lael-labs/executor

packages/control-plane/src/api/auth/workspace-membership.test.ts+20−10

 import { describe, expect, it } from "@effect/vitest";
+import {
+  AccountIdSchema,
+  OrganizationIdSchema,
+  OrganizationMemberIdSchema,
+  WorkspaceIdSchema,
+} from "#schema";
 import { deriveWorkspaceMembershipsForPrincipal } from "./workspace-membership";
 describe("workspace membership derivation", () => {
   it("prefers highest active role in matching organization", () => {
+    const principalAccountId = AccountIdSchema.make("acc_1");
+    const workspaceId = WorkspaceIdSchema.make("ws_1");
+    const organizationId = OrganizationIdSchema.make("org_1");
     const memberships = deriveWorkspaceMembershipsForPrincipal({
-      principalAccountId: "acc_1" as never,
+      principalAccountId,
-      workspaceId: "ws_1" as never,
+      workspaceId,
       workspace: {
-        id: "ws_1" as never,
+        id: workspaceId,
-        organizationId: "org_1" as never,
+        organizationId,
         name: "Main",
         createdByAccountId: null,
         createdAt: 1,
       },
       organizationMemberships: [
         {
-          id: "mem_1" as never,
+          id: OrganizationMemberIdSchema.make("mem_1"),
-          organizationId: "org_1" as never,
+          organizationId,
-          accountId: "acc_1" as never,
+          accountId: principalAccountId,
           role: "viewer",
           status: "active",
           billable: true,
           updatedAt: 1,
         },
         {
-          id: "mem_2" as never,
+          id: OrganizationMemberIdSchema.make("mem_2"),
-          organizationId: "org_1" as never,
+          organizationId,
-          accountId: "acc_1" as never,
+          accountId: principalAccountId,
           role: "admin",
           status: "active",
           billable: true,

packages/control-plane/src/api/executions/http.ts+5−7

 import { HttpApiBuilder, HttpServerRequest } from "@effect/platform";
 import * as Effect from "effect/Effect";
+import type { WorkspaceId } from "#schema";
 import {
   Actor,
     details: "Authentication required",
   });
-const resolveWorkspaceActor = (workspaceId: string) =>
+const resolveWorkspaceActor = (workspaceId: WorkspaceId) =>
   Effect.gen(function* () {
     const actorResolver = yield* ControlPlaneActorResolver;
     const request = yield* HttpServerRequest.HttpServerRequest;
-    return yield* actorResolver.resolveWorkspaceActor({
+    return yield* actorResolver.resolveWorkspaceActor({ workspaceId, headers: request.headers });
-      workspaceId: workspaceId as never,
-      headers: request.headers,
-    });
   });
-const requireExecuteWorkspace = (workspaceId: string) =>
+const requireExecuteWorkspace = (workspaceId: WorkspaceId) =>
   requirePermission({
     permission: "workspace:read",
-    workspaceId: workspaceId as never,
+    workspaceId,
   });
 export const ControlPlaneExecutionsLive = HttpApiBuilder.group(

packages/control-plane/src/api/memberships/http.ts+5−4

 import { HttpApiBuilder, HttpServerRequest } from "@effect/platform";
 import * as Effect from "effect/Effect";
+import type { OrganizationId } from "#schema";
 import {
   Actor,
   return yield* actorResolver.resolveActor({ headers: request.headers });
 });
-const requireReadMemberships = (organizationId: string) =>
+const requireReadMemberships = (organizationId: OrganizationId) =>
   requirePermission({
     permission: "memberships:read",
-    organizationId: organizationId as never,
+    organizationId,
   });
-const requireWriteMemberships = (organizationId: string) =>
+const requireWriteMemberships = (organizationId: OrganizationId) =>
   requirePermission({
     permission: "memberships:write",
-    organizationId: organizationId as never,
+    organizationId,
   });
 export const ControlPlaneMembershipsLive = HttpApiBuilder.group(

packages/control-plane/src/api/organizations/http.ts+3−2

 import { HttpApiBuilder, HttpServerRequest } from "@effect/platform";
 import * as Effect from "effect/Effect";
+import type { OrganizationId } from "#schema";
 import {
   Actor,
   permission: "organizations:read",
 });
-const requireManageOrganizations = (organizationId: string) =>
+const requireManageOrganizations = (organizationId: OrganizationId) =>
   requirePermission({
     permission: "organizations:manage",
-    organizationId: organizationId as never,
+    organizationId,
   });
 export const ControlPlaneOrganizationsLive = HttpApiBuilder.group(

packages/control-plane/src/api/policies/http.ts+7−9

 import { HttpApiBuilder, HttpServerRequest } from "@effect/platform";
 import * as Effect from "effect/Effect";
+import type { WorkspaceId } from "#schema";
 import {
   Actor,
     details: "Authentication required",
   });
-const resolveWorkspaceActor = (workspaceId: string) =>
+const resolveWorkspaceActor = (workspaceId: WorkspaceId) =>
   Effect.gen(function* () {
     const actorResolver = yield* ControlPlaneActorResolver;
     const request = yield* HttpServerRequest.HttpServerRequest;
-    return yield* actorResolver.resolveWorkspaceActor({
+    return yield* actorResolver.resolveWorkspaceActor({ workspaceId, headers: request.headers });
-      workspaceId: workspaceId as never,
-      headers: request.headers,
-    });
   });
-const requireReadPolicies = (workspaceId: string) =>
+const requireReadPolicies = (workspaceId: WorkspaceId) =>
   requirePermission({
     permission: "policies:read",
-    workspaceId: workspaceId as never,
+    workspaceId,
   });
-const requireWritePolicies = (workspaceId: string) =>
+const requireWritePolicies = (workspaceId: WorkspaceId) =>
   requirePermission({
     permission: "policies:write",
-    workspaceId: workspaceId as never,
+    workspaceId,
   });
 export const ControlPlanePoliciesLive = HttpApiBuilder.group(

packages/control-plane/src/api/sources/http.ts+7−9

 import { HttpApiBuilder, HttpServerRequest } from "@effect/platform";
 import * as Effect from "effect/Effect";
+import type { WorkspaceId } from "#schema";
 import {
   Actor,
     details: "Authentication required",
   });
-const resolveWorkspaceActor = (workspaceId: string) =>
+const resolveWorkspaceActor = (workspaceId: WorkspaceId) =>
   Effect.gen(function* () {
     const actorResolver = yield* ControlPlaneActorResolver;
     const request = yield* HttpServerRequest.HttpServerRequest;
-    return yield* actorResolver.resolveWorkspaceActor({
+    return yield* actorResolver.resolveWorkspaceActor({ workspaceId, headers: request.headers });
-      workspaceId: workspaceId as never,
-      headers: request.headers,
-    });
   });
-const requireReadSources = (workspaceId: string) =>
+const requireReadSources = (workspaceId: WorkspaceId) =>
   requirePermission({
     permission: "sources:read",
-    workspaceId: workspaceId as never,
+    workspaceId,
   });
-const requireWriteSources = (workspaceId: string) =>
+const requireWriteSources = (workspaceId: WorkspaceId) =>
   requirePermission({
     permission: "sources:write",
-    workspaceId: workspaceId as never,
+    workspaceId,
   });
 export const ControlPlaneSourcesLive = HttpApiBuilder.group(

packages/control-plane/src/api/workspaces/http.ts+11−13

 import { HttpApiBuilder, HttpServerRequest } from "@effect/platform";
 import * as Effect from "effect/Effect";
+import type { OrganizationId, WorkspaceId } from "#schema";
 import {
   Actor,
   return yield* actorResolver.resolveActor({ headers: request.headers });
 });
-const resolveWorkspaceActor = (workspaceId: string) =>
+const resolveWorkspaceActor = (workspaceId: WorkspaceId) =>
   Effect.gen(function* () {
     const actorResolver = yield* ControlPlaneActorResolver;
     const request = yield* HttpServerRequest.HttpServerRequest;
-    return yield* actorResolver.resolveWorkspaceActor({
+    return yield* actorResolver.resolveWorkspaceActor({ workspaceId, headers: request.headers });
-      workspaceId: workspaceId as never,
-      headers: request.headers,
-    });
   });
-const requireReadWorkspace = (workspaceId: string) =>
+const requireReadWorkspace = (workspaceId: WorkspaceId) =>
   requirePermission({
     permission: "workspace:read",
-    workspaceId: workspaceId as never,
+    workspaceId,
   });
-const requireManageWorkspace = (workspaceId: string) =>
+const requireManageWorkspace = (workspaceId: WorkspaceId) =>
   requirePermission({
     permission: "workspace:manage",
-    workspaceId: workspaceId as never,
+    workspaceId,
   });
-const requireOrganizationWorkspaceRead = (organizationId: string) =>
+const requireOrganizationWorkspaceRead = (organizationId: OrganizationId) =>
   requirePermission({
     permission: "workspace:read",
-    organizationId: organizationId as never,
+    organizationId,
   });
-const requireOrganizationWorkspaceManage = (organizationId: string) =>
+const requireOrganizationWorkspaceManage = (organizationId: OrganizationId) =>
   requirePermission({
     permission: "workspace:manage",
-    organizationId: organizationId as never,
+    organizationId,
   });
 export const ControlPlaneWorkspacesLive = HttpApiBuilder.group(

packages/control-plane/src/domain/auth/actor.test.ts+15−8

 import { describe, expect, it } from "@effect/vitest";
+import { AccountIdSchema, WorkspaceIdSchema } from "#schema";
 import * as Effect from "effect/Effect";
 import {
 describe("control-plane-domain actor", () => {
   it.effect("allows workspace permissions from active membership", () =>
     Effect.gen(function* () {
+      const accountId = AccountIdSchema.make("acc_1");
+      const workspaceId = WorkspaceIdSchema.make("ws_1");
       const actor = yield* makeActor({
         principal: {
-          accountId: "acc_1" as never,
+          accountId,
           provider: "local",
           subject: "local:acc_1",
           email: null,
         },
         workspaceMemberships: [
           {
-            accountId: "acc_1" as never,
+            accountId,
-            workspaceId: "ws_1" as never,
+            workspaceId,
             role: "editor",
             status: "active",
             grantedAt: 1,
       yield* actor.requirePermission({
         permission: "sources:write",
-        workspaceId: "ws_1" as never,
+        workspaceId,
       });
     }),
   );
   it.effect("denies permission when role is insufficient", () =>
     Effect.gen(function* () {
+      const accountId = AccountIdSchema.make("acc_1");
+      const workspaceId = WorkspaceIdSchema.make("ws_1");
       const actor = yield* makeActor({
         principal: {
-          accountId: "acc_1" as never,
+          accountId,
           provider: "local",
           subject: "local:acc_1",
           email: null,
         },
         workspaceMemberships: [
           {
-            accountId: "acc_1" as never,
+            accountId,
-            workspaceId: "ws_1" as never,
+            workspaceId,
             role: "viewer",
             status: "active",
             grantedAt: 1,
       const denied = yield* Effect.either(
         actor.requirePermission({
           permission: "sources:write",
-          workspaceId: "ws_1" as never,
+          workspaceId,
         }),
       );

packages/control-plane/src/domain/auth/policy.test.ts+6−2

 import { describe, expect, it } from "@effect/vitest";
+import { AccountIdSchema, WorkspaceIdSchema } from "#schema";
 import * as Effect from "effect/Effect";
 import { Actor, makeAllowAllActor } from "./actor";
 describe("control-plane-domain policy", () => {
   it.effect("runs protected effect when permission is granted", () =>
     Effect.gen(function* () {
+      const accountId = AccountIdSchema.make("acc_1");
+      const workspaceId = WorkspaceIdSchema.make("ws_1");
       const principal = {
-        accountId: "acc_1" as never,
+        accountId,
         provider: "local" as const,
         subject: "local:acc_1",
         email: null,
       const result = yield* withPolicy(
         requirePermission({
           permission: "workspace:read",
-          workspaceId: "ws_1" as never,
+          workspaceId,
         }),
       )(Effect.succeed("ok")).pipe(
         Effect.provideService(Actor, makeAllowAllActor(principal)),

packages/control-plane/src/persistence/control-plane-rows.test.ts+33−20

 import { describe, expect, it } from "@effect/vitest";
+import {
+  AccountIdSchema,
+  OrganizationIdSchema,
+  OrganizationMemberIdSchema,
+  PolicyIdSchema,
+  SourceIdSchema,
+  WorkspaceIdSchema,
+} from "#schema";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
     Effect.gen(function* () {
       const persistence = yield* makePersistence;
       const now = Date.now();
+      const organizationId = OrganizationIdSchema.make("org_1");
+      const accountId = AccountIdSchema.make("acc_1");
+      const workspaceId = WorkspaceIdSchema.make("ws_1");
       yield* persistence.rows.organizations.insert({
-        id: "org_1" as never,
+        id: organizationId,
         slug: "acme",
         name: "Acme",
         status: "active",
-        createdByAccountId: "acc_1" as never,
+        createdByAccountId: accountId,
         createdAt: now,
         updatedAt: now,
       });
       yield* persistence.rows.workspaces.insert({
-        id: "ws_1" as never,
+        id: workspaceId,
-        organizationId: "org_1" as never,
+        organizationId,
         name: "Main",
-        createdByAccountId: "acc_1" as never,
+        createdByAccountId: accountId,
         createdAt: now,
         updatedAt: now,
       });
       yield* persistence.rows.sources.insert({
-        id: "src_1" as never,
+        id: SourceIdSchema.make("src_1"),
-        workspaceId: "ws_1" as never,
+        workspaceId,
         name: "Github",
         kind: "openapi",
         endpoint: "https://api.github.com/openapi.json",
       });
       yield* persistence.rows.policies.insert({
-        id: "pol_1" as never,
+        id: PolicyIdSchema.make("pol_1"),
-        workspaceId: "ws_1" as never,
+        workspaceId,
         targetAccountId: null,
         clientId: null,
         resourceType: "tool_path",
         updatedAt: now,
       });
-      const workspace = yield* persistence.rows.workspaces.getById("ws_1" as never);
+      const workspace = yield* persistence.rows.workspaces.getById(workspaceId);
       expect(Option.isSome(workspace)).toBe(true);
-      const sources = yield* persistence.rows.sources.listByWorkspaceId("ws_1" as never);
+      const sources = yield* persistence.rows.sources.listByWorkspaceId(workspaceId);
       expect(sources).toHaveLength(1);
       expect(sources[0]?.name).toBe("Github");
-      const policies = yield* persistence.rows.policies.listByWorkspaceId("ws_1" as never);
+      const policies = yield* persistence.rows.policies.listByWorkspaceId(workspaceId);
       expect(policies).toHaveLength(1);
       expect(policies[0]?.resourcePattern).toBe("source.github.*");
     }),
     Effect.gen(function* () {
       const persistence = yield* makePersistence;
       const now = Date.now();
+      const organizationId = OrganizationIdSchema.make("org_1");
+      const accountId = AccountIdSchema.make("acc_1");
       yield* persistence.rows.organizationMemberships.upsert({
-        id: "mem_1" as never,
+        id: OrganizationMemberIdSchema.make("mem_1"),
-        organizationId: "org_1" as never,
+        organizationId,
-        accountId: "acc_1" as never,
+        accountId,
         role: "viewer",
         status: "active",
         billable: true,
       });
       yield* persistence.rows.organizationMemberships.upsert({
-        id: "mem_2" as never,
+        id: OrganizationMemberIdSchema.make("mem_2"),
-        organizationId: "org_1" as never,
+        organizationId,
-        accountId: "acc_1" as never,
+        accountId,
         role: "admin",
         status: "active",
         billable: true,
       });
       const membership = yield* persistence.rows.organizationMemberships.getByOrganizationAndAccount(
-        "org_1" as never,
+        organizationId,
-        "acc_1" as never,
+        accountId,
       );
       expect(Option.isSome(membership)).toBe(true);

packages/control-plane/src/runtime/control-plane-runtime.test.ts+2−2

@@ -1,7 +1,7 @@
1	import { describe, expect, it } from "@effect/vitest";	1	import { describe, expect, it } from "@effect/vitest";
2	import * as Effect from "effect/Effect";	2	import * as Effect from "effect/Effect";
3		3
4	import type { AccountId } from "#schema";	4	import { WorkspaceIdSchema, type AccountId } from "#schema";
5		5
6	import { makeSqlControlPlaneRuntime } from "./index";	6	import { makeSqlControlPlaneRuntime } from "./index";
7	import { withControlPlaneClient } from "./test-http-client";	7	import { withControlPlaneClient } from "./test-http-client";
@@ -312,7 +312,7 @@ describe("control-plane-runtime", () => { · 304 unmodified lines
312	expect(deleteOrg.removed).toBe(true);	312	expect(deleteOrg.removed).toBe(true);
313		313
314	const deletedWorkspaceLookup = yield* Effect.either(	314	const deletedWorkspaceLookup = yield* Effect.either(
315	runtime.service.getWorkspace(workspace.id as never),	315	runtime.service.getWorkspace(WorkspaceIdSchema.make(workspace.id)),
316	);	316	);
317	expect(deletedWorkspaceLookup._tag).toBe("Left");	317	expect(deletedWorkspaceLookup._tag).toBe("Left");
318		318