@executor-js/sdk 1.4.29 → 1.4.31

package/dist/core-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-schema.d.ts","sourceRoot":"","sources":["../src/core-schema.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAY,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAE/E,eAAO,MAAM,sBAAsB,EAAuC,CACxE,MAAM,EACN,QAAQ,EACR,YAAY,CACb,CAAC;AAEF,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA6GjB;+EACmE;;;;;;YAEnE;mEACuD;;;;;YAEvD,4DAA4D;;;;;YAE5D;yEAC6D;;;;;YAE7D;;iEAEqD;;;;;;YAErD,sDAAsD;;;;;YAEtD;yDAC6C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAiC7C,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA4BxC,gDAAgD;;;;;YAEhD;;;;;iCAKqB;;;;;;;;;;;;;;;;CAME,CAAC;AAE9B,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC;AAO3C,MAAM,MAAM,SAAS,GAAG,mBAAmB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,GACzE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,MAAM,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAElG,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjF,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,MAAM,MAAM,SAAS,GAAG,mBAAmB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,GACzE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,GACjF,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,KAAK,0BAA0B,GAAG,mBAAmB,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClG,KAAK,wBAAwB,GAAG,IAAI,CAClC,0BAA0B,EAC1B,MAAM,GAAG,YAAY,GAAG,WAAW,GAAG,iBAAiB,GAAG,eAAe,CAC1E,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,wBAAwB,GACzD,CACI;IACE,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB,CACJ,GACD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,GAClF,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAc1B,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,kBAAkB,GAAG,OAAO,CAAC;AAExE,eAAO,MAAM,mBAAmB,mDAIgB,CAAC;AAEjD,eAAO,MAAM,kBAAkB,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,gBAC4B,CAAC;AAkB1F,MAAM,WAAW,eAAe;IAC9B;kEAC8D;IAC9D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;4CACwC;IACxC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC;4DACwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAUD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;4EAEwE;IACxE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;CAC5C;AASD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;+CAC2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/C"}
+{"version":3,"file":"core-schema.d.ts","sourceRoot":"","sources":["../src/core-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,SAAS,EAAiB,MAAM,eAAe,CAAC;AACvF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAW9C,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAE7C,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,6DAA2B,CAAC;AACnE,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,2EAAsC,CAAC;AACtF,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,EAAE,cAAc,OAAO,oEAChB,CAAC;AAC/C,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,6DAA2B,CAAC;AACrE,eAAO,MAAM,oBAAoB,GAAI,MAAM,MAAM,2EAAsC,CAAC;AACxF,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,6DAAyB,CAAC;AACjE,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,6DAAoC,CAAC;AACpF,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,4DAA8B,CAAC;AA+BtE,eAAO,MAAM,mBAAmB,GAAI,KAAK,CAAC,QAAQ,SAAS,WAAW,EACpE,MAAM,MAAM,EACZ,SAAS,QAAQ;;;;MAwBlB,CAAC;AAKF,eAAO,MAAM,sBAAsB,2CAA4C,CAAC;AAuDhF,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6ErB,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAAa,CAAC;AACrC,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC;AAE3C,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,MAAM,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;AAC9D,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;AAC9D,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAErE,KAAK,wBAAwB,GAAG,IAAI,CAClC,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,EACzC,MAAM,GAAG,YAAY,GAAG,WAAW,GAAG,iBAAiB,GAAG,eAAe,CAC1E,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,wBAAwB,GACzD,CACI;IACE,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,GACD;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB,CACJ,GACD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1B,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;AAE/D,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,kBAAkB,GAAG,OAAO,CAAC;AAExE,eAAO,MAAM,mBAAmB,mDAIgB,CAAC;AAEjD,eAAO,MAAM,kBAAkB,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,gBAC4B,CAAC;AAE1F,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/C"}

package/dist/core-tools.d.ts

@@ -0,0 +1,6 @@
+export interface CoreToolsPluginOptions {
+    readonly webBaseUrl?: string;
+}
+export declare const coreToolsPlugin: import("./plugin").ConfiguredPlugin<"core-tools", {}, {}, CoreToolsPluginOptions, undefined, undefined, import("effect/Layer").Layer<unknown, never, never>, import("effect/unstable/httpapi/HttpApiGroup").Any>;
+export default coreToolsPlugin;
+//# sourceMappingURL=core-tools.d.ts.map

package/dist/core-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-tools.d.ts","sourceRoot":"","sources":["../src/core-tools.ts"],"names":[],"mappings":"AA6YA,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAmGD,eAAO,MAAM,eAAe,kNA6ezB,CAAC;AAEJ,eAAe,eAAe,CAAC"}

package/dist/core.js

@@ -1,16 +1,77 @@
+import {
+  defineExecutorConfig
+} from "./chunk-2LU3SC64.js";
+import {
+  InternalError,
+  OAUTH_POPUP_MESSAGE_TYPE,
+  isOAuthPopupResult
+} from "./chunk-B4YGTZF6.js";
 import {
   SecretBackedMap,
   SecretBackedValue,
-  defineExecutorConfig,
   isSecretBackedRef,
   resolveSecretBackedMap
-} from "./chunk-6SQWMOM4.js";
+} from "./chunk-MLNVNVRI.js";
 import {
+  ConnectionProviderState,
+  ConnectionRef,
+  ConnectionRefreshError,
+  CreateConnectionInput,
+  ElicitationAction,
+  ElicitationDeclinedError,
+  ElicitationResponse,
+  FormElicitation,
+  HostedOutboundRequestBlocked,
+  OAUTH2_DEFAULT_TIMEOUT_MS,
+  OAUTH2_REFRESH_SKEW_MS,
+  OAuth2Error,
+  OAuthAuthorizationServerMetadataSchema,
+  OAuthClientInformationSchema,
+  OAuthDiscoveryError,
+  OAuthProtectedResourceMetadataSchema,
+  RemoveConnectionInput,
+  RemoveSecretInput,
+  Scope,
+  SecretRef,
+  SetSecretInput,
+  TokenMaterial,
+  ToolResult,
+  UpdateConnectionTokensInput,
+  UrlElicitation,
+  assertSupportedOAuthEndpointUrl,
+  beginDynamicAuthorization,
+  buildAuthorizationUrl,
+  buildToolTypeScriptPreview,
+  collectRefs,
+  collectTables,
+  coreToolsPlugin,
+  createExecutor,
+  createPkceCodeChallenge,
+  createPkceCodeVerifier,
+  defaultSourceInstallScopeId,
   definePlugin,
-  defineSchema,
-  makeTestConfig,
-  tool
-} from "./chunk-I2OEQ2GJ.js";
+  discoverAuthorizationServerMetadata,
+  discoverProtectedResourceMetadata,
+  exchangeAuthorizationCode,
+  exchangeClientCredentials,
+  hoistDefinitions,
+  isSupportedOAuthEndpointUrl,
+  isToolResult,
+  makeFumaBlobStore,
+  makeHostedHttpClientLayer,
+  makeInMemoryBlobStore,
+  makeOAuth2Service,
+  normalizeRefs,
+  pluginBlobStore,
+  reattachDefs,
+  refreshAccessToken,
+  registerDynamicClient,
+  schemaToTypeScriptPreview,
+  schemaToTypeScriptPreviewWithDefs,
+  shouldRefreshToken,
+  tool,
+  validateHostedOutboundUrl
+} from "./chunk-BZNIRSMG.js";
 import {
   ConfiguredCredentialBinding,
   ConfiguredCredentialValue,
@@ -18,116 +79,87 @@ import {
   ConnectionInUseError,
   ConnectionNotFoundError,
   ConnectionProviderNotRegisteredError,
-  ConnectionProviderState,
   ConnectionReauthRequiredError,
-  ConnectionRef,
-  ConnectionRefreshError,
   ConnectionRefreshNotSupportedError,
-  CreateConnectionInput,
   CredentialBindingId,
   CredentialBindingKind,
   CredentialBindingRef,
   CredentialBindingResolutionStatus,
   CredentialBindingSlotInput,
-  CredentialBindingSourceInput,
   CredentialBindingValue,
-  ElicitationAction,
-  ElicitationDeclinedError,
-  ElicitationResponse,
-  FormElicitation,
-  HostedOutboundRequestBlocked,
   NoHandlerError,
-  OAUTH2_DEFAULT_TIMEOUT_MS,
   OAUTH2_PROVIDER_KEY,
-  OAUTH2_REFRESH_SKEW_MS,
   OAUTH2_SESSION_TTL_MS,
-  OAuth2Error,
   OAuthAuthorizationCodeStrategy,
-  OAuthAuthorizationServerMetadataSchema,
   OAuthClientCredentialsStrategy,
-  OAuthClientInformationSchema,
   OAuthCompleteError,
-  OAuthDiscoveryError,
   OAuthDynamicDcrStrategy,
   OAuthProbeError,
-  OAuthProtectedResourceMetadataSchema,
   OAuthProviderState,
   OAuthSessionNotFoundError,
   OAuthStartError,
   OAuthStrategy,
   PluginNotLoadedError,
   PolicyId,
-  RemoveConnectionInput,
   RemoveCredentialBindingInput,
-  RemoveSecretInput,
+  RemoveSourceCredentialBindingInput,
   ReplaceCredentialBindingValue,
   ReplaceCredentialBindingsInput,
+  ReplaceSourceCredentialBindingsInput,
   ResolvedCredentialSlot,
-  Scope,
   ScopeId,
   ScopedSecretCredentialInput,
   SecretId,
   SecretInUseError,
   SecretNotFoundError,
   SecretOwnedByConnectionError,
-  SecretRef,
   SecretResolutionError,
-  SetCredentialBindingInput,
-  SetSecretInput,
+  SetSourceCredentialBindingInput,
+  SourceCredentialBindingSlotInput,
+  SourceCredentialBindingSource,
+  SourceCredentialBindingSourceInput,
   SourceDetectionResult,
   SourceNotFoundError,
   SourceRemovalNotAllowedError,
+  StorageError,
   TOOL_POLICY_ACTIONS,
-  TokenMaterial,
   ToolBlockedError,
   ToolId,
   ToolInvocationError,
   ToolNotFoundError,
   ToolPolicyActionSchema,
   ToolSchema,
-  UpdateConnectionTokensInput,
-  UrlElicitation,
+  UniqueViolationError,
   Usage,
-  assertSupportedOAuthEndpointUrl,
-  beginDynamicAuthorization,
-  buildAuthorizationUrl,
-  buildToolTypeScriptPreview,
-  collectSchemas,
+  bigintColumn,
+  boolColumn,
   coreSchema,
-  createExecutor,
-  createPkceCodeChallenge,
-  createPkceCodeVerifier,
   credentialBindingId,
   credentialBindingRowToRef,
   credentialBindingValueFromRow,
   credentialSlotKey,
   credentialSlotPart,
-  discoverAuthorizationServerMetadata,
-  discoverProtectedResourceMetadata,
+  dateColumn,
   effectivePolicyFromSorted,
-  exchangeAuthorizationCode,
-  exchangeClientCredentials,
-  isSupportedOAuthEndpointUrl,
+  isStorageFailure,
   isToolPolicyAction,
   isValidPattern,
-  makeHostedHttpClientLayer,
-  makeInMemoryBlobStore,
-  makeOAuth2Service,
+  jsonColumn,
   matchPattern,
-  pluginBlobStore,
-  refreshAccessToken,
-  registerDynamicClient,
+  nullableBigintColumn,
+  nullableJsonColumn,
+  nullableTextColumn,
+  pluginStorageId,
   resolveEffectivePolicy,
   resolveToolPolicy,
   rowToToolPolicy,
-  schemaToTypeScriptPreview,
-  schemaToTypeScriptPreviewWithDefs,
-  shouldRefreshToken,
-  validateHostedOutboundUrl
-} from "./chunk-OIJL6F6M.js";
+  scopedExecutorTable,
+  textColumn
+} from "./chunk-ZANQD7E2.js";
+import "./chunk-7D4SUZUM.js";
 
 // src/index.ts
-import { Context, Effect, Layer, Schema as Schema2, Data, Option } from "effect";
+import { Context, Effect, Layer, Schema, Data, Option } from "effect";
 import {
   HttpApi,
   HttpApiBuilder,
@@ -137,110 +169,8 @@ import {
   HttpApiMiddleware,
   HttpApiSchema
 } from "effect/unstable/httpapi";
-import { typedAdapter } from "@executor-js/storage-core";
-import { StorageError, UniqueViolationError } from "@executor-js/storage-core";
-
-// src/oauth-popup-types.ts
-var OAUTH_POPUP_MESSAGE_TYPE = "executor:oauth-result";
-var isOAuthPopupResult = (value) => typeof value === "object" && value !== null && value.type === OAUTH_POPUP_MESSAGE_TYPE;
-
-// src/schema-refs.ts
-var REF_PATTERN = /^#\/(?:\$defs|definitions)\/(.+)$/;
-var parseRefName = (ref) => ref.match(REF_PATTERN)?.[1];
-var normalizeRefs = (node) => {
-  if (node == null || typeof node !== "object") return node;
-  if (Array.isArray(node)) {
-    let changed2 = false;
-    const out = node.map((item) => {
-      const n = normalizeRefs(item);
-      if (n !== item) changed2 = true;
-      return n;
-    });
-    return changed2 ? out : node;
-  }
-  const obj = node;
-  if (typeof obj.$ref === "string") {
-    const name = parseRefName(obj.$ref);
-    if (name) {
-      const canonical = `#/$defs/${name}`;
-      return canonical !== obj.$ref ? { ...obj, $ref: canonical } : obj;
-    }
-    return obj;
-  }
-  let changed = false;
-  const result = {};
-  for (const [k, v] of Object.entries(obj)) {
-    const n = normalizeRefs(v);
-    if (n !== v) changed = true;
-    result[k] = n;
-  }
-  return changed ? result : obj;
-};
-var hoistDefinitions = (schema) => {
-  if (schema == null || typeof schema !== "object") {
-    return { stripped: schema, defs: {} };
-  }
-  const obj = schema;
-  const defs = {};
-  if (obj.$defs && typeof obj.$defs === "object") {
-    for (const [k, v] of Object.entries(obj.$defs)) {
-      defs[k] = v;
-    }
-  }
-  if (obj.definitions && typeof obj.definitions === "object") {
-    for (const [k, v] of Object.entries(obj.definitions)) {
-      defs[k] = v;
-    }
-  }
-  const { $defs: _a, definitions: _b, ...rest } = obj;
-  return { stripped: rest, defs };
-};
-var collectRefs = (node, defs, found = /* @__PURE__ */ new Set()) => {
-  if (node == null || typeof node !== "object") return found;
-  const obj = node;
-  if (typeof obj.$ref === "string") {
-    const name = parseRefName(obj.$ref);
-    if (name && !found.has(name)) {
-      found.add(name);
-      const def = defs.get(name);
-      if (def) collectRefs(def, defs, found);
-    }
-    return found;
-  }
-  for (const v of Object.values(obj)) {
-    if (v && typeof v === "object") {
-      if (Array.isArray(v)) {
-        for (const item of v) collectRefs(item, defs, found);
-      } else {
-        collectRefs(v, defs, found);
-      }
-    }
-  }
-  return found;
-};
-var reattachDefs = (schema, defs) => {
-  if (schema == null || typeof schema !== "object") return schema;
-  const refs = collectRefs(schema, defs);
-  if (refs.size === 0) return schema;
-  const attached = {};
-  for (const name of refs) {
-    const def = defs.get(name);
-    if (def) attached[name] = def;
-  }
-  return { ...schema, $defs: attached };
-};
-
-// src/api-errors.ts
-import { Schema } from "effect";
-var InternalError = class extends Schema.TaggedErrorClass()(
-  "InternalError",
-  {
-    /** Opaque correlation id for backend lookup (Sentry event id, log line, etc.). */
-    traceId: Schema.String
-  },
-  { httpApiStatus: 500 }
-) {
-};
+import { fumadb } from "fumadb";
+import { column, idColumn, schema, table } from "fumadb/schema";
 export {
   ConfiguredCredentialBinding,
   ConfiguredCredentialValue,
@@ -260,7 +190,6 @@ export {
   CredentialBindingRef,
   CredentialBindingResolutionStatus,
   CredentialBindingSlotInput,
-  CredentialBindingSourceInput,
   CredentialBindingValue,
   Data,
   Effect,
@@ -304,10 +233,12 @@ export {
   RemoveConnectionInput,
   RemoveCredentialBindingInput,
   RemoveSecretInput,
+  RemoveSourceCredentialBindingInput,
   ReplaceCredentialBindingValue,
   ReplaceCredentialBindingsInput,
+  ReplaceSourceCredentialBindingsInput,
   ResolvedCredentialSlot,
-  Schema2 as Schema,
+  Schema,
   Scope,
   ScopeId,
   ScopedSecretCredentialInput,
@@ -319,8 +250,11 @@ export {
   SecretOwnedByConnectionError,
   SecretRef,
   SecretResolutionError,
-  SetCredentialBindingInput,
   SetSecretInput,
+  SetSourceCredentialBindingInput,
+  SourceCredentialBindingSlotInput,
+  SourceCredentialBindingSource,
+  SourceCredentialBindingSourceInput,
   SourceDetectionResult,
   SourceNotFoundError,
   SourceRemovalNotAllowedError,
@@ -332,6 +266,7 @@ export {
   ToolInvocationError,
   ToolNotFoundError,
   ToolPolicyActionSchema,
+  ToolResult,
   ToolSchema,
   UniqueViolationError,
   UpdateConnectionTokensInput,
@@ -339,11 +274,15 @@ export {
   Usage,
   assertSupportedOAuthEndpointUrl,
   beginDynamicAuthorization,
+  bigintColumn,
+  boolColumn,
   buildAuthorizationUrl,
   buildToolTypeScriptPreview,
   collectRefs,
-  collectSchemas,
+  collectTables,
+  column,
   coreSchema,
+  coreToolsPlugin,
   createExecutor,
   createPkceCodeChallenge,
   createPkceCodeVerifier,
@@ -352,27 +291,38 @@ export {
   credentialBindingValueFromRow,
   credentialSlotKey,
   credentialSlotPart,
+  dateColumn,
+  defaultSourceInstallScopeId,
   defineExecutorConfig,
   definePlugin,
-  defineSchema,
   discoverAuthorizationServerMetadata,
   discoverProtectedResourceMetadata,
   effectivePolicyFromSorted,
   exchangeAuthorizationCode,
   exchangeClientCredentials,
+  schema as fumaSchema,
+  fumadb,
   hoistDefinitions,
+  idColumn,
   isOAuthPopupResult,
   isSecretBackedRef,
+  isStorageFailure,
   isSupportedOAuthEndpointUrl,
   isToolPolicyAction,
+  isToolResult,
   isValidPattern,
+  jsonColumn,
+  makeFumaBlobStore,
   makeHostedHttpClientLayer,
   makeInMemoryBlobStore,
   makeOAuth2Service,
-  makeTestConfig,
   matchPattern,
   normalizeRefs,
+  nullableBigintColumn,
+  nullableJsonColumn,
+  nullableTextColumn,
   pluginBlobStore,
+  pluginStorageId,
   reattachDefs,
   refreshAccessToken,
   registerDynamicClient,
@@ -382,9 +332,11 @@ export {
   rowToToolPolicy,
   schemaToTypeScriptPreview,
   schemaToTypeScriptPreviewWithDefs,
+  scopedExecutorTable,
   shouldRefreshToken,
+  table,
+  textColumn,
   tool,
-  typedAdapter,
   validateHostedOutboundUrl
 };
 //# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/oauth-popup-types.ts","../src/schema-refs.ts","../src/api-errors.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// @executor-js/sdk — public surface\n// ---------------------------------------------------------------------------\n\n// Re-export the Effect/Schema/HttpApi primitives plugin authors need so a\n// plugin can be written importing only from `@executor-js/sdk`. Authors who\n// want to reach for additional Effect APIs keep importing from `effect/*`\n// directly — these re-exports are the curated minimum.\nexport { Context, Effect, Layer, Schema, Data, Option } from \"effect\";\nexport {\n  HttpApi,\n  HttpApiBuilder,\n  HttpApiClient,\n  HttpApiEndpoint,\n  HttpApiGroup,\n  HttpApiMiddleware,\n  HttpApiSchema,\n} from \"effect/unstable/httpapi\";\n\n// Storage adapter interface types (re-exported from @executor-js/storage-core\n// so plugin authors can write adapters against a single public surface\n// without depending on storage-core directly).\nexport type {\n  DBAdapter,\n  DBSchema,\n  DBFieldAttribute,\n  DBFieldType,\n  StorageFailure,\n  TypedAdapter,\n  Where,\n  WhereOperator,\n} from \"@executor-js/storage-core\";\n\nexport { typedAdapter } from \"@executor-js/storage-core\";\n\n// Storage-layer typed errors (re-exported so plugin code can catchTag\n// `UniqueViolationError` without importing storage-core directly).\nexport { StorageError, UniqueViolationError } from \"@executor-js/storage-core\";\n\n// IDs (branded)\nexport { ScopeId, ToolId, SecretId, PolicyId, ConnectionId, CredentialBindingId } from \"./ids\";\n\n// Scope\nexport { Scope } from \"./scope\";\n\n// Errors (tagged)\nexport {\n  ToolNotFoundError,\n  ToolInvocationError,\n  ToolBlockedError,\n  NoHandlerError,\n  SourceNotFoundError,\n  SourceRemovalNotAllowedError,\n  PluginNotLoadedError,\n  SecretNotFoundError,\n  SecretResolutionError,\n  SecretOwnedByConnectionError,\n  SecretInUseError,\n  ConnectionNotFoundError,\n  ConnectionProviderNotRegisteredError,\n  ConnectionRefreshNotSupportedError,\n  ConnectionReauthRequiredError,\n  ConnectionInUseError,\n  type ExecutorError,\n} from \"./errors\";\n\n// Public projections\nexport {\n  ToolSchema,\n  SourceDetectionResult,\n  type RefreshSourceInput,\n  type RemoveSourceInput,\n  type Source,\n  type Tool,\n  type ToolListFilter,\n} from \"./types\";\n\n// Core schema\nexport {\n  coreSchema,\n  isToolPolicyAction,\n  TOOL_POLICY_ACTIONS,\n  type CoreSchema,\n  type SourceInput,\n  type SourceInputTool,\n  type SourceRow,\n  type ToolRow,\n  type DefinitionRow,\n  type SecretRow,\n  type ConnectionRow,\n  type CredentialBindingRow,\n  type ToolPolicyRow,\n  type ToolPolicyAction,\n  type DefinitionsInput,\n  type ToolAnnotations,\n} from \"./core-schema\";\n\n// Tool policies\nexport {\n  matchPattern,\n  isValidPattern,\n  resolveToolPolicy,\n  resolveEffectivePolicy,\n  effectivePolicyFromSorted,\n  rowToToolPolicy,\n  ToolPolicyActionSchema,\n  type ToolPolicy,\n  type CreateToolPolicyInput,\n  type UpdateToolPolicyInput,\n  type RemoveToolPolicyInput,\n  type PolicyMatch,\n  type EffectivePolicy,\n  type PolicySource,\n} from \"./policies\";\n\n// Secrets\nexport { SecretRef, SetSecretInput, RemoveSecretInput, type SecretProvider } from \"./secrets\";\n\nexport {\n  SecretBackedMap,\n  SecretBackedValue,\n  isSecretBackedRef,\n  resolveSecretBackedMap,\n  type ResolveSecretBackedMapOptions,\n} from \"./secret-backed-value\";\n\nexport {\n  CredentialBindingKind,\n  CredentialBindingValue,\n  ConfiguredCredentialBinding,\n  ConfiguredCredentialValue,\n  ScopedSecretCredentialInput,\n  CredentialBindingRef,\n  SetCredentialBindingInput,\n  CredentialBindingSourceInput,\n  CredentialBindingSlotInput,\n  RemoveCredentialBindingInput,\n  ReplaceCredentialBindingValue,\n  ReplaceCredentialBindingsInput,\n  CredentialBindingResolutionStatus,\n  ResolvedCredentialSlot,\n  credentialBindingId,\n  credentialSlotKey,\n  credentialSlotPart,\n  credentialBindingRowToRef,\n  credentialBindingValueFromRow,\n  type CredentialBindingsFacade,\n} from \"./credential-bindings\";\n\n// Usage tracking — secret/connection refs across plugins\nexport { Usage, type UsagesForSecretInput, type UsagesForConnectionInput } from \"./usages\";\n\n// Connections\nexport {\n  ConnectionRef,\n  ConnectionProviderState,\n  CreateConnectionInput,\n  RemoveConnectionInput,\n  UpdateConnectionTokensInput,\n  TokenMaterial,\n  ConnectionRefreshError,\n  type ConnectionProvider,\n  type ConnectionRefreshInput,\n  type ConnectionRefreshResult,\n} from \"./connections\";\n\n// Elicitation\nexport {\n  FormElicitation,\n  UrlElicitation,\n  ElicitationAction,\n  ElicitationResponse,\n  ElicitationDeclinedError,\n  type ElicitationRequest,\n  type ElicitationHandler,\n  type ElicitationContext,\n} from \"./elicitation\";\n\n// Blob store\nexport {\n  type BlobStore,\n  type PluginBlobStore,\n  pluginBlobStore,\n  makeInMemoryBlobStore,\n} from \"./blob\";\n\n// OAuth 2.1\nexport {\n  type OAuthService,\n  type OAuthStrategy,\n  type OAuthDynamicDcrStrategy,\n  type OAuthAuthorizationCodeStrategy,\n  type OAuthClientCredentialsStrategy,\n  type OAuthProviderState,\n  type OAuthProbeInput,\n  type OAuthProbeResult,\n  type OAuthStartInput,\n  type OAuthStartResult,\n  type OAuthCompleteInput,\n  type OAuthCompleteResult,\n  OAuthProbeError,\n  OAuthStartError,\n  OAuthCompleteError,\n  OAuthSessionNotFoundError,\n  OAUTH2_PROVIDER_KEY,\n  OAUTH2_SESSION_TTL_MS,\n  OAuthStrategy as OAuthStrategySchema,\n  OAuthProviderState as OAuthProviderStateSchema,\n  OAuthDynamicDcrStrategy as OAuthDynamicDcrStrategySchema,\n  OAuthAuthorizationCodeStrategy as OAuthAuthorizationCodeStrategySchema,\n  OAuthClientCredentialsStrategy as OAuthClientCredentialsStrategySchema,\n} from \"./oauth\";\n\nexport {\n  OAuth2Error,\n  OAUTH2_DEFAULT_TIMEOUT_MS,\n  OAUTH2_REFRESH_SKEW_MS,\n  assertSupportedOAuthEndpointUrl,\n  buildAuthorizationUrl,\n  createPkceCodeChallenge,\n  createPkceCodeVerifier,\n  exchangeAuthorizationCode,\n  exchangeClientCredentials,\n  isSupportedOAuthEndpointUrl,\n  refreshAccessToken,\n  shouldRefreshToken,\n  type OAuth2TokenResponse,\n  type BuildAuthorizationUrlInput,\n  type ClientAuthMethod,\n  type ExchangeAuthorizationCodeInput,\n  type ExchangeClientCredentialsInput,\n  type RefreshAccessTokenInput,\n} from \"./oauth-helpers\";\n\nexport { makeOAuth2Service, type OAuthServiceDeps } from \"./oauth-service\";\nexport type { ScopedDBAdapter, ScopedTypedAdapter } from \"./scoped-adapter\";\n\nexport {\n  HostedOutboundRequestBlocked,\n  makeHostedHttpClientLayer,\n  validateHostedOutboundUrl,\n  type HostedHttpClientOptions,\n} from \"./hosted-http-client\";\n\nexport {\n  OAuthDiscoveryError,\n  OAuthAuthorizationServerMetadataSchema,\n  OAuthClientInformationSchema,\n  OAuthProtectedResourceMetadataSchema,\n  beginDynamicAuthorization,\n  discoverAuthorizationServerMetadata,\n  discoverProtectedResourceMetadata,\n  registerDynamicClient,\n  type BeginDynamicAuthorizationInput,\n  type DiscoveryRequestOptions,\n  type DynamicAuthorizationState,\n  type DynamicAuthorizationStartResult,\n  type DynamicClientMetadata,\n  type OAuthAuthorizationServerMetadata,\n  type OAuthClientInformation,\n  type OAuthProtectedResourceMetadata,\n  type RegisterDynamicClientInput,\n} from \"./oauth-discovery\";\n\nexport {\n  OAUTH_POPUP_MESSAGE_TYPE,\n  type OAuthPopupResult,\n  isOAuthPopupResult,\n} from \"./oauth-popup-types\";\n\n// Plugin definition\nexport {\n  type Plugin,\n  type PluginSpec,\n  type PluginCtx,\n  type PluginExtensions,\n  type ConfiguredPlugin,\n  type AnyPlugin,\n  type StorageDeps,\n  type StaticSourceDecl,\n  type StaticToolDecl,\n  type StaticToolExecuteContext,\n  type StaticToolHandlerInput,\n  type StaticToolInput,\n  type InvokeToolInput,\n  type SourceLifecycleInput,\n  type SecretListEntry,\n  type Elicit,\n  definePlugin,\n  defineSchema,\n  tool,\n} from \"./plugin\";\n\n// Executor\nexport {\n  type Executor,\n  type ExecutorConfig,\n  type OnElicitation,\n  type InvokeOptions,\n  createExecutor,\n  collectSchemas,\n} from \"./executor\";\n\n// CLI / runtime config\nexport {\n  defineExecutorConfig,\n  type ExecutorCliConfig,\n  type ExecutorDialect,\n  type ExecutorPluginsFactory,\n} from \"./config\";\n\n// Test helper\nexport { makeTestConfig } from \"./test-config\";\n\n// JSON schema $ref helpers (used by openapi for $defs handling)\nexport { hoistDefinitions, collectRefs, reattachDefs, normalizeRefs } from \"./schema-refs\";\n\n// TypeScript preview generation from JSON schemas\nexport {\n  schemaToTypeScriptPreview,\n  schemaToTypeScriptPreviewWithDefs,\n  buildToolTypeScriptPreview,\n  type TypeScriptRenderOptions,\n  type TypeScriptSchemaPreview,\n} from \"./schema-types\";\n\n// Wire-level HTTP error schemas usable by plugin HttpApiGroup definitions.\nexport { InternalError } from \"./api-errors\";\n","// ---------------------------------------------------------------------------\n// OAuth popup result — the message shape exchanged between the popup window\n// (opened during authorization) and the opener (the onboarding UI). Both the\n// server-side HTML generator and the client-side popup opener agree on this\n// shape so that success / failure can be communicated reliably via both\n// `postMessage` and `BroadcastChannel`.\n// ---------------------------------------------------------------------------\n\n/** Message type literal used to identify our popup results. */\nexport const OAUTH_POPUP_MESSAGE_TYPE = \"executor:oauth-result\" as const;\n\nexport type OAuthPopupResult<TAuth> =\n  | ({\n      readonly type: typeof OAUTH_POPUP_MESSAGE_TYPE;\n      readonly ok: true;\n      readonly sessionId: string;\n    } & TAuth)\n  | {\n      readonly type: typeof OAUTH_POPUP_MESSAGE_TYPE;\n      readonly ok: false;\n      readonly sessionId: string | null;\n      /** Short user-facing summary. */\n      readonly error: string;\n      /** Full technical detail. Omitted when identical to `error`. */\n      readonly errorDetails?: string;\n    };\n\nexport const isOAuthPopupResult = <TAuth>(value: unknown): value is OAuthPopupResult<TAuth> =>\n  typeof value === \"object\" &&\n  value !== null &&\n  (value as { type?: unknown }).type === OAUTH_POPUP_MESSAGE_TYPE;\n","// ---------------------------------------------------------------------------\n// JSON Schema $ref hoisting and re-attachment\n//\n// Core logic for deduplicating shared definitions across tools.\n// Used by any ToolRegistry implementation (in-memory, database-backed, etc.)\n//\n// Only handles standard JSON Schema formats ($defs, definitions).\n// Plugin-specific formats (e.g. OpenAPI components/schemas) must be\n// normalized by the plugin before calling registerDefinitions/register.\n// ---------------------------------------------------------------------------\n\ntype Obj = Record<string, unknown>;\n\n/** Standard JSON Schema $ref patterns. */\nconst REF_PATTERN = /^#\\/(?:\\$defs|definitions)\\/(.+)$/;\n\n/** Extract the definition name from a standard $ref pointer. */\nconst parseRefName = (ref: string): string | undefined => ref.match(REF_PATTERN)?.[1];\n\n/**\n * Recursively rewrite `#/definitions/<name>` pointers to `#/$defs/<name>`.\n * Returns the input unchanged if no rewrites are needed.\n */\nexport const normalizeRefs = (node: unknown): unknown => {\n  if (node == null || typeof node !== \"object\") return node;\n  if (Array.isArray(node)) {\n    let changed = false;\n    const out = node.map((item) => {\n      const n = normalizeRefs(item);\n      if (n !== item) changed = true;\n      return n;\n    });\n    return changed ? out : node;\n  }\n\n  const obj = node as Obj;\n\n  if (typeof obj.$ref === \"string\") {\n    const name = parseRefName(obj.$ref);\n    if (name) {\n      const canonical = `#/$defs/${name}`;\n      return canonical !== obj.$ref ? { ...obj, $ref: canonical } : obj;\n    }\n    return obj;\n  }\n\n  let changed = false;\n  const result: Obj = {};\n  for (const [k, v] of Object.entries(obj)) {\n    const n = normalizeRefs(v);\n    if (n !== v) changed = true;\n    result[k] = n;\n  }\n  return changed ? result : obj;\n};\n\n/**\n * Extract `$defs` and `definitions` from a JSON Schema,\n * returning { stripped, defs } where `stripped` is the schema without local\n * definitions and `defs` is a flat map of definition name → schema.\n */\nexport const hoistDefinitions = (\n  schema: unknown,\n): { stripped: unknown; defs: Record<string, unknown> } => {\n  if (schema == null || typeof schema !== \"object\") {\n    return { stripped: schema, defs: {} };\n  }\n  const obj = schema as Obj;\n  const defs: Record<string, unknown> = {};\n\n  if (obj.$defs && typeof obj.$defs === \"object\") {\n    for (const [k, v] of Object.entries(obj.$defs as Obj)) {\n      defs[k] = v;\n    }\n  }\n\n  if (obj.definitions && typeof obj.definitions === \"object\") {\n    for (const [k, v] of Object.entries(obj.definitions as Obj)) {\n      defs[k] = v;\n    }\n  }\n\n  const { $defs: _a, definitions: _b, ...rest } = obj;\n  return { stripped: rest, defs };\n};\n\n/**\n * Walk a schema and collect all $ref target names transitively.\n * e.g. \"#/$defs/Address\" → \"Address\", and if Address references City, both.\n */\nexport const collectRefs = (\n  node: unknown,\n  defs: ReadonlyMap<string, unknown>,\n  found: Set<string> = new Set(),\n): Set<string> => {\n  if (node == null || typeof node !== \"object\") return found;\n  const obj = node as Obj;\n\n  if (typeof obj.$ref === \"string\") {\n    const name = parseRefName(obj.$ref);\n    if (name && !found.has(name)) {\n      found.add(name);\n      const def = defs.get(name);\n      if (def) collectRefs(def, defs, found);\n    }\n    return found;\n  }\n\n  for (const v of Object.values(obj)) {\n    if (v && typeof v === \"object\") {\n      if (Array.isArray(v)) {\n        for (const item of v) collectRefs(item, defs, found);\n      } else {\n        collectRefs(v, defs, found);\n      }\n    }\n  }\n  return found;\n};\n\n/**\n * Re-attach only the referenced shared definitions into a schema,\n * so the caller gets a self-contained, usable JSON Schema.\n *\n * Assumes all `$ref` pointers and definitions have already been normalized\n * to `#/$defs/<name>` form at registration time.\n */\nexport const reattachDefs = (schema: unknown, defs: ReadonlyMap<string, unknown>): unknown => {\n  if (schema == null || typeof schema !== \"object\") return schema;\n  const refs = collectRefs(schema, defs);\n  if (refs.size === 0) return schema;\n\n  const attached: Record<string, unknown> = {};\n  for (const name of refs) {\n    const def = defs.get(name);\n    if (def) attached[name] = def;\n  }\n\n  return { ...(schema as Record<string, unknown>), $defs: attached };\n};\n","// ---------------------------------------------------------------------------\n// Wire-level HTTP errors. Lives in the SDK so plugin `HttpApiGroup`\n// definitions (which sit on the SDK side of the dependency graph and\n// must stay publishable) can declare them without dragging in the\n// server-only `@executor-js/api` package. The HTTP edge in\n// `@executor-js/api` re-exports these and pairs them with the\n// translation/capture helpers used by handlers.\n// ---------------------------------------------------------------------------\n\nimport { Schema } from \"effect\";\n\n/** Public 500 surface. Opaque by schema — only `traceId` crosses the wire. */\nexport class InternalError extends Schema.TaggedErrorClass<InternalError>()(\n  \"InternalError\",\n  {\n    /** Opaque correlation id for backend lookup (Sentry event id, log line, etc.). */\n    traceId: Schema.String,\n  },\n  { httpApiStatus: 500 },\n) {}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,SAAS,SAAS,QAAQ,OAAO,UAAAA,SAAQ,MAAM,cAAc;AAC7D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAgBP,SAAS,oBAAoB;AAI7B,SAAS,cAAc,4BAA4B;;;AC5B5C,IAAM,2BAA2B;AAkBjC,IAAM,qBAAqB,CAAQ,UACxC,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAS;;;AChBzC,IAAM,cAAc;AAGpB,IAAM,eAAe,CAAC,QAAoC,IAAI,MAAM,WAAW,IAAI,CAAC;AAM7E,IAAM,gBAAgB,CAAC,SAA2B;AACvD,MAAI,QAAQ,QAAQ,OAAO,SAAS,SAAU,QAAO;AACrD,MAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,QAAIC,WAAU;AACd,UAAM,MAAM,KAAK,IAAI,CAAC,SAAS;AAC7B,YAAM,IAAI,cAAc,IAAI;AAC5B,UAAI,MAAM,KAAM,CAAAA,WAAU;AAC1B,aAAO;AAAA,IACT,CAAC;AACD,WAAOA,WAAU,MAAM;AAAA,EACzB;AAEA,QAAM,MAAM;AAEZ,MAAI,OAAO,IAAI,SAAS,UAAU;AAChC,UAAM,OAAO,aAAa,IAAI,IAAI;AAClC,QAAI,MAAM;AACR,YAAM,YAAY,WAAW,IAAI;AACjC,aAAO,cAAc,IAAI,OAAO,EAAE,GAAG,KAAK,MAAM,UAAU,IAAI;AAAA,IAChE;AACA,WAAO;AAAA,EACT;AAEA,MAAI,UAAU;AACd,QAAM,SAAc,CAAC;AACrB,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AACxC,UAAM,IAAI,cAAc,CAAC;AACzB,QAAI,MAAM,EAAG,WAAU;AACvB,WAAO,CAAC,IAAI;AAAA,EACd;AACA,SAAO,UAAU,SAAS;AAC5B;AAOO,IAAM,mBAAmB,CAC9B,WACyD;AACzD,MAAI,UAAU,QAAQ,OAAO,WAAW,UAAU;AAChD,WAAO,EAAE,UAAU,QAAQ,MAAM,CAAC,EAAE;AAAA,EACtC;AACA,QAAM,MAAM;AACZ,QAAM,OAAgC,CAAC;AAEvC,MAAI,IAAI,SAAS,OAAO,IAAI,UAAU,UAAU;AAC9C,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,KAAY,GAAG;AACrD,WAAK,CAAC,IAAI;AAAA,IACZ;AAAA,EACF;AAEA,MAAI,IAAI,eAAe,OAAO,IAAI,gBAAgB,UAAU;AAC1D,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,WAAkB,GAAG;AAC3D,WAAK,CAAC,IAAI;AAAA,IACZ;AAAA,EACF;AAEA,QAAM,EAAE,OAAO,IAAI,aAAa,IAAI,GAAG,KAAK,IAAI;AAChD,SAAO,EAAE,UAAU,MAAM,KAAK;AAChC;AAMO,IAAM,cAAc,CACzB,MACA,MACA,QAAqB,oBAAI,IAAI,MACb;AAChB,MAAI,QAAQ,QAAQ,OAAO,SAAS,SAAU,QAAO;AACrD,QAAM,MAAM;AAEZ,MAAI,OAAO,IAAI,SAAS,UAAU;AAChC,UAAM,OAAO,aAAa,IAAI,IAAI;AAClC,QAAI,QAAQ,CAAC,MAAM,IAAI,IAAI,GAAG;AAC5B,YAAM,IAAI,IAAI;AACd,YAAM,MAAM,KAAK,IAAI,IAAI;AACzB,UAAI,IAAK,aAAY,KAAK,MAAM,KAAK;AAAA,IACvC;AACA,WAAO;AAAA,EACT;AAEA,aAAW,KAAK,OAAO,OAAO,GAAG,GAAG;AAClC,QAAI,KAAK,OAAO,MAAM,UAAU;AAC9B,UAAI,MAAM,QAAQ,CAAC,GAAG;AACpB,mBAAW,QAAQ,EAAG,aAAY,MAAM,MAAM,KAAK;AAAA,MACrD,OAAO;AACL,oBAAY,GAAG,MAAM,KAAK;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AASO,IAAM,eAAe,CAAC,QAAiB,SAAgD;AAC5F,MAAI,UAAU,QAAQ,OAAO,WAAW,SAAU,QAAO;AACzD,QAAM,OAAO,YAAY,QAAQ,IAAI;AACrC,MAAI,KAAK,SAAS,EAAG,QAAO;AAE5B,QAAM,WAAoC,CAAC;AAC3C,aAAW,QAAQ,MAAM;AACvB,UAAM,MAAM,KAAK,IAAI,IAAI;AACzB,QAAI,IAAK,UAAS,IAAI,IAAI;AAAA,EAC5B;AAEA,SAAO,EAAE,GAAI,QAAoC,OAAO,SAAS;AACnE;;;AClIA,SAAS,cAAc;AAGhB,IAAM,gBAAN,cAA4B,OAAO,iBAAgC;AAAA,EACxE;AAAA,EACA;AAAA;AAAA,IAEE,SAAS,OAAO;AAAA,EAClB;AAAA,EACA,EAAE,eAAe,IAAI;AACvB,EAAE;AAAC;","names":["Schema","changed"]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// @executor-js/sdk — public surface\n// ---------------------------------------------------------------------------\n\n// Re-export the Effect/Schema/HttpApi primitives plugin authors need so a\n// plugin can be written importing only from `@executor-js/sdk`. Authors who\n// want to reach for additional Effect APIs keep importing from `effect/*`\n// directly — these re-exports are the curated minimum.\nexport { Context, Effect, Layer, Schema, Data, Option } from \"effect\";\nexport {\n  HttpApi,\n  HttpApiBuilder,\n  HttpApiClient,\n  HttpApiEndpoint,\n  HttpApiGroup,\n  HttpApiMiddleware,\n  HttpApiSchema,\n} from \"effect/unstable/httpapi\";\n\n// FumaDB integration.\nexport { fumadb } from \"fumadb\";\nexport type { FumaDB } from \"fumadb\";\nexport type { AbstractQuery, Condition, ConditionBuilder } from \"fumadb/query\";\nexport { column, idColumn, schema as fumaSchema, table } from \"fumadb/schema\";\nexport type { AnyColumn, AnySchema, AnyTable, Column, Schema as FumaSchema } from \"fumadb/schema\";\n\nexport type {\n  FumaDb,\n  FumaQuery,\n  FumaRow,\n  FumaTables,\n  IFumaClient,\n  StorageFailure,\n} from \"./fuma-runtime\";\nexport { StorageError, UniqueViolationError, isStorageFailure } from \"./fuma-runtime\";\n\n// Storage-layer typed errors are still exported so plugin code can catchTag\n// `UniqueViolationError`, but FumaDB itself is the storage API.\n\n// IDs (branded)\nexport { ScopeId, ToolId, SecretId, PolicyId, ConnectionId, CredentialBindingId } from \"./ids\";\n\n// Scope\nexport { Scope, defaultSourceInstallScopeId } from \"./scope\";\n\n// Errors (tagged)\nexport {\n  ToolNotFoundError,\n  ToolInvocationError,\n  ToolBlockedError,\n  NoHandlerError,\n  SourceNotFoundError,\n  SourceRemovalNotAllowedError,\n  PluginNotLoadedError,\n  SecretNotFoundError,\n  SecretResolutionError,\n  SecretOwnedByConnectionError,\n  SecretInUseError,\n  ConnectionNotFoundError,\n  ConnectionProviderNotRegisteredError,\n  ConnectionRefreshNotSupportedError,\n  ConnectionReauthRequiredError,\n  ConnectionInUseError,\n  type ExecutorError,\n} from \"./errors\";\n\n// Public projections\nexport {\n  ToolSchema,\n  SourceDetectionResult,\n  type RefreshSourceInput,\n  type RemoveSourceInput,\n  type Source,\n  type Tool,\n  type ToolListFilter,\n} from \"./types\";\n\n// Core schema\nexport {\n  bigintColumn,\n  boolColumn,\n  coreSchema,\n  dateColumn,\n  isToolPolicyAction,\n  jsonColumn,\n  nullableBigintColumn,\n  nullableJsonColumn,\n  nullableTextColumn,\n  scopedExecutorTable,\n  textColumn,\n  TOOL_POLICY_ACTIONS,\n  type CoreSchema,\n  type SourceInput,\n  type SourceInputTool,\n  type SourceRow,\n  type ToolRow,\n  type DefinitionRow,\n  type SecretRow,\n  type ConnectionRow,\n  type PluginStorageRow,\n  type CredentialBindingRow,\n  type ToolPolicyRow,\n  type ToolPolicyAction,\n  type DefinitionsInput,\n  type ToolAnnotations,\n} from \"./core-schema\";\n\n// Tool policies\nexport {\n  matchPattern,\n  isValidPattern,\n  resolveToolPolicy,\n  resolveEffectivePolicy,\n  effectivePolicyFromSorted,\n  rowToToolPolicy,\n  ToolPolicyActionSchema,\n  type ToolPolicy,\n  type CreateToolPolicyInput,\n  type UpdateToolPolicyInput,\n  type RemoveToolPolicyInput,\n  type PolicyMatch,\n  type EffectivePolicy,\n  type PolicySource,\n} from \"./policies\";\n\n// Secrets\nexport { SecretRef, SetSecretInput, RemoveSecretInput, type SecretProvider } from \"./secrets\";\n\nexport {\n  SecretBackedMap,\n  SecretBackedValue,\n  isSecretBackedRef,\n  resolveSecretBackedMap,\n  type ResolveSecretBackedMapOptions,\n} from \"./secret-backed-value\";\n\nexport {\n  CredentialBindingKind,\n  CredentialBindingValue,\n  ConfiguredCredentialBinding,\n  ConfiguredCredentialValue,\n  ScopedSecretCredentialInput,\n  CredentialBindingRef,\n  CredentialBindingSlotInput,\n  RemoveCredentialBindingInput,\n  RemoveSourceCredentialBindingInput,\n  ReplaceCredentialBindingValue,\n  ReplaceCredentialBindingsInput,\n  ReplaceSourceCredentialBindingsInput,\n  CredentialBindingResolutionStatus,\n  ResolvedCredentialSlot,\n  SetSourceCredentialBindingInput,\n  SourceCredentialBindingSource,\n  SourceCredentialBindingSourceInput,\n  SourceCredentialBindingSlotInput,\n  credentialBindingId,\n  credentialSlotKey,\n  credentialSlotPart,\n  credentialBindingRowToRef,\n  credentialBindingValueFromRow,\n  type CredentialBindingsFacade,\n} from \"./credential-bindings\";\n\n// Usage tracking — secret/connection refs across plugins\nexport { Usage, type UsagesForSecretInput, type UsagesForConnectionInput } from \"./usages\";\n\n// Connections\nexport {\n  ConnectionRef,\n  ConnectionProviderState,\n  CreateConnectionInput,\n  RemoveConnectionInput,\n  UpdateConnectionTokensInput,\n  TokenMaterial,\n  ConnectionRefreshError,\n  type ConnectionProvider,\n  type ConnectionRefreshInput,\n  type ConnectionRefreshResult,\n} from \"./connections\";\n\n// Elicitation\nexport {\n  FormElicitation,\n  UrlElicitation,\n  ElicitationAction,\n  ElicitationResponse,\n  ElicitationDeclinedError,\n  type ElicitationRequest,\n  type ElicitationHandler,\n  type ElicitationContext,\n} from \"./elicitation\";\n\n// Blob store\nexport {\n  type BlobStore,\n  type PluginBlobStore,\n  pluginBlobStore,\n  makeFumaBlobStore,\n  makeInMemoryBlobStore,\n} from \"./blob\";\n\n// OAuth 2.1\nexport {\n  type OAuthService,\n  type OAuthStrategy,\n  type OAuthDynamicDcrStrategy,\n  type OAuthAuthorizationCodeStrategy,\n  type OAuthClientCredentialsStrategy,\n  type OAuthProviderState,\n  type OAuthProbeInput,\n  type OAuthProbeResult,\n  type OAuthStartInput,\n  type OAuthStartResult,\n  type OAuthCompleteInput,\n  type OAuthCompleteResult,\n  OAuthProbeError,\n  OAuthStartError,\n  OAuthCompleteError,\n  OAuthSessionNotFoundError,\n  OAUTH2_PROVIDER_KEY,\n  OAUTH2_SESSION_TTL_MS,\n  OAuthStrategy as OAuthStrategySchema,\n  OAuthProviderState as OAuthProviderStateSchema,\n  OAuthDynamicDcrStrategy as OAuthDynamicDcrStrategySchema,\n  OAuthAuthorizationCodeStrategy as OAuthAuthorizationCodeStrategySchema,\n  OAuthClientCredentialsStrategy as OAuthClientCredentialsStrategySchema,\n} from \"./oauth\";\n\nexport {\n  OAuth2Error,\n  OAUTH2_DEFAULT_TIMEOUT_MS,\n  OAUTH2_REFRESH_SKEW_MS,\n  assertSupportedOAuthEndpointUrl,\n  buildAuthorizationUrl,\n  createPkceCodeChallenge,\n  createPkceCodeVerifier,\n  exchangeAuthorizationCode,\n  exchangeClientCredentials,\n  isSupportedOAuthEndpointUrl,\n  refreshAccessToken,\n  shouldRefreshToken,\n  type OAuth2TokenResponse,\n  type BuildAuthorizationUrlInput,\n  type ClientAuthMethod,\n  type ExchangeAuthorizationCodeInput,\n  type ExchangeClientCredentialsInput,\n  type RefreshAccessTokenInput,\n} from \"./oauth-helpers\";\n\nexport { makeOAuth2Service, type OAuthServiceDeps } from \"./oauth-service\";\n\nexport {\n  HostedOutboundRequestBlocked,\n  makeHostedHttpClientLayer,\n  validateHostedOutboundUrl,\n  type HostedHttpClientOptions,\n} from \"./hosted-http-client\";\n\nexport {\n  OAuthDiscoveryError,\n  OAuthAuthorizationServerMetadataSchema,\n  OAuthClientInformationSchema,\n  OAuthProtectedResourceMetadataSchema,\n  beginDynamicAuthorization,\n  discoverAuthorizationServerMetadata,\n  discoverProtectedResourceMetadata,\n  registerDynamicClient,\n  type BeginDynamicAuthorizationInput,\n  type DiscoveryRequestOptions,\n  type DynamicAuthorizationState,\n  type DynamicAuthorizationStartResult,\n  type DynamicClientMetadata,\n  type OAuthAuthorizationServerMetadata,\n  type OAuthClientInformation,\n  type OAuthProtectedResourceMetadata,\n  type RegisterDynamicClientInput,\n} from \"./oauth-discovery\";\n\nexport {\n  OAUTH_POPUP_MESSAGE_TYPE,\n  type OAuthPopupResult,\n  isOAuthPopupResult,\n} from \"./oauth-popup-types\";\n\n// Plugin definition\nexport {\n  type Plugin,\n  type PluginSpec,\n  type PluginCtx,\n  type PluginExtensions,\n  type ConfiguredPlugin,\n  type AnyPlugin,\n  type StorageDeps,\n  type StaticSourceDecl,\n  type StaticToolDecl,\n  type StaticToolSchema,\n  type StaticToolExecuteContext,\n  type StaticToolHandlerInput,\n  type StaticToolInput,\n  type ConfigureSourceHandlerInput,\n  type InvokeToolInput,\n  type SourceLifecycleInput,\n  type SourceConfigureDecl,\n  type SecretListEntry,\n  type Elicit,\n  definePlugin,\n  tool,\n} from \"./plugin\";\nexport {\n  pluginStorageId,\n  type PluginStorageEntry,\n  type PluginStorageFacade,\n  type PluginStorageKeyInput,\n  type PluginStorageListInput,\n  type PluginStoragePutInput,\n  type PluginStorageScopedKeyInput,\n} from \"./plugin-storage\";\n\n// Executor\nexport {\n  type Executor,\n  type ExecutorConfig,\n  type ExecutorDb,\n  type ExecutorDbFactory,\n  type ExecutorDbInput,\n  type OnElicitation,\n  type InvokeOptions,\n  createExecutor,\n  collectTables,\n} from \"./executor\";\n\n// Built-in core-tools plugin (scopes.list, secrets.list, secrets.create\n// with URL elicitation). Auto-registered by createExecutor when\n// `coreTools` is set on the config; also exportable for callers who\n// want to register it manually.\nexport { coreToolsPlugin, type CoreToolsPluginOptions } from \"./core-tools\";\n\n// CLI / runtime config\nexport {\n  defineExecutorConfig,\n  type ExecutorCliConfig,\n  type ExecutorPluginsFactory,\n} from \"./config\";\n\n// JSON schema $ref helpers (used by openapi for $defs handling)\nexport { hoistDefinitions, collectRefs, reattachDefs, normalizeRefs } from \"./schema-refs\";\n\n// TypeScript preview generation from JSON schemas\nexport {\n  schemaToTypeScriptPreview,\n  schemaToTypeScriptPreviewWithDefs,\n  buildToolTypeScriptPreview,\n  type TypeScriptRenderOptions,\n  type TypeScriptSchemaPreview,\n} from \"./schema-types\";\n\n// Wire-level HTTP error schemas usable by plugin HttpApiGroup definitions.\nexport { InternalError } from \"./api-errors\";\n\n// ToolResult — typed value-based discriminated union for tool outcomes.\n// The `Tool` value namespace exposes `Tool.ok` / `Tool.fail` constructors;\n// the `Tool` type alias from `./types` is a separate row projection.\n// TypeScript permits the two to share a name because one is purely a\n// value and the other purely a type.\nexport { ToolResult, isToolResult, type ToolError } from \"./tool-result\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,SAAS,SAAS,QAAQ,OAAO,QAAQ,MAAM,cAAc;AAC7D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,cAAc;AAGvB,SAAS,QAAQ,UAAoB,QAAY,aAAa;","names":[]}