@executor-js/plugin-graphql 0.1.0 → 1.4.20

package/dist/chunk-PO2TPM5B.js

@@ -0,0 +1,1636 @@
+import {
+  ExtractedField,
+  ExtractionResult,
+  GRAPHQL_OAUTH_CONNECTION_SLOT,
+  GraphqlArgument,
+  GraphqlCredentialInput,
+  GraphqlExtractionError,
+  GraphqlIntrospectionError,
+  GraphqlInvocationError,
+  GraphqlSourceAuthInput,
+  GraphqlSourceBindingRef,
+  InvocationResult,
+  OperationBinding,
+  graphqlHeaderSlot,
+  graphqlQueryParamSlot
+} from "./chunk-445ZPXHU.js";
+
+// src/sdk/introspect.ts
+import { Effect, Schema } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/unstable/http";
+var INTROSPECTION_QUERY = `
+  query IntrospectionQuery {
+    __schema {
+      queryType { name }
+      mutationType { name }
+      types {
+        kind
+        name
+        description
+        fields(includeDeprecated: false) {
+          name
+          description
+          args {
+            name
+            description
+            type {
+              ...TypeRef
+            }
+            defaultValue
+          }
+          type {
+            ...TypeRef
+          }
+        }
+        inputFields {
+          name
+          description
+          type {
+            ...TypeRef
+          }
+          defaultValue
+        }
+        enumValues(includeDeprecated: false) {
+          name
+          description
+        }
+      }
+    }
+  }
+
+  fragment TypeRef on __Type {
+    kind
+    name
+    ofType {
+      kind
+      name
+      ofType {
+        kind
+        name
+        ofType {
+          kind
+          name
+          ofType {
+            kind
+            name
+            ofType {
+              kind
+              name
+              ofType {
+                kind
+                name
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+`;
+var IntrospectionTypeRefLeaf = Schema.Struct({
+  kind: Schema.String,
+  name: Schema.NullOr(Schema.String),
+  ofType: Schema.Null
+});
+var IntrospectionTypeRef5 = Schema.Struct({
+  kind: Schema.String,
+  name: Schema.NullOr(Schema.String),
+  ofType: Schema.NullOr(IntrospectionTypeRefLeaf)
+});
+var IntrospectionTypeRef4 = Schema.Struct({
+  kind: Schema.String,
+  name: Schema.NullOr(Schema.String),
+  ofType: Schema.NullOr(IntrospectionTypeRef5)
+});
+var IntrospectionTypeRef3 = Schema.Struct({
+  kind: Schema.String,
+  name: Schema.NullOr(Schema.String),
+  ofType: Schema.NullOr(IntrospectionTypeRef4)
+});
+var IntrospectionTypeRef2 = Schema.Struct({
+  kind: Schema.String,
+  name: Schema.NullOr(Schema.String),
+  ofType: Schema.NullOr(IntrospectionTypeRef3)
+});
+var IntrospectionTypeRefSchema = Schema.Struct({
+  kind: Schema.String,
+  name: Schema.NullOr(Schema.String),
+  ofType: Schema.NullOr(IntrospectionTypeRef2)
+});
+var IntrospectionInputValueSchema = Schema.Struct({
+  name: Schema.String,
+  description: Schema.NullOr(Schema.String),
+  type: IntrospectionTypeRefSchema,
+  defaultValue: Schema.NullOr(Schema.String)
+});
+var IntrospectionFieldSchema = Schema.Struct({
+  name: Schema.String,
+  description: Schema.NullOr(Schema.String),
+  args: Schema.Array(IntrospectionInputValueSchema),
+  type: IntrospectionTypeRefSchema
+});
+var IntrospectionTypeSchema = Schema.Struct({
+  kind: Schema.String,
+  name: Schema.String,
+  description: Schema.NullOr(Schema.String),
+  fields: Schema.NullOr(Schema.Array(IntrospectionFieldSchema)),
+  inputFields: Schema.NullOr(Schema.Array(IntrospectionInputValueSchema)),
+  enumValues: Schema.NullOr(
+    Schema.Array(
+      Schema.Struct({
+        name: Schema.String,
+        description: Schema.NullOr(Schema.String)
+      })
+    )
+  )
+});
+var IntrospectionResultSchema = Schema.Struct({
+  __schema: Schema.Struct({
+    queryType: Schema.NullOr(Schema.Struct({ name: Schema.String })),
+    mutationType: Schema.NullOr(Schema.Struct({ name: Schema.String })),
+    types: Schema.Array(IntrospectionTypeSchema)
+  })
+});
+var IntrospectionResponseSchema = Schema.Struct({
+  data: Schema.optional(IntrospectionResultSchema),
+  errors: Schema.optional(Schema.Array(Schema.Unknown))
+});
+var IntrospectionJsonSchema = Schema.Union([
+  Schema.Struct({ data: IntrospectionResultSchema }),
+  IntrospectionResultSchema
+]);
+var introspect = Effect.fn("GraphQL.introspect")(function* (endpoint, headers, queryParams) {
+  const client = yield* HttpClient.HttpClient;
+  const requestEndpoint = queryParams && Object.keys(queryParams).length > 0 ? (() => {
+    const url = new URL(endpoint);
+    for (const [name, value] of Object.entries(queryParams)) {
+      url.searchParams.set(name, value);
+    }
+    return url.toString();
+  })() : endpoint;
+  let request = HttpClientRequest.post(requestEndpoint).pipe(
+    HttpClientRequest.setHeader("Content-Type", "application/json"),
+    HttpClientRequest.bodyJsonUnsafe({
+      query: INTROSPECTION_QUERY
+    })
+  );
+  if (headers) {
+    for (const [k, v] of Object.entries(headers)) {
+      request = HttpClientRequest.setHeader(request, k, v);
+    }
+  }
+  const response = yield* client.execute(request).pipe(
+    Effect.tapCause((cause) => Effect.logError("graphql introspection request failed", cause)),
+    Effect.mapError(
+      () => new GraphqlIntrospectionError({
+        message: "Failed to reach GraphQL endpoint"
+      })
+    )
+  );
+  if (response.status !== 200) {
+    return yield* new GraphqlIntrospectionError({
+      message: `Introspection failed with status ${response.status}`
+    });
+  }
+  const raw = yield* response.json.pipe(
+    Effect.tapCause((cause) => Effect.logError("graphql introspection JSON parse failed", cause)),
+    Effect.mapError(
+      () => new GraphqlIntrospectionError({
+        message: `Failed to parse introspection response as JSON`
+      })
+    )
+  );
+  const json = yield* Schema.decodeUnknownEffect(IntrospectionResponseSchema)(raw).pipe(
+    Effect.mapError(
+      () => new GraphqlIntrospectionError({
+        message: "Introspection response has an invalid shape"
+      })
+    )
+  );
+  if (json.errors && Array.isArray(json.errors) && json.errors.length > 0) {
+    return yield* new GraphqlIntrospectionError({
+      message: `Introspection returned ${json.errors.length} error(s)`
+    });
+  }
+  if (!json.data?.__schema) {
+    return yield* new GraphqlIntrospectionError({
+      message: "Introspection response missing __schema"
+    });
+  }
+  return json.data;
+});
+var parseIntrospectionJson = (text) => Schema.decodeUnknownEffect(Schema.fromJsonString(IntrospectionJsonSchema))(text).pipe(
+  Effect.map((parsed) => "data" in parsed ? parsed.data : parsed),
+  Effect.mapError(
+    () => new GraphqlIntrospectionError({
+      message: "Failed to parse introspection JSON"
+    })
+  )
+);
+
+// src/sdk/extract.ts
+import { Effect as Effect2, Match, Option } from "effect";
+var unwrapTypeName = (ref) => {
+  if (ref.name) return ref.name;
+  if (ref.ofType) return unwrapTypeName(ref.ofType);
+  return "Unknown";
+};
+var isNonNull = (ref) => ref.kind === "NON_NULL";
+var buildDefinitions = (types) => {
+  const defs = {};
+  for (const [name, type] of types) {
+    if (name.startsWith("__")) continue;
+    if (type.kind === "INPUT_OBJECT" && type.inputFields) {
+      const properties = {};
+      const required = [];
+      for (const field of type.inputFields) {
+        const schema = typeRefToJsonSchema(field.type, types);
+        if (field.description) {
+          schema.description = field.description;
+        }
+        properties[field.name] = schema;
+        if (isNonNull(field.type)) {
+          required.push(field.name);
+        }
+      }
+      const def = { type: "object", properties };
+      if (required.length > 0) def.required = required;
+      if (type.description) def.description = type.description;
+      defs[name] = def;
+    }
+    if (type.kind === "ENUM" && type.enumValues) {
+      defs[name] = {
+        type: "string",
+        enum: type.enumValues.map((v) => v.name),
+        ...type.description ? { description: type.description } : {}
+      };
+    }
+  }
+  return defs;
+};
+var typeRefToJsonSchema = (ref, types) => Match.value(ref.kind).pipe(
+  Match.when(
+    "NON_NULL",
+    () => ref.ofType ? typeRefToJsonSchema(ref.ofType, types) : {}
+  ),
+  Match.when(
+    "LIST",
+    () => ({
+      type: "array",
+      items: ref.ofType ? typeRefToJsonSchema(ref.ofType, types) : {}
+    })
+  ),
+  Match.when("SCALAR", () => scalarToJsonSchema(ref.name ?? "String")),
+  Match.when(
+    "ENUM",
+    () => ref.name ? { $ref: `#/$defs/${ref.name}` } : { type: "string" }
+  ),
+  Match.when(
+    "INPUT_OBJECT",
+    () => ref.name ? { $ref: `#/$defs/${ref.name}` } : { type: "object" }
+  ),
+  Match.whenOr(
+    "OBJECT",
+    "INTERFACE",
+    "UNION",
+    () => ({ type: "object" })
+  ),
+  Match.option,
+  Option.getOrElse(() => ({}))
+);
+var scalarToJsonSchema = (name) => Match.value(name).pipe(
+  Match.whenOr("String", "ID", () => ({ type: "string" })),
+  Match.when("Int", () => ({ type: "integer" })),
+  Match.when("Float", () => ({ type: "number" })),
+  Match.when("Boolean", () => ({ type: "boolean" })),
+  Match.option,
+  Option.getOrElse(
+    () => ({ type: "string", description: `Custom scalar: ${name}` })
+  )
+);
+var buildInputSchema = (args, types) => {
+  if (args.length === 0) return void 0;
+  const properties = {};
+  const required = [];
+  for (const arg of args) {
+    const schema = typeRefToJsonSchema(arg.type, types);
+    if (arg.description) {
+      schema.description = arg.description;
+    }
+    properties[arg.name] = schema;
+    if (isNonNull(arg.type)) {
+      required.push(arg.name);
+    }
+  }
+  const inputSchema = {
+    type: "object",
+    properties
+  };
+  if (required.length > 0) inputSchema.required = required;
+  return inputSchema;
+};
+var formatTypeRef = (ref) => Match.value(ref.kind).pipe(
+  Match.when("NON_NULL", () => ref.ofType ? `${formatTypeRef(ref.ofType)}!` : "Unknown!"),
+  Match.when("LIST", () => ref.ofType ? `[${formatTypeRef(ref.ofType)}]` : "[Unknown]"),
+  Match.option,
+  Option.getOrElse(() => ref.name ?? "Unknown")
+);
+var extractFields = (_schema, kind, typeName, types) => {
+  if (!typeName) return [];
+  const type = types.get(typeName);
+  if (!type?.fields) return [];
+  return type.fields.filter((f) => !f.name.startsWith("__")).map((field) => {
+    const args = field.args.map(
+      (arg) => GraphqlArgument.make({
+        name: arg.name,
+        typeName: formatTypeRef(arg.type),
+        required: isNonNull(arg.type),
+        description: arg.description ? Option.some(arg.description) : Option.none()
+      })
+    );
+    const inputSchema = buildInputSchema(field.args, types);
+    return ExtractedField.make({
+      fieldName: field.name,
+      kind,
+      description: field.description ? Option.some(field.description) : Option.none(),
+      arguments: args,
+      inputSchema: inputSchema ? Option.some(inputSchema) : Option.none(),
+      returnTypeName: unwrapTypeName(field.type)
+    });
+  });
+};
+var extract = (introspection) => Effect2.try({
+  try: () => {
+    const schema = introspection.__schema;
+    const typeMap = /* @__PURE__ */ new Map();
+    for (const t of schema.types) {
+      typeMap.set(t.name, t);
+    }
+    const definitions = buildDefinitions(typeMap);
+    const queryFields = extractFields(schema, "query", schema.queryType?.name, typeMap);
+    const mutationFields = extractFields(schema, "mutation", schema.mutationType?.name, typeMap);
+    return {
+      result: ExtractionResult.make({
+        schemaName: Option.none(),
+        fields: [...queryFields, ...mutationFields]
+      }),
+      definitions
+    };
+  },
+  catch: () => new GraphqlExtractionError({
+    message: "Failed to extract GraphQL schema"
+  })
+});
+
+// src/sdk/invoke.ts
+import { Effect as Effect3, Option as Option2 } from "effect";
+import { HttpClient as HttpClient2, HttpClientRequest as HttpClientRequest2 } from "effect/unstable/http";
+import { resolveSecretBackedMap } from "@executor-js/sdk/core";
+var resolveHeaders = (headers, secrets) => {
+  const entries = Object.entries(headers);
+  const secretCount = entries.reduce(
+    (acc, [, value]) => typeof value === "string" ? acc : acc + 1,
+    0
+  );
+  return resolveSecretBackedMap({
+    values: headers,
+    getSecret: (secretId) => secrets.get(secretId).pipe(Effect3.catch(() => Effect3.succeed(null))),
+    missing: "drop",
+    onMissing: (name) => new GraphqlInvocationError({
+      message: `Missing secret for header "${name}"`,
+      statusCode: Option2.none()
+    })
+  }).pipe(
+    Effect3.catch(() => Effect3.succeed(void 0)),
+    Effect3.map((resolved) => resolved ?? {}),
+    Effect3.withSpan("plugin.graphql.secret.resolve", {
+      attributes: {
+        "plugin.graphql.headers.total": entries.length,
+        "plugin.graphql.headers.secret_count": secretCount
+      }
+    })
+  );
+};
+var endpointWithQueryParams = (endpoint, queryParams) => {
+  if (Object.keys(queryParams).length === 0) return endpoint;
+  const url = new URL(endpoint);
+  for (const [name, value] of Object.entries(queryParams)) {
+    url.searchParams.set(name, value);
+  }
+  return url.toString();
+};
+var endpointForTelemetry = (endpoint) => {
+  if (!URL.canParse(endpoint)) return endpoint;
+  const url = new URL(endpoint);
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+};
+var isJsonContentType = (ct) => {
+  if (!ct) return false;
+  const normalized = ct.split(";")[0]?.trim().toLowerCase() ?? "";
+  return normalized === "application/json" || normalized.includes("+json") || normalized.includes("json");
+};
+var invoke = Effect3.fn("GraphQL.invoke")(function* (operation, args, endpoint, resolvedHeaders, resolvedQueryParams = {}) {
+  const client = yield* HttpClient2.HttpClient;
+  const requestEndpoint = endpointWithQueryParams(endpoint, resolvedQueryParams);
+  const telemetryEndpoint = endpointForTelemetry(endpoint);
+  yield* Effect3.annotateCurrentSpan({
+    "http.method": "POST",
+    "http.url": telemetryEndpoint,
+    "plugin.graphql.endpoint": telemetryEndpoint,
+    "plugin.graphql.operation_kind": operation.kind,
+    "plugin.graphql.field_name": operation.fieldName,
+    "plugin.graphql.headers.resolved_count": Object.keys(resolvedHeaders).length,
+    "plugin.graphql.query_params.resolved_count": Object.keys(resolvedQueryParams).length
+  });
+  const variables = {};
+  for (const varName of operation.variableNames) {
+    if (args[varName] !== void 0) {
+      variables[varName] = args[varName];
+    }
+  }
+  if (typeof args.variables === "object" && args.variables !== null) {
+    Object.assign(variables, args.variables);
+  }
+  let request = HttpClientRequest2.post(requestEndpoint).pipe(
+    HttpClientRequest2.setHeader("Content-Type", "application/json"),
+    HttpClientRequest2.bodyJsonUnsafe({
+      query: operation.operationString,
+      variables: Object.keys(variables).length > 0 ? variables : void 0
+    })
+  );
+  for (const [name, value] of Object.entries(resolvedHeaders)) {
+    request = HttpClientRequest2.setHeader(request, name, value);
+  }
+  const response = yield* client.execute(request).pipe(
+    Effect3.mapError(
+      (err) => new GraphqlInvocationError({
+        message: "GraphQL request failed",
+        statusCode: Option2.none(),
+        cause: err
+      })
+    )
+  );
+  const status = response.status;
+  const contentType = response.headers["content-type"] ?? null;
+  const body = isJsonContentType(contentType) ? yield* response.json.pipe(Effect3.catch(() => response.text)) : yield* response.text;
+  const gqlBody = body;
+  const hasErrors = Array.isArray(gqlBody?.errors) && gqlBody.errors.length > 0;
+  yield* Effect3.annotateCurrentSpan({
+    "http.status_code": status,
+    "plugin.graphql.has_errors": hasErrors,
+    "plugin.graphql.error_count": hasErrors ? gqlBody.errors.length : 0
+  });
+  return InvocationResult.make({
+    status,
+    data: gqlBody?.data ?? null,
+    errors: hasErrors ? gqlBody.errors : null
+  });
+});
+var invokeWithLayer = (operation, args, endpoint, resolvedHeaders, resolvedQueryParams, httpClientLayer) => invoke(operation, args, endpoint, resolvedHeaders, resolvedQueryParams).pipe(
+  Effect3.provide(httpClientLayer),
+  Effect3.withSpan("plugin.graphql.invoke", {
+    attributes: {
+      "plugin.graphql.endpoint": endpointForTelemetry(endpoint),
+      "plugin.graphql.operation_kind": operation.kind,
+      "plugin.graphql.field_name": operation.fieldName
+    }
+  })
+);
+
+// src/sdk/store.ts
+import { Effect as Effect4, Schema as Schema2 } from "effect";
+import {
+  ConfiguredCredentialBinding,
+  defineSchema
+} from "@executor-js/sdk/core";
+var graphqlSchema = defineSchema({
+  graphql_source: {
+    fields: {
+      id: { type: "string", required: true },
+      scope_id: { type: "string", required: true, index: true },
+      name: { type: "string", required: true },
+      endpoint: { type: "string", required: true },
+      auth_kind: {
+        type: ["none", "oauth2"],
+        required: true,
+        defaultValue: "none"
+      },
+      auth_connection_slot: {
+        type: "string",
+        required: false
+      }
+    }
+  },
+  graphql_source_header: {
+    fields: {
+      id: { type: "string", required: true },
+      scope_id: { type: "string", required: true, index: true },
+      source_id: { type: "string", required: true, index: true },
+      name: { type: "string", required: true },
+      kind: {
+        type: ["text", "binding"],
+        required: true
+      },
+      text_value: { type: "string", required: false },
+      slot_key: { type: "string", required: false },
+      prefix: { type: "string", required: false }
+    }
+  },
+  graphql_source_query_param: {
+    fields: {
+      id: { type: "string", required: true },
+      scope_id: { type: "string", required: true, index: true },
+      source_id: { type: "string", required: true, index: true },
+      name: { type: "string", required: true },
+      kind: {
+        type: ["text", "binding"],
+        required: true
+      },
+      text_value: { type: "string", required: false },
+      slot_key: { type: "string", required: false },
+      prefix: { type: "string", required: false }
+    }
+  },
+  graphql_operation: {
+    fields: {
+      id: { type: "string", required: true },
+      scope_id: { type: "string", required: true, index: true },
+      source_id: { type: "string", required: true, index: true },
+      binding: { type: "json", required: true }
+    }
+  }
+});
+var OperationBindingFromJsonString = Schema2.fromJsonString(OperationBinding);
+var decodeOperationBindingFromJsonString = Schema2.decodeUnknownSync(
+  OperationBindingFromJsonString
+);
+var decodeOperationBinding = Schema2.decodeUnknownSync(OperationBinding);
+var decodeBinding = (value) => {
+  if (typeof value === "string") {
+    return decodeOperationBindingFromJsonString(value);
+  }
+  return decodeOperationBinding(value);
+};
+var encodeBinding = Schema2.encodeSync(OperationBinding);
+var toJsonRecord = (value) => value;
+var SourceRow = Schema2.Struct({
+  id: Schema2.String,
+  scope_id: Schema2.String,
+  name: Schema2.String,
+  endpoint: Schema2.String,
+  auth_kind: Schema2.Literals(["none", "oauth2"]),
+  auth_connection_slot: Schema2.NullOr(Schema2.String).pipe(Schema2.optionalKey)
+});
+var ChildValueRow = Schema2.Struct({
+  name: Schema2.String,
+  kind: Schema2.Literals(["text", "binding"]),
+  text_value: Schema2.NullOr(Schema2.String).pipe(Schema2.optionalKey),
+  slot_key: Schema2.NullOr(Schema2.String).pipe(Schema2.optionalKey),
+  prefix: Schema2.NullOr(Schema2.String).pipe(Schema2.optionalKey)
+});
+var OperationRow = Schema2.Struct({
+  id: Schema2.String,
+  source_id: Schema2.String,
+  binding: Schema2.Unknown
+});
+var decodeSourceRow = Schema2.decodeUnknownSync(SourceRow);
+var decodeChildValueRow = Schema2.decodeUnknownSync(ChildValueRow);
+var decodeOperationRow = Schema2.decodeUnknownSync(OperationRow);
+var rowsToValueMap = (rows) => {
+  const out = {};
+  for (const rawRow of rows) {
+    const row = decodeChildValueRow(rawRow);
+    const name = row.name;
+    if (row.kind === "binding" && typeof row.slot_key === "string") {
+      out[name] = typeof row.prefix === "string" ? ConfiguredCredentialBinding.make({
+        kind: "binding",
+        slot: row.slot_key,
+        prefix: row.prefix
+      }) : ConfiguredCredentialBinding.make({
+        kind: "binding",
+        slot: row.slot_key
+      });
+    } else if (row.kind === "text" && typeof row.text_value === "string") {
+      out[name] = row.text_value;
+    }
+  }
+  return out;
+};
+var valueToChildRow = (sourceId, scope, name, value) => {
+  const id = JSON.stringify([sourceId, name]);
+  if (typeof value === "string") {
+    return {
+      id,
+      scope_id: scope,
+      source_id: sourceId,
+      name,
+      kind: "text",
+      text_value: value
+    };
+  }
+  return {
+    id,
+    scope_id: scope,
+    source_id: sourceId,
+    name,
+    kind: "binding",
+    slot_key: value.slot,
+    prefix: value.prefix
+  };
+};
+var rowToAuth = (row) => {
+  if (row.auth_kind === "oauth2" && typeof row.auth_connection_slot === "string") {
+    return { kind: "oauth2", connectionSlot: row.auth_connection_slot };
+  }
+  return { kind: "none" };
+};
+var makeDefaultGraphqlStore = ({
+  adapter: db
+}) => {
+  const loadHeaders = (sourceId, scope) => db.findMany({
+    model: "graphql_source_header",
+    where: [
+      { field: "source_id", value: sourceId },
+      { field: "scope_id", value: scope }
+    ]
+  }).pipe(Effect4.map(rowsToValueMap));
+  const loadQueryParams = (sourceId, scope) => db.findMany({
+    model: "graphql_source_query_param",
+    where: [
+      { field: "source_id", value: sourceId },
+      { field: "scope_id", value: scope }
+    ]
+  }).pipe(Effect4.map(rowsToValueMap));
+  const rowToSourceWithChildren = (row) => Effect4.gen(function* () {
+    const source = decodeSourceRow(row);
+    const sourceId = source.id;
+    const scope = source.scope_id;
+    const headers = yield* loadHeaders(sourceId, scope);
+    const queryParams = yield* loadQueryParams(sourceId, scope);
+    return {
+      namespace: sourceId,
+      scope,
+      name: source.name,
+      endpoint: source.endpoint,
+      headers,
+      queryParams,
+      auth: rowToAuth(source)
+    };
+  });
+  const rowToOperation = (row) => {
+    const operation = decodeOperationRow(row);
+    return {
+      toolId: operation.id,
+      sourceId: operation.source_id,
+      binding: decodeBinding(operation.binding)
+    };
+  };
+  const replaceChildren = (model, sourceId, scope, values) => Effect4.gen(function* () {
+    yield* db.deleteMany({
+      model,
+      where: [
+        { field: "source_id", value: sourceId },
+        { field: "scope_id", value: scope }
+      ]
+    });
+    const entries = Object.entries(values);
+    if (entries.length === 0) return;
+    yield* db.createMany({
+      model,
+      data: entries.map(([name, value]) => valueToChildRow(sourceId, scope, name, value)),
+      forceAllowId: true
+    });
+  });
+  const deleteSource = (namespace, scope) => Effect4.gen(function* () {
+    yield* db.deleteMany({
+      model: "graphql_operation",
+      where: [
+        { field: "source_id", value: namespace },
+        { field: "scope_id", value: scope }
+      ]
+    });
+    yield* db.deleteMany({
+      model: "graphql_source_header",
+      where: [
+        { field: "source_id", value: namespace },
+        { field: "scope_id", value: scope }
+      ]
+    });
+    yield* db.deleteMany({
+      model: "graphql_source_query_param",
+      where: [
+        { field: "source_id", value: namespace },
+        { field: "scope_id", value: scope }
+      ]
+    });
+    yield* db.delete({
+      model: "graphql_source",
+      where: [
+        { field: "id", value: namespace },
+        { field: "scope_id", value: scope }
+      ]
+    });
+  });
+  return {
+    upsertSource: (input, operations) => Effect4.gen(function* () {
+      yield* deleteSource(input.namespace, input.scope);
+      yield* db.create({
+        model: "graphql_source",
+        data: {
+          id: input.namespace,
+          scope_id: input.scope,
+          name: input.name,
+          endpoint: input.endpoint,
+          auth_kind: input.auth.kind,
+          auth_connection_slot: input.auth.kind === "oauth2" ? input.auth.connectionSlot : void 0
+        },
+        forceAllowId: true
+      });
+      yield* replaceChildren(
+        "graphql_source_header",
+        input.namespace,
+        input.scope,
+        input.headers
+      );
+      yield* replaceChildren(
+        "graphql_source_query_param",
+        input.namespace,
+        input.scope,
+        input.queryParams
+      );
+      if (operations.length > 0) {
+        yield* db.createMany({
+          model: "graphql_operation",
+          data: operations.map((op) => ({
+            id: op.toolId,
+            scope_id: input.scope,
+            source_id: op.sourceId,
+            binding: toJsonRecord(encodeBinding(op.binding))
+          })),
+          forceAllowId: true
+        });
+      }
+    }),
+    updateSourceMeta: (namespace, scope, patch) => Effect4.gen(function* () {
+      const existing = yield* db.findOne({
+        model: "graphql_source",
+        where: [
+          { field: "id", value: namespace },
+          { field: "scope_id", value: scope }
+        ]
+      });
+      if (!existing) return;
+      const update = {};
+      if (patch.name !== void 0) update.name = patch.name;
+      if (patch.endpoint !== void 0) update.endpoint = patch.endpoint;
+      if (patch.auth !== void 0) {
+        update.auth_kind = patch.auth.kind;
+        update.auth_connection_slot = patch.auth.kind === "oauth2" ? patch.auth.connectionSlot : null;
+      }
+      if (Object.keys(update).length > 0) {
+        yield* db.update({
+          model: "graphql_source",
+          where: [
+            { field: "id", value: namespace },
+            { field: "scope_id", value: scope }
+          ],
+          update
+        });
+      }
+      if (patch.headers !== void 0) {
+        yield* replaceChildren("graphql_source_header", namespace, scope, patch.headers);
+      }
+      if (patch.queryParams !== void 0) {
+        yield* replaceChildren("graphql_source_query_param", namespace, scope, patch.queryParams);
+      }
+    }),
+    getSource: (namespace, scope) => Effect4.gen(function* () {
+      const row = yield* db.findOne({
+        model: "graphql_source",
+        where: [
+          { field: "id", value: namespace },
+          { field: "scope_id", value: scope }
+        ]
+      });
+      if (!row) return null;
+      return yield* rowToSourceWithChildren(row);
+    }),
+    listSources: () => Effect4.gen(function* () {
+      const rows = yield* db.findMany({ model: "graphql_source" });
+      return yield* Effect4.forEach(rows, rowToSourceWithChildren, {
+        concurrency: "unbounded"
+      });
+    }),
+    getOperationByToolId: (toolId, scope) => db.findOne({
+      model: "graphql_operation",
+      where: [
+        { field: "id", value: toolId },
+        { field: "scope_id", value: scope }
+      ]
+    }).pipe(Effect4.map((row) => row ? rowToOperation(row) : null)),
+    listOperationsBySource: (sourceId, scope) => db.findMany({
+      model: "graphql_operation",
+      where: [
+        { field: "source_id", value: sourceId },
+        { field: "scope_id", value: scope }
+      ]
+    }).pipe(Effect4.map((rows) => rows.map(rowToOperation))),
+    removeSource: (namespace, scope) => deleteSource(namespace, scope)
+  };
+};
+
+// src/sdk/plugin.ts
+import { Effect as Effect5, Match as Match2, Option as Option3, Schema as Schema3 } from "effect";
+import {
+  ConnectionId,
+  ConfiguredCredentialBinding as ConfiguredCredentialBinding2,
+  definePlugin,
+  tool,
+  ScopeId,
+  SecretId,
+  SourceDetectionResult,
+  StorageError
+} from "@executor-js/sdk/core";
+import {
+  headersToConfigValues
+} from "@executor-js/config";
+var StaticAddSourceInputSchema = Schema3.Struct({
+  scope: Schema3.String,
+  endpoint: Schema3.String,
+  name: Schema3.optional(Schema3.String),
+  introspectionJson: Schema3.optional(Schema3.String),
+  namespace: Schema3.optional(Schema3.String),
+  headers: Schema3.optional(Schema3.Record(Schema3.String, GraphqlCredentialInput)),
+  queryParams: Schema3.optional(Schema3.Record(Schema3.String, GraphqlCredentialInput)),
+  credentialTargetScope: Schema3.optional(Schema3.String),
+  auth: Schema3.optional(GraphqlSourceAuthInput)
+});
+var StaticAddSourceInputStandardSchema = Schema3.toStandardSchemaV1(
+  Schema3.toStandardJSONSchemaV1(StaticAddSourceInputSchema)
+);
+var StaticAddSourceOutputStandardSchema = Schema3.toStandardSchemaV1(
+  Schema3.toStandardJSONSchemaV1(Schema3.Struct({ toolCount: Schema3.Number }))
+);
+var urlMatchesToken = (url, token) => {
+  const re = new RegExp(`(?:^|[^a-z0-9])${token}(?:$|[^a-z0-9])`, "i");
+  return re.test(url.hostname) || re.test(url.pathname);
+};
+var namespaceFromEndpoint = (endpoint) => {
+  try {
+    const url = new URL(endpoint);
+    return url.hostname.replace(/[^a-z0-9]+/gi, "_").toLowerCase();
+  } catch {
+    return "graphql";
+  }
+};
+var formatTypeRef2 = (ref) => Match2.value(ref.kind).pipe(
+  Match2.when("NON_NULL", () => ref.ofType ? `${formatTypeRef2(ref.ofType)}!` : "Unknown!"),
+  Match2.when("LIST", () => ref.ofType ? `[${formatTypeRef2(ref.ofType)}]` : "[Unknown]"),
+  Match2.option,
+  Option3.getOrElse(() => ref.name ?? "Unknown")
+);
+var unwrapTypeName2 = (ref) => {
+  if (ref.name) return ref.name;
+  if (ref.ofType) return unwrapTypeName2(ref.ofType);
+  return "Unknown";
+};
+var buildSelectionSet = (ref, types, depth, seen) => {
+  if (depth > 2) return "";
+  const leafName = unwrapTypeName2(ref);
+  if (seen.has(leafName)) return "";
+  const objectType = types.get(leafName);
+  if (!objectType?.fields) return "";
+  const kind = objectType.kind;
+  if (kind === "SCALAR" || kind === "ENUM") return "";
+  seen.add(leafName);
+  const subFields = objectType.fields.filter((f) => !f.name.startsWith("__")).slice(0, 12).map((f) => {
+    const sub = buildSelectionSet(f.type, types, depth + 1, seen);
+    return sub ? `${f.name} ${sub}` : f.name;
+  });
+  seen.delete(leafName);
+  return subFields.length > 0 ? `{ ${subFields.join(" ")} }` : "";
+};
+var buildOperationStringForField = (kind, field, types) => {
+  const opType = kind === "query" ? "query" : "mutation";
+  const varDefs = field.args.map((arg) => {
+    const typeName = formatTypeRef2(arg.type);
+    return `$${arg.name}: ${typeName}`;
+  });
+  const argPasses = field.args.map((arg) => `${arg.name}: $${arg.name}`);
+  const selectionSet = buildSelectionSet(field.type, types, 0, /* @__PURE__ */ new Set());
+  const varDefsStr = varDefs.length > 0 ? `(${varDefs.join(", ")})` : "";
+  const argPassStr = argPasses.length > 0 ? `(${argPasses.join(", ")})` : "";
+  return `${opType}${varDefsStr} { ${field.name}${argPassStr}${selectionSet ? ` ${selectionSet}` : ""} }`;
+};
+var prepareOperations = (fields, introspection) => {
+  const typeMap = /* @__PURE__ */ new Map();
+  for (const t of introspection.__schema.types) {
+    typeMap.set(t.name, t);
+  }
+  const fieldMap = /* @__PURE__ */ new Map();
+  const schema = introspection.__schema;
+  for (const rootKind of ["query", "mutation"]) {
+    const typeName = rootKind === "query" ? schema.queryType?.name : schema.mutationType?.name;
+    if (!typeName) continue;
+    const rootType = typeMap.get(typeName);
+    if (!rootType?.fields) continue;
+    for (const f of rootType.fields) {
+      if (!f.name.startsWith("__")) {
+        fieldMap.set(`${rootKind}.${f.name}`, { kind: rootKind, field: f });
+      }
+    }
+  }
+  return fields.map((extracted) => {
+    const prefix = extracted.kind === "mutation" ? "mutation" : "query";
+    const toolPath = `${prefix}.${extracted.fieldName}`;
+    const description = Option3.getOrElse(
+      extracted.description,
+      () => `GraphQL ${extracted.kind}: ${extracted.fieldName} -> ${extracted.returnTypeName}`
+    );
+    const key = `${extracted.kind}.${extracted.fieldName}`;
+    const entry = fieldMap.get(key);
+    const operationString = entry ? buildOperationStringForField(entry.kind, entry.field, typeMap) : `${extracted.kind} { ${extracted.fieldName} }`;
+    const binding = OperationBinding.make({
+      kind: extracted.kind,
+      fieldName: extracted.fieldName,
+      operationString,
+      variableNames: extracted.arguments.map((a) => a.name)
+    });
+    return {
+      toolPath,
+      description,
+      inputSchema: Option3.getOrUndefined(extracted.inputSchema),
+      binding
+    };
+  });
+};
+var annotationsFor = (binding) => {
+  if (binding.kind === "mutation") {
+    return {
+      requiresApproval: true,
+      approvalDescription: `mutation ${binding.fieldName}`
+    };
+  }
+  return {};
+};
+var toGraphqlConfigEntry = (namespace, config) => {
+  const headers = {};
+  for (const [name, value] of Object.entries(config.headers ?? {})) {
+    if (typeof value === "string" || !("kind" in value)) {
+      headers[name] = value;
+    }
+  }
+  return {
+    kind: "graphql",
+    endpoint: config.endpoint,
+    introspectionJson: config.introspectionJson,
+    namespace,
+    headers: headersToConfigValues(Object.keys(headers).length > 0 ? headers : void 0)
+  };
+};
+var GRAPHQL_PLUGIN_ID = "graphql";
+var scopeRanks = (ctx) => new Map(ctx.scopes.map((scope, index) => [String(scope.id), index]));
+var scopeRank = (ranks, scopeId) => ranks.get(scopeId) ?? Infinity;
+var coreBindingToGraphqlBinding = (binding) => GraphqlSourceBindingRef.make({
+  sourceId: binding.sourceId,
+  sourceScopeId: binding.sourceScopeId,
+  scopeId: binding.scopeId,
+  slot: binding.slotKey,
+  value: binding.value,
+  createdAt: binding.createdAt,
+  updatedAt: binding.updatedAt
+});
+var listGraphqlSourceBindings = (ctx, sourceId, sourceScope) => Effect5.gen(function* () {
+  const ranks = scopeRanks(ctx);
+  const sourceSourceRank = scopeRank(ranks, sourceScope);
+  if (sourceSourceRank === Infinity) return [];
+  const bindings = yield* ctx.credentialBindings.listForSource({
+    pluginId: GRAPHQL_PLUGIN_ID,
+    sourceId,
+    sourceScope: ScopeId.make(sourceScope)
+  });
+  return bindings.filter((binding) => scopeRank(ranks, binding.scopeId) <= sourceSourceRank).map(coreBindingToGraphqlBinding);
+});
+var resolveGraphqlSourceBinding = (ctx, sourceId, sourceScope, slot) => Effect5.gen(function* () {
+  const ranks = scopeRanks(ctx);
+  const sourceSourceRank = scopeRank(ranks, sourceScope);
+  if (sourceSourceRank === Infinity) return null;
+  const bindings = yield* ctx.credentialBindings.listForSource({
+    pluginId: GRAPHQL_PLUGIN_ID,
+    sourceId,
+    sourceScope: ScopeId.make(sourceScope)
+  });
+  const binding = bindings.filter(
+    (candidate) => candidate.slotKey === slot && scopeRank(ranks, candidate.scopeId) <= sourceSourceRank
+  ).sort((a, b) => scopeRank(ranks, a.scopeId) - scopeRank(ranks, b.scopeId))[0];
+  return binding ? coreBindingToGraphqlBinding(binding) : null;
+});
+var validateGraphqlBindingTarget = (ctx, input) => Effect5.gen(function* () {
+  const ranks = scopeRanks(ctx);
+  const sourceSourceRank = scopeRank(ranks, input.sourceScope);
+  const targetRank = scopeRank(ranks, input.targetScope);
+  const scopeList = `[${ctx.scopes.map((s) => s.id).join(", ")}]`;
+  if (sourceSourceRank === Infinity) {
+    return yield* new StorageError({
+      message: `GraphQL source binding references source scope "${input.sourceScope}" which is not in the executor's scope stack ${scopeList}.`,
+      cause: void 0
+    });
+  }
+  if (targetRank === Infinity) {
+    return yield* new StorageError({
+      message: `GraphQL source binding targets scope "${input.targetScope}" which is not in the executor's scope stack ${scopeList}.`,
+      cause: void 0
+    });
+  }
+  if (targetRank > sourceSourceRank) {
+    return yield* new StorageError({
+      message: `GraphQL source bindings for "${input.sourceId}" cannot be written at outer scope "${input.targetScope}" because the base source lives at "${input.sourceScope}"`,
+      cause: void 0
+    });
+  }
+});
+var bindingTargetScope = (targetScope, bindings) => {
+  if (bindings.length === 0) return Effect5.succeed(void 0);
+  if (targetScope) return Effect5.succeed(targetScope);
+  return Effect5.fail(
+    new GraphqlIntrospectionError({
+      message: "credentialTargetScope is required when adding direct GraphQL credentials"
+    })
+  );
+};
+var targetScopeForBinding = (fallbackTargetScope, binding) => {
+  const targetScope = binding.targetScope ?? fallbackTargetScope;
+  if (targetScope) return Effect5.succeed(targetScope);
+  return Effect5.fail(
+    new GraphqlIntrospectionError({
+      message: "credentialTargetScope is required when adding direct GraphQL credentials"
+    })
+  );
+};
+var canonicalizeCredentialMap = (values, slotForName) => {
+  const nextValues = {};
+  const bindings = [];
+  for (const [name, value] of Object.entries(values ?? {})) {
+    if (typeof value === "string") {
+      nextValues[name] = value;
+      continue;
+    }
+    if ("kind" in value) {
+      nextValues[name] = value;
+      continue;
+    }
+    const slot = slotForName(name);
+    nextValues[name] = ConfiguredCredentialBinding2.make({
+      kind: "binding",
+      slot,
+      prefix: value.prefix
+    });
+    bindings.push({
+      slot,
+      targetScope: "targetScope" in value ? value.targetScope : void 0,
+      value: {
+        kind: "secret",
+        secretId: SecretId.make(value.secretId),
+        ..."secretScopeId" in value && value.secretScopeId ? { secretScopeId: value.secretScopeId } : {}
+      }
+    });
+  }
+  return { values: nextValues, bindings };
+};
+var canonicalizeAuth = (auth) => {
+  if (!auth || auth.kind === "none") return { auth: { kind: "none" }, bindings: [] };
+  if ("connectionSlot" in auth) return { auth, bindings: [] };
+  return {
+    auth: { kind: "oauth2", connectionSlot: GRAPHQL_OAUTH_CONNECTION_SLOT },
+    bindings: [
+      {
+        slot: GRAPHQL_OAUTH_CONNECTION_SLOT,
+        value: {
+          kind: "connection",
+          connectionId: ConnectionId.make(auth.connectionId)
+        }
+      }
+    ]
+  };
+};
+var resolveGraphqlBindingValueMap = (ctx, values, params) => Effect5.gen(function* () {
+  if (!values) return void 0;
+  const resolved = {};
+  for (const [name, value] of Object.entries(values)) {
+    if (typeof value === "string") {
+      resolved[name] = value;
+      continue;
+    }
+    const binding = yield* resolveGraphqlSourceBinding(
+      ctx,
+      params.sourceId,
+      params.sourceScope,
+      value.slot
+    );
+    if (binding?.value.kind === "secret") {
+      const secret = yield* ctx.secrets.getAtScope(binding.value.secretId, binding.scopeId).pipe(
+        Effect5.catchTag(
+          "SecretOwnedByConnectionError",
+          () => Effect5.fail(
+            params.makeError(`Secret not found for ${params.missingLabel} "${name}"`)
+          )
+        )
+      );
+      if (secret === null) {
+        return yield* Effect5.fail(
+          params.makeError(
+            `Missing secret "${binding.value.secretId}" for ${params.missingLabel} "${name}"`
+          )
+        );
+      }
+      resolved[name] = value.prefix ? `${value.prefix}${secret}` : secret;
+      continue;
+    }
+    if (binding?.value.kind === "text") {
+      resolved[name] = value.prefix ? `${value.prefix}${binding.value.text}` : binding.value.text;
+      continue;
+    }
+    return yield* Effect5.fail(
+      params.makeError(`Missing binding for ${params.missingLabel} "${name}"`)
+    );
+  }
+  return Object.keys(resolved).length > 0 ? resolved : void 0;
+});
+var resolveGraphqlStoredOAuthHeader = (ctx, sourceId, sourceScope, auth) => Effect5.gen(function* () {
+  if (!auth || auth.kind === "none") return void 0;
+  const binding = yield* resolveGraphqlSourceBinding(
+    ctx,
+    sourceId,
+    sourceScope,
+    auth.connectionSlot
+  );
+  if (binding?.value.kind !== "connection") {
+    return yield* new GraphqlInvocationError({
+      message: `Missing OAuth connection binding for GraphQL source "${sourceId}"`,
+      statusCode: Option3.none()
+    });
+  }
+  const accessToken = yield* ctx.connections.accessTokenAtScope(
+    binding.value.connectionId,
+    binding.scopeId
+  );
+  return { Authorization: `Bearer ${accessToken}` };
+});
+var makeGraphqlExtension = (ctx, httpClientLayer, configFile) => {
+  const resolveCredentialInputMap = (values, params) => Effect5.gen(function* () {
+    if (!values) return void 0;
+    const resolved = {};
+    for (const [name, value] of Object.entries(values)) {
+      if (typeof value === "string") {
+        resolved[name] = value;
+        continue;
+      }
+      if ("kind" in value) {
+        const slotResolved = yield* resolveGraphqlBindingValueMap(
+          ctx,
+          { [name]: value },
+          {
+            sourceId: params.sourceId,
+            sourceScope: params.sourceScope,
+            missingLabel: params.missingLabel,
+            makeError: params.makeError
+          }
+        );
+        if (slotResolved?.[name] !== void 0) resolved[name] = slotResolved[name];
+        continue;
+      }
+      const secretScope = "secretScopeId" in value ? value.secretScopeId ?? value.targetScope : params.targetScope ?? params.sourceScope;
+      const secret = yield* ctx.secrets.getAtScope(SecretId.make(value.secretId), secretScope).pipe(
+        Effect5.catchTag(
+          "SecretOwnedByConnectionError",
+          () => Effect5.fail(
+            params.makeError(`Secret not found for ${params.missingLabel} "${name}"`)
+          )
+        )
+      );
+      if (secret === null) {
+        return yield* Effect5.fail(
+          params.makeError(
+            `Missing secret "${value.secretId}" for ${params.missingLabel} "${name}"`
+          )
+        );
+      }
+      resolved[name] = value.prefix ? `${value.prefix}${secret}` : secret;
+    }
+    return Object.keys(resolved).length > 0 ? resolved : void 0;
+  });
+  const resolveOAuthInputHeader = (sourceId, sourceScope, targetScope, auth) => Effect5.gen(function* () {
+    if (!auth || auth.kind === "none") return void 0;
+    const connection = "connectionId" in auth ? { id: auth.connectionId, scope: targetScope ?? sourceScope } : yield* Effect5.gen(function* () {
+      const binding = yield* resolveGraphqlSourceBinding(
+        ctx,
+        sourceId,
+        sourceScope,
+        auth.connectionSlot
+      );
+      return binding?.value.kind === "connection" ? { id: binding.value.connectionId, scope: binding.scopeId } : null;
+    });
+    if (connection === null) {
+      return yield* new GraphqlIntrospectionError({
+        message: `Missing OAuth connection binding for "${sourceId}"`
+      });
+    }
+    const accessToken = yield* ctx.connections.accessTokenAtScope(connection.id, connection.scope).pipe(
+      Effect5.mapError(
+        () => new GraphqlIntrospectionError({
+          message: `Failed to resolve OAuth connection "${connection.id}"`
+        })
+      )
+    );
+    return { Authorization: `Bearer ${accessToken}` };
+  });
+  const addSourceInternal = (config) => ctx.transaction(
+    Effect5.gen(function* () {
+      const namespace = config.namespace ?? namespaceFromEndpoint(config.endpoint);
+      const canonicalHeaders = canonicalizeCredentialMap(config.headers, graphqlHeaderSlot);
+      const canonicalQueryParams = canonicalizeCredentialMap(
+        config.queryParams,
+        graphqlQueryParamSlot
+      );
+      const canonicalAuth = canonicalizeAuth(config.auth);
+      const directBindings = [
+        ...canonicalHeaders.bindings,
+        ...canonicalQueryParams.bindings,
+        ...canonicalAuth.bindings
+      ];
+      for (const binding of directBindings) {
+        const bindingTargetScope2 = yield* targetScopeForBinding(
+          config.credentialTargetScope,
+          binding
+        );
+        yield* validateGraphqlBindingTarget(ctx, {
+          sourceId: namespace,
+          sourceScope: config.scope,
+          targetScope: bindingTargetScope2
+        });
+      }
+      const targetScope = directBindings[0] !== void 0 ? yield* targetScopeForBinding(config.credentialTargetScope, directBindings[0]) : void 0;
+      let introspectionResult;
+      if (config.introspectionJson) {
+        introspectionResult = yield* parseIntrospectionJson(config.introspectionJson);
+      } else {
+        const resolvedHeaders = yield* resolveCredentialInputMap(config.headers, {
+          sourceId: namespace,
+          sourceScope: config.scope,
+          targetScope,
+          missingLabel: "header",
+          makeError: (message) => new GraphqlIntrospectionError({ message })
+        });
+        const oauthHeader = yield* resolveOAuthInputHeader(
+          namespace,
+          config.scope,
+          targetScope,
+          config.auth
+        );
+        const resolvedQueryParams = yield* resolveCredentialInputMap(config.queryParams, {
+          sourceId: namespace,
+          sourceScope: config.scope,
+          targetScope,
+          missingLabel: "query parameter",
+          makeError: (message) => new GraphqlIntrospectionError({ message })
+        });
+        introspectionResult = yield* introspect(
+          config.endpoint,
+          { ...resolvedHeaders ?? {}, ...oauthHeader ?? {} },
+          resolvedQueryParams
+        ).pipe(Effect5.provide(httpClientLayer));
+      }
+      const { result, definitions } = yield* extract(introspectionResult);
+      const prepared = prepareOperations(result.fields, introspectionResult);
+      const displayName = config.name?.trim() || namespace;
+      const storedSource = {
+        namespace,
+        scope: config.scope,
+        name: displayName,
+        endpoint: config.endpoint,
+        headers: canonicalHeaders.values,
+        queryParams: canonicalQueryParams.values,
+        auth: canonicalAuth.auth
+      };
+      const storedOps = prepared.map((p) => ({
+        toolId: `${namespace}.${p.toolPath}`,
+        sourceId: namespace,
+        binding: p.binding
+      }));
+      yield* ctx.storage.upsertSource(storedSource, storedOps);
+      yield* ctx.core.sources.register({
+        id: namespace,
+        scope: config.scope,
+        kind: "graphql",
+        name: displayName,
+        url: config.endpoint,
+        canRemove: true,
+        canRefresh: false,
+        canEdit: true,
+        tools: prepared.map((p) => ({
+          name: p.toolPath,
+          description: p.description,
+          inputSchema: p.inputSchema
+        }))
+      });
+      if (Object.keys(definitions).length > 0) {
+        yield* ctx.core.definitions.register({
+          sourceId: namespace,
+          scope: config.scope,
+          definitions
+        });
+      }
+      if (directBindings.length > 0) {
+        for (const binding of directBindings) {
+          const bindingTargetScope2 = yield* targetScopeForBinding(
+            config.credentialTargetScope,
+            binding
+          );
+          yield* ctx.credentialBindings.set({
+            targetScope: ScopeId.make(bindingTargetScope2),
+            pluginId: GRAPHQL_PLUGIN_ID,
+            sourceId: namespace,
+            sourceScope: ScopeId.make(config.scope),
+            slotKey: binding.slot,
+            value: binding.value
+          });
+        }
+      }
+      return { toolCount: prepared.length, namespace };
+    })
+  );
+  return {
+    addSource: (config) => addSourceInternal(config).pipe(
+      Effect5.tap(
+        (result) => configFile ? configFile.upsertSource(toGraphqlConfigEntry(result.namespace, config)) : Effect5.void
+      )
+    ),
+    removeSource: (namespace, scope) => Effect5.gen(function* () {
+      yield* ctx.transaction(
+        Effect5.gen(function* () {
+          yield* ctx.credentialBindings.removeForSource({
+            pluginId: GRAPHQL_PLUGIN_ID,
+            sourceId: namespace,
+            sourceScope: ScopeId.make(scope)
+          });
+          yield* ctx.storage.removeSource(namespace, scope);
+          yield* ctx.core.sources.unregister({ id: namespace, targetScope: scope });
+        })
+      );
+      if (configFile) {
+        yield* configFile.removeSource(namespace);
+      }
+    }),
+    getSource: (namespace, scope) => ctx.storage.getSource(namespace, scope),
+    updateSource: (namespace, scope, input) => Effect5.gen(function* () {
+      const existing = yield* ctx.storage.getSource(namespace, scope);
+      if (!existing) return;
+      const canonicalHeaders = input.headers !== void 0 ? canonicalizeCredentialMap(input.headers, graphqlHeaderSlot) : null;
+      const canonicalQueryParams = input.queryParams !== void 0 ? canonicalizeCredentialMap(input.queryParams, graphqlQueryParamSlot) : null;
+      const canonicalAuth = input.auth !== void 0 ? canonicalizeAuth(input.auth) : null;
+      const directBindings = [
+        ...canonicalHeaders?.bindings ?? [],
+        ...canonicalQueryParams?.bindings ?? [],
+        ...canonicalAuth?.bindings ?? []
+      ];
+      const targetScope = yield* bindingTargetScope(input.credentialTargetScope, directBindings);
+      if (targetScope) {
+        yield* validateGraphqlBindingTarget(ctx, {
+          sourceId: namespace,
+          sourceScope: scope,
+          targetScope
+        });
+      }
+      const affectedPrefixes = [
+        ...input.headers !== void 0 ? ["header:"] : [],
+        ...input.queryParams !== void 0 ? ["query_param:"] : [],
+        ...input.auth !== void 0 ? ["auth:"] : []
+      ];
+      const replacementTargetScope = targetScope ?? input.credentialTargetScope ?? scope;
+      yield* ctx.transaction(
+        Effect5.gen(function* () {
+          yield* ctx.storage.updateSourceMeta(namespace, scope, {
+            name: input.name?.trim() || void 0,
+            endpoint: input.endpoint,
+            headers: canonicalHeaders?.values,
+            queryParams: canonicalQueryParams?.values,
+            auth: canonicalAuth?.auth
+          });
+          if (affectedPrefixes.length > 0 || directBindings.length > 0) {
+            yield* ctx.credentialBindings.replaceForSource({
+              targetScope: ScopeId.make(replacementTargetScope),
+              pluginId: GRAPHQL_PLUGIN_ID,
+              sourceId: namespace,
+              sourceScope: ScopeId.make(scope),
+              slotPrefixes: affectedPrefixes,
+              bindings: directBindings.map((binding) => ({
+                slotKey: binding.slot,
+                value: binding.value
+              }))
+            });
+          }
+        })
+      );
+    }),
+    listSourceBindings: (sourceId, sourceScope) => listGraphqlSourceBindings(ctx, sourceId, sourceScope),
+    setSourceBinding: (input) => Effect5.gen(function* () {
+      yield* validateGraphqlBindingTarget(ctx, {
+        sourceId: input.sourceId,
+        sourceScope: input.sourceScope,
+        targetScope: input.scope
+      });
+      const binding = yield* ctx.credentialBindings.set({
+        targetScope: input.scope,
+        pluginId: GRAPHQL_PLUGIN_ID,
+        sourceId: input.sourceId,
+        sourceScope: input.sourceScope,
+        slotKey: input.slot,
+        value: input.value
+      });
+      return coreBindingToGraphqlBinding(binding);
+    }),
+    removeSourceBinding: (sourceId, sourceScope, slot, scope) => Effect5.gen(function* () {
+      yield* validateGraphqlBindingTarget(ctx, {
+        sourceId,
+        sourceScope,
+        targetScope: scope
+      });
+      yield* ctx.credentialBindings.remove({
+        targetScope: ScopeId.make(scope),
+        pluginId: GRAPHQL_PLUGIN_ID,
+        sourceId,
+        sourceScope: ScopeId.make(sourceScope),
+        slotKey: slot
+      });
+    })
+  };
+};
+var graphqlPlugin = definePlugin((options) => {
+  return {
+    id: "graphql",
+    packageName: "@executor-js/plugin-graphql",
+    schema: graphqlSchema,
+    storage: (deps) => makeDefaultGraphqlStore(deps),
+    extension: (ctx) => makeGraphqlExtension(
+      ctx,
+      options?.httpClientLayer ?? ctx.httpClientLayer,
+      options?.configFile
+    ),
+    staticSources: (self) => [
+      {
+        id: "graphql",
+        kind: "executor",
+        name: "GraphQL",
+        tools: [
+          tool({
+            name: "addSource",
+            description: "Add a GraphQL endpoint and register its operations as tools",
+            annotations: {
+              requiresApproval: true,
+              approvalDescription: "Add a GraphQL source"
+            },
+            inputSchema: StaticAddSourceInputStandardSchema,
+            outputSchema: StaticAddSourceOutputStandardSchema,
+            execute: (input) => self.addSource(input)
+          })
+        ]
+      }
+    ],
+    invokeTool: ({ ctx, toolRow, args }) => Effect5.gen(function* () {
+      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
+      const toolScope = toolRow.scope_id;
+      const op = yield* ctx.storage.getOperationByToolId(toolRow.id, toolScope);
+      if (!op) {
+        return yield* new GraphqlInvocationError({
+          message: `No GraphQL operation found for tool "${toolRow.id}"`,
+          statusCode: Option3.none()
+        });
+      }
+      const source = yield* ctx.storage.getSource(op.sourceId, toolScope);
+      if (!source) {
+        return yield* new GraphqlInvocationError({
+          message: `No GraphQL source found for "${op.sourceId}"`,
+          statusCode: Option3.none()
+        });
+      }
+      const resolvedHeaders = (yield* resolveGraphqlBindingValueMap(ctx, source.headers, {
+        sourceId: source.namespace,
+        sourceScope: source.scope,
+        missingLabel: "header",
+        makeError: (message) => new GraphqlInvocationError({ message, statusCode: Option3.none() })
+      })) ?? {};
+      const resolvedQueryParams = (yield* resolveGraphqlBindingValueMap(ctx, source.queryParams, {
+        sourceId: source.namespace,
+        sourceScope: source.scope,
+        missingLabel: "query parameter",
+        makeError: (message) => new GraphqlInvocationError({ message, statusCode: Option3.none() })
+      })) ?? {};
+      const oauthHeader = yield* resolveGraphqlStoredOAuthHeader(
+        ctx,
+        source.namespace,
+        source.scope,
+        source.auth
+      );
+      Object.assign(resolvedHeaders, oauthHeader ?? {});
+      const result = yield* invokeWithLayer(
+        op.binding,
+        args ?? {},
+        source.endpoint,
+        resolvedHeaders,
+        resolvedQueryParams,
+        httpClientLayer
+      );
+      return result;
+    }),
+    resolveAnnotations: ({ ctx, sourceId, toolRows }) => Effect5.gen(function* () {
+      const scopes = /* @__PURE__ */ new Set();
+      for (const row of toolRows) {
+        scopes.add(row.scope_id);
+      }
+      const entries = yield* Effect5.forEach(
+        [...scopes],
+        (scope) => Effect5.gen(function* () {
+          const ops = yield* ctx.storage.listOperationsBySource(sourceId, scope);
+          const byId = /* @__PURE__ */ new Map();
+          for (const op of ops) byId.set(op.toolId, op.binding);
+          return [scope, byId];
+        }),
+        { concurrency: "unbounded" }
+      );
+      const byScope = new Map(entries);
+      const out = {};
+      for (const row of toolRows) {
+        const binding = byScope.get(row.scope_id)?.get(row.id);
+        if (binding) out[row.id] = annotationsFor(binding);
+      }
+      return out;
+    }),
+    removeSource: ({ ctx, sourceId, scope }) => Effect5.gen(function* () {
+      yield* ctx.transaction(
+        Effect5.gen(function* () {
+          yield* ctx.credentialBindings.removeForSource({
+            pluginId: GRAPHQL_PLUGIN_ID,
+            sourceId,
+            sourceScope: ScopeId.make(scope)
+          });
+          yield* ctx.storage.removeSource(sourceId, scope);
+        })
+      );
+      if (options?.configFile) {
+        yield* options.configFile.removeSource(sourceId);
+      }
+    }),
+    usagesForSecret: () => Effect5.succeed([]),
+    usagesForConnection: () => Effect5.succeed([]),
+    detect: ({ ctx, url }) => Effect5.gen(function* () {
+      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
+      const trimmed = url.trim();
+      if (!trimmed) return null;
+      const parsed = yield* Effect5.try({
+        try: () => new URL(trimmed),
+        catch: (cause) => cause
+      }).pipe(Effect5.option);
+      if (Option3.isNone(parsed)) return null;
+      const ok = yield* introspect(trimmed).pipe(
+        Effect5.provide(httpClientLayer),
+        Effect5.map(() => true),
+        Effect5.catch(() => Effect5.succeed(false))
+      );
+      const name = namespaceFromEndpoint(trimmed);
+      if (ok) {
+        return SourceDetectionResult.make({
+          kind: "graphql",
+          confidence: "high",
+          endpoint: trimmed,
+          name,
+          namespace: name
+        });
+      }
+      if (urlMatchesToken(parsed.value, "graphql")) {
+        return SourceDetectionResult.make({
+          kind: "graphql",
+          confidence: "low",
+          endpoint: trimmed,
+          name,
+          namespace: name
+        });
+      }
+      return null;
+    })
+  };
+});
+
+export {
+  introspect,
+  parseIntrospectionJson,
+  extract,
+  resolveHeaders,
+  invoke,
+  invokeWithLayer,
+  graphqlSchema,
+  makeDefaultGraphqlStore,
+  graphqlPlugin
+};
+//# sourceMappingURL=chunk-PO2TPM5B.js.map