@executor-js/plugin-graphql 0.1.0 → 1.4.20

package/dist/sdk/plugin.d.ts

@@ -1,13 +1,13 @@
 import { Effect } from "effect";
 import type { Layer } from "effect";
 import { HttpClient } from "effect/unstable/http";
-import { GraphqlExtensionService } from "../api/handlers";
-import { type StorageFailure } from "@executor-js/sdk/core";
+import { type PluginCtx, type StorageFailure } from "@executor-js/sdk/core";
 import { type ConfigFileSink } from "@executor-js/config";
-import { GraphqlExtractionError, GraphqlIntrospectionError } from "./errors";
+import { GraphqlIntrospectionError } from "./errors";
 import { type GraphqlStore, type StoredGraphqlSource } from "./store";
-import { type GraphqlSourceAuth, type HeaderValue as HeaderValueValue, type QueryParamValue } from "./types";
+import { GraphqlSourceBindingInput, type ConfiguredGraphqlCredentialValue, type GraphqlCredentialInput, type HeaderValue as HeaderValueValue, type GraphqlSourceAuthInput } from "./types";
 export type HeaderValue = HeaderValueValue;
+export type GraphqlCredentialValue = ConfiguredGraphqlCredentialValue;
 export interface GraphqlSourceConfig {
     /** The GraphQL endpoint URL */
     readonly endpoint: string;
@@ -24,50 +24,25 @@ export interface GraphqlSourceConfig {
     readonly introspectionJson?: string;
     /** Namespace for the tools (derived from endpoint if not provided) */
     readonly namespace?: string;
-    /** Headers applied to every request. Values can reference secrets. */
-    readonly headers?: Record<string, HeaderValue>;
-    /** Query parameters applied to every request. Values can reference secrets. */
-    readonly queryParams?: Record<string, QueryParamValue>;
-    /** Optional OAuth2 connection used as a Bearer token for every request. */
-    readonly auth?: GraphqlSourceAuth;
+    /** Headers applied to every request. Direct secrets are rewritten to slots. */
+    readonly headers?: Record<string, GraphqlCredentialInput>;
+    /** Query parameters applied to every request. Direct secrets are rewritten to slots. */
+    readonly queryParams?: Record<string, GraphqlCredentialInput>;
+    /**
+     * Scope that owns any direct credentials supplied on this call. Required
+     * whenever headers/queryParams/auth carry direct secret or connection ids.
+     */
+    readonly credentialTargetScope?: string;
+    /** Optional OAuth2 credential used as a Bearer token for every request. */
+    readonly auth?: GraphqlSourceAuthInput;
 }
 export interface GraphqlUpdateSourceInput {
     readonly name?: string;
     readonly endpoint?: string;
-    readonly headers?: Record<string, HeaderValue>;
-    readonly queryParams?: Record<string, QueryParamValue>;
-    readonly auth?: GraphqlSourceAuth;
-}
-/**
- * Errors any GraphQL extension method may surface. `GraphqlIntrospectionError`
- * and `GraphqlExtractionError` are plugin-domain tagged errors that flow
- * directly to clients (4xx, each carrying its own `HttpApiSchema` status).
- * `StorageFailure` covers raw backend failures (`StorageError` plus
- * `UniqueViolationError`); the HTTP edge (`@executor-js/api`'s `withCapture`)
- * translates `StorageError` to the opaque `InternalError({ traceId })` at
- * Layer composition.
- */
-export type GraphqlExtensionFailure = GraphqlIntrospectionError | GraphqlExtractionError | StorageFailure;
-export interface GraphqlPluginExtension {
-    /** Add a GraphQL endpoint and register its operations as tools */
-    readonly addSource: (config: GraphqlSourceConfig) => Effect.Effect<{
-        readonly toolCount: number;
-        readonly namespace: string;
-    }, GraphqlExtensionFailure>;
-    /** Remove all tools from a previously added GraphQL source by namespace.
-     *  `scope` pins the cleanup to the exact row — without it a shadowed
-     *  outer-scope source with the same namespace could be wiped instead. */
-    readonly removeSource: (namespace: string, scope: string) => Effect.Effect<void, StorageFailure>;
-    /** Fetch the full stored source by namespace (or null if missing).
-     *  `scope` returns the exact row at that scope. For fall-through
-     *  reads across the executor's scope stack, use `executor.sources.*`. */
-    readonly getSource: (namespace: string, scope: string) => Effect.Effect<StoredGraphqlSource | null, StorageFailure>;
-    /** Update config (endpoint, headers) for an existing GraphQL source.
-     *  Does NOT re-introspect or re-register tools — just patches the
-     *  stored endpoint/headers used at invoke time. `scope` pins the
-     *  mutation to a single row so shadowed rows at other scopes are
-     *  untouched. */
-    readonly updateSource: (namespace: string, scope: string, input: GraphqlUpdateSourceInput) => Effect.Effect<void, StorageFailure>;
+    readonly headers?: Record<string, GraphqlCredentialInput>;
+    readonly queryParams?: Record<string, GraphqlCredentialInput>;
+    readonly credentialTargetScope?: string;
+    readonly auth?: GraphqlSourceAuthInput;
 }
 export interface GraphqlPluginOptions {
     readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;
@@ -75,14 +50,102 @@ export interface GraphqlPluginOptions {
      *  (best-effort — file errors are logged, not raised). */
     readonly configFile?: ConfigFileSink;
 }
+declare const makeGraphqlExtension: (ctx: PluginCtx<GraphqlStore>, httpClientLayer: Layer.Layer<HttpClient.HttpClient>, configFile: ConfigFileSink | undefined) => {
+    addSource: (config: GraphqlSourceConfig) => Effect.Effect<{
+        toolCount: number;
+        namespace: string;
+    }, StorageFailure | GraphqlIntrospectionError | import("./errors").GraphqlExtractionError, never>;
+    removeSource: (namespace: string, scope: string) => Effect.Effect<void, StorageFailure, never>;
+    getSource: (namespace: string, scope: string) => Effect.Effect<StoredGraphqlSource | null, StorageFailure, never>;
+    updateSource: (namespace: string, scope: string, input: GraphqlUpdateSourceInput) => Effect.Effect<void, StorageFailure | GraphqlIntrospectionError, never>;
+    listSourceBindings: (sourceId: string, sourceScope: string) => Effect.Effect<readonly {
+        readonly value: {
+            readonly text: string;
+            readonly kind: "text";
+        } | {
+            readonly secretId: string & import("effect/Brand").Brand<"SecretId">;
+            readonly kind: "secret";
+            readonly secretScopeId?: (string & import("effect/Brand").Brand<"ScopeId">) | undefined;
+        } | {
+            readonly connectionId: string & import("effect/Brand").Brand<"ConnectionId">;
+            readonly kind: "connection";
+        };
+        readonly createdAt: Date;
+        readonly sourceId: string;
+        readonly scopeId: string & import("effect/Brand").Brand<"ScopeId">;
+        readonly updatedAt: Date;
+        readonly slot: string;
+        readonly sourceScopeId: string & import("effect/Brand").Brand<"ScopeId">;
+    }[], StorageFailure, never>;
+    setSourceBinding: (input: GraphqlSourceBindingInput) => Effect.Effect<{
+        readonly value: {
+            readonly text: string;
+            readonly kind: "text";
+        } | {
+            readonly secretId: string & import("effect/Brand").Brand<"SecretId">;
+            readonly kind: "secret";
+            readonly secretScopeId?: (string & import("effect/Brand").Brand<"ScopeId">) | undefined;
+        } | {
+            readonly connectionId: string & import("effect/Brand").Brand<"ConnectionId">;
+            readonly kind: "connection";
+        };
+        readonly createdAt: Date;
+        readonly sourceId: string;
+        readonly scopeId: string & import("effect/Brand").Brand<"ScopeId">;
+        readonly updatedAt: Date;
+        readonly slot: string;
+        readonly sourceScopeId: string & import("effect/Brand").Brand<"ScopeId">;
+    }, StorageFailure, never>;
+    removeSourceBinding: (sourceId: string, sourceScope: string, slot: string, scope: string) => Effect.Effect<void, StorageFailure, never>;
+};
+export type GraphqlPluginExtension = ReturnType<typeof makeGraphqlExtension>;
 export declare const graphqlPlugin: import("@executor-js/sdk/core").ConfiguredPlugin<"graphql", {
     addSource: (config: GraphqlSourceConfig) => Effect.Effect<{
-        readonly toolCount: number;
-        readonly namespace: string;
-    }, StorageFailure | GraphqlIntrospectionError | GraphqlExtractionError, never>;
+        toolCount: number;
+        namespace: string;
+    }, StorageFailure | GraphqlIntrospectionError | import("./errors").GraphqlExtractionError, never>;
     removeSource: (namespace: string, scope: string) => Effect.Effect<void, StorageFailure, never>;
     getSource: (namespace: string, scope: string) => Effect.Effect<StoredGraphqlSource | null, StorageFailure, never>;
-    updateSource: (namespace: string, scope: string, input: GraphqlUpdateSourceInput) => Effect.Effect<void, StorageFailure, never>;
+    updateSource: (namespace: string, scope: string, input: GraphqlUpdateSourceInput) => Effect.Effect<void, StorageFailure | GraphqlIntrospectionError, never>;
+    listSourceBindings: (sourceId: string, sourceScope: string) => Effect.Effect<readonly {
+        readonly value: {
+            readonly text: string;
+            readonly kind: "text";
+        } | {
+            readonly secretId: string & import("effect/Brand").Brand<"SecretId">;
+            readonly kind: "secret";
+            readonly secretScopeId?: (string & import("effect/Brand").Brand<"ScopeId">) | undefined;
+        } | {
+            readonly connectionId: string & import("effect/Brand").Brand<"ConnectionId">;
+            readonly kind: "connection";
+        };
+        readonly createdAt: Date;
+        readonly sourceId: string;
+        readonly scopeId: string & import("effect/Brand").Brand<"ScopeId">;
+        readonly updatedAt: Date;
+        readonly slot: string;
+        readonly sourceScopeId: string & import("effect/Brand").Brand<"ScopeId">;
+    }[], StorageFailure, never>;
+    setSourceBinding: (input: GraphqlSourceBindingInput) => Effect.Effect<{
+        readonly value: {
+            readonly text: string;
+            readonly kind: "text";
+        } | {
+            readonly secretId: string & import("effect/Brand").Brand<"SecretId">;
+            readonly kind: "secret";
+            readonly secretScopeId?: (string & import("effect/Brand").Brand<"ScopeId">) | undefined;
+        } | {
+            readonly connectionId: string & import("effect/Brand").Brand<"ConnectionId">;
+            readonly kind: "connection";
+        };
+        readonly createdAt: Date;
+        readonly sourceId: string;
+        readonly scopeId: string & import("effect/Brand").Brand<"ScopeId">;
+        readonly updatedAt: Date;
+        readonly slot: string;
+        readonly sourceScopeId: string & import("effect/Brand").Brand<"ScopeId">;
+    }, StorageFailure, never>;
+    removeSourceBinding: (sourceId: string, sourceScope: string, slot: string, scope: string) => Effect.Effect<void, StorageFailure, never>;
 }, GraphqlStore, GraphqlPluginOptions, {
     readonly graphql_source: {
         readonly fields: {
@@ -103,16 +166,89 @@ export declare const graphqlPlugin: import("@executor-js/sdk/core").ConfiguredPl
                 readonly type: "string";
                 readonly required: true;
             };
-            readonly headers: {
-                readonly type: "json";
+            readonly auth_kind: {
+                readonly type: ["none", "oauth2"];
+                readonly required: true;
+                readonly defaultValue: "none";
+            };
+            readonly auth_connection_slot: {
+                readonly type: "string";
                 readonly required: false;
             };
-            readonly query_params: {
-                readonly type: "json";
+        };
+    };
+    readonly graphql_source_header: {
+        readonly fields: {
+            readonly id: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly scope_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly source_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly name: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly kind: {
+                readonly type: ["text", "binding"];
+                readonly required: true;
+            };
+            readonly text_value: {
+                readonly type: "string";
                 readonly required: false;
             };
-            readonly auth: {
-                readonly type: "json";
+            readonly slot_key: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly prefix: {
+                readonly type: "string";
+                readonly required: false;
+            };
+        };
+    };
+    readonly graphql_source_query_param: {
+        readonly fields: {
+            readonly id: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly scope_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly source_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly name: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly kind: {
+                readonly type: ["text", "binding"];
+                readonly required: true;
+            };
+            readonly text_value: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly slot_key: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly prefix: {
+                readonly type: "string";
                 readonly required: false;
             };
         };
@@ -139,119 +275,5 @@ export declare const graphqlPlugin: import("@executor-js/sdk/core").ConfiguredPl
             };
         };
     };
-}, typeof GraphqlExtensionService, Layer.Layer<import("effect/unstable/httpapi/HttpApiGroup").ApiGroup<"executor", "graphql">, never, import("effect/unstable/http/HttpRouter").Request<"Requires", GraphqlExtensionService>>, import("effect/unstable/httpapi/HttpApiGroup").HttpApiGroup<"graphql", import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"addSource", "POST", "/scopes/:scopeId/graphql/sources", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
-    scopeId: import("effect/Schema").brand<import("effect/Schema").String, "ScopeId">;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
-    readonly endpoint: import("effect/Schema").String;
-    readonly name: import("effect/Schema").optional<import("effect/Schema").String>;
-    readonly introspectionJson: import("effect/Schema").optional<import("effect/Schema").String>;
-    readonly namespace: import("effect/Schema").optional<import("effect/Schema").String>;
-    readonly headers: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-    readonly queryParams: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-    readonly auth: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
-        readonly kind: import("effect/Schema").Literal<"none">;
-    }>, import("effect/Schema").Struct<{
-        readonly kind: import("effect/Schema").Literal<"oauth2">;
-        readonly connectionId: import("effect/Schema").String;
-    }>]>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
-    readonly toolCount: import("effect/Schema").Number;
-    readonly namespace: import("effect/Schema").String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | import("effect/Schema").decodeTo<import("effect/Schema").declareConstructor<GraphqlIntrospectionError, {
-    readonly message: string;
-    readonly _tag: "GraphqlIntrospectionError";
-}, readonly [import("effect/Schema").TaggedStruct<"GraphqlIntrospectionError", {
-    readonly message: import("effect/Schema").String;
-}>], {
-    readonly message: string;
-    readonly _tag: "GraphqlIntrospectionError";
-}>, import("effect/Schema").TaggedStruct<"GraphqlIntrospectionError", {
-    readonly message: import("effect/Schema").String;
-}>, never, never> | import("effect/Schema").decodeTo<import("effect/Schema").declareConstructor<GraphqlExtractionError, {
-    readonly message: string;
-    readonly _tag: "GraphqlExtractionError";
-}, readonly [import("effect/Schema").TaggedStruct<"GraphqlExtractionError", {
-    readonly message: import("effect/Schema").String;
-}>], {
-    readonly message: string;
-    readonly _tag: "GraphqlExtractionError";
-}>, import("effect/Schema").TaggedStruct<"GraphqlExtractionError", {
-    readonly message: import("effect/Schema").String;
-}>, never, never>>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"getSource", "GET", "/scopes/:scopeId/graphql/sources/:namespace", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
-    scopeId: import("effect/Schema").brand<import("effect/Schema").String, "ScopeId">;
-    namespace: import("effect/Schema").String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").NullOr<import("effect/Schema").Struct<{
-    readonly namespace: import("effect/Schema").String;
-    readonly name: import("effect/Schema").String;
-    readonly endpoint: import("effect/Schema").String;
-    readonly headers: import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Union<readonly [import("effect/Schema").String, import("effect/Schema").Struct<{
-        readonly secretId: import("effect/Schema").String;
-        readonly prefix: import("effect/Schema").optional<import("effect/Schema").String>;
-    }>]>>;
-    readonly queryParams: import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Union<readonly [import("effect/Schema").String, import("effect/Schema").Struct<{
-        readonly secretId: import("effect/Schema").String;
-        readonly prefix: import("effect/Schema").optional<import("effect/Schema").String>;
-    }>]>>;
-    readonly auth: import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
-        readonly kind: import("effect/Schema").Literal<"none">;
-    }>, import("effect/Schema").Struct<{
-        readonly kind: import("effect/Schema").Literal<"oauth2">;
-        readonly connectionId: import("effect/Schema").String;
-    }>]>;
-}>>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | import("effect/Schema").decodeTo<import("effect/Schema").declareConstructor<GraphqlIntrospectionError, {
-    readonly message: string;
-    readonly _tag: "GraphqlIntrospectionError";
-}, readonly [import("effect/Schema").TaggedStruct<"GraphqlIntrospectionError", {
-    readonly message: import("effect/Schema").String;
-}>], {
-    readonly message: string;
-    readonly _tag: "GraphqlIntrospectionError";
-}>, import("effect/Schema").TaggedStruct<"GraphqlIntrospectionError", {
-    readonly message: import("effect/Schema").String;
-}>, never, never> | import("effect/Schema").decodeTo<import("effect/Schema").declareConstructor<GraphqlExtractionError, {
-    readonly message: string;
-    readonly _tag: "GraphqlExtractionError";
-}, readonly [import("effect/Schema").TaggedStruct<"GraphqlExtractionError", {
-    readonly message: import("effect/Schema").String;
-}>], {
-    readonly message: string;
-    readonly _tag: "GraphqlExtractionError";
-}>, import("effect/Schema").TaggedStruct<"GraphqlExtractionError", {
-    readonly message: import("effect/Schema").String;
-}>, never, never>>, never, never> | import("effect/unstable/httpapi/HttpApiEndpoint").HttpApiEndpoint<"updateSource", "PATCH", "/scopes/:scopeId/graphql/sources/:namespace", import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<import("effect/Schema").Struct<{
-    scopeId: import("effect/Schema").brand<import("effect/Schema").String, "ScopeId">;
-    namespace: import("effect/Schema").String;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
-    readonly name: import("effect/Schema").optional<import("effect/Schema").String>;
-    readonly endpoint: import("effect/Schema").optional<import("effect/Schema").String>;
-    readonly headers: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-    readonly queryParams: import("effect/Schema").optional<import("effect/Schema").$Record<import("effect/Schema").String, import("effect/Schema").Unknown>>;
-    readonly auth: import("effect/Schema").optional<import("effect/Schema").Union<readonly [import("effect/Schema").Struct<{
-        readonly kind: import("effect/Schema").Literal<"none">;
-    }>, import("effect/Schema").Struct<{
-        readonly kind: import("effect/Schema").Literal<"oauth2">;
-        readonly connectionId: import("effect/Schema").String;
-    }>]>>;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").StringTree<never>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<import("effect/Schema").Struct<{
-    readonly updated: import("effect/Schema").Boolean;
-}>>, import("effect/unstable/httpapi/HttpApiEndpoint").Json<typeof import("@executor-js/api").InternalError | import("effect/Schema").decodeTo<import("effect/Schema").declareConstructor<GraphqlIntrospectionError, {
-    readonly message: string;
-    readonly _tag: "GraphqlIntrospectionError";
-}, readonly [import("effect/Schema").TaggedStruct<"GraphqlIntrospectionError", {
-    readonly message: import("effect/Schema").String;
-}>], {
-    readonly message: string;
-    readonly _tag: "GraphqlIntrospectionError";
-}>, import("effect/Schema").TaggedStruct<"GraphqlIntrospectionError", {
-    readonly message: import("effect/Schema").String;
-}>, never, never> | import("effect/Schema").decodeTo<import("effect/Schema").declareConstructor<GraphqlExtractionError, {
-    readonly message: string;
-    readonly _tag: "GraphqlExtractionError";
-}, readonly [import("effect/Schema").TaggedStruct<"GraphqlExtractionError", {
-    readonly message: import("effect/Schema").String;
-}>], {
-    readonly message: string;
-    readonly _tag: "GraphqlExtractionError";
-}>, import("effect/Schema").TaggedStruct<"GraphqlExtractionError", {
-    readonly message: import("effect/Schema").String;
-}>, never, never>>, never, never>, false>>;
+}, undefined, Layer.Layer<unknown, never, never>, import("effect/unstable/httpapi/HttpApiGroup").Any>;
+export {};

package/dist/sdk/store.d.ts

@@ -1,6 +1,6 @@
 import { Effect } from "effect";
 import { type StorageDeps, type StorageFailure } from "@executor-js/sdk/core";
-import { OperationBinding, type GraphqlSourceAuth, type HeaderValue, type QueryParamValue } from "./types";
+import { OperationBinding, type ConfiguredGraphqlCredentialValue, type GraphqlSourceAuth } from "./types";
 export declare const graphqlSchema: {
     readonly graphql_source: {
         readonly fields: {
@@ -21,16 +21,89 @@ export declare const graphqlSchema: {
                 readonly type: "string";
                 readonly required: true;
             };
-            readonly headers: {
-                readonly type: "json";
+            readonly auth_kind: {
+                readonly type: ["none", "oauth2"];
+                readonly required: true;
+                readonly defaultValue: "none";
+            };
+            readonly auth_connection_slot: {
+                readonly type: "string";
                 readonly required: false;
             };
-            readonly query_params: {
-                readonly type: "json";
+        };
+    };
+    readonly graphql_source_header: {
+        readonly fields: {
+            readonly id: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly scope_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly source_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly name: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly kind: {
+                readonly type: ["text", "binding"];
+                readonly required: true;
+            };
+            readonly text_value: {
+                readonly type: "string";
                 readonly required: false;
             };
-            readonly auth: {
-                readonly type: "json";
+            readonly slot_key: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly prefix: {
+                readonly type: "string";
+                readonly required: false;
+            };
+        };
+    };
+    readonly graphql_source_query_param: {
+        readonly fields: {
+            readonly id: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly scope_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly source_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly name: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly kind: {
+                readonly type: ["text", "binding"];
+                readonly required: true;
+            };
+            readonly text_value: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly slot_key: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly prefix: {
+                readonly type: "string";
                 readonly required: false;
             };
         };
@@ -67,8 +140,8 @@ export interface StoredGraphqlSource {
     readonly scope: string;
     readonly name: string;
     readonly endpoint: string;
-    readonly headers: Record<string, HeaderValue>;
-    readonly queryParams: Record<string, QueryParamValue>;
+    readonly headers: Record<string, ConfiguredGraphqlCredentialValue>;
+    readonly queryParams: Record<string, ConfiguredGraphqlCredentialValue>;
     readonly auth: GraphqlSourceAuth;
 }
 export interface StoredOperation {
@@ -81,8 +154,8 @@ export interface GraphqlStore {
     readonly updateSourceMeta: (namespace: string, scope: string, patch: {
         readonly name?: string;
         readonly endpoint?: string;
-        readonly headers?: Record<string, HeaderValue>;
-        readonly queryParams?: Record<string, QueryParamValue>;
+        readonly headers?: Record<string, ConfiguredGraphqlCredentialValue>;
+        readonly queryParams?: Record<string, ConfiguredGraphqlCredentialValue>;
         readonly auth?: GraphqlSourceAuth;
     }) => Effect.Effect<void, StorageFailure>;
     readonly getSource: (namespace: string, scope: string) => Effect.Effect<StoredGraphqlSource | null, StorageFailure>;