Function checkHealthOpenApi

packages/plugins/openapi/src/sdk/backing.ts:785–909

(input: {
  readonly ctx: PluginCtx<OpenapiStore>;
  readonly integration: IntegrationRecord;
  readonly credential: ToolInvocationCredential;
  readonly spec?: HealthCheckSpec;
  readonly httpClientLayer: Layer.Layer<HttpClient.HttpClient, never, never>;
})

 *  reasons: a rejected credential is a `HealthCheckResult` with
 *  `status: "expired"`, not an error. */
export const checkHealthOpenApi = (input: {
  readonly ctx: PluginCtx<OpenapiStore>;
  readonly integration: IntegrationRecord;
  readonly credential: ToolInvocationCredential;
  readonly spec?: HealthCheckSpec;
  readonly httpClientLayer: Layer.Layer<HttpClient.HttpClient, never, never>;
}): Effect.Effect<HealthCheckResult, StorageFailure> =>
  Effect.gen(function* () {
    const checkedAt = Date.now();
    const config = decodeOpenApiIntegrationConfig(input.integration.config);
    const spec = input.spec;
    if (!spec) {
      return {
        status: "unknown",
        checkedAt,
        detail: "No health check configured.",
      } satisfies HealthCheckResult;
    }

    const integration = String(input.integration.slug);
    const binding = yield* resolveHealthCheckBinding(
      input.ctx,
      integration,
      spec.operation,
      config,
    );
    if (!binding) {
      return {
        status: "unknown",
        checkedAt,
        detail: `Health check operation "${spec.operation}" not found on "${integration}".`,
      } satisfies HealthCheckResult;
    }

    // HARD block, not just a ranking hint: a health check runs unattended and
    // repeatedly, so a mutating operation must never execute through it. The
    // normal tool path gates these behind approval, and this path has no
    // approval step. The candidate list labels these "(writes)"; refusing here
    // is the enforcement.
    if (REQUIRE_APPROVAL.has(binding.method.toLowerCase())) {
      return {
        status: "unknown",
        checkedAt,
        detail: `Health check operation "${spec.operation}" is a ${binding.method.toUpperCase()} (mutating): pick a read-only operation.`,
      } satisfies HealthCheckResult;
    }

    const headers: Record<string, string> = { ...(config?.headers ?? {}) };
    const queryParams: Record<string, string> = { ...(config?.queryParams ?? {}) };

    const template = (config?.authenticationTemplate ?? []).find(
      (entry) => String(entry.slug) === String(input.credential.template),
    );
    if (template) {
      const missing = requiredTemplateVariables(template).filter((name) => {
        const value = input.credential.values[name];
        return value == null || value === "";
      });