refactor(openapi,graphql): store invocation config on source, not per-tool

[RhysSullivan]

Summary

Per-tool binding rows in the OpenAPI and GraphQL plugins were duplicating the full InvocationConfig (baseUrl/endpoint + headers) on every binding entry. For a source with N operations, the plugin stored N copies of the same config in KV, and every updateSource call read and rewrote every binding row (O(N) writes per header edit).

This PR:

• Moves invocationConfig to the source row (one per namespace), alongside the user-facing SourceConfig.
• Per-tool rows now store only { namespace, binding }.
• The invoker resolves runtime config via getSource(namespace) on the hot path (one extra KV read, which is shared across all tools in the same source within a request).
• updateSource becomes a single putSource — O(1) writes instead of O(N).
• Applied symmetrically to the OpenAPI and GraphQL plugins.

Why this mattered

The edit-source path looked like this:

const toolIds = yield* operationStore.listByNamespace(namespace);
for (const toolId of toolIds) {
  const entry = yield* operationStore.get(toolId);
  if (entry) {
    yield* operationStore.put([{ toolId, namespace, binding: entry.binding, config: newInvocationConfig }]);
  }
}

For a Stripe-sized OpenAPI spec this is hundreds of KV writes per header rotation, and every binding row inflates with a redundant headers blob.

Not in scope

packages/plugins/mcp/src/sdk/binding-store.ts has the same anti-pattern (sourceData is stamped onto every binding row). Worth a follow-up.

Test plan

• bun run typecheck — full workspace, clean
• bun run --filter '@executor/plugin-openapi' --filter '@executor/plugin-graphql' test — 36/36 passing
• Manually exercise an OpenAPI add + edit-source flow against a real spec to confirm invocation still works end-to-end
• Same for GraphQL

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	0580036	Commit Preview URL Branch Preview URL	Apr 13 2026, 07:04 AM

[pkg-pr-new]

Open in StackBlitz

@executor/sdk

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/sdk@222

@executor/plugin-file-secrets

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-file-secrets@222

@executor/plugin-google-discovery

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-google-discovery@222

@executor/plugin-graphql

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-graphql@222

@executor/plugin-keychain

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-keychain@222

@executor/plugin-mcp

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-mcp@222

@executor/plugin-onepassword

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-onepassword@222

@executor/plugin-openapi

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-openapi@222

@executor/plugin-workos-vault

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-workos-vault@222

commit: 0580036