Normalize openapi plugin secret/connection refs

[RhysSullivan]

Move secret/connection references out of the JSON columns on
openapi_source and openapi_source_binding into:

• openapi_source_binding gains kind/secret_id/connection_id/text_value
  columns (replacing the discriminated-union json value)
• openapi_source_query_param: child table for query_params, mirrors
  graphql_source_query_param shape
• openapi_source_spec_fetch_header / spec_fetch_query_param: child
  tables for invocation_config.specFetchCredentials.{headers,queryParams}

Drops openapi_source.query_params and openapi_source.invocation_config
JSON columns. headers and oauth2 stay JSON because they hold slot
names rather than direct refs — the slots resolve through bindings,
which ARE normalized.

Plugin gains usagesForSecret / usagesForConnection that fan out across
all four locations in one indexed SELECT each. secrets.remove now
correctly RESTRICTs when an openapi binding still uses the secret.

Migration 0008 backfills via json_extract / json_each, then drops the
old columns. Three migration tests cover the backfill from a
hand-seeded pre-migration DB; two plugin-level tests cover usage
fan-out and remove RESTRICT.

[RhysSullivan]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Normalize google-discovery plugin secret/connection refs #521
• Normalize mcp plugin secret/connection refs #520
• Normalize openapi plugin secret/connection refs #519 👈 (View in Graphite)
• Normalize graphql plugin secret/connection refs #518
• Add secret/connection usages SDK surface #516
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	5a7fa76	Commit Preview URL Branch Preview URL	May 04 2026, 07:53 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	5a7fa76	May 04 2026, 07:53 PM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@519

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@519

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@519

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@519

@executor-js/storage-core

npm i https://pkg.pr.new/@executor-js/storage-core@519

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@519

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@519

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@519

@executor-js/plugin-google-discovery

npm i https://pkg.pr.new/@executor-js/plugin-google-discovery@519

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@519

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@519

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@519

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@519

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@519

executor

npm i https://pkg.pr.new/executor@519

commit: 5a7fa76