@executor-js/plugin-graphql 1.4.33 → 1.5.0

package/dist/chunk-ADQTI2OK.js

@@ -0,0 +1,1309 @@
+import {
+  graphqlPresets
+} from "./chunk-D6E4WAYW.js";
+import {
+  AuthTemplate,
+  ExtractedField,
+  ExtractionResult,
+  GraphqlArgument,
+  GraphqlAuthRequiredError,
+  GraphqlExtractionError,
+  GraphqlIntegrationConfig,
+  GraphqlIntrospectionError,
+  GraphqlInvocationError,
+  InvocationResult,
+  OperationBinding,
+  decodeGraphqlIntegrationConfig,
+  decodeGraphqlIntegrationConfigOption
+} from "./chunk-N5GJE7R6.js";
+
+// src/sdk/introspect.ts
+import { Effect, Option, Schema } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/unstable/http";
+var INTROSPECTION_QUERY = `
+  query IntrospectionQuery {
+    __schema {
+      queryType { name }
+      mutationType { name }
+      types {
+        kind
+        name
+        description
+        fields(includeDeprecated: false) {
+          name
+          description
+          args {
+            name
+            description
+            type {
+              ...TypeRef
+            }
+            defaultValue
+          }
+          type {
+            ...TypeRef
+          }
+        }
+        inputFields {
+          name
+          description
+          type {
+            ...TypeRef
+          }
+          defaultValue
+        }
+        enumValues(includeDeprecated: false) {
+          name
+          description
+        }
+      }
+    }
+  }
+
+  fragment TypeRef on __Type {
+    kind
+    name
+    ofType {
+      kind
+      name
+      ofType {
+        kind
+        name
+        ofType {
+          kind
+          name
+          ofType {
+            kind
+            name
+            ofType {
+              kind
+              name
+              ofType {
+                kind
+                name
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+`;
+var IntrospectionTypeRefLeaf = Schema.Struct({
+  kind: Schema.String,
+  name: Schema.NullOr(Schema.String),
+  ofType: Schema.optional(Schema.Null)
+});
+var IntrospectionTypeRef5 = Schema.Struct({
+  kind: Schema.String,
+  name: Schema.NullOr(Schema.String),
+  ofType: Schema.optional(Schema.NullOr(IntrospectionTypeRefLeaf))
+});
+var IntrospectionTypeRef4 = Schema.Struct({
+  kind: Schema.String,
+  name: Schema.NullOr(Schema.String),
+  ofType: Schema.optional(Schema.NullOr(IntrospectionTypeRef5))
+});
+var IntrospectionTypeRef3 = Schema.Struct({
+  kind: Schema.String,
+  name: Schema.NullOr(Schema.String),
+  ofType: Schema.optional(Schema.NullOr(IntrospectionTypeRef4))
+});
+var IntrospectionTypeRef2 = Schema.Struct({
+  kind: Schema.String,
+  name: Schema.NullOr(Schema.String),
+  ofType: Schema.optional(Schema.NullOr(IntrospectionTypeRef3))
+});
+var IntrospectionTypeRefSchema = Schema.Struct({
+  kind: Schema.String,
+  name: Schema.NullOr(Schema.String),
+  ofType: Schema.optional(Schema.NullOr(IntrospectionTypeRef2))
+});
+var IntrospectionInputValueSchema = Schema.Struct({
+  name: Schema.String,
+  description: Schema.NullOr(Schema.String),
+  type: IntrospectionTypeRefSchema,
+  defaultValue: Schema.NullOr(Schema.String)
+});
+var IntrospectionFieldSchema = Schema.Struct({
+  name: Schema.String,
+  description: Schema.NullOr(Schema.String),
+  args: Schema.Array(IntrospectionInputValueSchema),
+  type: IntrospectionTypeRefSchema
+});
+var IntrospectionTypeSchema = Schema.Struct({
+  kind: Schema.String,
+  name: Schema.String,
+  description: Schema.NullOr(Schema.String),
+  fields: Schema.NullOr(Schema.Array(IntrospectionFieldSchema)),
+  inputFields: Schema.NullOr(Schema.Array(IntrospectionInputValueSchema)),
+  enumValues: Schema.NullOr(
+    Schema.Array(
+      Schema.Struct({
+        name: Schema.String,
+        description: Schema.NullOr(Schema.String)
+      })
+    )
+  )
+});
+var IntrospectionResultSchema = Schema.Struct({
+  __schema: Schema.Struct({
+    queryType: Schema.NullOr(Schema.Struct({ name: Schema.String })),
+    mutationType: Schema.NullOr(Schema.Struct({ name: Schema.String })),
+    types: Schema.Array(IntrospectionTypeSchema)
+  })
+});
+var IntrospectionResponseSchema = Schema.Struct({
+  data: Schema.optional(IntrospectionResultSchema),
+  errors: Schema.optional(Schema.Array(Schema.Unknown))
+});
+var UpstreamErrorResponseSchema = Schema.Struct({
+  message: Schema.optional(Schema.String),
+  errors: Schema.optional(
+    Schema.Array(
+      Schema.Struct({
+        message: Schema.optional(Schema.String)
+      })
+    )
+  )
+});
+var IntrospectionJsonSchema = Schema.Union([
+  Schema.Struct({ data: IntrospectionResultSchema }),
+  IntrospectionResultSchema
+]);
+var JsonTextSchema = Schema.fromJsonString(Schema.Unknown);
+var decodeUpstreamErrorResponse = Schema.decodeUnknownOption(UpstreamErrorResponseSchema);
+var firstUpstreamErrorMessage = (value) => {
+  const decoded = decodeUpstreamErrorResponse(value);
+  return Option.match(decoded, {
+    onNone: () => null,
+    onSome: (response) => {
+      if (response.message) return response.message;
+      for (const entry of response.errors ?? []) {
+        const message = entry.message;
+        if (message) return message;
+      }
+      return null;
+    }
+  });
+};
+var redactUpstreamBody = (body) => body.replaceAll(
+  /("(?:access_token|refresh_token|id_token|client_secret|token|authorization)"\s*:\s*")[^"]*(")/gi,
+  "$1[redacted]$2"
+).replaceAll(
+  /((?:access_token|refresh_token|id_token|client_secret|token|authorization)=)[^&\s]*/gi,
+  "$1[redacted]"
+).replaceAll(
+  /((?:authorization|access-token|refresh-token|id-token|client-secret|token)\s*:\s*)(?:bearer\s+)?[^\s,;]+/gi,
+  "$1[redacted]"
+);
+var upstreamTextMessage = (body) => {
+  const text = redactUpstreamBody(body.replaceAll(/\s+/g, " ").trim());
+  if (text.length === 0) return null;
+  return text.length > 500 ? `${text.slice(0, 500)}...` : text;
+};
+var introspect = Effect.fn("GraphQL.introspect")(function* (endpoint, headers, queryParams) {
+  const client = yield* HttpClient.HttpClient;
+  const requestEndpoint = queryParams && Object.keys(queryParams).length > 0 ? (() => {
+    const url = new URL(endpoint);
+    for (const [name, value] of Object.entries(queryParams)) {
+      url.searchParams.set(name, value);
+    }
+    return url.toString();
+  })() : endpoint;
+  let request = HttpClientRequest.post(requestEndpoint).pipe(
+    HttpClientRequest.setHeader("Content-Type", "application/json"),
+    HttpClientRequest.setHeader("Accept", "application/json"),
+    HttpClientRequest.setHeader("User-Agent", "executor-graphql"),
+    HttpClientRequest.bodyJsonUnsafe({
+      query: INTROSPECTION_QUERY
+    })
+  );
+  if (headers) {
+    for (const [k, v] of Object.entries(headers)) {
+      request = HttpClientRequest.setHeader(request, k, v);
+    }
+  }
+  const response = yield* client.execute(request).pipe(
+    Effect.tapCause((cause) => Effect.logError("graphql introspection request failed", cause)),
+    Effect.mapError(
+      () => new GraphqlIntrospectionError({
+        message: "Failed to reach GraphQL endpoint"
+      })
+    )
+  );
+  if (response.status !== 200) {
+    const responseText = yield* response.text.pipe(Effect.catch(() => Effect.succeed("")));
+    const raw2 = responseText ? yield* Schema.decodeUnknownEffect(JsonTextSchema)(responseText).pipe(
+      Effect.catch(() => Effect.succeed(null))
+    ) : null;
+    const upstreamMessage = upstreamTextMessage(
+      (raw2 === null ? null : firstUpstreamErrorMessage(raw2)) ?? responseText
+    );
+    return yield* new GraphqlIntrospectionError({
+      message: upstreamMessage ? `Introspection failed with status ${response.status}: ${upstreamMessage}` : `Introspection failed with status ${response.status}`
+    });
+  }
+  const raw = yield* response.json.pipe(
+    Effect.tapCause((cause) => Effect.logError("graphql introspection JSON parse failed", cause)),
+    Effect.mapError(
+      () => new GraphqlIntrospectionError({
+        message: `Failed to parse introspection response as JSON`
+      })
+    )
+  );
+  const json = yield* Schema.decodeUnknownEffect(IntrospectionResponseSchema)(raw).pipe(
+    Effect.mapError(
+      () => new GraphqlIntrospectionError({
+        message: "Introspection response has an invalid shape"
+      })
+    )
+  );
+  if (json.errors && Array.isArray(json.errors) && json.errors.length > 0) {
+    const upstreamMessage = firstUpstreamErrorMessage(json);
+    return yield* new GraphqlIntrospectionError({
+      message: upstreamMessage ? `Introspection returned ${json.errors.length} error(s): ${upstreamMessage}` : `Introspection returned ${json.errors.length} error(s)`
+    });
+  }
+  if (!json.data?.__schema) {
+    return yield* new GraphqlIntrospectionError({
+      message: "Introspection response missing __schema"
+    });
+  }
+  return json.data;
+});
+var parseIntrospectionJson = (text) => Schema.decodeUnknownEffect(Schema.fromJsonString(IntrospectionJsonSchema))(text).pipe(
+  Effect.map((parsed) => "data" in parsed ? parsed.data : parsed),
+  Effect.mapError(
+    () => new GraphqlIntrospectionError({
+      message: "Failed to parse introspection JSON"
+    })
+  )
+);
+
+// src/sdk/extract.ts
+import { Effect as Effect2, Match, Option as Option2 } from "effect";
+var unwrapTypeName = (ref) => {
+  if (ref.name) return ref.name;
+  if (ref.ofType) return unwrapTypeName(ref.ofType);
+  return "Unknown";
+};
+var isNonNull = (ref) => ref.kind === "NON_NULL";
+var buildDefinitions = (types) => {
+  const defs = {};
+  for (const [name, type] of types) {
+    if (name.startsWith("__")) continue;
+    if (type.kind === "INPUT_OBJECT" && type.inputFields) {
+      const properties = {};
+      const required = [];
+      for (const field of type.inputFields) {
+        const schema = typeRefToJsonSchema(field.type, types);
+        if (field.description) {
+          schema.description = field.description;
+        }
+        properties[field.name] = schema;
+        if (isNonNull(field.type)) {
+          required.push(field.name);
+        }
+      }
+      const def = { type: "object", properties };
+      if (required.length > 0) def.required = required;
+      if (type.description) def.description = type.description;
+      defs[name] = def;
+    }
+    if (type.kind === "ENUM" && type.enumValues) {
+      defs[name] = {
+        type: "string",
+        enum: type.enumValues.map((v) => v.name),
+        ...type.description ? { description: type.description } : {}
+      };
+    }
+  }
+  return defs;
+};
+var typeRefToJsonSchema = (ref, types) => Match.value(ref.kind).pipe(
+  Match.when(
+    "NON_NULL",
+    () => ref.ofType ? typeRefToJsonSchema(ref.ofType, types) : {}
+  ),
+  Match.when(
+    "LIST",
+    () => ({
+      type: "array",
+      items: ref.ofType ? typeRefToJsonSchema(ref.ofType, types) : {}
+    })
+  ),
+  Match.when("SCALAR", () => scalarToJsonSchema(ref.name ?? "String")),
+  Match.when(
+    "ENUM",
+    () => ref.name ? { $ref: `#/$defs/${ref.name}` } : { type: "string" }
+  ),
+  Match.when(
+    "INPUT_OBJECT",
+    () => ref.name ? { $ref: `#/$defs/${ref.name}` } : { type: "object" }
+  ),
+  Match.whenOr(
+    "OBJECT",
+    "INTERFACE",
+    "UNION",
+    () => ({ type: "object" })
+  ),
+  Match.option,
+  Option2.getOrElse(() => ({}))
+);
+var scalarToJsonSchema = (name) => Match.value(name).pipe(
+  Match.whenOr("String", "ID", () => ({ type: "string" })),
+  Match.when("Int", () => ({ type: "integer" })),
+  Match.when("Float", () => ({ type: "number" })),
+  Match.when("Boolean", () => ({ type: "boolean" })),
+  Match.option,
+  Option2.getOrElse(
+    () => ({ type: "string", description: `Custom scalar: ${name}` })
+  )
+);
+var buildInputSchema = (args, types) => {
+  if (args.length === 0) return void 0;
+  const properties = {};
+  const required = [];
+  for (const arg of args) {
+    const schema = typeRefToJsonSchema(arg.type, types);
+    if (arg.description) {
+      schema.description = arg.description;
+    }
+    properties[arg.name] = schema;
+    if (isNonNull(arg.type)) {
+      required.push(arg.name);
+    }
+  }
+  const inputSchema = {
+    type: "object",
+    properties
+  };
+  if (required.length > 0) inputSchema.required = required;
+  return inputSchema;
+};
+var formatTypeRef = (ref) => Match.value(ref.kind).pipe(
+  Match.when("NON_NULL", () => ref.ofType ? `${formatTypeRef(ref.ofType)}!` : "Unknown!"),
+  Match.when("LIST", () => ref.ofType ? `[${formatTypeRef(ref.ofType)}]` : "[Unknown]"),
+  Match.option,
+  Option2.getOrElse(() => ref.name ?? "Unknown")
+);
+var extractFields = (_schema, kind, typeName, types) => {
+  if (!typeName) return [];
+  const type = types.get(typeName);
+  if (!type?.fields) return [];
+  return type.fields.filter((f) => !f.name.startsWith("__")).map((field) => {
+    const args = field.args.map(
+      (arg) => GraphqlArgument.make({
+        name: arg.name,
+        typeName: formatTypeRef(arg.type),
+        required: isNonNull(arg.type),
+        description: arg.description ? Option2.some(arg.description) : Option2.none()
+      })
+    );
+    const inputSchema = buildInputSchema(field.args, types);
+    return ExtractedField.make({
+      fieldName: field.name,
+      kind,
+      description: field.description ? Option2.some(field.description) : Option2.none(),
+      arguments: args,
+      inputSchema: inputSchema ? Option2.some(inputSchema) : Option2.none(),
+      returnTypeName: unwrapTypeName(field.type)
+    });
+  });
+};
+var extract = (introspection) => Effect2.try({
+  try: () => {
+    const schema = introspection.__schema;
+    const typeMap = /* @__PURE__ */ new Map();
+    for (const t of schema.types) {
+      typeMap.set(t.name, t);
+    }
+    const definitions = buildDefinitions(typeMap);
+    const queryFields = extractFields(schema, "query", schema.queryType?.name, typeMap);
+    const mutationFields = extractFields(schema, "mutation", schema.mutationType?.name, typeMap);
+    return {
+      result: ExtractionResult.make({
+        schemaName: Option2.none(),
+        fields: [...queryFields, ...mutationFields]
+      }),
+      definitions
+    };
+  },
+  catch: () => new GraphqlExtractionError({
+    message: "Failed to extract GraphQL schema"
+  })
+});
+
+// src/sdk/invoke.ts
+import { Effect as Effect3, Option as Option3 } from "effect";
+import { HttpClient as HttpClient2, HttpClientRequest as HttpClientRequest2 } from "effect/unstable/http";
+var endpointWithQueryParams = (endpoint, queryParams) => {
+  if (Object.keys(queryParams).length === 0) return endpoint;
+  const url = new URL(endpoint);
+  for (const [name, value] of Object.entries(queryParams)) {
+    url.searchParams.set(name, value);
+  }
+  return url.toString();
+};
+var endpointForTelemetry = (endpoint) => {
+  if (!URL.canParse(endpoint)) return endpoint;
+  const url = new URL(endpoint);
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+};
+var isJsonContentType = (ct) => {
+  if (!ct) return false;
+  const normalized = ct.split(";")[0]?.trim().toLowerCase() ?? "";
+  return normalized === "application/json" || normalized.includes("+json") || normalized.includes("json");
+};
+var invoke = Effect3.fn("GraphQL.invoke")(function* (operation, args, endpoint, resolvedHeaders, resolvedQueryParams = {}) {
+  const client = yield* HttpClient2.HttpClient;
+  const requestEndpoint = endpointWithQueryParams(endpoint, resolvedQueryParams);
+  const telemetryEndpoint = endpointForTelemetry(endpoint);
+  yield* Effect3.annotateCurrentSpan({
+    "http.method": "POST",
+    "http.url": telemetryEndpoint,
+    "plugin.graphql.endpoint": telemetryEndpoint,
+    "plugin.graphql.operation_kind": operation.kind,
+    "plugin.graphql.field_name": operation.fieldName,
+    "plugin.graphql.headers.resolved_count": Object.keys(resolvedHeaders).length,
+    "plugin.graphql.query_params.resolved_count": Object.keys(resolvedQueryParams).length
+  });
+  const variables = {};
+  for (const varName of operation.variableNames) {
+    if (args[varName] !== void 0) {
+      variables[varName] = args[varName];
+    }
+  }
+  if (typeof args.variables === "object" && args.variables !== null) {
+    Object.assign(variables, args.variables);
+  }
+  let request = HttpClientRequest2.post(requestEndpoint).pipe(
+    HttpClientRequest2.setHeader("Content-Type", "application/json"),
+    HttpClientRequest2.bodyJsonUnsafe({
+      query: operation.operationString,
+      variables: Object.keys(variables).length > 0 ? variables : void 0
+    })
+  );
+  for (const [name, value] of Object.entries(resolvedHeaders)) {
+    request = HttpClientRequest2.setHeader(request, name, value);
+  }
+  const response = yield* client.execute(request).pipe(
+    Effect3.mapError(
+      (err) => new GraphqlInvocationError({
+        message: "GraphQL request failed",
+        statusCode: Option3.none(),
+        cause: err
+      })
+    )
+  );
+  const status = response.status;
+  const contentType = response.headers["content-type"] ?? null;
+  const body = isJsonContentType(contentType) ? yield* response.json.pipe(Effect3.catch(() => response.text)) : yield* response.text;
+  const gqlBody = body;
+  const hasErrors = Array.isArray(gqlBody?.errors) && gqlBody.errors.length > 0;
+  yield* Effect3.annotateCurrentSpan({
+    "http.status_code": status,
+    "plugin.graphql.has_errors": hasErrors,
+    "plugin.graphql.error_count": hasErrors ? gqlBody.errors.length : 0
+  });
+  return InvocationResult.make({
+    status,
+    data: gqlBody?.data ?? null,
+    errors: hasErrors ? gqlBody.errors : null
+  });
+});
+var invokeWithLayer = (operation, args, endpoint, resolvedHeaders, resolvedQueryParams, httpClientLayer) => invoke(operation, args, endpoint, resolvedHeaders, resolvedQueryParams).pipe(
+  Effect3.provide(httpClientLayer),
+  Effect3.withSpan("plugin.graphql.invoke", {
+    attributes: {
+      "plugin.graphql.endpoint": endpointForTelemetry(endpoint),
+      "plugin.graphql.operation_kind": operation.kind,
+      "plugin.graphql.field_name": operation.fieldName
+    }
+  })
+);
+
+// src/sdk/store.ts
+import { Effect as Effect4, Option as Option4, Predicate, Schema as Schema2 } from "effect";
+var CATALOG_OWNER = "org";
+var OPERATION_COLLECTION = "operation";
+var OperationBindingFromJsonString = Schema2.fromJsonString(OperationBinding);
+var decodeOperationBindingFromJsonString = Schema2.decodeUnknownSync(
+  OperationBindingFromJsonString
+);
+var decodeOperationBinding = Schema2.decodeUnknownSync(OperationBinding);
+var encodeBinding = Schema2.encodeSync(OperationBinding);
+var decodeBinding = (value) => {
+  if (typeof value === "string") return decodeOperationBindingFromJsonString(value);
+  return decodeOperationBinding(value);
+};
+var toJsonRecord = (value) => value;
+var OperationStorage = Schema2.Struct({
+  toolName: Schema2.String,
+  integration: Schema2.String,
+  binding: Schema2.Unknown
+});
+var decodeOperationStorage = Schema2.decodeUnknownOption(OperationStorage);
+var operationKey = (integration, toolName) => `${integration}.${toolName}`;
+var operationData = (operation) => ({
+  toolName: operation.toolName,
+  integration: operation.integration,
+  binding: toJsonRecord(encodeBinding(operation.binding))
+});
+var rowToOperation = (row) => {
+  const decoded = decodeOperationStorage(row.data);
+  if (Option4.isNone(decoded)) return null;
+  const operation = decoded.value;
+  return {
+    toolName: operation.toolName,
+    integration: operation.integration,
+    binding: decodeBinding(operation.binding)
+  };
+};
+var makeDefaultGraphqlStore = ({ pluginStorage }) => {
+  const listOperationRows = (integration) => pluginStorage.list({
+    collection: OPERATION_COLLECTION,
+    keyPrefix: `${integration}.`
+  }).pipe(
+    Effect4.map(
+      (rows) => rows.filter((row) => rowToOperation(row)?.integration === integration)
+    )
+  );
+  const removeOperations = (integration) => Effect4.gen(function* () {
+    const rows = yield* listOperationRows(integration);
+    for (const row of rows) {
+      yield* pluginStorage.remove({
+        owner: CATALOG_OWNER,
+        collection: OPERATION_COLLECTION,
+        key: row.key
+      });
+    }
+  });
+  return {
+    replaceOperations: (integration, operations) => Effect4.gen(function* () {
+      yield* removeOperations(integration);
+      for (const operation of operations) {
+        yield* pluginStorage.put({
+          owner: CATALOG_OWNER,
+          collection: OPERATION_COLLECTION,
+          key: operationKey(integration, operation.toolName),
+          data: operationData(operation)
+        });
+      }
+    }),
+    getOperation: (integration, toolName) => pluginStorage.get({ collection: OPERATION_COLLECTION, key: operationKey(integration, toolName) }).pipe(Effect4.map((row) => row ? rowToOperation(row) : null)),
+    listOperations: (integration) => listOperationRows(integration).pipe(
+      Effect4.map((rows) => rows.map(rowToOperation).filter(Predicate.isNotNull))
+    ),
+    removeOperations
+  };
+};
+
+// src/sdk/plugin.ts
+import { Effect as Effect5, Match as Match2, Option as Option5, Schema as Schema3 } from "effect";
+import { FetchHttpClient } from "effect/unstable/http";
+import {
+  authToolFailure,
+  definePlugin,
+  IntegrationAlreadyExistsError,
+  IntegrationDetectionResult,
+  IntegrationSlug,
+  ToolName,
+  ToolResult
+} from "@executor-js/sdk/core";
+var GraphqlErrorBody = Schema3.Struct({ message: Schema3.String });
+var GraphqlErrorsBody = Schema3.Array(Schema3.Unknown);
+var decodeGraphqlErrorBody = Schema3.decodeUnknownOption(GraphqlErrorBody);
+var decodeGraphqlErrorsBody = Schema3.decodeUnknownOption(GraphqlErrorsBody);
+var decodeGraphqlErrors = (errors) => Option5.getOrUndefined(decodeGraphqlErrorsBody(errors));
+var extractGraphqlErrorMessage = (errors) => errors.map((error) => Option5.getOrUndefined(decodeGraphqlErrorBody(error))?.message).find((message) => message !== void 0 && message.length > 0);
+var GRAPHQL_PLUGIN_ID = "graphql";
+var AuthTemplateSchema = AuthTemplate;
+var GraphqlAddIntegrationInputSchema = Schema3.Struct({
+  endpoint: Schema3.String,
+  slug: Schema3.optional(Schema3.String),
+  name: Schema3.optional(Schema3.String),
+  introspectionJson: Schema3.optional(Schema3.String),
+  headers: Schema3.optional(Schema3.Record(Schema3.String, Schema3.String)),
+  queryParams: Schema3.optional(Schema3.Record(Schema3.String, Schema3.String)),
+  authenticationTemplate: Schema3.optional(Schema3.Array(AuthTemplateSchema))
+});
+var GraphqlConfigureInputSchema = Schema3.Struct({
+  name: Schema3.optional(Schema3.String),
+  endpoint: Schema3.optional(Schema3.String),
+  headers: Schema3.optional(Schema3.Record(Schema3.String, Schema3.String)),
+  queryParams: Schema3.optional(Schema3.Record(Schema3.String, Schema3.String)),
+  authenticationTemplate: Schema3.optional(Schema3.Array(AuthTemplateSchema))
+});
+var GraphqlConfigureAuthInputSchema = Schema3.Struct({
+  authenticationTemplate: Schema3.Array(AuthTemplateSchema),
+  mode: Schema3.optional(Schema3.Literals(["merge", "replace"]))
+});
+var StaticAddIntegrationOutputSchema = Schema3.Struct({
+  slug: Schema3.String,
+  name: Schema3.String
+});
+var StaticGetIntegrationInputSchema = Schema3.Struct({
+  slug: Schema3.String
+});
+var StaticGetIntegrationOutputSchema = Schema3.Struct({
+  integration: Schema3.NullOr(Schema3.Unknown)
+});
+var StaticAddIntegrationInputStandardSchema = Schema3.toStandardSchemaV1(
+  Schema3.toStandardJSONSchemaV1(GraphqlAddIntegrationInputSchema)
+);
+var StaticAddIntegrationOutputStandardSchema = Schema3.toStandardSchemaV1(
+  Schema3.toStandardJSONSchemaV1(StaticAddIntegrationOutputSchema)
+);
+var StaticGetIntegrationInputStandardSchema = Schema3.toStandardSchemaV1(
+  Schema3.toStandardJSONSchemaV1(StaticGetIntegrationInputSchema)
+);
+var StaticGetIntegrationOutputStandardSchema = Schema3.toStandardSchemaV1(
+  Schema3.toStandardJSONSchemaV1(StaticGetIntegrationOutputSchema)
+);
+var graphqlToolFailure = (code, message, details) => ToolResult.fail({
+  code,
+  message,
+  ...details === void 0 ? {} : { details }
+});
+var graphqlAuthToolFailure = (failure) => authToolFailure({
+  code: failure.code,
+  message: failure.message,
+  source: { id: failure.integration, scope: failure.owner },
+  credential: {
+    kind: failure.credentialKind,
+    ...failure.credentialLabel ? { label: failure.credentialLabel } : {},
+    connectionId: failure.connection
+  },
+  ...failure.status !== void 0 ? { status: failure.status } : {},
+  ...failure.details !== void 0 ? {
+    upstream: {
+      ...failure.status !== void 0 ? { status: failure.status } : {},
+      details: failure.details
+    }
+  } : {}
+});
+var urlMatchesToken = (url, token) => {
+  const re = new RegExp(`(?:^|[^a-z0-9])${token}(?:$|[^a-z0-9])`, "i");
+  return re.test(url.hostname) || re.test(url.pathname);
+};
+var slugFromEndpoint = (endpoint) => {
+  try {
+    const url = new URL(endpoint);
+    return url.hostname.replace(/[^a-z0-9]+/gi, "_").toLowerCase();
+  } catch {
+    return "graphql";
+  }
+};
+var formatTypeRef2 = (ref) => Match2.value(ref.kind).pipe(
+  Match2.when("NON_NULL", () => ref.ofType ? `${formatTypeRef2(ref.ofType)}!` : "Unknown!"),
+  Match2.when("LIST", () => ref.ofType ? `[${formatTypeRef2(ref.ofType)}]` : "[Unknown]"),
+  Match2.option,
+  Option5.getOrElse(() => ref.name ?? "Unknown")
+);
+var unwrapTypeName2 = (ref) => {
+  if (ref.name) return ref.name;
+  if (ref.ofType) return unwrapTypeName2(ref.ofType);
+  return "Unknown";
+};
+var buildSelectionSet = (ref, types, depth, seen) => {
+  if (depth > 2) return "";
+  const leafName = unwrapTypeName2(ref);
+  if (seen.has(leafName)) return "";
+  const objectType = types.get(leafName);
+  if (!objectType?.fields) return "";
+  const kind = objectType.kind;
+  if (kind === "SCALAR" || kind === "ENUM") return "";
+  seen.add(leafName);
+  const subFields = objectType.fields.filter((f) => !f.name.startsWith("__")).slice(0, 12).map((f) => {
+    const sub = buildSelectionSet(f.type, types, depth + 1, seen);
+    return sub ? `${f.name} ${sub}` : f.name;
+  });
+  seen.delete(leafName);
+  return subFields.length > 0 ? `{ ${subFields.join(" ")} }` : "";
+};
+var operationNameForField = (fieldName) => fieldName.charAt(0).toUpperCase() + fieldName.slice(1);
+var buildOperationStringForField = (kind, field, types) => {
+  const opType = kind === "query" ? "query" : "mutation";
+  const opName = operationNameForField(field.name);
+  const varDefs = field.args.map((arg) => {
+    const typeName = formatTypeRef2(arg.type);
+    return `$${arg.name}: ${typeName}`;
+  });
+  const argPasses = field.args.map((arg) => `${arg.name}: $${arg.name}`);
+  const selectionSet = buildSelectionSet(field.type, types, 0, /* @__PURE__ */ new Set());
+  const varDefsStr = varDefs.length > 0 ? `(${varDefs.join(", ")})` : "";
+  const argPassStr = argPasses.length > 0 ? `(${argPasses.join(", ")})` : "";
+  return `${opType} ${opName}${varDefsStr} { ${field.name}${argPassStr}${selectionSet ? ` ${selectionSet}` : ""} }`;
+};
+var prepareOperations = (fields, introspection) => {
+  const typeMap = /* @__PURE__ */ new Map();
+  for (const t of introspection.__schema.types) {
+    typeMap.set(t.name, t);
+  }
+  const fieldMap = /* @__PURE__ */ new Map();
+  const schema = introspection.__schema;
+  for (const rootKind of ["query", "mutation"]) {
+    const typeName = rootKind === "query" ? schema.queryType?.name : schema.mutationType?.name;
+    if (!typeName) continue;
+    const rootType = typeMap.get(typeName);
+    if (!rootType?.fields) continue;
+    for (const f of rootType.fields) {
+      if (!f.name.startsWith("__")) {
+        fieldMap.set(`${rootKind}.${f.name}`, { kind: rootKind, field: f });
+      }
+    }
+  }
+  return fields.map((extracted) => {
+    const prefix = extracted.kind === "mutation" ? "mutation" : "query";
+    const toolName = `${prefix}.${extracted.fieldName}`;
+    const description = Option5.getOrElse(
+      extracted.description,
+      () => `GraphQL ${extracted.kind}: ${extracted.fieldName} -> ${extracted.returnTypeName}`
+    );
+    const key = `${extracted.kind}.${extracted.fieldName}`;
+    const entry = fieldMap.get(key);
+    const operationString = entry ? buildOperationStringForField(entry.kind, entry.field, typeMap) : `${extracted.kind} ${operationNameForField(extracted.fieldName)} { ${extracted.fieldName} }`;
+    const binding = OperationBinding.make({
+      kind: extracted.kind,
+      fieldName: extracted.fieldName,
+      operationString,
+      variableNames: extracted.arguments.map((a) => a.name)
+    });
+    return {
+      toolName,
+      description,
+      inputSchema: Option5.getOrUndefined(extracted.inputSchema),
+      binding
+    };
+  });
+};
+var annotationsFor = (binding) => {
+  if (binding.kind === "mutation") {
+    return {
+      requiresApproval: true,
+      approvalDescription: `mutation ${binding.fieldName}`
+    };
+  }
+  return {};
+};
+var renderAuthTemplate = (template, value) => {
+  if (template.kind === "oauth2") {
+    const header = template.header ?? "Authorization";
+    const prefix = template.prefix ?? "Bearer ";
+    return { headers: { [header]: `${prefix}${value}` }, queryParams: {} };
+  }
+  const rendered = template.prefix ? `${template.prefix}${value}` : value;
+  if (template.in === "query") {
+    return { headers: {}, queryParams: { [template.name]: rendered } };
+  }
+  return { headers: { [template.name]: rendered }, queryParams: {} };
+};
+var buildToolDefs = (prepared) => prepared.map((p) => ({
+  name: ToolName.make(p.toolName),
+  description: p.description,
+  inputSchema: p.inputSchema,
+  annotations: annotationsFor(p.binding)
+}));
+var toStoredOperations = (slug, prepared) => prepared.map((p) => ({
+  toolName: p.toolName,
+  integration: String(slug),
+  binding: p.binding
+}));
+var introspectHeadersForConnection = (config, credentialValue) => {
+  const headers = { ...config.headers ?? {} };
+  const queryParams = { ...config.queryParams ?? {} };
+  if (credentialValue !== null) {
+    const template = config.authenticationTemplate[0];
+    if (template) {
+      const rendered = renderAuthTemplate(template, credentialValue);
+      Object.assign(headers, rendered.headers);
+      Object.assign(queryParams, rendered.queryParams);
+    }
+  }
+  return { headers, queryParams };
+};
+var introspectForConnection = (config, credentialValue, httpClientLayer) => {
+  if (config.introspectionJson) {
+    return parseIntrospectionJson(config.introspectionJson);
+  }
+  const auth = introspectHeadersForConnection(config, credentialValue);
+  return introspect(
+    config.endpoint,
+    Object.keys(auth.headers).length > 0 ? auth.headers : void 0,
+    Object.keys(auth.queryParams).length > 0 ? auth.queryParams : void 0
+  ).pipe(Effect5.provide(httpClientLayer));
+};
+var materializeOperations = (ctx, integration, config, credential, httpClientLayer) => Effect5.gen(function* () {
+  const template = config.authenticationTemplate.find(
+    (t) => t.slug === String(credential.template)
+  );
+  const headers = { ...config.headers ?? {} };
+  const queryParams = {
+    ...config.queryParams ?? {}
+  };
+  if (template && credential.value !== null) {
+    const rendered = renderAuthTemplate(template, credential.value);
+    Object.assign(headers, rendered.headers);
+    Object.assign(queryParams, rendered.queryParams);
+  }
+  const introspection = config.introspectionJson ? yield* parseIntrospectionJson(config.introspectionJson) : yield* introspect(
+    config.endpoint,
+    Object.keys(headers).length > 0 ? headers : void 0,
+    Object.keys(queryParams).length > 0 ? queryParams : void 0
+  ).pipe(Effect5.provide(httpClientLayer));
+  const { result } = yield* extract(introspection).pipe(
+    Effect5.catch(
+      () => Effect5.succeed({
+        result: { fields: [] }
+      })
+    )
+  );
+  const prepared = prepareOperations(result.fields, introspection);
+  const stored = toStoredOperations(IntegrationSlug.make(integration), prepared);
+  yield* ctx.storage.replaceOperations(integration, stored);
+  return stored;
+});
+var graphqlApiKeyLabel = (placement) => `API key (${placement.name || (placement.carrier === "header" ? "header" : "query")})`;
+var describeGraphqlAuthMethods = (record) => {
+  const config = Option5.getOrUndefined(decodeGraphqlIntegrationConfigOption(record.config));
+  if (!config) return [];
+  return config.authenticationTemplate.map((template) => {
+    const slug = template.slug;
+    if (template.kind === "oauth2") {
+      return {
+        id: slug,
+        label: "OAuth",
+        kind: "oauth",
+        template: slug,
+        oauth: {}
+      };
+    }
+    const placement = {
+      carrier: template.in,
+      name: template.name,
+      prefix: template.prefix ?? ""
+    };
+    return {
+      id: slug,
+      label: graphqlApiKeyLabel(placement),
+      kind: "apikey",
+      template: slug,
+      placements: [placement]
+    };
+  });
+};
+var describeGraphqlIntegrationDisplay = (record) => {
+  const config = Option5.getOrUndefined(decodeGraphqlIntegrationConfigOption(record.config));
+  return { url: config?.endpoint };
+};
+var shortId = () => Math.random().toString(36).slice(2, 8);
+var freshCustomSlug = (taken) => {
+  let candidate = `custom_${shortId()}`;
+  while (taken.has(candidate)) candidate = `custom_${shortId()}`;
+  return candidate;
+};
+var mergeGraphqlAuthTemplate = (existing, incoming) => {
+  const result = existing.map((entry) => entry);
+  const taken = new Set(result.map((entry) => entry.slug));
+  for (const entry of incoming) {
+    const requested = entry.slug.trim();
+    const existingIndex = result.findIndex((current) => current.slug === requested);
+    if (requested.length > 0 && existingIndex >= 0) {
+      result[existingIndex] = entry;
+      continue;
+    }
+    const slug = requested.length > 0 && !taken.has(requested) ? requested : freshCustomSlug(taken);
+    taken.add(slug);
+    result.push({ ...entry, slug });
+  }
+  return result;
+};
+var makeGraphqlExtension = (ctx) => {
+  const buildConfig = (input) => GraphqlIntegrationConfig.make({
+    endpoint: input.endpoint,
+    name: input.name?.trim() || slugFromEndpoint(input.endpoint),
+    ...input.introspectionJson !== void 0 ? { introspectionJson: input.introspectionJson } : {},
+    ...input.headers !== void 0 ? { headers: input.headers } : {},
+    ...input.queryParams !== void 0 ? { queryParams: input.queryParams } : {},
+    authenticationTemplate: input.authenticationTemplate ?? []
+  });
+  const addIntegrationInternal = (input) => Effect5.gen(function* () {
+    const slug = IntegrationSlug.make(input.slug ?? slugFromEndpoint(input.endpoint));
+    const existing = yield* ctx.core.integrations.get(slug);
+    if (existing) {
+      return yield* new IntegrationAlreadyExistsError({ slug });
+    }
+    return yield* addIntegrationTransaction(input, slug);
+  });
+  const addIntegrationTransaction = (input, slug) => ctx.transaction(
+    Effect5.gen(function* () {
+      const baseConfig = buildConfig(input);
+      if (baseConfig.introspectionJson === void 0) {
+        yield* ctx.core.integrations.register({
+          slug,
+          description: baseConfig.name,
+          config: baseConfig,
+          canRemove: true,
+          canRefresh: true
+        });
+        return { slug: String(slug), name: baseConfig.name, toolCount: 0 };
+      }
+      const introspection = yield* parseIntrospectionJson(baseConfig.introspectionJson);
+      const { result } = yield* extract(introspection);
+      const prepared = prepareOperations(result.fields, introspection);
+      const config = GraphqlIntegrationConfig.make({
+        ...baseConfig,
+        introspectionJson: JSON.stringify({ data: introspection })
+      });
+      yield* ctx.storage.replaceOperations(String(slug), toStoredOperations(slug, prepared));
+      yield* ctx.core.integrations.register({
+        slug,
+        description: config.name,
+        config,
+        canRemove: true,
+        canRefresh: true
+      });
+      return {
+        slug: String(slug),
+        name: config.name,
+        toolCount: prepared.length
+      };
+    })
+  );
+  const configureIntegration = (slug, input) => Effect5.gen(function* () {
+    const record = yield* ctx.core.integrations.get(IntegrationSlug.make(slug));
+    if (!record) return;
+    const current = Option5.getOrElse(
+      // best-effort: re-decode the stored config, falling back to an
+      // endpoint-only config if it was never set.
+      yield* decodeGraphqlIntegrationConfig(record.config).pipe(Effect5.option),
+      () => GraphqlIntegrationConfig.make({
+        endpoint: "",
+        name: record.description,
+        authenticationTemplate: []
+      })
+    );
+    const next = GraphqlIntegrationConfig.make({
+      endpoint: input.endpoint ?? current.endpoint,
+      name: input.name?.trim() || current.name,
+      ...current.introspectionJson !== void 0 ? { introspectionJson: current.introspectionJson } : {},
+      ...(input.headers ?? current.headers) !== void 0 ? { headers: input.headers ?? current.headers } : {},
+      ...(input.queryParams ?? current.queryParams) !== void 0 ? { queryParams: input.queryParams ?? current.queryParams } : {},
+      authenticationTemplate: input.authenticationTemplate ?? current.authenticationTemplate
+    });
+    yield* ctx.core.integrations.update(IntegrationSlug.make(slug), {
+      description: next.name,
+      config: next
+    });
+  });
+  const getConfig = (slug) => ctx.core.integrations.get(IntegrationSlug.make(slug)).pipe(
+    Effect5.map(
+      (record) => record ? Option5.getOrNull(decodeGraphqlIntegrationConfigOption(record.config)) : null
+    )
+  );
+  const configureAuthMethods = (slug, input) => ctx.transaction(
+    Effect5.gen(function* () {
+      const record = yield* ctx.core.integrations.get(IntegrationSlug.make(slug));
+      if (!record) return [];
+      const current = Option5.getOrNull(decodeGraphqlIntegrationConfigOption(record.config));
+      if (!current) return [];
+      const merged = input.mode === "replace" ? input.authenticationTemplate : mergeGraphqlAuthTemplate(
+        current.authenticationTemplate,
+        input.authenticationTemplate
+      );
+      const next = GraphqlIntegrationConfig.make({
+        ...current,
+        authenticationTemplate: merged
+      });
+      yield* ctx.core.integrations.update(IntegrationSlug.make(slug), {
+        config: next
+      });
+      return merged;
+    })
+  );
+  return {
+    /** Register a GraphQL integration (introspects + persists operations). */
+    addIntegration: (input) => addIntegrationInternal(input),
+    /** Read the integration's stored config. */
+    getIntegration: (slug) => ctx.core.integrations.get(IntegrationSlug.make(slug)).pipe(Effect5.map((record) => record ? record.config : null)),
+    /** Read the integration's decoded config (auth templates surfaced). */
+    getConfig,
+    /** Merge-append custom auth methods (custom-method-create flow). */
+    configureAuth: configureAuthMethods,
+    removeIntegration: (slug) => ctx.transaction(
+      Effect5.gen(function* () {
+        yield* ctx.storage.removeOperations(slug);
+        yield* ctx.core.integrations.remove(IntegrationSlug.make(slug)).pipe(Effect5.catchTag("IntegrationRemovalNotAllowedError", () => Effect5.void));
+      })
+    ),
+    configure: configureIntegration
+  };
+};
+var graphqlPlugin = definePlugin((options) => {
+  return {
+    id: GRAPHQL_PLUGIN_ID,
+    packageName: "@executor-js/plugin-graphql",
+    integrationPresets: graphqlPresets.map((preset) => ({
+      id: preset.id,
+      name: preset.name,
+      summary: preset.summary,
+      url: preset.url,
+      endpoint: preset.endpoint,
+      ...preset.icon ? { icon: preset.icon } : {},
+      ...preset.featured ? { featured: preset.featured } : {}
+    })),
+    storage: (deps) => makeDefaultGraphqlStore(deps),
+    extension: (ctx) => makeGraphqlExtension(ctx),
+    integrationConfigure: {
+      type: "graphql",
+      schema: GraphqlConfigureInputSchema,
+      configure: ({ ctx, integration, config }) => makeGraphqlExtension(ctx).configure(String(integration), config)
+    },
+    describeAuthMethods: describeGraphqlAuthMethods,
+    describeIntegrationDisplay: describeGraphqlIntegrationDisplay,
+    staticSources: (self) => [
+      {
+        id: "graphql",
+        kind: "executor",
+        name: "GraphQL",
+        tools: [
+          {
+            name: "getIntegration",
+            description: "Inspect an existing GraphQL integration, including endpoint, static headers/query params, and auth templates. Use this before repairing an integration with `graphql.configure` or creating a connection.",
+            inputSchema: StaticGetIntegrationInputStandardSchema,
+            outputSchema: StaticGetIntegrationOutputStandardSchema,
+            handler: ({ args }) => {
+              const input = args;
+              return Effect5.map(
+                self.getIntegration(input.slug),
+                (integration) => ToolResult.ok({ integration })
+              );
+            }
+          },
+          {
+            name: "addIntegration",
+            description: "Add a GraphQL endpoint to the catalog and register its operations. Introspects the endpoint (or uses provided introspection JSON). After adding, create an owner-scoped connection against the integration to materialize its per-connection tools. For API keys / bearer tokens, declare an `authenticationTemplate` and create a connection whose value is the token.",
+            annotations: {
+              requiresApproval: true,
+              approvalDescription: "Add a GraphQL integration"
+            },
+            inputSchema: StaticAddIntegrationInputStandardSchema,
+            outputSchema: StaticAddIntegrationOutputStandardSchema,
+            handler: ({ args }) => {
+              const input = args;
+              return self.addIntegration(input).pipe(
+                Effect5.map((result) => ToolResult.ok({ slug: result.slug, name: result.name })),
+                Effect5.catchTags({
+                  GraphqlIntrospectionError: ({ message }) => Effect5.succeed(graphqlToolFailure("graphql_introspection_failed", message)),
+                  GraphqlExtractionError: ({ message }) => Effect5.succeed(graphqlToolFailure("graphql_extraction_failed", message)),
+                  IntegrationAlreadyExistsError: ({ slug }) => Effect5.succeed(
+                    graphqlToolFailure(
+                      "integration_already_exists",
+                      `Integration ${slug} already exists; update it instead of re-adding.`
+                    )
+                  )
+                })
+              );
+            }
+          }
+        ]
+      }
+    ],
+    // -----------------------------------------------------------------------
+    // Per-connection tool production. THIS is where a GraphQL integration is
+    // introspected — when a connection is created (or refreshed), with that
+    // connection's credential — yielding one ToolDef per operation. Registering
+    // the integration in the catalog makes no network call; discovery is
+    // deferred to here, exactly how MCP defers tool discovery to connect time.
+    // The introspected schema is identical across connections, so `invokeTool`
+    // re-derives the same operation bindings; only the credential differs.
+    // -----------------------------------------------------------------------
+    resolveTools: ({
+      config,
+      getValue
+    }) => Effect5.gen(function* () {
+      const decoded = yield* decodeGraphqlIntegrationConfig(config).pipe(Effect5.option);
+      if (Option5.isNone(decoded)) return { tools: [] };
+      const graphqlConfig = decoded.value;
+      const credentialValue = graphqlConfig.introspectionJson === void 0 ? yield* getValue().pipe(Effect5.catch(() => Effect5.succeed(null))) : null;
+      const introspection = yield* introspectForConnection(
+        graphqlConfig,
+        credentialValue,
+        options?.httpClientLayer ?? httpClientLayerFallback
+      ).pipe(Effect5.option);
+      if (Option5.isNone(introspection)) return { tools: [] };
+      const extracted = yield* extract(introspection.value).pipe(Effect5.option);
+      if (Option5.isNone(extracted)) return { tools: [] };
+      const prepared = prepareOperations(extracted.value.result.fields, introspection.value);
+      return {
+        tools: buildToolDefs(prepared),
+        definitions: extracted.value.definitions
+      };
+    }).pipe(Effect5.catch(() => Effect5.succeed({ tools: [] }))),
+    // -----------------------------------------------------------------------
+    // Invoke one of a connection's tools. Look up the operation by integration
+    // + tool name, render the credential through the connection's auth
+    // template, and execute the GraphQL request.
+    // -----------------------------------------------------------------------
+    invokeTool: ({ ctx, toolRow, credential, args }) => Effect5.gen(function* () {
+      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
+      const integration = toolRow.integration;
+      const toolName = toolRow.name;
+      const config = yield* decodeGraphqlIntegrationConfig(credential.config).pipe(
+        Effect5.mapError(
+          () => new GraphqlInvocationError({
+            message: `Invalid GraphQL integration config for "${integration}"`,
+            statusCode: Option5.none()
+          })
+        )
+      );
+      let op = yield* ctx.storage.getOperation(integration, toolName);
+      if (!op) {
+        op = yield* materializeOperations(
+          ctx,
+          integration,
+          config,
+          credential,
+          httpClientLayer
+        ).pipe(Effect5.map((ops) => ops.find((o) => o.toolName === toolName) ?? null));
+      }
+      if (!op) {
+        return yield* new GraphqlInvocationError({
+          message: `No GraphQL operation found for tool "${integration}.${toolName}"`,
+          statusCode: Option5.none()
+        });
+      }
+      const headers = { ...config.headers ?? {} };
+      const queryParams = {
+        ...config.queryParams ?? {}
+      };
+      const template = config.authenticationTemplate.find(
+        (t) => t.slug === String(credential.template)
+      );
+      if (template) {
+        if (credential.value === null) {
+          return yield* new GraphqlAuthRequiredError({
+            code: template.kind === "oauth2" ? "oauth_connection_missing" : "connection_value_missing",
+            message: template.kind === "oauth2" ? `Missing OAuth connection value for GraphQL integration "${integration}" (connection "${credential.connection}")` : `Missing credential value for GraphQL integration "${integration}" (connection "${credential.connection}")`,
+            owner: credential.owner,
+            integration,
+            connection: String(credential.connection),
+            credentialKind: template.kind === "oauth2" ? "oauth" : "secret",
+            credentialLabel: template.kind === "oauth2" ? "OAuth sign-in" : "API key",
+            template: String(credential.template)
+          });
+        }
+        const rendered = renderAuthTemplate(template, credential.value);
+        Object.assign(headers, rendered.headers);
+        Object.assign(queryParams, rendered.queryParams);
+      }
+      const result = yield* invokeWithLayer(
+        op.binding,
+        args ?? {},
+        config.endpoint,
+        headers,
+        queryParams,
+        httpClientLayer
+      );
+      const errors = decodeGraphqlErrors(result.errors);
+      if (errors !== void 0 && errors.length > 0) {
+        const firstMessage = extractGraphqlErrorMessage(errors);
+        return ToolResult.fail({
+          code: "graphql_errors",
+          message: firstMessage !== void 0 ? firstMessage : "GraphQL request returned errors",
+          details: { errors }
+        });
+      }
+      if (result.status < 200 || result.status >= 300) {
+        if (result.status === 401 || result.status === 403) {
+          return authToolFailure({
+            code: "connection_rejected",
+            status: result.status,
+            message: `Upstream rejected credentials for GraphQL integration "${integration}" with HTTP ${result.status}. Re-authenticate or update the connection before retrying this tool.`,
+            source: { id: integration, scope: credential.owner },
+            credential: { kind: "upstream", label: "Upstream authorization" },
+            upstream: {
+              status: result.status,
+              details: {
+                data: result.data,
+                errors: result.errors
+              }
+            }
+          });
+        }
+        return ToolResult.fail({
+          code: "graphql_http_error",
+          status: result.status,
+          message: `GraphQL request failed with HTTP ${result.status}`,
+          details: {
+            status: result.status,
+            data: result.data,
+            errors: result.errors
+          }
+        });
+      }
+      return ToolResult.ok(result.data);
+    }).pipe(
+      Effect5.catchTag(
+        "GraphqlAuthRequiredError",
+        (error) => Effect5.succeed(graphqlAuthToolFailure(error))
+      )
+    ),
+    // Per-connection cleanup. Operation bindings are catalog-level (shared
+    // across an integration's connections), so removing a single connection
+    // leaves them in place; the executor drops the connection's tool rows.
+    removeConnection: () => Effect5.void,
+    detect: ({ ctx, url }) => Effect5.gen(function* () {
+      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
+      const trimmed = url.trim();
+      if (!trimmed) return null;
+      const parsed = yield* Effect5.try({
+        try: () => new URL(trimmed),
+        catch: (cause) => cause
+      }).pipe(Effect5.option);
+      if (Option5.isNone(parsed)) return null;
+      const ok = yield* introspect(trimmed).pipe(
+        Effect5.provide(httpClientLayer),
+        Effect5.map(() => true),
+        Effect5.catch(() => Effect5.succeed(false))
+      );
+      const slug = slugFromEndpoint(trimmed);
+      if (ok) {
+        return IntegrationDetectionResult.make({
+          kind: "graphql",
+          confidence: "high",
+          endpoint: trimmed,
+          name: slug,
+          slug
+        });
+      }
+      if (urlMatchesToken(parsed.value, "graphql")) {
+        return IntegrationDetectionResult.make({
+          kind: "graphql",
+          confidence: "low",
+          endpoint: trimmed,
+          name: slug,
+          slug
+        });
+      }
+      return null;
+    })
+  };
+});
+var httpClientLayerFallback = FetchHttpClient.layer;
+
+export {
+  introspect,
+  parseIntrospectionJson,
+  extract,
+  invoke,
+  invokeWithLayer,
+  makeDefaultGraphqlStore,
+  describeGraphqlAuthMethods,
+  graphqlPlugin
+};
+//# sourceMappingURL=chunk-ADQTI2OK.js.map