lael-labs/executor

CLAUDE.md+14−2

 ### Main quality commands
-- `bun run test` - runs executor + assistant test suites.
+- `bun run test` - runs executor fast suite + assistant tests.
 - `bun run typecheck` - runs executor + assistant TypeScript checks.
 - `bun run knip` - dead-code/unused-export scan.
 ### Package-specific quality commands
-- `bun run test:executor` - `bun test --cwd executor`.
+- `bun run test:executor` - executor fast/normal tests (`bun run --cwd executor test`).
+- `bun run test:executor:integration` - executor integration tests (`bun run --cwd executor test:integration`).
+- `bun run test:executor:e2e` - executor e2e tests (`bun run --cwd executor test:e2e`).
+- `bun run test:executor:all` - all executor tests (`bun run --cwd executor test:all`).
 - `bun run test:assistant` - assistant tests (`assistant/packages/core/src`).
 - `bun run typecheck:executor` - `tsc --noEmit -p executor/tsconfig.json`.
 - `bun run typecheck:assistant` - checks server + bot tsconfig files.
 - Use `bun:test` (`import { test, expect } from "bun:test"`).
 - Keep tests close to code with `.test.ts` / `.e2e.test.ts` naming.
+- Keep scheduler behavior test-safe by default; do not require `DISABLE_CONVEX_SCHEDULER=1` to run the normal fast suite.
 - When changing Convex auth/access logic, add/adjust permission tests in `executor/packages/convex/access-controls.test.ts`.
 - When changing tool discovery/typing behavior, update tests in `executor/packages/core/src/*.test.ts`.
+## User Preferences (Observed)
+- Preserve local/cloud parity: prefer the same architecture and runtime behavior in both environments.
+- Reduce complexity by enforcing write-time invariants over read-time repair (`ensure*` backfills should be minimal and clearly scoped).
+- For greenfield iterations, prefer clearing/resetting the DB over adding one-off migrations.
+- Keep default feedback loops fast: split tests into fast, integration, and e2e buckets and make fast the default.
+- Favor practical simplification over theoretical abstractions when refactoring data models and auth flows.
 ## Generated/Build Artifacts
 - Do not manually edit generated/build outputs such as:

executor/package.json+4−0

     "web": "bun run executor.ts web",
     "deploy": "bunx convex deploy",
     "codegen": "bunx convex codegen",
+    "test": "bun run scripts/test/run-suite.ts fast",
+    "test:integration": "bun run scripts/test/run-suite.ts integration",
+    "test:e2e": "bun run scripts/test/run-suite.ts e2e",
+    "test:all": "bun run scripts/test/run-suite.ts all",
     "test:e2e:install": "bun test scripts/e2e/install.e2e.test.ts",
     "test:e2e:install:sandbox": "bun test scripts/e2e/install.sandbox.e2e.test.ts",
     "sandbox:install:session": "bun run scripts/e2e/install.sandbox.session.ts",

executor/packages/core/src/identity.ts+30−36

 type WorkspaceAccessMembership = Pick<Doc<"workspaceMembers">, "role" | "status">;
-function mapOrganizationRoleToWorkspaceRole(
-  role: Doc<"organizationMembers">["role"],
-): Doc<"workspaceMembers">["role"] {
-  if (role === "owner") {
-    return "owner";
-  }
-  if (role === "admin") {
-    return "admin";
-  }
-  return "member";
-}
 export type WorkspaceAccess = {
   account: Doc<"accounts">;
   workspace: Doc<"workspaces">;
   organizationId: Id<"organizations">,
   accountId: Id<"accounts">,
 ) {
-  return await ctx.db
+  const memberships = await ctx.db
     .query("organizationMembers")
     .withIndex("by_org_account", (q) => q.eq("organizationId", organizationId).eq("accountId", accountId))
-    .unique();
+    .collect();
+  if (memberships.length === 0) {
+    return null;
+  }
+  memberships.sort((a, b) => {
+    const statusRankA = a.status === "active" ? 2 : a.status === "pending" ? 1 : 0;
+    const statusRankB = b.status === "active" ? 2 : b.status === "pending" ? 1 : 0;
+    return statusRankB - statusRankA || b.updatedAt - a.updatedAt;
+  });
+  return memberships[0]!;
 }
 export async function getWorkspaceMembership(
   workspaceId: Id<"workspaces">,
   accountId: Id<"accounts">,
 ) {
-  return await ctx.db
+  const memberships = await ctx.db
     .query("workspaceMembers")
     .withIndex("by_workspace_account", (q) => q.eq("workspaceId", workspaceId).eq("accountId", accountId))
-    .unique();
+    .collect();
+  if (memberships.length === 0) {
+    return null;
+  }
+  memberships.sort((a, b) => {
+    const statusRankA = a.status === "active" ? 2 : a.status === "pending" ? 1 : 0;
+    const statusRankB = b.status === "active" ? 2 : b.status === "pending" ? 1 : 0;
+    return statusRankB - statusRankA || b.updatedAt - a.updatedAt;
+  });
+  return memberships[0]!;
 }
 export async function requireWorkspaceAccessForAccount(
   }
   const workspaceMembership = await getWorkspaceMembership(ctx, workspace._id, account._id);
-  if (workspaceMembership) {
+  if (!workspaceMembership || workspaceMembership.status !== "active") {
-    if (workspaceMembership.status !== "active") {
-      throw new Error("You are not a member of this workspace");
-    }
-    return {
-      account,
-      workspace,
-      workspaceMembership,
-    };
-  }
-  const organizationMembership = await getOrganizationMembership(ctx, workspace.organizationId, account._id);
-  if (!organizationMembership || organizationMembership.status !== "active") {
     throw new Error("You are not a member of this workspace");
   }
-  const derivedWorkspaceMembership: WorkspaceAccessMembership = {
-    role: mapOrganizationRoleToWorkspaceRole(organizationMembership.role),
-    status: "active",
-  };
   return {
     account,
     workspace,
-    workspaceMembership: derivedWorkspaceMembership,
+    workspaceMembership,
   };
 }

executor/packages/core/src/runtimes/cloudflare/worker/loader-runtime.test.ts+9−0

 let fakeHostServer: ReturnType<typeof Bun.serve>;
 let fakeCallbackServer: ReturnType<typeof Bun.serve>;
+let previousConvexUrl: string | undefined;
 const AUTH_TOKEN = "test-sandbox-token";
 const CALLBACK_TOKEN = "test-callback-token";
 let lastHostRequestBody: HostRequestBody | null = null;
 beforeAll(() => {
+  previousConvexUrl = process.env.CONVEX_URL;
   fakeCallbackServer = Bun.serve({
     port: 0,
     fetch: () => Response.json({ ok: true }),
   process.env.CLOUDFLARE_SANDBOX_RUN_URL = `http://127.0.0.1:${fakeHostServer.port}/v1/runs`;
   process.env.CLOUDFLARE_SANDBOX_AUTH_TOKEN = AUTH_TOKEN;
+  delete process.env.CONVEX_URL;
   process.env.CONVEX_SITE_URL = `http://127.0.0.1:${fakeCallbackServer.port}`;
   process.env.EXECUTOR_INTERNAL_TOKEN = CALLBACK_TOKEN;
   process.env.CLOUDFLARE_SANDBOX_REQUEST_TIMEOUT_MS = "10000";
   fakeCallbackServer?.stop(true);
   delete process.env.CLOUDFLARE_SANDBOX_RUN_URL;
   delete process.env.CLOUDFLARE_SANDBOX_AUTH_TOKEN;
+  if (previousConvexUrl === undefined) {
+    delete process.env.CONVEX_URL;
+  } else {
+    process.env.CONVEX_URL = previousConvexUrl;
+  }
   delete process.env.CONVEX_SITE_URL;
   delete process.env.EXECUTOR_INTERNAL_TOKEN;
   delete process.env.CLOUDFLARE_SANDBOX_REQUEST_TIMEOUT_MS;

executor/packages/core/src/tool/source-serialization.ts+12−5

-import { Result } from "better-result";
 import { connectMcp, extractMcpResult } from "../mcp-runtime";
 import { executePostmanRequest, type PostmanSerializedRunSpec } from "../postman-runtime";
 import { normalizeGraphqlFieldVariables, selectGraphqlFieldEnvelope } from "../graphql/field-tools";
       return {
         ...base,
         run: async (input: unknown, context) => {
-          return await executeOpenApiRequest(runSpec, input, context.credential?.headers);
+          const response = await executeOpenApiRequest(runSpec, input, context.credential?.headers);
+          if (response.isErr()) {
+            throw new Error(response.error.message);
+          }
+          return response.value;
         },
       };
     }
             throw new Error("GraphQL query string is required");
           }
           const variables = payload.variables;
-          return await executeGraphqlRequest(endpoint, authHeaders, query, variables, context.credential?.headers);
+          const response = await executeGraphqlRequest(endpoint, authHeaders, query, variables, context.credential?.headers);
+          if (response.isErr()) {
+            throw new Error(response.error.message);
+          }
+          return response.value;
         },
       };
     }
             context.credential?.headers,
           );
           if (envelopeResult.isErr()) {
-            return envelopeResult;
+            throw new Error(envelopeResult.error.message);
           }
-          return Result.ok(selectGraphqlFieldEnvelope(envelopeResult.value, operationName));
+          return selectGraphqlFieldEnvelope(envelopeResult.value, operationName);
         },
       };
     }

executor/packages/database/convex/access-controls.test.ts+48−2

@@ -116,7 +116,7 @@ async function addOrgMember( · 115 unmodified lines
116	) {	116	) {
117	const now = Date.now();	117	const now = Date.now();
118	return await t.run(async (ctx) => {	118	return await t.run(async (ctx) => {
119	return await ctx.db.insert("organizationMembers", {	119	const membershipId = await ctx.db.insert("organizationMembers", {
120	organizationId: opts.organizationId,	120	organizationId: opts.organizationId,
121	accountId: opts.accountId,	121	accountId: opts.accountId,
122	role: opts.role,	122	role: opts.role,
@@ -126,6 +126,38 @@ async function addOrgMember( · 3 unmodified lines
126	createdAt: now,	126	createdAt: now,
127	updatedAt: now,	127	updatedAt: now,
128	});	128	});
		129
		130	const role = opts.role === "owner" \|\| opts.role === "admin" ? opts.role : "member";
		131	const workspaces = await ctx.db
		132	.query("workspaces")
		133	.withIndex("by_organization_created", (q) => q.eq("organizationId", opts.organizationId))
		134	.collect();
		135
		136	for (const workspace of workspaces) {
		137	const existing = await ctx.db
		138	.query("workspaceMembers")
		139	.withIndex("by_workspace_account", (q) => q.eq("workspaceId", workspace._id).eq("accountId", opts.accountId))
		140	.first();
		141
		142	if (existing) {
		143	await ctx.db.patch(existing._id, {
		144	role,
		145	status: opts.status ?? "active",
		146	updatedAt: now,
		147	});
		148	} else {
		149	await ctx.db.insert("workspaceMembers", {
		150	workspaceId: workspace._id,
		151	accountId: opts.accountId,
		152	role,
		153	status: opts.status ?? "active",
		154	createdAt: now,
		155	updatedAt: now,
		156	});
		157	}
		158	}
		159
		160	return membershipId;
129	});	161	});
130	}	162	}
131		163
@@ -143,6 +175,20 @@ async function addWorkspaceMember( · 11 unmodified lines
143	) {	175	) {
144	const now = Date.now();	176	const now = Date.now();
145	return await t.run(async (ctx) => {	177	return await t.run(async (ctx) => {
		178	const existing = await ctx.db
		179	.query("workspaceMembers")
		180	.withIndex("by_workspace_account", (q) => q.eq("workspaceId", opts.workspaceId).eq("accountId", opts.accountId))
		181	.first();
		182
		183	if (existing) {
		184	await ctx.db.patch(existing._id, {
		185	role: opts.role,
		186	status: opts.status ?? "active",
		187	updatedAt: now,
		188	});
		189	return existing._id;
		190	}
		191
146	return await ctx.db.insert("workspaceMembers", {	192	return await ctx.db.insert("workspaceMembers", {
147	workspaceId: opts.workspaceId,	193	workspaceId: opts.workspaceId,
148	accountId: opts.accountId,	194	accountId: opts.accountId,
@@ -262,7 +308,7 @@ describe("workspace access controls", () => { · 113 unmodified lines
262	expect(tasks).toEqual([]);	308	expect(tasks).toEqual([]);
263	});	309	});
264		310
265	test("org member without explicit workspace membership can read tasks", async () => {	311	test("org membership projection grants workspace read access", async () => {
266	const t = setup();	312	const t = setup();
267	const owner = await seedUser(t, { subject: "ws-owner-org-fallback" });	313	const owner = await seedUser(t, { subject: "ws-owner-org-fallback" });
268	const member = await seedUser(t, { subject: "ws-member-org-fallback" });	314	const member = await seedUser(t, { subject: "ws-member-org-fallback" });

executor/packages/database/convex/database/anonymous_session.ts+1−1

@@ -115,7 +115,7 @@ export const ensureAnonymousMcpSession = internalMutation({ · 114 unmodified lines
115	const membership = await ctx.db	115	const membership = await ctx.db
116	.query("workspaceMembers")	116	.query("workspaceMembers")
117	.withIndex("by_workspace_account", (q) => q.eq("workspaceId", args.workspaceId).eq("accountId", account._id))	117	.withIndex("by_workspace_account", (q) => q.eq("workspaceId", args.workspaceId).eq("accountId", account._id))
118	.unique();	118	.first();
119	if (!membership \|\| membership.status !== "active") {	119	if (!membership \|\| membership.status !== "active") {
120	throw new Error("Anonymous actor does not have workspace access");	120	throw new Error("Anonymous actor does not have workspace access");
121	}	121	}

executor/packages/database/convex/database/tool_sources.ts+2−2

   mapSource,
   normalizeSourceAuthFingerprint,
 } from "../../src/database/mappers";
+import { normalizeToolSourceConfig } from "../../src/database/tool_source_config";
 import { toolSourceTypeValidator } from "../../src/database/validators";
-import { asRecord } from "../../src/lib/object";
 export const upsertToolSource = internalMutation({
   args: {
   handler: async (ctx, args) => {
     const now = Date.now();
     const sourceId = args.id ?? `src_${crypto.randomUUID()}`;
-    const config = asRecord(args.config);
+    const config = normalizeToolSourceConfig(args.type, args.config);
     const specHash = computeSourceSpecHash(args.type, config);
     const authFingerprint = normalizeSourceAuthFingerprint(config.auth);
     const [existing, conflict] = await Promise.all([

executor/packages/database/convex/executor-mcp.e2e.test.ts+25−1

@@ -1,4 +1,4 @@
1	import { expect, test } from "bun:test";	1	import { afterAll, beforeAll, expect, test } from "bun:test";
2	import { convexTest } from "convex-test";	2	import { convexTest } from "convex-test";
3	import { Client } from "@modelcontextprotocol/sdk/client/index.js";	3	import { Client } from "@modelcontextprotocol/sdk/client/index.js";
4	import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";	4	import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
@@ -6,6 +6,30 @@ import { internal } from "./_generated/api"; · 1 unmodified line
6	import type { Id } from "./_generated/dataModel.d.ts";	6	import type { Id } from "./_generated/dataModel.d.ts";
7	import schema from "./schema";	7	import schema from "./schema";
8		8
		9	let previousAnonymousAuthPrivateKeyPem: string \| undefined;
		10	let previousAnonymousAuthPublicKeyPem: string \| undefined;
		11
		12	beforeAll(() => {
		13	previousAnonymousAuthPrivateKeyPem = process.env.ANONYMOUS_AUTH_PRIVATE_KEY_PEM;
		14	previousAnonymousAuthPublicKeyPem = process.env.ANONYMOUS_AUTH_PUBLIC_KEY_PEM;
		15	delete process.env.ANONYMOUS_AUTH_PRIVATE_KEY_PEM;
		16	delete process.env.ANONYMOUS_AUTH_PUBLIC_KEY_PEM;
		17	});
		18
		19	afterAll(() => {
		20	if (previousAnonymousAuthPrivateKeyPem === undefined) {
		21	delete process.env.ANONYMOUS_AUTH_PRIVATE_KEY_PEM;
		22	} else {
		23	process.env.ANONYMOUS_AUTH_PRIVATE_KEY_PEM = previousAnonymousAuthPrivateKeyPem;
		24	}
		25
		26	if (previousAnonymousAuthPublicKeyPem === undefined) {
		27	delete process.env.ANONYMOUS_AUTH_PUBLIC_KEY_PEM;
		28	} else {
		29	process.env.ANONYMOUS_AUTH_PUBLIC_KEY_PEM = previousAnonymousAuthPublicKeyPem;
		30	}
		31	});
		32
9	function setup() {	33	function setup() {
10	return convexTest(schema, {	34	return convexTest(schema, {
11	"./database.ts": () => import("./database"),	35	"./database.ts": () => import("./database"),

executor/packages/database/convex/invites.ts+3−2

   workosEnabled,
 } from "../src/invites/workos";
 import { normalizePersonalOrganizationName } from "../src/invites/normalize";
+import { safeRunAfter } from "../src/lib/scheduler";
 const organizationRoleValidator = v.union(
   v.literal("owner"),
       updatedAt: now,
     });
-    await ctx.scheduler.runAfter(0, internal.invites.deliverWorkosInvite, {
+    await safeRunAfter(ctx.scheduler, 0, internal.invites.deliverWorkosInvite, {
       inviteId,
       inviterWorkosUserId,
       expiresInDays: args.expiresInDays,
     });
     if (invite.providerInviteId) {
-      await ctx.scheduler.runAfter(0, internal.invites.revokeWorkosInvite, {
+      await safeRunAfter(ctx.scheduler, 0, internal.invites.revokeWorkosInvite, {
         inviteId: invite._id as Id<"invites">,
         providerInviteId: String(invite.providerInviteId),
       });

executor/packages/database/convex/organizationMembers.ts+20−6

 import { internal } from "./_generated/api";
 import { getOrganizationMembership } from "../../core/src/identity";
 import { organizationMutation, organizationQuery } from "../../core/src/function-builders";
+import { upsertOrganizationMembership } from "../src/auth/memberships";
+import { safeRunAfter } from "../src/lib/scheduler";
 const organizationRoleValidator = v.union(
   v.literal("owner"),
       throw new Error("Organization member not found");
     }
-    await ctx.db.patch(membership._id, {
+    await upsertOrganizationMembership(ctx, {
+      organizationId: ctx.organizationId,
+      accountId: args.accountId,
       role: args.role,
-      updatedAt: Date.now(),
+      status: membership.status,
+      billable: membership.billable,
+      invitedByAccountId: membership.invitedByAccountId,
+      workosOrgMembershipId: membership.workosOrgMembershipId,
+      now: Date.now(),
     });
     return { ok: true };
     const nextVersion = await ctx.runMutation(internal.billingInternal.bumpSeatSyncVersion, {
       organizationId: ctx.organizationId,
     });
-    await ctx.scheduler.runAfter(0, internal.billingSync.syncSeatQuantity, {
+    await safeRunAfter(ctx.scheduler, 0, internal.billingSync.syncSeatQuantity, {
       organizationId: ctx.organizationId,
       expectedVersion: nextVersion,
     });
       throw new Error("Organization member not found");
     }
-    await ctx.db.patch(membership._id, {
+    await upsertOrganizationMembership(ctx, {
+      organizationId: ctx.organizationId,
+      accountId: args.accountId,
+      role: membership.role,
       status: "removed",
-      updatedAt: Date.now(),
+      billable: false,
+      invitedByAccountId: membership.invitedByAccountId,
+      workosOrgMembershipId: membership.workosOrgMembershipId,
+      now: Date.now(),
     });
     const nextVersion = await ctx.runMutation(internal.billingInternal.bumpSeatSyncVersion, {
       organizationId: ctx.organizationId,
     });
-    await ctx.scheduler.runAfter(0, internal.billingSync.syncSeatQuantity, {
+    await safeRunAfter(ctx.scheduler, 0, internal.billingSync.syncSeatQuantity, {
       organizationId: ctx.organizationId,
       expectedVersion: nextVersion,
     });

executor/packages/database/convex/schema.ts+4−12

   //
   // Primary access patterns:
   // - Resolve by organization.
-  // - (Potential/expected) resolve by Stripe customer id in webhook reconciliation.
   billingCustomers: defineTable({
     organizationId: v.id("organizations"),
     stripeCustomerId: v.string(), // external Stripe customer ID
     createdAt: v.number(),
     updatedAt: v.number(),
   })
-    .index("by_org", ["organizationId"])
+    .index("by_org", ["organizationId"]),
-    .index("by_stripe_customer_id", ["stripeCustomerId"]),
   // Stripe subscription state for an organization.
   //
   // Primary access patterns:
   // - List subscriptions for an org.
-  // - (Potential/expected) resolve by subscription id and filter by status.
   billingSubscriptions: defineTable({
     organizationId: v.id("organizations"),
     stripeSubscriptionId: v.string(), // external Stripe subscription ID
     createdAt: v.number(),
     updatedAt: v.number(),
   })
-    .index("by_org", ["organizationId"])
+    .index("by_org", ["organizationId"]),
-    .index("by_org_status", ["organizationId", "status"])
-    .index("by_stripe_subscription_id", ["stripeSubscriptionId"]),
   // Seat syncing bookkeeping (eg Stripe per-seat quantity).
   // Stored separately from subscription records so sync logic can be retried/idempotent.
   // Primary access patterns:
   // - Get a specific call by (taskId, callId).
   // - List calls for a task ordered by creation time.
-  // - (Potential/expected) resolve via approval id to tie approvals to tool call rows.
   toolCalls: defineTable({
     taskId: v.string(),
     callId: v.string(),
   })
     .index("by_task_call", ["taskId", "callId"])
     .index("by_task_created", ["taskId", "createdAt"])
-    .index("by_workspace_created", ["workspaceId", "createdAt"])
+    .index("by_workspace_created", ["workspaceId", "createdAt"]),
-    .index("by_approval_id", ["approvalId"]),
   // Append-only event log for a task.
   // `sequence` is monotonically increasing per task (used for ordered replay).
     samplePaths: v.array(v.string()),
     createdAt: v.number(),
   })
-    .index("by_workspace_build", ["workspaceId", "buildId"])
+    .index("by_workspace_build", ["workspaceId", "buildId"]),
-    .index("by_workspace_build_namespace", ["workspaceId", "buildId", "namespace"]),
   // Anonymous session linkage.
   // Used to map an unauthenticated/anonymous actor to a backing `accounts` row and a

executor/packages/database/src/auth/actor_identity.ts+31−0

@@ -0,0 +1,31 @@
	1	import { actorIdForAccount } from "../../../core/src/identity";
	2
	3	type WorkspaceAccessIdentity = {
	4	actorId?: string;
	5	accountId: string;
	6	provider: string;
	7	providerAccountId: string;
	8	};
	9
	10	export function canonicalActorIdForWorkspaceAccess(access: WorkspaceAccessIdentity): string {
	11	const existingActorId = typeof access.actorId === "string" ? access.actorId.trim() : "";
	12	if (existingActorId.length > 0) {
	13	return existingActorId;
	14	}
	15
	16	return actorIdForAccount({
	17	_id: access.accountId,
	18	provider: access.provider,
	19	providerAccountId: access.providerAccountId,
	20	});
	21	}
	22
	23	export function assertMatchesCanonicalActorId(
	24	providedActorId: string \| undefined,
	25	canonicalActorId: string,
	26	fieldName = "actorId",
	27	): void {
	28	if (providedActorId && providedActorId !== canonicalActorId) {
	29	throw new Error(`${fieldName} must match the authenticated workspace actor`);
	30	}
	31	}

executor/packages/database/src/auth/bootstrap.ts+20−31

 import { getOrganizationByWorkosOrgId } from "./db_queries";
 import { getAuthKitUserProfile, resolveIdentityProfile } from "./identity";
 import {
-  ensureWorkspaceMembership,
   mapOrganizationRoleToWorkspaceRole,
   markPendingInvitesAcceptedByEmail,
   upsertOrganizationMembership,
 } from "./memberships";
 import { ensurePersonalWorkspace, refreshGeneratedPersonalWorkspaceNames } from "./personal_workspace";
+import { projectAccountOrganizationMembershipsToWorkspaceMembers } from "./workspace_membership_projection";
 import type { AccountId } from "./types";
 async function seedHintedOrganizationMembership(
   });
 }
-async function syncWorkspaceMembershipsForOrganizations(ctx: MutationCtx, args: { accountId: AccountId; now: number }) {
-  const activeOrganizationMemberships = await ctx.db
-    .query("organizationMembers")
-    .withIndex("by_account", (q) => q.eq("accountId", args.accountId))
-    .filter((q) => q.eq(q.field("status"), "active"))
-    .collect();
-  for (const membership of activeOrganizationMemberships) {
-    const orgWorkspaces = await ctx.db
-      .query("workspaces")
-      .withIndex("by_organization_created", (q) => q.eq("organizationId", membership.organizationId))
-      .collect();
-    const workspaceRole = mapOrganizationRoleToWorkspaceRole(membership.role);
-    for (const workspace of orgWorkspaces) {
-      await ensureWorkspaceMembership(ctx, {
-        workspaceId: workspace._id,
-        accountId: args.accountId,
-        role: workspaceRole,
-        now: args.now,
-      });
-    }
-  }
-}
 async function ensureAtLeastOneWorkspaceMembership(ctx: MutationCtx, args: { accountId: AccountId }) {
   const activeWorkspaceMembership = await ctx.db
     .query("workspaceMembers")
   return Boolean(activeWorkspaceMembership);
 }
+async function backfillWorkspaceMembershipsIfMissing(ctx: MutationCtx, args: { accountId: AccountId; now: number }) {
+  await projectAccountOrganizationMembershipsToWorkspaceMembers(ctx, {
+    accountId: args.accountId,
+    now: args.now,
+    mapRole: mapOrganizationRoleToWorkspaceRole,
+  });
+  return await ensureAtLeastOneWorkspaceMembership(ctx, {
+    accountId: args.accountId,
+  });
+}
 export async function bootstrapCurrentWorkosAccountImpl(ctx: MutationCtx) {
   const identity = await ctx.auth.getUserIdentity();
   if (!identity) return null;
     now,
   });
-  await syncWorkspaceMembershipsForOrganizations(ctx, {
+  let hasActiveWorkspaceMembership = await ensureAtLeastOneWorkspaceMembership(ctx, {
     accountId: account._id,
-    now,
   });
-  const hasActiveWorkspaceMembership = await ensureAtLeastOneWorkspaceMembership(ctx, {
+  if (!hasActiveWorkspaceMembership) {
-    accountId: account._id,
+    hasActiveWorkspaceMembership = await backfillWorkspaceMembershipsIfMissing(ctx, {
-  });
+      accountId: account._id,
+      now,
+    });
+  }
   if (!hasActiveWorkspaceMembership) {
     await ensurePersonalWorkspace(ctx, account._id, {

executor/packages/database/src/auth/event_handlers.ts+100−101

 } from "./db_queries";
 import {
   deriveOrganizationMembershipState,
-  deriveWorkspaceMembershipRole,
+  mapOrganizationRoleToWorkspaceRole,
   markPendingInvitesAcceptedByEmail,
   upsertOrganizationMembership,
 } from "./memberships";
 import { ensureUniqueOrganizationSlug } from "./naming";
+import { seedWorkspaceMembersFromOrganization } from "./workspace_membership_projection";
 type WorkosMembershipEventData = {
   id: string;
   status?: string;
 };
-async function resolveMembershipRecord(
+function deriveOrganizationRoleFromWorkosSlug(workosRoleSlug?: string): Doc<"organizationMembers">["role"] {
+  return workosRoleSlug === "admin" ? "admin" : "member";
+}
+async function resolveMembershipAccountAndOrganization(
   ctx: Pick<MutationCtx, "db">,
   data: WorkosMembershipEventData,
 ) {
-  let membership = await ctx.db
+  const workosUserId = data.user_id ?? data.userId;
-    .query("workspaceMembers")
+  const workosOrgId = data.organization_id ?? data.organizationId;
-    .withIndex("by_workos_membership_id", (q) => q.eq("workosOrgMembershipId", data.id))
-    .unique();
-  let account: Doc<"accounts"> | null = null;
-  let workspace: Doc<"workspaces"> | null = null;
-  if (!membership) {
+  if (workosUserId && workosOrgId) {
-    const workosUserId = data.user_id ?? data.userId;
+    const [account, organization] = await Promise.all([
-    const workosOrgId = data.organization_id ?? data.organizationId;
-    if (!workosUserId || !workosOrgId) {
-      return { membership: null, account: null, workspace: null };
-    }
-    [account, workspace] = await Promise.all([
       getAccountByWorkosId(ctx, workosUserId),
-      getWorkspaceByWorkosOrgId(ctx, workosOrgId),
+      getOrganizationByWorkosOrgId(ctx, workosOrgId),
     ]);
-    if (!account || !workspace) {
-      return { membership: null, account: null, workspace: null };
-    }
-    const workspaceId = workspace._id;
-    const accountId = account._id;
-    membership = await ctx.db
+    if (account && organization) {
-      .query("workspaceMembers")
+      return {
-      .withIndex("by_workspace_account", (q) => q.eq("workspaceId", workspaceId).eq("accountId", accountId))
+        account,
-      .unique();
+        organization,
-    if (!membership) {
+        fallbackRole: undefined as Doc<"workspaceMembers">["role"] | undefined,
-      return { membership: null, account: null, workspace: null };
+      };
     }
-  } else {
-    account = await ctx.db.get(membership.accountId);
-    workspace = await ctx.db.get(membership.workspaceId);
   }
+  const linkedMemberships = await ctx.db
+    .query("workspaceMembers")
+    .withIndex("by_workos_membership_id", (q) => q.eq("workosOrgMembershipId", data.id))
+    .collect();
+  if (linkedMemberships.length === 0) {
+    return {
+      account: null,
+      organization: null,
+      fallbackRole: undefined as Doc<"workspaceMembers">["role"] | undefined,
+    };
+  }
+  const linkedMembership = linkedMemberships[0]!;
+  const [account, workspace] = await Promise.all([
+    ctx.db.get(linkedMembership.accountId),
+    ctx.db.get(linkedMembership.workspaceId),
+  ]);
   if (!account || !workspace) {
-    return { membership: null, account: null, workspace: null };
+    return {
+      account: null,
+      organization: null,
+      fallbackRole: linkedMembership.role,
+    };
   }
-  return { membership, account, workspace };
+  const organization = await ctx.db.get(workspace.organizationId);
+  return {
+    account,
+    organization,
+    fallbackRole: linkedMembership.role,
+  };
 }
 export const workosEventHandlers = {
         workosOrgId: event.data.id,
         updatedAt: now,
       });
+      await seedWorkspaceMembersFromOrganization(ctx, {
+        organizationId: organization._id,
+        workspaceId: existingWorkspace._id,
+        now,
+        mapRole: mapOrganizationRoleToWorkspaceRole,
+      });
       return;
     }
         workosOrgId: event.data.id,
         updatedAt: now,
       });
+      await seedWorkspaceMembersFromOrganization(ctx, {
+        organizationId: organization._id,
+        workspaceId: organizationWorkspace._id,
+        now,
+        mapRole: mapOrganizationRoleToWorkspaceRole,
+      });
       return;
     }
       createdAt: now,
       updatedAt: now,
     });
+    const createdWorkspace = await getWorkspaceByWorkosOrgId(ctx, event.data.id);
+    if (createdWorkspace) {
+      await seedWorkspaceMembersFromOrganization(ctx, {
+        organizationId: organization._id,
+        workspaceId: createdWorkspace._id,
+        now,
+        mapRole: mapOrganizationRoleToWorkspaceRole,
+      });
+    }
   },
   "organization.updated": async (ctx, event) => {
   "organization_membership.created": async (ctx, event) => {
     const now = Date.now();
     const data = event.data as WorkosMembershipEventData;
-    const workosUserId = data.user_id ?? data.userId;
+    const { account, organization } = await resolveMembershipAccountAndOrganization(ctx, data);
-    const workosOrgId = data.organization_id ?? data.organizationId;
+    if (!account || !organization) return;
-    if (!workosUserId || !workosOrgId) return;
-    const [account, workspace] = await Promise.all([
-      getAccountByWorkosId(ctx, workosUserId),
-      getWorkspaceByWorkosOrgId(ctx, workosOrgId),
-    ]);
-    if (!account || !workspace) return;
-    const existing = await ctx.db
+    const role = deriveOrganizationRoleFromWorkosSlug(data.role?.slug);
-      .query("workspaceMembers")
-      .withIndex("by_workspace_account", (q) => q.eq("workspaceId", workspace._id).eq("accountId", account._id))
-      .unique();
-    const role = deriveWorkspaceMembershipRole(data.role?.slug);
     const status = deriveOrganizationMembershipState(data.status);
     await upsertOrganizationMembership(ctx, {
-      organizationId: workspace.organizationId,
+      organizationId: organization._id,
       accountId: account._id,
       role,
       status,
       billable: status === "active",
+      workosOrgMembershipId: data.id,
       now,
     });
     if (status === "active") {
       await markPendingInvitesAcceptedByEmail(ctx, {
-        organizationId: workspace.organizationId,
+        organizationId: organization._id,
         email: account.email,
         acceptedAt: now,
       });
     }
-    if (existing) {
-      await ctx.db.patch(existing._id, {
-        workosOrgMembershipId: event.data.id,
-        role,
-        status,
-        updatedAt: now,
-      });
-      return;
-    }
-    await ctx.db.insert("workspaceMembers", {
-      workspaceId: workspace._id,
-      accountId: account._id,
-      workosOrgMembershipId: event.data.id,
-      role,
-      status,
-      createdAt: now,
-      updatedAt: now,
-    });
   },
   "organization_membership.updated": async (ctx, event) => {
     const now = Date.now();
     const data = event.data as WorkosMembershipEventData;
-    const { membership, account, workspace } = await resolveMembershipRecord(ctx, data);
+    const { account, organization } = await resolveMembershipAccountAndOrganization(ctx, data);
-    if (!membership || !account || !workspace) {
+    if (!account || !organization) {
       return;
     }
-    const role = deriveWorkspaceMembershipRole(data.role?.slug);
+    const role = deriveOrganizationRoleFromWorkosSlug(data.role?.slug);
     const status = deriveOrganizationMembershipState(data.status);
     await upsertOrganizationMembership(ctx, {
-      organizationId: workspace.organizationId,
+      organizationId: organization._id,
       accountId: account._id,
       role,
       status,
       billable: status === "active",
+      workosOrgMembershipId: data.id,
       now,
     });
     if (status === "active") {
       await markPendingInvitesAcceptedByEmail(ctx, {
-        organizationId: workspace.organizationId,
+        organizationId: organization._id,
         email: account.email,
         acceptedAt: now,
       });
     }
-    await ctx.db.patch(membership._id, {
-      workosOrgMembershipId: data.id,
-      role,
-      status,
-      updatedAt: now,
-    });
   },
   "organization_membership.deleted": async (ctx, event) => {
     const now = Date.now();
-    const membership = await ctx.db
+    const data = event.data as WorkosMembershipEventData;
-      .query("workspaceMembers")
+    const { account, organization, fallbackRole } = await resolveMembershipAccountAndOrganization(ctx, data);
-      .withIndex("by_workos_membership_id", (q) => q.eq("workosOrgMembershipId", event.data.id))
+    if (!account || !organization) {
-      .unique();
+      return;
-    if (!membership) return;
-    const workspace = await ctx.db.get(membership.workspaceId);
-    if (workspace?.organizationId) {
-      await upsertOrganizationMembership(ctx, {
-        organizationId: workspace.organizationId,
-        accountId: membership.accountId,
-        role: membership.role,
-        status: "removed",
-        billable: false,
-        now,
-      });
     }
-    await ctx.db.delete(membership._id);
+    const existingOrgMembership = await ctx.db
+      .query("organizationMembers")
+      .withIndex("by_org_account", (q) => q.eq("organizationId", organization._id).eq("accountId", account._id))
+      .first();
+    await upsertOrganizationMembership(ctx, {
+      organizationId: organization._id,
+      accountId: account._id,
+      role: existingOrgMembership?.role ?? (fallbackRole === "admin" ? "admin" : "member"),
+      status: "removed",
+      billable: false,
+      workosOrgMembershipId: data.id,
+      now,
+    });
   },
 } satisfies Partial<Parameters<AuthKit<DataModel>["events"]>[0]>;

executor/packages/database/src/auth/memberships.ts+21−49

-import type { Doc } from "../../convex/_generated/dataModel.d.ts";
 import type {
   AccountId,
   DbCtx,
   OrganizationId,
   OrganizationMemberStatus,
   OrganizationRole,
-  WorkspaceId,
   WorkspaceMemberRole,
 } from "./types";
+import { projectOrganizationMembershipToWorkspaceMembers } from "./workspace_membership_projection";
 export function mapOrganizationRoleToWorkspaceRole(role: OrganizationRole): WorkspaceMemberRole {
   if (role === "owner") {
     status: OrganizationMemberStatus;
     billable: boolean;
     invitedByAccountId?: AccountId;
+    workosOrgMembershipId?: string;
     now: number;
   },
 ) {
   const existing = await ctx.db
     .query("organizationMembers")
     .withIndex("by_org_account", (q) => q.eq("organizationId", args.organizationId).eq("accountId", args.accountId))
-    .unique();
+    .first();
   if (existing) {
     await ctx.db.patch(existing._id, {
       status: args.status,
       billable: args.billable,
       invitedByAccountId: args.invitedByAccountId,
+      workosOrgMembershipId: args.workosOrgMembershipId,
       joinedAt: args.status === "active" ? (existing.joinedAt ?? args.now) : existing.joinedAt,
       updatedAt: args.now,
     });
-    return;
+  } else {
+    await ctx.db.insert("organizationMembers", {
+      organizationId: args.organizationId,
+      accountId: args.accountId,
+      role: args.role,
+      status: args.status,
+      billable: args.billable,
+      invitedByAccountId: args.invitedByAccountId,
+      workosOrgMembershipId: args.workosOrgMembershipId,
+      joinedAt: args.status === "active" ? args.now : undefined,
+      createdAt: args.now,
+      updatedAt: args.now,
+    });
   }
-  await ctx.db.insert("organizationMembers", {
+  await projectOrganizationMembershipToWorkspaceMembers(ctx, {
     organizationId: args.organizationId,
     accountId: args.accountId,
-    role: args.role,
+    role: mapOrganizationRoleToWorkspaceRole(args.role),
     status: args.status,
-    billable: args.billable,
+    now: args.now,
-    invitedByAccountId: args.invitedByAccountId,
+    workosOrgMembershipId: args.workosOrgMembershipId,
-    joinedAt: args.status === "active" ? args.now : undefined,
-    createdAt: args.now,
-    updatedAt: args.now,
-  });
-}
-export async function ensureWorkspaceMembership(
-  ctx: DbCtx,
-  args: {
-    workspaceId: WorkspaceId;
-    accountId: AccountId;
-    role: WorkspaceMemberRole;
-    now: number;
-  },
-) {
-  const existing = await ctx.db
-    .query("workspaceMembers")
-    .withIndex("by_workspace_account", (q) => q.eq("workspaceId", args.workspaceId).eq("accountId", args.accountId))
-    .unique();
-  if (existing) {
-    if (existing.status === "active") {
-      await ctx.db.patch(existing._id, {
-        role: args.role,
-        updatedAt: args.now,
-      });
-    }
-    return;
-  }
-  await ctx.db.insert("workspaceMembers", {
-    workspaceId: args.workspaceId,
-    accountId: args.accountId,
-    role: args.role,
-    status: "active",
-    createdAt: args.now,
-    updatedAt: args.now,
   });
 }
   }
 }
-export function deriveWorkspaceMembershipRole(workosRoleSlug?: string): Doc<"workspaceMembers">["role"] {
-  return workosRoleSlug === "admin" ? "admin" : "member";
-}
 export function deriveOrganizationMembershipState(status?: string): OrganizationMemberStatus {
   return status === "active" ? "active" : "pending";
 }

executor/packages/database/src/auth/workspace_membership_projection.ts+126−0

@@ -0,0 +1,126 @@
	1	import type { Doc } from "../../convex/_generated/dataModel.d.ts";
	2	import type { AccountId, DbCtx, OrganizationId, WorkspaceMemberRole } from "./types";
	3
	4	type WorkspaceMemberStatus = Doc<"workspaceMembers">["status"];
	5
	6	type ProjectOrganizationMembershipArgs = {
	7	organizationId: OrganizationId;
	8	accountId: AccountId;
	9	role: WorkspaceMemberRole;
	10	status: WorkspaceMemberStatus;
	11	now: number;
	12	workosOrgMembershipId?: string;
	13	};
	14
	15	async function upsertWorkspaceMembership(
	16	ctx: DbCtx,
	17	args: {
	18	workspaceId: Doc<"workspaces">["_id"];
	19	accountId: AccountId;
	20	role: WorkspaceMemberRole;
	21	status: WorkspaceMemberStatus;
	22	now: number;
	23	workosOrgMembershipId?: string;
	24	},
	25	): Promise<void> {
	26	const existing = await ctx.db
	27	.query("workspaceMembers")
	28	.withIndex("by_workspace_account", (q) => q.eq("workspaceId", args.workspaceId).eq("accountId", args.accountId))
	29	.first();
	30
	31	if (existing) {
	32	await ctx.db.patch(existing._id, {
	33	role: args.role,
	34	status: args.status,
	35	workosOrgMembershipId: args.workosOrgMembershipId,
	36	updatedAt: args.now,
	37	});
	38	return;
	39	}
	40
	41	await ctx.db.insert("workspaceMembers", {
	42	workspaceId: args.workspaceId,
	43	accountId: args.accountId,
	44	role: args.role,
	45	status: args.status,
	46	workosOrgMembershipId: args.workosOrgMembershipId,
	47	createdAt: args.now,
	48	updatedAt: args.now,
	49	});
	50	}
	51
	52	export async function projectOrganizationMembershipToWorkspaceMembers(
	53	ctx: DbCtx,
	54	args: ProjectOrganizationMembershipArgs,
	55	): Promise<void> {
	56	const workspaces = await ctx.db
	57	.query("workspaces")
	58	.withIndex("by_organization_created", (q) => q.eq("organizationId", args.organizationId))
	59	.collect();
	60
	61	for (const workspace of workspaces) {
	62	await upsertWorkspaceMembership(ctx, {
	63	workspaceId: workspace._id,
	64	accountId: args.accountId,
	65	role: args.role,
	66	status: args.status,
	67	now: args.now,
	68	workosOrgMembershipId: args.workosOrgMembershipId,
	69	});
	70	}
	71	}
	72
	73	export async function projectAccountOrganizationMembershipsToWorkspaceMembers(
	74	ctx: DbCtx,
	75	args: { accountId: AccountId; now: number; mapRole: (role: Doc<"organizationMembers">["role"]) => WorkspaceMemberRole },
	76	): Promise<void> {
	77	const memberships = await ctx.db
	78	.query("organizationMembers")
	79	.withIndex("by_account", (q) => q.eq("accountId", args.accountId))
	80	.collect();
	81
	82	for (const membership of memberships) {
	83	if (membership.status === "removed") {
	84	continue;
	85	}
	86
	87	await projectOrganizationMembershipToWorkspaceMembers(ctx, {
	88	organizationId: membership.organizationId,
	89	accountId: membership.accountId,
	90	role: args.mapRole(membership.role),
	91	status: membership.status,
	92	now: args.now,
	93	workosOrgMembershipId: membership.workosOrgMembershipId,
	94	});
	95	}
	96	}
	97
	98	export async function seedWorkspaceMembersFromOrganization(
	99	ctx: DbCtx,
	100	args: {
	101	organizationId: OrganizationId;
	102	workspaceId: Doc<"workspaces">["_id"];
	103	now: number;
	104	mapRole: (role: Doc<"organizationMembers">["role"]) => WorkspaceMemberRole;
	105	},
	106	): Promise<void> {
	107	const orgMemberships = await ctx.db
	108	.query("organizationMembers")
	109	.withIndex("by_org", (q) => q.eq("organizationId", args.organizationId))
	110	.collect();
	111
	112	for (const membership of orgMemberships) {
	113	if (membership.status === "removed") {
	114	continue;
	115	}
	116
	117	await upsertWorkspaceMembership(ctx, {
	118	workspaceId: args.workspaceId,
	119	accountId: membership.accountId,
	120	role: args.mapRole(membership.role),
	121	status: membership.status,
	122	now: args.now,
	123	workosOrgMembershipId: membership.workosOrgMembershipId,
	124	});
	125	}
	126	}

executor/packages/database/src/billing/public-handlers.ts+2−1

 import type { Id } from "../../convex/_generated/dataModel.d.ts";
 import type { ActionCtx, MutationCtx, QueryCtx } from "../../convex/_generated/server";
 import { canManageBilling, isAdminRole } from "../../../core/src/identity";
+import { safeRunAfter } from "../lib/scheduler";
 type Internal = typeof import("../../convex/_generated/api").internal;
 type Components = typeof import("../../convex/_generated/api").components;
     organizationId: typedCtx.organizationId,
   });
-  await typedCtx.scheduler.runAfter(0, internal.billingSync.syncSeatQuantity, {
+  await safeRunAfter(typedCtx.scheduler, 0, internal.billingSync.syncSeatQuantity, {
     organizationId: typedCtx.organizationId,
     expectedVersion: nextVersion,
   });

executor/packages/database/src/credentials-node/upsert-credential.ts+7−6

 import { WorkOS } from "@workos-inc/node";
 import type { Id } from "../../convex/_generated/dataModel.d.ts";
 import type { ActionCtx } from "../../convex/_generated/server";
+import {
+  assertMatchesCanonicalActorId,
+  canonicalActorIdForWorkspaceAccess,
+} from "../auth/actor_identity";
 import { asRecord } from "../lib/object";
 type Internal = typeof import("../../convex/_generated/api").internal;
     workspaceId: args.workspaceId,
     sessionId: args.sessionId,
   });
-  const canonicalActorId = access.provider === "anonymous"
+  const canonicalActorId = canonicalActorIdForWorkspaceAccess(access);
-    ? access.providerAccountId
+  if (args.scope === "actor") {
-    : access.accountId;
+    assertMatchesCanonicalActorId(args.actorId, canonicalActorId);
-  if (args.scope === "actor" && args.actorId && args.actorId !== canonicalActorId) {
-    throw new Error("actorId must match the authenticated workspace actor");
   }
   const actorId = normalizedActorId(args.scope, args.actorId ?? canonicalActorId);

executor/packages/database/src/database/anonymous.ts+2−42

@@ -2,9 +2,7 @@ import type { Doc } from "../../convex/_generated/dataModel.d.ts"; · 1 unmodified line
2	import type { MutationCtx } from "../../convex/_generated/server";	2	import type { MutationCtx } from "../../convex/_generated/server";
3	import { slugify } from "../../../core/src/identity";	3	import { slugify } from "../../../core/src/identity";
4	import { ensureUniqueSlug } from "../../../core/src/slug";	4	import { ensureUniqueSlug } from "../../../core/src/slug";
5		5	import { upsertOrganizationMembership } from "../auth/memberships";
6	type OrganizationRole = "owner" \| "admin" \| "member" \| "billing_admin";
7	type OrganizationMemberStatus = "active" \| "pending" \| "removed";
8		6
9	async function ensureUniqueOrganizationSlug(ctx: Pick<MutationCtx, "db">, baseName: string): Promise<string> {	7	async function ensureUniqueOrganizationSlug(ctx: Pick<MutationCtx, "db">, baseName: string): Promise<string> {
10	const baseSlug = slugify(baseName, "workspace");	8	const baseSlug = slugify(baseName, "workspace");
@@ -17,44 +15,6 @@ async function ensureUniqueOrganizationSlug(ctx: Pick<MutationCtx, "db">, baseNa · 6 unmodified lines
17	});	15	});
18	}	16	}
19		17
20	async function upsertOrganizationMembership(
21	ctx: Pick<MutationCtx, "db">,
22	args: {
23	organizationId: Doc<"organizations">["_id"];
24	accountId: Doc<"accounts">["_id"];
25	role: OrganizationRole;
26	status: OrganizationMemberStatus;
27	billable: boolean;
28	now: number;
29	},
30	) {
31	const existing = await ctx.db
32	.query("organizationMembers")
33	.withIndex("by_org_account", (q) => q.eq("organizationId", args.organizationId).eq("accountId", args.accountId))
34	.unique();
35
36	if (existing) {
37	await ctx.db.patch(existing._id, {
38	role: args.role,
39	status: args.status,
40	billable: args.billable,
41	joinedAt: args.status === "active" ? (existing.joinedAt ?? args.now) : existing.joinedAt,
42	updatedAt: args.now,
43	});
44	return;
45	}
46
47	await ctx.db.insert("organizationMembers", {
48	organizationId: args.organizationId,
49	accountId: args.accountId,
50	role: args.role,
51	status: args.status,
52	billable: args.billable,
53	joinedAt: args.status === "active" ? args.now : undefined,
54	createdAt: args.now,
55	updatedAt: args.now,
56	});
57	}
58		18
59	export async function ensureAnonymousIdentity(	19	export async function ensureAnonymousIdentity(
60	ctx: MutationCtx,	20	ctx: MutationCtx,
@@ -136,7 +96,7 @@ export async function ensureAnonymousIdentity( · 75 unmodified lines
136	let user = await ctx.db	96	let user = await ctx.db
137	.query("workspaceMembers")	97	.query("workspaceMembers")
138	.withIndex("by_workspace_account", (q) => q.eq("workspaceId", workspace._id).eq("accountId", account._id))	98	.withIndex("by_workspace_account", (q) => q.eq("workspaceId", workspace._id).eq("accountId", account._id))
139	.unique();	99	.first();
140		100
141	if (!user) {	101	if (!user) {
142	const userId = await ctx.db.insert("workspaceMembers", {	102	const userId = await ctx.db.insert("workspaceMembers", {

executor/packages/database/src/database/tool_source_config.ts+179−0

@@ -0,0 +1,179 @@
	1	import type { OpenApiAuth } from "../../../core/src/tool/source-types";
	2	import type { ToolApprovalMode } from "../../../core/src/types";
	3	import { asRecord } from "../lib/object";
	4
	5	type ToolSourceType = "mcp" \| "openapi" \| "graphql";
	6
	7	function optionalTrimmedString(value: unknown): string \| undefined {
	8	if (typeof value !== "string") return undefined;
	9	const trimmed = value.trim();
	10	return trimmed.length > 0 ? trimmed : undefined;
	11	}
	12
	13	function requiredTrimmedString(value: unknown, fieldName: string): string {
	14	const trimmed = optionalTrimmedString(value);
	15	if (!trimmed) {
	16	throw new Error(`Tool source ${fieldName} is required`);
	17	}
	18	return trimmed;
	19	}
	20
	21	function normalizeStringMap(value: unknown, fieldName: string): Record<string, string> \| undefined {
	22	if (value === undefined) return undefined;
	23	const record = asRecord(value);
	24	if (Object.keys(record).length === 0) {
	25	return undefined;
	26	}
	27
	28	const normalized: Record<string, string> = {};
	29	for (const [key, rawValue] of Object.entries(record)) {
	30	const normalizedKey = key.trim();
	31	if (!normalizedKey) continue;
	32	if (typeof rawValue !== "string") {
	33	throw new Error(`Tool source ${fieldName}.${normalizedKey} must be a string`);
	34	}
	35	normalized[normalizedKey] = rawValue;
	36	}
	37
	38	return Object.keys(normalized).length > 0 ? normalized : undefined;
	39	}
	40
	41	function normalizeApprovalMode(value: unknown, fieldName: string): ToolApprovalMode \| undefined {
	42	if (value === undefined) return undefined;
	43	if (value === "auto" \|\| value === "required") {
	44	return value;
	45	}
	46	throw new Error(`Tool source ${fieldName} must be 'auto' or 'required'`);
	47	}
	48
	49	function normalizeOverrides(value: unknown, fieldName: string): Record<string, { approval?: ToolApprovalMode }> \| undefined {
	50	if (value === undefined) return undefined;
	51	const raw = asRecord(value);
	52	if (Object.keys(raw).length === 0) {
	53	return undefined;
	54	}
	55
	56	const normalized: Record<string, { approval?: ToolApprovalMode }> = {};
	57	for (const [rawKey, rawValue] of Object.entries(raw)) {
	58	const key = rawKey.trim();
	59	if (!key) continue;
	60	const entry = asRecord(rawValue);
	61	const approval = normalizeApprovalMode(entry.approval, `${fieldName}.${key}.approval`);
	62	normalized[key] = approval ? { approval } : {};
	63	}
	64
	65	return Object.keys(normalized).length > 0 ? normalized : undefined;
	66	}
	67
	68	function normalizeAuthMode(value: unknown): "static" \| "workspace" \| "actor" \| undefined {
	69	if (value === undefined) return undefined;
	70	if (value === "static" \|\| value === "workspace" \|\| value === "actor") {
	71	return value;
	72	}
	73	throw new Error("Tool source auth.mode must be 'static', 'workspace', or 'actor'");
	74	}
	75
	76	function normalizeAuth(value: unknown): OpenApiAuth \| undefined {
	77	if (value === undefined) return undefined;
	78
	79	const auth = asRecord(value);
	80	const authType = optionalTrimmedString(auth.type);
	81	if (!authType) {
	82	throw new Error("Tool source auth.type is required when auth is provided");
	83	}
	84
	85	if (authType === "none") {
	86	return { type: "none" };
	87	}
	88
	89	if (authType === "basic") {
	90	return {
	91	type: "basic",
	92	mode: normalizeAuthMode(auth.mode),
	93	username: optionalTrimmedString(auth.username),
	94	password: optionalTrimmedString(auth.password),
	95	};
	96	}
	97
	98	if (authType === "bearer") {
	99	return {
	100	type: "bearer",
	101	mode: normalizeAuthMode(auth.mode),
	102	token: optionalTrimmedString(auth.token),
	103	};
	104	}
	105
	106	if (authType === "apiKey") {
	107	const header = requiredTrimmedString(auth.header, "auth.header");
	108	return {
	109	type: "apiKey",
	110	mode: normalizeAuthMode(auth.mode),
	111	header,
	112	value: optionalTrimmedString(auth.value),
	113	};
	114	}
	115
	116	throw new Error(`Unsupported tool source auth.type '${authType}'`);
	117	}
	118
	119	function normalizeSpec(value: unknown): string \| Record<string, unknown> {
	120	if (typeof value === "string") {
	121	const trimmed = value.trim();
	122	if (!trimmed) {
	123	throw new Error("Tool source spec is required");
	124	}
	125	return trimmed;
	126	}
	127
	128	const specObject = asRecord(value);
	129	if (Object.keys(specObject).length === 0) {
	130	throw new Error("Tool source spec must be a non-empty string or object");
	131	}
	132	return specObject;
	133	}
	134
	135	export function normalizeToolSourceConfig(type: ToolSourceType, rawConfig: unknown): Record<string, unknown> {
	136	const config = asRecord(rawConfig);
	137
	138	if (type === "mcp") {
	139	const url = requiredTrimmedString(config.url, "url");
	140	const transport = config.transport;
	141	if (transport !== undefined && transport !== "sse" && transport !== "streamable-http") {
	142	throw new Error("Tool source transport must be 'sse' or 'streamable-http'");
	143	}
	144
	145	return {
	146	url,
	147	transport,
	148	auth: normalizeAuth(config.auth),
	149	queryParams: normalizeStringMap(config.queryParams, "queryParams"),
	150	discoveryHeaders: normalizeStringMap(config.discoveryHeaders, "discoveryHeaders"),
	151	defaultApproval: normalizeApprovalMode(config.defaultApproval, "defaultApproval"),
	152	overrides: normalizeOverrides(config.overrides, "overrides"),
	153	};
	154	}
	155
	156	if (type === "graphql") {
	157	const endpoint = requiredTrimmedString(config.endpoint, "endpoint");
	158
	159	return {
	160	endpoint,
	161	schema: Object.keys(asRecord(config.schema)).length > 0 ? asRecord(config.schema) : undefined,
	162	auth: normalizeAuth(config.auth),
	163	defaultQueryApproval: normalizeApprovalMode(config.defaultQueryApproval, "defaultQueryApproval"),
	164	defaultMutationApproval: normalizeApprovalMode(config.defaultMutationApproval, "defaultMutationApproval"),
	165	overrides: normalizeOverrides(config.overrides, "overrides"),
	166	};
	167	}
	168
	169	return {
	170	spec: normalizeSpec(config.spec),
	171	collectionUrl: optionalTrimmedString(config.collectionUrl),
	172	postmanProxyUrl: optionalTrimmedString(config.postmanProxyUrl),
	173	baseUrl: optionalTrimmedString(config.baseUrl),
	174	auth: normalizeAuth(config.auth),
	175	defaultReadApproval: normalizeApprovalMode(config.defaultReadApproval, "defaultReadApproval"),
	176	defaultWriteApproval: normalizeApprovalMode(config.defaultWriteApproval, "defaultWriteApproval"),
	177	overrides: normalizeOverrides(config.overrides, "overrides"),
	178	};
	179	}

executor/packages/database/src/executor/handlers.ts+7−12

 import { actorIdForAccount } from "../../../core/src/identity";
 import { defaultRuntimeId, isKnownRuntimeId, isRuntimeEnabled } from "../../../core/src/runtimes/runtime-catalog";
 import type { ApprovalRecord, TaskExecutionOutcome, TaskRecord } from "../../../core/src/types";
+import {
+  assertMatchesCanonicalActorId,
+  canonicalActorIdForWorkspaceAccess,
+} from "../auth/actor_identity";
 import { DEFAULT_TASK_TIMEOUT_MS } from "../task/constants";
 import { createTaskEvent } from "../task/events";
 import { markTaskFinished } from "../task/finish";
     sessionId: args.sessionId,
   });
-  const canonicalActorId = actorIdForAccount({
+  const canonicalActorId = canonicalActorIdForWorkspaceAccess(access);
-    _id: access.accountId,
+  assertMatchesCanonicalActorId(args.actorId, canonicalActorId);
-    provider: access.provider,
-    providerAccountId: access.providerAccountId,
-  });
-  if (args.actorId && args.actorId !== canonicalActorId) {
-    throw new Error("actorId must match the authenticated workspace actor");
-  }
   const waitForResult = args.waitForResult ?? false;
   const created = await ctx.runMutation(internal.executor.createTaskInternal, {
   };
   const canonicalActorId = actorIdForAccount(typedCtx.account);
-  if (args.reviewerId && args.reviewerId !== canonicalActorId) {
+  assertMatchesCanonicalActorId(args.reviewerId, canonicalActorId, "reviewerId");
-    throw new Error("reviewerId must match the authenticated workspace actor");
-  }
   return await resolveApprovalRecord(typedCtx, internal, {
     ...args,

executor/packages/database/src/lib/scheduler.ts+14−1

@@ -2,8 +2,21 @@ type SchedulerLike = { · 1 unmodified line
2	runAfter: (delayMs: number, functionReference: any, args: any) => Promise<any>;	2	runAfter: (delayMs: number, functionReference: any, args: any) => Promise<any>;
3	};	3	};
4		4
		5	function isTestProcess(): boolean {
		6	if (process.env.NODE_ENV === "test") {
		7	return true;
		8	}
		9
		10	if (process.env.BUN_TEST === "1") {
		11	return true;
		12	}
		13
		14	const argv = process.argv.join(" ");
		15	return argv.includes(".test.ts");
		16	}
		17
5	export function isSchedulerDisabled(): boolean {	18	export function isSchedulerDisabled(): boolean {
6	return process.env.DISABLE_CONVEX_SCHEDULER === "1";	19	return process.env.DISABLE_CONVEX_SCHEDULER === "1" \|\| isTestProcess();
7	}	20	}
8		21
9	export async function safeRunAfter(	22	export async function safeRunAfter(

executor/packages/database/src/organizations/handlers.ts+14−4

 import type { MutationCtx, QueryCtx } from "../../convex/_generated/server";
 import { getOrganizationMembership, slugify } from "../../../core/src/identity";
 import { ensureUniqueSlug } from "../../../core/src/slug";
+import {
+  mapOrganizationRoleToWorkspaceRole,
+  upsertOrganizationMembership,
+} from "../auth/memberships";
+import { seedWorkspaceMembersFromOrganization } from "../auth/workspace_membership_projection";
 type WorkspaceSummary = {
   id: Id<"workspaces">;
     updatedAt: now,
   });
-  await typedCtx.db.insert("organizationMembers", {
+  await upsertOrganizationMembership(typedCtx, {
     organizationId,
     accountId: account._id,
     role: "owner",
     status: "active",
     billable: true,
-    joinedAt: now,
+    now,
-    createdAt: now,
-    updatedAt: now,
   });
   const workspaceId = await typedCtx.db.insert("workspaces", {
     updatedAt: now,
   });
+  await seedWorkspaceMembersFromOrganization(typedCtx, {
+    organizationId,
+    workspaceId,
+    now,
+    mapRole: mapOrganizationRoleToWorkspaceRole,
+  });
   const organization = await typedCtx.db.get(organizationId);
   const workspace = await typedCtx.db.get(workspaceId);
   if (!organization || !workspace) {

executor/packages/database/src/runtime/actor_auth.ts+6−9

 import type { ActionCtx } from "../../convex/_generated/server";
 import type { Id } from "../../convex/_generated/dataModel.d.ts";
 import { internal } from "../../convex/_generated/api";
-import { actorIdForAccount } from "../../../core/src/identity";
+import {
+  assertMatchesCanonicalActorId,
+  canonicalActorIdForWorkspaceAccess,
+} from "../auth/actor_identity";
 export async function requireCanonicalActor(
   ctx: ActionCtx,
     workspaceId: args.workspaceId,
     sessionId: args.sessionId,
   });
-  const canonicalActorId = actorIdForAccount({
+  const canonicalActorId = canonicalActorIdForWorkspaceAccess(access);
-    _id: access.accountId,
+  assertMatchesCanonicalActorId(args.actorId, canonicalActorId);
-    provider: access.provider,
-    providerAccountId: access.providerAccountId,
-  });
-  if (args.actorId && args.actorId !== canonicalActorId) {
-    throw new Error("actorId must match the authenticated workspace actor");
-  }
   return canonicalActorId;
 }

executor/packages/database/src/runtime/tool_call_resolution.ts+7−25

 import type { AccessPolicyRecord, PolicyDecision, TaskRecord, ToolDefinition } from "../../../core/src/types";
 import { rehydrateTools, type SerializedTool } from "../../../core/src/tool/source-serialization";
 import { getDecisionForContext, getToolDecision } from "./policy";
+import { getReadyRegistryBuildId } from "./tool_registry_state";
 import { normalizeToolPathForLookup, toPreferredToolPath } from "./tool_paths";
 import { baseTools } from "./workspace_tools";
-import { sourceSignature } from "./tool_source_loading";
 export function getGraphqlDecision(
   task: TaskRecord,
   return { decision: worstDecision, effectivePaths: fieldPaths };
 }
-async function resolveRegistryBuildId(
-  ctx: ActionCtx,
-  workspaceId: TaskRecord["workspaceId"],
-): Promise<string> {
-  const [state, sources] = await Promise.all([
-    ctx.runQuery(internal.toolRegistry.getState, { workspaceId }) as Promise<null | { signature: string; readyBuildId?: string }>,
-    ctx.runQuery(internal.database.listToolSources, { workspaceId }) as Promise<Array<{ id: string; updatedAt: number; enabled: boolean }>>,
-  ]);
-  const enabledSources = sources.filter((source) => source.enabled);
-  const signature = sourceSignature(workspaceId, enabledSources);
-  const expectedSignature = `toolreg_v2|${signature}`;
-  const buildId = state?.readyBuildId;
-  if (!buildId || state.signature !== expectedSignature) {
-    throw new Error(
-      "Tool registry is not ready (or is stale). Open Tools to refresh, or call listToolsWithWarnings to rebuild.",
-    );
-  }
-  return buildId;
-}
 async function suggestFromRegistry(
   ctx: ActionCtx,
   workspaceId: TaskRecord["workspaceId"],
     return { tool: builtin, resolvedToolPath: toolPath };
   }
-  const buildId = await resolveRegistryBuildId(ctx, task.workspaceId);
+  const buildId = await getReadyRegistryBuildId(ctx, {
+    workspaceId: task.workspaceId,
+    actorId: task.actorId,
+    clientId: task.clientId,
+    refreshOnStale: true,
+  });
   let resolvedToolPath = toolPath;
   let entry = await ctx.runQuery(internal.toolRegistry.getToolByPath, {

executor/packages/database/src/runtime/tool_invocation.ts+7−14

 import { completeToolCall, denyToolCall, failToolCall } from "./tool_call_lifecycle";
 import { assertPersistedCallRunnable, resolveCredentialHeaders } from "./tool_call_credentials";
 import { getGraphqlDecision, resolveToolForCall } from "./tool_call_resolution";
-import { sourceSignature } from "./tool_source_loading";
+import { getReadyRegistryBuildId } from "./tool_registry_state";
 function createApprovalId(): string {
   return `approval_${crypto.randomUUID()}`;
   // Fast system tools are handled server-side from the registry.
   if (toolPath === "discover" || toolPath === "catalog.namespaces" || toolPath === "catalog.tools") {
     const toolRegistry = internal.toolRegistry;
-    const [state, sources] = await Promise.all([
+    const buildId = await getReadyRegistryBuildId(ctx, {
-      ctx.runQuery(toolRegistry.getState, { workspaceId: task.workspaceId }) as Promise<null | { signature: string; readyBuildId?: string }>,
+      workspaceId: task.workspaceId,
-      ctx.runQuery(internal.database.listToolSources, { workspaceId: task.workspaceId }) as Promise<Array<{ id: string; updatedAt: number; enabled: boolean }>>,
+      actorId: task.actorId,
-    ]);
+      clientId: task.clientId,
-    const enabledSources = sources.filter((source) => source.enabled);
+      refreshOnStale: true,
-    const signature = sourceSignature(task.workspaceId, enabledSources);
+    });
-    const expectedSignature = `toolreg_v2|${signature}`;
-    const buildId = state?.readyBuildId;
-    if (!buildId || state.signature !== expectedSignature) {
-      throw new Error(
-        "Tool registry is not ready (or is stale). Open Tools to refresh, or call listToolsWithWarnings to rebuild.",
-      );
-    }
     const payload = typeof input === "string"
       ? { query: input }

executor/packages/database/src/runtime/tool_registry_state.ts+77−0

@@ -0,0 +1,77 @@
	1	"use node";
	2
	3	import type { ActionCtx } from "../../convex/_generated/server";
	4	import type { Id } from "../../convex/_generated/dataModel.d.ts";
	5	import { internal } from "../../convex/_generated/api";
	6	import { sourceSignature } from "./tool_source_loading";
	7
	8	export const TOOL_REGISTRY_SIGNATURE_PREFIX = "toolreg_v2\|";
	9
	10	export function registrySignatureForWorkspace(
	11	workspaceId: Id<"workspaces">,
	12	sources: Array<{ id: string; updatedAt: number; enabled: boolean }>,
	13	): string {
	14	const enabledSources = sources.filter((source) => source.enabled);
	15	return `${TOOL_REGISTRY_SIGNATURE_PREFIX}${sourceSignature(workspaceId, enabledSources)}`;
	16	}
	17
	18	type RegistryState = {
	19	signature: string;
	20	readyBuildId?: string;
	21	} \| null;
	22
	23	type ToolSourceState = {
	24	id: string;
	25	updatedAt: number;
	26	enabled: boolean;
	27	};
	28
	29	async function readRegistryState(
	30	ctx: Pick<ActionCtx, "runQuery">,
	31	workspaceId: Id<"workspaces">,
	32	): Promise<{ buildId?: string; isReady: boolean }> {
	33	const [state, sources] = await Promise.all([
	34	ctx.runQuery(internal.toolRegistry.getState, { workspaceId }) as Promise<RegistryState>,
	35	ctx.runQuery(internal.database.listToolSources, { workspaceId }) as Promise<ToolSourceState[]>,
	36	]);
	37
	38	const expectedSignature = registrySignatureForWorkspace(workspaceId, sources);
	39	const buildId = state?.readyBuildId;
	40
	41	return {
	42	buildId,
	43	isReady: Boolean(buildId && state?.signature === expectedSignature),
	44	};
	45	}
	46
	47	export async function getReadyRegistryBuildId(
	48	ctx: Pick<ActionCtx, "runQuery" \| "runAction">,
	49	args: {
	50	workspaceId: Id<"workspaces">;
	51	actorId?: string;
	52	clientId?: string;
	53	refreshOnStale?: boolean;
	54	},
	55	): Promise<string> {
	56	const initial = await readRegistryState(ctx, args.workspaceId);
	57	if (initial.isReady && initial.buildId) {
	58	return initial.buildId;
	59	}
	60
	61	if (args.refreshOnStale) {
	62	await ctx.runAction(internal.executorNode.listToolsWithWarningsInternal, {
	63	workspaceId: args.workspaceId,
	64	actorId: args.actorId,
	65	clientId: args.clientId,
	66	});
	67
	68	const refreshed = await readRegistryState(ctx, args.workspaceId);
	69	if (refreshed.isReady && refreshed.buildId) {
	70	return refreshed.buildId;
	71	}
	72	}
	73
	74	throw new Error(
	75	"Tool registry is not ready (or is stale). Open Tools to refresh, or call listToolsWithWarnings to rebuild.",
	76	);
	77	}

executor/packages/database/src/runtime/tool_source_loading.ts+5−38

   PreparedOpenApiSpec,
 } from "../../../core/src/tool/source-types";
 import type { ToolSourceRecord } from "../../../core/src/types";
+import { normalizeToolSourceConfig } from "../database/tool_source_config";
 import { asPayload } from "../lib/object";
 const OPENAPI_SPEC_CACHE_TTL_MS = 5 * 60 * 60_000;
   name: string;
   config: Record<string, unknown>;
 }): ExternalToolSourceConfig {
-  const config = raw.config;
+  const config = normalizeToolSourceConfig(raw.type, raw.config);
   if (raw.type === "mcp") {
-    if (typeof config.url !== "string" || config.url.trim().length === 0) {
-      throw new Error(`MCP source '${raw.name}' missing url`);
-    }
-    if (
-      config.transport !== undefined
-      && config.transport !== "sse"
-      && config.transport !== "streamable-http"
-    ) {
-      throw new Error(`MCP source '${raw.name}' has invalid transport`);
-    }
-    if (config.queryParams !== undefined) {
-      const queryParams = config.queryParams;
-      if (!queryParams || typeof queryParams !== "object" || Array.isArray(queryParams)) {
-        throw new Error(`MCP source '${raw.name}' queryParams must be an object`);
-      }
-      for (const value of Object.values(queryParams as Record<string, unknown>)) {
-        if (typeof value !== "string") {
-          throw new Error(`MCP source '${raw.name}' queryParams values must be strings`);
-        }
-      }
-    }
     const result: McpToolSourceConfig = {
       type: "mcp",
       name: raw.name,
       sourceId: raw.id,
       sourceKey: `source:${raw.id}`,
-      url: config.url,
+      url: String(config.url),
       auth: config.auth as McpToolSourceConfig["auth"],
       transport: config.transport as McpToolSourceConfig["transport"],
       queryParams: config.queryParams as McpToolSourceConfig["queryParams"],
   }
   if (raw.type === "graphql") {
-    if (typeof config.endpoint !== "string" || config.endpoint.trim().length === 0) {
-      throw new Error(`GraphQL source '${raw.name}' missing endpoint`);
-    }
     const result: GraphqlToolSourceConfig = {
       type: "graphql",
       name: raw.name,
       sourceId: raw.id,
       sourceKey: `source:${raw.id}`,
-      endpoint: config.endpoint,
+      endpoint: String(config.endpoint),
       schema: config.schema as GraphqlToolSourceConfig["schema"],
       auth: config.auth as GraphqlToolSourceConfig["auth"],
       defaultQueryApproval: config.defaultQueryApproval as GraphqlToolSourceConfig["defaultQueryApproval"],
     return result;
   }
-  const spec = config.spec;
-  if (typeof spec !== "string" && (typeof spec !== "object" || spec === null)) {
-    throw new Error(`OpenAPI source '${raw.name}' missing spec`);
-  }
   const result: OpenApiToolSourceConfig = {
     type: "openapi",
     name: raw.name,
     sourceId: raw.id,
     sourceKey: `source:${raw.id}`,
-    spec: spec as OpenApiToolSourceConfig["spec"],
+    spec: config.spec as OpenApiToolSourceConfig["spec"],
     baseUrl: config.baseUrl as OpenApiToolSourceConfig["baseUrl"],
     auth: config.auth as OpenApiToolSourceConfig["auth"],
     defaultReadApproval: config.defaultReadApproval as OpenApiToolSourceConfig["defaultReadApproval"],

executor/packages/database/src/runtime/workspace_tools.ts+2−1

 } from "../../../core/src/types";
 import { computeOpenApiSourceQuality, listVisibleToolDescriptors } from "./tool_descriptors";
 import { loadSourceArtifact, normalizeExternalToolSource, sourceSignature } from "./tool_source_loading";
+import { registrySignatureForWorkspace } from "./tool_registry_state";
 import { normalizeToolPathForLookup } from "./tool_paths";
 const baseTools = new Map<string, ToolDefinition>();
   traceStep("listToolSources", listSourcesStartedAt);
   const hasOpenApiSource = sources.some((source: { type: string }) => source.type === "openapi");
   const signature = sourceSignature(workspaceId, sources);
-  const registrySignature = `toolreg_v2|${signature}`;
+  const registrySignature = registrySignatureForWorkspace(workspaceId, sources);
   const debugBase: Omit<WorkspaceToolsDebug, "mode" | "normalizedSourceCount" | "cacheHit" | "cacheFresh" | "timedOutSources" | "durationMs" | "trace"> = {
       includeDts,
       sourceTimeoutMs: sourceTimeoutMs ?? null,

executor/packages/database/src/workspaces/handlers.ts+14−4

 import type { MutationCtx, QueryCtx } from "../../convex/_generated/server";
 import { getOrganizationMembership, slugify } from "../../../core/src/identity";
 import { ensureUniqueSlug } from "../../../core/src/slug";
+import {
+  mapOrganizationRoleToWorkspaceRole,
+  upsertOrganizationMembership,
+} from "../auth/memberships";
+import { seedWorkspaceMembersFromOrganization } from "../auth/workspace_membership_projection";
 type WorkspaceResult = {
   id: Id<"workspaces">;
       updatedAt: now,
     });
-    await typedCtx.db.insert("organizationMembers", {
+    await upsertOrganizationMembership(typedCtx, {
       organizationId,
       accountId: account._id,
       role: "owner",
       status: "active",
       billable: true,
-      joinedAt: now,
+      now,
-      createdAt: now,
-      updatedAt: now,
     });
   }
     throw new Error("Failed to create workspace");
   }
+  await seedWorkspaceMembersFromOrganization(typedCtx, {
+    organizationId,
+    workspaceId,
+    now,
+    mapRole: mapOrganizationRoleToWorkspaceRole,
+  });
   await cleanupEmptyStarterWorkspace(typedCtx, organizationId, workspaceId);
   return await toWorkspaceResult(typedCtx, workspace);

executor/scripts/test/run-suite.ts+92−0

@@ -0,0 +1,92 @@
	1	#!/usr/bin/env bun
	2
	3	export {};
	4
	5	const INTEGRATION_TESTS = new Set([
	6	"packages/core/src/openapi/real-specs.test.ts",
	7	]);
	8
	9	type SuiteMode = "fast" \| "integration" \| "e2e" \| "all";
	10
	11	function normalizeMode(raw: string \| undefined): SuiteMode {
	12	if (raw === "integration" \|\| raw === "e2e" \|\| raw === "all") {
	13	return raw;
	14	}
	15	return "fast";
	16	}
	17
	18	function isE2eTest(filePath: string): boolean {
	19	return filePath.endsWith(".e2e.test.ts");
	20	}
	21
	22	async function discoverAllTestFiles(): Promise<string[]> {
	23	const files = new Set<string>();
	24	const roots = ["apps", "packages", "scripts"];
	25
	26	for (const root of roots) {
	27	const glob = new Bun.Glob(`${root}/*/.test.ts`);
	28	for await (const match of glob.scan({ cwd: process.cwd() })) {
	29	files.add(match);
	30	}
	31	}
	32
	33	return [...files].sort();
	34	}
	35
	36	function selectTests(mode: SuiteMode, allTests: string[]): string[] {
	37	if (mode === "all") {
	38	return allTests;
	39	}
	40
	41	if (mode === "integration") {
	42	return allTests.filter((filePath) => INTEGRATION_TESTS.has(filePath));
	43	}
	44
	45	if (mode === "e2e") {
	46	return allTests.filter(isE2eTest);
	47	}
	48
	49	return allTests.filter((filePath) => !isE2eTest(filePath) && !INTEGRATION_TESTS.has(filePath));
	50	}
	51
	52	async function main(): Promise<void> {
	53	const mode = normalizeMode(process.argv[2]);
	54	const rawArgs = process.argv.slice(3);
	55	const listOnly = rawArgs.includes("--list");
	56	const passthroughArgs = rawArgs.filter((arg) => arg !== "--list");
	57
	58	const allTests = await discoverAllTestFiles();
	59	const selectedTests = selectTests(mode, allTests);
	60
	61	if (selectedTests.length === 0) {
	62	console.error(`[test-suite] No tests selected for mode '${mode}'.`);
	63	process.exit(1);
	64	}
	65
	66	console.log(`[test-suite] mode=${mode} files=${selectedTests.length}`);
	67
	68	if (listOnly) {
	69	for (const filePath of selectedTests) {
	70	console.log(filePath);
	71	}
	72	return;
	73	}
	74
	75	const child = Bun.spawn([
	76	"bun",
	77	"test",
	78	...selectedTests,
	79	...passthroughArgs,
	80	], {
	81	cwd: process.cwd(),
	82	stdin: "inherit",
	83	stdout: "inherit",
	84	stderr: "inherit",
	85	env: process.env,
	86	});
	87
	88	const exitCode = await child.exited;
	89	process.exit(exitCode);
	90	}
	91
	92	await main();

package.json+4−1

     "dev:assistant": "bun run --cwd assistant/packages/server dev",
     "dev:bot": "bun run --cwd assistant/packages/bot dev",
     "test": "bun run test:executor && bun run test:assistant",
-    "test:executor": "DISABLE_CONVEX_SCHEDULER=1 bun test --cwd executor",
+    "test:executor": "bun run --cwd executor test",
+    "test:executor:integration": "bun run --cwd executor test:integration",
+    "test:executor:e2e": "bun run --cwd executor test:e2e",
+    "test:executor:all": "bun run --cwd executor test:all",
     "test:assistant": "bun run --cwd assistant test",
     "typecheck": "bun run typecheck:executor && bun run typecheck:assistant",
     "typecheck:executor": "bunx tsc --noEmit -p executor/tsconfig.json",