lael-labs/executor

executor/apps/web/next-env.d.ts+1−1

@@ -1,6 +1,6 @@
1	/// <reference types="next" />	1	/// <reference types="next" />
2	/// <reference types="next/image-types/global" />	2	/// <reference types="next/image-types/global" />
3	import "./.next/types/routes.d.ts";	3	import "./.next/dev/types/routes.d.ts";
4		4
5	// NOTE: This file should not be edited	5	// NOTE: This file should not be edited
6	// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.	6	// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

executor/apps/web/src/app/api/generate/route.ts+4−14

 import { parse as parseYaml } from "yaml";
 import { z } from "zod";
-import { unstable_cache } from "next/cache";
 import { prepareOpenApiSpec } from "@executor/core/openapi-prepare";
-const GENERATED_SPEC_REVALIDATE_SECONDS = 60 * 60;
 const HEADER_FETCH_TIMEOUT_MS = 12_000;
 const querySchema = z.object({
   "referer",
 ]);
-const generatePreparedSpecCached = unstable_cache(
-  async (specUrl: string, includeDts: boolean) => {
-    return await prepareOpenApiSpec(specUrl, "openapi", {
-      includeDts,
-      profile: "inventory",
-    });
-  },
-  ["openapi-generate-v1"],
-  { revalidate: GENERATED_SPEC_REVALIDATE_SECONDS },
-);
 function jsonResponse(
   payload: unknown,
   status: number,
     const forwardedHeaders = sanitizeForwardHeaders(parseHeadersQueryValue(parsed.data.headers));
     const prepared = Object.keys(forwardedHeaders).length === 0
-      ? await generatePreparedSpecCached(parsed.data.specUrl, includeDts)
+      ? await prepareOpenApiSpec(parsed.data.specUrl, sourceName, {
+        includeDts,
+        profile: "inventory",
+      })
       : await prepareWithForwardedHeaders(
         parsed.data.specUrl,
         sourceName,

executor/apps/web/src/components/tools/add/source-dialog.tsx+2−0

         endpoint: form.endpoint.trim(),
         baseUrl: form.baseUrl,
         auth: form.buildAuthConfig(),
+        useCredentialedFetch: form.useCredentialedFetch,
         mcpTransport: form.mcpTransport,
         accountId: context.accountId,
       });
           authType: form.authType,
           authScope: form.authScope,
           apiKeyHeader: form.apiKeyHeader,
+          useCredentialedFetch: form.useCredentialedFetch,
           existingScopedCredential: form.existingScopedCredential,
           buildAuthConfig: form.buildAuthConfig,
           hasCredentialInput: form.hasCredentialInput,

executor/apps/web/src/components/tools/add/source-submit.ts+2−0

   authType: Exclude<SourceAuthType, "mixed">;
   authScope: CredentialScope;
   apiKeyHeader: string;
+  useCredentialedFetch: boolean;
   existingScopedCredential: CredentialRecord | null;
   buildAuthConfig: () => Record<string, unknown> | undefined;
   hasCredentialInput: () => boolean;
     endpoint: form.endpoint.trim(),
     baseUrl: form.baseUrl,
     auth: authConfig,
+    useCredentialedFetch: form.useCredentialedFetch,
     mcpTransport: form.mcpTransport,
     accountId: context.accountId,
   });

executor/apps/web/src/components/tools/add/source/auth-panel.tsx+11−13

@@ -172,19 +172,17 @@ export function SourceAuthPanel({ · 171 unmodified lines
172	</p>	172	</p>
173	) : null}	173	) : null}
174		174
175	{sourceType === "openapi" ? (	175	<label className="flex items-center gap-2 rounded-md border border-border/50 bg-background/40 px-2.5 py-2">
176	<label className="flex items-center gap-2 rounded-md border border-border/50 bg-background/40 px-2.5 py-2">	176	<input
177	<input	177	type="checkbox"
178	type="checkbox"	178	checked={useCredentialedFetch}
179	checked={useCredentialedFetch}	179	onChange={(event) => onUseCredentialedFetchChange(event.target.checked)}
180	onChange={(event) => onUseCredentialedFetchChange(event.target.checked)}	180	className="h-3.5 w-3.5"
181	className="h-3.5 w-3.5"	181	/>
182	/>	182	<span className="text-[11px] text-muted-foreground">
183	<span className="text-[11px] text-muted-foreground">	183	Use credentials while fetching source metadata
184	Use credentials while detecting/fetching spec (off by default for shared cache speed)	184	</span>
185	</span>	185	</label>
186	</label>
187	) : null}
188		186
189	{sourceType === "mcp" && mcpOAuthStatus === "checking" ? (	187	{sourceType === "mcp" && mcpOAuthStatus === "checking" ? (
190	<div className="flex items-center gap-1.5 text-[10px] text-muted-foreground">	188	<div className="flex items-center gap-1.5 text-[10px] text-muted-foreground">

executor/apps/web/src/components/tools/add/source/dialog-helpers.ts+5−0

   endpoint,
   baseUrl,
   auth,
+  useCredentialedFetch,
   mcpTransport,
   accountId,
 }: {
   endpoint: string;
   baseUrl: string;
   auth?: Record<string, unknown>;
+  useCredentialedFetch: boolean;
   mcpTransport: "auto" | "streamable-http" | "sse";
   accountId?: string;
 }): Record<string, unknown> {
   if (type === "mcp") {
     return {
       url: normalizedEndpoint,
+      useCredentialedFetch,
       ...(auth ? { auth } : {}),
       ...(mcpTransport !== "auto" ? { transport: mcpTransport } : {}),
       ...(accountId
   if (type === "graphql") {
     return {
       endpoint: normalizedEndpoint,
+      useCredentialedFetch,
       ...(auth ? { auth } : {}),
     };
   }
   return {
     spec: normalizedEndpoint,
     specUrl: normalizedEndpoint,
+    useCredentialedFetch,
     ...(baseUrl ? { baseUrl } : {}),
     ...(auth ? { auth } : {}),
   };

executor/apps/web/src/components/tools/add/source/form-utils.ts+1−1

@@ -178,7 +178,7 @@ export function sourceToFormValues(source: ToolSourceRecord): SourceFormValues { · 177 unmodified lines
178	apiKeyValue: "",	178	apiKeyValue: "",
179	basicUsername: "",	179	basicUsername: "",
180	basicPassword: "",	180	basicPassword: "",
181	useCredentialedFetch: false,	181	useCredentialedFetch: source.config.useCredentialedFetch === true,
182	};	182	};
183	}	183	}
184		184

executor/apps/web/src/components/tools/explorer/source-form-panel.tsx+2−0

         endpoint: form.endpoint.trim(),
         baseUrl: form.baseUrl,
         auth: form.buildAuthConfig(),
+        useCredentialedFetch: form.useCredentialedFetch,
         mcpTransport: form.mcpTransport,
         accountId: context.accountId,
       });
           authType: form.authType,
           authScope: form.authScope,
           apiKeyHeader: form.apiKeyHeader,
+          useCredentialedFetch: form.useCredentialedFetch,
           existingScopedCredential: form.existingScopedCredential,
           buildAuthConfig: form.buildAuthConfig,
           hasCredentialInput: form.hasCredentialInput,

executor/packages/core/src/tool/source-types.ts+3−0

   sourceId?: string;
   sourceKey?: string;
   url: string;
+  useCredentialedFetch?: boolean;
   auth?: OpenApiAuth;
   discoveryHeaders?: Record<string, string>;
   transport?: "sse" | "streamable-http";
   sourceId?: string;
   sourceKey?: string;
   spec: string | Record<string, unknown>;
+  useCredentialedFetch?: boolean;
   collectionUrl?: string;
   postmanProxyUrl?: string;
   baseUrl?: string;
   sourceId?: string;
   sourceKey?: string;
   endpoint: string;
+  useCredentialedFetch?: boolean;
   schema?: Record<string, unknown>;
   auth?: OpenApiAuth;
   defaultQueryApproval?: ToolApprovalMode;

executor/packages/database/convex/database/credentials.ts+35−0

@@ -392,6 +392,41 @@ export const resolveCredential = internalQuery({ · 391 unmodified lines
392	}	392	}
393		393
394	const organizationId = workspace.organizationId;	394	const organizationId = workspace.organizationId;
		395	const sourceId = sourceIdFromSourceKey(args.sourceKey);
		396	if (sourceId) {
		397	const source = await ctx.db
		398	.query("toolSources")
		399	.withIndex("by_source_id", (q) => q.eq("sourceId", sourceId))
		400	.unique();
		401
		402	if (source) {
		403	if (source.organizationId !== organizationId) {
		404	return null;
		405	}
		406
		407	if (source.scopeType === "workspace" && source.workspaceId !== args.workspaceId) {
		408	return null;
		409	}
		410	}
		411	}
		412
		413	if (args.scopeType === "account") {
		414	const accountId = args.accountId;
		415	if (!accountId) {
		416	return null;
		417	}
		418
		419	const membership = await ctx.db
		420	.query("organizationMembers")
		421	.withIndex("by_org_account", (q) =>
		422	q.eq("organizationId", organizationId).eq("accountId", accountId),
		423	)
		424	.unique();
		425
		426	if (!membership \|\| membership.status !== "active") {
		427	return null;
		428	}
		429	}
395		430
396	const tryWorkspace = async () => {	431	const tryWorkspace = async () => {
397	return await ctx.db	432	return await ctx.db

executor/packages/database/src/database/tool_source_config.ts+6−3

 export type NormalizedMcpToolSourceConfig = Pick<
   McpToolSourceConfig,
-  "url" | "auth" | "discoveryHeaders" | "transport" | "queryParams" | "defaultApproval" | "overrides"
+  "url" | "useCredentialedFetch" | "auth" | "discoveryHeaders" | "transport" | "queryParams" | "defaultApproval" | "overrides"
 >;
 export type NormalizedGraphqlToolSourceConfig = Pick<
   GraphqlToolSourceConfig,
-  "endpoint" | "schema" | "auth" | "defaultQueryApproval" | "defaultMutationApproval" | "overrides"
+  "endpoint" | "useCredentialedFetch" | "schema" | "auth" | "defaultQueryApproval" | "defaultMutationApproval" | "overrides"
 >;
 export type NormalizedOpenApiToolSourceConfig = Pick<
   OpenApiToolSourceConfig,
-  "spec" | "collectionUrl" | "postmanProxyUrl" | "baseUrl" | "auth" | "defaultReadApproval" | "defaultWriteApproval" | "overrides"
+  "spec" | "useCredentialedFetch" | "collectionUrl" | "postmanProxyUrl" | "baseUrl" | "auth" | "defaultReadApproval" | "defaultWriteApproval" | "overrides"
 >;
 export type NormalizedToolSourceConfig =
     return Result.ok({
       url: urlResult.value,
+      useCredentialedFetch: config.useCredentialedFetch === true,
       transport,
       auth: authResult.value,
       queryParams: queryParamsResult.value,
     return Result.ok({
       endpoint: endpointResult.value,
+      useCredentialedFetch: config.useCredentialedFetch === true,
       schema: Object.keys(schema).length > 0 ? schema : undefined,
       auth: authResult.value,
       defaultQueryApproval: defaultQueryApprovalResult.value,
   return Result.ok({
     spec: specResult.value,
+    useCredentialedFetch: config.useCredentialedFetch === true,
     collectionUrl: optionalTrimmedString(config.collectionUrl),
     postmanProxyUrl: optionalTrimmedString(config.postmanProxyUrl),
     baseUrl: optionalTrimmedString(config.baseUrl),

executor/packages/database/src/runtime/tool_source_loading.ts+146−36

   specUrl: string,
   sourceName: string,
   includeDts: boolean,
+  headers?: Record<string, string>,
 ): Promise<PreparedOpenApiSpec | null> {
   const endpoint = resolveExternalGenerateEndpoint();
   if (!endpoint) {
     url.searchParams.set("specUrl", specUrl);
     url.searchParams.set("sourceName", sourceName);
     url.searchParams.set("includeDts", includeDts ? "1" : "0");
+    if (headers && Object.keys(headers).length > 0) {
+      url.searchParams.set("headers", JSON.stringify(headers));
+    }
     const response = await fetch(url.toString(), {
       method: "GET",
       sourceId: normalizedRaw.id,
       sourceKey: `source:${normalizedRaw.id}`,
       url: config.url,
+      useCredentialedFetch: config.useCredentialedFetch,
       auth: config.auth,
       transport: config.transport,
       queryParams: config.queryParams,
       sourceId: normalizedRaw.id,
       sourceKey: `source:${normalizedRaw.id}`,
       endpoint: config.endpoint,
+      useCredentialedFetch: config.useCredentialedFetch,
       schema: config.schema,
       auth: config.auth,
       defaultQueryApproval: config.defaultQueryApproval,
     sourceId: normalizedRaw.id,
     sourceKey: `source:${normalizedRaw.id}`,
     spec: config.spec,
+    useCredentialedFetch: config.useCredentialedFetch,
     collectionUrl: config.collectionUrl,
     postmanProxyUrl: config.postmanProxyUrl,
     baseUrl: config.baseUrl,
   return { headers, warnings: [] };
 }
+async function resolveOpenApiFetchHeaders(
+  ctx: ActionCtx,
+  source: OpenApiToolSourceConfig,
+  workspaceId: Id<"workspaces">,
+  accountId?: Id<"accounts">,
+): Promise<{ headers: Record<string, string>; warnings: string[] }> {
+  if (!source.useCredentialedFetch) {
+    return { headers: {}, warnings: [] };
+  }
+  const auth = source.auth;
+  if (!auth || auth.type === "none") {
+    return { headers: {}, warnings: [] };
+  }
+  const mode = auth.mode ?? "workspace";
+  if (!source.sourceKey) {
+    return {
+      headers: {},
+      warnings: [`Source '${source.name}': missing source key for OpenAPI credentialed fetch`],
+    };
+  }
+  const record = await ctx.runQuery(internal.database.resolveCredential, {
+    workspaceId,
+    sourceKey: source.sourceKey,
+    scopeType: mode,
+    accountId,
+  });
+  if (!record) {
+    return {
+      headers: {},
+      warnings: [`Source '${source.name}': missing ${mode} credential for OpenAPI fetch`],
+    };
+  }
+  const readSecretResult = await resolveCredentialPayloadResult(record, {
+    readVaultObject: async (input) => await readWorkosVaultObjectViaAction(ctx, input),
+  });
+  if (readSecretResult.isErr()) {
+    return {
+      headers: {},
+      warnings: [`Source '${source.name}': failed to resolve OpenAPI credential: ${readSecretResult.error.message}`],
+    };
+  }
+  const secret = readSecretResult.value;
+  if (!secret) {
+    return {
+      headers: {},
+      warnings: [`Source '${source.name}': credential payload unavailable for OpenAPI fetch`],
+    };
+  }
+  const authSpec = toCredentialHeaderSpec(auth);
+  if (!authSpec) {
+    return { headers: {}, warnings: [] };
+  }
+  const headers = buildCredentialAuthHeaders(authSpec, secret);
+  const additionalHeaders = readCredentialAdditionalHeaders(record.additionalHeaders);
+  for (const [key, value] of Object.entries(additionalHeaders)) {
+    headers[key] = value;
+  }
+  if (Object.keys(headers).length === 0) {
+    return {
+      headers: {},
+      warnings: [`Source '${source.name}': credential did not produce OpenAPI auth headers`],
+    };
+  }
+  return { headers, warnings: [] };
+}
 async function loadCachedOpenApiSpec(
   ctx: ActionCtx,
   specUrl: string,
   sourceName: string,
   includeDts: boolean,
+  headers?: Record<string, string>,
 ): Promise<PreparedOpenApiSpec> {
+  const hasHeaders = Boolean(headers && Object.keys(headers).length > 0);
   const getDtsStatus = (prepared: PreparedOpenApiSpec): "ready" | "failed" | "skipped" => {
     if (prepared.dtsStatus) {
       return prepared.dtsStatus;
     return prepared.dts ? "ready" : "failed";
   };
-  try {
+  if (!hasHeaders) {
-    const entry = await ctx.runQuery(internal.openApiSpecCache.getEntry, {
+    try {
-      specUrl,
+      const entry = await ctx.runQuery(internal.openApiSpecCache.getEntry, {
-      version: OPENAPI_PREPARED_CACHE_VERSION,
+        specUrl,
-      maxAgeMs: OPENAPI_SPEC_CACHE_TTL_MS,
+        version: OPENAPI_PREPARED_CACHE_VERSION,
-    });
+        maxAgeMs: OPENAPI_SPEC_CACHE_TTL_MS,
+      });
-    if (entry) {
+      if (entry) {
-      const blob = await ctx.storage.get(entry.storageId);
+        const blob = await ctx.storage.get(entry.storageId);
-      if (blob) {
+        if (blob) {
-        const json = await blob.text();
+          const json = await blob.text();
-        let parsedJson: unknown;
+          let parsedJson: unknown;
-        try {
+          try {
-          parsedJson = JSON.parse(json);
+            parsedJson = JSON.parse(json);
-        } catch {
+          } catch {
-          parsedJson = undefined;
+            parsedJson = undefined;
-        }
+          }
-        if (parsedJson !== undefined) {
+          if (parsedJson !== undefined) {
-          const prepared = toPreparedOpenApiSpec(parsedJson);
+            const prepared = toPreparedOpenApiSpec(parsedJson);
-          if (prepared && (!includeDts || getDtsStatus(prepared) !== "skipped")) {
+            if (prepared && (!includeDts || getDtsStatus(prepared) !== "skipped")) {
-            return prepared;
+              return prepared;
+            }
           }
         }
       }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(`[executor] OpenAPI cache read failed for '${sourceName}': ${message}`);
     }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    console.warn(`[executor] OpenAPI cache read failed for '${sourceName}': ${message}`);
   }
   const externalPrepared = await loadPreparedOpenApiSpecFromExternalGenerate(
     specUrl,
     sourceName,
     includeDts,
+    headers,
   );
   if (externalPrepared) {
-    await cachePreparedOpenApiSpec(ctx, specUrl, sourceName, externalPrepared);
+    if (!hasHeaders) {
+      await cachePreparedOpenApiSpec(ctx, specUrl, sourceName, externalPrepared);
+    }
     return externalPrepared;
   }
     throw new Error(`Prepared OpenAPI payload for '${sourceName}' was invalid`);
   }
-  await cachePreparedOpenApiSpec(
+  if (!hasHeaders) {
-    ctx,
+    await cachePreparedOpenApiSpec(
-    specUrl,
+      ctx,
-    sourceName,
+      specUrl,
-    prepared,
+      sourceName,
-    preparedStorageId,
+      prepared,
-    preparedSizeBytes,
+      preparedStorageId,
-  );
+      preparedSizeBytes,
+    );
+  }
   return prepared;
 }
   if (source.type === "openapi" && typeof source.spec === "string") {
     try {
-      const sharedArtifactCacheEligible = canUseSharedOpenApiArtifactCache(source);
+      const resolvedOpenApiHeaders = await resolveOpenApiFetchHeaders(
+        ctx,
+        source,
+        options.workspaceId,
+        options.accountId,
+      );
+      const sharedArtifactCacheEligible = canUseSharedOpenApiArtifactCache(source)
+        && Object.keys(resolvedOpenApiHeaders.headers).length === 0;
       const sharedArtifactCacheKey = sharedArtifactCacheEligible
         ? sharedOpenApiArtifactCacheKey(source)
         : undefined;
         }
       }
-      const prepared = await loadCachedOpenApiSpec(ctx, source.spec, source.name, includeDts);
+      const prepared = await loadCachedOpenApiSpec(
+        ctx,
+        source.spec,
+        source.name,
+        includeDts,
+        resolvedOpenApiHeaders.headers,
+      );
       const artifact = compileOpenApiArtifactFromPrepared(source, prepared);
       if (sharedArtifactCacheEligible && sharedArtifactCacheKey) {
         await putSharedOpenApiArtifactCache(ctx, sharedArtifactCacheKey, artifact);
       }
-      const warnings = (prepared.warnings ?? []).map(
+      const warnings = [
+        ...resolvedOpenApiHeaders.warnings,
+        ...(prepared.warnings ?? []).map(
         (warning) => `Source '${source.name}': ${warning}`,
-      );
+        ),
+      ];
       return {
         artifact,
         warnings,