@executor-js/sdk 0.0.2 → 0.2.0

package/dist/client.d.ts

@@ -0,0 +1,132 @@
+import { createElement, type ComponentType, type ReactNode } from "react";
+import type { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+import * as AtomHttpApi from "effect/unstable/reactivity/AtomHttpApi";
+export { Schema } from "effect";
+export { HttpApi, HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+export * as AsyncResult from "effect/unstable/reactivity/AsyncResult";
+export * as Atom from "effect/unstable/reactivity/Atom";
+export * as AtomHttpApi from "effect/unstable/reactivity/AtomHttpApi";
+export { useAtomValue, useAtomSet, useAtomMount, useAtomRefresh } from "@effect/atom-react";
+export interface PageDecl {
+    /** Path relative to the plugin's mount point, e.g. `/`, `/edit/$id`. */
+    readonly path: string;
+    readonly component: ComponentType;
+    /** Optional sidebar nav metadata — the host renders these alongside its
+     *  own nav links. Omit to register a page without a nav entry. */
+    readonly nav?: {
+        readonly label: string;
+        readonly section?: string;
+    };
+}
+export interface WidgetProps {
+    readonly scopeId?: string;
+}
+export interface WidgetDecl {
+    readonly id: string;
+    readonly component: ComponentType<WidgetProps>;
+    readonly size?: "half" | "full";
+}
+/**
+ * Open record of host-defined slot components a plugin can fill. Slot
+ * names are part of the host UI contract — plugins opt in by registering
+ * a component for the slot they care about. Adding a slot is a host-side
+ * change; plugin authors don't define new slots.
+ */
+export type SlotComponent = ComponentType<Record<string, unknown>>;
+export interface SourcePreset {
+    /** Unique id (e.g. "stripe", "github-graphql"). */
+    readonly id: string;
+    readonly name: string;
+    readonly summary: string;
+    /** URL passed as `initialUrl` to the add form. Omit for presets that
+     *  don't use a URL (e.g. stdio MCP presets). */
+    readonly url?: string;
+    /** Optional icon URL (favicon, logo). */
+    readonly icon?: string;
+    /** Shown in the top-level grid on the sources page when true. */
+    readonly featured?: boolean;
+}
+export interface SourcePlugin {
+    /** Unique key matching the SDK plugin id (e.g. "openapi"). */
+    readonly key: string;
+    readonly label: string;
+    readonly add: ComponentType<{
+        readonly onComplete: () => void;
+        readonly onCancel: () => void;
+        readonly initialUrl?: string;
+        readonly initialPreset?: string;
+        readonly initialNamespace?: string;
+    }>;
+    readonly edit: ComponentType<{
+        readonly sourceId: string;
+        readonly onSave: () => void;
+    }>;
+    readonly summary?: ComponentType<{
+        readonly sourceId: string;
+        readonly variant?: "badge" | "panel";
+        readonly onAction?: () => void;
+    }>;
+    readonly presets?: readonly SourcePreset[];
+    /** Trigger early download of the plugin's lazy component chunks (add/edit/etc.).
+     *  Call from the host on intent (hover/focus) so the chunks land before the
+     *  user navigates into the add page. Idempotent. */
+    readonly preload?: () => void;
+}
+export interface SecretProviderPlugin {
+    /** Unique key matching the SDK plugin id (e.g. "onepassword"). */
+    readonly key: string;
+    readonly label: string;
+    readonly settings: ComponentType<Record<string, never>>;
+}
+export interface ClientPluginSpec<TId extends string = string> {
+    readonly id: TId;
+    readonly pages?: readonly PageDecl[];
+    readonly widgets?: readonly WidgetDecl[];
+    readonly slots?: Record<string, SlotComponent>;
+    /** Source plugin contribution — populated by plugins that expose
+     *  `kind` rows in the core `source` table (openapi, mcp, graphql,
+     *  google-discovery). The host's sources page derives its provider
+     *  list from the union of every loaded plugin's `sourcePlugin`. */
+    readonly sourcePlugin?: SourcePlugin;
+    /** Secret provider plugin contribution — populated by plugins that
+     *  also ship a `secretProviders` (or related) server-side capability
+     *  AND want to expose a settings card on the host's secrets page. */
+    readonly secretProviderPlugin?: SecretProviderPlugin;
+}
+/**
+ * Identity factory — returns the spec unchanged but pins the inferred
+ * literal type of `id` so the host can index plugin records by id with
+ * full autocomplete. Plugins export this as their package's default
+ * (or named) export from `./client`.
+ */
+export declare const defineClientPlugin: <const TId extends string>(spec: ClientPluginSpec<TId>) => ClientPluginSpec<TId>;
+export interface CreatePluginAtomClientOptions {
+    /** Override the base URL. Defaults to `/api` (host strips this prefix
+     *  when forwarding to the Effect handler) — same convention as the
+     *  core `ExecutorApiClient`. */
+    readonly baseUrl?: string | (() => string);
+}
+/**
+ * Build a typed reactive client for a plugin's HttpApiGroup.
+ *
+ *   const FooClient = createPluginAtomClient(FooApi)
+ *   export const fooThings = FooClient.query("foo", "listThings", { ... })
+ *   export const fooSync   = FooClient.mutation("foo", "syncThing")
+ *
+ * Each plugin gets a private service Tag (`Plugin_<id>Client`) keyed by
+ * the group's `identifier`, so multiple plugins coexist in the same
+ * React tree without colliding.
+ */
+export declare const createPluginAtomClient: <G extends HttpApiGroup.HttpApiGroup<string, HttpApiEndpoint.Any, boolean>>(group: G, options?: CreatePluginAtomClientOptions) => AtomHttpApi.AtomHttpApiClient<`Plugin_${G["identifier"]}Client`, `Plugin_${string}Client`, G>;
+export interface ExecutorPluginsProviderProps {
+    readonly plugins: readonly ClientPluginSpec[];
+    readonly children: ReactNode;
+}
+export declare function ExecutorPluginsProvider(props: ExecutorPluginsProviderProps): ReturnType<typeof createElement>;
+/** Full list of loaded `ClientPluginSpec` values. */
+export declare const useClientPlugins: () => readonly ClientPluginSpec[];
+/** Source plugins extracted from `clientPlugins[].sourcePlugin`. */
+export declare const useSourcePlugins: () => readonly SourcePlugin[];
+/** Secret-provider plugins extracted from `clientPlugins[].secretProviderPlugin`. */
+export declare const useSecretProviderPlugins: () => readonly SecretProviderPlugin[];
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAWA,OAAO,EAEL,aAAa,EAIb,KAAK,aAAa,EAClB,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AAEf,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE7E,OAAO,KAAK,WAAW,MAAM,wCAAwC,CAAC;AAOtE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEjF,OAAO,KAAK,WAAW,MAAM,wCAAwC,CAAC;AACtE,OAAO,KAAK,IAAI,MAAM,iCAAiC,CAAC;AACxD,OAAO,KAAK,WAAW,MAAM,wCAAwC,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAW5F,MAAM,WAAW,QAAQ;IACvB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC;sEACkE;IAClE,QAAQ,CAAC,GAAG,CAAC,EAAE;QACb,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAcnE,MAAM,WAAW,YAAY;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;oDACgD;IAChD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;QAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;QAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;KAC7B,CAAC,CAAC;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;QACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;KAChC,CAAC,CAAC;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C;;wDAEoD;IACpD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CAC/B;AAQD,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,gBAAgB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC3D,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC;IACjB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C;;;uEAGmE;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;yEAEqE;IACrE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CACtD;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,KAAK,CAAC,GAAG,SAAS,MAAM,EACzD,MAAM,gBAAgB,CAAC,GAAG,CAAC,KAC1B,gBAAgB,CAAC,GAAG,CAAS,CAAC;AAkBjC,MAAM,WAAW,6BAA6B;IAC5C;;oCAEgC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GACjC,CAAC,SAAS,YAAY,CAAC,YAAY,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,EAEzE,OAAO,CAAC,EACR,UAAS,6BAAkC,kGAgB5C,CAAC;AA0BF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;CAC9B;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,4BAA4B,GAClC,UAAU,CAAC,OAAO,aAAa,CAAC,CAkBlC;AAWD,qDAAqD;AACrD,eAAO,MAAM,gBAAgB,QAAO,SAAS,gBAAgB,EAClB,CAAC;AAE5C,oEAAoE;AACpE,eAAO,MAAM,gBAAgB,QAAO,SAAS,YAAY,EACR,CAAC;AAElD,qFAAqF;AACrF,eAAO,MAAM,wBAAwB,QAAO,SAAS,oBAAoB,EACR,CAAC"}

package/dist/client.js

@@ -0,0 +1,81 @@
+// src/client.ts
+import {
+  createContext,
+  createElement,
+  useContext,
+  useEffect,
+  useMemo
+} from "react";
+import { HttpApi } from "effect/unstable/httpapi";
+import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http";
+import * as AtomHttpApi from "effect/unstable/reactivity/AtomHttpApi";
+import { Schema } from "effect";
+import { HttpApi as HttpApi2, HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+import * as AsyncResult from "effect/unstable/reactivity/AsyncResult";
+import * as Atom from "effect/unstable/reactivity/Atom";
+import * as AtomHttpApi2 from "effect/unstable/reactivity/AtomHttpApi";
+import { useAtomValue, useAtomSet, useAtomMount, useAtomRefresh } from "@effect/atom-react";
+var defineClientPlugin = (spec) => spec;
+var createPluginAtomClient = (group, options = {}) => {
+  const { baseUrl = "/api" } = options;
+  const pluginId = group.identifier;
+  const bundle = HttpApi.make(`plugin-${pluginId}`).add(group);
+  return AtomHttpApi.Service()(`Plugin_${pluginId}Client`, {
+    api: bundle,
+    httpClient: FetchHttpClient.layer,
+    ...typeof baseUrl === "function" ? {
+      transformClient: HttpClient.mapRequest(
+        (request) => HttpClientRequest.prependUrl(request, baseUrl())
+      )
+    } : { baseUrl }
+  });
+};
+var ExecutorPluginsContext = createContext(null);
+ExecutorPluginsContext.displayName = "ExecutorPluginsContext";
+function ExecutorPluginsProvider(props) {
+  const { plugins, children } = props;
+  const value = useMemo(
+    () => ({
+      plugins,
+      sourcePlugins: plugins.flatMap((p) => p.sourcePlugin ? [p.sourcePlugin] : []),
+      secretProviderPlugins: plugins.flatMap(
+        (p) => p.secretProviderPlugin ? [p.secretProviderPlugin] : []
+      )
+    }),
+    [plugins]
+  );
+  useEffect(() => {
+    for (const sp of value.sourcePlugins) sp.preload?.();
+  }, [value.sourcePlugins]);
+  return createElement(ExecutorPluginsContext.Provider, { value }, children);
+}
+var usePluginsCtx = (hookName) => {
+  const ctx = useContext(ExecutorPluginsContext);
+  if (!ctx) {
+    throw new Error(`${hookName} must be called inside an <ExecutorPluginsProvider>.`);
+  }
+  return ctx;
+};
+var useClientPlugins = () => usePluginsCtx("useClientPlugins").plugins;
+var useSourcePlugins = () => usePluginsCtx("useSourcePlugins").sourcePlugins;
+var useSecretProviderPlugins = () => usePluginsCtx("useSecretProviderPlugins").secretProviderPlugins;
+export {
+  AsyncResult,
+  Atom,
+  AtomHttpApi2 as AtomHttpApi,
+  ExecutorPluginsProvider,
+  HttpApi2 as HttpApi,
+  HttpApiEndpoint,
+  HttpApiGroup,
+  Schema,
+  createPluginAtomClient,
+  defineClientPlugin,
+  useAtomMount,
+  useAtomRefresh,
+  useAtomSet,
+  useAtomValue,
+  useClientPlugins,
+  useSecretProviderPlugins,
+  useSourcePlugins
+};
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// @executor-js/sdk/client — frontend half of the plugin SDK.\n//\n// Plugins import from this entry to register pages/widgets and consume\n// their own typed reactive client. Server bundles must NOT import this\n// module — it pulls in React + @effect/atom-react. Plugin packages should\n// keep React/atom imports inside `./client.tsx` and Effect/Node imports\n// inside `./server.ts`; shared schema definitions go in `./shared.ts` and\n// can be imported from both halves.\n// ---------------------------------------------------------------------------\n\nimport {\n  createContext,\n  createElement,\n  useContext,\n  useEffect,\n  useMemo,\n  type ComponentType,\n  type ReactNode,\n} from \"react\";\nimport { HttpApi } from \"effect/unstable/httpapi\";\nimport type { HttpApiEndpoint, HttpApiGroup } from \"effect/unstable/httpapi\";\nimport { FetchHttpClient, HttpClient, HttpClientRequest } from \"effect/unstable/http\";\nimport * as AtomHttpApi from \"effect/unstable/reactivity/AtomHttpApi\";\n\n// ---------------------------------------------------------------------------\n// Re-exports — the curated set of primitives a plugin author needs to\n// build a typed reactive UI without reaching into `effect/*` directly.\n// ---------------------------------------------------------------------------\n\nexport { Schema } from \"effect\";\nexport { HttpApi, HttpApiEndpoint, HttpApiGroup } from \"effect/unstable/httpapi\";\n\nexport * as AsyncResult from \"effect/unstable/reactivity/AsyncResult\";\nexport * as Atom from \"effect/unstable/reactivity/Atom\";\nexport * as AtomHttpApi from \"effect/unstable/reactivity/AtomHttpApi\";\n\nexport { useAtomValue, useAtomSet, useAtomMount, useAtomRefresh } from \"@effect/atom-react\";\n\n// ---------------------------------------------------------------------------\n// defineClientPlugin — declarative spec for the frontend half of a plugin.\n//\n// Mirror of `definePlugin` on the server, but everything here is React /\n// browser-only. The host treats the value as data: collects routes,\n// widgets, and slot components from every loaded plugin and mounts them\n// alongside the host's own UI.\n// ---------------------------------------------------------------------------\n\nexport interface PageDecl {\n  /** Path relative to the plugin's mount point, e.g. `/`, `/edit/$id`. */\n  readonly path: string;\n  readonly component: ComponentType;\n  /** Optional sidebar nav metadata — the host renders these alongside its\n   *  own nav links. Omit to register a page without a nav entry. */\n  readonly nav?: {\n    readonly label: string;\n    readonly section?: string;\n  };\n}\n\nexport interface WidgetProps {\n  readonly scopeId?: string;\n}\n\nexport interface WidgetDecl {\n  readonly id: string;\n  readonly component: ComponentType<WidgetProps>;\n  readonly size?: \"half\" | \"full\";\n}\n\n/**\n * Open record of host-defined slot components a plugin can fill. Slot\n * names are part of the host UI contract — plugins opt in by registering\n * a component for the slot they care about. Adding a slot is a host-side\n * change; plugin authors don't define new slots.\n */\nexport type SlotComponent = ComponentType<Record<string, unknown>>;\n\n// ---------------------------------------------------------------------------\n// SourcePlugin / SourcePreset — UI contract for plugins that expose\n// \"sources\" (OpenAPI specs, MCP servers, GraphQL endpoints, etc.). The\n// host owns the source list / detail chrome; the plugin owns the\n// add-flow, edit form, and (optional) summary + sign-in buttons.\n//\n// Lives here, not in `@executor-js/react`, so it's part of the plugin\n// contract: a plugin's `./client` entry assembles its `sourcePlugin`\n// alongside `pages`/`widgets`, and the host derives the union list\n// from `virtual:executor/plugins-client`.\n// ---------------------------------------------------------------------------\n\nexport interface SourcePreset {\n  /** Unique id (e.g. \"stripe\", \"github-graphql\"). */\n  readonly id: string;\n  readonly name: string;\n  readonly summary: string;\n  /** URL passed as `initialUrl` to the add form. Omit for presets that\n   *  don't use a URL (e.g. stdio MCP presets). */\n  readonly url?: string;\n  /** Optional icon URL (favicon, logo). */\n  readonly icon?: string;\n  /** Shown in the top-level grid on the sources page when true. */\n  readonly featured?: boolean;\n}\n\nexport interface SourcePlugin {\n  /** Unique key matching the SDK plugin id (e.g. \"openapi\"). */\n  readonly key: string;\n  readonly label: string;\n  readonly add: ComponentType<{\n    readonly onComplete: () => void;\n    readonly onCancel: () => void;\n    readonly initialUrl?: string;\n    readonly initialPreset?: string;\n    readonly initialNamespace?: string;\n  }>;\n  readonly edit: ComponentType<{\n    readonly sourceId: string;\n    readonly onSave: () => void;\n  }>;\n  readonly summary?: ComponentType<{\n    readonly sourceId: string;\n    readonly variant?: \"badge\" | \"panel\";\n    readonly onAction?: () => void;\n  }>;\n  readonly presets?: readonly SourcePreset[];\n  /** Trigger early download of the plugin's lazy component chunks (add/edit/etc.).\n   *  Call from the host on intent (hover/focus) so the chunks land before the\n   *  user navigates into the add page. Idempotent. */\n  readonly preload?: () => void;\n}\n\n// ---------------------------------------------------------------------------\n// SecretProviderPlugin — UI contract for plugins that contribute secret\n// providers (1Password, WorkOS Vault, etc.). The host owns the secrets\n// page chrome; the plugin owns the settings card rendered inside.\n// ---------------------------------------------------------------------------\n\nexport interface SecretProviderPlugin {\n  /** Unique key matching the SDK plugin id (e.g. \"onepassword\"). */\n  readonly key: string;\n  readonly label: string;\n  readonly settings: ComponentType<Record<string, never>>;\n}\n\nexport interface ClientPluginSpec<TId extends string = string> {\n  readonly id: TId;\n  readonly pages?: readonly PageDecl[];\n  readonly widgets?: readonly WidgetDecl[];\n  readonly slots?: Record<string, SlotComponent>;\n  /** Source plugin contribution — populated by plugins that expose\n   *  `kind` rows in the core `source` table (openapi, mcp, graphql,\n   *  google-discovery). The host's sources page derives its provider\n   *  list from the union of every loaded plugin's `sourcePlugin`. */\n  readonly sourcePlugin?: SourcePlugin;\n  /** Secret provider plugin contribution — populated by plugins that\n   *  also ship a `secretProviders` (or related) server-side capability\n   *  AND want to expose a settings card on the host's secrets page. */\n  readonly secretProviderPlugin?: SecretProviderPlugin;\n}\n\n/**\n * Identity factory — returns the spec unchanged but pins the inferred\n * literal type of `id` so the host can index plugin records by id with\n * full autocomplete. Plugins export this as their package's default\n * (or named) export from `./client`.\n */\nexport const defineClientPlugin = <const TId extends string>(\n  spec: ClientPluginSpec<TId>,\n): ClientPluginSpec<TId> => spec;\n\n// ---------------------------------------------------------------------------\n// createPluginAtomClient — typed reactive HTTP client for one plugin.\n//\n// Wraps the plugin's `HttpApiGroup` in a per-plugin `HttpApi`, then\n// hands back an `AtomHttpApi.Service` keyed to that bundle. The\n// resulting service exposes `.query(\"group\", \"endpoint\", opts)` and\n// `.mutation(\"group\", \"endpoint\")` factories — same shape as the host's\n// existing `ExecutorApiClient` (see packages/react/src/api/client.tsx).\n// Per-endpoint payload/response/error types flow through from the\n// imported group, so plugin client code typechecks without codegen.\n//\n// The plugin id (used for the Service Tag and the synthetic API id) is\n// read from `group.identifier` — the same string the plugin passed to\n// `HttpApiGroup.make(\"foo\")`. No second-source duplication.\n// ---------------------------------------------------------------------------\n\nexport interface CreatePluginAtomClientOptions {\n  /** Override the base URL. Defaults to `/api` (host strips this prefix\n   *  when forwarding to the Effect handler) — same convention as the\n   *  core `ExecutorApiClient`. */\n  readonly baseUrl?: string | (() => string);\n}\n\n/**\n * Build a typed reactive client for a plugin's HttpApiGroup.\n *\n *   const FooClient = createPluginAtomClient(FooApi)\n *   export const fooThings = FooClient.query(\"foo\", \"listThings\", { ... })\n *   export const fooSync   = FooClient.mutation(\"foo\", \"syncThing\")\n *\n * Each plugin gets a private service Tag (`Plugin_<id>Client`) keyed by\n * the group's `identifier`, so multiple plugins coexist in the same\n * React tree without colliding.\n */\nexport const createPluginAtomClient = <\n  G extends HttpApiGroup.HttpApiGroup<string, HttpApiEndpoint.Any, boolean>,\n>(\n  group: G,\n  options: CreatePluginAtomClientOptions = {},\n) => {\n  const { baseUrl = \"/api\" } = options;\n  const pluginId = group.identifier;\n  const bundle = HttpApi.make(`plugin-${pluginId}`).add(group);\n  return AtomHttpApi.Service<`Plugin_${G[\"identifier\"]}Client`>()(`Plugin_${pluginId}Client`, {\n    api: bundle,\n    httpClient: FetchHttpClient.layer,\n    ...(typeof baseUrl === \"function\"\n      ? {\n          transformClient: HttpClient.mapRequest((request) =>\n            HttpClientRequest.prependUrl(request, baseUrl()),\n          ),\n        }\n      : { baseUrl }),\n  });\n};\n\n// ---------------------------------------------------------------------------\n// ExecutorPluginsProvider + hooks — host-level distribution of the loaded\n// `ClientPluginSpec[]` via React context.\n//\n// The host wraps once at the root of its tree (typically reading from\n// `virtual:executor/plugins-client`); pages and shared components consume\n// via the focused hooks (`useSourcePlugins` etc.) so they don't import\n// from any host-app aggregator file. Pages stay portable across hosts —\n// the same component renders against whatever plugin set the surrounding\n// `<ExecutorPluginsProvider>` provides.\n//\n// Hooks throw if no provider is in scope so missing setup fails loudly;\n// matches the pattern of `useScope` / `useAuth` already in the codebase.\n// ---------------------------------------------------------------------------\n\ninterface ExecutorPluginsContextValue {\n  readonly plugins: readonly ClientPluginSpec[];\n  readonly sourcePlugins: readonly SourcePlugin[];\n  readonly secretProviderPlugins: readonly SecretProviderPlugin[];\n}\n\nconst ExecutorPluginsContext = createContext<ExecutorPluginsContextValue | null>(null);\nExecutorPluginsContext.displayName = \"ExecutorPluginsContext\";\n\nexport interface ExecutorPluginsProviderProps {\n  readonly plugins: readonly ClientPluginSpec[];\n  readonly children: ReactNode;\n}\n\nexport function ExecutorPluginsProvider(\n  props: ExecutorPluginsProviderProps,\n): ReturnType<typeof createElement> {\n  const { plugins, children } = props;\n  const value = useMemo<ExecutorPluginsContextValue>(\n    () => ({\n      plugins,\n      sourcePlugins: plugins.flatMap((p) => (p.sourcePlugin ? [p.sourcePlugin] : [])),\n      secretProviderPlugins: plugins.flatMap((p) =>\n        p.secretProviderPlugin ? [p.secretProviderPlugin] : [],\n      ),\n    }),\n    [plugins],\n  );\n  // Kick off lazy chunk downloads for every source plugin once the host\n  // mounts, so navigating into an add/edit page doesn't suspend.\n  useEffect(() => {\n    for (const sp of value.sourcePlugins) sp.preload?.();\n  }, [value.sourcePlugins]);\n  return createElement(ExecutorPluginsContext.Provider, { value }, children);\n}\n\nconst usePluginsCtx = (hookName: string): ExecutorPluginsContextValue => {\n  const ctx = useContext(ExecutorPluginsContext);\n  if (!ctx) {\n    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: React hook invariant\n    throw new Error(`${hookName} must be called inside an <ExecutorPluginsProvider>.`);\n  }\n  return ctx;\n};\n\n/** Full list of loaded `ClientPluginSpec` values. */\nexport const useClientPlugins = (): readonly ClientPluginSpec[] =>\n  usePluginsCtx(\"useClientPlugins\").plugins;\n\n/** Source plugins extracted from `clientPlugins[].sourcePlugin`. */\nexport const useSourcePlugins = (): readonly SourcePlugin[] =>\n  usePluginsCtx(\"useSourcePlugins\").sourcePlugins;\n\n/** Secret-provider plugins extracted from `clientPlugins[].secretProviderPlugin`. */\nexport const useSecretProviderPlugins = (): readonly SecretProviderPlugin[] =>\n  usePluginsCtx(\"useSecretProviderPlugins\").secretProviderPlugins;\n"],"mappings":";AAWA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,eAAe;AAExB,SAAS,iBAAiB,YAAY,yBAAyB;AAC/D,YAAY,iBAAiB;AAO7B,SAAS,cAAc;AACvB,SAAS,WAAAA,UAAS,iBAAiB,oBAAoB;AAEvD,YAAY,iBAAiB;AAC7B,YAAY,UAAU;AACtB,YAAYC,kBAAiB;AAE7B,SAAS,cAAc,YAAY,cAAc,sBAAsB;AAiIhE,IAAM,qBAAqB,CAChC,SAC0B;AAoCrB,IAAM,yBAAyB,CAGpC,OACA,UAAyC,CAAC,MACvC;AACH,QAAM,EAAE,UAAU,OAAO,IAAI;AAC7B,QAAM,WAAW,MAAM;AACvB,QAAM,SAAS,QAAQ,KAAK,UAAU,QAAQ,EAAE,EAAE,IAAI,KAAK;AAC3D,SAAmB,oBAA2C,EAAE,UAAU,QAAQ,UAAU;AAAA,IAC1F,KAAK;AAAA,IACL,YAAY,gBAAgB;AAAA,IAC5B,GAAI,OAAO,YAAY,aACnB;AAAA,MACE,iBAAiB,WAAW;AAAA,QAAW,CAAC,YACtC,kBAAkB,WAAW,SAAS,QAAQ,CAAC;AAAA,MACjD;AAAA,IACF,IACA,EAAE,QAAQ;AAAA,EAChB,CAAC;AACH;AAuBA,IAAM,yBAAyB,cAAkD,IAAI;AACrF,uBAAuB,cAAc;AAO9B,SAAS,wBACd,OACkC;AAClC,QAAM,EAAE,SAAS,SAAS,IAAI;AAC9B,QAAM,QAAQ;AAAA,IACZ,OAAO;AAAA,MACL;AAAA,MACA,eAAe,QAAQ,QAAQ,CAAC,MAAO,EAAE,eAAe,CAAC,EAAE,YAAY,IAAI,CAAC,CAAE;AAAA,MAC9E,uBAAuB,QAAQ;AAAA,QAAQ,CAAC,MACtC,EAAE,uBAAuB,CAAC,EAAE,oBAAoB,IAAI,CAAC;AAAA,MACvD;AAAA,IACF;AAAA,IACA,CAAC,OAAO;AAAA,EACV;AAGA,YAAU,MAAM;AACd,eAAW,MAAM,MAAM,cAAe,IAAG,UAAU;AAAA,EACrD,GAAG,CAAC,MAAM,aAAa,CAAC;AACxB,SAAO,cAAc,uBAAuB,UAAU,EAAE,MAAM,GAAG,QAAQ;AAC3E;AAEA,IAAM,gBAAgB,CAAC,aAAkD;AACvE,QAAM,MAAM,WAAW,sBAAsB;AAC7C,MAAI,CAAC,KAAK;AAER,UAAM,IAAI,MAAM,GAAG,QAAQ,sDAAsD;AAAA,EACnF;AACA,SAAO;AACT;AAGO,IAAM,mBAAmB,MAC9B,cAAc,kBAAkB,EAAE;AAG7B,IAAM,mBAAmB,MAC9B,cAAc,kBAAkB,EAAE;AAG7B,IAAM,2BAA2B,MACtC,cAAc,0BAA0B,EAAE;","names":["HttpApi","AtomHttpApi"]}

package/dist/client.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=client.test.d.ts.map

package/dist/client.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.test.d.ts","sourceRoot":"","sources":["../src/client.test.ts"],"names":[],"mappings":""}

package/dist/config.d.ts

@@ -1,14 +1,24 @@
 import type { AnyPlugin } from "./plugin";
 export type ExecutorDialect = "pg" | "sqlite" | "mysql";
-export interface ExecutorCliConfig {
+export type ExecutorPluginsFactory<TDeps extends object = object, TPlugins extends readonly AnyPlugin[] = readonly AnyPlugin[]> = (deps?: TDeps) => TPlugins;
+export interface ExecutorCliConfig<TDeps extends object = object, TPlugins extends readonly AnyPlugin[] = readonly AnyPlugin[]> {
     readonly dialect: ExecutorDialect;
-    readonly plugins: readonly AnyPlugin[];
+    readonly plugins: ExecutorPluginsFactory<TDeps, TPlugins>;
 }
 /**
- * Declare an executor config for the CLI to consume. The CLI imports
- * this file via jiti and reads `plugins` + `dialect` to generate the
- * drizzle schema. Plugin runtime credentials can be stubs — only
- * `plugin.schema` is read.
+ * Declare an executor config. The CLI imports this file via jiti and
+ * reads `plugins` + `dialect` to generate the drizzle schema; the host
+ * runtime imports the same file to instantiate plugins. Plugin runtime
+ * credentials passed to the factory may be stubs from the CLI — only
+ * `plugin.schema` is read there.
+ *
+ * The `const TPlugins` modifier preserves the tuple-literal inference
+ * from the factory's return so per-plugin extension typing flows through
+ * (`ReturnType<typeof config.plugins>` keeps `[OpenApi, Mcp, ...]`).
+ *
+ * `TDeps` is inferred from the factory's parameter — apps annotate
+ * the destructure (e.g., `({ configFile }: { configFile?: ConfigFileSink })`)
+ * directly. No global module augmentation needed.
  */
-export declare const defineExecutorConfig: <const T extends ExecutorCliConfig>(config: T) => T;
+export declare const defineExecutorConfig: <TDeps extends object, const TPlugins extends readonly AnyPlugin[]>(config: ExecutorCliConfig<TDeps, TPlugins>) => ExecutorCliConfig<TDeps, TPlugins>;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,QAAQ,GAAG,OAAO,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;CACxC;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,CAAC,CAAC,SAAS,iBAAiB,EACpE,QAAQ,CAAC,KACR,CAAW,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,QAAQ,GAAG,OAAO,CAAC;AAExD,MAAM,MAAM,sBAAsB,CAChC,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,QAAQ,SAAS,SAAS,SAAS,EAAE,GAAG,SAAS,SAAS,EAAE,IAC1D,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,QAAQ,CAAC;AAE/B,MAAM,WAAW,iBAAiB,CAChC,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,QAAQ,SAAS,SAAS,SAAS,EAAE,GAAG,SAAS,SAAS,EAAE;IAE5D,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;CAC3D;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,GAC/B,KAAK,SAAS,MAAM,EACpB,KAAK,CAAC,QAAQ,SAAS,SAAS,SAAS,EAAE,EAE3C,QAAQ,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,KACzC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAW,CAAC"}

package/dist/connections.d.ts

@@ -103,5 +103,12 @@ declare const UpdateConnectionTokensInput_base: Schema.Class<UpdateConnectionTok
 }>, {}>;
 export declare class UpdateConnectionTokensInput extends UpdateConnectionTokensInput_base {
 }
+declare const RemoveConnectionInput_base: Schema.Class<RemoveConnectionInput, Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "ConnectionId">;
+    /** Scope id whose connection row and owned token secrets should be removed. */
+    readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
+}>, {}>;
+export declare class RemoveConnectionInput extends RemoveConnectionInput_base {
+}
 export {};
 //# sourceMappingURL=connections.d.ts.map

package/dist/connections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,OAAO,EAAY,MAAM,OAAO,CAAC;AAWxD;;;WAGW;AACX,eAAO,MAAM,uBAAuB,+CAA+C,CAAC;AACpF,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAC;;;;;;;;IAexE,oEAAoE;;IAEpE;sEACkE;;;;;;AAVpE,qBAAa,aAAc,SAAQ,kBAejC;CAAG;;IAeH;+DAC2D;;IAE3D;yDACqD;;;;AALvD,qBAAa,aAAc,SAAQ,kBAQjC;CAAG;;;IAMH;;6DAEyD;;;;;;;IAOzD,wEAAwE;;;;AAb1E,qBAAa,qBAAsB,SAAQ,0BAgBzC;CAAG;;;;AAQL,qBAAa,sBAAuB,SAAQ,4BAE1C;IACA,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AASL,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,gEAAgE;IAChE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACvD,uDAAuD;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAaD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;CACzD;AAcD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,CACjB,KAAK,EAAE,sBAAsB,KAC1B,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;CACrE;;;;;;;;;;AASD,qBAAa,2BAA4B,SAAQ,gCAU/C;CAAG"}
+{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,OAAO,EAAY,MAAM,OAAO,CAAC;AAWxD;;;WAGW;AACX,eAAO,MAAM,uBAAuB,+CAA+C,CAAC;AACpF,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAC;;;;;;;;IAexE,oEAAoE;;IAEpE;sEACkE;;;;;;AAVpE,qBAAa,aAAc,SAAQ,kBAejC;CAAG;;IAeH;+DAC2D;;IAE3D;yDACqD;;;;AALvD,qBAAa,aAAc,SAAQ,kBAQjC;CAAG;;;IAMH;;6DAEyD;;;;;;;IAOzD,wEAAwE;;;;AAb1E,qBAAa,qBAAsB,SAAQ,0BAgBzC;CAAG;;;;AAQL,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;CAAG;AASL,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,gEAAgE;IAChE,QAAQ,CAAC,aAAa,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACvD,uDAAuD;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAaD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;CACzD;AAcD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,CACjB,KAAK,EAAE,sBAAsB,KAC1B,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;CACrE;;;;;;;;;;AASD,qBAAa,2BAA4B,SAAQ,gCAU/C;CAAG;;;IAMH,+EAA+E;;;AAJjF,qBAAa,qBAAsB,SAAQ,0BAMzC;CAAG"}

package/dist/core-schema.d.ts

@@ -1,4 +1,5 @@
 import type { InferDBFieldsOutput } from "@executor-js/storage-core";
+export declare const credentialBindingKinds: ["text", "secret", "connection"];
 export declare const coreSchema: {
     readonly source: {
         readonly fields: {
@@ -177,9 +178,8 @@ export declare const coreSchema: {
                 readonly required: true;
                 readonly index: true;
             };
-            /** Routing key into `plugin.connectionProviders`. Typical shape
-             *  is `${pluginId}:${kind}` (e.g. `openapi:oauth2`, `mcp:oauth2`,
-             *  `google-discovery:google`). Mirrors `secret.provider`. */
+            /** Routing key into `plugin.connectionProviders`. OAuth2 connections
+             *  use the shared `oauth2` provider. Mirrors `secret.provider`. */
             readonly provider: {
                 readonly type: "string";
                 readonly required: true;
@@ -279,6 +279,72 @@ export declare const coreSchema: {
             };
         };
     };
+    readonly credential_binding: {
+        readonly fields: {
+            readonly id: {
+                readonly type: "string";
+                readonly required: true;
+            };
+            readonly scope_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly plugin_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly source_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly source_scope_id: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly slot_key: {
+                readonly type: "string";
+                readonly required: true;
+                readonly index: true;
+            };
+            /** "text" | "secret" | "connection". */
+            readonly kind: {
+                readonly type: ["text", "secret", "connection"];
+                readonly required: true;
+                readonly index: true;
+            };
+            readonly text_value: {
+                readonly type: "string";
+                readonly required: false;
+            };
+            readonly secret_id: {
+                readonly type: "string";
+                readonly required: false;
+                readonly index: true;
+            };
+            readonly secret_scope_id: {
+                readonly type: "string";
+                readonly required: false;
+                readonly index: true;
+            };
+            readonly connection_id: {
+                readonly type: "string";
+                readonly required: false;
+                readonly index: true;
+            };
+            readonly created_at: {
+                readonly type: "date";
+                readonly required: true;
+            };
+            readonly updated_at: {
+                readonly type: "date";
+                readonly required: true;
+            };
+        };
+    };
     readonly tool_policy: {
         readonly fields: {
             readonly id: {
@@ -327,6 +393,19 @@ export type ToolRow = InferDBFieldsOutput<CoreSchema["tool"]["fields"]> & Record
 export type DefinitionRow = InferDBFieldsOutput<CoreSchema["definition"]["fields"]> & Record<string, unknown>;
 export type SecretRow = InferDBFieldsOutput<CoreSchema["secret"]["fields"]> & Record<string, unknown>;
 export type ConnectionRow = InferDBFieldsOutput<CoreSchema["connection"]["fields"]> & Record<string, unknown>;
+type CredentialBindingRowFields = InferDBFieldsOutput<CoreSchema["credential_binding"]["fields"]>;
+type CredentialBindingRowBase = Omit<CredentialBindingRowFields, "kind" | "text_value" | "secret_id" | "secret_scope_id" | "connection_id">;
+export type CredentialBindingRow = CredentialBindingRowBase & ({
+    kind: "text";
+    text_value: string;
+} | {
+    kind: "secret";
+    secret_id: string;
+    secret_scope_id?: string;
+} | {
+    kind: "connection";
+    connection_id: string;
+}) & Record<string, unknown>;
 export type ToolPolicyRow = InferDBFieldsOutput<CoreSchema["tool_policy"]["fields"]> & Record<string, unknown>;
 export type ToolPolicyAction = "approve" | "require_approval" | "block";
 export declare const TOOL_POLICY_ACTIONS: readonly ["approve", "require_approval", "block"];
@@ -369,4 +448,5 @@ export interface DefinitionsInput {
     readonly scope: string;
     readonly definitions: Record<string, unknown>;
 }
+export {};
 //# sourceMappingURL=core-schema.d.ts.map

package/dist/core-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-schema.d.ts","sourceRoot":"","sources":["../src/core-schema.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAEV,mBAAmB,EACpB,MAAM,2BAA2B,CAAC;AAEnC,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA6GjB;;yEAE6D;;;;;;YAE7D;mEACuD;;;;;YAEvD,4DAA4D;;;;;YAE5D;yEAC6D;;;;;YAE7D;;iEAEqD;;;;;;YAErD,sDAAsD;;;;;YAEtD;yDAC6C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAyC7C,gDAAgD;;;;;YAEhD;;;;;iCAKqB;;;;;;;;;;;;;;;;CAME,CAAC;AAE9B,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC;AAO3C,MAAM,MAAM,SAAS,GAAG,mBAAmB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,GACzE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,MAAM,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,GACrE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAC7C,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CACnC,GACC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,MAAM,MAAM,SAAS,GAAG,mBAAmB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,GACzE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAC7C,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CACnC,GACC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAC7C,UAAU,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,CACpC,GACC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAc1B,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,kBAAkB,GAAG,OAAO,CAAC;AAExE,eAAO,MAAM,mBAAmB,mDAIgB,CAAC;AAEjD,eAAO,MAAM,kBAAkB,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,gBAED,CAAC;AAkB7D,MAAM,WAAW,eAAe;IAC9B;kEAC8D;IAC9D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;4CACwC;IACxC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;4DACwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAUD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;4EAEwE;IACxE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;CAC5C;AASD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;+CAC2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/C"}
+{"version":3,"file":"core-schema.d.ts","sourceRoot":"","sources":["../src/core-schema.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAY,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAE/E,eAAO,MAAM,sBAAsB,EAAuC,CACxE,MAAM,EACN,QAAQ,EACR,YAAY,CACb,CAAC;AAEF,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA6GjB;+EACmE;;;;;;YAEnE;mEACuD;;;;;YAEvD,4DAA4D;;;;;YAE5D;yEAC6D;;;;;YAE7D;;iEAEqD;;;;;;YAErD,sDAAsD;;;;;YAEtD;yDAC6C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAiC7C,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA4BxC,gDAAgD;;;;;YAEhD;;;;;iCAKqB;;;;;;;;;;;;;;;;CAME,CAAC;AAE9B,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC;AAO3C,MAAM,MAAM,SAAS,GAAG,mBAAmB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,GACzE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,MAAM,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAElG,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjF,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,MAAM,MAAM,SAAS,GAAG,mBAAmB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,GACzE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjF,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,KAAK,0BAA0B,GAAG,mBAAmB,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClG,KAAK,wBAAwB,GAAG,IAAI,CAClC,0BAA0B,EAC1B,MAAM,GAAG,YAAY,GAAG,WAAW,GAAG,iBAAiB,GAAG,eAAe,CAC1E,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,wBAAwB,GACzD,CACI;IACE,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB,CACJ,GACD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,GAClF,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAc1B,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,kBAAkB,GAAG,OAAO,CAAC;AAExE,eAAO,MAAM,mBAAmB,mDAIgB,CAAC;AAEjD,eAAO,MAAM,kBAAkB,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,gBAC4B,CAAC;AAkB1F,MAAM,WAAW,eAAe;IAC9B;kEAC8D;IAC9D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;4CACwC;IACxC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;4DACwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAUD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;4EAEwE;IACxE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;CAC5C;AASD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;+CAC2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/C"}