@executor-js/plugin-graphql 0.1.0 → 0.2.1

package/dist/sdk/plugin.d.ts

@@ -1,13 +1,13 @@
 import { Effect } from "effect";
 import type { Layer } from "effect";
 import { HttpClient } from "effect/unstable/http";
-import { GraphqlExtensionService } from "../api/handlers";
-import { type StorageFailure } from "@executor-js/sdk/core";
+import { type PluginCtx, type StorageFailure } from "@executor-js/sdk/core";
 import { type ConfigFileSink } from "@executor-js/config";
-import { GraphqlExtractionError, GraphqlIntrospectionError } from "./errors";
+import { GraphqlIntrospectionError } from "./errors";
 import { type GraphqlStore, type StoredGraphqlSource } from "./store";
-import { type GraphqlSourceAuth, type HeaderValue as HeaderValueValue, type QueryParamValue } from "./types";
+import { GraphqlSourceBindingInput, GraphqlSourceBindingRef, type ConfiguredGraphqlCredentialValue, type GraphqlCredentialInput, type HeaderValue as HeaderValueValue, type GraphqlSourceAuthInput } from "./types";
 export type HeaderValue = HeaderValueValue;
+export type GraphqlCredentialValue = ConfiguredGraphqlCredentialValue;
 export interface GraphqlSourceConfig {
     /** The GraphQL endpoint URL */
     readonly endpoint: string;
@@ -24,50 +24,25 @@ export interface GraphqlSourceConfig {
     readonly introspectionJson?: string;
     /** Namespace for the tools (derived from endpoint if not provided) */
     readonly namespace?: string;
-    /** Headers applied to every request. Values can reference secrets. */
-    readonly headers?: Record<string, HeaderValue>;
-    /** Query parameters applied to every request. Values can reference secrets. */
-    readonly queryParams?: Record<string, QueryParamValue>;
-    /** Optional OAuth2 connection used as a Bearer token for every request. */
-    readonly auth?: GraphqlSourceAuth;
+    /** Headers applied to every request. Direct secrets are rewritten to slots. */
+    readonly headers?: Record<string, GraphqlCredentialInput>;
+    /** Query parameters applied to every request. Direct secrets are rewritten to slots. */
+    readonly queryParams?: Record<string, GraphqlCredentialInput>;
+    /**
+     * Scope that owns any direct credentials supplied on this call. Required
+     * whenever headers/queryParams/auth carry direct secret or connection ids.
+     */
+    readonly credentialTargetScope?: string;
+    /** Optional OAuth2 credential used as a Bearer token for every request. */
+    readonly auth?: GraphqlSourceAuthInput;
 }
 export interface GraphqlUpdateSourceInput {
     readonly name?: string;
     readonly endpoint?: string;
-    readonly headers?: Record<string, HeaderValue>;
-    readonly queryParams?: Record<string, QueryParamValue>;
-    readonly auth?: GraphqlSourceAuth;
-}
-/**
- * Errors any GraphQL extension method may surface. `GraphqlIntrospectionError`
- * and `GraphqlExtractionError` are plugin-domain tagged errors that flow
- * directly to clients (4xx, each carrying its own `HttpApiSchema` status).
- * `StorageFailure` covers raw backend failures (`StorageError` plus
- * `UniqueViolationError`); the HTTP edge (`@executor-js/api`'s `withCapture`)
- * translates `StorageError` to the opaque `InternalError({ traceId })` at
- * Layer composition.
- */
-export type GraphqlExtensionFailure = GraphqlIntrospectionError | GraphqlExtractionError | StorageFailure;
-export interface GraphqlPluginExtension {
-    /** Add a GraphQL endpoint and register its operations as tools */
-    readonly addSource: (config: GraphqlSourceConfig) => Effect.Effect<{
-        readonly toolCount: number;
-        readonly namespace: string;
-    }, GraphqlExtensionFailure>;
-    /** Remove all tools from a previously added GraphQL source by namespace.
-     *  `scope` pins the cleanup to the exact row — without it a shadowed
-     *  outer-scope source with the same namespace could be wiped instead. */
-    readonly removeSource: (namespace: string, scope: string) => Effect.Effect<void, StorageFailure>;
-    /** Fetch the full stored source by namespace (or null if missing).
-     *  `scope` returns the exact row at that scope. For fall-through
-     *  reads across the executor's scope stack, use `executor.sources.*`. */
-    readonly getSource: (namespace: string, scope: string) => Effect.Effect<StoredGraphqlSource | null, StorageFailure>;
-    /** Update config (endpoint, headers) for an existing GraphQL source.
-     *  Does NOT re-introspect or re-register tools — just patches the
-     *  stored endpoint/headers used at invoke time. `scope` pins the
-     *  mutation to a single row so shadowed rows at other scopes are
-     *  untouched. */
-    readonly updateSource: (namespace: string, scope: string, input: GraphqlUpdateSourceInput) => Effect.Effect<void, StorageFailure>;
+    readonly headers?: Record<string, GraphqlCredentialInput>;
+    readonly queryParams?: Record<string, GraphqlCredentialInput>;
+    readonly credentialTargetScope?: string;
+    readonly auth?: GraphqlSourceAuthInput;
 }
 export interface GraphqlPluginOptions {
     readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;
@@ -75,14 +50,30 @@ export interface GraphqlPluginOptions {
      *  (best-effort — file errors are logged, not raised). */
     readonly configFile?: ConfigFileSink;
 }
+declare const makeGraphqlExtension: (ctx: PluginCtx<GraphqlStore>, httpClientLayer: Layer.Layer<HttpClient.HttpClient>, configFile: ConfigFileSink | undefined) => {
+    addSource: (config: GraphqlSourceConfig) => Effect.Effect<{
+        toolCount: number;
+        namespace: string;
+    }, StorageFailure | GraphqlIntrospectionError | import("./errors").GraphqlExtractionError, never>;
+    removeSource: (namespace: string, scope: string) => Effect.Effect<void, StorageFailure, never>;
+    getSource: (namespace: string, scope: string) => Effect.Effect<StoredGraphqlSource | null, StorageFailure, never>;
+    updateSource: (namespace: string, scope: string, input: GraphqlUpdateSourceInput) => Effect.Effect<void, StorageFailure | GraphqlIntrospectionError, never>;
+    listSourceBindings: (sourceId: string, sourceScope: string) => Effect.Effect<readonly GraphqlSourceBindingRef[], StorageFailure, never>;
+    setSourceBinding: (input: GraphqlSourceBindingInput) => Effect.Effect<GraphqlSourceBindingRef, StorageFailure, never>;
+    removeSourceBinding: (sourceId: string, sourceScope: string, slot: string, scope: string) => Effect.Effect<void, StorageFailure, never>;
+};
+export type GraphqlPluginExtension = ReturnType<typeof makeGraphqlExtension>;
 export declare const graphqlPlugin: import("@executor-js/sdk/core").ConfiguredPlugin<"graphql", {
     addSource: (config: GraphqlSourceConfig) => Effect.Effect<{
-        readonly toolCount: number;
-        readonly namespace: string;
-    }, StorageFailure | GraphqlIntrospectionError | GraphqlExtractionError, never>;
+        toolCount: number;
+        namespace: string;
+    }, StorageFailure | GraphqlIntrospectionError | import("./errors").GraphqlExtractionError, never>;
     removeSource: (namespace: string, scope: string) => Effect.Effect<void, StorageFailure, never>;
     getSource: (namespace: string, scope: string) => Effect.Effect<StoredGraphqlSource | null, StorageFailure, never>;
-    updateSource: (namespace: string, scope: string, input: GraphqlUpdateSourceInput) => Effect.Effect<void, StorageFailure, never>;
+    updateSource: (namespace: string, scope: string, input: GraphqlUpdateSourceInput) => Effect.Effect<void, StorageFailure | GraphqlIntrospectionError, never>;
+    listSourceBindings: (sourceId: string, sourceScope: string) => Effect.Effect<readonly GraphqlSourceBindingRef[], StorageFailure, never>;
+    setSourceBinding: (input: GraphqlSourceBindingInput) => Effect.Effect<GraphqlSourceBindingRef, StorageFailure, never>;
+    removeSourceBinding: (sourceId: string, sourceScope: string, slot: string, scope: string) => Effect.Effect<void, StorageFailure, never>;
 }, GraphqlStore, GraphqlPluginOptions, {
     readonly graphql_source: {
         readonly fields: {
@@ -103,16 +94,89 @@ export declare const graphqlPlugin: import("@executor-js/sdk/core").ConfiguredPl
                 readonly type: "string";
                 readonly required: true;
             };
-            readonly headers: {
-                readonly type: "json";
+            readonly auth_kind: {
+                readonly type: ["none", "oauth2"];
+                readonly required: true;
+                readonly defaultValue: "none";
+            };
+            readonly auth_connection_slot: {
+                readonly type: "string";
                 readonly required: false;
             };
-            readonly query_params: {
-                readonly type: "json";
+        };
+    };
+    readonly graphql_source_header: {
+        readonly fields: {
+            readonly id: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly scope_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly source_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly name: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly kind: {
+                readonly type: ["text", "binding"];
+                readonly required: true;
+            };
+            readonly text_value: {
+                readonly type: "string";
                 readonly required: false;
             };
-            readonly auth: {
-                readonly type: "json";
+            readonly slot_key: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly prefix: {
+                readonly type: "string";
+                readonly required: false;
+            };
+        };
+    };
+    readonly graphql_source_query_param: {
+        readonly fields: {
+            readonly id: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly scope_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly source_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly name: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly kind: {
+                readonly type: ["text", "binding"];
+                readonly required: true;
+            };
+            readonly text_value: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly slot_key: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly prefix: {
+                readonly type: "string";
                 readonly required: false;
             };
         };
@@ -139,119 +203,5 @@ export declare const graphqlPlugin: import("@executor-js/sdk/core").ConfiguredPl
             };
         };
     };
-}, typeof GraphqlExtensionService, Layer.Layer<import("effect/unstable/httpapi/HttpApiGroup").ApiGroup<"executor", "graphql">, never, import("effect/unstable/http/HttpRouter").Request<"Requires", GraphqlExtensionService>>, import("effect/unstable/httpapi/HttpApiGroup").HttpApiGroup<"graphql", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"addSource", "POST", "/scopes/:scopeId/graphql/sources", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
-    scopeId: import("effect/Schema").brand<import("effect/Schema").String, "ScopeId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
-    readonly endpoint: import("effect/Schema").String;
-    readonly name: import("effect/Schema").optional<import("effect/Schema").String>;
-    readonly introspectionJson: import("effect/Schema").optional<import("effect/Schema").String>;
-    readonly namespace: import("effect/Schema").optional<import("effect/Schema").String>;
-    readonly headers: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-    readonly queryParams: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-    readonly auth: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
-        readonly kind: import("effect/Schema").Literal<"none">;
-    }>, import("effect/Schema").Struct<{
-        readonly kind: import("effect/Schema").Literal<"oauth2">;
-        readonly connectionId: import("effect/Schema").String;
-    }>]>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
-    readonly toolCount: import("effect/Schema").Number;
-    readonly namespace: import("effect/Schema").String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | import("effect/Schema").decodeTo<import("effect/Schema").declareConstructor<GraphqlIntrospectionError, {
-    readonly message: string;
-    readonly _tag: "GraphqlIntrospectionError";
-}, readonly [import("effect/Schema").TaggedStruct<"GraphqlIntrospectionError", {
-    readonly message: import("effect/Schema").String;
-}>], {
-    readonly message: string;
-    readonly _tag: "GraphqlIntrospectionError";
-}>, import("effect/Schema").TaggedStruct<"GraphqlIntrospectionError", {
-    readonly message: import("effect/Schema").String;
-}>, never, never> | import("effect/Schema").decodeTo<import("effect/Schema").declareConstructor<GraphqlExtractionError, {
-    readonly message: string;
-    readonly _tag: "GraphqlExtractionError";
-}, readonly [import("effect/Schema").TaggedStruct<"GraphqlExtractionError", {
-    readonly message: import("effect/Schema").String;
-}>], {
-    readonly message: string;
-    readonly _tag: "GraphqlExtractionError";
-}>, import("effect/Schema").TaggedStruct<"GraphqlExtractionError", {
-    readonly message: import("effect/Schema").String;
-}>, never, never>>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"getSource", "GET", "/scopes/:scopeId/graphql/sources/:namespace", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
-    scopeId: import("effect/Schema").brand<import("effect/Schema").String, "ScopeId">;
-    namespace: import("effect/Schema").String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").NullOr<import("effect/Schema").Struct<{
-    readonly namespace: import("effect/Schema").String;
-    readonly name: import("effect/Schema").String;
-    readonly endpoint: import("effect/Schema").String;
-    readonly headers: import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Union<readonly [import("effect/Schema").String, import("effect/Schema").Struct<{
-        readonly secretId: import("effect/Schema").String;
-        readonly prefix: import("effect/Schema").optional<import("effect/Schema").String>;
-    }>]>>;
-    readonly queryParams: import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Union<readonly [import("effect/Schema").String, import("effect/Schema").Struct<{
-        readonly secretId: import("effect/Schema").String;
-        readonly prefix: import("effect/Schema").optional<import("effect/Schema").String>;
-    }>]>>;
-    readonly auth: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
-        readonly kind: import("effect/Schema").Literal<"none">;
-    }>, import("effect/Schema").Struct<{
-        readonly kind: import("effect/Schema").Literal<"oauth2">;
-        readonly connectionId: import("effect/Schema").String;
-    }>]>;
-}>>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | import("effect/Schema").decodeTo<import("effect/Schema").declareConstructor<GraphqlIntrospectionError, {
-    readonly message: string;
-    readonly _tag: "GraphqlIntrospectionError";
-}, readonly [import("effect/Schema").TaggedStruct<"GraphqlIntrospectionError", {
-    readonly message: import("effect/Schema").String;
-}>], {
-    readonly message: string;
-    readonly _tag: "GraphqlIntrospectionError";
-}>, import("effect/Schema").TaggedStruct<"GraphqlIntrospectionError", {
-    readonly message: import("effect/Schema").String;
-}>, never, never> | import("effect/Schema").decodeTo<import("effect/Schema").declareConstructor<GraphqlExtractionError, {
-    readonly message: string;
-    readonly _tag: "GraphqlExtractionError";
-}, readonly [import("effect/Schema").TaggedStruct<"GraphqlExtractionError", {
-    readonly message: import("effect/Schema").String;
-}>], {
-    readonly message: string;
-    readonly _tag: "GraphqlExtractionError";
-}>, import("effect/Schema").TaggedStruct<"GraphqlExtractionError", {
-    readonly message: import("effect/Schema").String;
-}>, never, never>>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"updateSource", "PATCH", "/scopes/:scopeId/graphql/sources/:namespace", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
-    scopeId: import("effect/Schema").brand<import("effect/Schema").String, "ScopeId">;
-    namespace: import("effect/Schema").String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
-    readonly name: import("effect/Schema").optional<import("effect/Schema").String>;
-    readonly endpoint: import("effect/Schema").optional<import("effect/Schema").String>;
-    readonly headers: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-    readonly queryParams: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-    readonly auth: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
-        readonly kind: import("effect/Schema").Literal<"none">;
-    }>, import("effect/Schema").Struct<{
-        readonly kind: import("effect/Schema").Literal<"oauth2">;
-        readonly connectionId: import("effect/Schema").String;
-    }>]>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
-    readonly updated: import("effect/Schema").Boolean;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | import("effect/Schema").decodeTo<import("effect/Schema").declareConstructor<GraphqlIntrospectionError, {
-    readonly message: string;
-    readonly _tag: "GraphqlIntrospectionError";
-}, readonly [import("effect/Schema").TaggedStruct<"GraphqlIntrospectionError", {
-    readonly message: import("effect/Schema").String;
-}>], {
-    readonly message: string;
-    readonly _tag: "GraphqlIntrospectionError";
-}>, import("effect/Schema").TaggedStruct<"GraphqlIntrospectionError", {
-    readonly message: import("effect/Schema").String;
-}>, never, never> | import("effect/Schema").decodeTo<import("effect/Schema").declareConstructor<GraphqlExtractionError, {
-    readonly message: string;
-    readonly _tag: "GraphqlExtractionError";
-}, readonly [import("effect/Schema").TaggedStruct<"GraphqlExtractionError", {
-    readonly message: import("effect/Schema").String;
-}>], {
-    readonly message: string;
-    readonly _tag: "GraphqlExtractionError";
-}>, import("effect/Schema").TaggedStruct<"GraphqlExtractionError", {
-    readonly message: import("effect/Schema").String;
-}>, never, never>>, never, never>, false>>;
+}, undefined, Layer.Layer<unknown, never, never>, import("effect/unstable/httpapi/HttpApiGroup").Any>;
+export {};

package/dist/sdk/store.d.ts

@@ -1,6 +1,6 @@
 import { Effect } from "effect";
 import { type StorageDeps, type StorageFailure } from "@executor-js/sdk/core";
-import { OperationBinding, type GraphqlSourceAuth, type HeaderValue, type QueryParamValue } from "./types";
+import { OperationBinding, type ConfiguredGraphqlCredentialValue, type GraphqlSourceAuth } from "./types";
 export declare const graphqlSchema: {
     readonly graphql_source: {
         readonly fields: {
@@ -21,16 +21,89 @@ export declare const graphqlSchema: {
                 readonly type: "string";
                 readonly required: true;
             };
-            readonly headers: {
-                readonly type: "json";
+            readonly auth_kind: {
+                readonly type: ["none", "oauth2"];
+                readonly required: true;
+                readonly defaultValue: "none";
+            };
+            readonly auth_connection_slot: {
+                readonly type: "string";
                 readonly required: false;
             };
-            readonly query_params: {
-                readonly type: "json";
+        };
+    };
+    readonly graphql_source_header: {
+        readonly fields: {
+            readonly id: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly scope_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly source_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly name: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly kind: {
+                readonly type: ["text", "binding"];
+                readonly required: true;
+            };
+            readonly text_value: {
+                readonly type: "string";
                 readonly required: false;
             };
-            readonly auth: {
-                readonly type: "json";
+            readonly slot_key: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly prefix: {
+                readonly type: "string";
+                readonly required: false;
+            };
+        };
+    };
+    readonly graphql_source_query_param: {
+        readonly fields: {
+            readonly id: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly scope_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly source_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly name: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly kind: {
+                readonly type: ["text", "binding"];
+                readonly required: true;
+            };
+            readonly text_value: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly slot_key: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly prefix: {
+                readonly type: "string";
                 readonly required: false;
             };
         };
@@ -67,8 +140,8 @@ export interface StoredGraphqlSource {
     readonly scope: string;
     readonly name: string;
     readonly endpoint: string;
-    readonly headers: Record<string, HeaderValue>;
-    readonly queryParams: Record<string, QueryParamValue>;
+    readonly headers: Record<string, ConfiguredGraphqlCredentialValue>;
+    readonly queryParams: Record<string, ConfiguredGraphqlCredentialValue>;
     readonly auth: GraphqlSourceAuth;
 }
 export interface StoredOperation {
@@ -81,8 +154,8 @@ export interface GraphqlStore {
     readonly updateSourceMeta: (namespace: string, scope: string, patch: {
         readonly name?: string;
         readonly endpoint?: string;
-        readonly headers?: Record<string, HeaderValue>;
-        readonly queryParams?: Record<string, QueryParamValue>;
+        readonly headers?: Record<string, ConfiguredGraphqlCredentialValue>;
+        readonly queryParams?: Record<string, ConfiguredGraphqlCredentialValue>;
         readonly auth?: GraphqlSourceAuth;
     }) => Effect.Effect<void, StorageFailure>;
     readonly getSource: (namespace: string, scope: string) => Effect.Effect<StoredGraphqlSource | null, StorageFailure>;

package/dist/sdk/types.d.ts

@@ -50,24 +50,128 @@ export declare const QueryParamValue: Schema.Union<readonly [Schema.String, Sche
     readonly prefix: Schema.optional<Schema.String>;
 }>]>;
 export type QueryParamValue = typeof QueryParamValue.Type;
+export declare const ConfiguredGraphqlCredentialValue: Schema.Union<readonly [Schema.String, Schema.Struct<{
+    readonly kind: Schema.Literal<"binding">;
+    readonly slot: Schema.String;
+    readonly prefix: Schema.optional<Schema.String>;
+}>]>;
+export type ConfiguredGraphqlCredentialValue = typeof ConfiguredGraphqlCredentialValue.Type;
+export declare const GraphqlCredentialInput: Schema.Union<readonly [Schema.Struct<{
+    readonly secretId: Schema.String;
+    readonly prefix: Schema.optional<Schema.String>;
+    readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
+    readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+}>, Schema.Union<readonly [Schema.String, Schema.Struct<{
+    readonly secretId: Schema.String;
+    readonly prefix: Schema.optional<Schema.String>;
+}>]>, Schema.Union<readonly [Schema.String, Schema.Struct<{
+    readonly kind: Schema.Literal<"binding">;
+    readonly slot: Schema.String;
+    readonly prefix: Schema.optional<Schema.String>;
+}>]>]>;
+export type GraphqlCredentialInput = typeof GraphqlCredentialInput.Type;
+export declare const graphqlHeaderSlot: (name: string) => string;
+export declare const graphqlQueryParamSlot: (name: string) => string;
+export declare const GRAPHQL_OAUTH_CONNECTION_SLOT = "auth:oauth2:connection";
 export declare const GraphqlSourceAuth: Schema.Union<readonly [Schema.Struct<{
     readonly kind: Schema.Literal<"none">;
 }>, Schema.Struct<{
     readonly kind: Schema.Literal<"oauth2">;
-    readonly connectionId: Schema.String;
+    readonly connectionSlot: Schema.String;
 }>]>;
 export type GraphqlSourceAuth = typeof GraphqlSourceAuth.Type;
+export declare const GraphqlSourceAuthInput: Schema.Union<readonly [Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"none">;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"oauth2">;
+    readonly connectionSlot: Schema.String;
+}>]>, Schema.Struct<{
+    readonly kind: Schema.Literal<"oauth2">;
+    readonly connectionId: Schema.String;
+}>]>;
+export type GraphqlSourceAuthInput = typeof GraphqlSourceAuthInput.Type;
+export declare const GraphqlSourceBindingValue: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"text">;
+    readonly text: Schema.String;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"secret">;
+    readonly secretId: Schema.brand<Schema.String, "SecretId">;
+    readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"connection">;
+    readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+}>]>;
+export type GraphqlSourceBindingValue = typeof GraphqlSourceBindingValue.Type;
+export declare const GraphqlSourceBindingInputSchema: Schema.Struct<{
+    readonly sourceId: Schema.String;
+    readonly sourceScope: Schema.brand<Schema.String, "ScopeId">;
+    readonly scope: Schema.brand<Schema.String, "ScopeId">;
+    readonly slot: Schema.String;
+    readonly value: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"text">;
+        readonly text: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"secret">;
+        readonly secretId: Schema.brand<Schema.String, "SecretId">;
+        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"connection">;
+        readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+    }>]>;
+}>;
+declare const GraphqlSourceBindingInput_base: Schema.Class<GraphqlSourceBindingInput, Schema.Struct<{
+    readonly sourceId: Schema.String;
+    readonly sourceScope: Schema.brand<Schema.String, "ScopeId">;
+    readonly scope: Schema.brand<Schema.String, "ScopeId">;
+    readonly slot: Schema.String;
+    readonly value: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"text">;
+        readonly text: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"secret">;
+        readonly secretId: Schema.brand<Schema.String, "SecretId">;
+        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"connection">;
+        readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+    }>]>;
+}>, {}>;
+export declare class GraphqlSourceBindingInput extends GraphqlSourceBindingInput_base {
+}
+declare const GraphqlSourceBindingRef_base: Schema.Class<GraphqlSourceBindingRef, Schema.Struct<{
+    readonly sourceId: Schema.String;
+    readonly sourceScopeId: Schema.brand<Schema.String, "ScopeId">;
+    readonly scopeId: Schema.brand<Schema.String, "ScopeId">;
+    readonly slot: Schema.String;
+    readonly value: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"text">;
+        readonly text: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"secret">;
+        readonly secretId: Schema.brand<Schema.String, "SecretId">;
+        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"connection">;
+        readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+    }>]>;
+    readonly createdAt: Schema.Date;
+    readonly updatedAt: Schema.Date;
+}>, {}>;
+export declare class GraphqlSourceBindingRef extends GraphqlSourceBindingRef_base {
+}
 declare const InvocationConfig_base: Schema.Class<InvocationConfig, Schema.Struct<{
     /** The GraphQL endpoint URL */
     readonly endpoint: Schema.String;
     /** Headers applied to every request. Values can reference secrets. */
     readonly headers: Schema.withConstructorDefault<Schema.withDecodingDefault<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly secretId: Schema.String;
+        readonly kind: Schema.Literal<"binding">;
+        readonly slot: Schema.String;
         readonly prefix: Schema.optional<Schema.String>;
     }>]>>>>;
     /** Query parameters applied to every request. Values can reference secrets. */
     readonly queryParams: Schema.withConstructorDefault<Schema.withDecodingDefault<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
-        readonly secretId: Schema.String;
+        readonly kind: Schema.Literal<"binding">;
+        readonly slot: Schema.String;
         readonly prefix: Schema.optional<Schema.String>;
     }>]>>>>;
 }>, {}>;

package/dist/testing/index.d.ts

@@ -0,0 +1,52 @@
+import { Context, Effect, Layer, Schema as EffectSchema, Scope } from "effect";
+import { GraphQLSchema } from "graphql";
+declare const GraphqlRequestPayload: EffectSchema.Struct<{
+    readonly query: EffectSchema.optional<EffectSchema.String>;
+    readonly variables: EffectSchema.optional<EffectSchema.$Record<EffectSchema.String, EffectSchema.Unknown>>;
+    readonly operationName: EffectSchema.optional<EffectSchema.NullOr<EffectSchema.String>>;
+}>;
+type GraphqlRequestPayload = typeof GraphqlRequestPayload.Type;
+export interface GraphqlTestRequest {
+    readonly url: string;
+    readonly method: string;
+    readonly path: string;
+    readonly headers: Readonly<Record<string, string>>;
+    readonly payload: GraphqlRequestPayload;
+}
+export interface GraphqlTestContext {
+    readonly request: GraphqlTestRequest;
+}
+export interface GraphqlTestServerOptions {
+    readonly schema: GraphQLSchema;
+    readonly path?: string;
+}
+export interface GraphqlTestServerShape {
+    readonly endpoint: string;
+    readonly schema: GraphQLSchema;
+    readonly requests: Effect.Effect<readonly GraphqlTestRequest[]>;
+    readonly clearRequests: Effect.Effect<void>;
+}
+declare const GraphqlTestServerAddressError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "GraphqlTestServerAddressError";
+} & Readonly<A>;
+declare class GraphqlTestServerAddressError extends GraphqlTestServerAddressError_base<{
+    readonly address: unknown;
+}> {
+}
+declare const GraphqlTestServerHandlerError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "GraphqlTestServerHandlerError";
+} & Readonly<A>;
+declare class GraphqlTestServerHandlerError extends GraphqlTestServerHandlerError_base<{
+    readonly cause: unknown;
+}> {
+}
+export declare const serveGraphqlTestServer: (options: GraphqlTestServerOptions) => Effect.Effect<GraphqlTestServerShape, GraphqlTestServerAddressError | GraphqlTestServerHandlerError, Scope.Scope>;
+declare const GraphqlTestServer_base: Context.ServiceClass<GraphqlTestServer, "@executor-js/plugin-graphql/testing/GraphqlTestServer", GraphqlTestServerShape>;
+export declare class GraphqlTestServer extends GraphqlTestServer_base {
+    static readonly layer: (options: GraphqlTestServerOptions) => Layer.Layer<GraphqlTestServer, GraphqlTestServerAddressError | GraphqlTestServerHandlerError, never>;
+}
+export declare const makeGreetingGraphqlSchema: () => GraphQLSchema;
+export declare const TestLayers: {
+    greeting: () => Layer.Layer<GraphqlTestServer, GraphqlTestServerAddressError | GraphqlTestServerHandlerError, never>;
+};
+export {};