lael-labs/executor

packages/core/sdk/src/errors.ts+4−1

 export class SecretResolutionError extends Schema.TaggedError<SecretResolutionError>()(
   "SecretResolutionError",
-  { secretId: SecretId, message: Schema.String },
+  {
+    secretId: SecretId,
+    message: Schema.String,
+  },
 ) {}
 export class PolicyDeniedError extends Schema.TaggedError<PolicyDeniedError>()(

packages/core/sdk/src/executor.ts+25−9

 import { Context, Effect } from "effect";
 import type { ToolId, SecretId, PolicyId } from "./ids";
-import type { Secret, SecretStore } from "./secrets";
+import type { SecretRef, SecretStore } from "./secrets";
 import type {
   ToolMetadata,
   ToolSchema,
   ToolNotFoundError,
   ToolInvocationError,
   SecretNotFoundError,
+  SecretResolutionError,
   PolicyDeniedError,
 } from "./errors";
 import type { ElicitationDeclinedError } from "./elicitation";
   };
   readonly secrets: {
-    readonly list: () => Effect.Effect<readonly Secret[]>;
+    readonly list: () => Effect.Effect<readonly SecretRef[]>;
-    readonly store: (input: {
+    /** Resolve a secret value by id */
+    readonly resolve: (
+      secretId: SecretId,
+    ) => Effect.Effect<string, SecretNotFoundError | SecretResolutionError>;
+    /** Check if a secret can be resolved */
+    readonly status: (
+      secretId: SecretId,
+    ) => Effect.Effect<"resolved" | "missing">;
+    /** Store a secret value (creates ref + writes to provider) */
+    readonly set: (input: {
+      readonly id: SecretId;
       readonly name: string;
       readonly value: string;
       readonly purpose?: string;
-    }) => Effect.Effect<Secret>;
+      readonly provider?: string;
+    }) => Effect.Effect<SecretRef, SecretResolutionError>;
     readonly remove: (
-      secretId: string,
+      secretId: SecretId,
     ) => Effect.Effect<boolean, SecretNotFoundError>;
   };
       secrets: {
         list: () => secrets.list(scope.id),
-        store: (input: {
+        resolve: (secretId: SecretId) => secrets.resolve(secretId, scope.id),
+        status: (secretId: SecretId) => secrets.status(secretId, scope.id),
+        set: (input: {
+          readonly id: SecretId;
           readonly name: string;
           readonly value: string;
           readonly purpose?: string;
-        }) => secrets.store({ ...input, scopeId: scope.id }),
+          readonly provider?: string;
-        remove: (secretId: string) =>
+        }) => secrets.set({ ...input, scopeId: scope.id }),
-          secrets.remove(secretId as SecretId),
+        remove: (secretId: SecretId) =>
+          secrets.remove(secretId),
       },
       close: () =>

packages/core/sdk/src/in-memory/secret-store.ts+115−25

@@ -1,50 +1,140 @@
1	import { Effect } from "effect";	1	import { Effect, Option } from "effect";
2		2
3	import { ScopeId, SecretId } from "../ids";	3	import { ScopeId, SecretId } from "../ids";
4	import { SecretNotFoundError } from "../errors";	4	import { SecretNotFoundError, SecretResolutionError } from "../errors";
5	import type { Secret } from "../secrets";	5	import type { SecretRef, SecretProvider } from "../secrets";
		6
		7	// ---------------------------------------------------------------------------
		8	// In-memory secret provider
		9	// ---------------------------------------------------------------------------
		10
		11	export const makeInMemorySecretProvider = (): SecretProvider => {
		12	const values = new Map<string, string>();
		13	return {
		14	key: "memory",
		15	writable: true,
		16	get: (key) => Effect.sync(() => values.get(key) ?? null),
		17	set: (key, value) => Effect.sync(() => { values.set(key, value); }),
		18	delete: (key) => Effect.sync(() => values.delete(key)),
		19	list: () => Effect.sync(() => [...values.keys()]),
		20	};
		21	};
		22
		23	// ---------------------------------------------------------------------------
		24	// In-memory secret store
		25	// ---------------------------------------------------------------------------
6		26
7	export const makeInMemorySecretStore = () => {	27	export const makeInMemorySecretStore = () => {
8	const secrets = new Map<string, Secret & { value: string }>();	28	const refs = new Map<string, SecretRef>();
9	let counter = 0;	29	const providers: SecretProvider[] = [];
		30
		31	// Add a default in-memory provider
		32	const defaultProvider = makeInMemorySecretProvider();
		33	providers.push(defaultProvider);
		34
		35	const findWritableProvider = (key?: string): SecretProvider \| undefined =>
		36	key ? providers.find((p) => p.key === key) : providers.find((p) => p.writable);
		37
		38	const resolveFromProviders = (
		39	secretId: SecretId,
		40	providerKey: string \| undefined,
		41	): Effect.Effect<string \| null> => {
		42	if (providerKey) {
		43	const provider = providers.find((p) => p.key === providerKey);
		44	return provider ? provider.get(secretId) : Effect.succeed(null);
		45	}
		46	// Try all providers in order
		47	return Effect.gen(function* () {
		48	for (const provider of providers) {
		49	const value = yield* provider.get(secretId);
		50	if (value !== null) return value;
		51	}
		52	return null;
		53	});
		54	};
10		55
11	return {	56	return {
12	list: (scopeId: ScopeId) =>	57	list: (scopeId: ScopeId) =>
13	Effect.succeed(	58	Effect.sync(() =>
14	[...secrets.values()].filter((s) => s.scopeId === scopeId),	59	[...refs.values()].filter((r) => r.scopeId === scopeId),
15	),	60	),
		61
16	get: (secretId: SecretId) =>	62	get: (secretId: SecretId) =>
17	Effect.fromNullable(secrets.get(secretId)).pipe(	63	Effect.fromNullable(refs.get(secretId)).pipe(
18	Effect.mapError(() => new SecretNotFoundError({ secretId })),	64	Effect.mapError(() => new SecretNotFoundError({ secretId })),
19	),	65	),
20	resolve: (secretId: SecretId) =>	66
21	Effect.fromNullable(secrets.get(secretId)).pipe(	67	resolve: (secretId: SecretId, _scopeId: ScopeId) =>
22	Effect.mapError(() => new SecretNotFoundError({ secretId })),	68	Effect.gen(function* () {
23	Effect.map((s) => s.value),	69	const ref = refs.get(secretId);
24	),	70	const providerKey = ref ? Option.getOrUndefined(ref.provider) : undefined;
25	store: (input: {	71
		72	const value = yield* resolveFromProviders(secretId, providerKey);
		73	if (value === null) {
		74	return yield* new SecretResolutionError({
		75	secretId,
		76	message: `Secret "${secretId}" not found in any provider`,
		77	});
		78	}
		79	return value;
		80	}),
		81
		82	status: (secretId: SecretId, _scopeId: ScopeId) =>
		83	Effect.gen(function* () {
		84	const value = yield* resolveFromProviders(secretId, undefined);
		85	return value !== null ? ("resolved" as const) : ("missing" as const);
		86	}),
		87
		88	set: (input: {
26	readonly scopeId: ScopeId;	89	readonly scopeId: ScopeId;
		90	readonly id: SecretId;
27	readonly name: string;	91	readonly name: string;
28	readonly value: string;	92	readonly value: string;
29	readonly purpose?: string;	93	readonly purpose?: string;
		94	readonly provider?: string;
30	}) =>	95	}) =>
31	Effect.sync(() => {	96	Effect.gen(function* () {
32	const id = SecretId.make(`secret-${++counter}`);	97	const provider = findWritableProvider(input.provider);
33	const secret = {	98	if (!provider?.set) {
34	id,	99	return yield* new SecretResolutionError({
		100	secretId: input.id,
		101	message: `No writable provider found${input.provider ? ` (requested: ${input.provider})` : ""}`,
		102	});
		103	}
		104
		105	yield* provider.set(input.id, input.value);
		106
		107	const ref: SecretRef = {
		108	id: input.id,
35	scopeId: input.scopeId,	109	scopeId: input.scopeId,
36	name: input.name,	110	name: input.name,
		111	provider: Option.fromNullable(input.provider),
37	purpose: input.purpose,	112	purpose: input.purpose,
38	createdAt: new Date(),	113	createdAt: new Date(),
39	value: input.value,
40	};	114	};
41	secrets.set(id, secret);	115	refs.set(input.id, ref);
42	return secret;	116	return ref;
43	}),	117	}),
		118
44	remove: (secretId: SecretId) =>	119	remove: (secretId: SecretId) =>
45	Effect.fromNullable(secrets.get(secretId)).pipe(	120	Effect.gen(function* () {
46	Effect.mapError(() => new SecretNotFoundError({ secretId })),	121	const ref = refs.get(secretId);
47	Effect.map(() => secrets.delete(secretId)),	122	if (!ref) return yield* new SecretNotFoundError({ secretId });
48	),	123
		124	const providerKey = Option.getOrUndefined(ref.provider);
		125	const provider = findWritableProvider(providerKey);
		126	if (provider?.delete) {
		127	yield* provider.delete(secretId);
		128	}
		129
		130	refs.delete(secretId);
		131	return true;
		132	}),
		133
		134	addProvider: (provider: SecretProvider) =>
		135	Effect.sync(() => { providers.push(provider); }),
		136
		137	providers: () =>
		138	Effect.sync(() => providers.map((p) => p.key)),
49	};	139	};
50	};	140	};

packages/core/sdk/src/index.test.ts+24−13

   ElicitationResponse,
   type MemoryToolContext,
   type ToolId,
+  SecretId,
 } from "./index";
 // ---------------------------------------------------------------------------
     Effect.gen(function* () {
       const executor = yield* createExecutor(makeTestConfig());
-      const secret = yield* executor.secrets.store({
+      const secret = yield* executor.secrets.set({
+        id: SecretId.make("api-key"),
         name: "API Key",
         value: "sk_test_123",
         purpose: "auth",
       });
       expect(secret.name).toBe("API Key");
+      expect(secret.id).toBe("api-key");
       const listed = yield* executor.secrets.list();
       expect(listed).toHaveLength(1);
       expect(listed[0]!.name).toBe("API Key");
+      // Can resolve by id
+      const resolved = yield* executor.secrets.resolve(SecretId.make("api-key"));
+      expect(resolved).toBe("sk_test_123");
+      // Can check status
+      const status = yield* executor.secrets.status(SecretId.make("api-key"));
+      expect(status).toBe("resolved");
+      const missing = yield* executor.secrets.status(SecretId.make("nonexistent"));
+      expect(missing).toBe("missing");
     }),
   );
                     ctx: MemoryToolContext,
                   ) =>
                     Effect.gen(function* () {
-                      // Read the current secrets
+                      // Try to resolve the existing secret by key
-                      const secrets = yield* ctx.sdk.secrets.list();
+                      const secretId = SecretId.make(secretName);
-                      const existing = secrets.find(
+                      const status = yield* ctx.sdk.secrets.status(secretId);
-                        (s) => s.name === secretName,
-                      );
                       let oldValue = "<none>";
-                      if (existing) {
+                      if (status === "resolved") {
-                        oldValue = yield* ctx.sdk.secrets.resolve(
+                        oldValue = yield* ctx.sdk.secrets.resolve(secretId);
-                          existing.id,
+                        yield* ctx.sdk.secrets.remove(secretId);
-                        );
-                        yield* ctx.sdk.secrets.remove(existing.id);
                       }
                       // Store the new value
-                      yield* ctx.sdk.secrets.store({
+                      yield* ctx.sdk.secrets.set({
+                        id: secretId,
                         name: secretName,
                         value: newValue,
                         purpose: "api_key",
       );
       // 1. Write initial secret
-      yield* executor.secrets.store({
+      yield* executor.secrets.set({
+        id: SecretId.make("DB_PASSWORD"),
         name: "DB_PASSWORD",
         value: "hunter2",
         purpose: "database",

packages/core/sdk/src/index.ts+2−2

@@ -34,7 +34,7 @@ export { · 33 unmodified lines
34	} from "./elicitation";	34	} from "./elicitation";
35		35
36	// Secrets	36	// Secrets
37	export { Secret, SecretStore } from "./secrets";	37	export { SecretRef, SecretStore, type SecretProvider } from "./secrets";
38		38
39	// Policies	39	// Policies
40	export { Policy, PolicyAction, PolicyEngine } from "./policies";	40	export { Policy, PolicyAction, PolicyEngine } from "./policies";
@@ -73,7 +73,7 @@ export { hoistDefinitions, collectRefs, reattachDefs } from "./schema-refs"; · 32 unmodified lines
73		73
74	// In-memory implementations	74	// In-memory implementations
75	export { makeInMemoryToolRegistry } from "./in-memory/tool-registry";	75	export { makeInMemoryToolRegistry } from "./in-memory/tool-registry";
76	export { makeInMemorySecretStore } from "./in-memory/secret-store";	76	export { makeInMemorySecretStore, makeInMemorySecretProvider } from "./in-memory/secret-store";
77	export { makeInMemoryPolicyEngine } from "./in-memory/policy-engine";	77	export { makeInMemoryPolicyEngine } from "./in-memory/policy-engine";
78		78
79	// Testing	79	// Testing

packages/core/sdk/src/plugins/in-memory-tools.ts+10−7

 import type { SecretId } from "../ids";
 import { ToolId } from "../ids";
 import { ToolInvocationError } from "../errors";
-import type { Secret } from "../secrets";
+import type { SecretRef } from "../secrets";
 import {
   ToolInvocationResult,
   type ToolRegistration,
 /** SDK services available to in-memory tool handlers */
 export interface MemoryToolSdkAccess {
   readonly secrets: {
-    readonly list: () => Effect.Effect<readonly Secret[]>;
+    readonly list: () => Effect.Effect<readonly SecretRef[]>;
     readonly resolve: (secretId: SecretId) => Effect.Effect<string, unknown>;
-    readonly store: (input: {
+    readonly status: (secretId: SecretId) => Effect.Effect<"resolved" | "missing">;
+    readonly set: (input: {
+      readonly id: SecretId;
       readonly name: string;
       readonly value: string;
       readonly purpose?: string;
-    }) => Effect.Effect<Secret>;
+    }) => Effect.Effect<SecretRef, unknown>;
     readonly remove: (secretId: SecretId) => Effect.Effect<boolean, unknown>;
   };
 }
       sdk: {
         secrets: {
           list: () => pluginCtx.secrets.list(pluginCtx.scope.id),
-          resolve: (secretId) => pluginCtx.secrets.resolve(secretId),
+          resolve: (secretId) => pluginCtx.secrets.resolve(secretId, pluginCtx.scope.id),
-          store: (input) =>
+          status: (secretId) => pluginCtx.secrets.status(secretId, pluginCtx.scope.id),
-            pluginCtx.secrets.store({
+          set: (input) =>
+            pluginCtx.secrets.set({
               ...input,
               scopeId: pluginCtx.scope.id,
             }),

packages/core/sdk/src/secrets.ts+71−5

@@ -3,32 +3,98 @@ import { Context, Effect, Schema } from "effect"; · 2 unmodified lines
3	import { SecretId, ScopeId } from "./ids";	3	import { SecretId, ScopeId } from "./ids";
4	import { SecretNotFoundError, SecretResolutionError } from "./errors";	4	import { SecretNotFoundError, SecretResolutionError } from "./errors";
5		5
6	export class Secret extends Schema.Class<Secret>("Secret")({	6	// ---------------------------------------------------------------------------
		7	// SecretProvider — adapter interface for secret backends
		8	// ---------------------------------------------------------------------------
		9
		10	export interface SecretProvider {
		11	/** Unique key (e.g. "keychain", "env", "1password", "memory") */
		12	readonly key: string;
		13	/** Whether this provider supports writing */
		14	readonly writable: boolean;
		15	/** Get a secret value by key. Returns null if not found. */
		16	readonly get: (key: string) => Effect.Effect<string \| null>;
		17	/** Set a secret value. Only called on writable providers. */
		18	readonly set?: (key: string, value: string) => Effect.Effect<void>;
		19	/** Delete a secret. Only called on writable providers. */
		20	readonly delete?: (key: string) => Effect.Effect<boolean>;
		21	/** List known secret keys. Optional — not all providers can enumerate. */
		22	readonly list?: () => Effect.Effect<readonly string[]>;
		23	}
		24
		25	// ---------------------------------------------------------------------------
		26	// SecretRef — what gets stored (not the value itself)
		27	// ---------------------------------------------------------------------------
		28
		29	export class SecretRef extends Schema.Class<SecretRef>("SecretRef")({
7	id: SecretId,	30	id: SecretId,
8	scopeId: ScopeId,	31	scopeId: ScopeId,
		32	/** Human-readable label (e.g. "Cloudflare API Token") */
9	name: Schema.String,	33	name: Schema.String,
		34	/** Optional: pin to a specific provider */
		35	provider: Schema.optionalWith(Schema.String, { as: "Option" }),
		36	/** What this secret is for */
10	purpose: Schema.optional(Schema.String),	37	purpose: Schema.optional(Schema.String),
11	createdAt: Schema.DateFromNumber,	38	createdAt: Schema.DateFromNumber,
12	}) {}	39	}) {}
13		40
		41	// ---------------------------------------------------------------------------
		42	// SecretStore — manages refs + delegates resolution to providers
		43	// ---------------------------------------------------------------------------
		44
14	export class SecretStore extends Context.Tag("@executor/sdk/SecretStore")<	45	export class SecretStore extends Context.Tag("@executor/sdk/SecretStore")<
15	SecretStore,	46	SecretStore,
16	{	47	{
17	readonly list: (scopeId: ScopeId) => Effect.Effect<readonly Secret[]>;	48	/** List all secret refs for a scope */
		49	readonly list: (scopeId: ScopeId) => Effect.Effect<readonly SecretRef[]>;
		50
		51	/** Get a specific secret ref by id */
18	readonly get: (	52	readonly get: (
19	secretId: SecretId,	53	secretId: SecretId,
20	) => Effect.Effect<Secret, SecretNotFoundError>;	54	) => Effect.Effect<SecretRef, SecretNotFoundError>;
		55
		56	/**
		57	* Resolve a secret value by id.
		58	* Walks the provider chain (and optionally scope chain) to find the value.
		59	*/
21	readonly resolve: (	60	readonly resolve: (
22	secretId: SecretId,	61	secretId: SecretId,
		62	scopeId: ScopeId,
23	) => Effect.Effect<string, SecretNotFoundError \| SecretResolutionError>;	63	) => Effect.Effect<string, SecretNotFoundError \| SecretResolutionError>;
24	readonly store: (input: {	64
		65	/**
		66	* Check if a secret can be resolved.
		67	*/
		68	readonly status: (
		69	secretId: SecretId,
		70	scopeId: ScopeId,
		71	) => Effect.Effect<"resolved" \| "missing">;
		72
		73	/**
		74	* Store a secret value. Creates a ref and writes the value to the
		75	* preferred writable provider.
		76	*/
		77	readonly set: (input: {
25	readonly scopeId: ScopeId;	78	readonly scopeId: ScopeId;
		79	readonly id: SecretId;
26	readonly name: string;	80	readonly name: string;
27	readonly value: string;	81	readonly value: string;
28	readonly purpose?: string;	82	readonly purpose?: string;
29	}) => Effect.Effect<Secret>;	83	/** Pin to a specific provider. Otherwise uses the first writable one. */
		84	readonly provider?: string;
		85	}) => Effect.Effect<SecretRef, SecretResolutionError>;
		86
		87	/** Remove a secret ref and its value from the provider */
30	readonly remove: (	88	readonly remove: (
31	secretId: SecretId,	89	secretId: SecretId,
32	) => Effect.Effect<boolean, SecretNotFoundError>;	90	) => Effect.Effect<boolean, SecretNotFoundError>;
		91
		92	// ----- Provider management -----
		93
		94	/** Register a secret provider */
		95	readonly addProvider: (provider: SecretProvider) => Effect.Effect<void>;
		96
		97	/** List registered provider keys */
		98	readonly providers: () => Effect.Effect<readonly string[]>;
33	}	99	}
34	>() {}	100	>() {}

packages/plugins/openapi/src/invoke.ts+68−19

   type ToolInvoker,
   ToolInvocationResult,
   ToolInvocationError,
+  type ScopeId,
+  type SecretId,
 } from "@executor/sdk";
 import { OpenApiInvocationError } from "./errors";
 import type { OpenApiOperationStore } from "./operation-store";
 import {
+  type HeaderValue,
   type OperationBinding,
   InvocationConfig,
   InvocationResult,
 });
 // ---------------------------------------------------------------------------
-// Header application
+// Header resolution — resolves secret refs at invocation time
 // ---------------------------------------------------------------------------
+const resolveHeaders = (
+  headers: Record<string, HeaderValue>,
+  secrets: { readonly resolve: (secretId: SecretId, scopeId: ScopeId) => Effect.Effect<string, unknown> },
+  scopeId: ScopeId,
+): Effect.Effect<Record<string, string>, ToolInvocationError> =>
+  Effect.gen(function* () {
+    const resolved: Record<string, string> = {};
+    for (const [name, value] of Object.entries(headers)) {
+      if (typeof value === "string") {
+        resolved[name] = value;
+      } else {
+        const secret = yield* secrets.resolve(value.secretId as SecretId, scopeId).pipe(
+          Effect.mapError(() =>
+            new ToolInvocationError({
+              toolId: "" as ToolId,
+              message: `Failed to resolve secret "${value.secretId}" for header "${name}"`,
+              cause: undefined,
+            }),
+          ),
+        );
+        resolved[name] = value.prefix ? `${value.prefix}${secret}` : secret;
+      }
+    }
+    return resolved;
+  });
 const applyHeaders = (
   request: HttpClientRequest.HttpClientRequest,
   headers: Record<string, string>,
   operation: OperationBinding,
   args: Record<string, unknown>,
   config: InvocationConfig,
+  /** Pre-resolved headers (secrets already resolved) */
+  resolvedHeaders?: Record<string, string>,
 ) {
   const client = yield* HttpClient.HttpClient;
     }
   }
-  // Static headers (auth, custom headers, etc.)
+  // Static headers (auth, custom headers, etc.) — use pre-resolved if available
-  request = applyHeaders(request, config.headers);
+  request = applyHeaders(request, resolvedHeaders ?? {});
   // Execute
   const response = yield* client.execute(request).pipe(
 // ToolInvoker — bridges operation store + HTTP client into SDK invoker
 // ---------------------------------------------------------------------------
-export const makeOpenApiInvoker = (
+export const makeOpenApiInvoker = (opts: {
-  operationStore: OpenApiOperationStore,
+  readonly operationStore: OpenApiOperationStore;
-  httpClientLayer: Layer.Layer<HttpClient.HttpClient>,
+  readonly httpClientLayer: Layer.Layer<HttpClient.HttpClient>;
-): ToolInvoker => ({
+  readonly secrets: { readonly resolve: (secretId: SecretId, scopeId: ScopeId) => Effect.Effect<string, unknown> };
+  readonly scopeId: ScopeId;
+}): ToolInvoker => ({
   invoke: (toolId: ToolId, args: unknown, _options) =>
     Effect.gen(function* () {
-      const entry = yield* operationStore.get(toolId);
+      const entry = yield* opts.operationStore.get(toolId);
       if (!entry) {
         return yield* new ToolInvocationError({
           toolId,
       const { binding, config } = entry;
       const baseUrl = config.baseUrl;
+      // Resolve secret-backed headers
+      const resolvedHeaders = yield* resolveHeaders(
+        config.headers,
+        opts.secrets,
+        opts.scopeId,
+      );
       const clientWithBaseUrl = baseUrl
         ? Layer.effect(
             HttpClient.HttpClient,
                 HttpClientRequest.prependUrl(baseUrl),
               ),
             ),
-          ).pipe(Layer.provide(httpClientLayer))
+          ).pipe(Layer.provide(opts.httpClientLayer))
-        : httpClientLayer;
+        : opts.httpClientLayer;
       const result = yield* invoke(
         binding,
         (args ?? {}) as Record<string, unknown>,
         config,
+        resolvedHeaders,
       ).pipe(Effect.provide(clientWithBaseUrl));
       return new ToolInvocationResult({
         status: result.status,
       });
     }).pipe(
-      Effect.mapError((err) =>
+      Effect.catchAll((err) => {
-        err._tag === "ToolInvocationError"
+        if (
-          ? err
+          typeof err === "object" &&
-          : new ToolInvocationError({
+          err !== null &&
-              toolId,
+          "_tag" in err &&
-              message: `OpenAPI invocation failed: ${err.message}`,
+          (err as { _tag: string })._tag === "ToolInvocationError"
-              cause: err,
+        ) {
-            }),
+          return Effect.fail(err as ToolInvocationError);
-      ),
+        }
+        return Effect.fail(
+          new ToolInvocationError({
+            toolId,
+            message: `OpenAPI invocation failed: ${err instanceof Error ? err.message : String(err)}`,
+            cause: err,
+          }),
+        );
+      }),
     ),
 });

packages/plugins/openapi/src/plugin.test.ts+96−1

@@ -6,11 +6,12 @@ import { · 5 unmodified lines
6	HttpApiEndpoint,	6	HttpApiEndpoint,
7	HttpApiGroup,	7	HttpApiGroup,
8	HttpClient,	8	HttpClient,
		9	HttpServerRequest,
9	OpenApi,	10	OpenApi,
10	} from "@effect/platform";	11	} from "@effect/platform";
11	import { NodeHttpServer } from "@effect/platform-node";	12	import { NodeHttpServer } from "@effect/platform-node";
12		13
13	import { createExecutor, makeTestConfig } from "@executor/sdk";	14	import { createExecutor, makeTestConfig, SecretId } from "@executor/sdk";
14	import { openApiPlugin } from "./plugin";	15	import { openApiPlugin } from "./plugin";
15		16
16	// ---------------------------------------------------------------------------	17	// ---------------------------------------------------------------------------
@@ -22,6 +23,11 @@ class Item extends Schema.Class<Item>("Item")({ · 5 unmodified lines
22	name: Schema.String,	23	name: Schema.String,
23	}) {}	24	}) {}
24		25
		26	class EchoHeaders extends Schema.Class<EchoHeaders>("EchoHeaders")({
		27	authorization: Schema.optional(Schema.String),
		28	"x-static": Schema.optional(Schema.String),
		29	}) {}
		30
25	const ItemsGroup = HttpApiGroup.make("items")	31	const ItemsGroup = HttpApiGroup.make("items")
26	.add(	32	.add(
27	HttpApiEndpoint.get("listItems", "/items").addSuccess(Schema.Array(Item)),	33	HttpApiEndpoint.get("listItems", "/items").addSuccess(Schema.Array(Item)),
@@ -30,6 +36,9 @@ const ItemsGroup = HttpApiGroup.make("items") · 2 unmodified lines
30	HttpApiEndpoint.get("getItem", "/items/:itemId")	36	HttpApiEndpoint.get("getItem", "/items/:itemId")
31	.setPath(Schema.Struct({ itemId: Schema.NumberFromString }))	37	.setPath(Schema.Struct({ itemId: Schema.NumberFromString }))
32	.addSuccess(Item),	38	.addSuccess(Item),
		39	)
		40	.add(
		41	HttpApiEndpoint.get("echoHeaders", "/echo-headers").addSuccess(EchoHeaders),
33	);	42	);
34		43
35	const TestApi = HttpApi.make("testApi").add(ItemsGroup);	44	const TestApi = HttpApi.make("testApi").add(ItemsGroup);
@@ -57,6 +66,15 @@ const ItemsGroupLive = HttpApiBuilder.group(TestApi, "items", (handlers) => · 21 unmodified lines
57	name: "Unknown",	66	name: "Unknown",
58	},	67	},
59	),	68	),
		69	)
		70	.handle("echoHeaders", () =>
		71	Effect.gen(function* () {
		72	const req = yield* HttpServerRequest.HttpServerRequest;
		73	return new EchoHeaders({
		74	authorization: req.headers["authorization"],
		75	"x-static": req.headers["x-static"],
		76	});
		77	}),
60	),	78	),
61	);	79	);
62		80
@@ -98,6 +116,83 @@ layer(TestLayer)("OpenAPI Plugin", (it) => { · 35 unmodified lines
98	}),	116	}),
99	);	117	);
100		118
		119	it.effect("resolves secret-backed headers at invocation time", () =>
		120	Effect.gen(function* () {
		121	const httpClient = yield* HttpClient.HttpClient;
		122	const clientLayer = Layer.succeed(HttpClient.HttpClient, httpClient);
		123
		124	const executor = yield* createExecutor(
		125	makeTestConfig({
		126	plugins: [
		127	openApiPlugin({ httpClientLayer: clientLayer }),
		128	] as const,
		129	}),
		130	);
		131
		132	// Store a secret
		133	yield* executor.secrets.set({
		134	id: SecretId.make("test-api-token"),
		135	name: "Test API Token",
		136	value: "secret-value-123",
		137	});
		138
		139	// Add spec with secret-backed header
		140	yield* executor.openapi.addSpec({
		141	spec: specJson,
		142	namespace: "authed",
		143	baseUrl: "",
		144	headers: {
		145	"Authorization": { secretId: "test-api-token", prefix: "Bearer " },
		146	"X-Static": "hello",
		147	},
		148	});
		149
		150	// Invoke the echo endpoint — verifies secret was resolved and sent
		151	const result = yield* executor.tools.invoke(
		152	"authed.items.echoHeaders",
		153	{},
		154	);
		155
		156	expect(result.error).toBeNull();
		157	const data = result.data as { authorization?: string; "x-static"?: string };
		158	expect(data.authorization).toBe("Bearer secret-value-123");
		159	expect(data["x-static"]).toBe("hello");
		160	}),
		161	);
		162
		163	it.effect("fails clearly when a secret is missing", () =>
		164	Effect.gen(function* () {
		165	const httpClient = yield* HttpClient.HttpClient;
		166	const clientLayer = Layer.succeed(HttpClient.HttpClient, httpClient);
		167
		168	const executor = yield* createExecutor(
		169	makeTestConfig({
		170	plugins: [
		171	openApiPlugin({ httpClientLayer: clientLayer }),
		172	] as const,
		173	}),
		174	);
		175
		176	// Add spec with secret-backed header but DON'T store the secret
		177	yield* executor.openapi.addSpec({
		178	spec: specJson,
		179	namespace: "noauth",
		180	baseUrl: "",
		181	headers: {
		182	"Authorization": { secretId: "missing-token", prefix: "Bearer " },
		183	},
		184	});
		185
		186	// Invoke — should fail with a clear error about the missing secret
		187	const error = yield* Effect.flip(
		188	executor.tools.invoke("noauth.items.listItems", {}),
		189	);
		190
		191	expect(error._tag).toBe("ToolInvocationError");
		192	expect((error as { message: string }).message).toContain("missing-token");
		193	}),
		194	);
		195
101	it.effect("registers tools from an OpenAPI spec", () =>	196	it.effect("registers tools from an OpenAPI spec", () =>
102	Effect.gen(function* () {	197	Effect.gen(function* () {
103	const httpClient = yield* HttpClient.HttpClient;	198	const httpClient = yield* HttpClient.HttpClient;

packages/plugins/openapi/src/plugin.ts+11−3

 // Plugin config
 // ---------------------------------------------------------------------------
+/** A header value — either a static string or a reference to a secret */
+export type HeaderValue = string | { readonly secretId: string; readonly prefix?: string };
 export interface OpenApiSpecConfig {
   readonly spec: string;
   readonly baseUrl?: string;
   readonly namespace?: string;
-  /** Static headers applied to every request for this spec */
+  /** Headers applied to every request. Values can reference secrets. */
-  readonly headers?: Record<string, string>;
+  readonly headers?: Record<string, HeaderValue>;
 }
 // ---------------------------------------------------------------------------
       Effect.gen(function* () {
         yield* ctx.tools.registerInvoker(
           "openapi",
-          makeOpenApiInvoker(operationStore, httpClientLayer),
+          makeOpenApiInvoker({
+            operationStore,
+            httpClientLayer,
+            secrets: ctx.secrets,
+            scopeId: ctx.scope.id,
+          }),
         );
         return {

packages/plugins/openapi/src/types.ts+15−2

 // Invocation
 // ---------------------------------------------------------------------------
+/**
+ * A header value — either a static string or a reference to a secret.
+ * Stored as JSON-serializable data.
+ */
+export const HeaderValue = Schema.Union(
+  Schema.String,
+  Schema.Struct({
+    secretId: Schema.String,
+    prefix: Schema.optional(Schema.String),
+  }),
+);
+export type HeaderValue = typeof HeaderValue.Type;
 export class InvocationConfig extends Schema.Class<InvocationConfig>(
   "InvocationConfig",
 )({
   baseUrl: Schema.String,
-  /** Static headers applied to every request (auth, custom headers, etc.) */
+  /** Headers applied to every request. Values can reference secrets. */
   headers: Schema.optionalWith(
-    Schema.Record({ key: Schema.String, value: Schema.String }),
+    Schema.Record({ key: Schema.String, value: HeaderValue }),
     { default: () => ({}) },
   ),
 }) {}