@executor-js/sdk 0.1.0 → 0.2.1

package/dist/core.js

@@ -1,5 +1,22 @@
 import {
+  SecretBackedMap,
+  SecretBackedValue,
+  defineExecutorConfig,
+  isSecretBackedRef,
+  resolveSecretBackedMap
+} from "./chunk-6SQWMOM4.js";
+import {
+  definePlugin,
+  defineSchema,
+  makeTestConfig,
+  tool
+} from "./chunk-QQK7X3DM.js";
+import {
+  ConfiguredCredentialBinding,
+  ConfiguredCredentialValue,
+  ConfiguredCredentialValueSchema,
   ConnectionId,
+  ConnectionInUseError,
   ConnectionNotFoundError,
   ConnectionProviderNotRegisteredError,
   ConnectionProviderState,
@@ -8,10 +25,18 @@ import {
   ConnectionRefreshError,
   ConnectionRefreshNotSupportedError,
   CreateConnectionInput,
+  CredentialBindingId,
+  CredentialBindingKind,
+  CredentialBindingRef,
+  CredentialBindingResolutionStatus,
+  CredentialBindingSlotInput,
+  CredentialBindingSourceInput,
+  CredentialBindingValue,
   ElicitationAction,
   ElicitationDeclinedError,
   ElicitationResponse,
   FormElicitation,
+  HostedOutboundRequestBlocked,
   NoHandlerError,
   OAUTH2_DEFAULT_TIMEOUT_MS,
   OAUTH2_PROVIDER_KEY,
@@ -33,15 +58,22 @@ import {
   OAuthStrategy,
   PluginNotLoadedError,
   PolicyId,
+  RemoveConnectionInput,
+  RemoveCredentialBindingInput,
+  RemoveSecretInput,
+  ReplaceCredentialBindingValue,
+  ReplaceCredentialBindingsInput,
+  ResolvedCredentialSlot,
   Scope,
   ScopeId,
-  SecretBackedMap,
-  SecretBackedValue,
+  ScopedSecretCredentialInput,
   SecretId,
+  SecretInUseError,
   SecretNotFoundError,
   SecretOwnedByConnectionError,
   SecretRef,
   SecretResolutionError,
+  SetCredentialBindingInput,
   SetSecretInput,
   SourceDetectionResult,
   SourceNotFoundError,
@@ -56,6 +88,8 @@ import {
   ToolSchema,
   UpdateConnectionTokensInput,
   UrlElicitation,
+  Usage,
+  assertSupportedOAuthEndpointUrl,
   beginDynamicAuthorization,
   buildAuthorizationUrl,
   buildToolTypeScriptPreview,
@@ -64,15 +98,20 @@ import {
   createExecutor,
   createPkceCodeChallenge,
   createPkceCodeVerifier,
-  defineExecutorConfig,
+  credentialBindingId,
+  credentialBindingRowToRef,
+  credentialBindingValueFromRow,
+  credentialSlotKey,
+  credentialSlotPart,
   discoverAuthorizationServerMetadata,
   discoverProtectedResourceMetadata,
   effectivePolicyFromSorted,
   exchangeAuthorizationCode,
   exchangeClientCredentials,
-  isSecretBackedRef,
+  isSupportedOAuthEndpointUrl,
   isToolPolicyAction,
   isValidPattern,
+  makeHostedHttpClientLayer,
   makeInMemoryBlobStore,
   makeOAuth2Service,
   matchPattern,
@@ -80,16 +119,16 @@ import {
   refreshAccessToken,
   registerDynamicClient,
   resolveEffectivePolicy,
-  resolveSecretBackedMap,
   resolveToolPolicy,
   rowToToolPolicy,
   schemaToTypeScriptPreview,
   schemaToTypeScriptPreviewWithDefs,
-  shouldRefreshToken
-} from "./chunk-2WV7VSNL.js";
+  shouldRefreshToken,
+  validateHostedOutboundUrl
+} from "./chunk-NPWV4R3N.js";
 
 // src/index.ts
-import { Context, Effect, Layer, Schema, Data, Option } from "effect";
+import { Context, Effect, Layer, Schema as Schema2, Data, Option } from "effect";
 import {
   HttpApi,
   HttpApiBuilder,
@@ -106,48 +145,6 @@ import { StorageError, UniqueViolationError } from "@executor-js/storage-core";
 var OAUTH_POPUP_MESSAGE_TYPE = "executor:oauth-result";
 var isOAuthPopupResult = (value) => typeof value === "object" && value !== null && value.type === OAUTH_POPUP_MESSAGE_TYPE;
 
-// src/plugin.ts
-var defineSchema = (schema) => schema;
-function definePlugin(authorFactory) {
-  return (options) => {
-    const {
-      storage: storageOverride,
-      ...rest
-    } = options ?? {};
-    const hasAuthorOptions = Object.keys(rest).length > 0;
-    const spec = authorFactory(
-      hasAuthorOptions ? rest : void 0
-    );
-    return {
-      ...spec,
-      storage: storageOverride ?? spec.storage
-    };
-  };
-}
-
-// src/testing.ts
-import { makeMemoryAdapter } from "@executor-js/storage-core/testing/memory";
-var makeTestConfig = (options) => {
-  const scopes = options?.scopes ?? [
-    new Scope({
-      id: ScopeId.make("test-scope"),
-      name: options?.scopeName ?? "test",
-      createdAt: /* @__PURE__ */ new Date()
-    })
-  ];
-  const schema = collectSchemas(options?.plugins ?? []);
-  return {
-    scopes,
-    adapter: makeMemoryAdapter({ schema }),
-    blobs: makeInMemoryBlobStore(),
-    plugins: options?.plugins,
-    // Tests default to auto-accepting elicitation prompts. Override via
-    // a wrapping spread if a test exercises a real handler:
-    //   { ...makeTestConfig(...), onElicitation: customHandler }
-    onElicitation: "accept-all"
-  };
-};
-
 // src/schema-refs.ts
 var REF_PATTERN = /^#\/(?:\$defs|definitions)\/(.+)$/;
 var parseRefName = (ref) => ref.match(REF_PATTERN)?.[1];
@@ -233,8 +230,24 @@ var reattachDefs = (schema, defs) => {
   }
   return { ...schema, $defs: attached };
 };
+
+// src/api-errors.ts
+import { Schema } from "effect";
+var InternalError = class extends Schema.TaggedErrorClass()(
+  "InternalError",
+  {
+    /** Opaque correlation id for backend lookup (Sentry event id, log line, etc.). */
+    traceId: Schema.String
+  },
+  { httpApiStatus: 500 }
+) {
+};
 export {
+  ConfiguredCredentialBinding,
+  ConfiguredCredentialValue,
+  ConfiguredCredentialValueSchema,
   ConnectionId,
+  ConnectionInUseError,
   ConnectionNotFoundError,
   ConnectionProviderNotRegisteredError,
   ConnectionProviderState,
@@ -244,12 +257,20 @@ export {
   ConnectionRefreshNotSupportedError,
   Context,
   CreateConnectionInput,
+  CredentialBindingId,
+  CredentialBindingKind,
+  CredentialBindingRef,
+  CredentialBindingResolutionStatus,
+  CredentialBindingSlotInput,
+  CredentialBindingSourceInput,
+  CredentialBindingValue,
   Data,
   Effect,
   ElicitationAction,
   ElicitationDeclinedError,
   ElicitationResponse,
   FormElicitation,
+  HostedOutboundRequestBlocked,
   HttpApi,
   HttpApiBuilder,
   HttpApiClient,
@@ -257,6 +278,7 @@ export {
   HttpApiGroup,
   HttpApiMiddleware,
   HttpApiSchema,
+  InternalError,
   Layer,
   NoHandlerError,
   OAUTH2_DEFAULT_TIMEOUT_MS,
@@ -281,16 +303,25 @@ export {
   Option,
   PluginNotLoadedError,
   PolicyId,
-  Schema,
+  RemoveConnectionInput,
+  RemoveCredentialBindingInput,
+  RemoveSecretInput,
+  ReplaceCredentialBindingValue,
+  ReplaceCredentialBindingsInput,
+  ResolvedCredentialSlot,
+  Schema2 as Schema,
   Scope,
   ScopeId,
+  ScopedSecretCredentialInput,
   SecretBackedMap,
   SecretBackedValue,
   SecretId,
+  SecretInUseError,
   SecretNotFoundError,
   SecretOwnedByConnectionError,
   SecretRef,
   SecretResolutionError,
+  SetCredentialBindingInput,
   SetSecretInput,
   SourceDetectionResult,
   SourceNotFoundError,
@@ -307,6 +338,8 @@ export {
   UniqueViolationError,
   UpdateConnectionTokensInput,
   UrlElicitation,
+  Usage,
+  assertSupportedOAuthEndpointUrl,
   beginDynamicAuthorization,
   buildAuthorizationUrl,
   buildToolTypeScriptPreview,
@@ -316,6 +349,11 @@ export {
   createExecutor,
   createPkceCodeChallenge,
   createPkceCodeVerifier,
+  credentialBindingId,
+  credentialBindingRowToRef,
+  credentialBindingValueFromRow,
+  credentialSlotKey,
+  credentialSlotPart,
   defineExecutorConfig,
   definePlugin,
   defineSchema,
@@ -327,8 +365,10 @@ export {
   hoistDefinitions,
   isOAuthPopupResult,
   isSecretBackedRef,
+  isSupportedOAuthEndpointUrl,
   isToolPolicyAction,
   isValidPattern,
+  makeHostedHttpClientLayer,
   makeInMemoryBlobStore,
   makeOAuth2Service,
   makeTestConfig,
@@ -345,6 +385,8 @@ export {
   schemaToTypeScriptPreview,
   schemaToTypeScriptPreviewWithDefs,
   shouldRefreshToken,
-  typedAdapter
+  tool,
+  typedAdapter,
+  validateHostedOutboundUrl
 };
 //# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/oauth-popup-types.ts","../src/plugin.ts","../src/testing.ts","../src/schema-refs.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// @executor-js/sdk — public surface\n// ---------------------------------------------------------------------------\n\n// Re-export the Effect/Schema/HttpApi primitives plugin authors need so a\n// plugin can be written importing only from `@executor-js/sdk`. Authors who\n// want to reach for additional Effect APIs keep importing from `effect/*`\n// directly — these re-exports are the curated minimum.\nexport { Context, Effect, Layer, Schema, Data, Option } from \"effect\";\nexport {\n  HttpApi,\n  HttpApiBuilder,\n  HttpApiClient,\n  HttpApiEndpoint,\n  HttpApiGroup,\n  HttpApiMiddleware,\n  HttpApiSchema,\n} from \"effect/unstable/httpapi\";\n\n// Storage adapter interface types (re-exported from @executor-js/storage-core\n// so plugin authors can write adapters against a single public surface\n// without depending on storage-core directly).\nexport type {\n  DBAdapter,\n  DBSchema,\n  DBFieldAttribute,\n  DBFieldType,\n  StorageFailure,\n  TypedAdapter,\n  Where,\n  WhereOperator,\n} from \"@executor-js/storage-core\";\n\nexport { typedAdapter } from \"@executor-js/storage-core\";\n\n// Storage-layer typed errors (re-exported so plugin code can catchTag\n// `UniqueViolationError` without importing storage-core directly).\nexport { StorageError, UniqueViolationError } from \"@executor-js/storage-core\";\n\n// IDs (branded)\nexport { ScopeId, ToolId, SecretId, PolicyId, ConnectionId } from \"./ids\";\n\n// Scope\nexport { Scope } from \"./scope\";\n\n// Errors (tagged)\nexport {\n  ToolNotFoundError,\n  ToolInvocationError,\n  ToolBlockedError,\n  NoHandlerError,\n  SourceNotFoundError,\n  SourceRemovalNotAllowedError,\n  PluginNotLoadedError,\n  SecretNotFoundError,\n  SecretResolutionError,\n  SecretOwnedByConnectionError,\n  ConnectionNotFoundError,\n  ConnectionProviderNotRegisteredError,\n  ConnectionRefreshNotSupportedError,\n  ConnectionReauthRequiredError,\n  type ExecutorError,\n} from \"./errors\";\n\n// Public projections\nexport {\n  ToolSchema,\n  SourceDetectionResult,\n  type Source,\n  type Tool,\n  type ToolListFilter,\n} from \"./types\";\n\n// Core schema\nexport {\n  coreSchema,\n  isToolPolicyAction,\n  TOOL_POLICY_ACTIONS,\n  type CoreSchema,\n  type SourceInput,\n  type SourceInputTool,\n  type SourceRow,\n  type ToolRow,\n  type DefinitionRow,\n  type SecretRow,\n  type ConnectionRow,\n  type ToolPolicyRow,\n  type ToolPolicyAction,\n  type DefinitionsInput,\n  type ToolAnnotations,\n} from \"./core-schema\";\n\n// Tool policies\nexport {\n  matchPattern,\n  isValidPattern,\n  resolveToolPolicy,\n  resolveEffectivePolicy,\n  effectivePolicyFromSorted,\n  rowToToolPolicy,\n  ToolPolicyActionSchema,\n  type ToolPolicy,\n  type CreateToolPolicyInput,\n  type UpdateToolPolicyInput,\n  type PolicyMatch,\n  type EffectivePolicy,\n  type PolicySource,\n} from \"./policies\";\n\n// Secrets\nexport { SecretRef, SetSecretInput, type SecretProvider } from \"./secrets\";\n\nexport {\n  SecretBackedMap,\n  SecretBackedValue,\n  isSecretBackedRef,\n  resolveSecretBackedMap,\n  type ResolveSecretBackedMapOptions,\n} from \"./secret-backed-value\";\n\n// Connections\nexport {\n  ConnectionRef,\n  ConnectionProviderState,\n  CreateConnectionInput,\n  UpdateConnectionTokensInput,\n  TokenMaterial,\n  ConnectionRefreshError,\n  type ConnectionProvider,\n  type ConnectionRefreshInput,\n  type ConnectionRefreshResult,\n} from \"./connections\";\n\n// Elicitation\nexport {\n  FormElicitation,\n  UrlElicitation,\n  ElicitationAction,\n  ElicitationResponse,\n  ElicitationDeclinedError,\n  type ElicitationRequest,\n  type ElicitationHandler,\n  type ElicitationContext,\n} from \"./elicitation\";\n\n// Blob store\nexport {\n  type BlobStore,\n  type PluginBlobStore,\n  pluginBlobStore,\n  makeInMemoryBlobStore,\n} from \"./blob\";\n\n// OAuth 2.1\nexport {\n  type OAuthService,\n  type OAuthStrategy,\n  type OAuthDynamicDcrStrategy,\n  type OAuthAuthorizationCodeStrategy,\n  type OAuthClientCredentialsStrategy,\n  type OAuthProviderState,\n  type OAuthProbeInput,\n  type OAuthProbeResult,\n  type OAuthStartInput,\n  type OAuthStartResult,\n  type OAuthCompleteInput,\n  type OAuthCompleteResult,\n  OAuthProbeError,\n  OAuthStartError,\n  OAuthCompleteError,\n  OAuthSessionNotFoundError,\n  OAUTH2_PROVIDER_KEY,\n  OAUTH2_SESSION_TTL_MS,\n  OAuthStrategy as OAuthStrategySchema,\n  OAuthProviderState as OAuthProviderStateSchema,\n  OAuthDynamicDcrStrategy as OAuthDynamicDcrStrategySchema,\n  OAuthAuthorizationCodeStrategy as OAuthAuthorizationCodeStrategySchema,\n  OAuthClientCredentialsStrategy as OAuthClientCredentialsStrategySchema,\n} from \"./oauth\";\n\nexport {\n  OAuth2Error,\n  OAUTH2_DEFAULT_TIMEOUT_MS,\n  OAUTH2_REFRESH_SKEW_MS,\n  buildAuthorizationUrl,\n  createPkceCodeChallenge,\n  createPkceCodeVerifier,\n  exchangeAuthorizationCode,\n  exchangeClientCredentials,\n  refreshAccessToken,\n  shouldRefreshToken,\n  type OAuth2TokenResponse,\n  type BuildAuthorizationUrlInput,\n  type ClientAuthMethod,\n  type ExchangeAuthorizationCodeInput,\n  type ExchangeClientCredentialsInput,\n  type RefreshAccessTokenInput,\n} from \"./oauth-helpers\";\n\nexport { makeOAuth2Service, type OAuthServiceDeps } from \"./oauth-service\";\n\nexport {\n  OAuthDiscoveryError,\n  OAuthAuthorizationServerMetadataSchema,\n  OAuthClientInformationSchema,\n  OAuthProtectedResourceMetadataSchema,\n  beginDynamicAuthorization,\n  discoverAuthorizationServerMetadata,\n  discoverProtectedResourceMetadata,\n  registerDynamicClient,\n  type BeginDynamicAuthorizationInput,\n  type DiscoveryRequestOptions,\n  type DynamicAuthorizationState,\n  type DynamicAuthorizationStartResult,\n  type DynamicClientMetadata,\n  type OAuthAuthorizationServerMetadata,\n  type OAuthClientInformation,\n  type OAuthProtectedResourceMetadata,\n  type RegisterDynamicClientInput,\n} from \"./oauth-discovery\";\n\nexport {\n  OAUTH_POPUP_MESSAGE_TYPE,\n  type OAuthPopupResult,\n  isOAuthPopupResult,\n} from \"./oauth-popup-types\";\n\n// Plugin definition\nexport {\n  type Plugin,\n  type PluginSpec,\n  type PluginCtx,\n  type PluginExtensions,\n  type ConfiguredPlugin,\n  type AnyPlugin,\n  type StorageDeps,\n  type StaticSourceDecl,\n  type StaticToolDecl,\n  type StaticToolHandlerInput,\n  type InvokeToolInput,\n  type SourceLifecycleInput,\n  type SecretListEntry,\n  type Elicit,\n  definePlugin,\n  defineSchema,\n} from \"./plugin\";\n\n// Executor\nexport {\n  type Executor,\n  type ExecutorConfig,\n  type OnElicitation,\n  type InvokeOptions,\n  createExecutor,\n  collectSchemas,\n} from \"./executor\";\n\n// CLI / runtime config\nexport {\n  defineExecutorConfig,\n  type ExecutorCliConfig,\n  type ExecutorDialect,\n  type ExecutorPluginsFactory,\n} from \"./config\";\n\n// Test helper\nexport { makeTestConfig } from \"./testing\";\n\n// JSON schema $ref helpers (used by openapi for $defs handling)\nexport { hoistDefinitions, collectRefs, reattachDefs, normalizeRefs } from \"./schema-refs\";\n\n// TypeScript preview generation from JSON schemas\nexport {\n  schemaToTypeScriptPreview,\n  schemaToTypeScriptPreviewWithDefs,\n  buildToolTypeScriptPreview,\n  type TypeScriptRenderOptions,\n  type TypeScriptSchemaPreview,\n} from \"./schema-types\";\n","// ---------------------------------------------------------------------------\n// OAuth popup result — the message shape exchanged between the popup window\n// (opened during authorization) and the opener (the onboarding UI). Both the\n// server-side HTML generator and the client-side popup opener agree on this\n// shape so that success / failure can be communicated reliably via both\n// `postMessage` and `BroadcastChannel`.\n// ---------------------------------------------------------------------------\n\n/** Message type literal used to identify our popup results. */\nexport const OAUTH_POPUP_MESSAGE_TYPE = \"executor:oauth-result\" as const;\n\nexport type OAuthPopupResult<TAuth> =\n  | ({\n      readonly type: typeof OAUTH_POPUP_MESSAGE_TYPE;\n      readonly ok: true;\n      readonly sessionId: string;\n    } & TAuth)\n  | {\n      readonly type: typeof OAUTH_POPUP_MESSAGE_TYPE;\n      readonly ok: false;\n      readonly sessionId: string | null;\n      readonly error: string;\n    };\n\nexport const isOAuthPopupResult = <TAuth>(\n  value: unknown,\n): value is OAuthPopupResult<TAuth> =>\n  typeof value === \"object\" &&\n  value !== null &&\n  (value as { type?: unknown }).type === OAUTH_POPUP_MESSAGE_TYPE;\n","import type { Context, Effect, Layer } from \"effect\";\nimport type { HttpApiGroup } from \"effect/unstable/httpapi\";\nimport type {\n  DBAdapter,\n  DBSchema,\n  StorageFailure,\n  TypedAdapter,\n} from \"@executor-js/storage-core\";\n\nimport type { PluginBlobStore } from \"./blob\";\nimport type {\n  ConnectionProvider,\n  ConnectionRef,\n  ConnectionRefreshError,\n  CreateConnectionInput,\n  UpdateConnectionTokensInput,\n} from \"./connections\";\nimport type {\n  DefinitionsInput,\n  SourceInput,\n  ToolAnnotations,\n  ToolRow,\n} from \"./core-schema\";\nimport type { SourceDetectionResult } from \"./types\";\nimport type {\n  ElicitationDeclinedError,\n  ElicitationHandler,\n  ElicitationRequest,\n  ElicitationResponse,\n} from \"./elicitation\";\nimport type {\n  ConnectionNotFoundError,\n  ConnectionProviderNotRegisteredError,\n  ConnectionReauthRequiredError,\n  ConnectionRefreshNotSupportedError,\n  SecretOwnedByConnectionError,\n} from \"./errors\";\nimport type { OAuthService } from \"./oauth\";\nimport type { Scope } from \"./scope\";\nimport type { SecretProvider, SecretRef, SetSecretInput } from \"./secrets\";\n\n// ---------------------------------------------------------------------------\n// StorageDeps — backing passed to a plugin's `storage` factory. The only\n// place a plugin ever sees storage; `PluginCtx` does not carry it. The\n// `adapter` field is a `TypedAdapter<TSchema>` view narrowed by the\n// plugin's own declared `schema` — plugins never import or construct\n// a typed adapter themselves, the executor infers TSchema from the\n// `schema` field on their spec and hands back a typed view.\n//\n// Plugins with no schema (secret-provider-only plugins, etc.) get a\n// bare `DBAdapter` they can ignore.\n// ---------------------------------------------------------------------------\n\nexport interface StorageDeps<TSchema extends DBSchema | undefined = undefined> {\n  /**\n   * Precedence-ordered scope stack visible to this executor. Innermost\n   * first. Reads on scoped tables walk every scope; writes require the\n   * plugin to name a target scope explicitly (via `scope_id` on the\n   * adapter payload, via `options.scope` on the blob store).\n   */\n  readonly scopes: readonly Scope[];\n  /**\n   * Plugin-facing typed adapter. Failures surface as raw `StorageFailure`\n   * (`StorageError` | `UniqueViolationError`). Plugins can\n   * `catchTag(\"UniqueViolationError\", …)` to translate to their own\n   * user-facing errors. `StorageError` bubbles up; the HTTP edge (see\n   * `@executor-js/api` `withCapture`) is the one place that\n   * translates it to the opaque `InternalError({ traceId })`.\n   */\n  readonly adapter: TSchema extends DBSchema\n    ? TypedAdapter<TSchema, StorageFailure>\n    : DBAdapter;\n  readonly blobs: PluginBlobStore;\n}\n\n// ---------------------------------------------------------------------------\n// defineSchema — sugar around `as const satisfies DBSchema`. Preserves\n// literal types via the `const` type parameter modifier so plugins can\n// just write `const mySchema = defineSchema({ ... })` without annotation\n// ceremony.\n// ---------------------------------------------------------------------------\n\nexport const defineSchema = <const S extends DBSchema>(schema: S): S => schema;\n\n// ---------------------------------------------------------------------------\n// Elicit — suspends the fiber, calls the invoke-time elicitation\n// handler, resumes with the user's response. Available on both static\n// tool handlers and dynamic `invokeTool` handlers. Threaded through\n// the executor from `createExecutor({ onElicitation })`.\n// ---------------------------------------------------------------------------\n\nexport type Elicit = (\n  request: ElicitationRequest,\n) => Effect.Effect<ElicitationResponse, ElicitationDeclinedError>;\n\n// ---------------------------------------------------------------------------\n// PluginCtx — threaded into every extension method, static tool handler,\n// and dynamic tool handler. No raw adapter, no raw blobs. Core writes\n// go through `core.sources.register` / `core.definitions.register`.\n// ---------------------------------------------------------------------------\n\nexport interface PluginCtx<TStore = unknown> {\n  /**\n   * Precedence-ordered scope stack visible to this executor. Innermost\n   * first. Plugins that write scoped rows must pick an element of\n   * `scopes` as the `scope`/`scope_id` they stamp; reads through the\n   * adapter or `ctx.secrets` automatically fall through the stack.\n   */\n  readonly scopes: readonly Scope[];\n  readonly storage: TStore;\n\n  readonly core: {\n    readonly sources: {\n      readonly register: (\n        input: SourceInput,\n      ) => Effect.Effect<void, StorageFailure>;\n      readonly unregister: (\n        sourceId: string,\n      ) => Effect.Effect<void, StorageFailure>;\n      readonly update: (input: {\n        readonly id: string;\n        readonly scope: string;\n        readonly name?: string;\n        readonly url?: string | null;\n      }) => Effect.Effect<void, StorageFailure>;\n    };\n    /** Register shared JSON-schema `$defs` for a source. Tool\n     *  input/output schemas registered via `sources.register` can carry\n     *  `$ref: \"#/$defs/X\"` pointers; `executor.tools.schema(toolId)`\n     *  attaches matching defs to the returned schema. Call inside the\n     *  same `ctx.transaction` as `sources.register` for atomicity.\n     *  Replaces any existing defs for the given sourceId. */\n    readonly definitions: {\n      readonly register: (\n        input: DefinitionsInput,\n      ) => Effect.Effect<void, StorageFailure>;\n    };\n  };\n\n  readonly secrets: {\n    readonly get: (\n      id: string,\n    ) => Effect.Effect<string | null, SecretOwnedByConnectionError | StorageFailure>;\n    /** List user-visible secrets. Connection-owned secrets (rows with\n     *  `owned_by_connection_id` set) are filtered out so they don't\n     *  clutter the UI — users see the Connection instead. */\n    readonly list: () => Effect.Effect<\n      readonly { readonly id: string; readonly name: string; readonly provider: string }[],\n      StorageFailure\n    >;\n    /** Write a secret value through a provider. Used by plugins that\n     *  mint secrets on behalf of the user (OAuth2 token storage,\n     *  interactive onboarding flows). Normally writes go through\n     *  `executor.secrets.set` on the host surface, but OAuth2 refresh\n     *  and one-shot token capture from plugin-owned flows need it here\n     *  too. Same routing rules as the host-level setter. */\n    readonly set: (\n      input: SetSecretInput,\n    ) => Effect.Effect<SecretRef, StorageFailure>;\n    /** Delete a secret from its pinned provider and the core table.\n     *  Rejects with `SecretOwnedByConnectionError` if the row is owned\n     *  by a connection — callers must go through `connections.remove`\n     *  to drop the whole sign-in. */\n    readonly remove: (\n      id: string,\n    ) => Effect.Effect<void, SecretOwnedByConnectionError | StorageFailure>;\n  };\n\n  /** Connections — product-level sign-in state. Owns backing secret\n   *  rows via `secret.owned_by_connection_id`. Plugins call\n   *  `connections.accessToken(id)` at invoke time to get a guaranteed-\n   *  fresh token (the SDK handles refresh via the registered provider\n   *  keyed by `connection.provider`). */\n  readonly connections: {\n    readonly get: (\n      id: string,\n    ) => Effect.Effect<ConnectionRef | null, StorageFailure>;\n    readonly list: () => Effect.Effect<readonly ConnectionRef[], StorageFailure>;\n    readonly create: (\n      input: CreateConnectionInput,\n    ) => Effect.Effect<\n      ConnectionRef,\n      ConnectionProviderNotRegisteredError | StorageFailure\n    >;\n    readonly updateTokens: (\n      input: UpdateConnectionTokensInput,\n    ) => Effect.Effect<\n      ConnectionRef,\n      ConnectionNotFoundError | StorageFailure\n    >;\n    readonly setIdentityLabel: (\n      id: string,\n      label: string | null,\n    ) => Effect.Effect<void, ConnectionNotFoundError | StorageFailure>;\n    /** Get a guaranteed-fresh access token. Calls the provider's\n     *  `refresh` handler if `expires_at` is in the past / within the\n     *  refresh skew window. */\n    readonly accessToken: (\n      id: string,\n    ) => Effect.Effect<\n      string,\n      | ConnectionNotFoundError\n      | ConnectionProviderNotRegisteredError\n      | ConnectionRefreshNotSupportedError\n      | ConnectionReauthRequiredError\n      | ConnectionRefreshError\n      | StorageFailure\n    >;\n    readonly remove: (id: string) => Effect.Effect<void, StorageFailure>;\n  };\n\n  /** Shared OAuth service. Plugins use this to probe/start/complete OAuth\n   *  flows; invocation should still resolve tokens via `connections.accessToken`. */\n  readonly oauth: OAuthService;\n\n  /** Run `effect` inside a database transaction. Wraps the underlying\n   *  adapter's transaction method. Use this in extension methods that\n   *  need atomicity across plugin storage writes AND core source/tool\n   *  registration. */\n  readonly transaction: <A, E>(\n    effect: Effect.Effect<A, E>,\n  ) => Effect.Effect<A, E | StorageFailure>;\n}\n\n// ---------------------------------------------------------------------------\n// Static tool / source declarations. Pure data + handlers declared at\n// plugin-definition time.\n//\n// Importantly, `StaticToolDecl.handler` does NOT reference TExtension.\n// If it did, the nested generic would break inference for the whole\n// PluginSpec (TS would fall back to the `object` constraint on TExtension).\n// `self: NoInfer<TExtension>` lives on `staticSources` one level up\n// instead, and plugin authors close over it via the arrow-function\n// closure when they write their handler.\n// ---------------------------------------------------------------------------\n\nexport interface StaticToolHandlerInput<TStore = unknown> {\n  readonly ctx: PluginCtx<TStore>;\n  readonly args: unknown;\n  /** Suspend the fiber to request user input. The handler passed to\n   *  `createExecutor({ onElicitation })` is called. */\n  readonly elicit: Elicit;\n}\n\nexport interface StaticToolDecl<TStore = unknown> {\n  readonly name: string;\n  readonly description: string;\n  readonly inputSchema?: unknown;\n  readonly outputSchema?: unknown;\n  /** Default-policy annotations — `requiresApproval`, `approvalDescription`,\n   *  `mayElicit`. Enforced by the executor before the handler runs.\n   *  Inline because static tools have no plugin storage to resolve from;\n   *  the plugin author literally writes this at definition time. */\n  readonly annotations?: ToolAnnotations;\n  readonly handler: (\n    input: StaticToolHandlerInput<TStore>,\n  ) => Effect.Effect<unknown, unknown>;\n}\n\nexport interface StaticSourceDecl<TStore = unknown> {\n  readonly id: string;\n  readonly kind: string;\n  readonly name: string;\n  readonly url?: string;\n  /** Static sources default to `canRemove: false` — they represent\n   *  plugin-provided control surfaces and shouldn't be user-removable.\n   *  Override only if you really want that. */\n  readonly canRemove?: boolean;\n  readonly canRefresh?: boolean;\n  readonly canEdit?: boolean;\n  readonly tools: readonly StaticToolDecl<TStore>[];\n}\n\n// ---------------------------------------------------------------------------\n// Dynamic invoke / source lifecycle inputs.\n// ---------------------------------------------------------------------------\n\nexport interface InvokeToolInput<TStore = unknown> {\n  readonly ctx: PluginCtx<TStore>;\n  /** Already-loaded tool row. Plugin doesn't need to re-fetch or parse\n   *  the tool id. Carries source_id, name, input/output schemas,\n   *  annotations. */\n  readonly toolRow: ToolRow;\n  readonly args: unknown;\n  /** Elicitation handle for plugins that need mid-invocation user input\n   *  (onepassword auth prompt, interactive MCP tools, etc.). */\n  readonly elicit: Elicit;\n}\n\nexport interface SourceLifecycleInput<TStore = unknown> {\n  readonly ctx: PluginCtx<TStore>;\n  readonly sourceId: string;\n  /**\n   * Scope of the source row being removed/refreshed — resolved by the\n   * SDK's `sources.remove` / `sources.refresh` via innermost-wins lookup\n   * across the executor's scope stack. Plugins that own a side table\n   * keyed by (id, scope_id) must pin their own cleanup to this scope;\n   * relying on the scoped adapter's `scope_id IN (stack)` fall-through\n   * would widen the mutation across the whole stack and wipe a\n   * shadowed outer-scope row.\n   */\n  readonly scope: string;\n}\n\n// ---------------------------------------------------------------------------\n// PluginSpec — what a `definePlugin(factory)` call returns.\n// ---------------------------------------------------------------------------\n\n// Defaults are `any` for slots that surface in contravariant positions\n// (storage/extension callbacks consume `TStore`/`TSchema`; `staticSources`\n// closes over `TExtension` via `NoInfer`). `any` is bivariant, so\n// `Plugin<string>` is a structural supertype of every concrete plugin\n// — `AnyPlugin = Plugin<string>` keeps the generic explosion contained\n// to this single declaration. Concrete specs ignore the defaults; TS\n// infers each slot from the literal returned by the author factory.\n//\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport interface PluginSpec<\n  TId extends string = string,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  TExtension extends object = any,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  TStore = any,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  TSchema extends DBSchema | undefined = any,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  TExtensionService extends Context.Service<any, any> | undefined = any,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  THandlersLayer extends Layer.Layer<any, any, any> = any,\n  TGroup extends HttpApiGroup.Any = HttpApiGroup.Any,\n> {\n  readonly id: TId;\n  /** npm package name. The Vite plugin uses this to derive the\n   *  `./client` import path for the frontend bundle (so the same\n   *  `executor.config.ts` drives both server and client) — `${packageName}/client`\n   *  is what gets bundled. The author writes the same string they\n   *  publish to npm; no transforms, no scope conventions. Required for\n   *  plugins that ship a `./client` entry; can be omitted for SDK-only\n   *  plugins (no client bundle = nothing to resolve). */\n  readonly packageName?: string;\n  /** Plugin-declared schema. Merged with coreSchema and other plugins'\n   *  schemas at executor startup via `collectSchemas`. The type flows\n   *  into the `storage` factory's `deps.adapter` as a `TypedAdapter<TSchema>`\n   *  so plugins get narrowed model names + typed rows for free. */\n  readonly schema?: TSchema;\n  /** Build the plugin's typed store from backing. `deps.adapter` is\n   *  already narrowed to this plugin's schema; `deps.blobs` is already\n   *  scoped to the plugin id so key collisions across plugins are\n   *  structurally impossible. */\n  readonly storage: (deps: StorageDeps<TSchema>) => TStore;\n\n  /** Build the plugin's extension API. The returned object becomes\n   *  `executor[plugin.id]` and is also the `self` passed to\n   *  `staticSources`. Field order matters: `extension` MUST appear\n   *  before `staticSources` so TS infers TExtension from this\n   *  factory's return BEFORE type-checking `self: NoInfer<TExtension>`. */\n  readonly extension?: (ctx: PluginCtx<TStore>) => TExtension;\n\n  /** Static sources contributed by this plugin with inline tool\n   *  handlers. Lives entirely in memory — no DB writes at startup.\n   *  Handlers close over `self` via the closure, so a control tool\n   *  that delegates to the plugin's real API is a one-liner:\n   *  `({ args }) => self.addSpec(args)`. */\n  readonly staticSources?: (\n    self: NoInfer<TExtension>,\n  ) => readonly StaticSourceDecl<TStore>[];\n\n  /** HttpApiGroup contributed by this plugin. Composed into the host's\n   *  `HttpApi` via the `addGroup` helper at runtime. The host mounts\n   *  the group at `/_executor/plugins/{id}/...` (or wherever the\n   *  plugin declares its base path) with the host's auth + scope\n   *  middleware applied. Endpoints automatically appear in the\n   *  executor OpenAPI doc and the typed reactive client.\n   *\n   *  TGroup is inferred from the plugin's own group declaration so the\n   *  precise group identity flows through `composePluginApi(plugins)` —\n   *  the host's typed `HttpApi<\"executor\", CoreGroups | PluginGroups>`\n   *  is derived from the plugin tuple alone, with no per-plugin Group\n   *  imports at the host. Per-endpoint typing already lives inside the\n   *  plugin — its `handlers` Layer is built against its own bundled\n   *  `HttpApi.make(\"foo\").add(FooApi)` for full `.handle(\"name\", ...)`\n   *  inference, and its client imports the same group directly. */\n  readonly routes?: () => TGroup;\n\n  /** Handlers Layer for this plugin's group. Built by the plugin against\n   *  its own bundled API for full type safety on `.handle(\"name\", ...)`,\n   *  composes into the host's runtime `FullApi` because\n   *  `HttpApiBuilder.group` keys the layer by group identity, not by the\n   *  surrounding API.\n   *\n   *  Late-binding: the layer leaves the plugin's extension as a Service\n   *  Tag requirement (see `extensionService` below). The host satisfies\n   *  it however its runtime wants:\n   *    - local: at boot via `Layer.succeed(extensionService)(executor[id])`\n   *      (see `composePluginHandlers`)\n   *    - cloud: per-request via `Effect.provideService(extensionService,\n   *      requestExecutor[id])` in the auth middleware\n   *\n   *  The Layer's channels are typed `any` because `Layer<RIn, E, ROut>`'s\n   *  `ROut` is contravariant — the host accepts any layer here and merges\n   *  them; per-plugin requirements flow through the merge. */\n  readonly handlers?: () => THandlersLayer;\n\n  /** Service tag the plugin's `handlers` layer requires. Set by plugins\n   *  whose handlers consume their extension via a `Context.Service` tag\n   *  (the established pattern: `*Handlers` reads `*ExtensionService`).\n   *  The host binds the tag to the live extension — at boot for local,\n   *  per request for cloud. Pairs with `handlers`; either both fields\n   *  are set or neither.\n   *\n   *  Inferred via the `TExtensionService` generic so the per-plugin\n   *  Service class identity propagates through `composePluginHandlers`,\n   *  `composePluginHandlerLayer`, and `providePluginExtensions` —\n   *  cloud's per-request middleware needs the precise tag for layer\n   *  satisfaction. */\n  readonly extensionService?: TExtensionService;\n\n  /** Invoke a dynamic tool. Called when the executor's static-handler\n   *  map doesn't have the toolId. The plugin reads its own enrichment\n   *  via `ctx.storage` and returns the result. Optional — plugins with\n   *  only static tools can omit it. */\n  readonly invokeTool?: (\n    input: InvokeToolInput<TStore>,\n  ) => Effect.Effect<unknown, unknown>;\n\n  /** Bulk resolve annotations (requiresApproval, approvalDescription,\n   *  mayElicit) for a set of tool rows under a single source. Called\n   *  by the executor:\n   *    - at invoke time with a single-element `toolRows` array, to\n   *      enforce approval on the about-to-run tool\n   *    - at list time with every dynamic tool row under each source,\n   *      grouped by source_id, to populate `Tool.annotations` for UI\n   *\n   *  The expected implementation for most plugins is: read plugin\n   *  storage once for the given source/rows, derive annotations from\n   *  the same data that was used to build the tool (HTTP method +\n   *  path for openapi, introspection kind for graphql, etc.), return\n   *  a map keyed by tool id.\n   *\n   *  Omit if the plugin has no annotations to contribute — executor\n   *  treats tools from that plugin as auto-approved with no\n   *  elicitation. */\n  readonly resolveAnnotations?: (input: {\n    readonly ctx: PluginCtx<TStore>;\n    readonly sourceId: string;\n    readonly toolRows: readonly ToolRow[];\n  }) => Effect.Effect<Record<string, ToolAnnotations>, unknown>;\n\n  /** Called when `executor.sources.remove(id)` targets a source owned\n   *  by this plugin. Plugin-side cleanup only; the executor deletes\n   *  the core source/tool rows after this callback returns, inside\n   *  the same transaction. */\n  readonly removeSource?: (\n    input: SourceLifecycleInput<TStore>,\n  ) => Effect.Effect<void, unknown>;\n\n  readonly refreshSource?: (\n    input: SourceLifecycleInput<TStore>,\n  ) => Effect.Effect<void, unknown>;\n\n  /** URL autodetection hook. When the user pastes a URL in the\n   *  onboarding UI, `executor.sources.detect(url)` fans out to every\n   *  plugin's `detect`. Return a `SourceDetectionResult` if you\n   *  recognize the URL, `null` otherwise. Implementations should be\n   *  defensive — swallow fetch errors and return null rather than\n   *  throwing. First high-confidence match wins. */\n  readonly detect?: (input: {\n    readonly ctx: PluginCtx<TStore>;\n    readonly url: string;\n  }) => Effect.Effect<SourceDetectionResult | null, unknown>;\n\n  /** Secret providers contributed by this plugin. Either a static\n   *  array, a function of ctx (for providers that need per-instance\n   *  state like the keychain's scope-derived service name), or a\n   *  function returning an Effect so plugins can probe for backend\n   *  availability at startup and register conditionally. Called once\n   *  at executor startup after `storage` and `extension` have been\n   *  built. */\n  readonly secretProviders?:\n    | readonly SecretProvider[]\n    | ((ctx: PluginCtx<TStore>) => readonly SecretProvider[])\n    | ((\n        ctx: PluginCtx<TStore>,\n      ) => Effect.Effect<readonly SecretProvider[]>);\n\n  /** Connection providers contributed by this plugin. Same registration\n   *  shape as `secretProviders`. Each provider's `key` is what\n   *  `connection.provider` references in the core table; the `refresh`\n   *  handler is the SDK's single entry point for token lifecycle —\n   *  plugins don't run their own refresh loops anymore. */\n  readonly connectionProviders?:\n    | readonly ConnectionProvider[]\n    | ((ctx: PluginCtx<TStore>) => readonly ConnectionProvider[])\n    | ((\n        ctx: PluginCtx<TStore>,\n      ) => Effect.Effect<readonly ConnectionProvider[]>);\n\n  readonly close?: () => Effect.Effect<void, unknown>;\n}\n\nexport interface Plugin<\n  TId extends string = string,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  TExtension extends object = any,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  TStore = any,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  TSchema extends DBSchema | undefined = any,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  TExtensionService extends Context.Service<any, any> | undefined = any,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  THandlersLayer extends Layer.Layer<any, any, any> = any,\n  TGroup extends HttpApiGroup.Any = HttpApiGroup.Any,\n> extends PluginSpec<\n    TId,\n    TExtension,\n    TStore,\n    TSchema,\n    TExtensionService,\n    THandlersLayer,\n    TGroup\n  > {}\n\n// ---------------------------------------------------------------------------\n// definePlugin — factory-returning-spec. Options from the author factory\n// are merged with a storage override so consumers can swap the default\n// store implementation without touching plugin internals.\n// ---------------------------------------------------------------------------\n\nexport type ConfiguredPlugin<\n  TId extends string,\n  TExtension extends object,\n  TStore,\n  TOptions extends object,\n  TSchema extends DBSchema | undefined,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  TExtensionService extends Context.Service<any, any> | undefined = undefined,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  THandlersLayer extends Layer.Layer<any, any, any> = Layer.Layer<unknown, never, never>,\n  TGroup extends HttpApiGroup.Any = HttpApiGroup.Any,\n> = (\n  options?: TOptions & {\n    readonly storage?: (deps: StorageDeps<TSchema>) => TStore;\n  },\n) => Plugin<\n  TId,\n  TExtension,\n  TStore,\n  TSchema,\n  TExtensionService,\n  THandlersLayer,\n  TGroup\n>;\n\n// eslint-disable-next-line @typescript-eslint/ban-types\nexport function definePlugin<\n  TId extends string,\n  TExtension extends object,\n  TStore,\n  TSchema extends DBSchema | undefined = undefined,\n  TOptions extends object = {},\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  TExtensionService extends Context.Service<any, any> | undefined = undefined,\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  THandlersLayer extends Layer.Layer<any, any, any> = Layer.Layer<unknown, never, never>,\n  TGroup extends HttpApiGroup.Any = HttpApiGroup.Any,\n>(\n  authorFactory: (\n    options?: TOptions,\n  ) => PluginSpec<\n    TId,\n    TExtension,\n    TStore,\n    TSchema,\n    TExtensionService,\n    THandlersLayer,\n    TGroup\n  >,\n): ConfiguredPlugin<\n  TId,\n  TExtension,\n  TStore,\n  TOptions,\n  TSchema,\n  TExtensionService,\n  THandlersLayer,\n  TGroup\n> {\n  return (options) => {\n    const {\n      storage: storageOverride,\n      ...rest\n    }: {\n      storage?: (deps: StorageDeps<TSchema>) => TStore;\n      [key: string]: unknown;\n    } = options ?? {};\n\n    const hasAuthorOptions = Object.keys(rest).length > 0;\n    const spec = authorFactory(\n      hasAuthorOptions ? (rest as TOptions) : undefined,\n    );\n\n    return {\n      ...spec,\n      storage: storageOverride ?? spec.storage,\n    };\n  };\n}\n\n// ---------------------------------------------------------------------------\n// AnyPlugin / PluginExtensions — type-level glue for the Executor surface.\n// ---------------------------------------------------------------------------\n\n// `Plugin<string>` (with all subsequent slots taking their wide defaults)\n// is structurally any concrete plugin — the `any` cascade stays inside\n// the spec's defaults instead of leaking into every consumer.\nexport type AnyPlugin = Plugin<string>;\n\nexport type PluginExtensions<TPlugins extends readonly AnyPlugin[]> = {\n  readonly [P in TPlugins[number] as P[\"id\"]]: P extends Plugin<\n    string,\n    infer TExt\n  >\n    ? TExt\n    : never;\n};\n\n/** Lightweight projection of a secret entry as returned by `ctx.secrets.list`. */\nexport interface SecretListEntry {\n  readonly id: string;\n  readonly name: string;\n  readonly provider: string;\n}\n\n// Re-exported for consumers that check the elicitation handler type.\nexport type { ElicitationHandler };\n","import { makeMemoryAdapter } from \"@executor-js/storage-core/testing/memory\";\n\nimport { makeInMemoryBlobStore } from \"./blob\";\nimport type { ExecutorConfig } from \"./executor\";\nimport { collectSchemas } from \"./executor\";\nimport { ScopeId } from \"./ids\";\nimport type { AnyPlugin } from \"./plugin\";\nimport { Scope } from \"./scope\";\n\n// ---------------------------------------------------------------------------\n// makeTestConfig — build an ExecutorConfig backed by in-memory adapter +\n// blob store. For unit tests, plugin authors validating their plugin,\n// REPL experimentation. No persistence.\n//\n// Defaults to a single-element scope stack (\"test-scope\") — tests that\n// need multi-scope behavior can pass `scopes` explicitly.\n// ---------------------------------------------------------------------------\n\nexport const makeTestConfig = <\n  const TPlugins extends readonly AnyPlugin[] = [],\n>(options?: {\n  readonly scopeName?: string;\n  readonly scopes?: readonly Scope[];\n  readonly plugins?: TPlugins;\n}): ExecutorConfig<TPlugins> => {\n  const scopes =\n    options?.scopes ?? [\n      new Scope({\n        id: ScopeId.make(\"test-scope\"),\n        name: options?.scopeName ?? \"test\",\n        createdAt: new Date(),\n      }),\n    ];\n\n  const schema = collectSchemas(options?.plugins ?? []);\n\n  return {\n    scopes,\n    adapter: makeMemoryAdapter({ schema }),\n    blobs: makeInMemoryBlobStore(),\n    plugins: options?.plugins,\n    // Tests default to auto-accepting elicitation prompts. Override via\n    // a wrapping spread if a test exercises a real handler:\n    //   { ...makeTestConfig(...), onElicitation: customHandler }\n    onElicitation: \"accept-all\",\n  };\n};\n","// ---------------------------------------------------------------------------\n// JSON Schema $ref hoisting and re-attachment\n//\n// Core logic for deduplicating shared definitions across tools.\n// Used by any ToolRegistry implementation (in-memory, database-backed, etc.)\n//\n// Only handles standard JSON Schema formats ($defs, definitions).\n// Plugin-specific formats (e.g. OpenAPI components/schemas) must be\n// normalized by the plugin before calling registerDefinitions/register.\n// ---------------------------------------------------------------------------\n\ntype Obj = Record<string, unknown>;\n\n/** Standard JSON Schema $ref patterns. */\nconst REF_PATTERN = /^#\\/(?:\\$defs|definitions)\\/(.+)$/;\n\n/** Extract the definition name from a standard $ref pointer. */\nconst parseRefName = (ref: string): string | undefined => ref.match(REF_PATTERN)?.[1];\n\n/**\n * Recursively rewrite `#/definitions/<name>` pointers to `#/$defs/<name>`.\n * Returns the input unchanged if no rewrites are needed.\n */\nexport const normalizeRefs = (node: unknown): unknown => {\n  if (node == null || typeof node !== \"object\") return node;\n  if (Array.isArray(node)) {\n    let changed = false;\n    const out = node.map((item) => {\n      const n = normalizeRefs(item);\n      if (n !== item) changed = true;\n      return n;\n    });\n    return changed ? out : node;\n  }\n\n  const obj = node as Obj;\n\n  if (typeof obj.$ref === \"string\") {\n    const name = parseRefName(obj.$ref);\n    if (name) {\n      const canonical = `#/$defs/${name}`;\n      return canonical !== obj.$ref ? { ...obj, $ref: canonical } : obj;\n    }\n    return obj;\n  }\n\n  let changed = false;\n  const result: Obj = {};\n  for (const [k, v] of Object.entries(obj)) {\n    const n = normalizeRefs(v);\n    if (n !== v) changed = true;\n    result[k] = n;\n  }\n  return changed ? result : obj;\n};\n\n/**\n * Extract `$defs` and `definitions` from a JSON Schema,\n * returning { stripped, defs } where `stripped` is the schema without local\n * definitions and `defs` is a flat map of definition name → schema.\n */\nexport const hoistDefinitions = (\n  schema: unknown,\n): { stripped: unknown; defs: Record<string, unknown> } => {\n  if (schema == null || typeof schema !== \"object\") {\n    return { stripped: schema, defs: {} };\n  }\n  const obj = schema as Obj;\n  const defs: Record<string, unknown> = {};\n\n  if (obj.$defs && typeof obj.$defs === \"object\") {\n    for (const [k, v] of Object.entries(obj.$defs as Obj)) {\n      defs[k] = v;\n    }\n  }\n\n  if (obj.definitions && typeof obj.definitions === \"object\") {\n    for (const [k, v] of Object.entries(obj.definitions as Obj)) {\n      defs[k] = v;\n    }\n  }\n\n  const { $defs: _a, definitions: _b, ...rest } = obj;\n  return { stripped: rest, defs };\n};\n\n/**\n * Walk a schema and collect all $ref target names transitively.\n * e.g. \"#/$defs/Address\" → \"Address\", and if Address references City, both.\n */\nexport const collectRefs = (\n  node: unknown,\n  defs: ReadonlyMap<string, unknown>,\n  found: Set<string> = new Set(),\n): Set<string> => {\n  if (node == null || typeof node !== \"object\") return found;\n  const obj = node as Obj;\n\n  if (typeof obj.$ref === \"string\") {\n    const name = parseRefName(obj.$ref);\n    if (name && !found.has(name)) {\n      found.add(name);\n      const def = defs.get(name);\n      if (def) collectRefs(def, defs, found);\n    }\n    return found;\n  }\n\n  for (const v of Object.values(obj)) {\n    if (v && typeof v === \"object\") {\n      if (Array.isArray(v)) {\n        for (const item of v) collectRefs(item, defs, found);\n      } else {\n        collectRefs(v, defs, found);\n      }\n    }\n  }\n  return found;\n};\n\n/**\n * Re-attach only the referenced shared definitions into a schema,\n * so the caller gets a self-contained, usable JSON Schema.\n *\n * Assumes all `$ref` pointers and definitions have already been normalized\n * to `#/$defs/<name>` form at registration time.\n */\nexport const reattachDefs = (schema: unknown, defs: ReadonlyMap<string, unknown>): unknown => {\n  if (schema == null || typeof schema !== \"object\") return schema;\n  const refs = collectRefs(schema, defs);\n  if (refs.size === 0) return schema;\n\n  const attached: Record<string, unknown> = {};\n  for (const name of refs) {\n    const def = defs.get(name);\n    if (def) attached[name] = def;\n  }\n\n  return { ...(schema as Record<string, unknown>), $defs: attached };\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,SAAS,SAAS,QAAQ,OAAO,QAAQ,MAAM,cAAc;AAC7D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAgBP,SAAS,oBAAoB;AAI7B,SAAS,cAAc,4BAA4B;;;AC5B5C,IAAM,2BAA2B;AAejC,IAAM,qBAAqB,CAChC,UAEA,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;;;ACqDlC,IAAM,eAAe,CAA2B,WAAiB;AAydjE,SAAS,aAYd,eAoBA;AACA,SAAO,CAAC,YAAY;AAClB,UAAM;AAAA,MACJ,SAAS;AAAA,MACT,GAAG;AAAA,IACL,IAGI,WAAW,CAAC;AAEhB,UAAM,mBAAmB,OAAO,KAAK,IAAI,EAAE,SAAS;AACpD,UAAM,OAAO;AAAA,MACX,mBAAoB,OAAoB;AAAA,IAC1C;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS,mBAAmB,KAAK;AAAA,IACnC;AAAA,EACF;AACF;;;AC/lBA,SAAS,yBAAyB;AAkB3B,IAAM,iBAAiB,CAE5B,YAI8B;AAC9B,QAAM,SACJ,SAAS,UAAU;AAAA,IACjB,IAAI,MAAM;AAAA,MACR,IAAI,QAAQ,KAAK,YAAY;AAAA,MAC7B,MAAM,SAAS,aAAa;AAAA,MAC5B,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AAEF,QAAM,SAAS,eAAe,SAAS,WAAW,CAAC,CAAC;AAEpD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,kBAAkB,EAAE,OAAO,CAAC;AAAA,IACrC,OAAO,sBAAsB;AAAA,IAC7B,SAAS,SAAS;AAAA;AAAA;AAAA;AAAA,IAIlB,eAAe;AAAA,EACjB;AACF;;;AChCA,IAAM,cAAc;AAGpB,IAAM,eAAe,CAAC,QAAoC,IAAI,MAAM,WAAW,IAAI,CAAC;AAM7E,IAAM,gBAAgB,CAAC,SAA2B;AACvD,MAAI,QAAQ,QAAQ,OAAO,SAAS,SAAU,QAAO;AACrD,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,QAAIA,WAAU;AACd,UAAM,MAAM,KAAK,IAAI,CAAC,SAAS;AAC7B,YAAM,IAAI,cAAc,IAAI;AAC5B,UAAI,MAAM,KAAM,CAAAA,WAAU;AAC1B,aAAO;AAAA,IACT,CAAC;AACD,WAAOA,WAAU,MAAM;AAAA,EACzB;AAEA,QAAM,MAAM;AAEZ,MAAI,OAAO,IAAI,SAAS,UAAU;AAChC,UAAM,OAAO,aAAa,IAAI,IAAI;AAClC,QAAI,MAAM;AACR,YAAM,YAAY,WAAW,IAAI;AACjC,aAAO,cAAc,IAAI,OAAO,EAAE,GAAG,KAAK,MAAM,UAAU,IAAI;AAAA,IAChE;AACA,WAAO;AAAA,EACT;AAEA,MAAI,UAAU;AACd,QAAM,SAAc,CAAC;AACrB,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AACxC,UAAM,IAAI,cAAc,CAAC;AACzB,QAAI,MAAM,EAAG,WAAU;AACvB,WAAO,CAAC,IAAI;AAAA,EACd;AACA,SAAO,UAAU,SAAS;AAC5B;AAOO,IAAM,mBAAmB,CAC9B,WACyD;AACzD,MAAI,UAAU,QAAQ,OAAO,WAAW,UAAU;AAChD,WAAO,EAAE,UAAU,QAAQ,MAAM,CAAC,EAAE;AAAA,EACtC;AACA,QAAM,MAAM;AACZ,QAAM,OAAgC,CAAC;AAEvC,MAAI,IAAI,SAAS,OAAO,IAAI,UAAU,UAAU;AAC9C,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,KAAY,GAAG;AACrD,WAAK,CAAC,IAAI;AAAA,IACZ;AAAA,EACF;AAEA,MAAI,IAAI,eAAe,OAAO,IAAI,gBAAgB,UAAU;AAC1D,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,WAAkB,GAAG;AAC3D,WAAK,CAAC,IAAI;AAAA,IACZ;AAAA,EACF;AAEA,QAAM,EAAE,OAAO,IAAI,aAAa,IAAI,GAAG,KAAK,IAAI;AAChD,SAAO,EAAE,UAAU,MAAM,KAAK;AAChC;AAMO,IAAM,cAAc,CACzB,MACA,MACA,QAAqB,oBAAI,IAAI,MACb;AAChB,MAAI,QAAQ,QAAQ,OAAO,SAAS,SAAU,QAAO;AACrD,QAAM,MAAM;AAEZ,MAAI,OAAO,IAAI,SAAS,UAAU;AAChC,UAAM,OAAO,aAAa,IAAI,IAAI;AAClC,QAAI,QAAQ,CAAC,MAAM,IAAI,IAAI,GAAG;AAC5B,YAAM,IAAI,IAAI;AACd,YAAM,MAAM,KAAK,IAAI,IAAI;AACzB,UAAI,IAAK,aAAY,KAAK,MAAM,KAAK;AAAA,IACvC;AACA,WAAO;AAAA,EACT;AAEA,aAAW,KAAK,OAAO,OAAO,GAAG,GAAG;AAClC,QAAI,KAAK,OAAO,MAAM,UAAU;AAC9B,UAAI,MAAM,QAAQ,CAAC,GAAG;AACpB,mBAAW,QAAQ,EAAG,aAAY,MAAM,MAAM,KAAK;AAAA,MACrD,OAAO;AACL,oBAAY,GAAG,MAAM,KAAK;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AASO,IAAM,eAAe,CAAC,QAAiB,SAAgD;AAC5F,MAAI,UAAU,QAAQ,OAAO,WAAW,SAAU,QAAO;AACzD,QAAM,OAAO,YAAY,QAAQ,IAAI;AACrC,MAAI,KAAK,SAAS,EAAG,QAAO;AAE5B,QAAM,WAAoC,CAAC;AAC3C,aAAW,QAAQ,MAAM;AACvB,UAAM,MAAM,KAAK,IAAI,IAAI;AACzB,QAAI,IAAK,UAAS,IAAI,IAAI;AAAA,EAC5B;AAEA,SAAO,EAAE,GAAI,QAAoC,OAAO,SAAS;AACnE;","names":["changed"]}
+{"version":3,"sources":["../src/index.ts","../src/oauth-popup-types.ts","../src/schema-refs.ts","../src/api-errors.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// @executor-js/sdk — public surface\n// ---------------------------------------------------------------------------\n\n// Re-export the Effect/Schema/HttpApi primitives plugin authors need so a\n// plugin can be written importing only from `@executor-js/sdk`. Authors who\n// want to reach for additional Effect APIs keep importing from `effect/*`\n// directly — these re-exports are the curated minimum.\nexport { Context, Effect, Layer, Schema, Data, Option } from \"effect\";\nexport {\n  HttpApi,\n  HttpApiBuilder,\n  HttpApiClient,\n  HttpApiEndpoint,\n  HttpApiGroup,\n  HttpApiMiddleware,\n  HttpApiSchema,\n} from \"effect/unstable/httpapi\";\n\n// Storage adapter interface types (re-exported from @executor-js/storage-core\n// so plugin authors can write adapters against a single public surface\n// without depending on storage-core directly).\nexport type {\n  DBAdapter,\n  DBSchema,\n  DBFieldAttribute,\n  DBFieldType,\n  StorageFailure,\n  TypedAdapter,\n  Where,\n  WhereOperator,\n} from \"@executor-js/storage-core\";\n\nexport { typedAdapter } from \"@executor-js/storage-core\";\n\n// Storage-layer typed errors (re-exported so plugin code can catchTag\n// `UniqueViolationError` without importing storage-core directly).\nexport { StorageError, UniqueViolationError } from \"@executor-js/storage-core\";\n\n// IDs (branded)\nexport { ScopeId, ToolId, SecretId, PolicyId, ConnectionId, CredentialBindingId } from \"./ids\";\n\n// Scope\nexport { Scope } from \"./scope\";\n\n// Errors (tagged)\nexport {\n  ToolNotFoundError,\n  ToolInvocationError,\n  ToolBlockedError,\n  NoHandlerError,\n  SourceNotFoundError,\n  SourceRemovalNotAllowedError,\n  PluginNotLoadedError,\n  SecretNotFoundError,\n  SecretResolutionError,\n  SecretOwnedByConnectionError,\n  SecretInUseError,\n  ConnectionNotFoundError,\n  ConnectionProviderNotRegisteredError,\n  ConnectionRefreshNotSupportedError,\n  ConnectionReauthRequiredError,\n  ConnectionInUseError,\n  type ExecutorError,\n} from \"./errors\";\n\n// Public projections\nexport {\n  ToolSchema,\n  SourceDetectionResult,\n  type RefreshSourceInput,\n  type RemoveSourceInput,\n  type Source,\n  type Tool,\n  type ToolListFilter,\n} from \"./types\";\n\n// Core schema\nexport {\n  coreSchema,\n  isToolPolicyAction,\n  TOOL_POLICY_ACTIONS,\n  type CoreSchema,\n  type SourceInput,\n  type SourceInputTool,\n  type SourceRow,\n  type ToolRow,\n  type DefinitionRow,\n  type SecretRow,\n  type ConnectionRow,\n  type CredentialBindingRow,\n  type ToolPolicyRow,\n  type ToolPolicyAction,\n  type DefinitionsInput,\n  type ToolAnnotations,\n} from \"./core-schema\";\n\n// Tool policies\nexport {\n  matchPattern,\n  isValidPattern,\n  resolveToolPolicy,\n  resolveEffectivePolicy,\n  effectivePolicyFromSorted,\n  rowToToolPolicy,\n  ToolPolicyActionSchema,\n  type ToolPolicy,\n  type CreateToolPolicyInput,\n  type UpdateToolPolicyInput,\n  type RemoveToolPolicyInput,\n  type PolicyMatch,\n  type EffectivePolicy,\n  type PolicySource,\n} from \"./policies\";\n\n// Secrets\nexport { SecretRef, SetSecretInput, RemoveSecretInput, type SecretProvider } from \"./secrets\";\n\nexport {\n  SecretBackedMap,\n  SecretBackedValue,\n  isSecretBackedRef,\n  resolveSecretBackedMap,\n  type ResolveSecretBackedMapOptions,\n} from \"./secret-backed-value\";\n\nexport {\n  CredentialBindingKind,\n  CredentialBindingValue,\n  ConfiguredCredentialBinding,\n  ConfiguredCredentialValue,\n  ConfiguredCredentialValueSchema,\n  ScopedSecretCredentialInput,\n  CredentialBindingRef,\n  SetCredentialBindingInput,\n  CredentialBindingSourceInput,\n  CredentialBindingSlotInput,\n  RemoveCredentialBindingInput,\n  ReplaceCredentialBindingValue,\n  ReplaceCredentialBindingsInput,\n  CredentialBindingResolutionStatus,\n  ResolvedCredentialSlot,\n  credentialBindingId,\n  credentialSlotKey,\n  credentialSlotPart,\n  credentialBindingRowToRef,\n  credentialBindingValueFromRow,\n  type CredentialBindingsFacade,\n} from \"./credential-bindings\";\n\n// Usage tracking — secret/connection refs across plugins\nexport { Usage, type UsagesForSecretInput, type UsagesForConnectionInput } from \"./usages\";\n\n// Connections\nexport {\n  ConnectionRef,\n  ConnectionProviderState,\n  CreateConnectionInput,\n  RemoveConnectionInput,\n  UpdateConnectionTokensInput,\n  TokenMaterial,\n  ConnectionRefreshError,\n  type ConnectionProvider,\n  type ConnectionRefreshInput,\n  type ConnectionRefreshResult,\n} from \"./connections\";\n\n// Elicitation\nexport {\n  FormElicitation,\n  UrlElicitation,\n  ElicitationAction,\n  ElicitationResponse,\n  ElicitationDeclinedError,\n  type ElicitationRequest,\n  type ElicitationHandler,\n  type ElicitationContext,\n} from \"./elicitation\";\n\n// Blob store\nexport {\n  type BlobStore,\n  type PluginBlobStore,\n  pluginBlobStore,\n  makeInMemoryBlobStore,\n} from \"./blob\";\n\n// OAuth 2.1\nexport {\n  type OAuthService,\n  type OAuthStrategy,\n  type OAuthDynamicDcrStrategy,\n  type OAuthAuthorizationCodeStrategy,\n  type OAuthClientCredentialsStrategy,\n  type OAuthProviderState,\n  type OAuthProbeInput,\n  type OAuthProbeResult,\n  type OAuthStartInput,\n  type OAuthStartResult,\n  type OAuthCompleteInput,\n  type OAuthCompleteResult,\n  OAuthProbeError,\n  OAuthStartError,\n  OAuthCompleteError,\n  OAuthSessionNotFoundError,\n  OAUTH2_PROVIDER_KEY,\n  OAUTH2_SESSION_TTL_MS,\n  OAuthStrategy as OAuthStrategySchema,\n  OAuthProviderState as OAuthProviderStateSchema,\n  OAuthDynamicDcrStrategy as OAuthDynamicDcrStrategySchema,\n  OAuthAuthorizationCodeStrategy as OAuthAuthorizationCodeStrategySchema,\n  OAuthClientCredentialsStrategy as OAuthClientCredentialsStrategySchema,\n} from \"./oauth\";\n\nexport {\n  OAuth2Error,\n  OAUTH2_DEFAULT_TIMEOUT_MS,\n  OAUTH2_REFRESH_SKEW_MS,\n  assertSupportedOAuthEndpointUrl,\n  buildAuthorizationUrl,\n  createPkceCodeChallenge,\n  createPkceCodeVerifier,\n  exchangeAuthorizationCode,\n  exchangeClientCredentials,\n  isSupportedOAuthEndpointUrl,\n  refreshAccessToken,\n  shouldRefreshToken,\n  type OAuth2TokenResponse,\n  type BuildAuthorizationUrlInput,\n  type ClientAuthMethod,\n  type ExchangeAuthorizationCodeInput,\n  type ExchangeClientCredentialsInput,\n  type RefreshAccessTokenInput,\n} from \"./oauth-helpers\";\n\nexport { makeOAuth2Service, type OAuthServiceDeps } from \"./oauth-service\";\nexport type { ScopedDBAdapter, ScopedTypedAdapter } from \"./scoped-adapter\";\n\nexport {\n  HostedOutboundRequestBlocked,\n  makeHostedHttpClientLayer,\n  validateHostedOutboundUrl,\n  type HostedHttpClientOptions,\n} from \"./hosted-http-client\";\n\nexport {\n  OAuthDiscoveryError,\n  OAuthAuthorizationServerMetadataSchema,\n  OAuthClientInformationSchema,\n  OAuthProtectedResourceMetadataSchema,\n  beginDynamicAuthorization,\n  discoverAuthorizationServerMetadata,\n  discoverProtectedResourceMetadata,\n  registerDynamicClient,\n  type BeginDynamicAuthorizationInput,\n  type DiscoveryRequestOptions,\n  type DynamicAuthorizationState,\n  type DynamicAuthorizationStartResult,\n  type DynamicClientMetadata,\n  type OAuthAuthorizationServerMetadata,\n  type OAuthClientInformation,\n  type OAuthProtectedResourceMetadata,\n  type RegisterDynamicClientInput,\n} from \"./oauth-discovery\";\n\nexport {\n  OAUTH_POPUP_MESSAGE_TYPE,\n  type OAuthPopupResult,\n  isOAuthPopupResult,\n} from \"./oauth-popup-types\";\n\n// Plugin definition\nexport {\n  type Plugin,\n  type PluginSpec,\n  type PluginCtx,\n  type PluginExtensions,\n  type ConfiguredPlugin,\n  type AnyPlugin,\n  type StorageDeps,\n  type StaticSourceDecl,\n  type StaticToolDecl,\n  type StaticToolExecuteContext,\n  type StaticToolHandlerInput,\n  type StaticToolInput,\n  type InvokeToolInput,\n  type SourceLifecycleInput,\n  type SecretListEntry,\n  type Elicit,\n  definePlugin,\n  defineSchema,\n  tool,\n} from \"./plugin\";\n\n// Executor\nexport {\n  type Executor,\n  type ExecutorConfig,\n  type OnElicitation,\n  type InvokeOptions,\n  createExecutor,\n  collectSchemas,\n} from \"./executor\";\n\n// CLI / runtime config\nexport {\n  defineExecutorConfig,\n  type ExecutorCliConfig,\n  type ExecutorDialect,\n  type ExecutorPluginsFactory,\n} from \"./config\";\n\n// Test helper\nexport { makeTestConfig } from \"./test-config\";\n\n// JSON schema $ref helpers (used by openapi for $defs handling)\nexport { hoistDefinitions, collectRefs, reattachDefs, normalizeRefs } from \"./schema-refs\";\n\n// TypeScript preview generation from JSON schemas\nexport {\n  schemaToTypeScriptPreview,\n  schemaToTypeScriptPreviewWithDefs,\n  buildToolTypeScriptPreview,\n  type TypeScriptRenderOptions,\n  type TypeScriptSchemaPreview,\n} from \"./schema-types\";\n\n// Wire-level HTTP error schemas usable by plugin HttpApiGroup definitions.\nexport { InternalError } from \"./api-errors\";\n","// ---------------------------------------------------------------------------\n// OAuth popup result — the message shape exchanged between the popup window\n// (opened during authorization) and the opener (the onboarding UI). Both the\n// server-side HTML generator and the client-side popup opener agree on this\n// shape so that success / failure can be communicated reliably via both\n// `postMessage` and `BroadcastChannel`.\n// ---------------------------------------------------------------------------\n\n/** Message type literal used to identify our popup results. */\nexport const OAUTH_POPUP_MESSAGE_TYPE = \"executor:oauth-result\" as const;\n\nexport type OAuthPopupResult<TAuth> =\n  | ({\n      readonly type: typeof OAUTH_POPUP_MESSAGE_TYPE;\n      readonly ok: true;\n      readonly sessionId: string;\n    } & TAuth)\n  | {\n      readonly type: typeof OAUTH_POPUP_MESSAGE_TYPE;\n      readonly ok: false;\n      readonly sessionId: string | null;\n      readonly error: string;\n    };\n\nexport const isOAuthPopupResult = <TAuth>(value: unknown): value is OAuthPopupResult<TAuth> =>\n  typeof value === \"object\" &&\n  value !== null &&\n  (value as { type?: unknown }).type === OAUTH_POPUP_MESSAGE_TYPE;\n","// ---------------------------------------------------------------------------\n// JSON Schema $ref hoisting and re-attachment\n//\n// Core logic for deduplicating shared definitions across tools.\n// Used by any ToolRegistry implementation (in-memory, database-backed, etc.)\n//\n// Only handles standard JSON Schema formats ($defs, definitions).\n// Plugin-specific formats (e.g. OpenAPI components/schemas) must be\n// normalized by the plugin before calling registerDefinitions/register.\n// ---------------------------------------------------------------------------\n\ntype Obj = Record<string, unknown>;\n\n/** Standard JSON Schema $ref patterns. */\nconst REF_PATTERN = /^#\\/(?:\\$defs|definitions)\\/(.+)$/;\n\n/** Extract the definition name from a standard $ref pointer. */\nconst parseRefName = (ref: string): string | undefined => ref.match(REF_PATTERN)?.[1];\n\n/**\n * Recursively rewrite `#/definitions/<name>` pointers to `#/$defs/<name>`.\n * Returns the input unchanged if no rewrites are needed.\n */\nexport const normalizeRefs = (node: unknown): unknown => {\n  if (node == null || typeof node !== \"object\") return node;\n  if (Array.isArray(node)) {\n    let changed = false;\n    const out = node.map((item) => {\n      const n = normalizeRefs(item);\n      if (n !== item) changed = true;\n      return n;\n    });\n    return changed ? out : node;\n  }\n\n  const obj = node as Obj;\n\n  if (typeof obj.$ref === \"string\") {\n    const name = parseRefName(obj.$ref);\n    if (name) {\n      const canonical = `#/$defs/${name}`;\n      return canonical !== obj.$ref ? { ...obj, $ref: canonical } : obj;\n    }\n    return obj;\n  }\n\n  let changed = false;\n  const result: Obj = {};\n  for (const [k, v] of Object.entries(obj)) {\n    const n = normalizeRefs(v);\n    if (n !== v) changed = true;\n    result[k] = n;\n  }\n  return changed ? result : obj;\n};\n\n/**\n * Extract `$defs` and `definitions` from a JSON Schema,\n * returning { stripped, defs } where `stripped` is the schema without local\n * definitions and `defs` is a flat map of definition name → schema.\n */\nexport const hoistDefinitions = (\n  schema: unknown,\n): { stripped: unknown; defs: Record<string, unknown> } => {\n  if (schema == null || typeof schema !== \"object\") {\n    return { stripped: schema, defs: {} };\n  }\n  const obj = schema as Obj;\n  const defs: Record<string, unknown> = {};\n\n  if (obj.$defs && typeof obj.$defs === \"object\") {\n    for (const [k, v] of Object.entries(obj.$defs as Obj)) {\n      defs[k] = v;\n    }\n  }\n\n  if (obj.definitions && typeof obj.definitions === \"object\") {\n    for (const [k, v] of Object.entries(obj.definitions as Obj)) {\n      defs[k] = v;\n    }\n  }\n\n  const { $defs: _a, definitions: _b, ...rest } = obj;\n  return { stripped: rest, defs };\n};\n\n/**\n * Walk a schema and collect all $ref target names transitively.\n * e.g. \"#/$defs/Address\" → \"Address\", and if Address references City, both.\n */\nexport const collectRefs = (\n  node: unknown,\n  defs: ReadonlyMap<string, unknown>,\n  found: Set<string> = new Set(),\n): Set<string> => {\n  if (node == null || typeof node !== \"object\") return found;\n  const obj = node as Obj;\n\n  if (typeof obj.$ref === \"string\") {\n    const name = parseRefName(obj.$ref);\n    if (name && !found.has(name)) {\n      found.add(name);\n      const def = defs.get(name);\n      if (def) collectRefs(def, defs, found);\n    }\n    return found;\n  }\n\n  for (const v of Object.values(obj)) {\n    if (v && typeof v === \"object\") {\n      if (Array.isArray(v)) {\n        for (const item of v) collectRefs(item, defs, found);\n      } else {\n        collectRefs(v, defs, found);\n      }\n    }\n  }\n  return found;\n};\n\n/**\n * Re-attach only the referenced shared definitions into a schema,\n * so the caller gets a self-contained, usable JSON Schema.\n *\n * Assumes all `$ref` pointers and definitions have already been normalized\n * to `#/$defs/<name>` form at registration time.\n */\nexport const reattachDefs = (schema: unknown, defs: ReadonlyMap<string, unknown>): unknown => {\n  if (schema == null || typeof schema !== \"object\") return schema;\n  const refs = collectRefs(schema, defs);\n  if (refs.size === 0) return schema;\n\n  const attached: Record<string, unknown> = {};\n  for (const name of refs) {\n    const def = defs.get(name);\n    if (def) attached[name] = def;\n  }\n\n  return { ...(schema as Record<string, unknown>), $defs: attached };\n};\n","// ---------------------------------------------------------------------------\n// Wire-level HTTP errors. Lives in the SDK so plugin `HttpApiGroup`\n// definitions (which sit on the SDK side of the dependency graph and\n// must stay publishable) can declare them without dragging in the\n// server-only `@executor-js/api` package. The HTTP edge in\n// `@executor-js/api` re-exports these and pairs them with the\n// translation/capture helpers used by handlers.\n// ---------------------------------------------------------------------------\n\nimport { Schema } from \"effect\";\n\n/** Public 500 surface. Opaque by schema — only `traceId` crosses the wire. */\nexport class InternalError extends Schema.TaggedErrorClass<InternalError>()(\n  \"InternalError\",\n  {\n    /** Opaque correlation id for backend lookup (Sentry event id, log line, etc.). */\n    traceId: Schema.String,\n  },\n  { httpApiStatus: 500 },\n) {}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,SAAS,SAAS,QAAQ,OAAO,UAAAA,SAAQ,MAAM,cAAc;AAC7D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAgBP,SAAS,oBAAoB;AAI7B,SAAS,cAAc,4BAA4B;;;AC5B5C,IAAM,2BAA2B;AAejC,IAAM,qBAAqB,CAAQ,UACxC,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;;;ACbzC,IAAM,cAAc;AAGpB,IAAM,eAAe,CAAC,QAAoC,IAAI,MAAM,WAAW,IAAI,CAAC;AAM7E,IAAM,gBAAgB,CAAC,SAA2B;AACvD,MAAI,QAAQ,QAAQ,OAAO,SAAS,SAAU,QAAO;AACrD,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,QAAIC,WAAU;AACd,UAAM,MAAM,KAAK,IAAI,CAAC,SAAS;AAC7B,YAAM,IAAI,cAAc,IAAI;AAC5B,UAAI,MAAM,KAAM,CAAAA,WAAU;AAC1B,aAAO;AAAA,IACT,CAAC;AACD,WAAOA,WAAU,MAAM;AAAA,EACzB;AAEA,QAAM,MAAM;AAEZ,MAAI,OAAO,IAAI,SAAS,UAAU;AAChC,UAAM,OAAO,aAAa,IAAI,IAAI;AAClC,QAAI,MAAM;AACR,YAAM,YAAY,WAAW,IAAI;AACjC,aAAO,cAAc,IAAI,OAAO,EAAE,GAAG,KAAK,MAAM,UAAU,IAAI;AAAA,IAChE;AACA,WAAO;AAAA,EACT;AAEA,MAAI,UAAU;AACd,QAAM,SAAc,CAAC;AACrB,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AACxC,UAAM,IAAI,cAAc,CAAC;AACzB,QAAI,MAAM,EAAG,WAAU;AACvB,WAAO,CAAC,IAAI;AAAA,EACd;AACA,SAAO,UAAU,SAAS;AAC5B;AAOO,IAAM,mBAAmB,CAC9B,WACyD;AACzD,MAAI,UAAU,QAAQ,OAAO,WAAW,UAAU;AAChD,WAAO,EAAE,UAAU,QAAQ,MAAM,CAAC,EAAE;AAAA,EACtC;AACA,QAAM,MAAM;AACZ,QAAM,OAAgC,CAAC;AAEvC,MAAI,IAAI,SAAS,OAAO,IAAI,UAAU,UAAU;AAC9C,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,KAAY,GAAG;AACrD,WAAK,CAAC,IAAI;AAAA,IACZ;AAAA,EACF;AAEA,MAAI,IAAI,eAAe,OAAO,IAAI,gBAAgB,UAAU;AAC1D,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,WAAkB,GAAG;AAC3D,WAAK,CAAC,IAAI;AAAA,IACZ;AAAA,EACF;AAEA,QAAM,EAAE,OAAO,IAAI,aAAa,IAAI,GAAG,KAAK,IAAI;AAChD,SAAO,EAAE,UAAU,MAAM,KAAK;AAChC;AAMO,IAAM,cAAc,CACzB,MACA,MACA,QAAqB,oBAAI,IAAI,MACb;AAChB,MAAI,QAAQ,QAAQ,OAAO,SAAS,SAAU,QAAO;AACrD,QAAM,MAAM;AAEZ,MAAI,OAAO,IAAI,SAAS,UAAU;AAChC,UAAM,OAAO,aAAa,IAAI,IAAI;AAClC,QAAI,QAAQ,CAAC,MAAM,IAAI,IAAI,GAAG;AAC5B,YAAM,IAAI,IAAI;AACd,YAAM,MAAM,KAAK,IAAI,IAAI;AACzB,UAAI,IAAK,aAAY,KAAK,MAAM,KAAK;AAAA,IACvC;AACA,WAAO;AAAA,EACT;AAEA,aAAW,KAAK,OAAO,OAAO,GAAG,GAAG;AAClC,QAAI,KAAK,OAAO,MAAM,UAAU;AAC9B,UAAI,MAAM,QAAQ,CAAC,GAAG;AACpB,mBAAW,QAAQ,EAAG,aAAY,MAAM,MAAM,KAAK;AAAA,MACrD,OAAO;AACL,oBAAY,GAAG,MAAM,KAAK;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AASO,IAAM,eAAe,CAAC,QAAiB,SAAgD;AAC5F,MAAI,UAAU,QAAQ,OAAO,WAAW,SAAU,QAAO;AACzD,QAAM,OAAO,YAAY,QAAQ,IAAI;AACrC,MAAI,KAAK,SAAS,EAAG,QAAO;AAE5B,QAAM,WAAoC,CAAC;AAC3C,aAAW,QAAQ,MAAM;AACvB,UAAM,MAAM,KAAK,IAAI,IAAI;AACzB,QAAI,IAAK,UAAS,IAAI,IAAI;AAAA,EAC5B;AAEA,SAAO,EAAE,GAAI,QAAoC,OAAO,SAAS;AACnE;;;AClIA,SAAS,cAAc;AAGhB,IAAM,gBAAN,cAA4B,OAAO,iBAAgC;AAAA,EACxE;AAAA,EACA;AAAA;AAAA,IAEE,SAAS,OAAO;AAAA,EAClB;AAAA,EACA,EAAE,eAAe,IAAI;AACvB,EAAE;AAAC;","names":["Schema","changed"]}

package/dist/credential-bindings.d.ts

@@ -0,0 +1,173 @@
+import { Effect, Schema } from "effect";
+import type { StorageFailure } from "@executor-js/storage-core";
+import { type CredentialBindingRow } from "./core-schema";
+import { CredentialBindingId } from "./ids";
+import type { Usage } from "./usages";
+export declare const CredentialBindingKind: Schema.Literals<["text", "secret", "connection"]>;
+export type CredentialBindingKind = typeof CredentialBindingKind.Type;
+export declare const CredentialBindingValue: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"text">;
+    readonly text: Schema.String;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"secret">;
+    readonly secretId: Schema.brand<Schema.String, "SecretId">;
+    readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"connection">;
+    readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+}>]>;
+export type CredentialBindingValue = typeof CredentialBindingValue.Type;
+export declare const ConfiguredCredentialBindingSchema: Schema.Struct<{
+    readonly kind: Schema.Literal<"binding">;
+    readonly slot: Schema.String;
+    readonly prefix: Schema.optional<Schema.String>;
+}>;
+declare const ConfiguredCredentialBinding_base: Schema.Class<ConfiguredCredentialBinding, Schema.Struct<{
+    readonly kind: Schema.Literal<"binding">;
+    readonly slot: Schema.String;
+    readonly prefix: Schema.optional<Schema.String>;
+}>, {}>;
+export declare class ConfiguredCredentialBinding extends ConfiguredCredentialBinding_base {
+}
+export declare const ConfiguredCredentialValue: Schema.Union<readonly [Schema.String, typeof ConfiguredCredentialBinding]>;
+export type ConfiguredCredentialValue = typeof ConfiguredCredentialValue.Type;
+export declare const ConfiguredCredentialValueSchema: Schema.Union<readonly [Schema.String, Schema.Struct<{
+    readonly kind: Schema.Literal<"binding">;
+    readonly slot: Schema.String;
+    readonly prefix: Schema.optional<Schema.String>;
+}>]>;
+export declare const ScopedSecretCredentialInput: Schema.Struct<{
+    readonly secretId: Schema.String;
+    readonly prefix: Schema.optional<Schema.String>;
+    readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
+    readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+}>;
+export type ScopedSecretCredentialInput = typeof ScopedSecretCredentialInput.Type;
+declare const CredentialBindingRef_base: Schema.Class<CredentialBindingRef, Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "CredentialBindingId">;
+    readonly scopeId: Schema.brand<Schema.String, "ScopeId">;
+    readonly pluginId: Schema.String;
+    readonly sourceId: Schema.String;
+    readonly sourceScopeId: Schema.brand<Schema.String, "ScopeId">;
+    readonly slotKey: Schema.String;
+    readonly value: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"text">;
+        readonly text: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"secret">;
+        readonly secretId: Schema.brand<Schema.String, "SecretId">;
+        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"connection">;
+        readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+    }>]>;
+    readonly createdAt: Schema.Date;
+    readonly updatedAt: Schema.Date;
+}>, {}>;
+export declare class CredentialBindingRef extends CredentialBindingRef_base {
+}
+declare const SetCredentialBindingInput_base: Schema.Class<SetCredentialBindingInput, Schema.Struct<{
+    readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
+    readonly pluginId: Schema.String;
+    readonly sourceId: Schema.String;
+    readonly sourceScope: Schema.brand<Schema.String, "ScopeId">;
+    readonly slotKey: Schema.String;
+    readonly value: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"text">;
+        readonly text: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"secret">;
+        readonly secretId: Schema.brand<Schema.String, "SecretId">;
+        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"connection">;
+        readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+    }>]>;
+}>, {}>;
+export declare class SetCredentialBindingInput extends SetCredentialBindingInput_base {
+}
+declare const CredentialBindingSourceInput_base: Schema.Class<CredentialBindingSourceInput, Schema.Struct<{
+    readonly pluginId: Schema.String;
+    readonly sourceId: Schema.String;
+    readonly sourceScope: Schema.brand<Schema.String, "ScopeId">;
+}>, {}>;
+export declare class CredentialBindingSourceInput extends CredentialBindingSourceInput_base {
+}
+declare const CredentialBindingSlotInput_base: Schema.Class<CredentialBindingSlotInput, Schema.Struct<{
+    readonly pluginId: Schema.String;
+    readonly sourceId: Schema.String;
+    readonly sourceScope: Schema.brand<Schema.String, "ScopeId">;
+    readonly slotKey: Schema.String;
+}>, {}>;
+export declare class CredentialBindingSlotInput extends CredentialBindingSlotInput_base {
+}
+declare const RemoveCredentialBindingInput_base: Schema.Class<RemoveCredentialBindingInput, Schema.Struct<{
+    readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
+    readonly pluginId: Schema.String;
+    readonly sourceId: Schema.String;
+    readonly sourceScope: Schema.brand<Schema.String, "ScopeId">;
+    readonly slotKey: Schema.String;
+}>, {}>;
+export declare class RemoveCredentialBindingInput extends RemoveCredentialBindingInput_base {
+}
+declare const ReplaceCredentialBindingValue_base: Schema.Class<ReplaceCredentialBindingValue, Schema.Struct<{
+    readonly slotKey: Schema.String;
+    readonly value: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"text">;
+        readonly text: Schema.String;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"secret">;
+        readonly secretId: Schema.brand<Schema.String, "SecretId">;
+        readonly secretScopeId: Schema.optional<Schema.brand<Schema.String, "ScopeId">>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"connection">;
+        readonly connectionId: Schema.brand<Schema.String, "ConnectionId">;
+    }>]>;
+}>, {}>;
+export declare class ReplaceCredentialBindingValue extends ReplaceCredentialBindingValue_base {
+}
+declare const ReplaceCredentialBindingsInput_base: Schema.Class<ReplaceCredentialBindingsInput, Schema.Struct<{
+    readonly targetScope: Schema.brand<Schema.String, "ScopeId">;
+    readonly pluginId: Schema.String;
+    readonly sourceId: Schema.String;
+    readonly sourceScope: Schema.brand<Schema.String, "ScopeId">;
+    readonly slotPrefixes: Schema.$Array<Schema.String>;
+    readonly bindings: Schema.$Array<typeof ReplaceCredentialBindingValue>;
+}>, {}>;
+export declare class ReplaceCredentialBindingsInput extends ReplaceCredentialBindingsInput_base {
+}
+export declare const CredentialBindingResolutionStatus: Schema.Literals<readonly ["resolved", "missing", "blocked"]>;
+export type CredentialBindingResolutionStatus = typeof CredentialBindingResolutionStatus.Type;
+declare const ResolvedCredentialSlot_base: Schema.Class<ResolvedCredentialSlot, Schema.Struct<{
+    readonly pluginId: Schema.String;
+    readonly sourceId: Schema.String;
+    readonly sourceScopeId: Schema.brand<Schema.String, "ScopeId">;
+    readonly slotKey: Schema.String;
+    readonly bindingScopeId: Schema.NullOr<Schema.brand<Schema.String, "ScopeId">>;
+    readonly kind: Schema.NullOr<Schema.Literals<["text", "secret", "connection"]>>;
+    readonly status: Schema.Literals<readonly ["resolved", "missing", "blocked"]>;
+}>, {}>;
+export declare class ResolvedCredentialSlot extends ResolvedCredentialSlot_base {
+}
+export interface CredentialBindingsFacade {
+    readonly listForSource: (input: CredentialBindingSourceInput) => Effect.Effect<readonly CredentialBindingRef[], StorageFailure>;
+    readonly resolve: (input: CredentialBindingSlotInput) => Effect.Effect<ResolvedCredentialSlot, StorageFailure>;
+    readonly set: (input: SetCredentialBindingInput) => Effect.Effect<CredentialBindingRef, StorageFailure>;
+    readonly remove: (input: RemoveCredentialBindingInput) => Effect.Effect<void, StorageFailure>;
+    readonly replaceForSource: (input: ReplaceCredentialBindingsInput) => Effect.Effect<readonly CredentialBindingRef[], StorageFailure>;
+    readonly removeForSource: (input: CredentialBindingSourceInput) => Effect.Effect<void, StorageFailure>;
+    readonly usagesForSecret: (id: string) => Effect.Effect<readonly Usage[], StorageFailure>;
+    readonly usagesForConnection: (id: string) => Effect.Effect<readonly Usage[], StorageFailure>;
+}
+export declare const credentialBindingId: (input: {
+    readonly pluginId: string;
+    readonly sourceId: string;
+    readonly sourceScope: string;
+    readonly slotKey: string;
+}) => CredentialBindingId;
+export declare const credentialSlotPart: (value: string) => string;
+export declare const credentialSlotKey: (prefix: string, name: string) => string;
+export declare const credentialBindingValueFromRow: (row: CredentialBindingRow) => CredentialBindingValue;
+export declare const credentialBindingRowToRef: (row: CredentialBindingRow) => CredentialBindingRef;
+export {};
+//# sourceMappingURL=credential-bindings.d.ts.map

package/dist/credential-bindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-bindings.d.ts","sourceRoot":"","sources":["../src/credential-bindings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAS,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,EAAgB,mBAAmB,EAAqB,MAAM,OAAO,CAAC;AAC7E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEtC,eAAO,MAAM,qBAAqB,mDAA0C,CAAC;AAC7E,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAC;AAEtE,eAAO,MAAM,sBAAsB;;;;;;;;;;IAcjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAC;AAExE,eAAO,MAAM,iCAAiC;;;;EAI5C,CAAC;;;;;;AAEH,qBAAa,2BAA4B,SAAQ,gCAEN;CAAG;AAE9C,eAAO,MAAM,yBAAyB,4EAA6D,CAAC;AACpG,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAC;AAE9E,eAAO,MAAM,+BAA+B;;;;IAG1C,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;EAKtC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;AAElF,qBAAa,oBAAqB,SAAQ,yBAYxC;CAAG;;;;;;;;;;;;;;;;;;;AAEL,qBAAa,yBAA0B,SAAQ,8BAS7C;CAAG;;;;;;AAEL,qBAAa,4BAA6B,SAAQ,iCAMhD;CAAG;;;;;;;AAEL,qBAAa,0BAA2B,SAAQ,+BAO9C;CAAG;;;;;;;;AAEL,qBAAa,4BAA6B,SAAQ,iCAQhD;CAAG;;;;;;;;;;;;;;;AAEL,qBAAa,6BAA8B,SAAQ,kCAKjD;CAAG;;;;;;;;;AAEL,qBAAa,8BAA+B,SAAQ,mCASlD;CAAG;AAEL,eAAO,MAAM,iCAAiC,8DAI5C,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,OAAO,iCAAiC,CAAC,IAAI,CAAC;;;;;;;;;;AAE9F,qBAAa,sBAAuB,SAAQ,2BAU1C;CAAG;AAEL,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,EAAE,CACtB,KAAK,EAAE,4BAA4B,KAChC,MAAM,CAAC,MAAM,CAAC,SAAS,oBAAoB,EAAE,EAAE,cAAc,CAAC,CAAC;IACpE,QAAQ,CAAC,OAAO,EAAE,CAChB,KAAK,EAAE,0BAA0B,KAC9B,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,cAAc,CAAC,CAAC;IAC3D,QAAQ,CAAC,GAAG,EAAE,CACZ,KAAK,EAAE,yBAAyB,KAC7B,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,cAAc,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,4BAA4B,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC9F,QAAQ,CAAC,gBAAgB,EAAE,CACzB,KAAK,EAAE,8BAA8B,KAClC,MAAM,CAAC,MAAM,CAAC,SAAS,oBAAoB,EAAE,EAAE,cAAc,CAAC,CAAC;IACpE,QAAQ,CAAC,eAAe,EAAE,CACxB,KAAK,EAAE,4BAA4B,KAChC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,cAAc,CAAC,CAAC;IAC1F,QAAQ,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,cAAc,CAAC,CAAC;CAC/F;AAED,eAAO,MAAM,mBAAmB,GAAI,OAAO;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,KAAG,mBAGD,CAAC;AAEJ,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,MAKV,CAAC;AAE1C,eAAO,MAAM,iBAAiB,GAAI,QAAQ,MAAM,EAAE,MAAM,MAAM,KAAG,MACxB,CAAC;AAE1C,eAAO,MAAM,6BAA6B,GAAI,KAAK,oBAAoB,KAAG,sBAgBvE,CAAC;AAEJ,eAAO,MAAM,yBAAyB,GAAI,KAAK,oBAAoB,KAAG,oBAarE,CAAC"}

package/dist/credential-bindings.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=credential-bindings.test.d.ts.map

package/dist/credential-bindings.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-bindings.test.d.ts","sourceRoot":"","sources":["../src/credential-bindings.test.ts"],"names":[],"mappings":""}