Support POST health checks for HTTP RPC APIs

[Karavil]

Summary

Some APIs use RPC over HTTP and expose read operations only through POST, so they have no GET endpoint for a health check. Allow POST probes with a warning that health checks run automatically and repeatedly, and users must choose an operation that only reads data.

Add validated JSON request bodies to the setup and edit forms, preserve them through save and preview, and show the reason when a configured probe cannot run. GET candidates still rank ahead of POST; PUT, PATCH, and DELETE probes remain blocked.

Before and after

--- health-checks.spec.yaml (before)
+++ health-checks.spec.yaml (after)
 health_checks:
-  allowed_methods: [GET, HEAD, OPTIONS, TRACE]
+  allowed_methods: [GET, HEAD, OPTIONS, TRACE, POST]
   rank_candidates: non_destructive_first_then_fewest_required_arguments

   post:
-    execution: refused
-    picker_label: "(writes)"
-    warning: "This operation writes data. Prefer a read-only (GET) operation for a health check."
+    execution: allowed
+    picker_label: "(may change data)"
+    warning: >-
+      POST requests can change data. Health checks run automatically and
+      repeatedly; choose an operation that only reads data.

   put_patch_delete:
-    add_save_preview: enabled_until_the_runner_refuses_the_probe
+    add_save_preview: disabled_with_supported_method_guidance
     execution: refused_before_http_request

   candidates: # persisted, full preview, and streaming preview
-    parameters: ordinary_parameters_only
-    required_count: required_ordinary_parameters
+    parameters: ordinary_parameters_plus_required_or_optional_body
+    required_count: required_ordinary_parameters_plus_required_body

   setup_and_edit_forms:
-    inputs: required_ordinary_parameters_only
+    inputs: required_ordinary_parameters_and_json_request_body
+    invalid_json: disable_add_save_and_preview
+    cleared_optional_body: omit_from_probe_arguments

   empty_arguments: omitted

   saved_body:
-    reopen: convert_to_string # object bodies become "[object Object]"
-    save_and_preview: trimmed_string
+    reopen: json_text
+    save_and_preview: parsed_json # preserve objects, arrays, scalars, and null

   live_preview:
-    required_argument_validation: none_before_request
+    required_argument_validation: block_until_all_required_values_are_present

   unchecked_connection:
-    account_row: hide_probe_detail
-    check_now: "No health check is configured for this integration"
+    account_row: show_probe_detail
+    check_now: show_probe_detail_or_"Health check did not run"

 verification:
-  method_refusal_case: POST
+  method_refusal_case: DELETE
+  post_probe: emulator_verifies_preview_and_saved_connection_requests
+  ui: warning_json_validation_save_reopen_and_refusal_reason
+  unit: json_round_trips_and_full_streaming_candidate_parity

 release:
+  "@executor-js/plugin-openapi": patch
+  "@executor-js/react": patch

Verification

• bun run format:check
• bun run lint -- passed in CI; changed files also pass local lint.
• Affected OpenAPI and React package typechecks, including their dependencies.
• Targeted package/API/UI tests.
• Selfhost e2e: Health checks (UI) · configure and run a POST probe with a warning and Health checks (UI) · explain why an unsupported method cannot run.

The POST scenario uses the published service emulator. Its request ledger confirms that both live preview and a saved connection send POST with the expected JSON body and receive a successful response. Browser checks cover the warning, malformed JSON, save/reopen, and the reason an unsupported probe cannot run. Seven health-check API regressions and twelve UI scenarios pass, including saving a check with no arguments.

Run the browser scenarios with cd e2e && bunx vitest run --project selfhost scenarios/health-check-rpc-ui.test.ts.

POST warning and JSON validation:

Normal-speed native Chrome recording (1:51): choose a POST endpoint, enter its JSON body, run a healthy preview, save, and reopen the health check. The recording captures only the app tab and its naturally silent audio.

post-health-check-realtime.mp4

Successful POST preview:

Checklist

• Added patch changesets for @executor-js/plugin-openapi and @executor-js/react.
• Added or updated tests for the new behaviour.
• No secrets, credentials, or private data in the diff.

[Karavil]

@RhysSullivan lmk if this makes sense! We use Depot's API in Executor but I can't add health checks to it (which inspired this PR).