@executor-js/plugin-graphql 1.4.29 → 1.4.31

package/dist/{chunk-PO2TPM5B.js → chunk-7S2FM3ZF.js}

@@ -1,22 +1,26 @@
+import {
+  graphqlPresets
+} from "./chunk-D6E4WAYW.js";
 import {
   ExtractedField,
   ExtractionResult,
   GRAPHQL_OAUTH_CONNECTION_SLOT,
   GraphqlArgument,
+  GraphqlConfiguredValueInput,
   GraphqlCredentialInput,
   GraphqlExtractionError,
   GraphqlIntrospectionError,
   GraphqlInvocationError,
+  GraphqlSourceAuth,
   GraphqlSourceAuthInput,
-  GraphqlSourceBindingRef,
   InvocationResult,
   OperationBinding,
   graphqlHeaderSlot,
   graphqlQueryParamSlot
-} from "./chunk-445ZPXHU.js";
+} from "./chunk-H422YIM4.js";
 
 // src/sdk/introspect.ts
-import { Effect, Schema } from "effect";
+import { Effect, Option, Schema } from "effect";
 import { HttpClient, HttpClientRequest } from "effect/unstable/http";
 var INTROSPECTION_QUERY = `
   query IntrospectionQuery {
@@ -90,32 +94,32 @@ var INTROSPECTION_QUERY = `
 var IntrospectionTypeRefLeaf = Schema.Struct({
   kind: Schema.String,
   name: Schema.NullOr(Schema.String),
-  ofType: Schema.Null
+  ofType: Schema.optional(Schema.Null)
 });
 var IntrospectionTypeRef5 = Schema.Struct({
   kind: Schema.String,
   name: Schema.NullOr(Schema.String),
-  ofType: Schema.NullOr(IntrospectionTypeRefLeaf)
+  ofType: Schema.optional(Schema.NullOr(IntrospectionTypeRefLeaf))
 });
 var IntrospectionTypeRef4 = Schema.Struct({
   kind: Schema.String,
   name: Schema.NullOr(Schema.String),
-  ofType: Schema.NullOr(IntrospectionTypeRef5)
+  ofType: Schema.optional(Schema.NullOr(IntrospectionTypeRef5))
 });
 var IntrospectionTypeRef3 = Schema.Struct({
   kind: Schema.String,
   name: Schema.NullOr(Schema.String),
-  ofType: Schema.NullOr(IntrospectionTypeRef4)
+  ofType: Schema.optional(Schema.NullOr(IntrospectionTypeRef4))
 });
 var IntrospectionTypeRef2 = Schema.Struct({
   kind: Schema.String,
   name: Schema.NullOr(Schema.String),
-  ofType: Schema.NullOr(IntrospectionTypeRef3)
+  ofType: Schema.optional(Schema.NullOr(IntrospectionTypeRef3))
 });
 var IntrospectionTypeRefSchema = Schema.Struct({
   kind: Schema.String,
   name: Schema.NullOr(Schema.String),
-  ofType: Schema.NullOr(IntrospectionTypeRef2)
+  ofType: Schema.optional(Schema.NullOr(IntrospectionTypeRef2))
 });
 var IntrospectionInputValueSchema = Schema.Struct({
   name: Schema.String,
@@ -155,10 +159,51 @@ var IntrospectionResponseSchema = Schema.Struct({
   data: Schema.optional(IntrospectionResultSchema),
   errors: Schema.optional(Schema.Array(Schema.Unknown))
 });
+var UpstreamErrorResponseSchema = Schema.Struct({
+  message: Schema.optional(Schema.String),
+  errors: Schema.optional(
+    Schema.Array(
+      Schema.Struct({
+        message: Schema.optional(Schema.String)
+      })
+    )
+  )
+});
 var IntrospectionJsonSchema = Schema.Union([
   Schema.Struct({ data: IntrospectionResultSchema }),
   IntrospectionResultSchema
 ]);
+var JsonTextSchema = Schema.fromJsonString(Schema.Unknown);
+var decodeUpstreamErrorResponse = Schema.decodeUnknownOption(UpstreamErrorResponseSchema);
+var firstUpstreamErrorMessage = (value) => {
+  const decoded = decodeUpstreamErrorResponse(value);
+  return Option.match(decoded, {
+    onNone: () => null,
+    onSome: (response) => {
+      if (response.message) return response.message;
+      for (const entry of response.errors ?? []) {
+        const message = entry.message;
+        if (message) return message;
+      }
+      return null;
+    }
+  });
+};
+var redactUpstreamBody = (body) => body.replaceAll(
+  /("(?:access_token|refresh_token|id_token|client_secret|token|authorization)"\s*:\s*")[^"]*(")/gi,
+  "$1[redacted]$2"
+).replaceAll(
+  /((?:access_token|refresh_token|id_token|client_secret|token|authorization)=)[^&\s]*/gi,
+  "$1[redacted]"
+).replaceAll(
+  /((?:authorization|access-token|refresh-token|id-token|client-secret|token)\s*:\s*)(?:bearer\s+)?[^\s,;]+/gi,
+  "$1[redacted]"
+);
+var upstreamTextMessage = (body) => {
+  const text = redactUpstreamBody(body.replaceAll(/\s+/g, " ").trim());
+  if (text.length === 0) return null;
+  return text.length > 500 ? `${text.slice(0, 500)}...` : text;
+};
 var introspect = Effect.fn("GraphQL.introspect")(function* (endpoint, headers, queryParams) {
   const client = yield* HttpClient.HttpClient;
   const requestEndpoint = queryParams && Object.keys(queryParams).length > 0 ? (() => {
@@ -170,6 +215,8 @@ var introspect = Effect.fn("GraphQL.introspect")(function* (endpoint, headers, q
   })() : endpoint;
   let request = HttpClientRequest.post(requestEndpoint).pipe(
     HttpClientRequest.setHeader("Content-Type", "application/json"),
+    HttpClientRequest.setHeader("Accept", "application/json"),
+    HttpClientRequest.setHeader("User-Agent", "executor-graphql"),
     HttpClientRequest.bodyJsonUnsafe({
       query: INTROSPECTION_QUERY
     })
@@ -188,8 +235,15 @@ var introspect = Effect.fn("GraphQL.introspect")(function* (endpoint, headers, q
     )
   );
   if (response.status !== 200) {
+    const responseText = yield* response.text.pipe(Effect.catch(() => Effect.succeed("")));
+    const raw2 = responseText ? yield* Schema.decodeUnknownEffect(JsonTextSchema)(responseText).pipe(
+      Effect.catch(() => Effect.succeed(null))
+    ) : null;
+    const upstreamMessage = upstreamTextMessage(
+      (raw2 === null ? null : firstUpstreamErrorMessage(raw2)) ?? responseText
+    );
     return yield* new GraphqlIntrospectionError({
-      message: `Introspection failed with status ${response.status}`
+      message: upstreamMessage ? `Introspection failed with status ${response.status}: ${upstreamMessage}` : `Introspection failed with status ${response.status}`
     });
   }
   const raw = yield* response.json.pipe(
@@ -208,8 +262,9 @@ var introspect = Effect.fn("GraphQL.introspect")(function* (endpoint, headers, q
     )
   );
   if (json.errors && Array.isArray(json.errors) && json.errors.length > 0) {
+    const upstreamMessage = firstUpstreamErrorMessage(json);
     return yield* new GraphqlIntrospectionError({
-      message: `Introspection returned ${json.errors.length} error(s)`
+      message: upstreamMessage ? `Introspection returned ${json.errors.length} error(s): ${upstreamMessage}` : `Introspection returned ${json.errors.length} error(s)`
     });
   }
   if (!json.data?.__schema) {
@@ -229,7 +284,7 @@ var parseIntrospectionJson = (text) => Schema.decodeUnknownEffect(Schema.fromJso
 );
 
 // src/sdk/extract.ts
-import { Effect as Effect2, Match, Option } from "effect";
+import { Effect as Effect2, Match, Option as Option2 } from "effect";
 var unwrapTypeName = (ref) => {
   if (ref.name) return ref.name;
   if (ref.ofType) return unwrapTypeName(ref.ofType);
@@ -296,7 +351,7 @@ var typeRefToJsonSchema = (ref, types) => Match.value(ref.kind).pipe(
     () => ({ type: "object" })
   ),
   Match.option,
-  Option.getOrElse(() => ({}))
+  Option2.getOrElse(() => ({}))
 );
 var scalarToJsonSchema = (name) => Match.value(name).pipe(
   Match.whenOr("String", "ID", () => ({ type: "string" })),
@@ -304,7 +359,7 @@ var scalarToJsonSchema = (name) => Match.value(name).pipe(
   Match.when("Float", () => ({ type: "number" })),
   Match.when("Boolean", () => ({ type: "boolean" })),
   Match.option,
-  Option.getOrElse(
+  Option2.getOrElse(
     () => ({ type: "string", description: `Custom scalar: ${name}` })
   )
 );
@@ -333,7 +388,7 @@ var formatTypeRef = (ref) => Match.value(ref.kind).pipe(
   Match.when("NON_NULL", () => ref.ofType ? `${formatTypeRef(ref.ofType)}!` : "Unknown!"),
   Match.when("LIST", () => ref.ofType ? `[${formatTypeRef(ref.ofType)}]` : "[Unknown]"),
   Match.option,
-  Option.getOrElse(() => ref.name ?? "Unknown")
+  Option2.getOrElse(() => ref.name ?? "Unknown")
 );
 var extractFields = (_schema, kind, typeName, types) => {
   if (!typeName) return [];
@@ -345,16 +400,16 @@ var extractFields = (_schema, kind, typeName, types) => {
         name: arg.name,
         typeName: formatTypeRef(arg.type),
         required: isNonNull(arg.type),
-        description: arg.description ? Option.some(arg.description) : Option.none()
+        description: arg.description ? Option2.some(arg.description) : Option2.none()
       })
     );
     const inputSchema = buildInputSchema(field.args, types);
     return ExtractedField.make({
       fieldName: field.name,
       kind,
-      description: field.description ? Option.some(field.description) : Option.none(),
+      description: field.description ? Option2.some(field.description) : Option2.none(),
       arguments: args,
-      inputSchema: inputSchema ? Option.some(inputSchema) : Option.none(),
+      inputSchema: inputSchema ? Option2.some(inputSchema) : Option2.none(),
       returnTypeName: unwrapTypeName(field.type)
     });
   });
@@ -371,7 +426,7 @@ var extract = (introspection) => Effect2.try({
     const mutationFields = extractFields(schema, "mutation", schema.mutationType?.name, typeMap);
     return {
       result: ExtractionResult.make({
-        schemaName: Option.none(),
+        schemaName: Option2.none(),
         fields: [...queryFields, ...mutationFields]
       }),
       definitions
@@ -383,7 +438,7 @@ var extract = (introspection) => Effect2.try({
 });
 
 // src/sdk/invoke.ts
-import { Effect as Effect3, Option as Option2 } from "effect";
+import { Effect as Effect3, Option as Option3 } from "effect";
 import { HttpClient as HttpClient2, HttpClientRequest as HttpClientRequest2 } from "effect/unstable/http";
 import { resolveSecretBackedMap } from "@executor-js/sdk/core";
 var resolveHeaders = (headers, secrets) => {
@@ -398,7 +453,7 @@ var resolveHeaders = (headers, secrets) => {
     missing: "drop",
     onMissing: (name) => new GraphqlInvocationError({
       message: `Missing secret for header "${name}"`,
-      statusCode: Option2.none()
+      statusCode: Option3.none()
     })
   }).pipe(
     Effect3.catch(() => Effect3.succeed(void 0)),
@@ -467,7 +522,7 @@ var invoke = Effect3.fn("GraphQL.invoke")(function* (operation, args, endpoint,
     Effect3.mapError(
       (err) => new GraphqlInvocationError({
         message: "GraphQL request failed",
-        statusCode: Option2.none(),
+        statusCode: Option3.none(),
         cause: err
       })
     )
@@ -500,378 +555,291 @@ var invokeWithLayer = (operation, args, endpoint, resolvedHeaders, resolvedQuery
 );
 
 // src/sdk/store.ts
-import { Effect as Effect4, Schema as Schema2 } from "effect";
+import { Effect as Effect4, Option as Option4, Predicate, Schema as Schema2 } from "effect";
 import {
-  ConfiguredCredentialBinding,
-  defineSchema
+  ConfiguredCredentialBinding
 } from "@executor-js/sdk/core";
-var graphqlSchema = defineSchema({
-  graphql_source: {
-    fields: {
-      id: { type: "string", required: true },
-      scope_id: { type: "string", required: true, index: true },
-      name: { type: "string", required: true },
-      endpoint: { type: "string", required: true },
-      auth_kind: {
-        type: ["none", "oauth2"],
-        required: true,
-        defaultValue: "none"
-      },
-      auth_connection_slot: {
-        type: "string",
-        required: false
-      }
-    }
-  },
-  graphql_source_header: {
-    fields: {
-      id: { type: "string", required: true },
-      scope_id: { type: "string", required: true, index: true },
-      source_id: { type: "string", required: true, index: true },
-      name: { type: "string", required: true },
-      kind: {
-        type: ["text", "binding"],
-        required: true
-      },
-      text_value: { type: "string", required: false },
-      slot_key: { type: "string", required: false },
-      prefix: { type: "string", required: false }
-    }
-  },
-  graphql_source_query_param: {
-    fields: {
-      id: { type: "string", required: true },
-      scope_id: { type: "string", required: true, index: true },
-      source_id: { type: "string", required: true, index: true },
-      name: { type: "string", required: true },
-      kind: {
-        type: ["text", "binding"],
-        required: true
-      },
-      text_value: { type: "string", required: false },
-      slot_key: { type: "string", required: false },
-      prefix: { type: "string", required: false }
-    }
-  },
-  graphql_operation: {
-    fields: {
-      id: { type: "string", required: true },
-      scope_id: { type: "string", required: true, index: true },
-      source_id: { type: "string", required: true, index: true },
-      binding: { type: "json", required: true }
-    }
-  }
-});
+var graphqlSchema = {};
+var SOURCE_COLLECTION = "source";
+var OPERATION_COLLECTION = "operation";
 var OperationBindingFromJsonString = Schema2.fromJsonString(OperationBinding);
 var decodeOperationBindingFromJsonString = Schema2.decodeUnknownSync(
   OperationBindingFromJsonString
 );
 var decodeOperationBinding = Schema2.decodeUnknownSync(OperationBinding);
+var encodeBinding = Schema2.encodeSync(OperationBinding);
 var decodeBinding = (value) => {
-  if (typeof value === "string") {
-    return decodeOperationBindingFromJsonString(value);
-  }
+  if (typeof value === "string") return decodeOperationBindingFromJsonString(value);
   return decodeOperationBinding(value);
 };
-var encodeBinding = Schema2.encodeSync(OperationBinding);
 var toJsonRecord = (value) => value;
-var SourceRow = Schema2.Struct({
-  id: Schema2.String,
-  scope_id: Schema2.String,
-  name: Schema2.String,
-  endpoint: Schema2.String,
-  auth_kind: Schema2.Literals(["none", "oauth2"]),
-  auth_connection_slot: Schema2.NullOr(Schema2.String).pipe(Schema2.optionalKey)
+var OptionalNullableString = Schema2.optional(Schema2.NullOr(Schema2.String));
+var ConfiguredCredentialBindingStorage = Schema2.Struct({
+  kind: Schema2.Literal("binding"),
+  slot: Schema2.String,
+  prefix: OptionalNullableString
 });
-var ChildValueRow = Schema2.Struct({
+var ConfiguredCredentialValueStorage = Schema2.Union([
+  Schema2.String,
+  ConfiguredCredentialBindingStorage
+]);
+var CredentialMapStorage = Schema2.Record(Schema2.String, ConfiguredCredentialValueStorage);
+var SourceStorage = Schema2.Struct({
+  namespace: Schema2.String,
+  scope: Schema2.String,
   name: Schema2.String,
-  kind: Schema2.Literals(["text", "binding"]),
-  text_value: Schema2.NullOr(Schema2.String).pipe(Schema2.optionalKey),
-  slot_key: Schema2.NullOr(Schema2.String).pipe(Schema2.optionalKey),
-  prefix: Schema2.NullOr(Schema2.String).pipe(Schema2.optionalKey)
+  endpoint: Schema2.String,
+  headers: Schema2.optional(CredentialMapStorage),
+  queryParams: Schema2.optional(CredentialMapStorage),
+  auth: GraphqlSourceAuth
 });
-var OperationRow = Schema2.Struct({
-  id: Schema2.String,
-  source_id: Schema2.String,
+var OperationStorage = Schema2.Struct({
+  toolId: Schema2.String,
+  sourceId: Schema2.String,
   binding: Schema2.Unknown
 });
-var decodeSourceRow = Schema2.decodeUnknownSync(SourceRow);
-var decodeChildValueRow = Schema2.decodeUnknownSync(ChildValueRow);
-var decodeOperationRow = Schema2.decodeUnknownSync(OperationRow);
-var rowsToValueMap = (rows) => {
-  const out = {};
-  for (const rawRow of rows) {
-    const row = decodeChildValueRow(rawRow);
-    const name = row.name;
-    if (row.kind === "binding" && typeof row.slot_key === "string") {
-      out[name] = typeof row.prefix === "string" ? ConfiguredCredentialBinding.make({
-        kind: "binding",
-        slot: row.slot_key,
-        prefix: row.prefix
-      }) : ConfiguredCredentialBinding.make({
-        kind: "binding",
-        slot: row.slot_key
-      });
-    } else if (row.kind === "text" && typeof row.text_value === "string") {
-      out[name] = row.text_value;
+var decodeSourceStorage = Schema2.decodeUnknownOption(SourceStorage);
+var decodeOperationStorage = Schema2.decodeUnknownOption(OperationStorage);
+var normalizeCredentialMap = (values) => {
+  if (!values) return {};
+  const normalized = {};
+  for (const [name, value] of Object.entries(values)) {
+    if (typeof value === "string") {
+      normalized[name] = value;
+      continue;
     }
+    normalized[name] = value.prefix != null ? ConfiguredCredentialBinding.make({
+      kind: "binding",
+      slot: value.slot,
+      prefix: value.prefix
+    }) : ConfiguredCredentialBinding.make({
+      kind: "binding",
+      slot: value.slot
+    });
   }
-  return out;
+  return normalized;
 };
-var valueToChildRow = (sourceId, scope, name, value) => {
-  const id = JSON.stringify([sourceId, name]);
-  if (typeof value === "string") {
-    return {
-      id,
-      scope_id: scope,
-      source_id: sourceId,
-      name,
-      kind: "text",
-      text_value: value
-    };
-  }
+var sourceData = (source) => ({
+  namespace: source.namespace,
+  scope: source.scope,
+  name: source.name,
+  endpoint: source.endpoint,
+  headers: source.headers,
+  queryParams: source.queryParams,
+  auth: source.auth
+});
+var operationData = (operation) => ({
+  toolId: operation.toolId,
+  sourceId: operation.sourceId,
+  binding: toJsonRecord(encodeBinding(operation.binding))
+});
+var rowToSource = (row) => {
+  const decoded = decodeSourceStorage(row.data);
+  if (Option4.isNone(decoded)) return null;
+  const source = decoded.value;
   return {
-    id,
-    scope_id: scope,
-    source_id: sourceId,
-    name,
-    kind: "binding",
-    slot_key: value.slot,
-    prefix: value.prefix
+    namespace: source.namespace,
+    scope: source.scope,
+    name: source.name,
+    endpoint: source.endpoint,
+    headers: normalizeCredentialMap(source.headers),
+    queryParams: normalizeCredentialMap(source.queryParams),
+    auth: source.auth
   };
 };
-var rowToAuth = (row) => {
-  if (row.auth_kind === "oauth2" && typeof row.auth_connection_slot === "string") {
-    return { kind: "oauth2", connectionSlot: row.auth_connection_slot };
-  }
-  return { kind: "none" };
+var rowToOperation = (row) => {
+  const decoded = decodeOperationStorage(row.data);
+  if (Option4.isNone(decoded)) return null;
+  const operation = decoded.value;
+  return {
+    toolId: operation.toolId,
+    sourceId: operation.sourceId,
+    binding: decodeBinding(operation.binding)
+  };
 };
 var makeDefaultGraphqlStore = ({
-  adapter: db
+  pluginStorage
 }) => {
-  const loadHeaders = (sourceId, scope) => db.findMany({
-    model: "graphql_source_header",
-    where: [
-      { field: "source_id", value: sourceId },
-      { field: "scope_id", value: scope }
-    ]
-  }).pipe(Effect4.map(rowsToValueMap));
-  const loadQueryParams = (sourceId, scope) => db.findMany({
-    model: "graphql_source_query_param",
-    where: [
-      { field: "source_id", value: sourceId },
-      { field: "scope_id", value: scope }
-    ]
-  }).pipe(Effect4.map(rowsToValueMap));
-  const rowToSourceWithChildren = (row) => Effect4.gen(function* () {
-    const source = decodeSourceRow(row);
-    const sourceId = source.id;
-    const scope = source.scope_id;
-    const headers = yield* loadHeaders(sourceId, scope);
-    const queryParams = yield* loadQueryParams(sourceId, scope);
-    return {
-      namespace: sourceId,
-      scope,
-      name: source.name,
-      endpoint: source.endpoint,
-      headers,
-      queryParams,
-      auth: rowToAuth(source)
-    };
-  });
-  const rowToOperation = (row) => {
-    const operation = decodeOperationRow(row);
-    return {
-      toolId: operation.id,
-      sourceId: operation.source_id,
-      binding: decodeBinding(operation.binding)
-    };
-  };
-  const replaceChildren = (model, sourceId, scope, values) => Effect4.gen(function* () {
-    yield* db.deleteMany({
-      model,
-      where: [
-        { field: "source_id", value: sourceId },
-        { field: "scope_id", value: scope }
-      ]
-    });
-    const entries = Object.entries(values);
-    if (entries.length === 0) return;
-    yield* db.createMany({
-      model,
-      data: entries.map(([name, value]) => valueToChildRow(sourceId, scope, name, value)),
-      forceAllowId: true
-    });
+  const listOperationRowsForSourceScope = (sourceId, scope) => pluginStorage.list({
+    collection: OPERATION_COLLECTION,
+    keyPrefix: `${sourceId}.`
+  }).pipe(
+    Effect4.map(
+      (rows) => rows.filter((row) => {
+        if (String(row.scopeId) !== scope) return false;
+        return rowToOperation(row)?.sourceId === sourceId;
+      })
+    )
+  );
+  const removeOperationsForSourceScope = (sourceId, scope) => Effect4.gen(function* () {
+    const rows = yield* listOperationRowsForSourceScope(sourceId, scope);
+    for (const row of rows) {
+      yield* pluginStorage.remove({
+        scope,
+        collection: OPERATION_COLLECTION,
+        key: row.key
+      });
+    }
   });
   const deleteSource = (namespace, scope) => Effect4.gen(function* () {
-    yield* db.deleteMany({
-      model: "graphql_operation",
-      where: [
-        { field: "source_id", value: namespace },
-        { field: "scope_id", value: scope }
-      ]
-    });
-    yield* db.deleteMany({
-      model: "graphql_source_header",
-      where: [
-        { field: "source_id", value: namespace },
-        { field: "scope_id", value: scope }
-      ]
-    });
-    yield* db.deleteMany({
-      model: "graphql_source_query_param",
-      where: [
-        { field: "source_id", value: namespace },
-        { field: "scope_id", value: scope }
-      ]
-    });
-    yield* db.delete({
-      model: "graphql_source",
-      where: [
-        { field: "id", value: namespace },
-        { field: "scope_id", value: scope }
-      ]
+    yield* removeOperationsForSourceScope(namespace, scope);
+    yield* pluginStorage.remove({
+      scope,
+      collection: SOURCE_COLLECTION,
+      key: namespace
     });
   });
   return {
     upsertSource: (input, operations) => Effect4.gen(function* () {
       yield* deleteSource(input.namespace, input.scope);
-      yield* db.create({
-        model: "graphql_source",
-        data: {
-          id: input.namespace,
-          scope_id: input.scope,
-          name: input.name,
-          endpoint: input.endpoint,
-          auth_kind: input.auth.kind,
-          auth_connection_slot: input.auth.kind === "oauth2" ? input.auth.connectionSlot : void 0
-        },
-        forceAllowId: true
+      yield* pluginStorage.put({
+        scope: input.scope,
+        collection: SOURCE_COLLECTION,
+        key: input.namespace,
+        data: sourceData(input)
       });
-      yield* replaceChildren(
-        "graphql_source_header",
-        input.namespace,
-        input.scope,
-        input.headers
-      );
-      yield* replaceChildren(
-        "graphql_source_query_param",
-        input.namespace,
-        input.scope,
-        input.queryParams
-      );
-      if (operations.length > 0) {
-        yield* db.createMany({
-          model: "graphql_operation",
-          data: operations.map((op) => ({
-            id: op.toolId,
-            scope_id: input.scope,
-            source_id: op.sourceId,
-            binding: toJsonRecord(encodeBinding(op.binding))
-          })),
-          forceAllowId: true
+      for (const operation of operations) {
+        yield* pluginStorage.put({
+          scope: input.scope,
+          collection: OPERATION_COLLECTION,
+          key: operation.toolId,
+          data: operationData(operation)
         });
       }
     }),
     updateSourceMeta: (namespace, scope, patch) => Effect4.gen(function* () {
-      const existing = yield* db.findOne({
-        model: "graphql_source",
-        where: [
-          { field: "id", value: namespace },
-          { field: "scope_id", value: scope }
-        ]
+      const existing = yield* pluginStorage.getAtScope({
+        scope,
+        collection: SOURCE_COLLECTION,
+        key: namespace
       });
       if (!existing) return;
-      const update = {};
-      if (patch.name !== void 0) update.name = patch.name;
-      if (patch.endpoint !== void 0) update.endpoint = patch.endpoint;
-      if (patch.auth !== void 0) {
-        update.auth_kind = patch.auth.kind;
-        update.auth_connection_slot = patch.auth.kind === "oauth2" ? patch.auth.connectionSlot : null;
-      }
-      if (Object.keys(update).length > 0) {
-        yield* db.update({
-          model: "graphql_source",
-          where: [
-            { field: "id", value: namespace },
-            { field: "scope_id", value: scope }
-          ],
-          update
-        });
-      }
-      if (patch.headers !== void 0) {
-        yield* replaceChildren("graphql_source_header", namespace, scope, patch.headers);
-      }
-      if (patch.queryParams !== void 0) {
-        yield* replaceChildren("graphql_source_query_param", namespace, scope, patch.queryParams);
-      }
-    }),
-    getSource: (namespace, scope) => Effect4.gen(function* () {
-      const row = yield* db.findOne({
-        model: "graphql_source",
-        where: [
-          { field: "id", value: namespace },
-          { field: "scope_id", value: scope }
-        ]
-      });
-      if (!row) return null;
-      return yield* rowToSourceWithChildren(row);
-    }),
-    listSources: () => Effect4.gen(function* () {
-      const rows = yield* db.findMany({ model: "graphql_source" });
-      return yield* Effect4.forEach(rows, rowToSourceWithChildren, {
-        concurrency: "unbounded"
+      const source = rowToSource(existing);
+      if (!source) return;
+      yield* pluginStorage.put({
+        scope,
+        collection: SOURCE_COLLECTION,
+        key: namespace,
+        data: sourceData({
+          ...source,
+          name: patch.name ?? source.name,
+          endpoint: patch.endpoint ?? source.endpoint,
+          headers: patch.headers ?? source.headers,
+          queryParams: patch.queryParams ?? source.queryParams,
+          auth: patch.auth ?? source.auth
+        })
       });
     }),
-    getOperationByToolId: (toolId, scope) => db.findOne({
-      model: "graphql_operation",
-      where: [
-        { field: "id", value: toolId },
-        { field: "scope_id", value: scope }
-      ]
-    }).pipe(Effect4.map((row) => row ? rowToOperation(row) : null)),
-    listOperationsBySource: (sourceId, scope) => db.findMany({
-      model: "graphql_operation",
-      where: [
-        { field: "source_id", value: sourceId },
-        { field: "scope_id", value: scope }
-      ]
-    }).pipe(Effect4.map((rows) => rows.map(rowToOperation))),
+    getSource: (namespace, scope) => pluginStorage.getAtScope({ scope, collection: SOURCE_COLLECTION, key: namespace }).pipe(Effect4.map((row) => row ? rowToSource(row) : null)),
+    listSources: () => pluginStorage.list({ collection: SOURCE_COLLECTION }).pipe(Effect4.map((rows) => rows.map(rowToSource).filter(Predicate.isNotNull))),
+    getOperationByToolId: (toolId, scope) => pluginStorage.getAtScope({ scope, collection: OPERATION_COLLECTION, key: toolId }).pipe(Effect4.map((row) => row ? rowToOperation(row) : null)),
+    listOperationsBySource: (sourceId, scope) => listOperationRowsForSourceScope(sourceId, scope).pipe(
+      Effect4.map((rows) => rows.map(rowToOperation).filter(Predicate.isNotNull))
+    ),
     removeSource: (namespace, scope) => deleteSource(namespace, scope)
   };
 };
 
 // src/sdk/plugin.ts
-import { Effect as Effect5, Match as Match2, Option as Option3, Schema as Schema3 } from "effect";
+import { Effect as Effect5, Match as Match2, Option as Option5, Schema as Schema3 } from "effect";
 import {
-  ConnectionId,
-  ConfiguredCredentialBinding as ConfiguredCredentialBinding2,
   definePlugin,
   tool,
+  defaultSourceInstallScopeId,
   ScopeId,
-  SecretId,
   SourceDetectionResult,
-  StorageError
+  StorageError,
+  ToolResult
 } from "@executor-js/sdk/core";
+import {
+  compileHttpNamedCredentialMap,
+  OAuth2SourceConfig,
+  httpCredentialInputToBindingValue
+} from "@executor-js/sdk/http-source";
 import {
   headersToConfigValues
 } from "@executor-js/config";
-var StaticAddSourceInputSchema = Schema3.Struct({
+var GraphqlErrorBody = Schema3.Struct({ message: Schema3.String });
+var GraphqlErrorsBody = Schema3.Array(Schema3.Unknown);
+var decodeGraphqlErrorBody = Schema3.decodeUnknownOption(GraphqlErrorBody);
+var decodeGraphqlErrorsBody = Schema3.decodeUnknownOption(GraphqlErrorsBody);
+var decodeGraphqlErrors = (errors) => Option5.getOrUndefined(decodeGraphqlErrorsBody(errors));
+var extractGraphqlErrorMessage = (errors) => errors.map((error) => Option5.getOrUndefined(decodeGraphqlErrorBody(error))?.message).find((message) => message !== void 0 && message.length > 0);
+var GraphqlInitialCredentialsInputSchema = Schema3.Struct({
   scope: Schema3.String,
+  headers: Schema3.optional(Schema3.Record(Schema3.String, GraphqlCredentialInput)),
+  queryParams: Schema3.optional(Schema3.Record(Schema3.String, GraphqlCredentialInput)),
+  auth: Schema3.optional(GraphqlSourceAuthInput)
+});
+var StaticAddSourceInputSchema = Schema3.Struct({
   endpoint: Schema3.String,
-  name: Schema3.optional(Schema3.String),
+  name: Schema3.String,
   introspectionJson: Schema3.optional(Schema3.String),
-  namespace: Schema3.optional(Schema3.String),
+  namespace: Schema3.String,
+  headers: Schema3.optional(Schema3.Record(Schema3.String, GraphqlConfiguredValueInput)),
+  queryParams: Schema3.optional(Schema3.Record(Schema3.String, GraphqlConfiguredValueInput)),
+  oauth2: Schema3.optional(OAuth2SourceConfig),
+  credentials: Schema3.optional(GraphqlInitialCredentialsInputSchema)
+});
+var SourceConfigureInputSchema = Schema3.Struct({
+  name: Schema3.optional(Schema3.String),
+  endpoint: Schema3.optional(Schema3.String),
   headers: Schema3.optional(Schema3.Record(Schema3.String, GraphqlCredentialInput)),
   queryParams: Schema3.optional(Schema3.Record(Schema3.String, GraphqlCredentialInput)),
-  credentialTargetScope: Schema3.optional(Schema3.String),
   auth: Schema3.optional(GraphqlSourceAuthInput)
 });
+var StaticConfigureSourceInputSchema = Schema3.Struct({
+  source: Schema3.Struct({
+    id: Schema3.String,
+    scope: Schema3.String
+  }),
+  scope: Schema3.String,
+  ...SourceConfigureInputSchema.fields
+});
+var StaticConfigureSourceOutputSchema = Schema3.Struct({
+  configured: Schema3.Boolean
+});
+var StaticGetSourceInputSchema = Schema3.Struct({
+  namespace: Schema3.String,
+  scope: Schema3.String
+});
+var StaticGetSourceOutputSchema = Schema3.Struct({
+  source: Schema3.NullOr(Schema3.Unknown)
+});
 var StaticAddSourceInputStandardSchema = Schema3.toStandardSchemaV1(
   Schema3.toStandardJSONSchemaV1(StaticAddSourceInputSchema)
 );
 var StaticAddSourceOutputStandardSchema = Schema3.toStandardSchemaV1(
-  Schema3.toStandardJSONSchemaV1(Schema3.Struct({ toolCount: Schema3.Number }))
+  Schema3.toStandardJSONSchemaV1(
+    Schema3.Struct({
+      namespace: Schema3.String,
+      source: Schema3.Struct({
+        id: Schema3.String,
+        scope: Schema3.String
+      }),
+      toolCount: Schema3.Number
+    })
+  )
+);
+var StaticGetSourceInputStandardSchema = Schema3.toStandardSchemaV1(
+  Schema3.toStandardJSONSchemaV1(StaticGetSourceInputSchema)
+);
+var StaticGetSourceOutputStandardSchema = Schema3.toStandardSchemaV1(
+  Schema3.toStandardJSONSchemaV1(StaticGetSourceOutputSchema)
+);
+var StaticConfigureSourceInputStandardSchema = Schema3.toStandardSchemaV1(
+  Schema3.toStandardJSONSchemaV1(StaticConfigureSourceInputSchema)
+);
+var StaticConfigureSourceOutputStandardSchema = Schema3.toStandardSchemaV1(
+  Schema3.toStandardJSONSchemaV1(StaticConfigureSourceOutputSchema)
+);
+var graphqlToolFailure = (code, message, details) => ToolResult.fail({
+  code,
+  message,
+  ...details === void 0 ? {} : { details }
+});
+var resolveStaticScopeInput = (ctx, value) => String(
+  ctx.scopes.find((scope) => scope.name === value || String(scope.id) === value)?.id ?? value
 );
 var urlMatchesToken = (url, token) => {
   const re = new RegExp(`(?:^|[^a-z0-9])${token}(?:$|[^a-z0-9])`, "i");
@@ -889,7 +857,7 @@ var formatTypeRef2 = (ref) => Match2.value(ref.kind).pipe(
   Match2.when("NON_NULL", () => ref.ofType ? `${formatTypeRef2(ref.ofType)}!` : "Unknown!"),
   Match2.when("LIST", () => ref.ofType ? `[${formatTypeRef2(ref.ofType)}]` : "[Unknown]"),
   Match2.option,
-  Option3.getOrElse(() => ref.name ?? "Unknown")
+  Option5.getOrElse(() => ref.name ?? "Unknown")
 );
 var unwrapTypeName2 = (ref) => {
   if (ref.name) return ref.name;
@@ -945,7 +913,7 @@ var prepareOperations = (fields, introspection) => {
   return fields.map((extracted) => {
     const prefix = extracted.kind === "mutation" ? "mutation" : "query";
     const toolPath = `${prefix}.${extracted.fieldName}`;
-    const description = Option3.getOrElse(
+    const description = Option5.getOrElse(
       extracted.description,
       () => `GraphQL ${extracted.kind}: ${extracted.fieldName} -> ${extracted.returnTypeName}`
     );
@@ -961,7 +929,7 @@ var prepareOperations = (fields, introspection) => {
     return {
       toolPath,
       description,
-      inputSchema: Option3.getOrUndefined(extracted.inputSchema),
+      inputSchema: Option5.getOrUndefined(extracted.inputSchema),
       binding
     };
   });
@@ -993,26 +961,6 @@ var toGraphqlConfigEntry = (namespace, config) => {
 var GRAPHQL_PLUGIN_ID = "graphql";
 var scopeRanks = (ctx) => new Map(ctx.scopes.map((scope, index) => [String(scope.id), index]));
 var scopeRank = (ranks, scopeId) => ranks.get(scopeId) ?? Infinity;
-var coreBindingToGraphqlBinding = (binding) => GraphqlSourceBindingRef.make({
-  sourceId: binding.sourceId,
-  sourceScopeId: binding.sourceScopeId,
-  scopeId: binding.scopeId,
-  slot: binding.slotKey,
-  value: binding.value,
-  createdAt: binding.createdAt,
-  updatedAt: binding.updatedAt
-});
-var listGraphqlSourceBindings = (ctx, sourceId, sourceScope) => Effect5.gen(function* () {
-  const ranks = scopeRanks(ctx);
-  const sourceSourceRank = scopeRank(ranks, sourceScope);
-  if (sourceSourceRank === Infinity) return [];
-  const bindings = yield* ctx.credentialBindings.listForSource({
-    pluginId: GRAPHQL_PLUGIN_ID,
-    sourceId,
-    sourceScope: ScopeId.make(sourceScope)
-  });
-  return bindings.filter((binding) => scopeRank(ranks, binding.scopeId) <= sourceSourceRank).map(coreBindingToGraphqlBinding);
-});
 var resolveGraphqlSourceBinding = (ctx, sourceId, sourceScope, slot) => Effect5.gen(function* () {
   const ranks = scopeRanks(ctx);
   const sourceSourceRank = scopeRank(ranks, sourceScope);
@@ -1025,7 +973,7 @@ var resolveGraphqlSourceBinding = (ctx, sourceId, sourceScope, slot) => Effect5.
   const binding = bindings.filter(
     (candidate) => candidate.slotKey === slot && scopeRank(ranks, candidate.scopeId) <= sourceSourceRank
   ).sort((a, b) => scopeRank(ranks, a.scopeId) - scopeRank(ranks, b.scopeId))[0];
-  return binding ? coreBindingToGraphqlBinding(binding) : null;
+  return binding ?? null;
 });
 var validateGraphqlBindingTarget = (ctx, input) => Effect5.gen(function* () {
   const ranks = scopeRanks(ctx);
@@ -1051,70 +999,93 @@ var validateGraphqlBindingTarget = (ctx, input) => Effect5.gen(function* () {
     });
   }
 });
-var bindingTargetScope = (targetScope, bindings) => {
-  if (bindings.length === 0) return Effect5.succeed(void 0);
-  if (targetScope) return Effect5.succeed(targetScope);
-  return Effect5.fail(
-    new GraphqlIntrospectionError({
-      message: "credentialTargetScope is required when adding direct GraphQL credentials"
-    })
-  );
-};
-var targetScopeForBinding = (fallbackTargetScope, binding) => {
-  const targetScope = binding.targetScope ?? fallbackTargetScope;
-  if (targetScope) return Effect5.succeed(targetScope);
-  return Effect5.fail(
-    new GraphqlIntrospectionError({
-      message: "credentialTargetScope is required when adding direct GraphQL credentials"
-    })
-  );
-};
-var canonicalizeCredentialMap = (values, slotForName) => {
-  const nextValues = {};
-  const bindings = [];
+var canonicalizeCredentialMap = compileHttpNamedCredentialMap;
+var canonicalizeConfiguredValueMap = (values, slotForName) => {
+  const next = {};
   for (const [name, value] of Object.entries(values ?? {})) {
     if (typeof value === "string") {
-      nextValues[name] = value;
+      next[name] = value;
       continue;
     }
-    if ("kind" in value) {
-      nextValues[name] = value;
-      continue;
-    }
-    const slot = slotForName(name);
-    nextValues[name] = ConfiguredCredentialBinding2.make({
+    next[name] = {
       kind: "binding",
-      slot,
+      slot: slotForName(name),
       prefix: value.prefix
-    });
-    bindings.push({
-      slot,
-      targetScope: "targetScope" in value ? value.targetScope : void 0,
-      value: {
-        kind: "secret",
-        secretId: SecretId.make(value.secretId),
-        ..."secretScopeId" in value && value.secretScopeId ? { secretScopeId: value.secretScopeId } : {}
-      }
-    });
+    };
+  }
+  return next;
+};
+var resolveConfiguredValueMap = (values) => {
+  if (!values) return void 0;
+  const resolved = {};
+  for (const [name, value] of Object.entries(values)) {
+    if (typeof value === "string") resolved[name] = value;
   }
-  return { values: nextValues, bindings };
+  return Object.keys(resolved).length > 0 ? resolved : void 0;
 };
+var authFromOAuth2Source = (oauth2) => oauth2 ? { kind: "oauth2", connectionSlot: oauth2.connectionSlot } : { kind: "none" };
 var canonicalizeAuth = (auth) => {
-  if (!auth || auth.kind === "none") return { auth: { kind: "none" }, bindings: [] };
-  if ("connectionSlot" in auth) return { auth, bindings: [] };
+  if (!auth || "kind" in auth || !auth.oauth2) return { auth: { kind: "none" }, bindings: [] };
+  const connection = auth.oauth2.connection;
   return {
     auth: { kind: "oauth2", connectionSlot: GRAPHQL_OAUTH_CONNECTION_SLOT },
-    bindings: [
+    bindings: connection ? [
       {
         slot: GRAPHQL_OAUTH_CONNECTION_SLOT,
-        value: {
-          kind: "connection",
-          connectionId: ConnectionId.make(auth.connectionId)
-        }
+        value: httpCredentialInputToBindingValue(connection)
       }
-    ]
+    ] : []
   };
 };
+var resolveInitialCredentialValueMap = (ctx, values, bindings, targetScope) => Effect5.gen(function* () {
+  const bySlot = new Map(bindings.map((binding) => [binding.slot, binding.value]));
+  const resolved = {};
+  for (const [name, value] of Object.entries(values)) {
+    if (typeof value === "string") {
+      resolved[name] = value;
+      continue;
+    }
+    const binding = bySlot.get(value.slot);
+    if (binding?.kind === "secret") {
+      const secret = yield* ctx.secrets.getAtScope(binding.secretId, binding.secretScopeId ?? ScopeId.make(targetScope)).pipe(
+        Effect5.catchTag(
+          "SecretOwnedByConnectionError",
+          () => Effect5.fail(
+            new GraphqlIntrospectionError({
+              message: `Secret not found for ${name}`
+            })
+          )
+        )
+      );
+      if (secret === null) {
+        return yield* new GraphqlIntrospectionError({
+          message: `Missing secret "${binding.secretId}" for ${name}`
+        });
+      }
+      resolved[name] = value.prefix ? `${value.prefix}${secret}` : secret;
+      continue;
+    }
+    if (binding?.kind === "text") {
+      resolved[name] = value.prefix ? `${value.prefix}${binding.text}` : binding.text;
+    }
+  }
+  return Object.keys(resolved).length > 0 ? resolved : void 0;
+});
+var resolveInitialOAuthHeaders = (ctx, bindings, targetScope) => Effect5.gen(function* () {
+  const connection = bindings.find(
+    (binding) => binding.slot === GRAPHQL_OAUTH_CONNECTION_SLOT && binding.value.kind === "connection"
+  );
+  if (!connection || connection.value.kind !== "connection") return void 0;
+  const connectionId = connection.value.connectionId;
+  const accessToken = yield* ctx.connections.accessTokenAtScope(connectionId, ScopeId.make(targetScope)).pipe(
+    Effect5.mapError(
+      ({ message }) => new GraphqlIntrospectionError({
+        message: `Failed to resolve OAuth connection "${connectionId}": ${message}`
+      })
+    )
+  );
+  return { Authorization: `Bearer ${accessToken}` };
+});
 var resolveGraphqlBindingValueMap = (ctx, values, params) => Effect5.gen(function* () {
   if (!values) return void 0;
   const resolved = {};
@@ -1169,7 +1140,7 @@ var resolveGraphqlStoredOAuthHeader = (ctx, sourceId, sourceScope, auth) => Effe
   if (binding?.value.kind !== "connection") {
     return yield* new GraphqlInvocationError({
       message: `Missing OAuth connection binding for GraphQL source "${sourceId}"`,
-      statusCode: Option3.none()
+      statusCode: Option5.none()
     });
   }
   const accessToken = yield* ctx.connections.accessTokenAtScope(
@@ -1179,127 +1150,61 @@ var resolveGraphqlStoredOAuthHeader = (ctx, sourceId, sourceScope, auth) => Effe
   return { Authorization: `Bearer ${accessToken}` };
 });
 var makeGraphqlExtension = (ctx, httpClientLayer, configFile) => {
-  const resolveCredentialInputMap = (values, params) => Effect5.gen(function* () {
-    if (!values) return void 0;
-    const resolved = {};
-    for (const [name, value] of Object.entries(values)) {
-      if (typeof value === "string") {
-        resolved[name] = value;
-        continue;
-      }
-      if ("kind" in value) {
-        const slotResolved = yield* resolveGraphqlBindingValueMap(
-          ctx,
-          { [name]: value },
-          {
-            sourceId: params.sourceId,
-            sourceScope: params.sourceScope,
-            missingLabel: params.missingLabel,
-            makeError: params.makeError
-          }
-        );
-        if (slotResolved?.[name] !== void 0) resolved[name] = slotResolved[name];
-        continue;
-      }
-      const secretScope = "secretScopeId" in value ? value.secretScopeId ?? value.targetScope : params.targetScope ?? params.sourceScope;
-      const secret = yield* ctx.secrets.getAtScope(SecretId.make(value.secretId), secretScope).pipe(
-        Effect5.catchTag(
-          "SecretOwnedByConnectionError",
-          () => Effect5.fail(
-            params.makeError(`Secret not found for ${params.missingLabel} "${name}"`)
-          )
-        )
-      );
-      if (secret === null) {
-        return yield* Effect5.fail(
-          params.makeError(
-            `Missing secret "${value.secretId}" for ${params.missingLabel} "${name}"`
-          )
-        );
-      }
-      resolved[name] = value.prefix ? `${value.prefix}${secret}` : secret;
-    }
-    return Object.keys(resolved).length > 0 ? resolved : void 0;
-  });
-  const resolveOAuthInputHeader = (sourceId, sourceScope, targetScope, auth) => Effect5.gen(function* () {
-    if (!auth || auth.kind === "none") return void 0;
-    const connection = "connectionId" in auth ? { id: auth.connectionId, scope: targetScope ?? sourceScope } : yield* Effect5.gen(function* () {
-      const binding = yield* resolveGraphqlSourceBinding(
-        ctx,
-        sourceId,
-        sourceScope,
-        auth.connectionSlot
-      );
-      return binding?.value.kind === "connection" ? { id: binding.value.connectionId, scope: binding.scopeId } : null;
-    });
-    if (connection === null) {
-      return yield* new GraphqlIntrospectionError({
-        message: `Missing OAuth connection binding for "${sourceId}"`
-      });
-    }
-    const accessToken = yield* ctx.connections.accessTokenAtScope(connection.id, connection.scope).pipe(
-      Effect5.mapError(
-        () => new GraphqlIntrospectionError({
-          message: `Failed to resolve OAuth connection "${connection.id}"`
-        })
-      )
-    );
-    return { Authorization: `Bearer ${accessToken}` };
-  });
   const addSourceInternal = (config) => ctx.transaction(
     Effect5.gen(function* () {
-      const namespace = config.namespace ?? namespaceFromEndpoint(config.endpoint);
-      const canonicalHeaders = canonicalizeCredentialMap(config.headers, graphqlHeaderSlot);
-      const canonicalQueryParams = canonicalizeCredentialMap(
+      const namespace = config.namespace;
+      const canonicalHeaders = canonicalizeConfiguredValueMap(config.headers, graphqlHeaderSlot);
+      const canonicalQueryParams = canonicalizeConfiguredValueMap(
         config.queryParams,
         graphqlQueryParamSlot
       );
-      const canonicalAuth = canonicalizeAuth(config.auth);
-      const directBindings = [
-        ...canonicalHeaders.bindings,
-        ...canonicalQueryParams.bindings,
-        ...canonicalAuth.bindings
+      const initialHeaders = config.credentials?.headers !== void 0 ? canonicalizeCredentialMap(config.credentials.headers, graphqlHeaderSlot) : null;
+      const initialQueryParams = config.credentials?.queryParams !== void 0 ? canonicalizeCredentialMap(config.credentials.queryParams, graphqlQueryParamSlot) : null;
+      const initialAuth = config.credentials?.auth !== void 0 ? canonicalizeAuth(config.credentials.auth) : null;
+      const auth = config.oauth2 ? authFromOAuth2Source(config.oauth2) : initialAuth?.auth ?? { kind: "none" };
+      const initialBindings = [
+        ...initialHeaders?.bindings ?? [],
+        ...initialQueryParams?.bindings ?? [],
+        ...initialAuth?.bindings ?? []
       ];
-      for (const binding of directBindings) {
-        const bindingTargetScope2 = yield* targetScopeForBinding(
-          config.credentialTargetScope,
-          binding
-        );
+      const initialScope = config.credentials?.scope;
+      if (initialScope && initialBindings.length > 0) {
         yield* validateGraphqlBindingTarget(ctx, {
           sourceId: namespace,
           sourceScope: config.scope,
-          targetScope: bindingTargetScope2
+          targetScope: initialScope
         });
       }
-      const targetScope = directBindings[0] !== void 0 ? yield* targetScopeForBinding(config.credentialTargetScope, directBindings[0]) : void 0;
       let introspectionResult;
       if (config.introspectionJson) {
         introspectionResult = yield* parseIntrospectionJson(config.introspectionJson);
       } else {
-        const resolvedHeaders = yield* resolveCredentialInputMap(config.headers, {
-          sourceId: namespace,
-          sourceScope: config.scope,
-          targetScope,
-          missingLabel: "header",
-          makeError: (message) => new GraphqlIntrospectionError({ message })
-        });
-        const oauthHeader = yield* resolveOAuthInputHeader(
-          namespace,
-          config.scope,
-          targetScope,
-          config.auth
-        );
-        const resolvedQueryParams = yield* resolveCredentialInputMap(config.queryParams, {
-          sourceId: namespace,
-          sourceScope: config.scope,
-          targetScope,
-          missingLabel: "query parameter",
-          makeError: (message) => new GraphqlIntrospectionError({ message })
-        });
+        const resolvedInitialHeaders = initialHeaders && initialScope ? yield* resolveInitialCredentialValueMap(
+          ctx,
+          canonicalHeaders,
+          initialHeaders.bindings,
+          initialScope
+        ) : void 0;
+        const resolvedOAuthHeaders = initialAuth && initialScope ? yield* resolveInitialOAuthHeaders(ctx, initialAuth.bindings, initialScope) : void 0;
+        const resolvedHeaders = {
+          ...resolveConfiguredValueMap(config.headers) ?? {},
+          ...resolvedInitialHeaders ?? {},
+          ...resolvedOAuthHeaders ?? {}
+        };
+        const resolvedInitialQueryParams = initialQueryParams && initialScope ? yield* resolveInitialCredentialValueMap(
+          ctx,
+          canonicalQueryParams,
+          initialQueryParams.bindings,
+          initialScope
+        ) : void 0;
+        const resolvedQueryParams = {
+          ...resolveConfiguredValueMap(config.queryParams) ?? {},
+          ...resolvedInitialQueryParams ?? {}
+        };
         introspectionResult = yield* introspect(
           config.endpoint,
-          { ...resolvedHeaders ?? {}, ...oauthHeader ?? {} },
-          resolvedQueryParams
+          Object.keys(resolvedHeaders).length > 0 ? resolvedHeaders : void 0,
+          Object.keys(resolvedQueryParams).length > 0 ? resolvedQueryParams : void 0
         ).pipe(Effect5.provide(httpClientLayer));
       }
       const { result, definitions } = yield* extract(introspectionResult);
@@ -1310,9 +1215,9 @@ var makeGraphqlExtension = (ctx, httpClientLayer, configFile) => {
         scope: config.scope,
         name: displayName,
         endpoint: config.endpoint,
-        headers: canonicalHeaders.values,
-        queryParams: canonicalQueryParams.values,
-        auth: canonicalAuth.auth
+        headers: canonicalHeaders,
+        queryParams: canonicalQueryParams,
+        auth
       };
       const storedOps = prepared.map((p) => ({
         toolId: `${namespace}.${p.toolPath}`,
@@ -1335,6 +1240,23 @@ var makeGraphqlExtension = (ctx, httpClientLayer, configFile) => {
           inputSchema: p.inputSchema
         }))
       });
+      if (initialScope && initialBindings.length > 0) {
+        yield* ctx.credentialBindings.replaceForSource({
+          targetScope: ScopeId.make(initialScope),
+          pluginId: GRAPHQL_PLUGIN_ID,
+          sourceId: namespace,
+          sourceScope: ScopeId.make(config.scope),
+          slotPrefixes: [
+            ...config.credentials?.headers !== void 0 ? ["header:"] : [],
+            ...config.credentials?.queryParams !== void 0 ? ["query_param:"] : [],
+            ...config.credentials?.auth !== void 0 ? ["auth:"] : []
+          ],
+          bindings: initialBindings.map((binding) => ({
+            slotKey: binding.slot,
+            value: binding.value
+          }))
+        });
+      }
       if (Object.keys(definitions).length > 0) {
         yield* ctx.core.definitions.register({
           sourceId: namespace,
@@ -1342,25 +1264,57 @@ var makeGraphqlExtension = (ctx, httpClientLayer, configFile) => {
           definitions
         });
       }
-      if (directBindings.length > 0) {
-        for (const binding of directBindings) {
-          const bindingTargetScope2 = yield* targetScopeForBinding(
-            config.credentialTargetScope,
-            binding
-          );
-          yield* ctx.credentialBindings.set({
-            targetScope: ScopeId.make(bindingTargetScope2),
+      return { toolCount: prepared.length, namespace };
+    })
+  );
+  const configureSource = (namespace, scope, targetScope, input) => Effect5.gen(function* () {
+    const existing = yield* ctx.storage.getSource(namespace, scope);
+    if (!existing) return;
+    const canonicalHeaders = input.headers !== void 0 ? canonicalizeCredentialMap(input.headers, graphqlHeaderSlot) : null;
+    const canonicalQueryParams = input.queryParams !== void 0 ? canonicalizeCredentialMap(input.queryParams, graphqlQueryParamSlot) : null;
+    const canonicalAuth = input.auth !== void 0 ? canonicalizeAuth(input.auth) : null;
+    const directBindings = [
+      ...canonicalHeaders?.bindings ?? [],
+      ...canonicalQueryParams?.bindings ?? [],
+      ...canonicalAuth?.bindings ?? []
+    ];
+    if (directBindings.length > 0) {
+      yield* validateGraphqlBindingTarget(ctx, {
+        sourceId: namespace,
+        sourceScope: scope,
+        targetScope
+      });
+    }
+    const affectedPrefixes = [
+      ...input.headers !== void 0 ? ["header:"] : [],
+      ...input.queryParams !== void 0 ? ["query_param:"] : [],
+      ...input.auth !== void 0 ? ["auth:"] : []
+    ];
+    yield* ctx.transaction(
+      Effect5.gen(function* () {
+        yield* ctx.storage.updateSourceMeta(namespace, scope, {
+          name: input.name?.trim() || void 0,
+          endpoint: input.endpoint,
+          headers: canonicalHeaders?.values,
+          queryParams: canonicalQueryParams?.values,
+          auth: canonicalAuth?.auth
+        });
+        if (affectedPrefixes.length > 0 || directBindings.length > 0) {
+          yield* ctx.credentialBindings.replaceForSource({
+            targetScope: ScopeId.make(targetScope),
             pluginId: GRAPHQL_PLUGIN_ID,
             sourceId: namespace,
-            sourceScope: ScopeId.make(config.scope),
-            slotKey: binding.slot,
-            value: binding.value
+            sourceScope: ScopeId.make(scope),
+            slotPrefixes: affectedPrefixes,
+            bindings: directBindings.map((binding) => ({
+              slotKey: binding.slot,
+              value: binding.value
+            }))
           });
         }
-      }
-      return { toolCount: prepared.length, namespace };
-    })
-  );
+      })
+    );
+  });
   return {
     addSource: (config) => addSourceInternal(config).pipe(
       Effect5.tap(
@@ -1384,93 +1338,15 @@ var makeGraphqlExtension = (ctx, httpClientLayer, configFile) => {
       }
     }),
     getSource: (namespace, scope) => ctx.storage.getSource(namespace, scope),
-    updateSource: (namespace, scope, input) => Effect5.gen(function* () {
-      const existing = yield* ctx.storage.getSource(namespace, scope);
-      if (!existing) return;
-      const canonicalHeaders = input.headers !== void 0 ? canonicalizeCredentialMap(input.headers, graphqlHeaderSlot) : null;
-      const canonicalQueryParams = input.queryParams !== void 0 ? canonicalizeCredentialMap(input.queryParams, graphqlQueryParamSlot) : null;
-      const canonicalAuth = input.auth !== void 0 ? canonicalizeAuth(input.auth) : null;
-      const directBindings = [
-        ...canonicalHeaders?.bindings ?? [],
-        ...canonicalQueryParams?.bindings ?? [],
-        ...canonicalAuth?.bindings ?? []
-      ];
-      const targetScope = yield* bindingTargetScope(input.credentialTargetScope, directBindings);
-      if (targetScope) {
-        yield* validateGraphqlBindingTarget(ctx, {
-          sourceId: namespace,
-          sourceScope: scope,
-          targetScope
-        });
-      }
-      const affectedPrefixes = [
-        ...input.headers !== void 0 ? ["header:"] : [],
-        ...input.queryParams !== void 0 ? ["query_param:"] : [],
-        ...input.auth !== void 0 ? ["auth:"] : []
-      ];
-      const replacementTargetScope = targetScope ?? input.credentialTargetScope ?? scope;
-      yield* ctx.transaction(
-        Effect5.gen(function* () {
-          yield* ctx.storage.updateSourceMeta(namespace, scope, {
-            name: input.name?.trim() || void 0,
-            endpoint: input.endpoint,
-            headers: canonicalHeaders?.values,
-            queryParams: canonicalQueryParams?.values,
-            auth: canonicalAuth?.auth
-          });
-          if (affectedPrefixes.length > 0 || directBindings.length > 0) {
-            yield* ctx.credentialBindings.replaceForSource({
-              targetScope: ScopeId.make(replacementTargetScope),
-              pluginId: GRAPHQL_PLUGIN_ID,
-              sourceId: namespace,
-              sourceScope: ScopeId.make(scope),
-              slotPrefixes: affectedPrefixes,
-              bindings: directBindings.map((binding) => ({
-                slotKey: binding.slot,
-                value: binding.value
-              }))
-            });
-          }
-        })
-      );
-    }),
-    listSourceBindings: (sourceId, sourceScope) => listGraphqlSourceBindings(ctx, sourceId, sourceScope),
-    setSourceBinding: (input) => Effect5.gen(function* () {
-      yield* validateGraphqlBindingTarget(ctx, {
-        sourceId: input.sourceId,
-        sourceScope: input.sourceScope,
-        targetScope: input.scope
-      });
-      const binding = yield* ctx.credentialBindings.set({
-        targetScope: input.scope,
-        pluginId: GRAPHQL_PLUGIN_ID,
-        sourceId: input.sourceId,
-        sourceScope: input.sourceScope,
-        slotKey: input.slot,
-        value: input.value
-      });
-      return coreBindingToGraphqlBinding(binding);
-    }),
-    removeSourceBinding: (sourceId, sourceScope, slot, scope) => Effect5.gen(function* () {
-      yield* validateGraphqlBindingTarget(ctx, {
-        sourceId,
-        sourceScope,
-        targetScope: scope
-      });
-      yield* ctx.credentialBindings.remove({
-        targetScope: ScopeId.make(scope),
-        pluginId: GRAPHQL_PLUGIN_ID,
-        sourceId,
-        sourceScope: ScopeId.make(sourceScope),
-        slotKey: slot
-      });
-    })
+    configureSource,
+    configure: (source, input) => configureSource(source.id, source.scope, input.scope, input)
   };
 };
 var graphqlPlugin = definePlugin((options) => {
   return {
     id: "graphql",
     packageName: "@executor-js/plugin-graphql",
+    sourcePresets: graphqlPresets,
     schema: graphqlSchema,
     storage: (deps) => makeDefaultGraphqlStore(deps),
     extension: (ctx) => makeGraphqlExtension(
@@ -1478,22 +1354,90 @@ var graphqlPlugin = definePlugin((options) => {
       options?.httpClientLayer ?? ctx.httpClientLayer,
       options?.configFile
     ),
+    sourceConfigure: {
+      type: "graphql",
+      schema: SourceConfigureInputSchema,
+      configure: ({ ctx, sourceId, sourceScope, targetScope, config }) => makeGraphqlExtension(
+        ctx,
+        options?.httpClientLayer ?? ctx.httpClientLayer,
+        options?.configFile
+      ).configureSource(
+        sourceId,
+        sourceScope,
+        targetScope,
+        config
+      )
+    },
     staticSources: (self) => [
       {
         id: "graphql",
         kind: "executor",
         name: "GraphQL",
         tools: [
+          tool({
+            name: "getSource",
+            description: "Inspect an existing GraphQL source, including endpoint, auth mode, configured headers/query params, and credential slots. Use this before repairing an existing source with `graphql.configureSource`, `secrets.create`, or `oauth.start`.",
+            inputSchema: StaticGetSourceInputStandardSchema,
+            outputSchema: StaticGetSourceOutputStandardSchema,
+            execute: (input, { ctx }) => Effect5.map(
+              self.getSource(input.namespace, resolveStaticScopeInput(ctx, input.scope)),
+              (source) => ToolResult.ok({ source })
+            )
+          }),
           tool({
             name: "addSource",
-            description: "Add a GraphQL endpoint and register its operations as tools",
+            description: "Add a GraphQL endpoint and register its operations as tools. Executor chooses the source install scope (local scope locally, organization scope in cloud) and returns it as `source`. For API keys or bearer tokens, first call `executor.coreTools.secrets.create` at the user's chosen credential scope and pass secret refs through `credentials`. For OAuth, start the browser flow with `executor.coreTools.oauth.start` using `credentialScope` set to the user's chosen personal or organization credential scope, verify completion with `connections.list`, then bind the connection through `credentials` or `graphql.configureSource`.",
             annotations: {
               requiresApproval: true,
               approvalDescription: "Add a GraphQL source"
             },
             inputSchema: StaticAddSourceInputStandardSchema,
             outputSchema: StaticAddSourceOutputStandardSchema,
-            execute: (input) => self.addSource(input)
+            execute: (input, { ctx }) => {
+              const sourceScope = defaultSourceInstallScopeId(ctx.scopes);
+              if (sourceScope === null) {
+                return Effect5.succeed(
+                  graphqlToolFailure(
+                    "source_scope_unavailable",
+                    "Cannot add a GraphQL source because this executor has no source install scope."
+                  )
+                );
+              }
+              return self.addSource({ ...input, scope: sourceScope }).pipe(
+                Effect5.map(
+                  (result) => ToolResult.ok({
+                    ...result,
+                    source: { id: result.namespace, scope: sourceScope }
+                  })
+                ),
+                Effect5.catchTags({
+                  GraphqlIntrospectionError: ({ message }) => Effect5.succeed(graphqlToolFailure("graphql_introspection_failed", message)),
+                  GraphqlExtractionError: ({ message }) => Effect5.succeed(graphqlToolFailure("graphql_extraction_failed", message))
+                })
+              );
+            }
+          }),
+          tool({
+            name: "configureSource",
+            description: 'Configure an existing GraphQL source with concrete fields. Use `source` returned by `graphql.addSource` or `sources.list`. The top-level `scope` is the credential target scope for bindings; in cloud, choose the user or organization credential scope deliberately. Pass secret refs as `{kind:"secret", secretId}` and OAuth connections as `{kind:"connection", connectionId}`.',
+            annotations: {
+              requiresApproval: true,
+              approvalDescription: "Configure a GraphQL source"
+            },
+            inputSchema: StaticConfigureSourceInputStandardSchema,
+            outputSchema: StaticConfigureSourceOutputStandardSchema,
+            execute: (input, { ctx }) => {
+              const { source, ...config } = input;
+              const sourceScope = resolveStaticScopeInput(ctx, source.scope);
+              const targetScope = resolveStaticScopeInput(ctx, config.scope);
+              return Effect5.as(
+                self.configure(
+                  { id: source.id, scope: sourceScope },
+                  { ...config, scope: targetScope }
+                ),
+                ToolResult.ok({ configured: true })
+              );
+            }
           })
         ]
       }
@@ -1505,27 +1449,27 @@ var graphqlPlugin = definePlugin((options) => {
       if (!op) {
         return yield* new GraphqlInvocationError({
           message: `No GraphQL operation found for tool "${toolRow.id}"`,
-          statusCode: Option3.none()
+          statusCode: Option5.none()
         });
       }
       const source = yield* ctx.storage.getSource(op.sourceId, toolScope);
       if (!source) {
         return yield* new GraphqlInvocationError({
           message: `No GraphQL source found for "${op.sourceId}"`,
-          statusCode: Option3.none()
+          statusCode: Option5.none()
         });
       }
       const resolvedHeaders = (yield* resolveGraphqlBindingValueMap(ctx, source.headers, {
         sourceId: source.namespace,
         sourceScope: source.scope,
         missingLabel: "header",
-        makeError: (message) => new GraphqlInvocationError({ message, statusCode: Option3.none() })
+        makeError: (message) => new GraphqlInvocationError({ message, statusCode: Option5.none() })
       })) ?? {};
       const resolvedQueryParams = (yield* resolveGraphqlBindingValueMap(ctx, source.queryParams, {
         sourceId: source.namespace,
         sourceScope: source.scope,
         missingLabel: "query parameter",
-        makeError: (message) => new GraphqlInvocationError({ message, statusCode: Option3.none() })
+        makeError: (message) => new GraphqlInvocationError({ message, statusCode: Option5.none() })
       })) ?? {};
       const oauthHeader = yield* resolveGraphqlStoredOAuthHeader(
         ctx,
@@ -1542,7 +1486,28 @@ var graphqlPlugin = definePlugin((options) => {
         resolvedQueryParams,
         httpClientLayer
       );
-      return result;
+      const errors = decodeGraphqlErrors(result.errors);
+      if (errors !== void 0 && errors.length > 0) {
+        const firstMessage = extractGraphqlErrorMessage(errors);
+        return ToolResult.fail({
+          code: "graphql_errors",
+          message: firstMessage !== void 0 ? firstMessage : "GraphQL request returned errors",
+          details: { errors }
+        });
+      }
+      if (result.status < 200 || result.status >= 300) {
+        return ToolResult.fail({
+          code: "graphql_http_error",
+          status: result.status,
+          message: `GraphQL request failed with HTTP ${result.status}`,
+          details: {
+            status: result.status,
+            data: result.data,
+            errors: result.errors
+          }
+        });
+      }
+      return ToolResult.ok(result.data);
     }),
     resolveAnnotations: ({ ctx, sourceId, toolRows }) => Effect5.gen(function* () {
       const scopes = /* @__PURE__ */ new Set();
@@ -1592,7 +1557,7 @@ var graphqlPlugin = definePlugin((options) => {
         try: () => new URL(trimmed),
         catch: (cause) => cause
       }).pipe(Effect5.option);
-      if (Option3.isNone(parsed)) return null;
+      if (Option5.isNone(parsed)) return null;
       const ok = yield* introspect(trimmed).pipe(
         Effect5.provide(httpClientLayer),
         Effect5.map(() => true),
@@ -1633,4 +1598,4 @@ export {
   makeDefaultGraphqlStore,
   graphqlPlugin
 };
-//# sourceMappingURL=chunk-PO2TPM5B.js.map
+//# sourceMappingURL=chunk-7S2FM3ZF.js.map