@executor-js/plugin-graphql 1.4.33 → 1.5.0

package/dist/chunk-2252RTCE.js

@@ -1,1730 +0,0 @@
-import {
-  graphqlPresets
-} from "./chunk-D6E4WAYW.js";
-import {
-  ExtractedField,
-  ExtractionResult,
-  GRAPHQL_OAUTH_CONNECTION_SLOT,
-  GraphqlArgument,
-  GraphqlAuthRequiredError,
-  GraphqlConfiguredValueInput,
-  GraphqlCredentialInput,
-  GraphqlExtractionError,
-  GraphqlIntrospectionError,
-  GraphqlInvocationError,
-  GraphqlSourceAuth,
-  GraphqlSourceAuthInput,
-  InvocationResult,
-  OperationBinding,
-  graphqlHeaderSlot,
-  graphqlQueryParamSlot
-} from "./chunk-UIAHATHP.js";
-
-// src/sdk/introspect.ts
-import { Effect, Option, Schema } from "effect";
-import { HttpClient, HttpClientRequest } from "effect/unstable/http";
-var INTROSPECTION_QUERY = `
-  query IntrospectionQuery {
-    __schema {
-      queryType { name }
-      mutationType { name }
-      types {
-        kind
-        name
-        description
-        fields(includeDeprecated: false) {
-          name
-          description
-          args {
-            name
-            description
-            type {
-              ...TypeRef
-            }
-            defaultValue
-          }
-          type {
-            ...TypeRef
-          }
-        }
-        inputFields {
-          name
-          description
-          type {
-            ...TypeRef
-          }
-          defaultValue
-        }
-        enumValues(includeDeprecated: false) {
-          name
-          description
-        }
-      }
-    }
-  }
-
-  fragment TypeRef on __Type {
-    kind
-    name
-    ofType {
-      kind
-      name
-      ofType {
-        kind
-        name
-        ofType {
-          kind
-          name
-          ofType {
-            kind
-            name
-            ofType {
-              kind
-              name
-              ofType {
-                kind
-                name
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-`;
-var IntrospectionTypeRefLeaf = Schema.Struct({
-  kind: Schema.String,
-  name: Schema.NullOr(Schema.String),
-  ofType: Schema.optional(Schema.Null)
-});
-var IntrospectionTypeRef5 = Schema.Struct({
-  kind: Schema.String,
-  name: Schema.NullOr(Schema.String),
-  ofType: Schema.optional(Schema.NullOr(IntrospectionTypeRefLeaf))
-});
-var IntrospectionTypeRef4 = Schema.Struct({
-  kind: Schema.String,
-  name: Schema.NullOr(Schema.String),
-  ofType: Schema.optional(Schema.NullOr(IntrospectionTypeRef5))
-});
-var IntrospectionTypeRef3 = Schema.Struct({
-  kind: Schema.String,
-  name: Schema.NullOr(Schema.String),
-  ofType: Schema.optional(Schema.NullOr(IntrospectionTypeRef4))
-});
-var IntrospectionTypeRef2 = Schema.Struct({
-  kind: Schema.String,
-  name: Schema.NullOr(Schema.String),
-  ofType: Schema.optional(Schema.NullOr(IntrospectionTypeRef3))
-});
-var IntrospectionTypeRefSchema = Schema.Struct({
-  kind: Schema.String,
-  name: Schema.NullOr(Schema.String),
-  ofType: Schema.optional(Schema.NullOr(IntrospectionTypeRef2))
-});
-var IntrospectionInputValueSchema = Schema.Struct({
-  name: Schema.String,
-  description: Schema.NullOr(Schema.String),
-  type: IntrospectionTypeRefSchema,
-  defaultValue: Schema.NullOr(Schema.String)
-});
-var IntrospectionFieldSchema = Schema.Struct({
-  name: Schema.String,
-  description: Schema.NullOr(Schema.String),
-  args: Schema.Array(IntrospectionInputValueSchema),
-  type: IntrospectionTypeRefSchema
-});
-var IntrospectionTypeSchema = Schema.Struct({
-  kind: Schema.String,
-  name: Schema.String,
-  description: Schema.NullOr(Schema.String),
-  fields: Schema.NullOr(Schema.Array(IntrospectionFieldSchema)),
-  inputFields: Schema.NullOr(Schema.Array(IntrospectionInputValueSchema)),
-  enumValues: Schema.NullOr(
-    Schema.Array(
-      Schema.Struct({
-        name: Schema.String,
-        description: Schema.NullOr(Schema.String)
-      })
-    )
-  )
-});
-var IntrospectionResultSchema = Schema.Struct({
-  __schema: Schema.Struct({
-    queryType: Schema.NullOr(Schema.Struct({ name: Schema.String })),
-    mutationType: Schema.NullOr(Schema.Struct({ name: Schema.String })),
-    types: Schema.Array(IntrospectionTypeSchema)
-  })
-});
-var IntrospectionResponseSchema = Schema.Struct({
-  data: Schema.optional(IntrospectionResultSchema),
-  errors: Schema.optional(Schema.Array(Schema.Unknown))
-});
-var UpstreamErrorResponseSchema = Schema.Struct({
-  message: Schema.optional(Schema.String),
-  errors: Schema.optional(
-    Schema.Array(
-      Schema.Struct({
-        message: Schema.optional(Schema.String)
-      })
-    )
-  )
-});
-var IntrospectionJsonSchema = Schema.Union([
-  Schema.Struct({ data: IntrospectionResultSchema }),
-  IntrospectionResultSchema
-]);
-var JsonTextSchema = Schema.fromJsonString(Schema.Unknown);
-var decodeUpstreamErrorResponse = Schema.decodeUnknownOption(UpstreamErrorResponseSchema);
-var firstUpstreamErrorMessage = (value) => {
-  const decoded = decodeUpstreamErrorResponse(value);
-  return Option.match(decoded, {
-    onNone: () => null,
-    onSome: (response) => {
-      if (response.message) return response.message;
-      for (const entry of response.errors ?? []) {
-        const message = entry.message;
-        if (message) return message;
-      }
-      return null;
-    }
-  });
-};
-var redactUpstreamBody = (body) => body.replaceAll(
-  /("(?:access_token|refresh_token|id_token|client_secret|token|authorization)"\s*:\s*")[^"]*(")/gi,
-  "$1[redacted]$2"
-).replaceAll(
-  /((?:access_token|refresh_token|id_token|client_secret|token|authorization)=)[^&\s]*/gi,
-  "$1[redacted]"
-).replaceAll(
-  /((?:authorization|access-token|refresh-token|id-token|client-secret|token)\s*:\s*)(?:bearer\s+)?[^\s,;]+/gi,
-  "$1[redacted]"
-);
-var upstreamTextMessage = (body) => {
-  const text = redactUpstreamBody(body.replaceAll(/\s+/g, " ").trim());
-  if (text.length === 0) return null;
-  return text.length > 500 ? `${text.slice(0, 500)}...` : text;
-};
-var introspect = Effect.fn("GraphQL.introspect")(function* (endpoint, headers, queryParams) {
-  const client = yield* HttpClient.HttpClient;
-  const requestEndpoint = queryParams && Object.keys(queryParams).length > 0 ? (() => {
-    const url = new URL(endpoint);
-    for (const [name, value] of Object.entries(queryParams)) {
-      url.searchParams.set(name, value);
-    }
-    return url.toString();
-  })() : endpoint;
-  let request = HttpClientRequest.post(requestEndpoint).pipe(
-    HttpClientRequest.setHeader("Content-Type", "application/json"),
-    HttpClientRequest.setHeader("Accept", "application/json"),
-    HttpClientRequest.setHeader("User-Agent", "executor-graphql"),
-    HttpClientRequest.bodyJsonUnsafe({
-      query: INTROSPECTION_QUERY
-    })
-  );
-  if (headers) {
-    for (const [k, v] of Object.entries(headers)) {
-      request = HttpClientRequest.setHeader(request, k, v);
-    }
-  }
-  const response = yield* client.execute(request).pipe(
-    Effect.tapCause((cause) => Effect.logError("graphql introspection request failed", cause)),
-    Effect.mapError(
-      () => new GraphqlIntrospectionError({
-        message: "Failed to reach GraphQL endpoint"
-      })
-    )
-  );
-  if (response.status !== 200) {
-    const responseText = yield* response.text.pipe(Effect.catch(() => Effect.succeed("")));
-    const raw2 = responseText ? yield* Schema.decodeUnknownEffect(JsonTextSchema)(responseText).pipe(
-      Effect.catch(() => Effect.succeed(null))
-    ) : null;
-    const upstreamMessage = upstreamTextMessage(
-      (raw2 === null ? null : firstUpstreamErrorMessage(raw2)) ?? responseText
-    );
-    return yield* new GraphqlIntrospectionError({
-      message: upstreamMessage ? `Introspection failed with status ${response.status}: ${upstreamMessage}` : `Introspection failed with status ${response.status}`
-    });
-  }
-  const raw = yield* response.json.pipe(
-    Effect.tapCause((cause) => Effect.logError("graphql introspection JSON parse failed", cause)),
-    Effect.mapError(
-      () => new GraphqlIntrospectionError({
-        message: `Failed to parse introspection response as JSON`
-      })
-    )
-  );
-  const json = yield* Schema.decodeUnknownEffect(IntrospectionResponseSchema)(raw).pipe(
-    Effect.mapError(
-      () => new GraphqlIntrospectionError({
-        message: "Introspection response has an invalid shape"
-      })
-    )
-  );
-  if (json.errors && Array.isArray(json.errors) && json.errors.length > 0) {
-    const upstreamMessage = firstUpstreamErrorMessage(json);
-    return yield* new GraphqlIntrospectionError({
-      message: upstreamMessage ? `Introspection returned ${json.errors.length} error(s): ${upstreamMessage}` : `Introspection returned ${json.errors.length} error(s)`
-    });
-  }
-  if (!json.data?.__schema) {
-    return yield* new GraphqlIntrospectionError({
-      message: "Introspection response missing __schema"
-    });
-  }
-  return json.data;
-});
-var parseIntrospectionJson = (text) => Schema.decodeUnknownEffect(Schema.fromJsonString(IntrospectionJsonSchema))(text).pipe(
-  Effect.map((parsed) => "data" in parsed ? parsed.data : parsed),
-  Effect.mapError(
-    () => new GraphqlIntrospectionError({
-      message: "Failed to parse introspection JSON"
-    })
-  )
-);
-
-// src/sdk/extract.ts
-import { Effect as Effect2, Match, Option as Option2 } from "effect";
-var unwrapTypeName = (ref) => {
-  if (ref.name) return ref.name;
-  if (ref.ofType) return unwrapTypeName(ref.ofType);
-  return "Unknown";
-};
-var isNonNull = (ref) => ref.kind === "NON_NULL";
-var buildDefinitions = (types) => {
-  const defs = {};
-  for (const [name, type] of types) {
-    if (name.startsWith("__")) continue;
-    if (type.kind === "INPUT_OBJECT" && type.inputFields) {
-      const properties = {};
-      const required = [];
-      for (const field of type.inputFields) {
-        const schema = typeRefToJsonSchema(field.type, types);
-        if (field.description) {
-          schema.description = field.description;
-        }
-        properties[field.name] = schema;
-        if (isNonNull(field.type)) {
-          required.push(field.name);
-        }
-      }
-      const def = { type: "object", properties };
-      if (required.length > 0) def.required = required;
-      if (type.description) def.description = type.description;
-      defs[name] = def;
-    }
-    if (type.kind === "ENUM" && type.enumValues) {
-      defs[name] = {
-        type: "string",
-        enum: type.enumValues.map((v) => v.name),
-        ...type.description ? { description: type.description } : {}
-      };
-    }
-  }
-  return defs;
-};
-var typeRefToJsonSchema = (ref, types) => Match.value(ref.kind).pipe(
-  Match.when(
-    "NON_NULL",
-    () => ref.ofType ? typeRefToJsonSchema(ref.ofType, types) : {}
-  ),
-  Match.when(
-    "LIST",
-    () => ({
-      type: "array",
-      items: ref.ofType ? typeRefToJsonSchema(ref.ofType, types) : {}
-    })
-  ),
-  Match.when("SCALAR", () => scalarToJsonSchema(ref.name ?? "String")),
-  Match.when(
-    "ENUM",
-    () => ref.name ? { $ref: `#/$defs/${ref.name}` } : { type: "string" }
-  ),
-  Match.when(
-    "INPUT_OBJECT",
-    () => ref.name ? { $ref: `#/$defs/${ref.name}` } : { type: "object" }
-  ),
-  Match.whenOr(
-    "OBJECT",
-    "INTERFACE",
-    "UNION",
-    () => ({ type: "object" })
-  ),
-  Match.option,
-  Option2.getOrElse(() => ({}))
-);
-var scalarToJsonSchema = (name) => Match.value(name).pipe(
-  Match.whenOr("String", "ID", () => ({ type: "string" })),
-  Match.when("Int", () => ({ type: "integer" })),
-  Match.when("Float", () => ({ type: "number" })),
-  Match.when("Boolean", () => ({ type: "boolean" })),
-  Match.option,
-  Option2.getOrElse(
-    () => ({ type: "string", description: `Custom scalar: ${name}` })
-  )
-);
-var buildInputSchema = (args, types) => {
-  if (args.length === 0) return void 0;
-  const properties = {};
-  const required = [];
-  for (const arg of args) {
-    const schema = typeRefToJsonSchema(arg.type, types);
-    if (arg.description) {
-      schema.description = arg.description;
-    }
-    properties[arg.name] = schema;
-    if (isNonNull(arg.type)) {
-      required.push(arg.name);
-    }
-  }
-  const inputSchema = {
-    type: "object",
-    properties
-  };
-  if (required.length > 0) inputSchema.required = required;
-  return inputSchema;
-};
-var formatTypeRef = (ref) => Match.value(ref.kind).pipe(
-  Match.when("NON_NULL", () => ref.ofType ? `${formatTypeRef(ref.ofType)}!` : "Unknown!"),
-  Match.when("LIST", () => ref.ofType ? `[${formatTypeRef(ref.ofType)}]` : "[Unknown]"),
-  Match.option,
-  Option2.getOrElse(() => ref.name ?? "Unknown")
-);
-var extractFields = (_schema, kind, typeName, types) => {
-  if (!typeName) return [];
-  const type = types.get(typeName);
-  if (!type?.fields) return [];
-  return type.fields.filter((f) => !f.name.startsWith("__")).map((field) => {
-    const args = field.args.map(
-      (arg) => GraphqlArgument.make({
-        name: arg.name,
-        typeName: formatTypeRef(arg.type),
-        required: isNonNull(arg.type),
-        description: arg.description ? Option2.some(arg.description) : Option2.none()
-      })
-    );
-    const inputSchema = buildInputSchema(field.args, types);
-    return ExtractedField.make({
-      fieldName: field.name,
-      kind,
-      description: field.description ? Option2.some(field.description) : Option2.none(),
-      arguments: args,
-      inputSchema: inputSchema ? Option2.some(inputSchema) : Option2.none(),
-      returnTypeName: unwrapTypeName(field.type)
-    });
-  });
-};
-var extract = (introspection) => Effect2.try({
-  try: () => {
-    const schema = introspection.__schema;
-    const typeMap = /* @__PURE__ */ new Map();
-    for (const t of schema.types) {
-      typeMap.set(t.name, t);
-    }
-    const definitions = buildDefinitions(typeMap);
-    const queryFields = extractFields(schema, "query", schema.queryType?.name, typeMap);
-    const mutationFields = extractFields(schema, "mutation", schema.mutationType?.name, typeMap);
-    return {
-      result: ExtractionResult.make({
-        schemaName: Option2.none(),
-        fields: [...queryFields, ...mutationFields]
-      }),
-      definitions
-    };
-  },
-  catch: () => new GraphqlExtractionError({
-    message: "Failed to extract GraphQL schema"
-  })
-});
-
-// src/sdk/invoke.ts
-import { Effect as Effect3, Option as Option3 } from "effect";
-import { HttpClient as HttpClient2, HttpClientRequest as HttpClientRequest2 } from "effect/unstable/http";
-import { resolveSecretBackedMap } from "@executor-js/sdk/core";
-var resolveHeaders = (headers, secrets) => {
-  const entries = Object.entries(headers);
-  const secretCount = entries.reduce(
-    (acc, [, value]) => typeof value === "string" ? acc : acc + 1,
-    0
-  );
-  return resolveSecretBackedMap({
-    values: headers,
-    getSecret: (secretId) => secrets.get(secretId).pipe(Effect3.catch(() => Effect3.succeed(null))),
-    missing: "drop",
-    onMissing: (name) => new GraphqlInvocationError({
-      message: `Missing secret for header "${name}"`,
-      statusCode: Option3.none()
-    })
-  }).pipe(
-    Effect3.catch(() => Effect3.succeed(void 0)),
-    Effect3.map((resolved) => resolved ?? {}),
-    Effect3.withSpan("plugin.graphql.secret.resolve", {
-      attributes: {
-        "plugin.graphql.headers.total": entries.length,
-        "plugin.graphql.headers.secret_count": secretCount
-      }
-    })
-  );
-};
-var endpointWithQueryParams = (endpoint, queryParams) => {
-  if (Object.keys(queryParams).length === 0) return endpoint;
-  const url = new URL(endpoint);
-  for (const [name, value] of Object.entries(queryParams)) {
-    url.searchParams.set(name, value);
-  }
-  return url.toString();
-};
-var endpointForTelemetry = (endpoint) => {
-  if (!URL.canParse(endpoint)) return endpoint;
-  const url = new URL(endpoint);
-  url.search = "";
-  url.hash = "";
-  return url.toString();
-};
-var isJsonContentType = (ct) => {
-  if (!ct) return false;
-  const normalized = ct.split(";")[0]?.trim().toLowerCase() ?? "";
-  return normalized === "application/json" || normalized.includes("+json") || normalized.includes("json");
-};
-var invoke = Effect3.fn("GraphQL.invoke")(function* (operation, args, endpoint, resolvedHeaders, resolvedQueryParams = {}) {
-  const client = yield* HttpClient2.HttpClient;
-  const requestEndpoint = endpointWithQueryParams(endpoint, resolvedQueryParams);
-  const telemetryEndpoint = endpointForTelemetry(endpoint);
-  yield* Effect3.annotateCurrentSpan({
-    "http.method": "POST",
-    "http.url": telemetryEndpoint,
-    "plugin.graphql.endpoint": telemetryEndpoint,
-    "plugin.graphql.operation_kind": operation.kind,
-    "plugin.graphql.field_name": operation.fieldName,
-    "plugin.graphql.headers.resolved_count": Object.keys(resolvedHeaders).length,
-    "plugin.graphql.query_params.resolved_count": Object.keys(resolvedQueryParams).length
-  });
-  const variables = {};
-  for (const varName of operation.variableNames) {
-    if (args[varName] !== void 0) {
-      variables[varName] = args[varName];
-    }
-  }
-  if (typeof args.variables === "object" && args.variables !== null) {
-    Object.assign(variables, args.variables);
-  }
-  let request = HttpClientRequest2.post(requestEndpoint).pipe(
-    HttpClientRequest2.setHeader("Content-Type", "application/json"),
-    HttpClientRequest2.bodyJsonUnsafe({
-      query: operation.operationString,
-      variables: Object.keys(variables).length > 0 ? variables : void 0
-    })
-  );
-  for (const [name, value] of Object.entries(resolvedHeaders)) {
-    request = HttpClientRequest2.setHeader(request, name, value);
-  }
-  const response = yield* client.execute(request).pipe(
-    Effect3.mapError(
-      (err) => new GraphqlInvocationError({
-        message: "GraphQL request failed",
-        statusCode: Option3.none(),
-        cause: err
-      })
-    )
-  );
-  const status = response.status;
-  const contentType = response.headers["content-type"] ?? null;
-  const body = isJsonContentType(contentType) ? yield* response.json.pipe(Effect3.catch(() => response.text)) : yield* response.text;
-  const gqlBody = body;
-  const hasErrors = Array.isArray(gqlBody?.errors) && gqlBody.errors.length > 0;
-  yield* Effect3.annotateCurrentSpan({
-    "http.status_code": status,
-    "plugin.graphql.has_errors": hasErrors,
-    "plugin.graphql.error_count": hasErrors ? gqlBody.errors.length : 0
-  });
-  return InvocationResult.make({
-    status,
-    data: gqlBody?.data ?? null,
-    errors: hasErrors ? gqlBody.errors : null
-  });
-});
-var invokeWithLayer = (operation, args, endpoint, resolvedHeaders, resolvedQueryParams, httpClientLayer) => invoke(operation, args, endpoint, resolvedHeaders, resolvedQueryParams).pipe(
-  Effect3.provide(httpClientLayer),
-  Effect3.withSpan("plugin.graphql.invoke", {
-    attributes: {
-      "plugin.graphql.endpoint": endpointForTelemetry(endpoint),
-      "plugin.graphql.operation_kind": operation.kind,
-      "plugin.graphql.field_name": operation.fieldName
-    }
-  })
-);
-
-// src/sdk/store.ts
-import { Effect as Effect4, Option as Option4, Predicate, Schema as Schema2 } from "effect";
-import {
-  ConfiguredCredentialBinding
-} from "@executor-js/sdk/core";
-var graphqlSchema = {};
-var SOURCE_COLLECTION = "source";
-var OPERATION_COLLECTION = "operation";
-var OperationBindingFromJsonString = Schema2.fromJsonString(OperationBinding);
-var decodeOperationBindingFromJsonString = Schema2.decodeUnknownSync(
-  OperationBindingFromJsonString
-);
-var decodeOperationBinding = Schema2.decodeUnknownSync(OperationBinding);
-var encodeBinding = Schema2.encodeSync(OperationBinding);
-var decodeBinding = (value) => {
-  if (typeof value === "string") return decodeOperationBindingFromJsonString(value);
-  return decodeOperationBinding(value);
-};
-var toJsonRecord = (value) => value;
-var OptionalNullableString = Schema2.optional(Schema2.NullOr(Schema2.String));
-var ConfiguredCredentialBindingStorage = Schema2.Struct({
-  kind: Schema2.Literal("binding"),
-  slot: Schema2.String,
-  prefix: OptionalNullableString
-});
-var ConfiguredCredentialValueStorage = Schema2.Union([
-  Schema2.String,
-  ConfiguredCredentialBindingStorage
-]);
-var CredentialMapStorage = Schema2.Record(Schema2.String, ConfiguredCredentialValueStorage);
-var SourceStorage = Schema2.Struct({
-  namespace: Schema2.String,
-  scope: Schema2.String,
-  name: Schema2.String,
-  endpoint: Schema2.String,
-  headers: Schema2.optional(CredentialMapStorage),
-  queryParams: Schema2.optional(CredentialMapStorage),
-  auth: GraphqlSourceAuth
-});
-var OperationStorage = Schema2.Struct({
-  toolId: Schema2.String,
-  sourceId: Schema2.String,
-  binding: Schema2.Unknown
-});
-var decodeSourceStorage = Schema2.decodeUnknownOption(SourceStorage);
-var decodeOperationStorage = Schema2.decodeUnknownOption(OperationStorage);
-var normalizeCredentialMap = (values) => {
-  if (!values) return {};
-  const normalized = {};
-  for (const [name, value] of Object.entries(values)) {
-    if (typeof value === "string") {
-      normalized[name] = value;
-      continue;
-    }
-    normalized[name] = value.prefix != null ? ConfiguredCredentialBinding.make({
-      kind: "binding",
-      slot: value.slot,
-      prefix: value.prefix
-    }) : ConfiguredCredentialBinding.make({
-      kind: "binding",
-      slot: value.slot
-    });
-  }
-  return normalized;
-};
-var sourceData = (source) => ({
-  namespace: source.namespace,
-  scope: source.scope,
-  name: source.name,
-  endpoint: source.endpoint,
-  headers: source.headers,
-  queryParams: source.queryParams,
-  auth: source.auth
-});
-var operationData = (operation) => ({
-  toolId: operation.toolId,
-  sourceId: operation.sourceId,
-  binding: toJsonRecord(encodeBinding(operation.binding))
-});
-var rowToSource = (row) => {
-  const decoded = decodeSourceStorage(row.data);
-  if (Option4.isNone(decoded)) return null;
-  const source = decoded.value;
-  return {
-    namespace: source.namespace,
-    scope: source.scope,
-    name: source.name,
-    endpoint: source.endpoint,
-    headers: normalizeCredentialMap(source.headers),
-    queryParams: normalizeCredentialMap(source.queryParams),
-    auth: source.auth
-  };
-};
-var rowToOperation = (row) => {
-  const decoded = decodeOperationStorage(row.data);
-  if (Option4.isNone(decoded)) return null;
-  const operation = decoded.value;
-  return {
-    toolId: operation.toolId,
-    sourceId: operation.sourceId,
-    binding: decodeBinding(operation.binding)
-  };
-};
-var makeDefaultGraphqlStore = ({
-  pluginStorage
-}) => {
-  const listOperationRowsForSourceScope = (sourceId, scope) => pluginStorage.list({
-    collection: OPERATION_COLLECTION,
-    keyPrefix: `${sourceId}.`
-  }).pipe(
-    Effect4.map(
-      (rows) => rows.filter((row) => {
-        if (String(row.scopeId) !== scope) return false;
-        return rowToOperation(row)?.sourceId === sourceId;
-      })
-    )
-  );
-  const removeOperationsForSourceScope = (sourceId, scope) => Effect4.gen(function* () {
-    const rows = yield* listOperationRowsForSourceScope(sourceId, scope);
-    for (const row of rows) {
-      yield* pluginStorage.remove({
-        scope,
-        collection: OPERATION_COLLECTION,
-        key: row.key
-      });
-    }
-  });
-  const deleteSource = (namespace, scope) => Effect4.gen(function* () {
-    yield* removeOperationsForSourceScope(namespace, scope);
-    yield* pluginStorage.remove({
-      scope,
-      collection: SOURCE_COLLECTION,
-      key: namespace
-    });
-  });
-  return {
-    upsertSource: (input, operations) => Effect4.gen(function* () {
-      yield* deleteSource(input.namespace, input.scope);
-      yield* pluginStorage.put({
-        scope: input.scope,
-        collection: SOURCE_COLLECTION,
-        key: input.namespace,
-        data: sourceData(input)
-      });
-      for (const operation of operations) {
-        yield* pluginStorage.put({
-          scope: input.scope,
-          collection: OPERATION_COLLECTION,
-          key: operation.toolId,
-          data: operationData(operation)
-        });
-      }
-    }),
-    updateSourceMeta: (namespace, scope, patch) => Effect4.gen(function* () {
-      const existing = yield* pluginStorage.getAtScope({
-        scope,
-        collection: SOURCE_COLLECTION,
-        key: namespace
-      });
-      if (!existing) return;
-      const source = rowToSource(existing);
-      if (!source) return;
-      yield* pluginStorage.put({
-        scope,
-        collection: SOURCE_COLLECTION,
-        key: namespace,
-        data: sourceData({
-          ...source,
-          name: patch.name ?? source.name,
-          endpoint: patch.endpoint ?? source.endpoint,
-          headers: patch.headers ?? source.headers,
-          queryParams: patch.queryParams ?? source.queryParams,
-          auth: patch.auth ?? source.auth
-        })
-      });
-    }),
-    getSource: (namespace, scope) => pluginStorage.getAtScope({ scope, collection: SOURCE_COLLECTION, key: namespace }).pipe(Effect4.map((row) => row ? rowToSource(row) : null)),
-    listSources: () => pluginStorage.list({ collection: SOURCE_COLLECTION }).pipe(Effect4.map((rows) => rows.map(rowToSource).filter(Predicate.isNotNull))),
-    getOperationByToolId: (toolId, scope) => pluginStorage.getAtScope({ scope, collection: OPERATION_COLLECTION, key: toolId }).pipe(Effect4.map((row) => row ? rowToOperation(row) : null)),
-    listOperationsBySource: (sourceId, scope) => listOperationRowsForSourceScope(sourceId, scope).pipe(
-      Effect4.map((rows) => rows.map(rowToOperation).filter(Predicate.isNotNull))
-    ),
-    removeSource: (namespace, scope) => deleteSource(namespace, scope)
-  };
-};
-
-// src/sdk/plugin.ts
-import { Effect as Effect5, Match as Match2, Option as Option5, Schema as Schema3 } from "effect";
-import {
-  definePlugin,
-  tool,
-  defaultSourceInstallScopeId,
-  ScopeId,
-  SourceDetectionResult,
-  StorageError,
-  ToolResult,
-  authToolFailure
-} from "@executor-js/sdk/core";
-import {
-  compileHttpNamedCredentialMap,
-  OAuth2SourceConfig,
-  httpCredentialInputToBindingValue
-} from "@executor-js/sdk/http-source";
-import {
-  headersToConfigValues
-} from "@executor-js/config";
-var GraphqlErrorBody = Schema3.Struct({ message: Schema3.String });
-var GraphqlErrorsBody = Schema3.Array(Schema3.Unknown);
-var decodeGraphqlErrorBody = Schema3.decodeUnknownOption(GraphqlErrorBody);
-var decodeGraphqlErrorsBody = Schema3.decodeUnknownOption(GraphqlErrorsBody);
-var decodeGraphqlErrors = (errors) => Option5.getOrUndefined(decodeGraphqlErrorsBody(errors));
-var extractGraphqlErrorMessage = (errors) => errors.map((error) => Option5.getOrUndefined(decodeGraphqlErrorBody(error))?.message).find((message) => message !== void 0 && message.length > 0);
-var GraphqlInitialCredentialsInputSchema = Schema3.Struct({
-  scope: Schema3.String,
-  headers: Schema3.optional(Schema3.Record(Schema3.String, GraphqlCredentialInput)),
-  queryParams: Schema3.optional(Schema3.Record(Schema3.String, GraphqlCredentialInput)),
-  auth: Schema3.optional(GraphqlSourceAuthInput)
-});
-var StaticAddSourceInputSchema = Schema3.Struct({
-  endpoint: Schema3.String,
-  name: Schema3.String,
-  introspectionJson: Schema3.optional(Schema3.String),
-  namespace: Schema3.String,
-  headers: Schema3.optional(Schema3.Record(Schema3.String, GraphqlConfiguredValueInput)),
-  queryParams: Schema3.optional(Schema3.Record(Schema3.String, GraphqlConfiguredValueInput)),
-  oauth2: Schema3.optional(OAuth2SourceConfig),
-  credentials: Schema3.optional(GraphqlInitialCredentialsInputSchema)
-});
-var SourceConfigureInputSchema = Schema3.Struct({
-  name: Schema3.optional(Schema3.String),
-  endpoint: Schema3.optional(Schema3.String),
-  headers: Schema3.optional(Schema3.Record(Schema3.String, GraphqlCredentialInput)),
-  queryParams: Schema3.optional(Schema3.Record(Schema3.String, GraphqlCredentialInput)),
-  auth: Schema3.optional(GraphqlSourceAuthInput)
-});
-var StaticConfigureSourceInputSchema = Schema3.Struct({
-  source: Schema3.Struct({
-    id: Schema3.String,
-    scope: Schema3.String
-  }),
-  scope: Schema3.String,
-  ...SourceConfigureInputSchema.fields
-});
-var StaticConfigureSourceOutputSchema = Schema3.Struct({
-  configured: Schema3.Boolean
-});
-var StaticGetSourceInputSchema = Schema3.Struct({
-  namespace: Schema3.String,
-  scope: Schema3.String
-});
-var StaticGetSourceOutputSchema = Schema3.Struct({
-  source: Schema3.NullOr(Schema3.Unknown)
-});
-var StaticAddSourceInputStandardSchema = Schema3.toStandardSchemaV1(
-  Schema3.toStandardJSONSchemaV1(StaticAddSourceInputSchema)
-);
-var StaticAddSourceOutputStandardSchema = Schema3.toStandardSchemaV1(
-  Schema3.toStandardJSONSchemaV1(
-    Schema3.Struct({
-      namespace: Schema3.String,
-      source: Schema3.Struct({
-        id: Schema3.String,
-        scope: Schema3.String
-      }),
-      toolCount: Schema3.Number
-    })
-  )
-);
-var StaticGetSourceInputStandardSchema = Schema3.toStandardSchemaV1(
-  Schema3.toStandardJSONSchemaV1(StaticGetSourceInputSchema)
-);
-var StaticGetSourceOutputStandardSchema = Schema3.toStandardSchemaV1(
-  Schema3.toStandardJSONSchemaV1(StaticGetSourceOutputSchema)
-);
-var StaticConfigureSourceInputStandardSchema = Schema3.toStandardSchemaV1(
-  Schema3.toStandardJSONSchemaV1(StaticConfigureSourceInputSchema)
-);
-var StaticConfigureSourceOutputStandardSchema = Schema3.toStandardSchemaV1(
-  Schema3.toStandardJSONSchemaV1(StaticConfigureSourceOutputSchema)
-);
-var graphqlToolFailure = (code, message, details) => ToolResult.fail({
-  code,
-  message,
-  ...details === void 0 ? {} : { details }
-});
-var graphqlAuthToolFailure = (failure) => authToolFailure({
-  code: failure.code,
-  message: failure.message,
-  source: { id: failure.sourceId, scope: failure.sourceScope },
-  credential: {
-    kind: failure.credentialKind,
-    ...failure.credentialLabel ? { label: failure.credentialLabel } : {},
-    ...failure.slotKey ? { slotKey: failure.slotKey } : {},
-    ...failure.secretId ? { secretId: failure.secretId } : {},
-    ...failure.connectionId ? { connectionId: failure.connectionId } : {}
-  },
-  ...failure.status !== void 0 ? { status: failure.status } : {},
-  ...failure.details !== void 0 ? {
-    upstream: {
-      ...failure.status !== void 0 ? { status: failure.status } : {},
-      details: failure.details
-    }
-  } : {},
-  recovery: { configureSourceTool: "executor.graphql.configureSource" }
-});
-var resolveStaticScopeInput = (ctx, value) => String(
-  ctx.scopes.find((scope) => scope.name === value || String(scope.id) === value)?.id ?? value
-);
-var urlMatchesToken = (url, token) => {
-  const re = new RegExp(`(?:^|[^a-z0-9])${token}(?:$|[^a-z0-9])`, "i");
-  return re.test(url.hostname) || re.test(url.pathname);
-};
-var namespaceFromEndpoint = (endpoint) => {
-  try {
-    const url = new URL(endpoint);
-    return url.hostname.replace(/[^a-z0-9]+/gi, "_").toLowerCase();
-  } catch {
-    return "graphql";
-  }
-};
-var formatTypeRef2 = (ref) => Match2.value(ref.kind).pipe(
-  Match2.when("NON_NULL", () => ref.ofType ? `${formatTypeRef2(ref.ofType)}!` : "Unknown!"),
-  Match2.when("LIST", () => ref.ofType ? `[${formatTypeRef2(ref.ofType)}]` : "[Unknown]"),
-  Match2.option,
-  Option5.getOrElse(() => ref.name ?? "Unknown")
-);
-var unwrapTypeName2 = (ref) => {
-  if (ref.name) return ref.name;
-  if (ref.ofType) return unwrapTypeName2(ref.ofType);
-  return "Unknown";
-};
-var buildSelectionSet = (ref, types, depth, seen) => {
-  if (depth > 2) return "";
-  const leafName = unwrapTypeName2(ref);
-  if (seen.has(leafName)) return "";
-  const objectType = types.get(leafName);
-  if (!objectType?.fields) return "";
-  const kind = objectType.kind;
-  if (kind === "SCALAR" || kind === "ENUM") return "";
-  seen.add(leafName);
-  const subFields = objectType.fields.filter((f) => !f.name.startsWith("__")).slice(0, 12).map((f) => {
-    const sub = buildSelectionSet(f.type, types, depth + 1, seen);
-    return sub ? `${f.name} ${sub}` : f.name;
-  });
-  seen.delete(leafName);
-  return subFields.length > 0 ? `{ ${subFields.join(" ")} }` : "";
-};
-var buildOperationStringForField = (kind, field, types) => {
-  const opType = kind === "query" ? "query" : "mutation";
-  const varDefs = field.args.map((arg) => {
-    const typeName = formatTypeRef2(arg.type);
-    return `$${arg.name}: ${typeName}`;
-  });
-  const argPasses = field.args.map((arg) => `${arg.name}: $${arg.name}`);
-  const selectionSet = buildSelectionSet(field.type, types, 0, /* @__PURE__ */ new Set());
-  const varDefsStr = varDefs.length > 0 ? `(${varDefs.join(", ")})` : "";
-  const argPassStr = argPasses.length > 0 ? `(${argPasses.join(", ")})` : "";
-  return `${opType}${varDefsStr} { ${field.name}${argPassStr}${selectionSet ? ` ${selectionSet}` : ""} }`;
-};
-var prepareOperations = (fields, introspection) => {
-  const typeMap = /* @__PURE__ */ new Map();
-  for (const t of introspection.__schema.types) {
-    typeMap.set(t.name, t);
-  }
-  const fieldMap = /* @__PURE__ */ new Map();
-  const schema = introspection.__schema;
-  for (const rootKind of ["query", "mutation"]) {
-    const typeName = rootKind === "query" ? schema.queryType?.name : schema.mutationType?.name;
-    if (!typeName) continue;
-    const rootType = typeMap.get(typeName);
-    if (!rootType?.fields) continue;
-    for (const f of rootType.fields) {
-      if (!f.name.startsWith("__")) {
-        fieldMap.set(`${rootKind}.${f.name}`, { kind: rootKind, field: f });
-      }
-    }
-  }
-  return fields.map((extracted) => {
-    const prefix = extracted.kind === "mutation" ? "mutation" : "query";
-    const toolPath = `${prefix}.${extracted.fieldName}`;
-    const description = Option5.getOrElse(
-      extracted.description,
-      () => `GraphQL ${extracted.kind}: ${extracted.fieldName} -> ${extracted.returnTypeName}`
-    );
-    const key = `${extracted.kind}.${extracted.fieldName}`;
-    const entry = fieldMap.get(key);
-    const operationString = entry ? buildOperationStringForField(entry.kind, entry.field, typeMap) : `${extracted.kind} { ${extracted.fieldName} }`;
-    const binding = OperationBinding.make({
-      kind: extracted.kind,
-      fieldName: extracted.fieldName,
-      operationString,
-      variableNames: extracted.arguments.map((a) => a.name)
-    });
-    return {
-      toolPath,
-      description,
-      inputSchema: Option5.getOrUndefined(extracted.inputSchema),
-      binding
-    };
-  });
-};
-var annotationsFor = (binding) => {
-  if (binding.kind === "mutation") {
-    return {
-      requiresApproval: true,
-      approvalDescription: `mutation ${binding.fieldName}`
-    };
-  }
-  return {};
-};
-var toGraphqlConfigEntry = (namespace, config) => {
-  const headers = {};
-  for (const [name, value] of Object.entries(config.headers ?? {})) {
-    if (typeof value === "string" || !("kind" in value)) {
-      headers[name] = value;
-    }
-  }
-  return {
-    kind: "graphql",
-    endpoint: config.endpoint,
-    introspectionJson: config.introspectionJson,
-    namespace,
-    headers: headersToConfigValues(Object.keys(headers).length > 0 ? headers : void 0)
-  };
-};
-var GRAPHQL_PLUGIN_ID = "graphql";
-var scopeRanks = (ctx) => new Map(ctx.scopes.map((scope, index) => [String(scope.id), index]));
-var scopeRank = (ranks, scopeId) => ranks.get(scopeId) ?? Infinity;
-var resolveGraphqlSourceBinding = (ctx, sourceId, sourceScope, slot) => Effect5.gen(function* () {
-  const ranks = scopeRanks(ctx);
-  const sourceSourceRank = scopeRank(ranks, sourceScope);
-  if (sourceSourceRank === Infinity) return null;
-  const bindings = yield* ctx.credentialBindings.listForSource({
-    pluginId: GRAPHQL_PLUGIN_ID,
-    sourceId,
-    sourceScope: ScopeId.make(sourceScope)
-  });
-  const binding = bindings.filter(
-    (candidate) => candidate.slotKey === slot && scopeRank(ranks, candidate.scopeId) <= sourceSourceRank
-  ).sort((a, b) => scopeRank(ranks, a.scopeId) - scopeRank(ranks, b.scopeId))[0];
-  return binding ?? null;
-});
-var validateGraphqlBindingTarget = (ctx, input) => Effect5.gen(function* () {
-  const ranks = scopeRanks(ctx);
-  const sourceSourceRank = scopeRank(ranks, input.sourceScope);
-  const targetRank = scopeRank(ranks, input.targetScope);
-  const scopeList = `[${ctx.scopes.map((s) => s.id).join(", ")}]`;
-  if (sourceSourceRank === Infinity) {
-    return yield* new StorageError({
-      message: `GraphQL source binding references source scope "${input.sourceScope}" which is not in the executor's scope stack ${scopeList}.`,
-      cause: void 0
-    });
-  }
-  if (targetRank === Infinity) {
-    return yield* new StorageError({
-      message: `GraphQL source binding targets scope "${input.targetScope}" which is not in the executor's scope stack ${scopeList}.`,
-      cause: void 0
-    });
-  }
-  if (targetRank > sourceSourceRank) {
-    return yield* new StorageError({
-      message: `GraphQL source bindings for "${input.sourceId}" cannot be written at outer scope "${input.targetScope}" because the base source lives at "${input.sourceScope}"`,
-      cause: void 0
-    });
-  }
-});
-var canonicalizeCredentialMap = compileHttpNamedCredentialMap;
-var canonicalizeConfiguredValueMap = (values, slotForName) => {
-  const next = {};
-  for (const [name, value] of Object.entries(values ?? {})) {
-    if (typeof value === "string") {
-      next[name] = value;
-      continue;
-    }
-    next[name] = {
-      kind: "binding",
-      slot: slotForName(name),
-      prefix: value.prefix
-    };
-  }
-  return next;
-};
-var resolveConfiguredValueMap = (values) => {
-  if (!values) return void 0;
-  const resolved = {};
-  for (const [name, value] of Object.entries(values)) {
-    if (typeof value === "string") resolved[name] = value;
-  }
-  return Object.keys(resolved).length > 0 ? resolved : void 0;
-};
-var authFromOAuth2Source = (oauth2) => oauth2 ? { kind: "oauth2", connectionSlot: oauth2.connectionSlot } : { kind: "none" };
-var canonicalizeAuth = (auth) => {
-  if (!auth || "kind" in auth || !auth.oauth2) return { auth: { kind: "none" }, bindings: [] };
-  const connection = auth.oauth2.connection;
-  return {
-    auth: { kind: "oauth2", connectionSlot: GRAPHQL_OAUTH_CONNECTION_SLOT },
-    bindings: connection ? [
-      {
-        slot: GRAPHQL_OAUTH_CONNECTION_SLOT,
-        value: httpCredentialInputToBindingValue(connection)
-      }
-    ] : []
-  };
-};
-var resolveInitialCredentialValueMap = (ctx, values, bindings, targetScope) => Effect5.gen(function* () {
-  const bySlot = new Map(bindings.map((binding) => [binding.slot, binding.value]));
-  const resolved = {};
-  for (const [name, value] of Object.entries(values)) {
-    if (typeof value === "string") {
-      resolved[name] = value;
-      continue;
-    }
-    const binding = bySlot.get(value.slot);
-    if (binding?.kind === "secret") {
-      const secret = yield* ctx.secrets.getAtScope(binding.secretId, binding.secretScopeId ?? ScopeId.make(targetScope)).pipe(
-        Effect5.catchTag(
-          "SecretOwnedByConnectionError",
-          () => Effect5.fail(
-            new GraphqlIntrospectionError({
-              message: `Secret not found for ${name}`
-            })
-          )
-        )
-      );
-      if (secret === null) {
-        return yield* new GraphqlIntrospectionError({
-          message: `Missing secret "${binding.secretId}" for ${name}`
-        });
-      }
-      resolved[name] = value.prefix ? `${value.prefix}${secret}` : secret;
-      continue;
-    }
-    if (binding?.kind === "text") {
-      resolved[name] = value.prefix ? `${value.prefix}${binding.text}` : binding.text;
-    }
-  }
-  return Object.keys(resolved).length > 0 ? resolved : void 0;
-});
-var resolveInitialOAuthHeaders = (ctx, bindings, targetScope) => Effect5.gen(function* () {
-  const connection = bindings.find(
-    (binding) => binding.slot === GRAPHQL_OAUTH_CONNECTION_SLOT && binding.value.kind === "connection"
-  );
-  if (!connection || connection.value.kind !== "connection") return void 0;
-  const connectionId = connection.value.connectionId;
-  const accessToken = yield* ctx.connections.accessTokenAtScope(connectionId, ScopeId.make(targetScope)).pipe(
-    Effect5.mapError(
-      ({ message }) => new GraphqlIntrospectionError({
-        message: `Failed to resolve OAuth connection "${connectionId}": ${message}`
-      })
-    )
-  );
-  return { Authorization: `Bearer ${accessToken}` };
-});
-var resolveGraphqlBindingValueMap = (ctx, values, params) => Effect5.gen(function* () {
-  if (!values) return void 0;
-  const resolved = {};
-  for (const [name, value] of Object.entries(values)) {
-    if (typeof value === "string") {
-      resolved[name] = value;
-      continue;
-    }
-    const binding = yield* resolveGraphqlSourceBinding(
-      ctx,
-      params.sourceId,
-      params.sourceScope,
-      value.slot
-    );
-    if (binding?.value.kind === "secret") {
-      const secretBinding = binding.value;
-      const secret = yield* ctx.secrets.getAtScope(secretBinding.secretId, binding.scopeId).pipe(
-        Effect5.catchTag(
-          "SecretOwnedByConnectionError",
-          () => Effect5.fail(
-            new GraphqlAuthRequiredError({
-              code: "credential_secret_missing",
-              sourceId: params.sourceId,
-              sourceScope: params.sourceScope,
-              credentialKind: "secret",
-              credentialLabel: name,
-              slotKey: value.slot,
-              secretId: String(secretBinding.secretId),
-              message: `Secret not found for ${params.missingLabel} "${name}"`
-            })
-          )
-        )
-      );
-      if (secret === null) {
-        return yield* new GraphqlAuthRequiredError({
-          code: "credential_secret_missing",
-          sourceId: params.sourceId,
-          sourceScope: params.sourceScope,
-          credentialKind: "secret",
-          credentialLabel: name,
-          slotKey: value.slot,
-          secretId: String(secretBinding.secretId),
-          message: `Missing secret "${secretBinding.secretId}" for ${params.missingLabel} "${name}"`
-        });
-      }
-      resolved[name] = value.prefix ? `${value.prefix}${secret}` : secret;
-      continue;
-    }
-    if (binding?.value.kind === "text") {
-      resolved[name] = value.prefix ? `${value.prefix}${binding.value.text}` : binding.value.text;
-      continue;
-    }
-    return yield* new GraphqlAuthRequiredError({
-      code: "credential_binding_missing",
-      sourceId: params.sourceId,
-      sourceScope: params.sourceScope,
-      credentialKind: "secret",
-      credentialLabel: name,
-      slotKey: value.slot,
-      message: `Missing binding for ${params.missingLabel} "${name}"`
-    });
-  }
-  return Object.keys(resolved).length > 0 ? resolved : void 0;
-});
-var resolveGraphqlStoredOAuthHeader = (ctx, sourceId, sourceScope, auth) => Effect5.gen(function* () {
-  if (!auth || auth.kind === "none") return void 0;
-  const binding = yield* resolveGraphqlSourceBinding(
-    ctx,
-    sourceId,
-    sourceScope,
-    auth.connectionSlot
-  );
-  if (binding?.value.kind !== "connection") {
-    return yield* new GraphqlAuthRequiredError({
-      code: "oauth_connection_missing",
-      sourceId,
-      sourceScope,
-      credentialKind: "connection",
-      credentialLabel: "OAuth sign-in",
-      slotKey: auth.connectionSlot,
-      message: `Missing OAuth connection binding for GraphQL source "${sourceId}"`
-    });
-  }
-  const connectionId = binding.value.connectionId;
-  const accessToken = yield* ctx.connections.accessTokenAtScope(connectionId, binding.scopeId).pipe(
-    Effect5.catchTags({
-      ConnectionReauthRequiredError: ({ message, connectionId: connectionId2 }) => Effect5.fail(
-        new GraphqlAuthRequiredError({
-          code: "oauth_reauth_required",
-          sourceId,
-          sourceScope,
-          credentialKind: "oauth",
-          credentialLabel: "OAuth sign-in",
-          slotKey: auth.connectionSlot,
-          connectionId: String(connectionId2),
-          message: `OAuth connection "${connectionId2}" needs re-authentication: ${message}`
-        })
-      ),
-      ConnectionNotFoundError: ({ connectionId: connectionId2 }) => Effect5.fail(
-        new GraphqlAuthRequiredError({
-          code: "oauth_connection_missing",
-          sourceId,
-          sourceScope,
-          credentialKind: "connection",
-          credentialLabel: "OAuth sign-in",
-          slotKey: auth.connectionSlot,
-          connectionId: String(connectionId2),
-          message: `OAuth connection "${connectionId2}" was not found for GraphQL source "${sourceId}"`
-        })
-      ),
-      ConnectionProviderNotRegisteredError: ({ provider }) => Effect5.fail(
-        new GraphqlAuthRequiredError({
-          code: "oauth_connection_failed",
-          sourceId,
-          sourceScope,
-          credentialKind: "oauth",
-          credentialLabel: "OAuth sign-in",
-          slotKey: auth.connectionSlot,
-          connectionId: String(connectionId),
-          message: `OAuth provider "${provider}" is not registered`
-        })
-      ),
-      ConnectionRefreshNotSupportedError: ({ provider, connectionId: connectionId2 }) => Effect5.fail(
-        new GraphqlAuthRequiredError({
-          code: "oauth_connection_failed",
-          sourceId,
-          sourceScope,
-          credentialKind: "oauth",
-          credentialLabel: "OAuth sign-in",
-          slotKey: auth.connectionSlot,
-          connectionId: String(connectionId2),
-          message: `OAuth provider "${provider}" cannot refresh connection "${connectionId2}"`
-        })
-      ),
-      ConnectionRefreshError: ({ message, connectionId: connectionId2 }) => Effect5.fail(
-        new GraphqlAuthRequiredError({
-          code: "oauth_connection_failed",
-          sourceId,
-          sourceScope,
-          credentialKind: "oauth",
-          credentialLabel: "OAuth sign-in",
-          slotKey: auth.connectionSlot,
-          connectionId: String(connectionId2),
-          message: `OAuth connection "${connectionId2}" refresh failed: ${message}`
-        })
-      )
-    })
-  );
-  return { Authorization: `Bearer ${accessToken}` };
-});
-var makeGraphqlExtension = (ctx, httpClientLayer, configFile) => {
-  const addSourceInternal = (config) => ctx.transaction(
-    Effect5.gen(function* () {
-      const namespace = config.namespace;
-      const canonicalHeaders = canonicalizeConfiguredValueMap(config.headers, graphqlHeaderSlot);
-      const canonicalQueryParams = canonicalizeConfiguredValueMap(
-        config.queryParams,
-        graphqlQueryParamSlot
-      );
-      const initialHeaders = config.credentials?.headers !== void 0 ? canonicalizeCredentialMap(config.credentials.headers, graphqlHeaderSlot) : null;
-      const initialQueryParams = config.credentials?.queryParams !== void 0 ? canonicalizeCredentialMap(config.credentials.queryParams, graphqlQueryParamSlot) : null;
-      const initialAuth = config.credentials?.auth !== void 0 ? canonicalizeAuth(config.credentials.auth) : null;
-      const auth = config.oauth2 ? authFromOAuth2Source(config.oauth2) : initialAuth?.auth ?? { kind: "none" };
-      const initialBindings = [
-        ...initialHeaders?.bindings ?? [],
-        ...initialQueryParams?.bindings ?? [],
-        ...initialAuth?.bindings ?? []
-      ];
-      const initialScope = config.credentials?.scope;
-      if (initialScope && initialBindings.length > 0) {
-        yield* validateGraphqlBindingTarget(ctx, {
-          sourceId: namespace,
-          sourceScope: config.scope,
-          targetScope: initialScope
-        });
-      }
-      let introspectionResult;
-      if (config.introspectionJson) {
-        introspectionResult = yield* parseIntrospectionJson(config.introspectionJson);
-      } else {
-        const resolvedInitialHeaders = initialHeaders && initialScope ? yield* resolveInitialCredentialValueMap(
-          ctx,
-          canonicalHeaders,
-          initialHeaders.bindings,
-          initialScope
-        ) : void 0;
-        const resolvedOAuthHeaders = initialAuth && initialScope ? yield* resolveInitialOAuthHeaders(ctx, initialAuth.bindings, initialScope) : void 0;
-        const resolvedHeaders = {
-          ...resolveConfiguredValueMap(config.headers) ?? {},
-          ...resolvedInitialHeaders ?? {},
-          ...resolvedOAuthHeaders ?? {}
-        };
-        const resolvedInitialQueryParams = initialQueryParams && initialScope ? yield* resolveInitialCredentialValueMap(
-          ctx,
-          canonicalQueryParams,
-          initialQueryParams.bindings,
-          initialScope
-        ) : void 0;
-        const resolvedQueryParams = {
-          ...resolveConfiguredValueMap(config.queryParams) ?? {},
-          ...resolvedInitialQueryParams ?? {}
-        };
-        introspectionResult = yield* introspect(
-          config.endpoint,
-          Object.keys(resolvedHeaders).length > 0 ? resolvedHeaders : void 0,
-          Object.keys(resolvedQueryParams).length > 0 ? resolvedQueryParams : void 0
-        ).pipe(Effect5.provide(httpClientLayer));
-      }
-      const { result, definitions } = yield* extract(introspectionResult);
-      const prepared = prepareOperations(result.fields, introspectionResult);
-      const displayName = config.name?.trim() || namespace;
-      const storedSource = {
-        namespace,
-        scope: config.scope,
-        name: displayName,
-        endpoint: config.endpoint,
-        headers: canonicalHeaders,
-        queryParams: canonicalQueryParams,
-        auth
-      };
-      const storedOps = prepared.map((p) => ({
-        toolId: `${namespace}.${p.toolPath}`,
-        sourceId: namespace,
-        binding: p.binding
-      }));
-      yield* ctx.storage.upsertSource(storedSource, storedOps);
-      yield* ctx.core.sources.register({
-        id: namespace,
-        scope: config.scope,
-        kind: "graphql",
-        name: displayName,
-        url: config.endpoint,
-        canRemove: true,
-        canRefresh: false,
-        canEdit: true,
-        tools: prepared.map((p) => ({
-          name: p.toolPath,
-          description: p.description,
-          inputSchema: p.inputSchema
-        }))
-      });
-      if (initialScope && initialBindings.length > 0) {
-        yield* ctx.credentialBindings.replaceForSource({
-          targetScope: ScopeId.make(initialScope),
-          pluginId: GRAPHQL_PLUGIN_ID,
-          sourceId: namespace,
-          sourceScope: ScopeId.make(config.scope),
-          slotPrefixes: [
-            ...config.credentials?.headers !== void 0 ? ["header:"] : [],
-            ...config.credentials?.queryParams !== void 0 ? ["query_param:"] : [],
-            ...config.credentials?.auth !== void 0 ? ["auth:"] : []
-          ],
-          bindings: initialBindings.map((binding) => ({
-            slotKey: binding.slot,
-            value: binding.value
-          }))
-        });
-      }
-      if (Object.keys(definitions).length > 0) {
-        yield* ctx.core.definitions.register({
-          sourceId: namespace,
-          scope: config.scope,
-          definitions
-        });
-      }
-      return { toolCount: prepared.length, namespace };
-    })
-  );
-  const configureSource = (namespace, scope, targetScope, input) => Effect5.gen(function* () {
-    const existing = yield* ctx.storage.getSource(namespace, scope);
-    if (!existing) return;
-    const canonicalHeaders = input.headers !== void 0 ? canonicalizeCredentialMap(input.headers, graphqlHeaderSlot) : null;
-    const canonicalQueryParams = input.queryParams !== void 0 ? canonicalizeCredentialMap(input.queryParams, graphqlQueryParamSlot) : null;
-    const canonicalAuth = input.auth !== void 0 ? canonicalizeAuth(input.auth) : null;
-    const directBindings = [
-      ...canonicalHeaders?.bindings ?? [],
-      ...canonicalQueryParams?.bindings ?? [],
-      ...canonicalAuth?.bindings ?? []
-    ];
-    if (directBindings.length > 0) {
-      yield* validateGraphqlBindingTarget(ctx, {
-        sourceId: namespace,
-        sourceScope: scope,
-        targetScope
-      });
-    }
-    const affectedPrefixes = [
-      ...input.headers !== void 0 ? ["header:"] : [],
-      ...input.queryParams !== void 0 ? ["query_param:"] : [],
-      ...input.auth !== void 0 ? ["auth:"] : []
-    ];
-    yield* ctx.transaction(
-      Effect5.gen(function* () {
-        yield* ctx.storage.updateSourceMeta(namespace, scope, {
-          name: input.name?.trim() || void 0,
-          endpoint: input.endpoint,
-          headers: canonicalHeaders?.values,
-          queryParams: canonicalQueryParams?.values,
-          auth: canonicalAuth?.auth
-        });
-        if (affectedPrefixes.length > 0 || directBindings.length > 0) {
-          yield* ctx.credentialBindings.replaceForSource({
-            targetScope: ScopeId.make(targetScope),
-            pluginId: GRAPHQL_PLUGIN_ID,
-            sourceId: namespace,
-            sourceScope: ScopeId.make(scope),
-            slotPrefixes: affectedPrefixes,
-            bindings: directBindings.map((binding) => ({
-              slotKey: binding.slot,
-              value: binding.value
-            }))
-          });
-        }
-      })
-    );
-  });
-  return {
-    addSource: (config) => addSourceInternal(config).pipe(
-      Effect5.tap(
-        (result) => configFile ? configFile.upsertSource(toGraphqlConfigEntry(result.namespace, config)) : Effect5.void
-      )
-    ),
-    removeSource: (namespace, scope) => Effect5.gen(function* () {
-      yield* ctx.transaction(
-        Effect5.gen(function* () {
-          yield* ctx.credentialBindings.removeForSource({
-            pluginId: GRAPHQL_PLUGIN_ID,
-            sourceId: namespace,
-            sourceScope: ScopeId.make(scope)
-          });
-          yield* ctx.storage.removeSource(namespace, scope);
-          yield* ctx.core.sources.unregister({ id: namespace, targetScope: scope });
-        })
-      );
-      if (configFile) {
-        yield* configFile.removeSource(namespace);
-      }
-    }),
-    getSource: (namespace, scope) => ctx.storage.getSource(namespace, scope),
-    configureSource,
-    configure: (source, input) => configureSource(source.id, source.scope, input.scope, input)
-  };
-};
-var graphqlPlugin = definePlugin((options) => {
-  return {
-    id: "graphql",
-    packageName: "@executor-js/plugin-graphql",
-    sourcePresets: graphqlPresets,
-    schema: graphqlSchema,
-    storage: (deps) => makeDefaultGraphqlStore(deps),
-    extension: (ctx) => makeGraphqlExtension(
-      ctx,
-      options?.httpClientLayer ?? ctx.httpClientLayer,
-      options?.configFile
-    ),
-    sourceConfigure: {
-      type: "graphql",
-      schema: SourceConfigureInputSchema,
-      configure: ({ ctx, sourceId, sourceScope, targetScope, config }) => makeGraphqlExtension(
-        ctx,
-        options?.httpClientLayer ?? ctx.httpClientLayer,
-        options?.configFile
-      ).configureSource(
-        sourceId,
-        sourceScope,
-        targetScope,
-        config
-      )
-    },
-    staticSources: (self) => [
-      {
-        id: "graphql",
-        kind: "executor",
-        name: "GraphQL",
-        tools: [
-          tool({
-            name: "getSource",
-            description: "Inspect an existing GraphQL source, including endpoint, auth mode, configured headers/query params, and credential slots. Use this before repairing an existing source with `graphql.configureSource`, `secrets.create`, or `oauth.start`.",
-            inputSchema: StaticGetSourceInputStandardSchema,
-            outputSchema: StaticGetSourceOutputStandardSchema,
-            execute: (input, { ctx }) => Effect5.map(
-              self.getSource(input.namespace, resolveStaticScopeInput(ctx, input.scope)),
-              (source) => ToolResult.ok({ source })
-            )
-          }),
-          tool({
-            name: "addSource",
-            description: "Add a GraphQL endpoint and register its operations as tools. Executor chooses the source install scope (local scope locally, organization scope in cloud) and returns it as `source`. For API keys or bearer tokens, first call `executor.coreTools.secrets.create` at the user's chosen credential scope and pass secret refs through `credentials`. For OAuth, start the browser flow with `executor.coreTools.oauth.start` using `credentialScope` set to the user's chosen personal or organization credential scope, verify completion with `connections.list`, then bind the connection through `credentials` or `graphql.configureSource`.",
-            annotations: {
-              requiresApproval: true,
-              approvalDescription: "Add a GraphQL source"
-            },
-            inputSchema: StaticAddSourceInputStandardSchema,
-            outputSchema: StaticAddSourceOutputStandardSchema,
-            execute: (input, { ctx }) => {
-              const sourceScope = defaultSourceInstallScopeId(ctx.scopes);
-              if (sourceScope === null) {
-                return Effect5.succeed(
-                  graphqlToolFailure(
-                    "source_scope_unavailable",
-                    "Cannot add a GraphQL source because this executor has no source install scope."
-                  )
-                );
-              }
-              return self.addSource({ ...input, scope: sourceScope }).pipe(
-                Effect5.map(
-                  (result) => ToolResult.ok({
-                    ...result,
-                    source: { id: result.namespace, scope: sourceScope }
-                  })
-                ),
-                Effect5.catchTags({
-                  GraphqlIntrospectionError: ({ message }) => Effect5.succeed(graphqlToolFailure("graphql_introspection_failed", message)),
-                  GraphqlExtractionError: ({ message }) => Effect5.succeed(graphqlToolFailure("graphql_extraction_failed", message))
-                })
-              );
-            }
-          }),
-          tool({
-            name: "configureSource",
-            description: 'Configure an existing GraphQL source with concrete fields. Use `source` returned by `graphql.addSource` or `sources.list`. The top-level `scope` is the credential target scope for bindings; in cloud, choose the user or organization credential scope deliberately. Pass secret refs as `{kind:"secret", secretId}` and OAuth connections as `{kind:"connection", connectionId}`.',
-            annotations: {
-              requiresApproval: true,
-              approvalDescription: "Configure a GraphQL source"
-            },
-            inputSchema: StaticConfigureSourceInputStandardSchema,
-            outputSchema: StaticConfigureSourceOutputStandardSchema,
-            execute: (input, { ctx }) => {
-              const { source, ...config } = input;
-              const sourceScope = resolveStaticScopeInput(ctx, source.scope);
-              const targetScope = resolveStaticScopeInput(ctx, config.scope);
-              return Effect5.as(
-                self.configure(
-                  { id: source.id, scope: sourceScope },
-                  { ...config, scope: targetScope }
-                ),
-                ToolResult.ok({ configured: true })
-              );
-            }
-          })
-        ]
-      }
-    ],
-    invokeTool: ({ ctx, toolRow, args }) => Effect5.gen(function* () {
-      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
-      const toolScope = toolRow.scope_id;
-      const op = yield* ctx.storage.getOperationByToolId(toolRow.id, toolScope);
-      if (!op) {
-        return yield* new GraphqlInvocationError({
-          message: `No GraphQL operation found for tool "${toolRow.id}"`,
-          statusCode: Option5.none()
-        });
-      }
-      const source = yield* ctx.storage.getSource(op.sourceId, toolScope);
-      if (!source) {
-        return yield* new GraphqlInvocationError({
-          message: `No GraphQL source found for "${op.sourceId}"`,
-          statusCode: Option5.none()
-        });
-      }
-      const resolvedHeaders = (yield* resolveGraphqlBindingValueMap(ctx, source.headers, {
-        sourceId: source.namespace,
-        sourceScope: source.scope,
-        missingLabel: "header"
-      })) ?? {};
-      const resolvedQueryParams = (yield* resolveGraphqlBindingValueMap(ctx, source.queryParams, {
-        sourceId: source.namespace,
-        sourceScope: source.scope,
-        missingLabel: "query parameter"
-      })) ?? {};
-      const oauthHeader = yield* resolveGraphqlStoredOAuthHeader(
-        ctx,
-        source.namespace,
-        source.scope,
-        source.auth
-      );
-      Object.assign(resolvedHeaders, oauthHeader ?? {});
-      const result = yield* invokeWithLayer(
-        op.binding,
-        args ?? {},
-        source.endpoint,
-        resolvedHeaders,
-        resolvedQueryParams,
-        httpClientLayer
-      );
-      const errors = decodeGraphqlErrors(result.errors);
-      if (errors !== void 0 && errors.length > 0) {
-        const firstMessage = extractGraphqlErrorMessage(errors);
-        return ToolResult.fail({
-          code: "graphql_errors",
-          message: firstMessage !== void 0 ? firstMessage : "GraphQL request returned errors",
-          details: { errors }
-        });
-      }
-      if (result.status < 200 || result.status >= 300) {
-        if (result.status === 401 || result.status === 403) {
-          return authToolFailure({
-            code: "credential_rejected",
-            status: result.status,
-            message: `Upstream rejected credentials for GraphQL source "${source.namespace}" with HTTP ${result.status}. Re-authenticate or update the source credentials before retrying this tool.`,
-            source: { id: source.namespace, scope: source.scope },
-            credential: { kind: "upstream", label: "Upstream authorization" },
-            upstream: {
-              status: result.status,
-              details: {
-                data: result.data,
-                errors: result.errors
-              }
-            },
-            recovery: { configureSourceTool: "executor.graphql.configureSource" }
-          });
-        }
-        return ToolResult.fail({
-          code: "graphql_http_error",
-          status: result.status,
-          message: `GraphQL request failed with HTTP ${result.status}`,
-          details: {
-            status: result.status,
-            data: result.data,
-            errors: result.errors
-          }
-        });
-      }
-      return ToolResult.ok(result.data);
-    }).pipe(
-      Effect5.catchTag(
-        "GraphqlAuthRequiredError",
-        (error) => Effect5.succeed(graphqlAuthToolFailure(error))
-      )
-    ),
-    resolveAnnotations: ({ ctx, sourceId, toolRows }) => Effect5.gen(function* () {
-      const scopes = /* @__PURE__ */ new Set();
-      for (const row of toolRows) {
-        scopes.add(row.scope_id);
-      }
-      const entries = yield* Effect5.forEach(
-        [...scopes],
-        (scope) => Effect5.gen(function* () {
-          const ops = yield* ctx.storage.listOperationsBySource(sourceId, scope);
-          const byId = /* @__PURE__ */ new Map();
-          for (const op of ops) byId.set(op.toolId, op.binding);
-          return [scope, byId];
-        }),
-        { concurrency: "unbounded" }
-      );
-      const byScope = new Map(entries);
-      const out = {};
-      for (const row of toolRows) {
-        const binding = byScope.get(row.scope_id)?.get(row.id);
-        if (binding) out[row.id] = annotationsFor(binding);
-      }
-      return out;
-    }),
-    removeSource: ({ ctx, sourceId, scope }) => Effect5.gen(function* () {
-      yield* ctx.transaction(
-        Effect5.gen(function* () {
-          yield* ctx.credentialBindings.removeForSource({
-            pluginId: GRAPHQL_PLUGIN_ID,
-            sourceId,
-            sourceScope: ScopeId.make(scope)
-          });
-          yield* ctx.storage.removeSource(sourceId, scope);
-        })
-      );
-      if (options?.configFile) {
-        yield* options.configFile.removeSource(sourceId);
-      }
-    }),
-    usagesForSecret: () => Effect5.succeed([]),
-    usagesForConnection: () => Effect5.succeed([]),
-    detect: ({ ctx, url }) => Effect5.gen(function* () {
-      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;
-      const trimmed = url.trim();
-      if (!trimmed) return null;
-      const parsed = yield* Effect5.try({
-        try: () => new URL(trimmed),
-        catch: (cause) => cause
-      }).pipe(Effect5.option);
-      if (Option5.isNone(parsed)) return null;
-      const ok = yield* introspect(trimmed).pipe(
-        Effect5.provide(httpClientLayer),
-        Effect5.map(() => true),
-        Effect5.catch(() => Effect5.succeed(false))
-      );
-      const name = namespaceFromEndpoint(trimmed);
-      if (ok) {
-        return SourceDetectionResult.make({
-          kind: "graphql",
-          confidence: "high",
-          endpoint: trimmed,
-          name,
-          namespace: name
-        });
-      }
-      if (urlMatchesToken(parsed.value, "graphql")) {
-        return SourceDetectionResult.make({
-          kind: "graphql",
-          confidence: "low",
-          endpoint: trimmed,
-          name,
-          namespace: name
-        });
-      }
-      return null;
-    })
-  };
-});
-
-export {
-  introspect,
-  parseIntrospectionJson,
-  extract,
-  resolveHeaders,
-  invoke,
-  invokeWithLayer,
-  graphqlSchema,
-  makeDefaultGraphqlStore,
-  graphqlPlugin
-};
-//# sourceMappingURL=chunk-2252RTCE.js.map