@rafads/plugin-openapi 1.5.38

package/dist/chunk-OR27BCXQ.js

@@ -0,0 +1,956 @@
+import {
+  openApiPresets
+} from "./chunk-CURJJXB3.js";
+import {
+  deriveAuthenticationTemplateFromPreview,
+  firstBaseUrlForPreview
+} from "./chunk-O2LMSZ2Z.js";
+import {
+  OAuth2AuthorizationCodeFlow,
+  OAuth2Flows,
+  OAuth2Preset,
+  OperationBinding,
+  SecurityScheme,
+  checkHealthOpenApi,
+  compileAndPersistOpenApiSpecStreaming,
+  compileOpenApiSpec,
+  extract,
+  invokeOpenApiBackedTool,
+  listHealthCheckCandidatesOpenApi,
+  normalizeOpenApiAuthInputs,
+  openApiStoredOperationsFromCompiled,
+  parse,
+  previewSpecText,
+  resolveOpenApiBackedAnnotations,
+  resolveOpenApiBackedTools,
+  resolveServerUrl,
+  resolveSpecText,
+  validateOpenApiBackedToolArgs
+} from "./chunk-HTHEUUJA.js";
+import {
+  decodeOpenApiIntegrationConfig
+} from "./chunk-R7TVM3XD.js";
+import {
+  OpenApiParseError
+} from "./chunk-CXFO6TLJ.js";
+
+// src/sdk/store.ts
+import { Effect, Option, Predicate, Schema } from "effect";
+var OPERATION_COLLECTION = "operation";
+var STORE_OWNER = "org";
+var OPERATION_KEY_VERSION = "op";
+var encodeBinding = Schema.encodeSync(OperationBinding);
+var decodeBinding = Schema.decodeUnknownSync(OperationBinding);
+var decodeBindingJson = Schema.decodeUnknownSync(Schema.fromJsonString(OperationBinding));
+var toJsonRecord = (value) => value;
+var OperationStorage = Schema.Struct({
+  integration: Schema.String,
+  toolName: Schema.String,
+  binding: Schema.Unknown,
+  // Resolved tool description (operation description / summary / method+path
+  // fallback), persisted so the serve path can rebuild the tool def without
+  // re-parsing the spec. Optional: legacy rows predate it and resolve via the
+  // parse fallback.
+  description: Schema.optional(Schema.String)
+});
+var decodeOperationStorage = Schema.decodeUnknownOption(OperationStorage);
+var rowToOperation = (row) => {
+  const decoded = decodeOperationStorage(row.data);
+  if (Option.isNone(decoded)) return null;
+  const operation = decoded.value;
+  return {
+    integration: operation.integration,
+    toolName: operation.toolName,
+    binding: decodeBinding(
+      typeof operation.binding === "string" ? decodeBindingJson(operation.binding) : operation.binding
+    ),
+    ...operation.description !== void 0 ? { description: operation.description } : {}
+  };
+};
+var stableKeyHash = (value) => {
+  let hash = 0xcbf29ce484222325n;
+  const prime = 0x100000001b3n;
+  const mask = 0xffffffffffffffffn;
+  for (let index = 0; index < value.length; index += 1) {
+    hash ^= BigInt(value.charCodeAt(index));
+    hash = hash * prime & mask;
+  }
+  return hash.toString(36).padStart(13, "0");
+};
+var operationKey = (integration, toolName) => `${OPERATION_KEY_VERSION}.${stableKeyHash(integration)}.${stableKeyHash(toolName)}`;
+var legacyOperationKey = (integration, toolName) => `${integration}.${toolName}`;
+var specBlobKey = (specHash) => `spec/${specHash}`;
+var defsBlobKey = (specHash) => `defs/${specHash}`;
+var makeDefaultOpenapiStore = ({ pluginStorage, blobs }) => {
+  const operationData = (operation) => ({
+    integration: operation.integration,
+    toolName: operation.toolName,
+    binding: toJsonRecord(encodeBinding(operation.binding)),
+    ...operation.description !== void 0 ? { description: operation.description } : {}
+  });
+  const listRows = (integration) => pluginStorage.list({ collection: OPERATION_COLLECTION }).pipe(
+    Effect.map(
+      (rows) => rows.filter((row) => rowToOperation(row)?.integration === integration)
+    )
+  );
+  const removeOperations = (integration) => Effect.gen(function* () {
+    const rows = yield* listRows(integration);
+    yield* pluginStorage.removeMany({
+      owner: STORE_OWNER,
+      entries: rows.map((row) => ({ collection: OPERATION_COLLECTION, key: row.key }))
+    });
+  });
+  const appendOperations = (integration, operations) => pluginStorage.putMany({
+    owner: STORE_OWNER,
+    entries: operations.map((operation) => ({
+      collection: OPERATION_COLLECTION,
+      key: operationKey(integration, operation.toolName),
+      data: operationData(operation)
+    }))
+  });
+  return {
+    putOperations: (integration, operations) => Effect.gen(function* () {
+      yield* removeOperations(integration);
+      yield* appendOperations(integration, operations);
+    }),
+    appendOperations,
+    getOperation: (integration, toolName) => Effect.gen(function* () {
+      const row = yield* pluginStorage.get({
+        collection: OPERATION_COLLECTION,
+        key: operationKey(integration, toolName)
+      });
+      if (row) return rowToOperation(row);
+      const legacyKey = legacyOperationKey(integration, toolName);
+      if (legacyKey.length > 255) return null;
+      const legacyRow = yield* pluginStorage.get({
+        collection: OPERATION_COLLECTION,
+        key: legacyKey
+      });
+      return legacyRow ? rowToOperation(legacyRow) : null;
+    }),
+    listOperations: (integration) => listRows(integration).pipe(
+      Effect.map((rows) => rows.map(rowToOperation).filter(Predicate.isNotNull))
+    ),
+    removeOperations,
+    putSpec: (specHash, specText) => blobs.put(specBlobKey(specHash), specText, { owner: STORE_OWNER }),
+    getSpec: (specHash) => blobs.get(specBlobKey(specHash)),
+    putDefs: (specHash, defsJson) => blobs.put(defsBlobKey(specHash), defsJson, { owner: STORE_OWNER }),
+    getDefs: (specHash) => blobs.get(defsBlobKey(specHash))
+  };
+};
+
+// src/sdk/spec-format.ts
+import { Effect as Effect2 } from "effect";
+var resolveSpecFormatAdapter = (adapters, id) => {
+  if (!id) return Effect2.succeed(null);
+  const adapter = adapters.find((candidate) => candidate.id === id);
+  if (adapter) return Effect2.succeed(adapter);
+  return Effect2.fail(new OpenApiParseError({ message: `Unknown OpenAPI spec format: ${id}` }));
+};
+
+// src/sdk/plugin.ts
+import { Effect as Effect3, Option as Option2, Schema as Schema2 } from "effect";
+import {
+  IntegrationAlreadyExistsError,
+  IntegrationDetectionResult,
+  IntegrationNotFoundError,
+  IntegrationSlug,
+  ToolResult,
+  definePlugin,
+  HealthCheckSpec,
+  mergeAuthTemplates,
+  sha256Hex,
+  tool
+} from "@rafads/sdk/core";
+import { ApiKeyAuthTemplate, describeApiKeyAuthMethod } from "@rafads/sdk/http-auth";
+var PreviewSpecInputSchema = Schema2.Struct({
+  spec: Schema2.String,
+  specFormat: Schema2.optional(Schema2.String)
+});
+var StaticPreviewServerVariableSchema = Schema2.Struct({
+  default: Schema2.String,
+  enum: Schema2.NullOr(Schema2.Array(Schema2.String)),
+  description: Schema2.NullOr(Schema2.String)
+});
+var StaticPreviewServerSchema = Schema2.Struct({
+  url: Schema2.String,
+  description: Schema2.NullOr(Schema2.String),
+  variables: Schema2.NullOr(Schema2.Record(Schema2.String, StaticPreviewServerVariableSchema))
+});
+var StaticPreviewOAuthAuthorizationCodeFlowSchema = Schema2.Struct({
+  authorizationUrl: Schema2.String,
+  tokenUrl: Schema2.String,
+  refreshUrl: Schema2.NullOr(Schema2.String),
+  scopes: Schema2.Record(Schema2.String, Schema2.String)
+});
+var StaticPreviewOAuthClientCredentialsFlowSchema = Schema2.Struct({
+  tokenUrl: Schema2.String,
+  refreshUrl: Schema2.NullOr(Schema2.String),
+  scopes: Schema2.Record(Schema2.String, Schema2.String)
+});
+var StaticPreviewOAuthFlowsSchema = Schema2.Struct({
+  authorizationCode: Schema2.NullOr(StaticPreviewOAuthAuthorizationCodeFlowSchema),
+  clientCredentials: Schema2.NullOr(StaticPreviewOAuthClientCredentialsFlowSchema)
+});
+var StaticPreviewSecuritySchemeSchema = Schema2.Struct({
+  name: Schema2.String,
+  type: Schema2.Literals(["http", "apiKey", "oauth2", "openIdConnect"]),
+  scheme: Schema2.NullOr(Schema2.String),
+  bearerFormat: Schema2.NullOr(Schema2.String),
+  in: Schema2.NullOr(Schema2.Literals(["header", "query", "cookie"])),
+  headerName: Schema2.NullOr(Schema2.String),
+  description: Schema2.NullOr(Schema2.String),
+  flows: Schema2.NullOr(StaticPreviewOAuthFlowsSchema),
+  openIdConnectUrl: Schema2.NullOr(Schema2.String)
+});
+var StaticPreviewOAuth2PresetSchema = Schema2.Struct({
+  label: Schema2.String,
+  securitySchemeName: Schema2.String,
+  flow: Schema2.Literals(["authorizationCode", "clientCredentials"]),
+  authorizationUrl: Schema2.NullOr(Schema2.String),
+  tokenUrl: Schema2.String,
+  resource: Schema2.NullOr(Schema2.String),
+  refreshUrl: Schema2.NullOr(Schema2.String),
+  scopes: Schema2.Record(Schema2.String, Schema2.String),
+  identityScopes: Schema2.Union([
+    Schema2.Literal("auto"),
+    Schema2.Literal(false),
+    Schema2.Array(Schema2.String)
+  ]),
+  supportsClientIdMetadataDocument: Schema2.optional(Schema2.Boolean)
+});
+var StaticPreviewSpecOutputSchema = Schema2.Struct({
+  title: Schema2.NullOr(Schema2.String),
+  version: Schema2.NullOr(Schema2.String),
+  servers: Schema2.Array(StaticPreviewServerSchema),
+  operationCount: Schema2.Number,
+  tags: Schema2.Array(Schema2.String),
+  securitySchemes: Schema2.Array(StaticPreviewSecuritySchemeSchema),
+  authStrategies: Schema2.Array(Schema2.Struct({ schemes: Schema2.Array(Schema2.String) })),
+  headerPresets: Schema2.Array(
+    Schema2.Struct({
+      label: Schema2.String,
+      headers: Schema2.Record(Schema2.String, Schema2.NullOr(Schema2.String)),
+      secretHeaders: Schema2.Array(Schema2.String)
+    })
+  ),
+  oauth2Presets: Schema2.Array(StaticPreviewOAuth2PresetSchema)
+});
+var OpenApiSpecInputSchema = Schema2.Union([
+  Schema2.Struct({ kind: Schema2.Literal("url"), url: Schema2.String }),
+  Schema2.Struct({ kind: Schema2.Literal("blob"), value: Schema2.String })
+]);
+var AuthenticationSchema = Schema2.Union([
+  Schema2.Struct({
+    slug: Schema2.String,
+    kind: Schema2.Literal("oauth2"),
+    authorizationUrl: Schema2.String,
+    tokenUrl: Schema2.String,
+    resource: Schema2.optional(Schema2.NullOr(Schema2.String)),
+    scopes: Schema2.Array(Schema2.String),
+    supportsClientIdMetadataDocument: Schema2.optional(Schema2.Boolean)
+  }),
+  // Credential methods are authored request-shaped - the ONE apikey input
+  // dialect: `{ type: "apiKey", headers: { Authorization: ["Bearer ",
+  // variable("token")] }, queryParams: { … } }`.
+  ApiKeyAuthTemplate
+]);
+var AddIntegrationInputSchema = Schema2.Struct({
+  spec: OpenApiSpecInputSchema,
+  slug: Schema2.optional(Schema2.String),
+  name: Schema2.optional(Schema2.String),
+  description: Schema2.optional(Schema2.String),
+  baseUrl: Schema2.optional(Schema2.String),
+  headers: Schema2.optional(Schema2.Record(Schema2.String, Schema2.String)),
+  queryParams: Schema2.optional(Schema2.Record(Schema2.String, Schema2.String)),
+  specFormat: Schema2.optional(Schema2.String),
+  family: Schema2.optional(Schema2.String),
+  healthCheck: Schema2.optional(HealthCheckSpec),
+  authenticationTemplate: Schema2.optional(Schema2.Array(AuthenticationSchema))
+});
+var AddIntegrationOutputSchema = Schema2.Struct({
+  slug: Schema2.String,
+  toolCount: Schema2.Number
+});
+var PreviewSpecInputStandardSchema = Schema2.toStandardSchemaV1(
+  Schema2.toStandardJSONSchemaV1(PreviewSpecInputSchema)
+);
+var PreviewSpecOutputStandardSchema = Schema2.toStandardSchemaV1(
+  Schema2.toStandardJSONSchemaV1(StaticPreviewSpecOutputSchema)
+);
+var AddIntegrationInputStandardSchema = Schema2.toStandardSchemaV1(
+  Schema2.toStandardJSONSchemaV1(AddIntegrationInputSchema)
+);
+var AddIntegrationOutputStandardSchema = Schema2.toStandardSchemaV1(
+  Schema2.toStandardJSONSchemaV1(AddIntegrationOutputSchema)
+);
+var openApiToolFailure = (code, message, details) => ToolResult.fail({
+  code,
+  message,
+  ...details === void 0 ? {} : { details }
+});
+var staticPreviewOutput = (preview) => ({
+  title: Option2.getOrNull(preview.title),
+  version: Option2.getOrNull(preview.version),
+  servers: preview.servers.map((server) => ({
+    url: server.url,
+    description: Option2.getOrNull(server.description),
+    variables: Option2.getOrNull(server.variables) ? Object.fromEntries(
+      Object.entries(Option2.getOrNull(server.variables) ?? {}).map(([name, variable]) => [
+        name,
+        {
+          default: variable.default,
+          enum: Option2.getOrNull(variable.enum),
+          description: Option2.getOrNull(variable.description)
+        }
+      ])
+    ) : null
+  })),
+  operationCount: preview.operationCount,
+  tags: preview.tags,
+  securitySchemes: preview.securitySchemes.map((scheme) => ({
+    name: scheme.name,
+    type: scheme.type,
+    scheme: Option2.getOrNull(scheme.scheme),
+    bearerFormat: Option2.getOrNull(scheme.bearerFormat),
+    in: Option2.getOrNull(scheme.in),
+    headerName: Option2.getOrNull(scheme.headerName),
+    description: Option2.getOrNull(scheme.description),
+    flows: Option2.isSome(scheme.flows) ? {
+      authorizationCode: Option2.isSome(scheme.flows.value.authorizationCode) ? {
+        authorizationUrl: scheme.flows.value.authorizationCode.value.authorizationUrl,
+        tokenUrl: scheme.flows.value.authorizationCode.value.tokenUrl,
+        refreshUrl: Option2.getOrNull(scheme.flows.value.authorizationCode.value.refreshUrl),
+        scopes: scheme.flows.value.authorizationCode.value.scopes
+      } : null,
+      clientCredentials: Option2.isSome(scheme.flows.value.clientCredentials) ? {
+        tokenUrl: scheme.flows.value.clientCredentials.value.tokenUrl,
+        refreshUrl: Option2.getOrNull(scheme.flows.value.clientCredentials.value.refreshUrl),
+        scopes: scheme.flows.value.clientCredentials.value.scopes
+      } : null
+    } : null,
+    openIdConnectUrl: Option2.getOrNull(scheme.openIdConnectUrl)
+  })),
+  authStrategies: preview.authStrategies,
+  headerPresets: preview.headerPresets,
+  oauth2Presets: preview.oauth2Presets.map((preset) => ({
+    label: preset.label,
+    securitySchemeName: preset.securitySchemeName,
+    flow: preset.flow,
+    authorizationUrl: Option2.getOrNull(preset.authorizationUrl),
+    tokenUrl: preset.tokenUrl,
+    resource: Option2.getOrNull(preset.resource),
+    refreshUrl: Option2.getOrNull(preset.refreshUrl),
+    scopes: preset.scopes,
+    identityScopes: preset.identityScopes,
+    supportsClientIdMetadataDocument: preset.supportsClientIdMetadataDocument
+  }))
+});
+var specInputToSpecUrl = (spec) => spec.kind === "url" ? spec.url : void 0;
+var OAUTH_DISCOVERED_SCHEME_NAME = "DiscoveredOAuth2";
+var OPENAPI_HTTP_METHODS = /* @__PURE__ */ new Set([
+  "get",
+  "put",
+  "post",
+  "delete",
+  "patch",
+  "head",
+  "options",
+  "trace"
+]);
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var maybeUrl = (value) => {
+  try {
+    return new URL(value);
+  } catch {
+    return null;
+  }
+};
+var addProbeCandidate = (candidates, value) => {
+  const trimmed = value?.trim();
+  if (!trimmed) return;
+  const parsed = maybeUrl(trimmed);
+  if (!parsed || parsed.protocol !== "https:" && parsed.protocol !== "http:") return;
+  const normalized = parsed.toString();
+  const origin = parsed.origin;
+  if (!candidates.includes(normalized)) candidates.push(normalized);
+  if (!candidates.includes(origin)) candidates.push(origin);
+};
+var oauthProbeCandidates = (preview, specUrl, baseUrl) => {
+  const candidates = [];
+  addProbeCandidate(candidates, baseUrl);
+  for (const server of preview.servers) {
+    addProbeCandidate(
+      candidates,
+      resolveServerUrl(server.url, Option2.getOrUndefined(server.variables), {})
+    );
+  }
+  addProbeCandidate(candidates, specUrl);
+  return candidates;
+};
+var securityRequirementScopes = (security, targetSchemes) => {
+  if (!Array.isArray(security)) return [];
+  const scopes = /* @__PURE__ */ new Set();
+  for (const requirement of security) {
+    if (!isRecord(requirement)) continue;
+    for (const [scheme, rawScopes] of Object.entries(requirement)) {
+      if (targetSchemes.size > 0 && !targetSchemes.has(scheme)) continue;
+      if (!Array.isArray(rawScopes)) continue;
+      for (const scope of rawScopes) {
+        if (typeof scope === "string" && scope.trim().length > 0) scopes.add(scope.trim());
+      }
+    }
+  }
+  return [...scopes];
+};
+var collectDeclaredSecurityScopes = (doc, targetSchemes) => {
+  const scopes = /* @__PURE__ */ new Set();
+  if (!isRecord(doc)) return [];
+  for (const scope of securityRequirementScopes(doc.security, targetSchemes)) scopes.add(scope);
+  const paths = doc.paths;
+  if (!isRecord(paths)) return [...scopes].sort();
+  for (const pathItem of Object.values(paths)) {
+    if (!isRecord(pathItem)) continue;
+    for (const [method, operation] of Object.entries(pathItem)) {
+      if (!OPENAPI_HTTP_METHODS.has(method.toLowerCase()) || !isRecord(operation)) continue;
+      for (const scope of securityRequirementScopes(operation.security, targetSchemes)) {
+        scopes.add(scope);
+      }
+    }
+  }
+  return [...scopes].sort();
+};
+var nonOAuthSecuritySchemeNames = (preview) => new Set(
+  preview.securitySchemes.filter((scheme) => scheme.type === "http" || scheme.type === "apiKey").map((scheme) => scheme.name)
+);
+var discoveredOAuthPreview = (input) => {
+  const scopes = Object.fromEntries(input.scopes.map((scope) => [scope, ""]));
+  const flow = OAuth2AuthorizationCodeFlow.make({
+    authorizationUrl: input.authorizationUrl,
+    tokenUrl: input.tokenUrl,
+    refreshUrl: Option2.none(),
+    scopes
+  });
+  const flows = OAuth2Flows.make({
+    authorizationCode: Option2.some(flow),
+    clientCredentials: Option2.none()
+  });
+  return {
+    ...input.preview,
+    securitySchemes: [
+      ...input.preview.securitySchemes,
+      SecurityScheme.make({
+        name: OAUTH_DISCOVERED_SCHEME_NAME,
+        type: "oauth2",
+        scheme: Option2.none(),
+        bearerFormat: Option2.none(),
+        in: Option2.none(),
+        headerName: Option2.none(),
+        description: Option2.some("Discovered from OAuth authorization-server metadata"),
+        flows: Option2.some(flows),
+        openIdConnectUrl: Option2.none()
+      })
+    ],
+    oauth2Presets: [
+      ...input.preview.oauth2Presets,
+      OAuth2Preset.make({
+        label: `OAuth2 Authorization Code \xB7 ${OAUTH_DISCOVERED_SCHEME_NAME}`,
+        securitySchemeName: OAUTH_DISCOVERED_SCHEME_NAME,
+        flow: "authorizationCode",
+        authorizationUrl: Option2.some(input.authorizationUrl),
+        tokenUrl: input.tokenUrl,
+        resource: input.resource ? Option2.some(input.resource) : Option2.none(),
+        refreshUrl: Option2.none(),
+        scopes,
+        identityScopes: "auto",
+        ...input.supportsClientIdMetadataDocument === true ? { supportsClientIdMetadataDocument: true } : {}
+      })
+    ]
+  };
+};
+var describeOpenApiAuthMethods = (record) => {
+  const config = decodeOpenApiIntegrationConfig(record.config);
+  if (!config) return [];
+  return (config.authenticationTemplate ?? []).map(
+    (template) => {
+      if (template.kind === "oauth2") {
+        return {
+          id: String(template.slug),
+          label: "OAuth2",
+          kind: "oauth",
+          template: String(template.slug),
+          oauth: {
+            authorizationUrl: template.authorizationUrl,
+            tokenUrl: template.tokenUrl,
+            resource: template.resource ?? null,
+            scopes: template.scopes,
+            supportsClientIdMetadataDocument: template.supportsClientIdMetadataDocument
+          }
+        };
+      }
+      return describeApiKeyAuthMethod(template);
+    }
+  );
+};
+var describeOpenApiIntegrationDisplay = (record) => {
+  const config = decodeOpenApiIntegrationConfig(record.config);
+  return {
+    url: config?.baseUrl ?? config?.specUrl,
+    ...config?.family ? { family: config.family } : {}
+  };
+};
+var openApiPlugin = definePlugin((options) => {
+  const resolveSpecForInput = (config, httpClientLayer) => Effect3.gen(function* () {
+    const adapter = yield* resolveSpecFormatAdapter(
+      options?.specFormats ?? [],
+      config.specFormat
+    );
+    if (adapter) {
+      if (config.spec.kind !== "url") {
+        return yield* new OpenApiParseError({
+          message: "Spec format adapters require a URL spec input"
+        });
+      }
+      return yield* adapter.fetch({
+        urls: [config.spec.url],
+        credentials: {
+          ...config.headers ? { headers: config.headers } : {},
+          ...config.queryParams ? { queryParams: config.queryParams } : {}
+        },
+        httpClientLayer
+      });
+    }
+    if (config.spec.kind === "url") {
+      const specText = yield* resolveSpecText(config.spec.url).pipe(
+        Effect3.provide(httpClientLayer)
+      );
+      return { specText, specUrl: config.spec.url };
+    }
+    return { specText: config.spec.value };
+  });
+  return {
+    id: "openapi",
+    packageName: "@rafads/plugin-openapi",
+    clientConfig: options?.presets ? { presets: options.presets } : void 0,
+    integrationPresets: [...openApiPresets, ...options?.presets ?? []].map((preset) => ({
+      id: preset.id,
+      name: preset.name,
+      summary: preset.summary,
+      ...preset.url ? { url: preset.url } : {},
+      ...preset.icon ? { icon: preset.icon } : {},
+      ...preset.featured ? { featured: preset.featured } : {},
+      ...preset.family ? { family: preset.family } : {},
+      ...preset.specFormat ? { specFormat: preset.specFormat } : {},
+      ...preset.defaultSlug ? { defaultSlug: preset.defaultSlug } : {},
+      ...preset.authTemplate ? { authTemplate: preset.authTemplate } : {},
+      ...preset.healthCheck ? { healthCheck: preset.healthCheck } : {}
+    })),
+    storage: (deps) => makeDefaultOpenapiStore(deps),
+    extension: (ctx) => {
+      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
+      const enrichPreviewWithDiscoveredOAuth = (input) => Effect3.gen(function* () {
+        if (input.preview.oauth2Presets.length > 0) return input.preview;
+        const candidates = oauthProbeCandidates(input.preview, input.specUrl, input.baseUrl);
+        if (candidates.length === 0) return input.preview;
+        for (const candidate of candidates) {
+          const oauth = yield* ctx.oauth.probe({ url: candidate }).pipe(
+            Effect3.map((result) => ({ ok: true, result })),
+            Effect3.catch(() => Effect3.succeed({ ok: false, result: null }))
+          );
+          if (!oauth.ok) continue;
+          const doc = yield* parse(input.specText);
+          const declaredScopes = collectDeclaredSecurityScopes(
+            doc,
+            nonOAuthSecuritySchemeNames(input.preview)
+          );
+          const supportedScopes = oauth.result.scopesSupported && oauth.result.scopesSupported.length > 0 ? new Set(oauth.result.scopesSupported) : null;
+          const scopes = supportedScopes ? declaredScopes.filter((scope) => supportedScopes.has(scope)) : declaredScopes;
+          return discoveredOAuthPreview({
+            preview: input.preview,
+            authorizationUrl: oauth.result.authorizationUrl,
+            tokenUrl: oauth.result.tokenUrl,
+            resource: oauth.result.resource ?? null,
+            scopes,
+            supportsClientIdMetadataDocument: oauth.result.clientIdMetadataDocumentSupported === true
+          });
+        }
+        return input.preview;
+      });
+      const addSpec = (config) => Effect3.gen(function* () {
+        const resolved = yield* resolveSpecForInput(config, httpClientLayer);
+        const compiled = resolved.keepPathItem ? void 0 : yield* compileOpenApiSpec(resolved.specText);
+        const adapter = yield* resolveSpecFormatAdapter(
+          options?.specFormats ?? [],
+          config.specFormat
+        );
+        const derivedIdentity = adapter?.deriveIdentity && resolved.document ? adapter.deriveIdentity(resolved.document) : null;
+        const resolvedSlug = config.slug?.trim() || derivedIdentity?.slug;
+        if (!resolvedSlug) {
+          return yield* new OpenApiParseError({
+            message: "OpenAPI integration slug is required"
+          });
+        }
+        const explicitBaseUrl = config.baseUrl ?? resolved.baseUrl;
+        const needsDerivedBaseUrl = explicitBaseUrl == null;
+        const needsDerivedAuth = config.authenticationTemplate == null;
+        const preview = needsDerivedBaseUrl || needsDerivedAuth ? yield* previewSpecText(resolved.specText).pipe(
+          Effect3.flatMap(
+            (rawPreview) => enrichPreviewWithDiscoveredOAuth({
+              specText: resolved.specText,
+              preview: rawPreview,
+              specUrl: resolved.specUrl ?? specInputToSpecUrl(config.spec),
+              baseUrl: explicitBaseUrl
+            })
+          )
+        ) : void 0;
+        const derivedBaseUrl = needsDerivedBaseUrl && preview ? firstBaseUrlForPreview(preview) : void 0;
+        const effectiveBaseUrl = explicitBaseUrl ?? (derivedBaseUrl || void 0);
+        const derivedAuthenticationTemplate = needsDerivedAuth && preview ? deriveAuthenticationTemplateFromPreview(preview, effectiveBaseUrl) : void 0;
+        const slug = IntegrationSlug.make(resolvedSlug);
+        const existing = yield* ctx.core.integrations.get(slug);
+        if (existing) {
+          return yield* new IntegrationAlreadyExistsError({ slug });
+        }
+        const specHash = yield* sha256Hex(resolved.specText);
+        const integrationConfig = {
+          ...resolved.config ?? {},
+          specHash,
+          ...(resolved.specUrl ?? specInputToSpecUrl(config.spec)) !== void 0 ? { specUrl: resolved.specUrl ?? specInputToSpecUrl(config.spec) } : {},
+          // baseUrl is an optional override only. The host is otherwise
+          // resolved per call from the operation's `servers` (extracted from
+          // the spec), so we never bake a derived base URL into the config.
+          ...config.baseUrl ? { baseUrl: config.baseUrl } : {},
+          ...config.headers ? { headers: config.headers } : {},
+          ...config.queryParams ? { queryParams: config.queryParams } : {},
+          ...config.specFormat ? { specFormat: config.specFormat } : {},
+          ...config.family ? { family: config.family } : {},
+          // Prefer the caller's explicit template; otherwise derive from the
+          // spec's declared security schemes.
+          ...config.authenticationTemplate ? {
+            authenticationTemplate: normalizeOpenApiAuthInputs(config.authenticationTemplate)
+          } : resolved.authenticationTemplate && resolved.authenticationTemplate.length > 0 ? { authenticationTemplate: resolved.authenticationTemplate } : derivedAuthenticationTemplate && derivedAuthenticationTemplate.length > 0 ? { authenticationTemplate: derivedAuthenticationTemplate } : {}
+        };
+        yield* ctx.storage.putSpec(specHash, resolved.specText);
+        if (compiled) {
+          yield* ctx.storage.putDefs(specHash, JSON.stringify(compiled.hoistedDefs));
+        }
+        yield* ctx.transaction(
+          Effect3.gen(function* () {
+            yield* ctx.core.integrations.register({
+              slug,
+              name: config.name?.trim() || derivedIdentity?.name || compiled?.title || resolvedSlug,
+              description: config.description ?? derivedIdentity?.description ?? compiled?.description ?? compiled?.title ?? resolvedSlug,
+              config: integrationConfig,
+              canRemove: true,
+              canRefresh: integrationConfig.specUrl != null
+            });
+            if (config.healthCheck) {
+              yield* ctx.core.integrations.setHealthCheck(slug, config.healthCheck);
+            }
+            if (compiled) {
+              yield* ctx.storage.putOperations(
+                resolvedSlug,
+                openApiStoredOperationsFromCompiled(resolvedSlug, compiled)
+              );
+              return compiled.definitions.length;
+            }
+            const persisted = yield* compileAndPersistOpenApiSpecStreaming({
+              specText: resolved.specText,
+              integration: resolvedSlug,
+              storage: ctx.storage,
+              specHash,
+              keepPathItem: resolved.keepPathItem
+            });
+            return persisted.toolCount;
+          })
+        );
+        const toolCount = compiled ? compiled.definitions.length : yield* ctx.storage.listOperations(resolvedSlug).pipe(Effect3.map((operations) => operations.length));
+        return { slug, toolCount };
+      });
+      const updateSpec = (rawSlug, input) => Effect3.gen(function* () {
+        const slug = IntegrationSlug.make(rawSlug);
+        const record = yield* ctx.core.integrations.get(slug);
+        const current = record ? decodeOpenApiIntegrationConfig(record.config) : null;
+        if (!record || !current) {
+          return yield* new IntegrationNotFoundError({ slug });
+        }
+        const specInput = input?.spec ?? (current.specUrl ? { kind: "url", url: current.specUrl } : null);
+        if (specInput === null) {
+          return yield* new OpenApiParseError({
+            message: "This integration's spec was pasted inline and has no source URL to re-fetch. Provide the updated spec content."
+          });
+        }
+        const resolved = yield* resolveSpecForInput(
+          {
+            spec: specInput,
+            specFormat: current.specFormat,
+            headers: current.headers,
+            queryParams: current.queryParams,
+            baseUrl: current.baseUrl
+          },
+          httpClientLayer
+        );
+        const compiled = resolved.keepPathItem ? void 0 : yield* compileOpenApiSpec(resolved.specText);
+        const previousOperations = yield* ctx.storage.listOperations(rawSlug);
+        const previousNames = new Set(previousOperations.map((op) => op.toolName));
+        const specHash = yield* sha256Hex(resolved.specText);
+        yield* ctx.storage.putSpec(specHash, resolved.specText);
+        if (compiled) {
+          yield* ctx.storage.putDefs(specHash, JSON.stringify(compiled.hoistedDefs));
+        }
+        const nextConfig = {
+          ...current,
+          specHash,
+          ...(resolved.specUrl ?? specInputToSpecUrl(specInput)) !== void 0 ? { specUrl: resolved.specUrl ?? specInputToSpecUrl(specInput) } : {}
+        };
+        yield* ctx.transaction(
+          Effect3.gen(function* () {
+            yield* ctx.core.integrations.update(slug, {
+              config: nextConfig
+            });
+            if (compiled) {
+              yield* ctx.storage.putOperations(
+                rawSlug,
+                openApiStoredOperationsFromCompiled(rawSlug, compiled)
+              );
+            } else {
+              yield* compileAndPersistOpenApiSpecStreaming({
+                specText: resolved.specText,
+                integration: rawSlug,
+                storage: ctx.storage,
+                specHash,
+                keepPathItem: resolved.keepPathItem
+              });
+            }
+          })
+        );
+        const nextOperations = compiled ? openApiStoredOperationsFromCompiled(rawSlug, compiled) : yield* ctx.storage.listOperations(rawSlug);
+        const nextNames = new Set(nextOperations.map((op) => op.toolName));
+        const connections = yield* ctx.connections.list({ integration: slug });
+        yield* Effect3.forEach(
+          connections,
+          (connection) => ctx.connections.refresh({
+            owner: connection.owner,
+            integration: connection.integration,
+            name: connection.name
+          }).pipe(Effect3.catchTag("ConnectionNotFoundError", () => Effect3.succeed([]))),
+          { discard: true }
+        ).pipe(
+          Effect3.catchTag("IntegrationNotFoundError", () => Effect3.void),
+          Effect3.withSpan("openapi.plugin.update_spec.refresh_connections", {
+            attributes: { "openapi.connection_count": connections.length }
+          })
+        );
+        return {
+          slug,
+          toolCount: nextNames.size,
+          addedTools: [...nextNames].filter((name) => !previousNames.has(name)).sort(),
+          removedTools: [...previousNames].filter((name) => !nextNames.has(name)).sort()
+        };
+      }).pipe(
+        Effect3.withSpan("openapi.plugin.update_spec", {
+          attributes: { "openapi.integration.slug": rawSlug }
+        })
+      );
+      return {
+        previewSpec: (input) => Effect3.gen(function* () {
+          const previewInput = typeof input === "string" ? { spec: input } : input;
+          const spec = maybeUrl(previewInput.spec.trim()) ? { kind: "url", url: previewInput.spec.trim() } : { kind: "blob", value: previewInput.spec };
+          const resolved = yield* resolveSpecForInput(
+            { spec, specFormat: previewInput.specFormat },
+            httpClientLayer
+          );
+          const preview = yield* previewSpecText(resolved.specText);
+          return yield* enrichPreviewWithDiscoveredOAuth({
+            specText: resolved.specText,
+            preview,
+            specUrl: resolved.specUrl ?? (spec.kind === "url" ? spec.url : void 0)
+          });
+        }),
+        addSpec,
+        updateSpec,
+        removeSpec: (slug) => ctx.transaction(
+          Effect3.gen(function* () {
+            yield* ctx.storage.removeOperations(slug);
+            yield* ctx.core.integrations.remove(IntegrationSlug.make(slug)).pipe(Effect3.catchTag("IntegrationRemovalNotAllowedError", () => Effect3.void));
+          })
+        ),
+        getIntegration: (slug) => ctx.core.integrations.get(IntegrationSlug.make(slug)).pipe(
+          Effect3.map(
+            (record) => record ? {
+              slug: record.slug,
+              description: record.description,
+              kind: record.kind,
+              canRemove: record.canRemove,
+              canRefresh: record.canRefresh
+            } : null
+          )
+        ),
+        getConfig: (slug) => ctx.core.integrations.get(IntegrationSlug.make(slug)).pipe(
+          Effect3.map(
+            (record) => record ? decodeOpenApiIntegrationConfig(record.config) : null
+          )
+        ),
+        configure: (slug, input) => ctx.transaction(
+          Effect3.gen(function* () {
+            const record = yield* ctx.core.integrations.get(IntegrationSlug.make(slug));
+            if (!record) return [];
+            const current = decodeOpenApiIntegrationConfig(record.config);
+            if (!current) return [];
+            const merged = input.authenticationTemplate === void 0 ? current.authenticationTemplate ?? [] : input.mode === "replace" ? normalizeOpenApiAuthInputs(input.authenticationTemplate) : mergeAuthTemplates(
+              current.authenticationTemplate ?? [],
+              normalizeOpenApiAuthInputs(input.authenticationTemplate)
+            );
+            const next = {
+              ...current,
+              ...input.baseUrl !== void 0 ? { baseUrl: input.baseUrl } : {},
+              authenticationTemplate: merged
+            };
+            yield* ctx.core.integrations.update(IntegrationSlug.make(slug), {
+              config: next
+            });
+            return merged;
+          })
+        )
+      };
+    },
+    staticIntegrations: (self) => [
+      {
+        id: "openapi",
+        kind: "executor",
+        name: "OpenAPI",
+        tools: [
+          tool({
+            name: "previewSpec",
+            description: "Preview an OpenAPI document before adding it as an integration. Call this first when the user provides a spec URL/blob so you can inspect servers, auth schemes, operation count, and tags before `addSpec`. Do not collect API keys or OAuth client secrets in chat; use the connections tools for those values.",
+            inputSchema: PreviewSpecInputStandardSchema,
+            outputSchema: PreviewSpecOutputStandardSchema,
+            execute: (input) => self.previewSpec(input).pipe(
+              Effect3.map((preview) => ToolResult.ok(staticPreviewOutput(preview))),
+              Effect3.catchTags({
+                OpenApiParseError: ({ message }) => Effect3.succeed(openApiToolFailure("openapi_parse_failed", message)),
+                OpenApiExtractionError: ({ message }) => Effect3.succeed(openApiToolFailure("openapi_extraction_failed", message)),
+                OpenApiOAuthError: ({ message }) => Effect3.succeed(openApiToolFailure("openapi_oauth_failed", message))
+              })
+            )
+          }),
+          tool({
+            name: "addSpec",
+            description: "Add an OpenAPI integration to the catalog and persist its operations as tools. Recommended flow: call `previewSpec`, choose a `slug`, then create a connection for that integration with the user's API key or via `oauth.start`. When `baseUrl` is omitted it defaults to the spec's first server; when `authenticationTemplate` is omitted the auth methods are derived from the spec's declared security schemes (pass an explicit template to override how a credential is applied - apiKey header/query, or oauth bearer - or an empty array for no auth methods).",
+            annotations: {
+              requiresApproval: true,
+              approvalDescription: "Add an OpenAPI integration"
+            },
+            inputSchema: AddIntegrationInputStandardSchema,
+            outputSchema: AddIntegrationOutputStandardSchema,
+            execute: (input) => self.addSpec({
+              spec: input.spec,
+              slug: input.slug,
+              name: input.name,
+              description: input.description,
+              baseUrl: input.baseUrl,
+              headers: input.headers,
+              queryParams: input.queryParams,
+              specFormat: input.specFormat,
+              family: input.family,
+              healthCheck: input.healthCheck,
+              authenticationTemplate: input.authenticationTemplate
+            }).pipe(
+              Effect3.map(
+                (result) => ToolResult.ok({
+                  slug: String(result.slug),
+                  toolCount: result.toolCount
+                })
+              ),
+              Effect3.catchTags({
+                OpenApiParseError: ({ message }) => Effect3.succeed(openApiToolFailure("openapi_parse_failed", message)),
+                OpenApiExtractionError: ({ message }) => Effect3.succeed(openApiToolFailure("openapi_extraction_failed", message)),
+                OpenApiOAuthError: ({ message }) => Effect3.succeed(openApiToolFailure("openapi_oauth_failed", message)),
+                IntegrationAlreadyExistsError: ({ slug }) => Effect3.succeed(
+                  openApiToolFailure(
+                    "integration_already_exists",
+                    `Integration ${slug} already exists; update it instead of re-adding.`
+                  )
+                )
+              })
+            )
+          })
+        ]
+      }
+    ],
+    describeAuthMethods: describeOpenApiAuthMethods,
+    describeIntegrationDisplay: describeOpenApiIntegrationDisplay,
+    // Health checks: the declared liveness/identity probe. Core owns the spec
+    // storage; the plugin only enumerates candidates and runs probes.
+    listHealthCheckCandidates: (input) => listHealthCheckCandidatesOpenApi({ ctx: input.ctx, integration: input.integration }),
+    checkHealth: (input) => checkHealthOpenApi({
+      ctx: input.ctx,
+      integration: input.integration,
+      credential: input.credential,
+      spec: input.spec,
+      httpClientLayer: options?.httpClientLayer ?? input.ctx.httpClientLayer
+    }),
+    // Produce one tool per spec operation. Spec-derived, identical for every
+    // connection on the integration - so `getValue` is never called here. The
+    // operation bindings invokeTool needs are persisted at addSpec time; this
+    // hook only shapes the per-connection ToolDefs from the spec blob the
+    // catalog config points at.
+    resolveTools: ({ integration, config, storage }) => resolveOpenApiBackedTools({ integration, config, storage }),
+    invokeTool: ({ ctx: invokeCtx, toolRow, credential, args }) => {
+      const httpClientLayer = options?.httpClientLayer ?? invokeCtx.httpClientLayer;
+      return invokeOpenApiBackedTool({
+        ctx: invokeCtx,
+        toolRow,
+        credential,
+        args,
+        httpClientLayer,
+        invokeOptions: options?.invokeOptions
+      });
+    },
+    validateToolArgs: ({ ctx: validateCtx, toolRow, args }) => validateOpenApiBackedToolArgs({ ctx: validateCtx, toolRow, args }),
+    resolveAnnotations: ({ ctx: annotationsCtx, integration, toolRows }) => resolveOpenApiBackedAnnotations({
+      ctx: annotationsCtx,
+      integration: String(integration),
+      toolRows
+    }),
+    removeConnection: () => Effect3.void,
+    detect: ({
+      ctx: detectCtx,
+      url
+    }) => Effect3.gen(function* () {
+      const httpClientLayer = options?.httpClientLayer ?? detectCtx.httpClientLayer;
+      const trimmed = url.trim();
+      if (!trimmed) return null;
+      const parsed = yield* Effect3.try({
+        try: () => new URL(trimmed),
+        catch: (error) => error
+      }).pipe(Effect3.option);
+      if (Option2.isNone(parsed)) return null;
+      const specText = yield* resolveSpecText(trimmed).pipe(
+        Effect3.provide(httpClientLayer),
+        Effect3.catch(() => Effect3.succeed(null))
+      );
+      if (specText === null) return null;
+      const doc = yield* parse(specText).pipe(Effect3.catch(() => Effect3.succeed(null)));
+      if (!doc) return null;
+      const result = yield* extract(doc).pipe(Effect3.catch(() => Effect3.succeed(null)));
+      if (!result) return null;
+      const slug = Option2.getOrElse(result.title, () => "api").toLowerCase().replace(/[^a-z0-9]+/g, "_");
+      const name = Option2.getOrElse(result.title, () => slug);
+      return IntegrationDetectionResult.make({
+        kind: "openapi",
+        confidence: "high",
+        endpoint: trimmed,
+        name,
+        slug
+      });
+    })
+  };
+});
+
+export {
+  makeDefaultOpenapiStore,
+  resolveSpecFormatAdapter,
+  openApiPlugin
+};
+//# sourceMappingURL=chunk-OR27BCXQ.js.map