Add WSDL import and SOAP operation tools

[bjacobso]

Summary

Import a self-contained WSDL 1.1 contract from the integration form, SDK, or HTTP API, then create a connection to expose its SOAP operations as tools. Adds @executor-js/plugin-wsdl and registers it in the local, cloud, and self-hosted app configurations.

The initial profile supports SOAP 1.1 document/literal request-response operations, namespace-aware XSD sequences, optional/repeated/nillable elements, validated string/boolean/int/integer/decimal values, SOAP faults, and HTTP authentication templates. Tool calls use { body: ... }, run through the host's Effect HttpClient, and require approval by default.

External WSDL/XSD imports, SOAP 1.2, RPC/encoded bindings, SOAP headers/WS-Security, recursive types, and broader XSD constructs are unsupported. The UI initially creates unauthenticated integrations; SDK/API registration can declare header/query authentication templates.

Verification

• bun run format:check
• bun run lint
• bun run typecheck — all 46 workspace tasks passed.
• WSDL package build and 16 scoped tests covering namespace resolution, XML escaping, precision, SOAP faults, unsupported contracts, element references/cardinality/nil, duplicate registration, and connection tool discovery.
• Self-host browser e2e: E2E_SELFHOST_URL=<dev-url> bunx vitest run --project selfhost scenarios/wsdl-integration.test.ts from e2e/.
• bun run test — full workspace run stops in desktop tests because the Electron binary is not installed. An earlier missing SQLite native binding was repaired.
• Live SOAP round-trip verification. The published emulator package has no SOAP service; no parallel fake service was added.

The recording below shows the WSDL form importing the Orders contract and navigating to the integration. The same scenario rejects an RPC contract through the API, creates a connection, and asserts that GetOrder appears in the tool catalog; these API assertions occur outside the video.

Checklist

• Added a changeset.
• Added unit and end-to-end coverage.
• No secrets, credentials, or private data in the diff.