lael-labs/executor

bun.lock+4−5

         "@convex-dev/migrations": "^0.3.1",
         "@convex-dev/stripe": "^0.1.3",
         "@convex-dev/workos-authkit": "^0.1.6",
-        "@executor/contracts": "workspace:*",
         "@workos-inc/node": "^8.2.0",
         "convex": "^1.31.7",
         "convex-helpers": "^0.1.111",
       "dependencies": {
         "@convex-dev/workos": "^0.0.1",
         "@elysiajs/eden": "^1.4.6",
-        "@executor/contracts": "workspace:*",
+        "@executor/convex": "workspace:*",
         "@monaco-editor/react": "^4.7.0",
         "@streamdown/code": "^1.0.1",
         "@tanstack/react-query": "^5.80.7",
         "typescript": "^5",
       },
     },
-    "executor/packages/contracts": {
+    "executor/convex": {
-      "name": "@executor/contracts",
+      "name": "@executor/convex",
       "version": "0.0.1",
     },
   },
     "@eslint/plugin-kit": ["@eslint/plugin-kit@0.4.1", "", { "dependencies": { "@eslint/core": "^0.17.0", "levn": "^0.4.1" } }, "sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA=="],
-    "@executor/contracts": ["@executor/contracts@workspace:executor/packages/contracts"],
+    "@executor/convex": ["@executor/convex@workspace:executor/convex"],
     "@executor/web": ["@executor/web@workspace:executor/apps/web"],

executor/apps/web/next.config.ts+1−1

@@ -13,7 +13,7 @@ const appShellRewriteExclusions = [ · 12 unmodified lines
13	].join("\|");	13	].join("\|");
14		14
15	const nextConfig: NextConfig = {	15	const nextConfig: NextConfig = {
16	transpilePackages: ["@executor/contracts"],	16	transpilePackages: ["@executor/convex"],
17	env: {	17	env: {
18	// Map canonical env vars to NEXT_PUBLIC_ so they're available client-side.	18	// Map canonical env vars to NEXT_PUBLIC_ so they're available client-side.
19	// This lets us keep a single root .env without NEXT_PUBLIC_ prefixes.	19	// This lets us keep a single root .env without NEXT_PUBLIC_ prefixes.

executor/apps/web/package.json+1−1

   },
   "dependencies": {
     "@convex-dev/workos": "^0.0.1",
+    "@executor/convex": "workspace:*",
     "@elysiajs/eden": "^1.4.6",
-    "@executor/contracts": "workspace:*",
     "@monaco-editor/react": "^4.7.0",
     "@streamdown/code": "^1.0.1",
     "@tanstack/react-query": "^5.80.7",

executor/apps/web/src/app/sign-in/route.ts+2−2

@@ -1,8 +1,8 @@
1	import type { NextRequest } from "next/server";	1	import type { NextRequest } from "next/server";
2	import { redirect } from "next/navigation";	2	import { redirect } from "next/navigation";
3	import { ConvexHttpClient } from "convex/browser";	3	import { ConvexHttpClient } from "convex/browser";
4	import { api } from "../../../../../convex/_generated/api";	4	import { api } from "@executor/convex/_generated/api";
5	import type { Id } from "../../../../../convex/_generated/dataModel";	5	import type { Id } from "@executor/convex/_generated/dataModel";
6		6
7	function getExternalOrigin(request: NextRequest) {	7	function getExternalOrigin(request: NextRequest) {
8	const host = request.headers.get("x-forwarded-host") ?? request.headers.get("host");	8	const host = request.headers.get("x-forwarded-host") ?? request.headers.get("host");

executor/apps/web/src/app/sign-up/route.ts+2−2

@@ -1,8 +1,8 @@
1	import type { NextRequest } from "next/server";	1	import type { NextRequest } from "next/server";
2	import { redirect } from "next/navigation";	2	import { redirect } from "next/navigation";
3	import { ConvexHttpClient } from "convex/browser";	3	import { ConvexHttpClient } from "convex/browser";
4	import { api } from "../../../../../convex/_generated/api";	4	import { api } from "@executor/convex/_generated/api";
5	import type { Id } from "../../../../../convex/_generated/dataModel";	5	import type { Id } from "@executor/convex/_generated/dataModel";
6		6
7	function getExternalOrigin(request: NextRequest) {	7	function getExternalOrigin(request: NextRequest) {
8	const host = request.headers.get("x-forwarded-host") ?? request.headers.get("host");	8	const host = request.headers.get("x-forwarded-host") ?? request.headers.get("host");

executor/apps/web/src/components/code-editor.tsx+0−16

@@ -131,17 +131,6 @@ type ToolOutput<Op> = · 130 unmodified lines
131	function generateToolsDts(tools: ToolDescriptor[], dtsSources: Set<string>): string {	131	function generateToolsDts(tools: ToolDescriptor[], dtsSources: Set<string>): string {
132	const root = buildTree(tools);	132	const root = buildTree(tools);
133		133
134	// Legacy compat: collect schemaTypes from tools that use the old format
135	const schemaTypeAliases = new Map<string, string>();
136	for (const tool of tools) {
137	if (!tool.schemaTypes) continue;
138	for (const [name, type] of Object.entries(tool.schemaTypes)) {
139	if (!schemaTypeAliases.has(name)) {
140	schemaTypeAliases.set(name, type);
141	}
142	}
143	}
144
145	const interfaces: string[] = [];	134	const interfaces: string[] = [];
146		135
147	// Emit all namespace interfaces recursively	136	// Emit all namespace interfaces recursively
@@ -170,11 +159,6 @@ function generateToolsDts(tools: ToolDescriptor[], dtsSources: Set<string>): str · 22 unmodified lines
170	*/	159	*/
171	`;	160	`;
172		161
173	// Legacy schema type aliases
174	if (schemaTypeAliases.size > 0) {
175	dts += Array.from(schemaTypeAliases, ([name, type]) => `type ${name} = ${type};`).join("\n") + "\n\n";
176	}
177
178	// Note: .d.ts blocks from OpenAPI sources are fetched separately and registered	162	// Note: .d.ts blocks from OpenAPI sources are fetched separately and registered
179	// as a distinct Monaco extra lib (see dtsUrls effect). This keeps generateToolsDts	163	// as a distinct Monaco extra lib (see dtsUrls effect). This keeps generateToolsDts
180	// fast and avoids bundling multi-MB .d.ts content into the tool declarations string.	164	// fast and avoids bundling multi-MB .d.ts content into the tool declarations string.

executor/apps/web/src/components/members-view.tsx+2−2

@@ -9,7 +9,7 @@ import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card"; · 8 unmodified lines
9	import { Input } from "@/components/ui/input";	9	import { Input } from "@/components/ui/input";
10	import { useSession } from "@/lib/session-context";	10	import { useSession } from "@/lib/session-context";
11	import { convexApi } from "@/lib/convex-api";	11	import { convexApi } from "@/lib/convex-api";
12	import type { Id } from "../../../../convex/_generated/dataModel";	12	import type { Id } from "@executor/convex/_generated/dataModel";
13		13
14	type Role = "owner" \| "admin" \| "member" \| "billing_admin";	14	type Role = "owner" \| "admin" \| "member" \| "billing_admin";
15	type MemberStatus = "active" \| "pending" \| "removed";	15	type MemberStatus = "active" \| "pending" \| "removed";
@@ -64,7 +64,7 @@ export function MembersView({ showHeader = true }: MembersViewProps) { · 48 unmodified lines
64		64
65	const memberItems: OrganizationMemberListItem[] = members?.items ?? [];	65	const memberItems: OrganizationMemberListItem[] = members?.items ?? [];
66	const actorMembership = memberItems.find((member: { accountId?: string; role?: string }) =>	66	const actorMembership = memberItems.find((member: { accountId?: string; role?: string }) =>
67	context?.accountId ? member.accountId === context.accountId : false,	67	context ? member.accountId === context.accountId : false,
68	);	68	);
69	const actorRole = actorMembership?.role ?? null;	69	const actorRole = actorMembership?.role ?? null;
70	const canManageMembers = actorRole === "owner" \|\| actorRole === "admin";	70	const canManageMembers = actorRole === "owner" \|\| actorRole === "admin";

executor/apps/web/src/components/tasks-view.tsx+2−1

   TaskEventRecord,
   TaskRecord,
 } from "@/lib/types";
+import type { Id } from "@executor/convex/_generated/dataModel";
 import { toast } from "sonner";
 import { cn } from "@/lib/utils";
   onClose,
 }: {
   task: TaskRecord;
-  workspaceId: string;
+  workspaceId: Id<"workspaces">;
   sessionId?: string;
   onClose: () => void;
 }) {

executor/apps/web/src/hooks/use-workspace-tools.ts+2−1

 import { useAction, useQuery as useConvexQuery } from "convex/react";
 import { convexApi } from "@/lib/convex-api";
 import type { OpenApiSourceQuality, ToolDescriptor } from "@/lib/types";
+import type { Id } from "@executor/convex/_generated/dataModel";
 interface WorkspaceContext {
-  workspaceId: string;
+  workspaceId: Id<"workspaces">;
   actorId?: string;
   clientId?: string;
   sessionId?: string;

executor/apps/web/src/lib/convex-api.ts+1−1

@@ -1,3 +1,3 @@
1	import { api } from "../../../../convex/_generated/api";	1	import { api } from "@executor/convex/_generated/api";
2		2
3	export const convexApi = api;	3	export const convexApi = api;

executor/apps/web/src/lib/session-context.tsx+1−1

@@ -14,7 +14,7 @@ import { anonymousDemoEnabled, workosEnabled } from "@/lib/auth-capabilities"; · 13 unmodified lines
14	import { useWorkosAuthLoading } from "@/lib/convex-provider";	14	import { useWorkosAuthLoading } from "@/lib/convex-provider";
15	import { convexApi } from "@/lib/convex-api";	15	import { convexApi } from "@/lib/convex-api";
16	import type { AnonymousContext } from "./types";	16	import type { AnonymousContext } from "./types";
17	import type { Id } from "../../../../convex/_generated/dataModel";	17	import type { Id } from "@executor/convex/_generated/dataModel";
18		18
19	interface SessionState {	19	interface SessionState {
20	context: AnonymousContext \| null;	20	context: AnonymousContext \| null;

executor/apps/web/src/lib/types.ts+124−22

@@ -1,27 +1,129 @@
1	// Re-export shared types from contracts	1	import type { Id } from "@executor/convex/_generated/dataModel";
2	export type {
3	TaskStatus,
4	ApprovalStatus,
5	PolicyDecision,
6	CredentialScope,
7	CredentialProvider,
8	ToolApprovalMode,
9	ToolSourceType,
10	TaskRecord,
11	ApprovalRecord,
12	PendingApprovalRecord,
13	TaskEventRecord,
14	AccessPolicyRecord,
15	CredentialRecord,
16	ToolSourceRecord,
17	ToolDescriptor,
18	OpenApiSourceQuality,
19	AnonymousContext,
20	} from "@executor/contracts";
21		2
22	// ── Web-only types ────────────────────────────────────────────────────────────	3	// ── Shared types (inlined from @executor/contracts) ──────────────────────────
		4
		5	export type TaskStatus = "queued" \| "running" \| "completed" \| "failed" \| "timed_out" \| "denied";
		6	export type ApprovalStatus = "pending" \| "approved" \| "denied";
		7	export type PolicyDecision = "allow" \| "require_approval" \| "deny";
		8	export type CredentialScope = "workspace" \| "actor";
		9	export type CredentialProvider = "managed" \| "workos-vault";
		10	export type ToolApprovalMode = "auto" \| "required";
		11	export type ToolSourceType = "mcp" \| "openapi" \| "graphql";
		12
		13	export interface TaskRecord {
		14	id: string;
		15	code: string;
		16	runtimeId: string;
		17	status: TaskStatus;
		18	timeoutMs: number;
		19	metadata: Record<string, unknown>;
		20	workspaceId: string;
		21	actorId?: string;
		22	clientId?: string;
		23	createdAt: number;
		24	updatedAt: number;
		25	startedAt?: number;
		26	completedAt?: number;
		27	error?: string;
		28	stdout?: string;
		29	stderr?: string;
		30	exitCode?: number;
		31	}
		32
		33	export interface ApprovalRecord {
		34	id: string;
		35	taskId: string;
		36	toolPath: string;
		37	input: unknown;
		38	status: ApprovalStatus;
		39	reason?: string;
		40	reviewerId?: string;
		41	createdAt: number;
		42	resolvedAt?: number;
		43	}
		44
		45	export interface PendingApprovalRecord extends ApprovalRecord {
		46	task: Pick<TaskRecord, "id" \| "status" \| "runtimeId" \| "timeoutMs" \| "createdAt">;
		47	}
		48
		49	export interface TaskEventRecord {
		50	id: number;
		51	taskId: string;
		52	eventName: string;
		53	type: string;
		54	payload: unknown;
		55	createdAt: number;
		56	}
		57
		58	export interface AccessPolicyRecord {
		59	id: string;
		60	workspaceId: string;
		61	actorId?: string;
		62	clientId?: string;
		63	toolPathPattern: string;
		64	decision: PolicyDecision;
		65	priority: number;
		66	createdAt: number;
		67	updatedAt: number;
		68	}
		69
		70	export interface CredentialRecord {
		71	id: string;
		72	workspaceId: string;
		73	sourceKey: string;
		74	scope: CredentialScope;
		75	actorId?: string;
		76	provider: CredentialProvider;
		77	secretJson: Record<string, unknown>;
		78	createdAt: number;
		79	updatedAt: number;
		80	}
		81
		82	export interface ToolSourceRecord {
		83	id: string;
		84	workspaceId: string;
		85	name: string;
		86	type: ToolSourceType;
		87	config: Record<string, unknown>;
		88	enabled: boolean;
		89	createdAt: number;
		90	updatedAt: number;
		91	}
		92
		93	export interface ToolDescriptor {
		94	path: string;
		95	description: string;
		96	approval: ToolApprovalMode;
		97	source?: string;
		98	argsType?: string;
		99	returnsType?: string;
		100	operationId?: string;
		101	}
		102
		103	export interface OpenApiSourceQuality {
		104	sourceKey: string;
		105	toolCount: number;
		106	unknownArgsCount: number;
		107	unknownReturnsCount: number;
		108	partialUnknownArgsCount: number;
		109	partialUnknownReturnsCount: number;
		110	argsQuality: number;
		111	returnsQuality: number;
		112	overallQuality: number;
		113	}
		114
		115	export interface AnonymousContext {
		116	sessionId: string;
		117	workspaceId: Id<"workspaces">;
		118	actorId: string;
		119	clientId: string;
		120	accountId: string;
		121	userId: string;
		122	createdAt: number;
		123	lastSeenAt: number;
		124	}
23		125
24	import type { TaskStatus, ApprovalStatus, CredentialScope } from "@executor/contracts";	126	// ── Web-only types ────────────────────────────────────────────────────────────
25		127
26	export type ApprovalDecision = "approved" \| "denied";	128	export type ApprovalDecision = "approved" \| "denied";
27		129

executor/convex/_generated/api.d.ts+72−45

         secretJson: any;
         sessionId?: string;
         sourceKey: string;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
         id: string;
         prompt: string;
         requesterId: string;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
         runtimeId?: string;
         sessionId?: string;
         timeoutMs?: number;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
         reason?: string;
         reviewerId?: string;
         sessionId?: string;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
         actorId?: string;
         clientId?: string;
         sessionId?: string;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
         actorId?: string;
         clientId?: string;
         sessionId?: string;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
     deleteToolSource: FunctionReference<
       "mutation",
       "public",
-      { sessionId?: string; sourceId: string; workspaceId: string },
+      { sessionId?: string; sourceId: string; workspaceId: Id<"workspaces"> },
       any
     >;
     getRequestContext: FunctionReference<
       "query",
       "public",
-      { sessionId?: string; workspaceId: string },
+      { sessionId?: string; workspaceId: Id<"workspaces"> },
       any
     >;
     getTask: FunctionReference<
       "query",
       "public",
-      { sessionId?: string; taskId: string; workspaceId: string },
+      { sessionId?: string; taskId: string; workspaceId: Id<"workspaces"> },
       any
     >;
     getTaskInWorkspace: FunctionReference<
       "query",
       "public",
-      { sessionId?: string; taskId: string; workspaceId: string },
+      { sessionId?: string; taskId: string; workspaceId: Id<"workspaces"> },
       any
     >;
     listAccessPolicies: FunctionReference<
       "query",
       "public",
-      { sessionId?: string; workspaceId: string },
+      { sessionId?: string; workspaceId: Id<"workspaces"> },
       any
     >;
     listApprovals: FunctionReference<
       {
         sessionId?: string;
         status?: "pending" | "approved" | "denied";
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
     listCredentials: FunctionReference<
       "query",
       "public",
-      { sessionId?: string; workspaceId: string },
+      { sessionId?: string; workspaceId: Id<"workspaces"> },
       any
     >;
     listPendingApprovals: FunctionReference<
       "query",
       "public",
-      { sessionId?: string; workspaceId: string },
+      { sessionId?: string; workspaceId: Id<"workspaces"> },
       any
     >;
     listRuntimeTargets: FunctionReference<"query", "public", {}, any>;
     listTaskEvents: FunctionReference<
       "query",
       "public",
-      { sessionId?: string; taskId: string; workspaceId: string },
+      { sessionId?: string; taskId: string; workspaceId: Id<"workspaces"> },
       any
     >;
     listTasks: FunctionReference<
       "query",
       "public",
-      { sessionId?: string; workspaceId: string },
+      { sessionId?: string; workspaceId: Id<"workspaces"> },
       any
     >;
     listToolSources: FunctionReference<
       "query",
       "public",
-      { sessionId?: string; workspaceId: string },
+      { sessionId?: string; workspaceId: Id<"workspaces"> },
       any
     >;
     resolveCredential: FunctionReference<
         scope: "workspace" | "actor";
         sessionId?: string;
         sourceKey: string;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
         priority?: number;
         sessionId?: string;
         toolPathPattern: string;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
         secretJson: any;
         sessionId?: string;
         sourceKey: string;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
         name: string;
         sessionId?: string;
         type: "mcp" | "openapi" | "graphql";
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
         metadata?: any;
         runtimeId: string;
         timeoutMs?: number;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
     deleteToolSource: FunctionReference<
       "mutation",
       "internal",
-      { sourceId: string; workspaceId: string },
+      { sourceId: string; workspaceId: Id<"workspaces"> },
       any
     >;
     getApproval: FunctionReference<
     getApprovalInWorkspace: FunctionReference<
       "query",
       "internal",
-      { approvalId: string; workspaceId: string },
+      { approvalId: string; workspaceId: Id<"workspaces"> },
       any
     >;
     getTask: FunctionReference<"query", "internal", { taskId: string }, any>;
     getTaskInWorkspace: FunctionReference<
       "query",
       "internal",
-      { taskId: string; workspaceId: string },
+      { taskId: string; workspaceId: Id<"workspaces"> },
       any
     >;
     listAccessPolicies: FunctionReference<
       "query",
       "internal",
-      { workspaceId: string },
+      { workspaceId: Id<"workspaces"> },
       any
     >;
     listApprovals: FunctionReference<
       "query",
       "internal",
-      { status?: "pending" | "approved" | "denied"; workspaceId: string },
+      {
+        status?: "pending" | "approved" | "denied";
+        workspaceId: Id<"workspaces">;
+      },
       any
     >;
     listCredentialProviders: FunctionReference<"query", "internal", {}, any>;
     listCredentials: FunctionReference<
       "query",
       "internal",
-      { workspaceId: string },
+      { workspaceId: Id<"workspaces"> },
       any
     >;
     listPendingApprovals: FunctionReference<
       "query",
       "internal",
-      { workspaceId: string },
+      { workspaceId: Id<"workspaces"> },
       any
     >;
     listQueuedTaskIds: FunctionReference<
     listTasks: FunctionReference<
       "query",
       "internal",
-      { workspaceId: string },
+      { workspaceId: Id<"workspaces"> },
       any
     >;
     listToolSources: FunctionReference<
       "query",
       "internal",
-      { workspaceId: string },
+      { workspaceId: Id<"workspaces"> },
       any
     >;
     markTaskFinished: FunctionReference<
         actorId?: string;
         scope: "workspace" | "actor";
         sourceKey: string;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
         id?: string;
         priority?: number;
         toolPathPattern: string;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
         scope: "workspace" | "actor";
         secretJson: any;
         sourceKey: string;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
         id?: string;
         name: string;
         type: "mcp" | "openapi" | "graphql";
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
         metadata?: any;
         runtimeId?: string;
         timeoutMs?: number;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
         decision: "approved" | "denied";
         reason?: string;
         reviewerId?: string;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;
     listToolsInternal: FunctionReference<
       "action",
       "internal",
-      { actorId?: string; clientId?: string; workspaceId: string },
+      { actorId?: string; clientId?: string; workspaceId: Id<"workspaces"> },
       any
     >;
     listToolsWithWarningsInternal: FunctionReference<
       "action",
       "internal",
-      { actorId?: string; clientId?: string; workspaceId: string },
+      { actorId?: string; clientId?: string; workspaceId: Id<"workspaces"> },
       any
     >;
     runTask: FunctionReference<"action", "internal", { taskId: string }, any>;
     >;
   };
   migrations: {
+    backfillDtsStorageIds: FunctionReference<
+      "mutation",
+      "internal",
+      {
+        batchSize?: number;
+        cursor?: string | null;
+        dryRun?: boolean;
+        fn?: string;
+        next?: Array<string>;
+      },
+      any
+    >;
     deleteAnonymousSessionsMissingAccountId: FunctionReference<
       "mutation",
       "internal",
       },
       any
     >;
+    deleteAnonymousSessionsMissingUserId: FunctionReference<
+      "mutation",
+      "internal",
+      {
+        batchSize?: number;
+        cursor?: string | null;
+        dryRun?: boolean;
+        fn?: string;
+        next?: Array<string>;
+      },
+      any
+    >;
     deleteInvitesMissingProvider: FunctionReference<
       "mutation",
       "internal",
     getWorkspaceAccessForRequest: FunctionReference<
       "query",
       "internal",
-      { sessionId?: string; workspaceId: string },
+      { sessionId?: string; workspaceId: Id<"workspaces"> },
       any
     >;
     getWorkspaceAccessForWorkosSubject: FunctionReference<
       "query",
       "internal",
-      { subject: string; workspaceId: string },
+      { subject: string; workspaceId: Id<"workspaces"> },
       any
     >;
   };
     getDtsStorageIds: FunctionReference<
       "query",
       "internal",
-      { workspaceId: string },
+      { workspaceId: Id<"workspaces"> },
       any
     >;
     getEntry: FunctionReference<
       "query",
       "internal",
-      { signature: string; workspaceId: string },
+      { signature: string; workspaceId: Id<"workspaces"> },
       any
     >;
     putEntry: FunctionReference<
       "mutation",
       "internal",
       {
-        dtsStorageIds?: Array<{ sourceKey: string; storageId: Id<"_storage"> }>;
+        dtsStorageIds: Array<{ sourceKey: string; storageId: Id<"_storage"> }>;
         signature: string;
         sizeBytes: number;
         storageId: Id<"_storage">;
         toolCount: number;
-        workspaceId: string;
+        workspaceId: Id<"workspaces">;
       },
       any
     >;

executor/convex/access-controls.test.ts+31−35

   });
 }
-function asWorkspaceId(id: Id<"workspaces">): string {
-  return id as unknown as string;
-}
 // ---------------------------------------------------------------------------
 // Tests
 // ---------------------------------------------------------------------------
     await expect(
       t.query(api.workspace.listTasks, {
-        workspaceId: asWorkspaceId(owner.workspaceId),
+        workspaceId: owner.workspaceId,
       }),
     ).rejects.toThrow("Must be signed in");
   });
     await expect(
       t.mutation(api.workspace.upsertAccessPolicy, {
-        workspaceId: asWorkspaceId(owner.workspaceId),
+        workspaceId: owner.workspaceId,
         toolPathPattern: "*",
         decision: "allow",
       }),
     await expect(
       t.mutation(api.executor.createTask, {
-        workspaceId: asWorkspaceId(owner.workspaceId),
+        workspaceId: owner.workspaceId,
         code: "console.log('hello')",
       }),
     ).rejects.toThrow("Must be signed in");
     const authed = t.withIdentity({ subject: "user-ok" });
     const tasks = await authed.query(api.workspace.listTasks, {
-      workspaceId: asWorkspaceId(owner.workspaceId),
+      workspaceId: owner.workspaceId,
     });
     expect(tasks).toEqual([]);
     const authedMember = t.withIdentity({ subject: "ws-member" });
     const tasks = await authedMember.query(api.workspace.listTasks, {
-      workspaceId: asWorkspaceId(owner.workspaceId),
+      workspaceId: owner.workspaceId,
     });
     expect(tasks).toEqual([]);
     const authedMember = t.withIdentity({ subject: "ws-member-org-fallback" });
     const tasks = await authedMember.query(api.workspace.listTasks, {
-      workspaceId: asWorkspaceId(owner.workspaceId),
+      workspaceId: owner.workspaceId,
     });
     expect(tasks).toEqual([]);
     await expect(
       authedOutsider.query(api.workspace.listTasks, {
-        workspaceId: asWorkspaceId(owner.workspaceId),
+        workspaceId: owner.workspaceId,
       }),
     ).rejects.toThrow("You are not a member of this workspace");
   });
     await expect(
       authedRemoved.query(api.workspace.listTasks, {
-        workspaceId: asWorkspaceId(owner.workspaceId),
+        workspaceId: owner.workspaceId,
       }),
     ).rejects.toThrow("You are not a member of this workspace");
   });
     await expect(
       authedMember.mutation(api.workspace.upsertAccessPolicy, {
-        workspaceId: asWorkspaceId(owner.workspaceId),
+        workspaceId: owner.workspaceId,
         toolPathPattern: "*",
         decision: "allow",
       }),
     const authedAdmin = t.withIdentity({ subject: "ws-policy-admin" });
     const policy = await authedAdmin.mutation(api.workspace.upsertAccessPolicy, {
-      workspaceId: asWorkspaceId(owner.workspaceId),
+      workspaceId: owner.workspaceId,
       toolPathPattern: "*.delete",
       decision: "require_approval",
     });
     const authedOwner = t.withIdentity({ subject: "ws-owner-policy" });
     const policy = await authedOwner.mutation(api.workspace.upsertAccessPolicy, {
-      workspaceId: asWorkspaceId(owner.workspaceId),
+      workspaceId: owner.workspaceId,
       toolPathPattern: "*",
       decision: "allow",
     });
     await expect(
       authedMember.mutation(api.workspace.upsertCredential, {
-        workspaceId: asWorkspaceId(owner.workspaceId),
+        workspaceId: owner.workspaceId,
         sourceKey: "openapi:github",
         scope: "workspace",
         secretJson: { token: "ghp_test" },
     await expect(
       authedMember.mutation(api.workspace.upsertToolSource, {
-        workspaceId: asWorkspaceId(owner.workspaceId),
+        workspaceId: owner.workspaceId,
         name: "my-tool",
         type: "mcp",
         config: { url: "https://example.com" },
     await expect(
       authedMember.mutation(api.workspace.deleteToolSource, {
-        workspaceId: asWorkspaceId(owner.workspaceId),
+        workspaceId: owner.workspaceId,
         sourceId: "src_nonexistent",
       }),
     ).rejects.toThrow("Only workspace admins can perform this action");
     const authedMember = t.withIdentity({ subject: "read-policy-member" });
     const policies = await authedMember.query(api.workspace.listAccessPolicies, {
-      workspaceId: asWorkspaceId(owner.workspaceId),
+      workspaceId: owner.workspaceId,
     });
     expect(policies).toEqual([]);
     const authedMember = t.withIdentity({ subject: "read-ts-member" });
     const sources = await authedMember.query(api.workspace.listToolSources, {
-      workspaceId: asWorkspaceId(owner.workspaceId),
+      workspaceId: owner.workspaceId,
     });
     expect(sources).toEqual([]);
     // User A tries to read User B's workspace
     await expect(
       authedA.query(api.workspace.listTasks, {
-        workspaceId: asWorkspaceId(userB.workspaceId),
+        workspaceId: userB.workspaceId,
       }),
     ).rejects.toThrow("You are not a member of this workspace");
   });
     await expect(
       authedA.mutation(api.executor.createTask, {
-        workspaceId: asWorkspaceId(userB.workspaceId),
+        workspaceId: userB.workspaceId,
         code: "console.log('pwned')",
       }),
     ).rejects.toThrow("You are not a member of this workspace");
     await expect(
       authedA.mutation(api.workspace.upsertAccessPolicy, {
-        workspaceId: asWorkspaceId(userB.workspaceId),
+        workspaceId: userB.workspaceId,
         toolPathPattern: "*",
         decision: "allow",
       }),
     await expect(
       authed.query(api.workspace.listTasks, {
-        workspaceId: "invalid_workspace_id",
+        workspaceId: "invalid_workspace_id" as Id<"workspaces">,
       }),
     ).rejects.toThrow();
   });
     const authed = t.withIdentity({ subject: "task-creator" });
     const result = await authed.mutation(api.executor.createTask, {
-      workspaceId: asWorkspaceId(user.workspaceId),
+      workspaceId: user.workspaceId,
       code: "console.log('hello')",
     });
     expect(result.task.status).toBe("queued");
-    expect(result.task.workspaceId).toBe(asWorkspaceId(user.workspaceId));
+    expect(result.task.workspaceId).toBe(user.workspaceId);
   });
   test("task is scoped to workspace and visible to members", async () => {
     // Owner creates a task
     const authedOwner = t.withIdentity({ subject: "task-scope-owner" });
     await authedOwner.mutation(api.executor.createTask, {
-      workspaceId: asWorkspaceId(owner.workspaceId),
+      workspaceId: owner.workspaceId,
       code: "1 + 1",
     });
     // Member can see it
     const authedMember = t.withIdentity({ subject: "task-scope-member" });
     const tasks = await authedMember.query(api.workspace.listTasks, {
-      workspaceId: asWorkspaceId(owner.workspaceId),
+      workspaceId: owner.workspaceId,
     });
     expect(tasks.length).toBe(1);
     // Owner creates a task
     const authedOwner = t.withIdentity({ subject: "task-vis-owner" });
     await authedOwner.mutation(api.executor.createTask, {
-      workspaceId: asWorkspaceId(owner.workspaceId),
+      workspaceId: owner.workspaceId,
       code: "secret code",
     });
     await expect(
       authedOutsider.query(api.workspace.listTasks, {
-        workspaceId: asWorkspaceId(owner.workspaceId),
+        workspaceId: owner.workspaceId,
       }),
     ).rejects.toThrow("You are not a member of this workspace");
   });
     // Create a credential via admin
     await authed.mutation(api.workspace.upsertCredential, {
-      workspaceId: asWorkspaceId(owner.workspaceId),
+      workspaceId: owner.workspaceId,
       sourceKey: "openapi:stripe",
       scope: "workspace",
       secretJson: { token: "sk_live_super_secret" },
     // List should redact
     const credentials = await authed.query(api.workspace.listCredentials, {
-      workspaceId: asWorkspaceId(owner.workspaceId),
+      workspaceId: owner.workspaceId,
     });
     expect(credentials.length).toBe(1);
     await expect(
       authedMember.query(api.workspace.resolveCredential, {
-        workspaceId: asWorkspaceId(owner.workspaceId),
+        workspaceId: owner.workspaceId,
         sourceKey: "openapi:github",
         scope: "workspace",
       }),
     // Admin can upsert access policies
     const policy = await authed.mutation(api.workspace.upsertAccessPolicy, {
-      workspaceId: asWorkspaceId(org.workspaceId),
+      workspaceId: org.workspaceId,
       toolPathPattern: "admin.*",
       decision: "deny",
     });
     // Admin can upsert tool sources
     const source = await authed.mutation(api.workspace.upsertToolSource, {
-      workspaceId: asWorkspaceId(org.workspaceId),
+      workspaceId: org.workspaceId,
       name: "admin-tool",
       type: "mcp",
       config: { url: "https://example.com" },

executor/convex/accounts.ts+7−9

     return false;
   }
-  const workspaceKey = String(workspaceId);
   const taskDocs = await ctx.db
     .query("tasks")
-    .withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceKey))
+    .withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceId))
     .collect();
   for (const task of taskDocs) {
     const taskEvents = await ctx.db
   const approvalDocs = await ctx.db
     .query("approvals")
-    .withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceKey))
+    .withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceId))
     .collect();
   for (const approval of approvalDocs) {
     await ctx.db.delete(approval._id);
   const policyDocs = await ctx.db
     .query("accessPolicies")
-    .withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceKey))
+    .withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceId))
     .collect();
   for (const policy of policyDocs) {
     await ctx.db.delete(policy._id);
   const credentialDocs = await ctx.db
     .query("sourceCredentials")
-    .withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceKey))
+    .withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceId))
     .collect();
   for (const credential of credentialDocs) {
     await ctx.db.delete(credential._id);
   const toolSources = await ctx.db
     .query("toolSources")
-    .withIndex("by_workspace_updated", (q) => q.eq("workspaceId", workspaceKey))
+    .withIndex("by_workspace_updated", (q) => q.eq("workspaceId", workspaceId))
     .collect();
   for (const source of toolSources) {
     await ctx.db.delete(source._id);
   const agentTasks = await ctx.db
     .query("agentTasks")
-    .withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceKey))
+    .withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceId))
     .collect();
   for (const agentTask of agentTasks) {
     await ctx.db.delete(agentTask._id);
   const cachedToolsets = await ctx.db
     .query("workspaceToolCache")
-    .withIndex("by_workspace", (q) => q.eq("workspaceId", workspaceKey))
+    .withIndex("by_workspace", (q) => q.eq("workspaceId", workspaceId))
     .collect();
   for (const cacheEntry of cachedToolsets) {
     await ctx.storage.delete(cacheEntry.storageId).catch(() => {});

executor/convex/credentialsNode.ts+1−1

@@ -141,7 +141,7 @@ async function upsertVaultObject(args: { · 140 unmodified lines
141	export const upsertCredential = action({	141	export const upsertCredential = action({
142	args: {	142	args: {
143	id: v.optional(v.string()),	143	id: v.optional(v.string()),
144	workspaceId: v.string(),	144	workspaceId: v.id("workspaces"),
145	sessionId: v.optional(v.string()),	145	sessionId: v.optional(v.string()),
146	sourceKey: v.string(),	146	sourceKey: v.string(),
147	scope: credentialScopeValidator,	147	scope: credentialScopeValidator,

executor/convex/database.test.ts+35−9

 import { expect, test } from "bun:test";
 import { convexTest } from "convex-test";
 import { internal } from "./_generated/api";
+import type { Id } from "./_generated/dataModel";
 import schema from "./schema";
 function setup() {
   });
 }
+/** Insert a minimal workspace row and return its Id. */
+async function seedWorkspace(t: ReturnType<typeof setup>, name = "test-ws"): Promise<Id<"workspaces">> {
+  return await t.run(async (ctx) => {
+    const orgId = await ctx.db.insert("organizations", {
+      name: `${name}-org`,
+      slug: `${name}-org`,
+      status: "active",
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+    });
+    return await ctx.db.insert("workspaces", {
+      name,
+      slug: name,
+      organizationId: orgId,
+      plan: "free",
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+    });
+  });
+}
 test("task lifecycle supports queue, run, and complete", async () => {
   const t = setup();
+  const wsId = await seedWorkspace(t, "ws_1");
   const created = await t.mutation(internal.database.createTask, {
     id: "task_1",
     code: "console.log('hello')",
     runtimeId: "local-bun",
-    workspaceId: "ws_1",
+    workspaceId: wsId,
     actorId: "actor_1",
     clientId: "web",
   });
 test("approval lifecycle tracks pending and resolution", async () => {
   const t = setup();
+  const wsId = await seedWorkspace(t, "ws_2");
   await t.mutation(internal.database.createTask, {
     id: "task_2",
     code: "await tools.admin.delete_data({ id: 'x' })",
     runtimeId: "local-bun",
-    workspaceId: "ws_2",
+    workspaceId: wsId,
     actorId: "actor_2",
     clientId: "web",
   });
   });
   expect(createdApproval.status).toBe("pending");
-  const pending = await t.query(internal.database.listPendingApprovals, { workspaceId: "ws_2" });
+  const pending = await t.query(internal.database.listPendingApprovals, { workspaceId: wsId });
   expect(pending.length).toBe(1);
   expect(pending[0]?.task.id).toBe("task_2");
   });
   expect(resolved?.status).toBe("approved");
-  const pendingAfter = await t.query(internal.database.listPendingApprovals, { workspaceId: "ws_2" });
+  const pendingAfter = await t.query(internal.database.listPendingApprovals, { workspaceId: wsId });
   expect(pendingAfter).toEqual([]);
 });
 test("credentials persist provider and resolve by scope", async () => {
   const t = setup();
+  const wsId = await seedWorkspace(t, "ws_cred");
   const workspaceCredential = await t.mutation(internal.database.upsertCredential, {
-    workspaceId: "ws_cred",
+    workspaceId: wsId,
     sourceKey: "openapi:github",
     scope: "workspace",
     provider: "managed",
   expect(workspaceCredential.provider).toBe("managed");
   const actorCredential = await t.mutation(internal.database.upsertCredential, {
-    workspaceId: "ws_cred",
+    workspaceId: wsId,
     sourceKey: "openapi:github",
     scope: "actor",
     actorId: "actor_cred",
   expect(actorCredential.actorId).toBe("actor_cred");
   const resolvedWorkspace = await t.query(internal.database.resolveCredential, {
-    workspaceId: "ws_cred",
+    workspaceId: wsId,
     sourceKey: "openapi:github",
     scope: "workspace",
   });
   expect(resolvedWorkspace?.provider).toBe("managed");
   const resolvedActor = await t.query(internal.database.resolveCredential, {
-    workspaceId: "ws_cred",
+    workspaceId: wsId,
     sourceKey: "openapi:github",
     scope: "actor",
     actorId: "actor_cred",
 test("upsertCredential defaults provider to managed", async () => {
   const t = setup();
+  const wsId = await seedWorkspace(t, "ws_default_provider");
   const credential = await t.mutation(internal.database.upsertCredential, {
-    workspaceId: "ws_default_provider",
+    workspaceId: wsId,
     sourceKey: "openapi:stripe",
     scope: "workspace",
     secretJson: { token: "sk_test_123" },

executor/convex/database.ts+16−16

@@ -5,7 +5,7 @@ query, · 4 unmodified lines
5	type MutationCtx, type QueryCtx } from "./_generated/server";	5	type MutationCtx, type QueryCtx } from "./_generated/server";
6	import { internalMutation, internalQuery } from "./_generated/server";	6	import { internalMutation, internalQuery } from "./_generated/server";
7	import { ensureUniqueSlug } from "../lib/slug";	7	import { ensureUniqueSlug } from "../lib/slug";
8	import type { TaskStatus } from "@executor/contracts";	8	import type { TaskStatus } from "../lib/types";
9		9
10	const DEFAULT_TIMEOUT_MS = 300_000;	10	const DEFAULT_TIMEOUT_MS = 300_000;
11	type OrganizationRole = "owner" \| "admin" \| "member" \| "billing_admin";	11	type OrganizationRole = "owner" \| "admin" \| "member" \| "billing_admin";
@@ -335,7 +335,7 @@ export const createTask = internalMutation({ · 323 unmodified lines
335	runtimeId: v.string(),	335	runtimeId: v.string(),
336	timeoutMs: v.optional(v.number()),	336	timeoutMs: v.optional(v.number()),
337	metadata: v.optional(v.any()),	337	metadata: v.optional(v.any()),
338	workspaceId: v.string(),	338	workspaceId: v.id("workspaces"),
339	actorId: v.string(),	339	actorId: v.string(),
340	clientId: v.optional(v.string()),	340	clientId: v.optional(v.string()),
341	},	341	},
@@ -377,7 +377,7 @@ export const getTask = internalQuery({ · 35 unmodified lines
377	});	377	});
378		378
379	export const listTasks = internalQuery({	379	export const listTasks = internalQuery({
380	args: { workspaceId: v.string() },	380	args: { workspaceId: v.id("workspaces") },
381	handler: async (ctx, args) => {	381	handler: async (ctx, args) => {
382	const docs = await ctx.db	382	const docs = await ctx.db
383	.query("tasks")	383	.query("tasks")
@@ -415,7 +415,7 @@ export const listRuntimeTargets = internalQuery({ · 31 unmodified lines
415	});	415	});
416		416
417	export const getTaskInWorkspace = internalQuery({	417	export const getTaskInWorkspace = internalQuery({
418	args: { taskId: v.string(), workspaceId: v.string() },	418	args: { taskId: v.string(), workspaceId: v.id("workspaces") },
419	handler: async (ctx, args) => {	419	handler: async (ctx, args) => {
420	const doc = await getTaskDoc(ctx, args.taskId);	420	const doc = await getTaskDoc(ctx, args.taskId);
421	if (!doc \|\| doc.workspaceId !== args.workspaceId) {	421	if (!doc \|\| doc.workspaceId !== args.workspaceId) {
@@ -523,7 +523,7 @@ export const getApproval = internalQuery({ · 101 unmodified lines
523		523
524	export const listApprovals = internalQuery({	524	export const listApprovals = internalQuery({
525	args: {	525	args: {
526	workspaceId: v.string(),	526	workspaceId: v.id("workspaces"),
527	status: v.optional(approvalStatusValidator),	527	status: v.optional(approvalStatusValidator),
528	},	528	},
529	handler: async (ctx, args) => {	529	handler: async (ctx, args) => {
@@ -549,7 +549,7 @@ export const listApprovals = internalQuery({ · 19 unmodified lines
549	});	549	});
550		550
551	export const listPendingApprovals = internalQuery({	551	export const listPendingApprovals = internalQuery({
552	args: { workspaceId: v.string() },	552	args: { workspaceId: v.id("workspaces") },
553	handler: async (ctx, args) => {	553	handler: async (ctx, args) => {
554	const docs = await ctx.db	554	const docs = await ctx.db
555	.query("approvals")	555	.query("approvals")
@@ -616,7 +616,7 @@ export const resolveApproval = internalMutation({ · 60 unmodified lines
616	});	616	});
617		617
618	export const getApprovalInWorkspace = internalQuery({	618	export const getApprovalInWorkspace = internalQuery({
619	args: { approvalId: v.string(), workspaceId: v.string() },	619	args: { approvalId: v.string(), workspaceId: v.id("workspaces") },
620	handler: async (ctx, args) => {	620	handler: async (ctx, args) => {
621	const doc = await getApprovalDoc(ctx, args.approvalId);	621	const doc = await getApprovalDoc(ctx, args.approvalId);
622	if (!doc \|\| doc.workspaceId !== args.workspaceId) {	622	if (!doc \|\| doc.workspaceId !== args.workspaceId) {
@@ -656,7 +656,7 @@ export const createAgentTask = mutation({ · 33 unmodified lines
656	id: v.string(),	656	id: v.string(),
657	prompt: v.string(),	657	prompt: v.string(),
658	requesterId: v.string(),	658	requesterId: v.string(),
659	workspaceId: v.string(),	659	workspaceId: v.id("workspaces"),
660	actorId: v.string(),	660	actorId: v.string(),
661	},	661	},
662	handler: async (ctx, args) => {	662	handler: async (ctx, args) => {
@@ -796,7 +796,7 @@ export const bootstrapAnonymousSession = internalMutation({ · 133 unmodified lines
796	export const upsertAccessPolicy = internalMutation({	796	export const upsertAccessPolicy = internalMutation({
797	args: {	797	args: {
798	id: v.optional(v.string()),	798	id: v.optional(v.string()),
799	workspaceId: v.string(),	799	workspaceId: v.id("workspaces"),
800	actorId: v.optional(v.string()),	800	actorId: v.optional(v.string()),
801	clientId: v.optional(v.string()),	801	clientId: v.optional(v.string()),
802	toolPathPattern: v.string(),	802	toolPathPattern: v.string(),
@@ -847,7 +847,7 @@ export const upsertAccessPolicy = internalMutation({ · 44 unmodified lines
847	});	847	});
848		848
849	export const listAccessPolicies = internalQuery({	849	export const listAccessPolicies = internalQuery({
850	args: { workspaceId: v.string() },	850	args: { workspaceId: v.id("workspaces") },
851	handler: async (ctx, args) => {	851	handler: async (ctx, args) => {
852	const docs = await ctx.db	852	const docs = await ctx.db
853	.query("accessPolicies")	853	.query("accessPolicies")
@@ -868,7 +868,7 @@ export const listAccessPolicies = internalQuery({ · 14 unmodified lines
868	export const upsertCredential = internalMutation({	868	export const upsertCredential = internalMutation({
869	args: {	869	args: {
870	id: v.optional(v.string()),	870	id: v.optional(v.string()),
871	workspaceId: v.string(),	871	workspaceId: v.id("workspaces"),
872	sourceKey: v.string(),	872	sourceKey: v.string(),
873	scope: credentialScopeValidator,	873	scope: credentialScopeValidator,
874	actorId: v.optional(v.string()),	874	actorId: v.optional(v.string()),
@@ -932,7 +932,7 @@ export const upsertCredential = internalMutation({ · 57 unmodified lines
932	});	932	});
933		933
934	export const listCredentials = internalQuery({	934	export const listCredentials = internalQuery({
935	args: { workspaceId: v.string() },	935	args: { workspaceId: v.id("workspaces") },
936	handler: async (ctx, args) => {	936	handler: async (ctx, args) => {
937	const docs = await ctx.db	937	const docs = await ctx.db
938	.query("sourceCredentials")	938	.query("sourceCredentials")
@@ -963,7 +963,7 @@ export const listCredentialProviders = internalQuery({ · 24 unmodified lines
963		963
964	export const resolveCredential = internalQuery({	964	export const resolveCredential = internalQuery({
965	args: {	965	args: {
966	workspaceId: v.string(),	966	workspaceId: v.id("workspaces"),
967	sourceKey: v.string(),	967	sourceKey: v.string(),
968	scope: credentialScopeValidator,	968	scope: credentialScopeValidator,
969	actorId: v.optional(v.string()),	969	actorId: v.optional(v.string()),
@@ -1007,7 +1007,7 @@ export const resolveCredential = internalQuery({ · 37 unmodified lines
1007	export const upsertToolSource = internalMutation({	1007	export const upsertToolSource = internalMutation({
1008	args: {	1008	args: {
1009	id: v.optional(v.string()),	1009	id: v.optional(v.string()),
1010	workspaceId: v.string(),	1010	workspaceId: v.id("workspaces"),
1011	name: v.string(),	1011	name: v.string(),
1012	type: toolSourceTypeValidator,	1012	type: toolSourceTypeValidator,
1013	config: v.any(),	1013	config: v.any(),
@@ -1065,7 +1065,7 @@ export const upsertToolSource = internalMutation({ · 51 unmodified lines
1065	});	1065	});
1066		1066
1067	export const listToolSources = internalQuery({	1067	export const listToolSources = internalQuery({
1068	args: { workspaceId: v.string() },	1068	args: { workspaceId: v.id("workspaces") },
1069	handler: async (ctx, args) => {	1069	handler: async (ctx, args) => {
1070	const docs = await ctx.db	1070	const docs = await ctx.db
1071	.query("toolSources")	1071	.query("toolSources")
@@ -1077,7 +1077,7 @@ export const listToolSources = internalQuery({ · 5 unmodified lines
1077	});	1077	});
1078		1078
1079	export const deleteToolSource = internalMutation({	1079	export const deleteToolSource = internalMutation({
1080	args: { workspaceId: v.string(), sourceId: v.string() },	1080	args: { workspaceId: v.id("workspaces"), sourceId: v.string() },
1081	handler: async (ctx, args) => {	1081	handler: async (ctx, args) => {
1082	const doc = await ctx.db	1082	const doc = await ctx.db
1083	.query("toolSources")	1083	.query("toolSources")

executor/convex/executor-mcp.e2e.test.ts+3−2

 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { ElicitRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import { internal } from "./_generated/api";
+import type { Id } from "./_generated/dataModel";
 import schema from "./schema";
 function setup() {
 async function waitForTaskId(t: ReturnType<typeof setup>, workspaceId: string, timeoutMs = 10_000): Promise<string> {
   const start = Date.now();
   while (Date.now() - start < timeoutMs) {
-    const tasks = await t.query(internal.database.listTasks, { workspaceId });
+    const tasks = await t.query(internal.database.listTasks, { workspaceId: workspaceId as Id<"workspaces"> });
     if (tasks.length > 0) {
       return tasks[0]!.id;
     }
 ): Promise<string> {
   const start = Date.now();
   while (Date.now() - start < timeoutMs) {
-    const approvals = await t.query(internal.database.listPendingApprovals, { workspaceId });
+    const approvals = await t.query(internal.database.listPendingApprovals, { workspaceId: workspaceId as Id<"workspaces"> });
     const approval = approvals.find((item: { toolPath: string; id: string }) => item.toolPath === toolPath);
     if (approval) {
       return approval.id;

executor/convex/executor.ts+5−4

 import { v } from "convex/values";
 import { internal } from "./_generated/api";
+import type { Id } from "./_generated/dataModel";
 import type { MutationCtx } from "./_generated/server";
 import { internalMutation } from "./_generated/server";
 import { workspaceMutation } from "../lib/functionBuilders";
     timeoutMs?: number;
     runtimeId?: string;
     metadata?: unknown;
-    workspaceId: string;
+    workspaceId: Id<"workspaces">;
     actorId: string;
     clientId?: string;
   },
 async function resolveApprovalRecord(
   ctx: MutationCtx,
   args: {
-    workspaceId: string;
+    workspaceId: Id<"workspaces">;
     approvalId: string;
     decision: "approved" | "denied";
     reviewerId?: string;
     timeoutMs: v.optional(v.number()),
     runtimeId: v.optional(v.string()),
     metadata: v.optional(v.any()),
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
     actorId: v.string(),
     clientId: v.optional(v.string()),
   },
 export const resolveApprovalInternal = internalMutation({
   args: {
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
     approvalId: v.string(),
     decision: v.union(v.literal("approved"), v.literal("denied")),
     reviewerId: v.optional(v.string()),

executor/convex/executorNode.ts+4−6

     operationId: tool.metadata?.operationId,
     // Note: sourceDts is NOT included — it's too large to send over the wire.
     // Monaco fetches .d.ts blobs separately via Convex storage URLs.
-    // Legacy compat
-    schemaTypes: tool.metadata?.schemaTypes,
   };
 }
 export const listTools = action({
   args: {
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
     actorId: v.optional(v.string()),
     clientId: v.optional(v.string()),
     sessionId: v.optional(v.string()),
 export const listToolsWithWarnings = action({
   args: {
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
     actorId: v.optional(v.string()),
     clientId: v.optional(v.string()),
     sessionId: v.optional(v.string()),
 export const listToolsInternal = internalAction({
   args: {
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
     actorId: v.optional(v.string()),
     clientId: v.optional(v.string()),
   },
 export const listToolsWithWarningsInternal = internalAction({
   args: {
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
     actorId: v.optional(v.string()),
     clientId: v.optional(v.string()),
   },

executor/convex/http.ts+15−8

 import { authKit } from "./auth";
 import { handleMcpRequest, type McpWorkspaceContext } from "../lib/mcp_server";
 import type { AnonymousContext, PendingApprovalRecord, TaskRecord, ToolDescriptor } from "../lib/types";
+import type { Id } from "./_generated/dataModel";
 const http = httpRouter();
 const internalToken = process.env.EXECUTOR_INTERNAL_TOKEN ?? null;
     try {
       if (mcpAuthConfig.enabled && auth?.subject) {
         const access = await ctx.runQuery(internal.workspaceAuthInternal.getWorkspaceAccessForWorkosSubject, {
-          workspaceId: requestedContext.workspaceId,
+          workspaceId: requestedContext.workspaceId as Id<"workspaces">,
           subject: auth.subject,
         });
         }
         const access = await ctx.runQuery(internal.workspaceAuthInternal.getWorkspaceAccessForRequest, {
-          workspaceId: requestedContext.workspaceId,
+          workspaceId: requestedContext.workspaceId as Id<"workspaces">,
           sessionId: requestedContext.sessionId,
         });
       actorId: string;
       clientId?: string;
     }) => {
-      return (await ctx.runMutation(internal.executor.createTaskInternal, input)) as { task: TaskRecord };
+      return (await ctx.runMutation(internal.executor.createTaskInternal, {
+        ...input,
+        workspaceId: input.workspaceId as Id<"workspaces">,
+      })) as { task: TaskRecord };
     },
     getTask: async (taskId: string, workspaceId?: string) => {
       if (workspaceId) {
-        return (await ctx.runQuery(internal.database.getTaskInWorkspace, { taskId, workspaceId })) as TaskRecord | null;
+        return (await ctx.runQuery(internal.database.getTaskInWorkspace, { taskId, workspaceId: workspaceId as Id<"workspaces"> })) as TaskRecord | null;
       }
       return null;
     },
         return [];
       }
-      return (await ctx.runAction(internal.executorNode.listToolsInternal, toolContext)) as ToolDescriptor[];
+      return (await ctx.runAction(internal.executorNode.listToolsInternal, { ...toolContext, workspaceId: toolContext.workspaceId as Id<"workspaces"> })) as ToolDescriptor[];
     },
     listToolsForTypecheck: async (toolContext: { workspaceId: string; actorId?: string; clientId?: string }) => {
-      const result = await ctx.runAction(internal.executorNode.listToolsWithWarningsInternal, toolContext) as {
+      const result = await ctx.runAction(internal.executorNode.listToolsWithWarningsInternal, { ...toolContext, workspaceId: toolContext.workspaceId as Id<"workspaces"> }) as {
         tools: ToolDescriptor[];
         dtsUrls?: Record<string, string>;
       };
       };
     },
     listPendingApprovals: async (workspaceId: string) => {
-      return (await ctx.runQuery(internal.database.listPendingApprovals, { workspaceId })) as PendingApprovalRecord[];
+      return (await ctx.runQuery(internal.database.listPendingApprovals, { workspaceId: workspaceId as Id<"workspaces"> })) as PendingApprovalRecord[];
     },
     resolveApproval: async (input: {
       workspaceId: string;
       reviewerId?: string;
       reason?: string;
     }) => {
-      return await ctx.runMutation(internal.executor.resolveApprovalInternal, input);
+      return await ctx.runMutation(internal.executor.resolveApprovalInternal, {
+        ...input,
+        workspaceId: input.workspaceId as Id<"workspaces">,
+      });
     },
   };

executor/convex/migrations.ts+20−0

@@ -92,4 +92,24 @@ export const deleteInvitesMissingProvider = migrations.define({ · 91 unmodified lines
92	},	92	},
93	});	93	});
94		94
		95	export const deleteAnonymousSessionsMissingUserId = migrations.define({
		96	table: "anonymousSessions",
		97	migrateOne: async (ctx, session) => {
		98	if (session.userId) {
		99	return;
		100	}
		101
		102	await ctx.db.delete(session._id);
		103	},
		104	});
		105
		106	export const backfillDtsStorageIds = migrations.define({
		107	table: "workspaceToolCache",
		108	migrateOne: async (_ctx, entry) => {
		109	if (entry.dtsStorageIds === undefined) {
		110	return { dtsStorageIds: [] };
		111	}
		112	},
		113	});
		114
95	export const run = migrations.runner();	115	export const run = migrations.runner();

executor/convex/package.json+7−0

@@ -0,0 +1,7 @@
	1	{
	2	"name": "@executor/convex",
	3	"version": "0.0.1",
	4	"private": true,
	5	"main": "./_generated/api.js",
	6	"types": "./_generated/api.d.ts"
	7	}

executor/convex/schema.ts+10−25

     taskId: v.string(),
     code: v.string(),
     runtimeId: v.string(),
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
     actorId: v.string(),
     clientId: v.string(),
     status: taskStatus,
   approvals: defineTable({
     approvalId: v.string(),
     taskId: v.string(),
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
     toolPath: v.string(),
     input: v.any(),
     status: approvalStatus,
     .index("by_workspace_created", ["workspaceId", "createdAt"])
     .index("by_workspace_status_created", ["workspaceId", "status", "createdAt"]),
-  pushSubscriptions: defineTable({
-    workspaceId: v.string(),
-    accountId: v.string(),
-    endpoint: v.string(),
-    p256dh: v.string(),
-    auth: v.string(),
-    expirationTime: v.optional(v.number()),
-    userAgent: v.optional(v.string()),
-    createdAt: v.number(),
-    updatedAt: v.number(),
-  })
-    .index("by_workspace_created", ["workspaceId", "createdAt"])
-    .index("by_workspace_account", ["workspaceId", "accountId"])
-    .index("by_endpoint", ["endpoint"]),
   taskEvents: defineTable({
     sequence: v.number(),
     taskId: v.string(),
   accessPolicies: defineTable({
     policyId: v.string(),
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
     actorId: v.string(),
     clientId: v.string(),
     toolPathPattern: v.string(),
   sourceCredentials: defineTable({
     credentialId: v.string(),
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
     sourceKey: v.string(),
     scope: credentialScope,
     actorId: v.string(),
   toolSources: defineTable({
     sourceId: v.string(),
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
     name: v.string(),
     type: toolSourceType,
     config: v.any(),
     agentTaskId: v.string(),
     prompt: v.string(),
     requesterId: v.string(),
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
     actorId: v.string(),
     status: agentTaskStatus,
     resultText: v.optional(v.string()),
     .index("by_spec_url_version", ["specUrl", "version"]),
   workspaceToolCache: defineTable({
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
     signature: v.string(),
     storageId: v.id("_storage"),
     /** Per-source .d.ts blobs stored separately (too large for action responses). */
-    dtsStorageIds: v.optional(v.array(v.object({
+    dtsStorageIds: v.array(v.object({
       sourceKey: v.string(),
       storageId: v.id("_storage"),
-    }))),
+    })),
     toolCount: v.number(),
     sizeBytes: v.number(),
     createdAt: v.number(),
     actorId: v.string(),
     clientId: v.string(),
     accountId: v.id("accounts"),
-    userId: v.optional(v.id("workspaceMembers")),
+    userId: v.id("workspaceMembers"),
     createdAt: v.number(),
     lastSeenAt: v.number(),
   })

executor/convex/workspaceAuthInternal.ts+2−2

@@ -12,7 +12,7 @@ function actorIdForAccount(account: { _id: string; provider: string; providerAcc · 11 unmodified lines
12		12
13	export const getWorkspaceAccessForRequest = internalQuery({	13	export const getWorkspaceAccessForRequest = internalQuery({
14	args: {	14	args: {
15	workspaceId: v.string(),	15	workspaceId: v.id("workspaces"),
16	sessionId: v.optional(v.string()),	16	sessionId: v.optional(v.string()),
17	},	17	},
18	handler: async (ctx, args) => {	18	handler: async (ctx, args) => {
@@ -36,7 +36,7 @@ export const getWorkspaceAccessForRequest = internalQuery({ · 17 unmodified lines
36		36
37	export const getWorkspaceAccessForWorkosSubject = internalQuery({	37	export const getWorkspaceAccessForWorkosSubject = internalQuery({
38	args: {	38	args: {
39	workspaceId: v.string(),	39	workspaceId: v.id("workspaces"),
40	subject: v.string(),	40	subject: v.string(),
41	},	41	},
42	handler: async (ctx, args) => {	42	handler: async (ctx, args) => {

executor/convex/workspaceToolCache.ts+9−11

  */
 export const getEntry = internalQuery({
   args: {
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
     signature: v.string(),
   },
   handler: async (ctx, args) => {
     return {
       storageId: entry.storageId,
-      dtsStorageIds: entry.dtsStorageIds ?? [],
+      dtsStorageIds: entry.dtsStorageIds,
       toolCount: entry.toolCount,
       sizeBytes: entry.sizeBytes,
       createdAt: entry.createdAt,
  */
 export const putEntry = internalMutation({
   args: {
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
     signature: v.string(),
     storageId: v.id("_storage"),
-    dtsStorageIds: v.optional(v.array(v.object({
+    dtsStorageIds: v.array(v.object({
       sourceKey: v.string(),
       storageId: v.id("_storage"),
-    }))),
+    })),
     toolCount: v.number(),
     sizeBytes: v.number(),
   },
       // Delete old main snapshot blob
       await ctx.storage.delete(existing.storageId).catch(() => {});
       // Delete old .d.ts blobs
-      if (existing.dtsStorageIds) {
+      for (const entry of existing.dtsStorageIds) {
-        for (const entry of existing.dtsStorageIds) {
+        await ctx.storage.delete(entry.storageId).catch(() => {});
-          await ctx.storage.delete(entry.storageId).catch(() => {});
-        }
       }
       await ctx.db.delete(existing._id);
     }
  */
 export const getDtsStorageIds = internalQuery({
   args: {
-    workspaceId: v.string(),
+    workspaceId: v.id("workspaces"),
   },
   handler: async (ctx, args) => {
     const entry = await ctx.db
       .unique();
     if (!entry) return [];
-    return entry.dtsStorageIds ?? [];
+    return entry.dtsStorageIds;
   },
 });

executor/convex/workspaces.ts+6−8

   ctx: Pick<QueryCtx, "db"> | Pick<MutationCtx, "db">,
   workspaceId: Id<"workspaces">,
 ): Promise<boolean> {
-  const workspaceIdString = String(workspaceId);
   const [
     task,
     approval,
     agentTask,
     member,
   ] = await Promise.all([
-    ctx.db.query("tasks").withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceIdString)).first(),
+    ctx.db.query("tasks").withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceId)).first(),
-    ctx.db.query("approvals").withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceIdString)).first(),
+    ctx.db.query("approvals").withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceId)).first(),
-    ctx.db.query("accessPolicies").withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceIdString)).first(),
+    ctx.db.query("accessPolicies").withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceId)).first(),
     ctx.db
       .query("sourceCredentials")
-      .withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceIdString))
+      .withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceId))
       .first(),
-    ctx.db.query("toolSources").withIndex("by_workspace_updated", (q) => q.eq("workspaceId", workspaceIdString)).first(),
+    ctx.db.query("toolSources").withIndex("by_workspace_updated", (q) => q.eq("workspaceId", workspaceId)).first(),
-    ctx.db.query("agentTasks").withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceIdString)).first(),
+    ctx.db.query("agentTasks").withIndex("by_workspace_created", (q) => q.eq("workspaceId", workspaceId)).first(),
     ctx.db.query("workspaceMembers").withIndex("by_workspace", (q) => q.eq("workspaceId", workspaceId)).first(),
   ]);

executor/lib/credential-providers.test.ts+0−9

@@ -46,15 +46,6 @@ test("WorkOS Vault provider falls back to id key and raw token", async () => { · 45 unmodified lines
46	expect(payload).toEqual({ token: "ghp_raw_token" });	46	expect(payload).toEqual({ token: "ghp_raw_token" });
47	});	47	});
48		48
49	test("WorkOS Vault provider supports legacy inline payload", async () => {
50	const payload = await resolveCredentialPayload({
51	provider: "workos-vault",
52	secretJson: { token: "legacy-token" },
53	});
54
55	expect(payload).toEqual({ token: "legacy-token" });
56	});
57
58	test("WorkOS Vault provider gives actionable error on missing reference", async () => {	49	test("WorkOS Vault provider gives actionable error on missing reference", async () => {
59	await expect(	50	await expect(
60	resolveCredentialPayload({	51	resolveCredentialPayload({

executor/lib/credential_providers.ts+1−9

         : "";
   if (!objectId) {
-    // Backward compatibility: older rows may have stored credential payload directly
-    // under the encrypted provider before object references were persisted.
-    const { objectId: _objectId, id: _id, apiKey: _apiKey, ...legacyPayload } = config;
-    const normalized = asRecord(legacyPayload);
-    if (Object.keys(normalized).length > 0) {
-      return normalized;
-    }
     throw new Error(
       "Encrypted credential is missing its secure reference. Re-save this credential in the dashboard.",
     );
   record: Pick<CredentialRecord, "provider" | "secretJson">,
   options?: { readVaultObject?: VaultObjectReader },
 ): Promise<CredentialPayload | null> {
-  const provider = (record.provider ?? "managed") as CredentialProvider;
+  const provider = record.provider;
   const resolver = providers[provider];
   if (!resolver) {
     throw new Error(`Unsupported credential provider: ${provider}`);

executor/lib/functionBuilders.ts+2−2

@@ -138,7 +138,7 @@ export const organizationMutation = customMutation(mutation, { · 137 unmodified lines
138		138
139	export const workspaceQuery = customQuery(query, {	139	export const workspaceQuery = customQuery(query, {
140	args: {	140	args: {
141	workspaceId: v.string(),	141	workspaceId: v.id("workspaces"),
142	sessionId: v.optional(v.string()),	142	sessionId: v.optional(v.string()),
143	},	143	},
144	input: async (ctx, args, options: WorkspaceAccessOptions = {}) => {	144	input: async (ctx, args, options: WorkspaceAccessOptions = {}) => {
@@ -158,7 +158,7 @@ export const workspaceQuery = customQuery(query, { · 13 unmodified lines
158		158
159	export const workspaceMutation = customMutation(mutation, {	159	export const workspaceMutation = customMutation(mutation, {
160	args: {	160	args: {
161	workspaceId: v.string(),	161	workspaceId: v.id("workspaces"),
162	sessionId: v.optional(v.string()),	162	sessionId: v.optional(v.string()),
163	},	163	},
164	input: async (ctx, args, options: WorkspaceAccessOptions = {}) => {	164	input: async (ctx, args, options: WorkspaceAccessOptions = {}) => {

executor/lib/identity.ts+3−3

@@ -100,10 +100,10 @@ export async function getWorkspaceMembership( · 99 unmodified lines
100		100
101	export async function requireWorkspaceAccessForAccount(	101	export async function requireWorkspaceAccessForAccount(
102	ctx: MembershipCtx,	102	ctx: MembershipCtx,
103	workspaceId: string,	103	workspaceId: Id<"workspaces">,
104	account: Doc<"accounts">,	104	account: Doc<"accounts">,
105	): Promise<WorkspaceAccess> {	105	): Promise<WorkspaceAccess> {
106	const workspace = await ctx.db.get(workspaceId as Id<"workspaces">);	106	const workspace = await ctx.db.get(workspaceId);
107	if (!workspace) {	107	if (!workspace) {
108	throw new Error("Workspace not found");	108	throw new Error("Workspace not found");
109	}	109	}
@@ -140,7 +140,7 @@ export async function requireWorkspaceAccessForAccount( · 30 unmodified lines
140		140
141	export async function requireWorkspaceAccessForRequest(	141	export async function requireWorkspaceAccessForRequest(
142	ctx: IdentityCtx,	142	ctx: IdentityCtx,
143	workspaceId: string,	143	workspaceId: Id<"workspaces">,
144	sessionId?: string,	144	sessionId?: string,
145	): Promise<WorkspaceAccess> {	145	): Promise<WorkspaceAccess> {
146	const account = await resolveAccountForRequest(ctx, sessionId);	146	const account = await resolveAccountForRequest(ctx, sessionId);

executor/lib/mcp-server.test.ts+2−0

       workspaceId: `ws_${crypto.randomUUID()}`,
       actorId: `anon_${crypto.randomUUID()}`,
       clientId: "mcp",
+      accountId: `account_${crypto.randomUUID()}`,
+      userId: `user_${crypto.randomUUID()}`,
       createdAt: now,
       lastSeenAt: now,
     };

executor/lib/openapi-cache.test.ts+0−188

@@ -168,110 +168,7 @@ describe("prepareOpenApiSpec with large specs", () => { · 167 unmodified lines
168	expect(json.length).toBeGreaterThan(100_000);	168	expect(json.length).toBeGreaterThan(100_000);
169	});	169	});
170		170
171	test("preserves operationTypes when spec is large", async () => {
172	const spec = makeLargeSpec(50);
173	const prepared = await prepareOpenApiSpec(spec, "type-test");
174		171
175	// openapiTS should generate types for all operations
176	if (prepared.operationTypes) {
177	const opCount = Object.keys(prepared.operationTypes).length;
178	// Should have types for most operations (openapiTS generates from valid specs)
179	expect(opCount).toBeGreaterThan(0);
180
181	// Spot-check a known operation
182	const getType = prepared.operationTypes["get_resource_0"];
183	if (getType) {
184	expect(getType.argsType).toBeDefined();
185	expect(getType.returnsType).toBeDefined();
186	}
187	}
188	});
189
190	test("preserves schemaTypes when spec has shared schemas", async () => {
191	const specWithSchemas: Record<string, unknown> = {
192	openapi: "3.0.3",
193	info: { title: "Schema Test", version: "1.0.0" },
194	servers: [{ url: "https://api.example.com" }],
195	components: {
196	schemas: {
197	User: {
198	type: "object",
199	properties: {
200	id: { type: "string" },
201	email: { type: "string" },
202	name: { type: "string" },
203	role: { type: "string", enum: ["admin", "user", "viewer"] },
204	},
205	required: ["id", "email"],
206	},
207	UserList: {
208	type: "object",
209	properties: {
210	data: {
211	type: "array",
212	items: { $ref: "#/components/schemas/User" },
213	},
214	total: { type: "number" },
215	},
216	},
217	},
218	},
219	paths: {
220	"/users": {
221	get: {
222	operationId: "listUsers",
223	tags: ["users"],
224	summary: "List users",
225	responses: {
226	"200": {
227	description: "ok",
228	content: {
229	"application/json": {
230	schema: { $ref: "#/components/schemas/UserList" },
231	},
232	},
233	},
234	},
235	},
236	},
237	"/users/{id}": {
238	get: {
239	operationId: "getUser",
240	tags: ["users"],
241	parameters: [
242	{
243	name: "id",
244	in: "path",
245	required: true,
246	schema: { type: "string" },
247	},
248	],
249	summary: "Get user",
250	responses: {
251	"200": {
252	description: "ok",
253	content: {
254	"application/json": {
255	schema: { $ref: "#/components/schemas/User" },
256	},
257	},
258	},
259	},
260	},
261	},
262	},
263	};
264
265	const prepared = await prepareOpenApiSpec(specWithSchemas, "schema-test");
266
267	// Should have generated schema types
268	if (prepared.schemaTypes) {
269	expect(Object.keys(prepared.schemaTypes).length).toBeGreaterThan(0);
270	}
271
272	// No warnings
273	expect(prepared.warnings).toHaveLength(0);
274	});
275	});	172	});
276		173
277	describe("buildOpenApiToolsFromPrepared", () => {	174	describe("buildOpenApiToolsFromPrepared", () => {
@@ -946,78 +843,7 @@ describe("buildOpenApiToolsFromPrepared", () => { · 668 unmodified lines
946	expect(tool!.metadata?.returnsType).not.toBe("unknown");	843	expect(tool!.metadata?.returnsType).not.toBe("unknown");
947	});	844	});
948		845
949	test("schemaTypes only attached to first tool from a source", async () => {
950	const specWithSchemas: Record<string, unknown> = {
951	openapi: "3.0.3",
952	info: { title: "Schema placement test", version: "1.0.0" },
953	servers: [{ url: "https://api.example.com" }],
954	components: {
955	schemas: {
956	Widget: {
957	type: "object",
958	properties: {
959	id: { type: "string" },
960	name: { type: "string" },
961	},
962	},
963	},
964	},
965	paths: {
966	"/widgets": {
967	get: {
968	operationId: "listWidgets",
969	tags: ["widgets"],
970	responses: {
971	"200": {
972	description: "ok",
973	content: {
974	"application/json": {
975	schema: {
976	type: "array",
977	items: { $ref: "#/components/schemas/Widget" },
978	},
979	},
980	},
981	},
982	},
983	},
984	post: {
985	operationId: "createWidget",
986	tags: ["widgets"],
987	requestBody: {
988	content: {
989	"application/json": {
990	schema: { $ref: "#/components/schemas/Widget" },
991	},
992	},
993	},
994	responses: {
995	"201": { description: "created" },
996	},
997	},
998	},
999	},
1000	};
1001		846
1002	const prepared = await prepareOpenApiSpec(specWithSchemas, "schema-placement");
1003	const tools = buildOpenApiToolsFromPrepared(
1004	{
1005	type: "openapi",
1006	name: "widgets",
1007	spec: specWithSchemas,
1008	baseUrl: "https://api.example.com",
1009	},
1010	prepared,
1011	);
1012
1013	expect(tools.length).toBe(2);
1014
1015	// Only the first tool should have schemaTypes
1016	const withSchemas = tools.filter(
1017	(t) => t.metadata?.schemaTypes && Object.keys(t.metadata.schemaTypes).length > 0,
1018	);
1019	expect(withSchemas.length).toBeLessThanOrEqual(1);
1020	});
1021	});	847	});
1022		848
1023	describe("prepared spec serialization round-trip", () => {	849	describe("prepared spec serialization round-trip", () => {
@@ -1035,20 +861,6 @@ describe("prepared spec serialization round-trip", () => { · 11 unmodified lines
1035	);	861	);
1036	expect(restored.warnings).toEqual(prepared.warnings);	862	expect(restored.warnings).toEqual(prepared.warnings);
1037		863
1038	if (prepared.operationTypes) {
1039	expect(restored.operationTypes).toBeDefined();
1040	expect(Object.keys(restored.operationTypes!).length).toBe(
1041	Object.keys(prepared.operationTypes).length,
1042	);
1043	}
1044
1045	if (prepared.schemaTypes) {
1046	expect(restored.schemaTypes).toBeDefined();
1047	expect(Object.keys(restored.schemaTypes!).length).toBe(
1048	Object.keys(prepared.schemaTypes).length,
1049	);
1050	}
1051
1052	// Verify tools built from the restored spec match the original	864	// Verify tools built from the restored spec match the original
1053	const config = {	865	const config = {
1054	type: "openapi" as const,	866	type: "openapi" as const,

executor/lib/tool_sources.ts+1−28

   paths: Record<string, unknown>;
   /** Raw .d.ts from openapiTS — cached as-is, extracted lazily on read */
   dts?: string;
-  /** @deprecated Kept for cache compat — new entries use `dts` instead */
-  operationTypes?: Record<string, { argsType: string; returnsType: string }>;
-  /** @deprecated Kept for cache compat — new entries use `dts` instead */
-  schemaTypes?: Record<string, string>;
   warnings: string[];
 }
   const paths = asRecord(prepared.paths);
   const tools: ToolDefinition[] = [];
-  // The raw .d.ts is attached to the first tool only (same pattern as old schemaTypes).
+  // The raw .d.ts is attached to the first tool only (one per source to avoid duplication).
   // The typechecker/Monaco use this directly via indexed access types.
   const sourceDts = prepared.dts
     ? prepared.dts.replace(/^export /gm, "")  // strip 'export' so types are ambient
    * MCP: { kind: "mcp", url, transport?, queryParams?, toolName }
    * GraphQL raw: { kind: "graphql_raw", endpoint, authHeaders }
    * GraphQL field: { kind: "graphql_field", endpoint, operationName, operationType, queryTemplate, argNames?, authHeaders }
-   * GraphQL (legacy compat): { kind: "graphql", endpoint, operationName, operationType, authHeaders }
    * Builtin: { kind: "builtin" } — run comes from DEFAULT_TOOLS
    */
   runSpec:
         argNames?: string[];
         authHeaders: Record<string, string>;
       }
-    | {
-        kind: "graphql";
-        endpoint: string;
-        operationName: string;
-        operationType: "query" | "mutation";
-        authHeaders: Record<string, string>;
-      }
     | { kind: "builtin" };
 }
       };
     }
-    if (st.runSpec.kind === "graphql") {
-      // Legacy compat for older cached entries.
-      const { endpoint, operationName, operationType, authHeaders } = st.runSpec;
-      const queryTemplate = `${operationType} ${operationName}($input: JSON) { ${operationName}(input: $input) }`;
-      return {
-        ...base,
-        run: async (input: unknown, context) => {
-          const payload = asRecord(input);
-          const variables = payload.variables ?? { input: payload };
-          const envelope = await executeGraphql(endpoint, authHeaders, queryTemplate, variables, context);
-          return selectGraphqlFieldEnvelope(envelope, operationName);
-        },
-      };
-    }
     return { ...base, run: async () => { throw new Error(`Unknown run spec kind for '${st.path}'`); } };
   });
 }

executor/lib/typechecker.test.ts+0−93

@@ -424,97 +424,4 @@ export interface operations { · 423 unmodified lines
424	});	424	});
425	});	425	});
426		426
427	// ---------------------------------------------------------------------------
428	// schemaTypes integration — verifies that schema type aliases are emitted and
429	// correctly used by the typechecker
430	// ---------------------------------------------------------------------------
431
432	describe("typecheckCode with schemaTypes", () => {
433	const CUSTOMER_SCHEMA_TOOL: ToolDescriptor = {
434	path: "stripe.customers.create",
435	description: "Create a customer",
436	approval: "auto",
437	argsType: "{ name: string; email: string }",
438	returnsType: "Customer",
439	// Only the first tool from a source carries schemaTypes
440	schemaTypes: {
441	Customer: "{ id: string; name: string; email: string; subscriptions: Subscription[] }",
442	Subscription: "{ id: string; status: string; plan: Plan }",
443	Plan: "{ id: string; amount: number; currency: string }",
444	},
445	};
446
447	const CUSTOMER_GET_TOOL: ToolDescriptor = {
448	path: "stripe.customers.get",
449	description: "Get a customer",
450	approval: "auto",
451	argsType: "{ id: string }",
452	returnsType: "Customer",
453	// Subsequent tools do NOT carry schemaTypes (deduplication)
454	};
455
456	const STRIPE_TOOLS = [CUSTOMER_SCHEMA_TOOL, CUSTOMER_GET_TOOL];
457
458	test("schema types are emitted in declarations", () => {
459	const result = generateToolDeclarations(STRIPE_TOOLS);
460	expect(result).toContain("type Customer =");
461	expect(result).toContain("type Subscription =");
462	expect(result).toContain("type Plan =");
463	// Declarations should come before the tools declaration
464	const schemaIdx = result.indexOf("type Customer =");
465	const toolsIdx = result.indexOf("declare const tools:");
466	expect(schemaIdx).toBeLessThan(toolsIdx);
467	});
468
469	test("code using schema return types typechecks correctly", () => {
470	const decl = generateToolDeclarations(STRIPE_TOOLS);
471	const result = typecheckCode(
472	`const customer = await tools.stripe.customers.create({ name: "John", email: "john@test.com" });
473	const id: string = customer.id;
474	const subs: Subscription[] = customer.subscriptions;
475	const plan: Plan = subs[0].plan;
476	return plan.amount;`,
477	decl,
478	);
479	expect(result.ok).toBe(true);
480	expect(result.errors).toHaveLength(0);
481	});
482
483	test("wrong property access on schema type produces errors", () => {
484	const decl = generateToolDeclarations(STRIPE_TOOLS);
485	const result = typecheckCode(
486	`const customer = await tools.stripe.customers.get({ id: "cus_123" });
487	return customer.nonexistent_field;`,
488	decl,
489	);
490	expect(result.ok).toBe(false);
491	expect(result.errors.some((e) => e.includes("nonexistent_field"))).toBe(true);
492	});
493		427
494	test("transitive schema types are available (Subscription, Plan)", () => {
495	const decl = generateToolDeclarations(STRIPE_TOOLS);
496	const result = typecheckCode(
497	`const customer = await tools.stripe.customers.get({ id: "cus_123" });
498	const sub = customer.subscriptions[0];
499	const status: string = sub.status;
500	const amount: number = sub.plan.amount;
501	const currency: string = sub.plan.currency;
502	return { status, amount, currency };`,
503	decl,
504	);
505	expect(result.ok).toBe(true);
506	expect(result.errors).toHaveLength(0);
507	});
508
509	test("wrong type on schema property produces errors", () => {
510	const decl = generateToolDeclarations(STRIPE_TOOLS);
511	const result = typecheckCode(
512	`const customer = await tools.stripe.customers.get({ id: "cus_123" });
513	const amount: string = customer.subscriptions[0].plan.amount;`,
514	decl,
515	);
516	expect(result.ok).toBe(false);
517	// amount is number, assigning to string should fail
518	expect(result.errors.some((e) => e.includes("number") \|\| e.includes("string"))).toBe(true);
519	});
520	});

executor/lib/typechecker.ts+0−19

@@ -104,18 +104,6 @@ export function generateToolDeclarations( · 103 unmodified lines
104	options?: GenerateToolDeclarationOptions,	104	options?: GenerateToolDeclarationOptions,
105	): string {	105	): string {
106		106
107	// Legacy compat: collect schemaTypes from tools that use the old format
108	const allSchemas = new Map<string, string>();
109	for (const tool of tools) {
110	if (tool.schemaTypes) {
111	for (const [name, type] of Object.entries(tool.schemaTypes)) {
112	if (!allSchemas.has(name)) {
113	allSchemas.set(name, type);
114	}
115	}
116	}
117	}
118
119	// Build a nested tree from flat tool paths	107	// Build a nested tree from flat tool paths
120	interface TreeNode {	108	interface TreeNode {
121	children: Map<string, TreeNode>;	109	children: Map<string, TreeNode>;
@@ -172,13 +160,6 @@ export function generateToolDeclarations( · 50 unmodified lines
172	// Assemble the full declarations block	160	// Assemble the full declarations block
173	const parts: string[] = [];	161	const parts: string[] = [];
174		162
175	// Legacy schema type aliases (from old cache format)
176	if (allSchemas.size > 0) {
177	for (const [name, type] of allSchemas) {
178	parts.push(`type ${name} = ${type};`);
179	}
180	}
181
182	const sourceDtsBySource = options?.sourceDtsBySource ?? {};	163	const sourceDtsBySource = options?.sourceDtsBySource ?? {};
183	const dtsEntries = Object.entries(sourceDtsBySource)	164	const dtsEntries = Object.entries(sourceDtsBySource)
184	.filter(([, dts]) => typeof dts === "string" && dts.trim().length > 0)	165	.filter(([, dts]) => typeof dts === "string" && dts.trim().length > 0)

executor/lib/types.ts+122−24

@@ -1,25 +1,125 @@
1	// Re-export shared types from contracts	1	// ── Shared types (inlined from @executor/contracts) ──────────────────────────
2	export type {	2
3	TaskStatus,	3	export type TaskStatus = "queued" \| "running" \| "completed" \| "failed" \| "timed_out" \| "denied";
4	ApprovalStatus,	4	export type ApprovalStatus = "pending" \| "approved" \| "denied";
5	PolicyDecision,	5	export type PolicyDecision = "allow" \| "require_approval" \| "deny";
6	CredentialScope,	6	export type CredentialScope = "workspace" \| "actor";
7	CredentialProvider,	7	export type CredentialProvider = "managed" \| "workos-vault";
8	ToolApprovalMode,	8	export type ToolApprovalMode = "auto" \| "required";
9	ToolSourceType,	9	export type ToolSourceType = "mcp" \| "openapi" \| "graphql";
10	TaskRecord,	10
11	ApprovalRecord,	11	export interface TaskRecord {
12	PendingApprovalRecord,	12	id: string;
13	TaskEventRecord,	13	code: string;
14	AccessPolicyRecord,	14	runtimeId: string;
15	CredentialRecord,	15	status: TaskStatus;
16	ToolSourceRecord,	16	timeoutMs: number;
17	ToolDescriptor,	17	metadata: Record<string, unknown>;
18	OpenApiSourceQuality,	18	workspaceId: string;
19	AnonymousContext,	19	actorId?: string;
20	} from "@executor/contracts";	20	clientId?: string;
21		21	createdAt: number;
22	import type { TaskStatus, CredentialScope, ToolApprovalMode } from "@executor/contracts";	22	updatedAt: number;
		23	startedAt?: number;
		24	completedAt?: number;
		25	error?: string;
		26	stdout?: string;
		27	stderr?: string;
		28	exitCode?: number;
		29	}
		30
		31	export interface ApprovalRecord {
		32	id: string;
		33	taskId: string;
		34	toolPath: string;
		35	input: unknown;
		36	status: ApprovalStatus;
		37	reason?: string;
		38	reviewerId?: string;
		39	createdAt: number;
		40	resolvedAt?: number;
		41	}
		42
		43	export interface PendingApprovalRecord extends ApprovalRecord {
		44	task: Pick<TaskRecord, "id" \| "status" \| "runtimeId" \| "timeoutMs" \| "createdAt">;
		45	}
		46
		47	export interface TaskEventRecord {
		48	id: number;
		49	taskId: string;
		50	eventName: string;
		51	type: string;
		52	payload: unknown;
		53	createdAt: number;
		54	}
		55
		56	export interface AccessPolicyRecord {
		57	id: string;
		58	workspaceId: string;
		59	actorId?: string;
		60	clientId?: string;
		61	toolPathPattern: string;
		62	decision: PolicyDecision;
		63	priority: number;
		64	createdAt: number;
		65	updatedAt: number;
		66	}
		67
		68	export interface CredentialRecord {
		69	id: string;
		70	workspaceId: string;
		71	sourceKey: string;
		72	scope: CredentialScope;
		73	actorId?: string;
		74	provider: CredentialProvider;
		75	secretJson: Record<string, unknown>;
		76	createdAt: number;
		77	updatedAt: number;
		78	}
		79
		80	export interface ToolSourceRecord {
		81	id: string;
		82	workspaceId: string;
		83	name: string;
		84	type: ToolSourceType;
		85	config: Record<string, unknown>;
		86	enabled: boolean;
		87	createdAt: number;
		88	updatedAt: number;
		89	}
		90
		91	export interface ToolDescriptor {
		92	path: string;
		93	description: string;
		94	approval: ToolApprovalMode;
		95	source?: string;
		96	argsType?: string;
		97	returnsType?: string;
		98	operationId?: string;
		99	}
		100
		101	export interface OpenApiSourceQuality {
		102	sourceKey: string;
		103	toolCount: number;
		104	unknownArgsCount: number;
		105	unknownReturnsCount: number;
		106	partialUnknownArgsCount: number;
		107	partialUnknownReturnsCount: number;
		108	argsQuality: number;
		109	returnsQuality: number;
		110	overallQuality: number;
		111	}
		112
		113	export interface AnonymousContext {
		114	sessionId: string;
		115	workspaceId: string;
		116	actorId: string;
		117	clientId: string;
		118	accountId: string;
		119	userId: string;
		120	createdAt: number;
		121	lastSeenAt: number;
		122	}
23		123
24	// ── Server-only types ─────────────────────────────────────────────────────────	124	// ── Server-only types ─────────────────────────────────────────────────────────
25		125
@@ -120,8 +220,6 @@ export interface ToolTypeMetadata { · 94 unmodified lines
120	* Only set on the FIRST tool per source to avoid duplication.	220	* Only set on the FIRST tool per source to avoid duplication.
121	*/	221	*/
122	sourceDts?: string;	222	sourceDts?: string;
123	/** @deprecated Use sourceDts instead. Kept for cache compat. */
124	schemaTypes?: Record<string, string>;
125	}	223	}
126		224
127	export interface ToolDefinition {	225	export interface ToolDefinition {

executor/lib/workspace-tool-cache.test.ts+37−17

  * round-trip with functional `run` methods.
  */
 import { test, expect, describe } from "bun:test";
+import type { Id } from "../convex/_generated/dataModel";
 import {
   prepareOpenApiSpec,
   buildOpenApiToolsFromPrepared,
 });
 describe("workspace tool cache table", () => {
-  // convex-test based tests for the table operations
+  async function setupCacheTest() {
-  test("getEntry + putEntry round-trip", async () => {
     const { convexTest } = await import("convex-test");
     const { internal } = await import("../convex/_generated/api");
     const schema = (await import("../convex/schema")).default;
       "./_generated/api.js": () => import("../convex/_generated/api.js"),
     });
+    const wsId = await t.run(async (ctx) => {
+      const orgId = await ctx.db.insert("organizations", {
+        name: "test-org",
+        slug: "test-org",
+        status: "active" as const,
+        createdAt: Date.now(),
+        updatedAt: Date.now(),
+      });
+      return await ctx.db.insert("workspaces", {
+        name: "test-ws",
+        slug: "test-ws",
+        organizationId: orgId,
+        plan: "free",
+        createdAt: Date.now(),
+        updatedAt: Date.now(),
+      });
+    });
+    return { t, internal, wsId };
+  }
+  test("getEntry + putEntry round-trip", async () => {
+    const { t, internal, wsId } = await setupCacheTest();
     // Empty cache
     const miss = await t.query(internal.workspaceToolCache.getEntry, {
-      workspaceId: "ws_1",
+      workspaceId: wsId,
       signature: "sig_1",
     });
     expect(miss).toBeNull();
     });
     await t.mutation(internal.workspaceToolCache.putEntry, {
-      workspaceId: "ws_1",
+      workspaceId: wsId,
       signature: "sig_1",
       storageId,
       toolCount: 0,
       sizeBytes: 27,
+      dtsStorageIds: [],
     });
     // Hit
     const hit = await t.query(internal.workspaceToolCache.getEntry, {
-      workspaceId: "ws_1",
+      workspaceId: wsId,
       signature: "sig_1",
     });
     expect(hit).not.toBeNull();
     // Wrong signature = miss
     const wrongSig = await t.query(internal.workspaceToolCache.getEntry, {
-      workspaceId: "ws_1",
+      workspaceId: wsId,
       signature: "sig_2",
     });
     expect(wrongSig).toBeNull();
   });
   test("putEntry replaces old entry and deletes old blob", async () => {
-    const { convexTest } = await import("convex-test");
+    const { t, internal, wsId } = await setupCacheTest();
-    const { internal } = await import("../convex/_generated/api");
-    const schema = (await import("../convex/schema")).default;
-    const t = convexTest(schema, {
-      "./workspaceToolCache.ts": () => import("../convex/workspaceToolCache"),
-      "./_generated/api.js": () => import("../convex/_generated/api.js"),
-    });
     const storageId1 = await t.run(async (ctx) => {
       return await ctx.storage.store(new Blob(["old"]));
     });
     await t.mutation(internal.workspaceToolCache.putEntry, {
-      workspaceId: "ws_1",
+      workspaceId: wsId,
       signature: "sig_1",
       storageId: storageId1,
       toolCount: 5,
       sizeBytes: 3,
+      dtsStorageIds: [],
     });
     const storageId2 = await t.run(async (ctx) => {
     });
     await t.mutation(internal.workspaceToolCache.putEntry, {
-      workspaceId: "ws_1",
+      workspaceId: wsId,
       signature: "sig_2",
       storageId: storageId2,
       toolCount: 10,
       sizeBytes: 3,
+      dtsStorageIds: [],
     });
     // New entry
     const entry = await t.query(internal.workspaceToolCache.getEntry, {
-      workspaceId: "ws_1",
+      workspaceId: wsId,
       signature: "sig_2",
     });
     expect(entry!.storageId).toBe(storageId2);

executor/mcp-gateway.ts+7−6

 import { api } from "./convex/_generated/api";
 import { handleMcpRequest, type McpWorkspaceContext } from "./lib/mcp_server";
 import type { AnonymousContext, PendingApprovalRecord, TaskRecord, ToolDescriptor } from "./lib/types";
+import type { Id } from "./convex/_generated/dataModel";
 const convexUrlFromEnv = Bun.env.CONVEX_URL;
 if (!convexUrlFromEnv) {
       clientId?: string;
     }) => {
       const created = await convex.mutation(api.executor.createTask, {
-        workspaceId: input.workspaceId,
+        workspaceId: input.workspaceId as Id<"workspaces">,
         sessionId,
         code: input.code,
         timeoutMs: input.timeoutMs,
         return null;
       }
       const task = await convex.query(api.workspace.getTaskInWorkspace, {
-        workspaceId: effectiveWorkspaceId,
+        workspaceId: effectiveWorkspaceId as Id<"workspaces">,
         sessionId,
         taskId,
       });
         return [];
       }
       const tools = await convex.action(api.executorNode.listTools, {
-        workspaceId: toolContext.workspaceId,
+        workspaceId: toolContext.workspaceId as Id<"workspaces">,
         sessionId,
         actorId: toolContext.actorId,
         clientId: toolContext.clientId,
     listPendingApprovals: async (approvalWorkspaceId: string) => {
       const approvals = await convex.query(api.workspace.listPendingApprovals, {
-        workspaceId: approvalWorkspaceId,
+        workspaceId: approvalWorkspaceId as Id<"workspaces">,
         sessionId,
       });
       return approvals as PendingApprovalRecord[];
       reason?: string;
     }) => {
       return await convex.mutation(api.executor.resolveApproval, {
-        workspaceId: input.workspaceId,
+        workspaceId: input.workspaceId as Id<"workspaces">,
         sessionId,
         approvalId: input.approvalId,
         decision: input.decision,
   }
   const requestContext = await convex.query(api.workspace.getRequestContext, {
-    workspaceId: requested.workspaceId,
+    workspaceId: requested.workspaceId as Id<"workspaces">,
     sessionId: requested.sessionId,
   });

executor/packages/contracts/package.json+0−7

@@ -1,7 +0,0 @@
1	{
2	"name": "@executor/contracts",
3	"version": "0.0.1",
4	"private": true,
5	"main": "src/index.ts",
6	"types": "src/index.ts"
7	}

executor/packages/contracts/src/index.ts+0−143

@@ -1,143 +0,0 @@
1	// ── Status enums ──────────────────────────────────────────────────────────────
2
3	export type TaskStatus =
4	\| "queued"
5	\| "running"
6	\| "completed"
7	\| "failed"
8	\| "timed_out"
9	\| "denied";
10
11	export type ApprovalStatus = "pending" \| "approved" \| "denied";
12
13	export type PolicyDecision = "allow" \| "require_approval" \| "deny";
14
15	export type CredentialScope = "workspace" \| "actor";
16
17	export type CredentialProvider = "managed" \| "workos-vault";
18
19	export type ToolApprovalMode = "auto" \| "required";
20
21	export type ToolSourceType = "mcp" \| "openapi" \| "graphql";
22
23	// ── Records ───────────────────────────────────────────────────────────────────
24
25	export interface TaskRecord {
26	id: string;
27	code: string;
28	runtimeId: string;
29	status: TaskStatus;
30	timeoutMs: number;
31	metadata: Record<string, unknown>;
32	workspaceId: string;
33	actorId?: string;
34	clientId?: string;
35	createdAt: number;
36	updatedAt: number;
37	startedAt?: number;
38	completedAt?: number;
39	error?: string;
40	stdout?: string;
41	stderr?: string;
42	exitCode?: number;
43	}
44
45	export interface ApprovalRecord {
46	id: string;
47	taskId: string;
48	toolPath: string;
49	input: unknown;
50	status: ApprovalStatus;
51	reason?: string;
52	reviewerId?: string;
53	createdAt: number;
54	resolvedAt?: number;
55	}
56
57	export interface PendingApprovalRecord extends ApprovalRecord {
58	task: Pick<TaskRecord, "id" \| "status" \| "runtimeId" \| "timeoutMs" \| "createdAt">;
59	}
60
61	export interface TaskEventRecord {
62	id: number;
63	taskId: string;
64	eventName: string;
65	type: string;
66	payload: unknown;
67	createdAt: number;
68	}
69
70	export interface AccessPolicyRecord {
71	id: string;
72	workspaceId: string;
73	actorId?: string;
74	clientId?: string;
75	toolPathPattern: string;
76	decision: PolicyDecision;
77	priority: number;
78	createdAt: number;
79	updatedAt: number;
80	}
81
82	export interface CredentialRecord {
83	id: string;
84	workspaceId: string;
85	sourceKey: string;
86	scope: CredentialScope;
87	actorId?: string;
88	provider: CredentialProvider;
89	secretJson: Record<string, unknown>;
90	createdAt: number;
91	updatedAt: number;
92	}
93
94	export interface ToolSourceRecord {
95	id: string;
96	workspaceId: string;
97	name: string;
98	type: ToolSourceType;
99	config: Record<string, unknown>;
100	enabled: boolean;
101	createdAt: number;
102	updatedAt: number;
103	}
104
105	// ── Descriptors ───────────────────────────────────────────────────────────────
106
107	export interface ToolDescriptor {
108	path: string;
109	description: string;
110	approval: ToolApprovalMode;
111	source?: string;
112	/** Lightweight TS type hint for args (for LLM prompt / discover tool). */
113	argsType?: string;
114	/** Lightweight TS type hint for return value (for LLM prompt / discover tool). */
115	returnsType?: string;
116	/** Raw operationId from the OpenAPI spec (used by Monaco for indexed access types). */
117	operationId?: string;
118	/** @deprecated Kept for cache compat. */
119	schemaTypes?: Record<string, string>;
120	}
121
122	export interface OpenApiSourceQuality {
123	sourceKey: string;
124	toolCount: number;
125	unknownArgsCount: number;
126	unknownReturnsCount: number;
127	partialUnknownArgsCount: number;
128	partialUnknownReturnsCount: number;
129	argsQuality: number;
130	returnsQuality: number;
131	overallQuality: number;
132	}
133
134	export interface AnonymousContext {
135	sessionId: string;
136	workspaceId: string;
137	actorId: string;
138	clientId: string;
139	accountId?: string;
140	userId?: string;
141	createdAt: number;
142	lastSeenAt: number;
143	}

executor/packages/contracts/tsconfig.json+0−11

@@ -1,11 +0,0 @@
1	{
2	"compilerOptions": {
3	"strict": true,
4	"moduleResolution": "bundler",
5	"target": "ESNext",
6	"module": "ESNext",
7	"noEmit": true,
8	"skipLibCheck": true
9	},
10	"include": ["src/*/.ts"]
11	}

package.json+1−1

   "private": true,
   "type": "module",
   "workspaces": [
+    "executor/convex",
     "executor/apps/*",
     "executor/packages/*",
     "assistant",
     "@convex-dev/migrations": "^0.3.1",
     "@convex-dev/stripe": "^0.1.3",
     "@convex-dev/workos-authkit": "^0.1.6",
-    "@executor/contracts": "workspace:*",
     "@workos-inc/node": "^8.2.0",
     "convex": "^1.31.7",
     "convex-helpers": "^0.1.111",

Tighten schema, delete @executor/contracts, add @executor/convex package

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code