import { defineExecutorConfig } from "@executor-js/sdk";import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";import { googleHttpPlugin } from "@executor-js/plugin-google/api";import { microsoftHttpPlugin } from "@executor-js/plugin-microsoft/api";import { mcpHttpPlugin } from "@executor-js/plugin-mcp/api";import { graphqlHttpPlugin } from "@executor-js/plugin-graphql/api";import { encryptedSecretsPlugin } from "@executor-js/plugin-encrypted-secrets";import { toolkitsPlugin } from "@executor-js/plugin-toolkits/server"; import { resolveSecretKey } from "./src/config";import { getSelfHostAppsSubsystem } from "./src/apps"; // ---------------------------------------------------------------------------// Single source of truth for the self-hosted app's plugin list.//// Self-host runs the same protocol/provider plugins as cloud, minus the// multi-tenant-only secret backends (WorkOS Vault). `dangerouslyAllowStdioMCP`// is false: a server reachable by multiple users must not let one user spawn// arbitrary stdio MCP processes on the host. The encrypted DB secret provider// (slice 4) is added here as the first writable secret provider.// --------------------------------------------------------------------------- interface SelfHostPluginDeps {  readonly activeToolkitSlug?: string;  /** Mirrors `HostConfig.allowLocalNetwork` (EXECUTOR_ALLOW_LOCAL_NETWORK):   *  lets `microsoft.addGraph` point at a loopback emulator instead of the   *  pinned Microsoft Graph URLs. Off by default. */  readonly allowLocalNetwork?: boolean;} export default defineExecutorConfig({  plugins: ({ activeToolkitSlug, allowLocalNetwork }: SelfHostPluginDeps = {}) =>    [      openApiHttpPlugin(),      googleHttpPlugin(),      microsoftHttpPlugin({ allowUnsafeUrlOverrides: allowLocalNetwork === true }),      mcpHttpPlugin({ dangerouslyAllowStdioMCP: false }),      graphqlHttpPlugin(),      toolkitsPlugin({ activeToolkitSlug }),      // First writable secret provider -> the default for `secrets.set`.      encryptedSecretsPlugin({ key: resolveSecretKey() }),      // The apps source plugin: published custom tools become real catalog      // citizens (tools.list + execute through the same policy/audit path). The      // runtime is a boot-time singleton shared across per-request plugin      // instances; the plugin itself is thin.      getSelfHostAppsSubsystem().plugin,    ] as const,});