) => compiled.definitions.map((def) => ({
+  integration,
+  toolName: def.toolPath,
+  binding: toBinding(def),
+  description: descriptionFor(def)
+}));
+var buildDefsJson = (doc) => {
+  const schemas = doc.components?.schemas;
+  if (!schemas) return "{}";
+  let json = "{";
+  let first = true;
+  for (const [name, schema] of Object.entries(schemas)) {
+    const serialized = JSON.stringify(normalizeOpenApiRefs(schema));
+    if (serialized === void 0) continue;
+    json += `${first ? "" : ","}${JSON.stringify(name)}:${serialized}`;
+    first = false;
+  }
+  return `${json}}`;
+};
+var buildDefsJsonStreaming = (structure) => {
+  let json = "{";
+  let first = true;
+  for (const range of structure.schemas) {
+    const entry = parseEntry(structure.text, range, 4);
+    if (!entry) continue;
+    const [name, schema] = entry;
+    const serialized = JSON.stringify(normalizeOpenApiRefs(schema));
+    if (serialized === void 0) continue;
+    json += `${first ? "" : ","}${JSON.stringify(name)}:${serialized}`;
+    first = false;
+  }
+  return `${json}}`;
+};
+var DefsJson = Schema4.Record(Schema4.String, Schema4.Unknown);
+var decodeDefsJson = Schema4.decodeUnknownOption(Schema4.fromJsonString(DefsJson));
+var toolDefFromStoredOperation = (op) => {
+  const binding = op.binding;
+  const returnsFile = Option4.match(binding.responseBody, {
+    onNone: () => false,
+    onSome: (responseBody) => Option4.isSome(responseBody.fileHint)
+  });
+  return {
+    name: ToolName.make(op.toolName),
+    description: withFileEmitHint(
+      op.description ?? `${binding.method.toUpperCase()} ${binding.pathTemplate}`,
+      returnsFile
+    ),
+    inputSchema: normalizeOpenApiRefs(
+      buildInputSchema(
+        binding.parameters,
+        Option4.getOrUndefined(binding.requestBody),
+        binding.servers ?? []
+      )
+    ),
+    outputSchema: returnsFile ? ToolFileJsonSchema : Option4.match(binding.responseBody, {
+      onNone: () => void 0,
+      onSome: (responseBody) => normalizeOpenApiRefs(outputSchemaFromResponseBody(responseBody))
+    }),
+    annotations: annotationsForOperation(binding.method, binding.pathTemplate)
+  };
+};
+var compileAndPersistOpenApiOperations = ({
+  doc,
+  integration,
+  storage,
+  specHash,
+  chunkSize
+}) => Effect4.gen(function* () {
+  yield* storage.removeOperations(integration);
+  const result = yield* streamOperationBindings(
+    doc,
+    chunkSize ?? 500,
+    (chunk) => storage.appendOperations(
+      integration,
+      chunk.map((item) => ({
+        integration,
+        toolName: item.toolName,
+        binding: item.binding,
+        description: item.description
+      }))
+    )
+  );
+  if (specHash != null) {
+    yield* storage.putDefs(specHash, buildDefsJson(doc));
+  }
+  return result;
+});
+var compileAndPersistOpenApiSpec = ({
+  specText,
+  integration,
+  storage,
+  specHash,
+  chunkSize
+}) => Effect4.gen(function* () {
+  const doc = yield* parse(specText);
+  return yield* compileAndPersistOpenApiOperations({
+    doc,
+    integration,
+    storage,
+    specHash,
+    chunkSize
+  });
+});
+var compileAndPersistOpenApiSpecStreaming = ({
+  specText,
+  integration,
+  storage,
+  specHash,
+  chunkSize,
+  keepPathItem
+}) => Effect4.gen(function* () {
+  const structure = structuralSplit(specText);
+  if (!structure) {
+    return yield* new OpenApiExtractionError({
+      message: "OpenAPI spec is not in the streamable block-YAML profile (no top-level `paths:` block); cannot stream-compile a spec this large in-band."
+    });
+  }
+  yield* storage.removeOperations(integration);
+  const result = yield* streamOperationBindingsFromStructure(
+    structure,
+    { chunkSize: chunkSize ?? 500, keepPathItem },
+    (chunk) => storage.appendOperations(
+      integration,
+      chunk.map((item) => ({
+        integration,
+        toolName: item.toolName,
+        binding: item.binding,
+        description: item.description
+      }))
+    )
+  );
+  if (specHash != null) {
+    yield* storage.putDefs(specHash, buildDefsJsonStreaming(structure));
+  }
+  return result;
+});
+var loadOpenApiSpecText = (storage, config) => config.specHash != null ? storage.getSpec(config.specHash) : Effect4.succeed(null);
+var resolveOpenApiBackedTools = ({
+  integration,
+  config,
+  storage
+}) => Effect4.gen(function* () {
+  const incomplete = (reason) => ({
+    tools: [],
+    definitions: {},
+    incomplete: true,
+    incompleteReason: reason
+  });
+  const openApiConfig = decodeOpenApiIntegrationConfig(config);
+  if (!openApiConfig) return { tools: [], definitions: {} };
+  if (openApiConfig.specHash != null) {
+    const defsJson = yield* storage.getDefs(openApiConfig.specHash).pipe(Effect4.catch(() => Effect4.succeed(null)));
+    if (defsJson != null) {
+      const definitions = Option4.getOrNull(decodeDefsJson(defsJson));
+      if (definitions != null) {
+        const ops = yield* storage.listOperations(String(integration.slug)).pipe(Effect4.catch(() => Effect4.succeed(null)));
+        if (ops == null) return incomplete("OpenAPI operation bindings could not be loaded.");
+        return { tools: ops.map(toolDefFromStoredOperation), definitions };
+      }
+    }
+  }
+  const specText = yield* loadOpenApiSpecText(storage, openApiConfig).pipe(
+    Effect4.catch(() => Effect4.succeed(null))
+  );
+  if (specText == null) return incomplete("OpenAPI spec blob could not be loaded.");
+  const compiled = yield* compileOpenApiSpecCached(openApiConfig.specHash, specText).pipe(
+    Effect4.catch(() => Effect4.succeed(null))
+  );
+  if (!compiled) return incomplete("OpenAPI spec could not be parsed.");
+  return {
+    tools: openApiToolDefsFromCompiled(compiled),
+    definitions: compiled.hoistedDefs
+  };
+});
+var invokeOpenApiBackedTool = (input) => Effect4.gen(function* () {
+  const integration = input.toolRow.integration;
+  const config = decodeOpenApiIntegrationConfig(input.credential.config);
+  let binding = (yield* input.ctx.storage.getOperation(integration, input.toolRow.name))?.binding;
+  if (!binding && config) {
+    const specText = yield* loadOpenApiSpecText(input.ctx.storage, config).pipe(
+      Effect4.catch(() => Effect4.succeed(null))
+    );
+    const compiled = specText == null ? null : yield* compileOpenApiSpecCached(config.specHash, specText).pipe(
+      Effect4.catch(() => Effect4.succeed(null))
+    );
+    binding = compiled ? openApiStoredOperationsFromCompiled(integration, compiled).find(
+      (op) => op.toolName === input.toolRow.name
+    )?.binding : void 0;
+  }
+  if (!binding) {
+    return yield* new OpenApiExtractionError({
+      message: `No OpenAPI operation found for tool "${input.toolRow.name}" on "${integration}"`
+    });
+  }
+  const headers = { ...config?.headers ?? {} };
+  const queryParams = {
+    ...config?.queryParams ?? {}
+  };
+  const template = (config?.authenticationTemplate ?? []).find(
+    (entry) => String(entry.slug) === String(input.credential.template)
+  );
+  if (template) {
+    const missing = requiredTemplateVariables(template).filter((name) => {
+      const value = input.credential.values[name];
+      return value == null || value === "";
+    });
+    if (missing.length > 0) {
+      return openApiAuthToolFailure({
+        code: template.kind === "oauth2" ? "oauth_connection_missing" : "connection_value_missing",
+        message: `Connection "${input.credential.connection}" for "${integration}" has no resolvable credential value. Re-authenticate or update the connection.`,
+        owner: input.credential.owner,
+        integration,
+        connection: String(input.credential.connection),
+        credentialKind: template.kind === "oauth2" ? "oauth" : "secret"
+      });
+    }
+    const rendered = renderAuthTemplate(template, input.credential.values);
+    Object.assign(headers, rendered.headers);
+    Object.assign(queryParams, rendered.queryParams);
+  }
+  const invocation = yield* invokeWithLayer(
+    binding,
+    input.args ?? {},
+    config?.baseUrl ?? "",
+    headers,
+    queryParams,
+    input.httpClientLayer,
+    input.invokeOptions
+  ).pipe(
+    Effect4.map((result2) => ({ ok: true, result: result2 })),
+    Effect4.catchTag(
+      "OpenApiInvocationError",
+      (error) => error.reason === "response_headers_timeout" ? Effect4.succeed({
+        ok: false,
+        failure: ToolResult.fail({
+          code: "upstream_response_headers_timeout",
+          message: error.message,
+          details: error.cause ?? error
+        })
+      }) : Effect4.fail(error)
+    )
+  );
+  if (!invocation.ok) return invocation.failure;
+  const result = invocation.result;
+  const ok = result.status >= 200 && result.status < 300;
+  if (!ok) {
+    if (result.status === 401 || result.status === 403) {
+      const insufficientScope = result.status === 403 ? detectInsufficientScope({ body: result.error, headers: result.headers }) : null;
+      if (insufficientScope) {
+        const required = insufficientScope.requiredScopes.length > 0 ? insufficientScope.requiredScopes.join(" ") : (binding.requiredScopeAlternatives ?? []).map((alternative) => alternative.join(" ")).join(", or ");
+        const granted = input.credential.grantedScopes;
+        return openApiAuthToolFailure({
+          code: "oauth_scope_insufficient",
+          status: result.status,
+          message: `The connection "${input.credential.connection}" for "${integration}" is authorized, but its grant${granted && granted.length > 0 ? ` (${granted.join(" ")})` : ""} does not cover the scope this operation requires${required.length > 0 ? ` (${required})` : ""}. Re-authenticating with the same grant will return the same error; reconnect with broader access.`,
+          owner: input.credential.owner,
+          integration,
+          connection: String(input.credential.connection),
+          credentialKind: "oauth",
+          credentialLabel: "Upstream authorization",
+          details: result.error
+        });
+      }
+      return openApiAuthToolFailure({
+        code: "connection_rejected",
+        status: result.status,
+        message: `Upstream rejected credentials for "${integration}" with HTTP ${result.status}. Re-authenticate or update the connection "${input.credential.connection}" before retrying this tool.`,
+        owner: input.credential.owner,
+        integration,
+        connection: String(input.credential.connection),
+        credentialKind: "upstream",
+        credentialLabel: "Upstream authorization",
+        details: result.error
+      });
+    }
+    return ToolResult.fail({
+      code: "upstream_http_error",
+      status: result.status,
+      message: extractOpenApiUpstreamMessage(result.error, result.status),
+      details: result.error
+    });
+  }
+  return ToolResult.ok(result.data, {
+    http: { status: result.status, headers: result.headers }
+  });
+});
+var validateOpenApiBackedToolArgs = (input) => Effect4.gen(function* () {
+  const operation = yield* input.ctx.storage.getOperation(
+    input.toolRow.integration,
+    input.toolRow.name
+  );
+  if (!operation) return;
+  yield* buildRequest(operation.binding, input.args ?? {}, {});
+});
+var resolveOpenApiBackedAnnotations = (input) => Effect4.gen(function* () {
+  const out = {};
+  for (const row of input.toolRows) {
+    const operation = yield* input.ctx.storage.getOperation(input.integration, row.name);
+    if (!operation) continue;
+    out[row.name] = annotationsForOperation(
+      operation.binding.method,
+      operation.binding.pathTemplate
+    );
+  }
+  return out;
+});
+var resolveHealthCheckBinding = (ctx, integration, operation, config) => Effect4.gen(function* () {
+  const stored = (yield* ctx.storage.getOperation(integration, operation))?.binding;
+  if (stored) return stored;
+  if (!config) return void 0;
+  const specText = yield* loadOpenApiSpecText(ctx.storage, config).pipe(
+    Effect4.catch(() => Effect4.succeed(null))
+  );
+  if (specText == null) return void 0;
+  const compiled = yield* compileOpenApiSpecCached(config.specHash, specText).pipe(
+    Effect4.catch(() => Effect4.succeed(null))
+  );
+  if (!compiled) return void 0;
+  return openApiStoredOperationsFromCompiled(integration, compiled).find(
+    (op) => op.toolName === operation
+  )?.binding;
+});
+var checkHealthOpenApi = (input) => Effect4.gen(function* () {
+  const checkedAt = Date.now();
+  const config = decodeOpenApiIntegrationConfig(input.integration.config);
+  const spec = input.spec;
+  if (!spec) {
+    return {
+      status: "unknown",
+      checkedAt,
+      detail: "No health check configured."
+    };
+  }
+  const integration = String(input.integration.slug);
+  const binding = yield* resolveHealthCheckBinding(
+    input.ctx,
+    integration,
+    spec.operation,
+    config
+  );
+  if (!binding) {
+    return {
+      status: "unknown",
+      checkedAt,
+      detail: `Health check operation "${spec.operation}" not found on "${integration}".`
+    };
+  }
+  if (REQUIRE_APPROVAL.has(binding.method.toLowerCase())) {
+    return {
+      status: "unknown",
+      checkedAt,
+      detail: `Health check operation "${spec.operation}" is a ${binding.method.toUpperCase()} (mutating): pick a read-only operation.`
+    };
+  }
+  const headers = { ...config?.headers ?? {} };
+  const queryParams = { ...config?.queryParams ?? {} };
+  const template = (config?.authenticationTemplate ?? []).find(
+    (entry) => String(entry.slug) === String(input.credential.template)
+  );
+  if (template) {
+    const missing = requiredTemplateVariables(template).filter((name) => {
+      const value = input.credential.values[name];
+      return value == null || value === "";
+    });
+    if (missing.length > 0) {
+      return {
+        status: "expired",
+        checkedAt,
+        detail: `Connection "${input.credential.connection}" has no resolvable credential value.`
+      };
+    }
+    const rendered = renderAuthTemplate(template, input.credential.values);
+    Object.assign(headers, rendered.headers);
+    Object.assign(queryParams, rendered.queryParams);
+  }
+  const probe = yield* invokeWithLayer(
+    binding,
+    { ...spec.args ?? {} },
+    config?.baseUrl ?? "",
+    headers,
+    queryParams,
+    input.httpClientLayer
+  ).pipe(
+    Effect4.map((result) => ({ ok: true, result })),
+    Effect4.catch((failure) => Effect4.succeed({ ok: false, failure }))
+  );
+  const secretValues = Object.values(input.credential.values).filter(
+    (value) => typeof value === "string" && value.length > 0
+  );
+  const scrubSecrets = (text) => secretValues.reduce((out, secret) => out.split(secret).join("[redacted]"), text);
+  if (!probe.ok) {
+    return {
+      status: "degraded",
+      checkedAt,
+      detail: scrubSecrets(`Health check request failed: ${probe.failure.message}`)
+    };
+  }
+  const status = classifyHttpStatus(probe.result.status);
+  const identity = status === "healthy" ? extractIdentity(probe.result.data, spec.identityField) : void 0;
+  const responseSample = status === "healthy" ? extractResponseFields(probe.result.data) : [];
+  return {
+    status,
+    httpStatus: probe.result.status,
+    ...identity !== void 0 ? { identity } : {},
+    checkedAt,
+    ...responseSample.length > 0 ? { responseSample } : {},
+    ...status === "healthy" ? {} : {
+      detail: scrubSecrets(
+        extractOpenApiUpstreamMessage(probe.result.error, probe.result.status)
+      )
+    }
+  };
+});
+var listHealthCheckCandidatesOpenApi = (input) => Effect4.gen(function* () {
+  const integration = String(input.integration.slug);
+  const operations = yield* input.ctx.storage.listOperations(integration);
+  const config = decodeOpenApiIntegrationConfig(input.integration.config);
+  const summaries = /* @__PURE__ */ new Map();
+  const responseFieldsByTool = /* @__PURE__ */ new Map();
+  if (config) {
+    const specText = yield* loadOpenApiSpecText(input.ctx.storage, config).pipe(
+      Effect4.catch(() => Effect4.succeed(null))
+    );
+    const compiled = specText == null ? null : yield* compileOpenApiSpecCached(config.specHash, specText).pipe(
+      Effect4.catch(() => Effect4.succeed(null))
+    );
+    if (compiled) {
+      for (const def of compiled.definitions) {
+        const summary = Option4.getOrUndefined(def.operation.summary) ?? Option4.getOrUndefined(def.operation.description);
+        if (summary) summaries.set(def.toolPath, summary);
+        const fields = projectResponseFields(
+          normalizeOpenApiRefs(Option4.getOrUndefined(def.operation.outputSchema)),
+          compiled.hoistedDefs
+        );
+        if (fields.length > 0) responseFieldsByTool.set(def.toolPath, fields);
+      }
+    }
+  }
+  const candidates = operations.map((op) => {
+    const method = op.binding.method.toLowerCase();
+    const parameters = op.binding.parameters.map((parameter) => ({
+      name: parameter.name,
+      location: parameter.location,
+      required: parameter.required,
+      ...Option4.isSome(parameter.description) ? { description: parameter.description.value } : {}
+    }));
+    const responseFields = responseFieldsByTool.get(op.toolName);
+    return {
+      operation: op.toolName,
+      method,
+      requiredArgCount: op.binding.parameters.filter((parameter) => parameter.required).length,
+      destructive: REQUIRE_APPROVAL.has(method),
+      summary: summaries.get(op.toolName) ?? `${method.toUpperCase()} ${op.binding.pathTemplate}`,
+      ...parameters.length > 0 ? { parameters } : {},
+      ...responseFields && responseFields.length > 0 ? { responseFields } : {}
+    };
+  });
+  return sortHealthCheckCandidatesByIdentity(candidates);
+});
+
+// src/sdk/preview.ts
+import { Effect as Effect5, Option as Option5, Predicate } from "effect";
+import { Schema as Schema5 } from "effect";
+import {
+  HealthCheckCandidate,
+  compareHealthCheckCandidates,
+  projectResponseFields as projectResponseFields2
+} from "@rafads/sdk/core";
+var DESTRUCTIVE_METHODS = /* @__PURE__ */ new Set(["post", "put", "patch", "delete"]);
+var MAX_PREVIEW_CANDIDATES = 1e3;
+var MAX_PREVIEW_RESPONSE_FIELD_CANDIDATES = 50;
+var OAuth2Scopes = Schema5.Record(Schema5.String, Schema5.String);
+var SecuritySchemeType = Schema5.Literals(["http", "apiKey", "oauth2", "openIdConnect"]);
+var decodeSecuritySchemeType = Schema5.decodeUnknownOption(SecuritySchemeType);
+var OAuth2AuthorizationCodeFlow = Schema5.Struct({
+  authorizationUrl: Schema5.String,
+  tokenUrl: Schema5.String,
+  refreshUrl: Schema5.OptionFromOptional(Schema5.String),
+  scopes: OAuth2Scopes
+});
+var OAuth2ClientCredentialsFlow = Schema5.Struct({
+  tokenUrl: Schema5.String,
+  refreshUrl: Schema5.OptionFromOptional(Schema5.String),
+  scopes: OAuth2Scopes
+});
+var OAuth2Flows = Schema5.Struct({
+  authorizationCode: Schema5.OptionFromOptional(OAuth2AuthorizationCodeFlow),
+  clientCredentials: Schema5.OptionFromOptional(OAuth2ClientCredentialsFlow)
+});
+var SecurityScheme = Schema5.Struct({
+  /** Key name in components.securitySchemes (e.g. "api_token") */
+  name: Schema5.String,
+  /** OpenAPI security scheme type */
+  type: SecuritySchemeType,
+  /** For type: "http" — e.g. "bearer", "basic" */
+  scheme: Schema5.OptionFromOptional(Schema5.String),
+  /** For type: "http" with scheme "bearer" — e.g. "JWT" */
+  bearerFormat: Schema5.OptionFromOptional(Schema5.String),
+  /** For type: "apiKey" — where the key goes */
+  in: Schema5.OptionFromOptional(Schema5.Literals(["header", "query", "cookie"])),
+  /** For type: "apiKey" — the header/query/cookie name */
+  headerName: Schema5.OptionFromOptional(Schema5.String),
+  description: Schema5.OptionFromOptional(Schema5.String),
+  /** For type: "oauth2" — declared flows (authorizationCode / clientCredentials only; implicit and password are deprecated). */
+  flows: Schema5.OptionFromOptional(OAuth2Flows),
+  /** For type: "openIdConnect" — the discovery URL. */
+  openIdConnectUrl: Schema5.OptionFromOptional(Schema5.String)
+});
+var AuthStrategy = Schema5.Struct({
+  /** The security schemes required together for this strategy */
+  schemes: Schema5.Array(Schema5.String)
+});
+var HeaderPreset = Schema5.Struct({
+  /** Human-readable label for the UI (e.g. "Bearer Token", "API Key + Email") */
+  label: Schema5.String,
+  /** Headers this strategy needs. Value is null when the user must provide it. */
+  headers: Schema5.Record(Schema5.String, Schema5.NullOr(Schema5.String)),
+  /** Which headers should be stored as secrets */
+  secretHeaders: Schema5.Array(Schema5.String)
+});
+var OAuth2Preset = Schema5.Struct({
+  /** Human-readable label for the UI (e.g. "OAuth2 (Authorization Code) — oauth_app") */
+  label: Schema5.String,
+  /** The source security scheme this preset came from (components.securitySchemes key). */
+  securitySchemeName: Schema5.String,
+  /** Which OAuth2 flow this preset uses. */
+  flow: Schema5.Literals(["authorizationCode", "clientCredentials"]),
+  /** For authorizationCode: user-agent redirect URL (from the spec). */
+  authorizationUrl: Schema5.OptionFromOptional(Schema5.String),
+  /** Token endpoint to exchange the code / refresh. */
+  tokenUrl: Schema5.String,
+  /** RFC 8707 resource indicator discovered from protected-resource metadata. */
+  resource: Schema5.OptionFromOptional(Schema5.String),
+  /** Optional refresh endpoint if the spec declares one separately. */
+  refreshUrl: Schema5.OptionFromOptional(Schema5.String),
+  /** Declared scopes for this flow: `{ scope: description }`. */
+  scopes: Schema5.Record(Schema5.String, Schema5.String),
+  /** Identity scopes to request alongside API scopes. `"auto"` discovers standard OIDC scopes. */
+  identityScopes: Schema5.Union([
+    Schema5.Literal("auto"),
+    Schema5.Literal(false),
+    Schema5.Array(Schema5.String)
+  ]),
+  /** Provider metadata advertised Client ID Metadata Document support. */
+  supportsClientIdMetadataDocument: Schema5.optional(Schema5.Boolean)
+});
+var PreviewOperation = Schema5.Struct({
+  operationId: Schema5.String,
+  method: HttpMethod,
+  path: Schema5.String,
+  summary: Schema5.OptionFromOptional(Schema5.String),
+  tags: Schema5.Array(Schema5.String),
+  deprecated: Schema5.Boolean
+});
+var SpecPreview = Schema5.Struct({
+  title: Schema5.OptionFromOptional(Schema5.String),
+  /** The spec's `info.description` — prefills the add form's description field. */
+  description: Schema5.OptionFromOptional(Schema5.String),
+  version: Schema5.OptionFromOptional(Schema5.String),
+  /** Reuses ServerInfo from extraction */
+  servers: Schema5.Array(ServerInfo),
+  operationCount: Schema5.Number,
+  /** Lightweight operation list for the add-integration UI */
+  operations: Schema5.Array(PreviewOperation),
+  tags: Schema5.Array(Schema5.String),
+  securitySchemes: Schema5.Array(SecurityScheme),
+  /** Valid auth strategies (each is a set of schemes used together) */
+  authStrategies: Schema5.Array(AuthStrategy),
+  /** Pre-built header presets derived from auth strategies */
+  headerPresets: Schema5.Array(HeaderPreset),
+  /** OAuth2 presets — one per (oauth2 scheme × supported flow) combination */
+  oauth2Presets: Schema5.Array(OAuth2Preset),
+  /** Top-ranked health-check candidates (bounded), so the add screen can offer a
+   *  typed operation + identity picker before the integration is registered. */
+  healthCheckCandidates: Schema5.Array(HealthCheckCandidate)
+});
+var SpecPreviewSummary = Schema5.Struct({
+  title: Schema5.OptionFromOptional(Schema5.String),
+  description: Schema5.OptionFromOptional(Schema5.String),
+  version: Schema5.OptionFromOptional(Schema5.String),
+  servers: Schema5.Array(ServerInfo),
+  operationCount: Schema5.Number,
+  tags: Schema5.Array(Schema5.String),
+  securitySchemes: Schema5.Array(SecurityScheme),
+  authStrategies: Schema5.Array(AuthStrategy),
+  headerPresets: Schema5.Array(HeaderPreset),
+  oauth2Presets: Schema5.Array(OAuth2Preset),
+  healthCheckCandidates: Schema5.Array(HealthCheckCandidate)
+});
+var stringRecord = (value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    if (typeof v === "string") out[k] = v;
+  }
+  return out;
+};
+var extractFlows = (rawFlows) => {
+  if (!rawFlows || typeof rawFlows !== "object") return Option5.none();
+  const flows = rawFlows;
+  const parseFlow = (key) => flows[key];
+  let authorizationCode = Option5.none();
+  const authCodeRaw = parseFlow("authorizationCode");
+  if (authCodeRaw && typeof authCodeRaw === "object") {
+    const f = authCodeRaw;
+    const authUrl = typeof f.authorizationUrl === "string" ? f.authorizationUrl : null;
+    const tokenUrl = typeof f.tokenUrl === "string" ? f.tokenUrl : null;
+    if (authUrl && tokenUrl) {
+      authorizationCode = Option5.some(
+        OAuth2AuthorizationCodeFlow.make({
+          authorizationUrl: authUrl,
+          tokenUrl,
+          refreshUrl: Option5.fromNullishOr(
+            typeof f.refreshUrl === "string" ? f.refreshUrl : void 0
+          ),
+          scopes: stringRecord(f.scopes)
+        })
+      );
+    }
+  }
+  let clientCredentials = Option5.none();
+  const ccRaw = parseFlow("clientCredentials");
+  if (ccRaw && typeof ccRaw === "object") {
+    const f = ccRaw;
+    const tokenUrl = typeof f.tokenUrl === "string" ? f.tokenUrl : null;
+    if (tokenUrl) {
+      clientCredentials = Option5.some(
+        OAuth2ClientCredentialsFlow.make({
+          tokenUrl,
+          refreshUrl: Option5.fromNullishOr(
+            typeof f.refreshUrl === "string" ? f.refreshUrl : void 0
+          ),
+          scopes: stringRecord(f.scopes)
+        })
+      );
+    }
+  }
+  if (Option5.isNone(authorizationCode) && Option5.isNone(clientCredentials)) {
+    return Option5.none();
+  }
+  return Option5.some(OAuth2Flows.make({ authorizationCode, clientCredentials }));
+};
+var extractSecuritySchemes = (rawSchemes, resolver) => Object.entries(rawSchemes).flatMap(([name, schemeOrRef]) => {
+  if (!schemeOrRef || typeof schemeOrRef !== "object") return [];
+  const resolved = resolver.resolve(
+    schemeOrRef
+  );
+  if (!resolved || typeof resolved !== "object") return [];
+  const scheme = resolved;
+  const type = decodeSecuritySchemeType(scheme.type);
+  if (Option5.isNone(type)) return [];
+  const schemeType = type.value;
+  return [
+    SecurityScheme.make({
+      name,
+      type: schemeType,
+      scheme: Option5.fromNullishOr(scheme.scheme),
+      bearerFormat: Option5.fromNullishOr(scheme.bearerFormat),
+      in: Option5.fromNullishOr(scheme.in),
+      headerName: Option5.fromNullishOr(scheme.name),
+      description: Option5.fromNullishOr(scheme.description),
+      flows: schemeType === "oauth2" ? extractFlows(scheme.flows) : Option5.none(),
+      openIdConnectUrl: Option5.fromNullishOr(scheme.openIdConnectUrl)
+    })
+  ];
+});
+var buildHeaderPresets = (schemes, strategies) => {
+  const schemeMap = new Map(schemes.map((s) => [s.name, s]));
+  return strategies.flatMap((strategy) => {
+    const resolved = strategy.schemes.map((name) => schemeMap.get(name)).filter(Predicate.isNotUndefined);
+    if (resolved.length === 0) return [];
+    const headers = {};
+    const secretHeaders = [];
+    const labelParts = [];
+    for (const scheme of resolved) {
+      if (scheme.type === "http" && Option5.getOrElse(scheme.scheme, () => "") === "bearer") {
+        headers["Authorization"] = null;
+        secretHeaders.push("Authorization");
+        labelParts.push("Bearer Token");
+      } else if (scheme.type === "http" && Option5.getOrElse(scheme.scheme, () => "") === "basic") {
+        headers["Authorization"] = null;
+        secretHeaders.push("Authorization");
+        labelParts.push("Basic Auth");
+      } else if (scheme.type === "apiKey" && Option5.getOrElse(scheme.in, () => "") === "header") {
+        const headerName = Option5.getOrElse(scheme.headerName, () => scheme.name);
+        headers[headerName] = null;
+        secretHeaders.push(headerName);
+        labelParts.push(scheme.name);
+      } else if (scheme.type === "apiKey") {
+        labelParts.push(`${scheme.name} (${Option5.getOrElse(scheme.in, () => "unknown")})`);
+      } else if (scheme.type === "oauth2" || scheme.type === "openIdConnect") {
+        return [];
+      } else {
+        labelParts.push(scheme.name);
+      }
+    }
+    if (Object.keys(headers).length === 0 && resolved.length > 0) {
+      return [
+        HeaderPreset.make({
+          label: labelParts.join(" + "),
+          headers: {},
+          secretHeaders: []
+        })
+      ];
+    }
+    return [
+      HeaderPreset.make({
+        label: labelParts.join(" + "),
+        headers,
+        secretHeaders
+      })
+    ];
+  });
+};
+var buildOAuth2Presets = (schemes) => {
+  const presets = [];
+  for (const scheme of schemes) {
+    if (scheme.type !== "oauth2") continue;
+    if (Option5.isNone(scheme.flows)) continue;
+    const flows = scheme.flows.value;
+    if (Option5.isSome(flows.authorizationCode)) {
+      const flow = flows.authorizationCode.value;
+      presets.push(
+        OAuth2Preset.make({
+          label: `OAuth2 Authorization Code \xB7 ${scheme.name}`,
+          securitySchemeName: scheme.name,
+          flow: "authorizationCode",
+          authorizationUrl: Option5.some(flow.authorizationUrl),
+          tokenUrl: flow.tokenUrl,
+          resource: Option5.none(),
+          refreshUrl: flow.refreshUrl,
+          scopes: flow.scopes,
+          identityScopes: "auto"
+        })
+      );
+    }
+    if (Option5.isSome(flows.clientCredentials)) {
+      const flow = flows.clientCredentials.value;
+      presets.push(
+        OAuth2Preset.make({
+          label: `OAuth2 Client Credentials \xB7 ${scheme.name}`,
+          securitySchemeName: scheme.name,
+          flow: "clientCredentials",
+          authorizationUrl: Option5.none(),
+          tokenUrl: flow.tokenUrl,
+          resource: Option5.none(),
+          refreshUrl: flow.refreshUrl,
+          scopes: flow.scopes,
+          identityScopes: false
+        })
+      );
+    }
+  }
+  return presets;
+};
+var collectTags = (result) => {
+  const tagSet = /* @__PURE__ */ new Set();
+  for (const op of result.operations) {
+    for (const tag of op.tags) tagSet.add(tag);
+  }
+  return [...tagSet].sort();
+};
+var buildPreviewHealthCheckCandidates = (doc, operations) => {
+  if (operations.length === 0) return [];
+  const definitions = compileToolDefinitions(operations);
+  const ranked = definitions.map((def) => {
+    const op = def.operation;
+    const method = op.method.toLowerCase();
+    const parameters = op.parameters.map((parameter) => ({
+      name: parameter.name,
+      location: parameter.location,
+      required: parameter.required,
+      ...Option5.isSome(parameter.description) ? { description: parameter.description.value } : {}
+    }));
+    return {
+      operation: def.toolPath,
+      method,
+      requiredArgCount: op.parameters.filter((parameter) => parameter.required).length,
+      destructive: DESTRUCTIVE_METHODS.has(method),
+      summary: Option5.getOrUndefined(op.summary) ?? Option5.getOrUndefined(op.description) ?? `${method.toUpperCase()} ${op.pathTemplate}`,
+      ...parameters.length > 0 ? { parameters } : {}
+    };
+  }).sort(compareHealthCheckCandidates).slice(0, MAX_PREVIEW_CANDIDATES);
+  const hoistedDefs = {};
+  const rawSchemas = doc.components?.schemas;
+  if (rawSchemas) {
+    for (const [name, schema] of Object.entries(rawSchemas)) {
+      hoistedDefs[name] = normalizeOpenApiRefs(schema);
+    }
+  }
+  const operationByToolPath = new Map(definitions.map((def) => [def.toolPath, def.operation]));
+  return ranked.map((candidate, index) => {
+    if (index >= MAX_PREVIEW_RESPONSE_FIELD_CANDIDATES) return candidate;
+    const op = operationByToolPath.get(candidate.operation);
+    if (!op) return candidate;
+    const responseFields = projectResponseFields2(
+      normalizeOpenApiRefs(Option5.getOrUndefined(op.outputSchema)),
+      hoistedDefs
+    );
+    return responseFields.length > 0 ? { ...candidate, responseFields } : candidate;
+  });
+};
+var previewSpecText = Effect5.fn("OpenApi.previewSpecText")(function* (specText) {
+  const doc = yield* parse(specText);
+  const result = yield* extract(doc);
+  const resolver = new DocResolver(doc);
+  const securitySchemes = extractSecuritySchemes(doc.components?.securitySchemes ?? {}, resolver);
+  const rawSecurity = doc.security ?? [];
+  const declaredStrategies = rawSecurity.map(
+    (entry) => AuthStrategy.make({ schemes: Object.keys(entry) })
+  );
+  const authStrategies = declaredStrategies.length > 0 ? declaredStrategies : securitySchemes.map((scheme) => AuthStrategy.make({ schemes: [scheme.name] }));
+  return SpecPreview.make({
+    title: result.title,
+    description: result.description,
+    version: result.version,
+    servers: result.servers,
+    operationCount: result.operations.length,
+    operations: result.operations.map(
+      (op) => PreviewOperation.make({
+        operationId: op.operationId,
+        method: op.method,
+        path: op.pathTemplate,
+        summary: op.summary,
+        tags: op.tags,
+        deprecated: op.deprecated
+      })
+    ),
+    tags: collectTags(result),
+    securitySchemes,
+    authStrategies,
+    headerPresets: buildHeaderPresets(securitySchemes, authStrategies),
+    oauth2Presets: buildOAuth2Presets(securitySchemes),
+    healthCheckCandidates: buildPreviewHealthCheckCandidates(doc, result.operations)
+  });
+});
+var previewSpec = Effect5.fn("OpenApi.previewSpec")(function* (input) {
+  const specText = yield* resolveSpecText(input);
+  return yield* previewSpecText(specText);
+});
+
+export {
+  fetchSpecText,
+  resolveSpecText,
+  parse,
+  DocResolver,
+  substituteUrlVariables,
+  resolveServerUrl,
+  preferredContent,
+  normalizeOpenApiAuthInputs,
+  OperationId,
+  HttpMethod,
+  ParameterLocation,
+  OperationParameter,
+  EncodingObject,
+  MediaBinding,
+  OperationRequestBody,
+  ServerVariable,
+  ServerInfo,
+  ExtractedOperation,
+  ExtractionResult,
+  OperationBinding,
+  InvocationResult,
+  TOKEN_VARIABLE,
+  extract,
+  streamOperationBindingsFromStructure,
+  RESPONSE_HEADERS_TIMEOUT_MS,
+  buildRequest,
+  invoke,
+  invokeWithLayer,
+  annotationsForOperation,
+  extractOpenApiUpstreamMessage,
+  normalizeOpenApiRefs,
+  compileOpenApiDocument,
+  compileOpenApiSpec,
+  openApiToolDefsFromCompiled,
+  openApiStoredOperationsFromCompiled,
+  buildDefsJsonStreaming,
+  compileAndPersistOpenApiOperations,
+  compileAndPersistOpenApiSpec,
+  compileAndPersistOpenApiSpecStreaming,
+  loadOpenApiSpecText,
+  resolveOpenApiBackedTools,
+  invokeOpenApiBackedTool,
+  validateOpenApiBackedToolArgs,
+  resolveOpenApiBackedAnnotations,
+  checkHealthOpenApi,
+  listHealthCheckCandidatesOpenApi,
+  OAuth2AuthorizationCodeFlow,
+  OAuth2ClientCredentialsFlow,
+  OAuth2Flows,
+  SecurityScheme,
+  AuthStrategy,
+  HeaderPreset,
+  OAuth2Preset,
+  PreviewOperation,
+  SpecPreview,
+  SpecPreviewSummary,
+  previewSpecText,
+  previewSpec
+};
+//# sourceMappingURL=chunk-HTHEUUJA.js.map