@executor-js/config 0.0.1

package/dist/config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=config.test.d.ts.map

package/dist/config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.test.d.ts","sourceRoot":"","sources":["../src/config.test.ts"],"names":[],"mappings":""}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { ExecutorFileConfig, SourceConfig, OpenApiSourceConfig, GraphqlSourceConfig, McpRemoteSourceConfig, McpStdioSourceConfig, McpAuthConfig, SecretMetadata, ConfigHeaderValue, SECRET_REF_PREFIX, } from "./schema";
+export { loadConfig, ConfigParseError } from "./load";
+export { addSourceToConfig, removeSourceFromConfig, writeConfig, addSecretToConfig, removeSecretFromConfig, } from "./write";
+export type { ConfigFileSink, ConfigFileSinkOptions } from "./sink";
+export { makeFileConfigSink, headerToConfigValue, headersToConfigValues, } from "./sink";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAEtD,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AACpE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,QAAQ,CAAC"}

package/dist/index.js

@@ -0,0 +1,267 @@
+// src/schema.ts
+import { Schema } from "effect";
+var SECRET_REF_PREFIX = "secret-public-ref:";
+var ConfigHeaderValue = Schema.Union([
+  Schema.String,
+  Schema.Struct({
+    value: Schema.String,
+    prefix: Schema.optional(Schema.String)
+  })
+]);
+var ConfigHeaders = Schema.Record(Schema.String, ConfigHeaderValue);
+var OpenApiSourceConfig = Schema.Struct({
+  kind: Schema.Literal("openapi"),
+  spec: Schema.String,
+  baseUrl: Schema.optional(Schema.String),
+  namespace: Schema.optional(Schema.String),
+  headers: Schema.optional(ConfigHeaders)
+});
+var GraphqlSourceConfig = Schema.Struct({
+  kind: Schema.Literal("graphql"),
+  endpoint: Schema.String,
+  introspectionJson: Schema.optional(Schema.NullOr(Schema.String)),
+  namespace: Schema.optional(Schema.String),
+  headers: Schema.optional(ConfigHeaders)
+});
+var StringMap = Schema.Record(Schema.String, Schema.String);
+var McpAuthConfig = Schema.Union([
+  Schema.Struct({ kind: Schema.Literal("none") }),
+  Schema.Struct({
+    kind: Schema.Literal("header"),
+    headerName: Schema.String,
+    secret: Schema.String,
+    prefix: Schema.optional(Schema.String)
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("oauth2"),
+    /** Stable id of the SDK Connection holding access + refresh token
+     *  material. Scope shadowing means the same id resolves per-user
+     *  via the executor's innermost-wins lookup. */
+    connectionId: Schema.String
+  })
+]);
+var McpRemoteSourceConfig = Schema.Struct({
+  kind: Schema.Literal("mcp"),
+  transport: Schema.Literal("remote"),
+  name: Schema.String,
+  endpoint: Schema.String,
+  remoteTransport: Schema.optional(Schema.Literals(["streamable-http", "sse", "auto"])),
+  namespace: Schema.optional(Schema.String),
+  queryParams: Schema.optional(StringMap),
+  headers: Schema.optional(StringMap),
+  auth: Schema.optional(McpAuthConfig)
+});
+var McpStdioSourceConfig = Schema.Struct({
+  kind: Schema.Literal("mcp"),
+  transport: Schema.Literal("stdio"),
+  name: Schema.String,
+  command: Schema.String,
+  args: Schema.optional(Schema.Array(Schema.String)),
+  env: Schema.optional(StringMap),
+  cwd: Schema.optional(Schema.String),
+  namespace: Schema.optional(Schema.String)
+});
+var SourceConfig = Schema.Union([
+  OpenApiSourceConfig,
+  GraphqlSourceConfig,
+  McpRemoteSourceConfig,
+  McpStdioSourceConfig
+]);
+var SecretMetadata = Schema.Struct({
+  name: Schema.String,
+  provider: Schema.optional(Schema.String),
+  purpose: Schema.optional(Schema.String)
+});
+var ExecutorFileConfig = Schema.Struct({
+  $schema: Schema.optional(Schema.String),
+  name: Schema.optional(Schema.String),
+  sources: Schema.optional(Schema.Array(SourceConfig)),
+  secrets: Schema.optional(Schema.Record(Schema.String, SecretMetadata))
+});
+
+// src/load.ts
+import { Effect, Schema as Schema2 } from "effect";
+import { FileSystem } from "effect";
+import * as jsonc from "jsonc-parser";
+var ConfigParseError = class {
+  constructor(path, message) {
+    this.path = path;
+    this.message = message;
+  }
+  path;
+  message;
+  _tag = "ConfigParseError";
+};
+var loadConfig = (path) => Effect.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const exists = yield* fs.exists(path);
+  if (!exists) return null;
+  const raw = yield* fs.readFileString(path);
+  const errors = [];
+  const parsed = jsonc.parse(raw, errors);
+  if (errors.length > 0) {
+    const msg = errors.map((e) => `offset ${e.offset}: ${jsonc.printParseErrorCode(e.error)}`).join("; ");
+    return yield* Effect.fail(new ConfigParseError(path, msg));
+  }
+  const decoded = yield* Schema2.decodeUnknownEffect(ExecutorFileConfig)(parsed).pipe(
+    Effect.mapError((e) => new ConfigParseError(path, String(e)))
+  );
+  return decoded;
+});
+
+// src/write.ts
+import { Effect as Effect2 } from "effect";
+import { FileSystem as FileSystem2 } from "effect";
+import * as jsonc2 from "jsonc-parser";
+var FORMATTING = {
+  tabSize: 2,
+  insertSpaces: true,
+  eol: "\n"
+};
+var DEFAULT_CONFIG = `{
+  "sources": []
+}
+`;
+var readOrCreate = (fs, path) => Effect2.gen(function* () {
+  const exists = yield* fs.exists(path);
+  if (exists) return yield* fs.readFileString(path);
+  yield* fs.writeFileString(path, DEFAULT_CONFIG);
+  return DEFAULT_CONFIG;
+});
+var addSourceToConfig = (path, source) => Effect2.gen(function* () {
+  const fs = yield* FileSystem2.FileSystem;
+  let text = yield* readOrCreate(fs, path);
+  let tree = jsonc2.parseTree(text);
+  let sourcesNode = tree ? jsonc2.findNodeAtLocation(tree, ["sources"]) : void 0;
+  if (!sourcesNode) {
+    const edits = jsonc2.modify(text, ["sources"], [source], {
+      formattingOptions: FORMATTING
+    });
+    text = jsonc2.applyEdits(text, edits);
+  } else {
+    const ns = "namespace" in source ? source.namespace : void 0;
+    if (ns && sourcesNode.children) {
+      for (let i = sourcesNode.children.length - 1; i >= 0; i--) {
+        const child = sourcesNode.children[i];
+        const nsNode = jsonc2.findNodeAtLocation(child, ["namespace"]);
+        if (nsNode && jsonc2.getNodeValue(nsNode) === ns) {
+          const edits2 = jsonc2.modify(text, ["sources", i], void 0, {
+            formattingOptions: FORMATTING
+          });
+          text = jsonc2.applyEdits(text, edits2);
+        }
+      }
+      tree = jsonc2.parseTree(text);
+      sourcesNode = tree ? jsonc2.findNodeAtLocation(tree, ["sources"]) : void 0;
+    }
+    const count = sourcesNode?.children?.length ?? 0;
+    const edits = jsonc2.modify(text, ["sources", count], source, {
+      formattingOptions: FORMATTING
+    });
+    text = jsonc2.applyEdits(text, edits);
+  }
+  yield* fs.writeFileString(path, text);
+});
+var removeSourceFromConfig = (path, namespace) => Effect2.gen(function* () {
+  const fs = yield* FileSystem2.FileSystem;
+  const exists = yield* fs.exists(path);
+  if (!exists) return;
+  let text = yield* fs.readFileString(path);
+  const tree = jsonc2.parseTree(text);
+  if (!tree) return;
+  const sourcesNode = jsonc2.findNodeAtLocation(tree, ["sources"]);
+  if (!sourcesNode?.children) return;
+  for (let i = sourcesNode.children.length - 1; i >= 0; i--) {
+    const child = sourcesNode.children[i];
+    const nsNode = jsonc2.findNodeAtLocation(child, ["namespace"]);
+    if (nsNode && jsonc2.getNodeValue(nsNode) === namespace) {
+      const edits = jsonc2.modify(text, ["sources", i], void 0, {
+        formattingOptions: FORMATTING
+      });
+      text = jsonc2.applyEdits(text, edits);
+    }
+  }
+  yield* fs.writeFileString(path, text);
+});
+var writeConfig = (path, config) => Effect2.gen(function* () {
+  const fs = yield* FileSystem2.FileSystem;
+  const text = yield* Effect2.try({
+    try: () => JSON.stringify(config, null, 2) + "\n",
+    catch: (cause) => cause
+  }).pipe(Effect2.orDie);
+  yield* fs.writeFileString(path, text);
+});
+var addSecretToConfig = (path, secretId, metadata) => Effect2.gen(function* () {
+  const fs = yield* FileSystem2.FileSystem;
+  let text = yield* readOrCreate(fs, path);
+  const edits = jsonc2.modify(text, ["secrets", secretId], metadata, {
+    formattingOptions: FORMATTING
+  });
+  text = jsonc2.applyEdits(text, edits);
+  yield* fs.writeFileString(path, text);
+});
+var removeSecretFromConfig = (path, secretId) => Effect2.gen(function* () {
+  const fs = yield* FileSystem2.FileSystem;
+  const exists = yield* fs.exists(path);
+  if (!exists) return;
+  let text = yield* fs.readFileString(path);
+  const edits = jsonc2.modify(text, ["secrets", secretId], void 0, {
+    formattingOptions: FORMATTING
+  });
+  text = jsonc2.applyEdits(text, edits);
+  yield* fs.writeFileString(path, text);
+});
+
+// src/sink.ts
+import { Effect as Effect3 } from "effect";
+var headerToConfigValue = (value) => {
+  if (typeof value === "string") return value;
+  const ref = `${SECRET_REF_PREFIX}${value.secretId}`;
+  return value.prefix ? { value: ref, prefix: value.prefix } : ref;
+};
+var headersToConfigValues = (headers) => {
+  if (!headers) return void 0;
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) out[k] = headerToConfigValue(v);
+  return out;
+};
+var defaultOnError = (op, err) => {
+  const msg = err instanceof Error ? err.message : String(err);
+  console.warn(`[config-sink] ${op} failed: ${msg}`);
+};
+var makeFileConfigSink = (options) => {
+  const { path, fsLayer, onError = defaultOnError } = options;
+  return {
+    upsertSource: (source) => addSourceToConfig(path, source).pipe(
+      Effect3.provide(fsLayer),
+      Effect3.catch((err) => Effect3.sync(() => onError("upsert", err)))
+    ),
+    removeSource: (namespace) => removeSourceFromConfig(path, namespace).pipe(
+      Effect3.provide(fsLayer),
+      Effect3.catch((err) => Effect3.sync(() => onError("remove", err)))
+    )
+  };
+};
+export {
+  ConfigHeaderValue,
+  ConfigParseError,
+  ExecutorFileConfig,
+  GraphqlSourceConfig,
+  McpAuthConfig,
+  McpRemoteSourceConfig,
+  McpStdioSourceConfig,
+  OpenApiSourceConfig,
+  SECRET_REF_PREFIX,
+  SecretMetadata,
+  SourceConfig,
+  addSecretToConfig,
+  addSourceToConfig,
+  headerToConfigValue,
+  headersToConfigValues,
+  loadConfig,
+  makeFileConfigSink,
+  removeSecretFromConfig,
+  removeSourceFromConfig,
+  writeConfig
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/schema.ts","../src/load.ts","../src/write.ts","../src/sink.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\n// ---------------------------------------------------------------------------\n// Header values\n//\n// Three forms:\n//   \"static-value\"                            — literal string\n//   \"secret-public-ref:my-token\"              — secret reference (no prefix)\n//   { value: \"secret-public-ref:x\", prefix }  — secret reference with prefix\n// ---------------------------------------------------------------------------\n\nexport const SECRET_REF_PREFIX = \"secret-public-ref:\";\n\nexport const ConfigHeaderValue = Schema.Union([\n  Schema.String,\n  Schema.Struct({\n    value: Schema.String,\n    prefix: Schema.optional(Schema.String),\n  }),\n]);\nexport type ConfigHeaderValue = typeof ConfigHeaderValue.Type;\n\nconst ConfigHeaders = Schema.Record(Schema.String, ConfigHeaderValue);\n\n// ---------------------------------------------------------------------------\n// Source configs — discriminated union on \"kind\"\n// ---------------------------------------------------------------------------\n\nexport const OpenApiSourceConfig = Schema.Struct({\n  kind: Schema.Literal(\"openapi\"),\n  spec: Schema.String,\n  baseUrl: Schema.optional(Schema.String),\n  namespace: Schema.optional(Schema.String),\n  headers: Schema.optional(ConfigHeaders),\n});\nexport type OpenApiSourceConfig = typeof OpenApiSourceConfig.Type;\n\nexport const GraphqlSourceConfig = Schema.Struct({\n  kind: Schema.Literal(\"graphql\"),\n  endpoint: Schema.String,\n  introspectionJson: Schema.optional(Schema.NullOr(Schema.String)),\n  namespace: Schema.optional(Schema.String),\n  headers: Schema.optional(ConfigHeaders),\n});\nexport type GraphqlSourceConfig = typeof GraphqlSourceConfig.Type;\n\nconst StringMap = Schema.Record(Schema.String, Schema.String);\n\nexport const McpAuthConfig = Schema.Union([\n  Schema.Struct({ kind: Schema.Literal(\"none\") }),\n  Schema.Struct({\n    kind: Schema.Literal(\"header\"),\n    headerName: Schema.String,\n    secret: Schema.String,\n    prefix: Schema.optional(Schema.String),\n  }),\n  Schema.Struct({\n    kind: Schema.Literal(\"oauth2\"),\n    /** Stable id of the SDK Connection holding access + refresh token\n     *  material. Scope shadowing means the same id resolves per-user\n     *  via the executor's innermost-wins lookup. */\n    connectionId: Schema.String,\n  }),\n]);\nexport type McpAuthConfig = typeof McpAuthConfig.Type;\n\nexport const McpRemoteSourceConfig = Schema.Struct({\n  kind: Schema.Literal(\"mcp\"),\n  transport: Schema.Literal(\"remote\"),\n  name: Schema.String,\n  endpoint: Schema.String,\n  remoteTransport: Schema.optional(Schema.Literals([\"streamable-http\", \"sse\", \"auto\"])),\n  namespace: Schema.optional(Schema.String),\n  queryParams: Schema.optional(StringMap),\n  headers: Schema.optional(StringMap),\n  auth: Schema.optional(McpAuthConfig),\n});\nexport type McpRemoteSourceConfig = typeof McpRemoteSourceConfig.Type;\n\nexport const McpStdioSourceConfig = Schema.Struct({\n  kind: Schema.Literal(\"mcp\"),\n  transport: Schema.Literal(\"stdio\"),\n  name: Schema.String,\n  command: Schema.String,\n  args: Schema.optional(Schema.Array(Schema.String)),\n  env: Schema.optional(StringMap),\n  cwd: Schema.optional(Schema.String),\n  namespace: Schema.optional(Schema.String),\n});\nexport type McpStdioSourceConfig = typeof McpStdioSourceConfig.Type;\n\nexport const SourceConfig = Schema.Union([\n  OpenApiSourceConfig,\n  GraphqlSourceConfig,\n  McpRemoteSourceConfig,\n  McpStdioSourceConfig,\n]);\nexport type SourceConfig = typeof SourceConfig.Type;\n\n// ---------------------------------------------------------------------------\n// Secret metadata\n// ---------------------------------------------------------------------------\n\nexport const SecretMetadata = Schema.Struct({\n  name: Schema.String,\n  provider: Schema.optional(Schema.String),\n  purpose: Schema.optional(Schema.String),\n});\nexport type SecretMetadata = typeof SecretMetadata.Type;\n\n// ---------------------------------------------------------------------------\n// Top-level config\n// ---------------------------------------------------------------------------\n\nexport const ExecutorFileConfig = Schema.Struct({\n  $schema: Schema.optional(Schema.String),\n  name: Schema.optional(Schema.String),\n  sources: Schema.optional(Schema.Array(SourceConfig)),\n  secrets: Schema.optional(Schema.Record(Schema.String, SecretMetadata)),\n});\nexport type ExecutorFileConfig = typeof ExecutorFileConfig.Type;\n","import { Effect, Schema } from \"effect\";\nimport { FileSystem } from \"effect\";\nimport type { PlatformError } from \"effect/PlatformError\";\nimport * as jsonc from \"jsonc-parser\";\nimport { ExecutorFileConfig } from \"./schema\";\n\nexport class ConfigParseError {\n  readonly _tag = \"ConfigParseError\";\n  constructor(\n    readonly path: string,\n    readonly message: string,\n  ) {}\n}\n\n/**\n * Load and validate an executor config file.\n * Returns null if the file doesn't exist.\n */\nexport const loadConfig = (\n  path: string,\n): Effect.Effect<\n  ExecutorFileConfig | null,\n  ConfigParseError | PlatformError,\n  FileSystem.FileSystem\n> =>\n  Effect.gen(function* () {\n    const fs = yield* FileSystem.FileSystem;\n\n    const exists = yield* fs.exists(path);\n    if (!exists) return null;\n\n    const raw = yield* fs.readFileString(path);\n\n    const errors: jsonc.ParseError[] = [];\n    const parsed = jsonc.parse(raw, errors);\n\n    if (errors.length > 0) {\n      const msg = errors\n        .map((e) => `offset ${e.offset}: ${jsonc.printParseErrorCode(e.error)}`)\n        .join(\"; \");\n      return yield* Effect.fail(new ConfigParseError(path, msg));\n    }\n\n    const decoded = yield* Schema.decodeUnknownEffect(ExecutorFileConfig)(parsed).pipe(\n      Effect.mapError((e) => new ConfigParseError(path, String(e))),\n    );\n\n    return decoded;\n  });\n","import { Effect } from \"effect\";\nimport { FileSystem } from \"effect\";\nimport type { PlatformError } from \"effect/PlatformError\";\nimport * as jsonc from \"jsonc-parser\";\nimport type { SourceConfig, ExecutorFileConfig } from \"./schema\";\n\nconst FORMATTING: jsonc.FormattingOptions = {\n  tabSize: 2,\n  insertSpaces: true,\n  eol: \"\\n\",\n};\n\nconst DEFAULT_CONFIG = `{\n  \"sources\": []\n}\n`;\n\n/** Read the raw JSONC text from a config file, or create a default one. */\nconst readOrCreate = (\n  fs: FileSystem.FileSystem,\n  path: string,\n): Effect.Effect<string, PlatformError> =>\n  Effect.gen(function* () {\n    const exists = yield* fs.exists(path);\n    if (exists) return yield* fs.readFileString(path);\n    yield* fs.writeFileString(path, DEFAULT_CONFIG);\n    return DEFAULT_CONFIG;\n  });\n\n/**\n * Add a source entry to the config file. Creates the file if it doesn't exist.\n * Preserves existing comments and formatting.\n */\nexport const addSourceToConfig = (\n  path: string,\n  source: SourceConfig,\n): Effect.Effect<void, PlatformError, FileSystem.FileSystem> =>\n  Effect.gen(function* () {\n    const fs = yield* FileSystem.FileSystem;\n    let text = yield* readOrCreate(fs, path);\n\n    // Ensure \"sources\" array exists\n    let tree = jsonc.parseTree(text);\n    let sourcesNode = tree ? jsonc.findNodeAtLocation(tree, [\"sources\"]) : undefined;\n\n    if (!sourcesNode) {\n      const edits = jsonc.modify(text, [\"sources\"], [source], {\n        formattingOptions: FORMATTING,\n      });\n      text = jsonc.applyEdits(text, edits);\n    } else {\n      // Remove existing entry with same namespace (if any) to avoid duplicates\n      const ns = \"namespace\" in source ? source.namespace : undefined;\n      if (ns && sourcesNode.children) {\n        for (let i = sourcesNode.children.length - 1; i >= 0; i--) {\n          const child = sourcesNode.children[i]!;\n          const nsNode = jsonc.findNodeAtLocation(child, [\"namespace\"]);\n          if (nsNode && jsonc.getNodeValue(nsNode) === ns) {\n            const edits = jsonc.modify(text, [\"sources\", i], undefined, {\n              formattingOptions: FORMATTING,\n            });\n            text = jsonc.applyEdits(text, edits);\n          }\n        }\n        // Re-parse after removals\n        tree = jsonc.parseTree(text);\n        sourcesNode = tree ? jsonc.findNodeAtLocation(tree, [\"sources\"]) : undefined;\n      }\n\n      const count = sourcesNode?.children?.length ?? 0;\n      const edits = jsonc.modify(text, [\"sources\", count], source, {\n        formattingOptions: FORMATTING,\n      });\n      text = jsonc.applyEdits(text, edits);\n    }\n\n    yield* fs.writeFileString(path, text);\n  });\n\n/**\n * Remove a source from the config file by namespace.\n */\nexport const removeSourceFromConfig = (\n  path: string,\n  namespace: string,\n): Effect.Effect<void, PlatformError, FileSystem.FileSystem> =>\n  Effect.gen(function* () {\n    const fs = yield* FileSystem.FileSystem;\n\n    const exists = yield* fs.exists(path);\n    if (!exists) return;\n\n    let text = yield* fs.readFileString(path);\n    const tree = jsonc.parseTree(text);\n    if (!tree) return;\n\n    const sourcesNode = jsonc.findNodeAtLocation(tree, [\"sources\"]);\n    if (!sourcesNode?.children) return;\n\n    // Walk backwards so indices stay valid after each removal\n    for (let i = sourcesNode.children.length - 1; i >= 0; i--) {\n      const child = sourcesNode.children[i]!;\n      const nsNode = jsonc.findNodeAtLocation(child, [\"namespace\"]);\n      if (nsNode && jsonc.getNodeValue(nsNode) === namespace) {\n        const edits = jsonc.modify(text, [\"sources\", i], undefined, {\n          formattingOptions: FORMATTING,\n        });\n        text = jsonc.applyEdits(text, edits);\n      }\n    }\n\n    yield* fs.writeFileString(path, text);\n  });\n\n/**\n * Write a full config object to a file.\n */\nexport const writeConfig = (\n  path: string,\n  config: ExecutorFileConfig,\n): Effect.Effect<void, PlatformError, FileSystem.FileSystem> =>\n  Effect.gen(function* () {\n    const fs = yield* FileSystem.FileSystem;\n    const text = yield* Effect.try({\n      try: () => JSON.stringify(config, null, 2) + \"\\n\",\n      catch: (cause) => cause,\n    }).pipe(Effect.orDie);\n    yield* fs.writeFileString(path, text);\n  });\n\n/**\n * Add secret metadata to the config file.\n */\nexport const addSecretToConfig = (\n  path: string,\n  secretId: string,\n  metadata: { name: string; provider?: string; purpose?: string },\n): Effect.Effect<void, PlatformError, FileSystem.FileSystem> =>\n  Effect.gen(function* () {\n    const fs = yield* FileSystem.FileSystem;\n    let text = yield* readOrCreate(fs, path);\n\n    const edits = jsonc.modify(text, [\"secrets\", secretId], metadata, {\n      formattingOptions: FORMATTING,\n    });\n    text = jsonc.applyEdits(text, edits);\n\n    yield* fs.writeFileString(path, text);\n  });\n\n/**\n * Remove secret metadata from the config file.\n */\nexport const removeSecretFromConfig = (\n  path: string,\n  secretId: string,\n): Effect.Effect<void, PlatformError, FileSystem.FileSystem> =>\n  Effect.gen(function* () {\n    const fs = yield* FileSystem.FileSystem;\n\n    const exists = yield* fs.exists(path);\n    if (!exists) return;\n\n    let text = yield* fs.readFileString(path);\n    const edits = jsonc.modify(text, [\"secrets\", secretId], undefined, {\n      formattingOptions: FORMATTING,\n    });\n    text = jsonc.applyEdits(text, edits);\n\n    yield* fs.writeFileString(path, text);\n  });\n","// ---------------------------------------------------------------------------\n// ConfigFileSink — best-effort write-back of source changes to executor.jsonc.\n//\n// Plugins (openapi, graphql, mcp) call `sink.upsertSource` after their DB\n// writes so the committable file stays in sync with runtime state. Errors\n// are logged and swallowed — a failed file write must never fail a DB\n// mutation, and the next successful mutation (or a boot-time sync) will\n// eventually reconcile.\n//\n// The FileSystem layer is injected so library code here doesn't pick a\n// platform binding. The host app provides NodeFileSystem (or BunFileSystem).\n// ---------------------------------------------------------------------------\n\nimport { Effect } from \"effect\";\nimport type { Layer } from \"effect\";\nimport type { FileSystem } from \"effect\";\n\nimport { SECRET_REF_PREFIX, type ConfigHeaderValue, type SourceConfig } from \"./schema\";\nimport { addSourceToConfig, removeSourceFromConfig } from \"./write\";\n\n// Translate a plugin-side header value (`{ secretId, prefix? }` for secret\n// refs) into the config file's `secret-public-ref:<id>` string form.\ntype PluginHeaderValue = string | { secretId: string; prefix?: string };\n\nexport const headerToConfigValue = (\n  value: PluginHeaderValue,\n): ConfigHeaderValue => {\n  if (typeof value === \"string\") return value;\n  const ref = `${SECRET_REF_PREFIX}${value.secretId}`;\n  return value.prefix ? { value: ref, prefix: value.prefix } : ref;\n};\n\nexport const headersToConfigValues = (\n  headers: Record<string, PluginHeaderValue> | undefined,\n): Record<string, ConfigHeaderValue> | undefined => {\n  if (!headers) return undefined;\n  const out: Record<string, ConfigHeaderValue> = {};\n  for (const [k, v] of Object.entries(headers)) out[k] = headerToConfigValue(v);\n  return out;\n};\n\nexport interface ConfigFileSink {\n  readonly upsertSource: (source: SourceConfig) => Effect.Effect<void>;\n  readonly removeSource: (namespace: string) => Effect.Effect<void>;\n}\n\nexport interface ConfigFileSinkOptions {\n  readonly path: string;\n  readonly fsLayer: Layer.Layer<FileSystem.FileSystem>;\n  /** Called when a file operation fails. Defaults to console.warn. */\n  readonly onError?: (op: \"upsert\" | \"remove\", err: unknown) => void;\n}\n\nconst defaultOnError = (op: \"upsert\" | \"remove\", err: unknown): void => {\n  const msg = err instanceof Error ? err.message : String(err);\n  console.warn(`[config-sink] ${op} failed: ${msg}`);\n};\n\nexport const makeFileConfigSink = (\n  options: ConfigFileSinkOptions,\n): ConfigFileSink => {\n  const { path, fsLayer, onError = defaultOnError } = options;\n\n  return {\n    upsertSource: (source) =>\n      addSourceToConfig(path, source).pipe(\n        Effect.provide(fsLayer),\n        Effect.catch((err: unknown) => Effect.sync(() => onError(\"upsert\", err))),\n      ),\n\n    removeSource: (namespace) =>\n      removeSourceFromConfig(path, namespace).pipe(\n        Effect.provide(fsLayer),\n        Effect.catch((err: unknown) => Effect.sync(() => onError(\"remove\", err))),\n      ),\n  };\n};\n"],"mappings":";AAAA,SAAS,cAAc;AAWhB,IAAM,oBAAoB;AAE1B,IAAM,oBAAoB,OAAO,MAAM;AAAA,EAC5C,OAAO;AAAA,EACP,OAAO,OAAO;AAAA,IACZ,OAAO,OAAO;AAAA,IACd,QAAQ,OAAO,SAAS,OAAO,MAAM;AAAA,EACvC,CAAC;AACH,CAAC;AAGD,IAAM,gBAAgB,OAAO,OAAO,OAAO,QAAQ,iBAAiB;AAM7D,IAAM,sBAAsB,OAAO,OAAO;AAAA,EAC/C,MAAM,OAAO,QAAQ,SAAS;AAAA,EAC9B,MAAM,OAAO;AAAA,EACb,SAAS,OAAO,SAAS,OAAO,MAAM;AAAA,EACtC,WAAW,OAAO,SAAS,OAAO,MAAM;AAAA,EACxC,SAAS,OAAO,SAAS,aAAa;AACxC,CAAC;AAGM,IAAM,sBAAsB,OAAO,OAAO;AAAA,EAC/C,MAAM,OAAO,QAAQ,SAAS;AAAA,EAC9B,UAAU,OAAO;AAAA,EACjB,mBAAmB,OAAO,SAAS,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,EAC/D,WAAW,OAAO,SAAS,OAAO,MAAM;AAAA,EACxC,SAAS,OAAO,SAAS,aAAa;AACxC,CAAC;AAGD,IAAM,YAAY,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM;AAErD,IAAM,gBAAgB,OAAO,MAAM;AAAA,EACxC,OAAO,OAAO,EAAE,MAAM,OAAO,QAAQ,MAAM,EAAE,CAAC;AAAA,EAC9C,OAAO,OAAO;AAAA,IACZ,MAAM,OAAO,QAAQ,QAAQ;AAAA,IAC7B,YAAY,OAAO;AAAA,IACnB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO,SAAS,OAAO,MAAM;AAAA,EACvC,CAAC;AAAA,EACD,OAAO,OAAO;AAAA,IACZ,MAAM,OAAO,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA,IAI7B,cAAc,OAAO;AAAA,EACvB,CAAC;AACH,CAAC;AAGM,IAAM,wBAAwB,OAAO,OAAO;AAAA,EACjD,MAAM,OAAO,QAAQ,KAAK;AAAA,EAC1B,WAAW,OAAO,QAAQ,QAAQ;AAAA,EAClC,MAAM,OAAO;AAAA,EACb,UAAU,OAAO;AAAA,EACjB,iBAAiB,OAAO,SAAS,OAAO,SAAS,CAAC,mBAAmB,OAAO,MAAM,CAAC,CAAC;AAAA,EACpF,WAAW,OAAO,SAAS,OAAO,MAAM;AAAA,EACxC,aAAa,OAAO,SAAS,SAAS;AAAA,EACtC,SAAS,OAAO,SAAS,SAAS;AAAA,EAClC,MAAM,OAAO,SAAS,aAAa;AACrC,CAAC;AAGM,IAAM,uBAAuB,OAAO,OAAO;AAAA,EAChD,MAAM,OAAO,QAAQ,KAAK;AAAA,EAC1B,WAAW,OAAO,QAAQ,OAAO;AAAA,EACjC,MAAM,OAAO;AAAA,EACb,SAAS,OAAO;AAAA,EAChB,MAAM,OAAO,SAAS,OAAO,MAAM,OAAO,MAAM,CAAC;AAAA,EACjD,KAAK,OAAO,SAAS,SAAS;AAAA,EAC9B,KAAK,OAAO,SAAS,OAAO,MAAM;AAAA,EAClC,WAAW,OAAO,SAAS,OAAO,MAAM;AAC1C,CAAC;AAGM,IAAM,eAAe,OAAO,MAAM;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,IAAM,iBAAiB,OAAO,OAAO;AAAA,EAC1C,MAAM,OAAO;AAAA,EACb,UAAU,OAAO,SAAS,OAAO,MAAM;AAAA,EACvC,SAAS,OAAO,SAAS,OAAO,MAAM;AACxC,CAAC;AAOM,IAAM,qBAAqB,OAAO,OAAO;AAAA,EAC9C,SAAS,OAAO,SAAS,OAAO,MAAM;AAAA,EACtC,MAAM,OAAO,SAAS,OAAO,MAAM;AAAA,EACnC,SAAS,OAAO,SAAS,OAAO,MAAM,YAAY,CAAC;AAAA,EACnD,SAAS,OAAO,SAAS,OAAO,OAAO,OAAO,QAAQ,cAAc,CAAC;AACvE,CAAC;;;ACvHD,SAAS,QAAQ,UAAAA,eAAc;AAC/B,SAAS,kBAAkB;AAE3B,YAAY,WAAW;AAGhB,IAAM,mBAAN,MAAuB;AAAA,EAE5B,YACW,MACA,SACT;AAFS;AACA;AAAA,EACR;AAAA,EAFQ;AAAA,EACA;AAAA,EAHF,OAAO;AAKlB;AAMO,IAAM,aAAa,CACxB,SAMA,OAAO,IAAI,aAAa;AACtB,QAAM,KAAK,OAAO,WAAW;AAE7B,QAAM,SAAS,OAAO,GAAG,OAAO,IAAI;AACpC,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,MAAM,OAAO,GAAG,eAAe,IAAI;AAEzC,QAAM,SAA6B,CAAC;AACpC,QAAM,SAAe,YAAM,KAAK,MAAM;AAEtC,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,MAAM,OACT,IAAI,CAAC,MAAM,UAAU,EAAE,MAAM,KAAW,0BAAoB,EAAE,KAAK,CAAC,EAAE,EACtE,KAAK,IAAI;AACZ,WAAO,OAAO,OAAO,KAAK,IAAI,iBAAiB,MAAM,GAAG,CAAC;AAAA,EAC3D;AAEA,QAAM,UAAU,OAAOC,QAAO,oBAAoB,kBAAkB,EAAE,MAAM,EAAE;AAAA,IAC5E,OAAO,SAAS,CAAC,MAAM,IAAI,iBAAiB,MAAM,OAAO,CAAC,CAAC,CAAC;AAAA,EAC9D;AAEA,SAAO;AACT,CAAC;;;AChDH,SAAS,UAAAC,eAAc;AACvB,SAAS,cAAAC,mBAAkB;AAE3B,YAAYC,YAAW;AAGvB,IAAM,aAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,cAAc;AAAA,EACd,KAAK;AACP;AAEA,IAAM,iBAAiB;AAAA;AAAA;AAAA;AAMvB,IAAM,eAAe,CACnB,IACA,SAEAF,QAAO,IAAI,aAAa;AACtB,QAAM,SAAS,OAAO,GAAG,OAAO,IAAI;AACpC,MAAI,OAAQ,QAAO,OAAO,GAAG,eAAe,IAAI;AAChD,SAAO,GAAG,gBAAgB,MAAM,cAAc;AAC9C,SAAO;AACT,CAAC;AAMI,IAAM,oBAAoB,CAC/B,MACA,WAEAA,QAAO,IAAI,aAAa;AACtB,QAAM,KAAK,OAAOC,YAAW;AAC7B,MAAI,OAAO,OAAO,aAAa,IAAI,IAAI;AAGvC,MAAI,OAAa,iBAAU,IAAI;AAC/B,MAAI,cAAc,OAAa,0BAAmB,MAAM,CAAC,SAAS,CAAC,IAAI;AAEvE,MAAI,CAAC,aAAa;AAChB,UAAM,QAAc,cAAO,MAAM,CAAC,SAAS,GAAG,CAAC,MAAM,GAAG;AAAA,MACtD,mBAAmB;AAAA,IACrB,CAAC;AACD,WAAa,kBAAW,MAAM,KAAK;AAAA,EACrC,OAAO;AAEL,UAAM,KAAK,eAAe,SAAS,OAAO,YAAY;AACtD,QAAI,MAAM,YAAY,UAAU;AAC9B,eAAS,IAAI,YAAY,SAAS,SAAS,GAAG,KAAK,GAAG,KAAK;AACzD,cAAM,QAAQ,YAAY,SAAS,CAAC;AACpC,cAAM,SAAe,0BAAmB,OAAO,CAAC,WAAW,CAAC;AAC5D,YAAI,UAAgB,oBAAa,MAAM,MAAM,IAAI;AAC/C,gBAAME,SAAc,cAAO,MAAM,CAAC,WAAW,CAAC,GAAG,QAAW;AAAA,YAC1D,mBAAmB;AAAA,UACrB,CAAC;AACD,iBAAa,kBAAW,MAAMA,MAAK;AAAA,QACrC;AAAA,MACF;AAEA,aAAa,iBAAU,IAAI;AAC3B,oBAAc,OAAa,0BAAmB,MAAM,CAAC,SAAS,CAAC,IAAI;AAAA,IACrE;AAEA,UAAM,QAAQ,aAAa,UAAU,UAAU;AAC/C,UAAM,QAAc,cAAO,MAAM,CAAC,WAAW,KAAK,GAAG,QAAQ;AAAA,MAC3D,mBAAmB;AAAA,IACrB,CAAC;AACD,WAAa,kBAAW,MAAM,KAAK;AAAA,EACrC;AAEA,SAAO,GAAG,gBAAgB,MAAM,IAAI;AACtC,CAAC;AAKI,IAAM,yBAAyB,CACpC,MACA,cAEAH,QAAO,IAAI,aAAa;AACtB,QAAM,KAAK,OAAOC,YAAW;AAE7B,QAAM,SAAS,OAAO,GAAG,OAAO,IAAI;AACpC,MAAI,CAAC,OAAQ;AAEb,MAAI,OAAO,OAAO,GAAG,eAAe,IAAI;AACxC,QAAM,OAAa,iBAAU,IAAI;AACjC,MAAI,CAAC,KAAM;AAEX,QAAM,cAAoB,0BAAmB,MAAM,CAAC,SAAS,CAAC;AAC9D,MAAI,CAAC,aAAa,SAAU;AAG5B,WAAS,IAAI,YAAY,SAAS,SAAS,GAAG,KAAK,GAAG,KAAK;AACzD,UAAM,QAAQ,YAAY,SAAS,CAAC;AACpC,UAAM,SAAe,0BAAmB,OAAO,CAAC,WAAW,CAAC;AAC5D,QAAI,UAAgB,oBAAa,MAAM,MAAM,WAAW;AACtD,YAAM,QAAc,cAAO,MAAM,CAAC,WAAW,CAAC,GAAG,QAAW;AAAA,QAC1D,mBAAmB;AAAA,MACrB,CAAC;AACD,aAAa,kBAAW,MAAM,KAAK;AAAA,IACrC;AAAA,EACF;AAEA,SAAO,GAAG,gBAAgB,MAAM,IAAI;AACtC,CAAC;AAKI,IAAM,cAAc,CACzB,MACA,WAEAD,QAAO,IAAI,aAAa;AACtB,QAAM,KAAK,OAAOC,YAAW;AAC7B,QAAM,OAAO,OAAOD,QAAO,IAAI;AAAA,IAC7B,KAAK,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI;AAAA,IAC7C,OAAO,CAAC,UAAU;AAAA,EACpB,CAAC,EAAE,KAAKA,QAAO,KAAK;AACpB,SAAO,GAAG,gBAAgB,MAAM,IAAI;AACtC,CAAC;AAKI,IAAM,oBAAoB,CAC/B,MACA,UACA,aAEAA,QAAO,IAAI,aAAa;AACtB,QAAM,KAAK,OAAOC,YAAW;AAC7B,MAAI,OAAO,OAAO,aAAa,IAAI,IAAI;AAEvC,QAAM,QAAc,cAAO,MAAM,CAAC,WAAW,QAAQ,GAAG,UAAU;AAAA,IAChE,mBAAmB;AAAA,EACrB,CAAC;AACD,SAAa,kBAAW,MAAM,KAAK;AAEnC,SAAO,GAAG,gBAAgB,MAAM,IAAI;AACtC,CAAC;AAKI,IAAM,yBAAyB,CACpC,MACA,aAEAD,QAAO,IAAI,aAAa;AACtB,QAAM,KAAK,OAAOC,YAAW;AAE7B,QAAM,SAAS,OAAO,GAAG,OAAO,IAAI;AACpC,MAAI,CAAC,OAAQ;AAEb,MAAI,OAAO,OAAO,GAAG,eAAe,IAAI;AACxC,QAAM,QAAc,cAAO,MAAM,CAAC,WAAW,QAAQ,GAAG,QAAW;AAAA,IACjE,mBAAmB;AAAA,EACrB,CAAC;AACD,SAAa,kBAAW,MAAM,KAAK;AAEnC,SAAO,GAAG,gBAAgB,MAAM,IAAI;AACtC,CAAC;;;AC7JH,SAAS,UAAAG,eAAc;AAWhB,IAAM,sBAAsB,CACjC,UACsB;AACtB,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,MAAM,GAAG,iBAAiB,GAAG,MAAM,QAAQ;AACjD,SAAO,MAAM,SAAS,EAAE,OAAO,KAAK,QAAQ,MAAM,OAAO,IAAI;AAC/D;AAEO,IAAM,wBAAwB,CACnC,YACkD;AAClD,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,MAAyC,CAAC;AAChD,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,EAAG,KAAI,CAAC,IAAI,oBAAoB,CAAC;AAC5E,SAAO;AACT;AAcA,IAAM,iBAAiB,CAAC,IAAyB,QAAuB;AACtE,QAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,UAAQ,KAAK,iBAAiB,EAAE,YAAY,GAAG,EAAE;AACnD;AAEO,IAAM,qBAAqB,CAChC,YACmB;AACnB,QAAM,EAAE,MAAM,SAAS,UAAU,eAAe,IAAI;AAEpD,SAAO;AAAA,IACL,cAAc,CAAC,WACb,kBAAkB,MAAM,MAAM,EAAE;AAAA,MAC9BC,QAAO,QAAQ,OAAO;AAAA,MACtBA,QAAO,MAAM,CAAC,QAAiBA,QAAO,KAAK,MAAM,QAAQ,UAAU,GAAG,CAAC,CAAC;AAAA,IAC1E;AAAA,IAEF,cAAc,CAAC,cACb,uBAAuB,MAAM,SAAS,EAAE;AAAA,MACtCA,QAAO,QAAQ,OAAO;AAAA,MACtBA,QAAO,MAAM,CAAC,QAAiBA,QAAO,KAAK,MAAM,QAAQ,UAAU,GAAG,CAAC,CAAC;AAAA,IAC1E;AAAA,EACJ;AACF;","names":["Schema","Schema","Effect","FileSystem","jsonc","edits","Effect","Effect"]}

package/dist/load.d.ts

@@ -0,0 +1,16 @@
+import { Effect } from "effect";
+import { FileSystem } from "effect";
+import type { PlatformError } from "effect/PlatformError";
+import { ExecutorFileConfig } from "./schema";
+export declare class ConfigParseError {
+    readonly path: string;
+    readonly message: string;
+    readonly _tag = "ConfigParseError";
+    constructor(path: string, message: string);
+}
+/**
+ * Load and validate an executor config file.
+ * Returns null if the file doesn't exist.
+ */
+export declare const loadConfig: (path: string) => Effect.Effect<ExecutorFileConfig | null, ConfigParseError | PlatformError, FileSystem.FileSystem>;
+//# sourceMappingURL=load.d.ts.map

package/dist/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../src/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAE9C,qBAAa,gBAAgB;IAGzB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM;IAH1B,QAAQ,CAAC,IAAI,sBAAsB;gBAExB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM;CAE3B;AAED;;;GAGG;AACH,eAAO,MAAM,UAAU,GACrB,MAAM,MAAM,KACX,MAAM,CAAC,MAAM,CACd,kBAAkB,GAAG,IAAI,EACzB,gBAAgB,GAAG,aAAa,EAChC,UAAU,CAAC,UAAU,CAyBnB,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,200 @@
+import { Schema } from "effect";
+export declare const SECRET_REF_PREFIX = "secret-public-ref:";
+export declare const ConfigHeaderValue: Schema.Union<readonly [Schema.String, Schema.Struct<{
+    readonly value: Schema.String;
+    readonly prefix: Schema.optional<Schema.String>;
+}>]>;
+export type ConfigHeaderValue = typeof ConfigHeaderValue.Type;
+export declare const OpenApiSourceConfig: Schema.Struct<{
+    readonly kind: Schema.Literal<"openapi">;
+    readonly spec: Schema.String;
+    readonly baseUrl: Schema.optional<Schema.String>;
+    readonly namespace: Schema.optional<Schema.String>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly value: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>>>;
+}>;
+export type OpenApiSourceConfig = typeof OpenApiSourceConfig.Type;
+export declare const GraphqlSourceConfig: Schema.Struct<{
+    readonly kind: Schema.Literal<"graphql">;
+    readonly endpoint: Schema.String;
+    readonly introspectionJson: Schema.optional<Schema.NullOr<Schema.String>>;
+    readonly namespace: Schema.optional<Schema.String>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly value: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>>>;
+}>;
+export type GraphqlSourceConfig = typeof GraphqlSourceConfig.Type;
+export declare const McpAuthConfig: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"none">;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"header">;
+    readonly headerName: Schema.String;
+    readonly secret: Schema.String;
+    readonly prefix: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"oauth2">;
+    /** Stable id of the SDK Connection holding access + refresh token
+     *  material. Scope shadowing means the same id resolves per-user
+     *  via the executor's innermost-wins lookup. */
+    readonly connectionId: Schema.String;
+}>]>;
+export type McpAuthConfig = typeof McpAuthConfig.Type;
+export declare const McpRemoteSourceConfig: Schema.Struct<{
+    readonly kind: Schema.Literal<"mcp">;
+    readonly transport: Schema.Literal<"remote">;
+    readonly name: Schema.String;
+    readonly endpoint: Schema.String;
+    readonly remoteTransport: Schema.optional<Schema.Literals<readonly ["streamable-http", "sse", "auto"]>>;
+    readonly namespace: Schema.optional<Schema.String>;
+    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly auth: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"none">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"header">;
+        readonly headerName: Schema.String;
+        readonly secret: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"oauth2">;
+        /** Stable id of the SDK Connection holding access + refresh token
+         *  material. Scope shadowing means the same id resolves per-user
+         *  via the executor's innermost-wins lookup. */
+        readonly connectionId: Schema.String;
+    }>]>>;
+}>;
+export type McpRemoteSourceConfig = typeof McpRemoteSourceConfig.Type;
+export declare const McpStdioSourceConfig: Schema.Struct<{
+    readonly kind: Schema.Literal<"mcp">;
+    readonly transport: Schema.Literal<"stdio">;
+    readonly name: Schema.String;
+    readonly command: Schema.String;
+    readonly args: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly env: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly cwd: Schema.optional<Schema.String>;
+    readonly namespace: Schema.optional<Schema.String>;
+}>;
+export type McpStdioSourceConfig = typeof McpStdioSourceConfig.Type;
+export declare const SourceConfig: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"openapi">;
+    readonly spec: Schema.String;
+    readonly baseUrl: Schema.optional<Schema.String>;
+    readonly namespace: Schema.optional<Schema.String>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly value: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>>>;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"graphql">;
+    readonly endpoint: Schema.String;
+    readonly introspectionJson: Schema.optional<Schema.NullOr<Schema.String>>;
+    readonly namespace: Schema.optional<Schema.String>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly value: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>>>;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"mcp">;
+    readonly transport: Schema.Literal<"remote">;
+    readonly name: Schema.String;
+    readonly endpoint: Schema.String;
+    readonly remoteTransport: Schema.optional<Schema.Literals<readonly ["streamable-http", "sse", "auto"]>>;
+    readonly namespace: Schema.optional<Schema.String>;
+    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly auth: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"none">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"header">;
+        readonly headerName: Schema.String;
+        readonly secret: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"oauth2">;
+        /** Stable id of the SDK Connection holding access + refresh token
+         *  material. Scope shadowing means the same id resolves per-user
+         *  via the executor's innermost-wins lookup. */
+        readonly connectionId: Schema.String;
+    }>]>>;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"mcp">;
+    readonly transport: Schema.Literal<"stdio">;
+    readonly name: Schema.String;
+    readonly command: Schema.String;
+    readonly args: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly env: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly cwd: Schema.optional<Schema.String>;
+    readonly namespace: Schema.optional<Schema.String>;
+}>]>;
+export type SourceConfig = typeof SourceConfig.Type;
+export declare const SecretMetadata: Schema.Struct<{
+    readonly name: Schema.String;
+    readonly provider: Schema.optional<Schema.String>;
+    readonly purpose: Schema.optional<Schema.String>;
+}>;
+export type SecretMetadata = typeof SecretMetadata.Type;
+export declare const ExecutorFileConfig: Schema.Struct<{
+    readonly $schema: Schema.optional<Schema.String>;
+    readonly name: Schema.optional<Schema.String>;
+    readonly sources: Schema.optional<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"openapi">;
+        readonly spec: Schema.String;
+        readonly baseUrl: Schema.optional<Schema.String>;
+        readonly namespace: Schema.optional<Schema.String>;
+        readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+            readonly value: Schema.String;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>]>>>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"graphql">;
+        readonly endpoint: Schema.String;
+        readonly introspectionJson: Schema.optional<Schema.NullOr<Schema.String>>;
+        readonly namespace: Schema.optional<Schema.String>;
+        readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+            readonly value: Schema.String;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>]>>>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"mcp">;
+        readonly transport: Schema.Literal<"remote">;
+        readonly name: Schema.String;
+        readonly endpoint: Schema.String;
+        readonly remoteTransport: Schema.optional<Schema.Literals<readonly ["streamable-http", "sse", "auto"]>>;
+        readonly namespace: Schema.optional<Schema.String>;
+        readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+        readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+        readonly auth: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"none">;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"header">;
+            readonly headerName: Schema.String;
+            readonly secret: Schema.String;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"oauth2">;
+            /** Stable id of the SDK Connection holding access + refresh token
+             *  material. Scope shadowing means the same id resolves per-user
+             *  via the executor's innermost-wins lookup. */
+            readonly connectionId: Schema.String;
+        }>]>>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"mcp">;
+        readonly transport: Schema.Literal<"stdio">;
+        readonly name: Schema.String;
+        readonly command: Schema.String;
+        readonly args: Schema.optional<Schema.$Array<Schema.String>>;
+        readonly env: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+        readonly cwd: Schema.optional<Schema.String>;
+        readonly namespace: Schema.optional<Schema.String>;
+    }>]>>>;
+    readonly secrets: Schema.optional<Schema.$Record<Schema.String, Schema.Struct<{
+        readonly name: Schema.String;
+        readonly provider: Schema.optional<Schema.String>;
+        readonly purpose: Schema.optional<Schema.String>;
+    }>>>;
+}>;
+export type ExecutorFileConfig = typeof ExecutorFileConfig.Type;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAWhC,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD,eAAO,MAAM,iBAAiB;;;IAM5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC;AAQ9D,eAAO,MAAM,mBAAmB;;;;;;;;;EAM9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAC;AAElE,eAAO,MAAM,mBAAmB;;;;;;;;;EAM9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAC;AAIlE,eAAO,MAAM,aAAa;;;;;;;;;IAUtB;;oDAEgD;;IAGlD,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAEtD,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;QAR9B;;wDAEgD;;;EAgBlD,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAC;AAEtE,eAAO,MAAM,oBAAoB;;;;;;;;;EAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAC;AAEpE,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAjCrB;;wDAEgD;;;;;;;;;;;;IAoClD,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;AAMpD,eAAO,MAAM,cAAc;;;;EAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAC;AAMxD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAxD3B;;4DAEgD;;;;;;;;;;;;;;;;;;EA2DlD,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAC"}

package/dist/sink.d.ts

@@ -0,0 +1,23 @@
+import { Effect } from "effect";
+import type { Layer } from "effect";
+import type { FileSystem } from "effect";
+import { type ConfigHeaderValue, type SourceConfig } from "./schema";
+type PluginHeaderValue = string | {
+    secretId: string;
+    prefix?: string;
+};
+export declare const headerToConfigValue: (value: PluginHeaderValue) => ConfigHeaderValue;
+export declare const headersToConfigValues: (headers: Record<string, PluginHeaderValue> | undefined) => Record<string, ConfigHeaderValue> | undefined;
+export interface ConfigFileSink {
+    readonly upsertSource: (source: SourceConfig) => Effect.Effect<void>;
+    readonly removeSource: (namespace: string) => Effect.Effect<void>;
+}
+export interface ConfigFileSinkOptions {
+    readonly path: string;
+    readonly fsLayer: Layer.Layer<FileSystem.FileSystem>;
+    /** Called when a file operation fails. Defaults to console.warn. */
+    readonly onError?: (op: "upsert" | "remove", err: unknown) => void;
+}
+export declare const makeFileConfigSink: (options: ConfigFileSinkOptions) => ConfigFileSink;
+export {};
+//# sourceMappingURL=sink.d.ts.map

package/dist/sink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sink.d.ts","sourceRoot":"","sources":["../src/sink.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEzC,OAAO,EAAqB,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAKxF,KAAK,iBAAiB,GAAG,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,eAAO,MAAM,mBAAmB,GAC9B,OAAO,iBAAiB,KACvB,iBAIF,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAChC,SAAS,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,SAAS,KACrD,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,SAKtC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrE,QAAQ,CAAC,YAAY,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACrD,oEAAoE;IACpE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,GAAG,QAAQ,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;CACpE;AAOD,eAAO,MAAM,kBAAkB,GAC7B,SAAS,qBAAqB,KAC7B,cAgBF,CAAC"}

package/dist/write.d.ts

@@ -0,0 +1,30 @@
+import { Effect } from "effect";
+import { FileSystem } from "effect";
+import type { PlatformError } from "effect/PlatformError";
+import type { SourceConfig, ExecutorFileConfig } from "./schema";
+/**
+ * Add a source entry to the config file. Creates the file if it doesn't exist.
+ * Preserves existing comments and formatting.
+ */
+export declare const addSourceToConfig: (path: string, source: SourceConfig) => Effect.Effect<void, PlatformError, FileSystem.FileSystem>;
+/**
+ * Remove a source from the config file by namespace.
+ */
+export declare const removeSourceFromConfig: (path: string, namespace: string) => Effect.Effect<void, PlatformError, FileSystem.FileSystem>;
+/**
+ * Write a full config object to a file.
+ */
+export declare const writeConfig: (path: string, config: ExecutorFileConfig) => Effect.Effect<void, PlatformError, FileSystem.FileSystem>;
+/**
+ * Add secret metadata to the config file.
+ */
+export declare const addSecretToConfig: (path: string, secretId: string, metadata: {
+    name: string;
+    provider?: string;
+    purpose?: string;
+}) => Effect.Effect<void, PlatformError, FileSystem.FileSystem>;
+/**
+ * Remove secret metadata from the config file.
+ */
+export declare const removeSecretFromConfig: (path: string, secretId: string) => Effect.Effect<void, PlatformError, FileSystem.FileSystem>;
+//# sourceMappingURL=write.d.ts.map

package/dist/write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../src/write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAyBjE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,MAAM,EACZ,QAAQ,YAAY,KACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CAyCvD,CAAC;AAEL;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,MAAM,MAAM,EACZ,WAAW,MAAM,KAChB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CA2BvD,CAAC;AAEL;;GAEG;AACH,eAAO,MAAM,WAAW,GACtB,MAAM,MAAM,EACZ,QAAQ,kBAAkB,KACzB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CAQvD,CAAC;AAEL;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,MAAM,EACZ,UAAU,MAAM,EAChB,UAAU;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,KAC9D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CAWvD,CAAC;AAEL;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,MAAM,MAAM,EACZ,UAAU,MAAM,KACf,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CAcvD,CAAC"}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@executor-js/config",
+  "version": "0.0.1",
+  "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/core/config",
+  "bugs": {
+    "url": "https://github.com/RhysSullivan/executor/issues"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/RhysSullivan/executor.git",
+    "directory": "packages/core/config"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup && (tsc --declaration --emitDeclarationOnly --outDir dist --rootDir src || true)",
+    "typecheck": "tsgo --noEmit",
+    "test": "vitest run",
+    "typecheck:slow": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@executor-js/sdk": "0.0.1",
+    "effect": "4.0.0-beta.59",
+    "jsonc-parser": "^3.3.1"
+  },
+  "devDependencies": {
+    "@effect/platform-node": "4.0.0-beta.59",
+    "@effect/vitest": "4.0.0-beta.59",
+    "@types/node": "^24.3.1",
+    "tsup": "^8.5.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.5"
+  }
+}