@rafads/config 1.5.38

package/dist/config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=config.test.d.ts.map

package/dist/config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.test.d.ts","sourceRoot":"","sources":["../src/config.test.ts"],"names":[],"mappings":""}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { ExecutorFileConfig, PluginConfig, IntegrationConfig, OpenApiIntegrationConfig, GraphqlIntegrationConfig, McpRemoteIntegrationConfig, McpStdioIntegrationConfig, McpAuthConfig, SecretMetadata, ConfigHeaderValue, SECRET_REF_PREFIX, } from "./schema";
+export { loadConfig, ConfigParseError } from "./load";
+export { loadPluginsFromJsonc } from "./load-plugins";
+export type { LoadPluginsFromJsoncOptions } from "./load-plugins";
+export { addIntegrationToConfig, removeIntegrationFromConfig, writeConfig, addSecretToConfig, removeSecretFromConfig, } from "./write";
+export type { ConfigFileSink, ConfigFileSinkOptions } from "./sink";
+export { makeFileConfigSink, headerToConfigValue, headersToConfigValues } from "./sink";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,YAAY,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAElE,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,WAAW,EACX,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,SAAS,CAAC;AAEjB,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC"}

package/dist/index.js

@@ -0,0 +1,368 @@
+// src/schema.ts
+import { Schema } from "effect";
+var SECRET_REF_PREFIX = "secret-public-ref:";
+var ConfigHeaderValue = Schema.Union([
+  Schema.String,
+  Schema.Struct({
+    value: Schema.String,
+    prefix: Schema.optional(Schema.String)
+  })
+]);
+var ConfigHeaders = Schema.Record(Schema.String, ConfigHeaderValue);
+var OpenApiIntegrationConfig = Schema.Struct({
+  kind: Schema.Literal("openapi"),
+  spec: Schema.String,
+  baseUrl: Schema.optional(Schema.String),
+  namespace: Schema.optional(Schema.String),
+  headers: Schema.optional(ConfigHeaders)
+});
+var GraphqlIntegrationConfig = Schema.Struct({
+  kind: Schema.Literal("graphql"),
+  endpoint: Schema.String,
+  introspectionJson: Schema.optional(Schema.NullOr(Schema.String)),
+  namespace: Schema.optional(Schema.String),
+  headers: Schema.optional(ConfigHeaders)
+});
+var StringMap = Schema.Record(Schema.String, Schema.String);
+var McpAuthConfig = Schema.Union([
+  Schema.Struct({ kind: Schema.Literal("none") }),
+  Schema.Struct({
+    kind: Schema.Literal("header"),
+    headerName: Schema.String,
+    secret: Schema.String,
+    prefix: Schema.optional(Schema.String)
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("oauth2"),
+    /** Stable id of the SDK Connection holding access + refresh token
+     *  material. The connection names its owner explicitly (org or user),
+     *  so the id resolves to exactly one connection — no scope stack, no
+     *  per-user shadowing. Core resolves its value (refreshing oauth
+     *  tokens) at execute time via the connection's provider. */
+    connectionId: Schema.String
+  })
+]);
+var McpRemoteIntegrationConfig = Schema.Struct({
+  kind: Schema.Literal("mcp"),
+  transport: Schema.Literal("remote"),
+  name: Schema.String,
+  endpoint: Schema.String,
+  remoteTransport: Schema.optional(Schema.Literals(["streamable-http", "sse", "auto"])),
+  namespace: Schema.optional(Schema.String),
+  queryParams: Schema.optional(ConfigHeaders),
+  headers: Schema.optional(ConfigHeaders),
+  auth: Schema.optional(McpAuthConfig)
+});
+var McpStdioIntegrationConfig = Schema.Struct({
+  kind: Schema.Literal("mcp"),
+  transport: Schema.Literal("stdio"),
+  name: Schema.String,
+  command: Schema.String,
+  args: Schema.optional(Schema.Array(Schema.String)),
+  env: Schema.optional(StringMap),
+  cwd: Schema.optional(Schema.String),
+  namespace: Schema.optional(Schema.String)
+});
+var IntegrationConfig = Schema.Union([
+  OpenApiIntegrationConfig,
+  GraphqlIntegrationConfig,
+  McpRemoteIntegrationConfig,
+  McpStdioIntegrationConfig
+]);
+var SecretMetadata = Schema.Struct({
+  name: Schema.String,
+  provider: Schema.optional(Schema.String),
+  purpose: Schema.optional(Schema.String)
+});
+var PluginConfig = Schema.Struct({
+  package: Schema.String,
+  options: Schema.optional(Schema.Record(Schema.String, Schema.Unknown))
+});
+var ExecutorFileConfig = Schema.Struct({
+  $schema: Schema.optional(Schema.String),
+  name: Schema.optional(Schema.String),
+  plugins: Schema.optional(Schema.Array(PluginConfig)),
+  integrations: Schema.optional(Schema.Array(IntegrationConfig)),
+  secrets: Schema.optional(Schema.Record(Schema.String, SecretMetadata))
+});
+
+// src/load.ts
+import { Effect, Schema as Schema2 } from "effect";
+import { FileSystem } from "effect";
+import * as jsonc from "jsonc-parser";
+var ConfigParseError = class extends Schema2.TaggedErrorClass()(
+  "ConfigParseError",
+  {
+    path: Schema2.String,
+    message: Schema2.String
+  }
+) {
+};
+var loadConfig = (path) => Effect.gen(function* () {
+  const fs2 = yield* FileSystem.FileSystem;
+  const exists = yield* fs2.exists(path);
+  if (!exists) return null;
+  const raw = yield* fs2.readFileString(path);
+  const errors = [];
+  const parsed = jsonc.parse(raw, errors);
+  if (errors.length > 0) {
+    const msg = errors.map((e) => `offset ${e.offset}: ${jsonc.printParseErrorCode(e.error)}`).join("; ");
+    return yield* new ConfigParseError({ path, message: msg });
+  }
+  const decoded = yield* Schema2.decodeUnknownEffect(ExecutorFileConfig)(parsed).pipe(
+    Effect.mapError(
+      (error) => new ConfigParseError({
+        path,
+        message: error.issue.toString()
+      })
+    )
+  );
+  return decoded;
+});
+
+// src/load-plugins.ts
+import { createRequire } from "module";
+import { dirname, isAbsolute, resolve as resolvePath } from "path";
+import { pathToFileURL } from "url";
+import * as fs from "fs";
+import * as jsonc2 from "jsonc-parser";
+import { Effect as Effect2, Schema as Schema3 } from "effect";
+var LoadPluginsError = class extends Schema3.TaggedErrorClass()(
+  "LoadPluginsError",
+  {
+    message: Schema3.String,
+    cause: Schema3.optional(Schema3.Unknown)
+  }
+) {
+};
+var loadPluginsFromJsonc = async (options) => Effect2.runPromise(loadPluginsFromJsoncEffect(options));
+var loadPluginsFromJsoncEffect = (options) => Effect2.gen(function* () {
+  const { path, deps } = options;
+  if (!fs.existsSync(path)) return null;
+  const raw = fs.readFileSync(path, "utf8");
+  const errors = [];
+  const parsed = jsonc2.parse(raw, errors);
+  if (errors.length > 0) {
+    const msg = errors.map((e) => `offset ${e.offset}: ${jsonc2.printParseErrorCode(e.error)}`).join("; ");
+    return yield* new LoadPluginsError({
+      message: `[load-plugins] failed to parse ${path}: ${msg}`
+    });
+  }
+  const config = yield* Schema3.decodeUnknownEffect(ExecutorFileConfig)(parsed).pipe(
+    Effect2.mapError(
+      (error) => new LoadPluginsError({
+        message: `[load-plugins] failed to decode ${path}: ${error.issue.toString()}`,
+        cause: error
+      })
+    )
+  );
+  const entries = config.plugins ?? null;
+  if (!entries || entries.length === 0) return null;
+  const { createJiti } = yield* Effect2.tryPromise({
+    try: () => import("jiti"),
+    catch: (cause) => new LoadPluginsError({
+      message: `[load-plugins] failed to import jiti.`,
+      cause
+    })
+  });
+  const jiti = createJiti(pathToFileURL(path).href, {
+    interopDefault: true,
+    moduleCache: false
+  });
+  const fromDir = dirname(path);
+  const require2 = createRequire(isAbsolute(path) ? path : resolvePath(fromDir, "_anchor.js"));
+  const loaded = [];
+  for (const entry of entries) {
+    const serverEntry = `${entry.package}/server`;
+    const resolved = yield* Effect2.try({
+      try: () => require2.resolve(serverEntry),
+      catch: (cause) => new LoadPluginsError({
+        message: `[load-plugins] cannot resolve "${serverEntry}" from ${fromDir}. Is "${entry.package}" installed and does it export "./server"?`,
+        cause
+      })
+    });
+    const mod = yield* Effect2.tryPromise({
+      try: () => jiti.import(resolved),
+      catch: (cause) => new LoadPluginsError({
+        message: `[load-plugins] failed to import "${serverEntry}" from ${resolved}.`,
+        cause
+      })
+    });
+    const factory = typeof mod === "function" ? mod : mod.default ?? null;
+    if (!factory || typeof factory !== "function") {
+      return yield* new LoadPluginsError({
+        message: `[load-plugins] "${serverEntry}" did not export a default definePlugin(...) factory.`
+      });
+    }
+    const merged = { ...deps ?? {}, ...entry.options ?? {} };
+    loaded.push(factory(merged));
+  }
+  return loaded;
+});
+
+// src/write.ts
+import { Effect as Effect3 } from "effect";
+import { FileSystem as FileSystem2 } from "effect";
+import * as jsonc3 from "jsonc-parser";
+var ConfigWriteError = class {
+  constructor(path, cause) {
+    this.path = path;
+    this.cause = cause;
+  }
+  path;
+  cause;
+  _tag = "ConfigWriteError";
+};
+var FORMATTING = {
+  tabSize: 2,
+  insertSpaces: true,
+  eol: "\n"
+};
+var DEFAULT_CONFIG = `{
+  "integrations": []
+}
+`;
+var readOrCreate = (fs2, path) => Effect3.gen(function* () {
+  const exists = yield* fs2.exists(path);
+  if (exists) return yield* fs2.readFileString(path);
+  yield* fs2.writeFileString(path, DEFAULT_CONFIG);
+  return DEFAULT_CONFIG;
+});
+var addIntegrationToConfig = (path, integration) => Effect3.gen(function* () {
+  const fs2 = yield* FileSystem2.FileSystem;
+  let text = yield* readOrCreate(fs2, path);
+  let tree = jsonc3.parseTree(text);
+  let integrationsNode = tree ? jsonc3.findNodeAtLocation(tree, ["integrations"]) : void 0;
+  if (!integrationsNode) {
+    const edits = jsonc3.modify(text, ["integrations"], [integration], {
+      formattingOptions: FORMATTING
+    });
+    text = jsonc3.applyEdits(text, edits);
+  } else {
+    const ns = "namespace" in integration ? integration.namespace : void 0;
+    if (ns && integrationsNode.children) {
+      for (let i = integrationsNode.children.length - 1; i >= 0; i--) {
+        const child = integrationsNode.children[i];
+        const nsNode = jsonc3.findNodeAtLocation(child, ["namespace"]);
+        if (nsNode && jsonc3.getNodeValue(nsNode) === ns) {
+          const edits2 = jsonc3.modify(text, ["integrations", i], void 0, {
+            formattingOptions: FORMATTING
+          });
+          text = jsonc3.applyEdits(text, edits2);
+        }
+      }
+      tree = jsonc3.parseTree(text);
+      integrationsNode = tree ? jsonc3.findNodeAtLocation(tree, ["integrations"]) : void 0;
+    }
+    const count = integrationsNode?.children?.length ?? 0;
+    const edits = jsonc3.modify(text, ["integrations", count], integration, {
+      formattingOptions: FORMATTING
+    });
+    text = jsonc3.applyEdits(text, edits);
+  }
+  yield* fs2.writeFileString(path, text);
+});
+var removeIntegrationFromConfig = (path, namespace) => Effect3.gen(function* () {
+  const fs2 = yield* FileSystem2.FileSystem;
+  const exists = yield* fs2.exists(path);
+  if (!exists) return;
+  let text = yield* fs2.readFileString(path);
+  const tree = jsonc3.parseTree(text);
+  if (!tree) return;
+  const integrationsNode = jsonc3.findNodeAtLocation(tree, ["integrations"]);
+  if (!integrationsNode?.children) return;
+  for (let i = integrationsNode.children.length - 1; i >= 0; i--) {
+    const child = integrationsNode.children[i];
+    const nsNode = jsonc3.findNodeAtLocation(child, ["namespace"]);
+    if (nsNode && jsonc3.getNodeValue(nsNode) === namespace) {
+      const edits = jsonc3.modify(text, ["integrations", i], void 0, {
+        formattingOptions: FORMATTING
+      });
+      text = jsonc3.applyEdits(text, edits);
+    }
+  }
+  yield* fs2.writeFileString(path, text);
+});
+var writeConfig = (path, config) => Effect3.gen(function* () {
+  const fs2 = yield* FileSystem2.FileSystem;
+  const text = yield* Effect3.try({
+    try: () => JSON.stringify(config, null, 2) + "\n",
+    catch: (cause) => new ConfigWriteError(path, cause)
+  });
+  yield* fs2.writeFileString(path, text);
+});
+var addSecretToConfig = (path, secretId, metadata) => Effect3.gen(function* () {
+  const fs2 = yield* FileSystem2.FileSystem;
+  let text = yield* readOrCreate(fs2, path);
+  const edits = jsonc3.modify(text, ["secrets", secretId], metadata, {
+    formattingOptions: FORMATTING
+  });
+  text = jsonc3.applyEdits(text, edits);
+  yield* fs2.writeFileString(path, text);
+});
+var removeSecretFromConfig = (path, secretId) => Effect3.gen(function* () {
+  const fs2 = yield* FileSystem2.FileSystem;
+  const exists = yield* fs2.exists(path);
+  if (!exists) return;
+  let text = yield* fs2.readFileString(path);
+  const edits = jsonc3.modify(text, ["secrets", secretId], void 0, {
+    formattingOptions: FORMATTING
+  });
+  text = jsonc3.applyEdits(text, edits);
+  yield* fs2.writeFileString(path, text);
+});
+
+// src/sink.ts
+import { Effect as Effect4 } from "effect";
+var headerToConfigValue = (value) => {
+  if (typeof value === "string") return value;
+  const ref = `${SECRET_REF_PREFIX}${value.secretId}`;
+  return value.prefix ? { value: ref, prefix: value.prefix } : ref;
+};
+var headersToConfigValues = (headers) => {
+  if (!headers) return void 0;
+  const out = {};
+  for (const [k, v] of Object.entries(headers)) out[k] = headerToConfigValue(v);
+  return out;
+};
+var defaultOnError = (op, err) => {
+  console.warn(`[config-sink] ${op} failed`, err);
+};
+var makeFileConfigSink = (options) => {
+  const { path, fsLayer, onError = defaultOnError } = options;
+  return {
+    upsertIntegration: (integration) => addIntegrationToConfig(path, integration).pipe(
+      Effect4.provide(fsLayer),
+      Effect4.catch((err) => Effect4.sync(() => onError("upsert", err)))
+    ),
+    removeIntegration: (namespace) => removeIntegrationFromConfig(path, namespace).pipe(
+      Effect4.provide(fsLayer),
+      Effect4.catch((err) => Effect4.sync(() => onError("remove", err)))
+    )
+  };
+};
+export {
+  ConfigHeaderValue,
+  ConfigParseError,
+  ExecutorFileConfig,
+  GraphqlIntegrationConfig,
+  IntegrationConfig,
+  McpAuthConfig,
+  McpRemoteIntegrationConfig,
+  McpStdioIntegrationConfig,
+  OpenApiIntegrationConfig,
+  PluginConfig,
+  SECRET_REF_PREFIX,
+  SecretMetadata,
+  addIntegrationToConfig,
+  addSecretToConfig,
+  headerToConfigValue,
+  headersToConfigValues,
+  loadConfig,
+  loadPluginsFromJsonc,
+  makeFileConfigSink,
+  removeIntegrationFromConfig,
+  removeSecretFromConfig,
+  writeConfig
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/schema.ts","../src/load.ts","../src/load-plugins.ts","../src/write.ts","../src/sink.ts"],"sourcesContent":["import { Schema } from \"effect\";\n\n// ---------------------------------------------------------------------------\n// Header values\n//\n// Three forms:\n//   \"static-value\"                            — literal string\n//   \"secret-public-ref:my-token\"              — secret reference (no prefix)\n//   { value: \"secret-public-ref:x\", prefix }  — secret reference with prefix\n// ---------------------------------------------------------------------------\n\nexport const SECRET_REF_PREFIX = \"secret-public-ref:\";\n\nexport const ConfigHeaderValue = Schema.Union([\n  Schema.String,\n  Schema.Struct({\n    value: Schema.String,\n    prefix: Schema.optional(Schema.String),\n  }),\n]);\nexport type ConfigHeaderValue = typeof ConfigHeaderValue.Type;\n\nconst ConfigHeaders = Schema.Record(Schema.String, ConfigHeaderValue);\n\n// ---------------------------------------------------------------------------\n// Integration configs — discriminated union on \"kind\"\n// ---------------------------------------------------------------------------\n\nexport const OpenApiIntegrationConfig = Schema.Struct({\n  kind: Schema.Literal(\"openapi\"),\n  spec: Schema.String,\n  baseUrl: Schema.optional(Schema.String),\n  namespace: Schema.optional(Schema.String),\n  headers: Schema.optional(ConfigHeaders),\n});\nexport type OpenApiIntegrationConfig = typeof OpenApiIntegrationConfig.Type;\n\nexport const GraphqlIntegrationConfig = Schema.Struct({\n  kind: Schema.Literal(\"graphql\"),\n  endpoint: Schema.String,\n  introspectionJson: Schema.optional(Schema.NullOr(Schema.String)),\n  namespace: Schema.optional(Schema.String),\n  headers: Schema.optional(ConfigHeaders),\n});\nexport type GraphqlIntegrationConfig = typeof GraphqlIntegrationConfig.Type;\n\nconst StringMap = Schema.Record(Schema.String, Schema.String);\n\nexport const McpAuthConfig = Schema.Union([\n  Schema.Struct({ kind: Schema.Literal(\"none\") }),\n  Schema.Struct({\n    kind: Schema.Literal(\"header\"),\n    headerName: Schema.String,\n    secret: Schema.String,\n    prefix: Schema.optional(Schema.String),\n  }),\n  Schema.Struct({\n    kind: Schema.Literal(\"oauth2\"),\n    /** Stable id of the SDK Connection holding access + refresh token\n     *  material. The connection names its owner explicitly (org or user),\n     *  so the id resolves to exactly one connection — no scope stack, no\n     *  per-user shadowing. Core resolves its value (refreshing oauth\n     *  tokens) at execute time via the connection's provider. */\n    connectionId: Schema.String,\n  }),\n]);\nexport type McpAuthConfig = typeof McpAuthConfig.Type;\n\nexport const McpRemoteIntegrationConfig = Schema.Struct({\n  kind: Schema.Literal(\"mcp\"),\n  transport: Schema.Literal(\"remote\"),\n  name: Schema.String,\n  endpoint: Schema.String,\n  remoteTransport: Schema.optional(Schema.Literals([\"streamable-http\", \"sse\", \"auto\"])),\n  namespace: Schema.optional(Schema.String),\n  queryParams: Schema.optional(ConfigHeaders),\n  headers: Schema.optional(ConfigHeaders),\n  auth: Schema.optional(McpAuthConfig),\n});\nexport type McpRemoteIntegrationConfig = typeof McpRemoteIntegrationConfig.Type;\n\nexport const McpStdioIntegrationConfig = Schema.Struct({\n  kind: Schema.Literal(\"mcp\"),\n  transport: Schema.Literal(\"stdio\"),\n  name: Schema.String,\n  command: Schema.String,\n  args: Schema.optional(Schema.Array(Schema.String)),\n  env: Schema.optional(StringMap),\n  cwd: Schema.optional(Schema.String),\n  namespace: Schema.optional(Schema.String),\n});\nexport type McpStdioIntegrationConfig = typeof McpStdioIntegrationConfig.Type;\n\nexport const IntegrationConfig = Schema.Union([\n  OpenApiIntegrationConfig,\n  GraphqlIntegrationConfig,\n  McpRemoteIntegrationConfig,\n  McpStdioIntegrationConfig,\n]);\nexport type IntegrationConfig = typeof IntegrationConfig.Type;\n\n// ---------------------------------------------------------------------------\n// Secret metadata\n// ---------------------------------------------------------------------------\n\nexport const SecretMetadata = Schema.Struct({\n  name: Schema.String,\n  provider: Schema.optional(Schema.String),\n  purpose: Schema.optional(Schema.String),\n});\nexport type SecretMetadata = typeof SecretMetadata.Type;\n\n// ---------------------------------------------------------------------------\n// Plugin manifest\n//\n// `plugins` is the install list. Each entry is a published npm package\n// that exports a `definePlugin(...)` factory under `./server`. The host\n// loads each at boot via jiti and calls the factory with merged\n// `options` plus host-injected deps (`configFile`, etc.). This is the\n// dynamic sibling of the static `executor.config.ts` plugin tuple — when\n// `plugins` is set, the host uses it; otherwise it falls back to the\n// statically-typed config.\n// ---------------------------------------------------------------------------\n\nexport const PluginConfig = Schema.Struct({\n  package: Schema.String,\n  options: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)),\n});\nexport type PluginConfig = typeof PluginConfig.Type;\n\n// ---------------------------------------------------------------------------\n// Top-level config\n// ---------------------------------------------------------------------------\n\nexport const ExecutorFileConfig = Schema.Struct({\n  $schema: Schema.optional(Schema.String),\n  name: Schema.optional(Schema.String),\n  plugins: Schema.optional(Schema.Array(PluginConfig)),\n  integrations: Schema.optional(Schema.Array(IntegrationConfig)),\n  secrets: Schema.optional(Schema.Record(Schema.String, SecretMetadata)),\n});\nexport type ExecutorFileConfig = typeof ExecutorFileConfig.Type;\n","import { Effect, Schema } from \"effect\";\nimport { FileSystem } from \"effect\";\nimport type { PlatformError } from \"effect/PlatformError\";\nimport * as jsonc from \"jsonc-parser\";\nimport { ExecutorFileConfig } from \"./schema\";\n\nexport class ConfigParseError extends Schema.TaggedErrorClass<ConfigParseError>()(\n  \"ConfigParseError\",\n  {\n    path: Schema.String,\n    message: Schema.String,\n  },\n) {}\n\n/**\n * Load and validate an executor config file.\n * Returns null if the file doesn't exist.\n */\nexport const loadConfig = (\n  path: string,\n): Effect.Effect<\n  ExecutorFileConfig | null,\n  ConfigParseError | PlatformError,\n  FileSystem.FileSystem\n> =>\n  Effect.gen(function* () {\n    const fs = yield* FileSystem.FileSystem;\n\n    const exists = yield* fs.exists(path);\n    if (!exists) return null;\n\n    const raw = yield* fs.readFileString(path);\n\n    const errors: jsonc.ParseError[] = [];\n    const parsed = jsonc.parse(raw, errors);\n\n    if (errors.length > 0) {\n      const msg = errors\n        .map((e) => `offset ${e.offset}: ${jsonc.printParseErrorCode(e.error)}`)\n        .join(\"; \");\n      return yield* new ConfigParseError({ path, message: msg });\n    }\n\n    const decoded = yield* Schema.decodeUnknownEffect(ExecutorFileConfig)(parsed).pipe(\n      Effect.mapError(\n        (error) =>\n          new ConfigParseError({\n            path,\n            message: error.issue.toString(),\n          }),\n      ),\n    );\n\n    return decoded;\n  });\n","// ---------------------------------------------------------------------------\n// loadPluginsFromJsonc — runtime plugin loader.\n//\n// Reads `executor.jsonc#plugins`, dynamically imports each package's\n// `./server` entry via jiti (so workspace TS sources work in dev and\n// published `dist/*.js` works after install), and calls the exported\n// `definePlugin(...)` factory with merged `options` plus host-injected\n// deps. Returns the resulting `Plugin[]` ready to hand to\n// `composePluginApi` / `createExecutor`.\n//\n// jiti is used instead of bare `import()` because:\n//   - workspace plugins under monorepo dev expose `.ts` source via the\n//     `bun` export condition; Node's loader can't read those directly,\n//     jiti transpiles on the fly.\n//   - in a published environment the package's `default` condition\n//     points at `dist/*.js`, which jiti loads as a normal ESM module.\n//\n// The convention is: every plugin package exports a `./server` subpath\n// whose default export is a `ConfiguredPlugin` (the result of\n// `definePlugin(...)`). Calling that with `{ ...options, ...deps }`\n// returns a concrete `Plugin`.\n// ---------------------------------------------------------------------------\n\nimport { createRequire } from \"node:module\";\nimport { dirname, isAbsolute, resolve as resolvePath } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport * as fs from \"node:fs\";\nimport * as jsonc from \"jsonc-parser\";\nimport { Effect, Schema } from \"effect\";\n\nimport type { AnyPlugin } from \"@rafads/sdk\";\n\n// Plugins are invoked dynamically by name — exact author types are\n// unknown at the call site, so the loader treats every factory as\n// `(options?: unknown) => AnyPlugin`. The plugin author's types still\n// hold inside the plugin's own module; we just don't propagate them\n// across the runtime boundary.\ntype LooseConfiguredPlugin = (options?: Record<string, unknown>) => AnyPlugin;\n\nimport { ExecutorFileConfig } from \"./schema\";\n\nexport class LoadPluginsError extends Schema.TaggedErrorClass<LoadPluginsError>()(\n  \"LoadPluginsError\",\n  {\n    message: Schema.String,\n    cause: Schema.optional(Schema.Unknown),\n  },\n) {}\n\nexport interface LoadPluginsFromJsoncOptions {\n  /** Absolute path to `executor.jsonc` (or compatible). */\n  readonly path: string;\n  /**\n   * Host-injected deps merged into each plugin's options. Common keys:\n   * `configFile` (the `ConfigFileSink`), env-derived credentials, etc.\n   * Plugins ignore deps they don't accept — `definePlugin` strips\n   * unknown keys before forwarding to the author factory.\n   */\n  readonly deps?: Readonly<Record<string, unknown>>;\n}\n\n/**\n * Returns the plugins listed in jsonc, or `null` if the file is missing\n * or has no `plugins` array. The host treats `null` as \"fall back to\n * the static `executor.config.ts` factory.\"\n */\nexport const loadPluginsFromJsonc = async (\n  options: LoadPluginsFromJsoncOptions,\n): Promise<readonly AnyPlugin[] | null> => Effect.runPromise(loadPluginsFromJsoncEffect(options));\n\nconst loadPluginsFromJsoncEffect = (\n  options: LoadPluginsFromJsoncOptions,\n): Effect.Effect<readonly AnyPlugin[] | null, LoadPluginsError> =>\n  Effect.gen(function* () {\n    const { path, deps } = options;\n    if (!fs.existsSync(path)) return null;\n\n    const raw = fs.readFileSync(path, \"utf8\");\n    const errors: jsonc.ParseError[] = [];\n    const parsed = jsonc.parse(raw, errors);\n    if (errors.length > 0) {\n      const msg = errors\n        .map((e) => `offset ${e.offset}: ${jsonc.printParseErrorCode(e.error)}`)\n        .join(\"; \");\n      return yield* new LoadPluginsError({\n        message: `[load-plugins] failed to parse ${path}: ${msg}`,\n      });\n    }\n\n    const config = yield* Schema.decodeUnknownEffect(ExecutorFileConfig)(parsed).pipe(\n      Effect.mapError(\n        (error) =>\n          new LoadPluginsError({\n            message: `[load-plugins] failed to decode ${path}: ${error.issue.toString()}`,\n            cause: error,\n          }),\n      ),\n    );\n\n    const entries = config.plugins ?? null;\n    if (!entries || entries.length === 0) return null;\n\n    // jiti is created once per call; `moduleCache: false` ensures a\n    // restart picks up freshly-installed packages without process restart\n    // (relevant when the dev server kicks a reload after `executor plugin\n    // install`).\n    const { createJiti } = yield* Effect.tryPromise({\n      try: () => import(\"jiti\"),\n      catch: (cause) =>\n        new LoadPluginsError({\n          message: `[load-plugins] failed to import jiti.`,\n          cause,\n        }),\n    });\n    const jiti = createJiti(pathToFileURL(path).href, {\n      interopDefault: true,\n      moduleCache: false,\n    });\n\n    const fromDir = dirname(path);\n    // require.resolve is anchored to the jsonc's directory so plugin\n    // packages resolve from the host app's `node_modules` regardless of\n    // CWD.\n    const require = createRequire(isAbsolute(path) ? path : resolvePath(fromDir, \"_anchor.js\"));\n\n    const loaded: AnyPlugin[] = [];\n    for (const entry of entries) {\n      const serverEntry = `${entry.package}/server`;\n      const resolved = yield* Effect.try({\n        try: () => require.resolve(serverEntry),\n        catch: (cause) =>\n          new LoadPluginsError({\n            message:\n              `[load-plugins] cannot resolve \"${serverEntry}\" from ${fromDir}. ` +\n              `Is \"${entry.package}\" installed and does it export \"./server\"?`,\n            cause,\n          }),\n      });\n      const mod = (yield* Effect.tryPromise({\n        try: () => jiti.import(resolved),\n        catch: (cause) =>\n          new LoadPluginsError({\n            message: `[load-plugins] failed to import \"${serverEntry}\" from ${resolved}.`,\n            cause,\n          }),\n      })) as { default?: LooseConfiguredPlugin } | LooseConfiguredPlugin;\n      const factory = (\n        typeof mod === \"function\" ? mod : (mod.default ?? null)\n      ) as LooseConfiguredPlugin | null;\n      if (!factory || typeof factory !== \"function\") {\n        return yield* new LoadPluginsError({\n          message:\n            `[load-plugins] \"${serverEntry}\" did not export a default ` +\n            `definePlugin(...) factory.`,\n        });\n      }\n      const merged = { ...(deps ?? {}), ...(entry.options ?? {}) };\n      loaded.push(factory(merged));\n    }\n\n    return loaded;\n  });\n","import { Effect } from \"effect\";\nimport { FileSystem } from \"effect\";\nimport type { PlatformError } from \"effect/PlatformError\";\nimport * as jsonc from \"jsonc-parser\";\nimport type { IntegrationConfig, ExecutorFileConfig } from \"./schema\";\n\nexport class ConfigWriteError {\n  readonly _tag = \"ConfigWriteError\";\n  constructor(\n    readonly path: string,\n    readonly cause: unknown,\n  ) {}\n}\n\nconst FORMATTING: jsonc.FormattingOptions = {\n  tabSize: 2,\n  insertSpaces: true,\n  eol: \"\\n\",\n};\n\nconst DEFAULT_CONFIG = `{\n  \"integrations\": []\n}\n`;\n\n/** Read the raw JSONC text from a config file, or create a default one. */\nconst readOrCreate = (\n  fs: FileSystem.FileSystem,\n  path: string,\n): Effect.Effect<string, PlatformError> =>\n  Effect.gen(function* () {\n    const exists = yield* fs.exists(path);\n    if (exists) return yield* fs.readFileString(path);\n    yield* fs.writeFileString(path, DEFAULT_CONFIG);\n    return DEFAULT_CONFIG;\n  });\n\n/**\n * Add an integration entry to the config file. Creates the file if it doesn't exist.\n * Preserves existing comments and formatting.\n */\nexport const addIntegrationToConfig = (\n  path: string,\n  integration: IntegrationConfig,\n): Effect.Effect<void, PlatformError, FileSystem.FileSystem> =>\n  Effect.gen(function* () {\n    const fs = yield* FileSystem.FileSystem;\n    let text = yield* readOrCreate(fs, path);\n\n    // Ensure \"integrations\" array exists\n    let tree = jsonc.parseTree(text);\n    let integrationsNode = tree ? jsonc.findNodeAtLocation(tree, [\"integrations\"]) : undefined;\n\n    if (!integrationsNode) {\n      const edits = jsonc.modify(text, [\"integrations\"], [integration], {\n        formattingOptions: FORMATTING,\n      });\n      text = jsonc.applyEdits(text, edits);\n    } else {\n      // Remove existing entry with same namespace (if any) to avoid duplicates\n      const ns = \"namespace\" in integration ? integration.namespace : undefined;\n      if (ns && integrationsNode.children) {\n        for (let i = integrationsNode.children.length - 1; i >= 0; i--) {\n          const child = integrationsNode.children[i]!;\n          const nsNode = jsonc.findNodeAtLocation(child, [\"namespace\"]);\n          if (nsNode && jsonc.getNodeValue(nsNode) === ns) {\n            const edits = jsonc.modify(text, [\"integrations\", i], undefined, {\n              formattingOptions: FORMATTING,\n            });\n            text = jsonc.applyEdits(text, edits);\n          }\n        }\n        // Re-parse after removals\n        tree = jsonc.parseTree(text);\n        integrationsNode = tree ? jsonc.findNodeAtLocation(tree, [\"integrations\"]) : undefined;\n      }\n\n      const count = integrationsNode?.children?.length ?? 0;\n      const edits = jsonc.modify(text, [\"integrations\", count], integration, {\n        formattingOptions: FORMATTING,\n      });\n      text = jsonc.applyEdits(text, edits);\n    }\n\n    yield* fs.writeFileString(path, text);\n  });\n\n/**\n * Remove an integration from the config file by namespace.\n */\nexport const removeIntegrationFromConfig = (\n  path: string,\n  namespace: string,\n): Effect.Effect<void, PlatformError, FileSystem.FileSystem> =>\n  Effect.gen(function* () {\n    const fs = yield* FileSystem.FileSystem;\n\n    const exists = yield* fs.exists(path);\n    if (!exists) return;\n\n    let text = yield* fs.readFileString(path);\n    const tree = jsonc.parseTree(text);\n    if (!tree) return;\n\n    const integrationsNode = jsonc.findNodeAtLocation(tree, [\"integrations\"]);\n    if (!integrationsNode?.children) return;\n\n    // Walk backwards so indices stay valid after each removal\n    for (let i = integrationsNode.children.length - 1; i >= 0; i--) {\n      const child = integrationsNode.children[i]!;\n      const nsNode = jsonc.findNodeAtLocation(child, [\"namespace\"]);\n      if (nsNode && jsonc.getNodeValue(nsNode) === namespace) {\n        const edits = jsonc.modify(text, [\"integrations\", i], undefined, {\n          formattingOptions: FORMATTING,\n        });\n        text = jsonc.applyEdits(text, edits);\n      }\n    }\n\n    yield* fs.writeFileString(path, text);\n  });\n\n/**\n * Write a full config object to a file.\n */\nexport const writeConfig = (\n  path: string,\n  config: ExecutorFileConfig,\n): Effect.Effect<void, ConfigWriteError | PlatformError, FileSystem.FileSystem> =>\n  Effect.gen(function* () {\n    const fs = yield* FileSystem.FileSystem;\n    const text = yield* Effect.try({\n      try: () => JSON.stringify(config, null, 2) + \"\\n\",\n      catch: (cause) => new ConfigWriteError(path, cause),\n    });\n    yield* fs.writeFileString(path, text);\n  });\n\n/**\n * Add secret metadata to the config file.\n */\nexport const addSecretToConfig = (\n  path: string,\n  secretId: string,\n  metadata: { name: string; provider?: string; purpose?: string },\n): Effect.Effect<void, PlatformError, FileSystem.FileSystem> =>\n  Effect.gen(function* () {\n    const fs = yield* FileSystem.FileSystem;\n    let text = yield* readOrCreate(fs, path);\n\n    const edits = jsonc.modify(text, [\"secrets\", secretId], metadata, {\n      formattingOptions: FORMATTING,\n    });\n    text = jsonc.applyEdits(text, edits);\n\n    yield* fs.writeFileString(path, text);\n  });\n\n/**\n * Remove secret metadata from the config file.\n */\nexport const removeSecretFromConfig = (\n  path: string,\n  secretId: string,\n): Effect.Effect<void, PlatformError, FileSystem.FileSystem> =>\n  Effect.gen(function* () {\n    const fs = yield* FileSystem.FileSystem;\n\n    const exists = yield* fs.exists(path);\n    if (!exists) return;\n\n    let text = yield* fs.readFileString(path);\n    const edits = jsonc.modify(text, [\"secrets\", secretId], undefined, {\n      formattingOptions: FORMATTING,\n    });\n    text = jsonc.applyEdits(text, edits);\n\n    yield* fs.writeFileString(path, text);\n  });\n","// ---------------------------------------------------------------------------\n// ConfigFileSink — best-effort write-back of integration changes to executor.jsonc.\n//\n// Plugins (openapi, graphql, mcp) call `sink.upsertIntegration` after their DB\n// writes so the committable file stays in sync with runtime state. Errors\n// are logged and swallowed — a failed file write must never fail a DB\n// mutation, and the next successful mutation (or a boot-time sync) will\n// eventually reconcile.\n//\n// The FileSystem layer is injected so library code here doesn't pick a\n// platform binding. The host app provides NodeFileSystem (or BunFileSystem).\n// ---------------------------------------------------------------------------\n\nimport { Effect } from \"effect\";\nimport type { Layer } from \"effect\";\nimport type { FileSystem } from \"effect\";\n\nimport { SECRET_REF_PREFIX, type ConfigHeaderValue, type IntegrationConfig } from \"./schema\";\nimport { addIntegrationToConfig, removeIntegrationFromConfig } from \"./write\";\n\n// Translate a plugin-side header value (`{ secretId, prefix? }` for secret\n// refs) into the config file's `secret-public-ref:<id>` string form.\ntype PluginHeaderValue = string | { secretId: string; prefix?: string };\n\nexport const headerToConfigValue = (value: PluginHeaderValue): ConfigHeaderValue => {\n  if (typeof value === \"string\") return value;\n  const ref = `${SECRET_REF_PREFIX}${value.secretId}`;\n  return value.prefix ? { value: ref, prefix: value.prefix } : ref;\n};\n\nexport const headersToConfigValues = (\n  headers: Record<string, PluginHeaderValue> | undefined,\n): Record<string, ConfigHeaderValue> | undefined => {\n  if (!headers) return undefined;\n  const out: Record<string, ConfigHeaderValue> = {};\n  for (const [k, v] of Object.entries(headers)) out[k] = headerToConfigValue(v);\n  return out;\n};\n\nexport interface ConfigFileSink {\n  readonly upsertIntegration: (integration: IntegrationConfig) => Effect.Effect<void>;\n  readonly removeIntegration: (namespace: string) => Effect.Effect<void>;\n}\n\nexport interface ConfigFileSinkOptions {\n  readonly path: string;\n  readonly fsLayer: Layer.Layer<FileSystem.FileSystem>;\n  /** Called when a file operation fails. Defaults to console.warn. */\n  readonly onError?: (op: \"upsert\" | \"remove\", err: unknown) => void;\n}\n\nconst defaultOnError = (op: \"upsert\" | \"remove\", err: unknown): void => {\n  console.warn(`[config-sink] ${op} failed`, err);\n};\n\nexport const makeFileConfigSink = (options: ConfigFileSinkOptions): ConfigFileSink => {\n  const { path, fsLayer, onError = defaultOnError } = options;\n\n  return {\n    upsertIntegration: (integration) =>\n      addIntegrationToConfig(path, integration).pipe(\n        Effect.provide(fsLayer),\n        Effect.catch((err: unknown) => Effect.sync(() => onError(\"upsert\", err))),\n      ),\n\n    removeIntegration: (namespace) =>\n      removeIntegrationFromConfig(path, namespace).pipe(\n        Effect.provide(fsLayer),\n        Effect.catch((err: unknown) => Effect.sync(() => onError(\"remove\", err))),\n      ),\n  };\n};\n"],"mappings":";AAAA,SAAS,cAAc;AAWhB,IAAM,oBAAoB;AAE1B,IAAM,oBAAoB,OAAO,MAAM;AAAA,EAC5C,OAAO;AAAA,EACP,OAAO,OAAO;AAAA,IACZ,OAAO,OAAO;AAAA,IACd,QAAQ,OAAO,SAAS,OAAO,MAAM;AAAA,EACvC,CAAC;AACH,CAAC;AAGD,IAAM,gBAAgB,OAAO,OAAO,OAAO,QAAQ,iBAAiB;AAM7D,IAAM,2BAA2B,OAAO,OAAO;AAAA,EACpD,MAAM,OAAO,QAAQ,SAAS;AAAA,EAC9B,MAAM,OAAO;AAAA,EACb,SAAS,OAAO,SAAS,OAAO,MAAM;AAAA,EACtC,WAAW,OAAO,SAAS,OAAO,MAAM;AAAA,EACxC,SAAS,OAAO,SAAS,aAAa;AACxC,CAAC;AAGM,IAAM,2BAA2B,OAAO,OAAO;AAAA,EACpD,MAAM,OAAO,QAAQ,SAAS;AAAA,EAC9B,UAAU,OAAO;AAAA,EACjB,mBAAmB,OAAO,SAAS,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,EAC/D,WAAW,OAAO,SAAS,OAAO,MAAM;AAAA,EACxC,SAAS,OAAO,SAAS,aAAa;AACxC,CAAC;AAGD,IAAM,YAAY,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM;AAErD,IAAM,gBAAgB,OAAO,MAAM;AAAA,EACxC,OAAO,OAAO,EAAE,MAAM,OAAO,QAAQ,MAAM,EAAE,CAAC;AAAA,EAC9C,OAAO,OAAO;AAAA,IACZ,MAAM,OAAO,QAAQ,QAAQ;AAAA,IAC7B,YAAY,OAAO;AAAA,IACnB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO,SAAS,OAAO,MAAM;AAAA,EACvC,CAAC;AAAA,EACD,OAAO,OAAO;AAAA,IACZ,MAAM,OAAO,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAM7B,cAAc,OAAO;AAAA,EACvB,CAAC;AACH,CAAC;AAGM,IAAM,6BAA6B,OAAO,OAAO;AAAA,EACtD,MAAM,OAAO,QAAQ,KAAK;AAAA,EAC1B,WAAW,OAAO,QAAQ,QAAQ;AAAA,EAClC,MAAM,OAAO;AAAA,EACb,UAAU,OAAO;AAAA,EACjB,iBAAiB,OAAO,SAAS,OAAO,SAAS,CAAC,mBAAmB,OAAO,MAAM,CAAC,CAAC;AAAA,EACpF,WAAW,OAAO,SAAS,OAAO,MAAM;AAAA,EACxC,aAAa,OAAO,SAAS,aAAa;AAAA,EAC1C,SAAS,OAAO,SAAS,aAAa;AAAA,EACtC,MAAM,OAAO,SAAS,aAAa;AACrC,CAAC;AAGM,IAAM,4BAA4B,OAAO,OAAO;AAAA,EACrD,MAAM,OAAO,QAAQ,KAAK;AAAA,EAC1B,WAAW,OAAO,QAAQ,OAAO;AAAA,EACjC,MAAM,OAAO;AAAA,EACb,SAAS,OAAO;AAAA,EAChB,MAAM,OAAO,SAAS,OAAO,MAAM,OAAO,MAAM,CAAC;AAAA,EACjD,KAAK,OAAO,SAAS,SAAS;AAAA,EAC9B,KAAK,OAAO,SAAS,OAAO,MAAM;AAAA,EAClC,WAAW,OAAO,SAAS,OAAO,MAAM;AAC1C,CAAC;AAGM,IAAM,oBAAoB,OAAO,MAAM;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,IAAM,iBAAiB,OAAO,OAAO;AAAA,EAC1C,MAAM,OAAO;AAAA,EACb,UAAU,OAAO,SAAS,OAAO,MAAM;AAAA,EACvC,SAAS,OAAO,SAAS,OAAO,MAAM;AACxC,CAAC;AAeM,IAAM,eAAe,OAAO,OAAO;AAAA,EACxC,SAAS,OAAO;AAAA,EAChB,SAAS,OAAO,SAAS,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,CAAC;AACvE,CAAC;AAOM,IAAM,qBAAqB,OAAO,OAAO;AAAA,EAC9C,SAAS,OAAO,SAAS,OAAO,MAAM;AAAA,EACtC,MAAM,OAAO,SAAS,OAAO,MAAM;AAAA,EACnC,SAAS,OAAO,SAAS,OAAO,MAAM,YAAY,CAAC;AAAA,EACnD,cAAc,OAAO,SAAS,OAAO,MAAM,iBAAiB,CAAC;AAAA,EAC7D,SAAS,OAAO,SAAS,OAAO,OAAO,OAAO,QAAQ,cAAc,CAAC;AACvE,CAAC;;;AC5ID,SAAS,QAAQ,UAAAA,eAAc;AAC/B,SAAS,kBAAkB;AAE3B,YAAY,WAAW;AAGhB,IAAM,mBAAN,cAA+BC,QAAO,iBAAmC;AAAA,EAC9E;AAAA,EACA;AAAA,IACE,MAAMA,QAAO;AAAA,IACb,SAASA,QAAO;AAAA,EAClB;AACF,EAAE;AAAC;AAMI,IAAM,aAAa,CACxB,SAMA,OAAO,IAAI,aAAa;AACtB,QAAMC,MAAK,OAAO,WAAW;AAE7B,QAAM,SAAS,OAAOA,IAAG,OAAO,IAAI;AACpC,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,MAAM,OAAOA,IAAG,eAAe,IAAI;AAEzC,QAAM,SAA6B,CAAC;AACpC,QAAM,SAAe,YAAM,KAAK,MAAM;AAEtC,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,MAAM,OACT,IAAI,CAAC,MAAM,UAAU,EAAE,MAAM,KAAW,0BAAoB,EAAE,KAAK,CAAC,EAAE,EACtE,KAAK,IAAI;AACZ,WAAO,OAAO,IAAI,iBAAiB,EAAE,MAAM,SAAS,IAAI,CAAC;AAAA,EAC3D;AAEA,QAAM,UAAU,OAAOD,QAAO,oBAAoB,kBAAkB,EAAE,MAAM,EAAE;AAAA,IAC5E,OAAO;AAAA,MACL,CAAC,UACC,IAAI,iBAAiB;AAAA,QACnB;AAAA,QACA,SAAS,MAAM,MAAM,SAAS;AAAA,MAChC,CAAC;AAAA,IACL;AAAA,EACF;AAEA,SAAO;AACT,CAAC;;;AC/BH,SAAS,qBAAqB;AAC9B,SAAS,SAAS,YAAY,WAAW,mBAAmB;AAC5D,SAAS,qBAAqB;AAC9B,YAAY,QAAQ;AACpB,YAAYE,YAAW;AACvB,SAAS,UAAAC,SAAQ,UAAAC,eAAc;AAaxB,IAAM,mBAAN,cAA+BC,QAAO,iBAAmC;AAAA,EAC9E;AAAA,EACA;AAAA,IACE,SAASA,QAAO;AAAA,IAChB,OAAOA,QAAO,SAASA,QAAO,OAAO;AAAA,EACvC;AACF,EAAE;AAAC;AAmBI,IAAM,uBAAuB,OAClC,YACyCC,QAAO,WAAW,2BAA2B,OAAO,CAAC;AAEhG,IAAM,6BAA6B,CACjC,YAEAA,QAAO,IAAI,aAAa;AACtB,QAAM,EAAE,MAAM,KAAK,IAAI;AACvB,MAAI,CAAI,cAAW,IAAI,EAAG,QAAO;AAEjC,QAAM,MAAS,gBAAa,MAAM,MAAM;AACxC,QAAM,SAA6B,CAAC;AACpC,QAAM,SAAe,aAAM,KAAK,MAAM;AACtC,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,MAAM,OACT,IAAI,CAAC,MAAM,UAAU,EAAE,MAAM,KAAW,2BAAoB,EAAE,KAAK,CAAC,EAAE,EACtE,KAAK,IAAI;AACZ,WAAO,OAAO,IAAI,iBAAiB;AAAA,MACjC,SAAS,kCAAkC,IAAI,KAAK,GAAG;AAAA,IACzD,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,OAAOD,QAAO,oBAAoB,kBAAkB,EAAE,MAAM,EAAE;AAAA,IAC3EC,QAAO;AAAA,MACL,CAAC,UACC,IAAI,iBAAiB;AAAA,QACnB,SAAS,mCAAmC,IAAI,KAAK,MAAM,MAAM,SAAS,CAAC;AAAA,QAC3E,OAAO;AAAA,MACT,CAAC;AAAA,IACL;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,WAAW;AAClC,MAAI,CAAC,WAAW,QAAQ,WAAW,EAAG,QAAO;AAM7C,QAAM,EAAE,WAAW,IAAI,OAAOA,QAAO,WAAW;AAAA,IAC9C,KAAK,MAAM,OAAO,MAAM;AAAA,IACxB,OAAO,CAAC,UACN,IAAI,iBAAiB;AAAA,MACnB,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AACD,QAAM,OAAO,WAAW,cAAc,IAAI,EAAE,MAAM;AAAA,IAChD,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf,CAAC;AAED,QAAM,UAAU,QAAQ,IAAI;AAI5B,QAAMC,WAAU,cAAc,WAAW,IAAI,IAAI,OAAO,YAAY,SAAS,YAAY,CAAC;AAE1F,QAAM,SAAsB,CAAC;AAC7B,aAAW,SAAS,SAAS;AAC3B,UAAM,cAAc,GAAG,MAAM,OAAO;AACpC,UAAM,WAAW,OAAOD,QAAO,IAAI;AAAA,MACjC,KAAK,MAAMC,SAAQ,QAAQ,WAAW;AAAA,MACtC,OAAO,CAAC,UACN,IAAI,iBAAiB;AAAA,QACnB,SACE,kCAAkC,WAAW,UAAU,OAAO,SACvD,MAAM,OAAO;AAAA,QACtB;AAAA,MACF,CAAC;AAAA,IACL,CAAC;AACD,UAAM,MAAO,OAAOD,QAAO,WAAW;AAAA,MACpC,KAAK,MAAM,KAAK,OAAO,QAAQ;AAAA,MAC/B,OAAO,CAAC,UACN,IAAI,iBAAiB;AAAA,QACnB,SAAS,oCAAoC,WAAW,UAAU,QAAQ;AAAA,QAC1E;AAAA,MACF,CAAC;AAAA,IACL,CAAC;AACD,UAAM,UACJ,OAAO,QAAQ,aAAa,MAAO,IAAI,WAAW;AAEpD,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY;AAC7C,aAAO,OAAO,IAAI,iBAAiB;AAAA,QACjC,SACE,mBAAmB,WAAW;AAAA,MAElC,CAAC;AAAA,IACH;AACA,UAAM,SAAS,EAAE,GAAI,QAAQ,CAAC,GAAI,GAAI,MAAM,WAAW,CAAC,EAAG;AAC3D,WAAO,KAAK,QAAQ,MAAM,CAAC;AAAA,EAC7B;AAEA,SAAO;AACT,CAAC;;;ACjKH,SAAS,UAAAE,eAAc;AACvB,SAAS,cAAAC,mBAAkB;AAE3B,YAAYC,YAAW;AAGhB,IAAM,mBAAN,MAAuB;AAAA,EAE5B,YACW,MACA,OACT;AAFS;AACA;AAAA,EACR;AAAA,EAFQ;AAAA,EACA;AAAA,EAHF,OAAO;AAKlB;AAEA,IAAM,aAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,cAAc;AAAA,EACd,KAAK;AACP;AAEA,IAAM,iBAAiB;AAAA;AAAA;AAAA;AAMvB,IAAM,eAAe,CACnBC,KACA,SAEAH,QAAO,IAAI,aAAa;AACtB,QAAM,SAAS,OAAOG,IAAG,OAAO,IAAI;AACpC,MAAI,OAAQ,QAAO,OAAOA,IAAG,eAAe,IAAI;AAChD,SAAOA,IAAG,gBAAgB,MAAM,cAAc;AAC9C,SAAO;AACT,CAAC;AAMI,IAAM,yBAAyB,CACpC,MACA,gBAEAH,QAAO,IAAI,aAAa;AACtB,QAAMG,MAAK,OAAOF,YAAW;AAC7B,MAAI,OAAO,OAAO,aAAaE,KAAI,IAAI;AAGvC,MAAI,OAAa,iBAAU,IAAI;AAC/B,MAAI,mBAAmB,OAAa,0BAAmB,MAAM,CAAC,cAAc,CAAC,IAAI;AAEjF,MAAI,CAAC,kBAAkB;AACrB,UAAM,QAAc,cAAO,MAAM,CAAC,cAAc,GAAG,CAAC,WAAW,GAAG;AAAA,MAChE,mBAAmB;AAAA,IACrB,CAAC;AACD,WAAa,kBAAW,MAAM,KAAK;AAAA,EACrC,OAAO;AAEL,UAAM,KAAK,eAAe,cAAc,YAAY,YAAY;AAChE,QAAI,MAAM,iBAAiB,UAAU;AACnC,eAAS,IAAI,iBAAiB,SAAS,SAAS,GAAG,KAAK,GAAG,KAAK;AAC9D,cAAM,QAAQ,iBAAiB,SAAS,CAAC;AACzC,cAAM,SAAe,0BAAmB,OAAO,CAAC,WAAW,CAAC;AAC5D,YAAI,UAAgB,oBAAa,MAAM,MAAM,IAAI;AAC/C,gBAAMC,SAAc,cAAO,MAAM,CAAC,gBAAgB,CAAC,GAAG,QAAW;AAAA,YAC/D,mBAAmB;AAAA,UACrB,CAAC;AACD,iBAAa,kBAAW,MAAMA,MAAK;AAAA,QACrC;AAAA,MACF;AAEA,aAAa,iBAAU,IAAI;AAC3B,yBAAmB,OAAa,0BAAmB,MAAM,CAAC,cAAc,CAAC,IAAI;AAAA,IAC/E;AAEA,UAAM,QAAQ,kBAAkB,UAAU,UAAU;AACpD,UAAM,QAAc,cAAO,MAAM,CAAC,gBAAgB,KAAK,GAAG,aAAa;AAAA,MACrE,mBAAmB;AAAA,IACrB,CAAC;AACD,WAAa,kBAAW,MAAM,KAAK;AAAA,EACrC;AAEA,SAAOD,IAAG,gBAAgB,MAAM,IAAI;AACtC,CAAC;AAKI,IAAM,8BAA8B,CACzC,MACA,cAEAH,QAAO,IAAI,aAAa;AACtB,QAAMG,MAAK,OAAOF,YAAW;AAE7B,QAAM,SAAS,OAAOE,IAAG,OAAO,IAAI;AACpC,MAAI,CAAC,OAAQ;AAEb,MAAI,OAAO,OAAOA,IAAG,eAAe,IAAI;AACxC,QAAM,OAAa,iBAAU,IAAI;AACjC,MAAI,CAAC,KAAM;AAEX,QAAM,mBAAyB,0BAAmB,MAAM,CAAC,cAAc,CAAC;AACxE,MAAI,CAAC,kBAAkB,SAAU;AAGjC,WAAS,IAAI,iBAAiB,SAAS,SAAS,GAAG,KAAK,GAAG,KAAK;AAC9D,UAAM,QAAQ,iBAAiB,SAAS,CAAC;AACzC,UAAM,SAAe,0BAAmB,OAAO,CAAC,WAAW,CAAC;AAC5D,QAAI,UAAgB,oBAAa,MAAM,MAAM,WAAW;AACtD,YAAM,QAAc,cAAO,MAAM,CAAC,gBAAgB,CAAC,GAAG,QAAW;AAAA,QAC/D,mBAAmB;AAAA,MACrB,CAAC;AACD,aAAa,kBAAW,MAAM,KAAK;AAAA,IACrC;AAAA,EACF;AAEA,SAAOA,IAAG,gBAAgB,MAAM,IAAI;AACtC,CAAC;AAKI,IAAM,cAAc,CACzB,MACA,WAEAH,QAAO,IAAI,aAAa;AACtB,QAAMG,MAAK,OAAOF,YAAW;AAC7B,QAAM,OAAO,OAAOD,QAAO,IAAI;AAAA,IAC7B,KAAK,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI;AAAA,IAC7C,OAAO,CAAC,UAAU,IAAI,iBAAiB,MAAM,KAAK;AAAA,EACpD,CAAC;AACD,SAAOG,IAAG,gBAAgB,MAAM,IAAI;AACtC,CAAC;AAKI,IAAM,oBAAoB,CAC/B,MACA,UACA,aAEAH,QAAO,IAAI,aAAa;AACtB,QAAMG,MAAK,OAAOF,YAAW;AAC7B,MAAI,OAAO,OAAO,aAAaE,KAAI,IAAI;AAEvC,QAAM,QAAc,cAAO,MAAM,CAAC,WAAW,QAAQ,GAAG,UAAU;AAAA,IAChE,mBAAmB;AAAA,EACrB,CAAC;AACD,SAAa,kBAAW,MAAM,KAAK;AAEnC,SAAOA,IAAG,gBAAgB,MAAM,IAAI;AACtC,CAAC;AAKI,IAAM,yBAAyB,CACpC,MACA,aAEAH,QAAO,IAAI,aAAa;AACtB,QAAMG,MAAK,OAAOF,YAAW;AAE7B,QAAM,SAAS,OAAOE,IAAG,OAAO,IAAI;AACpC,MAAI,CAAC,OAAQ;AAEb,MAAI,OAAO,OAAOA,IAAG,eAAe,IAAI;AACxC,QAAM,QAAc,cAAO,MAAM,CAAC,WAAW,QAAQ,GAAG,QAAW;AAAA,IACjE,mBAAmB;AAAA,EACrB,CAAC;AACD,SAAa,kBAAW,MAAM,KAAK;AAEnC,SAAOA,IAAG,gBAAgB,MAAM,IAAI;AACtC,CAAC;;;ACrKH,SAAS,UAAAE,eAAc;AAWhB,IAAM,sBAAsB,CAAC,UAAgD;AAClF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,MAAM,GAAG,iBAAiB,GAAG,MAAM,QAAQ;AACjD,SAAO,MAAM,SAAS,EAAE,OAAO,KAAK,QAAQ,MAAM,OAAO,IAAI;AAC/D;AAEO,IAAM,wBAAwB,CACnC,YACkD;AAClD,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,MAAyC,CAAC;AAChD,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,EAAG,KAAI,CAAC,IAAI,oBAAoB,CAAC;AAC5E,SAAO;AACT;AAcA,IAAM,iBAAiB,CAAC,IAAyB,QAAuB;AACtE,UAAQ,KAAK,iBAAiB,EAAE,WAAW,GAAG;AAChD;AAEO,IAAM,qBAAqB,CAAC,YAAmD;AACpF,QAAM,EAAE,MAAM,SAAS,UAAU,eAAe,IAAI;AAEpD,SAAO;AAAA,IACL,mBAAmB,CAAC,gBAClB,uBAAuB,MAAM,WAAW,EAAE;AAAA,MACxCC,QAAO,QAAQ,OAAO;AAAA,MACtBA,QAAO,MAAM,CAAC,QAAiBA,QAAO,KAAK,MAAM,QAAQ,UAAU,GAAG,CAAC,CAAC;AAAA,IAC1E;AAAA,IAEF,mBAAmB,CAAC,cAClB,4BAA4B,MAAM,SAAS,EAAE;AAAA,MAC3CA,QAAO,QAAQ,OAAO;AAAA,MACtBA,QAAO,MAAM,CAAC,QAAiBA,QAAO,KAAK,MAAM,QAAQ,UAAU,GAAG,CAAC,CAAC;AAAA,IAC1E;AAAA,EACJ;AACF;","names":["Schema","Schema","fs","jsonc","Effect","Schema","Schema","Effect","require","Effect","FileSystem","jsonc","fs","edits","Effect","Effect"]}

package/dist/load-plugins.d.ts

@@ -0,0 +1,27 @@
+import { Schema } from "effect";
+import type { AnyPlugin } from "@rafads/sdk";
+declare const LoadPluginsError_base: Schema.Class<LoadPluginsError, Schema.TaggedStruct<"LoadPluginsError", {
+    readonly message: Schema.String;
+    readonly cause: Schema.optional<Schema.Unknown>;
+}>, import("effect/Cause").YieldableError>;
+export declare class LoadPluginsError extends LoadPluginsError_base {
+}
+export interface LoadPluginsFromJsoncOptions {
+    /** Absolute path to `executor.jsonc` (or compatible). */
+    readonly path: string;
+    /**
+     * Host-injected deps merged into each plugin's options. Common keys:
+     * `configFile` (the `ConfigFileSink`), env-derived credentials, etc.
+     * Plugins ignore deps they don't accept — `definePlugin` strips
+     * unknown keys before forwarding to the author factory.
+     */
+    readonly deps?: Readonly<Record<string, unknown>>;
+}
+/**
+ * Returns the plugins listed in jsonc, or `null` if the file is missing
+ * or has no `plugins` array. The host treats `null` as "fall back to
+ * the static `executor.config.ts` factory."
+ */
+export declare const loadPluginsFromJsonc: (options: LoadPluginsFromJsoncOptions) => Promise<readonly AnyPlugin[] | null>;
+export {};
+//# sourceMappingURL=load-plugins.d.ts.map

package/dist/load-plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-plugins.d.ts","sourceRoot":"","sources":["../src/load-plugins.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;;;;;AAW7C,qBAAa,gBAAiB,SAAQ,qBAMrC;CAAG;AAEJ,MAAM,WAAW,2BAA2B;IAC1C,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAC/B,SAAS,2BAA2B,KACnC,OAAO,CAAC,SAAS,SAAS,EAAE,GAAG,IAAI,CAA2D,CAAC"}

package/dist/load-plugins.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=load-plugins.test.d.ts.map

package/dist/load-plugins.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-plugins.test.d.ts","sourceRoot":"","sources":["../src/load-plugins.test.ts"],"names":[],"mappings":""}

package/dist/load.d.ts

@@ -0,0 +1,17 @@
+import { Effect, Schema } from "effect";
+import { FileSystem } from "effect";
+import type { PlatformError } from "effect/PlatformError";
+import { ExecutorFileConfig } from "./schema";
+declare const ConfigParseError_base: Schema.Class<ConfigParseError, Schema.TaggedStruct<"ConfigParseError", {
+    readonly path: Schema.String;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class ConfigParseError extends ConfigParseError_base {
+}
+/**
+ * Load and validate an executor config file.
+ * Returns null if the file doesn't exist.
+ */
+export declare const loadConfig: (path: string) => Effect.Effect<ExecutorFileConfig | null, ConfigParseError | PlatformError, FileSystem.FileSystem>;
+export {};
+//# sourceMappingURL=load.d.ts.map

package/dist/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../src/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;;;;;AAE9C,qBAAa,gBAAiB,SAAQ,qBAMrC;CAAG;AAEJ;;;GAGG;AACH,eAAO,MAAM,UAAU,GACrB,MAAM,MAAM,KACX,MAAM,CAAC,MAAM,CACd,kBAAkB,GAAG,IAAI,EACzB,gBAAgB,GAAG,aAAa,EAChC,UAAU,CAAC,UAAU,CA+BnB,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,235 @@
+import { Schema } from "effect";
+export declare const SECRET_REF_PREFIX = "secret-public-ref:";
+export declare const ConfigHeaderValue: Schema.Union<readonly [Schema.String, Schema.Struct<{
+    readonly value: Schema.String;
+    readonly prefix: Schema.optional<Schema.String>;
+}>]>;
+export type ConfigHeaderValue = typeof ConfigHeaderValue.Type;
+export declare const OpenApiIntegrationConfig: Schema.Struct<{
+    readonly kind: Schema.Literal<"openapi">;
+    readonly spec: Schema.String;
+    readonly baseUrl: Schema.optional<Schema.String>;
+    readonly namespace: Schema.optional<Schema.String>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly value: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>>>;
+}>;
+export type OpenApiIntegrationConfig = typeof OpenApiIntegrationConfig.Type;
+export declare const GraphqlIntegrationConfig: Schema.Struct<{
+    readonly kind: Schema.Literal<"graphql">;
+    readonly endpoint: Schema.String;
+    readonly introspectionJson: Schema.optional<Schema.NullOr<Schema.String>>;
+    readonly namespace: Schema.optional<Schema.String>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly value: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>>>;
+}>;
+export type GraphqlIntegrationConfig = typeof GraphqlIntegrationConfig.Type;
+export declare const McpAuthConfig: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"none">;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"header">;
+    readonly headerName: Schema.String;
+    readonly secret: Schema.String;
+    readonly prefix: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"oauth2">;
+    /** Stable id of the SDK Connection holding access + refresh token
+     *  material. The connection names its owner explicitly (org or user),
+     *  so the id resolves to exactly one connection — no scope stack, no
+     *  per-user shadowing. Core resolves its value (refreshing oauth
+     *  tokens) at execute time via the connection's provider. */
+    readonly connectionId: Schema.String;
+}>]>;
+export type McpAuthConfig = typeof McpAuthConfig.Type;
+export declare const McpRemoteIntegrationConfig: Schema.Struct<{
+    readonly kind: Schema.Literal<"mcp">;
+    readonly transport: Schema.Literal<"remote">;
+    readonly name: Schema.String;
+    readonly endpoint: Schema.String;
+    readonly remoteTransport: Schema.optional<Schema.Literals<readonly ["streamable-http", "sse", "auto"]>>;
+    readonly namespace: Schema.optional<Schema.String>;
+    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly value: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>>>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly value: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>>>;
+    readonly auth: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"none">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"header">;
+        readonly headerName: Schema.String;
+        readonly secret: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"oauth2">;
+        /** Stable id of the SDK Connection holding access + refresh token
+         *  material. The connection names its owner explicitly (org or user),
+         *  so the id resolves to exactly one connection — no scope stack, no
+         *  per-user shadowing. Core resolves its value (refreshing oauth
+         *  tokens) at execute time via the connection's provider. */
+        readonly connectionId: Schema.String;
+    }>]>>;
+}>;
+export type McpRemoteIntegrationConfig = typeof McpRemoteIntegrationConfig.Type;
+export declare const McpStdioIntegrationConfig: Schema.Struct<{
+    readonly kind: Schema.Literal<"mcp">;
+    readonly transport: Schema.Literal<"stdio">;
+    readonly name: Schema.String;
+    readonly command: Schema.String;
+    readonly args: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly env: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly cwd: Schema.optional<Schema.String>;
+    readonly namespace: Schema.optional<Schema.String>;
+}>;
+export type McpStdioIntegrationConfig = typeof McpStdioIntegrationConfig.Type;
+export declare const IntegrationConfig: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"openapi">;
+    readonly spec: Schema.String;
+    readonly baseUrl: Schema.optional<Schema.String>;
+    readonly namespace: Schema.optional<Schema.String>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly value: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>>>;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"graphql">;
+    readonly endpoint: Schema.String;
+    readonly introspectionJson: Schema.optional<Schema.NullOr<Schema.String>>;
+    readonly namespace: Schema.optional<Schema.String>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly value: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>>>;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"mcp">;
+    readonly transport: Schema.Literal<"remote">;
+    readonly name: Schema.String;
+    readonly endpoint: Schema.String;
+    readonly remoteTransport: Schema.optional<Schema.Literals<readonly ["streamable-http", "sse", "auto"]>>;
+    readonly namespace: Schema.optional<Schema.String>;
+    readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly value: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>>>;
+    readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+        readonly value: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>]>>>;
+    readonly auth: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"none">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"header">;
+        readonly headerName: Schema.String;
+        readonly secret: Schema.String;
+        readonly prefix: Schema.optional<Schema.String>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"oauth2">;
+        /** Stable id of the SDK Connection holding access + refresh token
+         *  material. The connection names its owner explicitly (org or user),
+         *  so the id resolves to exactly one connection — no scope stack, no
+         *  per-user shadowing. Core resolves its value (refreshing oauth
+         *  tokens) at execute time via the connection's provider. */
+        readonly connectionId: Schema.String;
+    }>]>>;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"mcp">;
+    readonly transport: Schema.Literal<"stdio">;
+    readonly name: Schema.String;
+    readonly command: Schema.String;
+    readonly args: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly env: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly cwd: Schema.optional<Schema.String>;
+    readonly namespace: Schema.optional<Schema.String>;
+}>]>;
+export type IntegrationConfig = typeof IntegrationConfig.Type;
+export declare const SecretMetadata: Schema.Struct<{
+    readonly name: Schema.String;
+    readonly provider: Schema.optional<Schema.String>;
+    readonly purpose: Schema.optional<Schema.String>;
+}>;
+export type SecretMetadata = typeof SecretMetadata.Type;
+export declare const PluginConfig: Schema.Struct<{
+    readonly package: Schema.String;
+    readonly options: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+}>;
+export type PluginConfig = typeof PluginConfig.Type;
+export declare const ExecutorFileConfig: Schema.Struct<{
+    readonly $schema: Schema.optional<Schema.String>;
+    readonly name: Schema.optional<Schema.String>;
+    readonly plugins: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly package: Schema.String;
+        readonly options: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>>>;
+    readonly integrations: Schema.optional<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"openapi">;
+        readonly spec: Schema.String;
+        readonly baseUrl: Schema.optional<Schema.String>;
+        readonly namespace: Schema.optional<Schema.String>;
+        readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+            readonly value: Schema.String;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>]>>>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"graphql">;
+        readonly endpoint: Schema.String;
+        readonly introspectionJson: Schema.optional<Schema.NullOr<Schema.String>>;
+        readonly namespace: Schema.optional<Schema.String>;
+        readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+            readonly value: Schema.String;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>]>>>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"mcp">;
+        readonly transport: Schema.Literal<"remote">;
+        readonly name: Schema.String;
+        readonly endpoint: Schema.String;
+        readonly remoteTransport: Schema.optional<Schema.Literals<readonly ["streamable-http", "sse", "auto"]>>;
+        readonly namespace: Schema.optional<Schema.String>;
+        readonly queryParams: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+            readonly value: Schema.String;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>]>>>;
+        readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+            readonly value: Schema.String;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>]>>>;
+        readonly auth: Schema.optional<Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"none">;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"header">;
+            readonly headerName: Schema.String;
+            readonly secret: Schema.String;
+            readonly prefix: Schema.optional<Schema.String>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"oauth2">;
+            /** Stable id of the SDK Connection holding access + refresh token
+             *  material. The connection names its owner explicitly (org or user),
+             *  so the id resolves to exactly one connection — no scope stack, no
+             *  per-user shadowing. Core resolves its value (refreshing oauth
+             *  tokens) at execute time via the connection's provider. */
+            readonly connectionId: Schema.String;
+        }>]>>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"mcp">;
+        readonly transport: Schema.Literal<"stdio">;
+        readonly name: Schema.String;
+        readonly command: Schema.String;
+        readonly args: Schema.optional<Schema.$Array<Schema.String>>;
+        readonly env: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+        readonly cwd: Schema.optional<Schema.String>;
+        readonly namespace: Schema.optional<Schema.String>;
+    }>]>>>;
+    readonly secrets: Schema.optional<Schema.$Record<Schema.String, Schema.Struct<{
+        readonly name: Schema.String;
+        readonly provider: Schema.optional<Schema.String>;
+        readonly purpose: Schema.optional<Schema.String>;
+    }>>>;
+}>;
+export type ExecutorFileConfig = typeof ExecutorFileConfig.Type;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAWhC,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD,eAAO,MAAM,iBAAiB;;;IAM5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC;AAQ9D,eAAO,MAAM,wBAAwB;;;;;;;;;EAMnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAC;AAE5E,eAAO,MAAM,wBAAwB;;;;;;;;;EAMnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAC;AAI5E,eAAO,MAAM,aAAa;;;;;;;;;IAUtB;;;;iEAI6D;;IAG/D,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAEtD,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;QAVnC;;;;qEAI6D;;;EAgB/D,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAC;AAEhF,eAAO,MAAM,yBAAyB;;;;;;;;;EASpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAC;AAE9E,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAnC1B;;;;qEAI6D;;;;;;;;;;;;IAoC/D,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC;AAM9D,eAAO,MAAM,cAAc;;;;EAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAC;AAcxD,eAAO,MAAM,YAAY;;;EAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;AAMpD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA5E3B;;;;yEAI6D;;;;;;;;;;;;;;;;;;EA8E/D,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAC"}

package/dist/sink.d.ts

@@ -0,0 +1,23 @@
+import { Effect } from "effect";
+import type { Layer } from "effect";
+import type { FileSystem } from "effect";
+import { type ConfigHeaderValue, type IntegrationConfig } from "./schema";
+type PluginHeaderValue = string | {
+    secretId: string;
+    prefix?: string;
+};
+export declare const headerToConfigValue: (value: PluginHeaderValue) => ConfigHeaderValue;
+export declare const headersToConfigValues: (headers: Record<string, PluginHeaderValue> | undefined) => Record<string, ConfigHeaderValue> | undefined;
+export interface ConfigFileSink {
+    readonly upsertIntegration: (integration: IntegrationConfig) => Effect.Effect<void>;
+    readonly removeIntegration: (namespace: string) => Effect.Effect<void>;
+}
+export interface ConfigFileSinkOptions {
+    readonly path: string;
+    readonly fsLayer: Layer.Layer<FileSystem.FileSystem>;
+    /** Called when a file operation fails. Defaults to console.warn. */
+    readonly onError?: (op: "upsert" | "remove", err: unknown) => void;
+}
+export declare const makeFileConfigSink: (options: ConfigFileSinkOptions) => ConfigFileSink;
+export {};
+//# sourceMappingURL=sink.d.ts.map

package/dist/sink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sink.d.ts","sourceRoot":"","sources":["../src/sink.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEzC,OAAO,EAAqB,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAK7F,KAAK,iBAAiB,GAAG,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,eAAO,MAAM,mBAAmB,GAAI,OAAO,iBAAiB,KAAG,iBAI9D,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAChC,SAAS,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,SAAS,KACrD,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,SAKtC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,CAAC,WAAW,EAAE,iBAAiB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpF,QAAQ,CAAC,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACrD,oEAAoE;IACpE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,GAAG,QAAQ,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;CACpE;AAMD,eAAO,MAAM,kBAAkB,GAAI,SAAS,qBAAqB,KAAG,cAgBnE,CAAC"}

package/dist/write.d.ts

@@ -0,0 +1,36 @@
+import { Effect } from "effect";
+import { FileSystem } from "effect";
+import type { PlatformError } from "effect/PlatformError";
+import type { IntegrationConfig, ExecutorFileConfig } from "./schema";
+export declare class ConfigWriteError {
+    readonly path: string;
+    readonly cause: unknown;
+    readonly _tag = "ConfigWriteError";
+    constructor(path: string, cause: unknown);
+}
+/**
+ * Add an integration entry to the config file. Creates the file if it doesn't exist.
+ * Preserves existing comments and formatting.
+ */
+export declare const addIntegrationToConfig: (path: string, integration: IntegrationConfig) => Effect.Effect<void, PlatformError, FileSystem.FileSystem>;
+/**
+ * Remove an integration from the config file by namespace.
+ */
+export declare const removeIntegrationFromConfig: (path: string, namespace: string) => Effect.Effect<void, PlatformError, FileSystem.FileSystem>;
+/**
+ * Write a full config object to a file.
+ */
+export declare const writeConfig: (path: string, config: ExecutorFileConfig) => Effect.Effect<void, ConfigWriteError | PlatformError, FileSystem.FileSystem>;
+/**
+ * Add secret metadata to the config file.
+ */
+export declare const addSecretToConfig: (path: string, secretId: string, metadata: {
+    name: string;
+    provider?: string;
+    purpose?: string;
+}) => Effect.Effect<void, PlatformError, FileSystem.FileSystem>;
+/**
+ * Remove secret metadata from the config file.
+ */
+export declare const removeSecretFromConfig: (path: string, secretId: string) => Effect.Effect<void, PlatformError, FileSystem.FileSystem>;
+//# sourceMappingURL=write.d.ts.map

package/dist/write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../src/write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEtE,qBAAa,gBAAgB;IAGzB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,KAAK,EAAE,OAAO;IAHzB,QAAQ,CAAC,IAAI,sBAAsB;gBAExB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO;CAE1B;AAyBD;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GACjC,MAAM,MAAM,EACZ,aAAa,iBAAiB,KAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CAyCvD,CAAC;AAEL;;GAEG;AACH,eAAO,MAAM,2BAA2B,GACtC,MAAM,MAAM,EACZ,WAAW,MAAM,KAChB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CA2BvD,CAAC;AAEL;;GAEG;AACH,eAAO,MAAM,WAAW,GACtB,MAAM,MAAM,EACZ,QAAQ,kBAAkB,KACzB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,GAAG,aAAa,EAAE,UAAU,CAAC,UAAU,CAQ1E,CAAC;AAEL;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,MAAM,EACZ,UAAU,MAAM,EAChB,UAAU;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,KAC9D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CAWvD,CAAC;AAEL;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,MAAM,MAAM,EACZ,UAAU,MAAM,KACf,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,UAAU,CAAC,UAAU,CAcvD,CAAC"}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@rafads/config",
+  "version": "1.5.38",
+  "homepage": "https://github.com/UsefulSoftwareCo/executor/tree/main/packages/core/config",
+  "bugs": {
+    "url": "https://github.com/UsefulSoftwareCo/executor/issues"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/UsefulSoftwareCo/executor.git",
+    "directory": "packages/core/config"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup && tsc --declaration --emitDeclarationOnly --outDir dist --rootDir src",
+    "typecheck": "tsgo --noEmit",
+    "test": "vitest run",
+    "typecheck:slow": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@rafads/sdk": "1.5.38",
+    "jiti": "^2.6.1",
+    "jsonc-parser": "^3.3.1"
+  },
+  "devDependencies": {
+    "@effect/platform-node": "4.0.0-beta.59",
+    "@effect/vitest": "4.0.0-beta.59",
+    "@types/node": "^24.3.1",
+    "effect": "4.0.0-beta.59",
+    "tsup": "^8.5.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.5"
+  },
+  "peerDependencies": {
+    "effect": "4.0.0-beta.59"
+  }
+}