import { Option, Schema } from "effect";import {  ApiKeyAuthMethod,  TOKEN_VARIABLE,  renderAuthPlacements,  requiredPlacementVariables,} from "@executor-js/sdk/http-auth"; import type { Authentication } from "./types";import { SpecOverridesSchema, type SpecOverrides } from "./spec-overrides"; // ---------------------------------------------------------------------------// OpenAPI integration config — the opaque blob stored on the catalog// `integration.config` column (D1). Core never parses it; the plugin writes it// at register time and reads it back in `resolveTools` / `invokeTool`.//// In v2 there are NO credential bindings, NO per-source secret slots, and NO// StoredSource credential config. The config carries only://   - the content hash of the spec blob and/or the source URL to (re)fetch//     from,//   - optional RFC 6902 overrides and the raw source hash they apply to,//   - the optional base URL override,//   - the auth templates a connection's value is rendered through.// The resolved spec text itself lives in the plugin blob store, keyed// `spec/<specHash>` — it's a build input for resolveTools/refresh, not data// any list/invoke path should pay to load. Rows that predate the blob store// (inline `spec` text) are rewritten before this schema sees them: cloud by// the out-of-band migrate-specs-to-blobs script, the libSQL hosts by the// boot-time ledger migration.// --------------------------------------------------------------------------- const OAuthAuthenticationSchema = Schema.Struct({  slug: Schema.String,  kind: Schema.Literal("oauth2"),  label: Schema.optional(Schema.String),  authorizationUrl: Schema.String,  tokenUrl: Schema.String,  resource: Schema.optional(Schema.NullOr(Schema.String)),  scopes: Schema.Array(Schema.String),  supportsClientIdMetadataDocument: Schema.optional(Schema.Boolean),}); export const AuthenticationSchema = Schema.Union([OAuthAuthenticationSchema, ApiKeyAuthMethod]); export const OpenApiIntegrationConfigSchema = Schema.Struct({  /** Hex SHA-256 of the resolved spec text — the content address of the spec   *  blob (`spec/<hash>` in the plugin blob store). */  specHash: Schema.optional(Schema.String),  /** Hex SHA-256 of the unmodified source text when spec overrides are active. */  sourceSpecHash: Schema.optional(Schema.String),  /** Origin URL the spec was fetched from, when known. Enables refresh. */  specUrl: Schema.optional(Schema.String),  /** Optional base URL override. */  baseUrl: Schema.optional(Schema.String),  /** The PRODUCT's domain, recorded at add time when the caller knew it (a   *  registry row names notion.com). The spec's own host is often a code   *  host (raw.githubusercontent.com) that says nothing about the product,   *  which sent credential guidance and favicons to the wrong domain. */  displayDomain: Schema.optional(Schema.String),  /** Static headers applied to every request (no secret material). */  headers: Schema.optional(Schema.Record(Schema.String, Schema.String)),  /** Static query params applied to every request (no secret material). */  queryParams: Schema.optional(Schema.Record(Schema.String, Schema.String)),  /** Adapter id used to fetch/convert the source format, when not plain OpenAPI. */  specFormat: Schema.optional(Schema.String),  /** Catalog family for grouped integration display. */  family: Schema.optional(Schema.String),  /** Ordered RFC 6902 operations reapplied whenever the source spec is refreshed. */  specOverrides: Schema.optional(SpecOverridesSchema),  /** The auth methods a connection's value can be applied through. */  authenticationTemplate: Schema.optional(Schema.Array(AuthenticationSchema)),}); export type OpenApiIntegrationConfig = Omit<  typeof OpenApiIntegrationConfigSchema.Type,  "authenticationTemplate" | "specOverrides"> & {  /** Branded over the schema's structural form so the template renderer can   *  treat `slug` as an `AuthTemplateSlug`. */  readonly authenticationTemplate?: readonly Authentication[];  readonly specOverrides?: SpecOverrides;}; const decodeConfig = Schema.decodeUnknownOption(OpenApiIntegrationConfigSchema); /** Decode the opaque integration config blob into the openapi shape. *  Returns null when the blob is missing/incompatible. */export const decodeOpenApiIntegrationConfig = (value: unknown): OpenApiIntegrationConfig | null =>  Option.getOrNull(decodeConfig(value)) as OpenApiIntegrationConfig | null; // ---------------------------------------------------------------------------// Template rendering — "auth state derived into the auth-template format"// (D11). An apiKey method renders through the shared placements renderer; an// oauth template (no explicit placement) renders a bearer `authorization`// header from the `token` input (the access token).// --------------------------------------------------------------------------- export interface RenderedAuth {  readonly headers: Record<string, string>;  readonly queryParams: Record<string, string>;} /** Render an auth template against a connection's resolved input `values` *  (`variable → value`). Each placement substitutes from its own entry, so a *  method with two distinct inputs (e.g. Datadog) fills each header from a *  different value. */export const renderAuthTemplate = (  template: Authentication,  values: Record<string, string | null>,): RenderedAuth => {  if (template.kind === "oauth2") {    return {      headers: { authorization: `Bearer ${values[TOKEN_VARIABLE] ?? ""}` },      queryParams: {},    };  }  return renderAuthPlacements(template.placements, values);}; /** The distinct input variables a template references — the inputs a connection *  must supply. An oauth template needs `token`; an apiKey method needs every *  variable across its placements. */export const requiredTemplateVariables = (template: Authentication): readonly string[] => {  if (template.kind === "oauth2") return [TOKEN_VARIABLE];  return requiredPlacementVariables(template.placements);};