Normalize graphql plugin secret/connection refs

[RhysSullivan]

Move secret/connection references out of the JSON columns on
graphql_source (auth, headers, query_params) into:

• two new flat columns auth_kind + auth_connection_id (indexed)
• two child tables graphql_source_header / graphql_source_query_param,
  each with kind/text_value/secret_id/secret_prefix and an indexed
  secret_id

This lets usagesForSecret and usagesForConnection answer "where is X
referenced?" with a single indexed SELECT instead of scanning JSON, and
secrets.remove / connections.remove now correctly RESTRICT when a
graphql source still references the id.

Migration 0007 backfills existing JSON via json_each + json_extract,
then drops the old columns. Three tests cover the backfill against a
hand-seeded pre-migration DB; three plugin-level tests cover usage
fan-out and remove RESTRICT.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	57a1a41	Commit Preview URL Branch Preview URL	May 05 2026, 06:26 PM

[RhysSullivan]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Normalize plugin secret/connection refs + add usages SDK surface #521
• Normalize mcp plugin secret/connection refs #520
• Normalize openapi plugin secret/connection refs #519
• Normalize graphql plugin secret/connection refs #518 👈 (View in Graphite)
• Add secret/connection usages SDK surface #516
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	57a1a41	May 05 2026, 06:28 PM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@518

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@518

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@518

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@518

@executor-js/storage-core

npm i https://pkg.pr.new/@executor-js/storage-core@518

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@518

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@518

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@518

@executor-js/plugin-google-discovery

npm i https://pkg.pr.new/@executor-js/plugin-google-discovery@518

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@518

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@518

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@518

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@518

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@518

executor

npm i https://pkg.pr.new/executor@518

commit: 57a1a41

[RhysSullivan]

Consolidated into #521