From b720d76bc9719f86f00e7da5acfb4e593c35cb1f Mon Sep 17 00:00:00 2001
From: Ben Jacobson <ben@onboarded.com>
Date: Wed, 16 Sep 2026 10:47:20 -0700
Subject: [PATCH 1/2] Add WSDL import and SOAP operation tools

---
 .changeset/wsdl-soap-integration.md     |   8 +
 apps/cloud/executor.config.ts           |   2 +
 apps/cloud/package.json                 |   1 +
 apps/desktop/package.json               |   1 +
 apps/host-cloudflare/executor.config.ts |   2 +
 apps/host-cloudflare/package.json       |   1 +
 apps/host-cloudflare/src/plugins.ts     |   2 +
 apps/host-selfhost/executor.config.ts   |   2 +
 apps/host-selfhost/package.json         |   1 +
 apps/local/executor.config.ts           |   2 +
 apps/local/package.json                 |   1 +
 bun.lock                                |  45 ++++
 e2e/package.json                        |   1 +
 e2e/scenarios/wsdl-integration.test.ts  |  74 ++++++
 packages/plugins/wsdl/CHANGELOG.md      |   1 +
 packages/plugins/wsdl/README.md         |  58 +++++
 packages/plugins/wsdl/package.json      |  84 +++++++
 packages/plugins/wsdl/src/api.ts        |  28 +++
 packages/plugins/wsdl/src/client.tsx    | 121 +++++++++
 packages/plugins/wsdl/src/codec.ts      | 199 +++++++++++++++
 packages/plugins/wsdl/src/contract.ts   | 315 ++++++++++++++++++++++++
 packages/plugins/wsdl/src/errors.ts     |   4 +
 packages/plugins/wsdl/src/fixture.ts    |  13 +
 packages/plugins/wsdl/src/group.ts      |  22 ++
 packages/plugins/wsdl/src/index.ts      | 205 +++++++++++++++
 packages/plugins/wsdl/src/invoke.ts     |  72 ++++++
 packages/plugins/wsdl/src/shared.ts     |  14 ++
 packages/plugins/wsdl/src/wsdl.test.ts  | 202 +++++++++++++++
 packages/plugins/wsdl/src/xml.ts        | 113 +++++++++
 packages/plugins/wsdl/tsconfig.json     |  26 ++
 packages/plugins/wsdl/tsup.config.ts    |  14 ++
 packages/plugins/wsdl/vitest.config.ts  |   2 +
 32 files changed, 1636 insertions(+)
 create mode 100644 .changeset/wsdl-soap-integration.md
 create mode 100644 e2e/scenarios/wsdl-integration.test.ts
 create mode 100644 packages/plugins/wsdl/CHANGELOG.md
 create mode 100644 packages/plugins/wsdl/README.md
 create mode 100644 packages/plugins/wsdl/package.json
 create mode 100644 packages/plugins/wsdl/src/api.ts
 create mode 100644 packages/plugins/wsdl/src/client.tsx
 create mode 100644 packages/plugins/wsdl/src/codec.ts
 create mode 100644 packages/plugins/wsdl/src/contract.ts
 create mode 100644 packages/plugins/wsdl/src/errors.ts
 create mode 100644 packages/plugins/wsdl/src/fixture.ts
 create mode 100644 packages/plugins/wsdl/src/group.ts
 create mode 100644 packages/plugins/wsdl/src/index.ts
 create mode 100644 packages/plugins/wsdl/src/invoke.ts
 create mode 100644 packages/plugins/wsdl/src/shared.ts
 create mode 100644 packages/plugins/wsdl/src/wsdl.test.ts
 create mode 100644 packages/plugins/wsdl/src/xml.ts
 create mode 100644 packages/plugins/wsdl/tsconfig.json
 create mode 100644 packages/plugins/wsdl/tsup.config.ts
 create mode 100644 packages/plugins/wsdl/vitest.config.ts

diff --git a/.changeset/wsdl-soap-integration.md b/.changeset/wsdl-soap-integration.md
new file mode 100644
index 0000000000..6ac625231f
--- /dev/null
+++ b/.changeset/wsdl-soap-integration.md
@@ -0,0 +1,8 @@
+---
+"@executor-js/plugin-wsdl": minor
+"@executor-js/local": minor
+"@executor-js/desktop": minor
+"@executor-js/host-selfhost": minor
+---
+
+Add WSDL integration import and SOAP operation tools for self-contained WSDL 1.1 document/literal contracts, with schema validation, SOAP fault handling, and HTTP authentication templates.
diff --git a/apps/cloud/executor.config.ts b/apps/cloud/executor.config.ts
index 71cd359999..2958475d4a 100644
--- a/apps/cloud/executor.config.ts
+++ b/apps/cloud/executor.config.ts
@@ -1,3 +1,4 @@
+import { wsdlHttpPlugin } from "@executor-js/plugin-wsdl/api";
 import { defineExecutorConfig } from "@executor-js/sdk";
 import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";
 import {
@@ -61,6 +62,7 @@ export default defineExecutorConfig({
         dangerouslyAllowStdioMCP: false,
       }),
       graphqlHttpPlugin(),
+      wsdlHttpPlugin(),
       toolkitsPlugin({ activeToolkitSlug }),
       workosVaultPlugin({
         credentials: workosCredentials ?? { apiKey: "", clientId: "" },
diff --git a/apps/cloud/package.json b/apps/cloud/package.json
index 4feae6f1ac..780e5fc0eb 100644
--- a/apps/cloud/package.json
+++ b/apps/cloud/package.json
@@ -50,6 +50,7 @@
     "@executor-js/plugin-openapi": "workspace:*",
     "@executor-js/plugin-toolkits": "workspace:*",
     "@executor-js/plugin-workos-vault": "workspace:*",
+    "@executor-js/plugin-wsdl": "workspace:*",
     "@executor-js/react": "workspace:*",
     "@executor-js/runtime-dynamic-worker": "workspace:*",
     "@executor-js/runtime-quickjs": "workspace:*",
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index 3d27a2ad8d..adef7fc04a 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -22,6 +22,7 @@
     "typecheck:slow": "tsc --noEmit"
   },
   "dependencies": {
+    "@executor-js/plugin-wsdl": "workspace:*",
     "@sentry/bun": "^10.57.0",
     "@sentry/electron": "7.19.0",
     "electron-log": "^5",
diff --git a/apps/host-cloudflare/executor.config.ts b/apps/host-cloudflare/executor.config.ts
index 5a47434b54..bbe4d4ff2e 100644
--- a/apps/host-cloudflare/executor.config.ts
+++ b/apps/host-cloudflare/executor.config.ts
@@ -1,3 +1,4 @@
+import { wsdlHttpPlugin } from "@executor-js/plugin-wsdl/api";
 import { defineExecutorConfig } from "@executor-js/sdk";
 import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";
 import {
@@ -31,6 +32,7 @@ export default defineExecutorConfig({
       }),
       mcpHttpPlugin({ dangerouslyAllowStdioMCP: false }),
       graphqlHttpPlugin(),
+      wsdlHttpPlugin(),
       toolkitsPlugin({ activeToolkitSlug }),
       encryptedSecretsPlugin({ key: process.env.EXECUTOR_SECRET_KEY ?? "build-time-placeholder" }),
     ] as const,
diff --git a/apps/host-cloudflare/package.json b/apps/host-cloudflare/package.json
index b693834278..5a2ca5636e 100644
--- a/apps/host-cloudflare/package.json
+++ b/apps/host-cloudflare/package.json
@@ -30,6 +30,7 @@
     "@executor-js/plugin-openapi": "workspace:*",
     "@executor-js/plugin-provider-service-split": "workspace:*",
     "@executor-js/plugin-toolkits": "workspace:*",
+    "@executor-js/plugin-wsdl": "workspace:*",
     "@executor-js/react": "workspace:*",
     "@executor-js/runtime-dynamic-worker": "workspace:*",
     "@executor-js/runtime-quickjs": "workspace:*",
diff --git a/apps/host-cloudflare/src/plugins.ts b/apps/host-cloudflare/src/plugins.ts
index ddd5f5e018..d119b5d5c2 100644
--- a/apps/host-cloudflare/src/plugins.ts
+++ b/apps/host-cloudflare/src/plugins.ts
@@ -1,3 +1,4 @@
+import { wsdlHttpPlugin } from "@executor-js/plugin-wsdl/api";
 import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";
 import {
   googleCatalog,
@@ -34,6 +35,7 @@ export const makeCloudflarePlugins = (
     }),
     mcpHttpPlugin({ dangerouslyAllowStdioMCP: false }),
     graphqlHttpPlugin(),
+    wsdlHttpPlugin(),
     toolkitsPlugin({ activeToolkitSlug: options.activeToolkitSlug }),
     encryptedSecretsPlugin({ key: secretKey }),
   ] as const;
diff --git a/apps/host-selfhost/executor.config.ts b/apps/host-selfhost/executor.config.ts
index c0826b9bcb..86d75b9be5 100644
--- a/apps/host-selfhost/executor.config.ts
+++ b/apps/host-selfhost/executor.config.ts
@@ -1,3 +1,4 @@
+import { wsdlHttpPlugin } from "@executor-js/plugin-wsdl/api";
 import { defineExecutorConfig } from "@executor-js/sdk";
 import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";
 import {
@@ -43,6 +44,7 @@ export default defineExecutorConfig({
         dangerouslyAllowStdioMCP: process.env.EXECUTOR_ALLOW_STDIO_MCP === "true",
       }),
       graphqlHttpPlugin(),
+      wsdlHttpPlugin(),
       toolkitsPlugin({ activeToolkitSlug }),
       // First writable secret provider -> the default for `secrets.set`.
       encryptedSecretsPlugin({ key: resolveSecretKey() }),
diff --git a/apps/host-selfhost/package.json b/apps/host-selfhost/package.json
index 9d4da00172..56aee10f41 100644
--- a/apps/host-selfhost/package.json
+++ b/apps/host-selfhost/package.json
@@ -35,6 +35,7 @@
     "@executor-js/plugin-openapi": "workspace:*",
     "@executor-js/plugin-provider-service-split": "workspace:*",
     "@executor-js/plugin-toolkits": "workspace:*",
+    "@executor-js/plugin-wsdl": "workspace:*",
     "@executor-js/react": "workspace:*",
     "@executor-js/runtime-quickjs": "workspace:*",
     "@executor-js/sdk": "workspace:*",
diff --git a/apps/local/executor.config.ts b/apps/local/executor.config.ts
index fa44b48c72..11779fc4f8 100644
--- a/apps/local/executor.config.ts
+++ b/apps/local/executor.config.ts
@@ -1,3 +1,4 @@
+import { wsdlHttpPlugin } from "@executor-js/plugin-wsdl/api";
 import { defineExecutorConfig } from "@executor-js/sdk";
 import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";
 import {
@@ -38,6 +39,7 @@ export default defineExecutorConfig({
       }),
       mcpHttpPlugin({ dangerouslyAllowStdioMCP: true }),
       graphqlHttpPlugin(),
+      wsdlHttpPlugin(),
       toolkitsPlugin({ activeToolkitSlug }),
       // The durable file store must register before keychain: the first
       // writable provider becomes the default for minted OAuth tokens, and on
diff --git a/apps/local/package.json b/apps/local/package.json
index 79bebeef85..53f5bb6c61 100644
--- a/apps/local/package.json
+++ b/apps/local/package.json
@@ -41,6 +41,7 @@
     "@executor-js/plugin-openapi": "workspace:*",
     "@executor-js/plugin-provider-service-split": "workspace:*",
     "@executor-js/plugin-toolkits": "workspace:*",
+    "@executor-js/plugin-wsdl": "workspace:*",
     "@executor-js/react": "workspace:*",
     "@executor-js/runtime-quickjs": "workspace:*",
     "@executor-js/sdk": "workspace:*",
diff --git a/bun.lock b/bun.lock
index 52aac3adf6..3480053896 100644
--- a/bun.lock
+++ b/bun.lock
@@ -76,6 +76,7 @@
         "@executor-js/plugin-openapi": "workspace:*",
         "@executor-js/plugin-toolkits": "workspace:*",
         "@executor-js/plugin-workos-vault": "workspace:*",
+        "@executor-js/plugin-wsdl": "workspace:*",
         "@executor-js/react": "workspace:*",
         "@executor-js/runtime-dynamic-worker": "workspace:*",
         "@executor-js/runtime-quickjs": "workspace:*",
@@ -135,6 +136,7 @@
       "name": "@executor-js/desktop",
       "version": "1.6.8",
       "dependencies": {
+        "@executor-js/plugin-wsdl": "workspace:*",
         "@sentry/bun": "^10.57.0",
         "@sentry/electron": "7.19.0",
         "electron-log": "^5",
@@ -186,6 +188,7 @@
         "@executor-js/plugin-openapi": "workspace:*",
         "@executor-js/plugin-provider-service-split": "workspace:*",
         "@executor-js/plugin-toolkits": "workspace:*",
+        "@executor-js/plugin-wsdl": "workspace:*",
         "@executor-js/react": "workspace:*",
         "@executor-js/runtime-dynamic-worker": "workspace:*",
         "@executor-js/runtime-quickjs": "workspace:*",
@@ -239,6 +242,7 @@
         "@executor-js/plugin-openapi": "workspace:*",
         "@executor-js/plugin-provider-service-split": "workspace:*",
         "@executor-js/plugin-toolkits": "workspace:*",
+        "@executor-js/plugin-wsdl": "workspace:*",
         "@executor-js/react": "workspace:*",
         "@executor-js/runtime-quickjs": "workspace:*",
         "@executor-js/sdk": "workspace:*",
@@ -296,6 +300,7 @@
         "@executor-js/plugin-openapi": "workspace:*",
         "@executor-js/plugin-provider-service-split": "workspace:*",
         "@executor-js/plugin-toolkits": "workspace:*",
+        "@executor-js/plugin-wsdl": "workspace:*",
         "@executor-js/react": "workspace:*",
         "@executor-js/runtime-quickjs": "workspace:*",
         "@executor-js/sdk": "workspace:*",
@@ -362,6 +367,7 @@
         "@executor-js/plugin-mcp": "workspace:*",
         "@executor-js/plugin-openapi": "workspace:*",
         "@executor-js/plugin-toolkits": "workspace:*",
+        "@executor-js/plugin-wsdl": "workspace:*",
         "@executor-js/sdk": "workspace:*",
         "@kitlangton/terminal-control": "^0.3.0",
         "@modelcontextprotocol/sdk": "^1.29.0",
@@ -1217,6 +1223,39 @@
         "react",
       ],
     },
+    "packages/plugins/wsdl": {
+      "name": "@executor-js/plugin-wsdl",
+      "version": "0.1.0",
+      "dependencies": {
+        "@executor-js/api": "workspace:*",
+        "@executor-js/sdk": "workspace:*",
+        "saxes": "^6.0.0",
+      },
+      "devDependencies": {
+        "@effect/atom-react": "catalog:",
+        "@effect/vitest": "catalog:",
+        "@executor-js/react": "workspace:*",
+        "@types/node": "catalog:",
+        "@types/react": "catalog:",
+        "bun-types": "catalog:",
+        "effect": "catalog:",
+        "react": "catalog:",
+        "tsup": "catalog:",
+        "typescript": "catalog:",
+        "vitest": "catalog:",
+      },
+      "peerDependencies": {
+        "@effect/atom-react": "catalog:",
+        "@executor-js/react": "workspace:*",
+        "effect": "catalog:",
+        "react": "catalog:",
+      },
+      "optionalPeers": [
+        "@effect/atom-react",
+        "@executor-js/react",
+        "react",
+      ],
+    },
     "packages/react": {
       "name": "@executor-js/react",
       "version": "1.4.71",
@@ -1869,6 +1908,8 @@
 
     "@executor-js/plugin-workos-vault": ["@executor-js/plugin-workos-vault@workspace:packages/plugins/workos-vault"],
 
+    "@executor-js/plugin-wsdl": ["@executor-js/plugin-wsdl@workspace:packages/plugins/wsdl"],
+
     "@executor-js/react": ["@executor-js/react@workspace:packages/react"],
 
     "@executor-js/runtime-deno-subprocess": ["@executor-js/runtime-deno-subprocess@workspace:packages/kernel/runtime-deno-subprocess"],
@@ -5345,6 +5386,8 @@
 
     "sax": ["sax@1.6.0", "", {}, "sha512-6R3J5M4AcbtLUdZmRv2SygeVaM7IhrLXu9BmnOGmmACak8fiUtOsYNWUS4uK7upbmHIBbLBeFeI//477BKLBzA=="],
 
+    "saxes": ["saxes@6.0.0", "", { "dependencies": { "xmlchars": "^2.2.0" } }, "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA=="],
+
     "scheduler": ["scheduler@0.27.0", "", {}, "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q=="],
 
     "screenfull": ["screenfull@5.2.0", "", {}, "sha512-9BakfsO2aUQN2K9Fdbj87RJIEZ82Q9IGim7FqM5OsebfoFC6ZHXgDq/KvniuLTPdeM8wY2o6Dj3WQ7KeQCj3cA=="],
@@ -5821,6 +5864,8 @@
 
     "xmlbuilder2": ["xmlbuilder2@4.0.3", "", { "dependencies": { "@oozcitak/dom": "^2.0.2", "@oozcitak/infra": "^2.0.2", "@oozcitak/util": "^10.0.0", "js-yaml": "^4.1.1" } }, "sha512-bx8Q1STctnNaaDymWnkfQLKofs0mGNN7rLLapJlGuV3VlvegD7Ls4ggMjE3aUSWItCCzU0PEv45lI87iSigiCA=="],
 
+    "xmlchars": ["xmlchars@2.2.0", "", {}, "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw=="],
+
     "xtend": ["xtend@4.0.2", "", {}, "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ=="],
 
     "xxhash-wasm": ["xxhash-wasm@1.1.0", "", {}, "sha512-147y/6YNh+tlp6nd/2pWq38i9h6mz/EuQ6njIrmW8D1BS5nCqs0P6DG+m6zTGnNz5I+uhZ0SHxBs9BsPrwcKDA=="],
diff --git a/e2e/package.json b/e2e/package.json
index d605fedf77..9f08b0bf9d 100644
--- a/e2e/package.json
+++ b/e2e/package.json
@@ -29,6 +29,7 @@
     "@executor-js/plugin-mcp": "workspace:*",
     "@executor-js/plugin-openapi": "workspace:*",
     "@executor-js/plugin-toolkits": "workspace:*",
+    "@executor-js/plugin-wsdl": "workspace:*",
     "@executor-js/sdk": "workspace:*",
     "@kitlangton/terminal-control": "^0.3.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
diff --git a/e2e/scenarios/wsdl-integration.test.ts b/e2e/scenarios/wsdl-integration.test.ts
new file mode 100644
index 0000000000..ee2038196c
--- /dev/null
+++ b/e2e/scenarios/wsdl-integration.test.ts
@@ -0,0 +1,74 @@
+import { randomBytes } from "node:crypto";
+import { expect } from "@effect/vitest";
+import { Effect, Exit } from "effect";
+import { composePluginApi } from "@executor-js/api/server";
+import { wsdlHttpPlugin } from "@executor-js/plugin-wsdl/api";
+import { ordersWsdl } from "@executor-js/plugin-wsdl/testing";
+import { AuthTemplateSlug, ConnectionName, IntegrationSlug } from "@executor-js/sdk/shared";
+import { scenario } from "../src/scenario";
+import { Api, Browser, Target } from "../src/services";
+
+const api = composePluginApi([wsdlHttpPlugin()] as const);
+scenario(
+  "WSDL · import a contract and discover SOAP operations",
+  {},
+  Effect.gen(function* () {
+    const target = yield* Target;
+    const browser = yield* Browser;
+    const { client: makeClient } = yield* Api;
+    const identity = yield* target.newIdentity();
+    const client = yield* makeClient(api, identity);
+    const slug = IntegrationSlug.make(`orders-${randomBytes(4).toString("hex")}`);
+    yield* Effect.ensuring(
+      Effect.gen(function* () {
+        const rejected = yield* Effect.exit(
+          client.wsdl.addIntegration({
+            payload: {
+              slug,
+              name: "Orders",
+              wsdl: ordersWsdl.replace('style="document"', 'style="rpc"'),
+            },
+          }),
+        );
+        expect(Exit.isFailure(rejected), "RPC contracts must fail import").toBe(true);
+        yield* browser.session(identity, async ({ page, step }) => {
+          await step("Open the WSDL import form", async () => {
+            await page.goto("/integrations/add/wsdl", { waitUntil: "networkidle" });
+            await page.getByLabel("WSDL contract").waitFor();
+          });
+          await step("Import the Orders WSDL contract", async () => {
+            await page.getByLabel("Integration name").fill("Orders SOAP");
+            await page.getByLabel("Namespace", { exact: true }).fill(slug);
+            await page.getByLabel("WSDL contract").fill(ordersWsdl);
+            await page.getByRole("button", { name: "Add WSDL integration" }).click();
+            await page.waitForURL(`**/integrations/${slug}`, { timeout: 30_000 });
+            await page.getByText("Orders SOAP", { exact: true }).first().waitFor();
+            await page.getByText("No connections yet", { exact: true }).waitFor();
+            expect(await page.getByText("Orders SOAP", { exact: true }).count()).toBeGreaterThan(0);
+          });
+        });
+        yield* client.connections.create({
+          payload: {
+            owner: "org",
+            name: ConnectionName.make("main"),
+            integration: slug,
+            template: AuthTemplateSlug.make("none"),
+            values: {},
+          },
+        });
+        const tools = yield* client.tools.list({ query: {} });
+        expect(tools.filter((tool) => tool.integration === slug).map((tool) => tool.name)).toEqual([
+          "GetOrder",
+        ]);
+      }),
+      Effect.gen(function* () {
+        yield* client.connections
+          .remove({
+            params: { owner: "org", integration: slug, name: ConnectionName.make("main") },
+          })
+          .pipe(Effect.ignore);
+        yield* client.integrations.remove({ params: { slug } }).pipe(Effect.ignore);
+      }),
+    );
+  }),
+);
diff --git a/packages/plugins/wsdl/CHANGELOG.md b/packages/plugins/wsdl/CHANGELOG.md
new file mode 100644
index 0000000000..14e7fa4c4b
--- /dev/null
+++ b/packages/plugins/wsdl/CHANGELOG.md
@@ -0,0 +1 @@
+# @executor-js/plugin-wsdl
diff --git a/packages/plugins/wsdl/README.md b/packages/plugins/wsdl/README.md
new file mode 100644
index 0000000000..ea9d0b0750
--- /dev/null
+++ b/packages/plugins/wsdl/README.md
@@ -0,0 +1,58 @@
+# WSDL / SOAP plugin
+
+Import a self-contained WSDL contract in **Add integration → WSDL / SOAP**, or
+call the `wsdl.addIntegration` SDK extension / static tool. Create a connection
+against the integration to expose one tool per operation. Tool calls take
+`{ body: ... }`, where `body` is the selected input element's value.
+
+```ts
+import { IntegrationSlug } from "@executor-js/sdk";
+import { wsdlPlugin } from "@executor-js/plugin-wsdl";
+
+// Include wsdlPlugin() in your executor's plugins.
+const addOrders = executor.wsdl.addIntegration({
+  slug: IntegrationSlug.make("orders"),
+  name: "Orders",
+  wsdl: contractXml,
+  service: "Orders", // required when service/port selection is ambiguous
+  port: "OrdersPort",
+  // endpoint: "https://example.com/soap", // optional override
+});
+```
+
+The SDK extension returns an Effect; compose it with your application's Effect
+runtime to execute it. The HTTP variant is `wsdlHttpPlugin`
+from `@executor-js/plugin-wsdl/api`, with `POST /wsdl/integrations`.
+
+## Supported profile
+
+- WSDL 1.1, SOAP 1.1 with UTF-8 XML over HTTP(S), document/literal request-response operations.
+- One element body part per input/output; wrapped and bare bodies retain their
+  declared XML shape. Service and port selection use their local names.
+- Inline XSD schemas, global element references, named or inline complex types
+  with sequences, optional/repeated elements, and nillable values.
+- XSD `string`, `boolean`, `int`, `integer`, and `decimal`. Unbounded integers
+  and decimals use validated JSON strings, preserving precision.
+- SOAP faults become tool failures, including on HTTP error statuses.
+- SDK/API registration accepts shared `authenticationTemplate` entries of kind
+  `apikey` (header/query placements) or `none`. Credentials come from Executor
+  connections. The initial import form creates an unauthenticated integration.
+
+Unsupported contracts fail import: external WSDL/XSD imports/includes, WSDL 2,
+SOAP 1.2, RPC/encoded bindings, attachments, SOAP header bindings, WS-Security,
+recursive types, and XSD constructs outside the profile above. Fault details
+are not decoded into typed values. No automatic SOAP calls are used as health
+checks, and all operations require approval by default.
+
+XML rejects DTD/entity declarations, limits input/response size to 2 MB, depth
+to 64, and elements to 50,000. Expanded schemas are limited to 10,000 elements
+and 32 levels; repeated fields permit at most 10,000 values. HTTP calls use the
+host's injected Effect HttpClient, a 110-second deadline, and no automatic retry.
+
+## Development
+
+Run `bun run typecheck` and `bun run test` from this package. The cross-target
+browser scenario is `e2e/scenarios/wsdl-integration.test.ts`.
+
+Protocol references: [WSDL 1.1](https://www.w3.org/TR/wsdl.html) and
+[SOAP 1.1](https://www.w3.org/TR/2000/NOTE-SOAP-20000508/).
diff --git a/packages/plugins/wsdl/package.json b/packages/plugins/wsdl/package.json
new file mode 100644
index 0000000000..5e19ff2754
--- /dev/null
+++ b/packages/plugins/wsdl/package.json
@@ -0,0 +1,84 @@
+{
+  "name": "@executor-js/plugin-wsdl",
+  "version": "0.1.0",
+  "license": "MIT",
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./api": "./src/api.ts",
+    "./client": "./src/client.tsx",
+    "./testing": "./src/fixture.ts"
+  },
+  "publishConfig": {
+    "access": "public",
+    "exports": {
+      ".": {
+        "import": {
+          "types": "./dist/index.d.ts",
+          "default": "./dist/index.js"
+        }
+      },
+      "./api": {
+        "import": {
+          "types": "./dist/api.d.ts",
+          "default": "./dist/api.js"
+        }
+      },
+      "./client": {
+        "import": {
+          "types": "./dist/client.d.ts",
+          "default": "./dist/client.js"
+        }
+      },
+      "./testing": {
+        "import": {
+          "types": "./dist/fixture.d.ts",
+          "default": "./dist/testing.js"
+        }
+      }
+    }
+  },
+  "scripts": {
+    "typecheck": "tsgo --noEmit",
+    "test": "vitest run",
+    "build": "tsup && tsc --declaration --emitDeclarationOnly --outDir dist --rootDir src"
+  },
+  "dependencies": {
+    "@executor-js/api": "workspace:*",
+    "@executor-js/sdk": "workspace:*",
+    "saxes": "^6.0.0"
+  },
+  "devDependencies": {
+    "@effect/atom-react": "catalog:",
+    "@effect/vitest": "catalog:",
+    "@executor-js/react": "workspace:*",
+    "@types/node": "catalog:",
+    "@types/react": "catalog:",
+    "bun-types": "catalog:",
+    "effect": "catalog:",
+    "react": "catalog:",
+    "tsup": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
+  },
+  "peerDependencies": {
+    "@effect/atom-react": "catalog:",
+    "@executor-js/react": "workspace:*",
+    "effect": "catalog:",
+    "react": "catalog:"
+  },
+  "peerDependenciesMeta": {
+    "@executor-js/react": {
+      "optional": true
+    },
+    "@effect/atom-react": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    }
+  }
+}
diff --git a/packages/plugins/wsdl/src/api.ts b/packages/plugins/wsdl/src/api.ts
new file mode 100644
index 0000000000..e8fd71ec80
--- /dev/null
+++ b/packages/plugins/wsdl/src/api.ts
@@ -0,0 +1,28 @@
+import { Context, Effect } from "effect";
+import { HttpApiBuilder } from "effect/unstable/httpapi";
+import { addGroup, capture } from "@executor-js/api";
+import { definePlugin } from "@executor-js/sdk/core";
+import { wsdlPlugin } from "./index";
+
+import { WsdlGroup } from "./group";
+export { WsdlGroup } from "./group";
+export class WsdlExtension extends Context.Service<
+  WsdlExtension,
+  ReturnType<NonNullable<ReturnType<typeof wsdlPlugin>["extension"]>>
+>()("WsdlExtension") {}
+const Handlers = HttpApiBuilder.group(addGroup(WsdlGroup), "wsdl", (handlers) =>
+  handlers.handle("addIntegration", ({ payload }) =>
+    capture(
+      Effect.gen(function* () {
+        const extension = yield* WsdlExtension;
+        return yield* extension.addIntegration(payload);
+      }),
+    ),
+  ),
+);
+export const wsdlHttpPlugin = definePlugin(() => ({
+  ...wsdlPlugin(),
+  routes: () => WsdlGroup,
+  handlers: () => Handlers,
+  extensionService: WsdlExtension,
+}));
diff --git a/packages/plugins/wsdl/src/client.tsx b/packages/plugins/wsdl/src/client.tsx
new file mode 100644
index 0000000000..665fdfb561
--- /dev/null
+++ b/packages/plugins/wsdl/src/client.tsx
@@ -0,0 +1,121 @@
+import { useState } from "react";
+import { Exit, Option, Predicate } from "effect";
+import { defineClientPlugin, createPluginAtomClient, useAtomSet } from "@executor-js/sdk/client";
+import { IntegrationSlug } from "@executor-js/sdk/shared";
+import { Button } from "@executor-js/react/components/button";
+import { Input } from "@executor-js/react/components/input";
+import { Textarea } from "@executor-js/react/components/textarea";
+import { integrationWriteKeys } from "@executor-js/react/api/reactivity-keys";
+import { WsdlGroup } from "./group";
+
+const Client = createPluginAtomClient(WsdlGroup);
+const addAtom = Client.mutation("wsdl", "addIntegration");
+function AddWsdl(props: { onComplete: (slug?: string) => void; onCancel: () => void }) {
+  const [name, setName] = useState("");
+  const [slug, setSlug] = useState("");
+  const [wsdl, setWsdl] = useState("");
+  const [service, setService] = useState("");
+  const [port, setPort] = useState("");
+  const [endpoint, setEndpoint] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string>();
+  const add = useAtomSet(addAtom, { mode: "promiseExit" });
+  const submit = async () => {
+    if (busy) return;
+    setBusy(true);
+    setError(undefined);
+    const result = await add({
+      payload: {
+        name,
+        slug: IntegrationSlug.make(slug),
+        wsdl,
+        service: service || undefined,
+        port: port || undefined,
+        endpoint: endpoint || undefined,
+      },
+      reactivityKeys: integrationWriteKeys,
+    });
+    setBusy(false);
+    if (Exit.isFailure(result)) {
+      const failure = Exit.findErrorOption(result);
+      setError(
+        Option.isSome(failure) && Predicate.isTagged(failure.value, "WsdlError")
+          ? failure.value.message
+          : "Could not add WSDL integration",
+      );
+      return;
+    }
+    props.onComplete(result.value.slug);
+  };
+  return (
+    <div className="space-y-4">
+      <p className="text-sm text-muted-foreground">
+        Import a self-contained WSDL 1.1 contract using SOAP 1.1 document/literal. External imports,
+        SOAP headers, and RPC bindings are not supported.
+      </p>
+      <Input
+        aria-label="Integration name"
+        placeholder="Integration name"
+        value={name}
+        onChange={(e) => setName(e.target.value)}
+        disabled={busy}
+      />
+      <Input
+        aria-label="Namespace"
+        placeholder="Namespace (e.g. orders)"
+        value={slug}
+        onChange={(e) => setSlug(e.target.value)}
+        disabled={busy}
+      />
+      <Textarea
+        aria-label="WSDL contract"
+        placeholder="Paste WSDL XML"
+        value={wsdl}
+        onChange={(e) => setWsdl(e.target.value)}
+        rows={12}
+        disabled={busy}
+      />
+      <Input
+        aria-label="Service"
+        placeholder="Service (required if ambiguous)"
+        value={service}
+        onChange={(e) => setService(e.target.value)}
+        disabled={busy}
+      />
+      <Input
+        aria-label="Port"
+        placeholder="Port (required if ambiguous)"
+        value={port}
+        onChange={(e) => setPort(e.target.value)}
+        disabled={busy}
+      />
+      <Input
+        aria-label="Endpoint override"
+        placeholder="Endpoint override (optional)"
+        value={endpoint}
+        onChange={(e) => setEndpoint(e.target.value)}
+        disabled={busy}
+      />
+      {error && (
+        <p role="alert" className="text-sm text-destructive">
+          {error}
+        </p>
+      )}
+      <div className="flex gap-2">
+        <Button
+          disabled={busy || !name.trim() || !/^[a-z][a-z0-9_-]*$/.test(slug) || !wsdl.trim()}
+          onClick={submit}
+        >
+          {busy ? "Importing…" : "Add WSDL integration"}
+        </Button>
+        <Button variant="outline" disabled={busy} onClick={props.onCancel}>
+          Cancel
+        </Button>
+      </div>
+    </div>
+  );
+}
+export default defineClientPlugin({
+  id: "wsdl" as const,
+  integrationPlugin: { key: "wsdl", label: "WSDL / SOAP", add: AddWsdl },
+});
diff --git a/packages/plugins/wsdl/src/codec.ts b/packages/plugins/wsdl/src/codec.ts
new file mode 100644
index 0000000000..b12e6cd1d7
--- /dev/null
+++ b/packages/plugins/wsdl/src/codec.ts
@@ -0,0 +1,199 @@
+import { Effect, Predicate } from "effect";
+import type { ElementShape } from "./contract";
+import {
+  children,
+  ENVELOPE,
+  escapeXml,
+  key,
+  one,
+  parseXml,
+  WsdlError,
+  XSI,
+  type XmlNode,
+} from "./xml";
+
+export const jsonSchema = (shape: ElementShape): Record<string, unknown> => {
+  const value: Record<string, unknown> =
+    shape.kind === "object"
+      ? {
+          type: "object",
+          additionalProperties: false,
+          properties: Object.fromEntries(
+            shape.fields.map((field) => [field.name, jsonSchema(field)]),
+          ),
+          required: shape.fields.filter((field) => field.min > 0).map((field) => field.name),
+        }
+      : shape.kind === "int"
+        ? { type: "integer", minimum: -2147483648, maximum: 2147483647 }
+        : shape.kind === "boolean"
+          ? { type: "boolean" }
+          : {
+              type: "string",
+              ...(shape.kind === "integer"
+                ? { pattern: "^[+-]?[0-9]+$" }
+                : shape.kind === "decimal"
+                  ? { pattern: "^[+-]?([0-9]+(\\.[0-9]*)?|\\.[0-9]+)$" }
+                  : {}),
+            };
+  const nullable = shape.nullable ? { anyOf: [value, { type: "null" }] } : value;
+  return shape.max > 1
+    ? { type: "array", items: nullable, minItems: shape.min, maxItems: shape.max }
+    : nullable;
+};
+
+const scalar = (shape: ElementShape, value: unknown): Effect.Effect<string, WsdlError> =>
+  Effect.gen(function* () {
+    if (shape.kind === "boolean" && typeof value === "boolean") return value ? "true" : "false";
+    if (
+      shape.kind === "int" &&
+      typeof value === "number" &&
+      Number.isInteger(value) &&
+      value >= -2147483648 &&
+      value <= 2147483647
+    )
+      return String(value);
+    if (typeof value === "string") {
+      if (
+        shape.kind === "string" &&
+        [...value].every((character) => {
+          const code = character.codePointAt(0)!;
+          return (
+            code === 9 ||
+            code === 10 ||
+            code === 13 ||
+            (code >= 0x20 && code <= 0xd7ff) ||
+            (code >= 0xe000 && code <= 0xfffd) ||
+            code >= 0x10000
+          );
+        })
+      )
+        return value;
+      if (shape.kind === "integer" && /^[+-]?\d+$/.test(value)) return value;
+      if (shape.kind === "decimal" && /^[+-]?(\d+(\.\d*)?|\.\d+)$/.test(value)) return value;
+    }
+    return yield* new WsdlError({ message: `Invalid ${shape.kind} value for ${shape.name}` });
+  });
+
+export const encodeElement = (
+  shape: ElementShape,
+  value: unknown,
+): Effect.Effect<string, WsdlError> =>
+  Effect.gen(function* () {
+    if (value === undefined && shape.min === 0) return "";
+    if (shape.max > 1) {
+      if (!Array.isArray(value) || value.length < shape.min || value.length > shape.max)
+        return yield* new WsdlError({ message: `Invalid array cardinality for ${shape.name}` });
+      return (yield* Effect.forEach(value, (item) =>
+        encodeElement({ ...shape, min: 1, max: 1 }, item),
+      )).join("");
+    }
+    if (value === undefined && shape.min === 0) return "";
+    if (shape.max === 0)
+      return yield* new WsdlError({ message: `Element ${shape.name} is prohibited` });
+    const start = `<${shape.name} xmlns="${escapeXml(shape.ns)}"`;
+    if (value === null && shape.nullable) return `${start} xmlns:xsi="${XSI}" xsi:nil="true"/>`;
+    let content: string;
+    if (shape.kind === "object") {
+      if (
+        !Predicate.isObject(value) ||
+        Object.keys(value).some((name) => !shape.fields.some((field) => field.name === name))
+      )
+        return yield* new WsdlError({
+          message: `Invalid object or unexpected fields for ${shape.name}`,
+        });
+      content = (yield* Effect.forEach(shape.fields, (field) =>
+        encodeElement(field, value[field.name]),
+      )).join("");
+    } else content = escapeXml(yield* scalar(shape, value));
+    return `${start}>${content}</${shape.name}>`;
+  });
+
+const decodeElement = (shape: ElementShape, node: XmlNode): Effect.Effect<unknown, WsdlError> =>
+  Effect.gen(function* () {
+    if (node.ns !== shape.ns || node.name !== shape.name)
+      return yield* new WsdlError({
+        message: `Unexpected response element; expected {${shape.ns}}${shape.name}`,
+      });
+    for (const attr of Object.keys(node.attrs))
+      if (!attr.startsWith("{http://www.w3.org/2000/xmlns/}") && attr !== key(XSI, "nil"))
+        return yield* new WsdlError({ message: `Unsupported response attribute ${attr}` });
+    const nil = node.attrs[key(XSI, "nil")];
+    if (nil && !["true", "false", "1", "0"].includes(nil))
+      return yield* new WsdlError({ message: "Invalid xsi:nil" });
+    if (nil === "true" || nil === "1") {
+      if (!shape.nullable || node.children.length || node.text.length)
+        return yield* new WsdlError({ message: "Invalid nil response element" });
+      return null;
+    }
+    if (shape.kind === "object") {
+      if (node.text.trim())
+        return yield* new WsdlError({ message: "Mixed response content is unsupported" });
+      const result: Record<string, unknown> = Object.create(null);
+      let offset = 0;
+      for (const field of shape.fields) {
+        const values: unknown[] = [];
+        while (
+          offset < node.children.length &&
+          node.children[offset]!.name === field.name &&
+          node.children[offset]!.ns === field.ns
+        ) {
+          values.push(yield* decodeElement(field, node.children[offset++]!));
+        }
+        if (values.length < field.min || values.length > field.max)
+          return yield* new WsdlError({
+            message: `Invalid response cardinality for ${field.name}`,
+          });
+        if (field.max > 1) result[field.name] = values;
+        else if (values.length) result[field.name] = values[0];
+      }
+      if (offset !== node.children.length)
+        return yield* new WsdlError({ message: "Unexpected or out-of-order response elements" });
+      return result;
+    }
+    if (node.children.length)
+      return yield* new WsdlError({ message: "Unexpected children in scalar response" });
+    const text = shape.kind === "string" ? node.text : node.text.trim();
+    const value =
+      shape.kind === "boolean"
+        ? text === "true" || text === "1"
+          ? true
+          : text === "false" || text === "0"
+            ? false
+            : text
+        : shape.kind === "int" && /^[+-]?\d+$/.test(text)
+          ? Number(text)
+          : text;
+    yield* scalar(shape, value);
+    return value;
+  });
+
+export const decodeEnvelope = (shape: ElementShape, xml: string) =>
+  Effect.gen(function* () {
+    const root = yield* parseXml(xml);
+    if (root.ns !== ENVELOPE || root.name !== "Envelope")
+      return yield* new WsdlError({ message: "Expected SOAP 1.1 Envelope" });
+    for (const header of children(root, ENVELOPE, "Header"))
+      for (const item of header.children)
+        if (["1", "true"].includes(item.attrs[key(ENVELOPE, "mustUnderstand")] ?? ""))
+          return yield* new WsdlError({ message: "Unsupported mandatory SOAP header" });
+    if (
+      root.text.trim() ||
+      root.children.some(
+        (node) => node.ns !== ENVELOPE || !["Header", "Body"].includes(node.name),
+      ) ||
+      children(root, ENVELOPE, "Header").length > 1 ||
+      root.children.at(-1)?.name !== "Body"
+    )
+      return yield* new WsdlError({ message: "Invalid SOAP envelope structure" });
+    const body = yield* one(root, ENVELOPE, "Body");
+    if (body.text.trim()) return yield* new WsdlError({ message: "Unexpected SOAP body text" });
+    if (body.children.length !== 1)
+      return yield* new WsdlError({ message: "Expected one SOAP body element" });
+    const payload = body.children[0]!;
+    if (payload.ns === ENVELOPE && payload.name === "Fault") {
+      const code = yield* one(payload, "", "faultcode");
+      const reason = yield* one(payload, "", "faultstring");
+      return { ok: false as const, fault: { code: code.text, message: reason.text } };
+    }
+    return { ok: true as const, value: yield* decodeElement(shape, payload) };
+  });
diff --git a/packages/plugins/wsdl/src/contract.ts b/packages/plugins/wsdl/src/contract.ts
new file mode 100644
index 0000000000..1a31e83d16
--- /dev/null
+++ b/packages/plugins/wsdl/src/contract.ts
@@ -0,0 +1,315 @@
+import { Effect } from "effect";
+import {
+  children,
+  key,
+  one,
+  parseXml,
+  qname,
+  SOAP,
+  WSDL,
+  WsdlError,
+  XSD,
+  type XmlNode,
+} from "./xml";
+
+export interface ElementShape {
+  readonly name: string;
+  readonly ns: string;
+  readonly min: number;
+  readonly max: number;
+  readonly nullable: boolean;
+  readonly kind: "string" | "boolean" | "int" | "decimal" | "integer" | "object";
+  readonly fields: readonly ElementShape[];
+}
+export interface WsdlOperation {
+  readonly name: string;
+  readonly action: string;
+  readonly input: ElementShape;
+  readonly output: ElementShape;
+}
+export interface WsdlContract {
+  readonly service: string;
+  readonly port: string;
+  readonly endpoint: string;
+  readonly operations: readonly WsdlOperation[];
+}
+export interface WsdlSelection {
+  readonly service?: string;
+  readonly port?: string;
+  readonly endpoint?: string;
+}
+
+export const parseWsdl = (
+  xml: string,
+  selection: WsdlSelection = {},
+): Effect.Effect<WsdlContract, WsdlError> =>
+  Effect.gen(function* () {
+    const root = yield* parseXml(xml);
+    if (root.ns !== WSDL || root.name !== "definitions")
+      return yield* new WsdlError({ message: "Expected WSDL 1.1 definitions" });
+    const all = (node: XmlNode): XmlNode[] => [node, ...node.children.flatMap(all)];
+    for (const node of all(root)) {
+      if (
+        (node.ns === WSDL && node.name === "import") ||
+        (node.ns === XSD && ["import", "include", "redefine"].includes(node.name))
+      )
+        return yield* new WsdlError({
+          message: "External WSDL/XSD imports are not supported; supply a self-contained contract",
+        });
+      if (node.attrs[key(WSDL, "required")] === "true" || node.attrs[key(WSDL, "required")] === "1")
+        return yield* new WsdlError({ message: "Required WSDL extensions are not supported" });
+    }
+    const namespace = root.attrs.targetNamespace ?? "";
+    const symbols = new Map<string, XmlNode>();
+    const schemas = new Map<XmlNode, XmlNode>();
+    for (const node of root.children) {
+      if (node.ns !== WSDL || !node.attrs.name) continue;
+      const id = `${node.name}:${key(namespace, node.attrs.name)}`;
+      if (symbols.has(id)) return yield* new WsdlError({ message: `Duplicate WSDL symbol ${id}` });
+      symbols.set(id, node);
+    }
+    for (const types of children(root, WSDL, "types"))
+      for (const schema of children(types, XSD, "schema")) {
+        for (const node of schema.children) {
+          if (node.name === "annotation") continue;
+          if (
+            node.ns !== XSD ||
+            !["element", "complexType"].includes(node.name) ||
+            !node.attrs.name
+          )
+            return yield* new WsdlError({ message: `Unsupported schema declaration ${node.name}` });
+          const id = `${node.name}:${key(schema.attrs.targetNamespace ?? "", node.attrs.name)}`;
+          if (symbols.has(id))
+            return yield* new WsdlError({ message: `Duplicate schema symbol ${id}` });
+          symbols.set(id, node);
+          for (const descendant of all(node)) schemas.set(descendant, schema);
+        }
+      }
+    const resolve = (kind: string, node: XmlNode, attr: string) =>
+      Effect.gen(function* () {
+        const id = `${kind}:${yield* qname(node, node.attrs[attr])}`;
+        const target = symbols.get(id);
+        if (!target) return yield* new WsdlError({ message: `Unresolved ${id}` });
+        return target;
+      });
+    let expandedElements = 0;
+    const shape = (node: XmlNode, depth = 0): Effect.Effect<ElementShape, WsdlError> =>
+      Effect.gen(function* () {
+        if (
+          (node.attrs.minOccurs !== undefined && !/^\d+$/.test(node.attrs.minOccurs)) ||
+          (node.attrs.maxOccurs !== undefined &&
+            node.attrs.maxOccurs !== "unbounded" &&
+            !/^\d+$/.test(node.attrs.maxOccurs))
+        )
+          return yield* new WsdlError({ message: "Invalid occurrence bounds" });
+        if (++expandedElements > 10_000)
+          return yield* new WsdlError({ message: "Expanded schema exceeds 10000 elements" });
+        if (depth > 32)
+          return yield* new WsdlError({
+            message: "Recursive or deeply nested XSD types are not supported",
+          });
+        if (
+          node.children.some(
+            (child) => child.ns !== XSD || !["annotation", "complexType"].includes(child.name),
+          )
+        )
+          return yield* new WsdlError({ message: "Unsupported element schema content" });
+        if (node.attrs.type && children(node, XSD, "complexType").length)
+          return yield* new WsdlError({
+            message: "Element cannot declare both type and inline complexType",
+          });
+        if (node.attrs.ref) {
+          const target = yield* resolve("element", node, "ref");
+          const resolved = yield* shape(target, depth + 1);
+          const min = Number(node.attrs.minOccurs ?? "1");
+          const max =
+            node.attrs.maxOccurs === "unbounded" ? 10_000 : Number(node.attrs.maxOccurs ?? "1");
+          if (
+            !Number.isInteger(min) ||
+            !Number.isInteger(max) ||
+            min < 0 ||
+            max < min ||
+            max > 10_000
+          )
+            return yield* new WsdlError({ message: "Unsupported occurrence bounds" });
+          return { ...resolved, min, max };
+        }
+        for (const attr of ["default", "fixed", "substitutionGroup", "abstract"])
+          if (node.attrs[attr] !== undefined)
+            return yield* new WsdlError({ message: `Unsupported XSD element attribute ${attr}` });
+        const schema = schemas.get(node);
+        // Global references retain the namespace of their declaration.
+        const owningSchema = schema;
+        const global = [...symbols.values()].includes(node);
+        const ns =
+          global || (node.attrs.form ?? owningSchema?.attrs.elementFormDefault) === "qualified"
+            ? (owningSchema?.attrs.targetNamespace ?? "")
+            : "";
+        const min = Number(node.attrs.minOccurs ?? "1");
+        const max =
+          node.attrs.maxOccurs === "unbounded" ? 10_000 : Number(node.attrs.maxOccurs ?? "1");
+        if (
+          !Number.isInteger(min) ||
+          !Number.isInteger(max) ||
+          min < 0 ||
+          max < min ||
+          max > 10_000
+        )
+          return yield* new WsdlError({ message: "Unsupported occurrence bounds" });
+        if (!node.attrs.name) return yield* new WsdlError({ message: "Element name is required" });
+        let kind: ElementShape["kind"] = "object";
+        let complex: XmlNode | undefined;
+        if (node.attrs.type) {
+          const type = yield* qname(node, node.attrs.type);
+          const primitive = ["string", "boolean", "int", "decimal", "integer"].find(
+            (value) => type === key(XSD, value),
+          );
+          if (
+            primitive === "string" ||
+            primitive === "boolean" ||
+            primitive === "int" ||
+            primitive === "decimal" ||
+            primitive === "integer"
+          )
+            kind = primitive;
+          else complex = yield* resolve("complexType", node, "type");
+        } else complex = yield* one(node, XSD, "complexType");
+        const fields: ElementShape[] = [];
+        if (complex) {
+          if (complex.attrs.mixed && complex.attrs.mixed !== "false")
+            return yield* new WsdlError({ message: "Mixed XSD content is unsupported" });
+          if (
+            complex.children.some(
+              (child) => child.ns !== XSD || !["sequence", "annotation"].includes(child.name),
+            )
+          )
+            return yield* new WsdlError({
+              message: "Only XSD sequence complex types are supported",
+            });
+          const sequences = children(complex, XSD, "sequence");
+          if (sequences.length > 1)
+            return yield* new WsdlError({ message: "Multiple sequences are unsupported" });
+          const sequence = sequences[0];
+          if (sequence) {
+            if (
+              (sequence.attrs.minOccurs ?? "1") !== "1" ||
+              (sequence.attrs.maxOccurs ?? "1") !== "1"
+            )
+              return yield* new WsdlError({
+                message: "Repeated/optional sequences are unsupported",
+              });
+            for (const field of sequence.children) {
+              if (field.ns === XSD && field.name === "annotation") continue;
+              if (field.ns !== XSD || field.name !== "element")
+                return yield* new WsdlError({ message: `Unsupported XSD construct ${field.name}` });
+              const parsed = yield* shape(field, depth + 1);
+              if (fields.some((existing) => existing.name === parsed.name))
+                return yield* new WsdlError({ message: "Duplicate field names are unsupported" });
+              fields.push(parsed);
+            }
+          }
+        }
+        return {
+          name: node.attrs.name,
+          ns,
+          min,
+          max,
+          nullable: ["true", "1"].includes(node.attrs.nillable ?? ""),
+          kind,
+          fields,
+        };
+      });
+    const ports = children(root, WSDL, "service").flatMap((service) =>
+      children(service, WSDL, "port").map((port) => ({ service, port })),
+    );
+    const matches = ports.filter(
+      ({ service, port }) =>
+        (!selection.service || selection.service === service.attrs.name) &&
+        (!selection.port || selection.port === port.attrs.name),
+    );
+    if (matches.length !== 1)
+      return yield* new WsdlError({
+        message: `Select exactly one service and port. Available: ${ports.map(({ service, port }) => `${service.attrs.name}/${port.attrs.name}`).join(", ")}`,
+      });
+    const { service, port } = matches[0]!;
+    const binding = yield* resolve("binding", port, "binding");
+    const soapBinding = yield* one(binding, SOAP, "binding");
+    if (
+      (soapBinding.attrs.style ?? "document") !== "document" ||
+      soapBinding.attrs.transport !== "http://schemas.xmlsoap.org/soap/http"
+    )
+      return yield* new WsdlError({
+        message: "Only SOAP 1.1 document/literal HTTP bindings are supported",
+      });
+    const portType = yield* resolve("portType", binding, "type");
+    const address = yield* one(port, SOAP, "address");
+    const endpoint = selection.endpoint ?? address.attrs.location ?? "";
+    const url = yield* Effect.try({
+      try: () => new URL(endpoint),
+      catch: () => new WsdlError({ message: "Invalid SOAP endpoint URL" }),
+    });
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.hash)
+      return yield* new WsdlError({
+        message: "SOAP endpoint must be an HTTP(S) URL without credentials or fragment",
+      });
+    const operations: WsdlOperation[] = [];
+    for (const bound of children(binding, WSDL, "operation")) {
+      const name = bound.attrs.name ?? "";
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || operations.some((op) => op.name === name))
+        return yield* new WsdlError({ message: "Unsupported or duplicate operation name" });
+      const abstract = children(portType, WSDL, "operation").filter((op) => op.attrs.name === name);
+      if (abstract.length !== 1)
+        return yield* new WsdlError({ message: `Ambiguous or missing operation ${name}` });
+      const directions = abstract[0]!.children.filter(
+        (node) => node.ns === WSDL && ["input", "output"].includes(node.name),
+      );
+      if (
+        directions.length !== 2 ||
+        directions[0]!.name !== "input" ||
+        directions[1]!.name !== "output"
+      )
+        return yield* new WsdlError({ message: "Only request/response operations are supported" });
+      const soapOperation = yield* one(bound, SOAP, "operation");
+      if ((soapOperation.attrs.style ?? soapBinding.attrs.style ?? "document") !== "document")
+        return yield* new WsdlError({ message: "RPC operations are unsupported" });
+      const action = soapOperation.attrs.soapAction;
+      if (action === undefined || /["\r\n]/.test(action))
+        return yield* new WsdlError({ message: "Missing or invalid SOAPAction" });
+      const messageShape = (direction: string) =>
+        Effect.gen(function* () {
+          const concrete = yield* one(bound, WSDL, direction);
+          if (concrete.children.some((child) => child.ns !== SOAP || child.name !== "body"))
+            return yield* new WsdlError({
+              message: "SOAP headers and attachments are unsupported",
+            });
+          const body = yield* one(concrete, SOAP, "body");
+          if (body.attrs.use !== "literal" || body.attrs.encodingStyle)
+            return yield* new WsdlError({ message: "SOAP encoded bodies are unsupported" });
+          const message = yield* resolve(
+            "message",
+            yield* one(abstract[0]!, WSDL, direction),
+            "message",
+          );
+          if (body.attrs.parts !== undefined && body.attrs.parts.trim().split(/\s+/).length !== 1)
+            return yield* new WsdlError({
+              message: "SOAP body must select exactly one named part",
+            });
+          const parts = children(message, WSDL, "part").filter(
+            (part) => body.attrs.parts === undefined || body.attrs.parts.trim() === part.attrs.name,
+          );
+          if (parts.length !== 1 || !parts[0]!.attrs.element)
+            return yield* new WsdlError({
+              message: "SOAP body must select exactly one element part",
+            });
+          return yield* shape(yield* resolve("element", parts[0]!, "element"));
+        });
+      operations.push({
+        name,
+        action,
+        input: yield* messageShape("input"),
+        output: yield* messageShape("output"),
+      });
+    }
+    if (!operations.length) return yield* new WsdlError({ message: "No supported operations" });
+    return { service: service.attrs.name ?? "", port: port.attrs.name ?? "", endpoint, operations };
+  });
diff --git a/packages/plugins/wsdl/src/errors.ts b/packages/plugins/wsdl/src/errors.ts
new file mode 100644
index 0000000000..b7a2e2f0e6
--- /dev/null
+++ b/packages/plugins/wsdl/src/errors.ts
@@ -0,0 +1,4 @@
+import { Schema } from "effect";
+export class WsdlError extends Schema.TaggedErrorClass<WsdlError>()("WsdlError", {
+  message: Schema.String,
+}) {}
diff --git a/packages/plugins/wsdl/src/fixture.ts b/packages/plugins/wsdl/src/fixture.ts
new file mode 100644
index 0000000000..ef6b41b008
--- /dev/null
+++ b/packages/plugins/wsdl/src/fixture.ts
@@ -0,0 +1,13 @@
+/** Redistributable self-contained contract for examples and conformance tests. */
+export const ordersWsdl = `<?xml version="1.0"?>
+<w:definitions xmlns:w="http://schemas.xmlsoap.org/wsdl/" xmlns:s="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:x="http://www.w3.org/2001/XMLSchema" xmlns:t="urn:orders" targetNamespace="urn:orders">
+<w:types><x:schema targetNamespace="urn:orders" elementFormDefault="qualified">
+<x:element name="GetOrder"><x:complexType><x:sequence><x:element name="id" type="x:string"/></x:sequence></x:complexType></x:element>
+<x:element name="GetOrderResponse"><x:complexType><x:sequence><x:element name="total" type="x:decimal"/><x:element name="paid" type="x:boolean"/></x:sequence></x:complexType></x:element>
+</x:schema></w:types>
+<w:message name="Request"><w:part name="body" element="t:GetOrder"/></w:message>
+<w:message name="Response"><w:part name="body" element="t:GetOrderResponse"/></w:message>
+<w:portType name="OrdersPortType"><w:operation name="GetOrder"><w:input message="t:Request"/><w:output message="t:Response"/></w:operation></w:portType>
+<w:binding name="OrdersBinding" type="t:OrdersPortType"><s:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/><w:operation name="GetOrder"><s:operation soapAction="urn:getOrder"/><w:input><s:body use="literal"/></w:input><w:output><s:body use="literal"/></w:output></w:operation></w:binding>
+<w:service name="Orders"><w:port name="OrdersPort" binding="t:OrdersBinding"><s:address location="https://example.com/orders"/></w:port></w:service>
+</w:definitions>`;
diff --git a/packages/plugins/wsdl/src/group.ts b/packages/plugins/wsdl/src/group.ts
new file mode 100644
index 0000000000..23b459635f
--- /dev/null
+++ b/packages/plugins/wsdl/src/group.ts
@@ -0,0 +1,22 @@
+import { Schema } from "effect";
+import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+import {
+  InternalError,
+  OrgWriteDeniedError,
+  IntegrationAlreadyExistsError,
+} from "@executor-js/sdk/shared";
+import { AddWsdlInput } from "./shared";
+import { WsdlError } from "./errors";
+export const WsdlGroup = HttpApiGroup.make("wsdl").add(
+  HttpApiEndpoint.post("addIntegration", "/wsdl/integrations", {
+    payload: AddWsdlInput,
+    success: Schema.Struct({ slug: Schema.String, name: Schema.String, toolCount: Schema.Number }),
+    error: [
+      IntegrationAlreadyExistsError,
+      InternalError,
+      OrgWriteDeniedError,
+      IntegrationAlreadyExistsError,
+      WsdlError.annotate({ httpApiStatus: 400 }),
+    ],
+  }),
+);
diff --git a/packages/plugins/wsdl/src/index.ts b/packages/plugins/wsdl/src/index.ts
new file mode 100644
index 0000000000..8207836246
--- /dev/null
+++ b/packages/plugins/wsdl/src/index.ts
@@ -0,0 +1,205 @@
+import { Effect, Option, Schema } from "effect";
+import {
+  definePlugin,
+  IntegrationAlreadyExistsError,
+  ToolName,
+  ToolResult,
+  type PluginCtx,
+} from "@executor-js/sdk/core";
+import {
+  describeApiKeyAuthMethod,
+  describeNoneAuthMethod,
+  renderAuthPlacements,
+  requiredPlacementVariables,
+} from "@executor-js/sdk/http-auth";
+import { parseWsdl } from "./contract";
+import { jsonSchema } from "./codec";
+import { invoke } from "./invoke";
+import { WsdlError } from "./xml";
+
+export { parseWsdl } from "./contract";
+export type { WsdlContract, WsdlOperation, WsdlSelection } from "./contract";
+export { invoke } from "./invoke";
+export { WsdlError } from "./xml";
+
+import { AddWsdlInput } from "./shared";
+export { AddWsdlInput } from "./shared";
+const Config = Schema.Struct({
+  type: Schema.Literal("wsdl"),
+  ...AddWsdlInput.fields,
+});
+const decodeConfigOption = Schema.decodeUnknownOption(Config);
+const decodeConfig = Schema.decodeUnknownEffect(Config);
+const extension = (ctx: PluginCtx) => ({
+  addIntegration: (input: typeof AddWsdlInput.Type) =>
+    Effect.gen(function* () {
+      const checked = yield* Schema.decodeUnknownEffect(AddWsdlInput)(input).pipe(
+        Effect.mapError(() => new WsdlError({ message: "Invalid WSDL integration input" })),
+      );
+      if (!/^[a-z][a-z0-9_-]*$/.test(checked.slug) || !checked.name.trim())
+        return yield* new WsdlError({
+          message:
+            "Provide a name and a lowercase namespace using letters, digits, underscores, or hyphens",
+        });
+      yield* ctx.core.integrations.authorizeWrite();
+      const contract = yield* parseWsdl(checked.wsdl, checked);
+      const templates = checked.authenticationTemplate ?? [];
+      if (new Set(templates.map((method) => method.slug)).size !== templates.length)
+        return yield* new WsdlError({ message: "Authentication method slugs must be unique" });
+      for (const method of templates)
+        if (method.kind === "apikey")
+          for (const placement of method.placements)
+            if (
+              placement.carrier === "header" &&
+              ["soapaction", "content-type", "host", "content-length"].includes(
+                placement.name.toLowerCase(),
+              )
+            )
+              return yield* new WsdlError({
+                message: "Authentication cannot override SOAP protocol headers",
+              });
+      yield* ctx.transaction(
+        Effect.gen(function* () {
+          if (yield* ctx.core.integrations.get(checked.slug))
+            return yield* new IntegrationAlreadyExistsError({ slug: checked.slug });
+          yield* ctx.core.integrations.register({
+            slug: checked.slug,
+            name: checked.name,
+            description: `SOAP service ${contract.service}`,
+            config: {
+              ...checked,
+              type: "wsdl",
+              endpoint: contract.endpoint,
+              service: contract.service,
+              port: contract.port,
+            },
+            canRemove: true,
+            canRefresh: true,
+          });
+        }),
+      );
+      return {
+        slug: String(checked.slug),
+        name: checked.name,
+        toolCount: contract.operations.length,
+      };
+    }),
+});
+
+export const wsdlPlugin = definePlugin(() => ({
+  id: "wsdl" as const,
+  packageName: "@executor-js/plugin-wsdl",
+  storage: () => ({}),
+  extension,
+  describeAuthMethods: (record) => {
+    const decoded = decodeConfigOption(record.config);
+    if (Option.isNone(decoded)) return [];
+    const methods = decoded.value.authenticationTemplate ?? [];
+    return methods.length
+      ? methods.map((method) =>
+          method.kind === "apikey"
+            ? describeApiKeyAuthMethod(method)
+            : describeNoneAuthMethod(method.slug),
+        )
+      : [describeNoneAuthMethod("none")];
+  },
+  staticIntegrations: (self: ReturnType<typeof extension>) => [
+    {
+      id: "wsdl",
+      kind: "executor",
+      name: "WSDL / SOAP",
+      tools: [
+        {
+          name: "addIntegration",
+          description:
+            "Import a self-contained WSDL 1.1 SOAP document/literal contract. Then create a connection to expose its operations. Select service and port when ambiguous. Authentication supports HTTP header/query placements; SOAP headers are unsupported.",
+          annotations: { requiresApproval: true, approvalDescription: "Add a WSDL integration" },
+          inputSchema: Schema.toStandardSchemaV1(Schema.toStandardJSONSchemaV1(AddWsdlInput)),
+          handler: ({ args }) =>
+            Schema.decodeUnknownEffect(AddWsdlInput)(args).pipe(
+              Effect.mapError(() => new WsdlError({ message: "Invalid WSDL integration input" })),
+              Effect.flatMap(self.addIntegration),
+              Effect.map(ToolResult.ok),
+              Effect.catchTag("WsdlError", ({ message }) =>
+                Effect.succeed(ToolResult.fail({ code: "wsdl_invalid_contract", message })),
+              ),
+            ),
+        },
+      ],
+    },
+  ],
+  resolveTools: ({ config }) =>
+    Effect.gen(function* () {
+      const parsed = yield* decodeConfig(config).pipe(
+        Effect.mapError(() => new WsdlError({ message: "Invalid WSDL integration config" })),
+      );
+      const contract = yield* parseWsdl(parsed.wsdl, parsed);
+      return {
+        tools: contract.operations.map((operation) => ({
+          name: ToolName.make(operation.name),
+          description: `Call ${contract.service}.${operation.name} via SOAP`,
+          inputSchema: {
+            type: "object",
+            properties: { body: jsonSchema(operation.input) },
+            required: ["body"],
+            additionalProperties: false,
+          },
+          annotations: {
+            requiresApproval: true,
+            approvalDescription: `Call SOAP operation ${operation.name}`,
+          },
+        })),
+      };
+    }).pipe(
+      Effect.catch(() =>
+        Effect.succeed({
+          tools: [],
+          incomplete: true,
+          incompleteReason: "WSDL contract could not be resolved",
+        }),
+      ),
+    ),
+  invokeTool: ({ ctx, toolRow, credential, args }) =>
+    Effect.gen(function* () {
+      const config = yield* decodeConfig(credential.config).pipe(
+        Effect.mapError(() => new WsdlError({ message: "Invalid WSDL integration config" })),
+      );
+      const contract = yield* parseWsdl(config.wsdl, config);
+      const operation = contract.operations.find((op) => op.name === toolRow.name);
+      if (!operation) return yield* new WsdlError({ message: "WSDL operation not found" });
+      const input = yield* Schema.decodeUnknownEffect(Schema.Struct({ body: Schema.Unknown }))(
+        args,
+      ).pipe(Effect.mapError(() => new WsdlError({ message: "Expected SOAP arguments in body" })));
+      const methods = config.authenticationTemplate ?? [];
+      const method = methods.find((candidate) => candidate.slug === credential.template);
+      if (methods.length && !method)
+        return yield* new WsdlError({ message: "Unknown authentication template" });
+      const placements = method?.kind === "apikey" ? method.placements : [];
+      if (requiredPlacementVariables(placements).some((variable) => !credential.values[variable]))
+        return ToolResult.fail({
+          code: "wsdl_auth_required",
+          message: "Required SOAP credentials are missing",
+        });
+      const auth = renderAuthPlacements(placements, credential.values);
+      const endpoint = new URL(contract.endpoint);
+      for (const [name, value] of Object.entries(auth.queryParams))
+        endpoint.searchParams.set(name, value);
+      const result = yield* invoke(operation, input.body, endpoint.toString(), auth.headers).pipe(
+        Effect.provide(ctx.httpClientLayer),
+      );
+      if (result.ok) return ToolResult.ok(result.value);
+      const redact = (text: string) =>
+        Object.values(credential.values)
+          .filter((value): value is string => !!value)
+          .reduce((message, secret) => message.split(secret).join("[redacted]"), text);
+      return ToolResult.fail({
+        code: "soap_fault",
+        message: redact(result.fault.message),
+        details: { faultCode: redact(result.fault.code) },
+      });
+    }).pipe(
+      Effect.catchTag("WsdlError", ({ message }) =>
+        Effect.succeed(ToolResult.fail({ code: "wsdl_invocation_failed", message })),
+      ),
+    ),
+}));
diff --git a/packages/plugins/wsdl/src/invoke.ts b/packages/plugins/wsdl/src/invoke.ts
new file mode 100644
index 0000000000..ceb349514e
--- /dev/null
+++ b/packages/plugins/wsdl/src/invoke.ts
@@ -0,0 +1,72 @@
+import { Effect, Stream } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/unstable/http";
+import type { WsdlOperation } from "./contract";
+import { decodeEnvelope, encodeElement } from "./codec";
+import { ENVELOPE, WsdlError } from "./xml";
+
+export const invoke = (
+  operation: WsdlOperation,
+  args: unknown,
+  endpoint: string,
+  headers: Readonly<Record<string, string>> = {},
+) =>
+  Effect.gen(function* () {
+    const url = yield* Effect.try({
+      try: () => new URL(endpoint),
+      catch: () => new WsdlError({ message: "Invalid SOAP endpoint" }),
+    });
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.hash)
+      return yield* new WsdlError({
+        message: "SOAP endpoint must be HTTP(S) without credentials or fragment",
+      });
+    if (/["\r\n]/.test(operation.action))
+      return yield* new WsdlError({ message: "Invalid SOAPAction" });
+    const body = yield* encodeElement(operation.input, args);
+    if (new TextEncoder().encode(body).byteLength > 2_000_000)
+      return yield* new WsdlError({ message: "SOAP request exceeds 2 MB" });
+    const client = yield* HttpClient.HttpClient;
+    const request = HttpClientRequest.post(endpoint).pipe(
+      HttpClientRequest.setHeaders(headers),
+      HttpClientRequest.bodyText(
+        `<soap:Envelope xmlns:soap="${ENVELOPE}"><soap:Body>${body}</soap:Body></soap:Envelope>`,
+        "text/xml; charset=utf-8",
+      ),
+      HttpClientRequest.setHeader("SOAPAction", `"${operation.action}"`),
+    );
+    const response = yield* client
+      .execute(request)
+      .pipe(Effect.mapError(() => new WsdlError({ message: "SOAP HTTP request failed" })));
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    const collected = yield* response.stream.pipe(
+      Stream.runFoldEffect(
+        () => ({ bytes: 0, text: "" }),
+        (state, chunk) => {
+          const bytes = state.bytes + chunk.byteLength;
+          return bytes > 2_000_000
+            ? Effect.fail(new WsdlError({ message: "SOAP response exceeds 2 MB" }))
+            : Effect.try({
+                try: () => ({ bytes, text: state.text + decoder.decode(chunk, { stream: true }) }),
+                catch: () => new WsdlError({ message: "SOAP response must be valid UTF-8" }),
+              });
+        },
+      ),
+      Effect.mapError(
+        () => new WsdlError({ message: "Unable to read SOAP response or response exceeds 2 MB" }),
+      ),
+    );
+    const text = yield* Effect.try({
+      try: () => collected.text + decoder.decode(),
+      catch: () => new WsdlError({ message: "SOAP response must be valid UTF-8" }),
+    });
+    const decoded = yield* decodeEnvelope(operation.output, text);
+    if (decoded.ok && (response.status < 200 || response.status >= 300))
+      return yield* new WsdlError({
+        message: `SOAP HTTP request failed with status ${response.status}`,
+      });
+    return decoded;
+  }).pipe(
+    Effect.timeoutOrElse({
+      duration: "110 seconds",
+      orElse: () => Effect.fail(new WsdlError({ message: "SOAP request timed out" })),
+    }),
+  );
diff --git a/packages/plugins/wsdl/src/shared.ts b/packages/plugins/wsdl/src/shared.ts
new file mode 100644
index 0000000000..cc48d02a6a
--- /dev/null
+++ b/packages/plugins/wsdl/src/shared.ts
@@ -0,0 +1,14 @@
+import { Schema } from "effect";
+import { IntegrationSlug } from "@executor-js/sdk/shared";
+import { ApiKeyAuthMethod, NoneAuthMethod } from "@executor-js/sdk/http-auth";
+export const AddWsdlInput = Schema.Struct({
+  slug: IntegrationSlug,
+  name: Schema.String,
+  wsdl: Schema.String,
+  service: Schema.optional(Schema.String),
+  port: Schema.optional(Schema.String),
+  endpoint: Schema.optional(Schema.String),
+  authenticationTemplate: Schema.optional(
+    Schema.Array(Schema.Union([ApiKeyAuthMethod, NoneAuthMethod])),
+  ),
+});
diff --git a/packages/plugins/wsdl/src/wsdl.test.ts b/packages/plugins/wsdl/src/wsdl.test.ts
new file mode 100644
index 0000000000..2f6e2d9cf4
--- /dev/null
+++ b/packages/plugins/wsdl/src/wsdl.test.ts
@@ -0,0 +1,202 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Exit } from "effect";
+import {
+  AuthTemplateSlug,
+  ConnectionName,
+  IntegrationSlug,
+  createExecutor,
+} from "@executor-js/sdk";
+import { makeTestConfig, memoryCredentialsPlugin } from "@executor-js/sdk/testing";
+import { parseWsdl, wsdlPlugin } from "./index";
+import { decodeEnvelope, encodeElement, jsonSchema } from "./codec";
+import { ordersWsdl } from "./fixture";
+
+const envelope = (body: string) =>
+  `<e:Envelope xmlns:e="http://schemas.xmlsoap.org/soap/envelope/"><e:Body>${body}</e:Body></e:Envelope>`;
+describe("WSDL support", () => {
+  it.effect("resolves namespace-aware operations and escapes XML input", () =>
+    Effect.gen(function* () {
+      const contract = yield* parseWsdl(ordersWsdl);
+      expect(contract.service).toBe("Orders");
+      const op = contract.operations[0]!;
+      expect(op.action).toBe("urn:getOrder");
+      expect(yield* encodeElement(op.input, { id: '<&"' })).toBe(
+        '<GetOrder xmlns="urn:orders"><id xmlns="urn:orders">&lt;&amp;&quot;</id></GetOrder>',
+      );
+      expect(jsonSchema(op.input)).toMatchObject({
+        type: "object",
+        required: ["id"],
+        additionalProperties: false,
+      });
+    }),
+  );
+  it.effect("decodes arbitrary prefixes and preserves decimal precision", () =>
+    Effect.gen(function* () {
+      const contract = yield* parseWsdl(ordersWsdl);
+      const decoded = yield* decodeEnvelope(
+        contract.operations[0]!.output,
+        envelope(
+          '<o:GetOrderResponse xmlns:o="urn:orders"><o:total>9007199254740993.12</o:total><o:paid>1</o:paid></o:GetOrderResponse>',
+        ),
+      );
+      expect(decoded).toEqual({ ok: true, value: { total: "9007199254740993.12", paid: true } });
+    }),
+  );
+  it.effect("classifies SOAP faults", () =>
+    Effect.gen(function* () {
+      const contract = yield* parseWsdl(ordersWsdl);
+      expect(
+        yield* decodeEnvelope(
+          contract.operations[0]!.output,
+          envelope(
+            "<e:Fault><faultcode>e:Server</faultcode><faultstring>Order unavailable</faultstring></e:Fault>",
+          ),
+        ),
+      ).toEqual({ ok: false, fault: { code: "e:Server", message: "Order unavailable" } });
+    }),
+  );
+  it.effect("rejects missing inputs and unexpected response namespaces/order", () =>
+    Effect.gen(function* () {
+      const {
+        operations: [op],
+      } = yield* parseWsdl(ordersWsdl);
+      expect(Exit.isFailure(yield* Effect.exit(encodeElement(op!.input, {})))).toBe(true);
+      expect(
+        Exit.isFailure(
+          yield* Effect.exit(
+            decodeEnvelope(
+              op!.output,
+              envelope(
+                '<GetOrderResponse xmlns="urn:wrong"><total>1</total><paid>true</paid></GetOrderResponse>',
+              ),
+            ),
+          ),
+        ),
+      ).toBe(true);
+      expect(
+        Exit.isFailure(
+          yield* Effect.exit(
+            decodeEnvelope(
+              op!.output,
+              envelope(
+                '<GetOrderResponse xmlns="urn:orders"><paid>true</paid><total>1</total></GetOrderResponse>',
+              ),
+            ),
+          ),
+        ),
+      ).toBe(true);
+    }),
+  );
+  for (const [name, document] of [
+    ["DTD", '<!DOCTYPE x [<!ENTITY a "boom">]>' + ordersWsdl],
+    ["RPC", ordersWsdl.replace('style="document"', 'style="rpc"')],
+    ["encoding", ordersWsdl.replace('use="literal"', 'use="encoded"')],
+    [
+      "imports",
+      ordersWsdl.replace(
+        "<w:types>",
+        '<w:import namespace="urn:other" location="https://example.com/other"/><w:types>',
+      ),
+    ],
+    ["choice", ordersWsdl.replaceAll("x:sequence", "x:choice")],
+    ["unknown type", ordersWsdl.replace('type="x:string"', 'type="x:anyType"')],
+    ["unknown prefix", ordersWsdl.replace('element="t:GetOrder"', 'element="missing:GetOrder"')],
+  ])
+    it.effect(`rejects ${name}`, () =>
+      Effect.gen(function* () {
+        expect(Exit.isFailure(yield* Effect.exit(parseWsdl(document!)))).toBe(true);
+      }),
+    );
+  it.effect("requires selection when multiple ports exist", () =>
+    Effect.gen(function* () {
+      const document = ordersWsdl.replace(
+        "</w:service>",
+        '<w:port name="Other" binding="t:OrdersBinding"><s:address location="https://example.com/other"/></w:port></w:service>',
+      );
+      expect(Exit.isFailure(yield* Effect.exit(parseWsdl(document)))).toBe(true);
+      expect((yield* parseWsdl(document, { port: "Other" })).endpoint).toBe(
+        "https://example.com/other",
+      );
+    }),
+  );
+  it.effect("registers an integration and materializes connection tools", () =>
+    Effect.gen(function* () {
+      const executor = yield* createExecutor(
+        makeTestConfig({ plugins: [memoryCredentialsPlugin(), wsdlPlugin()] as const }),
+      );
+      const added = yield* executor.wsdl.addIntegration({
+        slug: IntegrationSlug.make("orders"),
+        name: "Orders",
+        wsdl: ordersWsdl,
+      });
+      expect(added.toolCount).toBe(1);
+      yield* executor.connections.create({
+        owner: "org",
+        name: ConnectionName.make("main"),
+        integration: IntegrationSlug.make("orders"),
+        template: AuthTemplateSlug.make("none"),
+        values: {},
+      });
+      const tools = yield* executor.tools.list({ integration: IntegrationSlug.make("orders") });
+      expect(tools.map((tool) => String(tool.name))).toEqual(["GetOrder"]);
+    }),
+  );
+  it.effect("preserves references, repetition, absence, and nil", () =>
+    Effect.gen(function* () {
+      const document = ordersWsdl
+        .replace(
+          '<x:element name="GetOrder">',
+          '<x:element name="item" type="x:string" nillable="true"/><x:element name="GetOrder">',
+        )
+        .replace(
+          '<x:element name="id" type="x:string"/>',
+          '<x:element ref="t:item" minOccurs="0" maxOccurs="3"/>',
+        );
+      const contract = yield* parseWsdl(document);
+      const input = contract.operations[0]!.input;
+      expect(yield* encodeElement(input, {})).toBe('<GetOrder xmlns="urn:orders"></GetOrder>');
+      expect(yield* encodeElement(input, { item: ["one", null] })).toContain(
+        '<item xmlns="urn:orders" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:nil="true"/>',
+      );
+      expect(
+        yield* decodeEnvelope(
+          input,
+          envelope(
+            '<GetOrder xmlns="urn:orders"><item>one</item><item xmlns:i="http://www.w3.org/2001/XMLSchema-instance" i:nil="1"/></GetOrder>',
+          ),
+        ),
+      ).toEqual({ ok: true, value: { item: ["one", null] } });
+      expect(
+        Exit.isFailure(yield* Effect.exit(encodeElement(input, { item: ["1", "2", "3", "4"] }))),
+      ).toBe(true);
+    }),
+  );
+  it.effect("rejects malformed XML, excessive nesting, and unsupported inline restrictions", () =>
+    Effect.gen(function* () {
+      expect(
+        Exit.isFailure(yield* Effect.exit(parseWsdl(ordersWsdl.replace("</w:definitions>", "")))),
+      ).toBe(true);
+      expect(
+        Exit.isFailure(yield* Effect.exit(parseWsdl("<a>".repeat(65) + "</a>".repeat(65)))),
+      ).toBe(true);
+      const restricted = ordersWsdl.replace(
+        '<x:element name="id" type="x:string"/>',
+        '<x:element name="id"><x:simpleType><x:restriction base="x:string"><x:pattern value="a+"/></x:restriction></x:simpleType></x:element>',
+      );
+      expect(Exit.isFailure(yield* Effect.exit(parseWsdl(restricted)))).toBe(true);
+    }),
+  );
+  it.effect("does not replace an existing integration on duplicate registration", () =>
+    Effect.gen(function* () {
+      const executor = yield* createExecutor(makeTestConfig({ plugins: [wsdlPlugin()] as const }));
+      const input = { slug: IntegrationSlug.make("orders"), name: "Orders", wsdl: ordersWsdl };
+      yield* executor.wsdl.addIntegration(input);
+      expect(
+        Exit.isFailure(
+          yield* Effect.exit(executor.wsdl.addIntegration({ ...input, name: "Replacement" })),
+        ),
+      ).toBe(true);
+      expect((yield* executor.integrations.get(input.slug))?.name).toBe("Orders");
+    }),
+  );
+});
diff --git a/packages/plugins/wsdl/src/xml.ts b/packages/plugins/wsdl/src/xml.ts
new file mode 100644
index 0000000000..bfa718a945
--- /dev/null
+++ b/packages/plugins/wsdl/src/xml.ts
@@ -0,0 +1,113 @@
+import { Effect } from "effect";
+import { SaxesParser } from "saxes";
+
+import { WsdlError } from "./errors";
+export { WsdlError } from "./errors";
+
+export interface XmlNode {
+  readonly name: string;
+  readonly ns: string;
+  readonly attrs: Readonly<Record<string, string>>;
+  readonly namespaces: Readonly<Record<string, string>>;
+  readonly children: XmlNode[];
+  text: string;
+}
+
+export const WSDL = "http://schemas.xmlsoap.org/wsdl/";
+export const XSD = "http://www.w3.org/2001/XMLSchema";
+export const SOAP = "http://schemas.xmlsoap.org/wsdl/soap/";
+export const ENVELOPE = "http://schemas.xmlsoap.org/soap/envelope/";
+export const XSI = "http://www.w3.org/2001/XMLSchema-instance";
+export const key = (ns: string, name: string) => `{${ns}}${name}`;
+export const children = (node: XmlNode, ns: string, name: string) =>
+  node.children.filter((child) => child.ns === ns && child.name === name);
+
+export const parseXml = (xml: string) =>
+  Effect.try({
+    try: () => {
+      // The SAX parser is a synchronous throwing boundary. Reject DTDs before parsing.
+      if (
+        xml.length > 2_000_000 ||
+        new TextEncoder().encode(xml).byteLength > 2_000_000 ||
+        /<!DOCTYPE|<!ENTITY/i.test(xml)
+      ) {
+        // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: synchronous SAX adapter translated by Effect.try
+        throw new WsdlError({
+          message: "XML exceeds 2 MB or contains a forbidden DTD/entity declaration",
+        });
+      }
+      const stack: XmlNode[] = [];
+      let root: XmlNode | undefined;
+      let count = 0;
+      const parser = new SaxesParser({ xmlns: true });
+      parser.on("opentag", (tag) => {
+        if (stack.length >= 64 || ++count > 50_000) {
+          // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: stop the synchronous SAX parser before further allocation
+          throw new WsdlError({ message: "XML complexity limit exceeded" });
+        }
+        const attrs: Record<string, string> = Object.create(null);
+        for (const attr of Object.values(tag.attributes)) {
+          attrs[attr.uri ? key(attr.uri, attr.local) : attr.local] = attr.value;
+        }
+        const node: XmlNode = {
+          name: tag.local,
+          ns: tag.uri,
+          attrs,
+          namespaces: { ...stack.at(-1)?.namespaces, ...tag.ns },
+          children: [],
+          text: "",
+        };
+        const parent = stack.at(-1);
+        if (parent) parent.children.push(node);
+        else root = node;
+        stack.push(node);
+      });
+      parser.on("text", (text) => {
+        const node = stack.at(-1);
+        if (node) node.text += text;
+      });
+      parser.on("cdata", (text) => {
+        const node = stack.at(-1);
+        if (node) node.text += text;
+      });
+      parser.on("closetag", () => {
+        stack.pop();
+      });
+      parser.write(xml).close();
+      // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: parser result translated by Effect.try
+      if (!root) throw new WsdlError({ message: "XML has no root element" });
+      return root;
+    },
+    catch: () =>
+      new WsdlError({
+        message: "Invalid XML, forbidden DTD/entity declaration, or XML size/depth limit exceeded",
+      }),
+  });
+
+export const qname = (node: XmlNode, value: string | undefined) =>
+  Effect.gen(function* () {
+    if (!value || !/^(?:[\w.-]+:)?[\w.-]+$/.test(value))
+      return yield* new WsdlError({ message: "Missing or invalid qualified name" });
+    const parts = value.split(":");
+    const prefix = parts.length === 2 ? parts[0]! : "";
+    const ns = node.namespaces[prefix];
+    if (prefix && ns === undefined)
+      return yield* new WsdlError({ message: `Unbound namespace prefix ${prefix}` });
+    return key(ns ?? "", parts.at(-1)!);
+  });
+
+export const one = (node: XmlNode, ns: string, name: string) =>
+  Effect.gen(function* () {
+    const found = children(node, ns, name);
+    if (found.length !== 1)
+      return yield* new WsdlError({ message: `Expected exactly one ${name} in ${node.name}` });
+    return found[0]!;
+  });
+
+export const escapeXml = (value: string) =>
+  value
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&apos;");
diff --git a/packages/plugins/wsdl/tsconfig.json b/packages/plugins/wsdl/tsconfig.json
new file mode 100644
index 0000000000..02451ed35a
--- /dev/null
+++ b/packages/plugins/wsdl/tsconfig.json
@@ -0,0 +1,26 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "strict": true,
+    "skipLibCheck": true,
+    "lib": ["ES2022", "DOM"],
+    "types": ["bun-types", "node"],
+    "noUnusedLocals": true,
+    "noImplicitOverride": true,
+    "jsx": "react-jsx",
+    "plugins": [
+      {
+        "name": "@effect/language-service",
+        "ignoreEffectSuggestionsInTscExitCode": true,
+        "ignoreEffectWarningsInTscExitCode": true,
+        "diagnosticSeverity": {
+          "globalErrorInEffectFailure": "off"
+        }
+      }
+    ]
+  },
+  "include": ["src/**/*.ts", "src/**/*.tsx"],
+  "exclude": ["src/**/*.test.ts", "src/**/*.test.tsx"]
+}
diff --git a/packages/plugins/wsdl/tsup.config.ts b/packages/plugins/wsdl/tsup.config.ts
new file mode 100644
index 0000000000..77bc25880c
--- /dev/null
+++ b/packages/plugins/wsdl/tsup.config.ts
@@ -0,0 +1,14 @@
+import { defineConfig } from "tsup";
+export default defineConfig({
+  entry: {
+    index: "src/index.ts",
+    api: "src/api.ts",
+    client: "src/client.tsx",
+    testing: "src/fixture.ts",
+  },
+  format: ["esm"],
+  dts: false,
+  sourcemap: true,
+  clean: true,
+  external: [/^@executor-js\//, /^effect/, /^@effect\//, /^react/, "saxes"],
+});
diff --git a/packages/plugins/wsdl/vitest.config.ts b/packages/plugins/wsdl/vitest.config.ts
new file mode 100644
index 0000000000..76601ffb33
--- /dev/null
+++ b/packages/plugins/wsdl/vitest.config.ts
@@ -0,0 +1,2 @@
+import { defineConfig } from "vitest/config";
+export default defineConfig({ test: { include: ["src/**/*.test.ts"] } });

From df8630b4d0fa3040abad69f2b275bfd7e307741e Mon Sep 17 00:00:00 2001
From: Ben Jacobson <ben@onboarded.com>
Date: Wed, 16 Sep 2026 11:05:59 -0700
Subject: [PATCH 2/2] Fix WSDL browser requests missing cloud organization
 context

---
 e2e/scenarios/wsdl-integration.test.ts |  7 +++++++
 packages/plugins/wsdl/src/client.tsx   | 11 ++++++++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/e2e/scenarios/wsdl-integration.test.ts b/e2e/scenarios/wsdl-integration.test.ts
index ee2038196c..e892d1c2ee 100644
--- a/e2e/scenarios/wsdl-integration.test.ts
+++ b/e2e/scenarios/wsdl-integration.test.ts
@@ -40,7 +40,14 @@ scenario(
             await page.getByLabel("Integration name").fill("Orders SOAP");
             await page.getByLabel("Namespace", { exact: true }).fill(slug);
             await page.getByLabel("WSDL contract").fill(ordersWsdl);
+            const submitted = page.waitForResponse(
+              (response) =>
+                new URL(response.url()).pathname === "/api/wsdl/integrations" &&
+                response.request().method() === "POST",
+            );
             await page.getByRole("button", { name: "Add WSDL integration" }).click();
+            const response = await submitted;
+            expect(response.status(), await response.text()).toBe(200);
             await page.waitForURL(`**/integrations/${slug}`, { timeout: 30_000 });
             await page.getByText("Orders SOAP", { exact: true }).first().waitFor();
             await page.getByText("No connections yet", { exact: true }).waitFor();
diff --git a/packages/plugins/wsdl/src/client.tsx b/packages/plugins/wsdl/src/client.tsx
index 665fdfb561..f2d0198c8f 100644
--- a/packages/plugins/wsdl/src/client.tsx
+++ b/packages/plugins/wsdl/src/client.tsx
@@ -6,9 +6,18 @@ import { Button } from "@executor-js/react/components/button";
 import { Input } from "@executor-js/react/components/input";
 import { Textarea } from "@executor-js/react/components/textarea";
 import { integrationWriteKeys } from "@executor-js/react/api/reactivity-keys";
+import {
+  getExecutorApiBaseUrl,
+  getExecutorOrganizationHeaders,
+  getExecutorServerAuthorizationHeader,
+} from "@executor-js/react/api/server-connection";
 import { WsdlGroup } from "./group";
 
-const Client = createPluginAtomClient(WsdlGroup);
+const Client = createPluginAtomClient(WsdlGroup, {
+  baseUrl: getExecutorApiBaseUrl,
+  authorizationHeader: getExecutorServerAuthorizationHeader,
+  headers: getExecutorOrganizationHeaders,
+});
 const addAtom = Client.mutation("wsdl", "addIntegration");
 function AddWsdl(props: { onComplete: (slug?: string) => void; onCancel: () => void }) {
   const [name, setName] = useState("");