Merge remote-tracking branch 'origin/codex/batch17-core-executor-boundaries' into codex/effect-lint-integration

Rhys Sullivan committed 6 months ago

Commit cd10e672 parents 36b20f5 44315a81 file · +340 −591Browse files

Unified · Split

packages/core/sdk/src/executor.ts+340−591

   type TypedAdapter,
 } from "@executor-js/storage-core";
-import {
+import { pluginBlobStore, type BlobStore } from "./blob";
-  pluginBlobStore,
-  type BlobStore,
-} from "./blob";
 import {
   ConnectionProviderState,
   ConnectionRef,
   StorageDeps,
 } from "./plugin";
 import type { Scope } from "./scope";
-import {
+import { SecretRef, SetSecretInput, type SecretProvider } from "./secrets";
-  SecretRef,
-  SetSecretInput,
-  type SecretProvider,
-} from "./secrets";
 import { Usage } from "./usages";
 import {
   ToolSchema,
 const acceptAllHandler: ElicitationHandler = () =>
   Effect.succeed(new ElicitationResponse({ action: "accept" }));
-const resolveElicitationHandler = (
+const resolveElicitationHandler = (onElicitation: OnElicitation): ElicitationHandler =>
-  onElicitation: OnElicitation,
-): ElicitationHandler =>
   onElicitation === "accept-all" ? acceptAllHandler : onElicitation;
 // ---------------------------------------------------------------------------
   readonly scopes: readonly Scope[];
   readonly tools: {
-    readonly list: (
+    readonly list: (filter?: ToolListFilter) => Effect.Effect<readonly Tool[], StorageFailure>;
-      filter?: ToolListFilter,
-    ) => Effect.Effect<readonly Tool[], StorageFailure>;
     /** Fetch a tool's full schema view: JSON schemas with `$defs`
      *  attached from the core `definition` table, plus TypeScript
      *  preview strings rendered from them. Returns `null` for unknown
      *  tool ids. */
-    readonly schema: (
+    readonly schema: (toolId: string) => Effect.Effect<ToolSchema | null, StorageFailure>;
-      toolId: string,
-    ) => Effect.Effect<ToolSchema | null, StorageFailure>;
     /** Every `$defs` entry across every source, grouped by source id.
      *  Used for bulk schema export and downstream TypeScript rendering. */
     readonly definitions: () => Effect.Effect<
      *  only, never calls the provider. Use this for UI state ("secret
      *  missing, prompt to add") to avoid keychain permission prompts
      *  or 1password IPC roundtrips on a pre-flight check. */
-    readonly status: (
+    readonly status: (id: string) => Effect.Effect<"resolved" | "missing", StorageFailure>;
-      id: string,
+    readonly set: (input: SetSecretInput) => Effect.Effect<SecretRef, StorageFailure>;
-    ) => Effect.Effect<"resolved" | "missing", StorageFailure>;
-    readonly set: (
-      input: SetSecretInput,
-    ) => Effect.Effect<SecretRef, StorageFailure>;
     /** Delete a bare (non-connection-owned) secret. Connection-owned
      *  secrets are rejected with `SecretOwnedByConnectionError` — use
      *  `connections.remove` instead. Refuses with `SecretInUseError`
      *  show the `usages(id)` list and ask the user to detach first. */
     readonly remove: (
       id: string,
-    ) => Effect.Effect<
+    ) => Effect.Effect<void, SecretOwnedByConnectionError | SecretInUseError | StorageFailure>;
-      void,
-      SecretOwnedByConnectionError | SecretInUseError | StorageFailure
-    >;
     readonly list: () => Effect.Effect<readonly SecretRef[], StorageFailure>;
     /** All places this secret is referenced — fans out across every
      *  plugin's `usagesForSecret`. Used by the Secrets-tab "Used by"
      *  list and by `remove` for its RESTRICT check. */
-    readonly usages: (
+    readonly usages: (id: string) => Effect.Effect<readonly Usage[], StorageFailure>;
-      id: string,
-    ) => Effect.Effect<readonly Usage[], StorageFailure>;
     readonly providers: () => Effect.Effect<readonly string[]>;
   };
   readonly connections: {
-    readonly get: (
+    readonly get: (id: string) => Effect.Effect<ConnectionRef | null, StorageFailure>;
-      id: string,
-    ) => Effect.Effect<ConnectionRef | null, StorageFailure>;
     readonly list: () => Effect.Effect<readonly ConnectionRef[], StorageFailure>;
     readonly create: (
       input: CreateConnectionInput,
-    ) => Effect.Effect<
+    ) => Effect.Effect<ConnectionRef, ConnectionProviderNotRegisteredError | StorageFailure>;
-      ConnectionRef,
-      ConnectionProviderNotRegisteredError | StorageFailure
-    >;
     readonly updateTokens: (
       input: UpdateConnectionTokensInput,
-    ) => Effect.Effect<
+    ) => Effect.Effect<ConnectionRef, ConnectionNotFoundError | StorageFailure>;
-      ConnectionRef,
-      ConnectionNotFoundError | StorageFailure
-    >;
     readonly setIdentityLabel: (
       id: string,
       label: string | null,
     >;
     /** Refuses with `ConnectionInUseError` if any plugin reports the
      *  connection as in use. */
-    readonly remove: (
+    readonly remove: (id: string) => Effect.Effect<void, ConnectionInUseError | StorageFailure>;
-      id: string,
-    ) => Effect.Effect<void, ConnectionInUseError | StorageFailure>;
     /** All places this connection is referenced — fans out across every
      *  plugin's `usagesForConnection`. */
-    readonly usages: (
+    readonly usages: (id: string) => Effect.Effect<readonly Usage[], StorageFailure>;
-      id: string,
-    ) => Effect.Effect<readonly Usage[], StorageFailure>;
     readonly providers: () => Effect.Effect<readonly string[]>;
   };
     readonly list: () => Effect.Effect<readonly ToolPolicy[], StorageFailure>;
     /** Create a new policy. Defaults to the top of the target scope's
      *  list (highest precedence) when `position` is omitted. */
-    readonly create: (
+    readonly create: (input: CreateToolPolicyInput) => Effect.Effect<ToolPolicy, StorageFailure>;
-      input: CreateToolPolicyInput,
+    readonly update: (input: UpdateToolPolicyInput) => Effect.Effect<ToolPolicy, StorageFailure>;
-    ) => Effect.Effect<ToolPolicy, StorageFailure>;
-    readonly update: (
-      input: UpdateToolPolicyInput,
-    ) => Effect.Effect<ToolPolicy, StorageFailure>;
     readonly remove: (id: string) => Effect.Effect<void, StorageFailure>;
     /** Resolve the effective policy for a tool id by walking the scope-
      *  stacked policy list with first-match-wins semantics. Returns
      *  `undefined` when no rule matches (caller falls back to the
      *  plugin's `resolveAnnotations` output). */
-    readonly resolve: (
+    readonly resolve: (toolId: string) => Effect.Effect<PolicyMatch | undefined, StorageFailure>;
-      toolId: string,
-    ) => Effect.Effect<PolicyMatch | undefined, StorageFailure>;
   };
   readonly close: () => Effect.Effect<void, StorageFailure>;
 } & PluginExtensions<TPlugins>;
-export interface ExecutorConfig<
+export interface ExecutorConfig<TPlugins extends readonly AnyPlugin[] = []> {
-  TPlugins extends readonly AnyPlugin[] = [],
-> {
   /**
    * Precedence-ordered scope stack. Innermost first; typical shape is
    * `[userInOrgScope, orgScope]`. Reads on scoped tables walk the
 // manifest) before constructing the executor.
 // ---------------------------------------------------------------------------
-export const collectSchemas = (
+export const collectSchemas = (plugins: readonly AnyPlugin[]): DBSchema => {
-  plugins: readonly AnyPlugin[],
-): DBSchema => {
   const merged: Record<string, DBSchema[string]> = { ...coreSchema };
   for (const plugin of plugins) {
     if (!plugin.schema) continue;
     for (const [modelKey, model] of Object.entries(plugin.schema)) {
       if (merged[modelKey]) {
-        throw new Error(
+        // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: collectSchemas is a synchronous configuration API
-          `Duplicate model "${modelKey}" contributed by plugin "${plugin.id}"` +
+        throw new StorageError({
+          message:
+            `Duplicate model "${modelKey}" contributed by plugin "${plugin.id}"` +
             ` (reserved by core or another plugin)`,
-        );
+          cause: undefined,
+        });
       }
       merged[modelKey] = model as DBSchema[string];
     }
   runtime: false,
 });
-const staticDeclToSource = (
+const staticDeclToSource = (decl: StaticSourceDecl, pluginId: string): Source => ({
-  decl: StaticSourceDecl,
-  pluginId: string,
-): Source => ({
   id: decl.id,
   scopeId: undefined,
   kind: decl.kind,
 const decodeJsonColumn = (value: unknown): unknown => {
   if (value === null || value === undefined) return undefined;
   if (typeof value !== "string") return value;
-  try {
+  return Schema.decodeUnknownOption(Schema.UnknownFromJsonString)(value).pipe(
-    return JSON.parse(value);
+    Option.getOrElse(() => value),
-  } catch {
+  );
-    return value;
-  }
 };
-const rowToTool = (
+const rowToTool = (row: ToolRow, annotations?: ToolAnnotations): Tool => ({
-  row: ToolRow,
-  annotations?: ToolAnnotations,
-): Tool => ({
   id: row.id,
   sourceId: row.source_id,
   pluginId: row.plugin_id,
 // query through the same sql.begin connection. This is what makes nested
 // writes atomic on postgres + Hyperdrive without deadlocking a pool of 1.
 // ---------------------------------------------------------------------------
-const activeAdapterRef = Context.Reference<DBTransactionAdapter | null>(
+const activeAdapterRef = Context.Reference<DBTransactionAdapter | null>("executor/ActiveAdapter", {
-  "executor/ActiveAdapter",
+  defaultValue: () => null,
-  { defaultValue: () => null },
+});
-);
 // A `DBAdapter` whose methods dispatch to the active adapter (tx handle or
 // root) on every call. Stable identity for consumers (plugin storage,
     use: (active: DBTransactionAdapter) => Effect.Effect<A, E>,
   ): Effect.Effect<A, E> =>
     Effect.flatMap(Effect.service(activeAdapterRef), (active) =>
-      use((active ?? (root as DBTransactionAdapter))),
+      use(active ?? (root as DBTransactionAdapter)),
     );
   return {
   readonly ctx: PluginCtx<unknown>;
 }
-export const createExecutor = <
+export const createExecutor = <const TPlugins extends readonly AnyPlugin[] = []>(
-  const TPlugins extends readonly AnyPlugin[] = [],
->(
   config: ExecutorConfig<TPlugins>,
-): Effect.Effect<Executor<TPlugins>, Error> =>
+): Effect.Effect<Executor<TPlugins>, StorageFailure> =>
   Effect.gen(function* () {
     const defaultPlugins = (): TPlugins => {
       const empty: readonly AnyPlugin[] = [];
       return empty as TPlugins;
     };
-    const {
+    const { scopes, adapter: rootAdapter, blobs, plugins = defaultPlugins() } = config;
-      scopes,
-      adapter: rootAdapter,
-      blobs,
-      plugins = defaultPlugins(),
-    } = config;
     if (scopes.length === 0) {
-      return yield* Effect.fail(
+      return yield* new StorageError({
-        new Error("createExecutor requires a non-empty scopes array"),
+        message: "createExecutor requires a non-empty scopes array",
-      );
+        cause: undefined,
+      });
     }
     // Scope-wrap the root adapter so every read on a tenant-scoped
     // visible. Only tables whose schema declares `scope_id` are
     // scoped.
     const schema = collectSchemas(plugins);
-    const scopeIds = scopes.map((s) => s.id as string);
+    const scopeIds = scopes.map((s) => s.id);
-    const scopedRoot = scopeAdapter(
+    const scopedRoot = scopeAdapter(rootAdapter, { scopes: scopeIds }, schema);
-      rootAdapter,
-      { scopes: scopeIds },
-      schema,
-    );
     const adapter = buildAdapterRouter(scopedRoot);
     const core = typedAdapter<CoreSchema>(adapter);
       ["google-discovery:google", "oauth2"],
       ["google-discovery:oauth2", "oauth2"],
     ]);
-    const resolveConnectionProvider = (
+    const resolveConnectionProvider = (key: string): ConnectionProvider | undefined => {
-      key: string,
-    ): ConnectionProvider | undefined => {
       const direct = connectionProviders.get(key);
       if (direct) return direct;
       const canonical = connectionProviderAliases.get(key);
     // Rows whose scope isn't in the stack get pushed to the end (they
     // shouldn't reach us — the adapter filters by `scope_id IN (stack)` —
     // but guarding here means a stray row can't silently win).
-    const scopeRank = (row: { scope_id: unknown }) =>
+    const rowScopeId = (row: { readonly scope_id: unknown }) =>
-      scopePrecedence.get(row.scope_id as string) ?? Infinity;
+      typeof row.scope_id === "string" ? row.scope_id : null;
+    const scopeRank = (row: { readonly scope_id: unknown }) => {
+      const scopeId = rowScopeId(row);
+      return scopeId === null ? Infinity : (scopePrecedence.get(scopeId) ?? Infinity);
+    };
     // Pick the innermost-scope row on a findOne-by-id against a scoped
     // model. The scope-wrapped adapter returns rows from every scope in
     // and wrong when a user has shadowed an outer default. Callers that
     // need a single logical row (invoke, tool schema, source removal)
     // must go through this path so the innermost write always wins.
-    const findInnermost = <T extends { scope_id: unknown }>(
+    const findInnermost = <T extends { scope_id: unknown }>(rows: readonly T[]): T | null => {
-      rows: readonly T[],
-    ): T | null => {
       if (rows.length === 0) return null;
       let winner: T | undefined;
       let best = Infinity;
       return winner ?? null;
     };
-    const secretRowsForId = (
+    const secretRowsForId = (id: string): Effect.Effect<readonly SecretRow[], StorageFailure> =>
-      id: string,
-    ): Effect.Effect<readonly SecretRow[], StorageFailure> =>
       core.findMany({
         model: "secret",
         where: [{ field: "id", value: id }],
       rows: readonly SecretRow[],
     ): Effect.Effect<string | null, StorageFailure> =>
       Effect.gen(function* () {
-        const ordered = [...rows].sort(
+        const ordered = [...rows].sort((a, b) => scopeRank(a) - scopeRank(b));
-          (a, b) =>
-            (scopePrecedence.get(a.scope_id as string) ?? Infinity) -
-            (scopePrecedence.get(b.scope_id as string) ?? Infinity),
-        );
         for (const row of ordered) {
-          const provider = secretProviders.get(row.provider as string);
+          const provider = secretProviders.get(row.provider);
           if (!provider) continue;
-          const value = yield* provider.get(id, row.scope_id as string);
+          const value = yield* provider.get(id, row.scope_id);
           if (value !== null) return value;
         }
         // enumeration fallback doesn't know which scope the value
         // lives in; flat providers ignore the arg.
         const fallbackScope = scopeIds[0]!;
-        const candidates = [...secretProviders.values()].filter(
+        const candidates = [...secretProviders.values()].filter((p) => p.list);
-          (p) => p.list,
-        );
         const values = yield* Effect.all(
           candidates.map((p) =>
-            p
+            p.get(id, fallbackScope).pipe(Effect.catch(() => Effect.succeed(null))),
-              .get(id, fallbackScope)
-              .pipe(Effect.catch(() => Effect.succeed(null))),
           ),
           { concurrency: "unbounded" },
         );
         // must not expose them even if a token secret id is leaked.
         const rows = yield* secretRowsForId(id);
         const owned = rows.find((row) => row.owned_by_connection_id);
-        if (owned) {
+        const ownedByConnectionId = owned?.owned_by_connection_id;
-          return yield* Effect.fail(
+        if (ownedByConnectionId) {
-            new SecretOwnedByConnectionError({
+          return yield* new SecretOwnedByConnectionError({
-              secretId: SecretId.make(id),
+            secretId: SecretId.make(id),
-              connectionId: ConnectionId.make(
+            connectionId: ConnectionId.make(ownedByConnectionId),
-                owned.owned_by_connection_id as string,
+          });
-              ),
-            }),
-          );
         }
         return yield* resolveSecretValueFromRows(id, rows);
       });
-    const connectionSecretGet = (
+    const connectionSecretGet = (id: string): Effect.Effect<string | null, StorageFailure> =>
-      id: string,
-    ): Effect.Effect<string | null, StorageFailure> =>
       Effect.gen(function* () {
         const rows = yield* secretRowsForId(id);
         return yield* resolveSecretValueFromRows(id, rows);
       });
     const secretRouteHasBackingValue = (row: SecretRow) => {
-      const provider = secretProviders.get(row.provider as string);
+      const provider = secretProviders.get(row.provider);
       if (!provider?.has) return Effect.succeed(true);
-      return provider
+      return provider.has(row.id, row.scope_id).pipe(Effect.catch(() => Effect.succeed(false)));
-        .has(row.id as string, row.scope_id as string)
-        .pipe(Effect.catch(() => Effect.succeed(false)));
     };
-    const secretsSet = (
+    const secretsSet = (input: SetSecretInput): Effect.Effect<SecretRef, StorageFailure> =>
-      input: SetSecretInput,
-    ): Effect.Effect<SecretRef, StorageFailure> =>
       Effect.gen(function* () {
         // Validate the write target up front. The adapter would reject
         // an out-of-stack scope too, but catching it here gives a
         // clearer error before we touch the provider.
-        if (!scopeIds.includes(input.scope as string)) {
+        if (!scopeIds.includes(input.scope)) {
-          return yield* Effect.fail(
+          return yield* new StorageError({
-            new StorageError({
+            message:
-              message:
+              `secrets.set targets scope "${input.scope}" which is not ` +
-                `secrets.set targets scope "${input.scope}" which is not ` +
+              `in the executor's scope stack [${scopeIds.join(", ")}].`,
-                `in the executor's scope stack [${scopeIds.join(", ")}].`,
+            cause: undefined,
-              cause: undefined,
+          });
-            }),
-          );
         }
         // Pick provider: explicit or first-writable. Misconfiguration
         if (input.provider) {
           target = secretProviders.get(input.provider);
           if (!target) {
-            return yield* Effect.fail(
+            return yield* new StorageError({
-              new StorageError({
+              message: `Unknown secret provider: ${input.provider}`,
-                message: `Unknown secret provider: ${input.provider}`,
+              cause: undefined,
-                cause: undefined,
+            });
-              }),
-            );
           }
         } else {
           for (const provider of secretProviders.values()) {
             }
           }
           if (!target) {
-            return yield* Effect.fail(
+            return yield* new StorageError({
-              new StorageError({
+              message: "No writable secret providers registered",
-                message: "No writable secret providers registered",
+              cause: undefined,
-                cause: undefined,
+            });
-              }),
-            );
           }
         }
         if (!target.writable || !target.set) {
-          return yield* Effect.fail(
+          return yield* new StorageError({
-            new StorageError({
+            message: `Secret provider "${target.key}" is read-only`,
-              message: `Secret provider "${target.key}" is read-only`,
+            cause: undefined,
-              cause: undefined,
+          });
-            }),
-          );
         }
-        yield* target.set(input.id, input.value, input.scope as string);
+        yield* target.set(input.id, input.value, input.scope);
         // Upsert metadata row in the core `secret` table at the
         // caller-named scope. Pin the delete to `scope_id = input.scope`
     // errors fail the whole call so a transient plugin failure can't be
     // mistaken for "no usages" and let through a delete that creates
     // dangling refs.
-    const secretsUsagesStrict = (
+    const secretsUsagesStrict = (id: string): Effect.Effect<readonly Usage[], StorageFailure> =>
-      id: string,
-    ): Effect.Effect<readonly Usage[], StorageFailure> =>
       Effect.gen(function* () {
         const secretId = SecretId.make(id);
         const perPlugin = yield* Effect.all(
         return perPlugin.flat();
       });
-    const secretsUsages = (
+    const secretsUsages = (id: string): Effect.Effect<readonly Usage[], StorageFailure> =>
-      id: string,
-    ): Effect.Effect<readonly Usage[], StorageFailure> =>
       Effect.gen(function* () {
         const secretId = SecretId.make(id);
         const perPlugin = yield* Effect.all(
                 args: { secretId },
               }).pipe(
                 Effect.catchCause((cause: unknown) =>
-                  Effect.logWarning(
+                  Effect.logWarning(`usagesForSecret failed for plugin ${r.plugin.id}`, cause).pipe(
-                    `usagesForSecret failed for plugin ${r.plugin.id}`,
+                    Effect.as([] as readonly Usage[]),
-                    cause,
+                  ),
-                  ).pipe(Effect.as([] as readonly Usage[])),
                 ),
               ),
             ),
         return perPlugin.flat();
       });
-    const connectionsUsagesStrict = (
+    const connectionsUsagesStrict = (id: string): Effect.Effect<readonly Usage[], StorageFailure> =>
-      id: string,
-    ): Effect.Effect<readonly Usage[], StorageFailure> =>
       Effect.gen(function* () {
         const connectionId = ConnectionId.make(id);
         const perPlugin = yield* Effect.all(
         return perPlugin.flat();
       });
-    const connectionsUsages = (
+    const connectionsUsages = (id: string): Effect.Effect<readonly Usage[], StorageFailure> =>
-      id: string,
-    ): Effect.Effect<readonly Usage[], StorageFailure> =>
       Effect.gen(function* () {
         const connectionId = ConnectionId.make(id);
         const perPlugin = yield* Effect.all(
     const secretsRemove = (
       id: string,
-    ): Effect.Effect<
+    ): Effect.Effect<void, SecretOwnedByConnectionError | SecretInUseError | StorageFailure> =>
-      void,
-      SecretOwnedByConnectionError | SecretInUseError | StorageFailure
-    > =>
       Effect.gen(function* () {
         // Remove is shadowing-aware: drop only the innermost-scope row.
         // Removing a user-scope override on a secret that also has an
         // Refuse to delete connection-owned secrets. The connection owns
         // the lifecycle — callers must go through connections.remove.
         if (target && target.owned_by_connection_id) {
-          return yield* Effect.fail(
+          return yield* new SecretOwnedByConnectionError({
-            new SecretOwnedByConnectionError({
+            secretId: SecretId.make(id),
-              secretId: SecretId.make(id),
+            connectionId: ConnectionId.make(target.owned_by_connection_id),
-              connectionId: ConnectionId.make(
+          });
-                target.owned_by_connection_id as string,
-              ),
-            }),
-          );
         }
         // RESTRICT: refuse if any source/binding still references this
         // secret AND deleting the innermost row would leave the reference
         if (willDangle) {
           const usages = yield* secretsUsagesStrict(id);
           if (usages.length > 0) {
-            return yield* Effect.fail(
+            return yield* new SecretInUseError({
-              new SecretInUseError({
+              secretId: SecretId.make(id),
-                secretId: SecretId.make(id),
+              usageCount: usages.length,
-                usageCount: usages.length,
+            });
-              }),
-            );
           }
         }
-        const targetScope = (target?.scope_id as string | undefined) ??
+        const targetScope = target?.scope_id ?? scopeIds[0]!;
-          scopeIds[0]!;
         const deleters = [...secretProviders.values()].filter(
           (p): p is typeof p & { delete: NonNullable<typeof p.delete> } =>
         // leak them back in below.
         const allRows = yield* core.findMany({ model: "secret" });
         const connectionOwnedIds = new Set(
-          allRows
+          allRows.filter((r) => r.owned_by_connection_id).map((r) => r.id),
-            .filter((r) => r.owned_by_connection_id)
-            .map((r) => r.id as string),
         );
         const rows = allRows.filter((r) => !r.owned_by_connection_id);
-        const precedence = new Map<string, number>();
+        const pick = (row: (typeof rows)[number]) => {
-        scopeIds.forEach((id, index) => precedence.set(id, index));
-        const pick = (row: typeof rows[number]) => {
           const existing = byId.get(row.id);
-          const incomingScope = row.scope_id as string;
+          const incomingScope = row.scope_id;
-          const incomingRank = precedence.get(incomingScope) ?? Number.MAX_SAFE_INTEGER;
+          const incomingRank = scopeRank(row);
           if (existing) {
-            const existingRank = precedence.get(existing.scopeId as string) ?? Number.MAX_SAFE_INTEGER;
+            const existingRank = scopePrecedence.get(existing.scopeId) ?? Infinity;
             if (existingRank <= incomingRank) return;
           }
           byId.set(
               scopeId: ScopeId.make(incomingScope),
               name: row.name,
               provider: row.provider,
-              createdAt:
+              createdAt: row.created_at instanceof Date ? row.created_at : new Date(row.created_at),
-                row.created_at instanceof Date
-                  ? row.created_at
-                  : new Date(row.created_at as string),
             }),
           );
         };
         // whole list. Merge in registration order afterwards so the
         // "first provider wins" precedence stays deterministic.
         const attribution = scopes[0]!.id;
-        const listers = [...secretProviders.entries()].filter(
+        const listers = [...secretProviders.entries()].filter(([, p]) => p.list);
-          ([, p]) => p.list,
-        );
         const lists = yield* Effect.all(
           listers.map(([key, p]) =>
-            p
+            p.list!().pipe(
-              .list!()
+              Effect.catch(() => Effect.succeed([] as const)),
-              .pipe(
+              Effect.map((entries) => ({ key, entries })),
-                Effect.catch(() => Effect.succeed([] as const)),
+            ),
-                Effect.map((entries) => ({ key, entries })),
-              ),
           ),
           { concurrency: "unbounded" },
         );
     // behavior under the new SDK orchestration stays identical.
     const CONNECTION_REFRESH_SKEW_MS = 60_000;
-    const decodeProviderState = Schema.decodeUnknownOption(
+    const decodeProviderState = Schema.decodeUnknownOption(ConnectionProviderState);
-      ConnectionProviderState,
-    );
     const rowToConnection = (row: ConnectionRow): ConnectionRef =>
       new ConnectionRef({
-        id: ConnectionId.make(row.id as string),
+        id: ConnectionId.make(row.id),
-        scopeId: ScopeId.make(row.scope_id as string),
+        scopeId: ScopeId.make(row.scope_id),
-        provider: row.provider as string,
+        provider: row.provider,
-        identityLabel: (row.identity_label as string | null | undefined) ?? null,
+        identityLabel: row.identity_label ?? null,
-        accessTokenSecretId: SecretId.make(row.access_token_secret_id as string),
+        accessTokenSecretId: SecretId.make(row.access_token_secret_id),
         refreshTokenSecretId:
-          row.refresh_token_secret_id != null
+          row.refresh_token_secret_id != null ? SecretId.make(row.refresh_token_secret_id) : null,
-            ? SecretId.make(row.refresh_token_secret_id as string)
+        expiresAt: row.expires_at != null ? Number(row.expires_at) : null,
-            : null,
+        oauthScope: row.scope ?? null,
-        expiresAt:
+        providerState: Option.getOrNull(decodeProviderState(decodeJsonColumn(row.provider_state))),
-          row.expires_at != null ? Number(row.expires_at as number) : null,
+        createdAt: row.created_at instanceof Date ? row.created_at : new Date(row.created_at),
-        oauthScope: (row.scope as string | null | undefined) ?? null,
+        updatedAt: row.updated_at instanceof Date ? row.updated_at : new Date(row.updated_at),
-        providerState: Option.getOrNull(
-          decodeProviderState(decodeJsonColumn(row.provider_state)),
-        ),
-        createdAt:
-          row.created_at instanceof Date
-            ? row.created_at
-            : new Date(row.created_at as string),
-        updatedAt:
-          row.updated_at instanceof Date
-            ? row.updated_at
-            : new Date(row.updated_at as string),
       });
     const findInnermostConnectionRow = (
         return findInnermost(rows as readonly ConnectionRow[]);
       });
-    const connectionsGet = (
+    const connectionsGet = (id: string): Effect.Effect<ConnectionRef | null, StorageFailure> =>
-      id: string,
-    ): Effect.Effect<ConnectionRef | null, StorageFailure> =>
       Effect.gen(function* () {
         const row = yield* findInnermostConnectionRow(id);
         return row ? rowToConnection(row) : null;
       });
-    const connectionsList = (): Effect.Effect<
+    const connectionsList = (): Effect.Effect<readonly ConnectionRef[], StorageFailure> =>
-      readonly ConnectionRef[],
-      StorageFailure
-    > =>
       Effect.gen(function* () {
         const rows = yield* core.findMany({ model: "connection" });
         // Dedup by id, innermost scope wins — same rule as sources/tools.
         const byId = new Map<string, ConnectionRow>();
         const byIdRank = new Map<string, number>();
         for (const row of rows as readonly ConnectionRow[]) {
-          const rank = scopeRank(row as { scope_id: unknown });
+          const rank = scopeRank(row);
-          const existing = byIdRank.get(row.id as string);
+          const existing = byIdRank.get(row.id);
           if (existing === undefined || rank < existing) {
-            byId.set(row.id as string, row);
+            byId.set(row.id, row);
-            byIdRank.set(row.id as string, rank);
+            byIdRank.set(row.id, rank);
           }
         }
         return [...byId.values()].map(rowToConnection);
     // Write a secret value through a specific provider, bypassing the
     // bare-secrets ownership check so the SDK can stamp
     // `owned_by_connection_id` atomically alongside a connection row.
-    const writeOwnedSecret = (
+    const writeOwnedSecret = (params: {
-      params: {
+      id: string;
-        id: string;
+      scope: string;
-        scope: string;
+      name: string;
-        name: string;
+      value: string;
-        value: string;
+      provider: string;
-        provider: string;
+      ownedByConnectionId: string;
-        ownedByConnectionId: string;
+    }): Effect.Effect<void, StorageFailure> =>
-      },
-    ): Effect.Effect<void, StorageFailure> =>
       Effect.gen(function* () {
         const target = secretProviders.get(params.provider);
         if (!target) {
-          return yield* Effect.fail(
+          return yield* new StorageError({
-            new StorageError({
+            message: `Unknown secret provider: ${params.provider}`,
-              message: `Unknown secret provider: ${params.provider}`,
+            cause: undefined,
-              cause: undefined,
+          });
-            }),
-          );
         }
         if (!target.writable || !target.set) {
-          return yield* Effect.fail(
+          return yield* new StorageError({
-            new StorageError({
+            message: `Secret provider "${target.key}" is read-only`,
-              message: `Secret provider "${target.key}" is read-only`,
+            cause: undefined,
-              cause: undefined,
+          });
-            }),
-          );
         }
         yield* target.set(params.id, params.value, params.scope);
         if (requested) {
           const p = secretProviders.get(requested);
           if (!p) {
-            return yield* Effect.fail(
+            return yield* new StorageError({
-              new StorageError({
+              message: `Unknown secret provider: ${requested}`,
-                message: `Unknown secret provider: ${requested}`,
+              cause: undefined,
-                cause: undefined,
+            });
-              }),
-            );
           }
           return p;
         }
         for (const p of secretProviders.values()) {
           if (p.writable && p.set) return p;
         }
-        return yield* Effect.fail(
+        return yield* new StorageError({
-          new StorageError({
+          message: "No writable secret providers registered",
-            message: "No writable secret providers registered",
+          cause: undefined,
-            cause: undefined,
+        });
-          }),
-        );
       });
     const connectionsCreate = (
       input: CreateConnectionInput,
-    ): Effect.Effect<
+    ): Effect.Effect<ConnectionRef, ConnectionProviderNotRegisteredError | StorageFailure> =>
-      ConnectionRef,
-      ConnectionProviderNotRegisteredError | StorageFailure
-    > =>
       Effect.gen(function* () {
-        if (!scopeIds.includes(input.scope as string)) {
+        if (!scopeIds.some((scopeId) => scopeId === input.scope)) {
-          return yield* Effect.fail(
+          return yield* new StorageError({
-            new StorageError({
+            message:
-              message:
+              `connections.create targets scope "${input.scope}" which is not ` +
-                `connections.create targets scope "${input.scope}" which is not ` +
+              `in the executor's scope stack [${scopeIds.join(", ")}].`,
-                `in the executor's scope stack [${scopeIds.join(", ")}].`,
+            cause: undefined,
-              cause: undefined,
+          });
-            }),
-          );
         }
         if (!resolveConnectionProvider(input.provider)) {
-          return yield* Effect.fail(
+          return yield* new ConnectionProviderNotRegisteredError({
-            new ConnectionProviderNotRegisteredError({
+            provider: input.provider,
-              provider: input.provider,
+            connectionId: input.id,
-              connectionId: input.id,
+          });
-            }),
-          );
         }
         const writable = yield* pickWritableProvider();
             yield* core.delete({
               model: "connection",
               where: [
-                { field: "id", value: input.id as string },
+                { field: "id", value: input.id },
-                { field: "scope_id", value: input.scope as string },
+                { field: "scope_id", value: input.scope },
               ],
             });
             yield* writeOwnedSecret({
-              id: input.accessToken.secretId as string,
+              id: input.accessToken.secretId,
-              scope: input.scope as string,
+              scope: input.scope,
               name: input.accessToken.name,
               value: input.accessToken.value,
               provider: writable.key,
-              ownedByConnectionId: input.id as string,
+              ownedByConnectionId: input.id,
             });
             if (input.refreshToken) {
               yield* writeOwnedSecret({
-                id: input.refreshToken.secretId as string,
+                id: input.refreshToken.secretId,
-                scope: input.scope as string,
+                scope: input.scope,
                 name: input.refreshToken.name,
                 value: input.refreshToken.value,
                 provider: writable.key,
-                ownedByConnectionId: input.id as string,
+                ownedByConnectionId: input.id,
               });
             }
             yield* core.create({
               model: "connection",
               data: {
-                id: input.id as string,
+                id: input.id,
-                scope_id: input.scope as string,
+                scope_id: input.scope,
                 provider: input.provider,
                 identity_label: input.identityLabel ?? undefined,
-                access_token_secret_id: input.accessToken.secretId as string,
+                access_token_secret_id: input.accessToken.secretId,
-                refresh_token_secret_id:
+                refresh_token_secret_id: input.refreshToken?.secretId ?? undefined,
-                  input.refreshToken?.secretId ?? undefined,
                 expires_at: input.expiresAt ?? undefined,
                 scope: input.oauthScope ?? undefined,
                 provider_state: input.providerState ?? undefined,
               provider: input.provider,
               identityLabel: input.identityLabel,
               accessTokenSecretId: input.accessToken.secretId,
-              refreshTokenSecretId:
+              refreshTokenSecretId: input.refreshToken?.secretId ?? null,
-                input.refreshToken?.secretId ?? null,
               expiresAt: input.expiresAt,
               oauthScope: input.oauthScope,
               providerState: input.providerState,
     // configs still resolve.
     const connectionsUpdateTokens = (
       input: UpdateConnectionTokensInput,
-    ): Effect.Effect<
+    ): Effect.Effect<ConnectionRef, ConnectionNotFoundError | StorageFailure> =>
-      ConnectionRef,
-      ConnectionNotFoundError | StorageFailure
-    > =>
       Effect.gen(function* () {
-        const row = yield* findInnermostConnectionRow(input.id as string);
+        const row = yield* findInnermostConnectionRow(input.id);
         if (!row) {
-          return yield* Effect.fail(
+          return yield* new ConnectionNotFoundError({ connectionId: input.id });
-            new ConnectionNotFoundError({ connectionId: input.id }),
-          );
         }
         const writable = yield* pickWritableProvider();
-        const accessName =
+        const accessName = `Connection ${input.id} access token`;
-          `Connection ${input.id as string} access token`;
+        const refreshName = `Connection ${input.id} refresh token`;
-        const refreshName =
-          `Connection ${input.id as string} refresh token`;
         return yield* adapter.transaction(() =>
           Effect.gen(function* () {
             yield* writeOwnedSecret({
-              id: row.access_token_secret_id as string,
+              id: row.access_token_secret_id,
-              scope: row.scope_id as string,
+              scope: row.scope_id,
               name: accessName,
               value: input.accessToken,
               provider: writable.key,
-              ownedByConnectionId: row.id as string,
+              ownedByConnectionId: row.id,
             });
             const rotatedRefresh = input.refreshToken ?? undefined;
-            if (
+            if (rotatedRefresh && row.refresh_token_secret_id) {
-              rotatedRefresh &&
-              row.refresh_token_secret_id
-            ) {
               yield* writeOwnedSecret({
-                id: row.refresh_token_secret_id as string,
+                id: row.refresh_token_secret_id,
-                scope: row.scope_id as string,
+                scope: row.scope_id,
                 name: refreshName,
                 value: rotatedRefresh,
                 provider: writable.key,
-                ownedByConnectionId: row.id as string,
+                ownedByConnectionId: row.id,
               });
             }
             const now = new Date();
             const patch: Record<string, unknown> = { updated_at: now };
-            if (input.expiresAt !== undefined)
+            if (input.expiresAt !== undefined) patch.expires_at = input.expiresAt ?? undefined;
-              patch.expires_at = input.expiresAt ?? undefined;
+            if (input.oauthScope !== undefined) patch.scope = input.oauthScope ?? undefined;
-            if (input.oauthScope !== undefined)
-              patch.scope = input.oauthScope ?? undefined;
             if (input.providerState !== undefined)
               patch.provider_state = input.providerState ?? undefined;
             if (input.identityLabel !== undefined)
             yield* core.update({
               model: "connection",
               where: [
-                { field: "id", value: row.id as string },
+                { field: "id", value: row.id },
-                { field: "scope_id", value: row.scope_id as string },
+                { field: "scope_id", value: row.scope_id },
               ],
               update: patch,
             });
-            const updated = yield* findInnermostConnectionRow(
+            const updated = yield* findInnermostConnectionRow(row.id);
-              row.id as string,
-            );
             if (!updated) {
-              return yield* Effect.fail(
+              return yield* new ConnectionNotFoundError({
-                new ConnectionNotFoundError({ connectionId: input.id }),
+                connectionId: input.id,
-              );
+              });
             }
             return rowToConnection(updated);
           }),
       Effect.gen(function* () {
         const row = yield* findInnermostConnectionRow(id);
         if (!row) {
-          return yield* Effect.fail(
+          return yield* new ConnectionNotFoundError({
-            new ConnectionNotFoundError({
+            connectionId: ConnectionId.make(id),
-              connectionId: ConnectionId.make(id),
+          });
-            }),
-          );
         }
         yield* core.update({
           model: "connection",
           where: [
             { field: "id", value: id },
-            { field: "scope_id", value: row.scope_id as string },
+            { field: "scope_id", value: row.scope_id },
           ],
           update: {
             identity_label: label ?? undefined,
         if (willDangle) {
           const usages = yield* connectionsUsagesStrict(id);
           if (usages.length > 0) {
-            return yield* Effect.fail(
+            return yield* new ConnectionInUseError({
-              new ConnectionInUseError({
+              connectionId: ConnectionId.make(id),
-                connectionId: ConnectionId.make(id),
+              usageCount: usages.length,
-                usageCount: usages.length,
+            });
-              }),
-            );
           }
         }
-        const scope = row.scope_id as string;
+        const scope = row.scope_id;
         yield* adapter.transaction(() =>
           Effect.gen(function* () {
             // Find every owned secret at this scope and drop through
             for (const secret of owned) {
               yield* Effect.all(
                 deleters.map((p) =>
-                  p.delete(secret.id as string, scope).pipe(
+                  p
-                    Effect.catchCause((cause) =>
+                    .delete(secret.id, scope)
-                      Effect.logWarning(
+                    .pipe(
-                        `Failed to delete connection-owned secret from provider ${p.key}`,
+                      Effect.catchCause((cause) =>
-                        cause,
+                        Effect.logWarning(
-                      ).pipe(Effect.as(false)),
+                          `Failed to delete connection-owned secret from provider ${p.key}`,
+                          cause,
+                        ).pipe(Effect.as(false)),
+                      ),
                     ),
-                  ),
                 ),
                 { concurrency: "unbounded" },
               );
     // The actual work of a single refresh cycle, factored out so the
     // concurrency gate (`connectionsAccessToken`) stays readable. Runs
     // for the fiber that wins the `refreshInFlight` race.
-    const performRefresh = (
+    const performRefresh = (ref: ConnectionRef): Effect.Effect<string, AccessTokenError> =>
-      ref: ConnectionRef,
-    ): Effect.Effect<string, AccessTokenError> =>
       Effect.gen(function* () {
         const provider = resolveConnectionProvider(ref.provider);
         if (!provider) {
-          return yield* Effect.fail(
+          return yield* new ConnectionProviderNotRegisteredError({
-            new ConnectionProviderNotRegisteredError({
+            provider: ref.provider,
-              provider: ref.provider,
+            connectionId: ref.id,
-              connectionId: ref.id,
+          });
-            }),
-          );
         }
         if (!provider.refresh) {
-          return yield* Effect.fail(
+          return yield* new ConnectionRefreshNotSupportedError({
-            new ConnectionRefreshNotSupportedError({
+            connectionId: ref.id,
-              connectionId: ref.id,
+            provider: ref.provider,
-              provider: ref.provider,
+          });
-            }),
-          );
         }
         const refreshTokenValue = ref.refreshTokenSecretId
         // stored refresh token can't recover. Translate into the
         // caller-visible "re-authenticate" error so the UI can
         // prompt sign-in instead of silently retrying.
-        const rawResult: Result.Result<
+        const rawResult: Result.Result<ConnectionRefreshResult, ConnectionRefreshError> =
-          ConnectionRefreshResult,
+          yield* Effect.result(
-          ConnectionRefreshError
+            provider.refresh({
-        > = yield* Effect.result(
+              connectionId: ref.id,
-          provider.refresh({
+              scopeId: ref.scopeId,
-            connectionId: ref.id,
+              identityLabel: ref.identityLabel,
-            scopeId: ref.scopeId,
+              refreshToken: refreshTokenValue,
-            identityLabel: ref.identityLabel,
+              providerState: ref.providerState,
-            refreshToken: refreshTokenValue,
+              oauthScope: ref.oauthScope,
-            providerState: ref.providerState,
+            }),
-            oauthScope: ref.oauthScope,
+          );
-          }),
-        );
         if (Result.isFailure(rawResult)) {
           const err = rawResult.failure;
           if (err.reauthRequired) {
-            return yield* Effect.fail(
+            return yield* new ConnectionReauthRequiredError({
-              new ConnectionReauthRequiredError({
+              connectionId: err.connectionId,
-                connectionId: err.connectionId,
+              provider: ref.provider,
-                provider: ref.provider,
+              // oxlint-disable-next-line executor/no-unknown-error-message -- typed: ConnectionRefreshError.message is provider-facing domain data, not an unknown caught error
-                message: err.message,
+              message: err["message"],
-              }),
+            });
-            );
           }
-          return yield* Effect.fail(err);
+          return yield* err;
         }
         const result = rawResult.success;
     // observes the Deferred and awaits its completion. The Deferred is
     // pulled out of the map before the refresh result resolves so
     // later invokes don't reuse a completed slot.
-    const connectionsAccessToken = (
+    const connectionsAccessToken = (id: string): Effect.Effect<string, AccessTokenError> =>
-      id: string,
-    ): Effect.Effect<string, AccessTokenError> =>
       Effect.gen(function* () {
         const row = yield* findInnermostConnectionRow(id);
         if (!row) {
-          return yield* Effect.fail(
+          return yield* new ConnectionNotFoundError({
-            new ConnectionNotFoundError({
+            connectionId: ConnectionId.make(id),
-              connectionId: ConnectionId.make(id),
+          });
-            }),
-          );
         }
         const ref = rowToConnection(row);
         const now = Date.now();
         const needsRefresh =
-          ref.expiresAt !== null &&
+          ref.expiresAt !== null && ref.expiresAt - CONNECTION_REFRESH_SKEW_MS <= now;
-          ref.expiresAt - CONNECTION_REFRESH_SKEW_MS <= now;
         if (!needsRefresh) {
-          const current = yield* connectionSecretGet(
+          const current = yield* connectionSecretGet(ref.accessTokenSecretId);
-            ref.accessTokenSecretId,
-          );
           if (current !== null) return current;
           // Fall through to refresh if the stored token vanished — a
           // genuinely-missing secret with no way to refresh is a
       rawAdapter: adapter,
       secretsGet: (id) =>
         secretsGet(id).pipe(
-          Effect.catchTag("SecretOwnedByConnectionError", () =>
+          Effect.catchTag("SecretOwnedByConnectionError", () => Effect.succeed(null)),
-            Effect.succeed(null),
-          ),
         ),
       secretsSet: (input) => secretsSet(input),
       connectionsCreate: (input) => connectionsCreate(input),
     });
-    connectionProviders.set(
+    connectionProviders.set(oauthBundle.connectionProvider.key, oauthBundle.connectionProvider);
-      oauthBundle.connectionProvider.key,
-      oauthBundle.connectionProvider,
-    );
     // ------------------------------------------------------------------
     // Plugin wiring — build ctx, run extension, populate static pools,
     // ------------------------------------------------------------------
     for (const plugin of plugins) {
       if (runtimes.has(plugin.id)) {
-        return yield* Effect.fail(
+        return yield* new StorageError({
-          new Error(`Duplicate plugin id: ${plugin.id}`),
+          message: `Duplicate plugin id: ${plugin.id}`,
-        );
+          cause: undefined,
+        });
       }
       // Plugin-facing typed view. `StorageError` and `UniqueViolationError`
                 // share the same string space. Fails as `StorageError`
                 // so the HTTP edge surfaces it as `InternalError(traceId)`.
                 if (staticSources.has(input.id)) {
-                  return yield* Effect.fail(
+                  return yield* new StorageError({
-                    new StorageError({
+                    message: `Source id "${input.id}" collides with a static source`,
-                      message: `Source id "${input.id}" collides with a static source`,
+                    cause: undefined,
-                      cause: undefined,
+                  });
-                    }),
-                  );
                 }
                 for (const tool of input.tools) {
                   const fqid = `${input.id}.${tool.name}`;
                   if (staticTools.has(fqid)) {
-                    return yield* Effect.fail(
+                    return yield* new StorageError({
-                      new StorageError({
+                      message: `Tool id "${fqid}" collides with a static tool`,
-                        message: `Tool id "${fqid}" collides with a static tool`,
+                      cause: undefined,
-                        cause: undefined,
+                    });
-                      }),
-                    );
                   }
                 }
                 // Wrap in adapter.transaction so a standalone register()
                 // the router short-circuits to the active tx handle
                 // instead of opening a nested sql.begin — that nested
                 // sql.begin is the postgres.js + pool=1 deadlock path.
-                yield* adapter.transaction(() =>
+                yield* adapter.transaction(() => writeSourceInput(core, plugin.id, input));
-                  writeSourceInput(core, plugin.id, input),
-                );
               }),
             unregister: (sourceId: string) =>
               // `unregister` is scoped to a specific source row — look up
                   });
                   const row = findInnermost(rows);
                   if (!row) return;
-                  yield* deleteSourceById(
+                  yield* deleteSourceById(core, sourceId, row.scope_id);
-                    core,
-                    sourceId,
-                    row.scope_id as string,
-                  );
                 }),
               ),
             update: (input) =>
-              core.update({
+              core
-                model: "source",
+                .update({
-                where: [
+                  model: "source",
-                  { field: "id", value: input.id },
+                  where: [
-                  { field: "scope_id", value: input.scope },
+                    { field: "id", value: input.id },
-                ],
+                    { field: "scope_id", value: input.scope },
-                update: {
+                  ],
-                  ...(input.name !== undefined ? { name: input.name } : {}),
+                  update: {
-                  ...(input.url !== undefined ? { url: input.url ?? undefined } : {}),
+                    ...(input.name !== undefined ? { name: input.name } : {}),
-                  updated_at: new Date(),
+                    ...(input.url !== undefined ? { url: input.url ?? undefined } : {}),
-                },
+                    updated_at: new Date(),
-              }).pipe(Effect.asVoid),
+                  },
+                })
+                .pipe(Effect.asVoid),
           },
           definitions: {
             register: (input: DefinitionsInput) =>
-              adapter.transaction(() =>
+              adapter.transaction(() => writeDefinitions(core, plugin.id, input)),
-                writeDefinitions(core, plugin.id, input),
-              ),
           },
         },
         secrets: {
           list: () => connectionsListForCtx(),
           create: (input) => connectionsCreate(input),
           updateTokens: (input) => connectionsUpdateTokens(input),
-          setIdentityLabel: (id, label) =>
+          setIdentityLabel: (id, label) => connectionsSetIdentityLabel(id, label),
-            connectionsSetIdentityLabel(id, label),
           accessToken: (id) => connectionsAccessToken(id),
           remove: (id) => connectionsRemove(id),
         },
         // propagate unchanged; storage failures also stay typed
         // (`StorageFailure`) so the HTTP edge wrapper can translate them.
         transaction: <A, E>(effect: Effect.Effect<A, E>) =>
-          adapter.transaction(() => effect) as Effect.Effect<
+          adapter.transaction(() => effect) as Effect.Effect<A, E | StorageFailure>,
-            A,
-            E | StorageFailure
-          >,
       };
       // Build extension FIRST so it's available as `self` when resolving
       // staticSources. Field ordering in the plugin spec matters — TS
       // infers TExtension from `extension`'s return type, then NoInfer
       // locks `self` to that inferred type on `staticSources`.
-      const extension: object = plugin.extension
+      const extension: object = plugin.extension ? plugin.extension(ctx) : {};
-        ? plugin.extension(ctx)
-        : {};
       if (plugin.extension) {
         extensions[plugin.id] = extension;
       }
       // Resolve static declarations to the in-memory pools. NO DB WRITES.
-      const decls = plugin.staticSources
+      const decls = plugin.staticSources ? plugin.staticSources(extension) : [];
-        ? plugin.staticSources(extension)
-        : [];
       for (const source of decls) {
         if (staticSources.has(source.id)) {
-          return yield* Effect.fail(
+          return yield* new StorageError({
-            new Error(
+            message: `Duplicate static source id: ${source.id} (plugin ${plugin.id})`,
-              `Duplicate static source id: ${source.id} (plugin ${plugin.id})`,
+            cause: undefined,
-            ),
+          });
-          );
         }
         staticSources.set(source.id, { source, pluginId: plugin.id });
         for (const tool of source.tools) {
           const fqid = `${source.id}.${tool.name}`;
           if (staticTools.has(fqid)) {
-            return yield* Effect.fail(
+            return yield* new StorageError({
-              new Error(
+              message: `Duplicate static tool id: ${fqid} (plugin ${plugin.id})`,
-                `Duplicate static tool id: ${fqid} (plugin ${plugin.id})`,
+              cause: undefined,
-              ),
+            });
-            );
           }
           staticTools.set(fqid, {
             source,
         const providers = Effect.isEffect(raw) ? yield* raw : raw;
         for (const provider of providers) {
           if (secretProviders.has(provider.key)) {
-            return yield* Effect.fail(
+            return yield* new StorageError({
-              new Error(
+              message: `Duplicate secret provider key: ${provider.key} (from plugin ${plugin.id})`,
-                `Duplicate secret provider key: ${provider.key} (from plugin ${plugin.id})`,
+              cause: undefined,
-              ),
+            });
-            );
           }
           secretProviders.set(provider.key, provider);
         }
         const providers = Effect.isEffect(raw) ? yield* raw : raw;
         for (const provider of providers) {
           if (connectionProviders.has(provider.key)) {
-            return yield* Effect.fail(
+            return yield* new StorageError({
-              new Error(
+              message: `Duplicate connection provider key: ${provider.key} (from plugin ${plugin.id})`,
-                `Duplicate connection provider key: ${provider.key} (from plugin ${plugin.id})`,
+              cause: undefined,
-              ),
+            });
-            );
           }
           connectionProviders.set(provider.key, provider);
         }
         // two rows — their override and the outer default — which is
         // inconsistent with how `secrets.list` and every other list
         // surface dedup shadowed entries.
-        const byId = new Map<string, typeof dynamic[number]>();
+        const byId = new Map<string, (typeof dynamic)[number]>();
         const byIdRank = new Map<string, number>();
         for (const row of dynamic) {
           const rank = scopeRank(row);
           [...groups],
           ([key, groupRows]) =>
             Effect.gen(function* () {
-              const [pluginId, sourceId] = key.split("\u0000") as [
+              const [pluginId, sourceId] = key.split("\u0000") as [string, string];
-                string,
-                string,
-              ];
               const runtime = runtimes.get(pluginId);
               if (!runtime?.plugin.resolveAnnotations) return undefined;
               return yield* runtime.plugin.resolveAnnotations({
       Effect.gen(function* () {
         const dynamic = yield* core.findMany({
           model: "tool",
-          where: filter?.sourceId
+          where: filter?.sourceId ? [{ field: "source_id", value: filter.sourceId }] : undefined,
-            ? [{ field: "source_id", value: filter.sourceId }]
-            : undefined,
         });
         // Dedup by tool id, innermost scope winning — same reason as
         // `listSources` above: a shadowed id must surface as one entry
         // (the inner one), not two.
-        const byId = new Map<string, typeof dynamic[number]>();
+        const byId = new Map<string, (typeof dynamic)[number]>();
         const byIdRank = new Map<string, number>();
         for (const row of dynamic) {
           const rank = scopeRank(row);
         for (const row of dynamicDeduped) {
           out.push(rowToTool(row, annotations.get(row.id)));
         }
-        const filtered = filter
+        const filtered = filter ? out.filter((t) => toolMatchesFilter(t, filter)) : out;
-          ? out.filter((t) => toolMatchesFilter(t, filter))
-          : out;
         // Drop tools blocked by user policy unless the caller explicitly
         // asked to see them (the settings UI does, agent surfaces don't).
           model: "definition",
           where: [{ field: "source_id", value: sourceId }],
         });
-        const winners = new Map<string, { row: typeof defRows[number]; rank: number }>();
+        const winners = new Map<string, { row: (typeof defRows)[number]; rank: number }>();
         for (const row of defRows) {
           const rank = scopeRank(row);
           const existing = winners.get(row.name);
     const toolsDefinitions = () =>
       Effect.gen(function* () {
         const rows = yield* core.findMany({ model: "definition" });
-        const winners = new Map<string, { row: typeof rows[number]; rank: number }>();
+        const winners = new Map<string, { row: (typeof rows)[number]; rank: number }>();
         for (const row of rows) {
           const key = `${row.source_id}\u0000${row.name}`;
           const rank = scopeRank(row);
         return out;
       });
-    const defaultElicitationHandler = resolveElicitationHandler(
+    const defaultElicitationHandler = resolveElicitationHandler(config.onElicitation);
-      config.onElicitation,
-    );
     const pickHandler = (options: InvokeOptions | undefined): ElicitationHandler =>
       options?.onElicitation
         ? resolveElicitationHandler(options.onElicitation)
         : defaultElicitationHandler;
-    const buildElicit = (
+    const buildElicit = (toolId: string, args: unknown, handler: ElicitationHandler): Elicit => {
-      toolId: string,
-      args: unknown,
-      handler: ElicitationHandler,
-    ): Elicit => {
       return (request: ElicitationRequest) =>
         Effect.gen(function* () {
           const tid = ToolId.make(toolId);
     // used as today.
     // ------------------------------------------------------------------
-    const loadAllPolicies = () =>
+    const loadAllPolicies = () => core.findMany({ model: "tool_policy" });
-      core.findMany({ model: "tool_policy" });
     const resolveToolPolicyForId = (toolId: string) =>
       Effect.gen(function* () {
         }
       });
-    const invokeTool = (
+    const invokeTool = (toolId: string, args: unknown, options?: InvokeOptions) => {
-      toolId: string,
-      args: unknown,
-      options?: InvokeOptions,
-    ) => {
       const handler = pickHandler(options);
       return Effect.gen(function* () {
+        const formatInvocationCauseMessage = (cause: unknown): string => {
+          // oxlint-disable-next-line executor/no-instanceof-error, executor/no-unknown-error-message -- boundary: preserve public invoke error message wrapping for unknown plugin failures
+          return cause instanceof Error ? cause.message : String(cause);
+        };
         const wrapInvocationError = <A, E>(
           effect: Effect.Effect<A, E>,
         ): Effect.Effect<A, ToolInvocationError> =>
               (cause) =>
                 new ToolInvocationError({
                   toolId: ToolId.make(toolId),
-                  message:
+                  message: formatInvocationCauseMessage(cause),
-                    cause instanceof Error ? cause.message : String(cause),
                   cause,
                 }),
             ),
             "executor.source_kind": staticEntry.source.kind,
             "executor.plugin_id": staticEntry.pluginId,
           });
-          yield* enforceApproval(
+          yield* enforceApproval(staticEntry.tool.annotations, toolId, args, policy, handler).pipe(
-            staticEntry.tool.annotations,
+            Effect.withSpan("executor.tool.enforce_approval"),
-            toolId,
+          );
-            args,
-            policy,
-            handler,
-          ).pipe(Effect.withSpan("executor.tool.enforce_approval"));
           return yield* wrapInvocationError(
             staticEntry.tool.handler({
               ctx: staticEntry.ctx,
               yield* runtime.plugin.removeSource({
                 ctx: runtime.ctx,
                 sourceId,
-                scope: sourceRow.scope_id as string,
+                scope: sourceRow.scope_id,
               });
             }
-            yield* deleteSourceById(
+            yield* deleteSourceById(core, sourceId, sourceRow.scope_id);
-              core,
-              sourceId,
-              sourceRow.scope_id as string,
-            );
           }),
         );
       });
           yield* runtime.plugin.refreshSource({
             ctx: runtime.ctx,
             sourceId,
-            scope: sourceRow.scope_id as string,
+            scope: sourceRow.scope_id,
           });
         }
       });
     // `detect` hook. Collect all non-null results. Plugin-level detect
     // implementations should swallow fetch errors and return null, so
     // one flaky plugin doesn't block the whole dispatch.
-    const detectionConfidenceScore = (
+    const detectionConfidenceScore = (confidence: SourceDetectionResult["confidence"]) => {
-      confidence: SourceDetectionResult["confidence"],
-    ) => {
       switch (confidence) {
         case "high":
           return 3;
           if (result) results.push(result);
         }
         return results.sort(
-          (a, b) =>
+          (a, b) => detectionConfidenceScore(b.confidence) - detectionConfidenceScore(a.confidence),
-            detectionConfidenceScore(b.confidence) -
-            detectionConfidenceScore(a.confidence),
         );
       });
     // Per-source definitions accessor — one query, one mapping pass.
-    const sourceDefinitions = (sourceId: string) =>
+    const sourceDefinitions = (sourceId: string) => loadDefinitionsForSource(sourceId);
-      loadDefinitionsForSource(sourceId);
     // Existence check for user-facing secret pickers. Core `secret`
     // rows are routing metadata; when a provider can answer `has()`,
     // confirm the backing value still exists. Providers without `has()`
     // remain conservative so keychain/1password don't need to return
     // the value or prompt just to populate picker/status UI.
-    const secretsStatus = (
+    const secretsStatus = (id: string): Effect.Effect<"resolved" | "missing", StorageFailure> =>
-      id: string,
-    ): Effect.Effect<"resolved" | "missing", StorageFailure> =>
       Effect.gen(function* () {
         const rows = yield* secretRowsForId(id);
         if (rows.some((row) => row.owned_by_connection_id)) return "missing";
           });
           let min: string | null = null;
           for (const row of existing) {
-            const p = row.position as string;
+            const p = row.position;
             if (min === null || p < min) min = p;
           }
           position = generateKeyBetween(null, min);
           model: "tool_policy",
           where: [
             { field: "id", value: input.id },
-            { field: "scope_id", value: row.scope_id as string },
+            { field: "scope_id", value: row.scope_id },
           ],
           update: {
-            pattern: updated.pattern as string,
+            pattern: updated.pattern,
-            action: updated.action as string,
+            action: updated.action,
-            position: updated.position as string,
+            position: updated.position,
-            updated_at: updated.updated_at as Date,
+            updated_at: updated.updated_at,
           },
         });
         return rowToToolPolicy(updated);
         .pipe(Effect.asVoid, Effect.withSpan("executor.policies.remove"));
     const policiesResolve = (toolId: string) =>
-      resolveToolPolicyForId(toolId).pipe(
+      resolveToolPolicyForId(toolId).pipe(Effect.withSpan("executor.policies.resolve"));
-        Effect.withSpan("executor.policies.resolve"),
-      );
     const close = () =>
       Effect.gen(function* () {
         remove: secretsRemove,
         list: secretsList,
         usages: secretsUsages,
-        providers: () =>
+        providers: () => Effect.sync(() => Array.from(secretProviders.keys()) as readonly string[]),
-          Effect.sync(
-            () => Array.from(secretProviders.keys()) as readonly string[],
-          ),
       },
       connections: {
         get: connectionsGet,
         remove: connectionsRemove,
         usages: connectionsUsages,
         providers: () =>
-          Effect.sync(
+          Effect.sync(() => Array.from(connectionProviders.keys()) as readonly string[]),
-            () =>
-              Array.from(connectionProviders.keys()) as readonly string[],
-          ),
       },
       oauth: oauthBundle.service,
       policies: {
     // those leak via the helper functions and won't be cleaned until
     // every plugin tightens its surface to typed errors. The runtime
     // shape matches `Executor<TPlugins>`.
-    const toExecutor = (value: unknown): Executor<TPlugins> =>
+    const toExecutor = (value: unknown): Executor<TPlugins> => value as Executor<TPlugins>;
-      value as Executor<TPlugins>;
     return toExecutor(Object.assign(base, extensions));
   });