lael-labs/executor

.executor/executor.jsonc+105−10

@@ -1,22 +1,117 @@
1	{	1	{
2	"sources": {	2	"sources": {
3	"github": {	3	"github": {
4	"kind": "openapi",
5	"name": "GitHub",	4	"name": "GitHub",
6	"connection": {	5	"connection": {
7	"endpoint": "https://api.github.com/"	6	"endpoint": "https://api.github.com"
8	},	7	},
		8	"kind": "openapi",
9	"binding": {	9	"binding": {
10	"specUrl": "https://raw.githubusercontent.com/github/rest-api-description/main/descriptions/api.github.com/api.github.com.json",	10	"specUrl": "https://example.com/github-openapi.yaml",
11	"defaultHeaders": null	11	"defaultHeaders": null
12	}	12	}
13	}	13	},
14	},	14	"googleapis": {
15	"policies": {	15	"name": "Drive",
16	"demo.*": {	16	"namespace": "google.drive",
17	"match": "demo.*",	17	"connection": {
18	"action": "allow",	18	"endpoint": "http://127.0.0.1:60144/drive/$discovery/rest?version=v3"
19	"approval": "auto"	19	},
		20	"kind": "google_discovery",
		21	"binding": {
		22	"service": "drive",
		23	"version": "v3",
		24	"discoveryUrl": "http://127.0.0.1:60144/drive/$discovery/rest?version=v3",
		25	"defaultHeaders": null,
		26	"scopes": [
		27	"scope:drive.readonly"
		28	]
		29	}
		30	},
		31	"google-gmail": {
		32	"name": "Gmail",
		33	"namespace": "google.gmail",
		34	"connection": {
		35	"endpoint": "http://127.0.0.1:60197/gmail/$discovery/rest?version=v1"
		36	},
		37	"kind": "google_discovery",
		38	"binding": {
		39	"service": "gmail",
		40	"version": "v1",
		41	"discoveryUrl": "http://127.0.0.1:60197/gmail/$discovery/rest?version=v1",
		42	"defaultHeaders": null,
		43	"scopes": [
		44	"scope:gmail.readonly"
		45	]
		46	}
		47	},
		48	"google-calendar": {
		49	"name": "Calendar",
		50	"namespace": "google.calendar",
		51	"connection": {
		52	"endpoint": "http://127.0.0.1:60190/calendar/$discovery/rest?version=v3"
		53	},
		54	"kind": "google_discovery",
		55	"binding": {
		56	"service": "calendar",
		57	"version": "v3",
		58	"discoveryUrl": "http://127.0.0.1:60190/calendar/$discovery/rest?version=v3",
		59	"defaultHeaders": null,
		60	"scopes": [
		61	"scope:calendar.readonly"
		62	]
		63	}
		64	},
		65	"google-drive": {
		66	"name": "Drive",
		67	"namespace": "google.drive",
		68	"connection": {
		69	"endpoint": "http://127.0.0.1:60205/drive/$discovery/rest?version=v3"
		70	},
		71	"kind": "google_discovery",
		72	"binding": {
		73	"service": "drive",
		74	"version": "v3",
		75	"discoveryUrl": "http://127.0.0.1:60205/drive/$discovery/rest?version=v3",
		76	"defaultHeaders": null,
		77	"scopes": [
		78	"scope:drive.readonly"
		79	]
		80	}
		81	},
		82	"google-drive-2": {
		83	"name": "Drive",
		84	"namespace": "google.drive",
		85	"connection": {
		86	"endpoint": "https://example.test/drive/$discovery/rest?version=v3"
		87	},
		88	"kind": "google_discovery",
		89	"binding": {
		90	"service": "drive",
		91	"version": "v3",
		92	"discoveryUrl": "https://example.test/drive/$discovery/rest?version=v3",
		93	"defaultHeaders": null,
		94	"scopes": [
		95	"scope:drive.readonly"
		96	]
		97	}
		98	},
		99	"google-gmail-2": {
		100	"kind": "google_discovery",
		101	"name": "Gmail",
		102	"namespace": "google.gmail",
		103	"connection": {
		104	"endpoint": "https://example.test/gmail/$discovery/rest?version=v1"
		105	},
		106	"binding": {
		107	"service": "gmail",
		108	"version": "v1",
		109	"discoveryUrl": "https://example.test/gmail/$discovery/rest?version=v1",
		110	"defaultHeaders": null,
		111	"scopes": [
		112	"scope:gmail.readonly"
		113	]
		114	}
20	}	115	}
21	}	116	}
22	}	117	}

.oxlintrc.jsonc+13−0

@@ -43,6 +43,8 @@ · 42 unmodified lines
43	"executor-monorepo/no-cross-workspace-relative-imports": "error",	43	"executor-monorepo/no-cross-workspace-relative-imports": "error",
44	"executor-monorepo/no-direct-effect-tag-read": "error",	44	"executor-monorepo/no-direct-effect-tag-read": "error",
45	"executor-monorepo/no-effect-run-in-effect-vitest-tests": "error",	45	"executor-monorepo/no-effect-run-in-effect-vitest-tests": "error",
		46	"executor-monorepo/no-manual-httpapi-openapi-bridge": "error",
		47	"executor-monorepo/no-manual-openapi-documents": "error",
46	"executor-monorepo/no-node-fs-with-effect-imports": "error",	48	"executor-monorepo/no-node-fs-with-effect-imports": "error",
47	"executor-monorepo/no-raw-effect-fail-errors": "error",	49	"executor-monorepo/no-raw-effect-fail-errors": "error",
48	"executor-monorepo/no-yield-effect-fail": "error",	50	"executor-monorepo/no-yield-effect-fail": "error",
@@ -50,6 +52,17 @@ · 1 unmodified line
50	},	52	},
51		53
52	"overrides": [	54	"overrides": [
		55	{
		56	// SDK tests still use relative workspace imports to avoid introducing
		57	// package-graph cycles from test-only dependencies.
		58	"files": [
		59	"packages/platform/sdk/src/executor.test.ts",
		60	"packages/platform/sdk/src/runtime/executor-runtime.test.ts"
		61	],
		62	"rules": {
		63	"executor-monorepo/no-cross-workspace-relative-imports": "off"
		64	}
		65	},
53	{	66	{
54	// JSON Schema conditionals legitimately use a `then` key.	67	// JSON Schema conditionals legitimately use a `then` key.
55	"files": [	68	"files": [

.tmp-openapi-helper-probe.ts+30−0

@@ -0,0 +1,30 @@
	1	import { HttpApi, HttpApiBuilder, HttpApiEndpoint, HttpApiGroup, HttpApiSchema } from '@effect/platform';
	2	import { startOpenApiTestServer } from '@executor/effect-test-utils';
	3	import * as Effect from 'effect/Effect';
	4	import * as Layer from 'effect/Layer';
	5	import * as Schema from 'effect/Schema';
	6
	7	const ownerParam = HttpApiSchema.param('owner', Schema.String);
	8	const repoParam = HttpApiSchema.param('repo', Schema.String);
	9	class DemoReposApi extends HttpApiGroup.make('repos').add(
	10	HttpApiEndpoint.get('getRepo')`/repos/${ownerParam}/${repoParam}`.addSuccess(
	11	Schema.Struct({ full_name: Schema.String, private: Schema.Boolean }),
	12	),
	13	) {}
	14	class DemoApi extends HttpApi.make('demo').add(DemoReposApi) {}
	15	const live = HttpApiBuilder.group(DemoApi, 'repos', (handlers) =>
	16	handlers.handle('getRepo', ({ path, request }) => {
	17	console.log('auth', request.headers.authorization);
	18	return Effect.succeed({ full_name: `${path.owner}/${path.repo}`, private: false });
	19	}),
	20	);
	21	const main = async () => {
	22	const server = await startOpenApiTestServer({ apiLayer: HttpApiBuilder.api(DemoApi).pipe(Layer.provide(live)) });
	23	console.log('base', server.baseUrl, server.specUrl);
	24	const spec = await fetch(server.specUrl);
	25	console.log('spec', spec.status, await spec.text());
	26	const resp = await fetch(`${server.baseUrl}/repos/vercel/ai`, { headers: { authorization: 'Bearer test' } });
	27	console.log('repo', resp.status, await resp.text());
	28	await server.close();
	29	};
	30	main().catch((e) => { console.error(e); process.exit(1); });

CLAUDE.md+7−0

@@ -0,0 +1,7 @@
	1	# Repo Agent Notes
	2
	3	- When a test needs an OpenAPI spec, generate it from Effect `HttpApi` with `OpenApi.fromApi(...)`.
	4	- When a test needs to serve an Effect `HttpApi` plus `/openapi.json`, use `@executor/effect-test-utils` via `startOpenApiTestServer(...)` or `makeOpenApiTestServer(...)`.
	5	- Do not hand-author inline OpenAPI documents in normal tests.
	6	- Do not hand-roll `HttpApiBuilder.toWebHandler(...)` to Node HTTP bridges for OpenAPI test servers.
	7	- Raw OpenAPI parser/import-fidelity tests are the exception; those may keep literal OpenAPI documents where the point of the test is the raw document itself.

apps/executor/package.json+1−0

@@ -45,6 +45,7 @@ · 44 unmodified lines
45	"effect": "catalog:"	45	"effect": "catalog:"
46	},	46	},
47	"devDependencies": {	47	"devDependencies": {
		48	"@executor/effect-test-utils": "workspace:*",
48	"@executor/mcp-elicitation-demo": "workspace:*",	49	"@executor/mcp-elicitation-demo": "workspace:*",
49	"@executor/runtime-ses": "workspace:*",	50	"@executor/runtime-ses": "workspace:*",
50	"@effect/vitest": "catalog:",	51	"@effect/vitest": "catalog:",

apps/executor/src/cli/dev.ts+3−3

@@ -1,5 +1,5 @@
1	import type { ExecutorApiClient } from "@executor/platform-api";	1	import type { ExecutorApiClient } from "@executor/platform-api";
2	import { WorkspaceIdSchema } from "@executor/platform-sdk/schema";	2	import { ScopeIdSchema } from "@executor/platform-sdk/schema";
3	import * as Effect from "effect/Effect";	3	import * as Effect from "effect/Effect";
4		4
5	const readBindingString = (binding: Record<string, unknown>, key: string): string \| null =>	5	const readBindingString = (binding: Record<string, unknown>, key: string): string \| null =>
@@ -41,7 +41,7 @@ export const seedDemoMcpSourceInWorkspace = ( · 35 unmodified lines
41	input: SeedDemoMcpSourceInput,	41	input: SeedDemoMcpSourceInput,
42	): Effect.Effect<SeedDemoMcpSourceResult, unknown, never> =>	42	): Effect.Effect<SeedDemoMcpSourceResult, unknown, never> =>
43	Effect.gen(function* () {	43	Effect.gen(function* () {
44	const workspaceId = WorkspaceIdSchema.make(input.workspaceId);	44	const workspaceId = ScopeIdSchema.make(input.workspaceId);
45		45
46	const existing = yield* input.client.sources.list({	46	const existing = yield* input.client.sources.list({
47	path: {	47	path: {
@@ -138,7 +138,7 @@ export const seedGithubOpenApiSourceInWorkspace = ( · 90 unmodified lines
138	input: SeedGithubOpenApiSourceInput,	138	input: SeedGithubOpenApiSourceInput,
139	): Effect.Effect<SeedDemoMcpSourceResult, unknown, never> =>	139	): Effect.Effect<SeedDemoMcpSourceResult, unknown, never> =>
140	Effect.gen(function* () {	140	Effect.gen(function* () {
141	const workspaceId = WorkspaceIdSchema.make(input.workspaceId);	141	const workspaceId = ScopeIdSchema.make(input.workspaceId);
142		142
143	const existing = yield* input.client.sources.list({	143	const existing = yield* input.client.sources.list({
144	path: {	144	path: {

apps/executor/src/cli/main.ts+15−11

         const environment = yield* Effect.gen(function* () {
           const resolveExecutionEnvironment = yield* RuntimeExecutionResolverService;
           return yield* resolveExecutionEnvironment({
-            workspaceId: executor.workspaceId,
+            scopeId: executor.scopeId,
-            accountId: executor.accountId,
+            actorScopeId: executor.actorScopeId,
             executionId: ExecutionIdSchema.make("exec_help"),
           });
         }).pipe(
     const installation = yield* bootstrapClient.local.installation({});
     const client = yield* createExecutorApiClient({
       baseUrl,
-      accountId: installation.accountId,
+      accountId: installation.actorScopeId,
     });
     return {
     const installation = reachable
       ? yield* getBootstrapClient(baseUrl).pipe(
           Effect.flatMap((client) => client.local.installation({})),
+          Effect.map((installation) => ({
+            accountId: installation.actorScopeId,
+            workspaceId: installation.scopeId,
+          })),
           Effect.catchAll(() => Effect.succeed(null)),
         )
       : null;
 const waitForExecutionProgress = (input: {
   client: ExecutorApiClient;
-  workspaceId: ExecutionEnvelope["execution"]["workspaceId"];
+  workspaceId: ExecutionEnvelope["execution"]["scopeId"];
   executionId: ExecutionEnvelope["execution"]["id"];
   pendingInteractionId: ExecutionInteraction["id"];
 }) =>
     const { installation, client } = yield* getLocalAuthedClient(input.baseUrl);
     const result = yield* seedDemoMcpSourceInWorkspace({
       client,
-      workspaceId: installation.workspaceId,
+      workspaceId: installation.scopeId,
       endpoint: input.endpoint,
       name: input.name,
       namespace: input.namespace,
     const { installation, client } = yield* getLocalAuthedClient(input.baseUrl);
     const result = yield* seedGithubOpenApiSourceInWorkspace({
       client,
-      workspaceId: installation.workspaceId,
+      workspaceId: installation.scopeId,
       endpoint: input.endpoint,
       specUrl: input.specUrl,
       name: input.name,
 const driveExecution = (input: {
   client: ExecutorApiClient;
-  workspaceId: ExecutionEnvelope["execution"]["workspaceId"];
+  workspaceId: ExecutionEnvelope["execution"]["scopeId"];
   envelope: ExecutionEnvelope;
   baseUrl: string;
   shouldOpenUrls: boolean;
       const { installation, client } = yield* getLocalAuthedClient(baseUrl);
       const created = yield* client.executions.create({
         path: {
-          workspaceId: installation.workspaceId,
+          workspaceId: installation.scopeId,
         },
         payload: {
           code: resolvedCode,
       const settled = yield* driveExecution({
         client,
-        workspaceId: installation.workspaceId,
+        workspaceId: installation.scopeId,
         envelope: created,
         baseUrl,
         shouldOpenUrls: !noOpen,
       );
       const execution = yield* client.executions.get({
         path: {
-          workspaceId: installation.workspaceId,
+          workspaceId: installation.scopeId,
           executionId: decodedExecutionId,
         },
       });
       const settled = yield* driveExecution({
         client,
-        workspaceId: installation.workspaceId,
+        workspaceId: installation.scopeId,
         envelope: execution,
         baseUrl,
         shouldOpenUrls: !noOpen,

apps/executor/src/distribution/distribution.test.ts+6−6

@@ -65,8 +65,8 @@ describe("distribution flow", () => { · 64 unmodified lines
65	const installationResponse = yield* harness.fetchText("/v1/local/installation");	65	const installationResponse = yield* harness.fetchText("/v1/local/installation");
66	expect(installationResponse.status).toBe(200);	66	expect(installationResponse.status).toBe(200);
67	const installation = JSON.parse(installationResponse.body) as {	67	const installation = JSON.parse(installationResponse.body) as {
68	workspaceId: string;	68	scopeId: string;
69	accountId: string;	69	actorScopeId: string;
70	};	70	};
71		71
72	const sesCall = yield* runCommand(	72	const sesCall = yield* runCommand(
@@ -88,12 +88,12 @@ describe("distribution flow", () => { · 15 unmodified lines
88	const installationAfterRestart = JSON.parse(	88	const installationAfterRestart = JSON.parse(
89	installationAfterRestartResponse.body,	89	installationAfterRestartResponse.body,
90	) as {	90	) as {
91	workspaceId: string;	91	scopeId: string;
92	accountId: string;	92	actorScopeId: string;
93	};	93	};
94		94
95	expect(installationAfterRestart.workspaceId).toBe(installation.workspaceId);	95	expect(installationAfterRestart.scopeId).toBe(installation.scopeId);
96	expect(installationAfterRestart.accountId).toBe(installation.accountId);	96	expect(installationAfterRestart.actorScopeId).toBe(installation.actorScopeId);
97		97
98	yield* runCommand(["down", "--base-url", harness.baseUrl]);	98	yield* runCommand(["down", "--base-url", harness.baseUrl]);
99	});	99	});

apps/executor/src/server/server.real-ingestion.test.ts+11−11

@@ -39,7 +39,7 @@ const createApiClientHarness = () => · 38 unmodified lines
39	const installation = yield* bootstrapClient.local.installation({});	39	const installation = yield* bootstrapClient.local.installation({});
40	const client = yield* createExecutorApiClient({	40	const client = yield* createExecutorApiClient({
41	baseUrl: server.baseUrl,	41	baseUrl: server.baseUrl,
42	accountId: installation.accountId,	42	accountId: installation.actorScopeId,
43	});	43	});
44		44
45	return {	45	return {
@@ -75,7 +75,7 @@ describe("local-executor-server real ingestion", () => { · 29 unmodified lines
75		75
76	const connected = yield* client.sources.connect({	76	const connected = yield* client.sources.connect({
77	path: {	77	path: {
78	workspaceId: installation.workspaceId,	78	workspaceId: installation.scopeId,
79	},	79	},
80	payload: {	80	payload: {
81	kind: "openapi",	81	kind: "openapi",
@@ -96,7 +96,7 @@ describe("local-executor-server real ingestion", () => { · 14 unmodified lines
96		96
97	const inspection = yield* client.sources.inspection({	97	const inspection = yield* client.sources.inspection({
98	path: {	98	path: {
99	workspaceId: installation.workspaceId,	99	workspaceId: installation.scopeId,
100	sourceId: connected.source.id,	100	sourceId: connected.source.id,
101	},	101	},
102	});	102	});
@@ -106,7 +106,7 @@ describe("local-executor-server real ingestion", () => { · 3 unmodified lines
106		106
107	const discoveredTools = yield* client.sources.inspectionDiscover({	107	const discoveredTools = yield* client.sources.inspectionDiscover({
108	path: {	108	path: {
109	workspaceId: installation.workspaceId,	109	workspaceId: installation.scopeId,
110	sourceId: connected.source.id,	110	sourceId: connected.source.id,
111	},	111	},
112	payload: {	112	payload: {
@@ -137,7 +137,7 @@ describe("local-executor-server real ingestion", () => { · 24 unmodified lines
137		137
138	const connected = yield* client.sources.connect({	138	const connected = yield* client.sources.connect({
139	path: {	139	path: {
140	workspaceId: installation.workspaceId,	140	workspaceId: installation.scopeId,
141	},	141	},
142	payload: {	142	payload: {
143	kind: "graphql",	143	kind: "graphql",
@@ -159,7 +159,7 @@ describe("local-executor-server real ingestion", () => { · 15 unmodified lines
159		159
160	const inspection = yield* client.sources.inspection({	160	const inspection = yield* client.sources.inspection({
161	path: {	161	path: {
162	workspaceId: installation.workspaceId,	162	workspaceId: installation.scopeId,
163	sourceId: connected.source.id,	163	sourceId: connected.source.id,
164	},	164	},
165	});	165	});
@@ -175,7 +175,7 @@ describe("local-executor-server real ingestion", () => { · 9 unmodified lines
175		175
176	const toolDetail = yield* client.sources.inspectionTool({	176	const toolDetail = yield* client.sources.inspectionTool({
177	path: {	177	path: {
178	workspaceId: installation.workspaceId,	178	workspaceId: installation.scopeId,
179	sourceId: connected.source.id,	179	sourceId: connected.source.id,
180	toolPath: "linear.administrableTeams",	180	toolPath: "linear.administrableTeams",
181	},	181	},
@@ -191,7 +191,7 @@ describe("local-executor-server real ingestion", () => { · 9 unmodified lines
191		191
192	const storedSource = yield* client.sources.get({	192	const storedSource = yield* client.sources.get({
193	path: {	193	path: {
194	workspaceId: installation.workspaceId,	194	workspaceId: installation.scopeId,
195	sourceId: connected.source.id,	195	sourceId: connected.source.id,
196	},	196	},
197	});	197	});
@@ -218,7 +218,7 @@ describe("local-executor-server real ingestion", () => { · 20 unmodified lines
218		218
219	const connected = yield* client.sources.connect({	219	const connected = yield* client.sources.connect({
220	path: {	220	path: {
221	workspaceId: installation.workspaceId,	221	workspaceId: installation.scopeId,
222	},	222	},
223	payload: {	223	payload: {
224	kind: "mcp",	224	kind: "mcp",
@@ -235,7 +235,7 @@ describe("local-executor-server real ingestion", () => { · 10 unmodified lines
235		235
236	const inspection = yield* client.sources.inspection({	236	const inspection = yield* client.sources.inspection({
237	path: {	237	path: {
238	workspaceId: installation.workspaceId,	238	workspaceId: installation.scopeId,
239	sourceId: connected.source.id,	239	sourceId: connected.source.id,
240	},	240	},
241	});	241	});
@@ -245,7 +245,7 @@ describe("local-executor-server real ingestion", () => { · 3 unmodified lines
245		245
246	const discoveredTools = yield* client.sources.inspectionDiscover({	246	const discoveredTools = yield* client.sources.inspectionDiscover({
247	path: {	247	path: {
248	workspaceId: installation.workspaceId,	248	workspaceId: installation.scopeId,
249	sourceId: connected.source.id,	249	sourceId: connected.source.id,
250	},	250	},
251	payload: {	251	payload: {

apps/executor/src/server/server.test.ts+111−181

@@ -1,4 +1,4 @@
1	import { createServer, type IncomingMessage, type ServerResponse } from "node:http";	1	import { type IncomingMessage, type ServerResponse } from "node:http";
2	import { randomUUID } from "node:crypto";	2	import { randomUUID } from "node:crypto";
3		3
4	import {	4	import {
@@ -6,17 +6,19 @@ import { · 1 unmodified line
6	HttpApiEndpoint,	6	HttpApiEndpoint,
7	HttpApiGroup,	7	HttpApiGroup,
8	HttpApiSchema,	8	HttpApiSchema,
9	OpenApi,	9	HttpApiBuilder,
10	FileSystem,	10	FileSystem,
11	} from "@effect/platform";	11	} from "@effect/platform";
12	import { NodeFileSystem } from "@effect/platform-node";	12	import { NodeFileSystem } from "@effect/platform-node";
13	import { describe, expect, it } from "@effect/vitest";	13	import { describe, expect, it } from "@effect/vitest";
14	import { assertTrue } from "@effect/vitest/utils";	14	import { assertTrue } from "@effect/vitest/utils";
15	import * as Effect from "effect/Effect";	15	import * as Effect from "effect/Effect";
		16	import * as Layer from "effect/Layer";
16	import * as Schema from "effect/Schema";	17	import * as Schema from "effect/Schema";
17		18
18	import { startMcpElicitationDemoServer } from "@executor/mcp-elicitation-demo";	19	import { startMcpElicitationDemoServer } from "@executor/mcp-elicitation-demo";
19	import { makeToolInvokerFromTools, toTool } from "@executor/codemode-core";	20	import { makeToolInvokerFromTools, toTool } from "@executor/codemode-core";
		21	import { startOpenApiTestServer } from "@executor/effect-test-utils";
20	import {	22	import {
21	createExecutorApiClient,	23	createExecutorApiClient,
22	executorOpenApiSpec,	24	executorOpenApiSpec,
@@ -122,7 +124,7 @@ const writeConfiguredLocalMcpSource = (input: { · 99 unmodified lines
122		124
123	const source = {	125	const source = {
124	id: sourceId,	126	id: sourceId,
125	workspaceId: installation.workspaceId,	127	scopeId: installation.scopeId,
126	name: input.name ?? "Demo",	128	name: input.name ?? "Demo",
127	kind: "mcp" as const,	129	kind: "mcp" as const,
128	endpoint: input.endpoint,	130	endpoint: input.endpoint,
@@ -196,7 +198,7 @@ const createApiClientHarness = () => · 67 unmodified lines
196	const installation = yield* bootstrapClient.local.installation({});	198	const installation = yield* bootstrapClient.local.installation({});
197	const client = yield* createExecutorApiClient({	199	const client = yield* createExecutorApiClient({
198	baseUrl: server.baseUrl,	200	baseUrl: server.baseUrl,
199	accountId: installation.accountId,	201	accountId: installation.actorScopeId,
200	});	202	});
201		203
202	return {	204	return {
@@ -288,161 +290,89 @@ const repoParam = HttpApiSchema.param("repo", Schema.String); · 85 unmodified lines
288	class ExecutorDemoReposApi extends HttpApiGroup.make("repos")	290	class ExecutorDemoReposApi extends HttpApiGroup.make("repos")
289	.add(	291	.add(
290	HttpApiEndpoint.get("getRepo")`/repos/${ownerParam}/${repoParam}`	292	HttpApiEndpoint.get("getRepo")`/repos/${ownerParam}/${repoParam}`
291	.addSuccess(	293	.addSuccess(Schema.Unknown),
292	Schema.Struct({
293	full_name: Schema.String,
294	private: Schema.Boolean,
295	}),
296	),
297	)	294	)
298	{}	295	{}
299		296
300	class ExecutorDemoApi extends HttpApi.make("executorDemo").add(ExecutorDemoReposApi) {}	297	class ExecutorDemoApi extends HttpApi.make("executorDemo").add(ExecutorDemoReposApi) {}
301		298
302	const executorDemoOpenApiSpec = OpenApi.fromApi(ExecutorDemoApi);	299	class ExecutorDnsRecordsApi extends HttpApiGroup.make("records")
		300	.add(
		301	HttpApiEndpoint.post("createRecord")`/records`
		302	.setPayload(
		303	Schema.Struct({
		304	type: Schema.optional(Schema.String),
		305	name: Schema.optional(Schema.String),
		306	value: Schema.String,
		307	}),
		308	)
		309	.addSuccess(Schema.Unknown),
		310	)
		311	{}
		312
		313	class ExecutorDnsApi extends HttpApi.make("executorDns").add(
		314	ExecutorDnsRecordsApi,
		315	) {}
303		316
304	const startOpenApiDemoServer = async () => {	317	const startOpenApiDemoServer = async () => {
305	const seenAuthHeaders: Array<string \| null> = [];	318	const seenAuthHeaders: Array<string \| null> = [];
		319	const executorDemoLive = HttpApiBuilder.group(
		320	ExecutorDemoApi,
		321	"repos",
		322	(handlers) =>
		323	handlers.handle("getRepo", ({ path, request }) => {
		324	const authorization = request.headers.authorization;
		325	if (typeof authorization === "string") {
		326	seenAuthHeaders.push(authorization);
		327	} else {
		328	seenAuthHeaders.push(null);
		329	}
306		330
307	const handler = (req: IncomingMessage, res: ServerResponse) => {	331	return Effect.succeed({
308	if (req.url === "/openapi.json") {	332	full_name: `${path.owner}/${path.repo}`,
309	res.statusCode = 200;
310	res.setHeader("content-type", "application/json");
311	res.end(JSON.stringify(executorDemoOpenApiSpec));
312	return;
313	}
314
315	const match = req.url?.match(/^\/repos\/([^/]+)\/([^/]+)$/);
316	if (req.method === "GET" && match) {
317	seenAuthHeaders.push(
318	typeof req.headers.authorization === "string" ? req.headers.authorization : null,
319	);
320	res.statusCode = 200;
321	res.setHeader("content-type", "application/json");
322	res.end(
323	JSON.stringify({
324	full_name: `${decodeURIComponent(match[1] ?? "")}/${decodeURIComponent(match[2] ?? "")}`,
325	private: false,	333	private: false,
326	}),	334	});
327	);	335	}),
328	return;	336	);
329	}
330
331	res.statusCode = 404;
332	res.end("not found");
333	};
334		337
335	const server = createServer(handler);	338	const server = await startOpenApiTestServer({
336	await new Promise<void>((resolve, reject) => {	339	apiLayer: HttpApiBuilder.api(ExecutorDemoApi).pipe(
337	server.once("error", reject);	340	Layer.provide(executorDemoLive),
338	server.listen(0, "127.0.0.1", () => resolve());	341	),
339	});	342	});
340	const address = server.address();
341	if (!address \|\| typeof address === "string") {
342	throw new Error("Failed to bind OpenAPI demo server");
343	}
344		343
345	return {	344	return {
346	baseUrl: `http://127.0.0.1:${address.port}`,	345	...server,
347	specUrl: `http://127.0.0.1:${address.port}/openapi.json`,
348	seenAuthHeaders,	346	seenAuthHeaders,
349	close: () =>
350	new Promise<void>((resolve, reject) => {
351	server.close((error) => (error ? reject(error) : resolve()));
352	}),
353	};	347	};
354	};	348	};
355		349
356	const startMutatingOpenApiDemoServer = async () => {	350	const startMutatingOpenApiDemoServer = async () => {
357	const createdBodies: Array<Record<string, unknown>> = [];	351	const createdBodies: Array<Record<string, unknown>> = [];
358	const openApiDocument = JSON.stringify({	352	const executorDnsLive = HttpApiBuilder.group(
359	openapi: "3.0.3",	353	ExecutorDnsApi,
360	info: {	354	"records",
361	title: "Executor DNS Demo API",	355	(handlers) =>
362	version: "1.0.0",	356	handlers.handle("createRecord", ({ payload }) => {
363	},	357	createdBodies.push(payload);
364	paths: {	358
365	"/records": {	359	return Effect.succeed({
366	post: {
367	operationId: "records.createRecord",
368	tags: ["records"],
369	summary: "Create a DNS record",
370	requestBody: {
371	required: true,
372	content: {
373	"application/json": {
374	schema: {
375	type: "object",
376	properties: {
377	type: { type: "string" },
378	name: { type: "string" },
379	value: { type: "string" },
380	},
381	required: ["type", "value"],
382	},
383	},
384	},
385	},
386	responses: {
387	200: {
388	description: "ok",
389	},
390	},
391	},
392	},
393	},
394	});
395
396	const handler = (req: IncomingMessage, res: ServerResponse) => {
397	if (req.url === "/openapi.json") {
398	res.statusCode = 200;
399	res.setHeader("content-type", "application/json");
400	res.end(openApiDocument);
401	return;
402	}
403
404	if (req.method === "POST" && req.url === "/records") {
405	const chunks: Array<Buffer> = [];
406	req.on("data", (chunk) => {
407	chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
408	});
409	req.on("end", () => {
410	const raw = Buffer.concat(chunks).toString("utf8");
411	const parsed = JSON.parse(raw) as Record<string, unknown>;
412	createdBodies.push(parsed);
413	res.statusCode = 200;
414	res.setHeader("content-type", "application/json");
415	res.end(JSON.stringify({
416	ok: true,	360	ok: true,
417	id: `rec_${createdBodies.length}`,	361	id: `rec_${createdBodies.length}`,
418	record: parsed,	362	record: payload,
419	}));	363	});
420	});	364	}),
421	return;	365	);
422	}
423
424	res.statusCode = 404;
425	res.end("not found");
426	};
427		366
428	const server = createServer(handler);	367	const server = await startOpenApiTestServer({
429	await new Promise<void>((resolve, reject) => {	368	apiLayer: HttpApiBuilder.api(ExecutorDnsApi).pipe(
430	server.once("error", reject);	369	Layer.provide(executorDnsLive),
431	server.listen(0, "127.0.0.1", () => resolve());	370	),
432	});	371	});
433	const address = server.address();
434	if (!address \|\| typeof address === "string") {
435	throw new Error("Failed to bind mutating OpenAPI demo server");
436	}
437		372
438	return {	373	return {
439	baseUrl: `http://127.0.0.1:${address.port}`,	374	...server,
440	specUrl: `http://127.0.0.1:${address.port}/openapi.json`,
441	createdBodies,	375	createdBodies,
442	close: () =>
443	new Promise<void>((resolve, reject) => {
444	server.close((error) => (error ? reject(error) : resolve()));
445	}),
446	};	376	};
447	};	377	};
448		378
@@ -750,12 +680,12 @@ describe("local-executor-server", () => { · 301 unmodified lines
750	const installation = yield* bootstrapClient.local.installation({});	680	const installation = yield* bootstrapClient.local.installation({});
751	const client = yield* createExecutorApiClient({	681	const client = yield* createExecutorApiClient({
752	baseUrl: server.baseUrl,	682	baseUrl: server.baseUrl,
753	accountId: installation.accountId,	683	accountId: installation.actorScopeId,
754	});	684	});
755		685
756	const execution = yield* client.executions.create({	686	const execution = yield* client.executions.create({
757	path: {	687	path: {
758	workspaceId: installation.workspaceId,	688	workspaceId: installation.scopeId,
759	},	689	},
760	payload: {	690	payload: {
761	code: "return await tools.math.add({ a: 20, b: 22 });",	691	code: "return await tools.math.add({ a: 20, b: 22 });",
@@ -951,12 +881,12 @@ describe("local-executor-server", () => { · 189 unmodified lines
951	const installation = yield* bootstrapClient.local.installation({});	881	const installation = yield* bootstrapClient.local.installation({});
952	const client = yield* createExecutorApiClient({	882	const client = yield* createExecutorApiClient({
953	baseUrl: server.baseUrl,	883	baseUrl: server.baseUrl,
954	accountId: installation.accountId,	884	accountId: installation.actorScopeId,
955	});	885	});
956		886
957	yield* client.sources.create({	887	yield* client.sources.create({
958	path: {	888	path: {
959	workspaceId: installation.workspaceId,	889	workspaceId: installation.scopeId,
960	},	890	},
961	payload: {	891	payload: {
962	name: "Demo",	892	name: "Demo",
@@ -978,7 +908,7 @@ describe("local-executor-server", () => { · 15 unmodified lines
978		908
979	const created = yield* client.executions.create({	909	const created = yield* client.executions.create({
980	path: {	910	path: {
981	workspaceId: installation.workspaceId,	911	workspaceId: installation.scopeId,
982	},	912	},
983	payload: {	913	payload: {
984	code: 'return await tools.demo.gated_echo({ value: "from-daemon" });',	914	code: 'return await tools.demo.gated_echo({ value: "from-daemon" });',
@@ -995,7 +925,7 @@ describe("local-executor-server", () => { · 10 unmodified lines
995		925
996	const approved = yield* client.executions.resume({	926	const approved = yield* client.executions.resume({
997	path: {	927	path: {
998	workspaceId: installation.workspaceId,	928	workspaceId: installation.scopeId,
999	executionId: created.execution.id,	929	executionId: created.execution.id,
1000	},	930	},
1001	payload: {	931	payload: {
@@ -1018,7 +948,7 @@ describe("local-executor-server", () => { · 16 unmodified lines
1018		948
1019	const resumed = yield* client.executions.resume({	949	const resumed = yield* client.executions.resume({
1020	path: {	950	path: {
1021	workspaceId: installation.workspaceId,	951	workspaceId: installation.scopeId,
1022	executionId: created.execution.id,	952	executionId: created.execution.id,
1023	},	953	},
1024	payload: {	954	payload: {
@@ -1057,12 +987,12 @@ describe("local-executor-server", () => { · 32 unmodified lines
1057	const installation = yield* bootstrapClient.local.installation({});	987	const installation = yield* bootstrapClient.local.installation({});
1058	const client = yield* createExecutorApiClient({	988	const client = yield* createExecutorApiClient({
1059	baseUrl: server.baseUrl,	989	baseUrl: server.baseUrl,
1060	accountId: installation.accountId,	990	accountId: installation.actorScopeId,
1061	});	991	});
1062		992
1063	yield* client.sources.create({	993	yield* client.sources.create({
1064	path: {	994	path: {
1065	workspaceId: installation.workspaceId,	995	workspaceId: installation.scopeId,
1066	},	996	},
1067	payload: {	997	payload: {
1068	name: "Demo",	998	name: "Demo",
@@ -1085,7 +1015,7 @@ describe("local-executor-server", () => { · 16 unmodified lines
1085	for (const value of ["first", "second"]) {	1015	for (const value of ["first", "second"]) {
1086	const created = yield* client.executions.create({	1016	const created = yield* client.executions.create({
1087	path: {	1017	path: {
1088	workspaceId: installation.workspaceId,	1018	workspaceId: installation.scopeId,
1089	},	1019	},
1090	payload: {	1020	payload: {
1091	code: `return await tools.demo.gated_echo({ value: "${value}" });`,	1021	code: `return await tools.demo.gated_echo({ value: "${value}" });`,
@@ -1098,7 +1028,7 @@ describe("local-executor-server", () => { · 6 unmodified lines
1098		1028
1099	const approved = yield* client.executions.resume({	1029	const approved = yield* client.executions.resume({
1100	path: {	1030	path: {
1101	workspaceId: installation.workspaceId,	1031	workspaceId: installation.scopeId,
1102	executionId: created.execution.id,	1032	executionId: created.execution.id,
1103	},	1033	},
1104	payload: {	1034	payload: {
@@ -1121,7 +1051,7 @@ describe("local-executor-server", () => { · 16 unmodified lines
1121		1051
1122	const resumed = yield* client.executions.resume({	1052	const resumed = yield* client.executions.resume({
1123	path: {	1053	path: {
1124	workspaceId: installation.workspaceId,	1054	workspaceId: installation.scopeId,
1125	executionId: created.execution.id,	1055	executionId: created.execution.id,
1126	},	1056	},
1127	payload: {	1057	payload: {
@@ -1160,12 +1090,12 @@ describe("local-executor-server", () => { · 32 unmodified lines
1160	const installation = yield* bootstrapClient.local.installation({});	1090	const installation = yield* bootstrapClient.local.installation({});
1161	const client = yield* createExecutorApiClient({	1091	const client = yield* createExecutorApiClient({
1162	baseUrl: server.baseUrl,	1092	baseUrl: server.baseUrl,
1163	accountId: installation.accountId,	1093	accountId: installation.actorScopeId,
1164	});	1094	});
1165		1095
1166	const existing = yield* client.sources.create({	1096	const existing = yield* client.sources.create({
1167	path: {	1097	path: {
1168	workspaceId: installation.workspaceId,	1098	workspaceId: installation.scopeId,
1169	},	1099	},
1170	payload: {	1100	payload: {
1171	name: "Demo",	1101	name: "Demo",
@@ -1187,7 +1117,7 @@ describe("local-executor-server", () => { · 15 unmodified lines
1187		1117
1188	const seeded = yield* seedDemoMcpSourceInWorkspace({	1118	const seeded = yield* seedDemoMcpSourceInWorkspace({
1189	client,	1119	client,
1190	workspaceId: installation.workspaceId,	1120	workspaceId: installation.scopeId,
1191	endpoint: demoServer.endpoint,	1121	endpoint: demoServer.endpoint,
1192	name: "Demo",	1122	name: "Demo",
1193	namespace: "demo",	1123	namespace: "demo",
@@ -1198,7 +1128,7 @@ describe("local-executor-server", () => { · 4 unmodified lines
1198		1128
1199	const sources = yield* client.sources.list({	1129	const sources = yield* client.sources.list({
1200	path: {	1130	path: {
1201	workspaceId: installation.workspaceId,	1131	workspaceId: installation.scopeId,
1202	},	1132	},
1203	});	1133	});
1204		1134
@@ -1249,12 +1179,12 @@ describe("local-executor-server", () => { · 44 unmodified lines
1249	const installation = yield* bootstrapClient.local.installation({});	1179	const installation = yield* bootstrapClient.local.installation({});
1250	const client = yield* createExecutorApiClient({	1180	const client = yield* createExecutorApiClient({
1251	baseUrl: server.baseUrl,	1181	baseUrl: server.baseUrl,
1252	accountId: installation.accountId,	1182	accountId: installation.actorScopeId,
1253	});	1183	});
1254		1184
1255	yield* seedGithubOpenApiSourceInWorkspace({	1185	yield* seedGithubOpenApiSourceInWorkspace({
1256	client,	1186	client,
1257	workspaceId: installation.workspaceId,	1187	workspaceId: installation.scopeId,
1258	endpoint: openApiServer.baseUrl,	1188	endpoint: openApiServer.baseUrl,
1259	specUrl: openApiServer.specUrl,	1189	specUrl: openApiServer.specUrl,
1260	name: "GitHub",	1190	name: "GitHub",
@@ -1263,7 +1193,7 @@ describe("local-executor-server", () => { · 2 unmodified lines
1263		1193
1264	const execution = yield* client.executions.create({	1194	const execution = yield* client.executions.create({
1265	path: {	1195	path: {
1266	workspaceId: installation.workspaceId,	1196	workspaceId: installation.scopeId,
1267	},	1197	},
1268	payload: {	1198	payload: {
1269	code: 'return await tools.github.repos.getRepo({ owner: "vercel", repo: "ai" });',	1199	code: 'return await tools.github.repos.getRepo({ owner: "vercel", repo: "ai" });',
@@ -1287,7 +1217,7 @@ describe("local-executor-server", () => { · 17 unmodified lines
1287		1217
1288	const connected = yield* client.sources.connect({	1218	const connected = yield* client.sources.connect({
1289	path: {	1219	path: {
1290	workspaceId: installation.workspaceId,	1220	workspaceId: installation.scopeId,
1291	},	1221	},
1292	payload: {	1222	payload: {
1293	kind: "openapi",	1223	kind: "openapi",
@@ -1309,7 +1239,7 @@ describe("local-executor-server", () => { · 15 unmodified lines
1309		1239
1310	const sources = yield* client.sources.list({	1240	const sources = yield* client.sources.list({
1311	path: {	1241	path: {
1312	workspaceId: installation.workspaceId,	1242	workspaceId: installation.scopeId,
1313	},	1243	},
1314	});	1244	});
1315		1245
@@ -1318,7 +1248,7 @@ describe("local-executor-server", () => { · 2 unmodified lines
1318		1248
1319	const execution = yield* client.executions.create({	1249	const execution = yield* client.executions.create({
1320	path: {	1250	path: {
1321	workspaceId: installation.workspaceId,	1251	workspaceId: installation.scopeId,
1322	},	1252	},
1323	payload: {	1253	payload: {
1324	code: 'return await tools.github.repos.getRepo({ owner: "vercel", repo: "ai" });',	1254	code: 'return await tools.github.repos.getRepo({ owner: "vercel", repo: "ai" });',
@@ -1343,7 +1273,7 @@ describe("local-executor-server", () => { · 18 unmodified lines
1343		1273
1344	const connected = yield* client.sources.connect({	1274	const connected = yield* client.sources.connect({
1345	path: {	1275	path: {
1346	workspaceId: installation.workspaceId,	1276	workspaceId: installation.scopeId,
1347	},	1277	},
1348	payload: {	1278	payload: {
1349	kind: "mcp",	1279	kind: "mcp",
@@ -1361,7 +1291,7 @@ describe("local-executor-server", () => { · 11 unmodified lines
1361		1291
1362	const execution = yield* client.executions.create({	1292	const execution = yield* client.executions.create({
1363	path: {	1293	path: {
1364	workspaceId: installation.workspaceId,	1294	workspaceId: installation.scopeId,
1365	},	1295	},
1366	payload: {	1296	payload: {
1367	code: 'return await tools.demo.gated_echo({ value: "from-api-client" });',	1297	code: 'return await tools.demo.gated_echo({ value: "from-api-client" });',
@@ -1379,7 +1309,7 @@ describe("local-executor-server", () => { · 11 unmodified lines
1379		1309
1380	const approved = yield* client.executions.resume({	1310	const approved = yield* client.executions.resume({
1381	path: {	1311	path: {
1382	workspaceId: installation.workspaceId,	1312	workspaceId: installation.scopeId,
1383	executionId: execution.execution.id,	1313	executionId: execution.execution.id,
1384	},	1314	},
1385	payload: {	1315	payload: {
@@ -1405,7 +1335,7 @@ describe("local-executor-server", () => { · 19 unmodified lines
1405		1335
1406	const resumed = yield* client.executions.resume({	1336	const resumed = yield* client.executions.resume({
1407	path: {	1337	path: {
1408	workspaceId: installation.workspaceId,	1338	workspaceId: installation.scopeId,
1409	executionId: execution.execution.id,	1339	executionId: execution.execution.id,
1410	},	1340	},
1411	payload: {	1341	payload: {
@@ -1436,7 +1366,7 @@ describe("local-executor-server", () => { · 24 unmodified lines
1436		1366
1437	const connected = yield* client.sources.connect({	1367	const connected = yield* client.sources.connect({
1438	path: {	1368	path: {
1439	workspaceId: installation.workspaceId,	1369	workspaceId: installation.scopeId,
1440	},	1370	},
1441	payload: {	1371	payload: {
1442	kind: "mcp",	1372	kind: "mcp",
@@ -1463,7 +1393,7 @@ describe("local-executor-server", () => { · 20 unmodified lines
1463		1393
1464	const refreshedSource = yield* client.sources.get({	1394	const refreshedSource = yield* client.sources.get({
1465	path: {	1395	path: {
1466	workspaceId: installation.workspaceId,	1396	workspaceId: installation.scopeId,
1467	sourceId: connected.source.id,	1397	sourceId: connected.source.id,
1468	},	1398	},
1469	});	1399	});
@@ -1474,7 +1404,7 @@ describe("local-executor-server", () => { · 4 unmodified lines
1474		1404
1475	const toolCall = yield* client.executions.create({	1405	const toolCall = yield* client.executions.create({
1476	path: {	1406	path: {
1477	workspaceId: installation.workspaceId,	1407	workspaceId: installation.scopeId,
1478	},	1408	},
1479	payload: {	1409	payload: {
1480	code: "return await tools.axiom.whoami({});",	1410	code: "return await tools.axiom.whoami({});",
@@ -1491,7 +1421,7 @@ describe("local-executor-server", () => { · 10 unmodified lines
1491		1421
1492	const approvedToolCall = yield* client.executions.resume({	1422	const approvedToolCall = yield* client.executions.resume({
1493	path: {	1423	path: {
1494	workspaceId: installation.workspaceId,	1424	workspaceId: installation.scopeId,
1495	executionId: toolCall.execution.id,	1425	executionId: toolCall.execution.id,
1496	},	1426	},
1497	payload: {	1427	payload: {
@@ -1529,12 +1459,12 @@ describe("local-executor-server", () => { · 31 unmodified lines
1529	const installation = yield* bootstrapClient.local.installation({});	1459	const installation = yield* bootstrapClient.local.installation({});
1530	const client = yield* createExecutorApiClient({	1460	const client = yield* createExecutorApiClient({
1531	baseUrl: server.baseUrl,	1461	baseUrl: server.baseUrl,
1532	accountId: installation.accountId,	1462	accountId: installation.actorScopeId,
1533	});	1463	});
1534		1464
1535	const added = yield* client.executions.create({	1465	const added = yield* client.executions.create({
1536	path: {	1466	path: {
1537	workspaceId: installation.workspaceId,	1467	workspaceId: installation.scopeId,
1538	},	1468	},
1539	payload: {	1469	payload: {
1540	code: `return await tools.executor.sources.add({ endpoint: ${JSON.stringify(oauthServer.endpoint)}, name: "Axiom", namespace: "axiom" });`,	1470	code: `return await tools.executor.sources.add({ endpoint: ${JSON.stringify(oauthServer.endpoint)}, name: "Axiom", namespace: "axiom" });`,
@@ -1563,7 +1493,7 @@ describe("local-executor-server", () => { · 22 unmodified lines
1563	while (true) {	1493	while (true) {
1564	const sources = yield* client.sources.list({	1494	const sources = yield* client.sources.list({
1565	path: {	1495	path: {
1566	workspaceId: installation.workspaceId,	1496	workspaceId: installation.scopeId,
1567	},	1497	},
1568	});	1498	});
1569	const source = sources.find((entry) => entry.namespace === "axiom");	1499	const source = sources.find((entry) => entry.namespace === "axiom");
@@ -1581,7 +1511,7 @@ describe("local-executor-server", () => { · 11 unmodified lines
1581		1511
1582	const toolCall = yield* client.executions.create({	1512	const toolCall = yield* client.executions.create({
1583	path: {	1513	path: {
1584	workspaceId: installation.workspaceId,	1514	workspaceId: installation.scopeId,
1585	},	1515	},
1586	payload: {	1516	payload: {
1587	code: "return await tools.axiom.whoami({});",	1517	code: "return await tools.axiom.whoami({});",
@@ -1597,7 +1527,7 @@ describe("local-executor-server", () => { · 9 unmodified lines
1597		1527
1598	const approvedToolCall = yield* client.executions.resume({	1528	const approvedToolCall = yield* client.executions.resume({
1599	path: {	1529	path: {
1600	workspaceId: installation.workspaceId,	1530	workspaceId: installation.scopeId,
1601	executionId: toolCall.execution.id,	1531	executionId: toolCall.execution.id,
1602	},	1532	},
1603	payload: {	1533	payload: {
@@ -1633,12 +1563,12 @@ describe("local-executor-server", () => { · 29 unmodified lines
1633	const installation = yield* bootstrapClient.local.installation({});	1563	const installation = yield* bootstrapClient.local.installation({});
1634	const client = yield* createExecutorApiClient({	1564	const client = yield* createExecutorApiClient({
1635	baseUrl: server.baseUrl,	1565	baseUrl: server.baseUrl,
1636	accountId: installation.accountId,	1566	accountId: installation.actorScopeId,
1637	});	1567	});
1638		1568
1639	const connected = yield* client.sources.connect({	1569	const connected = yield* client.sources.connect({
1640	path: {	1570	path: {
1641	workspaceId: installation.workspaceId,	1571	workspaceId: installation.scopeId,
1642	},	1572	},
1643	payload: {	1573	payload: {
1644	kind: "openapi",	1574	kind: "openapi",
@@ -1655,7 +1585,7 @@ describe("local-executor-server", () => { · 10 unmodified lines
1655		1585
1656	const gated = yield* client.executions.create({	1586	const gated = yield* client.executions.create({
1657	path: {	1587	path: {
1658	workspaceId: installation.workspaceId,	1588	workspaceId: installation.scopeId,
1659	},	1589	},
1660	payload: {	1590	payload: {
1661	code: 'return await tools.dns.records.createRecord({ body: { type: "TXT", name: "", value: "hello world" } });',	1591	code: 'return await tools.dns.records.createRecord({ body: { type: "TXT", name: "", value: "hello world" } });',
@@ -1668,12 +1598,12 @@ describe("local-executor-server", () => { · 6 unmodified lines
1668	throw new Error("Expected pending approval interaction");	1598	throw new Error("Expected pending approval interaction");
1669	}	1599	}
1670	expect(gated.pendingInteraction.kind).toBe("form");	1600	expect(gated.pendingInteraction.kind).toBe("form");
1671	expect(gated.pendingInteraction.payloadJson).toContain("Allow Create a DNS record?");	1601	expect(gated.pendingInteraction.payloadJson).toContain("Allow records.createRecord?");
1672	expect(gated.pendingInteraction.payloadJson).toContain("\"approve\"");	1602	expect(gated.pendingInteraction.payloadJson).toContain("\"approve\"");
1673		1603
1674	const approved = yield* client.executions.resume({	1604	const approved = yield* client.executions.resume({
1675	path: {	1605	path: {
1676	workspaceId: installation.workspaceId,	1606	workspaceId: installation.scopeId,
1677	executionId: gated.execution.id,	1607	executionId: gated.execution.id,
1678	},	1608	},
1679	payload: {	1609	payload: {
@@ -1691,7 +1621,7 @@ describe("local-executor-server", () => { · 11 unmodified lines
1691		1621
1692	const policy = yield* client.policies.create({	1622	const policy = yield* client.policies.create({
1693	path: {	1623	path: {
1694	workspaceId: installation.workspaceId,	1624	workspaceId: installation.scopeId,
1695	},	1625	},
1696	payload: {	1626	payload: {
1697	resourcePattern: "dns.records.createRecord",	1627	resourcePattern: "dns.records.createRecord",
@@ -1703,7 +1633,7 @@ describe("local-executor-server", () => { · 5 unmodified lines
1703		1633
1704	const automatic = yield* client.executions.create({	1634	const automatic = yield* client.executions.create({
1705	path: {	1635	path: {
1706	workspaceId: installation.workspaceId,	1636	workspaceId: installation.scopeId,
1707	},	1637	},
1708	payload: {	1638	payload: {
1709	code: 'return await tools.dns.records.createRecord({ body: { type: "TXT", name: "", value: "hello again" } });',	1639	code: 'return await tools.dns.records.createRecord({ body: { type: "TXT", name: "", value: "hello again" } });',
@@ -1735,11 +1665,11 @@ describe("local-executor-server", () => { · 25 unmodified lines
1735	const installation = yield* bootstrapClient.local.installation({});	1665	const installation = yield* bootstrapClient.local.installation({});
1736		1666
1737	const startResponse = yield* Effect.promise(() =>	1667	const startResponse = yield* Effect.promise(() =>
1738	fetch(`${server.baseUrl}/v1/workspaces/${encodeURIComponent(installation.workspaceId)}/oauth/source-auth/start`, {	1668	fetch(`${server.baseUrl}/v1/workspaces/${encodeURIComponent(installation.scopeId)}/oauth/source-auth/start`, {
1739	method: "POST",	1669	method: "POST",
1740	headers: {	1670	headers: {
1741	"content-type": "application/json",	1671	"content-type": "application/json",
1742	"x-executor-account-id": installation.accountId,	1672	"x-executor-account-id": installation.actorScopeId,
1743	},	1673	},
1744	body: JSON.stringify({	1674	body: JSON.stringify({
1745	provider: "mcp",	1675	provider: "mcp",
@@ -1774,11 +1704,11 @@ describe("local-executor-server", () => { · 28 unmodified lines
1774		1704
1775	const client = yield* createExecutorApiClient({	1705	const client = yield* createExecutorApiClient({
1776	baseUrl: server.baseUrl,	1706	baseUrl: server.baseUrl,
1777	accountId: installation.accountId,	1707	accountId: installation.actorScopeId,
1778	});	1708	});
1779	const sources = yield* client.sources.list({	1709	const sources = yield* client.sources.list({
1780	path: {	1710	path: {
1781	workspaceId: installation.workspaceId,	1711	workspaceId: installation.scopeId,
1782	},	1712	},
1783	});	1713	});
1784		1714
@@ -1804,7 +1734,7 @@ describe("local-executor-server", () => { · 19 unmodified lines
1804	const installation = yield* bootstrapClient.local.installation({});	1734	const installation = yield* bootstrapClient.local.installation({});
1805	const client = yield* createExecutorApiClient({	1735	const client = yield* createExecutorApiClient({
1806	baseUrl: server.baseUrl,	1736	baseUrl: server.baseUrl,
1807	accountId: installation.accountId,	1737	accountId: installation.actorScopeId,
1808	});	1738	});
1809	yield* writeConfiguredLocalMcpSource({	1739	yield* writeConfiguredLocalMcpSource({
1810	workspaceRoot: server.workspaceRoot,	1740	workspaceRoot: server.workspaceRoot,
@@ -1816,7 +1746,7 @@ describe("local-executor-server", () => { · 5 unmodified lines
1816		1746
1817	const execution = yield* client.executions.create({	1747	const execution = yield* client.executions.create({
1818	path: {	1748	path: {
1819	workspaceId: installation.workspaceId,	1749	workspaceId: installation.scopeId,
1820	},	1750	},
1821	payload: {	1751	payload: {
1822	code: 'return await tools.demo.gated_echo({ value: "broken" });',	1752	code: 'return await tools.demo.gated_echo({ value: "broken" });',
@@ -1832,7 +1762,7 @@ describe("local-executor-server", () => { · 9 unmodified lines
1832		1762
1833	const resumed = yield* client.executions.resume({	1763	const resumed = yield* client.executions.resume({
1834	path: {	1764	path: {
1835	workspaceId: installation.workspaceId,	1765	workspaceId: installation.scopeId,
1836	executionId: execution.execution.id,	1766	executionId: execution.execution.id,
1837	},	1767	},
1838	payload: {	1768	payload: {

apps/web/src/views/add-source.tsx+2−2

@@ -484,7 +484,7 @@ const buildConnectPayload = (form: ConnectFormState): ConnectSourcePayload => { · 483 unmodified lines
484	discoveryUrl: trimToNull(form.discoveryUrl),	484	discoveryUrl: trimToNull(form.discoveryUrl),
485	name: trimToNull(form.name),	485	name: trimToNull(form.name),
486	namespace: trimToNull(form.namespace),	486	namespace: trimToNull(form.namespace),
487	workspaceOauthClientId:	487	scopeOauthClientId:
488	form.authKind === "oauth2" &&	488	form.authKind === "oauth2" &&
489	form.workspaceOauthClientId.trim().length > 0	489	form.workspaceOauthClientId.trim().length > 0
490	? form.workspaceOauthClientId.trim()	490	? form.workspaceOauthClientId.trim()
@@ -1114,7 +1114,7 @@ export function AddSourcePage() { · 623 unmodified lines
1114	selectedGoogleTemplateIds.includes(template.id),	1114	selectedGoogleTemplateIds.includes(template.id),
1115	);	1115	);
1116	const payload: ConnectSourceBatchPayload = {	1116	const payload: ConnectSourceBatchPayload = {
1117	workspaceOauthClientId:	1117	scopeOauthClientId:
1118	workspaceOauthClientId as WorkspaceOauthClient["id"],	1118	workspaceOauthClientId as WorkspaceOauthClient["id"],
1119	sources: selectedTemplates.map((template) => ({	1119	sources: selectedTemplates.map((template) => ({
1120	service: template.service,	1120	service: template.service,

bun.lock+19−0

       },
       "devDependencies": {
         "@effect/vitest": "catalog:",
+        "@executor/effect-test-utils": "workspace:*",
         "@executor/mcp-elicitation-demo": "workspace:*",
         "@executor/runtime-ses": "workspace:*",
         "@modelcontextprotocol/sdk": "^1.26.0",
         "@effect/platform": "catalog:",
         "@effect/platform-node": "catalog:",
         "@effect/vitest": "catalog:",
+        "@executor/effect-test-utils": "workspace:*",
         "@executor/platform-sdk-file": "workspace:*",
         "@types/jsdom": "^21.1.7",
         "@types/node": "catalog:",
         "react": ">=18 <20",
       },
     },
+    "packages/dev/effect-test-utils": {
+      "name": "@executor/effect-test-utils",
+      "version": "0.0.0",
+      "dependencies": {
+        "@effect/platform": "catalog:",
+        "@effect/platform-node": "catalog:",
+        "effect": "catalog:",
+      },
+      "devDependencies": {
+        "@types/node": "catalog:",
+        "bun-types": "catalog:",
+        "typescript": "^5.9.3",
+      },
+    },
     "packages/dev/kitchen-sink": {
       "name": "@executor/kitchen-sink",
       "version": "0.0.0",
       },
       "devDependencies": {
         "@effect/vitest": "catalog:",
+        "@executor/effect-test-utils": "workspace:*",
         "@modelcontextprotocol/sdk": "^1.26.0",
         "@types/node": "catalog:",
         "bun-types": "catalog:",
     "@executor/docs": ["@executor/docs@workspace:apps/docs"],
+    "@executor/effect-test-utils": ["@executor/effect-test-utils@workspace:packages/dev/effect-test-utils"],
     "@executor/executor-mcp": ["@executor/executor-mcp@workspace:packages/hosts/mcp"],
     "@executor/ir": ["@executor/ir@workspace:packages/kernel/ir"],

examples/sqlite-sdk-consumer/src/main.ts+2−2

@@ -5,8 +5,8 @@ const databasePath = process.env.DATABASE_PATH · 4 unmodified lines
5		5
6	const executor = await createSqliteExecutor({	6	const executor = await createSqliteExecutor({
7	databasePath,	7	databasePath,
8	workspaceName: "SQLite Example Workspace",	8	scopeName: "SQLite Example Workspace",
9	workspaceRoot: process.cwd(),	9	scopeRoot: process.cwd(),
10	});	10	});
11		11
12	try {	12	try {

examples/sqlite-sdk-consumer/src/sqlite-backend.ts+84−81

   type ExecutorSecretMaterialBackend,
   type ExecutorSourceArtifactBackend,
   type ExecutorSourceTypeDeclarationsBackend,
-  type ExecutorWorkspaceConfigBackend,
+  type ExecutorScopeConfigBackend,
-  type ExecutorWorkspaceStateBackend,
+  type ExecutorScopeStateBackend,
 } from "@executor/platform-sdk";
 import type { ExecutorRuntimeOptions } from "@executor/platform-sdk/runtime";
 import {
   type AuthArtifact,
-  AccountIdSchema,
+  ScopeIdSchema,
   AuthArtifactSchema,
   type AuthLease,
   AuthLeaseSchema,
   SourceAuthSessionSchema,
   SourceCatalogIdSchema,
   SourceCatalogRevisionIdSchema,
-  WorkspaceIdSchema,
+  type ScopeOauthClient,
-  type WorkspaceOauthClient,
+  ScopeOauthClientSchema,
-  WorkspaceOauthClientSchema,
+  type ScopedSourceOauthClient,
-  type WorkspaceSourceOauthClient,
+  ScopedSourceOauthClientSchema,
-  WorkspaceSourceOauthClientSchema,
   type SecretMaterial,
   type SecretRef,
 } from "@executor/platform-sdk/schema";
 export type CreateSqliteExecutorBackendOptions = {
   databasePath?: string;
-  workspaceName?: string;
+  scopeName?: string;
-  workspaceRoot?: string | null;
+  scopeRoot?: string | null;
-  workspaceId?: string;
+  scopeId?: string;
-  accountId?: string;
+  actorScopeId?: string;
 };
 type DocumentNamespace =
   | "installation"
-  | "workspace_config"
+  | "scope_config"
-  | "workspace_state"
+  | "scope_state"
   | "source_artifact"
   | "executor_state";
 type ExecutorStateCollections = {
   authArtifacts: readonly AuthArtifact[];
   authLeases: readonly AuthLease[];
-  sourceOauthClients: readonly WorkspaceSourceOauthClient[];
+  sourceOauthClients: readonly ScopedSourceOauthClient[];
-  workspaceOauthClients: readonly WorkspaceOauthClient[];
+  scopeOauthClients: readonly ScopeOauthClient[];
   providerAuthGrants: readonly ProviderAuthGrant[];
   sourceAuthSessions: readonly SourceAuthSession[];
   secretMaterials: readonly SecretMaterial[];
 const decodeAuthArtifacts = Schema.decodeUnknownSync(Schema.Array(AuthArtifactSchema));
 const decodeAuthLeases = Schema.decodeUnknownSync(Schema.Array(AuthLeaseSchema));
 const decodeSourceOauthClients = Schema.decodeUnknownSync(
-  Schema.Array(WorkspaceSourceOauthClientSchema),
+  Schema.Array(ScopedSourceOauthClientSchema),
 );
-const decodeWorkspaceOauthClients = Schema.decodeUnknownSync(
+const decodeScopeOauthClients = Schema.decodeUnknownSync(
-  Schema.Array(WorkspaceOauthClientSchema),
+  Schema.Array(ScopeOauthClientSchema),
 );
 const decodeProviderAuthGrants = Schema.decodeUnknownSync(
   Schema.Array(ProviderAuthGrantSchema),
 const SQLITE_SECRET_PROVIDER_ID = "sqlite";
-type WorkspaceState = Parameters<ExecutorWorkspaceStateBackend["write"]>[0];
+type ScopeState = Parameters<ExecutorScopeStateBackend["write"]>[0];
 const defaultProjectConfig = decodeConfig({});
-const defaultWorkspaceState = (): WorkspaceState => ({
+const defaultScopeState = (): ScopeState => ({
   version: 1 as const,
   sources: {},
   policies: {},
 ): ExecutorInstallationBackend => {
   const provision = (): LocalInstallation =>
     decodeInstallation({
-      accountId: AccountIdSchema.make(options.accountId ?? "acct_sqlite_example"),
+      actorScopeId: ScopeIdSchema.make(options.actorScopeId ?? "acct_sqlite_example"),
-      workspaceId: WorkspaceIdSchema.make(options.workspaceId ?? "ws_sqlite_example"),
+      scopeId: ScopeIdSchema.make(options.scopeId ?? "ws_sqlite_example"),
+      resolutionScopeIds: [
+        ScopeIdSchema.make(options.scopeId ?? "ws_sqlite_example"),
+        ScopeIdSchema.make(options.actorScopeId ?? "acct_sqlite_example"),
+      ],
     });
   return {
   };
 };
-const createWorkspaceConfigStore = (
+const createScopeConfigStore = (
   store: SqliteDocumentStore,
-): ExecutorWorkspaceConfigBackend => ({
+): ExecutorScopeConfigBackend => ({
   load: () =>
     effectTry("load workspace config", () => {
       const projectConfig = store.read(
-        "workspace_config",
+        "scope_config",
         "project",
         decodeConfig,
         () => defaultProjectConfig,
     }),
   writeProject: (config) =>
     effectTry("write workspace config", () => {
-      store.write("workspace_config", "project", config);
+      store.write("scope_config", "project", config);
     }),
-  resolveRelativePath: ({ path, workspaceRoot }) =>
+  resolveRelativePath: ({ path, scopeRoot }) =>
-    resolvePath(workspaceRoot, path),
+    resolvePath(scopeRoot, path),
 });
-const createWorkspaceStateStore = (
+const createScopeStateStore = (
   store: SqliteDocumentStore,
-): ExecutorWorkspaceStateBackend => ({
+): ExecutorScopeStateBackend => ({
   load: () =>
     effectTry("load workspace state", () =>
-      store.read("workspace_state", "active", (value) => value as ReturnType<typeof defaultWorkspaceState>, defaultWorkspaceState),
+      store.read("scope_state", "active", (value) => value as ReturnType<typeof defaultScopeState>, defaultScopeState),
     ),
   write: (state) =>
     effectTry("write workspace state", () => {
-      store.write("workspace_state", "active", state);
+      store.write("scope_state", "active", state);
     }),
 });
         return store.read("executor_state", key, decodeAuthLeases, () => []) as ExecutorStateCollections[K];
       case "sourceOauthClients":
         return store.read("executor_state", key, decodeSourceOauthClients, () => []) as ExecutorStateCollections[K];
-      case "workspaceOauthClients":
+      case "scopeOauthClients":
-        return store.read("executor_state", key, decodeWorkspaceOauthClients, () => []) as ExecutorStateCollections[K];
+        return store.read("executor_state", key, decodeScopeOauthClients, () => []) as ExecutorStateCollections[K];
       case "providerAuthGrants":
         return store.read("executor_state", key, decodeProviderAuthGrants, () => []) as ExecutorStateCollections[K];
       case "sourceAuthSessions":
   return {
     authArtifacts: {
-      listByWorkspaceId: (workspaceId) =>
+      listByScopeId: (scopeId) =>
         effectTry("list auth artifacts by workspace", () =>
-          readCollection("authArtifacts").filter((item) => item.workspaceId === workspaceId),
+          readCollection("authArtifacts").filter((item) => item.scopeId === scopeId),
         ),
-      listByWorkspaceAndSourceId: ({ workspaceId, sourceId }) =>
+      listByScopeAndSourceId: ({ scopeId, sourceId }) =>
         effectTry("list auth artifacts by source", () =>
           readCollection("authArtifacts").filter((item) =>
-            item.workspaceId === workspaceId && item.sourceId === sourceId
+            item.scopeId === scopeId && item.sourceId === sourceId
           ),
         ),
-      getByWorkspaceSourceAndActor: ({ workspaceId, sourceId, actorAccountId, slot }) =>
+      getByScopeSourceAndActor: ({ scopeId, sourceId, actorScopeId, slot }) =>
         effectTry("get auth artifact", () =>
           Option.fromNullable(
             readCollection("authArtifacts").find((item) =>
-              item.workspaceId === workspaceId
+              item.scopeId === scopeId
               && item.sourceId === sourceId
-              && sameActor(item.actorAccountId, actorAccountId)
+              && sameActor(item.actorScopeId, actorScopeId)
               && item.slot === slot
             ),
           ),
         effectTry("upsert auth artifact", () => {
           updateCollection("authArtifacts", (items) => {
             const index = items.findIndex((item) =>
-              item.workspaceId === artifact.workspaceId
+              item.scopeId === artifact.scopeId
               && item.sourceId === artifact.sourceId
-              && sameActor(item.actorAccountId, artifact.actorAccountId)
+              && sameActor(item.actorScopeId, artifact.actorScopeId)
               && item.slot === artifact.slot
             );
             if (index >= 0) {
             }
           });
         }),
-      removeByWorkspaceSourceAndActor: ({ workspaceId, sourceId, actorAccountId, slot }) =>
+      removeByScopeSourceAndActor: ({ scopeId, sourceId, actorScopeId, slot }) =>
         effectTry("remove auth artifact", () =>
           updateCollection("authArtifacts", (items) => {
             const before = items.length;
             const remaining = items.filter((item) => !(
-              item.workspaceId === workspaceId
+              item.scopeId === scopeId
               && item.sourceId === sourceId
-              && sameActor(item.actorAccountId, actorAccountId)
+              && sameActor(item.actorScopeId, actorScopeId)
               && (slot === undefined || item.slot === slot)
             ));
             items.splice(0, items.length, ...remaining);
             return before !== remaining.length;
           }),
         ),
-      removeByWorkspaceAndSourceId: ({ workspaceId, sourceId }) =>
+      removeByScopeAndSourceId: ({ scopeId, sourceId }) =>
         effectTry("remove auth artifacts by source", () =>
           updateCollection("authArtifacts", (items) => {
             const remaining = items.filter((item) =>
-              !(item.workspaceId === workspaceId && item.sourceId === sourceId)
+              !(item.scopeId === scopeId && item.sourceId === sourceId)
             );
             const removed = items.length - remaining.length;
             items.splice(0, items.length, ...remaining);
         ),
     },
     sourceOauthClients: {
-      getByWorkspaceSourceAndProvider: ({ workspaceId, sourceId, providerKey }) =>
+      getByScopeSourceAndProvider: ({ scopeId, sourceId, providerKey }) =>
         effectTry("get source oauth client", () =>
           Option.fromNullable(
             readCollection("sourceOauthClients").find((item) =>
-              item.workspaceId === workspaceId
+              item.scopeId === scopeId
               && item.sourceId === sourceId
               && item.providerKey === providerKey
             ),
         effectTry("upsert source oauth client", () => {
           updateCollection("sourceOauthClients", (items) => {
             const index = items.findIndex((item) =>
-              item.workspaceId === oauthClient.workspaceId
+              item.scopeId === oauthClient.scopeId
               && item.sourceId === oauthClient.sourceId
               && item.providerKey === oauthClient.providerKey
             );
             }
           });
         }),
-      removeByWorkspaceAndSourceId: ({ workspaceId, sourceId }) =>
+      removeByScopeAndSourceId: ({ scopeId, sourceId }) =>
         effectTry("remove source oauth clients", () =>
           updateCollection("sourceOauthClients", (items) => {
             const remaining = items.filter((item) =>
-              !(item.workspaceId === workspaceId && item.sourceId === sourceId)
+              !(item.scopeId === scopeId && item.sourceId === sourceId)
             );
             const removed = items.length - remaining.length;
             items.splice(0, items.length, ...remaining);
           }),
         ),
     },
-    workspaceOauthClients: {
+    scopeOauthClients: {
-      listByWorkspaceAndProvider: ({ workspaceId, providerKey }) =>
+      listByScopeAndProvider: ({ scopeId, providerKey }) =>
         effectTry("list workspace oauth clients", () =>
-          readCollection("workspaceOauthClients").filter((item) =>
+          readCollection("scopeOauthClients").filter((item) =>
-            item.workspaceId === workspaceId && item.providerKey === providerKey
+            item.scopeId === scopeId && item.providerKey === providerKey
           ),
         ),
       getById: (id) =>
         effectTry("get workspace oauth client", () =>
           Option.fromNullable(
-            readCollection("workspaceOauthClients").find((item) => item.id === id),
+            readCollection("scopeOauthClients").find((item) => item.id === id),
           ),
         ),
       upsert: (oauthClient) =>
         effectTry("upsert workspace oauth client", () => {
-          updateCollection("workspaceOauthClients", (items) => {
+          updateCollection("scopeOauthClients", (items) => {
             const index = items.findIndex((item) => item.id === oauthClient.id);
             if (index >= 0) {
               items[index] = oauthClient;
         }),
       removeById: (id) =>
         effectTry("remove workspace oauth client", () =>
-          updateCollection("workspaceOauthClients", (items) => {
+          updateCollection("scopeOauthClients", (items) => {
             const remaining = items.filter((item) => item.id !== id);
             const removed = remaining.length !== items.length;
             items.splice(0, items.length, ...remaining);
         ),
     },
     providerAuthGrants: {
-      listByWorkspaceId: (workspaceId) =>
+      listByScopeId: (scopeId) =>
         effectTry("list provider grants by workspace", () =>
-          readCollection("providerAuthGrants").filter((item) => item.workspaceId === workspaceId),
+          readCollection("providerAuthGrants").filter((item) => item.scopeId === scopeId),
         ),
-      listByWorkspaceActorAndProvider: ({ workspaceId, actorAccountId, providerKey }) =>
+      listByScopeActorAndProvider: ({ scopeId, actorScopeId, providerKey }) =>
         effectTry("list provider grants by actor", () =>
           readCollection("providerAuthGrants").filter((item) =>
-            item.workspaceId === workspaceId
+            item.scopeId === scopeId
-            && item.actorAccountId === actorAccountId
+            && item.actorScopeId === actorScopeId
             && item.providerKey === providerKey
           ),
         ),
     sourceAuthSessions: {
       listAll: () =>
         effectTry("list source auth sessions", () => readCollection("sourceAuthSessions")),
-      listByWorkspaceId: (workspaceId) =>
+      listByScopeId: (scopeId) =>
         effectTry("list source auth sessions by workspace", () =>
-          readCollection("sourceAuthSessions").filter((item) => item.workspaceId === workspaceId),
+          readCollection("sourceAuthSessions").filter((item) => item.scopeId === scopeId),
         ),
       getById: (id) =>
         effectTry("get source auth session", () =>
             readCollection("sourceAuthSessions").find((item) => item.state === state),
           ),
         ),
-      getPendingByWorkspaceSourceAndActor: ({ workspaceId, sourceId, actorAccountId, credentialSlot }) =>
+      getPendingByScopeSourceAndActor: ({ scopeId, sourceId, actorScopeId, credentialSlot }) =>
         effectTry("get pending source auth session", () =>
           Option.fromNullable(
             readCollection("sourceAuthSessions").find((item) =>
-              item.workspaceId === workspaceId
+              item.scopeId === scopeId
               && item.sourceId === sourceId
-              && item.actorAccountId === actorAccountId
+              && item.actorScopeId === actorScopeId
               && item.status === "pending"
               && (credentialSlot === undefined || item.credentialSlot === credentialSlot)
             ),
             }
           });
         }),
-      removeByWorkspaceAndSourceId: (workspaceId, sourceId) =>
+      removeByScopeAndSourceId: (scopeId, sourceId) =>
         effectTry("remove source auth sessions", () =>
           updateCollection("sourceAuthSessions", (items) => {
             const remaining = items.filter((item) =>
-              !(item.workspaceId === workspaceId && item.sourceId === sourceId)
+              !(item.scopeId === scopeId && item.sourceId === sourceId)
             );
             const removed = remaining.length !== items.length;
             items.splice(0, items.length, ...remaining);
             readCollection("executions").find((item) => item.id === executionId),
           ),
         ),
-      getByWorkspaceAndId: (workspaceId, executionId) =>
+      getByScopeAndId: (scopeId, executionId) =>
-        effectTry("get execution by workspace and id", () =>
+        effectTry("get execution by scope and id", () =>
           Option.fromNullable(
             readCollection("executions").find((item) =>
-              item.workspaceId === workspaceId && item.id === executionId
+              item.scopeId === scopeId && item.id === executionId
             ),
           ),
         ),
         const secretMaterial = createSecretMaterialBackend(executorState);
         return {
-          workspace: {
+          scope: {
-            workspaceName: options.workspaceName ?? "SQLite SDK Example",
+            scopeName: options.scopeName ?? "SQLite SDK Example",
-            workspaceRoot: options.workspaceRoot ?? null,
+            scopeRoot: options.scopeRoot ?? null,
             metadata: {
               kind: "sqlite",
               databasePath,
           },
           storage: {
             installation: createInstallationStore(store, options),
-            workspaceConfig: createWorkspaceConfigStore(store),
+            scopeConfig: createScopeConfigStore(store),
-            workspaceState: createWorkspaceStateStore(store),
+            scopeState: createScopeStateStore(store),
             sourceArtifacts: createSourceArtifactStore(store),
             executorState,
             secretMaterial,

packages/clients/react/package.json+1−0

@@ -24,6 +24,7 @@ · 23 unmodified lines
24	"@effect/platform": "catalog:",	24	"@effect/platform": "catalog:",
25	"@effect/platform-node": "catalog:",	25	"@effect/platform-node": "catalog:",
26	"@effect/vitest": "catalog:",	26	"@effect/vitest": "catalog:",
		27	"@executor/effect-test-utils": "workspace:*",
27	"@executor/platform-sdk-file": "workspace:*",	28	"@executor/platform-sdk-file": "workspace:*",
28	"@types/jsdom": "^21.1.7",	29	"@types/jsdom": "^21.1.7",
29	"@types/node": "catalog:",	30	"@types/node": "catalog:",

packages/clients/react/src/index.test.tsx+46−107

@@ -1,8 +1,19 @@
1	import { createServer } from "node:http";	1	import { createServer } from "node:http";
2		2
3	import { FileSystem, HttpApiBuilder, HttpServer } from "@effect/platform";	3	import {
		4	FileSystem,
		5	HttpApi,
		6	HttpApiBuilder,
		7	HttpApiEndpoint,
		8	HttpApiGroup,
		9	HttpServer,
		10	OpenApi,
		11	} from "@effect/platform";
4	import { NodeFileSystem, NodeHttpServer } from "@effect/platform-node";	12	import { NodeFileSystem, NodeHttpServer } from "@effect/platform-node";
5	import { describe, expect, it } from "@effect/vitest";	13	import { describe, expect, it } from "@effect/vitest";
		14	import {
		15	startOpenApiTestServer,
		16	} from "@executor/effect-test-utils";
6	import {	17	import {
7	createExecutorApiLayer,	18	createExecutorApiLayer,
8	} from "@executor/platform-api";	19	} from "@executor/platform-api";
@@ -17,6 +28,7 @@ import * as Context from "effect/Context"; · 8 unmodified lines
17	import * as Effect from "effect/Effect";	28	import * as Effect from "effect/Effect";
18	import * as Exit from "effect/Exit";	29	import * as Exit from "effect/Exit";
19	import * as Layer from "effect/Layer";	30	import * as Layer from "effect/Layer";
		31	import * as Schema from "effect/Schema";
20	import * as Scope from "effect/Scope";	32	import * as Scope from "effect/Scope";
21	import { JSDOM } from "jsdom";	33	import { JSDOM } from "jsdom";
22	import * as React from "react";	34	import * as React from "react";
@@ -225,83 +237,38 @@ type OpenApiSpecServer = RunningServer & { · 202 unmodified lines
225	specUrl: string;	237	specUrl: string;
226	};	238	};
227		239
228	const startOpenApiSpecServer = async (): Promise<OpenApiSpecServer> => {	240	class HooksTestPingApi extends HttpApiGroup.make("ping")
229	const spec = {	241	.add(
230	openapi: "3.0.3",	242	HttpApiEndpoint.get("ping")`/ping`
231	info: {	243	.addSuccess(
232	title: "Hook Test API",	244	Schema.Struct({
233	version: "1.0.0",	245	ok: Schema.Boolean,
234	},	246	}),
235	paths: {	247	),
236	"/ping": {	248	)
237	get: {	249	{}
238	operationId: "ping",	250
239	responses: {	251	class HooksTestOpenApi extends HttpApi.make("hooksTest").add(HooksTestPingApi) {}
240	200: {	252
241	description: "ok",	253	const hooksTestOpenApiSpec = OpenApi.fromApi(HooksTestOpenApi);
242	content: {	254	const hooksTestOpenApiLive = HttpApiBuilder.group(
243	"application/json": {	255	HooksTestOpenApi,
244	schema: {	256	"ping",
245	type: "object",	257	(handlers) =>
246	properties: {	258	handlers.handle("ping", () =>
247	ok: { type: "boolean" },	259	Effect.succeed({
248	},	260	ok: true,
249	},	261	}),
250	},	262	),
251	},	263	);
252	},	264	const hooksTestOpenApiLayer = HttpApiBuilder.api(HooksTestOpenApi).pipe(
253	},	265	Layer.provide(hooksTestOpenApiLive),
254	},	266	);
255	},
256	},
257	};
258
259	const server = createServer((req, res) => {
260	if (req.url === "/openapi.json") {
261	res.statusCode = 200;
262	res.setHeader("content-type", "application/json");
263	res.end(JSON.stringify(spec));
264	return;
265	}
266
267	if (req.url === "/ping") {
268	res.statusCode = 200;
269	res.setHeader("content-type", "application/json");
270	res.end(JSON.stringify({ ok: true }));
271	return;
272	}
273
274	res.statusCode = 404;
275	res.end("not found");
276	});
277		267
278	await new Promise<void>((resolve, reject) => {	268	const startOpenApiSpecServer = async (): Promise<OpenApiSpecServer> => {
279	server.once("error", reject);	269	return startOpenApiTestServer({
280	server.listen(0, "127.0.0.1", () => resolve());	270	apiLayer: hooksTestOpenApiLayer,
281	});	271	});
282
283	const address = server.address();
284	if (!address \|\| typeof address === "string") {
285	throw new Error("Failed to bind OpenAPI spec server");
286	}
287
288	const baseUrl = `http://127.0.0.1:${address.port}`;
289
290	return {
291	baseUrl,
292	specUrl: `${baseUrl}/openapi.json`,
293	close: () =>
294	new Promise<void>((resolve, reject) => {
295	server.close((error) => {
296	if (error) {
297	reject(error);
298	return;
299	}
300
301	resolve();
302	});
303	}),
304	};
305	};	272	};
306		273
307	async function requestJson<T>(input: {	274	async function requestJson<T>(input: {
@@ -343,42 +310,14 @@ const seedStoredOpenApiSource = async (input: { · 35 unmodified lines
343	name: string;	310	name: string;
344	specUrl?: string;	311	specUrl?: string;
345	}): Promise<Source> => {	312	}): Promise<Source> => {
346	const sourceDocumentText = JSON.stringify({	313	const sourceDocumentText = JSON.stringify(hooksTestOpenApiSpec);
347	openapi: "3.0.3",
348	info: {
349	title: input.name,
350	version: "1.0.0",
351	},
352	paths: {
353	"/ping": {
354	get: {
355	operationId: "ping",
356	responses: {
357	200: {
358	description: "ok",
359	content: {
360	"application/json": {
361	schema: {
362	type: "object",
363	properties: {
364	ok: { type: "boolean" },
365	},
366	},
367	},
368	},
369	},
370	},
371	},
372	},
373	},
374	});
375	const specUrl = input.specUrl ?? `data:application/json,${encodeURIComponent(sourceDocumentText)}`;	314	const specUrl = input.specUrl ?? `data:application/json,${encodeURIComponent(sourceDocumentText)}`;
376		315
377	return requestJson<Source>({	316	return requestJson<Source>({
378	baseUrl: input.server.baseUrl,	317	baseUrl: input.server.baseUrl,
379	path: `/v1/workspaces/${input.installation.workspaceId}/sources`,	318	path: `/v1/workspaces/${input.installation.scopeId}/sources`,
380	method: "POST",	319	method: "POST",
381	accountId: input.installation.accountId,	320	accountId: input.installation.actorScopeId,
382	payload: {	321	payload: {
383	name: input.name,	322	name: input.name,
384	kind: "openapi",	323	kind: "openapi",

packages/clients/react/src/index.ts+21−21

@@ -32,7 +32,7 @@ import type { · 31 unmodified lines
32	SourceInspection,	32	SourceInspection,
33	SourceInspectionDiscoverResult,	33	SourceInspectionDiscoverResult,
34	SourceInspectionToolDetail,	34	SourceInspectionToolDetail,
35	WorkspaceOauthClient,	35	ScopeOauthClient as WorkspaceOauthClient,
36	} from "@executor/platform-sdk/schema";	36	} from "@executor/platform-sdk/schema";
37	import * as Cause from "effect/Cause";	37	import * as Cause from "effect/Cause";
38	import * as Effect from "effect/Effect";	38	import * as Effect from "effect/Effect";
@@ -42,7 +42,7 @@ import * as Runtime from "effect/Runtime"; · 3 unmodified lines
42	import * as React from "react";	42	import * as React from "react";
43		43
44	const DEFAULT_EXECUTOR_API_BASE_URL = "http://127.0.0.1:8788";	44	const DEFAULT_EXECUTOR_API_BASE_URL = "http://127.0.0.1:8788";
45	const PLACEHOLDER_WORKSPACE_ID = "ws_placeholder" as Source["workspaceId"];	45	const PLACEHOLDER_WORKSPACE_ID = "ws_placeholder" as Source["scopeId"];
46	const PLACEHOLDER_ACCOUNT_ID = "acc_placeholder";	46	const PLACEHOLDER_ACCOUNT_ID = "acc_placeholder";
47	const PLACEHOLDER_SOURCE_ID = "src_placeholder" as Source["id"];	47	const PLACEHOLDER_SOURCE_ID = "src_placeholder" as Source["id"];
48		48
@@ -58,18 +58,18 @@ export type SourceRemoveResult = { · 9 unmodified lines
58		58
59	type AtomKeyPart = string \| number \| boolean \| null \| undefined;	59	type AtomKeyPart = string \| number \| boolean \| null \| undefined;
60		60
61	type SourcesKeyParts = readonly [boolean, Source["workspaceId"], string];	61	type SourcesKeyParts = readonly [boolean, Source["scopeId"], string];
62	type SourceKeyParts = readonly [boolean, Source["workspaceId"], string, Source["id"]];	62	type SourceKeyParts = readonly [boolean, Source["scopeId"], string, Source["id"]];
63	type SourceToolDetailKeyParts = readonly [	63	type SourceToolDetailKeyParts = readonly [
64	boolean,	64	boolean,
65	Source["workspaceId"],	65	Source["scopeId"],
66	string,	66	string,
67	Source["id"],	67	Source["id"],
68	string \| null,	68	string \| null,
69	];	69	];
70	type SourceDiscoveryKeyParts = readonly [	70	type SourceDiscoveryKeyParts = readonly [
71	boolean,	71	boolean,
72	Source["workspaceId"],	72	Source["scopeId"],
73	string,	73	string,
74	Source["id"],	74	Source["id"],
75	string,	75	string,
@@ -77,13 +77,13 @@ type SourceDiscoveryKeyParts = readonly [ · 1 unmodified line
77	];	77	];
78	type WorkspaceOauthClientsKeyParts = readonly [	78	type WorkspaceOauthClientsKeyParts = readonly [
79	boolean,	79	boolean,
80	Source["workspaceId"],	80	Source["scopeId"],
81	string,	81	string,
82	string,	82	string,
83	];	83	];
84		84
85	type InvalidationTarget = {	85	type InvalidationTarget = {
86	workspaceId?: Source["workspaceId"];	86	workspaceId?: Source["scopeId"];
87	accountId?: string;	87	accountId?: string;
88	sourceId?: Source["id"];	88	sourceId?: Source["id"];
89	};	89	};
@@ -104,7 +104,7 @@ type ExecutorQueryContextValue = { · 14 unmodified lines
104	};	104	};
105		105
106	type MutationExecutionContext = {	106	type MutationExecutionContext = {
107	workspaceId: Source["workspaceId"];	107	workspaceId: Source["scopeId"];
108	accountId: string;	108	accountId: string;
109	registry: Registry.Registry;	109	registry: Registry.Registry;
110	invalidateQueries: (target?: InvalidationTarget) => void;	110	invalidateQueries: (target?: InvalidationTarget) => void;
@@ -149,20 +149,20 @@ const decodeAtomKey = <T extends ReadonlyArray<AtomKeyPart>>(key: string): T => · 38 unmodified lines
149		149
150	const encodeSourcesKey = (	150	const encodeSourcesKey = (
151	enabled: boolean,	151	enabled: boolean,
152	workspaceId: Source["workspaceId"],	152	workspaceId: Source["scopeId"],
153	accountId: string,	153	accountId: string,
154	): string => encodeAtomKey([enabled, workspaceId, accountId] satisfies SourcesKeyParts);	154	): string => encodeAtomKey([enabled, workspaceId, accountId] satisfies SourcesKeyParts);
155		155
156	const encodeSourceKey = (	156	const encodeSourceKey = (
157	enabled: boolean,	157	enabled: boolean,
158	workspaceId: Source["workspaceId"],	158	workspaceId: Source["scopeId"],
159	accountId: string,	159	accountId: string,
160	sourceId: Source["id"],	160	sourceId: Source["id"],
161	): string => encodeAtomKey([enabled, workspaceId, accountId, sourceId] satisfies SourceKeyParts);	161	): string => encodeAtomKey([enabled, workspaceId, accountId, sourceId] satisfies SourceKeyParts);
162		162
163	const encodeToolDetailKey = (	163	const encodeToolDetailKey = (
164	enabled: boolean,	164	enabled: boolean,
165	workspaceId: Source["workspaceId"],	165	workspaceId: Source["scopeId"],
166	accountId: string,	166	accountId: string,
167	sourceId: Source["id"],	167	sourceId: Source["id"],
168	toolPath: string \| null,	168	toolPath: string \| null,
@@ -171,7 +171,7 @@ const encodeToolDetailKey = ( · 2 unmodified lines
171		171
172	const encodeDiscoveryKey = (	172	const encodeDiscoveryKey = (
173	enabled: boolean,	173	enabled: boolean,
174	workspaceId: Source["workspaceId"],	174	workspaceId: Source["scopeId"],
175	accountId: string,	175	accountId: string,
176	sourceId: Source["id"],	176	sourceId: Source["id"],
177	query: string,	177	query: string,
@@ -181,7 +181,7 @@ const encodeDiscoveryKey = ( · 3 unmodified lines
181		181
182	const encodeWorkspaceOauthClientsKey = (	182	const encodeWorkspaceOauthClientsKey = (
183	enabled: boolean,	183	enabled: boolean,
184	workspaceId: Source["workspaceId"],	184	workspaceId: Source["scopeId"],
185	accountId: string,	185	accountId: string,
186	providerKey: string,	186	providerKey: string,
187	): string =>	187	): string =>
@@ -430,7 +430,7 @@ export type Loadable<T> = · 242 unmodified lines
430		430
431	type WorkspaceContext = {	431	type WorkspaceContext = {
432	installation: LocalInstallation;	432	installation: LocalInstallation;
433	workspaceId: Source["workspaceId"];	433	workspaceId: Source["scopeId"];
434	accountId: string;	434	accountId: string;
435	};	435	};
436		436
@@ -483,8 +483,8 @@ const useWorkspaceContext = (): Loadable<WorkspaceContext> => { · 46 unmodified lines
483	status: "ready",	483	status: "ready",
484	data: {	484	data: {
485	installation: installation.data,	485	installation: installation.data,
486	workspaceId: installation.data.workspaceId,	486	workspaceId: installation.data.scopeId,
487	accountId: installation.data.accountId,	487	accountId: installation.data.actorScopeId,
488	},	488	},
489	} satisfies Loadable<WorkspaceContext>;	489	} satisfies Loadable<WorkspaceContext>;
490	}, [installation]);	490	}, [installation]);
@@ -559,7 +559,7 @@ const createActiveQueryCollections = (): ActiveQueryCollections => ({ · 68 unmodified lines
559		559
560	const targetMatches = (	560	const targetMatches = (
561	target: InvalidationTarget \| undefined,	561	target: InvalidationTarget \| undefined,
562	workspaceId: Source["workspaceId"],	562	workspaceId: Source["scopeId"],
563	accountId: string,	563	accountId: string,
564	sourceId?: Source["id"],	564	sourceId?: Source["id"],
565	): boolean => {	565	): boolean => {
@@ -671,14 +671,14 @@ const removeSourceFromList = ( · 105 unmodified lines
671	): ReadonlyArray<Source> => sources.filter((source) => source.id !== sourceId);	671	): ReadonlyArray<Source> => sources.filter((source) => source.id !== sourceId);
672		672
673	const createOptimisticSource = (input: {	673	const createOptimisticSource = (input: {
674	workspaceId: Source["workspaceId"];	674	workspaceId: Source["scopeId"];
675	payload: CreateSourcePayload;	675	payload: CreateSourcePayload;
676	}): Source => {	676	}): Source => {
677	const now = Date.now();	677	const now = Date.now();
678		678
679	return {	679	return {
680	id: `src_optimistic_${crypto.randomUUID()}` as Source["id"],	680	id: `src_optimistic_${crypto.randomUUID()}` as Source["id"],
681	workspaceId: input.workspaceId,	681	scopeId: input.workspaceId,
682	name: input.payload.name,	682	name: input.payload.name,
683	kind: input.payload.kind,	683	kind: input.payload.kind,
684	endpoint: input.payload.endpoint,	684	endpoint: input.payload.endpoint,
@@ -713,7 +713,7 @@ const applyUpdatePayloadToSource = (source: Source, payload: UpdateSourcePayload · 28 unmodified lines
713		713
714	const useSourceMutation = <TInput, TOutput, TOptimistic = never>(	714	const useSourceMutation = <TInput, TOutput, TOptimistic = never>(
715	execute: (input: {	715	execute: (input: {
716	workspaceId: Source["workspaceId"];	716	workspaceId: Source["scopeId"];
717	accountId: string;	717	accountId: string;
718	payload: TInput;	718	payload: TInput;
719	}) => Promise<TOutput>,	719	}) => Promise<TOutput>,

packages/dev/effect-test-utils/package.json+22−0

@@ -0,0 +1,22 @@
	1	{
	2	"name": "@executor/effect-test-utils",
	3	"private": true,
	4	"type": "module",
	5	"exports": {
	6	".": "./src/index.ts"
	7	},
	8	"scripts": {
	9	"typecheck": "bunx tsc --noEmit -p tsconfig.json"
	10	},
	11	"dependencies": {
	12	"@effect/platform": "catalog:",
	13	"@effect/platform-node": "catalog:",
	14	"effect": "catalog:"
	15	},
	16	"devDependencies": {
	17	"@types/node": "catalog:",
	18	"bun-types": "catalog:",
	19	"typescript": "^5.9.3"
	20	},
	21	"version": "0.0.0"
	22	}

packages/dev/effect-test-utils/src/index.ts+103−0

@@ -0,0 +1,103 @@
	1	import { createServer } from "node:http";
	2
	3	import { HttpApiBuilder, HttpServer } from "@effect/platform";
	4	import { NodeHttpServer } from "@effect/platform-node";
	5	import * as Context from "effect/Context";
	6	import * as Effect from "effect/Effect";
	7	import * as Exit from "effect/Exit";
	8	import * as Layer from "effect/Layer";
	9	import * as Scope from "effect/Scope";
	10
	11	export type RunningHttpApiTestServer = {
	12	baseUrl: string;
	13	close: () => Promise<void>;
	14	};
	15
	16	export type RunningOpenApiTestServer = RunningHttpApiTestServer & {
	17	specUrl: string;
	18	};
	19
	20	type TestApiLayer = Layer.Layer<any, any, never>;
	21
	22	type HttpApiTestServerOptions = {
	23	apiLayer: TestApiLayer;
	24	host?: string;
	25	openApiPath?: `/${string}`;
	26	};
	27
	28	const createHttpApiServerLayer = (options: HttpApiTestServerOptions) => {
	29	const host = options.host ?? "127.0.0.1";
	30	const openApiPath = options.openApiPath;
	31	const apiLayerWithOpenApi =
	32	openApiPath === undefined
	33	? options.apiLayer
	34	: Layer.mergeAll(
	35	options.apiLayer,
	36	HttpApiBuilder.middlewareOpenApi({ path: openApiPath }).pipe(
	37	Layer.provideMerge(options.apiLayer),
	38	),
	39	);
	40
	41	return HttpApiBuilder.serve().pipe(
	42	Layer.provide(apiLayerWithOpenApi),
	43	Layer.provideMerge(
	44	NodeHttpServer.layer(() => createServer(), {
	45	port: 0,
	46	host,
	47	}),
	48	),
	49	);
	50	};
	51
	52	export const startHttpApiTestServer = async (
	53	options: HttpApiTestServerOptions,
	54	): Promise<RunningHttpApiTestServer> => {
	55	const scope = await Effect.runPromise(Scope.make());
	56
	57	try {
	58	const context = await Effect.runPromise(
	59	Layer.buildWithScope(createHttpApiServerLayer(options), scope),
	60	);
	61	const server = Context.get(context, HttpServer.HttpServer);
	62	const baseUrl = HttpServer.formatAddress(server.address);
	63
	64	return {
	65	baseUrl,
	66	close: () => Effect.runPromise(Scope.close(scope, Exit.void)),
	67	};
	68	} catch (error) {
	69	await Effect.runPromise(Scope.close(scope, Exit.void));
	70	throw error;
	71	}
	72	};
	73
	74	export const startOpenApiTestServer = async (
	75	options: HttpApiTestServerOptions,
	76	): Promise<RunningOpenApiTestServer> => {
	77	const openApiPath = options.openApiPath ?? "/openapi.json";
	78	const server = await startHttpApiTestServer({
	79	...options,
	80	openApiPath,
	81	});
	82
	83	return {
	84	...server,
	85	specUrl: `${server.baseUrl}${openApiPath}`,
	86	};
	87	};
	88
	89	export const makeHttpApiTestServer = (
	90	options: HttpApiTestServerOptions,
	91	): Effect.Effect<RunningHttpApiTestServer, never, Scope.Scope> =>
	92	Effect.acquireRelease(
	93	Effect.promise(() => startHttpApiTestServer(options)),
	94	(server) => Effect.promise(() => server.close()).pipe(Effect.orDie),
	95	);
	96
	97	export const makeOpenApiTestServer = (
	98	options: HttpApiTestServerOptions,
	99	): Effect.Effect<RunningOpenApiTestServer, never, Scope.Scope> =>
	100	Effect.acquireRelease(
	101	Effect.promise(() => startOpenApiTestServer(options)),
	102	(server) => Effect.promise(() => server.close()).pipe(Effect.orDie),
	103	);

packages/dev/effect-test-utils/tsconfig.json+15−0

@@ -0,0 +1,15 @@
	1	{
	2	"compilerOptions": {
	3	"target": "ES2022",
	4	"module": "ESNext",
	5	"moduleResolution": "Bundler",
	6	"strict": true,
	7	"skipLibCheck": true,
	8	"noEmit": true,
	9	"lib": ["ES2022"],
	10	"types": ["bun-types", "node"]
	11	},
	12	"include": [
	13	"src/*/.ts"
	14	]
	15	}

packages/hosts/mcp/src/index.ts+24−24

@@ -154,8 +154,8 @@ const loadExecuteDescription = (runtime: ExecutorRuntime): Promise<string> => · 153 unmodified lines
154	Effect.gen(function* () {	154	Effect.gen(function* () {
155	const resolveExecutionEnvironment = yield* RuntimeExecutionResolverService;	155	const resolveExecutionEnvironment = yield* RuntimeExecutionResolverService;
156	const environment = yield* resolveExecutionEnvironment({	156	const environment = yield* resolveExecutionEnvironment({
157	workspaceId: runtime.localInstallation.workspaceId,	157	scopeId: runtime.localInstallation.scopeId,
158	accountId: runtime.localInstallation.accountId,	158	actorScopeId: runtime.localInstallation.actorScopeId,
159	executionId: ExecutionIdSchema.make("exec_mcp_help"),	159	executionId: ExecutionIdSchema.make("exec_mcp_help"),
160	});	160	});
161		161
@@ -260,7 +260,7 @@ const buildToolResult = (envelope: ExecutionEnvelope): ExecutorMcpToolResult => · 98 unmodified lines
260		260
261	const waitForInteractionProgress = async (input: {	261	const waitForInteractionProgress = async (input: {
262	runtime: ExecutorRuntime;	262	runtime: ExecutorRuntime;
263	workspaceId: string;	263	scopeId: string;
264	executionId: string;	264	executionId: string;
265	pendingInteractionId: string;	265	pendingInteractionId: string;
266	}): Promise<ExecutionEnvelope> => {	266	}): Promise<ExecutionEnvelope> => {
@@ -268,7 +268,7 @@ const waitForInteractionProgress = async (input: { · 1 unmodified line
268	const next = await runControlPlane(	268	const next = await runControlPlane(
269	input.runtime,	269	input.runtime,
270	getExecution({	270	getExecution({
271	workspaceId: input.workspaceId as never,	271	scopeId: input.scopeId as never,
272	executionId: input.executionId as never,	272	executionId: input.executionId as never,
273	}),	273	}),
274	);	274	);
@@ -286,8 +286,8 @@ const waitForInteractionProgress = async (input: { · 11 unmodified lines
286		286
287	const driveExecutionWithElicitation = async (input: {	287	const driveExecutionWithElicitation = async (input: {
288	runtime: ExecutorRuntime;	288	runtime: ExecutorRuntime;
289	workspaceId: string;	289	scopeId: string;
290	accountId: string;	290	actorScopeId: string;
291	server: McpServer;	291	server: McpServer;
292	envelope: ExecutionEnvelope;	292	envelope: ExecutionEnvelope;
293	}): Promise<ExecutionEnvelope> => {	293	}): Promise<ExecutionEnvelope> => {
@@ -317,13 +317,13 @@ const driveExecutionWithElicitation = async (input: { · 23 unmodified lines
317	current = await runControlPlane(	317	current = await runControlPlane(
318	input.runtime,	318	input.runtime,
319	resumeExecution({	319	resumeExecution({
320	workspaceId: input.workspaceId as never,	320	scopeId: input.scopeId as never,
321	executionId: current.execution.id as never,	321	executionId: current.execution.id as never,
322	payload: {	322	payload: {
323	responseJson: JSON.stringify(response),	323	responseJson: JSON.stringify(response),
324	interactionMode: interactionModeForServer(input.server),	324	interactionMode: interactionModeForServer(input.server),
325	},	325	},
326	resumedByAccountId: input.accountId as never,	326	resumedByScopeId: input.actorScopeId as never,
327	}),	327	}),
328	);	328	);
329	continue;	329	continue;
@@ -340,13 +340,13 @@ const driveExecutionWithElicitation = async (input: { · 10 unmodified lines
340	current = await runControlPlane(	340	current = await runControlPlane(
341	input.runtime,	341	input.runtime,
342	resumeExecution({	342	resumeExecution({
343	workspaceId: input.workspaceId as never,	343	scopeId: input.scopeId as never,
344	executionId: current.execution.id as never,	344	executionId: current.execution.id as never,
345	payload: {	345	payload: {
346	responseJson: JSON.stringify(response),	346	responseJson: JSON.stringify(response),
347	interactionMode: interactionModeForServer(input.server),	347	interactionMode: interactionModeForServer(input.server),
348	},	348	},
349	resumedByAccountId: input.accountId as never,	349	resumedByScopeId: input.actorScopeId as never,
350	}),	350	}),
351	);	351	);
352	continue;	352	continue;
@@ -354,7 +354,7 @@ const driveExecutionWithElicitation = async (input: { · 1 unmodified line
354		354
355	current = await waitForInteractionProgress({	355	current = await waitForInteractionProgress({
356	runtime: input.runtime,	356	runtime: input.runtime,
357	workspaceId: input.workspaceId,	357	scopeId: input.scopeId,
358	executionId: current.execution.id,	358	executionId: current.execution.id,
359	pendingInteractionId: pending.id,	359	pendingInteractionId: pending.id,
360	});	360	});
@@ -365,15 +365,15 @@ const driveExecutionWithElicitation = async (input: { · 4 unmodified lines
365		365
366	const driveExecutionWithoutElicitation = async (input: {	366	const driveExecutionWithoutElicitation = async (input: {
367	runtime: ExecutorRuntime;	367	runtime: ExecutorRuntime;
368	workspaceId: string;	368	scopeId: string;
369	accountId: string;	369	actorScopeId: string;
370	executionId: string;	370	executionId: string;
371	initialResponse?: ResumeResponseInput;	371	initialResponse?: ResumeResponseInput;
372	}): Promise<ExecutionEnvelope> => {	372	}): Promise<ExecutionEnvelope> => {
373	let current = await runControlPlane(	373	let current = await runControlPlane(
374	input.runtime,	374	input.runtime,
375	getExecution({	375	getExecution({
376	workspaceId: input.workspaceId as never,	376	scopeId: input.scopeId as never,
377	executionId: input.executionId as never,	377	executionId: input.executionId as never,
378	}),	378	}),
379	);	379	);
@@ -388,13 +388,13 @@ const driveExecutionWithoutElicitation = async (input: { · 8 unmodified lines
388	current = await runControlPlane(	388	current = await runControlPlane(
389	input.runtime,	389	input.runtime,
390	resumeExecution({	390	resumeExecution({
391	workspaceId: input.workspaceId as never,	391	scopeId: input.scopeId as never,
392	executionId: current.execution.id as never,	392	executionId: current.execution.id as never,
393	payload: {	393	payload: {
394	responseJson: JSON.stringify(response),	394	responseJson: JSON.stringify(response),
395	interactionMode: "detach",	395	interactionMode: "detach",
396	},	396	},
397	resumedByAccountId: input.accountId as never,	397	resumedByScopeId: input.actorScopeId as never,
398	}),	398	}),
399	);	399	);
400	response = undefined;	400	response = undefined;
@@ -416,8 +416,8 @@ const createExecutorMcpServer = async (config: { · 15 unmodified lines
416	},	416	},
417	);	417	);
418		418
419	const workspaceId = config.runtime.localInstallation.workspaceId;	419	const scopeId = config.runtime.localInstallation.scopeId;
420	const accountId = config.runtime.localInstallation.accountId;	420	const actorScopeId = config.runtime.localInstallation.actorScopeId;
421		421
422	const executeTool = server.registerTool(	422	const executeTool = server.registerTool(
423	"execute",	423	"execute",
@@ -429,20 +429,20 @@ const createExecutorMcpServer = async (config: { · 5 unmodified lines
429	let created = await runControlPlane(	429	let created = await runControlPlane(
430	config.runtime,	430	config.runtime,
431	createExecution({	431	createExecution({
432	workspaceId,	432	scopeId,
433	payload: {	433	payload: {
434	code,	434	code,
435	interactionMode: interactionModeForServer(server),	435	interactionMode: interactionModeForServer(server),
436	},	436	},
437	createdByAccountId: accountId,	437	createdByScopeId: actorScopeId,
438	}),	438	}),
439	);	439	);
440		440
441	if (supportsManagedElicitation(server)) {	441	if (supportsManagedElicitation(server)) {
442	created = await driveExecutionWithElicitation({	442	created = await driveExecutionWithElicitation({
443	runtime: config.runtime,	443	runtime: config.runtime,
444	workspaceId,	444	scopeId,
445	accountId,	445	actorScopeId,
446	server,	446	server,
447	envelope: created,	447	envelope: created,
448	});	448	});
@@ -469,8 +469,8 @@ const createExecutorMcpServer = async (config: { · 20 unmodified lines
469	) => {	469	) => {
470	const resumed = await driveExecutionWithoutElicitation({	470	const resumed = await driveExecutionWithoutElicitation({
471	runtime: config.runtime,	471	runtime: config.runtime,
472	workspaceId,	472	scopeId,
473	accountId,	473	actorScopeId,
474	executionId: input.resumePayload.executionId,	474	executionId: input.resumePayload.executionId,
475	initialResponse: input.response,	475	initialResponse: input.response,
476	});	476	});

packages/hosts/mcp/src/paused-result.test.ts+2−2

@@ -35,8 +35,8 @@ const makeEnvelope = ( · 34 unmodified lines
35	): ExecutionEnvelope => ({	35	): ExecutionEnvelope => ({
36	execution: {	36	execution: {
37	id: "exec_123" as never,	37	id: "exec_123" as never,
38	workspaceId: "ws_123" as never,	38	scopeId: "ws_123" as never,
39	createdByAccountId: "acct_123" as never,	39	createdByScopeId: "acct_123" as never,
40	status: "waiting_for_interaction",	40	status: "waiting_for_interaction",
41	code: "return await tools.executor.sources.add({ endpoint: 'https://mcp.axiom.co/mcp' });",	41	code: "return await tools.executor.sources.add({ endpoint: 'https://mcp.axiom.co/mcp' });",
42	resultJson: null,	42	resultJson: null,

packages/platform/api/src/executions/api.ts+1−1

@@ -10,7 +10,7 @@ export type { · 9 unmodified lines
10	import {	10	import {
11	ExecutionIdSchema,	11	ExecutionIdSchema,
12	ExecutionEnvelopeSchema,	12	ExecutionEnvelopeSchema,
13	WorkspaceIdSchema,	13	ScopeIdSchema as WorkspaceIdSchema,
14	} from "@executor/platform-sdk/schema";	14	} from "@executor/platform-sdk/schema";
15		15
16	import {	16	import {

packages/platform/api/src/executor-context.ts+3−3

@@ -1,5 +1,5 @@
1	import type { Executor } from "@executor/platform-sdk";	1	import type { Executor } from "@executor/platform-sdk";
2	import type { WorkspaceId } from "@executor/platform-sdk/schema";	2	import type { ScopeId as WorkspaceId } from "@executor/platform-sdk/schema";
3	import {	3	import {
4	ControlPlaneBadRequestError,	4	ControlPlaneBadRequestError,
5	ControlPlaneForbiddenError,	5	ControlPlaneForbiddenError,
@@ -23,13 +23,13 @@ export const resolveRequestedLocalWorkspace = ( · 17 unmodified lines
23	workspaceId: WorkspaceId,	23	workspaceId: WorkspaceId,
24	) =>	24	) =>
25	Effect.flatMap(ControlPlaneExecutor, (executor) =>	25	Effect.flatMap(ControlPlaneExecutor, (executor) =>
26	executor.workspaceId === workspaceId	26	executor.scopeId === workspaceId
27	? Effect.succeed(executor)	27	? Effect.succeed(executor)
28	: Effect.fail(	28	: Effect.fail(
29	new ControlPlaneForbiddenError({	29	new ControlPlaneForbiddenError({
30	operation,	30	operation,
31	message: "Requested workspace is not the active local workspace",	31	message: "Requested workspace is not the active local workspace",
32	details: `requestedWorkspaceId=${workspaceId} activeWorkspaceId=${executor.workspaceId}`,	32	details: `requestedWorkspaceId=${workspaceId} activeWorkspaceId=${executor.scopeId}`,
33	}),	33	}),
34	),	34	),
35	);	35	);

packages/platform/api/src/oauth/api.ts+1−1

@@ -4,7 +4,7 @@ import { · 3 unmodified lines
4	SourceAuthSessionIdSchema,	4	SourceAuthSessionIdSchema,
5	SourceTransportSchema,	5	SourceTransportSchema,
6	StringMapSchema,	6	StringMapSchema,
7	WorkspaceIdSchema,	7	ScopeIdSchema as WorkspaceIdSchema,
8	} from "@executor/platform-sdk/schema";	8	} from "@executor/platform-sdk/schema";
9	import * as Schema from "effect/Schema";	9	import * as Schema from "effect/Schema";
10		10

packages/platform/api/src/oauth/http.ts+1−1

@@ -3,7 +3,7 @@ import { · 2 unmodified lines
3	HttpServerRequest,	3	HttpServerRequest,
4	HttpServerResponse,	4	HttpServerResponse,
5	} from "@effect/platform";	5	} from "@effect/platform";
6	import type { WorkspaceId } from "@executor/platform-sdk/schema";	6	import type { ScopeId as WorkspaceId } from "@executor/platform-sdk/schema";
7	import * as Cause from "effect/Cause";	7	import * as Cause from "effect/Cause";
8	import * as Either from "effect/Either";	8	import * as Either from "effect/Either";
9	import * as Effect from "effect/Effect";	9	import * as Effect from "effect/Effect";

packages/platform/api/src/policies/api.ts+2−2

@@ -11,9 +11,9 @@ import { · 10 unmodified lines
11	ControlPlaneUnauthorizedError,	11	ControlPlaneUnauthorizedError,
12	} from "@executor/platform-sdk/errors";	12	} from "@executor/platform-sdk/errors";
13	import {	13	import {
14	LocalWorkspacePolicySchema,	14	LocalScopePolicySchema as LocalWorkspacePolicySchema,
15	PolicyIdSchema,	15	PolicyIdSchema,
16	WorkspaceIdSchema,	16	ScopeIdSchema as WorkspaceIdSchema,
17	} from "@executor/platform-sdk/schema";	17	} from "@executor/platform-sdk/schema";
18	import * as Schema from "effect/Schema";	18	import * as Schema from "effect/Schema";
19		19

packages/platform/api/src/sources/api.ts+6−6

@@ -5,13 +5,13 @@ import { · 4 unmodified lines
5	ConnectSourcePayloadSchema,	5	ConnectSourcePayloadSchema,
6	ConnectSourceResultSchema,	6	ConnectSourceResultSchema,
7	CreateSourcePayloadSchema,	7	CreateSourcePayloadSchema,
8	CreateWorkspaceOauthClientPayloadSchema,	8	CreateScopeOauthClientPayloadSchema as CreateWorkspaceOauthClientPayloadSchema,
9	CredentialOauthCompleteUrlParamsSchema,	9	CredentialOauthCompleteUrlParamsSchema,
10	CredentialPageUrlParamsSchema,	10	CredentialPageUrlParamsSchema,
11	CredentialSubmitPayloadSchema,	11	CredentialSubmitPayloadSchema,
12	DiscoverSourcePayloadSchema,	12	DiscoverSourcePayloadSchema,
13	UpdateSourcePayloadSchema,	13	UpdateSourcePayloadSchema,
14	WorkspaceOauthClientQuerySchema,	14	ScopeOauthClientQuerySchema as WorkspaceOauthClientQuerySchema,
15	} from "@executor/platform-sdk/contracts";	15	} from "@executor/platform-sdk/contracts";
16	import {	16	import {
17	ControlPlaneBadRequestError,	17	ControlPlaneBadRequestError,
@@ -29,9 +29,9 @@ import { · 11 unmodified lines
29	SourceInspectionSchema,	29	SourceInspectionSchema,
30	SourceInspectionToolDetailSchema,	30	SourceInspectionToolDetailSchema,
31	SourceSchema,	31	SourceSchema,
32	WorkspaceOauthClientIdSchema,	32	ScopeOauthClientIdSchema as WorkspaceOauthClientIdSchema,
33	WorkspaceOauthClientSchema,	33	ScopeOauthClientSchema as WorkspaceOauthClientSchema,
34	WorkspaceIdSchema,	34	ScopeIdSchema as WorkspaceIdSchema,
35	} from "@executor/platform-sdk/schema";	35	} from "@executor/platform-sdk/schema";
36	import * as Schema from "effect/Schema";	36	import * as Schema from "effect/Schema";
37		37
@@ -41,7 +41,7 @@ export type { · 3 unmodified lines
41	ConnectSourcePayload,	41	ConnectSourcePayload,
42	ConnectSourceResult,	42	ConnectSourceResult,
43	CreateSourcePayload,	43	CreateSourcePayload,
44	CreateWorkspaceOauthClientPayload,	44	CreateScopeOauthClientPayload as CreateWorkspaceOauthClientPayload,
45	DiscoverSourcePayload,	45	DiscoverSourcePayload,
46	UpdateSourcePayload,	46	UpdateSourcePayload,
47	} from "@executor/platform-sdk/contracts";	47	} from "@executor/platform-sdk/contracts";

packages/platform/api/src/sources/http.ts+6−6

@@ -6,8 +6,8 @@ import { · 5 unmodified lines
6	import type {	6	import type {
7	ExecutionInteraction,	7	ExecutionInteraction,
8	Source,	8	Source,
9	WorkspaceId,	9	ScopeId as WorkspaceId,
10	WorkspaceOauthClient,	10	ScopeOauthClient as WorkspaceOauthClient,
11	} from "@executor/platform-sdk/schema";	11	} from "@executor/platform-sdk/schema";
12	import type {	12	import type {
13	ExecutorMcpSourceInput,	13	ExecutorMcpSourceInput,
@@ -18,7 +18,7 @@ import * as Effect from "effect/Effect"; · 4 unmodified lines
18	import {	18	import {
19	sourceAdapterRequiresInteractiveConnect,	19	sourceAdapterRequiresInteractiveConnect,
20	} from "@executor/platform-sdk/runtime";	20	} from "@executor/platform-sdk/runtime";
21	import { WorkspaceOauthClientIdSchema } from "@executor/platform-sdk/schema";	21	import { ScopeOauthClientIdSchema as WorkspaceOauthClientIdSchema } from "@executor/platform-sdk/schema";
22		22
23	import {	23	import {
24	ControlPlaneBadRequestError,	24	ControlPlaneBadRequestError,
@@ -130,8 +130,8 @@ const toExecutorSourceInput = ( · 105 unmodified lines
130	version: payload.version,	130	version: payload.version,
131	discoveryUrl: payload.discoveryUrl,	131	discoveryUrl: payload.discoveryUrl,
132	scopes: payload.scopes,	132	scopes: payload.scopes,
133	workspaceOauthClientId: toWorkspaceOauthClientId(	133	scopeOauthClientId: toWorkspaceOauthClientId(
134	payload.workspaceOauthClientId,	134	payload.scopeOauthClientId,
135	),	135	),
136	oauthClient: payload.oauthClient,	136	oauthClient: payload.oauthClient,
137	name: payload.name,	137	name: payload.name,
@@ -1137,7 +1137,7 @@ export const ExecutorSourcesLive = HttpApiBuilder.group( · 999 unmodified lines
1137	Effect.flatMap((executor) =>	1137	Effect.flatMap((executor) =>
1138	Effect.gen(function* () {	1138	Effect.gen(function* () {
1139	const completed = yield* executor.effect.oauth.completeProviderCallback({	1139	const completed = yield* executor.effect.oauth.completeProviderCallback({
1140	workspaceId: path.workspaceId,	1140	scopeId: path.workspaceId,
1141	state: urlParams.state,	1141	state: urlParams.state,
1142	code: urlParams.code,	1142	code: urlParams.code,
1143	error: urlParams.error,	1143	error: urlParams.error,

packages/platform/internal/src/tools/executor-admin.ts+103−103

@@ -1,9 +1,9 @@
1	import { toTool, type ToolMap } from "@executor/codemode-core";	1	import { toTool, type ToolMap } from "@executor/codemode-core";
2	import type { Executor } from "@executor/platform-sdk";	2	import type { Executor } from "@executor/platform-sdk";
3	import {	3	import {
4	type AccountId,	4	type ScopeId as AccountId,
5	LocalInstallationSchema,	5	LocalInstallationSchema,
6	LocalWorkspacePolicySchema,	6	LocalScopePolicySchema,
7	SourceDiscoveryResultSchema,	7	SourceDiscoveryResultSchema,
8	SourceIdSchema,	8	SourceIdSchema,
9	SourceInspectionDiscoverPayloadSchema,	9	SourceInspectionDiscoverPayloadSchema,
@@ -11,8 +11,8 @@ import { · 1 unmodified line
11	SourceInspectionSchema,	11	SourceInspectionSchema,
12	SourceInspectionToolDetailSchema,	12	SourceInspectionToolDetailSchema,
13	SourceSchema,	13	SourceSchema,
14	type WorkspaceId,	14	type ScopeId as WorkspaceId,
15	WorkspaceOauthClientSchema,	15	ScopeOauthClientSchema,
16	} from "@executor/platform-sdk/schema";	16	} from "@executor/platform-sdk/schema";
17	import * as Effect from "effect/Effect";	17	import * as Effect from "effect/Effect";
18	import * as Layer from "effect/Layer";	18	import * as Layer from "effect/Layer";
@@ -25,25 +25,25 @@ import { · 6 unmodified lines
25	SecretMaterialStorerService,	25	SecretMaterialStorerService,
26	SecretMaterialUpdaterService,	26	SecretMaterialUpdaterService,
27	type ExecutorStateStoreShape,	27	type ExecutorStateStoreShape,
28	type WorkspaceInternalToolContext,	28	type ScopeInternalToolContext as WorkspaceInternalToolContext,
29	RuntimeSourceAuthService,	29	RuntimeSourceAuthService,
30	RuntimeSourceCatalogSyncService,	30	RuntimeSourceCatalogSyncService,
31	RuntimeSourceStore,	31	RuntimeSourceStore,
32	RuntimeSourceStoreService,	32	RuntimeSourceStoreService,
33	} from "@executor/platform-sdk/runtime";	33	} from "@executor/platform-sdk/runtime";
34	import {	34	import {
35	type RuntimeLocalWorkspaceState,	35	type RuntimeLocalScopeState,
36	provideOptionalRuntimeLocalWorkspace,	36	provideOptionalRuntimeLocalScope,
37	} from "../../../sdk/src/runtime/workspace/runtime-context";	37	} from "../../../sdk/src/runtime/scope/runtime-context";
38	import {	38	import {
39	SourceArtifactStore,	39	SourceArtifactStore,
40	type SourceArtifactStoreShape,	40	type SourceArtifactStoreShape,
41	WorkspaceConfigStore,	41	ScopeConfigStore,
42	type WorkspaceConfigStoreShape,	42	type ScopeConfigStoreShape,
43	WorkspaceStateStore,	43	ScopeStateStore,
44	type WorkspaceStateStoreShape,	44	type ScopeStateStoreShape,
45	makeWorkspaceStorageLayer,	45	makeScopeStorageLayer,
46	} from "../../../sdk/src/runtime/workspace/storage";	46	} from "../../../sdk/src/runtime/scope/storage";
47	import {	47	import {
48	CreateSecretPayloadSchema,	48	CreateSecretPayloadSchema,
49	CreateSecretResultSchema,	49	CreateSecretResultSchema,
@@ -81,9 +81,9 @@ import { · 31 unmodified lines
81	UpdatePolicyPayloadSchema,	81	UpdatePolicyPayloadSchema,
82	} from "@executor/platform-sdk/contracts";	82	} from "@executor/platform-sdk/contracts";
83	import {	83	import {
84	CreateWorkspaceOauthClientPayloadSchema,	84	CreateScopeOauthClientPayloadSchema,
85	DiscoverSourcePayloadSchema,	85	DiscoverSourcePayloadSchema,
86	type CreateWorkspaceOauthClientPayload,	86	type CreateScopeOauthClientPayload as CreateWorkspaceOauthClientPayload,
87	UpdateSourcePayloadSchema,	87	UpdateSourcePayloadSchema,
88	} from "@executor/platform-sdk/contracts";	88	} from "@executor/platform-sdk/contracts";
89		89
@@ -145,7 +145,7 @@ const inspectDiscoverInputSchema = Schema.standardSchemaV1( · 55 unmodified lines
145	}),	145	}),
146	);	146	);
147	const listPoliciesOutputSchema = Schema.standardSchemaV1(	147	const listPoliciesOutputSchema = Schema.standardSchemaV1(
148	Schema.Array(LocalWorkspacePolicySchema),	148	Schema.Array(LocalScopePolicySchema),
149	);	149	);
150	const policyIdInputSchema = Schema.standardSchemaV1(	150	const policyIdInputSchema = Schema.standardSchemaV1(
151	Schema.Struct({	151	Schema.Struct({
@@ -167,10 +167,10 @@ const workspaceOauthClientListInputSchema = Schema.standardSchemaV1( · 15 unmodified lines
167	}),	167	}),
168	);	168	);
169	const workspaceOauthClientListOutputSchema = Schema.standardSchemaV1(	169	const workspaceOauthClientListOutputSchema = Schema.standardSchemaV1(
170	Schema.Array(WorkspaceOauthClientSchema),	170	Schema.Array(ScopeOauthClientSchema),
171	);	171	);
172	const createWorkspaceOauthClientInputSchema = Schema.standardSchemaV1(	172	const createWorkspaceOauthClientInputSchema = Schema.standardSchemaV1(
173	CreateWorkspaceOauthClientPayloadSchema,	173	CreateScopeOauthClientPayloadSchema,
174	);	174	);
175	const removeWorkspaceOauthClientInputSchema = Schema.standardSchemaV1(	175	const removeWorkspaceOauthClientInputSchema = Schema.standardSchemaV1(
176	Schema.Struct({	176	Schema.Struct({
@@ -195,8 +195,8 @@ const sourceInspectionDiscoverOutputSchema = Schema.standardSchemaV1( · 18 unmodified lines
195	const sourceDiscoveryOutputSchema = Schema.standardSchemaV1(	195	const sourceDiscoveryOutputSchema = Schema.standardSchemaV1(
196	SourceDiscoveryResultSchema,	196	SourceDiscoveryResultSchema,
197	);	197	);
198	const localWorkspacePolicyOutputSchema = Schema.standardSchemaV1(	198	const localScopePolicyOutputSchema = Schema.standardSchemaV1(
199	LocalWorkspacePolicySchema,	199	LocalScopePolicySchema,
200	);	200	);
201		201
202	const makeRuntimeLayer = (input: {	202	const makeRuntimeLayer = (input: {
@@ -205,8 +205,8 @@ const makeRuntimeLayer = (input: { · 2 unmodified lines
205	sourceCatalogSyncService: Effect.Effect.Success<	205	sourceCatalogSyncService: Effect.Effect.Success<
206	typeof RuntimeSourceCatalogSyncService	206	typeof RuntimeSourceCatalogSyncService
207	>;	207	>;
208	workspaceConfigStore: WorkspaceConfigStoreShape;	208	scopeConfigStore: ScopeConfigStoreShape;
209	workspaceStateStore: WorkspaceStateStoreShape;	209	scopeStateStore: ScopeStateStoreShape;
210	sourceArtifactStore: SourceArtifactStoreShape;	210	sourceArtifactStore: SourceArtifactStoreShape;
211	instanceConfigResolver: WorkspaceInternalToolContext["instanceConfigResolver"];	211	instanceConfigResolver: WorkspaceInternalToolContext["instanceConfigResolver"];
212	storeSecretMaterial: WorkspaceInternalToolContext["storeSecretMaterial"];	212	storeSecretMaterial: WorkspaceInternalToolContext["storeSecretMaterial"];
@@ -224,9 +224,9 @@ const makeRuntimeLayer = (input: { · 11 unmodified lines
224	Layer.succeed(SecretMaterialStorerService, input.storeSecretMaterial),	224	Layer.succeed(SecretMaterialStorerService, input.storeSecretMaterial),
225	Layer.succeed(SecretMaterialDeleterService, input.deleteSecretMaterial),	225	Layer.succeed(SecretMaterialDeleterService, input.deleteSecretMaterial),
226	Layer.succeed(SecretMaterialUpdaterService, input.updateSecretMaterial),	226	Layer.succeed(SecretMaterialUpdaterService, input.updateSecretMaterial),
227	makeWorkspaceStorageLayer({	227	makeScopeStorageLayer({
228	workspaceConfigStore: input.workspaceConfigStore,	228	scopeConfigStore: input.scopeConfigStore,
229	workspaceStateStore: input.workspaceStateStore,	229	scopeStateStore: input.scopeStateStore,
230	sourceArtifactStore: input.sourceArtifactStore,	230	sourceArtifactStore: input.sourceArtifactStore,
231	}),	231	}),
232	);	232	);
@@ -241,34 +241,34 @@ const runRuntimeEffect = <A, E, R>(input: { · 8 unmodified lines
241	\| SecretMaterialStorerService	241	\| SecretMaterialStorerService
242	\| SecretMaterialDeleterService	242	\| SecretMaterialDeleterService
243	\| SecretMaterialUpdaterService	243	\| SecretMaterialUpdaterService
244	\| WorkspaceConfigStore	244	\| ScopeConfigStore
245	\| WorkspaceStateStore	245	\| ScopeStateStore
246	\| SourceArtifactStore,	246	\| SourceArtifactStore,
247	never,	247	never,
248	never	248	never
249	>;	249	>;
250	runtimeLocalWorkspace: RuntimeLocalWorkspaceState \| null;	250	runtimeLocalScope: RuntimeLocalScopeState \| null;
251	}) =>	251	}) =>
252	Effect.runPromise(	252	Effect.runPromise(
253	provideOptionalRuntimeLocalWorkspace(	253	provideOptionalRuntimeLocalScope(
254	input.effect.pipe(Effect.provide(input.runtimeLayer)),	254	input.effect.pipe(Effect.provide(input.runtimeLayer)),
255	input.runtimeLocalWorkspace,	255	input.runtimeLocalScope,
256	) as Effect.Effect<A, E, never>,	256	) as Effect.Effect<A, E, never>,
257	);	257	);
258		258
259	const runWorkspaceStorageEffect = <A, E, R>(input: {	259	const runScopeStorageEffect = <A, E, R>(input: {
260	effect: Effect.Effect<A, E, R>;	260	effect: Effect.Effect<A, E, R>;
261	workspaceStorageLayer: Layer.Layer<	261	scopeStorageLayer: Layer.Layer<
262	WorkspaceConfigStore \| WorkspaceStateStore \| SourceArtifactStore,	262	ScopeConfigStore \| ScopeStateStore \| SourceArtifactStore,
263	never,	263	never,
264	never	264	never
265	>;	265	>;
266	runtimeLocalWorkspace: RuntimeLocalWorkspaceState \| null;	266	runtimeLocalScope: RuntimeLocalScopeState \| null;
267	}) =>	267	}) =>
268	Effect.runPromise(	268	Effect.runPromise(
269	provideOptionalRuntimeLocalWorkspace(	269	provideOptionalRuntimeLocalScope(
270	input.effect.pipe(Effect.provide(input.workspaceStorageLayer)),	270	input.effect.pipe(Effect.provide(input.scopeStorageLayer)),
271	input.runtimeLocalWorkspace,	271	input.runtimeLocalScope,
272	) as Effect.Effect<A, E, never>,	272	) as Effect.Effect<A, E, never>,
273	);	273	);
274		274
@@ -279,17 +279,17 @@ export const createWorkspaceExecutorAdminToolMap = ( · 4 unmodified lines
279	executorStateStore: input.executorStateStore,	279	executorStateStore: input.executorStateStore,
280	sourceStore: input.sourceStore,	280	sourceStore: input.sourceStore,
281	sourceCatalogSyncService: input.sourceCatalogSyncService,	281	sourceCatalogSyncService: input.sourceCatalogSyncService,
282	workspaceConfigStore: input.workspaceConfigStore,	282	scopeConfigStore: input.scopeConfigStore,
283	workspaceStateStore: input.workspaceStateStore,	283	scopeStateStore: input.scopeStateStore,
284	sourceArtifactStore: input.sourceArtifactStore,	284	sourceArtifactStore: input.sourceArtifactStore,
285	instanceConfigResolver: input.instanceConfigResolver,	285	instanceConfigResolver: input.instanceConfigResolver,
286	storeSecretMaterial: input.storeSecretMaterial,	286	storeSecretMaterial: input.storeSecretMaterial,
287	deleteSecretMaterial: input.deleteSecretMaterial,	287	deleteSecretMaterial: input.deleteSecretMaterial,
288	updateSecretMaterial: input.updateSecretMaterial,	288	updateSecretMaterial: input.updateSecretMaterial,
289	});	289	});
290	const workspaceStorageLayer = makeWorkspaceStorageLayer({	290	const scopeStorageLayer = makeScopeStorageLayer({
291	workspaceConfigStore: input.workspaceConfigStore,	291	scopeConfigStore: input.scopeConfigStore,
292	workspaceStateStore: input.workspaceStateStore,	292	scopeStateStore: input.scopeStateStore,
293	sourceArtifactStore: input.sourceArtifactStore,	293	sourceArtifactStore: input.sourceArtifactStore,
294	});	294	});
295		295
@@ -306,8 +306,8 @@ export const createWorkspaceExecutorAdminToolMap = ( · 10 unmodified lines
306	inputSchema: emptyInputSchema,	306	inputSchema: emptyInputSchema,
307	outputSchema: localInstallationOutputSchema,	307	outputSchema: localInstallationOutputSchema,
308	execute: async () => ({	308	execute: async () => ({
309	workspaceId: input.workspaceId,	309	scopeId: input.scopeId,
310	accountId: input.accountId,	310	actorScopeId: input.actorScopeId,
311	}),	311	}),
312	},	312	},
313	metadata,	313	metadata,
@@ -332,7 +332,7 @@ export const createWorkspaceExecutorAdminToolMap = ( · 18 unmodified lines
332	runRuntimeEffect({	332	runRuntimeEffect({
333	effect: listLocalSecrets(),	333	effect: listLocalSecrets(),
334	runtimeLayer,	334	runtimeLayer,
335	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	335	runtimeLocalScope: input.runtimeLocalScope,
336	}),	336	}),
337	},	337	},
338	metadata,	338	metadata,
@@ -347,7 +347,7 @@ export const createWorkspaceExecutorAdminToolMap = ( · 8 unmodified lines
347	runRuntimeEffect({	347	runRuntimeEffect({
348	effect: createLocalSecret(payload),	348	effect: createLocalSecret(payload),
349	runtimeLayer,	349	runtimeLayer,
350	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	350	runtimeLocalScope: input.runtimeLocalScope,
351	}),	351	}),
352	},	352	},
353	metadata,	353	metadata,
@@ -365,7 +365,7 @@ export const createWorkspaceExecutorAdminToolMap = ( · 11 unmodified lines
365	runRuntimeEffect({	365	runRuntimeEffect({
366	effect: updateLocalSecret(payload),	366	effect: updateLocalSecret(payload),
367	runtimeLayer,	367	runtimeLayer,
368	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	368	runtimeLocalScope: input.runtimeLocalScope,
369	}),	369	}),
370	},	370	},
371	metadata,	371	metadata,
@@ -379,7 +379,7 @@ export const createWorkspaceExecutorAdminToolMap = ( · 7 unmodified lines
379	runRuntimeEffect({	379	runRuntimeEffect({
380	effect: deleteLocalSecret(secretId),	380	effect: deleteLocalSecret(secretId),
381	runtimeLayer,	381	runtimeLayer,
382	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	382	runtimeLocalScope: input.runtimeLocalScope,
383	}),	383	}),
384	},	384	},
385	metadata,	385	metadata,
@@ -408,11 +408,11 @@ export const createWorkspaceExecutorAdminToolMap = ( · 22 unmodified lines
408	execute: () =>	408	execute: () =>
409	runRuntimeEffect({	409	runRuntimeEffect({
410	effect: listSources({	410	effect: listSources({
411	workspaceId: input.workspaceId,	411	scopeId: input.scopeId,
412	accountId: input.accountId as never,	412	actorScopeId: input.actorScopeId as never,
413	}),	413	}),
414	runtimeLayer,	414	runtimeLayer,
415	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	415	runtimeLocalScope: input.runtimeLocalScope,
416	}),	416	}),
417	},	417	},
418	metadata,	418	metadata,
@@ -425,12 +425,12 @@ export const createWorkspaceExecutorAdminToolMap = ( · 6 unmodified lines
425	execute: ({ sourceId }: { sourceId: string }) =>	425	execute: ({ sourceId }: { sourceId: string }) =>
426	runRuntimeEffect({	426	runRuntimeEffect({
427	effect: getSource({	427	effect: getSource({
428	workspaceId: input.workspaceId,	428	scopeId: input.scopeId,
429	sourceId: sourceId as never,	429	sourceId: sourceId as never,
430	accountId: input.accountId as never,	430	actorScopeId: input.actorScopeId as never,
431	}),	431	}),
432	runtimeLayer,	432	runtimeLayer,
433	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	433	runtimeLocalScope: input.runtimeLocalScope,
434	}),	434	}),
435	},	435	},
436	metadata,	436	metadata,
@@ -446,13 +446,13 @@ export const createWorkspaceExecutorAdminToolMap = ( · 9 unmodified lines
446	}) =>	446	}) =>
447	runRuntimeEffect({	447	runRuntimeEffect({
448	effect: updateSource({	448	effect: updateSource({
449	workspaceId: input.workspaceId,	449	scopeId: input.scopeId,
450	sourceId: payload.sourceId as never,	450	sourceId: payload.sourceId as never,
451	accountId: input.accountId as never,	451	actorScopeId: input.actorScopeId as never,
452	payload: payload.payload as never,	452	payload: payload.payload as never,
453	}),	453	}),
454	runtimeLayer,	454	runtimeLayer,
455	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	455	runtimeLocalScope: input.runtimeLocalScope,
456	}),	456	}),
457	},	457	},
458	metadata,	458	metadata,
@@ -465,11 +465,11 @@ export const createWorkspaceExecutorAdminToolMap = ( · 6 unmodified lines
465	execute: ({ sourceId }: { sourceId: string }) =>	465	execute: ({ sourceId }: { sourceId: string }) =>
466	runRuntimeEffect({	466	runRuntimeEffect({
467	effect: removeSource({	467	effect: removeSource({
468	workspaceId: input.workspaceId,	468	scopeId: input.scopeId,
469	sourceId: sourceId as never,	469	sourceId: sourceId as never,
470	}),	470	}),
471	runtimeLayer,	471	runtimeLayer,
472	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	472	runtimeLocalScope: input.runtimeLocalScope,
473	}),	473	}),
474	},	474	},
475	metadata,	475	metadata,
@@ -482,11 +482,11 @@ export const createWorkspaceExecutorAdminToolMap = ( · 6 unmodified lines
482	execute: ({ sourceId }: { sourceId: string }) =>	482	execute: ({ sourceId }: { sourceId: string }) =>
483	runRuntimeEffect({	483	runRuntimeEffect({
484	effect: getSourceInspection({	484	effect: getSourceInspection({
485	workspaceId: input.workspaceId,	485	scopeId: input.scopeId,
486	sourceId: sourceId as never,	486	sourceId: sourceId as never,
487	}),	487	}),
488	runtimeLayer,	488	runtimeLayer,
489	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	489	runtimeLocalScope: input.runtimeLocalScope,
490	}),	490	}),
491	},	491	},
492	metadata,	492	metadata,
@@ -505,12 +505,12 @@ export const createWorkspaceExecutorAdminToolMap = ( · 12 unmodified lines
505	}) =>	505	}) =>
506	runRuntimeEffect({	506	runRuntimeEffect({
507	effect: getSourceInspectionToolDetail({	507	effect: getSourceInspectionToolDetail({
508	workspaceId: input.workspaceId,	508	scopeId: input.scopeId,
509	sourceId: sourceId as never,	509	sourceId: sourceId as never,
510	toolPath,	510	toolPath,
511	}),	511	}),
512	runtimeLayer,	512	runtimeLayer,
513	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	513	runtimeLocalScope: input.runtimeLocalScope,
514	}),	514	}),
515	},	515	},
516	metadata,	516	metadata,
@@ -529,12 +529,12 @@ export const createWorkspaceExecutorAdminToolMap = ( · 12 unmodified lines
529	}) =>	529	}) =>
530	runRuntimeEffect({	530	runRuntimeEffect({
531	effect: discoverSourceInspectionTools({	531	effect: discoverSourceInspectionTools({
532	workspaceId: input.workspaceId,	532	scopeId: input.scopeId,
533	sourceId: sourceId as never,	533	sourceId: sourceId as never,
534	payload: payload as never,	534	payload: payload as never,
535	}),	535	}),
536	runtimeLayer,	536	runtimeLayer,
537	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	537	runtimeLocalScope: input.runtimeLocalScope,
538	}),	538	}),
539	},	539	},
540	metadata,	540	metadata,
@@ -545,13 +545,13 @@ export const createWorkspaceExecutorAdminToolMap = ( · 4 unmodified lines
545	inputSchema: workspaceOauthClientListInputSchema,	545	inputSchema: workspaceOauthClientListInputSchema,
546	outputSchema: workspaceOauthClientListOutputSchema,	546	outputSchema: workspaceOauthClientListOutputSchema,
547	execute: ({ providerKey }: { providerKey: string }) =>	547	execute: ({ providerKey }: { providerKey: string }) =>
548	runWorkspaceStorageEffect({	548	runScopeStorageEffect({
549	effect: input.sourceAuthService.listWorkspaceOauthClients({	549	effect: input.sourceAuthService.listScopeOauthClients({
550	workspaceId: input.workspaceId,	550	scopeId: input.scopeId,
551	providerKey,	551	providerKey,
552	}),	552	}),
553	workspaceStorageLayer,	553	scopeStorageLayer,
554	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	554	runtimeLocalScope: input.runtimeLocalScope,
555	}),	555	}),
556	},	556	},
557	metadata,	557	metadata,
@@ -561,17 +561,17 @@ export const createWorkspaceExecutorAdminToolMap = ( · 3 unmodified lines
561	description:	561	description:
562	"Create a workspace OAuth client used for shared provider auth flows.",	562	"Create a workspace OAuth client used for shared provider auth flows.",
563	inputSchema: createWorkspaceOauthClientInputSchema,	563	inputSchema: createWorkspaceOauthClientInputSchema,
564	outputSchema: Schema.standardSchemaV1(WorkspaceOauthClientSchema),	564	outputSchema: Schema.standardSchemaV1(ScopeOauthClientSchema),
565	execute: (payload: CreateWorkspaceOauthClientPayload) =>	565	execute: (payload: CreateWorkspaceOauthClientPayload) =>
566	runWorkspaceStorageEffect({	566	runScopeStorageEffect({
567	effect: input.sourceAuthService.createWorkspaceOauthClient({	567	effect: input.sourceAuthService.createScopeOauthClient({
568	workspaceId: input.workspaceId,	568	scopeId: input.scopeId,
569	providerKey: payload.providerKey,	569	providerKey: payload.providerKey,
570	label: payload.label,	570	label: payload.label,
571	oauthClient: payload.oauthClient,	571	oauthClient: payload.oauthClient,
572	}),	572	}),
573	workspaceStorageLayer,	573	scopeStorageLayer,
574	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	574	runtimeLocalScope: input.runtimeLocalScope,
575	}),	575	}),
576	},	576	},
577	metadata,	577	metadata,
@@ -582,15 +582,15 @@ export const createWorkspaceExecutorAdminToolMap = ( · 4 unmodified lines
582	inputSchema: removeWorkspaceOauthClientInputSchema,	582	inputSchema: removeWorkspaceOauthClientInputSchema,
583	outputSchema: removeResultSchema,	583	outputSchema: removeResultSchema,
584	execute: ({ oauthClientId }: { oauthClientId: string }) =>	584	execute: ({ oauthClientId }: { oauthClientId: string }) =>
585	runWorkspaceStorageEffect({	585	runScopeStorageEffect({
586	effect: input.sourceAuthService	586	effect: input.sourceAuthService
587	.removeWorkspaceOauthClient({	587	.removeScopeOauthClient({
588	workspaceId: input.workspaceId,	588	scopeId: input.scopeId,
589	oauthClientId: oauthClientId as never,	589	oauthClientId: oauthClientId as never,
590	})	590	})
591	.pipe(Effect.map((removed) => ({ removed }))),	591	.pipe(Effect.map((removed) => ({ removed }))),
592	workspaceStorageLayer,	592	scopeStorageLayer,
593	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	593	runtimeLocalScope: input.runtimeLocalScope,
594	}),	594	}),
595	},	595	},
596	metadata,	596	metadata,
@@ -602,15 +602,15 @@ export const createWorkspaceExecutorAdminToolMap = ( · 5 unmodified lines
602	inputSchema: removeProviderGrantInputSchema,	602	inputSchema: removeProviderGrantInputSchema,
603	outputSchema: removeResultSchema,	603	outputSchema: removeResultSchema,
604	execute: ({ grantId }: { grantId: string }) =>	604	execute: ({ grantId }: { grantId: string }) =>
605	runWorkspaceStorageEffect({	605	runScopeStorageEffect({
606	effect: input.sourceAuthService	606	effect: input.sourceAuthService
607	.removeProviderAuthGrant({	607	.removeProviderAuthGrant({
608	workspaceId: input.workspaceId,	608	scopeId: input.scopeId,
609	grantId: grantId as never,	609	grantId: grantId as never,
610	})	610	})
611	.pipe(Effect.map((removed) => ({ removed }))),	611	.pipe(Effect.map((removed) => ({ removed }))),
612	workspaceStorageLayer,	612	scopeStorageLayer,
613	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	613	runtimeLocalScope: input.runtimeLocalScope,
614	}),	614	}),
615	},	615	},
616	metadata,	616	metadata,
@@ -622,9 +622,9 @@ export const createWorkspaceExecutorAdminToolMap = ( · 5 unmodified lines
622	outputSchema: listPoliciesOutputSchema,	622	outputSchema: listPoliciesOutputSchema,
623	execute: () =>	623	execute: () =>
624	runRuntimeEffect({	624	runRuntimeEffect({
625	effect: listPolicies(input.workspaceId),	625	effect: listPolicies(input.scopeId),
626	runtimeLayer,	626	runtimeLayer,
627	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	627	runtimeLocalScope: input.runtimeLocalScope,
628	}),	628	}),
629	},	629	},
630	metadata,	630	metadata,
@@ -633,15 +633,15 @@ export const createWorkspaceExecutorAdminToolMap = ( · 2 unmodified lines
633	tool: {	633	tool: {
634	description: "Create a local workspace policy.",	634	description: "Create a local workspace policy.",
635	inputSchema: createPolicyInputSchema,	635	inputSchema: createPolicyInputSchema,
636	outputSchema: localWorkspacePolicyOutputSchema,	636	outputSchema: localScopePolicyOutputSchema,
637	execute: (payload: CreatePolicyPayload) =>	637	execute: (payload: CreatePolicyPayload) =>
638	runRuntimeEffect({	638	runRuntimeEffect({
639	effect: createPolicy({	639	effect: createPolicy({
640	workspaceId: input.workspaceId,	640	scopeId: input.scopeId,
641	payload,	641	payload,
642	}),	642	}),
643	runtimeLayer,	643	runtimeLayer,
644	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	644	runtimeLocalScope: input.runtimeLocalScope,
645	}),	645	}),
646	},	646	},
647	metadata,	647	metadata,
@@ -650,15 +650,15 @@ export const createWorkspaceExecutorAdminToolMap = ( · 2 unmodified lines
650	tool: {	650	tool: {
651	description: "Get one local workspace policy by id.",	651	description: "Get one local workspace policy by id.",
652	inputSchema: policyIdInputSchema,	652	inputSchema: policyIdInputSchema,
653	outputSchema: localWorkspacePolicyOutputSchema,	653	outputSchema: localScopePolicyOutputSchema,
654	execute: ({ policyId }: { policyId: string }) =>	654	execute: ({ policyId }: { policyId: string }) =>
655	runRuntimeEffect({	655	runRuntimeEffect({
656	effect: getPolicy({	656	effect: getPolicy({
657	workspaceId: input.workspaceId,	657	scopeId: input.scopeId,
658	policyId: policyId as never,	658	policyId: policyId as never,
659	}),	659	}),
660	runtimeLayer,	660	runtimeLayer,
661	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	661	runtimeLocalScope: input.runtimeLocalScope,
662	}),	662	}),
663	},	663	},
664	metadata,	664	metadata,
@@ -667,7 +667,7 @@ export const createWorkspaceExecutorAdminToolMap = ( · 2 unmodified lines
667	tool: {	667	tool: {
668	description: "Update a local workspace policy.",	668	description: "Update a local workspace policy.",
669	inputSchema: updatePolicyInputSchema,	669	inputSchema: updatePolicyInputSchema,
670	outputSchema: localWorkspacePolicyOutputSchema,	670	outputSchema: localScopePolicyOutputSchema,
671	execute: ({	671	execute: ({
672	policyId,	672	policyId,
673	payload,	673	payload,
@@ -677,12 +677,12 @@ export const createWorkspaceExecutorAdminToolMap = ( · 3 unmodified lines
677	}) =>	677	}) =>
678	runRuntimeEffect({	678	runRuntimeEffect({
679	effect: updatePolicy({	679	effect: updatePolicy({
680	workspaceId: input.workspaceId,	680	scopeId: input.scopeId,
681	policyId: policyId as never,	681	policyId: policyId as never,
682	payload,	682	payload,
683	}),	683	}),
684	runtimeLayer,	684	runtimeLayer,
685	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	685	runtimeLocalScope: input.runtimeLocalScope,
686	}),	686	}),
687	},	687	},
688	metadata,	688	metadata,
@@ -695,11 +695,11 @@ export const createWorkspaceExecutorAdminToolMap = ( · 6 unmodified lines
695	execute: ({ policyId }: { policyId: string }) =>	695	execute: ({ policyId }: { policyId: string }) =>
696	runRuntimeEffect({	696	runRuntimeEffect({
697	effect: removePolicy({	697	effect: removePolicy({
698	workspaceId: input.workspaceId,	698	scopeId: input.scopeId,
699	policyId: policyId as never,	699	policyId: policyId as never,
700	}),	700	}),
701	runtimeLayer,	701	runtimeLayer,
702	runtimeLocalWorkspace: input.runtimeLocalWorkspace,	702	runtimeLocalScope: input.runtimeLocalScope,
703	}),	703	}),
704	},	704	},
705	metadata,	705	metadata,
@@ -903,7 +903,7 @@ export const createExecutorAdminToolMap = (input: { · 197 unmodified lines
903	description:	903	description:
904	"Create a workspace OAuth client for a provider-backed source flow.",	904	"Create a workspace OAuth client for a provider-backed source flow.",
905	inputSchema: createWorkspaceOauthClientInputSchema,	905	inputSchema: createWorkspaceOauthClientInputSchema,
906	outputSchema: Schema.standardSchemaV1(WorkspaceOauthClientSchema),	906	outputSchema: Schema.standardSchemaV1(ScopeOauthClientSchema),
907	execute: (payload: CreateWorkspaceOauthClientPayload) =>	907	execute: (payload: CreateWorkspaceOauthClientPayload) =>
908	input.executor.sources.oauthClients.create(payload),	908	input.executor.sources.oauthClients.create(payload),
909	},	909	},
@@ -952,7 +952,7 @@ export const createExecutorAdminToolMap = (input: { · 42 unmodified lines
952	tool: {	952	tool: {
953	description: "Create a local workspace policy.",	953	description: "Create a local workspace policy.",
954	inputSchema: createPolicyInputSchema,	954	inputSchema: createPolicyInputSchema,
955	outputSchema: localWorkspacePolicyOutputSchema,	955	outputSchema: localScopePolicyOutputSchema,
956	execute: (payload: CreatePolicyPayload) =>	956	execute: (payload: CreatePolicyPayload) =>
957	input.executor.policies.create(payload),	957	input.executor.policies.create(payload),
958	},	958	},
@@ -962,7 +962,7 @@ export const createExecutorAdminToolMap = (input: { · 3 unmodified lines
962	tool: {	962	tool: {
963	description: "Get one local workspace policy by id.",	963	description: "Get one local workspace policy by id.",
964	inputSchema: policyIdInputSchema,	964	inputSchema: policyIdInputSchema,
965	outputSchema: localWorkspacePolicyOutputSchema,	965	outputSchema: localScopePolicyOutputSchema,
966	execute: ({ policyId }: { policyId: string }) =>	966	execute: ({ policyId }: { policyId: string }) =>
967	input.executor.policies.get(policyId),	967	input.executor.policies.get(policyId),
968	},	968	},
@@ -972,7 +972,7 @@ export const createExecutorAdminToolMap = (input: { · 3 unmodified lines
972	tool: {	972	tool: {
973	description: "Update a local workspace policy.",	973	description: "Update a local workspace policy.",
974	inputSchema: updatePolicyInputSchema,	974	inputSchema: updatePolicyInputSchema,
975	outputSchema: localWorkspacePolicyOutputSchema,	975	outputSchema: localScopePolicyOutputSchema,
976	execute: ({	976	execute: ({
977	policyId,	977	policyId,
978	payload,	978	payload,

packages/platform/sdk-file/src/config.test.ts+1−1

@@ -34,7 +34,7 @@ describe("local-config", () => { · 33 unmodified lines
34	join(configDirectory, "executor.jsonc"),	34	join(configDirectory, "executor.jsonc"),
35	`{	35	`{
36	"runtime": "ses",	36	"runtime": "ses",
37	// local workspace config	37	// local scope config
38	"sources": {	38	"sources": {
39	"github": {	39	"github": {
40	"kind": "openapi",	40	"kind": "openapi",

packages/platform/sdk-file/src/config.ts+5−5

@@ -16,8 +16,8 @@ import { · 15 unmodified lines
16	} from "@executor/platform-sdk/schema";	16	} from "@executor/platform-sdk/schema";
17	import * as Effect from "effect/Effect";	17	import * as Effect from "effect/Effect";
18	import * as Schema from "effect/Schema";	18	import * as Schema from "effect/Schema";
19	import type { ExecutorWorkspaceDescriptor } from "@executor/platform-sdk";	19	import type { ExecutorScopeDescriptor } from "@executor/platform-sdk";
20	import type { LoadedLocalExecutorConfig } from "../../sdk/src/runtime/workspace-config";	20	import type { LoadedLocalExecutorConfig } from "../../sdk/src/runtime/scope-config";
21	import {	21	import {
22	LocalExecutorConfigDecodeError,	22	LocalExecutorConfigDecodeError,
23	LocalFileSystemError,	23	LocalFileSystemError,
@@ -36,7 +36,7 @@ export const encodeLocalExecutorConfig = (config: LocalExecutorConfig): string = · 12 unmodified lines
36		36
37	export const resolveConfigRelativePath = (input: {	37	export const resolveConfigRelativePath = (input: {
38	path: string;	38	path: string;
39	workspaceRoot: string;	39	scopeRoot: string;
40	}): string => {	40	}): string => {
41	const trimmed = input.path.trim();	41	const trimmed = input.path.trim();
42	if (trimmed.startsWith("~/")) {	42	if (trimmed.startsWith("~/")) {
@@ -48,10 +48,10 @@ export const resolveConfigRelativePath = (input: { · 5 unmodified lines
48	if (isAbsolute(trimmed)) {	48	if (isAbsolute(trimmed)) {
49	return trimmed;	49	return trimmed;
50	}	50	}
51	return resolve(input.workspaceRoot, trimmed);	51	return resolve(input.scopeRoot, trimmed);
52	};	52	};
53		53
54	export type { LoadedLocalExecutorConfig } from "../../sdk/src/runtime/workspace-config";	54	export type { LoadedLocalExecutorConfig } from "../../sdk/src/runtime/scope-config";
55		55
56	const PROJECT_CONFIG_BASENAME = "executor.jsonc";	56	const PROJECT_CONFIG_BASENAME = "executor.jsonc";
57	const PROJECT_CONFIG_DIRECTORY = ".executor";	57	const PROJECT_CONFIG_DIRECTORY = ".executor";

packages/platform/sdk-file/src/executor-state-store.test.ts+1−1

@@ -52,7 +52,7 @@ describe("local-executor-state-store", () => { · 51 unmodified lines
52	authArtifacts: [],	52	authArtifacts: [],
53	authLeases: [],	53	authLeases: [],
54	sourceOauthClients: [],	54	sourceOauthClients: [],
55	workspaceOauthClients: [],	55	scopeOauthClients: [],
56	providerAuthGrants: [],	56	providerAuthGrants: [],
57	sourceAuthSessions: [],	57	sourceAuthSessions: [],
58	secretMaterials: [],	58	secretMaterials: [],

packages/platform/sdk-file/src/executor-state-store.ts+95−95

@@ -20,10 +20,10 @@ import { · 19 unmodified lines
20	type SecretMaterial,	20	type SecretMaterial,
21	type SourceAuthSession,	21	type SourceAuthSession,
22	SourceAuthSessionSchema,	22	SourceAuthSessionSchema,
23	type WorkspaceOauthClient,	23	type ScopeOauthClient,
24	WorkspaceOauthClientSchema,	24	ScopeOauthClientSchema,
25	type WorkspaceSourceOauthClient,	25	type ScopedSourceOauthClient,
26	WorkspaceSourceOauthClientSchema,	26	ScopedSourceOauthClientSchema,
27	} from "@executor/platform-sdk/schema";	27	} from "@executor/platform-sdk/schema";
28	import * as Effect from "effect/Effect";	28	import * as Effect from "effect/Effect";
29	import * as Option from "effect/Option";	29	import * as Option from "effect/Option";
@@ -43,8 +43,8 @@ const LocalExecutorStateSnapshotSchema = Schema.Struct({ · 13 unmodified lines
43	version: Schema.Literal(LOCAL_EXECUTOR_STATE_VERSION),	43	version: Schema.Literal(LOCAL_EXECUTOR_STATE_VERSION),
44	authArtifacts: Schema.Array(AuthArtifactSchema),	44	authArtifacts: Schema.Array(AuthArtifactSchema),
45	authLeases: Schema.Array(AuthLeaseSchema),	45	authLeases: Schema.Array(AuthLeaseSchema),
46	sourceOauthClients: Schema.Array(WorkspaceSourceOauthClientSchema),	46	sourceOauthClients: Schema.Array(ScopedSourceOauthClientSchema),
47	workspaceOauthClients: Schema.Array(WorkspaceOauthClientSchema),	47	scopeOauthClients: Schema.Array(ScopeOauthClientSchema),
48	providerAuthGrants: Schema.Array(ProviderAuthGrantSchema),	48	providerAuthGrants: Schema.Array(ProviderAuthGrantSchema),
49	sourceAuthSessions: Schema.Array(SourceAuthSessionSchema),	49	sourceAuthSessions: Schema.Array(SourceAuthSessionSchema),
50	secretMaterials: Schema.Array(SecretMaterialSchema),	50	secretMaterials: Schema.Array(SecretMaterialSchema),
@@ -69,7 +69,7 @@ const defaultLocalExecutorStateSnapshot = (): LocalExecutorStateSnapshot => ({ · 18 unmodified lines
69	authArtifacts: [],	69	authArtifacts: [],
70	authLeases: [],	70	authLeases: [],
71	sourceOauthClients: [],	71	sourceOauthClients: [],
72	workspaceOauthClients: [],	72	scopeOauthClients: [],
73	providerAuthGrants: [],	73	providerAuthGrants: [],
74	sourceAuthSessions: [],	74	sourceAuthSessions: [],
75	secretMaterials: [],	75	secretMaterials: [],
@@ -114,7 +114,7 @@ const localExecutorStatePath = ( · 38 unmodified lines
114	join(	114	join(
115	context.homeStateDirectory,	115	context.homeStateDirectory,
116	"workspaces",	116	"workspaces",
117	deriveLocalInstallation(context).workspaceId,	117	deriveLocalInstallation(context).scopeId,
118	LOCAL_EXECUTOR_STATE_BASENAME,	118	LOCAL_EXECUTOR_STATE_BASENAME,
119	);	119	);
120		120
@@ -230,9 +230,9 @@ const mergeAuthArtifacts = ( · 109 unmodified lines
230	for (const artifact of imported) {	230	for (const artifact of imported) {
231	merged.set(	231	merged.set(
232	[	232	[
233	artifact.workspaceId,	233	artifact.scopeId,
234	artifact.sourceId,	234	artifact.sourceId,
235	artifact.actorAccountId ?? "",	235	artifact.actorScopeId ?? "",
236	artifact.slot,	236	artifact.slot,
237	].join("::"),	237	].join("::"),
238	cloneValue(artifact),	238	cloneValue(artifact),
@@ -242,9 +242,9 @@ const mergeAuthArtifacts = ( · 3 unmodified lines
242	for (const artifact of current) {	242	for (const artifact of current) {
243	merged.set(	243	merged.set(
244	[	244	[
245	artifact.workspaceId,	245	artifact.scopeId,
246	artifact.sourceId,	246	artifact.sourceId,
247	artifact.actorAccountId ?? "",	247	artifact.actorScopeId ?? "",
248	artifact.slot,	248	artifact.slot,
249	].join("::"),	249	].join("::"),
250	cloneValue(artifact),	250	cloneValue(artifact),
@@ -255,14 +255,14 @@ const mergeAuthArtifacts = ( · 4 unmodified lines
255	};	255	};
256		256
257	const mergeSourceOauthClients = (	257	const mergeSourceOauthClients = (
258	current: readonly WorkspaceSourceOauthClient[],	258	current: readonly ScopedSourceOauthClient[],
259	imported: readonly WorkspaceSourceOauthClient[],	259	imported: readonly ScopedSourceOauthClient[],
260	): WorkspaceSourceOauthClient[] => {	260	): ScopedSourceOauthClient[] => {
261	const merged = new Map<string, WorkspaceSourceOauthClient>();	261	const merged = new Map<string, ScopedSourceOauthClient>();
262		262
263	for (const oauthClient of imported) {	263	for (const oauthClient of imported) {
264	merged.set(	264	merged.set(
265	[oauthClient.workspaceId, oauthClient.sourceId, oauthClient.providerKey].join(	265	[oauthClient.scopeId, oauthClient.sourceId, oauthClient.providerKey].join(
266	"::",	266	"::",
267	),	267	),
268	cloneValue(oauthClient),	268	cloneValue(oauthClient),
@@ -271,7 +271,7 @@ const mergeSourceOauthClients = ( · 2 unmodified lines
271		271
272	for (const oauthClient of current) {	272	for (const oauthClient of current) {
273	merged.set(	273	merged.set(
274	[oauthClient.workspaceId, oauthClient.sourceId, oauthClient.providerKey].join(	274	[oauthClient.scopeId, oauthClient.sourceId, oauthClient.providerKey].join(
275	"::",	275	"::",
276	),	276	),
277	cloneValue(oauthClient),	277	cloneValue(oauthClient),
@@ -282,21 +282,21 @@ const mergeSourceOauthClients = ( · 4 unmodified lines
282	};	282	};
283		283
284	const mergeWorkspaceOauthClients = (	284	const mergeWorkspaceOauthClients = (
285	current: readonly WorkspaceOauthClient[],	285	current: readonly ScopeOauthClient[],
286	imported: readonly WorkspaceOauthClient[],	286	imported: readonly ScopeOauthClient[],
287	): WorkspaceOauthClient[] => {	287	): ScopeOauthClient[] => {
288	const merged = new Map<string, WorkspaceOauthClient>();	288	const merged = new Map<string, ScopeOauthClient>();
289		289
290	for (const oauthClient of imported) {	290	for (const oauthClient of imported) {
291	merged.set(	291	merged.set(
292	[oauthClient.workspaceId, oauthClient.providerKey, oauthClient.id].join("::"),	292	[oauthClient.scopeId, oauthClient.providerKey, oauthClient.id].join("::"),
293	cloneValue(oauthClient),	293	cloneValue(oauthClient),
294	);	294	);
295	}	295	}
296		296
297	for (const oauthClient of current) {	297	for (const oauthClient of current) {
298	merged.set(	298	merged.set(
299	[oauthClient.workspaceId, oauthClient.providerKey, oauthClient.id].join("::"),	299	[oauthClient.scopeId, oauthClient.providerKey, oauthClient.id].join("::"),
300	cloneValue(oauthClient),	300	cloneValue(oauthClient),
301	);	301	);
302	}	302	}
@@ -326,9 +326,9 @@ export const mergeImportedLocalExecutorStateSnapshot = (input: { · 23 unmodified lines
326	input.current.sourceOauthClients,	326	input.current.sourceOauthClients,
327	input.imported.sourceOauthClients ?? [],	327	input.imported.sourceOauthClients ?? [],
328	),	328	),
329	workspaceOauthClients: mergeWorkspaceOauthClients(	329	scopeOauthClients: mergeWorkspaceOauthClients(
330	input.current.workspaceOauthClients,	330	input.current.scopeOauthClients,
331	input.imported.workspaceOauthClients ?? [],	331	input.imported.scopeOauthClients ?? [],
332	),	332	),
333	providerAuthGrants: mergeProviderAuthGrants(	333	providerAuthGrants: mergeProviderAuthGrants(
334	input.current.providerAuthGrants,	334	input.current.providerAuthGrants,
@@ -440,40 +440,40 @@ export const createLocalExecutorStateStore = ( · 105 unmodified lines
440		440
441	return {	441	return {
442	authArtifacts: {	442	authArtifacts: {
443	listByWorkspaceId: (workspaceId: AuthArtifact["workspaceId"]) =>	443	listByScopeId: (scopeId: AuthArtifact["scopeId"]) =>
444	stateManager.read((state) =>	444	stateManager.read((state) =>
445	sortByUpdatedAtAndIdAsc(	445	sortByUpdatedAtAndIdAsc(
446	state.authArtifacts.filter((artifact) => artifact.workspaceId === workspaceId),	446	state.authArtifacts.filter((artifact) => artifact.scopeId === scopeId),
447	),	447	),
448	),	448	),
449		449
450	listByWorkspaceAndSourceId: (input: {	450	listByScopeAndSourceId: (input: {
451	workspaceId: AuthArtifact["workspaceId"];	451	scopeId: AuthArtifact["scopeId"];
452	sourceId: AuthArtifact["sourceId"];	452	sourceId: AuthArtifact["sourceId"];
453	}) =>	453	}) =>
454	stateManager.read((state) =>	454	stateManager.read((state) =>
455	sortByUpdatedAtAndIdAsc(	455	sortByUpdatedAtAndIdAsc(
456	state.authArtifacts.filter(	456	state.authArtifacts.filter(
457	(artifact) =>	457	(artifact) =>
458	artifact.workspaceId === input.workspaceId	458	artifact.scopeId === input.scopeId
459	&& artifact.sourceId === input.sourceId,	459	&& artifact.sourceId === input.sourceId,
460	),	460	),
461	),	461	),
462	),	462	),
463		463
464	getByWorkspaceSourceAndActor: (input: {	464	getByScopeSourceAndActor: (input: {
465	workspaceId: AuthArtifact["workspaceId"];	465	scopeId: AuthArtifact["scopeId"];
466	sourceId: AuthArtifact["sourceId"];	466	sourceId: AuthArtifact["sourceId"];
467	actorAccountId: AuthArtifact["actorAccountId"];	467	actorScopeId: AuthArtifact["actorScopeId"];
468	slot: AuthArtifact["slot"];	468	slot: AuthArtifact["slot"];
469	}) =>	469	}) =>
470	stateManager.read((state) => {	470	stateManager.read((state) => {
471	const artifact = state.authArtifacts.find(	471	const artifact = state.authArtifacts.find(
472	(candidate) =>	472	(candidate) =>
473	candidate.workspaceId === input.workspaceId	473	candidate.scopeId === input.scopeId
474	&& candidate.sourceId === input.sourceId	474	&& candidate.sourceId === input.sourceId
475	&& candidate.slot === input.slot	475	&& candidate.slot === input.slot
476	&& actorEquals(candidate.actorAccountId, input.actorAccountId),	476	&& actorEquals(candidate.actorScopeId, input.actorScopeId),
477	);	477	);
478		478
479	return artifact ? Option.some(cloneValue(artifact)) : Option.none<AuthArtifact>();	479	return artifact ? Option.some(cloneValue(artifact)) : Option.none<AuthArtifact>();
@@ -484,10 +484,10 @@ export const createLocalExecutorStateStore = ( · 4 unmodified lines
484	const nextArtifacts = state.authArtifacts.filter(	484	const nextArtifacts = state.authArtifacts.filter(
485	(candidate) =>	485	(candidate) =>
486	!(	486	!(
487	candidate.workspaceId === artifact.workspaceId	487	candidate.scopeId === artifact.scopeId
488	&& candidate.sourceId === artifact.sourceId	488	&& candidate.sourceId === artifact.sourceId
489	&& candidate.slot === artifact.slot	489	&& candidate.slot === artifact.slot
490	&& actorEquals(candidate.actorAccountId, artifact.actorAccountId)	490	&& actorEquals(candidate.actorScopeId, artifact.actorScopeId)
491	),	491	),
492	);	492	);
493	nextArtifacts.push(cloneValue(artifact));	493	nextArtifacts.push(cloneValue(artifact));
@@ -501,18 +501,18 @@ export const createLocalExecutorStateStore = ( · 7 unmodified lines
501	} satisfies StateMutationResult<void>;	501	} satisfies StateMutationResult<void>;
502	}),	502	}),
503		503
504	removeByWorkspaceSourceAndActor: (input: {	504	removeByScopeSourceAndActor: (input: {
505	workspaceId: AuthArtifact["workspaceId"];	505	scopeId: AuthArtifact["scopeId"];
506	sourceId: AuthArtifact["sourceId"];	506	sourceId: AuthArtifact["sourceId"];
507	actorAccountId: AuthArtifact["actorAccountId"];	507	actorScopeId: AuthArtifact["actorScopeId"];
508	slot?: AuthArtifact["slot"];	508	slot?: AuthArtifact["slot"];
509	}) =>	509	}) =>
510	stateManager.mutate((state) => {	510	stateManager.mutate((state) => {
511	const nextArtifacts = state.authArtifacts.filter(	511	const nextArtifacts = state.authArtifacts.filter(
512	(candidate) =>	512	(candidate) =>
513	candidate.workspaceId !== input.workspaceId	513	candidate.scopeId !== input.scopeId
514	\|\| candidate.sourceId !== input.sourceId	514	\|\| candidate.sourceId !== input.sourceId
515	\|\| !actorEquals(candidate.actorAccountId, input.actorAccountId)	515	\|\| !actorEquals(candidate.actorScopeId, input.actorScopeId)
516	\|\| (input.slot !== undefined && candidate.slot !== input.slot),	516	\|\| (input.slot !== undefined && candidate.slot !== input.slot),
517	);	517	);
518		518
@@ -525,14 +525,14 @@ export const createLocalExecutorStateStore = ( · 6 unmodified lines
525	} satisfies StateMutationResult<boolean>;	525	} satisfies StateMutationResult<boolean>;
526	}),	526	}),
527		527
528	removeByWorkspaceAndSourceId: (input: {	528	removeByScopeAndSourceId: (input: {
529	workspaceId: AuthArtifact["workspaceId"];	529	scopeId: AuthArtifact["scopeId"];
530	sourceId: AuthArtifact["sourceId"];	530	sourceId: AuthArtifact["sourceId"];
531	}) =>	531	}) =>
532	stateManager.mutate((state) => {	532	stateManager.mutate((state) => {
533	const nextArtifacts = state.authArtifacts.filter(	533	const nextArtifacts = state.authArtifacts.filter(
534	(candidate) =>	534	(candidate) =>
535	candidate.workspaceId !== input.workspaceId	535	candidate.scopeId !== input.scopeId
536	\|\| candidate.sourceId !== input.sourceId,	536	\|\| candidate.sourceId !== input.sourceId,
537	);	537	);
538		538
@@ -591,30 +591,30 @@ export const createLocalExecutorStateStore = ( · 52 unmodified lines
591	},	591	},
592		592
593	sourceOauthClients: {	593	sourceOauthClients: {
594	getByWorkspaceSourceAndProvider: (input: {	594	getByScopeSourceAndProvider: (input: {
595	workspaceId: WorkspaceSourceOauthClient["workspaceId"];	595	scopeId: ScopedSourceOauthClient["scopeId"];
596	sourceId: WorkspaceSourceOauthClient["sourceId"];	596	sourceId: ScopedSourceOauthClient["sourceId"];
597	providerKey: string;	597	providerKey: string;
598	}) =>	598	}) =>
599	stateManager.read((state) => {	599	stateManager.read((state) => {
600	const oauthClient = state.sourceOauthClients.find(	600	const oauthClient = state.sourceOauthClients.find(
601	(candidate) =>	601	(candidate) =>
602	candidate.workspaceId === input.workspaceId	602	candidate.scopeId === input.scopeId
603	&& candidate.sourceId === input.sourceId	603	&& candidate.sourceId === input.sourceId
604	&& candidate.providerKey === input.providerKey,	604	&& candidate.providerKey === input.providerKey,
605	);	605	);
606		606
607	return oauthClient	607	return oauthClient
608	? Option.some(cloneValue(oauthClient))	608	? Option.some(cloneValue(oauthClient))
609	: Option.none<WorkspaceSourceOauthClient>();	609	: Option.none<ScopedSourceOauthClient>();
610	}),	610	}),
611		611
612	upsert: (oauthClient: WorkspaceSourceOauthClient) =>	612	upsert: (oauthClient: ScopedSourceOauthClient) =>
613	stateManager.mutate((state) => {	613	stateManager.mutate((state) => {
614	const nextOauthClients = state.sourceOauthClients.filter(	614	const nextOauthClients = state.sourceOauthClients.filter(
615	(candidate) =>	615	(candidate) =>
616	!(	616	!(
617	candidate.workspaceId === oauthClient.workspaceId	617	candidate.scopeId === oauthClient.scopeId
618	&& candidate.sourceId === oauthClient.sourceId	618	&& candidate.sourceId === oauthClient.sourceId
619	&& candidate.providerKey === oauthClient.providerKey	619	&& candidate.providerKey === oauthClient.providerKey
620	),	620	),
@@ -630,14 +630,14 @@ export const createLocalExecutorStateStore = ( · 9 unmodified lines
630	} satisfies StateMutationResult<void>;	630	} satisfies StateMutationResult<void>;
631	}),	631	}),
632		632
633	removeByWorkspaceAndSourceId: (input: {	633	removeByScopeAndSourceId: (input: {
634	workspaceId: WorkspaceSourceOauthClient["workspaceId"];	634	scopeId: ScopedSourceOauthClient["scopeId"];
635	sourceId: WorkspaceSourceOauthClient["sourceId"];	635	sourceId: ScopedSourceOauthClient["sourceId"];
636	}) =>	636	}) =>
637	stateManager.mutate((state) => {	637	stateManager.mutate((state) => {
638	const nextOauthClients = state.sourceOauthClients.filter(	638	const nextOauthClients = state.sourceOauthClients.filter(
639	(candidate) =>	639	(candidate) =>
640	candidate.workspaceId !== input.workspaceId	640	candidate.scopeId !== input.scopeId
641	\|\| candidate.sourceId !== input.sourceId,	641	\|\| candidate.sourceId !== input.sourceId,
642	);	642	);
643		643
@@ -651,35 +651,35 @@ export const createLocalExecutorStateStore = ( · 7 unmodified lines
651	}),	651	}),
652	},	652	},
653		653
654	workspaceOauthClients: {	654	scopeOauthClients: {
655	listByWorkspaceAndProvider: (input: {	655	listByScopeAndProvider: (input: {
656	workspaceId: WorkspaceOauthClient["workspaceId"];	656	scopeId: ScopeOauthClient["scopeId"];
657	providerKey: string;	657	providerKey: string;
658	}) =>	658	}) =>
659	stateManager.read((state) =>	659	stateManager.read((state) =>
660	sortByUpdatedAtAndIdAsc(	660	sortByUpdatedAtAndIdAsc(
661	state.workspaceOauthClients.filter(	661	state.scopeOauthClients.filter(
662	(candidate) =>	662	(candidate) =>
663	candidate.workspaceId === input.workspaceId	663	candidate.scopeId === input.scopeId
664	&& candidate.providerKey === input.providerKey,	664	&& candidate.providerKey === input.providerKey,
665	),	665	),
666	),	666	),
667	),	667	),
668		668
669	getById: (id: WorkspaceOauthClient["id"]) =>	669	getById: (id: ScopeOauthClient["id"]) =>
670	stateManager.read((state) => {	670	stateManager.read((state) => {
671	const oauthClient = state.workspaceOauthClients.find(	671	const oauthClient = state.scopeOauthClients.find(
672	(candidate) => candidate.id === id,	672	(candidate) => candidate.id === id,
673	);	673	);
674		674
675	return oauthClient	675	return oauthClient
676	? Option.some(cloneValue(oauthClient))	676	? Option.some(cloneValue(oauthClient))
677	: Option.none<WorkspaceOauthClient>();	677	: Option.none<ScopeOauthClient>();
678	}),	678	}),
679		679
680	upsert: (oauthClient: WorkspaceOauthClient) =>	680	upsert: (oauthClient: ScopeOauthClient) =>
681	stateManager.mutate((state) => {	681	stateManager.mutate((state) => {
682	const nextOauthClients = state.workspaceOauthClients.filter(	682	const nextOauthClients = state.scopeOauthClients.filter(
683	(candidate) => candidate.id !== oauthClient.id,	683	(candidate) => candidate.id !== oauthClient.id,
684	);	684	);
685	nextOauthClients.push(cloneValue(oauthClient));	685	nextOauthClients.push(cloneValue(oauthClient));
@@ -687,50 +687,50 @@ export const createLocalExecutorStateStore = ( · 1 unmodified line
687	return {	687	return {
688	state: {	688	state: {
689	...state,	689	...state,
690	workspaceOauthClients: nextOauthClients,	690	scopeOauthClients: nextOauthClients,
691	},	691	},
692	value: undefined,	692	value: undefined,
693	} satisfies StateMutationResult<void>;	693	} satisfies StateMutationResult<void>;
694	}),	694	}),
695		695
696	removeById: (id: WorkspaceOauthClient["id"]) =>	696	removeById: (id: ScopeOauthClient["id"]) =>
697	stateManager.mutate((state) => {	697	stateManager.mutate((state) => {
698	const nextOauthClients = state.workspaceOauthClients.filter(	698	const nextOauthClients = state.scopeOauthClients.filter(
699	(candidate) => candidate.id !== id,	699	(candidate) => candidate.id !== id,
700	);	700	);
701		701
702	return {	702	return {
703	state: {	703	state: {
704	...state,	704	...state,
705	workspaceOauthClients: nextOauthClients,	705	scopeOauthClients: nextOauthClients,
706	},	706	},
707	value: nextOauthClients.length !== state.workspaceOauthClients.length,	707	value: nextOauthClients.length !== state.scopeOauthClients.length,
708	} satisfies StateMutationResult<boolean>;	708	} satisfies StateMutationResult<boolean>;
709	}),	709	}),
710	},	710	},
711		711
712	providerAuthGrants: {	712	providerAuthGrants: {
713	listByWorkspaceId: (workspaceId: ProviderAuthGrant["workspaceId"]) =>	713	listByScopeId: (scopeId: ProviderAuthGrant["scopeId"]) =>
714	stateManager.read((state) =>	714	stateManager.read((state) =>
715	sortByUpdatedAtAndIdAsc(	715	sortByUpdatedAtAndIdAsc(
716	state.providerAuthGrants.filter(	716	state.providerAuthGrants.filter(
717	(grant) => grant.workspaceId === workspaceId,	717	(grant) => grant.scopeId === scopeId,
718	),	718	),
719	),	719	),
720	),	720	),
721		721
722	listByWorkspaceActorAndProvider: (input: {	722	listByScopeActorAndProvider: (input: {
723	workspaceId: ProviderAuthGrant["workspaceId"];	723	scopeId: ProviderAuthGrant["scopeId"];
724	actorAccountId: ProviderAuthGrant["actorAccountId"];	724	actorScopeId: ProviderAuthGrant["actorScopeId"];
725	providerKey: string;	725	providerKey: string;
726	}) =>	726	}) =>
727	stateManager.read((state) =>	727	stateManager.read((state) =>
728	sortByUpdatedAtAndIdAsc(	728	sortByUpdatedAtAndIdAsc(
729	state.providerAuthGrants.filter(	729	state.providerAuthGrants.filter(
730	(grant) =>	730	(grant) =>
731	grant.workspaceId === input.workspaceId	731	grant.scopeId === input.scopeId
732	&& grant.providerKey === input.providerKey	732	&& grant.providerKey === input.providerKey
733	&& actorEquals(grant.actorAccountId, input.actorAccountId),	733	&& actorEquals(grant.actorScopeId, input.actorScopeId),
734	),	734	),
735	),	735	),
736	),	736	),
@@ -782,11 +782,11 @@ export const createLocalExecutorStateStore = ( · 45 unmodified lines
782	listAll: () =>	782	listAll: () =>
783	stateManager.read((state) => sortByUpdatedAtAndIdAsc(state.sourceAuthSessions)),	783	stateManager.read((state) => sortByUpdatedAtAndIdAsc(state.sourceAuthSessions)),
784		784
785	listByWorkspaceId: (workspaceId: SourceAuthSession["workspaceId"]) =>	785	listByScopeId: (scopeId: SourceAuthSession["scopeId"]) =>
786	stateManager.read((state) =>	786	stateManager.read((state) =>
787	sortByUpdatedAtAndIdAsc(	787	sortByUpdatedAtAndIdAsc(
788	state.sourceAuthSessions.filter(	788	state.sourceAuthSessions.filter(
789	(session) => session.workspaceId === workspaceId,	789	(session) => session.scopeId === scopeId,
790	),	790	),
791	),	791	),
792	),	792	),
@@ -811,20 +811,20 @@ export const createLocalExecutorStateStore = ( · 18 unmodified lines
811	: Option.none<SourceAuthSession>();	811	: Option.none<SourceAuthSession>();
812	}),	812	}),
813		813
814	getPendingByWorkspaceSourceAndActor: (input: {	814	getPendingByScopeSourceAndActor: (input: {
815	workspaceId: SourceAuthSession["workspaceId"];	815	scopeId: SourceAuthSession["scopeId"];
816	sourceId: SourceAuthSession["sourceId"];	816	sourceId: SourceAuthSession["sourceId"];
817	actorAccountId: SourceAuthSession["actorAccountId"];	817	actorScopeId: SourceAuthSession["actorScopeId"];
818	credentialSlot?: SourceAuthSession["credentialSlot"];	818	credentialSlot?: SourceAuthSession["credentialSlot"];
819	}) =>	819	}) =>
820	stateManager.read((state) => {	820	stateManager.read((state) => {
821	const session = sortByUpdatedAtAndIdAsc(	821	const session = sortByUpdatedAtAndIdAsc(
822	state.sourceAuthSessions.filter(	822	state.sourceAuthSessions.filter(
823	(candidate) =>	823	(candidate) =>
824	candidate.workspaceId === input.workspaceId	824	candidate.scopeId === input.scopeId
825	&& candidate.sourceId === input.sourceId	825	&& candidate.sourceId === input.sourceId
826	&& candidate.status === "pending"	826	&& candidate.status === "pending"
827	&& actorEquals(candidate.actorAccountId, input.actorAccountId)	827	&& actorEquals(candidate.actorScopeId, input.actorScopeId)
828	&& (input.credentialSlot === undefined	828	&& (input.credentialSlot === undefined
829	\|\| candidate.credentialSlot === input.credentialSlot),	829	\|\| candidate.credentialSlot === input.credentialSlot),
830	),	830	),
@@ -846,7 +846,7 @@ export const createLocalExecutorStateStore = ( · 15 unmodified lines
846		846
847	update: (	847	update: (
848	id: SourceAuthSession["id"],	848	id: SourceAuthSession["id"],
849	patch: Partial<Omit<SourceAuthSession, "id" \| "workspaceId" \| "sourceId" \| "createdAt">>,	849	patch: Partial<Omit<SourceAuthSession, "id" \| "scopeId" \| "sourceId" \| "createdAt">>,
850	) =>	850	) =>
851	stateManager.mutate((state) => {	851	stateManager.mutate((state) => {
852	let updated: SourceAuthSession \| null = null;	852	let updated: SourceAuthSession \| null = null;
@@ -887,14 +887,14 @@ export const createLocalExecutorStateStore = ( · 34 unmodified lines
887	} satisfies StateMutationResult<void>;	887	} satisfies StateMutationResult<void>;
888	}),	888	}),
889		889
890	removeByWorkspaceAndSourceId: (	890	removeByScopeAndSourceId: (
891	workspaceId: SourceAuthSession["workspaceId"],	891	scopeId: SourceAuthSession["scopeId"],
892	sourceId: SourceAuthSession["sourceId"],	892	sourceId: SourceAuthSession["sourceId"],
893	) =>	893	) =>
894	stateManager.mutate((state) => {	894	stateManager.mutate((state) => {
895	const nextSessions = state.sourceAuthSessions.filter(	895	const nextSessions = state.sourceAuthSessions.filter(
896	(candidate) =>	896	(candidate) =>
897	candidate.workspaceId !== workspaceId \|\| candidate.sourceId !== sourceId,	897	candidate.scopeId !== scopeId \|\| candidate.sourceId !== sourceId,
898	);	898	);
899		899
900	return {	900	return {
@@ -993,14 +993,14 @@ export const createLocalExecutorStateStore = ( · 92 unmodified lines
993	: Option.none<Execution>();	993	: Option.none<Execution>();
994	}),	994	}),
995		995
996	getByWorkspaceAndId: (	996	getByScopeAndId: (
997	workspaceId: Execution["workspaceId"],	997	scopeId: Execution["scopeId"],
998	executionId: Execution["id"],	998	executionId: Execution["id"],
999	) =>	999	) =>
1000	stateManager.read((state) => {	1000	stateManager.read((state) => {
1001	const execution = state.executions.find(	1001	const execution = state.executions.find(
1002	(candidate) =>	1002	(candidate) =>
1003	candidate.workspaceId === workspaceId && candidate.id === executionId,	1003	candidate.scopeId === scopeId && candidate.id === executionId,
1004	);	1004	);
1005	return execution	1005	return execution
1006	? Option.some(cloneValue(execution))	1006	? Option.some(cloneValue(execution))
@@ -1019,7 +1019,7 @@ export const createLocalExecutorStateStore = ( · 12 unmodified lines
1019	update: (	1019	update: (
1020	executionId: Execution["id"],	1020	executionId: Execution["id"],
1021	patch: Partial<	1021	patch: Partial<
1022	Omit<Execution, "id" \| "workspaceId" \| "createdByAccountId" \| "createdAt">	1022	Omit<Execution, "id" \| "scopeId" \| "createdByAccountId" \| "createdAt">
1023	>,	1023	>,
1024	) =>	1024	) =>
1025	stateManager.mutate((state) => {	1025	stateManager.mutate((state) => {

packages/platform/sdk-file/src/index.ts+8−8

@@ -10,7 +10,7 @@ import { · 9 unmodified lines
10	type ExecutorBackendServices,	10	type ExecutorBackendServices,
11	type ExecutorLocalToolBackend,	11	type ExecutorLocalToolBackend,
12	type ExecutorSourceTypeDeclarationsBackend,	12	type ExecutorSourceTypeDeclarationsBackend,
13	type ExecutorWorkspaceDescriptor,	13	type ExecutorScopeDescriptor,
14	} from "@executor/platform-sdk";	14	} from "@executor/platform-sdk";
15	import type {	15	import type {
16	LocalExecutorConfig,	16	LocalExecutorConfig,
@@ -198,11 +198,11 @@ const createBoundSourceTypeDeclarationsRefresher = ( · 181 unmodified lines
198	}),	198	}),
199	});	199	});
200		200
201	const toExecutorWorkspaceContext = (	201	const toExecutorScopeContext = (
202	context: ResolvedLocalWorkspaceContext,	202	context: ResolvedLocalWorkspaceContext,
203	): ExecutorWorkspaceDescriptor => ({	203	): ExecutorScopeDescriptor => ({
204	workspaceName: context.workspaceName,	204	scopeName: context.workspaceName,
205	workspaceRoot: context.workspaceRoot,	205	scopeRoot: context.workspaceRoot,
206	metadata: {	206	metadata: {
207	kind: "file",	207	kind: "file",
208	configDirectory: context.configDirectory,	208	configDirectory: context.configDirectory,
@@ -248,11 +248,11 @@ export const createLocalExecutorServicesEffect = ( · 39 unmodified lines
248	});	248	});
249		249
250	return {	250	return {
251	workspace: toExecutorWorkspaceContext(workspaceContext),	251	scope: toExecutorScopeContext(workspaceContext),
252	storage: {	252	storage: {
253	installation: createBoundInstallationStore(workspaceContext),	253	installation: createBoundInstallationStore(workspaceContext),
254	workspaceConfig: workspaceConfigStore,	254	scopeConfig: workspaceConfigStore,
255	workspaceState: createBoundWorkspaceStateStore(	255	scopeState: createBoundWorkspaceStateStore(
256	workspaceContext,	256	workspaceContext,
257	fileSystem,	257	fileSystem,
258	),	258	),

packages/platform/sdk-file/src/installation.test.ts+4−4

@@ -42,8 +42,8 @@ describe("local-installation", () => { · 41 unmodified lines
42	const installation = runtime.localInstallation;	42	const installation = runtime.localInstallation;
43	const fs = yield* FileSystem.FileSystem;	43	const fs = yield* FileSystem.FileSystem;
44		44
45	expect(installation.accountId).toBe("acc_local_default");	45	expect(installation.actorScopeId).toBe("acc_local_default");
46	expect(installation.workspaceId.startsWith("ws_local_")).toBe(true);	46	expect(installation.scopeId.startsWith("ws_local_")).toBe(true);
47	expect(yield* fs.exists(join(workspaceRoot, ".executor", "executor.jsonc"))).toBe(false);	47	expect(yield* fs.exists(join(workspaceRoot, ".executor", "executor.jsonc"))).toBe(false);
48	}).pipe(Effect.provide(NodeFileSystem.layer)),	48	}).pipe(Effect.provide(NodeFileSystem.layer)),
49	60_000,	49	60_000,
@@ -63,8 +63,8 @@ describe("local-installation", () => { · 13 unmodified lines
63	context,	63	context,
64	});	64	});
65		65
66	expect(second.accountId).toBe(first.accountId);	66	expect(second.actorScopeId).toBe(first.actorScopeId);
67	expect(second.workspaceId).toBe(first.workspaceId);	67	expect(second.scopeId).toBe(first.scopeId);
68	}).pipe(Effect.provide(NodeFileSystem.layer)),	68	}).pipe(Effect.provide(NodeFileSystem.layer)),
69	);	69	);
70	});	70	});

packages/platform/sdk-file/src/installation.ts+9−6

 import { createHash } from "node:crypto";
 import {
-  AccountIdSchema,
+  ScopeIdSchema,
-  WorkspaceIdSchema,
   type LocalInstallation,
 } from "@executor/platform-sdk/schema";
 import * as Effect from "effect/Effect";
 import type { ResolvedLocalWorkspaceContext } from "./config";
-const LOCAL_ACCOUNT_ID = AccountIdSchema.make("acc_local_default");
+const LOCAL_ACCOUNT_ID = ScopeIdSchema.make("acc_local_default");
 const stableHash = (value: string): string =>
   createHash("sha256").update(value).digest("hex").slice(0, 16);
   value.replaceAll("\\", "/");
 const deriveWorkspaceId = (context: ResolvedLocalWorkspaceContext) =>
-  WorkspaceIdSchema.make(
+  ScopeIdSchema.make(
     `ws_local_${stableHash(normalizeSlashPath(context.workspaceRoot))}`,
   );
 export const deriveLocalInstallation = (
   context: ResolvedLocalWorkspaceContext,
 ): LocalInstallation => ({
-  accountId: LOCAL_ACCOUNT_ID,
+  actorScopeId: LOCAL_ACCOUNT_ID,
-  workspaceId: deriveWorkspaceId(context),
+  scopeId: deriveWorkspaceId(context),
+  resolutionScopeIds: [
+    deriveWorkspaceId(context),
+    LOCAL_ACCOUNT_ID,
+  ],
 });
 export const loadLocalInstallation = (

packages/platform/sdk-file/src/secret-material-providers.ts+7−7

@@ -28,9 +28,9 @@ import { · 27 unmodified lines
28	type StoreSecretMaterial,	28	type StoreSecretMaterial,
29	type DeleteSecretMaterial,	29	type DeleteSecretMaterial,
30	type UpdateSecretMaterial,	30	type UpdateSecretMaterial,
31	} from "../../sdk/src/runtime/workspace/secret-material-providers";	31	} from "../../sdk/src/runtime/scope/secret-material-providers";
32	import { fromConfigSecretProviderId } from "../../sdk/src/runtime/workspace/config-secrets";	32	import { fromConfigSecretProviderId } from "../../sdk/src/runtime/scope/config-secrets";
33	import { getRuntimeLocalWorkspaceOption } from "../../sdk/src/runtime/workspace/runtime-context";	33	import { getRuntimeLocalScopeOption } from "../../sdk/src/runtime/scope/runtime-context";
34	import {	34	import {
35	ExecutorStateStore,	35	ExecutorStateStore,
36	type ExecutorStateStoreShape,	36	type ExecutorStateStoreShape,
@@ -876,7 +876,7 @@ const readFileSecretValue = (input: { · 839 unmodified lines
876	const fs = yield* FileSystem.FileSystem;	876	const fs = yield* FileSystem.FileSystem;
877	const resolvedPath = resolveConfigRelativePath({	877	const resolvedPath = resolveConfigRelativePath({
878	path: input.provider.path,	878	path: input.provider.path,
879	workspaceRoot: input.workspaceRoot,	879	scopeRoot: input.workspaceRoot,
880	});	880	});
881	const raw = yield* fs.readFileString(resolvedPath, "utf8").pipe(	881	const raw = yield* fs.readFileString(resolvedPath, "utf8").pipe(
882	Effect.mapError(toError),	882	Effect.mapError(toError),
@@ -1140,14 +1140,14 @@ const resolveRuntimeSecretMaterialConfig = (input: { · 257 unmodified lines
1140	workspaceRoot?: string \| null;	1140	workspaceRoot?: string \| null;
1141	}) =>	1141	}) =>
1142	Effect.gen(function* () {	1142	Effect.gen(function* () {
1143	const runtimeLocalWorkspace = yield* getRuntimeLocalWorkspaceOption();	1143	const runtimeLocalScope = yield* getRuntimeLocalScopeOption();
1144		1144
1145	return {	1145	return {
1146	localConfig: input.localConfig	1146	localConfig: input.localConfig
1147	?? runtimeLocalWorkspace?.loadedConfig.config	1147	?? runtimeLocalScope?.loadedConfig.config
1148	?? null,	1148	?? null,
1149	workspaceRoot: input.workspaceRoot	1149	workspaceRoot: input.workspaceRoot
1150	?? runtimeLocalWorkspace?.workspace.workspaceRoot	1150	?? runtimeLocalScope?.scope.scopeRoot
1151	?? null,	1151	?? null,
1152	};	1152	};
1153	});	1153	});

packages/platform/sdk-file/src/source-artifacts.test.ts+2−2

@@ -7,7 +7,7 @@ import * as Effect from "effect/Effect"; · 6 unmodified lines
7		7
8	import {	8	import {
9	SourceIdSchema,	9	SourceIdSchema,
10	WorkspaceIdSchema,	10	ScopeIdSchema,
11	type Source,	11	type Source,
12	} from "@executor/platform-sdk/schema";	12	} from "@executor/platform-sdk/schema";
13		13
@@ -52,7 +52,7 @@ const makeContext = (): Effect.Effect< · 38 unmodified lines
52		52
53	const makeSource = (): Source => ({	53	const makeSource = (): Source => ({
54	id: SourceIdSchema.make("src_test"),	54	id: SourceIdSchema.make("src_test"),
55	workspaceId: WorkspaceIdSchema.make("ws_test"),	55	scopeId: ScopeIdSchema.make("ws_test"),
56	name: "Test Source",	56	name: "Test Source",
57	kind: "openapi",	57	kind: "openapi",
58	endpoint: "https://example.com/api",	58	endpoint: "https://example.com/api",

packages/platform/sdk-file/src/source-type-declarations.test.ts+2−3

 import {
   SourceIdSchema,
-  WorkspaceIdSchema,
+  ScopeIdSchema,
   type Source,
 } from "@executor/platform-sdk/schema";
   ExecutableIdSchema,
   ResourceIdSchema,
   ResponseSetIdSchema,
-  ScopeIdSchema,
   ShapeSymbolIdSchema,
 } from "@executor/ir/ids";
 import type { CatalogV1, ProvenanceRef } from "@executor/ir/model";
   status?: Source["status"];
 }): Source => ({
   id: SourceIdSchema.make(input.id),
-  workspaceId: WorkspaceIdSchema.make("ws_test"),
+  scopeId: ScopeIdSchema.make("ws_test"),
   name: input.id,
   kind: "graphql",
   endpoint: "https://api.linear.app/graphql",

packages/platform/sdk-file/src/workspace-state.ts+9−9

@@ -3,11 +3,11 @@ import { FileSystem } from "@effect/platform"; · 2 unmodified lines
3	import * as Effect from "effect/Effect";	3	import * as Effect from "effect/Effect";
4	import * as Schema from "effect/Schema";	4	import * as Schema from "effect/Schema";
5		5
6	import type { LocalWorkspaceState } from "../../sdk/src/runtime/workspace-state";	6	import type { LocalScopeState } from "../../sdk/src/runtime/scope-state";
7	import {	7	import {
8	defaultLocalWorkspaceState,	8	defaultLocalScopeState,
9	LocalWorkspaceStateSchema,	9	LocalScopeStateSchema,
10	} from "../../sdk/src/runtime/workspace-state";	10	} from "../../sdk/src/runtime/scope-state";
11	import type { ResolvedLocalWorkspaceContext } from "./config";	11	import type { ResolvedLocalWorkspaceContext } from "./config";
12	import {	12	import {
13	LocalFileSystemError,	13	LocalFileSystemError,
@@ -17,7 +17,7 @@ import { · 3 unmodified lines
17		17
18	const WORKSPACE_STATE_BASENAME = "workspace-state.json";	18	const WORKSPACE_STATE_BASENAME = "workspace-state.json";
19		19
20	const decodeLocalWorkspaceState = Schema.decodeUnknownSync(LocalWorkspaceStateSchema);	20	const decodeLocalWorkspaceState = Schema.decodeUnknownSync(LocalScopeStateSchema);
21		21
22	const mapFileSystemError = (path: string, action: string) => (cause: unknown) =>	22	const mapFileSystemError = (path: string, action: string) => (cause: unknown) =>
23	new LocalFileSystemError({	23	new LocalFileSystemError({
@@ -34,7 +34,7 @@ export const localWorkspaceStatePath = ( · 10 unmodified lines
34	export const loadLocalWorkspaceState = (	34	export const loadLocalWorkspaceState = (
35	context: ResolvedLocalWorkspaceContext,	35	context: ResolvedLocalWorkspaceContext,
36	): Effect.Effect<	36	): Effect.Effect<
37	LocalWorkspaceState,	37	LocalScopeState,
38	LocalFileSystemError \| LocalWorkspaceStateDecodeError,	38	LocalFileSystemError \| LocalWorkspaceStateDecodeError,
39	FileSystem.FileSystem	39	FileSystem.FileSystem
40	> =>	40	> =>
@@ -45,7 +45,7 @@ export const loadLocalWorkspaceState = ( · 4 unmodified lines
45	Effect.mapError(mapFileSystemError(path, "check workspace state path")),	45	Effect.mapError(mapFileSystemError(path, "check workspace state path")),
46	);	46	);
47	if (!exists) {	47	if (!exists) {
48	return defaultLocalWorkspaceState();	48	return defaultLocalScopeState();
49	}	49	}
50		50
51	const content = yield* fs.readFileString(path, "utf8").pipe(	51	const content = yield* fs.readFileString(path, "utf8").pipe(
@@ -55,7 +55,7 @@ export const loadLocalWorkspaceState = ( · 3 unmodified lines
55	try: () => decodeLocalWorkspaceState(JSON.parse(content) as unknown),	55	try: () => decodeLocalWorkspaceState(JSON.parse(content) as unknown),
56	catch: (cause) =>	56	catch: (cause) =>
57	new LocalWorkspaceStateDecodeError({	57	new LocalWorkspaceStateDecodeError({
58	message: `Invalid local workspace state at ${path}: ${unknownLocalErrorDetails(cause)}`,	58	message: `Invalid local scope state at ${path}: ${unknownLocalErrorDetails(cause)}`,
59	path,	59	path,
60	details: unknownLocalErrorDetails(cause),	60	details: unknownLocalErrorDetails(cause),
61	}),	61	}),
@@ -64,7 +64,7 @@ export const loadLocalWorkspaceState = ( · 2 unmodified lines
64		64
65	export const writeLocalWorkspaceState = (input: {	65	export const writeLocalWorkspaceState = (input: {
66	context: ResolvedLocalWorkspaceContext;	66	context: ResolvedLocalWorkspaceContext;
67	state: LocalWorkspaceState;	67	state: LocalScopeState;
68	}): Effect.Effect<void, LocalFileSystemError, FileSystem.FileSystem> =>	68	}): Effect.Effect<void, LocalFileSystemError, FileSystem.FileSystem> =>
69	Effect.gen(function* () {	69	Effect.gen(function* () {
70	const fs = yield* FileSystem.FileSystem;	70	const fs = yield* FileSystem.FileSystem;

packages/platform/sdk/package.json+1−0

@@ -42,6 +42,7 @@ · 41 unmodified lines
42	},	42	},
43	"devDependencies": {	43	"devDependencies": {
44	"@effect/vitest": "catalog:",	44	"@effect/vitest": "catalog:",
		45	"@executor/effect-test-utils": "workspace:*",
45	"@modelcontextprotocol/sdk": "^1.26.0",	46	"@modelcontextprotocol/sdk": "^1.26.0",
46	"@types/node": "catalog:",	47	"@types/node": "catalog:",
47	"bun-types": "catalog:",	48	"bun-types": "catalog:",

packages/platform/sdk/src/backend.ts+14−14

@@ -6,8 +6,8 @@ import { · 5 unmodified lines
6	type BoundLocalToolRuntimeLoader,	6	type BoundLocalToolRuntimeLoader,
7	type BoundSourceArtifactStore,	7	type BoundSourceArtifactStore,
8	type BoundSourceTypeDeclarationsRefresher,	8	type BoundSourceTypeDeclarationsRefresher,
9	type BoundWorkspaceConfigStore,	9	type BoundScopeConfigStore,
10	type BoundWorkspaceStateStore,	10	type BoundScopeStateStore,
11	type ExecutorRuntime,	11	type ExecutorRuntime,
12	type ExecutorRuntimeOptions,	12	type ExecutorRuntimeOptions,
13	type RuntimeInstanceConfigService,	13	type RuntimeInstanceConfigService,
@@ -15,13 +15,13 @@ import { · 1 unmodified line
15	type RuntimeSecretMaterialServices,	15	type RuntimeSecretMaterialServices,
16	} from "./runtime";	16	} from "./runtime";
17	import type {	17	import type {
18	ExecutorWorkspaceContext,	18	ExecutorScopeContext,
19	ExecutorWorkspaceDescriptor,	19	ExecutorScopeDescriptor,
20	} from "./workspace";	20	} from "./scope";
21	export type {	21	export type {
22	ExecutorWorkspaceContext,	22	ExecutorScopeContext,
23	ExecutorWorkspaceDescriptor,	23	ExecutorScopeDescriptor,
24	} from "./workspace";	24	} from "./scope";
25		25
26	export type ExecutorBackend = {	26	export type ExecutorBackend = {
27	createRuntime: (	27	createRuntime: (
@@ -30,8 +30,8 @@ export type ExecutorBackend = { · 2 unmodified lines
30	};	30	};
31		31
32	export type ExecutorInstallationBackend = BoundInstallationStore;	32	export type ExecutorInstallationBackend = BoundInstallationStore;
33	export type ExecutorWorkspaceConfigBackend = BoundWorkspaceConfigStore;	33	export type ExecutorScopeConfigBackend = BoundScopeConfigStore;
34	export type ExecutorWorkspaceStateBackend = BoundWorkspaceStateStore;	34	export type ExecutorScopeStateBackend = BoundScopeStateStore;
35	export type ExecutorSourceArtifactBackend = BoundSourceArtifactStore;	35	export type ExecutorSourceArtifactBackend = BoundSourceArtifactStore;
36	export type ExecutorStateBackend = import("./runtime").ExecutorStateStoreShape;	36	export type ExecutorStateBackend = import("./runtime").ExecutorStateStoreShape;
37	export type ExecutorLocalToolBackend = BoundLocalToolRuntimeLoader;	37	export type ExecutorLocalToolBackend = BoundLocalToolRuntimeLoader;
@@ -42,8 +42,8 @@ export type ExecutorInstanceConfigBackend = RuntimeInstanceConfigService; · 4 unmodified lines
42		42
43	export type ExecutorStorageBackend = {	43	export type ExecutorStorageBackend = {
44	installation: ExecutorInstallationBackend;	44	installation: ExecutorInstallationBackend;
45	workspaceConfig: ExecutorWorkspaceConfigBackend;	45	scopeConfig: ExecutorScopeConfigBackend;
46	workspaceState: ExecutorWorkspaceStateBackend;	46	scopeState: ExecutorScopeStateBackend;
47	sourceArtifacts: ExecutorSourceArtifactBackend;	47	sourceArtifacts: ExecutorSourceArtifactBackend;
48	executorState: ExecutorStateBackend;	48	executorState: ExecutorStateBackend;
49	secretMaterial: ExecutorSecretMaterialBackend;	49	secretMaterial: ExecutorSecretMaterialBackend;
@@ -51,7 +51,7 @@ export type ExecutorStorageBackend = { · 1 unmodified line
51	};	51	};
52		52
53	export type ExecutorBackendServices = {	53	export type ExecutorBackendServices = {
54	workspace: ExecutorWorkspaceDescriptor;	54	scope: ExecutorScopeDescriptor;
55	storage: ExecutorStorageBackend;	55	storage: ExecutorStorageBackend;
56	instanceConfig: ExecutorInstanceConfigBackend;	56	instanceConfig: ExecutorInstanceConfigBackend;
57	localTools?: ExecutorLocalToolBackend;	57	localTools?: ExecutorLocalToolBackend;
@@ -68,7 +68,7 @@ export const createExecutorBackend = (input: { · 10 unmodified lines
68	createExecutorRuntimeFromServices({	68	createExecutorRuntimeFromServices({
69	...options,	69	...options,
70	services: {	70	services: {
71	workspace: services.workspace,	71	scope: services.scope,
72	storage: services.storage satisfies RuntimeStorageServices,	72	storage: services.storage satisfies RuntimeStorageServices,
73	localToolRuntimeLoader: services.localTools,	73	localToolRuntimeLoader: services.localTools,
74	sourceTypeDeclarationsRefresher: services.sourceTypeDeclarations,	74	sourceTypeDeclarationsRefresher: services.sourceTypeDeclarations,

packages/platform/sdk/src/errors.ts+3−1

@@ -1,4 +1,6 @@
1	import { HttpApiSchema } from "@effect/platform";	1	import {
		2	HttpApiSchema,
		3	} from "@effect/platform";
2	import * as Schema from "effect/Schema";	4	import * as Schema from "effect/Schema";
3		5
4	export class ControlPlaneBadRequestError extends Schema.TaggedError<ControlPlaneBadRequestError>()(	6	export class ControlPlaneBadRequestError extends Schema.TaggedError<ControlPlaneBadRequestError>()(

packages/platform/sdk/src/executions/contracts.ts+3−1

@@ -1,6 +1,8 @@
1	import * as Schema from "effect/Schema";	1	import * as Schema from "effect/Schema";
2		2
3	import { TrimmedNonEmptyStringSchema } from "../string-schemas";	3	import {
		4	TrimmedNonEmptyStringSchema,
		5	} from "../string-schemas";
4		6
5	export const CreateExecutionPayloadSchema = Schema.Struct({	7	export const CreateExecutionPayloadSchema = Schema.Struct({
6	code: TrimmedNonEmptyStringSchema,	8	code: TrimmedNonEmptyStringSchema,

packages/platform/sdk/src/executor.test.ts+453−0

@@ -0,0 +1,453 @@
	1	import { join } from "node:path";
	2	import {
	3	HttpApi,
	4	HttpApiEndpoint,
	5	HttpApiGroup,
	6	HttpApiSchema,
	7	HttpApiBuilder,
	8	HttpApiClient,
	9	FileSystem,
	10	} from "@effect/platform";
	11	import {
	12	NodeFileSystem,
	13	NodeHttpServer,
	14	} from "@effect/platform-node";
	15	import {
	16	describe,
	17	expect,
	18	it,
	19	} from "@effect/vitest";
	20	import * as Either from "effect/Either";
	21	import {
	22	assertInclude,
	23	} from "@effect/vitest/utils";
	24	import * as Effect from "effect/Effect";
	25	import * as Layer from "effect/Layer";
	26	import * as Schema from "effect/Schema";
	27	import {
	28	makeOpenApiTestServer,
	29	} from "@executor/effect-test-utils";
	30
	31	import {
	32	createExecutorBackend,
	33	createExecutorEffect,
	34	type Executor,
	35	} from "./index";
	36	import {
	37	type LocalInstallation,
	38	ScopeIdSchema,
	39	} from "./schema";
	40	import {
	41	createLocalExecutorServicesEffect,
	42	} from "../../sdk-file/src/index";
	43	import {
	44	ExecutorApi,
	45	createExecutorApiLayer,
	46	} from "../../api/src/index";
	47
	48	type LocalExecutorServices = Effect.Effect.Success<
	49	ReturnType<typeof createLocalExecutorServicesEffect>
	50	>;
	51
	52	const createClientLayer = (executor: Executor) =>
	53	HttpApiBuilder.serve().pipe(
	54	Layer.provide(createExecutorApiLayer(executor)),
	55	Layer.provideMerge(NodeHttpServer.layerTest),
	56	);
	57
	58	const createExecutorApiClient = () =>
	59	HttpApiClient.make(ExecutorApi, {
	60	});
	61
	62	type ExecutorApiClient = Effect.Effect.Success<
	63	ReturnType<typeof createExecutorApiClient>
	64	>;
	65
	66	const withExecutorApiClient = <A, E>(
	67	executor: Executor,
	68	f: (client: ExecutorApiClient) => Effect.Effect<A, E, never>,
	69	): Effect.Effect<A, E, never> =>
	70	Effect.gen(function* () {
	71	const client = yield* createExecutorApiClient();
	72	return yield* f(client);
	73	}).pipe(Effect.provide(createClientLayer(executor).pipe(Layer.orDie)));
	74
	75	const expectLeft = <A, E>(effect: Effect.Effect<A, E, never>) =>
	76	Effect.either(effect).pipe(
	77	Effect.flatMap((result) =>
	78	Either.isLeft(result)
	79	? Effect.succeed(result.left)
	80	: Effect.die("Expected effect to fail"),
	81	),
	82	);
	83
	84	type OpenApiSpecServer = {
	85	baseUrl: string;
	86	specUrl: string;
	87	close: () => Promise<void>;
	88	};
	89
	90	const ownerParam = HttpApiSchema.param("owner", Schema.String);
	91	const repoParam = HttpApiSchema.param("repo", Schema.String);
	92	const issueIdParam = HttpApiSchema.param("issueId", Schema.String);
	93
	94	class WorkspaceSourceReposApi extends HttpApiGroup.make("repos")
	95	.add(
	96	HttpApiEndpoint.get("getRepo")`/repos/${ownerParam}/${repoParam}`
	97	.addSuccess(Schema.Unknown),
	98	)
	99	{}
	100
	101	class WorkspaceSourceIssuesApi extends HttpApiGroup.make("issues")
	102	.add(
	103	HttpApiEndpoint.get("getIssue")`/issues/${issueIdParam}`
	104	.addSuccess(Schema.Unknown),
	105	)
	106	.add(
	107	HttpApiEndpoint.get("listIssues")`/issues`
	108	.addSuccess(Schema.Unknown),
	109	)
	110	{}
	111
	112	class WorkspaceSourceReposRootApi extends HttpApi.make("workspaceSourceRepos")
	113	.add(WorkspaceSourceReposApi)
	114	{}
	115
	116	class WorkspaceSourceIssuesRootApi extends HttpApi.make("workspaceSourceIssues")
	117	.add(WorkspaceSourceIssuesApi)
	118	{}
	119
	120	const workspaceSourceReposLive = HttpApiBuilder.group(
	121	WorkspaceSourceReposRootApi,
	122	"repos",
	123	(handlers) =>
	124	handlers.handle("getRepo", ({ path }) =>
	125	Effect.succeed({
	126	full_name: `${path.owner}/${path.repo}`,
	127	private: false,
	128	}),
	129	),
	130	);
	131
	132	const workspaceSourceIssuesLive = HttpApiBuilder.group(
	133	WorkspaceSourceIssuesRootApi,
	134	"issues",
	135	(handlers) =>
	136	handlers
	137	.handle("getIssue", ({ path }) =>
	138	Effect.succeed({
	139	id: path.issueId,
	140	title: `Issue ${path.issueId}`,
	141	}),
	142	)
	143	.handle("listIssues", () =>
	144	Effect.succeed([
	145	{
	146	id: "1",
	147	title: "Issue 1",
	148	},
	149	]),
	150	),
	151	);
	152
	153	const workspaceSourceReposApiLayer = HttpApiBuilder.api(
	154	WorkspaceSourceReposRootApi,
	155	).pipe(Layer.provide(workspaceSourceReposLive));
	156
	157	const workspaceSourceIssuesApiLayer = HttpApiBuilder.api(
	158	WorkspaceSourceIssuesRootApi,
	159	).pipe(Layer.provide(workspaceSourceIssuesLive));
	160
	161	const createScopedExecutor = (input: {
	162	services: LocalExecutorServices;
	163	installation: LocalInstallation;
	164	}) =>
	165	createExecutorEffect({
	166	backend: createExecutorBackend({
	167	loadServices: () =>
	168	Effect.succeed({
	169	...input.services,
	170	scope: {
	171	...input.services.scope,
	172	actorScopeId: input.installation.actorScopeId,
	173	resolutionScopeIds: input.installation.resolutionScopeIds,
	174	},
	175	storage: {
	176	...input.services.storage,
	177	installation: {
	178	load: () => Effect.succeed(input.installation),
	179	getOrProvision: () => Effect.succeed(input.installation),
	180	},
	181	},
	182	}),
	183	}),
	184	getLocalServerBaseUrl: () => "http://127.0.0.1",
	185	});
	186
	187	const makeSharedScopeExecutors = Effect.acquireRelease(
	188	Effect.gen(function* () {
	189	const fs = yield* FileSystem.FileSystem;
	190	const sharedScopeId = ScopeIdSchema.make("org_shared_sdk_pair_test");
	191
	192	const workspaceRootA = yield* fs.makeTempDirectoryScoped({
	193	prefix: "executor-sdk-scope-a-",
	194	});
	195	const workspaceRootB = yield* fs.makeTempDirectoryScoped({
	196	prefix: "executor-sdk-scope-b-",
	197	});
	198
	199	const servicesA = yield* createLocalExecutorServicesEffect({
	200	workspaceRoot: workspaceRootA,
	201	homeConfigPath: join(workspaceRootA, ".executor-home.jsonc"),
	202	homeStateDirectory: join(workspaceRootA, ".executor-home-state"),
	203	});
	204	const servicesB = yield* createLocalExecutorServicesEffect({
	205	workspaceRoot: workspaceRootB,
	206	homeConfigPath: join(workspaceRootB, ".executor-home.jsonc"),
	207	homeStateDirectory: join(workspaceRootB, ".executor-home-state"),
	208	});
	209
	210	const baseInstallationA =
	211	yield* servicesA.storage.installation.getOrProvision();
	212	const baseInstallationB =
	213	yield* servicesB.storage.installation.getOrProvision();
	214
	215	const sharedStorageClose = (() => {
	216	let closed = false;
	217	return async () => {
	218	if (closed) {
	219	return;
	220	}
	221	closed = true;
	222	await servicesA.storage.close?.();
	223	await servicesB.storage.close?.();
	224	};
	225	})();
	226
	227	const sharedStorage = {
	228	executorState: servicesA.storage.executorState,
	229	secretMaterial: servicesA.storage.secretMaterial,
	230	close: sharedStorageClose,
	231	};
	232
	233	const installationA: LocalInstallation = {
	234	...baseInstallationA,
	235	actorScopeId: ScopeIdSchema.make("acc_sdk_executor_a"),
	236	resolutionScopeIds: [
	237	baseInstallationA.scopeId,
	238	sharedScopeId,
	239	ScopeIdSchema.make("acc_sdk_executor_a"),
	240	],
	241	};
	242	const installationB: LocalInstallation = {
	243	...baseInstallationB,
	244	actorScopeId: ScopeIdSchema.make("acc_sdk_executor_b"),
	245	resolutionScopeIds: [
	246	baseInstallationB.scopeId,
	247	sharedScopeId,
	248	ScopeIdSchema.make("acc_sdk_executor_b"),
	249	],
	250	};
	251
	252	const executorA = yield* createScopedExecutor({
	253	services: {
	254	...servicesA,
	255	storage: {
	256	...servicesA.storage,
	257	...sharedStorage,
	258	},
	259	},
	260	installation: installationA,
	261	});
	262	const executorB = yield* createScopedExecutor({
	263	services: {
	264	...servicesB,
	265	storage: {
	266	...servicesB.storage,
	267	...sharedStorage,
	268	},
	269	},
	270	installation: installationB,
	271	});
	272
	273	return {
	274	executorA,
	275	executorB,
	276	sharedScopeId,
	277	};
	278	}).pipe(Effect.provide(NodeFileSystem.layer)),
	279	({ executorA, executorB }) =>
	280	Effect.promise(async () => {
	281	await executorA.close();
	282	await executorB.close();
	283	}).pipe(Effect.orDie),
	284	);
	285
	286	describe("executor", () => {
	287	it.scoped(
	288	"keeps workspace sources isolated across executors that share an ancestor scope",
	289	() =>
	290	Effect.gen(function* () {
	291	const { executorA, executorB, sharedScopeId } =
	292	yield* makeSharedScopeExecutors;
	293	const openApiServer: OpenApiSpecServer = yield* makeOpenApiTestServer({
	294	apiLayer: workspaceSourceReposApiLayer,
	295	});
	296
	297	expect(executorA.resolutionScopeIds).toContain(sharedScopeId);
	298	expect(executorB.resolutionScopeIds).toContain(sharedScopeId);
	299
	300	const sourceA = yield* withExecutorApiClient(executorA, (client) =>
	301	client.sources.create({
	302	path: {
	303	workspaceId: executorA.scopeId,
	304	},
	305	payload: {
	306	name: "Workspace A Source",
	307	kind: "openapi",
	308	endpoint: openApiServer.baseUrl,
	309	namespace: "workspace.a",
	310	binding: {
	311	specUrl: openApiServer.specUrl,
	312	defaultHeaders: null,
	313	},
	314	auth: { kind: "none" },
	315	},
	316	}),
	317	);
	318	const sourceB = yield* withExecutorApiClient(executorB, (client) =>
	319	client.sources.create({
	320	path: {
	321	workspaceId: executorB.scopeId,
	322	},
	323	payload: {
	324	name: "Workspace B Source",
	325	kind: "openapi",
	326	endpoint: openApiServer.baseUrl,
	327	namespace: "workspace.b",
	328	binding: {
	329	specUrl: openApiServer.specUrl,
	330	defaultHeaders: null,
	331	},
	332	auth: { kind: "none" },
	333	},
	334	}),
	335	);
	336
	337	const listedA = yield* withExecutorApiClient(executorA, (client) =>
	338	client.sources.list({
	339	path: {
	340	workspaceId: executorA.scopeId,
	341	},
	342	}),
	343	);
	344	const listedB = yield* withExecutorApiClient(executorB, (client) =>
	345	client.sources.list({
	346	path: {
	347	workspaceId: executorB.scopeId,
	348	},
	349	}),
	350	);
	351
	352	expect(listedA.map((source) => source.id)).toEqual([sourceA.id]);
	353	expect(listedB.map((source) => source.id)).toEqual([sourceB.id]);
	354
	355	const lookupFromSibling = yield* expectLeft(
	356	withExecutorApiClient(executorB, (client) =>
	357	client.sources.get({
	358	path: {
	359	workspaceId: executorB.scopeId,
	360	sourceId: sourceA.id,
	361	},
	362	}),
	363	),
	364	);
	365	assertInclude(String(lookupFromSibling), "Source not found");
	366	}),
	367	);
	368
	369	it.scoped(
	370	"keeps each executor's tool surface tied to its own workspace sources",
	371	() =>
	372	Effect.gen(function* () {
	373	const { executorA, executorB } =
	374	yield* makeSharedScopeExecutors;
	375	const openApiServerA: OpenApiSpecServer = yield* makeOpenApiTestServer({
	376	apiLayer: workspaceSourceReposApiLayer,
	377	});
	378	const openApiServerB: OpenApiSpecServer = yield* makeOpenApiTestServer({
	379	apiLayer: workspaceSourceIssuesApiLayer,
	380	});
	381
	382	const sourceA = yield* withExecutorApiClient(executorA, (client) =>
	383	client.sources.create({
	384	path: {
	385	workspaceId: executorA.scopeId,
	386	},
	387	payload: {
	388	name: "Workspace A Tools",
	389	kind: "openapi",
	390	endpoint: openApiServerA.baseUrl,
	391	namespace: "workspace.a",
	392	binding: {
	393	specUrl: openApiServerA.specUrl,
	394	defaultHeaders: null,
	395	},
	396	auth: { kind: "none" },
	397	},
	398	}),
	399	);
	400	const sourceB = yield* withExecutorApiClient(executorB, (client) =>
	401	client.sources.create({
	402	path: {
	403	workspaceId: executorB.scopeId,
	404	},
	405	payload: {
	406	name: "Workspace B Tools",
	407	kind: "openapi",
	408	endpoint: openApiServerB.baseUrl,
	409	namespace: "workspace.b",
	410	binding: {
	411	specUrl: openApiServerB.specUrl,
	412	defaultHeaders: null,
	413	},
	414	auth: { kind: "none" },
	415	},
	416	}),
	417	);
	418
	419	const inspectionA = yield* withExecutorApiClient(executorA, (client) =>
	420	client.sources.inspection({
	421	path: {
	422	workspaceId: executorA.scopeId,
	423	sourceId: sourceA.id,
	424	},
	425	}),
	426	);
	427	const inspectionB = yield* withExecutorApiClient(executorB, (client) =>
	428	client.sources.inspection({
	429	path: {
	430	workspaceId: executorB.scopeId,
	431	sourceId: sourceB.id,
	432	},
	433	}),
	434	);
	435
	436	expect(inspectionA.toolCount).toBe(1);
	437	expect(inspectionB.toolCount).toBe(2);
	438
	439	const siblingInspection = yield* expectLeft(
	440	withExecutorApiClient(executorA, (client) =>
	441	client.sources.inspection({
	442	path: {
	443	workspaceId: executorA.scopeId,
	444	sourceId: sourceB.id,
	445	},
	446	}),
	447	),
	448	);
	449	assertInclude(String(siblingInspection), "Source not found");
	450	}),
	451	60_000,
	452	);
	453	});

packages/platform/sdk/src/executor.ts+95−78

 import * as Effect from "effect/Effect";
 import type {
-  AccountId,
+  ScopeId,
   Execution,
   ExecutionEnvelope,
   ExecutionInteraction,
   LocalInstallation,
-  LocalWorkspacePolicy,
+  LocalScopePolicy,
   ProviderAuthGrant,
   Source,
-  WorkspaceId,
+  ScopeOauthClient,
-  WorkspaceOauthClient,
+} from "./schema";
+import {
+  ExecutionIdSchema,
 } from "./schema";
-import { ExecutionIdSchema } from "./schema";
+import type {
-import type { CreateExecutionPayload, ResumeExecutionPayload } from "./executions/contracts";
+  CreateExecutionPayload,
+  ResumeExecutionPayload,
+} from "./executions/contracts";
 import type {
   CreateSecretPayload,
   CreateSecretResult,
   listLocalSecrets,
   updateLocalSecret,
 } from "./local/secrets";
-import type { CreatePolicyPayload, UpdatePolicyPayload } from "./policies/contracts";
+import type {
+  CreatePolicyPayload,
+  UpdatePolicyPayload,
+} from "./policies/contracts";
 import {
   createPolicy,
   getPolicy,
 } from "./policies/operations";
 import type {
   CreateSourcePayload,
-  CreateWorkspaceOauthClientPayload,
+  CreateScopeOauthClientPayload,
   UpdateSourcePayload,
 } from "./sources/contracts";
-import { discoverSource } from "./sources/discovery";
+import {
+  discoverSource,
+} from "./sources/discovery";
 import {
   discoverSourceInspectionTools,
   getSourceInspection,
   removeSource,
   updateSource,
 } from "./sources/operations";
-import type { ExecutorBackend } from "./backend";
+import type {
+  ExecutorBackend,
+} from "./backend";
 import {
   provideExecutorRuntime,
   type ExecutorRuntime,
   type ExecutorRuntimeOptions,
-  type CreateWorkspaceInternalToolMap,
+  type CreateScopeInternalToolMap,
   type ResolveExecutionEnvironment,
   type ResolveSecretMaterial,
   RuntimeSourceAuthServiceTag,
 } from "./runtime";
-import { createExecution, getExecution, resumeExecution } from "./runtime/execution/service";
+import {
+  createExecution,
+  getExecution,
+  resumeExecution,
+} from "./runtime/execution/service";
 import type {
   CompleteProviderOauthCallbackResult,
   CompleteSourceCredentialSetupResult,
 export type ExecutorSourceInput = DistributiveOmit<
   ExecutorAddSourceInput,
-  "workspaceId" | "actorAccountId" | "executionId" | "interactionId"
+  "scopeId" | "actorScopeId" | "executionId" | "interactionId"
 >;
 export type ExecutorSourceBatchInput = DistributiveOmit<
   ConnectGoogleDiscoveryBatchInput,
-  "workspaceId" | "actorAccountId" | "executionId" | "interactionId"
+  "scopeId" | "actorScopeId" | "executionId" | "interactionId"
 >;
 export type ExecutorMcpSourceInput = DistributiveOmit<
   ConnectMcpSourceInput,
-  "workspaceId" | "actorAccountId"
+  "scopeId" | "actorScopeId"
 >;
 export type ExecutorSourceOAuthInput = DistributiveOmit<
   StartSourceOAuthSessionInput,
-  "workspaceId" | "actorAccountId"
+  "scopeId" | "actorScopeId"
 >;
 export type Executor = {
   runtime: ExecutorRuntime;
   installation: LocalInstallation;
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
-  accountId: AccountId;
+  actorScopeId: ScopeId;
+  resolutionScopeIds: ReadonlyArray<ScopeId>;
   provide: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, any>;
   run: <A, E, R>(effect: Effect.Effect<A, E, R>) => Promise<A>;
   close: () => Promise<void>;
       oauthClients: {
         list: (
           providerKey: string,
-        ) => Effect.Effect<ReadonlyArray<WorkspaceOauthClient>, Error, never>;
+        ) => Effect.Effect<ReadonlyArray<ScopeOauthClient>, Error, never>;
         create: (
-          payload: CreateWorkspaceOauthClientPayload,
+          payload: CreateScopeOauthClientPayload,
-        ) => Effect.Effect<WorkspaceOauthClient, Error, never>;
+        ) => Effect.Effect<ScopeOauthClient, Error, never>;
         remove: (
-          oauthClientId: WorkspaceOauthClient["id"],
+          oauthClientId: ScopeOauthClient["id"],
         ) => Effect.Effect<boolean, Error, never>;
       };
       providerGrants: {
         errorDescription?: string | null;
       }) => Effect.Effect<CompleteSourceOAuthSessionResult, Error, never>;
       completeProviderCallback: (input: {
-        workspaceId?: WorkspaceId;
+        scopeId?: ScopeId;
-        actorAccountId?: AccountId | null;
+        actorScopeId?: ScopeId | null;
         state: string;
         code?: string | null;
         error?: string | null;
     remove: (secretId: string) => Promise<DeleteSecretResult>;
   };
   policies: {
-    list: () => Promise<ReadonlyArray<LocalWorkspacePolicy>>;
+    list: () => Promise<ReadonlyArray<LocalScopePolicy>>;
-    create: (payload: CreatePolicyPayload) => Promise<LocalWorkspacePolicy>;
+    create: (payload: CreatePolicyPayload) => Promise<LocalScopePolicy>;
-    get: (policyId: string) => Promise<LocalWorkspacePolicy>;
+    get: (policyId: string) => Promise<LocalScopePolicy>;
     update: (
       policyId: string,
       payload: UpdatePolicyPayload,
-    ) => Promise<LocalWorkspacePolicy>;
+    ) => Promise<LocalScopePolicy>;
     remove: (policyId: string) => Promise<boolean>;
   };
   sources: {
       }) => Promise<Effect.Effect.Success<ReturnType<typeof discoverSourceInspectionTools>>>;
     };
     oauthClients: {
-      list: (providerKey: string) => Promise<ReadonlyArray<WorkspaceOauthClient>>;
+      list: (providerKey: string) => Promise<ReadonlyArray<ScopeOauthClient>>;
       create: (
-        payload: CreateWorkspaceOauthClientPayload,
+        payload: CreateScopeOauthClientPayload,
-      ) => Promise<WorkspaceOauthClient>;
+      ) => Promise<ScopeOauthClient>;
-      remove: (oauthClientId: WorkspaceOauthClient["id"]) => Promise<boolean>;
+      remove: (oauthClientId: ScopeOauthClient["id"]) => Promise<boolean>;
     };
     providerGrants: {
       remove: (grantId: ProviderAuthGrant["id"]) => Promise<boolean>;
       errorDescription?: string | null;
     }) => Promise<CompleteSourceOAuthSessionResult>;
     completeProviderCallback: (input: {
-      workspaceId?: WorkspaceId;
+      scopeId?: ScopeId;
-      actorAccountId?: AccountId | null;
+      actorScopeId?: ScopeId | null;
       state: string;
       code?: string | null;
       error?: string | null;
 const fromRuntime = (runtime: ExecutorRuntime): Executor => {
   const installation = runtime.localInstallation;
-  const workspaceId = installation.workspaceId;
+  const scopeId = installation.scopeId;
-  const accountId = installation.accountId;
+  const actorScopeId = installation.actorScopeId;
   const provide = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
     provideExecutorRuntime(effect, runtime);
   const run = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
         get: ({ sourceId, interactionId }) =>
           provide(
             getSourceCredentialInteraction({
-              workspaceId,
+              scopeId,
               sourceId,
               interactionId,
             }),
         submit: ({ sourceId, interactionId, action, token }) =>
           provide(
             submitSourceCredentialInteraction({
-              workspaceId,
+              scopeId,
               sourceId,
               interactionId,
               action,
         complete: ({ sourceId, state, code, error, errorDescription }) =>
           provide(
             completeSourceCredentialSetup({
-              workspaceId,
+              scopeId,
               sourceId,
               state,
               code,
       remove: (secretId: string) => provide(deleteLocalSecret(secretId)),
     },
     policies: {
-      list: () => provide(listPolicies(workspaceId)),
+      list: () => provide(listPolicies(scopeId)),
       create: (payload: CreatePolicyPayload) =>
-        provide(createPolicy({ workspaceId, payload })),
+        provide(createPolicy({ scopeId, payload })),
       get: (policyId: string) =>
-        provide(getPolicy({ workspaceId, policyId: policyId as never })),
+        provide(getPolicy({ scopeId, policyId: policyId as never })),
       update: (policyId: string, payload: UpdatePolicyPayload) =>
-        provide(updatePolicy({ workspaceId, policyId: policyId as never, payload })),
+        provide(updatePolicy({ scopeId, policyId: policyId as never, payload })),
       remove: (policyId: string) =>
-        provide(removePolicy({ workspaceId, policyId: policyId as never })),
+        provide(removePolicy({ scopeId, policyId: policyId as never })),
     },
     sources: {
       add: (input: ExecutorSourceInput, options?: { baseUrl?: string | null }) =>
           return service.addExecutorSource(
             {
               ...input,
-              workspaceId,
+              scopeId,
-              actorAccountId: accountId,
+              actorScopeId: actorScopeId,
               executionId: session.executionId,
               interactionId: session.interactionId,
             },
         provideSourceAuth((service) =>
           service.connectMcpSource({
             ...payload,
-            workspaceId,
+            scopeId,
-            actorAccountId: accountId,
+            actorScopeId: actorScopeId,
           }),
         ),
       connectBatch: (payload: ExecutorSourceBatchInput) =>
           const session = createSdkSourceSession();
           return service.connectGoogleDiscoveryBatch({
             ...payload,
-            workspaceId,
+            scopeId,
-            actorAccountId: accountId,
+            actorScopeId: actorScopeId,
             executionId: session.executionId,
             interactionId: session.interactionId,
           });
         url: string;
         probeAuth?: Parameters<typeof discoverSource>[0]["probeAuth"];
       }) => provide(discoverSource(input)),
-      list: () => provide(listSources({ workspaceId, accountId })),
+      list: () => provide(listSources({ scopeId, actorScopeId })),
       create: (payload: CreateSourcePayload) =>
-        provide(createSource({ workspaceId, accountId, payload })),
+        provide(createSource({ scopeId, actorScopeId, payload })),
       get: (sourceId: Source["id"]) =>
-        provide(getSource({ workspaceId, sourceId, accountId })),
+        provide(getSource({ scopeId, sourceId, actorScopeId })),
       update: (sourceId: Source["id"], payload: UpdateSourcePayload) =>
-        provide(updateSource({ workspaceId, sourceId, accountId, payload })),
+        provide(updateSource({ scopeId, sourceId, actorScopeId, payload })),
       remove: (sourceId: Source["id"]) =>
-        provide(removeSource({ workspaceId, sourceId })),
+        provide(removeSource({ scopeId, sourceId })),
       inspection: {
         get: (sourceId: Source["id"]) =>
-          provide(getSourceInspection({ workspaceId, sourceId })),
+          provide(getSourceInspection({ scopeId, sourceId })),
         tool: ({ sourceId, toolPath }: { sourceId: Source["id"]; toolPath: string }) =>
           provide(
             getSourceInspectionToolDetail({
-              workspaceId,
+              scopeId,
               sourceId,
               toolPath,
             }),
         }) =>
           provide(
             discoverSourceInspectionTools({
-              workspaceId,
+              scopeId,
               sourceId,
               payload,
             }),
       oauthClients: {
         list: (providerKey: string) =>
           provideSourceAuth((service) =>
-            service.listWorkspaceOauthClients({
+            service.listScopeOauthClients({
-              workspaceId,
+              scopeId,
               providerKey,
             }),
           ),
-        create: (payload: CreateWorkspaceOauthClientPayload) =>
+        create: (payload: CreateScopeOauthClientPayload) =>
           provideSourceAuth((service) =>
-            service.createWorkspaceOauthClient({
+            service.createScopeOauthClient({
-              workspaceId,
+              scopeId,
               providerKey: payload.providerKey,
               label: payload.label,
               oauthClient: payload.oauthClient,
             }),
           ),
-        remove: (oauthClientId: WorkspaceOauthClient["id"]) =>
+        remove: (oauthClientId: ScopeOauthClient["id"]) =>
           provideSourceAuth((service) =>
-            service.removeWorkspaceOauthClient({
+            service.removeScopeOauthClient({
-              workspaceId,
+              scopeId,
               oauthClientId,
             }),
           ),
         remove: (grantId: ProviderAuthGrant["id"]) =>
           provideSourceAuth((service) =>
             service.removeProviderAuthGrant({
-              workspaceId,
+              scopeId,
               grantId,
             }),
           ),
         provideSourceAuth((service) =>
           service.startSourceOAuthSession({
             ...input,
-            workspaceId,
+            scopeId,
-            actorAccountId: accountId,
+            actorScopeId: actorScopeId,
           }),
         ),
       completeSourceAuth: ({ state, code, error, errorDescription }) =>
         provideSourceAuth((service) =>
           service.completeProviderOauthCallback({
             ...input,
-            workspaceId: input.workspaceId ?? workspaceId,
+            scopeId: input.scopeId ?? scopeId,
-            actorAccountId: input.actorAccountId ?? accountId,
+            actorScopeId: input.actorScopeId ?? actorScopeId,
           }),
         ),
     },
       create: (payload: CreateExecutionPayload) =>
         provide(
           createExecution({
-            workspaceId,
+            scopeId,
             payload,
-            createdByAccountId: accountId,
+            createdByScopeId: actorScopeId,
           }),
         ),
       get: (executionId: Execution["id"]) =>
-        provide(getExecution({ workspaceId, executionId })),
+        provide(getExecution({ scopeId, executionId })),
       resume: (executionId: Execution["id"], payload: ResumeExecutionPayload) =>
         provide(
           resumeExecution({
-            workspaceId,
+            scopeId,
             executionId,
             payload,
-            resumedByAccountId: accountId,
+            resumedByScopeId: actorScopeId,
           }),
         ),
     },
   return {
     runtime,
     installation,
-    workspaceId,
+    scopeId,
-    accountId,
+    actorScopeId,
+    resolutionScopeIds: installation.resolutionScopeIds,
     provide,
     run,
     close: () => runtime.close(),

packages/platform/sdk/src/local/contracts.ts+3−1

@@ -1,4 +1,6 @@
1	import { SecretMaterialPurposeSchema } from "../schema";	1	import {
		2	SecretMaterialPurposeSchema,
		3	} from "../schema";
2	import * as Schema from "effect/Schema";	4	import * as Schema from "effect/Schema";
3		5
4	export const SecretProviderSchema = Schema.Struct({	6	export const SecretProviderSchema = Schema.Struct({

packages/platform/sdk/src/local/operations.ts+32−20

   Execution,
   ExecutionInteraction,
   Source,
-  WorkspaceId,
+  ScopeId,
 } from "../schema";
 import {
   SourceIdSchema,
-  WorkspaceIdSchema,
+  ScopeIdSchema,
 } from "../schema";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
-import { submitExecutionInteractionResponse } from "../runtime/execution/service";
+import {
-import { LiveExecutionManagerService } from "../runtime/execution/live";
+  submitExecutionInteractionResponse,
-import { operationErrors } from "../runtime/policy/operation-errors";
+} from "../runtime/execution/service";
-import { InstallationStore } from "../runtime/workspace/storage";
+import {
-import { RuntimeSourceAuthServiceTag } from "../runtime/sources/source-auth-service";
+  LiveExecutionManagerService,
+} from "../runtime/execution/live";
+import {
+  operationErrors,
+} from "../runtime/policy/operation-errors";
+import {
+  InstallationStore,
+} from "../runtime/scope/storage";
+import {
+  RuntimeSourceAuthServiceTag,
+} from "../runtime/sources/source-auth-service";
 import {
   createSourceCredentialSelectionBearerContent,
   createSourceCredentialSelectionNoneContent,
 } from "../runtime/sources/source-credential-interactions";
-import { ExecutorStateStore } from "../runtime/executor-state-store";
+import {
+  ExecutorStateStore,
+} from "../runtime/executor-state-store";
 const localOps = {
   installation: operationErrors("local.installation.get"),
   executionId: Execution["id"];
   status: ExecutionInteraction["status"];
   message: string;
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: Source["id"];
   sourceLabel: string;
   endpoint: string;
       return null;
     }
-    const workspaceId = trimOrNull(asString(args.workspaceId));
+    const scopeId = trimOrNull(asString(args.scopeId));
     const sourceId = trimOrNull(asString(args.sourceId));
     const message = trimOrNull(asString(elicitation.message));
-    if (workspaceId === null || sourceId === null || message === null) {
+    if (scopeId === null || sourceId === null || message === null) {
       return null;
     }
       executionId: interaction.executionId,
       status: interaction.status,
       message,
-      workspaceId: WorkspaceIdSchema.make(workspaceId),
+      scopeId: ScopeIdSchema.make(scopeId),
       sourceId: SourceIdSchema.make(sourceId),
     };
   } catch {
 };
 const loadSourceCredentialInteraction = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: Source["id"];
   interactionId: ExecutionInteraction["id"];
   operation:
     const decoded = decodeSourceCredentialInteraction(stored.value);
     if (
       decoded === null ||
-      decoded.workspaceId !== input.workspaceId ||
+      decoded.scopeId !== input.scopeId ||
       decoded.sourceId !== input.sourceId
     ) {
       return yield* input.operation.notFound(
         "Source credential request not found",
-        `workspaceId=${input.workspaceId} sourceId=${input.sourceId} interactionId=${input.interactionId}`,
+        `scopeId=${input.scopeId} sourceId=${input.sourceId} interactionId=${input.interactionId}`,
       );
     }
     const source = yield* sourceAuthService
       .getSourceById({
-        workspaceId: input.workspaceId,
+        scopeId: input.scopeId,
         sourceId: input.sourceId,
       })
       .pipe(
   });
 export const getSourceCredentialInteraction = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: Source["id"];
   interactionId: ExecutionInteraction["id"];
 }) =>
   });
 export const submitSourceCredentialInteraction = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: Source["id"];
   interactionId: ExecutionInteraction["id"];
   action: "submit" | "continue" | "cancel";
 }) =>
   Effect.gen(function* () {
     const interaction = yield* loadSourceCredentialInteraction({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       sourceId: input.sourceId,
       interactionId: input.interactionId,
       operation: localOps.sourceCredentialSubmit,
   });
 export const completeSourceCredentialSetup = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: Source["id"];
   state: string;
   code?: string | null;

packages/platform/sdk/src/local/secrets.ts+18−10

 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
-import { SecretMaterialIdSchema } from "../schema";
+import {
+  SecretMaterialIdSchema,
+} from "../schema";
 import {
   type CreateSecretPayload,
   type CreateSecretResult,
   ControlPlaneNotFoundError,
   ControlPlaneStorageError,
 } from "../errors";
-import { requireRuntimeLocalWorkspace } from "../runtime/workspace/runtime-context";
+import {
+  requireRuntimeLocalScope,
+} from "../runtime/scope/runtime-context";
 import {
   LocalInstanceConfigService,
   SecretMaterialDeleterService,
   SecretMaterialStorerService,
   SecretMaterialUpdaterService,
-} from "../runtime/workspace/secret-material-providers";
+} from "../runtime/scope/secret-material-providers";
-import { RuntimeSourceStoreService } from "../runtime/sources/source-store";
+import {
-import { ExecutorStateStore } from "../runtime/executor-state-store";
+  RuntimeSourceStoreService,
+} from "../runtime/sources/source-store";
+import {
+  ExecutorStateStore,
+} from "../runtime/executor-state-store";
 const secretStorageError = (operation: string, message: string) =>
   new ControlPlaneStorageError({
   Effect.gen(function* () {
     const store = yield* ExecutorStateStore;
     const sourceStore = yield* RuntimeSourceStoreService;
-    const runtimeLocalWorkspace = yield* requireRuntimeLocalWorkspace().pipe(
+    const runtimeLocalScope = yield* requireRuntimeLocalScope().pipe(
       Effect.mapError(() =>
-        secretStorageError("secrets.list", "Failed resolving local workspace."),
+        secretStorageError("secrets.list", "Failed resolving local scope."),
       ),
     );
     const secretMaterials = yield* store.secretMaterials
         ),
       );
     const linkedSourcesMap = yield* sourceStore
-      .listLinkedSecretSourcesInWorkspace(
+      .listLinkedSecretSourcesInScope(
-        runtimeLocalWorkspace.installation.workspaceId,
+        runtimeLocalScope.installation.scopeId,
         {
-          actorAccountId: runtimeLocalWorkspace.installation.accountId,
+          actorScopeId: runtimeLocalScope.installation.actorScopeId,
         },
       )
       .pipe(

packages/platform/sdk/src/policies/contracts.ts+10−8

@@ -1,23 +1,25 @@
1	import {	1	import {
2	LocalWorkspacePolicyApprovalModeSchema,	2	LocalScopePolicyApprovalModeSchema,
3	LocalWorkspacePolicyEffectSchema,	3	LocalScopePolicyEffectSchema,
4	} from "../schema";	4	} from "../schema";
5	import * as Schema from "effect/Schema";	5	import * as Schema from "effect/Schema";
6		6
7	import { OptionalTrimmedNonEmptyStringSchema } from "../string-schemas";	7	import {
		8	OptionalTrimmedNonEmptyStringSchema,
		9	} from "../string-schemas";
8		10
9	const LocalWorkspacePolicyPayloadSchema = Schema.Struct({	11	const LocalScopePolicyPayloadSchema = Schema.Struct({
10	resourcePattern: OptionalTrimmedNonEmptyStringSchema,	12	resourcePattern: OptionalTrimmedNonEmptyStringSchema,
11	effect: Schema.optional(LocalWorkspacePolicyEffectSchema),	13	effect: Schema.optional(LocalScopePolicyEffectSchema),
12	approvalMode: Schema.optional(LocalWorkspacePolicyApprovalModeSchema),	14	approvalMode: Schema.optional(LocalScopePolicyApprovalModeSchema),
13	priority: Schema.optional(Schema.Number),	15	priority: Schema.optional(Schema.Number),
14	enabled: Schema.optional(Schema.Boolean),	16	enabled: Schema.optional(Schema.Boolean),
15	});	17	});
16		18
17	export const CreatePolicyPayloadSchema = LocalWorkspacePolicyPayloadSchema;	19	export const CreatePolicyPayloadSchema = LocalScopePolicyPayloadSchema;
18		20
19	export type CreatePolicyPayload = typeof CreatePolicyPayloadSchema.Type;	21	export type CreatePolicyPayload = typeof CreatePolicyPayloadSchema.Type;
20		22
21	export const UpdatePolicyPayloadSchema = LocalWorkspacePolicyPayloadSchema;	23	export const UpdatePolicyPayloadSchema = LocalScopePolicyPayloadSchema;
22		24
23	export type UpdatePolicyPayload = typeof UpdatePolicyPayloadSchema.Type;	25	export type UpdatePolicyPayload = typeof UpdatePolicyPayloadSchema.Type;

packages/platform/sdk/src/policies/operations.ts+135−127

-import { createHash } from "node:crypto";
+import {
+  createHash,
+} from "node:crypto";
 import type {
   CreatePolicyPayload,
 import {
   PolicyIdSchema,
   type LocalExecutorConfig,
-  type LocalWorkspacePolicy,
+  type LocalScopePolicy,
   type PolicyId,
-  type WorkspaceId,
+  type ScopeId,
 } from "../schema";
 import * as Effect from "effect/Effect";
-import { requireRuntimeLocalWorkspace } from "../runtime/workspace/runtime-context";
+import {
+  requireRuntimeLocalScope,
+} from "../runtime/scope/runtime-context";
 import type {
-  WorkspaceConfigStoreShape,
+  ScopeConfigStoreShape,
-  WorkspaceStateStoreShape,
+  ScopeStateStoreShape,
-} from "../runtime/workspace/storage";
+} from "../runtime/scope/storage";
+import {
+  ScopeConfigStore,
+  ScopeStateStore,
+} from "../runtime/scope/storage";
+import {
+  type LocalScopeState,
+} from "../runtime/scope-state";
 import {
-  WorkspaceConfigStore,
+  derivePolicyConfigKey,
-  WorkspaceStateStore,
+} from "../runtime/scope/scope-sync";
-} from "../runtime/workspace/storage";
-import { type LocalWorkspaceState } from "../runtime/workspace-state";
-import { derivePolicyConfigKey } from "../runtime/workspace/workspace-sync";
 import {
   type OperationErrors,
   operationErrors,
 const cloneJson = <T>(value: T): T => JSON.parse(JSON.stringify(value)) as T;
-const workspacePolicyStableKey = (input: {
+const scopePolicyStableKey = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
-  workspaceRoot?: string | null;
+  scopeRoot?: string | null;
-}): string => input.workspaceRoot?.trim() || input.workspaceId;
+}): string => input.scopeRoot?.trim() || input.scopeId;
 const localPolicyIdForKey = (input: {
-  workspaceStableKey: string;
+  scopeStableKey: string;
   key: string;
 }): PolicyId =>
   PolicyIdSchema.make(
-    `pol_local_${createHash("sha256").update(`${input.workspaceStableKey}:${input.key}`).digest("hex").slice(0, 16)}`,
+    `pol_local_${createHash("sha256").update(`${input.scopeStableKey}:${input.key}`).digest("hex").slice(0, 16)}`,
   );
-const toLocalWorkspacePolicy = (input: {
+const toLocalScopePolicy = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
-  workspaceStableKey: string;
+  scopeStableKey: string;
   key: string;
   policyConfig: NonNullable<LocalExecutorConfig["policies"]>[string];
-  state: LocalWorkspaceState["policies"][string] | undefined;
+  state: LocalScopeState["policies"][string] | undefined;
-}): LocalWorkspacePolicy => ({
+}): LocalScopePolicy => ({
   id:
     input.state?.id ??
     localPolicyIdForKey({
-      workspaceStableKey: input.workspaceStableKey,
+      scopeStableKey: input.scopeStableKey,
       key: input.key,
     }),
   key: input.key,
-  workspaceId: input.workspaceId,
+  scopeId: input.scopeId,
   resourcePattern: input.policyConfig.match.trim(),
   effect: input.policyConfig.action,
   approvalMode: input.policyConfig.approval === "manual" ? "required" : "auto",
   updatedAt: input.state?.updatedAt ?? Date.now(),
 });
-export const loadRuntimeLocalWorkspacePolicies = (workspaceId: WorkspaceId) =>
+export const loadRuntimeLocalScopePolicies = (scopeId: ScopeId) =>
   Effect.gen(function* () {
-    const runtimeLocalWorkspace =
+    const runtimeLocalScope =
-      yield* requireRuntimeLocalWorkspace(workspaceId);
+      yield* requireRuntimeLocalScope(scopeId);
-    const workspaceConfigStore = yield* WorkspaceConfigStore;
+    const scopeConfigStore = yield* ScopeConfigStore;
-    const workspaceStateStore = yield* WorkspaceStateStore;
+    const scopeStateStore = yield* ScopeStateStore;
-    const loadedConfig = yield* workspaceConfigStore.load();
+    const loadedConfig = yield* scopeConfigStore.load();
-    const workspaceState = yield* workspaceStateStore.load();
+    const scopeState = yield* scopeStateStore.load();
     const policies = Object.entries(loadedConfig.config?.policies ?? {}).map(
       ([key, policyConfig]) =>
-        toLocalWorkspacePolicy({
+        toLocalScopePolicy({
-          workspaceId,
+          scopeId,
-          workspaceStableKey: workspacePolicyStableKey({
+          scopeStableKey: scopePolicyStableKey({
-            workspaceId,
+            scopeId,
-            workspaceRoot: runtimeLocalWorkspace.workspace.workspaceRoot,
+            scopeRoot: runtimeLocalScope.scope.scopeRoot,
           }),
           key,
           policyConfig,
-          state: workspaceState.policies[key],
+          state: scopeState.policies[key],
         }),
     );
     return {
-      runtimeLocalWorkspace,
+      runtimeLocalScope,
       loadedConfig,
-      workspaceState,
+      scopeState,
       policies,
     };
   });
 const writeLocalPolicyFiles = (input: {
   operation: OperationErrors;
-  workspaceConfigStore: WorkspaceConfigStoreShape;
+  scopeConfigStore: ScopeConfigStoreShape;
-  workspaceStateStore: WorkspaceStateStoreShape;
+  scopeStateStore: ScopeStateStoreShape;
   projectConfig: LocalExecutorConfig;
-  workspaceState: LocalWorkspaceState;
+  scopeState: LocalScopeState;
 }) =>
   Effect.all(
     [
-      input.workspaceConfigStore.writeProject({
+      input.scopeConfigStore.writeProject({
         config: input.projectConfig,
       }),
-      input.workspaceStateStore.write({
+      input.scopeStateStore.write({
-        state: input.workspaceState,
+        state: input.scopeState,
       }),
     ],
     { discard: true },
     Effect.mapError((cause) =>
       input.operation.unknownStorage(
         cause,
-        "Failed writing local workspace policy files",
+        "Failed writing local scope policy files",
       ),
     ),
   );
-const loadWorkspacePolicyContext = (
+const loadScopePolicyContext = (
   operation: OperationErrors,
-  workspaceId: WorkspaceId,
+  scopeId: ScopeId,
 ) =>
-  requireRuntimeLocalWorkspace(workspaceId).pipe(
+  requireRuntimeLocalScope(scopeId).pipe(
     Effect.mapError((cause) =>
       operation.notFound(
         "Workspace not found",
     ),
   );
-export const listPolicies = (workspaceId: WorkspaceId) =>
+export const listPolicies = (scopeId: ScopeId) =>
   Effect.gen(function* () {
-    yield* loadWorkspacePolicyContext(policyOps.list, workspaceId);
+    yield* loadScopePolicyContext(policyOps.list, scopeId);
-    const localWorkspace = yield* loadRuntimeLocalWorkspacePolicies(
+    const localScope = yield* loadRuntimeLocalScopePolicies(
-      workspaceId,
+      scopeId,
     ).pipe(
       Effect.mapError((cause) =>
         policyOps.list.unknownStorage(
           cause,
-          "Failed loading local workspace policies",
+          "Failed loading local scope policies",
         ),
       ),
     );
-    return localWorkspace.policies;
+    return localScope.policies;
   });
 export const createPolicy = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   payload: CreatePolicyPayload;
 }) =>
   Effect.gen(function* () {
-    const runtimeLocalWorkspace = yield* loadWorkspacePolicyContext(
+    const runtimeLocalScope = yield* loadScopePolicyContext(
       policyOps.create,
-      input.workspaceId,
+      input.scopeId,
     );
-    const workspaceConfigStore = yield* WorkspaceConfigStore;
+    const scopeConfigStore = yield* ScopeConfigStore;
-    const workspaceStateStore = yield* WorkspaceStateStore;
+    const scopeStateStore = yield* ScopeStateStore;
-    const localWorkspace = yield* loadRuntimeLocalWorkspacePolicies(
+    const localScope = yield* loadRuntimeLocalScopePolicies(
-      input.workspaceId,
+      input.scopeId,
     ).pipe(
       Effect.mapError((cause) =>
         policyOps.create.unknownStorage(
           cause,
-          "Failed loading local workspace policies",
+          "Failed loading local scope policies",
         ),
       ),
     );
     const now = Date.now();
     const projectConfig = cloneJson(
-      localWorkspace.loadedConfig.projectConfig ?? {},
+      localScope.loadedConfig.projectConfig ?? {},
     );
     const policies = { ...projectConfig.policies };
     const key = derivePolicyConfigKey(
         : {}),
     };
-    const existingState = localWorkspace.workspaceState.policies[key];
+    const existingState = localScope.scopeState.policies[key];
-    const workspaceState: LocalWorkspaceState = {
+    const scopeState: LocalScopeState = {
-      ...localWorkspace.workspaceState,
+      ...localScope.scopeState,
       policies: {
-        ...localWorkspace.workspaceState.policies,
+        ...localScope.scopeState.policies,
         [key]: {
           id:
             existingState?.id ??
             localPolicyIdForKey({
-              workspaceStableKey: workspacePolicyStableKey({
+              scopeStableKey: scopePolicyStableKey({
-                workspaceId: input.workspaceId,
+                scopeId: input.scopeId,
-                workspaceRoot: runtimeLocalWorkspace.workspace.workspaceRoot,
+                scopeRoot: runtimeLocalScope.scope.scopeRoot,
               }),
               key,
             }),
     yield* writeLocalPolicyFiles({
       operation: policyOps.create,
-      workspaceConfigStore,
+      scopeConfigStore,
-      workspaceStateStore,
+      scopeStateStore,
       projectConfig: {
         ...projectConfig,
         policies,
       },
-      workspaceState,
+      scopeState,
     });
-    return toLocalWorkspacePolicy({
+    return toLocalScopePolicy({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
-      workspaceStableKey: workspacePolicyStableKey({
+      scopeStableKey: scopePolicyStableKey({
-        workspaceId: input.workspaceId,
+        scopeId: input.scopeId,
-        workspaceRoot: runtimeLocalWorkspace.workspace.workspaceRoot,
+        scopeRoot: runtimeLocalScope.scope.scopeRoot,
       }),
       key,
       policyConfig: policies[key]!,
-      state: workspaceState.policies[key],
+      state: scopeState.policies[key],
     });
   });
 export const getPolicy = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   policyId: PolicyId;
 }) =>
   Effect.gen(function* () {
-    yield* loadWorkspacePolicyContext(policyOps.get, input.workspaceId);
+    yield* loadScopePolicyContext(policyOps.get, input.scopeId);
-    const localWorkspace = yield* loadRuntimeLocalWorkspacePolicies(
+    const localScope = yield* loadRuntimeLocalScopePolicies(
-      input.workspaceId,
+      input.scopeId,
     ).pipe(
       Effect.mapError((cause) =>
         policyOps.get.unknownStorage(
           cause,
-          "Failed loading local workspace policies",
+          "Failed loading local scope policies",
         ),
       ),
     );
     const policy =
-      localWorkspace.policies.find(
+      localScope.policies.find(
         (candidate) => candidate.id === input.policyId,
       ) ?? null;
     if (policy === null) {
       return yield* policyOps.get.notFound(
         "Policy not found",
-        `workspaceId=${input.workspaceId} policyId=${input.policyId}`,
+        `scopeId=${input.scopeId} policyId=${input.policyId}`,
       );
     }
     return policy;
   });
 export const updatePolicy = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   policyId: PolicyId;
   payload: UpdatePolicyPayload;
 }) =>
   Effect.gen(function* () {
-    const runtimeLocalWorkspace = yield* loadWorkspacePolicyContext(
+    const runtimeLocalScope = yield* loadScopePolicyContext(
       policyOps.update,
-      input.workspaceId,
+      input.scopeId,
     );
-    const workspaceConfigStore = yield* WorkspaceConfigStore;
+    const scopeConfigStore = yield* ScopeConfigStore;
-    const workspaceStateStore = yield* WorkspaceStateStore;
+    const scopeStateStore = yield* ScopeStateStore;
-    const localWorkspace = yield* loadRuntimeLocalWorkspacePolicies(
+    const localScope = yield* loadRuntimeLocalScopePolicies(
-      input.workspaceId,
+      input.scopeId,
     ).pipe(
       Effect.mapError((cause) =>
         policyOps.update.unknownStorage(
           cause,
-          "Failed loading local workspace policies",
+          "Failed loading local scope policies",
         ),
       ),
     );
     const existing =
-      localWorkspace.policies.find(
+      localScope.policies.find(
         (candidate) => candidate.id === input.policyId,
       ) ?? null;
     if (existing === null) {
       return yield* policyOps.update.notFound(
         "Policy not found",
-        `workspaceId=${input.workspaceId} policyId=${input.policyId}`,
+        `scopeId=${input.scopeId} policyId=${input.policyId}`,
       );
     }
     const projectConfig = cloneJson(
-      localWorkspace.loadedConfig.projectConfig ?? {},
+      localScope.loadedConfig.projectConfig ?? {},
     );
     const policies = { ...projectConfig.policies };
     const existingConfig = policies[existing.key]!;
     };
     const updatedAt = Date.now();
-    const existingState = localWorkspace.workspaceState.policies[existing.key];
+    const existingState = localScope.scopeState.policies[existing.key];
-    const workspaceState: LocalWorkspaceState = {
+    const scopeState: LocalScopeState = {
-      ...localWorkspace.workspaceState,
+      ...localScope.scopeState,
       policies: {
-        ...localWorkspace.workspaceState.policies,
+        ...localScope.scopeState.policies,
         [existing.key]: {
           id: existing.id,
           createdAt: existingState?.createdAt ?? existing.createdAt,
     yield* writeLocalPolicyFiles({
       operation: policyOps.update,
-      workspaceConfigStore,
+      scopeConfigStore,
-      workspaceStateStore,
+      scopeStateStore,
       projectConfig: {
         ...projectConfig,
         policies,
       },
-      workspaceState,
+      scopeState,
     });
-    return toLocalWorkspacePolicy({
+    return toLocalScopePolicy({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
-      workspaceStableKey: workspacePolicyStableKey({
+      scopeStableKey: scopePolicyStableKey({
-        workspaceId: input.workspaceId,
+        scopeId: input.scopeId,
-        workspaceRoot: runtimeLocalWorkspace.workspace.workspaceRoot,
+        scopeRoot: runtimeLocalScope.scope.scopeRoot,
       }),
       key: existing.key,
       policyConfig: policies[existing.key]!,
-      state: workspaceState.policies[existing.key],
+      state: scopeState.policies[existing.key],
     });
   });
 export const removePolicy = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   policyId: PolicyId;
 }) =>
   Effect.gen(function* () {
-    const runtimeLocalWorkspace = yield* loadWorkspacePolicyContext(
+    const runtimeLocalScope = yield* loadScopePolicyContext(
       policyOps.remove,
-      input.workspaceId,
+      input.scopeId,
     );
-    const workspaceConfigStore = yield* WorkspaceConfigStore;
+    const scopeConfigStore = yield* ScopeConfigStore;
-    const workspaceStateStore = yield* WorkspaceStateStore;
+    const scopeStateStore = yield* ScopeStateStore;
-    const localWorkspace = yield* loadRuntimeLocalWorkspacePolicies(
+    const localScope = yield* loadRuntimeLocalScopePolicies(
-      input.workspaceId,
+      input.scopeId,
     ).pipe(
       Effect.mapError((cause) =>
         policyOps.remove.unknownStorage(
           cause,
-          "Failed loading local workspace policies",
+          "Failed loading local scope policies",
         ),
       ),
     );
     const existing =
-      localWorkspace.policies.find(
+      localScope.policies.find(
         (candidate) => candidate.id === input.policyId,
       ) ?? null;
     if (existing === null) {
     }
     const projectConfig = cloneJson(
-      localWorkspace.loadedConfig.projectConfig ?? {},
+      localScope.loadedConfig.projectConfig ?? {},
     );
     const policies = { ...projectConfig.policies };
     delete policies[existing.key];
     const { [existing.key]: _removedPolicy, ...remainingPolicies } =
-      localWorkspace.workspaceState.policies;
+      localScope.scopeState.policies;
     yield* writeLocalPolicyFiles({
       operation: policyOps.remove,
-      workspaceConfigStore,
+      scopeConfigStore,
-      workspaceStateStore,
+      scopeStateStore,
       projectConfig: {
         ...projectConfig,
         policies,
       },
-      workspaceState: {
+      scopeState: {
-        ...localWorkspace.workspaceState,
+        ...localScope.scopeState,
         policies: remainingPolicies,
       },
     });

packages/platform/sdk/src/runtime/auth/auth-artifacts.ts+19−15

-import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
+import type {
+  OAuthClientProvider,
+} from "@modelcontextprotocol/sdk/client/auth.js";
 import {
-  type AccountId,
+  type ScopeId,
   AuthGrantSetJsonSchema,
   McpOAuthAuthArtifactConfigJsonSchema,
   McpOAuthAuthArtifactKind,
 import type {
   ResolveSecretMaterial,
   SecretMaterialResolveContext,
-} from "../workspace/secret-material-providers";
+} from "../scope/secret-material-providers";
-import { runtimeEffectError } from "../effect-errors";
+import {
+  runtimeEffectError,
+} from "../effect-errors";
 export type ResolvedSourceAuthMaterial = {
   placements: ReadonlyArray<RequestPlacement>;
   source: Source;
   auth: SourceAuth;
   slot: CredentialSlot;
-  actorAccountId?: AccountId | null;
+  actorScopeId?: ScopeId | null;
   existingAuthArtifactId?: AuthArtifact["id"] | null;
 }): AuthArtifact | null => {
   if (input.auth.kind === "none") {
   if (input.auth.kind === "bearer") {
     return {
       id,
-      workspaceId: input.source.workspaceId,
+      scopeId: input.source.scopeId,
       sourceId: input.source.id,
-      actorAccountId: input.actorAccountId ?? null,
+      actorScopeId: input.actorScopeId ?? null,
       slot: input.slot,
       artifactKind: StaticBearerAuthArtifactKind,
       configJson: encodeStaticBearerAuthArtifactConfig({
   if (input.auth.kind === "oauth2_authorized_user") {
     return {
       id,
-      workspaceId: input.source.workspaceId,
+      scopeId: input.source.scopeId,
       sourceId: input.source.id,
-      actorAccountId: input.actorAccountId ?? null,
+      actorScopeId: input.actorScopeId ?? null,
       slot: input.slot,
       artifactKind: RefreshableOAuth2AuthorizedUserAuthArtifactKind,
       configJson: encodeRefreshableOAuth2AuthorizedUserAuthArtifactConfig({
   if (input.auth.kind === "provider_grant_ref") {
     return {
       id,
-      workspaceId: input.source.workspaceId,
+      scopeId: input.source.scopeId,
       sourceId: input.source.id,
-      actorAccountId: input.actorAccountId ?? null,
+      actorScopeId: input.actorScopeId ?? null,
       slot: input.slot,
       artifactKind: ProviderGrantRefAuthArtifactKind,
       configJson: encodeProviderGrantRefAuthArtifactConfig({
   if (input.auth.kind === "mcp_oauth") {
     return {
       id,
-      workspaceId: input.source.workspaceId,
+      scopeId: input.source.scopeId,
       sourceId: input.source.id,
-      actorAccountId: input.actorAccountId ?? null,
+      actorScopeId: input.actorScopeId ?? null,
       slot: input.slot,
       artifactKind: McpOAuthAuthArtifactKind,
       configJson: encodeMcpOAuthAuthArtifactConfig({
   return {
     id,
-    workspaceId: input.source.workspaceId,
+    scopeId: input.source.scopeId,
     sourceId: input.source.id,
-    actorAccountId: input.actorAccountId ?? null,
+    actorScopeId: input.actorScopeId ?? null,
     slot: input.slot,
     artifactKind: StaticOAuth2AuthArtifactKind,
     configJson: encodeStaticOAuth2AuthArtifactConfig({

packages/platform/sdk/src/runtime/auth/auth-leases.ts+30−17

 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
-import type { ExecutorStateStoreShape } from "../executor-state-store";
+import type {
-import { resolveAuthArtifactMaterial, type ResolvedSourceAuthMaterial } from "./auth-artifacts";
+  ExecutorStateStoreShape,
+} from "../executor-state-store";
+import {
+  resolveAuthArtifactMaterial,
+  type ResolvedSourceAuthMaterial,
+} from "./auth-artifacts";
 import {
   type DeleteSecretMaterial,
   type ResolveSecretMaterial,
   type SecretMaterialResolveContext,
   type StoreSecretMaterial,
-} from "../workspace/secret-material-providers";
+} from "../scope/secret-material-providers";
-import { refreshOAuth2AccessToken } from "./oauth2-pkce";
+import {
-import type { OAuth2TokenResponse } from "./oauth2-pkce";
+  refreshOAuth2AccessToken,
-import { createPersistedMcpAuthProvider } from "./mcp-auth-provider";
+} from "./oauth2-pkce";
-import { runtimeEffectError } from "../effect-errors";
+import type {
+  OAuth2TokenResponse,
+} from "./oauth2-pkce";
+import {
+  createPersistedMcpAuthProvider,
+} from "./mcp-auth-provider";
+import {
+  runtimeEffectError,
+} from "../effect-errors";
 const LEASE_REFRESH_SKEW_MS = 60_000;
     const nextLease: AuthLease = {
       id: input.lease?.id ?? AuthLeaseIdSchema.make(`auth_lease_${crypto.randomUUID()}`),
       authArtifactId: input.artifact.id,
-      workspaceId: input.artifact.workspaceId,
+      scopeId: input.artifact.scopeId,
       sourceId: input.artifact.sourceId,
-      actorAccountId: input.artifact.actorAccountId,
+      actorScopeId: input.artifact.actorScopeId,
       slot: input.artifact.slot,
       placementsTemplateJson: encodeLeasePlacementTemplatesJson([
         {
     return nextLease;
   });
-const workspaceOauthClientSecretRef = (input: {
+const scopeOauthClientSecretRef = (input: {
   clientSecretProviderId: string | null;
   clientSecretHandle: string | null;
 }): SecretRef | null =>
     }
     const grant = grantOption.value;
-    const oauthClientOption = yield* input.executorState.workspaceOauthClients.getById(grant.oauthClientId);
+    const oauthClientOption = yield* input.executorState.scopeOauthClients.getById(grant.oauthClientId);
     if (Option.isNone(oauthClientOption)) {
-      return yield* runtimeEffectError("auth/auth-leases", `Workspace OAuth client not found: ${grant.oauthClientId}`);
+      return yield* runtimeEffectError("auth/auth-leases", `Scope OAuth client not found: ${grant.oauthClientId}`);
     }
     const oauthClient = oauthClientOption.value;
       ref: grant.refreshToken,
       context: input.context,
     });
-    const clientSecretRef = workspaceOauthClientSecretRef(oauthClient);
+    const clientSecretRef = scopeOauthClientSecretRef(oauthClient);
     const clientSecret = clientSecretRef
       ? yield* input.resolveSecretMaterial({
           ref: clientSecretRef,
     const nextLease: AuthLease = {
       id: input.lease?.id ?? AuthLeaseIdSchema.make(`auth_lease_${crypto.randomUUID()}`),
       authArtifactId: input.artifact.id,
-      workspaceId: input.artifact.workspaceId,
+      scopeId: input.artifact.scopeId,
       sourceId: input.artifact.sourceId,
-      actorAccountId: input.artifact.actorAccountId,
+      actorScopeId: input.artifact.actorScopeId,
       slot: input.artifact.slot,
       placementsTemplateJson: encodeLeasePlacementTemplatesJson([
         {
     const nextLease: AuthLease = {
       id: existingLease?.id ?? AuthLeaseIdSchema.make(`auth_lease_${crypto.randomUUID()}`),
       authArtifactId: input.artifact.id,
-      workspaceId: input.artifact.workspaceId,
+      scopeId: input.artifact.scopeId,
       sourceId: input.artifact.sourceId,
-      actorAccountId: input.artifact.actorAccountId,
+      actorScopeId: input.artifact.actorScopeId,
       slot: input.artifact.slot,
       placementsTemplateJson: encodeLeasePlacementTemplatesJson([
         {

packages/platform/sdk/src/runtime/auth/mcp-auth-provider.ts+4−2

 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
-import type { ExecutorStateStoreShape } from "../executor-state-store";
+import type {
+  ExecutorStateStoreShape,
+} from "../executor-state-store";
 import {
   type DeleteSecretMaterial,
   type ResolveSecretMaterial,
   type SecretMaterialResolveContext,
   type StoreSecretMaterial,
-} from "../workspace/secret-material-providers";
+} from "../scope/secret-material-providers";
 const encodeMcpOAuthAuthArtifactConfig = Schema.encodeSync(
   McpOAuthAuthArtifactConfigJsonSchema,

packages/platform/sdk/src/runtime/auth/oauth-loopback.test.ts+11−3

-import { createServer } from "node:http";
+import {
+  createServer,
+} from "node:http";
-import { describe, expect, it } from "@effect/vitest";
+import {
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
 import * as Effect from "effect/Effect";
-import { startOauthLoopbackRedirectServer } from "./oauth-loopback";
+import {
+  startOauthLoopbackRedirectServer,
+} from "./oauth-loopback";
 const toError = (cause: unknown): Error =>
   cause instanceof Error ? cause : new Error(String(cause));

packages/platform/sdk/src/runtime/auth/oauth-loopback.ts+3−1

@@ -1,4 +1,6 @@
1	import { createServer } from "node:http";	1	import {
		2	createServer,
		3	} from "node:http";
2		4
3	import * as Effect from "effect/Effect";	5	import * as Effect from "effect/Effect";
4		6

packages/platform/sdk/src/runtime/auth/provider-grant-lifecycle.ts+9−7

 import type {
   AuthArtifact,
   ProviderAuthGrant,
-  WorkspaceId,
+  ScopeId,
 } from "#schema";
 import {
   decodeProviderGrantRefAuthArtifactConfig,
 import {
   type DeleteSecretMaterial,
-} from "../workspace/secret-material-providers";
+} from "../scope/secret-material-providers";
-import type { ExecutorStateStoreShape } from "../executor-state-store";
+import type {
+  ExecutorStateStoreShape,
+} from "../executor-state-store";
 const providerGrantRefFromArtifact = (
   artifact: Pick<AuthArtifact, "artifactKind" | "configJson">,
   providerGrantRefFromArtifact(artifact)?.grantId ?? null;
 export const listProviderGrantRefArtifacts = (executorState: ExecutorStateStoreShape, input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   grantId?: ProviderAuthGrant["id"] | null;
 }): Effect.Effect<readonly AuthArtifact[], Error, never> =>
   Effect.map(
-    executorState.authArtifacts.listByWorkspaceId(input.workspaceId),
+    executorState.authArtifacts.listByScopeId(input.scopeId),
     (artifacts) =>
       artifacts.filter((artifact) => {
         const grantId = providerGrantIdFromArtifact(artifact);
   });
 export const markProviderGrantOrphanedIfUnused = (executorState: ExecutorStateStoreShape, input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   grantId: ProviderAuthGrant["id"];
 }): Effect.Effect<boolean, Error, never> =>
   Effect.gen(function* () {
     }
     const grantOption = yield* executorState.providerAuthGrants.getById(input.grantId);
-    if (Option.isNone(grantOption) || grantOption.value.workspaceId !== input.workspaceId) {
+    if (Option.isNone(grantOption) || grantOption.value.scopeId !== input.scopeId) {
       return false;
     }

packages/platform/sdk/src/runtime/auth/source-auth-material.test.ts+14−8

-import { describe, expect, it } from "@effect/vitest";
+import {
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import {
   AuthArtifactIdSchema,
   SourceIdSchema,
-  WorkspaceIdSchema,
+  ScopeIdSchema,
   type Source,
 } from "#schema";
-import { resolveSourceAuthMaterialWithDeps } from "./source-auth-material";
+import {
+  resolveSourceAuthMaterialWithDeps,
+} from "./source-auth-material";
 const makeSource = (overrides: Partial<Source> = {}): Source => ({
   id: SourceIdSchema.make("src_tool_artifacts"),
-  workspaceId: WorkspaceIdSchema.make("ws_tool_artifacts"),
+  scopeId: ScopeIdSchema.make("ws_tool_artifacts"),
   name: "GitHub",
   kind: "openapi",
   endpoint: "https://api.github.com",
               },
               auth: { kind: "none" },
             }),
-            actorAccountId: null,
+            actorScopeId: null,
             executorState: {
               authArtifacts: {
-                getByWorkspaceSourceAndActor: () =>
+                getByScopeSourceAndActor: () =>
                   Effect.succeed(
                     Option.some({
                       id: AuthArtifactIdSchema.make("auth_artifact_mcp"),
-                      workspaceId: WorkspaceIdSchema.make("ws_tool_artifacts"),
+                      scopeId: ScopeIdSchema.make("ws_tool_artifacts"),
                       sourceId: SourceIdSchema.make("src_tool_artifacts"),
-                      actorAccountId: null,
+                      actorScopeId: null,
                       slot: "runtime",
                       artifactKind: "mcp_oauth",
                       configJson: JSON.stringify({

packages/platform/sdk/src/runtime/auth/source-auth-material.ts+20−13

 import type {
-  AccountId,
+  ScopeId,
   CredentialSlot,
   Source,
   SourceAuth,
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
-import { ExecutorStateStore, type ExecutorStateStoreShape } from "../executor-state-store";
+import {
+  ExecutorStateStore,
+  type ExecutorStateStoreShape,
+} from "../executor-state-store";
 import {
   authArtifactFromSourceAuth,
   resolveAuthArtifactMaterial,
   type ResolvedSourceAuthMaterial,
 } from "./auth-artifacts";
-import { resolveAuthArtifactMaterialWithLeases } from "./auth-leases";
+import {
+  resolveAuthArtifactMaterialWithLeases,
+} from "./auth-leases";
 import type {
   DeleteSecretMaterial,
   ResolveSecretMaterial,
   SecretMaterialResolveContext,
   StoreSecretMaterial,
-} from "../workspace/secret-material-providers";
+} from "../scope/secret-material-providers";
 import {
   SecretMaterialDeleterService,
   SecretMaterialResolverService,
   SecretMaterialStorerService,
-} from "../workspace/secret-material-providers";
+} from "../scope/secret-material-providers";
-import { runtimeEffectError } from "../effect-errors";
+import {
+  runtimeEffectError,
+} from "../effect-errors";
 const authForSlot = (input: {
   source: Source;
   resolve: (input: {
     source: Source;
     slot?: CredentialSlot;
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
     context?: SecretMaterialResolveContext;
   }) => Effect.Effect<ResolvedSourceAuthMaterial, Error, never>;
 };
 export const resolveSourceAuthMaterialWithDeps = (input: {
   source: Source;
   slot?: CredentialSlot;
-  actorAccountId?: AccountId | null;
+  actorScopeId?: ScopeId | null;
   executorState?: ExecutorStateStoreShape;
   resolveSecretMaterial: ResolveSecretMaterial;
   storeSecretMaterial?: StoreSecretMaterial;
           : [slot] satisfies ReadonlyArray<CredentialSlot>;
       for (const candidateSlot of candidateSlots) {
-        const artifactOption = yield* input.executorState.authArtifacts.getByWorkspaceSourceAndActor({
+        const artifactOption = yield* input.executorState.authArtifacts.getByScopeSourceAndActor({
-          workspaceId: input.source.workspaceId,
+          scopeId: input.source.scopeId,
           sourceId: input.source.id,
-          actorAccountId: input.actorAccountId ?? null,
+          actorScopeId: input.actorScopeId ?? null,
           slot: candidateSlot,
         });
         slot,
       }),
       slot,
-      actorAccountId: input.actorAccountId ?? null,
+      actorScopeId: input.actorScopeId ?? null,
     });
     if (input.executorState !== undefined) {
 export const resolveSourceAuthMaterial = (input: {
   source: Source;
   slot?: CredentialSlot;
-  actorAccountId?: AccountId | null;
+  actorScopeId?: ScopeId | null;
   context?: SecretMaterialResolveContext;
 }): Effect.Effect<ResolvedSourceAuthMaterial, Error, RuntimeSourceAuthMaterialService> =>
   Effect.flatMap(RuntimeSourceAuthMaterialService, (service) => service.resolve(input));

packages/platform/sdk/src/runtime/catalog/catalog-typescript.ts+9−3

-import { createHash } from "node:crypto";
+import {
+  createHash,
+} from "node:crypto";
-import type { ProjectedCatalog } from "@executor/ir/catalog";
+import type {
-import type { ShapeSymbolId } from "@executor/ir/ids";
+  ProjectedCatalog,
+} from "@executor/ir/catalog";
+import type {
+  ShapeSymbolId,
+} from "@executor/ir/ids";
 import type {
   CatalogV1,
   DocumentationBlock,

packages/platform/sdk/src/runtime/catalog/prettier-format.ts+3−1

@@ -1,4 +1,6 @@
1	import { format } from "prettier/standalone";	1	import {
		2	format,
		3	} from "prettier/standalone";
2	import parserBabel from "prettier/plugins/babel";	4	import parserBabel from "prettier/plugins/babel";
3	import parserEstree from "prettier/plugins/estree";	5	import parserEstree from "prettier/plugins/estree";
4	import parserTypescript from "prettier/plugins/typescript";	6	import parserTypescript from "prettier/plugins/typescript";

packages/platform/sdk/src/runtime/catalog/source/reconcile.ts+24−15

 import type {
-  AccountId,
+  ScopeId,
   Source,
-  WorkspaceId,
 } from "#schema";
 import * as Effect from "effect/Effect";
-import { RuntimeLocalWorkspaceService } from "../../workspace/runtime-context";
+import {
-import { SourceArtifactStore } from "../../workspace/storage";
+  RuntimeLocalScopeService,
-import { getSourceAdapterForSource } from "../../sources/source-adapters";
+} from "../../scope/runtime-context";
-import { RuntimeSourceStoreService } from "../../sources/source-store";
+import {
-import { RuntimeSourceCatalogSyncService } from "./sync";
+  SourceArtifactStore,
+} from "../../scope/storage";
+import {
+  getSourceAdapterForSource,
+} from "../../sources/source-adapters";
+import {
+  RuntimeSourceStoreService,
+} from "../../sources/source-store";
+import {
+  RuntimeSourceCatalogSyncService,
+} from "./sync";
 const shouldReconcileSource = (source: Source): boolean =>
   source.enabled
   && getSourceAdapterForSource(source).catalogKind !== "internal";
 export const reconcileMissingSourceCatalogArtifacts = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
-  actorAccountId?: AccountId | null;
+  actorScopeId?: ScopeId | null;
 }): Effect.Effect<
   void,
   Error,
-  | RuntimeLocalWorkspaceService
+  | RuntimeLocalScopeService
   | SourceArtifactStore
   | RuntimeSourceStoreService
   | RuntimeSourceCatalogSyncService
 > =>
   Effect.gen(function* () {
-    const runtimeLocalWorkspace = yield* RuntimeLocalWorkspaceService;
+    const runtimeLocalScope = yield* RuntimeLocalScopeService;
     const sourceStore = yield* RuntimeSourceStoreService;
     const sourceArtifactStore = yield* SourceArtifactStore;
     const sourceCatalogSync = yield* RuntimeSourceCatalogSyncService;
-    const sources = yield* sourceStore.loadSourcesInWorkspace(input.workspaceId, {
+    const sources = yield* sourceStore.loadSourcesInScope(input.scopeId, {
-      actorAccountId: input.actorAccountId,
+      actorScopeId: input.actorScopeId,
     });
     for (const source of sources) {
       yield* sourceCatalogSync.sync({
         source,
-        actorAccountId: input.actorAccountId,
+        actorScopeId: input.actorScopeId,
       }).pipe(
         Effect.catchAll(() => Effect.void),
       );
   }).pipe(
     Effect.withSpan("source.catalog.reconcile_missing", {
       attributes: {
-        "executor.workspace.id": input.workspaceId,
+        "executor.scope.id": input.scopeId,
       },
     }),
   );

packages/platform/sdk/src/runtime/catalog/source/runtime.test.ts+12−5

-import { describe, expect, it } from "@effect/vitest";
+import {
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import type {
   SourceCatalogIdSchema,
   SourceCatalogRevisionIdSchema,
   SourceIdSchema,
-  WorkspaceIdSchema,
+  ScopeIdSchema,
 } from "#schema";
 import {
   ScopeIdSchema,
   ShapeSymbolIdSchema,
 } from "@executor/ir/ids";
-import type { CatalogV1, ProvenanceRef } from "@executor/ir/model";
+import type {
+  CatalogV1,
+  ProvenanceRef,
+} from "@executor/ir/model";
 import {
   createCatalogTypeProjector,
   formatTypeNameSegment,
   const source = {
     id: SourceIdSchema.make("src_linear"),
-    workspaceId: WorkspaceIdSchema.make("ws_linear"),
+    scopeId: ScopeIdSchema.make("ws_linear"),
     name: "Linear",
     kind: "graphql-schema",
     endpoint: "https://api.linear.app/graphql",
   const sourceRecord = {
     id: source.id,
-    workspaceId: source.workspaceId,
+    scopeId: source.scopeId,
     catalogId: SourceCatalogIdSchema.make("catalog_linear"),
     catalogRevisionId: SourceCatalogRevisionIdSchema.make("catalog_revision_linear"),
     name: source.name,

packages/platform/sdk/src/runtime/catalog/source/runtime.ts+65−56

   type ToolDescriptor as CatalogToolDescriptor,
 } from "@executor/codemode-core";
 import type {
-  AccountId,
+  ScopeId,
   Source,
   StoredSourceRecord,
   StoredSourceCatalogRevisionRecord,
-  WorkspaceId,
 } from "#schema";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
   projectCatalogForAgentSdk,
   type ProjectedCatalog,
 } from "@executor/ir/catalog";
-import type { ShapeSymbolId } from "@executor/ir/ids";
+import type {
+  ShapeSymbolId,
+} from "@executor/ir/ids";
 import type {
   Capability,
   CatalogSnapshotV1,
   Executable,
   ShapeSymbol,
 } from "@executor/ir/model";
-import { LocalSourceArtifactMissingError } from "../../workspace-errors";
+import {
+  LocalSourceArtifactMissingError,
+} from "../../scope-errors";
 import {
   createCatalogTypeProjector,
   documentationComment,
   shapeAllowsOmittedArgs,
   type CatalogTypeProjector,
 } from "../catalog-typescript";
-import { formatWithPrettier } from "../prettier-format";
 import {
-  RuntimeLocalWorkspaceService,
+  formatWithPrettier,
-  type RuntimeLocalWorkspaceState,
+} from "../prettier-format";
-} from "../../workspace/runtime-context";
+import {
-import type { LocalSourceArtifact } from "../../source-artifacts";
+  RuntimeLocalScopeService,
+  type RuntimeLocalScopeState,
+} from "../../scope/runtime-context";
+import type {
+  LocalSourceArtifact,
+} from "../../source-artifacts";
 import {
   SourceArtifactStore,
   type SourceArtifactStoreShape,
-} from "../../workspace/storage";
+} from "../../scope/storage";
 import {
   RuntimeSourceStoreService,
   type RuntimeSourceStore,
 } from "../../sources/source-store";
-import { runtimeEffectError } from "../../effect-errors";
+import {
+  runtimeEffectError,
+} from "../../effect-errors";
 type CatalogImportMetadata = CatalogSnapshotV1["import"];
   };
 }): StoredSourceRecord => ({
   id: input.source.id,
-  workspaceId: input.source.workspaceId,
+  scopeId: input.source.scopeId,
   catalogId: input.artifact.catalogId,
   catalogRevisionId: input.artifact.revision.id,
   name: input.source.name,
 type RuntimeSourceCatalogStoreShape = {
   loadWorkspaceSourceCatalogs: (input: {
-    workspaceId: WorkspaceId;
+    scopeId: ScopeId;
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
   }) => Effect.Effect<readonly LoadedSourceCatalog[], Error, never>;
   loadSourceWithCatalog: (input: {
-    workspaceId: WorkspaceId;
+    scopeId: ScopeId;
     sourceId: Source["id"];
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
   }) => Effect.Effect<LoadedSourceCatalog, Error | LocalSourceArtifactMissingError, never>;
   loadWorkspaceSourceCatalogToolIndex: (input: {
-    workspaceId: WorkspaceId;
+    scopeId: ScopeId;
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
     includeSchemas: boolean;
   }) => Effect.Effect<readonly LoadedSourceCatalogToolIndexEntry[], Error, never>;
   loadWorkspaceSourceCatalogToolByPath: (input: {
-    workspaceId: WorkspaceId;
+    scopeId: ScopeId;
     path: string;
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
     includeSchemas: boolean;
   }) => Effect.Effect<LoadedSourceCatalogToolIndexEntry | null, Error, never>;
 };
 )<RuntimeSourceCatalogStoreService, RuntimeSourceCatalogStoreShape>() {}
 type RuntimeSourceCatalogStoreDeps = {
-  runtimeLocalWorkspace: RuntimeLocalWorkspaceState;
+  runtimeLocalScope: RuntimeLocalScopeState;
   sourceStore: RuntimeSourceStore;
   sourceArtifactStore: SourceArtifactStoreShape;
 };
 type SourceCatalogRuntimeServices =
-  | RuntimeLocalWorkspaceService
+  | RuntimeLocalScopeService
   | RuntimeSourceStoreService
   | SourceArtifactStore;
 const ensureRuntimeCatalogWorkspace = (
   deps: RuntimeSourceCatalogStoreDeps,
-  workspaceId: WorkspaceId,
+  scopeId: ScopeId,
 ) =>
   Effect.gen(function* () {
-  if (deps.runtimeLocalWorkspace.installation.workspaceId !== workspaceId) {
+  if (deps.runtimeLocalScope.installation.scopeId !== scopeId) {
     return yield* Effect.fail(
       runtimeEffectError("catalog/source/runtime",
-        `Runtime local workspace mismatch: expected ${workspaceId}, got ${deps.runtimeLocalWorkspace.installation.workspaceId}`,
+        `Runtime local scope mismatch: expected ${scopeId}, got ${deps.runtimeLocalScope.installation.scopeId}`,
       ),
     );
   }
 };
 const loadWorkspaceSourceCatalogsWithDeps = (deps: RuntimeSourceCatalogStoreDeps, input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
-  actorAccountId?: AccountId | null;
+  actorScopeId?: ScopeId | null;
 }): Effect.Effect<readonly LoadedSourceCatalog[], Error, never> =>
   Effect.gen(function* () {
-    yield* ensureRuntimeCatalogWorkspace(deps, input.workspaceId);
+    yield* ensureRuntimeCatalogWorkspace(deps, input.scopeId);
-    const sources = yield* deps.sourceStore.loadSourcesInWorkspace(
+    const sources = yield* deps.sourceStore.loadSourcesInScope(
-      input.workspaceId,
+      input.scopeId,
       {
-        actorAccountId: input.actorAccountId,
+        actorScopeId: input.actorScopeId,
       },
     );
   });
 const loadSourceWithCatalogWithDeps = (deps: RuntimeSourceCatalogStoreDeps, input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: Source["id"];
-  actorAccountId?: AccountId | null;
+  actorScopeId?: ScopeId | null;
 }): Effect.Effect<LoadedSourceCatalog, Error | LocalSourceArtifactMissingError, never> =>
   Effect.gen(function* () {
-    yield* ensureRuntimeCatalogWorkspace(deps, input.workspaceId);
+    yield* ensureRuntimeCatalogWorkspace(deps, input.scopeId);
     const source = yield* deps.sourceStore.loadSourceById({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       sourceId: input.sourceId,
-      actorAccountId: input.actorAccountId,
+      actorScopeId: input.actorScopeId,
     });
     const artifact = yield* deps.sourceArtifactStore.read({
       sourceId: source.id,
   });
 export const loadWorkspaceSourceCatalogs = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
-  actorAccountId?: AccountId | null;
+  actorScopeId?: ScopeId | null;
 }): Effect.Effect<readonly LoadedSourceCatalog[], Error, SourceCatalogRuntimeServices> =>
   Effect.gen(function* () {
-    const runtimeLocalWorkspace = yield* RuntimeLocalWorkspaceService;
+    const runtimeLocalScope = yield* RuntimeLocalScopeService;
     const sourceStore = yield* RuntimeSourceStoreService;
     const sourceArtifactStore = yield* SourceArtifactStore;
     return yield* loadWorkspaceSourceCatalogsWithDeps(
       {
-        runtimeLocalWorkspace,
+        runtimeLocalScope,
         sourceStore,
         sourceArtifactStore,
       },
   });
 export const loadSourceWithCatalog = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: Source["id"];
-  actorAccountId?: AccountId | null;
+  actorScopeId?: ScopeId | null;
 }): Effect.Effect<
   LoadedSourceCatalog,
   Error | LocalSourceArtifactMissingError,
   SourceCatalogRuntimeServices
 > =>
   Effect.gen(function* () {
-    const runtimeLocalWorkspace = yield* RuntimeLocalWorkspaceService;
+    const runtimeLocalScope = yield* RuntimeLocalScopeService;
     const sourceStore = yield* RuntimeSourceStoreService;
     const sourceArtifactStore = yield* SourceArtifactStore;
     return yield* loadSourceWithCatalogWithDeps(
       {
-        runtimeLocalWorkspace,
+        runtimeLocalScope,
         sourceStore,
         sourceArtifactStore,
       },
   );
 export const loadWorkspaceSourceCatalogToolIndex = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
-  actorAccountId?: AccountId | null;
+  actorScopeId?: ScopeId | null;
   includeSchemas: boolean;
 }): Effect.Effect<
   readonly LoadedSourceCatalogToolIndexEntry[],
 > =>
   Effect.gen(function* () {
     const catalogs = yield* loadWorkspaceSourceCatalogs({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
-      actorAccountId: input.actorAccountId,
+      actorScopeId: input.actorScopeId,
     });
     const tools = yield* expandCatalogTools({
       catalogs,
   });
 export const loadWorkspaceSourceCatalogToolByPath = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   path: string;
-  actorAccountId?: AccountId | null;
+  actorScopeId?: ScopeId | null;
   includeSchemas: boolean;
 }): Effect.Effect<
   LoadedSourceCatalogToolIndexEntry | null,
 > =>
   Effect.gen(function* () {
     const catalogs = yield* loadWorkspaceSourceCatalogs({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
-      actorAccountId: input.actorAccountId,
+      actorScopeId: input.actorScopeId,
     });
     const tool = yield* expandCatalogToolByPath({
       catalogs,
 export const RuntimeSourceCatalogStoreLive = Layer.effect(
   RuntimeSourceCatalogStoreService,
   Effect.gen(function* () {
-    const runtimeLocalWorkspace = yield* RuntimeLocalWorkspaceService;
+    const runtimeLocalScope = yield* RuntimeLocalScopeService;
     const sourceStore = yield* RuntimeSourceStoreService;
     const sourceArtifactStore = yield* SourceArtifactStore;
     const deps: RuntimeSourceCatalogStoreDeps = {
-      runtimeLocalWorkspace,
+      runtimeLocalScope,
       sourceStore,
       sourceArtifactStore,
     };
         loadSourceWithCatalogWithDeps(deps, input),
       loadWorkspaceSourceCatalogToolIndex: (input) =>
         loadWorkspaceSourceCatalogToolIndex(input).pipe(
-          Effect.provideService(RuntimeLocalWorkspaceService, runtimeLocalWorkspace),
+          Effect.provideService(RuntimeLocalScopeService, runtimeLocalScope),
           Effect.provideService(RuntimeSourceStoreService, sourceStore),
           Effect.provideService(SourceArtifactStore, sourceArtifactStore),
         ),
       loadWorkspaceSourceCatalogToolByPath: (input) =>
         loadWorkspaceSourceCatalogToolByPath(input).pipe(
-          Effect.provideService(RuntimeLocalWorkspaceService, runtimeLocalWorkspace),
+          Effect.provideService(RuntimeLocalScopeService, runtimeLocalScope),
           Effect.provideService(RuntimeSourceStoreService, sourceStore),
           Effect.provideService(SourceArtifactStore, sourceArtifactStore),
         ),

packages/platform/sdk/src/runtime/catalog/source/snapshot.test.ts+21−7

-import { describe, expect, it } from "@effect/vitest";
+import {
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
-import type { Source } from "#schema";
+import type {
+  Source,
+} from "#schema";
 import {
   buildGraphqlToolPresentation,
   compileGraphqlToolDefinitions,
   type GraphqlToolManifest,
 } from "@executor/source-graphql";
-import { createGoogleDiscoveryCatalogSnapshot } from "@executor/source-google-discovery";
+import {
-import { createGraphqlCatalogSnapshot } from "@executor/source-graphql";
+  createGoogleDiscoveryCatalogSnapshot,
-import { createMcpCatalogSnapshot } from "@executor/source-mcp";
+} from "@executor/source-google-discovery";
-import { createOpenApiCatalogSnapshot } from "@executor/source-openapi";
+import {
+  createGraphqlCatalogSnapshot,
+} from "@executor/source-graphql";
+import {
+  createMcpCatalogSnapshot,
+} from "@executor/source-mcp";
+import {
+  createOpenApiCatalogSnapshot,
+} from "@executor/source-openapi";
 const baseSource: Source = {
   id: "src_calendar" as Source["id"],
-  workspaceId: "ws_test" as Source["workspaceId"],
+  scopeId: "ws_test" as Source["scopeId"],
   name: "Calendar",
   kind: "openapi",
   endpoint: "https://api.example.test",

packages/platform/sdk/src/runtime/catalog/source/sync.ts+53−45

 import type {
-  AccountId,
+  ScopeId,
   Source,
   SourceStatus,
 } from "#schema";
-import type { McpToolManifest } from "@executor/source-mcp";
+import type {
+  McpToolManifest,
+} from "@executor/source-mcp";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import {
-  RuntimeLocalWorkspaceService,
+  RuntimeLocalScopeService,
-  type RuntimeLocalWorkspaceState,
+  type RuntimeLocalScopeState,
-} from "../../workspace/runtime-context";
+} from "../../scope/runtime-context";
 import {
   SourceArtifactStore,
   type SourceArtifactStoreShape,
-  WorkspaceStateStore,
+  ScopeStateStore,
-  type WorkspaceStateStoreShape,
+  type ScopeStateStoreShape,
-} from "../../workspace/storage";
+} from "../../scope/storage";
 import {
-  type LocalWorkspaceState,
+  type LocalScopeState,
-} from "../../workspace-state";
+} from "../../scope-state";
 import {
   RuntimeSourceAuthMaterialService,
 } from "../../auth/source-auth-material";
 import {
   catalogSyncResultFromMcpManifest,
 } from "@executor/source-mcp";
-import { SecretMaterialResolverService } from "../../workspace/secret-material-providers";
+import {
-import { snapshotFromSourceCatalogSyncResult } from "@executor/source-core";
+  SecretMaterialResolverService,
+} from "../../scope/secret-material-providers";
+import {
+  snapshotFromSourceCatalogSyncResult,
+} from "@executor/source-core";
 import {
   SourceTypeDeclarationsRefresherService,
   type SourceTypeDeclarationsRefresherShape,
 } from "./type-declarations";
-import { runtimeEffectError } from "../../effect-errors";
+import {
+  runtimeEffectError,
+} from "../../effect-errors";
 const shouldIndexSource = (source: Source): boolean =>
   source.enabled
   && getSourceAdapterForSource(source).catalogKind !== "internal";
 type RuntimeSourceCatalogSyncDeps = {
-  runtimeLocalWorkspace: RuntimeLocalWorkspaceState;
+  runtimeLocalScope: RuntimeLocalScopeState;
-  workspaceStateStore: WorkspaceStateStoreShape;
+  scopeStateStore: ScopeStateStoreShape;
   sourceArtifactStore: SourceArtifactStoreShape;
   sourceTypeDeclarationsRefresher: SourceTypeDeclarationsRefresherShape;
   resolveSecretMaterial: Effect.Effect.Success<typeof SecretMaterialResolverService>;
 };
 type SourceCatalogSyncServices =
-  | RuntimeLocalWorkspaceService
+  | RuntimeLocalScopeService
-  | WorkspaceStateStore
+  | ScopeStateStore
   | SourceArtifactStore
   | SourceTypeDeclarationsRefresherService
   | RuntimeSourceAuthMaterialService
 export type RuntimeSourceCatalogSyncShape = {
   sync: (input: {
     source: Source;
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
   }) => Effect.Effect<void, Error, never>;
   persistMcpCatalogSnapshotFromManifest: (input: {
     source: Source;
 const ensureRuntimeCatalogSyncWorkspace = (
   deps: RuntimeSourceCatalogSyncDeps,
-  workspaceId: Source["workspaceId"],
+  scopeId: Source["scopeId"],
 ) =>
   Effect.gen(function* () {
-  if (deps.runtimeLocalWorkspace.installation.workspaceId !== workspaceId) {
+  if (deps.runtimeLocalScope.installation.scopeId !== scopeId) {
     return yield* Effect.fail(
       runtimeEffectError("catalog/source/sync",
-        `Runtime local workspace mismatch: expected ${workspaceId}, got ${deps.runtimeLocalWorkspace.installation.workspaceId}`,
+        `Runtime local scope mismatch: expected ${scopeId}, got ${deps.runtimeLocalScope.installation.scopeId}`,
       ),
     );
   }
   deps: RuntimeSourceCatalogSyncDeps,
   input: {
     source: Source;
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
   },
 ): Effect.Effect<void, Error, never> =>
   Effect.gen(function* () {
-    yield* ensureRuntimeCatalogSyncWorkspace(deps, input.source.workspaceId);
+    yield* ensureRuntimeCatalogSyncWorkspace(deps, input.source.scopeId);
     if (!shouldIndexSource(input.source)) {
-      const state = yield* deps.workspaceStateStore.load();
+      const state = yield* deps.scopeStateStore.load();
       const existingSourceState = state.sources[input.source.id];
-      const nextState: LocalWorkspaceState = {
+      const nextState: LocalScopeState = {
         ...state,
         sources: {
           ...state.sources,
           },
         },
       };
-      yield* deps.workspaceStateStore.write({
+      yield* deps.scopeStateStore.write({
         state: nextState,
       });
       yield* deps.sourceTypeDeclarationsRefresher.refreshSourceInBackground({
         deps.sourceAuthMaterialService.resolve({
           source: input.source,
           slot,
-          actorAccountId: input.actorAccountId,
+          actorScopeId: input.actorScopeId,
         }),
     });
     const snapshot = snapshotFromSourceCatalogSyncResult(syncResult);
       }),
     });
-    const state = yield* deps.workspaceStateStore.load();
+    const state = yield* deps.scopeStateStore.load();
     const existingSourceState = state.sources[input.source.id];
-    const nextState: LocalWorkspaceState = {
+    const nextState: LocalScopeState = {
       ...state,
       sources: {
         ...state.sources,
         },
       },
     };
-    yield* deps.workspaceStateStore.write({
+    yield* deps.scopeStateStore.write({
       state: nextState,
     });
   },
 ): Effect.Effect<void, Error, never> =>
   Effect.gen(function* () {
-    yield* ensureRuntimeCatalogSyncWorkspace(deps, input.source.workspaceId);
+    yield* ensureRuntimeCatalogSyncWorkspace(deps, input.source.scopeId);
     const syncResult = catalogSyncResultFromMcpManifest({
       source: input.source,
       endpoint: input.source.endpoint,
 export const syncSourceCatalog = (input: {
   source: Source;
-  actorAccountId?: AccountId | null;
+  actorScopeId?: ScopeId | null;
 }): Effect.Effect<void, Error, SourceCatalogSyncServices> =>
   Effect.gen(function* () {
-    const runtimeLocalWorkspace = yield* RuntimeLocalWorkspaceService;
+    const runtimeLocalScope = yield* RuntimeLocalScopeService;
-    const workspaceStateStore = yield* WorkspaceStateStore;
+    const scopeStateStore = yield* ScopeStateStore;
     const sourceArtifactStore = yield* SourceArtifactStore;
     const sourceTypeDeclarationsRefresher =
       yield* SourceTypeDeclarationsRefresherService;
     return yield* syncSourceCatalogWithDeps(
       {
-        runtimeLocalWorkspace,
+        runtimeLocalScope,
-        workspaceStateStore,
+        scopeStateStore,
         sourceArtifactStore,
         sourceTypeDeclarationsRefresher,
         resolveSecretMaterial,
       },
       {
         source: input.source,
-        actorAccountId: input.actorAccountId,
+        actorScopeId: input.actorScopeId,
       },
     );
   });
   manifest: McpToolManifest;
 }): Effect.Effect<void, Error, SourceCatalogSyncServices> =>
   Effect.gen(function* () {
-    const runtimeLocalWorkspace = yield* RuntimeLocalWorkspaceService;
+    const runtimeLocalScope = yield* RuntimeLocalScopeService;
-    const workspaceStateStore = yield* WorkspaceStateStore;
+    const scopeStateStore = yield* ScopeStateStore;
     const sourceArtifactStore = yield* SourceArtifactStore;
     const sourceTypeDeclarationsRefresher =
       yield* SourceTypeDeclarationsRefresherService;
     return yield* persistMcpCatalogSnapshotFromManifestWithDeps(
       {
-        runtimeLocalWorkspace,
+        runtimeLocalScope,
-        workspaceStateStore,
+        scopeStateStore,
         sourceArtifactStore,
         sourceTypeDeclarationsRefresher,
         resolveSecretMaterial,
 export const RuntimeSourceCatalogSyncLive = Layer.effect(
   RuntimeSourceCatalogSyncService,
   Effect.gen(function* () {
-    const runtimeLocalWorkspace = yield* RuntimeLocalWorkspaceService;
+    const runtimeLocalScope = yield* RuntimeLocalScopeService;
-    const workspaceStateStore = yield* WorkspaceStateStore;
+    const scopeStateStore = yield* ScopeStateStore;
     const sourceArtifactStore = yield* SourceArtifactStore;
     const sourceTypeDeclarationsRefresher =
       yield* SourceTypeDeclarationsRefresherService;
     const sourceAuthMaterialService = yield* RuntimeSourceAuthMaterialService;
     const deps: RuntimeSourceCatalogSyncDeps = {
-      runtimeLocalWorkspace,
+      runtimeLocalScope,
-      workspaceStateStore,
+      scopeStateStore,
       sourceArtifactStore,
       sourceTypeDeclarationsRefresher,
       resolveSecretMaterial,

packages/platform/sdk/src/runtime/catalog/source/type-declarations.ts+6−2

-import type { Source } from "#schema";
+import type {
-import type { CatalogSnapshotV1 } from "@executor/ir/model";
+  Source,
+} from "#schema";
+import type {
+  CatalogSnapshotV1,
+} from "@executor/ir/model";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";

packages/platform/sdk/src/runtime/execution/http.test.ts+39−19

-import { tmpdir } from "node:os";
+import {
-import { join } from "node:path";
+  tmpdir,
-import { FileSystem } from "@effect/platform";
+} from "node:os";
-import { NodeFileSystem } from "@effect/platform-node";
+import {
-import { describe, expect, it } from "@effect/vitest";
+  join,
+} from "node:path";
+import {
+  FileSystem,
+} from "@effect/platform";
+import {
+  NodeFileSystem,
+} from "@effect/platform-node";
+import {
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
-import { makeToolInvokerFromTools } from "@executor/codemode-core";
+import {
-import { makeDenoSubprocessExecutor } from "@executor/runtime-deno-subprocess";
+  makeToolInvokerFromTools,
+} from "@executor/codemode-core";
+import {
+  makeDenoSubprocessExecutor,
+} from "@executor/runtime-deno-subprocess";
-import { createLocalExecutorRuntime as createExecutorRuntime } from "../../../../sdk-file/src/index";
+import {
-import { withExecutorApiClient } from "./test-http-client";
+  createLocalExecutorRuntime as createExecutorRuntime,
+} from "../../../../sdk-file/src/index";
+import {
+  withExecutorApiClient,
+} from "./test-http-client";
 const makeExecutionResolver = () => {
   const toolInvoker = makeToolInvokerFromTools({
 const makeRuntime = Effect.acquireRelease(
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
-    const workspaceRoot = yield* fs.makeTempDirectory({
+    const scopeRoot = yield* fs.makeTempDirectory({
       directory: tmpdir(),
       prefix: "executor-execution-http-",
     });
     return {
-      workspaceRoot,
+      scopeRoot,
-      homeConfigPath: join(workspaceRoot, ".executor-home.jsonc"),
+      homeConfigPath: join(scopeRoot, ".executor-home.jsonc"),
-      homeStateDirectory: join(workspaceRoot, ".executor-home-state"),
+      homeStateDirectory: join(scopeRoot, ".executor-home-state"),
     };
   }).pipe(
     Effect.provide(NodeFileSystem.layer),
-    Effect.flatMap(({ workspaceRoot, homeConfigPath, homeStateDirectory }) =>
+    Effect.flatMap(({ scopeRoot, homeConfigPath, homeStateDirectory }) =>
       createExecutorRuntime({
         localDataDir: ":memory:",
-        workspaceRoot,
+        workspaceRoot: scopeRoot,
         homeConfigPath,
         homeStateDirectory,
         executionResolver: makeExecutionResolver(),
       const createExecution = yield* withExecutorApiClient(
         {
           runtime,
-          accountId: installation.accountId,
+          actorScopeId: installation.actorScopeId,
         },
         (client) =>
           client.executions.create({
             path: {
-              workspaceId: installation.workspaceId,
+              scopeId: installation.scopeId,
             },
             payload: {
               code: "return await tools.math.add({ a: 20, b: 22 });",
       const getExecution = yield* withExecutorApiClient(
         {
           runtime,
-          accountId: installation.accountId,
+          actorScopeId: installation.actorScopeId,
         },
         (client) =>
           client.executions.get({
             path: {
-              workspaceId: installation.workspaceId,
+              scopeId: installation.scopeId,
               executionId: createExecution.execution.id,
             },
           }),

packages/platform/sdk/src/runtime/execution/ir-execution.ts+21−8

-import type { AccountId, Source } from "#schema";
+import type {
-import type { OnElicitation } from "@executor/codemode-core";
+  ScopeId,
+  Source,
+} from "#schema";
+import type {
+  OnElicitation,
+} from "@executor/codemode-core";
 import * as Effect from "effect/Effect";
-import type { LoadedSourceCatalogToolIndexEntry } from "../catalog/source/runtime";
+import type {
-import type { ResolvedSourceAuthMaterial } from "../auth/source-auth-material";
+  LoadedSourceCatalogToolIndexEntry,
-import { getSourceAdapter } from "../sources/source-adapters";
+} from "../catalog/source/runtime";
-import { runtimeEffectError } from "../effect-errors";
+import type {
+  ResolvedSourceAuthMaterial,
+} from "../auth/source-auth-material";
+import {
+  getSourceAdapter,
+} from "../sources/source-adapters";
+import {
+  runtimeEffectError,
+} from "../effect-errors";
 export const invocationDescriptorFromTool = (input: {
   tool: LoadedSourceCatalogToolIndexEntry;
 });
 export const invokeIrTool = (input: {
-  workspaceId: Source["workspaceId"];
+  scopeId: Source["scopeId"];
-  accountId: AccountId;
+  actorScopeId: ScopeId;
   tool: LoadedSourceCatalogToolIndexEntry;
   auth: ResolvedSourceAuthMaterial;
   args: unknown;

packages/platform/sdk/src/runtime/execution/live.test.ts+8−2

-import { describe, expect, it } from "@effect/vitest";
+import {
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
-import { sanitizePersistedElicitationResponse } from "./live";
+import {
+  sanitizePersistedElicitationResponse,
+} from "./live";
 describe("live-execution", () => {
   it("redacts secret refs from persisted interaction responses", () => {

packages/platform/sdk/src/runtime/execution/live.ts+6−2

   ElicitationResponse,
   OnElicitation,
 } from "@executor/codemode-core";
-import { clearMcpConnectionPoolRun } from "@executor/source-mcp";
+import {
+  clearMcpConnectionPoolRun,
+} from "@executor/source-mcp";
 import {
   ExecutionInteractionIdSchema,
   type Execution,
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import type { ExecutorStateStoreShape } from "../executor-state-store";
+import type {
+  ExecutorStateStoreShape,
+} from "../executor-state-store";
 type VisibleExecutionState =
   | "running"

packages/platform/sdk/src/runtime/execution/mcp-resume.test.ts+65−27

@@ -1,29 +1,67 @@
1	import { randomUUID } from "node:crypto";	1	import {
2		2	randomUUID,
3	import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";	3	} from "node:crypto";
4	import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";	4
5	import { Client } from "@modelcontextprotocol/sdk/client/index.js";	5	import {
6	import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";	6	createMcpExpressApp,
7	import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";	7	} from "@modelcontextprotocol/sdk/server/express.js";
8	import { tmpdir } from "node:os";	8	import {
9	import { join } from "node:path";	9	McpServer,
10	import { FileSystem } from "@effect/platform";	10	} from "@modelcontextprotocol/sdk/server/mcp.js";
11	import { NodeFileSystem } from "@effect/platform-node";	11	import {
12	import { describe, expect, it } from "@effect/vitest";	12	Client,
13	import { assertTrue } from "@effect/vitest/utils";	13	} from "@modelcontextprotocol/sdk/client/index.js";
		14	import {
		15	StreamableHTTPClientTransport,
		16	} from "@modelcontextprotocol/sdk/client/streamableHttp.js";
		17	import {
		18	StreamableHTTPServerTransport,
		19	} from "@modelcontextprotocol/sdk/server/streamableHttp.js";
		20	import {
		21	tmpdir,
		22	} from "node:os";
		23	import {
		24	join,
		25	} from "node:path";
		26	import {
		27	FileSystem,
		28	} from "@effect/platform";
		29	import {
		30	NodeFileSystem,
		31	} from "@effect/platform-node";
		32	import {
		33	describe,
		34	expect,
		35	it,
		36	} from "@effect/vitest";
		37	import {
		38	assertTrue,
		39	} from "@effect/vitest/utils";
14	import * as Effect from "effect/Effect";	40	import * as Effect from "effect/Effect";
15	import * as Option from "effect/Option";	41	import * as Option from "effect/Option";
16	import { z } from "zod/v4";	42	import {
		43	z,
		44	} from "zod/v4";
17		45
18	import { makeToolInvokerFromTools } from "@executor/codemode-core";	46	import {
19	import { discoverMcpToolsFromConnector } from "@executor/source-mcp";	47	makeToolInvokerFromTools,
20	import { makeDenoSubprocessExecutor } from "@executor/runtime-deno-subprocess";	48	} from "@executor/codemode-core";
		49	import {
		50	discoverMcpToolsFromConnector,
		51	} from "@executor/source-mcp";
		52	import {
		53	makeDenoSubprocessExecutor,
		54	} from "@executor/runtime-deno-subprocess";
21		55
22	import {	56	import {
23	type ResolveExecutionEnvironment,	57	type ResolveExecutionEnvironment,
24	} from "../index";	58	} from "../index";
25	import { createLocalExecutorRuntime as createExecutorRuntime } from "../../../../sdk-file/src/index";	59	import {
26	import { withExecutorApiClient } from "./test-http-client";	60	createLocalExecutorRuntime as createExecutorRuntime,
		61	} from "../../../../sdk-file/src/index";
		62	import {
		63	withExecutorApiClient,
		64	} from "./test-http-client";
27		65
28	type McpFormServer = {	66	type McpFormServer = {
29	endpoint: string;	67	endpoint: string;
@@ -290,16 +328,16 @@ describe("execution-mcp-resume", () => { · 260 unmodified lines
290	Effect.gen(function* () {	328	Effect.gen(function* () {
291	const mcpServer = yield* makeFormElicitationServer;	329	const mcpServer = yield* makeFormElicitationServer;
292	const fs = yield* FileSystem.FileSystem;	330	const fs = yield* FileSystem.FileSystem;
293	const workspaceRoot = yield* fs.makeTempDirectory({	331	const scopeRoot = yield* fs.makeTempDirectory({
294	directory: tmpdir(),	332	directory: tmpdir(),
295	prefix: "executor-execution-mcp-resume-",	333	prefix: "executor-execution-mcp-resume-",
296	});	334	});
297	const runtime = yield* Effect.acquireRelease(	335	const runtime = yield* Effect.acquireRelease(
298	createExecutorRuntime({	336	createExecutorRuntime({
299	localDataDir: ":memory:",	337	localDataDir: ":memory:",
300	workspaceRoot,	338	workspaceRoot: scopeRoot,
301	homeConfigPath: join(workspaceRoot, ".executor-home.jsonc"),	339	homeConfigPath: join(scopeRoot, ".executor-home.jsonc"),
302	homeStateDirectory: join(workspaceRoot, ".executor-home-state"),	340	homeStateDirectory: join(scopeRoot, ".executor-home-state"),
303	executionResolver: makeMcpExecutionResolver(mcpServer.endpoint),	341	executionResolver: makeMcpExecutionResolver(mcpServer.endpoint),
304	}),	342	}),
305	(runtime) => Effect.promise(() => runtime.close()).pipe(Effect.orDie),	343	(runtime) => Effect.promise(() => runtime.close()).pipe(Effect.orDie),
@@ -310,12 +348,12 @@ describe("execution-mcp-resume", () => { · 4 unmodified lines
310	const created = yield* withExecutorApiClient(	348	const created = yield* withExecutorApiClient(
311	{	349	{
312	runtime,	350	runtime,
313	accountId: installation.accountId,	351	actorScopeId: installation.actorScopeId,
314	},	352	},
315	(client) =>	353	(client) =>
316	client.executions.create({	354	client.executions.create({
317	path: {	355	path: {
318	workspaceId: installation.workspaceId,	356	scopeId: installation.scopeId,
319	},	357	},
320	payload: {	358	payload: {
321	code: 'return await tools.source.form.gated_echo({ value: "from-control-plane" });',	359	code: 'return await tools.source.form.gated_echo({ value: "from-control-plane" });',
@@ -344,12 +382,12 @@ describe("execution-mcp-resume", () => { · 22 unmodified lines
344	const resumed = yield* withExecutorApiClient(	382	const resumed = yield* withExecutorApiClient(
345	{	383	{
346	runtime,	384	runtime,
347	accountId: installation.accountId,	385	actorScopeId: installation.actorScopeId,
348	},	386	},
349	(client) =>	387	(client) =>
350	client.executions.resume({	388	client.executions.resume({
351	path: {	389	path: {
352	workspaceId: installation.workspaceId,	390	scopeId: installation.scopeId,
353	executionId: created.execution.id,	391	executionId: created.execution.id,
354	},	392	},
355	payload: {	393	payload: {

packages/platform/sdk/src/runtime/execution/runtime-config.test.ts+36−20

-import { tmpdir } from "node:os";
+import {
-import { join } from "node:path";
+  tmpdir,
-import { FileSystem } from "@effect/platform";
+} from "node:os";
-import { NodeFileSystem } from "@effect/platform-node";
+import {
-import { describe, expect, it } from "@effect/vitest";
+  join,
+} from "node:path";
+import {
+  FileSystem,
+} from "@effect/platform";
+import {
+  NodeFileSystem,
+} from "@effect/platform-node";
+import {
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
 import * as Effect from "effect/Effect";
-import { createLocalExecutorRuntime as createExecutorRuntime } from "../../../../sdk-file/src/index";
+import {
-import { withExecutorApiClient } from "./test-http-client";
+  createLocalExecutorRuntime as createExecutorRuntime,
+} from "../../../../sdk-file/src/index";
+import {
+  withExecutorApiClient,
+} from "./test-http-client";
 const writeProjectConfig = (
-  workspaceRoot: string,
+  scopeRoot: string,
   config: Record<string, unknown>,
 ) =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
-  const configDirectory = join(workspaceRoot, ".executor");
+  const configDirectory = join(scopeRoot, ".executor");
     yield* fs.makeDirectory(configDirectory, { recursive: true });
     yield* fs.writeFileString(
       join(configDirectory, "executor.jsonc"),
   return Effect.acquireRelease(
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
-      const workspaceRoot = yield* fs.makeTempDirectory({
+      const scopeRoot = yield* fs.makeTempDirectory({
         directory: tmpdir(),
         prefix: "executor-runtime-config-",
       });
-      yield* writeProjectConfig(workspaceRoot, config);
+      yield* writeProjectConfig(scopeRoot, config);
       return yield* createExecutorRuntime({
-        workspaceRoot,
+        workspaceRoot: scopeRoot,
-        homeConfigPath: join(workspaceRoot, ".executor-home.jsonc"),
+        homeConfigPath: join(scopeRoot, ".executor-home.jsonc"),
-        homeStateDirectory: join(workspaceRoot, ".executor-home-state"),
+        homeStateDirectory: join(scopeRoot, ".executor-home-state"),
       });
     }).pipe(Effect.provide(NodeFileSystem.layer)),
     (runtime) => Effect.promise(() => runtime.close()).pipe(Effect.orDie),
       const execution = yield* withExecutorApiClient(
         {
           runtime,
-          accountId: installation.accountId,
+          actorScopeId: installation.actorScopeId,
         },
         (client) =>
           client.executions.create({
             path: {
-              workspaceId: installation.workspaceId,
+              scopeId: installation.scopeId,
             },
             payload: {
               code: 'await fetch("https://example.com"); return 1;',
       const execution = yield* withExecutorApiClient(
         {
           runtime,
-          accountId: installation.accountId,
+          actorScopeId: installation.actorScopeId,
         },
         (client) =>
           client.executions.create({
             path: {
-              workspaceId: installation.workspaceId,
+              scopeId: installation.scopeId,
             },
             payload: {
               code: 'await fetch("https://example.com"); return 1;',
       const execution = yield* withExecutorApiClient(
         {
           runtime,
-          accountId: installation.accountId,
+          actorScopeId: installation.actorScopeId,
         },
         (client) =>
           client.executions.create({
             path: {
-              workspaceId: installation.workspaceId,
+              scopeId: installation.scopeId,
             },
             payload: {
               code: 'return typeof Deno !== "undefined";',

packages/platform/sdk/src/runtime/execution/runtime.ts+16−5

@@ -1,8 +1,19 @@
1	import type { CodeExecutor } from "@executor/codemode-core";	1	import type {
2	import { makeDenoSubprocessExecutor } from "@executor/runtime-deno-subprocess";	2	CodeExecutor,
3	import { makeQuickJsExecutor } from "@executor/runtime-quickjs";	3	} from "@executor/codemode-core";
4	import { makeSesExecutor } from "@executor/runtime-ses";	4	import {
5	import type { LocalExecutorConfig, LocalExecutorRuntime } from "#schema";	5	makeDenoSubprocessExecutor,
		6	} from "@executor/runtime-deno-subprocess";
		7	import {
		8	makeQuickJsExecutor,
		9	} from "@executor/runtime-quickjs";
		10	import {
		11	makeSesExecutor,
		12	} from "@executor/runtime-ses";
		13	import type {
		14	LocalExecutorConfig,
		15	LocalExecutorRuntime,
		16	} from "#schema";
6		17
7	const DEFAULT_EXECUTION_RUNTIME: LocalExecutorRuntime = "quickjs";	18	const DEFAULT_EXECUTION_RUNTIME: LocalExecutorRuntime = "quickjs";
8		19

packages/platform/sdk/src/runtime/execution/scope/authorization.tsrenamed from packages/platform/sdk/src/runtime/execution/workspace/authorization.ts+33−16

-import { type ToolPath, makeToolInvokerFromTools } from "@executor/codemode-core";
+import {
-import type { Source } from "#schema";
+  type ToolPath,
+  makeToolInvokerFromTools,
+} from "@executor/codemode-core";
+import type {
+  Source,
+} from "#schema";
 import * as Either from "effect/Either";
 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
-import type { LoadedSourceCatalogToolIndexEntry } from "../../catalog/source/runtime";
+import type {
-import type { SecretMaterialResolveContext } from "../../workspace/secret-material-providers";
+  LoadedSourceCatalogToolIndexEntry,
-import type { WorkspaceStorageServices } from "../../workspace/storage";
+} from "../../catalog/source/runtime";
-import { invocationDescriptorFromTool } from "../ir-execution";
+import type {
-import { evaluateInvocationPolicy } from "../../policy/invocation-policy-engine";
+  SecretMaterialResolveContext,
-import { loadRuntimeLocalWorkspacePolicies } from "../../../policies/operations";
+} from "../../scope/secret-material-providers";
+import type {
+  ScopeStorageServices,
+} from "../../scope/storage";
+import {
+  invocationDescriptorFromTool,
+} from "../ir-execution";
+import {
+  evaluateInvocationPolicy,
+} from "../../policy/invocation-policy-engine";
+import {
+  loadRuntimeLocalScopePolicies,
+} from "../../../policies/operations";
 const asToolPath = (value: string): ToolPath => value as ToolPath;
 const failAuthorization = (message: string): Effect.Effect<never, Error, never> =>
   Effect.fail(new Error(message));
-type WorkspaceToolElicitation = Parameters<
+type ScopeToolElicitation = Parameters<
   typeof makeToolInvokerFromTools
 >[0]["onElicitation"];
 export const authorizePersistedToolInvocation = (input: {
-  workspaceId: Source["workspaceId"];
+  scopeId: Source["scopeId"];
   tool: LoadedSourceCatalogToolIndexEntry;
   args: unknown;
   context?: Record<string, unknown>;
-  onElicitation?: WorkspaceToolElicitation;
+  onElicitation?: ScopeToolElicitation;
-}): Effect.Effect<void, Error, WorkspaceStorageServices> =>
+}): Effect.Effect<void, Error, ScopeStorageServices> =>
   Effect.gen(function* () {
     const descriptor = invocationDescriptorFromTool({
       tool: input.tool,
     });
-    const localWorkspacePolicies = yield* loadRuntimeLocalWorkspacePolicies(
+    const localScopePolicies = yield* loadRuntimeLocalScopePolicies(
-      input.workspaceId,
+      input.scopeId,
     ).pipe(
       Effect.mapError((cause) =>
         cause instanceof Error ? cause : new Error(String(cause)),
     const decision = evaluateInvocationPolicy({
       descriptor,
       args: input.args,
-      policies: localWorkspacePolicies.policies,
+      policies: localScopePolicies.policies,
       context: {
-        workspaceId: input.workspaceId,
+        scopeId: input.scopeId,
       },
     });

packages/platform/sdk/src/runtime/execution/scope/environment.tsrenamed from packages/platform/sdk/src/runtime/execution/workspace/environment.ts+55−37

   createCodeExecutorForRuntime,
   resolveConfiguredExecutionRuntime,
 } from "../runtime";
-import { createWorkspaceToolInvoker } from "./tool-invoker";
+import {
-import { RuntimeSourceAuthServiceTag } from "../../sources/source-auth-service";
+  createScopeToolInvoker,
-import { RuntimeSourceCatalogStoreService } from "../../catalog/source/runtime";
+} from "./tool-invoker";
-import { RuntimeSourceAuthMaterialService } from "../../auth/source-auth-material";
+import {
-import { RuntimeSourceCatalogSyncService } from "../../catalog/source/sync";
+  RuntimeSourceAuthServiceTag,
-import { getRuntimeLocalWorkspaceOption } from "../../workspace/runtime-context";
+} from "../../sources/source-auth-service";
+import {
+  RuntimeSourceCatalogStoreService,
+} from "../../catalog/source/runtime";
+import {
+  RuntimeSourceAuthMaterialService,
+} from "../../auth/source-auth-material";
+import {
+  RuntimeSourceCatalogSyncService,
+} from "../../catalog/source/sync";
+import {
+  getRuntimeLocalScopeOption,
+} from "../../scope/runtime-context";
 import {
   LocalInstanceConfigService,
   SecretMaterialDeleterService,
   SecretMaterialStorerService,
   SecretMaterialUpdaterService,
-} from "../../workspace/secret-material-providers";
+} from "../../scope/secret-material-providers";
 import {
   LocalToolRuntimeLoaderService,
   type LocalToolRuntimeLoaderShape,
   type InstallationStoreShape,
   SourceArtifactStore,
   type SourceArtifactStoreShape,
-  WorkspaceConfigStore,
+  ScopeConfigStore,
-  type WorkspaceConfigStoreShape,
+  type ScopeConfigStoreShape,
-  WorkspaceStateStore,
+  ScopeStateStore,
-  type WorkspaceStateStoreShape,
+  type ScopeStateStoreShape,
-} from "../../workspace/storage";
+} from "../../scope/storage";
-import { ExecutorStateStore } from "../../executor-state-store";
+import {
-import { RuntimeSourceStoreService } from "../../sources/source-store";
+  ExecutorStateStore,
-import type { CreateWorkspaceInternalToolMap } from "./tool-invoker";
+} from "../../executor-state-store";
+import {
+  RuntimeSourceStoreService,
+} from "../../sources/source-store";
+import type {
+  CreateScopeInternalToolMap,
+} from "./tool-invoker";
 export {
   createCodeExecutorForRuntime,
   resolveConfiguredExecutionRuntime,
   toolPaths: new Set<string>(),
 });
-export const createWorkspaceExecutionEnvironmentResolver =
+export const createScopeExecutionEnvironmentResolver =
   (input: {
     executorStateStore: Effect.Effect.Success<typeof ExecutorStateStore>;
     sourceStore: Effect.Effect.Success<typeof RuntimeSourceStoreService>;
     storeSecretMaterial: Effect.Effect.Success<typeof SecretMaterialStorerService>;
     deleteSecretMaterial: Effect.Effect.Success<typeof SecretMaterialDeleterService>;
     updateSecretMaterial: Effect.Effect.Success<typeof SecretMaterialUpdaterService>;
-    workspaceConfigStore: WorkspaceConfigStoreShape;
+    scopeConfigStore: ScopeConfigStoreShape;
-    workspaceStateStore: WorkspaceStateStoreShape;
+    scopeStateStore: ScopeStateStoreShape;
     sourceArtifactStore: SourceArtifactStoreShape;
-    createInternalToolMap?: CreateWorkspaceInternalToolMap;
+    createInternalToolMap?: CreateScopeInternalToolMap;
   }): ResolveExecutionEnvironment =>
-  ({ workspaceId, accountId, onElicitation }) =>
+  ({ scopeId, actorScopeId, onElicitation }) =>
     Effect.gen(function* () {
-      const runtimeLocalWorkspace = yield* getRuntimeLocalWorkspaceOption();
+      const runtimeLocalScope = yield* getRuntimeLocalScopeOption();
       const loadedConfig =
-        runtimeLocalWorkspace === null
+        runtimeLocalScope === null
           ? null
-          : yield* input.workspaceConfigStore.load();
+          : yield* input.scopeConfigStore.load();
       const localToolRuntime =
-        runtimeLocalWorkspace === null
+        runtimeLocalScope === null
           ? createEmptyLocalToolRuntime()
           : yield* input.localToolRuntimeLoader.load();
-      const { catalog, toolInvoker } = createWorkspaceToolInvoker({
+      const { catalog, toolInvoker } = createScopeToolInvoker({
-        workspaceId,
+        scopeId,
-        accountId,
+        actorScopeId,
         executorStateStore: input.executorStateStore,
         sourceStore: input.sourceStore,
         sourceCatalogSyncService: input.sourceCatalogSyncService,
         storeSecretMaterial: input.storeSecretMaterial,
         deleteSecretMaterial: input.deleteSecretMaterial,
         updateSecretMaterial: input.updateSecretMaterial,
-        workspaceConfigStore: input.workspaceConfigStore,
+        scopeConfigStore: input.scopeConfigStore,
-        workspaceStateStore: input.workspaceStateStore,
+        scopeStateStore: input.scopeStateStore,
         sourceArtifactStore: input.sourceArtifactStore,
         sourceAuthMaterialService: input.sourceAuthMaterialService,
         sourceAuthService: input.sourceAuthService,
-        runtimeLocalWorkspace,
+        runtimeLocalScope,
         localToolRuntime,
         createInternalToolMap: input.createInternalToolMap,
         onElicitation,
   "#runtime/RuntimeExecutionResolverService",
 )<
   RuntimeExecutionResolverService,
-  ReturnType<typeof createWorkspaceExecutionEnvironmentResolver>
+  ReturnType<typeof createScopeExecutionEnvironmentResolver>
 >() {}
 export const RuntimeExecutionResolverLive = (
   input: {
     executionResolver?: ResolveExecutionEnvironment;
-    createInternalToolMap?: CreateWorkspaceInternalToolMap;
+    createInternalToolMap?: CreateScopeInternalToolMap;
   } = {},
 ) =>
   input.executionResolver
           const storeSecretMaterial = yield* SecretMaterialStorerService;
           const deleteSecretMaterial = yield* SecretMaterialDeleterService;
           const updateSecretMaterial = yield* SecretMaterialUpdaterService;
-          const workspaceConfigStore = yield* WorkspaceConfigStore;
+          const scopeConfigStore = yield* ScopeConfigStore;
-          const workspaceStateStore = yield* WorkspaceStateStore;
+          const scopeStateStore = yield* ScopeStateStore;
           const sourceArtifactStore = yield* SourceArtifactStore;
-          return createWorkspaceExecutionEnvironmentResolver({
+          return createScopeExecutionEnvironmentResolver({
             executorStateStore,
             sourceStore,
             sourceCatalogSyncService,
             storeSecretMaterial,
             deleteSecretMaterial,
             updateSecretMaterial,
-            workspaceConfigStore,
+            scopeConfigStore,
-            workspaceStateStore,
+            scopeStateStore,
             sourceArtifactStore,
             createInternalToolMap: input.createInternalToolMap,
           });

packages/platform/sdk/src/runtime/execution/scope/local.ts+12−0

@@ -0,0 +1,12 @@
	1	import * as Effect from "effect/Effect";
	2
	3	import {
	4	provideOptionalRuntimeLocalScope,
	5	type RuntimeLocalScopeState,
	6	} from "../../scope/runtime-context";
	7
	8	export const provideRuntimeLocalScope = <A, E, R>(
	9	effect: Effect.Effect<A, E, R>,
	10	runtimeLocalScope: RuntimeLocalScopeState \| null,
	11	): Effect.Effect<A, E, R> =>
	12	provideOptionalRuntimeLocalScope(effect, runtimeLocalScope);

packages/platform/sdk/src/runtime/execution/scope/source-catalog.tsrenamed from packages/platform/sdk/src/runtime/execution/workspace/source-catalog.ts+45−38

   createToolCatalogFromEntries,
   type ToolCatalog,
 } from "@executor/codemode-core";
-import type { AccountId, Source } from "#schema";
+import type {
+  ScopeId,
+  Source,
+} from "#schema";
 import * as Effect from "effect/Effect";
 import {
   type LoadedSourceCatalogToolIndexEntry,
   catalogToolCatalogEntry,
 } from "../../catalog/source/runtime";
-import type { RuntimeLocalWorkspaceState } from "../../workspace/runtime-context";
+import type {
+  RuntimeLocalScopeState,
+} from "../../scope/runtime-context";
 import {
-  makeWorkspaceStorageLayer,
+  makeScopeStorageLayer,
   type SourceArtifactStoreShape,
-  type WorkspaceConfigStoreShape,
+  type ScopeConfigStoreShape,
-  type WorkspaceStateStoreShape,
+  type ScopeStateStoreShape,
-  type WorkspaceStorageServices,
+  type ScopeStorageServices,
-} from "../../workspace/storage";
+} from "../../scope/storage";
-import { provideRuntimeLocalWorkspace } from "./local";
+import {
+  provideRuntimeLocalScope,
+} from "./local";
 const tokenize = (value: string): string[] =>
   value
   LOW_SIGNAL_QUERY_TOKENS.has(token) ? 0.25 : 1;
 export const loadWorkspaceCatalogTools = (input: {
-  workspaceId: Source["workspaceId"];
+  scopeId: Source["scopeId"];
-  accountId: AccountId;
+  actorScopeId: ScopeId;
   sourceCatalogStore: Effect.Effect.Success<typeof RuntimeSourceCatalogStoreService>;
   includeSchemas: boolean;
 }): Effect.Effect<
   readonly LoadedSourceCatalogToolIndexEntry[],
   Error,
-  WorkspaceStorageServices
+  ScopeStorageServices
 > =>
   Effect.map(
     input.sourceCatalogStore.loadWorkspaceSourceCatalogToolIndex({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
-      actorAccountId: input.accountId,
+      actorScopeId: input.actorScopeId,
       includeSchemas: input.includeSchemas,
     }),
     (tools) =>
   );
 export const loadWorkspaceCatalogToolByPath = (input: {
-  workspaceId: Source["workspaceId"];
+  scopeId: Source["scopeId"];
-  accountId: AccountId;
+  actorScopeId: ScopeId;
   sourceCatalogStore: Effect.Effect.Success<typeof RuntimeSourceCatalogStoreService>;
   path: string;
   includeSchemas: boolean;
 }): Effect.Effect<
   LoadedSourceCatalogToolIndexEntry | null,
   Error,
-  WorkspaceStorageServices
+  ScopeStorageServices
 > =>
   input.sourceCatalogStore.loadWorkspaceSourceCatalogToolByPath({
-    workspaceId: input.workspaceId,
+    scopeId: input.scopeId,
     path: input.path,
-    actorAccountId: input.accountId,
+    actorScopeId: input.actorScopeId,
     includeSchemas: input.includeSchemas,
   }).pipe(
     Effect.map((tool) =>
   return score;
 };
-export const createWorkspaceSourceCatalog = (input: {
+export const createScopeSourceCatalog = (input: {
-  workspaceId: Source["workspaceId"];
+  scopeId: Source["scopeId"];
-  accountId: AccountId;
+  actorScopeId: ScopeId;
   sourceCatalogStore: Effect.Effect.Success<typeof RuntimeSourceCatalogStoreService>;
-  workspaceConfigStore: WorkspaceConfigStoreShape;
+  scopeConfigStore: ScopeConfigStoreShape;
-  workspaceStateStore: WorkspaceStateStoreShape;
+  scopeStateStore: ScopeStateStoreShape;
   sourceArtifactStore: SourceArtifactStoreShape;
-  runtimeLocalWorkspace: RuntimeLocalWorkspaceState | null;
+  runtimeLocalScope: RuntimeLocalScopeState | null;
 }): ToolCatalog => {
-  const workspaceStorageLayer = makeWorkspaceStorageLayer({
+  const scopeStorageLayer = makeScopeStorageLayer({
-    workspaceConfigStore: input.workspaceConfigStore,
+    scopeConfigStore: input.scopeConfigStore,
-    workspaceStateStore: input.workspaceStateStore,
+    scopeStateStore: input.scopeStateStore,
     sourceArtifactStore: input.sourceArtifactStore,
   });
   const provideWorkspaceStorage = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
-    effect.pipe(Effect.provide(workspaceStorageLayer));
+    effect.pipe(Effect.provide(scopeStorageLayer));
   const createSharedCatalog = (includeSchemas: boolean): Effect.Effect<ToolCatalog, Error, never> =>
     provideWorkspaceStorage(Effect.gen(function* () {
       const catalogTools = yield* loadWorkspaceCatalogTools({
-        workspaceId: input.workspaceId,
+        scopeId: input.scopeId,
-        accountId: input.accountId,
+        actorScopeId: input.actorScopeId,
         sourceCatalogStore: input.sourceCatalogStore,
         includeSchemas,
       });
   return {
     listNamespaces: ({ limit }) =>
-      provideRuntimeLocalWorkspace(
+      provideRuntimeLocalScope(
         Effect.flatMap(createSharedCatalog(false), (catalog) =>
           catalog.listNamespaces({ limit }),
         ),
-        input.runtimeLocalWorkspace,
+        input.runtimeLocalScope,
       ),
     listTools: ({ namespace, query, limit, includeSchemas = false }) =>
-      provideRuntimeLocalWorkspace(
+      provideRuntimeLocalScope(
         Effect.flatMap(createSharedCatalog(includeSchemas), (catalog) =>
           catalog.listTools({
             ...(namespace !== undefined ? { namespace } : {}),
             includeSchemas,
           }),
         ),
-        input.runtimeLocalWorkspace,
+        input.runtimeLocalScope,
       ),
     getToolByPath: ({ path, includeSchemas }) =>
-      provideRuntimeLocalWorkspace(
+      provideRuntimeLocalScope(
         Effect.flatMap(createSharedCatalog(includeSchemas), (catalog) =>
           catalog.getToolByPath({ path, includeSchemas }),
         ),
-        input.runtimeLocalWorkspace,
+        input.runtimeLocalScope,
       ),
     searchTools: ({ query, namespace, limit }) =>
-      provideRuntimeLocalWorkspace(
+      provideRuntimeLocalScope(
         Effect.flatMap(createSharedCatalog(false), (catalog) =>
           catalog.searchTools({
             query,
             limit,
           }),
         ),
-        input.runtimeLocalWorkspace,
+        input.runtimeLocalScope,
       ),
   } satisfies ToolCatalog;
 };

packages/platform/sdk/src/runtime/execution/scope/tool-invoker.tsrenamed from packages/platform/sdk/src/runtime/execution/workspace/tool-invoker.ts+92−65

   type ToolMap,
   type ToolInvoker,
 } from "@executor/codemode-core";
-import type { AccountId, Source } from "#schema";
+import type {
+  ScopeId,
+  Source,
+} from "#schema";
 import * as Effect from "effect/Effect";
-import { RuntimeSourceAuthMaterialService } from "../../auth/source-auth-material";
+import {
-import { RuntimeSourceCatalogStoreService } from "../../catalog/source/runtime";
+  RuntimeSourceAuthMaterialService,
-import type { RuntimeLocalWorkspaceState } from "../../workspace/runtime-context";
+} from "../../auth/source-auth-material";
-import { type LocalToolRuntime } from "../../local-tool-runtime";
+import {
+  RuntimeSourceCatalogStoreService,
+} from "../../catalog/source/runtime";
+import type {
+  RuntimeLocalScopeState,
+} from "../../scope/runtime-context";
+import {
+  type LocalToolRuntime,
+} from "../../local-tool-runtime";
 import {
   type InstallationStoreShape,
-  makeWorkspaceStorageLayer,
+  makeScopeStorageLayer,
   type SourceArtifactStoreShape,
-  type WorkspaceConfigStoreShape,
+  type ScopeConfigStoreShape,
-  type WorkspaceStateStoreShape,
+  type ScopeStateStoreShape,
-} from "../../workspace/storage";
+} from "../../scope/storage";
 import type {
   DeleteSecretMaterial,
   ResolveInstanceConfig,
   StoreSecretMaterial,
   UpdateSecretMaterial,
-} from "../../workspace/secret-material-providers";
+} from "../../scope/secret-material-providers";
-import type { ExecutorStateStoreShape } from "../../executor-state-store";
+import type {
-import { RuntimeSourceAuthService } from "../../sources/source-auth-service";
+  ExecutorStateStoreShape,
-import { type RuntimeSourceStore } from "../../sources/source-store";
+} from "../../executor-state-store";
-import { createExecutorToolMap } from "../../sources/executor-tools";
+import {
-import { RuntimeSourceCatalogSyncService } from "../../catalog/source/sync";
+  RuntimeSourceAuthService,
-import { invokeIrTool } from "../ir-execution";
+} from "../../sources/source-auth-service";
+import {
+  type RuntimeSourceStore,
+} from "../../sources/source-store";
+import {
+  createExecutorToolMap,
+} from "../../sources/executor-tools";
+import {
+  RuntimeSourceCatalogSyncService,
+} from "../../catalog/source/sync";
+import {
+  invokeIrTool,
+} from "../ir-execution";
 import {
   authorizePersistedToolInvocation,
   toSecretResolutionContext,
 } from "./authorization";
-import { provideRuntimeLocalWorkspace } from "./local";
 import {
-  createWorkspaceSourceCatalog,
+  provideRuntimeLocalScope,
+} from "./local";
+import {
+  createScopeSourceCatalog,
   loadWorkspaceCatalogToolByPath,
 } from "./source-catalog";
-import { runtimeEffectError } from "../../effect-errors";
+import {
+  runtimeEffectError,
+} from "../../effect-errors";
-export type WorkspaceInternalToolContext = {
+export type ScopeInternalToolContext = {
-  workspaceId: Source["workspaceId"];
+  scopeId: Source["scopeId"];
-  accountId: AccountId;
+  actorScopeId: ScopeId;
   executorStateStore: ExecutorStateStoreShape;
   sourceStore: RuntimeSourceStore;
   sourceCatalogSyncService: Effect.Effect.Success<
   storeSecretMaterial: StoreSecretMaterial;
   deleteSecretMaterial: DeleteSecretMaterial;
   updateSecretMaterial: UpdateSecretMaterial;
-  workspaceConfigStore: WorkspaceConfigStoreShape;
+  scopeConfigStore: ScopeConfigStoreShape;
-  workspaceStateStore: WorkspaceStateStoreShape;
+  scopeStateStore: ScopeStateStoreShape;
   sourceArtifactStore: SourceArtifactStoreShape;
-  runtimeLocalWorkspace: RuntimeLocalWorkspaceState | null;
+  runtimeLocalScope: RuntimeLocalScopeState | null;
 };
-export type CreateWorkspaceInternalToolMap = (
+export type CreateScopeInternalToolMap = (
-  input: WorkspaceInternalToolContext,
+  input: ScopeInternalToolContext,
 ) => ToolMap;
-export const createWorkspaceToolInvoker = (input: {
+export const createScopeToolInvoker = (input: {
-  workspaceId: Source["workspaceId"];
+  scopeId: Source["scopeId"];
-  accountId: AccountId;
+  actorScopeId: ScopeId;
   executorStateStore: ExecutorStateStoreShape;
   sourceStore: RuntimeSourceStore;
   sourceCatalogSyncService: Effect.Effect.Success<
   storeSecretMaterial: StoreSecretMaterial;
   deleteSecretMaterial: DeleteSecretMaterial;
   updateSecretMaterial: UpdateSecretMaterial;
-  workspaceConfigStore: WorkspaceConfigStoreShape;
+  scopeConfigStore: ScopeConfigStoreShape;
-  workspaceStateStore: WorkspaceStateStoreShape;
+  scopeStateStore: ScopeStateStoreShape;
   sourceArtifactStore: SourceArtifactStoreShape;
   sourceAuthMaterialService: Effect.Effect.Success<
     typeof RuntimeSourceAuthMaterialService
   >;
   sourceAuthService: RuntimeSourceAuthService;
-  runtimeLocalWorkspace: RuntimeLocalWorkspaceState | null;
+  runtimeLocalScope: RuntimeLocalScopeState | null;
   localToolRuntime: LocalToolRuntime;
-  createInternalToolMap?: CreateWorkspaceInternalToolMap;
+  createInternalToolMap?: CreateScopeInternalToolMap;
   onElicitation?: Parameters<
     typeof makeToolInvokerFromTools
   >[0]["onElicitation"];
   catalog: ToolCatalog;
   toolInvoker: ToolInvoker;
 } => {
-  const workspaceStorageLayer = makeWorkspaceStorageLayer({
+  const scopeStorageLayer = makeScopeStorageLayer({
-    workspaceConfigStore: input.workspaceConfigStore,
+    scopeConfigStore: input.scopeConfigStore,
-    workspaceStateStore: input.workspaceStateStore,
+    scopeStateStore: input.scopeStateStore,
     sourceArtifactStore: input.sourceArtifactStore,
   });
   const provideWorkspaceStorage = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
-    effect.pipe(Effect.provide(workspaceStorageLayer));
+    effect.pipe(Effect.provide(scopeStorageLayer));
   const executorTools = createExecutorToolMap({
-    workspaceId: input.workspaceId,
+    scopeId: input.scopeId,
-    accountId: input.accountId,
+    actorScopeId: input.actorScopeId,
     sourceAuthService: input.sourceAuthService,
     installationStore: input.installationStore,
-    workspaceConfigStore: input.workspaceConfigStore,
+    scopeConfigStore: input.scopeConfigStore,
-    workspaceStateStore: input.workspaceStateStore,
+    scopeStateStore: input.scopeStateStore,
     sourceArtifactStore: input.sourceArtifactStore,
-    runtimeLocalWorkspace: input.runtimeLocalWorkspace,
+    runtimeLocalScope: input.runtimeLocalScope,
   });
   const internalTools =
     input.createInternalToolMap?.({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
-      accountId: input.accountId,
+      actorScopeId: input.actorScopeId,
       executorStateStore: input.executorStateStore,
       sourceStore: input.sourceStore,
       sourceCatalogSyncService: input.sourceCatalogSyncService,
       storeSecretMaterial: input.storeSecretMaterial,
       deleteSecretMaterial: input.deleteSecretMaterial,
       updateSecretMaterial: input.updateSecretMaterial,
-      workspaceConfigStore: input.workspaceConfigStore,
+      scopeConfigStore: input.scopeConfigStore,
-      workspaceStateStore: input.workspaceStateStore,
+      scopeStateStore: input.scopeStateStore,
       sourceArtifactStore: input.sourceArtifactStore,
-      runtimeLocalWorkspace: input.runtimeLocalWorkspace,
+      runtimeLocalScope: input.runtimeLocalScope,
     }) ?? {};
-  const sourceCatalog = createWorkspaceSourceCatalog({
+  const sourceCatalog = createScopeSourceCatalog({
-    workspaceId: input.workspaceId,
+    scopeId: input.scopeId,
-    accountId: input.accountId,
+    actorScopeId: input.actorScopeId,
     sourceCatalogStore: input.sourceCatalogStore,
-    workspaceConfigStore: input.workspaceConfigStore,
+    scopeConfigStore: input.scopeConfigStore,
-    workspaceStateStore: input.workspaceStateStore,
+    scopeStateStore: input.scopeStateStore,
     sourceArtifactStore: input.sourceArtifactStore,
-    runtimeLocalWorkspace: input.runtimeLocalWorkspace,
+    runtimeLocalScope: input.runtimeLocalScope,
   });
   let catalog: ToolCatalog | null = null;
   const systemTools = createSystemToolMap({
     args: unknown;
     context?: Record<string, unknown>;
   }) =>
-    provideRuntimeLocalWorkspace(
+    provideRuntimeLocalScope(
       provideWorkspaceStorage(
         Effect.gen(function* () {
           const catalogTool = yield* loadWorkspaceCatalogToolByPath({
-            workspaceId: input.workspaceId,
+            scopeId: input.scopeId,
-            accountId: input.accountId,
+            actorScopeId: input.actorScopeId,
             sourceCatalogStore: input.sourceCatalogStore,
             path: invocation.path,
             includeSchemas: false,
           });
           if (!catalogTool) {
             return yield* runtimeEffectError(
-              "execution/workspace/tool-invoker",
+              "execution/scope/tool-invoker",
               `Unknown tool path: ${invocation.path}`,
             );
           }
           yield* authorizePersistedToolInvocation({
-            workspaceId: input.workspaceId,
+            scopeId: input.scopeId,
             tool: catalogTool,
             args: invocation.args,
             context: invocation.context,
           const auth = yield* input.sourceAuthMaterialService.resolve({
             source: catalogTool.source,
-            actorAccountId: input.accountId,
+            actorScopeId: input.actorScopeId,
             context: toSecretResolutionContext(invocation.context),
           });
           return yield* invokeIrTool({
-            workspaceId: input.workspaceId,
+            scopeId: input.scopeId,
-            accountId: input.accountId,
+            actorScopeId: input.actorScopeId,
             tool: catalogTool,
             auth,
             args: invocation.args,
           });
         }),
       ),
-      input.runtimeLocalWorkspace,
+      input.runtimeLocalScope,
     );
   return {
     catalog,
     toolInvoker: {
       invoke: ({ path, args, context }) =>
-        provideRuntimeLocalWorkspace(
+        provideRuntimeLocalScope(
           authoredToolPaths.has(path)
             ? authoredInvoker.invoke({ path, args, context })
             : invokePersistedTool({ path, args, context }),
-          input.runtimeLocalWorkspace,
+          input.runtimeLocalScope,
         ),
     },
   };

packages/platform/sdk/src/runtime/execution/service.ts+35−30

   ExecutionIdSchema,
   ExecutionInteractionIdSchema,
   ExecutionStepIdSchema,
-  type AccountId,
+  type ScopeId,
   type Execution,
   type ExecutionEnvelope,
   type ExecutionId,
   type ExecutionInteraction,
-  type WorkspaceId,
 } from "#schema";
 import * as Data from "effect/Data";
 import * as Deferred from "effect/Deferred";
 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
-import { type ResolveExecutionEnvironment } from "./state";
+import {
+  type ResolveExecutionEnvironment,
+} from "./state";
 import {
   LiveExecutionManagerService,
   sanitizePersistedElicitationResponse,
   type LiveExecutionManager,
 } from "./live";
 import {
-  getRuntimeLocalWorkspaceOption,
+  getRuntimeLocalScopeOption,
-  provideOptionalRuntimeLocalWorkspace,
+  provideOptionalRuntimeLocalScope,
-} from "../workspace/runtime-context";
+} from "../scope/runtime-context";
 import {
   asOperationErrors,
   operationErrors,
   ExecutorStateStore,
   type ExecutorStateStoreShape,
 } from "../executor-state-store";
-import { RuntimeExecutionResolverService } from "./workspace/environment";
+import {
-import { runtimeEffectError } from "../effect-errors";
+  RuntimeExecutionResolverService,
+} from "./scope/environment";
+import {
+  runtimeEffectError,
+} from "../effect-errors";
 const executionOps = {
   create: operationErrors("executions.create"),
 const fetchExecution = (
   store: ExecutorStateStoreShape,
   input: {
-    workspaceId: Execution["workspaceId"];
+    scopeId: Execution["scopeId"];
     executionId: Execution["id"];
     operation: OperationErrorsLike;
   },
   Effect.gen(function* () {
     const errors = asOperationErrors(input.operation);
     const existing = yield* errors.mapStorage(
-      store.executions.getByWorkspaceAndId(input.workspaceId, input.executionId),
+      store.executions.getByScopeAndId(input.scopeId, input.executionId),
     );
     if (Option.isNone(existing)) {
       return yield* errors.notFound(
           "Execution not found",
-          `workspaceId=${input.workspaceId} executionId=${input.executionId}`,
+          `scopeId=${input.scopeId} executionId=${input.executionId}`,
         );
     }
 const fetchExecutionEnvelope = (
   store: ExecutorStateStoreShape,
   input: {
-    workspaceId: Execution["workspaceId"];
+    scopeId: Execution["scopeId"];
     executionId: Execution["id"];
     operation: OperationErrorsLike;
   },
 const waitForExecutionEnvelopeToSettle = (
   store: ExecutorStateStoreShape,
   input: {
-    workspaceId: Execution["workspaceId"];
+    scopeId: Execution["scopeId"];
     executionId: Execution["id"];
     operation: OperationErrorsLike;
     previousPendingInteractionId: ExecutionInteraction["id"] | null;
   interactionMode: InteractionMode,
 ) =>
   executionResolver({
-    workspaceId: execution.workspaceId,
+    scopeId: execution.scopeId,
-    accountId: execution.createdByAccountId,
+    actorScopeId: execution.createdByScopeId,
     executionId: execution.id,
     onElicitation: createHybridOnElicitation({
       executorState: store,
   interactionMode: InteractionMode,
 ) =>
   Effect.gen(function* () {
-    const runtimeLocalWorkspace = yield* getRuntimeLocalWorkspaceOption();
+    const runtimeLocalScope = yield* getRuntimeLocalScopeOption();
     yield* Effect.sync(() => {
       const effect = runExecutionAttemptWithDependencies(
       );
       Effect.runFork(
-        provideOptionalRuntimeLocalWorkspace(effect, runtimeLocalWorkspace),
+        provideOptionalRuntimeLocalScope(effect, runtimeLocalScope),
       );
     });
   });
   executionResolver: ResolveExecutionEnvironment,
   liveExecutionManager: LiveExecutionManager,
   input: {
-    workspaceId: WorkspaceId;
+    scopeId: ScopeId;
     payload: CreateExecutionPayload;
-    createdByAccountId: AccountId;
+    createdByScopeId: ScopeId;
   },
 ) =>
   Effect.gen(function* () {
     const now = Date.now();
     const execution: Execution = {
       id: ExecutionIdSchema.make(`exec_${crypto.randomUUID()}`),
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
-      createdByAccountId: input.createdByAccountId,
+      createdByScopeId: input.createdByScopeId,
       status: "pending",
       code,
       resultJson: null,
     yield* Deferred.await(nextState);
     return yield* fetchExecutionEnvelope(store, {
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       executionId: execution.id,
       operation: executionOps.create,
     });
   });
 export const createExecution = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   payload: CreateExecutionPayload;
-  createdByAccountId: AccountId;
+  createdByScopeId: ScopeId;
 }) =>
   Effect.gen(function* () {
     const store = yield* ExecutorStateStore;
   });
 export const getExecution = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   executionId: ExecutionId;
 }) =>
   Effect.flatMap(ExecutorStateStore, (store) =>
     fetchExecutionEnvelope(store, {
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       executionId: input.executionId,
       operation: executionOps.get,
     })
   });
 export const resumeExecution = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   executionId: ExecutionId;
   payload: ResumeExecutionPayload;
-  resumedByAccountId: AccountId;
+  resumedByScopeId: ScopeId;
 }) =>
   Effect.gen(function* () {
     const store = yield* ExecutorStateStore;
     const liveExecutionManager = yield* LiveExecutionManagerService;
     const existing = yield* fetchExecutionEnvelope(store, {
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       executionId: input.executionId,
       operation: "executions.resume",
     });
     }
     return yield* waitForExecutionEnvelopeToSettle(store, {
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       executionId: input.executionId,
       operation: executionOps.resume,
       previousPendingInteractionId: existing.pendingInteraction?.id ?? null,

packages/platform/sdk/src/runtime/execution/state.ts+6−3

   ToolCatalog,
   ToolInvoker,
 } from "@executor/codemode-core";
-import type { AccountId, ExecutionId, WorkspaceId } from "#schema";
+import type {
+  ScopeId,
+  ExecutionId,
+} from "#schema";
 import * as Data from "effect/Data";
 import type * as Effect from "effect/Effect";
 };
 export type ResolveExecutionEnvironment = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
-  accountId: AccountId;
+  actorScopeId: ScopeId;
   executionId: ExecutionId;
   onElicitation?: OnElicitation;
 }) => Effect.Effect<ExecutionEnvironment, unknown>;

packages/platform/sdk/src/runtime/execution/test-http-client.ts+4−2

   HttpApiClient,
   HttpServer,
 } from "@effect/platform";
-import { NodeHttpServer } from "@effect/platform-node";
+import {
+  NodeHttpServer,
+} from "@effect/platform-node";
 import {
   ExecutorApi,
   createExecutorApiLayer,
 export const withExecutorApiClient = <A, E>(
   input: {
     runtime: ExecutorRuntime;
-    accountId?: string;
+    actorScopeId?: string;
   },
   f: (client: ExecutorApiClient) => Effect.Effect<A, E, never>,
 ): Effect.Effect<A, E, never> =>

packages/platform/sdk/src/runtime/execution/workspace/local.ts+0−12

@@ -1,12 +0,0 @@
1	import * as Effect from "effect/Effect";
2
3	import {
4	provideOptionalRuntimeLocalWorkspace,
5	type RuntimeLocalWorkspaceState,
6	} from "../../workspace/runtime-context";
7
8	export const provideRuntimeLocalWorkspace = <A, E, R>(
9	effect: Effect.Effect<A, E, R>,
10	runtimeLocalWorkspace: RuntimeLocalWorkspaceState \| null,
11	): Effect.Effect<A, E, R> =>
12	provideOptionalRuntimeLocalWorkspace(effect, runtimeLocalWorkspace);

packages/platform/sdk/src/runtime/executor-runtime.test.ts+195−195

@@ -1,14 +1,35 @@
1	import { createServer } from "node:http";	1	import {
2	import { join } from "node:path";	2	createServer,
		3	} from "node:http";
		4	import {
		5	join,
		6	} from "node:path";
3		7
4	import { FileSystem } from "@effect/platform";	8	import {
5	import { NodeFileSystem } from "@effect/platform-node";	9	FileSystem,
6	import { describe, expect, it } from "@effect/vitest";	10	HttpApi,
7	import { assertTrue } from "@effect/vitest/utils";	11	HttpApiEndpoint,
		12	HttpApiGroup,
		13	HttpApiSchema,
		14	HttpApiBuilder,
		15	} from "@effect/platform";
		16	import {
		17	NodeFileSystem,
		18	} from "@effect/platform-node";
		19	import {
		20	describe,
		21	expect,
		22	it,
		23	} from "@effect/vitest";
		24	import {
		25	assertTrue,
		26	} from "@effect/vitest/utils";
8	import * as Either from "effect/Either";	27	import * as Either from "effect/Either";
9	import * as Effect from "effect/Effect";	28	import * as Effect from "effect/Effect";
10	import * as Fiber from "effect/Fiber";	29	import * as Fiber from "effect/Fiber";
		30	import * as Layer from "effect/Layer";
11	import * as Option from "effect/Option";	31	import * as Option from "effect/Option";
		32	import * as Schema from "effect/Schema";
12		33
13	import {	34	import {
14	ExecutionIdSchema,	35	ExecutionIdSchema,
@@ -18,12 +39,23 @@ import { · 3 unmodified lines
18	SecretMaterialIdSchema,	39	SecretMaterialIdSchema,
19	SourceAuthSessionIdSchema,	40	SourceAuthSessionIdSchema,
20	SourceIdSchema,	41	SourceIdSchema,
21	WorkspaceOauthClientIdSchema,	42	ScopeOauthClientIdSchema,
22	} from "#schema";	43	} from "#schema";
23	import type { ToolPath } from "@executor/codemode-core";	44	import type {
24	import { createCatalogImportMetadata } from "@executor/source-core";	45	ToolPath,
25	import { createGraphqlCatalogFragment } from "@executor/source-graphql";	46	} from "@executor/codemode-core";
26	import { createWorkspaceExecutorAdminToolMap } from "../../../internal/src/index";	47	import {
		48	makeOpenApiTestServer,
		49	} from "@executor/effect-test-utils";
		50	import {
		51	createCatalogImportMetadata,
		52	} from "@executor/source-core";
		53	import {
		54	createGraphqlCatalogFragment,
		55	} from "@executor/source-graphql";
		56	import {
		57	createWorkspaceExecutorAdminToolMap,
		58	} from "../../../internal/src/index";
27		59
28	import {	60	import {
29	type ExecutorRuntime,	61	type ExecutorRuntime,
@@ -31,14 +63,22 @@ import { · 1 unmodified line
31	provideExecutorRuntime,	63	provideExecutorRuntime,
32	RuntimeExecutionResolverService,	64	RuntimeExecutionResolverService,
33	} from "./index";	65	} from "./index";
34	import { createSourceFromPayload } from "./sources/source-definitions";	66	import {
35	import { decodeSourceCredentialSelectionContent } from "./sources/source-credential-interactions";	67	createSourceFromPayload,
36	import { persistSource } from "./sources/source-store";	68	} from "./sources/source-definitions";
		69	import {
		70	decodeSourceCredentialSelectionContent,
		71	} from "./sources/source-credential-interactions";
		72	import {
		73	persistSource,
		74	} from "./sources/source-store";
37	import {	75	import {
38	withExecutorApiClient,	76	withExecutorApiClient,
39	withExecutorApiRequestHandler,	77	withExecutorApiRequestHandler,
40	} from "./execution/test-http-client";	78	} from "./execution/test-http-client";
41	import { runtimeEffectError } from "./effect-errors";	79	import {
		80	runtimeEffectError,
		81	} from "./effect-errors";
42	import {	82	import {
43	buildLocalSourceArtifact,	83	buildLocalSourceArtifact,
44	createLocalExecutorRuntime as createExecutorRuntime,	84	createLocalExecutorRuntime as createExecutorRuntime,
@@ -57,15 +97,15 @@ import { · 12 unmodified lines
57		97
58	const makeRuntime = Effect.gen(function* () {	98	const makeRuntime = Effect.gen(function* () {
59	const fs = yield* FileSystem.FileSystem;	99	const fs = yield* FileSystem.FileSystem;
60	const workspaceRoot = yield* fs.makeTempDirectoryScoped({	100	const scopeRoot = yield* fs.makeTempDirectoryScoped({
61	prefix: "executor-runtime-",	101	prefix: "executor-runtime-",
62	});	102	});
63	const homeConfigPath = join(workspaceRoot, ".executor-home.jsonc");	103	const homeConfigPath = join(scopeRoot, ".executor-home.jsonc");
64	const homeStateDirectory = join(workspaceRoot, ".executor-home-state");	104	const homeStateDirectory = join(scopeRoot, ".executor-home-state");
65		105
66	return yield* Effect.acquireRelease(	106	return yield* Effect.acquireRelease(
67	createExecutorRuntime({	107	createExecutorRuntime({
68	workspaceRoot,	108	workspaceRoot: scopeRoot,
69	homeConfigPath,	109	homeConfigPath,
70	homeStateDirectory,	110	homeStateDirectory,
71	createInternalToolMap: createWorkspaceExecutorAdminToolMap,	111	createInternalToolMap: createWorkspaceExecutorAdminToolMap,
@@ -74,11 +114,19 @@ const makeRuntime = Effect.gen(function* () { · 2 unmodified lines
74	);	114	);
75	}).pipe(Effect.provide(NodeFileSystem.layer));	115	}).pipe(Effect.provide(NodeFileSystem.layer));
76		116
77	type OpenApiSpecServer = {	117	const ownerParam = HttpApiSchema.param("owner", Schema.String);
78	baseUrl: string;	118	const repoParam = HttpApiSchema.param("repo", Schema.String);
79	specUrl: string;	119
80	close: () => Promise<void>;	120	class RuntimeTestReposApi extends HttpApiGroup.make("repos")
81	};	121	.add(
		122	HttpApiEndpoint.get("getRepo")`/repos/${ownerParam}/${repoParam}`
		123	.addSuccess(Schema.Unknown),
		124	)
		125	{}
		126
		127	class RuntimeTestOpenApi extends HttpApi.make("runtimeTest").add(
		128	RuntimeTestReposApi,
		129	) {}
82		130
83	type GoogleWorkspaceTestServer = {	131	type GoogleWorkspaceTestServer = {
84	baseUrl: string;	132	baseUrl: string;
@@ -99,74 +147,26 @@ type GoogleWorkspaceTestServer = { · 14 unmodified lines
99	close: () => Promise<void>;	147	close: () => Promise<void>;
100	};	148	};
101		149
102	const makeOpenApiSpecServer = Effect.acquireRelease(	150	const runtimeTestOpenApiLive = HttpApiBuilder.group(
103	Effect.promise<OpenApiSpecServer>(	151	RuntimeTestOpenApi,
104	() =>	152	"repos",
105	new Promise<OpenApiSpecServer>((resolve, reject) => {	153	(handlers) =>
106	const openApiDocument = JSON.stringify({	154	handlers.handle("getRepo", ({ path }) =>
107	openapi: "3.0.3",	155	Effect.succeed({
108	info: {	156	full_name: `${path.owner}/${path.repo}`,
109	title: "GitHub Test API",	157	private: false,
110	version: "1.0.0",
111	},
112	paths: {
113	"/repos/{owner}/{repo}": {
114	get: {
115	operationId: "repos/get-repo",
116	tags: ["repos"],
117	summary: "Get a repository",
118	responses: {
119	200: {
120	description: "ok",
121	},
122	},
123	},
124	},
125	},
126	});
127
128	const server = createServer((request, response) => {
129	if (request.url !== "/openapi.json") {
130	response.statusCode = 404;
131	response.end();
132	return;
133	}
134
135	response.statusCode = 200;
136	response.setHeader("content-type", "application/json");
137	response.end(openApiDocument);
138	});
139
140	server.once("error", reject);
141	server.listen(0, "127.0.0.1", () => {
142	const address = server.address();
143	if (!address \|\| typeof address === "string") {
144	reject(new Error("Failed to bind OpenAPI runtime test server"));
145	return;
146	}
147
148	const baseUrl = `http://127.0.0.1:${address.port}`;
149	resolve({
150	baseUrl,
151	specUrl: `${baseUrl}/openapi.json`,
152	close: () =>
153	new Promise<void>((closeResolve, closeReject) => {
154	server.close((error) => {
155	if (error) {
156	closeReject(error);
157	return;
158	}
159
160	closeResolve();
161	});
162	}),
163	});
164	});
165	}),	158	}),
166	),	159	),
167	(server) => Effect.promise(() => server.close()).pipe(Effect.orDie),
168	);	160	);
169		161
		162	const runtimeTestOpenApiLayer = HttpApiBuilder.api(RuntimeTestOpenApi).pipe(
		163	Layer.provide(runtimeTestOpenApiLive),
		164	);
		165
		166	const makeOpenApiSpecServer = makeOpenApiTestServer({
		167	apiLayer: runtimeTestOpenApiLayer,
		168	});
		169
170	const makeGoogleWorkspaceTestServer = Effect.acquireRelease(	170	const makeGoogleWorkspaceTestServer = Effect.acquireRelease(
171	Effect.promise<GoogleWorkspaceTestServer>(	171	Effect.promise<GoogleWorkspaceTestServer>(
172	() =>	172	() =>
@@ -379,7 +379,7 @@ const createPersistedGoogleSource = (input: { · 206 unmodified lines
379	Effect.gen(function* () {	379	Effect.gen(function* () {
380	const installation = input.runtime.localInstallation;	380	const installation = input.runtime.localInstallation;
381	const source = yield* createSourceFromPayload({	381	const source = yield* createSourceFromPayload({
382	workspaceId: installation.workspaceId,	382	scopeId: installation.scopeId,
383	sourceId: SourceIdSchema.make(`src_${crypto.randomUUID()}`),	383	sourceId: SourceIdSchema.make(`src_${crypto.randomUUID()}`),
384	payload: {	384	payload: {
385	name: input.name,	385	name: input.name,
@@ -402,7 +402,7 @@ const createPersistedGoogleSource = (input: { · 16 unmodified lines
402	});	402	});
403		403
404	return yield* persistSource(input.runtime.storage.executorState, source, {	404	return yield* persistSource(input.runtime.storage.executorState, source, {
405	actorAccountId: installation.accountId,	405	actorScopeId: installation.actorScopeId,
406	}).pipe((effect) => provideExecutorRuntime(effect, input.runtime));	406	}).pipe((effect) => provideExecutorRuntime(effect, input.runtime));
407	});	407	});
408		408
@@ -430,8 +430,8 @@ const invokeWorkspaceTool = <A>(input: { · 21 unmodified lines
430	const installation = input.runtime.localInstallation;	430	const installation = input.runtime.localInstallation;
431	const resolveEnvironment = yield* RuntimeExecutionResolverService;	431	const resolveEnvironment = yield* RuntimeExecutionResolverService;
432	const environment = yield* resolveEnvironment({	432	const environment = yield* resolveEnvironment({
433	workspaceId: installation.workspaceId,	433	scopeId: installation.scopeId,
434	accountId: installation.accountId,	434	actorScopeId: installation.actorScopeId,
435	executionId: ExecutionIdSchema.make(`exec_tool_${crypto.randomUUID()}`),	435	executionId: ExecutionIdSchema.make(`exec_tool_${crypto.randomUUID()}`),
436	});	436	});
437		437
@@ -449,14 +449,14 @@ describe("executor-runtime", () => { · 11 unmodified lines
449	() =>	449	() =>
450	Effect.gen(function* () {	450	Effect.gen(function* () {
451	const fs = yield* FileSystem.FileSystem;	451	const fs = yield* FileSystem.FileSystem;
452	const workspaceRoot = yield* fs.makeTempDirectoryScoped({	452	const scopeRoot = yield* fs.makeTempDirectoryScoped({
453	prefix: "executor-local-config-runtime-",	453	prefix: "executor-local-config-runtime-",
454	});	454	});
455	const homeConfigPath = join(workspaceRoot, ".executor-home.jsonc");	455	const homeConfigPath = join(scopeRoot, ".executor-home.jsonc");
456	const homeStateDirectory = join(workspaceRoot, ".executor-home-state");	456	const homeStateDirectory = join(scopeRoot, ".executor-home-state");
457	const runtime = yield* Effect.acquireRelease(	457	const runtime = yield* Effect.acquireRelease(
458	createExecutorRuntime({	458	createExecutorRuntime({
459	workspaceRoot,	459	workspaceRoot: scopeRoot,
460	homeConfigPath,	460	homeConfigPath,
461	homeStateDirectory,	461	homeStateDirectory,
462	}),	462	}),
@@ -467,10 +467,10 @@ describe("executor-runtime", () => { · 4 unmodified lines
467	const installation = runtime.localInstallation;	467	const installation = runtime.localInstallation;
468		468
469	const createdSource = yield* withExecutorApiClient(	469	const createdSource = yield* withExecutorApiClient(
470	{ runtime, accountId: installation.accountId },	470	{ runtime, actorScopeId: installation.actorScopeId },
471	(client) =>	471	(client) =>
472	client.sources.create({	472	client.sources.create({
473	path: { workspaceId: installation.workspaceId },	473	path: { workspaceId: installation.scopeId },
474	payload: {	474	payload: {
475	name: "GitHub",	475	name: "GitHub",
476	kind: "openapi",	476	kind: "openapi",
@@ -485,7 +485,7 @@ describe("executor-runtime", () => { · 8 unmodified lines
485	}),	485	}),
486	);	486	);
487		487
488	const configPath = join(workspaceRoot, ".executor", "executor.jsonc");	488	const configPath = join(scopeRoot, ".executor", "executor.jsonc");
489	const createdConfig = JSON.parse(	489	const createdConfig = JSON.parse(
490	yield* fs.readFileString(configPath, "utf8"),	490	yield* fs.readFileString(configPath, "utf8"),
491	) as {	491	) as {
@@ -500,11 +500,11 @@ describe("executor-runtime", () => { · 8 unmodified lines
500	);	500	);
501		501
502	const removed = yield* withExecutorApiClient(	502	const removed = yield* withExecutorApiClient(
503	{ runtime, accountId: installation.accountId },	503	{ runtime, actorScopeId: installation.actorScopeId },
504	(client) =>	504	(client) =>
505	client.sources.remove({	505	client.sources.remove({
506	path: {	506	path: {
507	workspaceId: installation.workspaceId,	507	workspaceId: installation.scopeId,
508	sourceId: createdSource.id,	508	sourceId: createdSource.id,
509	},	509	},
510	}),	510	}),
@@ -615,11 +615,11 @@ describe("executor-runtime", () => { · 104 unmodified lines
615	const openApiServer = yield* makeOpenApiSpecServer;	615	const openApiServer = yield* makeOpenApiSpecServer;
616	const installation = runtime.localInstallation;	616	const installation = runtime.localInstallation;
617	const createdSource = yield* withExecutorApiClient(	617	const createdSource = yield* withExecutorApiClient(
618	{ runtime, accountId: installation.accountId },	618	{ runtime, actorScopeId: installation.actorScopeId },
619	(client) =>	619	(client) =>
620	client.sources.create({	620	client.sources.create({
621	path: {	621	path: {
622	workspaceId: installation.workspaceId,	622	workspaceId: installation.scopeId,
623	},	623	},
624	payload: {	624	payload: {
625	name: "GitHub",	625	name: "GitHub",
@@ -640,15 +640,15 @@ describe("executor-runtime", () => { · 14 unmodified lines
640	);	640	);
641		641
642	const localInstallation = yield* invokeWorkspaceTool<{	642	const localInstallation = yield* invokeWorkspaceTool<{
643	workspaceId: string;	643	scopeId: string;
644	accountId: string;	644	actorScopeId: string;
645	}>({	645	}>({
646	runtime,	646	runtime,
647	path: "executor.local.installation.get" as ToolPath,	647	path: "executor.local.installation.get" as ToolPath,
648	args: {},	648	args: {},
649	});	649	});
650	expect(localInstallation.workspaceId).toBe(installation.workspaceId);	650	expect(localInstallation.scopeId).toBe(installation.scopeId);
651	expect(localInstallation.accountId).toBe(installation.accountId);	651	expect(localInstallation.actorScopeId).toBe(installation.actorScopeId);
652		652
653	const localConfig = yield* invokeWorkspaceTool<{	653	const localConfig = yield* invokeWorkspaceTool<{
654	defaultSecretStoreProvider: string;	654	defaultSecretStoreProvider: string;
@@ -723,11 +723,11 @@ describe("executor-runtime", () => { · 68 unmodified lines
723	expect(loadedPolicy.id).toBe(createdPolicy.id);	723	expect(loadedPolicy.id).toBe(createdPolicy.id);
724		724
725	const listedPolicies = yield* withExecutorApiClient(	725	const listedPolicies = yield* withExecutorApiClient(
726	{ runtime, accountId: installation.accountId },	726	{ runtime, actorScopeId: installation.actorScopeId },
727	(client) =>	727	(client) =>
728	client.policies.list({	728	client.policies.list({
729	path: {	729	path: {
730	workspaceId: installation.workspaceId,	730	workspaceId: installation.scopeId,
731	},	731	},
732	}),	732	}),
733	);	733	);
@@ -768,11 +768,11 @@ describe("executor-runtime", () => { · 34 unmodified lines
768	expect(removedSource.removed).toBe(true);	768	expect(removedSource.removed).toBe(true);
769		769
770	const apiSources = yield* withExecutorApiClient(	770	const apiSources = yield* withExecutorApiClient(
771	{ runtime, accountId: installation.accountId },	771	{ runtime, actorScopeId: installation.actorScopeId },
772	(client) =>	772	(client) =>
773	client.sources.list({	773	client.sources.list({
774	path: {	774	path: {
775	workspaceId: installation.workspaceId,	775	workspaceId: installation.scopeId,
776	},	776	},
777	}),	777	}),
778	);	778	);
@@ -798,8 +798,8 @@ describe("executor-runtime", () => { · 19 unmodified lines
798		798
799	yield* runtime.storage.executorState.executions.insert({	799	yield* runtime.storage.executorState.executions.insert({
800	id: executionId,	800	id: executionId,
801	workspaceId: installation.workspaceId,	801	scopeId: installation.scopeId,
802	createdByAccountId: installation.accountId,	802	createdByScopeId: installation.actorScopeId,
803	status: "running",	803	status: "running",
804	code: "return await tools.executor.sources.add(...)",	804	code: "return await tools.executor.sources.add(...)",
805	resultJson: null,	805	resultJson: null,
@@ -812,7 +812,7 @@ describe("executor-runtime", () => { · 6 unmodified lines
812	});	812	});
813		813
814	const localSource = yield* createSourceFromPayload({	814	const localSource = yield* createSourceFromPayload({
815	workspaceId: installation.workspaceId,	815	scopeId: installation.scopeId,
816	sourceId,	816	sourceId,
817	payload: {	817	payload: {
818	name: "GitHub",	818	name: "GitHub",
@@ -832,7 +832,7 @@ describe("executor-runtime", () => { · 13 unmodified lines
832	now,	832	now,
833	}).pipe(Effect.orDie);	833	}).pipe(Effect.orDie);
834	yield* persistSource(runtime.storage.executorState, localSource, {	834	yield* persistSource(runtime.storage.executorState, localSource, {
835	actorAccountId: installation.accountId,	835	actorScopeId: installation.actorScopeId,
836	}).pipe(	836	}).pipe(
837	(effect) => provideExecutorRuntime(effect, runtime),	837	(effect) => provideExecutorRuntime(effect, runtime),
838	Effect.orDie,	838	Effect.orDie,
@@ -854,13 +854,13 @@ describe("executor-runtime", () => { · 15 unmodified lines
854	endpoint: "https://api.github.com",	854	endpoint: "https://api.github.com",
855	specUrl: "https://example.com/github-openapi.yaml",	855	specUrl: "https://example.com/github-openapi.yaml",
856	name: "GitHub",	856	name: "GitHub",
857	workspaceId: installation.workspaceId,	857	scopeId: installation.scopeId,
858	sourceId,	858	sourceId,
859	},	859	},
860	elicitation: {	860	elicitation: {
861	mode: "url",	861	mode: "url",
862	message: "Open the secure credential page to connect GitHub",	862	message: "Open the secure credential page to connect GitHub",
863	url: `http://127.0.0.1/v1/workspaces/${encodeURIComponent(installation.workspaceId)}/sources/${encodeURIComponent(sourceId)}/credentials?interactionId=${encodeURIComponent(interactionId)}`,	863	url: `http://127.0.0.1/v1/workspaces/${encodeURIComponent(installation.scopeId)}/sources/${encodeURIComponent(sourceId)}/credentials?interactionId=${encodeURIComponent(interactionId)}`,
864	elicitationId: interactionSuffix,	864	elicitationId: interactionSuffix,
865	},	865	},
866	});	866	});
@@ -893,7 +893,7 @@ describe("executor-runtime", () => { · 26 unmodified lines
893	(handleRequest) =>	893	(handleRequest) =>
894	Effect.promise(async () => {	894	Effect.promise(async () => {
895	const url = new URL(	895	const url = new URL(
896	`/v1/workspaces/${encodeURIComponent(installation.workspaceId)}/sources/${encodeURIComponent(sourceId)}/credentials`,	896	`/v1/workspaces/${encodeURIComponent(installation.scopeId)}/sources/${encodeURIComponent(sourceId)}/credentials`,
897	"http://127.0.0.1",	897	"http://127.0.0.1",
898	);	898	);
899	url.searchParams.set("interactionId", pendingInteraction.value.id);	899	url.searchParams.set("interactionId", pendingInteraction.value.id);
@@ -910,7 +910,7 @@ describe("executor-runtime", () => { · 10 unmodified lines
910	(handleRequest) =>	910	(handleRequest) =>
911	Effect.promise(async () => {	911	Effect.promise(async () => {
912	const url = new URL(	912	const url = new URL(
913	`/v1/workspaces/${encodeURIComponent(installation.workspaceId)}/sources/${encodeURIComponent(sourceId)}/credentials`,	913	`/v1/workspaces/${encodeURIComponent(installation.scopeId)}/sources/${encodeURIComponent(sourceId)}/credentials`,
914	"http://127.0.0.1",	914	"http://127.0.0.1",
915	);	915	);
916	url.searchParams.set("interactionId", pendingInteraction.value.id);	916	url.searchParams.set("interactionId", pendingInteraction.value.id);
@@ -978,12 +978,12 @@ describe("executor-runtime", () => { · 61 unmodified lines
978	it.scoped("loads a v1.2.3-style workspace artifact on startup", () =>	978	it.scoped("loads a v1.2.3-style workspace artifact on startup", () =>
979	Effect.gen(function* () {	979	Effect.gen(function* () {
980	const fs = yield* FileSystem.FileSystem;	980	const fs = yield* FileSystem.FileSystem;
981	const workspaceRoot = yield* fs.makeTempDirectoryScoped({	981	const scopeRoot = yield* fs.makeTempDirectoryScoped({
982	prefix: "executor-runtime-v123-",	982	prefix: "executor-runtime-v123-",
983	});	983	});
984	const homeConfigPath = join(workspaceRoot, ".executor-home.jsonc");	984	const homeConfigPath = join(scopeRoot, ".executor-home.jsonc");
985	const homeStateDirectory = join(workspaceRoot, ".executor-home-state");	985	const homeStateDirectory = join(scopeRoot, ".executor-home-state");
986	const configDirectory = join(workspaceRoot, ".executor");	986	const configDirectory = join(scopeRoot, ".executor");
987	const configPath = join(configDirectory, "executor.jsonc");	987	const configPath = join(configDirectory, "executor.jsonc");
988	const sourceId = SourceIdSchema.make("graphql");	988	const sourceId = SourceIdSchema.make("graphql");
989	const now = Date.now();	989	const now = Date.now();
@@ -1010,13 +1010,13 @@ describe("executor-runtime", () => { · 20 unmodified lines
1010	);	1010	);
1011		1011
1012	const context = yield* resolveLocalWorkspaceContext({	1012	const context = yield* resolveLocalWorkspaceContext({
1013	workspaceRoot,	1013	workspaceRoot: scopeRoot,
1014	homeConfigPath,	1014	homeConfigPath,
1015	homeStateDirectory,	1015	homeStateDirectory,
1016	});	1016	});
1017	const installation = deriveLocalInstallation(context);	1017	const installation = deriveLocalInstallation(context);
1018	const source = yield* createSourceFromPayload({	1018	const source = yield* createSourceFromPayload({
1019	workspaceId: installation.workspaceId,	1019	scopeId: installation.scopeId,
1020	sourceId,	1020	sourceId,
1021	payload: {	1021	payload: {
1022	name: "GraphQL API",	1022	name: "GraphQL API",
@@ -1108,7 +1108,7 @@ describe("executor-runtime", () => { · 85 unmodified lines
1108	authArtifacts: [],	1108	authArtifacts: [],
1109	authLeases: [],	1109	authLeases: [],
1110	sourceOauthClients: [],	1110	sourceOauthClients: [],
1111	workspaceOauthClients: [],	1111	scopeOauthClients: [],
1112	providerAuthGrants: [],	1112	providerAuthGrants: [],
1113	sourceAuthSessions: [],	1113	sourceAuthSessions: [],
1114	secretMaterials: [],	1114	secretMaterials: [],
@@ -1145,7 +1145,7 @@ describe("executor-runtime", () => { · 30 unmodified lines
1145		1145
1146	const runtime = yield* Effect.acquireRelease(	1146	const runtime = yield* Effect.acquireRelease(
1147	createExecutorRuntime({	1147	createExecutorRuntime({
1148	workspaceRoot,	1148	workspaceRoot: scopeRoot,
1149	homeConfigPath,	1149	homeConfigPath,
1150	homeStateDirectory,	1150	homeStateDirectory,
1151	}),	1151	}),
@@ -1154,11 +1154,11 @@ describe("executor-runtime", () => { · 2 unmodified lines
1154	);	1154	);
1155		1155
1156	const inspection = yield* withExecutorApiClient(	1156	const inspection = yield* withExecutorApiClient(
1157	{ runtime, accountId: installation.accountId },	1157	{ runtime, actorScopeId: installation.actorScopeId },
1158	(client) =>	1158	(client) =>
1159	client.sources.inspection({	1159	client.sources.inspection({
1160	path: {	1160	path: {
1161	workspaceId: installation.workspaceId,	1161	workspaceId: installation.scopeId,
1162	sourceId,	1162	sourceId,
1163	},	1163	},
1164	}),	1164	}),
@@ -1179,13 +1179,13 @@ describe("executor-runtime", () => { · 14 unmodified lines
1179	Effect.gen(function* () {	1179	Effect.gen(function* () {
1180	const fs = yield* FileSystem.FileSystem;	1180	const fs = yield* FileSystem.FileSystem;
1181	const openApiServer = yield* makeOpenApiSpecServer;	1181	const openApiServer = yield* makeOpenApiSpecServer;
1182	const workspaceRoot = yield* fs.makeTempDirectoryScoped({	1182	const scopeRoot = yield* fs.makeTempDirectoryScoped({
1183	prefix: "executor-runtime-startup-rebuild-",	1183	prefix: "executor-runtime-startup-rebuild-",
1184	});	1184	});
1185	const homeConfigPath = join(workspaceRoot, ".executor-home.jsonc");	1185	const homeConfigPath = join(scopeRoot, ".executor-home.jsonc");
1186	const homeStateDirectory = join(workspaceRoot, ".executor-home-state");	1186	const homeStateDirectory = join(scopeRoot, ".executor-home-state");
1187	const context = yield* resolveLocalWorkspaceContext({	1187	const context = yield* resolveLocalWorkspaceContext({
1188	workspaceRoot,	1188	workspaceRoot: scopeRoot,
1189	homeConfigPath,	1189	homeConfigPath,
1190	homeStateDirectory,	1190	homeStateDirectory,
1191	});	1191	});
@@ -1193,7 +1193,7 @@ describe("executor-runtime", () => { · 1 unmodified line
1193	const sourceId = SourceIdSchema.make("github");	1193	const sourceId = SourceIdSchema.make("github");
1194	const now = Date.now();	1194	const now = Date.now();
1195	const source = yield* createSourceFromPayload({	1195	const source = yield* createSourceFromPayload({
1196	workspaceId: installation.workspaceId,	1196	scopeId: installation.scopeId,
1197	sourceId,	1197	sourceId,
1198	payload: {	1198	payload: {
1199	name: "GitHub",	1199	name: "GitHub",
@@ -1251,7 +1251,7 @@ describe("executor-runtime", () => { · 51 unmodified lines
1251		1251
1252	const runtime = yield* Effect.acquireRelease(	1252	const runtime = yield* Effect.acquireRelease(
1253	createExecutorRuntime({	1253	createExecutorRuntime({
1254	workspaceRoot,	1254	workspaceRoot: scopeRoot,
1255	homeConfigPath,	1255	homeConfigPath,
1256	homeStateDirectory,	1256	homeStateDirectory,
1257	}),	1257	}),
@@ -1266,11 +1266,11 @@ describe("executor-runtime", () => { · 8 unmodified lines
1266	expect(rebuiltArtifact).not.toBeNull();	1266	expect(rebuiltArtifact).not.toBeNull();
1267		1267
1268	const inspection = yield* withExecutorApiClient(	1268	const inspection = yield* withExecutorApiClient(
1269	{ runtime, accountId: installation.accountId },	1269	{ runtime, actorScopeId: installation.actorScopeId },
1270	(client) =>	1270	(client) =>
1271	client.sources.inspection({	1271	client.sources.inspection({
1272	path: {	1272	path: {
1273	workspaceId: installation.workspaceId,	1273	workspaceId: installation.scopeId,
1274	sourceId,	1274	sourceId,
1275	},	1275	},
1276	}),	1276	}),
@@ -1290,7 +1290,7 @@ describe("executor-runtime", () => { · 13 unmodified lines
1290	const now = Date.now();	1290	const now = Date.now();
1291		1291
1292	const localSource = yield* createSourceFromPayload({	1292	const localSource = yield* createSourceFromPayload({
1293	workspaceId: installation.workspaceId,	1293	scopeId: installation.scopeId,
1294	sourceId,	1294	sourceId,
1295	payload: {	1295	payload: {
1296	name: "Google Drive",	1296	name: "Google Drive",
@@ -1314,18 +1314,18 @@ describe("executor-runtime", () => { · 17 unmodified lines
1314	now,	1314	now,
1315	}).pipe(Effect.orDie);	1315	}).pipe(Effect.orDie);
1316	yield* persistSource(runtime.storage.executorState, localSource, {	1316	yield* persistSource(runtime.storage.executorState, localSource, {
1317	actorAccountId: installation.accountId,	1317	actorScopeId: installation.actorScopeId,
1318	}).pipe(	1318	}).pipe(
1319	(effect) => provideExecutorRuntime(effect, runtime),	1319	(effect) => provideExecutorRuntime(effect, runtime),
1320	Effect.orDie,	1320	Effect.orDie,
1321	);	1321	);
1322		1322
1323	const inspection = yield* withExecutorApiClient(	1323	const inspection = yield* withExecutorApiClient(
1324	{ runtime, accountId: installation.accountId },	1324	{ runtime, actorScopeId: installation.actorScopeId },
1325	(client) =>	1325	(client) =>
1326	client.sources.inspection({	1326	client.sources.inspection({
1327	path: {	1327	path: {
1328	workspaceId: installation.workspaceId,	1328	workspaceId: installation.scopeId,
1329	sourceId,	1329	sourceId,
1330	},	1330	},
1331	}),	1331	}),
@@ -1348,7 +1348,7 @@ describe("executor-runtime", () => { · 16 unmodified lines
1348	const now = Date.now();	1348	const now = Date.now();
1349		1349
1350	const localSource = yield* createSourceFromPayload({	1350	const localSource = yield* createSourceFromPayload({
1351	workspaceId: installation.workspaceId,	1351	scopeId: installation.scopeId,
1352	sourceId,	1352	sourceId,
1353	payload: {	1353	payload: {
1354	name: "Google Drive",	1354	name: "Google Drive",
@@ -1372,7 +1372,7 @@ describe("executor-runtime", () => { · 17 unmodified lines
1372	now,	1372	now,
1373	}).pipe(Effect.orDie);	1373	}).pipe(Effect.orDie);
1374	yield* persistSource(runtime.storage.executorState, localSource, {	1374	yield* persistSource(runtime.storage.executorState, localSource, {
1375	actorAccountId: installation.accountId,	1375	actorScopeId: installation.actorScopeId,
1376	}).pipe(	1376	}).pipe(
1377	(effect) => provideExecutorRuntime(effect, runtime),	1377	(effect) => provideExecutorRuntime(effect, runtime),
1378	Effect.orDie,	1378	Effect.orDie,
@@ -1380,11 +1380,11 @@ describe("executor-runtime", () => { · 1 unmodified line
1380		1380
1381	const error = yield* expectLeft(	1381	const error = yield* expectLeft(
1382	withExecutorApiClient(	1382	withExecutorApiClient(
1383	{ runtime, accountId: installation.accountId },	1383	{ runtime, actorScopeId: installation.actorScopeId },
1384	(client) =>	1384	(client) =>
1385	client.sources.inspection({	1385	client.sources.inspection({
1386	path: {	1386	path: {
1387	workspaceId: installation.workspaceId,	1387	workspaceId: installation.scopeId,
1388	sourceId,	1388	sourceId,
1389	},	1389	},
1390	}),	1390	}),
@@ -1415,8 +1415,8 @@ describe("executor-runtime", () => { · 24 unmodified lines
1415		1415
1416	yield* runtime.storage.executorState.executions.insert({	1416	yield* runtime.storage.executorState.executions.insert({
1417	id: executionId,	1417	id: executionId,
1418	workspaceId: installation.workspaceId,	1418	scopeId: installation.scopeId,
1419	createdByAccountId: installation.accountId,	1419	createdByScopeId: installation.actorScopeId,
1420	status: "running",	1420	status: "running",
1421	code: "return await tools.executor.sources.add(...)",	1421	code: "return await tools.executor.sources.add(...)",
1422	resultJson: null,	1422	resultJson: null,
@@ -1429,7 +1429,7 @@ describe("executor-runtime", () => { · 6 unmodified lines
1429	});	1429	});
1430		1430
1431	const localSource = yield* createSourceFromPayload({	1431	const localSource = yield* createSourceFromPayload({
1432	workspaceId: installation.workspaceId,	1432	scopeId: installation.scopeId,
1433	sourceId,	1433	sourceId,
1434	payload: {	1434	payload: {
1435	name: "GitHub",	1435	name: "GitHub",
@@ -1449,7 +1449,7 @@ describe("executor-runtime", () => { · 13 unmodified lines
1449	now,	1449	now,
1450	}).pipe(Effect.orDie);	1450	}).pipe(Effect.orDie);
1451	yield* persistSource(runtime.storage.executorState, localSource, {	1451	yield* persistSource(runtime.storage.executorState, localSource, {
1452	actorAccountId: installation.accountId,	1452	actorScopeId: installation.actorScopeId,
1453	}).pipe(	1453	}).pipe(
1454	(effect) => provideExecutorRuntime(effect, runtime),	1454	(effect) => provideExecutorRuntime(effect, runtime),
1455	Effect.orDie,	1455	Effect.orDie,
@@ -1471,13 +1471,13 @@ describe("executor-runtime", () => { · 15 unmodified lines
1471	endpoint: "https://api.github.com",	1471	endpoint: "https://api.github.com",
1472	specUrl: "https://example.com/github-openapi.yaml",	1472	specUrl: "https://example.com/github-openapi.yaml",
1473	name: "GitHub",	1473	name: "GitHub",
1474	workspaceId: installation.workspaceId,	1474	scopeId: installation.scopeId,
1475	sourceId,	1475	sourceId,
1476	},	1476	},
1477	elicitation: {	1477	elicitation: {
1478	mode: "url",	1478	mode: "url",
1479	message: "Open the secure credential page to connect GitHub",	1479	message: "Open the secure credential page to connect GitHub",
1480	url: `http://127.0.0.1/v1/workspaces/${encodeURIComponent(installation.workspaceId)}/sources/${encodeURIComponent(sourceId)}/credentials?interactionId=${encodeURIComponent(interactionId)}`,	1480	url: `http://127.0.0.1/v1/workspaces/${encodeURIComponent(installation.scopeId)}/sources/${encodeURIComponent(sourceId)}/credentials?interactionId=${encodeURIComponent(interactionId)}`,
1481	elicitationId: interactionSuffix,	1481	elicitationId: interactionSuffix,
1482	},	1482	},
1483	});	1483	});
@@ -1505,7 +1505,7 @@ describe("executor-runtime", () => { · 21 unmodified lines
1505	assertTrue(Option.isSome(pendingInteraction));	1505	assertTrue(Option.isSome(pendingInteraction));
1506		1506
1507	const submitted = yield* submitSourceCredentialInteraction({	1507	const submitted = yield* submitSourceCredentialInteraction({
1508	workspaceId: installation.workspaceId,	1508	scopeId: installation.scopeId,
1509	sourceId,	1509	sourceId,
1510	interactionId: pendingInteraction.value.id,	1510	interactionId: pendingInteraction.value.id,
1511	action: "continue",	1511	action: "continue",
@@ -1538,7 +1538,7 @@ describe("executor-runtime", () => { · 26 unmodified lines
1538	const executionId = ExecutionIdSchema.make(	1538	const executionId = ExecutionIdSchema.make(
1539	"exec_local_graphql_credential_continue",	1539	"exec_local_graphql_credential_continue",
1540	);	1540	);
1541	const workspaceId = "ws_local_graphql" as const;	1541	const scopeId = "ws_local_graphql" as const;
1542	const sourceId = SourceIdSchema.make("graphql_api");	1542	const sourceId = SourceIdSchema.make("graphql_api");
1543	const now = Date.now();	1543	const now = Date.now();
1544	const decoded = decodeSourceCredentialInteraction({	1544	const decoded = decodeSourceCredentialInteraction({
@@ -1555,7 +1555,7 @@ describe("executor-runtime", () => { · 10 unmodified lines
1555	endpoint: "https://example.com/graphql",	1555	endpoint: "https://example.com/graphql",
1556	name: "GraphQL API",	1556	name: "GraphQL API",
1557	namespace: "graphql",	1557	namespace: "graphql",
1558	workspaceId,	1558	scopeId,
1559	sourceId,	1559	sourceId,
1560	},	1560	},
1561	elicitation: {	1561	elicitation: {
@@ -1570,7 +1570,7 @@ describe("executor-runtime", () => { · 8 unmodified lines
1570	});	1570	});
1571		1571
1572	expect(decoded).not.toBeNull();	1572	expect(decoded).not.toBeNull();
1573	expect(decoded?.workspaceId).toBe(workspaceId);	1573	expect(decoded?.scopeId).toBe(scopeId);
1574	expect(decoded?.sourceId).toBe(sourceId);	1574	expect(decoded?.sourceId).toBe(sourceId);
1575	expect(decoded?.message).toContain("GraphQL API");	1575	expect(decoded?.message).toContain("GraphQL API");
1576	}),	1576	}),
@@ -1589,7 +1589,7 @@ describe("executor-runtime", () => { · 12 unmodified lines
1589	(client) =>	1589	(client) =>
1590	client.sources.createWorkspaceOauthClient({	1590	client.sources.createWorkspaceOauthClient({
1591	path: {	1591	path: {
1592	workspaceId: installation.workspaceId,	1592	workspaceId: installation.scopeId,
1593	},	1593	},
1594	payload: {	1594	payload: {
1595	providerKey: "google_workspace",	1595	providerKey: "google_workspace",
@@ -1615,8 +1615,8 @@ describe("executor-runtime", () => { · 19 unmodified lines
1615	);	1615	);
1616	yield* runtime.storage.executorState.providerAuthGrants.upsert({	1616	yield* runtime.storage.executorState.providerAuthGrants.upsert({
1617	id: grantId,	1617	id: grantId,
1618	workspaceId: installation.workspaceId,	1618	scopeId: installation.scopeId,
1619	actorAccountId: installation.accountId,	1619	actorScopeId: installation.actorScopeId,
1620	providerKey: "google_workspace",	1620	providerKey: "google_workspace",
1621	oauthClientId: oauthClient.id,	1621	oauthClientId: oauthClient.id,
1622	tokenEndpoint: googleServer.tokenEndpoint,	1622	tokenEndpoint: googleServer.tokenEndpoint,
@@ -1642,11 +1642,11 @@ describe("executor-runtime", () => { · 19 unmodified lines
1642	const result = yield* withExecutorApiClient({ runtime }, (client) =>	1642	const result = yield* withExecutorApiClient({ runtime }, (client) =>
1643	client.sources.connect({	1643	client.sources.connect({
1644	path: {	1644	path: {
1645	workspaceId: installation.workspaceId,	1645	workspaceId: installation.scopeId,
1646	},	1646	},
1647	payload: {	1647	payload: {
1648	kind: "google_discovery",	1648	kind: "google_discovery",
1649	workspaceOauthClientId: oauthClient.id,	1649	scopeOauthClientId: oauthClient.id,
1650	service: "drive",	1650	service: "drive",
1651	version: "v3",	1651	version: "v3",
1652	discoveryUrl: googleServer.discoveryUrl({	1652	discoveryUrl: googleServer.discoveryUrl({
@@ -1698,7 +1698,7 @@ describe("executor-runtime", () => { · 45 unmodified lines
1698	(client) =>	1698	(client) =>
1699	client.sources.createWorkspaceOauthClient({	1699	client.sources.createWorkspaceOauthClient({
1700	path: {	1700	path: {
1701	workspaceId: installation.workspaceId,	1701	workspaceId: installation.scopeId,
1702	},	1702	},
1703	payload: {	1703	payload: {
1704	providerKey: "google_workspace",	1704	providerKey: "google_workspace",
@@ -1714,11 +1714,11 @@ describe("executor-runtime", () => { · 9 unmodified lines
1714	const result = yield* withExecutorApiClient({ runtime }, (client) =>	1714	const result = yield* withExecutorApiClient({ runtime }, (client) =>
1715	client.sources.connect({	1715	client.sources.connect({
1716	path: {	1716	path: {
1717	workspaceId: installation.workspaceId,	1717	workspaceId: installation.scopeId,
1718	},	1718	},
1719	payload: {	1719	payload: {
1720	kind: "google_discovery",	1720	kind: "google_discovery",
1721	workspaceOauthClientId: oauthClient.id,	1721	scopeOauthClientId: oauthClient.id,
1722	service: "gmail",	1722	service: "gmail",
1723	version: "v1",	1723	version: "v1",
1724	discoveryUrl: googleServer.discoveryUrl({	1724	discoveryUrl: googleServer.discoveryUrl({
@@ -1745,7 +1745,7 @@ describe("executor-runtime", () => { · 20 unmodified lines
1745	);	1745	);
1746	expect(redirectUri).not.toBeNull();	1746	expect(redirectUri).not.toBeNull();
1747	expect(new URL(redirectUri!).pathname).toBe(	1747	expect(new URL(redirectUri!).pathname).toBe(
1748	`/v1/workspaces/${encodeURIComponent(installation.workspaceId)}/oauth/provider/callback`,	1748	`/v1/workspaces/${encodeURIComponent(installation.scopeId)}/oauth/provider/callback`,
1749	);	1749	);
1750	expect(result.source.status).toBe("auth_required");	1750	expect(result.source.status).toBe("auth_required");
1751	}),	1751	}),
@@ -1765,7 +1765,7 @@ describe("executor-runtime", () => { · 13 unmodified lines
1765	(client) =>	1765	(client) =>
1766	client.sources.createWorkspaceOauthClient({	1766	client.sources.createWorkspaceOauthClient({
1767	path: {	1767	path: {
1768	workspaceId: installation.workspaceId,	1768	workspaceId: installation.scopeId,
1769	},	1769	},
1770	payload: {	1770	payload: {
1771	providerKey: "google_workspace",	1771	providerKey: "google_workspace",
@@ -1791,8 +1791,8 @@ describe("executor-runtime", () => { · 19 unmodified lines
1791	);	1791	);
1792	yield* runtime.storage.executorState.providerAuthGrants.upsert({	1792	yield* runtime.storage.executorState.providerAuthGrants.upsert({
1793	id: grantId,	1793	id: grantId,
1794	workspaceId: installation.workspaceId,	1794	scopeId: installation.scopeId,
1795	actorAccountId: installation.accountId,	1795	actorScopeId: installation.actorScopeId,
1796	providerKey: "google_workspace",	1796	providerKey: "google_workspace",
1797	oauthClientId: oauthClient.id,	1797	oauthClientId: oauthClient.id,
1798	tokenEndpoint: googleServer.tokenEndpoint,	1798	tokenEndpoint: googleServer.tokenEndpoint,
@@ -1822,10 +1822,10 @@ describe("executor-runtime", () => { · 23 unmodified lines
1822	const result = yield* withExecutorApiClient({ runtime }, (client) =>	1822	const result = yield* withExecutorApiClient({ runtime }, (client) =>
1823	client.sources.connectBatch({	1823	client.sources.connectBatch({
1824	path: {	1824	path: {
1825	workspaceId: installation.workspaceId,	1825	workspaceId: installation.scopeId,
1826	},	1826	},
1827	payload: {	1827	payload: {
1828	workspaceOauthClientId: oauthClient.id,	1828	scopeOauthClientId: oauthClient.id,
1829	sources: [	1829	sources: [
1830	{	1830	{
1831	service: "gmail",	1831	service: "gmail",
@@ -1894,7 +1894,7 @@ describe("executor-runtime", () => { · 62 unmodified lines
1894	(client) =>	1894	(client) =>
1895	client.sources.createWorkspaceOauthClient({	1895	client.sources.createWorkspaceOauthClient({
1896	path: {	1896	path: {
1897	workspaceId: installation.workspaceId,	1897	workspaceId: installation.scopeId,
1898	},	1898	},
1899	payload: {	1899	payload: {
1900	providerKey: "google_workspace",	1900	providerKey: "google_workspace",
@@ -1910,10 +1910,10 @@ describe("executor-runtime", () => { · 9 unmodified lines
1910	const result = yield* withExecutorApiClient({ runtime }, (client) =>	1910	const result = yield* withExecutorApiClient({ runtime }, (client) =>
1911	client.sources.connectBatch({	1911	client.sources.connectBatch({
1912	path: {	1912	path: {
1913	workspaceId: installation.workspaceId,	1913	workspaceId: installation.scopeId,
1914	},	1914	},
1915	payload: {	1915	payload: {
1916	workspaceOauthClientId: oauthClient.id,	1916	scopeOauthClientId: oauthClient.id,
1917	sources: [	1917	sources: [
1918	{	1918	{
1919	service: "gmail",	1919	service: "gmail",
@@ -1939,7 +1939,7 @@ describe("executor-runtime", () => { · 19 unmodified lines
1939		1939
1940	expect(redirectUri).not.toBeNull();	1940	expect(redirectUri).not.toBeNull();
1941	expect(new URL(redirectUri!).pathname).toBe(	1941	expect(new URL(redirectUri!).pathname).toBe(
1942	`/v1/workspaces/${encodeURIComponent(installation.workspaceId)}/oauth/provider/callback`,	1942	`/v1/workspaces/${encodeURIComponent(installation.scopeId)}/oauth/provider/callback`,
1943	);	1943	);
1944	}),	1944	}),
1945	60_000,	1945	60_000,
@@ -1958,7 +1958,7 @@ describe("executor-runtime", () => { · 12 unmodified lines
1958	(client) =>	1958	(client) =>
1959	client.sources.createWorkspaceOauthClient({	1959	client.sources.createWorkspaceOauthClient({
1960	path: {	1960	path: {
1961	workspaceId: installation.workspaceId,	1961	workspaceId: installation.scopeId,
1962	},	1962	},
1963	payload: {	1963	payload: {
1964	providerKey: "google_workspace",	1964	providerKey: "google_workspace",
@@ -2001,8 +2001,8 @@ describe("executor-runtime", () => { · 36 unmodified lines
2001	);	2001	);
2002	yield* runtime.storage.executorState.providerAuthGrants.upsert({	2002	yield* runtime.storage.executorState.providerAuthGrants.upsert({
2003	id: grantId,	2003	id: grantId,
2004	workspaceId: installation.workspaceId,	2004	scopeId: installation.scopeId,
2005	actorAccountId: installation.accountId,	2005	actorScopeId: installation.actorScopeId,
2006	providerKey: "google_workspace",	2006	providerKey: "google_workspace",
2007	oauthClientId: oauthClient.id,	2007	oauthClientId: oauthClient.id,
2008	tokenEndpoint: googleServer.tokenEndpoint,	2008	tokenEndpoint: googleServer.tokenEndpoint,
@@ -2026,11 +2026,11 @@ describe("executor-runtime", () => { · 17 unmodified lines
2026	const state = `provider-state-${crypto.randomUUID()}`;	2026	const state = `provider-state-${crypto.randomUUID()}`;
2027	yield* runtime.storage.executorState.sourceAuthSessions.upsert({	2027	yield* runtime.storage.executorState.sourceAuthSessions.upsert({
2028	id: sessionId,	2028	id: sessionId,
2029	workspaceId: installation.workspaceId,	2029	scopeId: installation.scopeId,
2030	sourceId: SourceIdSchema.make(	2030	sourceId: SourceIdSchema.make(
2031	`oauth_provider_${crypto.randomUUID()}`,	2031	`oauth_provider_${crypto.randomUUID()}`,
2032	),	2032	),
2033	actorAccountId: installation.accountId,	2033	actorScopeId: installation.actorScopeId,
2034	credentialSlot: "runtime",	2034	credentialSlot: "runtime",
2035	executionId: null,	2035	executionId: null,
2036	interactionId: null,	2036	interactionId: null,
@@ -2083,7 +2083,7 @@ describe("executor-runtime", () => { · 46 unmodified lines
2083	(client) =>	2083	(client) =>
2084	client.sources.providerOauthComplete({	2084	client.sources.providerOauthComplete({
2085	path: {	2085	path: {
2086	workspaceId: installation.workspaceId,	2086	workspaceId: installation.scopeId,
2087	},	2087	},
2088	urlParams: {	2088	urlParams: {
2089	state,	2089	state,
@@ -2111,7 +2111,7 @@ describe("executor-runtime", () => { · 21 unmodified lines
2111	(client) =>	2111	(client) =>
2112	client.sources.get({	2112	client.sources.get({
2113	path: {	2113	path: {
2114	workspaceId: installation.workspaceId,	2114	workspaceId: installation.scopeId,
2115	sourceId: source.id,	2115	sourceId: source.id,
2116	},	2116	},
2117	}),	2117	}),
@@ -2148,14 +2148,14 @@ describe("executor-runtime", () => { · 30 unmodified lines
2148	Effect.gen(function* () {	2148	Effect.gen(function* () {
2149	const runtime = yield* makeRuntime;	2149	const runtime = yield* makeRuntime;
2150	const installation = runtime.localInstallation;	2150	const installation = runtime.localInstallation;
2151	const oauthClientId = WorkspaceOauthClientIdSchema.make(	2151	const oauthClientId = ScopeOauthClientIdSchema.make(
2152	`ws_oauth_client_${crypto.randomUUID()}`,	2152	`ws_oauth_client_${crypto.randomUUID()}`,
2153	);	2153	);
2154	const refreshSecretId = "sec_google_refresh_orphan";	2154	const refreshSecretId = "sec_google_refresh_orphan";
2155		2155
2156	yield* runtime.storage.executorState.workspaceOauthClients.upsert({	2156	yield* runtime.storage.executorState.scopeOauthClients.upsert({
2157	id: oauthClientId,	2157	id: oauthClientId,
2158	workspaceId: installation.workspaceId,	2158	scopeId: installation.scopeId,
2159	providerKey: "google_workspace",	2159	providerKey: "google_workspace",
2160	label: "Local Google Workspace Client",	2160	label: "Local Google Workspace Client",
2161	clientId: "google-client-id",	2161	clientId: "google-client-id",
@@ -2177,8 +2177,8 @@ describe("executor-runtime", () => { · 15 unmodified lines
2177	);	2177	);
2178	yield* runtime.storage.executorState.providerAuthGrants.upsert({	2178	yield* runtime.storage.executorState.providerAuthGrants.upsert({
2179	id: grantId,	2179	id: grantId,
2180	workspaceId: installation.workspaceId,	2180	scopeId: installation.scopeId,
2181	actorAccountId: installation.accountId,	2181	actorScopeId: installation.actorScopeId,
2182	providerKey: "google_workspace",	2182	providerKey: "google_workspace",
2183	oauthClientId,	2183	oauthClientId,
2184	tokenEndpoint: "https://example.test/oauth/token",	2184	tokenEndpoint: "https://example.test/oauth/token",
@@ -2217,7 +2217,7 @@ describe("executor-runtime", () => { · 32 unmodified lines
2217	const removed = yield* withExecutorApiClient({ runtime }, (client) =>	2217	const removed = yield* withExecutorApiClient({ runtime }, (client) =>
2218	client.sources.remove({	2218	client.sources.remove({
2219	path: {	2219	path: {
2220	workspaceId: installation.workspaceId,	2220	workspaceId: installation.scopeId,
2221	sourceId: source.id,	2221	sourceId: source.id,
2222	},	2222	},
2223	}),	2223	}),
@@ -2238,14 +2238,14 @@ describe("executor-runtime", () => { · 14 unmodified lines
2238	Effect.gen(function* () {	2238	Effect.gen(function* () {
2239	const runtime = yield* makeRuntime;	2239	const runtime = yield* makeRuntime;
2240	const installation = runtime.localInstallation;	2240	const installation = runtime.localInstallation;
2241	const oauthClientId = WorkspaceOauthClientIdSchema.make(	2241	const oauthClientId = ScopeOauthClientIdSchema.make(
2242	`ws_oauth_client_${crypto.randomUUID()}`,	2242	`ws_oauth_client_${crypto.randomUUID()}`,
2243	);	2243	);
2244	const refreshSecretId = "sec_google_refresh_revoke";	2244	const refreshSecretId = "sec_google_refresh_revoke";
2245		2245
2246	yield* runtime.storage.executorState.workspaceOauthClients.upsert({	2246	yield* runtime.storage.executorState.scopeOauthClients.upsert({
2247	id: oauthClientId,	2247	id: oauthClientId,
2248	workspaceId: installation.workspaceId,	2248	scopeId: installation.scopeId,
2249	providerKey: "google_workspace",	2249	providerKey: "google_workspace",
2250	label: "Local Google Workspace Client",	2250	label: "Local Google Workspace Client",
2251	clientId: "google-client-id",	2251	clientId: "google-client-id",
@@ -2267,8 +2267,8 @@ describe("executor-runtime", () => { · 15 unmodified lines
2267	);	2267	);
2268	yield* runtime.storage.executorState.providerAuthGrants.upsert({	2268	yield* runtime.storage.executorState.providerAuthGrants.upsert({
2269	id: grantId,	2269	id: grantId,
2270	workspaceId: installation.workspaceId,	2270	scopeId: installation.scopeId,
2271	actorAccountId: installation.accountId,	2271	actorScopeId: installation.actorScopeId,
2272	providerKey: "google_workspace",	2272	providerKey: "google_workspace",
2273	oauthClientId,	2273	oauthClientId,
2274	tokenEndpoint: "https://example.test/oauth/token",	2274	tokenEndpoint: "https://example.test/oauth/token",
@@ -2324,7 +2324,7 @@ describe("executor-runtime", () => { · 49 unmodified lines
2324	const removed = yield* withExecutorApiClient({ runtime }, (client) =>	2324	const removed = yield* withExecutorApiClient({ runtime }, (client) =>
2325	client.sources.removeProviderAuthGrant({	2325	client.sources.removeProviderAuthGrant({
2326	path: {	2326	path: {
2327	workspaceId: installation.workspaceId,	2327	workspaceId: installation.scopeId,
2328	grantId,	2328	grantId,
2329	},	2329	},
2330	}),	2330	}),
@@ -2347,7 +2347,7 @@ describe("executor-runtime", () => { · 16 unmodified lines
2347	(client) =>	2347	(client) =>
2348	client.sources.get({	2348	client.sources.get({
2349	path: {	2349	path: {
2350	workspaceId: installation.workspaceId,	2350	workspaceId: installation.scopeId,
2351	sourceId: driveSource.id,	2351	sourceId: driveSource.id,
2352	},	2352	},
2353	}),	2353	}),
@@ -2357,7 +2357,7 @@ describe("executor-runtime", () => { · 3 unmodified lines
2357	(client) =>	2357	(client) =>
2358	client.sources.get({	2358	client.sources.get({
2359	path: {	2359	path: {
2360	workspaceId: installation.workspaceId,	2360	workspaceId: installation.scopeId,
2361	sourceId: gmailSource.id,	2361	sourceId: gmailSource.id,
2362	},	2362	},
2363	}),	2363	}),

packages/platform/sdk/src/runtime/executor-state-store.ts+46−46

@@ -10,8 +10,8 @@ import type { · 9 unmodified lines
10	ProviderAuthGrant,	10	ProviderAuthGrant,
11	SecretMaterial,	11	SecretMaterial,
12	SourceAuthSession,	12	SourceAuthSession,
13	WorkspaceOauthClient,	13	ScopeOauthClient,
14	WorkspaceSourceOauthClient,	14	ScopedSourceOauthClient,
15	} from "#schema";	15	} from "#schema";
16		16
17	type SecretMaterialSummary = {	17	type SecretMaterialSummary = {
@@ -25,28 +25,28 @@ type SecretMaterialSummary = { · 7 unmodified lines
25		25
26	export type ExecutorStateStoreShape = {	26	export type ExecutorStateStoreShape = {
27	authArtifacts: {	27	authArtifacts: {
28	listByWorkspaceId: (	28	listByScopeId: (
29	workspaceId: AuthArtifact["workspaceId"],	29	scopeId: AuthArtifact["scopeId"],
30	) => Effect.Effect<readonly AuthArtifact[], Error, never>;	30	) => Effect.Effect<readonly AuthArtifact[], Error, never>;
31	listByWorkspaceAndSourceId: (input: {	31	listByScopeAndSourceId: (input: {
32	workspaceId: AuthArtifact["workspaceId"];	32	scopeId: AuthArtifact["scopeId"];
33	sourceId: AuthArtifact["sourceId"];	33	sourceId: AuthArtifact["sourceId"];
34	}) => Effect.Effect<readonly AuthArtifact[], Error, never>;	34	}) => Effect.Effect<readonly AuthArtifact[], Error, never>;
35	getByWorkspaceSourceAndActor: (input: {	35	getByScopeSourceAndActor: (input: {
36	workspaceId: AuthArtifact["workspaceId"];	36	scopeId: AuthArtifact["scopeId"];
37	sourceId: AuthArtifact["sourceId"];	37	sourceId: AuthArtifact["sourceId"];
38	actorAccountId: AuthArtifact["actorAccountId"];	38	actorScopeId: AuthArtifact["actorScopeId"];
39	slot: AuthArtifact["slot"];	39	slot: AuthArtifact["slot"];
40	}) => Effect.Effect<import("effect/Option").Option<AuthArtifact>, Error, never>;	40	}) => Effect.Effect<import("effect/Option").Option<AuthArtifact>, Error, never>;
41	upsert: (artifact: AuthArtifact) => Effect.Effect<void, Error, never>;	41	upsert: (artifact: AuthArtifact) => Effect.Effect<void, Error, never>;
42	removeByWorkspaceSourceAndActor: (input: {	42	removeByScopeSourceAndActor: (input: {
43	workspaceId: AuthArtifact["workspaceId"];	43	scopeId: AuthArtifact["scopeId"];
44	sourceId: AuthArtifact["sourceId"];	44	sourceId: AuthArtifact["sourceId"];
45	actorAccountId: AuthArtifact["actorAccountId"];	45	actorScopeId: AuthArtifact["actorScopeId"];
46	slot?: AuthArtifact["slot"];	46	slot?: AuthArtifact["slot"];
47	}) => Effect.Effect<boolean, Error, never>;	47	}) => Effect.Effect<boolean, Error, never>;
48	removeByWorkspaceAndSourceId: (input: {	48	removeByScopeAndSourceId: (input: {
49	workspaceId: AuthArtifact["workspaceId"];	49	scopeId: AuthArtifact["scopeId"];
50	sourceId: AuthArtifact["sourceId"];	50	sourceId: AuthArtifact["sourceId"];
51	}) => Effect.Effect<number, Error, never>;	51	}) => Effect.Effect<number, Error, never>;
52	};	52	};
@@ -61,41 +61,41 @@ export type ExecutorStateStoreShape = { · 8 unmodified lines
61	) => Effect.Effect<boolean, Error, never>;	61	) => Effect.Effect<boolean, Error, never>;
62	};	62	};
63	sourceOauthClients: {	63	sourceOauthClients: {
64	getByWorkspaceSourceAndProvider: (input: {	64	getByScopeSourceAndProvider: (input: {
65	workspaceId: WorkspaceSourceOauthClient["workspaceId"];	65	scopeId: ScopedSourceOauthClient["scopeId"];
66	sourceId: WorkspaceSourceOauthClient["sourceId"];	66	sourceId: ScopedSourceOauthClient["sourceId"];
67	providerKey: string;	67	providerKey: string;
68	}) => Effect.Effect<	68	}) => Effect.Effect<
69	import("effect/Option").Option<WorkspaceSourceOauthClient>,	69	import("effect/Option").Option<ScopedSourceOauthClient>,
70	Error,	70	Error,
71	never	71	never
72	>;	72	>;
73	upsert: (	73	upsert: (
74	oauthClient: WorkspaceSourceOauthClient,	74	oauthClient: ScopedSourceOauthClient,
75	) => Effect.Effect<void, Error, never>;	75	) => Effect.Effect<void, Error, never>;
76	removeByWorkspaceAndSourceId: (input: {	76	removeByScopeAndSourceId: (input: {
77	workspaceId: WorkspaceSourceOauthClient["workspaceId"];	77	scopeId: ScopedSourceOauthClient["scopeId"];
78	sourceId: WorkspaceSourceOauthClient["sourceId"];	78	sourceId: ScopedSourceOauthClient["sourceId"];
79	}) => Effect.Effect<number, Error, never>;	79	}) => Effect.Effect<number, Error, never>;
80	};	80	};
81	workspaceOauthClients: {	81	scopeOauthClients: {
82	listByWorkspaceAndProvider: (input: {	82	listByScopeAndProvider: (input: {
83	workspaceId: WorkspaceOauthClient["workspaceId"];	83	scopeId: ScopeOauthClient["scopeId"];
84	providerKey: string;	84	providerKey: string;
85	}) => Effect.Effect<readonly WorkspaceOauthClient[], Error, never>;	85	}) => Effect.Effect<readonly ScopeOauthClient[], Error, never>;
86	getById: (	86	getById: (
87	id: WorkspaceOauthClient["id"],	87	id: ScopeOauthClient["id"],
88	) => Effect.Effect<import("effect/Option").Option<WorkspaceOauthClient>, Error, never>;	88	) => Effect.Effect<import("effect/Option").Option<ScopeOauthClient>, Error, never>;
89	upsert: (oauthClient: WorkspaceOauthClient) => Effect.Effect<void, Error, never>;	89	upsert: (oauthClient: ScopeOauthClient) => Effect.Effect<void, Error, never>;
90	removeById: (id: WorkspaceOauthClient["id"]) => Effect.Effect<boolean, Error, never>;	90	removeById: (id: ScopeOauthClient["id"]) => Effect.Effect<boolean, Error, never>;
91	};	91	};
92	providerAuthGrants: {	92	providerAuthGrants: {
93	listByWorkspaceId: (	93	listByScopeId: (
94	workspaceId: ProviderAuthGrant["workspaceId"],	94	scopeId: ProviderAuthGrant["scopeId"],
95	) => Effect.Effect<readonly ProviderAuthGrant[], Error, never>;	95	) => Effect.Effect<readonly ProviderAuthGrant[], Error, never>;
96	listByWorkspaceActorAndProvider: (input: {	96	listByScopeActorAndProvider: (input: {
97	workspaceId: ProviderAuthGrant["workspaceId"];	97	scopeId: ProviderAuthGrant["scopeId"];
98	actorAccountId: ProviderAuthGrant["actorAccountId"];	98	actorScopeId: ProviderAuthGrant["actorScopeId"];
99	providerKey: string;	99	providerKey: string;
100	}) => Effect.Effect<readonly ProviderAuthGrant[], Error, never>;	100	}) => Effect.Effect<readonly ProviderAuthGrant[], Error, never>;
101	getById: (	101	getById: (
@@ -106,8 +106,8 @@ export type ExecutorStateStoreShape = { · 4 unmodified lines
106	};	106	};
107	sourceAuthSessions: {	107	sourceAuthSessions: {
108	listAll: () => Effect.Effect<readonly SourceAuthSession[], Error, never>;	108	listAll: () => Effect.Effect<readonly SourceAuthSession[], Error, never>;
109	listByWorkspaceId: (	109	listByScopeId: (
110	workspaceId: SourceAuthSession["workspaceId"],	110	scopeId: SourceAuthSession["scopeId"],
111	) => Effect.Effect<readonly SourceAuthSession[], Error, never>;	111	) => Effect.Effect<readonly SourceAuthSession[], Error, never>;
112	getById: (	112	getById: (
113	id: SourceAuthSession["id"],	113	id: SourceAuthSession["id"],
@@ -115,10 +115,10 @@ export type ExecutorStateStoreShape = { · 1 unmodified line
115	getByState: (	115	getByState: (
116	state: SourceAuthSession["state"],	116	state: SourceAuthSession["state"],
117	) => Effect.Effect<import("effect/Option").Option<SourceAuthSession>, Error, never>;	117	) => Effect.Effect<import("effect/Option").Option<SourceAuthSession>, Error, never>;
118	getPendingByWorkspaceSourceAndActor: (input: {	118	getPendingByScopeSourceAndActor: (input: {
119	workspaceId: SourceAuthSession["workspaceId"];	119	scopeId: SourceAuthSession["scopeId"];
120	sourceId: SourceAuthSession["sourceId"];	120	sourceId: SourceAuthSession["sourceId"];
121	actorAccountId: SourceAuthSession["actorAccountId"];	121	actorScopeId: SourceAuthSession["actorScopeId"];
122	credentialSlot?: SourceAuthSession["credentialSlot"];	122	credentialSlot?: SourceAuthSession["credentialSlot"];
123	}) => Effect.Effect<	123	}) => Effect.Effect<
124	import("effect/Option").Option<SourceAuthSession>,	124	import("effect/Option").Option<SourceAuthSession>,
@@ -129,12 +129,12 @@ export type ExecutorStateStoreShape = { · 4 unmodified lines
129	update: (	129	update: (
130	id: SourceAuthSession["id"],	130	id: SourceAuthSession["id"],
131	patch: Partial<	131	patch: Partial<
132	Omit<SourceAuthSession, "id" \| "workspaceId" \| "sourceId" \| "createdAt">	132	Omit<SourceAuthSession, "id" \| "scopeId" \| "sourceId" \| "createdAt">
133	>,	133	>,
134	) => Effect.Effect<import("effect/Option").Option<SourceAuthSession>, Error, never>;	134	) => Effect.Effect<import("effect/Option").Option<SourceAuthSession>, Error, never>;
135	upsert: (session: SourceAuthSession) => Effect.Effect<void, Error, never>;	135	upsert: (session: SourceAuthSession) => Effect.Effect<void, Error, never>;
136	removeByWorkspaceAndSourceId: (	136	removeByScopeAndSourceId: (
137	workspaceId: SourceAuthSession["workspaceId"],	137	scopeId: SourceAuthSession["scopeId"],
138	sourceId: SourceAuthSession["sourceId"],	138	sourceId: SourceAuthSession["sourceId"],
139	) => Effect.Effect<boolean, Error, never>;	139	) => Effect.Effect<boolean, Error, never>;
140	};	140	};
@@ -158,15 +158,15 @@ export type ExecutorStateStoreShape = { · 17 unmodified lines
158	getById: (	158	getById: (
159	executionId: Execution["id"],	159	executionId: Execution["id"],
160	) => Effect.Effect<import("effect/Option").Option<Execution>, Error, never>;	160	) => Effect.Effect<import("effect/Option").Option<Execution>, Error, never>;
161	getByWorkspaceAndId: (	161	getByScopeAndId: (
162	workspaceId: Execution["workspaceId"],	162	scopeId: Execution["scopeId"],
163	executionId: Execution["id"],	163	executionId: Execution["id"],
164	) => Effect.Effect<import("effect/Option").Option<Execution>, Error, never>;	164	) => Effect.Effect<import("effect/Option").Option<Execution>, Error, never>;
165	insert: (execution: Execution) => Effect.Effect<void, Error, never>;	165	insert: (execution: Execution) => Effect.Effect<void, Error, never>;
166	update: (	166	update: (
167	executionId: Execution["id"],	167	executionId: Execution["id"],
168	patch: Partial<	168	patch: Partial<
169	Omit<Execution, "id" \| "workspaceId" \| "createdByAccountId" \| "createdAt">	169	Omit<Execution, "id" \| "scopeId" \| "createdByScopeId" \| "createdAt">
170	>,	170	>,
171	) => Effect.Effect<import("effect/Option").Option<Execution>, Error, never>;	171	) => Effect.Effect<import("effect/Option").Option<Execution>, Error, never>;
172	};	172	};

packages/platform/sdk/src/runtime/index.ts+110−72

   makeToolInvokerFromTools,
   type ToolMap,
 } from "@executor/codemode-core";
-import { clearAllMcpConnectionPools } from "@executor/source-mcp";
+import {
-import type { LocalInstallation } from "#schema";
+  clearAllMcpConnectionPools,
+} from "@executor/source-mcp";
+import type {
+  LocalInstallation,
+} from "#schema";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as ManagedRuntime from "effect/ManagedRuntime";
-import { RuntimeSourceAuthMaterialLive } from "./auth/source-auth-material";
+import {
-import { RuntimeSourceCatalogStoreLive } from "./catalog/source/runtime";
+  RuntimeSourceAuthMaterialLive,
-import { reconcileMissingSourceCatalogArtifacts } from "./catalog/source/reconcile";
+} from "./auth/source-auth-material";
-import { RuntimeSourceCatalogSyncLive } from "./catalog/source/sync";
+import {
+  RuntimeSourceCatalogStoreLive,
+} from "./catalog/source/runtime";
+import {
+  reconcileMissingSourceCatalogArtifacts,
+} from "./catalog/source/reconcile";
+import {
+  RuntimeSourceCatalogSyncLive,
+} from "./catalog/source/sync";
 import {
   SourceTypeDeclarationsRefresherService,
   type SourceTypeDeclarationsRefresherShape,
 } from "./catalog/source/type-declarations";
-import { createLiveExecutionManager, LiveExecutionManagerService } from "./execution/live";
+import {
-import { RuntimeExecutionResolverLive } from "./execution/workspace/environment";
+  createLiveExecutionManager,
-import type { CreateWorkspaceInternalToolMap, WorkspaceInternalToolContext } from "./execution/workspace/tool-invoker";
+  LiveExecutionManagerService,
-import type { LoadedLocalExecutorConfig } from "./workspace-config";
+} from "./execution/live";
-import type { LocalExecutorConfig } from "#schema";
+import {
-import type { InstanceConfig } from "../local/contracts";
+  RuntimeExecutionResolverLive,
+} from "./execution/scope/environment";
+import type {
+  CreateScopeInternalToolMap,
+  ScopeInternalToolContext,
+} from "./execution/scope/tool-invoker";
+import type {
+  LoadedLocalExecutorConfig,
+} from "./scope-config";
 import type {
-  ExecutorWorkspaceContext,
+  LocalExecutorConfig,
-  ExecutorWorkspaceDescriptor,
+} from "#schema";
-} from "../workspace";
+import type {
+  InstanceConfig,
+} from "../local/contracts";
+import type {
+  ExecutorScopeContext,
+  ExecutorScopeDescriptor,
+} from "../scope";
 import {
   LocalInstanceConfigService,
   type DeleteSecretMaterial,
   SecretMaterialUpdaterService,
   type StoreSecretMaterial,
   type UpdateSecretMaterial,
-} from "./workspace/secret-material-providers";
+} from "./scope/secret-material-providers";
-import type { LocalSourceArtifact } from "./source-artifacts";
+import type {
+  LocalSourceArtifact,
+} from "./source-artifacts";
 import {
-  type RuntimeLocalWorkspaceState,
+  type RuntimeLocalScopeState,
-  RuntimeLocalWorkspaceLive,
+  RuntimeLocalScopeLive,
-} from "./workspace/runtime-context";
+} from "./scope/runtime-context";
 import {
   type LocalToolRuntime,
   type LocalToolRuntimeLoaderShape,
   makeLocalStorageLayer,
   type InstallationStoreShape,
   type SourceArtifactStoreShape,
-  type WorkspaceConfigStoreShape,
+  type ScopeConfigStoreShape,
-  type WorkspaceStateStoreShape,
+  type ScopeStateStoreShape,
-} from "./workspace/storage";
+} from "./scope/storage";
-import type { LocalWorkspaceState } from "./workspace-state";
+import type {
-import { synchronizeLocalWorkspaceState } from "./workspace/workspace-sync";
+  LocalScopeState,
-import { ExecutorStateStore, type ExecutorStateStoreShape } from "./executor-state-store";
+} from "./scope-state";
-import { RuntimeSourceAuthServiceLive } from "./sources/source-auth-service";
+import {
-import { RuntimeSourceStoreLive } from "./sources/source-store";
+  synchronizeLocalScopeState,
+} from "./scope/scope-sync";
+import {
+  ExecutorStateStore,
+  type ExecutorStateStoreShape,
+} from "./executor-state-store";
+import {
+  RuntimeSourceAuthServiceLive,
+} from "./sources/source-auth-service";
+import {
+  RuntimeSourceStoreLive,
+} from "./sources/source-store";
 export * from "./execution/state";
 export * from "./sources/executor-tools";
 export * from "./sources/source-adapters/mcp";
 export * from "./sources/source-store";
 export * from "./executor-state-store";
-export * from "./execution/workspace/environment";
+export * from "./execution/scope/environment";
 export * from "../sources/inspection";
 export * from "../sources/discovery";
 export * from "./execution/service";
 export type {
-  CreateWorkspaceInternalToolMap,
+  CreateScopeInternalToolMap,
-  WorkspaceInternalToolContext,
+  ScopeInternalToolContext,
-} from "./execution/workspace/tool-invoker";
+} from "./execution/scope/tool-invoker";
 export {
   LocalInstanceConfigService,
   SecretMaterialDeleterService,
   SecretMaterialResolverService,
   SecretMaterialStorerService,
   SecretMaterialUpdaterService,
-} from "./workspace/secret-material-providers";
+} from "./scope/secret-material-providers";
 export type {
   DeleteSecretMaterial,
   ResolveInstanceConfig,
   ResolveSecretMaterial,
   StoreSecretMaterial,
   UpdateSecretMaterial,
-} from "./workspace/secret-material-providers";
+} from "./scope/secret-material-providers";
 export {
   builtInSourceAdapters,
   connectableSourceAdapters,
 export type ExecutorRuntimeOptions = {
   executionResolver?: ResolveExecutionEnvironment;
-  createInternalToolMap?: CreateWorkspaceInternalToolMap;
+  createInternalToolMap?: CreateScopeInternalToolMap;
   resolveSecretMaterial?: ResolveSecretMaterial;
   getLocalServerBaseUrl?: () => string | undefined;
 };
   getOrProvision: () => Effect.Effect<LocalInstallation, Error, never>;
 };
-export type BoundWorkspaceConfigStore = {
+export type BoundScopeConfigStore = {
   load: () => Effect.Effect<LoadedLocalExecutorConfig, Error, never>;
   writeProject: (
     config: LocalExecutorConfig,
   ) => Effect.Effect<void, Error, never>;
-  resolveRelativePath: WorkspaceConfigStoreShape["resolveRelativePath"];
+  resolveRelativePath: ScopeConfigStoreShape["resolveRelativePath"];
 };
-export type BoundWorkspaceStateStore = {
+export type BoundScopeStateStore = {
-  load: () => Effect.Effect<LocalWorkspaceState, Error, never>;
+  load: () => Effect.Effect<LocalScopeState, Error, never>;
   write: (
-    state: LocalWorkspaceState,
+    state: LocalScopeState,
   ) => Effect.Effect<void, Error, never>;
 };
 export type RuntimeStorageServices = {
   installation: BoundInstallationStore;
-  workspaceConfig: BoundWorkspaceConfigStore;
+  scopeConfig: BoundScopeConfigStore;
-  workspaceState: BoundWorkspaceStateStore;
+  scopeState: BoundScopeStateStore;
   sourceArtifacts: BoundSourceArtifactStore;
   executorState: ExecutorStateStoreShape;
   secretMaterial: RuntimeSecretMaterialServices;
 };
 export type ExecutorRuntimeServices = {
-  workspace: ExecutorWorkspaceDescriptor;
+  scope: ExecutorScopeDescriptor;
   storage: RuntimeStorageServices;
   localToolRuntimeLoader?: BoundLocalToolRuntimeLoader;
   sourceTypeDeclarationsRefresher?: BoundSourceTypeDeclarationsRefresher;
   getOrProvision: input.getOrProvision,
 });
-const toWorkspaceConfigStoreShape = (
+const toScopeConfigStoreShape = (
-  input: BoundWorkspaceConfigStore,
+  input: BoundScopeConfigStore,
-): WorkspaceConfigStoreShape => ({
+): ScopeConfigStoreShape => ({
   load: input.load,
   writeProject: ({ config }) => input.writeProject(config),
   resolveRelativePath: input.resolveRelativePath,
 });
-const toWorkspaceStateStoreShape = (
+const toScopeStateStoreShape = (
-  input: BoundWorkspaceStateStore,
+  input: BoundScopeStateStore,
-): WorkspaceStateStoreShape => ({
+): ScopeStateStoreShape => ({
   load: input.load,
   write: ({ state }) => input.write(state),
 });
 export const createExecutorRuntimeLayer = (
   input: ExecutorRuntimeOptions & ExecutorRuntimeServices & {
-    localWorkspaceState: RuntimeLocalWorkspaceState;
+    localScopeState: RuntimeLocalScopeState;
     liveExecutionManager: ReturnType<typeof createLiveExecutionManager>;
   },
 ) => {
   const storageLayer = makeLocalStorageLayer({
     installationStore: toInstallationStoreShape(input.storage.installation),
-    workspaceConfigStore: toWorkspaceConfigStoreShape(input.storage.workspaceConfig),
+    scopeConfigStore: toScopeConfigStoreShape(input.storage.scopeConfig),
-    workspaceStateStore: toWorkspaceStateStoreShape(input.storage.workspaceState),
+    scopeStateStore: toScopeStateStoreShape(input.storage.scopeState),
     sourceArtifactStore: toSourceArtifactStoreShape(input.storage.sourceArtifacts),
   });
   const localToolRuntimeLayer = Layer.succeed(
   const baseLayer = Layer.mergeAll(
     Layer.succeed(ExecutorStateStore, input.storage.executorState),
-    RuntimeLocalWorkspaceLive(input.localWorkspaceState),
+    RuntimeLocalScopeLive(input.localScopeState),
     storageLayer,
     Layer.succeed(LiveExecutionManagerService, input.liveExecutionManager),
     sourceTypeDeclarationsRefresherLayer,
       .getOrProvision()
       .pipe(Effect.mapError(toRuntimeBootstrapError));
-    const loadedLocalConfig = yield* input.services.storage.workspaceConfig
+    const loadedLocalConfig = yield* input.services.storage.scopeConfig
       .load()
       .pipe(Effect.mapError(toRuntimeBootstrapError));
-    const runtimeWorkspace: ExecutorWorkspaceContext = {
+    const runtimeWorkspace: ExecutorScopeContext = {
-      ...input.services.workspace,
+      ...input.services.scope,
-      workspaceId: localInstallation.workspaceId,
+      scopeId: localInstallation.scopeId,
-      accountId: localInstallation.accountId,
+      actorScopeId: input.services.scope.actorScopeId ?? localInstallation.actorScopeId,
+      resolutionScopeIds:
+        input.services.scope.resolutionScopeIds ?? localInstallation.resolutionScopeIds,
     };
-    const effectiveLocalConfig = yield* synchronizeLocalWorkspaceState({
+    const effectiveLocalConfig = yield* synchronizeLocalScopeState({
       loadedConfig: loadedLocalConfig,
     })
       .pipe(
             installationStore: toInstallationStoreShape(
               input.services.storage.installation,
             ),
-            workspaceConfigStore: toWorkspaceConfigStoreShape(
+            scopeConfigStore: toScopeConfigStoreShape(
-              input.services.storage.workspaceConfig,
+              input.services.storage.scopeConfig,
             ),
-            workspaceStateStore: toWorkspaceStateStoreShape(
+            scopeStateStore: toScopeStateStoreShape(
-              input.services.storage.workspaceState,
+              input.services.storage.scopeState,
             ),
             sourceArtifactStore: toSourceArtifactStoreShape(
               input.services.storage.sourceArtifacts,
         ),
       )
       .pipe(Effect.mapError(toRuntimeBootstrapError));
-    const runtimeLocalWorkspaceState: RuntimeLocalWorkspaceState = {
+    const runtimeLocalScopeState: RuntimeLocalScopeState = {
-      workspace: runtimeWorkspace,
+      scope: runtimeWorkspace,
-      installation: {
+      installation: localInstallation,
-        workspaceId: localInstallation.workspaceId,
-        accountId: localInstallation.accountId,
-      },
       loadedConfig: {
         ...loadedLocalConfig,
         config: effectiveLocalConfig,
     const concreteRuntimeLayer = createExecutorRuntimeLayer({
       ...input,
       ...input.services,
-      localWorkspaceState: runtimeLocalWorkspaceState,
+      localScopeState: runtimeLocalScopeState,
       liveExecutionManager,
     });
     const managedRuntime = ManagedRuntime.make(concreteRuntimeLayer);
     yield* managedRuntime.runtimeEffect;
     yield* reconcileMissingSourceCatalogArtifacts({
-      workspaceId: localInstallation.workspaceId,
+      scopeId: localInstallation.scopeId,
-      actorAccountId: localInstallation.accountId,
+      actorScopeId: localInstallation.actorScopeId,
     }).pipe(
       Effect.provide(managedRuntime),
       Effect.catchAll(() => Effect.void),

packages/platform/sdk/src/runtime/policy/invocation-policy-engine.test.ts+18−12

-import { describe, expect, it } from "@effect/vitest";
+import {
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
-import type { LocalWorkspacePolicy } from "#schema";
+import type {
+  LocalScopePolicy,
+} from "#schema";
 import {
   PolicyIdSchema,
   SourceIdSchema,
-  WorkspaceIdSchema,
+  ScopeIdSchema,
 } from "#schema";
 import {
   type InvocationDescriptor,
 } from "./invocation-policy-engine";
-const workspaceId = WorkspaceIdSchema.make("ws_policy_engine");
+const scopeId = ScopeIdSchema.make("ws_policy_engine");
 const sourceId = SourceIdSchema.make("src_policy_engine");
 const now = 1_700_000_000_000;
 };
 const basePolicy = (
-  patch: Partial<LocalWorkspacePolicy> = {},
+  patch: Partial<LocalScopePolicy> = {},
-): LocalWorkspacePolicy => ({
+): LocalScopePolicy => ({
   id: PolicyIdSchema.make(`pol_${Math.random().toString(36).slice(2, 8)}`),
   key: "vercel-dns",
-  workspaceId,
+  scopeId,
   resourcePattern: "vercel.api.dns.createRecord",
   effect: "allow",
   approvalMode: "auto",
       args: {},
       policies: [],
       context: {
-        workspaceId,
+        scopeId,
       },
     });
       args: { domain: "testing.executor.sh" },
       policies: [],
       context: {
-        workspaceId,
+        scopeId,
       },
     });
         id: PolicyIdSchema.make("pol_allow"),
       })],
       context: {
-        workspaceId,
+        scopeId,
       },
     });
         }),
       ],
       context: {
-        workspaceId,
+        scopeId,
       },
     });
         enabled: false,
       })],
       context: {
-        workspaceId,
+        scopeId,
       },
     });

packages/platform/sdk/src/runtime/policy/invocation-policy-engine.ts+7−7

@@ -1,5 +1,5 @@
1	import type {	1	import type {
2	LocalWorkspacePolicy,	2	LocalScopePolicy,
3	Source,	3	Source,
4	} from "#schema";	4	} from "#schema";
5		5
@@ -22,13 +22,13 @@ export type InvocationDescriptor = { · 16 unmodified lines
22	};	22	};
23		23
24	export type InvocationPolicyContext = {	24	export type InvocationPolicyContext = {
25	workspaceId: LocalWorkspacePolicy["workspaceId"];	25	scopeId: LocalScopePolicy["scopeId"];
26	};	26	};
27		27
28	export type InvocationAuthorizationDecision = {	28	export type InvocationAuthorizationDecision = {
29	kind: "allow" \| "deny" \| "require_interaction";	29	kind: "allow" \| "deny" \| "require_interaction";
30	reason: string;	30	reason: string;
31	matchedPolicyId: LocalWorkspacePolicy["id"] \| null;	31	matchedPolicyId: LocalScopePolicy["id"] \| null;
32	};	32	};
33		33
34	const matchesGlob = (pattern: string, value: string): boolean => {	34	const matchesGlob = (pattern: string, value: string): boolean => {
@@ -38,7 +38,7 @@ const matchesGlob = (pattern: string, value: string): boolean => { · 3 unmodified lines
38	return new RegExp(`^${escaped}$`).test(value);	38	return new RegExp(`^${escaped}$`).test(value);
39	};	39	};
40		40
41	const policySpecificity = (policy: LocalWorkspacePolicy): number =>	41	const policySpecificity = (policy: LocalScopePolicy): number =>
42	policy.priority + Math.max(1, policy.resourcePattern.replace(/\*/g, "").length);	42	policy.priority + Math.max(1, policy.resourcePattern.replace(/\*/g, "").length);
43		43
44	const defaultDecisionForInvocation = (	44	const defaultDecisionForInvocation = (
@@ -60,7 +60,7 @@ const defaultDecisionForInvocation = ( · 15 unmodified lines
60	};	60	};
61		61
62	const resolvePolicyDecision = (	62	const resolvePolicyDecision = (
63	policy: LocalWorkspacePolicy,	63	policy: LocalScopePolicy,
64	): InvocationAuthorizationDecision => {	64	): InvocationAuthorizationDecision => {
65	if (policy.effect === "deny") {	65	if (policy.effect === "deny") {
66	return {	66	return {
@@ -88,13 +88,13 @@ const resolvePolicyDecision = ( · 21 unmodified lines
88	export const evaluateInvocationPolicy = (input: {	88	export const evaluateInvocationPolicy = (input: {
89	descriptor: InvocationDescriptor;	89	descriptor: InvocationDescriptor;
90	args: unknown;	90	args: unknown;
91	policies: ReadonlyArray<LocalWorkspacePolicy>;	91	policies: ReadonlyArray<LocalScopePolicy>;
92	context: InvocationPolicyContext;	92	context: InvocationPolicyContext;
93	}): InvocationAuthorizationDecision => {	93	}): InvocationAuthorizationDecision => {
94	const matchingPolicies = input.policies	94	const matchingPolicies = input.policies
95	.filter((policy) =>	95	.filter((policy) =>
96	policy.enabled	96	policy.enabled
97	&& policy.workspaceId === input.context.workspaceId	97	&& policy.scopeId === input.context.scopeId
98	&& matchesGlob(policy.resourcePattern, input.descriptor.toolPath))	98	&& matchesGlob(policy.resourcePattern, input.descriptor.toolPath))
99	.sort((left, right) =>	99	.sort((left, right) =>
100	policySpecificity(right) - policySpecificity(left)	100	policySpecificity(right) - policySpecificity(left)

packages/platform/sdk/src/runtime/scope-config.tsrenamed from packages/platform/sdk/src/runtime/workspace-config.ts+3−1

@@ -1,4 +1,6 @@
1	import type { LocalExecutorConfig } from "#schema";	1	import type {
		2	LocalExecutorConfig,
		3	} from "#schema";
2		4
3	export type LoadedExecutorConfig = {	5	export type LoadedExecutorConfig = {
4	config: LocalExecutorConfig \| null;	6	config: LocalExecutorConfig \| null;

packages/platform/sdk/src/runtime/scope-errors.tsrenamed from packages/platform/sdk/src/runtime/workspace-errors.ts+6−6

@@ -1,17 +1,17 @@
1	import * as Data from "effect/Data";	1	import * as Data from "effect/Data";
2		2
3	export class RuntimeLocalWorkspaceUnavailableError extends Data.TaggedError(	3	export class RuntimeLocalScopeUnavailableError extends Data.TaggedError(
4	"RuntimeLocalWorkspaceUnavailableError",	4	"RuntimeLocalScopeUnavailableError",
5	)<{	5	)<{
6	readonly message: string;	6	readonly message: string;
7	}> {}	7	}> {}
8		8
9	export class RuntimeLocalWorkspaceMismatchError extends Data.TaggedError(	9	export class RuntimeLocalScopeMismatchError extends Data.TaggedError(
10	"RuntimeLocalWorkspaceMismatchError",	10	"RuntimeLocalScopeMismatchError",
11	)<{	11	)<{
12	readonly message: string;	12	readonly message: string;
13	readonly requestedWorkspaceId: string;	13	readonly requestedScopeId: string;
14	readonly activeWorkspaceId: string;	14	readonly activeScopeId: string;
15	}> {}	15	}> {}
16		16
17	export class LocalConfiguredSourceNotFoundError extends Data.TaggedError(	17	export class LocalConfiguredSourceNotFoundError extends Data.TaggedError(

packages/platform/sdk/src/runtime/scope-state.tsrenamed from packages/platform/sdk/src/runtime/workspace-state.ts+6−6

@@ -13,13 +13,13 @@ const LocalWorkspaceSourceStateSchema = Schema.Struct({ · 12 unmodified lines
13	updatedAt: TimestampMsSchema,	13	updatedAt: TimestampMsSchema,
14	});	14	});
15		15
16	const LocalWorkspacePolicyStateSchema = Schema.Struct({	16	const LocalScopePolicyStateSchema = Schema.Struct({
17	id: PolicyIdSchema,	17	id: PolicyIdSchema,
18	createdAt: TimestampMsSchema,	18	createdAt: TimestampMsSchema,
19	updatedAt: TimestampMsSchema,	19	updatedAt: TimestampMsSchema,
20	});	20	});
21		21
22	export const LocalWorkspaceStateSchema = Schema.Struct({	22	export const LocalScopeStateSchema = Schema.Struct({
23	version: Schema.Literal(1),	23	version: Schema.Literal(1),
24	sources: Schema.Record({	24	sources: Schema.Record({
25	key: Schema.String,	25	key: Schema.String,
@@ -27,15 +27,15 @@ export const LocalWorkspaceStateSchema = Schema.Struct({ · 1 unmodified line
27	}),	27	}),
28	policies: Schema.Record({	28	policies: Schema.Record({
29	key: Schema.String,	29	key: Schema.String,
30	value: LocalWorkspacePolicyStateSchema,	30	value: LocalScopePolicyStateSchema,
31	}),	31	}),
32	});	32	});
33		33
34	export type LocalWorkspaceSourceState = typeof LocalWorkspaceSourceStateSchema.Type;	34	export type LocalWorkspaceSourceState = typeof LocalWorkspaceSourceStateSchema.Type;
35	export type LocalWorkspacePolicyState = typeof LocalWorkspacePolicyStateSchema.Type;	35	export type LocalScopePolicyState = typeof LocalScopePolicyStateSchema.Type;
36	export type LocalWorkspaceState = typeof LocalWorkspaceStateSchema.Type;	36	export type LocalScopeState = typeof LocalScopeStateSchema.Type;
37		37
38	export const defaultLocalWorkspaceState = (): LocalWorkspaceState => ({	38	export const defaultLocalScopeState = (): LocalScopeState => ({
39	version: 1,	39	version: 1,
40	sources: {},	40	sources: {},
41	policies: {},	41	policies: {},

packages/platform/sdk/src/runtime/scope/config-secrets.tsrenamed from packages/platform/sdk/src/runtime/workspace/config-secrets.ts+0−0

File renamed without changes.

packages/platform/sdk/src/runtime/scope/runtime-context.ts+85−0

@@ -0,0 +1,85 @@
	1	import * as Context from "effect/Context";
	2	import * as Effect from "effect/Effect";
	3	import * as Layer from "effect/Layer";
	4	import * as Option from "effect/Option";
	5
	6	import type {
	7	ScopeId,
	8	} from "#schema";
	9	import type {
	10	ExecutorScopeContext,
	11	} from "../../scope";
	12	import type {
	13	LoadedLocalExecutorConfig,
	14	} from "../scope-config";
	15	import {
	16	RuntimeLocalScopeMismatchError,
	17	RuntimeLocalScopeUnavailableError,
	18	} from "../scope-errors";
	19
	20	export type RuntimeLocalScopeState = {
	21	scope: ExecutorScopeContext;
	22	installation: {
	23	scopeId: ScopeId;
	24	actorScopeId: ScopeId;
	25	resolutionScopeIds: ReadonlyArray<ScopeId>;
	26	};
	27	loadedConfig: LoadedLocalExecutorConfig;
	28	};
	29
	30	export class RuntimeLocalScopeService extends Context.Tag(
	31	"#runtime/RuntimeLocalScopeService",
	32	)<RuntimeLocalScopeService, RuntimeLocalScopeState>() {}
	33
	34	export const RuntimeLocalScopeLive = (
	35	runtimeLocalScope: RuntimeLocalScopeState,
	36	) => Layer.succeed(RuntimeLocalScopeService, runtimeLocalScope);
	37
	38	export const provideOptionalRuntimeLocalScope = <A, E, R>(
	39	effect: Effect.Effect<A, E, R>,
	40	runtimeLocalScope: RuntimeLocalScopeState \| null \| undefined,
	41	): Effect.Effect<A, E, R> =>
	42	runtimeLocalScope === null \|\| runtimeLocalScope === undefined
	43	? effect
	44	: effect.pipe(Effect.provide(RuntimeLocalScopeLive(runtimeLocalScope)));
	45
	46	export const getRuntimeLocalScopeOption = () =>
	47	Effect.contextWith((context) =>
	48	Context.getOption(context, RuntimeLocalScopeService),
	49	).pipe(
	50	Effect.map((option) => (Option.isSome(option) ? option.value : null)),
	51	) as Effect.Effect<RuntimeLocalScopeState \| null, never, never>;
	52
	53	export const requireRuntimeLocalScope = (
	54	scopeId?: ScopeId,
	55	): Effect.Effect<
	56	RuntimeLocalScopeState,
	57	RuntimeLocalScopeUnavailableError \| RuntimeLocalScopeMismatchError,
	58	never
	59	> =>
	60	Effect.gen(function* () {
	61	const runtimeLocalScope = yield* getRuntimeLocalScopeOption();
	62	if (runtimeLocalScope === null) {
	63	return yield* new RuntimeLocalScopeUnavailableError({
	64	message: "Runtime local scope is unavailable",
	65	});
	66	}
	67
	68	if (
	69	scopeId !== undefined
	70	&& runtimeLocalScope.installation.scopeId !== scopeId
	71	) {
	72	return yield* new RuntimeLocalScopeMismatchError({
	73	message: `Scope ${scopeId} is not the active local scope ${runtimeLocalScope.installation.scopeId}`,
	74	requestedScopeId: scopeId,
	75	activeScopeId: runtimeLocalScope.installation.scopeId,
	76	});
	77	}
	78
	79	return runtimeLocalScope;
	80	});
	81
	82	export const requireRuntimeLocalActorScopeId = (scopeId?: ScopeId) =>
	83	requireRuntimeLocalScope(scopeId).pipe(
	84	Effect.map((runtimeLocalScope) => runtimeLocalScope.installation.actorScopeId),
	85	);

packages/platform/sdk/src/runtime/scope/scope-sync.tsrenamed from packages/platform/sdk/src/runtime/workspace/workspace-sync.ts+16−10

 import * as Effect from "effect/Effect";
-import { type LoadedLocalExecutorConfig } from "../workspace-config";
+import {
-import { WorkspaceStateStore } from "./storage";
+  type LoadedLocalExecutorConfig,
-import { type LocalWorkspaceState } from "../workspace-state";
+} from "../scope-config";
+import {
+  ScopeStateStore,
+} from "./storage";
+import {
+  type LocalScopeState,
+} from "../scope-state";
 const trimOrNull = (value: string | null | undefined): string | null => {
   if (value == null) {
 const pruneLocalWorkspaceState = (input: {
   loadedConfig: LoadedLocalExecutorConfig;
-}): Effect.Effect<LocalWorkspaceState, Error, WorkspaceStateStore> =>
+}): Effect.Effect<LocalScopeState, Error, ScopeStateStore> =>
   Effect.gen(function* () {
-    const workspaceStateStore = yield* WorkspaceStateStore;
+    const scopeStateStore = yield* ScopeStateStore;
-    const currentState = yield* workspaceStateStore.load();
+    const currentState = yield* scopeStateStore.load();
     const configuredSourceIds = new Set(
       Object.keys(input.loadedConfig.config?.sources ?? {}),
       Object.keys(input.loadedConfig.config?.policies ?? {}),
     );
-    const nextState: LocalWorkspaceState = {
+    const nextState: LocalScopeState = {
       ...currentState,
       sources: Object.fromEntries(
         Object.entries(currentState.sources).filter(([sourceId]) =>
       return currentState;
     }
-    yield* workspaceStateStore.write({
+    yield* scopeStateStore.write({
       state: nextState,
     });
     return nextState;
   });
-export const synchronizeLocalWorkspaceState = (input: {
+export const synchronizeLocalScopeState = (input: {
   loadedConfig: LoadedLocalExecutorConfig;
-}): Effect.Effect<LoadedLocalExecutorConfig["config"], Error, WorkspaceStateStore> =>
+}): Effect.Effect<LoadedLocalExecutorConfig["config"], Error, ScopeStateStore> =>
   Effect.gen(function* () {
     yield* pruneLocalWorkspaceState({
       loadedConfig: input.loadedConfig,

packages/platform/sdk/src/runtime/scope/secret-material-providers.tsrenamed from packages/platform/sdk/src/runtime/workspace/secret-material-providers.ts+3−1

@@ -1,4 +1,6 @@
1	import type { InstanceConfig } from "../../local/contracts";	1	import type {
		2	InstanceConfig,
		3	} from "../../local/contracts";
2	import * as Context from "effect/Context";	4	import * as Context from "effect/Context";
3	import * as Effect from "effect/Effect";	5	import * as Effect from "effect/Effect";
4		6

packages/platform/sdk/src/runtime/scope/storage.tsrenamed from packages/platform/sdk/src/runtime/workspace/storage.ts+43−30

-import type { LocalInstallation, LocalExecutorConfig } from "#schema";
+import type {
+  LocalInstallation,
+  LocalExecutorConfig,
+} from "#schema";
 import * as Context from "effect/Context";
 import * as Layer from "effect/Layer";
-import type { LoadedLocalExecutorConfig } from "../workspace-config";
+import type {
-import type { LocalSourceArtifact } from "../source-artifacts";
+  LoadedLocalExecutorConfig,
-import type { LocalWorkspaceState } from "../workspace-state";
+} from "../scope-config";
-import type { SourceCatalogSyncResult } from "@executor/source-core";
+import type {
-import type { Source } from "#schema";
+  LocalSourceArtifact,
+} from "../source-artifacts";
+import type {
+  LocalScopeState,
+} from "../scope-state";
+import type {
+  SourceCatalogSyncResult,
+} from "@executor/source-core";
+import type {
+  Source,
+} from "#schema";
 export type InstallationStoreShape = {
   load: () => import("effect/Effect").Effect<LocalInstallation, Error, never>;
   "#runtime/InstallationStore",
 )<InstallationStore, InstallationStoreShape>() {}
-export type WorkspaceConfigStoreShape = {
+export type ScopeConfigStoreShape = {
   load: () => import("effect/Effect").Effect<LoadedLocalExecutorConfig, Error, never>;
   writeProject: (input: {
     config: LocalExecutorConfig;
   }) => import("effect/Effect").Effect<void, Error, never>;
-  resolveRelativePath: (input: { path: string; workspaceRoot: string }) => string;
+  resolveRelativePath: (input: { path: string; scopeRoot: string }) => string;
 };
-export class WorkspaceConfigStore extends Context.Tag(
+export class ScopeConfigStore extends Context.Tag(
-  "#runtime/WorkspaceConfigStore",
+  "#runtime/ScopeConfigStore",
-)<WorkspaceConfigStore, WorkspaceConfigStoreShape>() {}
+)<ScopeConfigStore, ScopeConfigStoreShape>() {}
-export type WorkspaceStateStoreShape = {
+export type ScopeStateStoreShape = {
-  load: () => import("effect/Effect").Effect<LocalWorkspaceState, Error, never>;
+  load: () => import("effect/Effect").Effect<LocalScopeState, Error, never>;
   write: (input: {
-    state: LocalWorkspaceState;
+    state: LocalScopeState;
   }) => import("effect/Effect").Effect<void, Error, never>;
 };
-export class WorkspaceStateStore extends Context.Tag(
+export class ScopeStateStore extends Context.Tag(
-  "#runtime/WorkspaceStateStore",
+  "#runtime/ScopeStateStore",
-)<WorkspaceStateStore, WorkspaceStateStoreShape>() {}
+)<ScopeStateStore, ScopeStateStoreShape>() {}
 export type SourceArtifactStoreShape = {
   build: (input: {
 export type LocalStorageServices =
   | InstallationStore
-  | WorkspaceConfigStore
+  | ScopeConfigStore
-  | WorkspaceStateStore
+  | ScopeStateStore
   | SourceArtifactStore;
-export type WorkspaceStorageServices =
+export type ScopeStorageServices =
-  | WorkspaceConfigStore
+  | ScopeConfigStore
-  | WorkspaceStateStore
+  | ScopeStateStore
   | SourceArtifactStore;
-export const makeWorkspaceStorageLayer = (input: {
+export const makeScopeStorageLayer = (input: {
-  workspaceConfigStore: WorkspaceConfigStoreShape;
+  scopeConfigStore: ScopeConfigStoreShape;
-  workspaceStateStore: WorkspaceStateStoreShape;
+  scopeStateStore: ScopeStateStoreShape;
   sourceArtifactStore: SourceArtifactStoreShape;
 }) =>
   Layer.mergeAll(
-    Layer.succeed(WorkspaceConfigStore, input.workspaceConfigStore),
+    Layer.succeed(ScopeConfigStore, input.scopeConfigStore),
-    Layer.succeed(WorkspaceStateStore, input.workspaceStateStore),
+    Layer.succeed(ScopeStateStore, input.scopeStateStore),
     Layer.succeed(SourceArtifactStore, input.sourceArtifactStore),
   );
 export const makeLocalStorageLayer = (input: {
   installationStore: InstallationStoreShape;
-  workspaceConfigStore: WorkspaceConfigStoreShape;
+  scopeConfigStore: ScopeConfigStoreShape;
-  workspaceStateStore: WorkspaceStateStoreShape;
+  scopeStateStore: ScopeStateStoreShape;
   sourceArtifactStore: SourceArtifactStoreShape;
 }) =>
   Layer.mergeAll(
     Layer.succeed(InstallationStore, input.installationStore),
-    makeWorkspaceStorageLayer(input),
+    makeScopeStorageLayer(input),
   );

packages/platform/sdk/src/runtime/source-artifacts.ts+3−1

 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
-import { decodeCatalogSnapshotV1 } from "@executor/ir/catalog";
+import {
+  decodeCatalogSnapshotV1,
+} from "@executor/ir/catalog";
 import {
   CatalogSnapshotV1Schema,
   type CatalogSnapshotV1,

packages/platform/sdk/src/runtime/sources/executor-tools.ts+67−60

   type ToolPath,
 } from "@executor/codemode-core";
 import {
-  type AccountId,
+  type ScopeId,
   ExecutionIdSchema,
   ExecutionInteractionIdSchema,
   SourceSchema,
   type Source,
-  type WorkspaceId,
 } from "#schema";
 import * as Effect from "effect/Effect";
 import * as Cause from "effect/Cause";
 import * as Exit from "effect/Exit";
 import * as Schema from "effect/Schema";
-import type { RuntimeLocalWorkspaceState } from "../workspace/runtime-context";
+import type {
+  RuntimeLocalScopeState,
+} from "../scope/runtime-context";
 import {
   type LocalStorageServices,
   type InstallationStoreShape,
   type SourceArtifactStoreShape,
-  type WorkspaceConfigStoreShape,
+  type ScopeConfigStoreShape,
-  type WorkspaceStateStoreShape,
+  type ScopeStateStoreShape,
   makeLocalStorageLayer,
-} from "../workspace/storage";
+} from "../scope/storage";
-import { provideOptionalRuntimeLocalWorkspace } from "../workspace/runtime-context";
+import {
-import { runtimeEffectError } from "../effect-errors";
+  provideOptionalRuntimeLocalScope,
+} from "../scope/runtime-context";
+import {
+  runtimeEffectError,
+} from "../effect-errors";
 /** Run an Effect as a Promise, preserving the original error (not FiberFailure). */
 const runEffect = async <A>(
   effect: Effect.Effect<A, unknown, LocalStorageServices>,
   storage: {
     installationStore: InstallationStoreShape;
-    workspaceConfigStore: WorkspaceConfigStoreShape;
+    scopeConfigStore: ScopeConfigStoreShape;
-    workspaceStateStore: WorkspaceStateStoreShape;
+    scopeStateStore: ScopeStateStoreShape;
     sourceArtifactStore: SourceArtifactStoreShape;
   },
-  runtimeLocalWorkspace: RuntimeLocalWorkspaceState | null = null,
+  runtimeLocalScope: RuntimeLocalScopeState | null = null,
 ): Promise<A> => {
   const baseLayer = makeLocalStorageLayer(storage);
   const exit = await Effect.runPromiseExit(
-    provideOptionalRuntimeLocalWorkspace(
+    provideOptionalRuntimeLocalScope(
       effect.pipe(Effect.provide(baseLayer)),
-      runtimeLocalWorkspace,
+      runtimeLocalScope,
     ),
   );
   if (Exit.isSuccess(exit)) return exit.value;
   executorAddableSourceAdapters,
   sourceAdapterRequiresInteractiveConnect,
 } from "./source-adapters";
-import { decodeSourceCredentialSelectionContent } from "./source-credential-interactions";
+import {
+  decodeSourceCredentialSelectionContent,
+} from "./source-credential-interactions";
 const ExecutorSourcesAddInputSchema = Schema.standardSchemaV1(
   ExecutorAddSourceInputSchema,
 export const buildExecutorSourcesAddDescription = (): string =>
   [
-    "Add an MCP, OpenAPI, or GraphQL source to the current workspace.",
+    "Add an MCP, OpenAPI, or GraphQL source to the current scope.",
     ...EXECUTOR_SOURCES_ADD_HELP_LINES,
   ].join("\n");
   JSON.parse(JSON.stringify(value)) as A;
 type ExecutorSourcesAddToolArgs =
-  | Omit<ExecutorMcpSourceInput, "workspaceId" | "actorAccountId" | "executionId" | "interactionId">
+  | Omit<ExecutorMcpSourceInput, "scopeId" | "actorScopeId" | "executionId" | "interactionId">
   | Omit<
       ExecutorCredentialManagedSourceInput,
-      "workspaceId" | "actorAccountId" | "executionId" | "interactionId"
+      "scopeId" | "actorScopeId" | "executionId" | "interactionId"
     >;
 type ExecutorGoogleDiscoveryToolArgs = Omit<
   Extract<ExecutorCredentialManagedSourceInput, { service: string; version: string }>,
-  "workspaceId" | "actorAccountId" | "executionId" | "interactionId"
+  "scopeId" | "actorScopeId" | "executionId" | "interactionId"
 >;
 type ExecutorOpenApiToolArgs = Omit<
   Extract<ExecutorCredentialManagedSourceInput, { specUrl: string }>,
-  "workspaceId" | "actorAccountId" | "executionId" | "interactionId"
+  "scopeId" | "actorScopeId" | "executionId" | "interactionId"
 >;
 type ExecutorGraphqlToolArgs = Omit<
   Extract<ExecutorCredentialManagedSourceInput, { kind: "graphql" }>,
-  "workspaceId" | "actorAccountId" | "executionId" | "interactionId"
+  "scopeId" | "actorScopeId" | "executionId" | "interactionId"
 >;
 type ExecutorCredentialPromptArgs = {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: Source["id"];
   kind: ExecutorCredentialManagedSourceInput["kind"];
   endpoint?: string;
 const isExecutorMcpToolArgs = (
   args: ExecutorSourcesAddToolArgs,
-): args is Omit<ExecutorMcpSourceInput, "workspaceId" | "actorAccountId" | "executionId" | "interactionId"> =>
+): args is Omit<ExecutorMcpSourceInput, "scopeId" | "actorScopeId" | "executionId" | "interactionId"> =>
   args.kind === undefined || sourceAdapterRequiresInteractiveConnect(args.kind);
 const isExecutorCredentialManagedSourceInput = (
 const prepareExecutorAddSourceInput = (input: {
   args: ExecutorSourcesAddToolArgs;
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
-  accountId: AccountId;
+  actorScopeId: ScopeId;
   executionId: ReturnType<typeof toExecutionId>;
   interactionId: ReturnType<typeof ExecutionInteractionIdSchema.make>;
 }): ExecutorAddSourceInput => {
       args: input.args.args ?? null,
       env: input.args.env ?? null,
       cwd: input.args.cwd ?? null,
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
-      actorAccountId: input.accountId,
+      actorScopeId: input.actorScopeId,
       executionId: input.executionId,
       interactionId: input.interactionId,
     } satisfies ExecutorMcpSourceInput;
     const args = input.args as ExecutorGoogleDiscoveryToolArgs;
     return {
       ...args,
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
-      actorAccountId: input.accountId,
+      actorScopeId: input.actorScopeId,
       executionId: input.executionId,
       interactionId: input.interactionId,
     } satisfies Extract<ExecutorCredentialManagedSourceInput, { service: string; version: string }>;
     const args = input.args as ExecutorOpenApiToolArgs;
     return {
       ...args,
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
-      actorAccountId: input.accountId,
+      actorScopeId: input.actorScopeId,
       executionId: input.executionId,
       interactionId: input.interactionId,
     } satisfies Extract<ExecutorCredentialManagedSourceInput, { specUrl: string }>;
   const args = input.args as ExecutorGraphqlToolArgs;
   return {
     ...args,
-    workspaceId: input.workspaceId,
+    scopeId: input.scopeId,
-    actorAccountId: input.accountId,
+    actorScopeId: input.actorScopeId,
     executionId: input.executionId,
     interactionId: input.interactionId,
   } satisfies Extract<ExecutorCredentialManagedSourceInput, { kind: "graphql" }>;
 const resolveLocalCredentialUrl = (input: {
   baseUrl: string;
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: Source["id"];
   executionId: string;
   interactionId: string;
 }): string =>
   new URL(
-    `/v1/workspaces/${encodeURIComponent(input.workspaceId)}/sources/${encodeURIComponent(input.sourceId)}/credentials?interactionId=${encodeURIComponent(`${input.executionId}:${input.interactionId}`)}`,
+    `/v1/workspaces/${encodeURIComponent(input.scopeId)}/sources/${encodeURIComponent(input.sourceId)}/credentials?interactionId=${encodeURIComponent(`${input.executionId}:${input.interactionId}`)}`,
     input.baseUrl,
   ).toString();
             : `Open the secure credential page to connect ${input.source.name}`,
         url: resolveLocalCredentialUrl({
           baseUrl: input.localServerBaseUrl,
-          workspaceId: input.args.workspaceId,
+          scopeId: input.args.scopeId,
           sourceId: input.args.sourceId,
           executionId: input.executionId,
           interactionId: input.interactionId,
   });
 export const createExecutorToolMap = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
-  accountId: AccountId;
+  actorScopeId: ScopeId;
   sourceAuthService: RuntimeSourceAuthService;
   installationStore: InstallationStoreShape;
-  workspaceConfigStore: WorkspaceConfigStoreShape;
+  scopeConfigStore: ScopeConfigStoreShape;
-  workspaceStateStore: WorkspaceStateStoreShape;
+  scopeStateStore: ScopeStateStoreShape;
   sourceArtifactStore: SourceArtifactStoreShape;
-  runtimeLocalWorkspace: RuntimeLocalWorkspaceState | null;
+  runtimeLocalScope: RuntimeLocalScopeState | null;
 }): ToolMap => ({
   "executor.sources.add": toTool({
     tool: {
         );
         const preparedArgs = prepareExecutorAddSourceInput({
           args,
-          workspaceId: input.workspaceId,
+          scopeId: input.scopeId,
-          accountId: input.accountId,
+          actorScopeId: input.actorScopeId,
           executionId,
           interactionId,
         });
           ),
           {
             installationStore: input.installationStore,
-            workspaceConfigStore: input.workspaceConfigStore,
+            scopeConfigStore: input.scopeConfigStore,
-            workspaceStateStore: input.workspaceStateStore,
+            scopeStateStore: input.scopeStateStore,
             sourceArtifactStore: input.sourceArtifactStore,
           },
-          input.runtimeLocalWorkspace,
+          input.runtimeLocalScope,
         );
         if (result.kind === "connected") {
               promptForSourceCredentialSelection({
                 args: {
                   ...pendingArgs,
-                  workspaceId: input.workspaceId,
+                  scopeId: input.scopeId,
                   sourceId: pendingResult.source.id,
                 },
                 credentialSlot: pendingResult.credentialSlot,
               }),
               {
                 installationStore: input.installationStore,
-                workspaceConfigStore: input.workspaceConfigStore,
+                scopeConfigStore: input.scopeConfigStore,
-                workspaceStateStore: input.workspaceStateStore,
+                scopeStateStore: input.scopeStateStore,
                 sourceArtifactStore: input.sourceArtifactStore,
               },
-              input.runtimeLocalWorkspace,
+              input.runtimeLocalScope,
             );
             pendingArgs = pendingResult.credentialSlot === "import"
               ),
               {
                 installationStore: input.installationStore,
-                workspaceConfigStore: input.workspaceConfigStore,
+                scopeConfigStore: input.scopeConfigStore,
-                workspaceStateStore: input.workspaceStateStore,
+                scopeStateStore: input.scopeStateStore,
                 sourceArtifactStore: input.sourceArtifactStore,
               },
-              input.runtimeLocalWorkspace,
+              input.runtimeLocalScope,
             );
             if (completed.kind === "connected") {
           }),
           {
             installationStore: input.installationStore,
-            workspaceConfigStore: input.workspaceConfigStore,
+            scopeConfigStore: input.scopeConfigStore,
-            workspaceStateStore: input.workspaceStateStore,
+            scopeStateStore: input.scopeStateStore,
             sourceArtifactStore: input.sourceArtifactStore,
           },
-          input.runtimeLocalWorkspace,
+          input.runtimeLocalScope,
         );
         if (response.action !== "accept") {
         const connected = await runEffect(
           input.sourceAuthService.getSourceById({
-            workspaceId: input.workspaceId,
+            scopeId: input.scopeId,
             sourceId: result.source.id,
-            actorAccountId: input.accountId,
+            actorScopeId: input.actorScopeId,
           }),
           {
             installationStore: input.installationStore,
-            workspaceConfigStore: input.workspaceConfigStore,
+            scopeConfigStore: input.scopeConfigStore,
-            workspaceStateStore: input.workspaceStateStore,
+            scopeStateStore: input.scopeStateStore,
             sourceArtifactStore: input.sourceArtifactStore,
           },
-          input.runtimeLocalWorkspace,
+          input.runtimeLocalScope,
         );
         return toSerializableValue(connected);
       },

packages/platform/sdk/src/runtime/sources/graphql-tools.test.ts+13−3

@@ -1,8 +1,18 @@
1	import { createServer, type IncomingMessage } from "node:http";	1	import {
		2	createServer,
		3	type IncomingMessage,
		4	} from "node:http";
2		5
3	import { afterEach, describe, expect, it } from "@effect/vitest";	6	import {
		7	afterEach,
		8	describe,
		9	expect,
		10	it,
		11	} from "@effect/vitest";
4		12
5	import { createGraphqlToolFromPersistedOperation } from "./graphql-tools";	13	import {
		14	createGraphqlToolFromPersistedOperation,
		15	} from "./graphql-tools";
6		16
7	type CapturedRequest = {	17	type CapturedRequest = {
8	path: string;	18	path: string;

packages/platform/sdk/src/runtime/sources/source-adapter-fixture-matrix.test.ts+47−23

-import { createServer } from "node:http";
+import {
-import { fileURLToPath } from "node:url";
+  createServer,
+} from "node:http";
+import {
+  fileURLToPath,
+} from "node:url";
 import {
   FileSystem,
   HttpApiSchema,
   OpenApi,
 } from "@effect/platform";
-import { NodeFileSystem } from "@effect/platform-node";
+import {
+  NodeFileSystem,
+} from "@effect/platform-node";
 import {
   buildOpenApiToolPresentation,
   compileOpenApiToolDefinitions,
   compileGoogleDiscoveryToolDefinitions,
   extractGoogleDiscoveryManifest,
 } from "@executor/source-google-discovery";
-import { describe, expect, it } from "@effect/vitest";
+import {
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
 import type {
   Source,
   SourceCatalogIdSchema,
   SourceCatalogRevisionIdSchema,
   SourceIdSchema,
-  WorkspaceIdSchema,
+  ScopeIdSchema,
 } from "#schema";
 import * as Effect from "effect/Effect";
-import { Schema } from "effect";
+import {
+  Schema,
+} from "effect";
-import { projectCatalogForAgentSdk } from "@executor/ir/catalog";
+import {
-import type { CatalogSnapshotV1 } from "@executor/ir/model";
+  projectCatalogForAgentSdk,
+} from "@executor/ir/catalog";
+import type {
+  CatalogSnapshotV1,
+} from "@executor/ir/model";
 import {
   createCatalogTypeProjector,
   projectedCatalogTypeRoots,
   expandCatalogToolByPath,
   type LoadedSourceCatalog,
 } from "../catalog/source/runtime";
-import { invokeIrTool } from "../execution/ir-execution";
+import {
-import { createGoogleDiscoveryCatalogSnapshot } from "@executor/source-google-discovery";
+  invokeIrTool,
-import { createGraphqlCatalogSnapshot } from "@executor/source-graphql";
+} from "../execution/ir-execution";
-import { createOpenApiCatalogSnapshot } from "@executor/source-openapi";
+import {
+  createGoogleDiscoveryCatalogSnapshot,
+} from "@executor/source-google-discovery";
+import {
+  createGraphqlCatalogSnapshot,
+} from "@executor/source-graphql";
+import {
+  createOpenApiCatalogSnapshot,
+} from "@executor/source-openapi";
-const FIXTURE_WORKSPACE_ID = WorkspaceIdSchema.make("ws_source_fixture_matrix");
+const FIXTURE_WORKSPACE_ID = ScopeIdSchema.make("ws_source_fixture_matrix");
 const readFixture = (name: string) =>
   FileSystem.FileSystem.pipe(
   binding: Source["binding"];
 }): Source => ({
   id: SourceIdSchema.make(input.id),
-  workspaceId: FIXTURE_WORKSPACE_ID,
+  scopeId: FIXTURE_WORKSPACE_ID,
   name: input.name,
   kind: input.kind,
   endpoint: input.endpoint,
   );
   const sourceRecord = {
     id: input.source.id,
-    workspaceId: input.source.workspaceId,
+    scopeId: input.source.scopeId,
     catalogId,
     catalogRevisionId: revisionId,
     name: input.source.name,
             const getItemResult = await Effect.runPromise(
               invokeIrTool({
-                workspaceId: source.workspaceId,
+                scopeId: source.scopeId,
-                accountId: "acct_fixture" as any,
+                actorScopeId: "acct_fixture" as any,
                 tool: getItemTool,
                 auth,
                 args: {
             );
             const submitFormResult = await Effect.runPromise(
               invokeIrTool({
-                workspaceId: source.workspaceId,
+                scopeId: source.scopeId,
-                accountId: "acct_fixture" as any,
+                actorScopeId: "acct_fixture" as any,
                 tool: submitFormTool,
                 auth,
                 args: {
             const result = await Effect.runPromise(
               invokeIrTool({
-                workspaceId: source.workspaceId,
+                scopeId: source.scopeId,
-                accountId: "acct_fixture" as any,
+                actorScopeId: "acct_fixture" as any,
                 tool,
                 auth,
                 args: {
           } as const;
           const result = yield* invokeIrTool({
-            workspaceId: source.workspaceId,
+            scopeId: source.scopeId,
-            accountId: "acct_fixture" as any,
+            actorScopeId: "acct_fixture" as any,
             tool,
             auth,
             args: {},

packages/platform/sdk/src/runtime/sources/source-adapters/google-discovery.test.ts+24−8

-import { createServer } from "node:http";
+import {
+  createServer,
+} from "node:http";
-import { describe, expect, it } from "@effect/vitest";
+import {
-import { SourceIdSchema } from "#schema";
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
+import {
+  SourceIdSchema,
+} from "#schema";
 import * as Effect from "effect/Effect";
-import { googleDiscoverySourceAdapter } from "./google-discovery";
+import {
-import { snapshotFromSourceCatalogSyncResult } from "../catalog-sync-result";
+  googleDiscoverySourceAdapter,
-import { createSourceFromPayload } from "../source-definitions";
+} from "./google-discovery";
-import { runtimeEffectError } from "../../effect-errors";
+import {
+  snapshotFromSourceCatalogSyncResult,
+} from "../catalog-sync-result";
+import {
+  createSourceFromPayload,
+} from "../source-definitions";
+import {
+  runtimeEffectError,
+} from "../../effect-errors";
 const fetchLiveDiscoveryDocument = async (): Promise<string> => {
   const response = await fetch("https://www.googleapis.com/discovery/v1/apis/sheets/v4/rest", {
         await withStaticServer(discoveryDocument, async (discoveryUrl) => {
           const source = await Effect.runPromise(
             createSourceFromPayload({
-              workspaceId: "ws_test" as any,
+              scopeId: "ws_test" as any,
               sourceId: SourceIdSchema.make(`src_${crypto.randomUUID()}`),
               payload: {
                 name: "Google Sheets",

packages/platform/sdk/src/runtime/sources/source-adapters/graphql.test.ts+24−8

-import { createServer } from "node:http";
+import {
+  createServer,
+} from "node:http";
-import { describe, expect, it } from "@effect/vitest";
+import {
-import { SourceIdSchema } from "#schema";
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
+import {
+  SourceIdSchema,
+} from "#schema";
 import * as Effect from "effect/Effect";
-import { vi } from "vitest";
+import {
+  vi,
+} from "vitest";
-import { createSourceFromPayload } from "../source-definitions";
+import {
-import { graphqlSourceAdapter } from "./graphql";
+  createSourceFromPayload,
-import { runtimeEffectError } from "../../effect-errors";
+} from "../source-definitions";
+import {
+  graphqlSourceAdapter,
+} from "./graphql";
+import {
+  runtimeEffectError,
+} from "../../effect-errors";
 const toError = (cause: unknown): Error =>
   cause instanceof Error ? cause : new Error(String(cause));
       );
       const source = yield* createSourceFromPayload({
-        workspaceId: "ws_test" as any,
+        scopeId: "ws_test" as any,
         sourceId: SourceIdSchema.make(`src_${crypto.randomUUID()}`),
         payload: {
           name: "GraphQL Timeout",

packages/platform/sdk/src/runtime/sources/source-adapters/index.ts+6−2

   createSourceAdapterComposition,
   type SourceAdapter,
 } from "@executor/source-core";
-import { externalSourceAdapters } from "@executor/source-builtins";
+import {
+  externalSourceAdapters,
+} from "@executor/source-builtins";
-import { internalSourceAdapter } from "./internal";
+import {
+  internalSourceAdapter,
+} from "./internal";
 export type * from "@executor/source-core";

packages/platform/sdk/src/runtime/sources/source-adapters/internal.ts+3−1

@@ -10,7 +10,9 @@ import { · 9 unmodified lines
10	type Source,	10	type Source,
11	type SourceAdapter,	11	type SourceAdapter,
12	} from "@executor/source-core";	12	} from "@executor/source-core";
13	import { runtimeEffectError } from "../../effect-errors";	13	import {
		14	runtimeEffectError,
		15	} from "../../effect-errors";
14		16
15	const InternalBindingConfigSchema = Schema.Struct({});	17	const InternalBindingConfigSchema = Schema.Struct({});
16		18

packages/platform/sdk/src/runtime/sources/source-adapters/mcp.test.ts+73−34

-import { randomUUID } from "node:crypto";
+import {
+  randomUUID,
+} from "node:crypto";
-import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
+import {
-import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
+  createMcpExpressApp,
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+} from "@modelcontextprotocol/sdk/server/express.js";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import type {
-import { describe, expect, it } from "@effect/vitest";
+  OAuthClientProvider,
+} from "@modelcontextprotocol/sdk/client/auth.js";
+import {
+  McpServer,
+} from "@modelcontextprotocol/sdk/server/mcp.js";
+import {
+  StreamableHTTPServerTransport,
+} from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import {
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
 import {
   SourceCatalogIdSchema,
   SourceCatalogRevisionIdSchema,
 } from "#schema";
 import * as Effect from "effect/Effect";
-import { z } from "zod/v4";
+import {
+  z,
+} from "zod/v4";
-import { projectCatalogForAgentSdk } from "@executor/ir/catalog";
+import {
-import type { CatalogSnapshotV1 } from "@executor/ir/model";
+  projectCatalogForAgentSdk,
-import { createCatalogTypeProjector, projectedCatalogTypeRoots } from "../../catalog/catalog-typescript";
+} from "@executor/ir/catalog";
-import { invokeIrTool } from "../../execution/ir-execution";
+import type {
+  CatalogSnapshotV1,
+} from "@executor/ir/model";
+import {
+  createCatalogTypeProjector,
+  projectedCatalogTypeRoots,
+} from "../../catalog/catalog-typescript";
+import {
+  invokeIrTool,
+} from "../../execution/ir-execution";
 import {
   expandCatalogToolByPath,
   type LoadedSourceCatalog,
 } from "../../catalog/source/runtime";
-import { snapshotFromSourceCatalogSyncResult } from "../catalog-sync-result";
+import {
-import { createSourceFromPayload } from "../source-definitions";
+  snapshotFromSourceCatalogSyncResult,
-import { mcpSourceAdapter } from "./mcp";
+} from "../catalog-sync-result";
-import { runtimeEffectError } from "../../effect-errors";
+import {
+  createSourceFromPayload,
+} from "../source-definitions";
+import {
+  mcpSourceAdapter,
+} from "./mcp";
+import {
+  runtimeEffectError,
+} from "../../effect-errors";
 type RealMcpServer = {
   endpoint: string;
   );
   const sourceRecord = {
     id: input.source.id,
-    workspaceId: input.source.workspaceId,
+    scopeId: input.source.scopeId,
     catalogId,
     catalogRevisionId: revisionId,
     name: input.source.name,
 );
 const STDIO_TEST_SERVER_SCRIPT = `
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import {
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+  McpServer,
-import { z } from "zod/v4";
+} from "@modelcontextprotocol/sdk/server/mcp.js";
+import {
+  StdioServerTransport,
+} from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  z,
+} from "zod/v4";
 const server = new McpServer(
   { name: "mcp-stdio-test-server", version: "1.0.0" },
     Effect.gen(function* () {
       const realServer = yield* makeRealMcpServer;
       const source = yield* createSourceFromPayload({
-        workspaceId: "ws_test" as any,
+        scopeId: "ws_test" as any,
         sourceId: SourceIdSchema.make(`src_${randomUUID()}`),
         payload: {
           name: "MCP Demo",
     Effect.gen(function* () {
       const realServer = yield* makeRealMcpServer;
       const source = yield* createSourceFromPayload({
-        workspaceId: "ws_test" as any,
+        scopeId: "ws_test" as any,
         sourceId: SourceIdSchema.make(`src_${randomUUID()}`),
         payload: {
           name: "MCP Demo",
       }
       const result = yield* invokeIrTool({
-        workspaceId: source.workspaceId,
+        scopeId: source.scopeId,
-        accountId: "acct_test" as any,
+        actorScopeId: "acct_test" as any,
         tool,
         auth: {
           placements: [],
       const realServer = yield* makeAuthenticatedMcpServer("Bearer mcp-auth-token");
       const authProvider = makeStaticAuthProvider("mcp-auth-token");
       const source = yield* createSourceFromPayload({
-        workspaceId: "ws_test" as any,
+        scopeId: "ws_test" as any,
         sourceId: SourceIdSchema.make(`src_${randomUUID()}`),
         payload: {
           name: "Authenticated MCP Demo",
       }
       const result = yield* invokeIrTool({
-        workspaceId: source.workspaceId,
+        scopeId: source.scopeId,
-        accountId: "acct_test" as any,
+        actorScopeId: "acct_test" as any,
         tool,
         auth: resolvedAuth,
         args: {
     Effect.gen(function* () {
       const realServer = yield* makeStatefulMcpServer;
       const source = yield* createSourceFromPayload({
-        workspaceId: "ws_test" as any,
+        scopeId: "ws_test" as any,
         sourceId: SourceIdSchema.make(`src_${randomUUID()}`),
         payload: {
           name: "Stateful MCP Demo",
       }
       const incrementResult = yield* invokeIrTool({
-        workspaceId: source.workspaceId,
+        scopeId: source.scopeId,
-        accountId: "acct_test" as any,
+        actorScopeId: "acct_test" as any,
         tool: incrementTool,
         auth: {
           placements: [],
       });
       const readResult = yield* invokeIrTool({
-        workspaceId: source.workspaceId,
+        scopeId: source.scopeId,
-        accountId: "acct_test" as any,
+        actorScopeId: "acct_test" as any,
         tool: readTool,
         auth: {
           placements: [],
   it.scoped("supports stdio MCP sources", () =>
     Effect.gen(function* () {
       const source = yield* createSourceFromPayload({
-        workspaceId: "ws_test" as any,
+        scopeId: "ws_test" as any,
         sourceId: SourceIdSchema.make(`src_${randomUUID()}`),
         payload: {
           name: "Stdio MCP Demo",
       }
       const result = yield* invokeIrTool({
-        workspaceId: source.workspaceId,
+        scopeId: source.scopeId,
-        accountId: "acct_test" as any,
+        actorScopeId: "acct_test" as any,
         tool,
         auth: {
           placements: [],

packages/platform/sdk/src/runtime/sources/source-auth-service.ts+379−305

@@ -9,7 +9,6 @@ import { · 8 unmodified lines
9	type SourceAdapterOauth2SetupConfig,	9	type SourceAdapterOauth2SetupConfig,
10	} from "@executor/source-core";	10	} from "@executor/source-core";
11	import {	11	import {
12	AccountId,
13	type CredentialSlot,	12	type CredentialSlot,
14	McpSourceAuthSessionDataJsonSchema,	13	McpSourceAuthSessionDataJsonSchema,
15	type McpSourceAuthSessionData,	14	type McpSourceAuthSessionData,
@@ -30,12 +29,12 @@ import { · 14 unmodified lines
30	SourceSchema,	29	SourceSchema,
31	type SecretRef,	30	type SecretRef,
32	type StringMap,	31	type StringMap,
33	WorkspaceOauthClientIdSchema,	32	ScopeOauthClientIdSchema,
34	WorkspaceSourceOauthClientIdSchema,	33	ScopedSourceOauthClientIdSchema,
35	WorkspaceSourceOauthClientMetadataJsonSchema,	34	ScopedSourceOauthClientMetadataJsonSchema,
36	type WorkspaceOauthClient,	35	type ScopeOauthClient,
37	type WorkspaceSourceOauthClientRedirectMode,	36	type ScopedSourceOauthClientRedirectMode,
38	type WorkspaceId,	37	type ScopeId,
39	} from "#schema";	38	} from "#schema";
40	import * as Context from "effect/Context";	39	import * as Context from "effect/Context";
41	import * as Either from "effect/Either";	40	import * as Either from "effect/Either";
@@ -51,15 +50,17 @@ import { · 9 unmodified lines
51	type LiveExecutionManager,	50	type LiveExecutionManager,
52	} from "../execution/live";	51	} from "../execution/live";
53	import {	52	import {
54	getRuntimeLocalWorkspaceOption,	53	getRuntimeLocalScopeOption,
55	provideOptionalRuntimeLocalWorkspace,	54	provideOptionalRuntimeLocalScope,
56	type RuntimeLocalWorkspaceState,	55	type RuntimeLocalScopeState,
57	} from "../workspace/runtime-context";	56	} from "../scope/runtime-context";
58	import {	57	import {
59	exchangeMcpOAuthAuthorizationCode,	58	exchangeMcpOAuthAuthorizationCode,
60	startMcpOAuthAuthorization,	59	startMcpOAuthAuthorization,
61	} from "../auth/mcp-oauth";	60	} from "../auth/mcp-oauth";
62	import { createPersistedMcpOAuthSourceAuth } from "../auth/mcp-auth-provider";	61	import {
		62	createPersistedMcpOAuthSourceAuth,
		63	} from "../auth/mcp-auth-provider";
63	import {	64	import {
64	createSourceFromPayload,	65	createSourceFromPayload,
65	updateSourceFromPayload,	66	updateSourceFromPayload,
@@ -79,7 +80,7 @@ import { · 13 unmodified lines
79	SecretMaterialResolverService,	80	SecretMaterialResolverService,
80	SecretMaterialStorerService,	81	SecretMaterialStorerService,
81	type StoreSecretMaterial,	82	type StoreSecretMaterial,
82	} from "../workspace/secret-material-providers";	83	} from "../scope/secret-material-providers";
83	import {	84	import {
84	removeAuthLeaseAndSecrets,	85	removeAuthLeaseAndSecrets,
85	upsertOauth2AuthorizedUserLeaseFromTokenResponse,	86	upsertOauth2AuthorizedUserLeaseFromTokenResponse,
@@ -97,14 +98,23 @@ import { · 11 unmodified lines
97	createPkceCodeVerifier,	98	createPkceCodeVerifier,
98	exchangeOAuth2AuthorizationCode,	99	exchangeOAuth2AuthorizationCode,
99	} from "../auth/oauth2-pkce";	100	} from "../auth/oauth2-pkce";
100	import { startOauthLoopbackRedirectServer } from "../auth/oauth-loopback";	101	import {
		102	startOauthLoopbackRedirectServer,
		103	} from "../auth/oauth-loopback";
101	import {	104	import {
102	type RuntimeSourceStore,	105	type RuntimeSourceStore,
103	RuntimeSourceStoreService,	106	RuntimeSourceStoreService,
104	} from "./source-store";	107	} from "./source-store";
105	import type { WorkspaceStorageServices } from "../workspace/storage";	108	import type {
106	import { ExecutorStateStore, type ExecutorStateStoreShape } from "../executor-state-store";	109	ScopeStorageServices,
107	import { runtimeEffectError } from "../effect-errors";	110	} from "../scope/storage";
		111	import {
		112	ExecutorStateStore,
		113	type ExecutorStateStoreShape,
		114	} from "../executor-state-store";
		115	import {
		116	runtimeEffectError,
		117	} from "../effect-errors";
108		118
109	const trimOrNull = (value: string \| null \| undefined): string \| null => {	119	const trimOrNull = (value: string \| null \| undefined): string \| null => {
110	if (value === null \|\| value === undefined) {	120	if (value === null \|\| value === undefined) {
@@ -199,11 +209,11 @@ const normalizeMcpEndpoint = (input: { · 88 unmodified lines
199		209
200	const resolveSourceCredentialOauthCompleteUrl = (input: {	210	const resolveSourceCredentialOauthCompleteUrl = (input: {
201	baseUrl: string;	211	baseUrl: string;
202	workspaceId: WorkspaceId;	212	scopeId: ScopeId;
203	sourceId: Source["id"];	213	sourceId: Source["id"];
204	}): string =>	214	}): string =>
205	new URL(	215	new URL(
206	`/v1/workspaces/${encodeURIComponent(input.workspaceId)}/sources/${encodeURIComponent(input.sourceId)}/credentials/oauth/complete`,	216	`/v1/workspaces/${encodeURIComponent(input.scopeId)}/sources/${encodeURIComponent(input.sourceId)}/credentials/oauth/complete`,
207	input.baseUrl,	217	input.baseUrl,
208	).toString();	218	).toString();
209		219
@@ -217,10 +227,10 @@ const resolveSourceOAuthCallbackUrl = (input: { · 7 unmodified lines
217		227
218	const resolveWorkspaceProviderOauthCompleteUrl = (input: {	228	const resolveWorkspaceProviderOauthCompleteUrl = (input: {
219	baseUrl: string;	229	baseUrl: string;
220	workspaceId: WorkspaceId;	230	scopeId: ScopeId;
221	}): string =>	231	}): string =>
222	new URL(	232	new URL(
223	`/v1/workspaces/${encodeURIComponent(input.workspaceId)}/oauth/provider/callback`,	233	`/v1/workspaces/${encodeURIComponent(input.scopeId)}/oauth/provider/callback`,
224	input.baseUrl,	234	input.baseUrl,
225	).toString();	235	).toString();
226		236
@@ -491,7 +501,7 @@ const serializeJson = (value: unknown): string \| null => { · 264 unmodified lines
491	};	501	};
492		502
493	const updateSourceStatus = Effect.fn("source.status.update")((sourceStore: RuntimeSourceStore, source: Source, input: {	503	const updateSourceStatus = Effect.fn("source.status.update")((sourceStore: RuntimeSourceStore, source: Source, input: {
494	actorAccountId?: AccountId \| null;	504	actorScopeId?: ScopeId \| null;
495	status: Source["status"];	505	status: Source["status"];
496	lastError?: string \| null;	506	lastError?: string \| null;
497	auth?: Source["auth"];	507	auth?: Source["auth"];
@@ -499,9 +509,9 @@ const updateSourceStatus = Effect.fn("source.status.update")((sourceStore: Runti · 1 unmodified line
499	}) =>	509	}) =>
500	Effect.gen(function* () {	510	Effect.gen(function* () {
501	const latest = yield* sourceStore.loadSourceById({	511	const latest = yield* sourceStore.loadSourceById({
502	workspaceId: source.workspaceId,	512	scopeId: source.scopeId,
503	sourceId: source.id,	513	sourceId: source.id,
504	actorAccountId: input.actorAccountId,	514	actorScopeId: input.actorScopeId,
505	});	515	});
506		516
507	return yield* sourceStore.persistSource({	517	return yield* sourceStore.persistSource({
@@ -512,7 +522,7 @@ const updateSourceStatus = Effect.fn("source.status.update")((sourceStore: Runti · 4 unmodified lines
512	importAuth: input.importAuth ?? latest.importAuth,	522	importAuth: input.importAuth ?? latest.importAuth,
513	updatedAt: Date.now(),	523	updatedAt: Date.now(),
514	}, {	524	}, {
515	actorAccountId: input.actorAccountId,	525	actorScopeId: input.actorScopeId,
516	});	526	});
517	}).pipe(	527	}).pipe(
518	Effect.withSpan("source.status.update", {	528	Effect.withSpan("source.status.update", {
@@ -564,8 +574,8 @@ export type ExecutorHttpSourceAuthInput = · 45 unmodified lines
564	export type ExecutorAddSourceInput =	574	export type ExecutorAddSourceInput =
565	\| {	575	\| {
566	kind?: "mcp";	576	kind?: "mcp";
567	workspaceId: WorkspaceId;	577	scopeId: ScopeId;
568	actorAccountId?: AccountId \| null;	578	actorScopeId?: ScopeId \| null;
569	executionId: SourceAuthSession["executionId"];	579	executionId: SourceAuthSession["executionId"];
570	interactionId: SourceAuthSession["interactionId"];	580	interactionId: SourceAuthSession["interactionId"];
571	endpoint?: string \| null;	581	endpoint?: string \| null;
@@ -581,8 +591,8 @@ export type ExecutorAddSourceInput = · 9 unmodified lines
581	}	591	}
582	\| {	592	\| {
583	kind: "openapi";	593	kind: "openapi";
584	workspaceId: WorkspaceId;	594	scopeId: ScopeId;
585	actorAccountId?: AccountId \| null;	595	actorScopeId?: ScopeId \| null;
586	executionId: SourceAuthSession["executionId"];	596	executionId: SourceAuthSession["executionId"];
587	interactionId: SourceAuthSession["interactionId"];	597	interactionId: SourceAuthSession["interactionId"];
588	endpoint: string;	598	endpoint: string;
@@ -595,8 +605,8 @@ export type ExecutorAddSourceInput = · 6 unmodified lines
595	}	605	}
596	\| {	606	\| {
597	kind: "graphql";	607	kind: "graphql";
598	workspaceId: WorkspaceId;	608	scopeId: ScopeId;
599	actorAccountId?: AccountId \| null;	609	actorScopeId?: ScopeId \| null;
600	executionId: SourceAuthSession["executionId"];	610	executionId: SourceAuthSession["executionId"];
601	interactionId: SourceAuthSession["interactionId"];	611	interactionId: SourceAuthSession["interactionId"];
602	endpoint: string;	612	endpoint: string;
@@ -608,15 +618,15 @@ export type ExecutorAddSourceInput = · 5 unmodified lines
608	}	618	}
609	\| {	619	\| {
610	kind: "google_discovery";	620	kind: "google_discovery";
611	workspaceId: WorkspaceId;	621	scopeId: ScopeId;
612	actorAccountId?: AccountId \| null;	622	actorScopeId?: ScopeId \| null;
613	executionId: SourceAuthSession["executionId"];	623	executionId: SourceAuthSession["executionId"];
614	interactionId: SourceAuthSession["interactionId"];	624	interactionId: SourceAuthSession["interactionId"];
615	service: string;	625	service: string;
616	version: string;	626	version: string;
617	discoveryUrl?: string \| null;	627	discoveryUrl?: string \| null;
618	scopes?: ReadonlyArray<string> \| null;	628	scopes?: ReadonlyArray<string> \| null;
619	workspaceOauthClientId?: WorkspaceOauthClient["id"] \| null;	629	scopeOauthClientId?: ScopeOauthClient["id"] \| null;
620	oauthClient?: SourceOauthClientInput \| null;	630	oauthClient?: SourceOauthClientInput \| null;
621	name?: string \| null;	631	name?: string \| null;
622	namespace?: string \| null;	632	namespace?: string \| null;
@@ -641,8 +651,8 @@ export type ExecutorMcpSourceInput = Exclude< · 18 unmodified lines
641	>;	651	>;
642		652
643	export type ConnectMcpSourceInput = {	653	export type ConnectMcpSourceInput = {
644	workspaceId: WorkspaceId;	654	scopeId: ScopeId;
645	actorAccountId?: AccountId \| null;	655	actorScopeId?: ScopeId \| null;
646	sourceId?: Source["id"] \| null;	656	sourceId?: Source["id"] \| null;
647	endpoint?: string \| null;	657	endpoint?: string \| null;
648	name?: string \| null;	658	name?: string \| null;
@@ -659,11 +669,11 @@ export type ConnectMcpSourceInput = { · 10 unmodified lines
659	};	669	};
660		670
661	export type ConnectGoogleDiscoveryBatchInput = {	671	export type ConnectGoogleDiscoveryBatchInput = {
662	workspaceId: WorkspaceId;	672	scopeId: ScopeId;
663	actorAccountId?: AccountId \| null;	673	actorScopeId?: ScopeId \| null;
664	executionId: SourceAuthSession["executionId"];	674	executionId: SourceAuthSession["executionId"];
665	interactionId: SourceAuthSession["interactionId"];	675	interactionId: SourceAuthSession["interactionId"];
666	workspaceOauthClientId: WorkspaceOauthClient["id"];	676	scopeOauthClientId: ScopeOauthClient["id"];
667	sources: ReadonlyArray<{	677	sources: ReadonlyArray<{
668	service: string;	678	service: string;
669	version: string;	679	version: string;
@@ -687,8 +697,8 @@ export type ConnectGoogleDiscoveryBatchResult = { · 17 unmodified lines
687	} \| null;	697	} \| null;
688	};	698	};
689		699
690	export type CreateWorkspaceOauthClientInput = {	700	export type CreateScopeOauthClientInput = {
691	workspaceId: WorkspaceId;	701	scopeId: ScopeId;
692	providerKey: string;	702	providerKey: string;
693	label?: string \| null;	703	label?: string \| null;
694	oauthClient: SourceOauthClientInput;	704	oauthClient: SourceOauthClientInput;
@@ -707,8 +717,8 @@ export type SourceOAuthProviderInput = { · 12 unmodified lines
707	};	717	};
708		718
709	export type StartSourceOAuthSessionInput = {	719	export type StartSourceOAuthSessionInput = {
710	workspaceId: WorkspaceId;	720	scopeId: ScopeId;
711	actorAccountId?: AccountId \| null;	721	actorScopeId?: ScopeId \| null;
712	provider: SourceOAuthProviderInput;	722	provider: SourceOAuthProviderInput;
713	baseUrl?: string \| null;	723	baseUrl?: string \| null;
714	displayName?: string \| null;	724	displayName?: string \| null;
@@ -928,11 +938,11 @@ type ResolvedSourceOauthClient = { · 213 unmodified lines
928	providerKey: string;	938	providerKey: string;
929	clientId: string;	939	clientId: string;
930	clientSecret: SecretRef \| null;	940	clientSecret: SecretRef \| null;
931	redirectMode: WorkspaceSourceOauthClientRedirectMode;	941	redirectMode: ScopedSourceOauthClientRedirectMode;
932	};	942	};
933		943
934	type ResolvedWorkspaceOauthClient = ResolvedSourceOauthClient & {	944	type ResolvedScopeOauthClient = ResolvedSourceOauthClient & {
935	id: WorkspaceOauthClient["id"];	945	id: ScopeOauthClient["id"];
936	label: string \| null;	946	label: string \| null;
937	};	947	};
938		948
@@ -954,22 +964,22 @@ type RuntimeProviderAuthResult = · 15 unmodified lines
954	authorizationUrl: string;	964	authorizationUrl: string;
955	};	965	};
956		966
957	const decodeWorkspaceSourceOauthClientMetadataOption = Schema.decodeUnknownOption(	967	const decodeScopedSourceOauthClientMetadataOption = Schema.decodeUnknownOption(
958	WorkspaceSourceOauthClientMetadataJsonSchema,	968	ScopedSourceOauthClientMetadataJsonSchema,
959	);	969	);
960		970
961	const encodeWorkspaceSourceOauthClientMetadataJson = Schema.encodeSync(	971	const encodeScopedSourceOauthClientMetadataJson = Schema.encodeSync(
962	WorkspaceSourceOauthClientMetadataJsonSchema,	972	ScopedSourceOauthClientMetadataJsonSchema,
963	);	973	);
964		974
965	const sourceOauthClientRedirectMode = (client: {	975	const sourceOauthClientRedirectMode = (client: {
966	clientMetadataJson: string \| null;	976	clientMetadataJson: string \| null;
967	}): WorkspaceSourceOauthClientRedirectMode => {	977	}): ScopedSourceOauthClientRedirectMode => {
968	if (client.clientMetadataJson === null) {	978	if (client.clientMetadataJson === null) {
969	return "app_callback";	979	return "app_callback";
970	}	980	}
971		981
972	const decoded = decodeWorkspaceSourceOauthClientMetadataOption(	982	const decoded = decodeScopedSourceOauthClientMetadataOption(
973	client.clientMetadataJson,	983	client.clientMetadataJson,
974	);	984	);
975	if (Option.isNone(decoded)) {	985	if (Option.isNone(decoded)) {
@@ -1009,8 +1019,8 @@ const upsertSourceOauthClient = (input: { · 33 unmodified lines
1009	return yield* runtimeEffectError("sources/source-auth-service", `Source ${input.source.id} does not support OAuth client configuration`);	1019	return yield* runtimeEffectError("sources/source-auth-service", `Source ${input.source.id} does not support OAuth client configuration`);
1010	}	1020	}
1011		1021
1012	const existing = yield* input.executorState.sourceOauthClients.getByWorkspaceSourceAndProvider({	1022	const existing = yield* input.executorState.sourceOauthClients.getByScopeSourceAndProvider({
1013	workspaceId: input.source.workspaceId,	1023	scopeId: input.source.scopeId,
1014	sourceId: input.source.id,	1024	sourceId: input.source.id,
1015	providerKey: setupConfig.providerKey,	1025	providerKey: setupConfig.providerKey,
1016	});	1026	});
@@ -1029,18 +1039,18 @@ const upsertSourceOauthClient = (input: { · 12 unmodified lines
1029	const now = Date.now();	1039	const now = Date.now();
1030	const clientId = Option.isSome(existing)	1040	const clientId = Option.isSome(existing)
1031	? existing.value.id	1041	? existing.value.id
1032	: WorkspaceSourceOauthClientIdSchema.make(	1042	: ScopedSourceOauthClientIdSchema.make(
1033	`src_oauth_client_${crypto.randomUUID()}`,	1043	`src_oauth_client_${crypto.randomUUID()}`,
1034	);	1044	);
1035	yield* input.executorState.sourceOauthClients.upsert({	1045	yield* input.executorState.sourceOauthClients.upsert({
1036	id: clientId,	1046	id: clientId,
1037	workspaceId: input.source.workspaceId,	1047	scopeId: input.source.scopeId,
1038	sourceId: input.source.id,	1048	sourceId: input.source.id,
1039	providerKey: setupConfig.providerKey,	1049	providerKey: setupConfig.providerKey,
1040	clientId: normalizedOauthClient.clientId,	1050	clientId: normalizedOauthClient.clientId,
1041	clientSecretProviderId: clientSecretRef?.providerId ?? null,	1051	clientSecretProviderId: clientSecretRef?.providerId ?? null,
1042	clientSecretHandle: clientSecretRef?.handle ?? null,	1052	clientSecretHandle: clientSecretRef?.handle ?? null,
1043	clientMetadataJson: encodeWorkspaceSourceOauthClientMetadataJson({	1053	clientMetadataJson: encodeScopedSourceOauthClientMetadataJson({
1044	redirectMode: normalizedOauthClient.redirectMode ?? "app_callback",	1054	redirectMode: normalizedOauthClient.redirectMode ?? "app_callback",
1045	}),	1055	}),
1046	createdAt: Option.isSome(existing) ? existing.value.createdAt : now,	1056	createdAt: Option.isSome(existing) ? existing.value.createdAt : now,
@@ -1084,8 +1094,8 @@ const resolveExistingSourceOauthClient = (input: { · 37 unmodified lines
1084	return null;	1094	return null;
1085	}	1095	}
1086		1096
1087	const existing = yield* input.executorState.sourceOauthClients.getByWorkspaceSourceAndProvider({	1097	const existing = yield* input.executorState.sourceOauthClients.getByScopeSourceAndProvider({
1088	workspaceId: input.source.workspaceId,	1098	scopeId: input.source.scopeId,
1089	sourceId: input.source.id,	1099	sourceId: input.source.id,
1090	providerKey: setupConfig.providerKey,	1100	providerKey: setupConfig.providerKey,
1091	});	1101	});
@@ -1101,9 +1111,9 @@ const resolveExistingSourceOauthClient = (input: { · 9 unmodified lines
1101	};	1111	};
1102	});	1112	});
1103		1113
1104	const createWorkspaceOauthClient = (input: {	1114	const createScopeOauthClient = (input: {
1105	executorState: ExecutorStateStoreShape;	1115	executorState: ExecutorStateStoreShape;
1106	workspaceId: WorkspaceId;	1116	scopeId: ScopeId;
1107	providerKey: string;	1117	providerKey: string;
1108	oauthClient: SourceOauthClientInput;	1118	oauthClient: SourceOauthClientInput;
1109	label?: string \| null;	1119	label?: string \| null;
@@ -1111,7 +1121,7 @@ const createWorkspaceOauthClient = (input: { · 1 unmodified line
1111	input: SourceOauthClientInput,	1121	input: SourceOauthClientInput,
1112	) => Effect.Effect<SourceOauthClientInput, Error, never>;	1122	) => Effect.Effect<SourceOauthClientInput, Error, never>;
1113	storeSecretMaterial: StoreSecretMaterial;	1123	storeSecretMaterial: StoreSecretMaterial;
1114	}): Effect.Effect<ResolvedWorkspaceOauthClient, Error, never> =>	1124	}): Effect.Effect<ResolvedScopeOauthClient, Error, never> =>
1115	Effect.gen(function* () {	1125	Effect.gen(function* () {
1116	const normalizedOauthClient = input.normalizeOauthClient	1126	const normalizedOauthClient = input.normalizeOauthClient
1117	? yield* input.normalizeOauthClient(input.oauthClient)	1127	? yield* input.normalizeOauthClient(input.oauthClient)
@@ -1123,19 +1133,19 @@ const createWorkspaceOauthClient = (input: { · 5 unmodified lines
1123	})	1133	})
1124	: null;	1134	: null;
1125	const now = Date.now();	1135	const now = Date.now();
1126	const id = WorkspaceOauthClientIdSchema.make(	1136	const id = ScopeOauthClientIdSchema.make(
1127	`ws_oauth_client_${crypto.randomUUID()}`,	1137	`ws_oauth_client_${crypto.randomUUID()}`,
1128	);	1138	);
1129		1139
1130	yield* input.executorState.workspaceOauthClients.upsert({	1140	yield* input.executorState.scopeOauthClients.upsert({
1131	id,	1141	id,
1132	workspaceId: input.workspaceId,	1142	scopeId: input.scopeId,
1133	providerKey: input.providerKey,	1143	providerKey: input.providerKey,
1134	label: trimOrNull(input.label) ?? null,	1144	label: trimOrNull(input.label) ?? null,
1135	clientId: normalizedOauthClient.clientId,	1145	clientId: normalizedOauthClient.clientId,
1136	clientSecretProviderId: clientSecretRef?.providerId ?? null,	1146	clientSecretProviderId: clientSecretRef?.providerId ?? null,
1137	clientSecretHandle: clientSecretRef?.handle ?? null,	1147	clientSecretHandle: clientSecretRef?.handle ?? null,
1138	clientMetadataJson: encodeWorkspaceSourceOauthClientMetadataJson({	1148	clientMetadataJson: encodeScopedSourceOauthClientMetadataJson({
1139	redirectMode: normalizedOauthClient.redirectMode ?? "app_callback",	1149	redirectMode: normalizedOauthClient.redirectMode ?? "app_callback",
1140	}),	1150	}),
1141	createdAt: now,	1151	createdAt: now,
@@ -1152,23 +1162,28 @@ const createWorkspaceOauthClient = (input: { · 10 unmodified lines
1152	};	1162	};
1153	});	1163	});
1154		1164
1155	const resolveWorkspaceOauthClientById = (input: {	1165	const resolveScopeOauthClientById = (input: {
1156	executorState: ExecutorStateStoreShape;	1166	executorState: ExecutorStateStoreShape;
1157	workspaceId: WorkspaceId;	1167	scopeId: ScopeId;
1158	oauthClientId: WorkspaceOauthClient["id"];	1168	oauthClientId: ScopeOauthClient["id"];
1159	providerKey: string;	1169	providerKey: string;
1160	}): Effect.Effect<ResolvedWorkspaceOauthClient \| null, Error, never> =>	1170	localScopeState?: RuntimeLocalScopeState;
		1171	}): Effect.Effect<ResolvedScopeOauthClient \| null, Error, never> =>
1161	Effect.gen(function* () {	1172	Effect.gen(function* () {
1162	const existing = yield* input.executorState.workspaceOauthClients.getById(input.oauthClientId);	1173	const existing = yield* input.executorState.scopeOauthClients.getById(input.oauthClientId);
1163	if (Option.isNone(existing)) {	1174	if (Option.isNone(existing)) {
1164	return null;	1175	return null;
1165	}	1176	}
1166		1177
		1178	const allowedScopeIds = resolvedScopeSearchOrder({
		1179	scopeId: input.scopeId,
		1180	localScopeState: input.localScopeState,
		1181	});
1167	if (	1182	if (
1168	existing.value.workspaceId !== input.workspaceId	1183	!allowedScopeIds.includes(existing.value.scopeId)
1169	\|\| existing.value.providerKey !== input.providerKey	1184	\|\| existing.value.providerKey !== input.providerKey
1170	) {	1185	) {
1171	return yield* runtimeEffectError("sources/source-auth-service", `Workspace OAuth client ${input.oauthClientId} is not valid for ${input.providerKey}`);	1186	return yield* runtimeEffectError("sources/source-auth-service", `Scope OAuth client ${input.oauthClientId} is not valid for ${input.providerKey}`);
1172	}	1187	}
1173		1188
1174	return {	1189	return {
@@ -1192,6 +1207,25 @@ const providerGrantCoversScopes = ( · 17 unmodified lines
1192	const normalizeScopes = (scopes: ReadonlyArray<string>): ReadonlyArray<string> =>	1207	const normalizeScopes = (scopes: ReadonlyArray<string>): ReadonlyArray<string> =>
1193	[...new Set(scopes.map((scope) => scope.trim()).filter((scope) => scope.length > 0))];	1208	[...new Set(scopes.map((scope) => scope.trim()).filter((scope) => scope.length > 0))];
1194		1209
		1210	const resolvedScopeSearchOrder = (input: {
		1211	scopeId: ScopeId;
		1212	localScopeState?: RuntimeLocalScopeState;
		1213	}): ReadonlyArray<ScopeId> => {
		1214	const localScopeState = input.localScopeState;
		1215	if (!localScopeState) {
		1216	return [input.scopeId];
		1217	}
		1218
		1219	if (localScopeState.installation.scopeId !== input.scopeId) {
		1220	return [input.scopeId];
		1221	}
		1222
		1223	return [...new Set([
		1224	input.scopeId,
		1225	...localScopeState.installation.resolutionScopeIds,
		1226	])];
		1227	};
		1228
1195	const authorizationParamsMatch = (	1229	const authorizationParamsMatch = (
1196	left: SourceAdapterOauth2SetupConfig["authorizationParams"],	1230	left: SourceAdapterOauth2SetupConfig["authorizationParams"],
1197	right: SourceAdapterOauth2SetupConfig["authorizationParams"],	1231	right: SourceAdapterOauth2SetupConfig["authorizationParams"],
@@ -1272,34 +1306,44 @@ const mergeRuntimeProviderAuthSetupConfig = ( · 74 unmodified lines
1272		1306
1273	const findReusableProviderGrant = (input: {	1307	const findReusableProviderGrant = (input: {
1274	executorState: ExecutorStateStoreShape;	1308	executorState: ExecutorStateStoreShape;
1275	workspaceId: WorkspaceId;	1309	scopeId: ScopeId;
1276	actorAccountId?: AccountId \| null;	1310	actorScopeId?: ScopeId \| null;
1277	providerKey: string;	1311	providerKey: string;
1278	oauthClientId: WorkspaceOauthClient["id"];	1312	oauthClientId: ScopeOauthClient["id"];
1279	requiredScopes: ReadonlyArray<string>;	1313	requiredScopes: ReadonlyArray<string>;
		1314	localScopeState?: RuntimeLocalScopeState;
1280	}): Effect.Effect<import("effect/Option").Option<import("#schema").ProviderAuthGrant>, Error, never> =>	1315	}): Effect.Effect<import("effect/Option").Option<import("#schema").ProviderAuthGrant>, Error, never> =>
1281	Effect.map(	1316	Effect.gen(function* () {
1282	input.executorState.providerAuthGrants.listByWorkspaceActorAndProvider({	1317	const scopeIds = resolvedScopeSearchOrder({
1283	workspaceId: input.workspaceId,	1318	scopeId: input.scopeId,
1284	actorAccountId: input.actorAccountId ?? null,	1319	localScopeState: input.localScopeState,
1285	providerKey: input.providerKey,	1320	});
1286	}),	1321
1287	(grants) =>	1322	for (const candidateScopeId of scopeIds) {
1288	Option.fromNullable(	1323	const grants = yield* input.executorState.providerAuthGrants.listByScopeActorAndProvider({
1289	grants.find(	1324	scopeId: candidateScopeId,
1290	(grant) =>	1325	actorScopeId: input.actorScopeId ?? null,
1291	grant.oauthClientId === input.oauthClientId	1326	providerKey: input.providerKey,
1292	&& providerGrantCoversScopes(grant.grantedScopes, input.requiredScopes),	1327	});
1293	),	1328	const matchingGrant = grants.find(
1294	),	1329	(grant) =>
1295	);	1330	grant.oauthClientId === input.oauthClientId
		1331	&& providerGrantCoversScopes(grant.grantedScopes, input.requiredScopes),
		1332	);
		1333	if (matchingGrant) {
		1334	return Option.some(matchingGrant);
		1335	}
		1336	}
		1337
		1338	return Option.none();
		1339	});
1296		1340
1297	const upsertProviderAuthGrant = (input: {	1341	const upsertProviderAuthGrant = (input: {
1298	executorState: ExecutorStateStoreShape;	1342	executorState: ExecutorStateStoreShape;
1299	workspaceId: WorkspaceId;	1343	scopeId: ScopeId;
1300	actorAccountId?: AccountId \| null;	1344	actorScopeId?: ScopeId \| null;
1301	providerKey: string;	1345	providerKey: string;
1302	oauthClientId: WorkspaceOauthClient["id"];	1346	oauthClientId: ScopeOauthClient["id"];
1303	tokenEndpoint: string;	1347	tokenEndpoint: string;
1304	clientAuthentication: "none" \| "client_secret_post";	1348	clientAuthentication: "none" \| "client_secret_post";
1305	headerName: string;	1349	headerName: string;
@@ -1328,8 +1372,8 @@ const upsertProviderAuthGrant = (input: { · 22 unmodified lines
1328	const now = Date.now();	1372	const now = Date.now();
1329	const nextGrant = {	1373	const nextGrant = {
1330	id: existingGrant?.id ?? ProviderAuthGrantIdSchema.make(`provider_grant_${crypto.randomUUID()}`),	1374	id: existingGrant?.id ?? ProviderAuthGrantIdSchema.make(`provider_grant_${crypto.randomUUID()}`),
1331	workspaceId: input.workspaceId,	1375	scopeId: input.scopeId,
1332	actorAccountId: input.actorAccountId ?? null,	1376	actorScopeId: input.actorScopeId ?? null,
1333	providerKey: input.providerKey,	1377	providerKey: input.providerKey,
1334	oauthClientId: input.oauthClientId,	1378	oauthClientId: input.oauthClientId,
1335	tokenEndpoint: input.tokenEndpoint,	1379	tokenEndpoint: input.tokenEndpoint,
@@ -1369,16 +1413,16 @@ const startOauth2PkceSourceCredentialSetup = (input: { · 33 unmodified lines
1369	executorState: ExecutorStateStoreShape;	1413	executorState: ExecutorStateStoreShape;
1370	sourceStore: RuntimeSourceStore;	1414	sourceStore: RuntimeSourceStore;
1371	source: Source;	1415	source: Source;
1372	actorAccountId?: AccountId \| null;	1416	actorScopeId?: ScopeId \| null;
1373	executionId?: SourceAuthSession["executionId"];	1417	executionId?: SourceAuthSession["executionId"];
1374	interactionId?: SourceAuthSession["interactionId"];	1418	interactionId?: SourceAuthSession["interactionId"];
1375	baseUrl: string;	1419	baseUrl: string;
1376	redirectModeOverride?: WorkspaceSourceOauthClientRedirectMode;	1420	redirectModeOverride?: ScopedSourceOauthClientRedirectMode;
1377	storeSecretMaterial: StoreSecretMaterial;	1421	storeSecretMaterial: StoreSecretMaterial;
1378	}): Effect.Effect<	1422	}): Effect.Effect<
1379	Extract<ExecutorSourceAddResult, { kind: "oauth_required" }> \| null,	1423	Extract<ExecutorSourceAddResult, { kind: "oauth_required" }> \| null,
1380	Error,	1424	Error,
1381	WorkspaceStorageServices	1425	ScopeStorageServices
1382	> =>	1426	> =>
1383	Effect.gen(function* () {	1427	Effect.gen(function* () {
1384	const adapter = getSourceAdapterForSource(input.source);	1428	const adapter = getSourceAdapterForSource(input.source);
@@ -1404,7 +1448,7 @@ const startOauth2PkceSourceCredentialSetup = (input: { · 19 unmodified lines
1404	const state = crypto.randomUUID();	1448	const state = crypto.randomUUID();
1405	const completionUrl = resolveSourceCredentialOauthCompleteUrl({	1449	const completionUrl = resolveSourceCredentialOauthCompleteUrl({
1406	baseUrl: input.baseUrl,	1450	baseUrl: input.baseUrl,
1407	workspaceId: input.source.workspaceId,	1451	scopeId: input.source.scopeId,
1408	sourceId: input.source.id,	1452	sourceId: input.source.id,
1409	});	1453	});
1410	const redirectMode = input.redirectModeOverride ?? oauthClient.redirectMode;	1454	const redirectMode = input.redirectModeOverride ?? oauthClient.redirectMode;
@@ -1429,9 +1473,9 @@ const startOauth2PkceSourceCredentialSetup = (input: { · 18 unmodified lines
1429		1473
1430	yield* input.executorState.sourceAuthSessions.upsert({	1474	yield* input.executorState.sourceAuthSessions.upsert({
1431	id: sessionId,	1475	id: sessionId,
1432	workspaceId: input.source.workspaceId,	1476	scopeId: input.source.scopeId,
1433	sourceId: input.source.id,	1477	sourceId: input.source.id,
1434	actorAccountId: input.actorAccountId ?? null,	1478	actorScopeId: input.actorScopeId ?? null,
1435	credentialSlot: "runtime",	1479	credentialSlot: "runtime",
1436	executionId: input.executionId ?? null,	1480	executionId: input.executionId ?? null,
1437	interactionId: input.interactionId ?? null,	1481	interactionId: input.interactionId ?? null,
@@ -1463,7 +1507,7 @@ const startOauth2PkceSourceCredentialSetup = (input: { · 25 unmodified lines
1463	});	1507	});
1464		1508
1465	const authRequiredSource = yield* updateSourceStatus(input.sourceStore, input.source, {	1509	const authRequiredSource = yield* updateSourceStatus(input.sourceStore, input.source, {
1466	actorAccountId: input.actorAccountId,	1510	actorScopeId: input.actorScopeId,
1467	status: "auth_required",	1511	status: "auth_required",
1468	lastError: null,	1512	lastError: null,
1469	});	1513	});
@@ -1486,13 +1530,13 @@ const startOauth2PkceSourceCredentialSetup = (input: { · 16 unmodified lines
1486	const startProviderOauthBatchCredentialSetup = (input: {	1530	const startProviderOauthBatchCredentialSetup = (input: {
1487	executorState: ExecutorStateStoreShape;	1531	executorState: ExecutorStateStoreShape;
1488	sourceStore: RuntimeSourceStore;	1532	sourceStore: RuntimeSourceStore;
1489	workspaceId: WorkspaceId;	1533	scopeId: ScopeId;
1490	actorAccountId?: AccountId \| null;	1534	actorScopeId?: ScopeId \| null;
1491	executionId?: SourceAuthSession["executionId"];	1535	executionId?: SourceAuthSession["executionId"];
1492	interactionId?: SourceAuthSession["interactionId"];	1536	interactionId?: SourceAuthSession["interactionId"];
1493	baseUrl: string;	1537	baseUrl: string;
1494	redirectModeOverride?: WorkspaceSourceOauthClientRedirectMode;	1538	redirectModeOverride?: ScopedSourceOauthClientRedirectMode;
1495	workspaceOauthClient: ResolvedWorkspaceOauthClient;	1539	scopeOauthClient: ResolvedScopeOauthClient;
1496	setupConfig: SourceAdapterOauth2SetupConfig;	1540	setupConfig: SourceAdapterOauth2SetupConfig;
1497	targetSources: ReadonlyArray<{	1541	targetSources: ReadonlyArray<{
1498	source: Source;	1542	source: Source;
@@ -1502,7 +1546,7 @@ const startProviderOauthBatchCredentialSetup = (input: { · 3 unmodified lines
1502	sessionId: SourceAuthSession["id"];	1546	sessionId: SourceAuthSession["id"];
1503	authorizationUrl: string;	1547	authorizationUrl: string;
1504	source: Source;	1548	source: Source;
1505	}, Error, WorkspaceStorageServices> =>	1549	}, Error, ScopeStorageServices> =>
1506	Effect.gen(function* () {	1550	Effect.gen(function* () {
1507	if (input.targetSources.length === 0) {	1551	if (input.targetSources.length === 0) {
1508	return yield* runtimeEffectError("sources/source-auth-service", "Provider OAuth setup requires at least one target source");	1552	return yield* runtimeEffectError("sources/source-auth-service", "Provider OAuth setup requires at least one target source");
@@ -1512,9 +1556,9 @@ const startProviderOauthBatchCredentialSetup = (input: { · 3 unmodified lines
1512	const state = crypto.randomUUID();	1556	const state = crypto.randomUUID();
1513	const completionUrl = resolveWorkspaceProviderOauthCompleteUrl({	1557	const completionUrl = resolveWorkspaceProviderOauthCompleteUrl({
1514	baseUrl: input.baseUrl,	1558	baseUrl: input.baseUrl,
1515	workspaceId: input.workspaceId,	1559	scopeId: input.scopeId,
1516	});	1560	});
1517	const redirectMode = input.redirectModeOverride ?? input.workspaceOauthClient.redirectMode;	1561	const redirectMode = input.redirectModeOverride ?? input.scopeOauthClient.redirectMode;
1518	const redirectServer = redirectMode === "loopback"	1562	const redirectServer = redirectMode === "loopback"
1519	? yield* startOauthLoopbackRedirectServer({	1563	? yield* startOauthLoopbackRedirectServer({
1520	completionUrl,	1564	completionUrl,
@@ -1526,7 +1570,7 @@ const startProviderOauthBatchCredentialSetup = (input: { · 5 unmodified lines
1526	return yield* Effect.gen(function* () {	1570	return yield* Effect.gen(function* () {
1527	const authorizationUrl = buildOAuth2AuthorizationUrl({	1571	const authorizationUrl = buildOAuth2AuthorizationUrl({
1528	authorizationEndpoint: input.setupConfig.authorizationEndpoint,	1572	authorizationEndpoint: input.setupConfig.authorizationEndpoint,
1529	clientId: input.workspaceOauthClient.clientId,	1573	clientId: input.scopeOauthClient.clientId,
1530	redirectUri,	1574	redirectUri,
1531	scopes: [...normalizeScopes(input.setupConfig.scopes)],	1575	scopes: [...normalizeScopes(input.setupConfig.scopes)],
1532	state,	1576	state,
@@ -1537,9 +1581,9 @@ const startProviderOauthBatchCredentialSetup = (input: { · 4 unmodified lines
1537		1581
1538	yield* input.executorState.sourceAuthSessions.upsert({	1582	yield* input.executorState.sourceAuthSessions.upsert({
1539	id: sessionId,	1583	id: sessionId,
1540	workspaceId: input.workspaceId,	1584	scopeId: input.scopeId,
1541	sourceId: SourceIdSchema.make(`oauth_provider_${crypto.randomUUID()}`),	1585	sourceId: SourceIdSchema.make(`oauth_provider_${crypto.randomUUID()}`),
1542	actorAccountId: input.actorAccountId ?? null,	1586	actorScopeId: input.actorScopeId ?? null,
1543	credentialSlot: "runtime",	1587	credentialSlot: "runtime",
1544	executionId: input.executionId ?? null,	1588	executionId: input.executionId ?? null,
1545	interactionId: input.interactionId ?? null,	1589	interactionId: input.interactionId ?? null,
@@ -1552,7 +1596,7 @@ const startProviderOauthBatchCredentialSetup = (input: { · 6 unmodified lines
1552	authorizationEndpoint: input.setupConfig.authorizationEndpoint,	1596	authorizationEndpoint: input.setupConfig.authorizationEndpoint,
1553	tokenEndpoint: input.setupConfig.tokenEndpoint,	1597	tokenEndpoint: input.setupConfig.tokenEndpoint,
1554	redirectUri,	1598	redirectUri,
1555	oauthClientId: input.workspaceOauthClient.id,	1599	oauthClientId: input.scopeOauthClient.id,
1556	clientAuthentication: input.setupConfig.clientAuthentication,	1600	clientAuthentication: input.setupConfig.clientAuthentication,
1557	scopes: [...normalizeScopes(input.setupConfig.scopes)],	1601	scopes: [...normalizeScopes(input.setupConfig.scopes)],
1558	headerName: input.setupConfig.headerName,	1602	headerName: input.setupConfig.headerName,
@@ -1577,7 +1621,7 @@ const startProviderOauthBatchCredentialSetup = (input: { · 18 unmodified lines
1577	input.sourceStore,	1621	input.sourceStore,
1578	input.targetSources[0]!.source,	1622	input.targetSources[0]!.source,
1579	{	1623	{
1580	actorAccountId: input.actorAccountId,	1624	actorScopeId: input.actorScopeId,
1581	status: "auth_required",	1625	status: "auth_required",
1582	lastError: null,	1626	lastError: null,
1583	},	1627	},
@@ -1587,7 +1631,7 @@ const startProviderOauthBatchCredentialSetup = (input: { · 3 unmodified lines
1587	input.targetSources.slice(1),	1631	input.targetSources.slice(1),
1588	(target) =>	1632	(target) =>
1589	updateSourceStatus(input.sourceStore, target.source, {	1633	updateSourceStatus(input.sourceStore, target.source, {
1590	actorAccountId: input.actorAccountId,	1634	actorScopeId: input.actorScopeId,
1591	status: "auth_required",	1635	status: "auth_required",
1592	lastError: null,	1636	lastError: null,
1593	}).pipe(Effect.asVoid),	1637	}).pipe(Effect.asVoid),
@@ -1612,31 +1656,33 @@ const connectSourcesWithProviderRuntimeAuth = (input: { · 18 unmodified lines
1612	executorState: ExecutorStateStoreShape;	1656	executorState: ExecutorStateStoreShape;
1613	sourceStore: RuntimeSourceStore;	1657	sourceStore: RuntimeSourceStore;
1614	sourceCatalogSync: RuntimeSourceCatalogSyncShape;	1658	sourceCatalogSync: RuntimeSourceCatalogSyncShape;
1615	workspaceId: WorkspaceId;	1659	scopeId: ScopeId;
1616	actorAccountId?: AccountId \| null;	1660	actorScopeId?: ScopeId \| null;
1617	executionId?: SourceAuthSession["executionId"];	1661	executionId?: SourceAuthSession["executionId"];
1618	interactionId?: SourceAuthSession["interactionId"];	1662	interactionId?: SourceAuthSession["interactionId"];
1619	baseUrl?: string \| null;	1663	baseUrl?: string \| null;
1620	getLocalServerBaseUrl?: () => string \| undefined;	1664	getLocalServerBaseUrl?: () => string \| undefined;
1621	workspaceOauthClient: ResolvedWorkspaceOauthClient;	1665	scopeOauthClient: ResolvedScopeOauthClient;
1622	targets: ReadonlyArray<RuntimeProviderAuthTarget>;	1666	targets: ReadonlyArray<RuntimeProviderAuthTarget>;
1623	}): Effect.Effect<RuntimeProviderAuthResult, Error, WorkspaceStorageServices> =>	1667	localScopeState?: RuntimeLocalScopeState;
		1668	}): Effect.Effect<RuntimeProviderAuthResult, Error, ScopeStorageServices> =>
1624	Effect.gen(function* () {	1669	Effect.gen(function* () {
1625	const setupConfig = yield* mergeRuntimeProviderAuthSetupConfig(input.targets);	1670	const setupConfig = yield* mergeRuntimeProviderAuthSetupConfig(input.targets);
1626	const reusableGrant = yield* findReusableProviderGrant({	1671	const reusableGrant = yield* findReusableProviderGrant({
1627	executorState: input.executorState,	1672	executorState: input.executorState,
1628	workspaceId: input.workspaceId,	1673	scopeId: input.scopeId,
1629	actorAccountId: input.actorAccountId,	1674	actorScopeId: input.actorScopeId,
1630	providerKey: setupConfig.providerKey,	1675	providerKey: setupConfig.providerKey,
1631	oauthClientId: input.workspaceOauthClient.id,	1676	oauthClientId: input.scopeOauthClient.id,
1632	requiredScopes: setupConfig.scopes,	1677	requiredScopes: setupConfig.scopes,
		1678	localScopeState: input.localScopeState,
1633	});	1679	});
1634		1680
1635	if (Option.isSome(reusableGrant)) {	1681	if (Option.isSome(reusableGrant)) {
1636	const connectedSources = yield* attachProviderGrantToSources({	1682	const connectedSources = yield* attachProviderGrantToSources({
1637	sourceStore: input.sourceStore,	1683	sourceStore: input.sourceStore,
1638	sourceCatalogSync: input.sourceCatalogSync,	1684	sourceCatalogSync: input.sourceCatalogSync,
1639	actorAccountId: input.actorAccountId,	1685	actorScopeId: input.actorScopeId,
1640	grantId: reusableGrant.value.id,	1686	grantId: reusableGrant.value.id,
1641	providerKey: reusableGrant.value.providerKey,	1687	providerKey: reusableGrant.value.providerKey,
1642	headerName: reusableGrant.value.headerName,	1688	headerName: reusableGrant.value.headerName,
@@ -1665,13 +1711,13 @@ const connectSourcesWithProviderRuntimeAuth = (input: { · 22 unmodified lines
1665	const oauthRequired = yield* startProviderOauthBatchCredentialSetup({	1711	const oauthRequired = yield* startProviderOauthBatchCredentialSetup({
1666	executorState: input.executorState,	1712	executorState: input.executorState,
1667	sourceStore: input.sourceStore,	1713	sourceStore: input.sourceStore,
1668	workspaceId: input.workspaceId,	1714	scopeId: input.scopeId,
1669	actorAccountId: input.actorAccountId,	1715	actorScopeId: input.actorScopeId,
1670	executionId: input.executionId,	1716	executionId: input.executionId,
1671	interactionId: input.interactionId,	1717	interactionId: input.interactionId,
1672	baseUrl,	1718	baseUrl,
1673	redirectModeOverride: requestBaseUrl ? "app_callback" : undefined,	1719	redirectModeOverride: requestBaseUrl ? "app_callback" : undefined,
1674	workspaceOauthClient: input.workspaceOauthClient,	1720	scopeOauthClient: input.scopeOauthClient,
1675	setupConfig,	1721	setupConfig,
1676	targetSources: input.targets.map((target) => ({	1722	targetSources: input.targets.map((target) => ({
1677	source: target.source,	1723	source: target.source,
@@ -1683,9 +1729,9 @@ const connectSourcesWithProviderRuntimeAuth = (input: { · 5 unmodified lines
1683	input.targets,	1729	input.targets,
1684	(target) =>	1730	(target) =>
1685	input.sourceStore.loadSourceById({	1731	input.sourceStore.loadSourceById({
1686	workspaceId: target.source.workspaceId,	1732	scopeId: target.source.scopeId,
1687	sourceId: target.source.id,	1733	sourceId: target.source.id,
1688	actorAccountId: input.actorAccountId,	1734	actorScopeId: input.actorScopeId,
1689	}),	1735	}),
1690	{ discard: false },	1736	{ discard: false },
1691	);	1737	);
@@ -1701,7 +1747,7 @@ const connectSourcesWithProviderRuntimeAuth = (input: { · 9 unmodified lines
1701	const attachProviderGrantToSources = (input: {	1747	const attachProviderGrantToSources = (input: {
1702	sourceStore: RuntimeSourceStore;	1748	sourceStore: RuntimeSourceStore;
1703	sourceCatalogSync: RuntimeSourceCatalogSyncShape;	1749	sourceCatalogSync: RuntimeSourceCatalogSyncShape;
1704	actorAccountId?: AccountId \| null;	1750	actorScopeId?: ScopeId \| null;
1705	grantId: ProviderAuthGrant["id"];	1751	grantId: ProviderAuthGrant["id"];
1706	providerKey: string;	1752	providerKey: string;
1707	headerName: string;	1753	headerName: string;
@@ -1710,13 +1756,13 @@ const attachProviderGrantToSources = (input: { · 2 unmodified lines
1710	source: Source;	1756	source: Source;
1711	requiredScopes: ReadonlyArray<string>;	1757	requiredScopes: ReadonlyArray<string>;
1712	}>;	1758	}>;
1713	}): Effect.Effect<ReadonlyArray<Source>, Error, WorkspaceStorageServices> =>	1759	}): Effect.Effect<ReadonlyArray<Source>, Error, ScopeStorageServices> =>
1714	Effect.forEach(	1760	Effect.forEach(
1715	input.targets,	1761	input.targets,
1716	(target) =>	1762	(target) =>
1717	Effect.gen(function* () {	1763	Effect.gen(function* () {
1718	const connectedSource = yield* updateSourceStatus(input.sourceStore, target.source, {	1764	const connectedSource = yield* updateSourceStatus(input.sourceStore, target.source, {
1719	actorAccountId: input.actorAccountId,	1765	actorScopeId: input.actorScopeId,
1720	status: "connected",	1766	status: "connected",
1721	lastError: null,	1767	lastError: null,
1722	auth: {	1768	auth: {
@@ -1731,7 +1777,7 @@ const attachProviderGrantToSources = (input: { · 8 unmodified lines
1731		1777
1732	yield* input.sourceCatalogSync.sync({	1778	yield* input.sourceCatalogSync.sync({
1733	source: connectedSource,	1779	source: connectedSource,
1734	actorAccountId: input.actorAccountId,	1780	actorScopeId: input.actorScopeId,
1735	});	1781	});
1736		1782
1737	return connectedSource;	1783	return connectedSource;
@@ -1742,18 +1788,18 @@ const attachProviderGrantToSources = (input: { · 4 unmodified lines
1742	const removeProviderAuthGrantInternal = (input: {	1788	const removeProviderAuthGrantInternal = (input: {
1743	executorState: ExecutorStateStoreShape;	1789	executorState: ExecutorStateStoreShape;
1744	sourceStore: RuntimeSourceStore;	1790	sourceStore: RuntimeSourceStore;
1745	workspaceId: WorkspaceId;	1791	scopeId: ScopeId;
1746	grantId: ProviderAuthGrant["id"];	1792	grantId: ProviderAuthGrant["id"];
1747	deleteSecretMaterial: DeleteSecretMaterial;	1793	deleteSecretMaterial: DeleteSecretMaterial;
1748	}): Effect.Effect<boolean, Error, WorkspaceStorageServices> =>	1794	}): Effect.Effect<boolean, Error, ScopeStorageServices> =>
1749	Effect.gen(function* () {	1795	Effect.gen(function* () {
1750	const grantOption = yield* input.executorState.providerAuthGrants.getById(input.grantId);	1796	const grantOption = yield* input.executorState.providerAuthGrants.getById(input.grantId);
1751	if (Option.isNone(grantOption) \|\| grantOption.value.workspaceId !== input.workspaceId) {	1797	if (Option.isNone(grantOption) \|\| grantOption.value.scopeId !== input.scopeId) {
1752	return false;	1798	return false;
1753	}	1799	}
1754		1800
1755	const references = yield* listProviderGrantRefArtifacts(input.executorState, {	1801	const references = yield* listProviderGrantRefArtifacts(input.executorState, {
1756	workspaceId: input.workspaceId,	1802	scopeId: input.scopeId,
1757	grantId: input.grantId,	1803	grantId: input.grantId,
1758	});	1804	});
1759		1805
@@ -1762,9 +1808,9 @@ const removeProviderAuthGrantInternal = (input: { · 2 unmodified lines
1762	(artifact) =>	1808	(artifact) =>
1763	Effect.gen(function* () {	1809	Effect.gen(function* () {
1764	const latestSource = yield* input.sourceStore.loadSourceById({	1810	const latestSource = yield* input.sourceStore.loadSourceById({
1765	workspaceId: artifact.workspaceId,	1811	scopeId: artifact.scopeId,
1766	sourceId: artifact.sourceId,	1812	sourceId: artifact.sourceId,
1767	actorAccountId: artifact.actorAccountId,	1813	actorScopeId: artifact.actorScopeId,
1768	}).pipe(	1814	}).pipe(
1769	Effect.catchAll(() => Effect.succeed(null)),	1815	Effect.catchAll(() => Effect.succeed(null)),
1770	);	1816	);
@@ -1773,10 +1819,10 @@ const removeProviderAuthGrantInternal = (input: { · 2 unmodified lines
1773	yield* removeAuthLeaseAndSecrets(input.executorState, {	1819	yield* removeAuthLeaseAndSecrets(input.executorState, {
1774	authArtifactId: artifact.id,	1820	authArtifactId: artifact.id,
1775	}, input.deleteSecretMaterial);	1821	}, input.deleteSecretMaterial);
1776	yield* input.executorState.authArtifacts.removeByWorkspaceSourceAndActor({	1822	yield* input.executorState.authArtifacts.removeByScopeSourceAndActor({
1777	workspaceId: artifact.workspaceId,	1823	scopeId: artifact.scopeId,
1778	sourceId: artifact.sourceId,	1824	sourceId: artifact.sourceId,
1779	actorAccountId: artifact.actorAccountId,	1825	actorScopeId: artifact.actorScopeId,
1780	slot: artifact.slot,	1826	slot: artifact.slot,
1781	});	1827	});
1782	return;	1828	return;
@@ -1790,7 +1836,7 @@ const removeProviderAuthGrantInternal = (input: { · 7 unmodified lines
1790	importAuth: artifact.slot === "import" ? { kind: "none" } : latestSource.importAuth,	1836	importAuth: artifact.slot === "import" ? { kind: "none" } : latestSource.importAuth,
1791	updatedAt: Date.now(),	1837	updatedAt: Date.now(),
1792	}, {	1838	}, {
1793	actorAccountId: artifact.actorAccountId,	1839	actorScopeId: artifact.actorScopeId,
1794	}).pipe(Effect.asVoid);	1840	}).pipe(Effect.asVoid);
1795	}),	1841	}),
1796	{ discard: true },	1842	{ discard: true },
@@ -1809,8 +1855,8 @@ const connectMcpSourceInternal = (input: { · 12 unmodified lines
1809	sourceCatalogSync: RuntimeSourceCatalogSyncShape;	1855	sourceCatalogSync: RuntimeSourceCatalogSyncShape;
1810	getLocalServerBaseUrl?: () => string \| undefined;	1856	getLocalServerBaseUrl?: () => string \| undefined;
1811	baseUrl?: string \| null;	1857	baseUrl?: string \| null;
1812	workspaceId: WorkspaceId;	1858	scopeId: ScopeId;
1813	actorAccountId?: AccountId \| null;	1859	actorScopeId?: ScopeId \| null;
1814	sourceId?: Source["id"] \| null;	1860	sourceId?: Source["id"] \| null;
1815	executionId?: SourceAuthSession["executionId"];	1861	executionId?: SourceAuthSession["executionId"];
1816	interactionId?: SourceAuthSession["interactionId"];	1862	interactionId?: SourceAuthSession["interactionId"];
@@ -1827,7 +1873,7 @@ const connectMcpSourceInternal = (input: { · 10 unmodified lines
1827	cwd?: string \| null;	1873	cwd?: string \| null;
1828	mcpDiscoveryElicitation?: McpDiscoveryElicitationContext;	1874	mcpDiscoveryElicitation?: McpDiscoveryElicitationContext;
1829	resolveSecretMaterial: ResolveSecretMaterial;	1875	resolveSecretMaterial: ResolveSecretMaterial;
1830	}): Effect.Effect<McpSourceConnectResult, Error, WorkspaceStorageServices> =>	1876	}): Effect.Effect<McpSourceConnectResult, Error, ScopeStorageServices> =>
1831	Effect.gen(function* () {	1877	Effect.gen(function* () {
1832	const lookupEndpoint = input.sourceId	1878	const lookupEndpoint = input.sourceId
1833	? null	1879	? null
@@ -1840,9 +1886,9 @@ const connectMcpSourceInternal = (input: { · 6 unmodified lines
1840	const existing = yield* (	1886	const existing = yield* (
1841	input.sourceId	1887	input.sourceId
1842	? input.sourceStore.loadSourceById({	1888	? input.sourceStore.loadSourceById({
1843	workspaceId: input.workspaceId,	1889	scopeId: input.scopeId,
1844	sourceId: input.sourceId,	1890	sourceId: input.sourceId,
1845	actorAccountId: input.actorAccountId,	1891	actorScopeId: input.actorScopeId,
1846	}).pipe(	1892	}).pipe(
1847	Effect.flatMap((source) =>	1893	Effect.flatMap((source) =>
1848	sourceAdapterRequiresInteractiveConnect(source.kind)	1894	sourceAdapterRequiresInteractiveConnect(source.kind)
@@ -1850,8 +1896,8 @@ const connectMcpSourceInternal = (input: { · 1 unmodified line
1850	: Effect.fail(runtimeEffectError("sources/source-auth-service", `Expected MCP source, received ${source.kind}`)),	1896	: Effect.fail(runtimeEffectError("sources/source-auth-service", `Expected MCP source, received ${source.kind}`)),
1851	),	1897	),
1852	)	1898	)
1853	: input.sourceStore.loadSourcesInWorkspace(input.workspaceId, {	1899	: input.sourceStore.loadSourcesInScope(input.scopeId, {
1854	actorAccountId: input.actorAccountId,	1900	actorScopeId: input.actorScopeId,
1855	}).pipe(	1901	}).pipe(
1856	Effect.map((sources) =>	1902	Effect.map((sources) =>
1857	sources.find(	1903	sources.find(
@@ -1943,7 +1989,7 @@ const connectMcpSourceInternal = (input: { · 85 unmodified lines
1943	now,	1989	now,
1944	})	1990	})
1945	: yield* createSourceFromPayload({	1991	: yield* createSourceFromPayload({
1946	workspaceId: input.workspaceId,	1992	scopeId: input.scopeId,
1947	sourceId: SourceIdSchema.make(`src_${crypto.randomUUID()}`),	1993	sourceId: SourceIdSchema.make(`src_${crypto.randomUUID()}`),
1948	payload: {	1994	payload: {
1949	name: chosenName,	1995	name: chosenName,
@@ -1969,11 +2015,11 @@ const connectMcpSourceInternal = (input: { · 19 unmodified lines
1969	});	2015	});
1970		2016
1971	const persistedDraft = yield* input.sourceStore.persistSource(draftSource, {	2017	const persistedDraft = yield* input.sourceStore.persistSource(draftSource, {
1972	actorAccountId: input.actorAccountId,	2018	actorScopeId: input.actorScopeId,
1973	});	2019	});
1974	yield* input.sourceCatalogSync.sync({	2020	yield* input.sourceCatalogSync.sync({
1975	source: persistedDraft,	2021	source: persistedDraft,
1976	actorAccountId: input.actorAccountId,	2022	actorScopeId: input.actorScopeId,
1977	});	2023	});
1978		2024
1979	const discovered = yield* Effect.either(	2025	const discovered = yield* Effect.either(
@@ -1988,7 +2034,7 @@ const connectMcpSourceInternal = (input: { · 8 unmodified lines
1988	onRight: (result) =>	2034	onRight: (result) =>
1989	Effect.gen(function* () {	2035	Effect.gen(function* () {
1990	const connected = yield* updateSourceStatus(input.sourceStore, persistedDraft, {	2036	const connected = yield* updateSourceStatus(input.sourceStore, persistedDraft, {
1991	actorAccountId: input.actorAccountId,	2037	actorScopeId: input.actorScopeId,
1992	status: "connected",	2038	status: "connected",
1993	lastError: null,	2039	lastError: null,
1994	auth: { kind: "none" },	2040	auth: { kind: "none" },
@@ -2003,7 +2049,7 @@ const connectMcpSourceInternal = (input: { · 8 unmodified lines
2003	return yield* Either.match(indexed, {	2049	return yield* Either.match(indexed, {
2004	onLeft: (error) =>	2050	onLeft: (error) =>
2005	updateSourceStatus(input.sourceStore, connected, {	2051	updateSourceStatus(input.sourceStore, connected, {
2006	actorAccountId: input.actorAccountId,	2052	actorScopeId: input.actorScopeId,
2007	status: "error",	2053	status: "error",
2008	lastError: error.message,	2054	lastError: error.message,
2009	}).pipe(	2055	}).pipe(
@@ -2031,7 +2077,7 @@ const connectMcpSourceInternal = (input: { · 21 unmodified lines
2031	const state = crypto.randomUUID();	2077	const state = crypto.randomUUID();
2032	const redirectUrl = resolveSourceCredentialOauthCompleteUrl({	2078	const redirectUrl = resolveSourceCredentialOauthCompleteUrl({
2033	baseUrl: localServerBaseUrl,	2079	baseUrl: localServerBaseUrl,
2034	workspaceId: input.workspaceId,	2080	scopeId: input.scopeId,
2035	sourceId: persistedDraft.id,	2081	sourceId: persistedDraft.id,
2036	});	2082	});
2037	const oauthStart = yield* startMcpOAuthAuthorization({	2083	const oauthStart = yield* startMcpOAuthAuthorization({
@@ -2041,7 +2087,7 @@ const connectMcpSourceInternal = (input: { · 3 unmodified lines
2041	});	2087	});
2042		2088
2043	const authRequiredSource = yield* updateSourceStatus(input.sourceStore, persistedDraft, {	2089	const authRequiredSource = yield* updateSourceStatus(input.sourceStore, persistedDraft, {
2044	actorAccountId: input.actorAccountId,	2090	actorScopeId: input.actorScopeId,
2045	status: "auth_required",	2091	status: "auth_required",
2046	lastError: null,	2092	lastError: null,
2047	});	2093	});
@@ -2049,9 +2095,9 @@ const connectMcpSourceInternal = (input: { · 1 unmodified line
2049	const sessionNow = Date.now();	2095	const sessionNow = Date.now();
2050	yield* input.executorState.sourceAuthSessions.upsert({	2096	yield* input.executorState.sourceAuthSessions.upsert({
2051	id: sessionId,	2097	id: sessionId,
2052	workspaceId: input.workspaceId,	2098	scopeId: input.scopeId,
2053	sourceId: authRequiredSource.id,	2099	sourceId: authRequiredSource.id,
2054	actorAccountId: input.actorAccountId ?? null,	2100	actorScopeId: input.actorScopeId ?? null,
2055	credentialSlot: "runtime",	2101	credentialSlot: "runtime",
2056	executionId: input.executionId ?? null,	2102	executionId: input.executionId ?? null,
2057	interactionId: input.interactionId ?? null,	2103	interactionId: input.interactionId ?? null,
@@ -2095,16 +2141,17 @@ const addExecutorHttpSource = (input: { · 37 unmodified lines
2095	resolveSecretMaterial: ResolveSecretMaterial;	2141	resolveSecretMaterial: ResolveSecretMaterial;
2096	getLocalServerBaseUrl?: () => string \| undefined;	2142	getLocalServerBaseUrl?: () => string \| undefined;
2097	baseUrl?: string \| null;	2143	baseUrl?: string \| null;
2098	}): Effect.Effect<ExecutorSourceAddResult, Error, WorkspaceStorageServices> =>	2144	localScopeState?: RuntimeLocalScopeState;
		2145	}): Effect.Effect<ExecutorSourceAddResult, Error, ScopeStorageServices> =>
2099	Effect.gen(function* () {	2146	Effect.gen(function* () {
2100	const normalizedEndpoint = normalizeEndpoint(input.sourceInput.endpoint);	2147	const normalizedEndpoint = normalizeEndpoint(input.sourceInput.endpoint);
2101	const normalizedSpecUrl = input.sourceInput.kind === "openapi"	2148	const normalizedSpecUrl = input.sourceInput.kind === "openapi"
2102	? normalizeEndpoint(input.sourceInput.specUrl)	2149	? normalizeEndpoint(input.sourceInput.specUrl)
2103	: null;	2150	: null;
2104	const existingSources = yield* input.sourceStore.loadSourcesInWorkspace(	2151	const existingSources = yield* input.sourceStore.loadSourcesInScope(
2105	input.sourceInput.workspaceId,	2152	input.sourceInput.scopeId,
2106	{	2153	{
2107	actorAccountId: input.sourceInput.actorAccountId,	2154	actorScopeId: input.sourceInput.actorScopeId,
2108	},	2155	},
2109	);	2156	);
2110	const existing = existingSources.find((source) => {	2157	const existing = existingSources.find((source) => {
@@ -2175,7 +2222,7 @@ const addExecutorHttpSource = (input: { · 64 unmodified lines
2175	now,	2222	now,
2176	})	2223	})
2177	: yield* createSourceFromPayload({	2224	: yield* createSourceFromPayload({
2178	workspaceId: input.sourceInput.workspaceId,	2225	scopeId: input.sourceInput.scopeId,
2179	sourceId: SourceIdSchema.make(`src_${crypto.randomUUID()}`),	2226	sourceId: SourceIdSchema.make(`src_${crypto.randomUUID()}`),
2180	payload: {	2227	payload: {
2181	name: chosenName,	2228	name: chosenName,
@@ -2200,7 +2247,7 @@ const addExecutorHttpSource = (input: { · 18 unmodified lines
2200	});	2247	});
2201		2248
2202	const persistedDraft = yield* input.sourceStore.persistSource(draftSource, {	2249	const persistedDraft = yield* input.sourceStore.persistSource(draftSource, {
2203	actorAccountId: input.sourceInput.actorAccountId,	2250	actorScopeId: input.sourceInput.actorScopeId,
2204	});	2251	});
2205		2252
2206	if (shouldPromptForExecutorHttpRuntimeCredentialSetup({	2253	if (shouldPromptForExecutorHttpRuntimeCredentialSetup({
@@ -2215,7 +2262,7 @@ const addExecutorHttpSource = (input: { · 8 unmodified lines
2215	executorState: input.executorState,	2262	executorState: input.executorState,
2216	sourceStore: input.sourceStore,	2263	sourceStore: input.sourceStore,
2217	source: persistedDraft,	2264	source: persistedDraft,
2218	actorAccountId: input.sourceInput.actorAccountId,	2265	actorScopeId: input.sourceInput.actorScopeId,
2219	executionId: input.sourceInput.executionId,	2266	executionId: input.sourceInput.executionId,
2220	interactionId: input.sourceInput.interactionId,	2267	interactionId: input.sourceInput.interactionId,
2221	baseUrl,	2268	baseUrl,
@@ -2228,7 +2275,7 @@ const addExecutorHttpSource = (input: { · 6 unmodified lines
2228	}	2275	}
2229		2276
2230	const authRequiredSource = yield* updateSourceStatus(input.sourceStore, persistedDraft, {	2277	const authRequiredSource = yield* updateSourceStatus(input.sourceStore, persistedDraft, {
2231	actorAccountId: input.sourceInput.actorAccountId,	2278	actorScopeId: input.sourceInput.actorScopeId,
2232	status: "auth_required",	2279	status: "auth_required",
2233	lastError: null,	2280	lastError: null,
2234	});	2281	});
@@ -2246,7 +2293,7 @@ const addExecutorHttpSource = (input: { · 11 unmodified lines
2246	...persistedDraft,	2293	...persistedDraft,
2247	status: "connected",	2294	status: "connected",
2248	},	2295	},
2249	actorAccountId: input.sourceInput.actorAccountId,	2296	actorScopeId: input.sourceInput.actorScopeId,
2250	}),	2297	}),
2251	);	2298	);
2252		2299
@@ -2254,7 +2301,7 @@ const addExecutorHttpSource = (input: { · 1 unmodified line
2254	onLeft: (error) =>	2301	onLeft: (error) =>
2255	isSourceCredentialRequiredError(error)	2302	isSourceCredentialRequiredError(error)
2256	? updateSourceStatus(input.sourceStore, persistedDraft, {	2303	? updateSourceStatus(input.sourceStore, persistedDraft, {
2257	actorAccountId: input.sourceInput.actorAccountId,	2304	actorScopeId: input.sourceInput.actorScopeId,
2258	status: "auth_required",	2305	status: "auth_required",
2259	lastError: null,	2306	lastError: null,
2260	}).pipe(	2307	}).pipe(
@@ -2267,7 +2314,7 @@ const addExecutorHttpSource = (input: { · 6 unmodified lines
2267	),	2314	),
2268	)	2315	)
2269	: updateSourceStatus(input.sourceStore, persistedDraft, {	2316	: updateSourceStatus(input.sourceStore, persistedDraft, {
2270	actorAccountId: input.sourceInput.actorAccountId,	2317	actorScopeId: input.sourceInput.actorScopeId,
2271	status: "error",	2318	status: "error",
2272	lastError: error.message,	2319	lastError: error.message,
2273	}).pipe(	2320	}).pipe(
@@ -2275,7 +2322,7 @@ const addExecutorHttpSource = (input: { · 1 unmodified line
2275	),	2322	),
2276	onRight: () =>	2323	onRight: () =>
2277	updateSourceStatus(input.sourceStore, persistedDraft, {	2324	updateSourceStatus(input.sourceStore, persistedDraft, {
2278	actorAccountId: input.sourceInput.actorAccountId,	2325	actorScopeId: input.sourceInput.actorScopeId,
2279	status: "connected",	2326	status: "connected",
2280	lastError: null,	2327	lastError: null,
2281	}).pipe(	2328	}).pipe(
@@ -2308,7 +2355,8 @@ const addExecutorGoogleDiscoverySource = (input: { · 26 unmodified lines
2308	resolveSecretMaterial: ResolveSecretMaterial;	2355	resolveSecretMaterial: ResolveSecretMaterial;
2309	getLocalServerBaseUrl?: () => string \| undefined;	2356	getLocalServerBaseUrl?: () => string \| undefined;
2310	baseUrl?: string \| null;	2357	baseUrl?: string \| null;
2311	}): Effect.Effect<ExecutorSourceAddResult, Error, WorkspaceStorageServices> =>	2358	localScopeState?: RuntimeLocalScopeState;
		2359	}): Effect.Effect<ExecutorSourceAddResult, Error, ScopeStorageServices> =>
2312	Effect.gen(function* () {	2360	Effect.gen(function* () {
2313	const normalizedService = input.sourceInput.service.trim();	2361	const normalizedService = input.sourceInput.service.trim();
2314	const normalizedVersion = input.sourceInput.version.trim();	2362	const normalizedVersion = input.sourceInput.version.trim();
@@ -2316,10 +2364,10 @@ const addExecutorGoogleDiscoverySource = (input: { · 1 unmodified line
2316	trimOrNull(input.sourceInput.discoveryUrl)	2364	trimOrNull(input.sourceInput.discoveryUrl)
2317	?? defaultGoogleDiscoveryUrl(normalizedService, normalizedVersion),	2365	?? defaultGoogleDiscoveryUrl(normalizedService, normalizedVersion),
2318	);	2366	);
2319	const existingSources = yield* input.sourceStore.loadSourcesInWorkspace(	2367	const existingSources = yield* input.sourceStore.loadSourcesInScope(
2320	input.sourceInput.workspaceId,	2368	input.sourceInput.scopeId,
2321	{	2369	{
2322	actorAccountId: input.sourceInput.actorAccountId,	2370	actorScopeId: input.sourceInput.actorScopeId,
2323	},	2371	},
2324	);	2372	);
2325	const existing = existingSources.find((source) => {	2373	const existing = existingSources.find((source) => {
@@ -2397,7 +2445,7 @@ const addExecutorGoogleDiscoverySource = (input: { · 71 unmodified lines
2397	now,	2445	now,
2398	})	2446	})
2399	: yield* createSourceFromPayload({	2447	: yield* createSourceFromPayload({
2400	workspaceId: input.sourceInput.workspaceId,	2448	scopeId: input.sourceInput.scopeId,
2401	sourceId: SourceIdSchema.make(`src_${crypto.randomUUID()}`),	2449	sourceId: SourceIdSchema.make(`src_${crypto.randomUUID()}`),
2402	payload: {	2450	payload: {
2403	name: chosenName,	2451	name: chosenName,
@@ -2421,7 +2469,7 @@ const addExecutorGoogleDiscoverySource = (input: { · 17 unmodified lines
2421	});	2469	});
2422		2470
2423	const persistedDraft = yield* input.sourceStore.persistSource(draftSource, {	2471	const persistedDraft = yield* input.sourceStore.persistSource(draftSource, {
2424	actorAccountId: input.sourceInput.actorAccountId,	2472	actorScopeId: input.sourceInput.actorScopeId,
2425	});	2473	});
2426	const googleAdapter = getSourceAdapterForSource(persistedDraft);	2474	const googleAdapter = getSourceAdapterForSource(persistedDraft);
2427	const providerAuthTarget = yield* resolveRuntimeProviderAuthTarget(persistedDraft);	2475	const providerAuthTarget = yield* resolveRuntimeProviderAuthTarget(persistedDraft);
@@ -2431,18 +2479,19 @@ const addExecutorGoogleDiscoverySource = (input: { · 3 unmodified lines
2431	&& input.sourceInput.auth === undefined	2479	&& input.sourceInput.auth === undefined
2432	&& persistedDraft.auth.kind === "none"	2480	&& persistedDraft.auth.kind === "none"
2433	) {	2481	) {
2434	let workspaceOauthClient: ResolvedWorkspaceOauthClient \| null = null;	2482	let scopeOauthClient: ResolvedScopeOauthClient \| null = null;
2435	if (input.sourceInput.workspaceOauthClientId) {	2483	if (input.sourceInput.scopeOauthClientId) {
2436	workspaceOauthClient = yield* resolveWorkspaceOauthClientById({	2484	scopeOauthClient = yield* resolveScopeOauthClientById({
2437	executorState: input.executorState,	2485	executorState: input.executorState,
2438	workspaceId: persistedDraft.workspaceId,	2486	scopeId: persistedDraft.scopeId,
2439	oauthClientId: input.sourceInput.workspaceOauthClientId,	2487	oauthClientId: input.sourceInput.scopeOauthClientId,
2440	providerKey: providerAuthTarget.setupConfig.providerKey,	2488	providerKey: providerAuthTarget.setupConfig.providerKey,
		2489	localScopeState: input.localScopeState,
2441	});	2490	});
2442	} else if (input.sourceInput.oauthClient) {	2491	} else if (input.sourceInput.oauthClient) {
2443	workspaceOauthClient = yield* createWorkspaceOauthClient({	2492	scopeOauthClient = yield* createScopeOauthClient({
2444	executorState: input.executorState,	2493	executorState: input.executorState,
2445	workspaceId: persistedDraft.workspaceId,	2494	scopeId: persistedDraft.scopeId,
2446	providerKey: providerAuthTarget.setupConfig.providerKey,	2495	providerKey: providerAuthTarget.setupConfig.providerKey,
2447	oauthClient: input.sourceInput.oauthClient,	2496	oauthClient: input.sourceInput.oauthClient,
2448	label: `${chosenName} OAuth Client`,	2497	label: `${chosenName} OAuth Client`,
@@ -2451,7 +2500,7 @@ const addExecutorGoogleDiscoverySource = (input: { · 2 unmodified lines
2451	});	2500	});
2452	}	2501	}
2453		2502
2454	if (workspaceOauthClient === null) {	2503	if (scopeOauthClient === null) {
2455	return yield* runtimeEffectError(	2504	return yield* runtimeEffectError(
2456	"sources/source-auth-service",	2505	"sources/source-auth-service",
2457	`${providerAuthTarget.setupConfig.providerKey} shared auth requires a workspace OAuth client`,	2506	`${providerAuthTarget.setupConfig.providerKey} shared auth requires a workspace OAuth client`,
@@ -2462,14 +2511,15 @@ const addExecutorGoogleDiscoverySource = (input: { · 4 unmodified lines
2462	executorState: input.executorState,	2511	executorState: input.executorState,
2463	sourceStore: input.sourceStore,	2512	sourceStore: input.sourceStore,
2464	sourceCatalogSync: input.sourceCatalogSync,	2513	sourceCatalogSync: input.sourceCatalogSync,
2465	workspaceId: persistedDraft.workspaceId,	2514	scopeId: persistedDraft.scopeId,
2466	actorAccountId: input.sourceInput.actorAccountId,	2515	actorScopeId: input.sourceInput.actorScopeId,
2467	executionId: input.sourceInput.executionId,	2516	executionId: input.sourceInput.executionId,
2468	interactionId: input.sourceInput.interactionId,	2517	interactionId: input.sourceInput.interactionId,
2469	baseUrl: input.baseUrl,	2518	baseUrl: input.baseUrl,
2470	getLocalServerBaseUrl: input.getLocalServerBaseUrl,	2519	getLocalServerBaseUrl: input.getLocalServerBaseUrl,
2471	workspaceOauthClient,	2520	scopeOauthClient,
2472	targets: [providerAuthTarget],	2521	targets: [providerAuthTarget],
		2522	localScopeState: input.localScopeState,
2473	});	2523	});
2474		2524
2475	return providerAuthResult.kind === "connected"	2525	return providerAuthResult.kind === "connected"
@@ -2507,7 +2557,7 @@ const addExecutorGoogleDiscoverySource = (input: { · 31 unmodified lines
2507	executorState: input.executorState,	2557	executorState: input.executorState,
2508	sourceStore: input.sourceStore,	2558	sourceStore: input.sourceStore,
2509	source: persistedDraft,	2559	source: persistedDraft,
2510	actorAccountId: input.sourceInput.actorAccountId,	2560	actorScopeId: input.sourceInput.actorScopeId,
2511	executionId: input.sourceInput.executionId,	2561	executionId: input.sourceInput.executionId,
2512	interactionId: input.sourceInput.interactionId,	2562	interactionId: input.sourceInput.interactionId,
2513	baseUrl,	2563	baseUrl,
@@ -2520,7 +2570,7 @@ const addExecutorGoogleDiscoverySource = (input: { · 6 unmodified lines
2520	}	2570	}
2521		2571
2522	const authRequiredSource = yield* updateSourceStatus(input.sourceStore, persistedDraft, {	2572	const authRequiredSource = yield* updateSourceStatus(input.sourceStore, persistedDraft, {
2523	actorAccountId: input.sourceInput.actorAccountId,	2573	actorScopeId: input.sourceInput.actorScopeId,
2524	status: "auth_required",	2574	status: "auth_required",
2525	lastError: null,	2575	lastError: null,
2526	});	2576	});
@@ -2538,7 +2588,7 @@ const addExecutorGoogleDiscoverySource = (input: { · 11 unmodified lines
2538	...persistedDraft,	2588	...persistedDraft,
2539	status: "connected",	2589	status: "connected",
2540	},	2590	},
2541	actorAccountId: input.sourceInput.actorAccountId,	2591	actorScopeId: input.sourceInput.actorScopeId,
2542	}),	2592	}),
2543	);	2593	);
2544		2594
@@ -2546,7 +2596,7 @@ const addExecutorGoogleDiscoverySource = (input: { · 1 unmodified line
2546	onLeft: (error) =>	2596	onLeft: (error) =>
2547	isSourceCredentialRequiredError(error)	2597	isSourceCredentialRequiredError(error)
2548	? updateSourceStatus(input.sourceStore, persistedDraft, {	2598	? updateSourceStatus(input.sourceStore, persistedDraft, {
2549	actorAccountId: input.sourceInput.actorAccountId,	2599	actorScopeId: input.sourceInput.actorScopeId,
2550	status: "auth_required",	2600	status: "auth_required",
2551	lastError: null,	2601	lastError: null,
2552	}).pipe(	2602	}).pipe(
@@ -2559,7 +2609,7 @@ const addExecutorGoogleDiscoverySource = (input: { · 6 unmodified lines
2559	),	2609	),
2560	)	2610	)
2561	: updateSourceStatus(input.sourceStore, persistedDraft, {	2611	: updateSourceStatus(input.sourceStore, persistedDraft, {
2562	actorAccountId: input.sourceInput.actorAccountId,	2612	actorScopeId: input.sourceInput.actorScopeId,
2563	status: "error",	2613	status: "error",
2564	lastError: error.message,	2614	lastError: error.message,
2565	}).pipe(	2615	}).pipe(
@@ -2567,7 +2617,7 @@ const addExecutorGoogleDiscoverySource = (input: { · 1 unmodified line
2567	),	2617	),
2568	onRight: () =>	2618	onRight: () =>
2569	updateSourceStatus(input.sourceStore, persistedDraft, {	2619	updateSourceStatus(input.sourceStore, persistedDraft, {
2570	actorAccountId: input.sourceInput.actorAccountId,	2620	actorScopeId: input.sourceInput.actorScopeId,
2571	status: "connected",	2621	status: "connected",
2572	lastError: null,	2622	lastError: null,
2573	}).pipe(	2623	}).pipe(
@@ -2587,16 +2637,17 @@ const connectGoogleDiscoveryBatchInternal = (input: { · 13 unmodified lines
2587	sourceCatalogSync: RuntimeSourceCatalogSyncShape;	2637	sourceCatalogSync: RuntimeSourceCatalogSyncShape;
2588	sourceInput: ConnectGoogleDiscoveryBatchInput;	2638	sourceInput: ConnectGoogleDiscoveryBatchInput;
2589	getLocalServerBaseUrl?: () => string \| undefined;	2639	getLocalServerBaseUrl?: () => string \| undefined;
2590	}): Effect.Effect<ConnectGoogleDiscoveryBatchResult, Error, WorkspaceStorageServices> =>	2640	localScopeState?: RuntimeLocalScopeState;
		2641	}): Effect.Effect<ConnectGoogleDiscoveryBatchResult, Error, ScopeStorageServices> =>
2591	Effect.gen(function* () {	2642	Effect.gen(function* () {
2592	if (input.sourceInput.sources.length === 0) {	2643	if (input.sourceInput.sources.length === 0) {
2593	return yield* runtimeEffectError("sources/source-auth-service", "Google batch connect requires at least one source");	2644	return yield* runtimeEffectError("sources/source-auth-service", "Google batch connect requires at least one source");
2594	}	2645	}
2595		2646
2596	const existingSources = yield* input.sourceStore.loadSourcesInWorkspace(	2647	const existingSources = yield* input.sourceStore.loadSourcesInScope(
2597	input.sourceInput.workspaceId,	2648	input.sourceInput.scopeId,
2598	{	2649	{
2599	actorAccountId: input.sourceInput.actorAccountId,	2650	actorScopeId: input.sourceInput.actorScopeId,
2600	},	2651	},
2601	);	2652	);
2602		2653
@@ -2664,7 +2715,7 @@ const connectGoogleDiscoveryBatchInternal = (input: { · 61 unmodified lines
2664	now,	2715	now,
2665	})	2716	})
2666	: yield* createSourceFromPayload({	2717	: yield* createSourceFromPayload({
2667	workspaceId: input.sourceInput.workspaceId,	2718	scopeId: input.sourceInput.scopeId,
2668	sourceId: SourceIdSchema.make(`src_${crypto.randomUUID()}`),	2719	sourceId: SourceIdSchema.make(`src_${crypto.randomUUID()}`),
2669	payload: {	2720	payload: {
2670	name: chosenName,	2721	name: chosenName,
@@ -2688,7 +2739,7 @@ const connectGoogleDiscoveryBatchInternal = (input: { · 17 unmodified lines
2688	});	2739	});
2689		2740
2690	const persistedDraft = yield* input.sourceStore.persistSource(draftSource, {	2741	const persistedDraft = yield* input.sourceStore.persistSource(draftSource, {
2691	actorAccountId: input.sourceInput.actorAccountId,	2742	actorScopeId: input.sourceInput.actorScopeId,
2692	});	2743	});
2693	const providerAuthTarget = yield* resolveRuntimeProviderAuthTarget(persistedDraft);	2744	const providerAuthTarget = yield* resolveRuntimeProviderAuthTarget(persistedDraft);
2694	if (providerAuthTarget === null) {	2745	if (providerAuthTarget === null) {
@@ -2700,28 +2751,30 @@ const connectGoogleDiscoveryBatchInternal = (input: { · 5 unmodified lines
2700	{ discard: false },	2751	{ discard: false },
2701	);	2752	);
2702		2753
2703	const workspaceOauthClient = yield* resolveWorkspaceOauthClientById({	2754	const scopeOauthClient = yield* resolveScopeOauthClientById({
2704	executorState: input.executorState,	2755	executorState: input.executorState,
2705	workspaceId: input.sourceInput.workspaceId,	2756	scopeId: input.sourceInput.scopeId,
2706	oauthClientId: input.sourceInput.workspaceOauthClientId,	2757	oauthClientId: input.sourceInput.scopeOauthClientId,
2707	providerKey: persistedTargets[0]!.setupConfig.providerKey,	2758	providerKey: persistedTargets[0]!.setupConfig.providerKey,
		2759	localScopeState: input.localScopeState,
2708	});	2760	});
2709	if (workspaceOauthClient === null) {	2761	if (scopeOauthClient === null) {
2710	return yield* runtimeEffectError("sources/source-auth-service", `Workspace OAuth client not found: ${input.sourceInput.workspaceOauthClientId}`);	2762	return yield* runtimeEffectError("sources/source-auth-service", `Scope OAuth client not found: ${input.sourceInput.scopeOauthClientId}`);
2711	}	2763	}
2712		2764
2713	const providerAuthResult = yield* connectSourcesWithProviderRuntimeAuth({	2765	const providerAuthResult = yield* connectSourcesWithProviderRuntimeAuth({
2714	executorState: input.executorState,	2766	executorState: input.executorState,
2715	sourceStore: input.sourceStore,	2767	sourceStore: input.sourceStore,
2716	sourceCatalogSync: input.sourceCatalogSync,	2768	sourceCatalogSync: input.sourceCatalogSync,
2717	workspaceId: input.sourceInput.workspaceId,	2769	scopeId: input.sourceInput.scopeId,
2718	actorAccountId: input.sourceInput.actorAccountId,	2770	actorScopeId: input.sourceInput.actorScopeId,
2719	executionId: input.sourceInput.executionId,	2771	executionId: input.sourceInput.executionId,
2720	interactionId: input.sourceInput.interactionId,	2772	interactionId: input.sourceInput.interactionId,
2721	baseUrl: input.sourceInput.baseUrl,	2773	baseUrl: input.sourceInput.baseUrl,
2722	getLocalServerBaseUrl: input.getLocalServerBaseUrl,	2774	getLocalServerBaseUrl: input.getLocalServerBaseUrl,
2723	workspaceOauthClient,	2775	scopeOauthClient,
2724	targets: persistedTargets,	2776	targets: persistedTargets,
		2777	localScopeState: input.localScopeState,
2725	});	2778	});
2726		2779
2727	if (providerAuthResult.kind === "connected") {	2780	if (providerAuthResult.kind === "connected") {
@@ -2749,10 +2802,10 @@ const connectGoogleDiscoveryBatchInternal = (input: { · 21 unmodified lines
2749		2802
2750	type RuntimeSourceAuthServiceShape = {	2803	type RuntimeSourceAuthServiceShape = {
2751	getSourceById: (input: {	2804	getSourceById: (input: {
2752	workspaceId: WorkspaceId;	2805	scopeId: ScopeId;
2753	sourceId: Source["id"];	2806	sourceId: Source["id"];
2754	actorAccountId?: AccountId \| null;	2807	actorScopeId?: ScopeId \| null;
2755	}) => Effect.Effect<Source, Error, WorkspaceStorageServices>;	2808	}) => Effect.Effect<Source, Error, ScopeStorageServices>;
2756	getLocalServerBaseUrl: () => string \| null;	2809	getLocalServerBaseUrl: () => string \| null;
2757	storeSecretMaterial: (input: {	2810	storeSecretMaterial: (input: {
2758	purpose: SecretMaterialPurpose;	2811	purpose: SecretMaterialPurpose;
@@ -2764,28 +2817,28 @@ type RuntimeSourceAuthServiceShape = { · 5 unmodified lines
2764	mcpDiscoveryElicitation?: McpDiscoveryElicitationContext;	2817	mcpDiscoveryElicitation?: McpDiscoveryElicitationContext;
2765	baseUrl?: string \| null;	2818	baseUrl?: string \| null;
2766	},	2819	},
2767	) => Effect.Effect<ExecutorSourceAddResult, Error, WorkspaceStorageServices>;	2820	) => Effect.Effect<ExecutorSourceAddResult, Error, ScopeStorageServices>;
2768	connectGoogleDiscoveryBatch: (	2821	connectGoogleDiscoveryBatch: (
2769	input: ConnectGoogleDiscoveryBatchInput,	2822	input: ConnectGoogleDiscoveryBatchInput,
2770	) => Effect.Effect<ConnectGoogleDiscoveryBatchResult, Error, WorkspaceStorageServices>;	2823	) => Effect.Effect<ConnectGoogleDiscoveryBatchResult, Error, ScopeStorageServices>;
2771	connectMcpSource: (	2824	connectMcpSource: (
2772	input: ConnectMcpSourceInput,	2825	input: ConnectMcpSourceInput,
2773	) => Effect.Effect<McpSourceConnectResult, Error, WorkspaceStorageServices>;	2826	) => Effect.Effect<McpSourceConnectResult, Error, ScopeStorageServices>;
2774	listWorkspaceOauthClients: (input: {	2827	listScopeOauthClients: (input: {
2775	workspaceId: WorkspaceId;	2828	scopeId: ScopeId;
2776	providerKey: string;	2829	providerKey: string;
2777	}) => Effect.Effect<readonly WorkspaceOauthClient[], Error, WorkspaceStorageServices>;	2830	}) => Effect.Effect<readonly ScopeOauthClient[], Error, ScopeStorageServices>;
2778	createWorkspaceOauthClient: (	2831	createScopeOauthClient: (
2779	input: CreateWorkspaceOauthClientInput,	2832	input: CreateScopeOauthClientInput,
2780	) => Effect.Effect<WorkspaceOauthClient, Error, WorkspaceStorageServices>;	2833	) => Effect.Effect<ScopeOauthClient, Error, ScopeStorageServices>;
2781	removeWorkspaceOauthClient: (input: {	2834	removeScopeOauthClient: (input: {
2782	workspaceId: WorkspaceId;	2835	scopeId: ScopeId;
2783	oauthClientId: WorkspaceOauthClient["id"];	2836	oauthClientId: ScopeOauthClient["id"];
2784	}) => Effect.Effect<boolean, Error, WorkspaceStorageServices>;	2837	}) => Effect.Effect<boolean, Error, ScopeStorageServices>;
2785	removeProviderAuthGrant: (input: {	2838	removeProviderAuthGrant: (input: {
2786	workspaceId: WorkspaceId;	2839	scopeId: ScopeId;
2787	grantId: ProviderAuthGrant["id"];	2840	grantId: ProviderAuthGrant["id"];
2788	}) => Effect.Effect<boolean, Error, WorkspaceStorageServices>;	2841	}) => Effect.Effect<boolean, Error, ScopeStorageServices>;
2789	startSourceOAuthSession: (	2842	startSourceOAuthSession: (
2790	input: StartSourceOAuthSessionInput,	2843	input: StartSourceOAuthSessionInput,
2791	) => Effect.Effect<StartSourceOAuthSessionResult, Error, never>;	2844	) => Effect.Effect<StartSourceOAuthSessionResult, Error, never>;
@@ -2794,24 +2847,24 @@ type RuntimeSourceAuthServiceShape = { · 2 unmodified lines
2794	code?: string \| null;	2847	code?: string \| null;
2795	error?: string \| null;	2848	error?: string \| null;
2796	errorDescription?: string \| null;	2849	errorDescription?: string \| null;
2797	}) => Effect.Effect<CompleteSourceOAuthSessionResult, Error, WorkspaceStorageServices>;	2850	}) => Effect.Effect<CompleteSourceOAuthSessionResult, Error, ScopeStorageServices>;
2798	completeProviderOauthCallback: (input: {	2851	completeProviderOauthCallback: (input: {
2799	workspaceId: WorkspaceId;	2852	scopeId: ScopeId;
2800	actorAccountId?: AccountId \| null;	2853	actorScopeId?: ScopeId \| null;
2801	state: string;	2854	state: string;
2802	code?: string \| null;	2855	code?: string \| null;
2803	error?: string \| null;	2856	error?: string \| null;
2804	errorDescription?: string \| null;	2857	errorDescription?: string \| null;
2805	}) => Effect.Effect<CompleteProviderOauthCallbackResult, Error, WorkspaceStorageServices>;	2858	}) => Effect.Effect<CompleteProviderOauthCallbackResult, Error, ScopeStorageServices>;
2806	completeSourceCredentialSetup: (input: {	2859	completeSourceCredentialSetup: (input: {
2807	workspaceId: WorkspaceId;	2860	scopeId: ScopeId;
2808	sourceId: Source["id"];	2861	sourceId: Source["id"];
2809	actorAccountId?: AccountId \| null;	2862	actorScopeId?: ScopeId \| null;
2810	state: string;	2863	state: string;
2811	code?: string \| null;	2864	code?: string \| null;
2812	error?: string \| null;	2865	error?: string \| null;
2813	errorDescription?: string \| null;	2866	errorDescription?: string \| null;
2814	}) => Effect.Effect<CompleteSourceCredentialSetupResult, Error, WorkspaceStorageServices>;	2867	}) => Effect.Effect<CompleteSourceCredentialSetupResult, Error, ScopeStorageServices>;
2815	};	2868	};
2816		2869
2817	type RuntimeSourceAuthDependencies = {	2870	type RuntimeSourceAuthDependencies = {
@@ -2823,10 +2876,10 @@ type RuntimeSourceAuthDependencies = { · 5 unmodified lines
2823	storeSecretMaterial: StoreSecretMaterial;	2876	storeSecretMaterial: StoreSecretMaterial;
2824	deleteSecretMaterial: DeleteSecretMaterial;	2877	deleteSecretMaterial: DeleteSecretMaterial;
2825	getLocalServerBaseUrl?: () => string \| undefined;	2878	getLocalServerBaseUrl?: () => string \| undefined;
2826	localWorkspaceState?: RuntimeLocalWorkspaceState;	2879	localScopeState?: RuntimeLocalScopeState;
2827	};	2880	};
2828		2881
2829	type ProvideLocalWorkspace = <A, E, R>(	2882	type ProvideLocalScope = <A, E, R>(
2830	effect: Effect.Effect<A, E, R>,	2883	effect: Effect.Effect<A, E, R>,
2831	) => Effect.Effect<A, E, R>;	2884	) => Effect.Effect<A, E, R>;
2832		2885
@@ -2836,9 +2889,9 @@ type RuntimeSourceConnectionServiceShape = Pick< · 3 unmodified lines
2836	\| "addExecutorSource"	2889	\| "addExecutorSource"
2837	\| "connectGoogleDiscoveryBatch"	2890	\| "connectGoogleDiscoveryBatch"
2838	\| "connectMcpSource"	2891	\| "connectMcpSource"
2839	\| "listWorkspaceOauthClients"	2892	\| "listScopeOauthClients"
2840	\| "createWorkspaceOauthClient"	2893	\| "createScopeOauthClient"
2841	\| "removeWorkspaceOauthClient"	2894	\| "removeScopeOauthClient"
2842	\| "removeProviderAuthGrant"	2895	\| "removeProviderAuthGrant"
2843	>;	2896	>;
2844		2897
@@ -2852,24 +2905,24 @@ type RuntimeSourceOAuthSessionServiceShape = Pick< · 7 unmodified lines
2852		2905
2853	const createRuntimeSourceConnectionService = (	2906	const createRuntimeSourceConnectionService = (
2854	input: RuntimeSourceAuthDependencies,	2907	input: RuntimeSourceAuthDependencies,
2855	provideLocalWorkspace: ProvideLocalWorkspace,	2908	provideLocalWorkspace: ProvideLocalScope,
2856	): RuntimeSourceConnectionServiceShape => {	2909	): RuntimeSourceConnectionServiceShape => {
2857	const mirrorLocalSourceResult = (	2910	const mirrorLocalSourceResult = (
2858	result: ExecutorSourceAddResult,	2911	result: ExecutorSourceAddResult,
2859	): Effect.Effect<ExecutorSourceAddResult, Error, WorkspaceStorageServices> =>	2912	): Effect.Effect<ExecutorSourceAddResult, Error, ScopeStorageServices> =>
2860	Effect.succeed(result);	2913	Effect.succeed(result);
2861	const mirrorLocalMcpSourceResult = (	2914	const mirrorLocalMcpSourceResult = (
2862	result: McpSourceConnectResult,	2915	result: McpSourceConnectResult,
2863	): Effect.Effect<McpSourceConnectResult, Error, WorkspaceStorageServices> =>	2916	): Effect.Effect<McpSourceConnectResult, Error, ScopeStorageServices> =>
2864	Effect.succeed(result);	2917	Effect.succeed(result);
2865		2918
2866	return {	2919	return {
2867	getSourceById: ({ workspaceId, sourceId, actorAccountId }) =>	2920	getSourceById: ({ scopeId, sourceId, actorScopeId }) =>
2868	provideLocalWorkspace(	2921	provideLocalWorkspace(
2869	input.sourceStore.loadSourceById({	2922	input.sourceStore.loadSourceById({
2870	workspaceId,	2923	scopeId,
2871	sourceId,	2924	sourceId,
2872	actorAccountId,	2925	actorScopeId,
2873	}),	2926	}),
2874	),	2927	),
2875		2928
@@ -2886,6 +2939,7 @@ const createRuntimeSourceConnectionService = ( · 10 unmodified lines
2886	resolveSecretMaterial: input.resolveSecretMaterial,	2939	resolveSecretMaterial: input.resolveSecretMaterial,
2887	getLocalServerBaseUrl: input.getLocalServerBaseUrl,	2940	getLocalServerBaseUrl: input.getLocalServerBaseUrl,
2888	baseUrl: options?.baseUrl,	2941	baseUrl: options?.baseUrl,
		2942	localScopeState: input.localScopeState,
2889	})	2943	})
2890	: isExecutorHttpEndpointSourceInput(sourceInput)	2944	: isExecutorHttpEndpointSourceInput(sourceInput)
2891	? addExecutorHttpSource({	2945	? addExecutorHttpSource({
@@ -2898,6 +2952,7 @@ const createRuntimeSourceConnectionService = ( · 6 unmodified lines
2898	resolveSecretMaterial: input.resolveSecretMaterial,	2952	resolveSecretMaterial: input.resolveSecretMaterial,
2899	getLocalServerBaseUrl: input.getLocalServerBaseUrl,	2953	getLocalServerBaseUrl: input.getLocalServerBaseUrl,
2900	baseUrl: options?.baseUrl,	2954	baseUrl: options?.baseUrl,
		2955	localScopeState: input.localScopeState,
2901	})	2956	})
2902	: isExecutorMcpSourceInput(sourceInput)	2957	: isExecutorMcpSourceInput(sourceInput)
2903	? connectMcpSourceInternal({	2958	? connectMcpSourceInternal({
@@ -2905,8 +2960,8 @@ const createRuntimeSourceConnectionService = ( · 1 unmodified line
2905	sourceStore: input.sourceStore,	2960	sourceStore: input.sourceStore,
2906	sourceCatalogSync: input.sourceCatalogSync,	2961	sourceCatalogSync: input.sourceCatalogSync,
2907	getLocalServerBaseUrl: input.getLocalServerBaseUrl,	2962	getLocalServerBaseUrl: input.getLocalServerBaseUrl,
2908	workspaceId: sourceInput.workspaceId,	2963	scopeId: sourceInput.scopeId,
2909	actorAccountId: sourceInput.actorAccountId,	2964	actorScopeId: sourceInput.actorScopeId,
2910	executionId: sourceInput.executionId,	2965	executionId: sourceInput.executionId,
2911	interactionId: sourceInput.interactionId,	2966	interactionId: sourceInput.interactionId,
2912	endpoint: sourceInput.endpoint,	2967	endpoint: sourceInput.endpoint,
@@ -2936,6 +2991,7 @@ const createRuntimeSourceConnectionService = ( · 23 unmodified lines
2936	sourceCatalogSync: input.sourceCatalogSync,	2991	sourceCatalogSync: input.sourceCatalogSync,
2937	sourceInput,	2992	sourceInput,
2938	getLocalServerBaseUrl: input.getLocalServerBaseUrl,	2993	getLocalServerBaseUrl: input.getLocalServerBaseUrl,
		2994	localScopeState: input.localScopeState,
2939	}),	2995	}),
2940	),	2996	),
2941		2997
@@ -2946,8 +3002,8 @@ const createRuntimeSourceConnectionService = ( · 4 unmodified lines
2946	sourceStore: input.sourceStore,	3002	sourceStore: input.sourceStore,
2947	sourceCatalogSync: input.sourceCatalogSync,	3003	sourceCatalogSync: input.sourceCatalogSync,
2948	getLocalServerBaseUrl: input.getLocalServerBaseUrl,	3004	getLocalServerBaseUrl: input.getLocalServerBaseUrl,
2949	workspaceId: sourceInput.workspaceId,	3005	scopeId: sourceInput.scopeId,
2950	actorAccountId: sourceInput.actorAccountId,	3006	actorScopeId: sourceInput.actorScopeId,
2951	sourceId: sourceInput.sourceId,	3007	sourceId: sourceInput.sourceId,
2952	executionId: null,	3008	executionId: null,
2953	interactionId: null,	3009	interactionId: null,
@@ -2969,54 +3025,71 @@ const createRuntimeSourceConnectionService = ( · 15 unmodified lines
2969	),	3025	),
2970	),	3026	),
2971		3027
2972	listWorkspaceOauthClients: ({ workspaceId, providerKey }) =>	3028	listScopeOauthClients: ({ scopeId, providerKey }) =>
2973	provideLocalWorkspace(	3029	provideLocalWorkspace(
2974	input.executorState.workspaceOauthClients.listByWorkspaceAndProvider({	3030	Effect.gen(function* () {
2975	workspaceId,	3031	const scopeIds = resolvedScopeSearchOrder({
2976	providerKey,	3032	scopeId,
		3033	localScopeState: input.localScopeState,
		3034	});
		3035	const clientsById = new Map<ScopeOauthClient["id"], ScopeOauthClient>();
		3036
		3037	for (const candidateScopeId of scopeIds) {
		3038	const clients = yield* input.executorState.scopeOauthClients.listByScopeAndProvider({
		3039	scopeId: candidateScopeId,
		3040	providerKey,
		3041	});
		3042	for (const client of clients) {
		3043	if (!clientsById.has(client.id)) {
		3044	clientsById.set(client.id, client);
		3045	}
		3046	}
		3047	}
		3048
		3049	return [...clientsById.values()];
2977	}),	3050	}),
2978	),	3051	),
2979		3052
2980	createWorkspaceOauthClient: ({ workspaceId, providerKey, label, oauthClient }) =>	3053	createScopeOauthClient: ({ scopeId, providerKey, label, oauthClient }) =>
2981	provideLocalWorkspace(	3054	provideLocalWorkspace(
2982	Effect.gen(function* () {	3055	Effect.gen(function* () {
2983	const sourceAdapter = findSourceAdapterByProviderKey(providerKey);	3056	const sourceAdapter = findSourceAdapterByProviderKey(providerKey);
2984	const created = yield* createWorkspaceOauthClient({	3057	const created = yield* createScopeOauthClient({
2985	executorState: input.executorState,	3058	executorState: input.executorState,
2986	workspaceId,	3059	scopeId,
2987	providerKey,	3060	providerKey,
2988	oauthClient,	3061	oauthClient,
2989	label,	3062	label,
2990	normalizeOauthClient: sourceAdapter?.normalizeOauthClientInput,	3063	normalizeOauthClient: sourceAdapter?.normalizeOauthClientInput,
2991	storeSecretMaterial: input.storeSecretMaterial,	3064	storeSecretMaterial: input.storeSecretMaterial,
2992	});	3065	});
2993	const stored = yield* input.executorState.workspaceOauthClients.getById(created.id);	3066	const stored = yield* input.executorState.scopeOauthClients.getById(created.id);
2994	if (Option.isNone(stored)) {	3067	if (Option.isNone(stored)) {
2995	return yield* runtimeEffectError("sources/source-auth-service", `Workspace OAuth client ${created.id} was not persisted`);	3068	return yield* runtimeEffectError("sources/source-auth-service", `Scope OAuth client ${created.id} was not persisted`);
2996	}	3069	}
2997		3070
2998	return stored.value;	3071	return stored.value;
2999	}),	3072	}),
3000	),	3073	),
3001		3074
3002	removeWorkspaceOauthClient: ({ workspaceId, oauthClientId }) =>	3075	removeScopeOauthClient: ({ scopeId, oauthClientId }) =>
3003	provideLocalWorkspace(	3076	provideLocalWorkspace(
3004	Effect.gen(function* () {	3077	Effect.gen(function* () {
3005	const oauthClient = yield* input.executorState.workspaceOauthClients.getById(oauthClientId);	3078	const oauthClient = yield* input.executorState.scopeOauthClients.getById(oauthClientId);
3006	if (Option.isNone(oauthClient) \|\| oauthClient.value.workspaceId !== workspaceId) {	3079	if (Option.isNone(oauthClient) \|\| oauthClient.value.scopeId !== scopeId) {
3007	return false;	3080	return false;
3008	}	3081	}
3009		3082
3010	const grants = yield* input.executorState.providerAuthGrants.listByWorkspaceId(workspaceId);	3083	const grants = yield* input.executorState.providerAuthGrants.listByScopeId(scopeId);
3011	const dependentGrant = grants.find((grant) => grant.oauthClientId === oauthClientId);	3084	const dependentGrant = grants.find((grant) => grant.oauthClientId === oauthClientId);
3012	if (dependentGrant) {	3085	if (dependentGrant) {
3013	return yield* runtimeEffectError("sources/source-auth-service",	3086	return yield* runtimeEffectError("sources/source-auth-service",
3014	`Workspace OAuth client ${oauthClientId} is still referenced by provider grant ${dependentGrant.id}`,	3087	`Scope OAuth client ${oauthClientId} is still referenced by provider grant ${dependentGrant.id}`,
3015	);	3088	);
3016	}	3089	}
3017		3090
3018	const secretRef = sourceOauthClientSecretRef(oauthClient.value);	3091	const secretRef = sourceOauthClientSecretRef(oauthClient.value);
3019	const removed = yield* input.executorState.workspaceOauthClients.removeById(oauthClientId);	3092	const removed = yield* input.executorState.scopeOauthClients.removeById(oauthClientId);
3020	if (removed && secretRef) {	3093	if (removed && secretRef) {
3021	yield* input.deleteSecretMaterial(secretRef).pipe(	3094	yield* input.deleteSecretMaterial(secretRef).pipe(
3022	Effect.either,	3095	Effect.either,
@@ -3028,12 +3101,12 @@ const createRuntimeSourceConnectionService = ( · 5 unmodified lines
3028	}),	3101	}),
3029	),	3102	),
3030		3103
3031	removeProviderAuthGrant: ({ workspaceId, grantId }) =>	3104	removeProviderAuthGrant: ({ scopeId, grantId }) =>
3032	provideLocalWorkspace(	3105	provideLocalWorkspace(
3033	removeProviderAuthGrantInternal({	3106	removeProviderAuthGrantInternal({
3034	executorState: input.executorState,	3107	executorState: input.executorState,
3035	sourceStore: input.sourceStore,	3108	sourceStore: input.sourceStore,
3036	workspaceId,	3109	scopeId,
3037	grantId,	3110	grantId,
3038	deleteSecretMaterial: input.deleteSecretMaterial,	3111	deleteSecretMaterial: input.deleteSecretMaterial,
3039	}),	3112	}),
@@ -3043,7 +3116,7 @@ const createRuntimeSourceConnectionService = ( · 3 unmodified lines
3043		3116
3044	const createRuntimeSourceOAuthSessionService = (	3117	const createRuntimeSourceOAuthSessionService = (
3045	input: RuntimeSourceAuthDependencies,	3118	input: RuntimeSourceAuthDependencies,
3046	provideLocalWorkspace: ProvideLocalWorkspace,	3119	provideLocalWorkspace: ProvideLocalScope,
3047	): RuntimeSourceOAuthSessionServiceShape => ({	3120	): RuntimeSourceOAuthSessionServiceShape => ({
3048	startSourceOAuthSession: (oauthInput) =>	3121	startSourceOAuthSession: (oauthInput) =>
3049	Effect.gen(function* () {	3122	Effect.gen(function* () {
@@ -3069,9 +3142,9 @@ const createRuntimeSourceOAuthSessionService = ( · 19 unmodified lines
3069		3142
3070	yield* input.executorState.sourceAuthSessions.upsert({	3143	yield* input.executorState.sourceAuthSessions.upsert({
3071	id: sessionId,	3144	id: sessionId,
3072	workspaceId: oauthInput.workspaceId,	3145	scopeId: oauthInput.scopeId,
3073	sourceId: SourceIdSchema.make(`oauth_draft_${crypto.randomUUID()}`),	3146	sourceId: SourceIdSchema.make(`oauth_draft_${crypto.randomUUID()}`),
3074	actorAccountId: oauthInput.actorAccountId ?? null,	3147	actorScopeId: oauthInput.actorScopeId ?? null,
3075	credentialSlot: "runtime",	3148	credentialSlot: "runtime",
3076	executionId: null,	3149	executionId: null,
3077	interactionId: null,	3150	interactionId: null,
@@ -3215,7 +3288,7 @@ const createRuntimeSourceOAuthSessionService = ( · 137 unmodified lines
3215	} satisfies CompleteSourceOAuthSessionResult;	3288	} satisfies CompleteSourceOAuthSessionResult;
3216	})),	3289	})),
3217		3290
3218	completeProviderOauthCallback: ({ workspaceId, actorAccountId, state, code, error, errorDescription }) =>	3291	completeProviderOauthCallback: ({ scopeId, actorScopeId, state, code, error, errorDescription }) =>
3219	provideLocalWorkspace(Effect.gen(function* () {	3292	provideLocalWorkspace(Effect.gen(function* () {
3220	const sessionOption = yield* input.executorState.sourceAuthSessions.getByState(state);	3293	const sessionOption = yield* input.executorState.sourceAuthSessions.getByState(state);
3221	if (Option.isNone(sessionOption)) {	3294	if (Option.isNone(sessionOption)) {
@@ -3223,10 +3296,10 @@ const createRuntimeSourceOAuthSessionService = ( · 1 unmodified line
3223	}	3296	}
3224		3297
3225	const session = sessionOption.value;	3298	const session = sessionOption.value;
3226	if (session.workspaceId !== workspaceId) {	3299	if (session.scopeId !== scopeId) {
3227	return yield* runtimeEffectError("sources/source-auth-service", `Source auth session ${session.id} does not match workspaceId=${workspaceId}`);	3300	return yield* runtimeEffectError("sources/source-auth-service", `Source auth session ${session.id} does not match scopeId=${scopeId}`);
3228	}	3301	}
3229	if ((session.actorAccountId ?? null) !== (actorAccountId ?? null)) {	3302	if ((session.actorScopeId ?? null) !== (actorScopeId ?? null)) {
3230	return yield* runtimeEffectError("sources/source-auth-service", `Source auth session ${session.id} does not match the active account`);	3303	return yield* runtimeEffectError("sources/source-auth-service", `Source auth session ${session.id} does not match the active account`);
3231	}	3304	}
3232	if (session.providerKind !== "oauth2_provider_batch") {	3305	if (session.providerKind !== "oauth2_provider_batch") {
@@ -3238,9 +3311,9 @@ const createRuntimeSourceOAuthSessionService = ( · 5 unmodified lines
3238	sessionData.targetSources,	3311	sessionData.targetSources,
3239	(target) =>	3312	(target) =>
3240	input.sourceStore.loadSourceById({	3313	input.sourceStore.loadSourceById({
3241	workspaceId,	3314	scopeId,
3242	sourceId: target.sourceId,	3315	sourceId: target.sourceId,
3243	actorAccountId,	3316	actorScopeId,
3244	}),	3317	}),
3245	{ discard: false },	3318	{ discard: false },
3246	);	3319	);
@@ -3276,14 +3349,15 @@ const createRuntimeSourceOAuthSessionService = ( · 29 unmodified lines
3276	return yield* runtimeEffectError("sources/source-auth-service", "OAuth session is missing the PKCE code verifier");	3349	return yield* runtimeEffectError("sources/source-auth-service", "OAuth session is missing the PKCE code verifier");
3277	}	3350	}
3278		3351
3279	const oauthClient = yield* resolveWorkspaceOauthClientById({	3352	const oauthClient = yield* resolveScopeOauthClientById({
3280	executorState: input.executorState,	3353	executorState: input.executorState,
3281	workspaceId,	3354	scopeId,
3282	oauthClientId: sessionData.oauthClientId,	3355	oauthClientId: sessionData.oauthClientId,
3283	providerKey: sessionData.providerKey,	3356	providerKey: sessionData.providerKey,
		3357	localScopeState: input.localScopeState,
3284	});	3358	});
3285	if (oauthClient === null) {	3359	if (oauthClient === null) {
3286	return yield* runtimeEffectError("sources/source-auth-service", `Workspace OAuth client not found: ${sessionData.oauthClientId}`);	3360	return yield* runtimeEffectError("sources/source-auth-service", `Scope OAuth client not found: ${sessionData.oauthClientId}`);
3287	}	3361	}
3288		3362
3289	let clientSecret: string \| null = null;	3363	let clientSecret: string \| null = null;
@@ -3303,9 +3377,9 @@ const createRuntimeSourceOAuthSessionService = ( · 13 unmodified lines
3303	code: authorizationCode,	3377	code: authorizationCode,
3304	});	3378	});
3305		3379
3306	const availableGrants = yield* input.executorState.providerAuthGrants.listByWorkspaceActorAndProvider({	3380	const availableGrants = yield* input.executorState.providerAuthGrants.listByScopeActorAndProvider({
3307	workspaceId,	3381	scopeId,
3308	actorAccountId: actorAccountId ?? null,	3382	actorScopeId: actorScopeId ?? null,
3309	providerKey: sessionData.providerKey,	3383	providerKey: sessionData.providerKey,
3310	});	3384	});
3311	const existingGrant = availableGrants.find(	3385	const existingGrant = availableGrants.find(
@@ -3319,8 +3393,8 @@ const createRuntimeSourceOAuthSessionService = ( · 7 unmodified lines
3319	);	3393	);
3320	const nextGrant = yield* upsertProviderAuthGrant({	3394	const nextGrant = yield* upsertProviderAuthGrant({
3321	executorState: input.executorState,	3395	executorState: input.executorState,
3322	workspaceId,	3396	scopeId,
3323	actorAccountId,	3397	actorScopeId,
3324	providerKey: sessionData.providerKey,	3398	providerKey: sessionData.providerKey,
3325	oauthClientId: sessionData.oauthClientId,	3399	oauthClientId: sessionData.oauthClientId,
3326	tokenEndpoint: sessionData.tokenEndpoint,	3400	tokenEndpoint: sessionData.tokenEndpoint,
@@ -3339,9 +3413,9 @@ const createRuntimeSourceOAuthSessionService = ( · 12 unmodified lines
3339	(target) =>	3413	(target) =>
3340	Effect.map(	3414	Effect.map(
3341	input.sourceStore.loadSourceById({	3415	input.sourceStore.loadSourceById({
3342	workspaceId,	3416	scopeId,
3343	sourceId: target.sourceId,	3417	sourceId: target.sourceId,
3344	actorAccountId,	3418	actorScopeId,
3345	}),	3419	}),
3346	(source) => ({	3420	(source) => ({
3347	source,	3421	source,
@@ -3354,7 +3428,7 @@ const createRuntimeSourceOAuthSessionService = ( · 6 unmodified lines
3354	const connectedSources = yield* attachProviderGrantToSources({	3428	const connectedSources = yield* attachProviderGrantToSources({
3355	sourceStore: input.sourceStore,	3429	sourceStore: input.sourceStore,
3356	sourceCatalogSync: input.sourceCatalogSync,	3430	sourceCatalogSync: input.sourceCatalogSync,
3357	actorAccountId,	3431	actorScopeId,
3358	grantId: nextGrant.id,	3432	grantId: nextGrant.id,
3359	providerKey: nextGrant.providerKey,	3433	providerKey: nextGrant.providerKey,
3360	headerName: nextGrant.headerName,	3434	headerName: nextGrant.headerName,
@@ -3384,7 +3458,7 @@ const createRuntimeSourceOAuthSessionService = ( · 23 unmodified lines
3384	} satisfies CompleteProviderOauthCallbackResult;	3458	} satisfies CompleteProviderOauthCallbackResult;
3385	})),	3459	})),
3386		3460
3387	completeSourceCredentialSetup: ({ workspaceId, sourceId, actorAccountId, state, code, error, errorDescription }) =>	3461	completeSourceCredentialSetup: ({ scopeId, sourceId, actorScopeId, state, code, error, errorDescription }) =>
3388	provideLocalWorkspace(Effect.gen(function* () {	3462	provideLocalWorkspace(Effect.gen(function* () {
3389	const sessionOption = yield* input.executorState.sourceAuthSessions.getByState(state);	3463	const sessionOption = yield* input.executorState.sourceAuthSessions.getByState(state);
3390	if (Option.isNone(sessionOption)) {	3464	if (Option.isNone(sessionOption)) {
@@ -3392,22 +3466,22 @@ const createRuntimeSourceOAuthSessionService = ( · 1 unmodified line
3392	}	3466	}
3393		3467
3394	const session = sessionOption.value;	3468	const session = sessionOption.value;
3395	if (session.workspaceId !== workspaceId \|\| session.sourceId !== sourceId) {	3469	if (session.scopeId !== scopeId \|\| session.sourceId !== sourceId) {
3396	return yield* runtimeEffectError("sources/source-auth-service",	3470	return yield* runtimeEffectError("sources/source-auth-service",
3397	`Source auth session ${session.id} does not match workspaceId=${workspaceId} sourceId=${sourceId}`,	3471	`Source auth session ${session.id} does not match scopeId=${scopeId} sourceId=${sourceId}`,
3398	);	3472	);
3399	}	3473	}
3400	if (	3474	if (
3401	actorAccountId !== undefined	3475	actorScopeId !== undefined
3402	&& (session.actorAccountId ?? null) !== (actorAccountId ?? null)	3476	&& (session.actorScopeId ?? null) !== (actorScopeId ?? null)
3403	) {	3477	) {
3404	return yield* runtimeEffectError("sources/source-auth-service", `Source auth session ${session.id} does not match the active account`);	3478	return yield* runtimeEffectError("sources/source-auth-service", `Source auth session ${session.id} does not match the active account`);
3405	}	3479	}
3406		3480
3407	const source = yield* input.sourceStore.loadSourceById({	3481	const source = yield* input.sourceStore.loadSourceById({
3408	workspaceId: session.workspaceId,	3482	scopeId: session.scopeId,
3409	sourceId: session.sourceId,	3483	sourceId: session.sourceId,
3410	actorAccountId: session.actorAccountId,	3484	actorScopeId: session.actorScopeId,
3411	});	3485	});
3412		3486
3413	if (session.status === "completed") {	3487	if (session.status === "completed") {
@@ -3439,13 +3513,13 @@ const createRuntimeSourceOAuthSessionService = ( · 25 unmodified lines
3439	}),	3513	}),
3440	);	3514	);
3441	const failedSource = yield* updateSourceStatus(input.sourceStore, source, {	3515	const failedSource = yield* updateSourceStatus(input.sourceStore, source, {
3442	actorAccountId: session.actorAccountId,	3516	actorScopeId: session.actorScopeId,
3443	status: "error",	3517	status: "error",
3444	lastError: reason,	3518	lastError: reason,
3445	});	3519	});
3446	yield* input.sourceCatalogSync.sync({	3520	yield* input.sourceCatalogSync.sync({
3447	source: failedSource,	3521	source: failedSource,
3448	actorAccountId: session.actorAccountId,	3522	actorScopeId: session.actorScopeId,
3449	});	3523	});
3450	yield* completeLiveInteraction({	3524	yield* completeLiveInteraction({
3451	executorState: input.executorState,	3525	executorState: input.executorState,
@@ -3503,7 +3577,7 @@ const createRuntimeSourceOAuthSessionService = ( · 51 unmodified lines
3503	? exchanged.scope!.split(/\s+/).filter((scope) => scope.length > 0)	3577	? exchanged.scope!.split(/\s+/).filter((scope) => scope.length > 0)
3504	: [...oauthSessionData.scopes];	3578	: [...oauthSessionData.scopes];
3505	connectedSource = yield* updateSourceStatus(input.sourceStore, source, {	3579	connectedSource = yield* updateSourceStatus(input.sourceStore, source, {
3506	actorAccountId: session.actorAccountId,	3580	actorScopeId: session.actorScopeId,
3507	status: "connected",	3581	status: "connected",
3508	lastError: null,	3582	lastError: null,
3509	auth: {	3583	auth: {
@@ -3518,10 +3592,10 @@ const createRuntimeSourceOAuthSessionService = ( · 8 unmodified lines
3518	grantSet: grantedScopes,	3592	grantSet: grantedScopes,
3519	},	3593	},
3520	});	3594	});
3521	const authArtifact = yield* input.executorState.authArtifacts.getByWorkspaceSourceAndActor({	3595	const authArtifact = yield* input.executorState.authArtifacts.getByScopeSourceAndActor({
3522	workspaceId: connectedSource.workspaceId,	3596	scopeId: connectedSource.scopeId,
3523	sourceId: connectedSource.id,	3597	sourceId: connectedSource.id,
3524	actorAccountId: session.actorAccountId ?? null,	3598	actorScopeId: session.actorScopeId ?? null,
3525	slot: "runtime",	3599	slot: "runtime",
3526	});	3600	});
3527	if (Option.isSome(authArtifact)) {	3601	if (Option.isSome(authArtifact)) {
@@ -3583,7 +3657,7 @@ const createRuntimeSourceOAuthSessionService = ( · 55 unmodified lines
3583	: null;	3657	: null;
3584		3658
3585	connectedSource = yield* updateSourceStatus(input.sourceStore, source, {	3659	connectedSource = yield* updateSourceStatus(input.sourceStore, source, {
3586	actorAccountId: session.actorAccountId,	3660	actorScopeId: session.actorScopeId,
3587	status: "connected",	3661	status: "connected",
3588	lastError: null,	3662	lastError: null,
3589	auth: createPersistedMcpOAuthSourceAuth({	3663	auth: createPersistedMcpOAuthSourceAuth({
@@ -3628,13 +3702,13 @@ const createRuntimeSourceOAuthSessionService = ( · 38 unmodified lines
3628	const indexed = yield* Effect.either(	3702	const indexed = yield* Effect.either(
3629	input.sourceCatalogSync.sync({	3703	input.sourceCatalogSync.sync({
3630	source: connectedSource,	3704	source: connectedSource,
3631	actorAccountId: session.actorAccountId,	3705	actorScopeId: session.actorScopeId,
3632	}),	3706	}),
3633	);	3707	);
3634	yield* Either.match(indexed, {	3708	yield* Either.match(indexed, {
3635	onLeft: (error) =>	3709	onLeft: (error) =>
3636	updateSourceStatus(input.sourceStore, connectedSource, {	3710	updateSourceStatus(input.sourceStore, connectedSource, {
3637	actorAccountId: session.actorAccountId,	3711	actorScopeId: session.actorScopeId,
3638	status: "error",	3712	status: "error",
3639	lastError: error.message,	3713	lastError: error.message,
3640	}).pipe(	3714	}).pipe(
@@ -3660,8 +3734,8 @@ const createRuntimeSourceOAuthSessionService = ( · 19 unmodified lines
3660	});	3734	});
3661		3735
3662	export const createRuntimeSourceAuthService = (input: RuntimeSourceAuthDependencies) => {	3736	export const createRuntimeSourceAuthService = (input: RuntimeSourceAuthDependencies) => {
3663	const provideLocalWorkspace: ProvideLocalWorkspace = (effect) =>	3737	const provideLocalWorkspace: ProvideLocalScope = (effect) =>
3664	provideOptionalRuntimeLocalWorkspace(effect, input.localWorkspaceState);	3738	provideOptionalRuntimeLocalScope(effect, input.localScopeState);
3665	const sourceConnection = createRuntimeSourceConnectionService(	3739	const sourceConnection = createRuntimeSourceConnectionService(
3666	input,	3740	input,
3667	provideLocalWorkspace,	3741	provideLocalWorkspace,
@@ -3704,7 +3778,7 @@ export const RuntimeSourceAuthServiceLive = (input: { · 36 unmodified lines
3704	const resolveSecretMaterial = yield* SecretMaterialResolverService;	3778	const resolveSecretMaterial = yield* SecretMaterialResolverService;
3705	const storeSecretMaterial = yield* SecretMaterialStorerService;	3779	const storeSecretMaterial = yield* SecretMaterialStorerService;
3706	const deleteSecretMaterial = yield* SecretMaterialDeleterService;	3780	const deleteSecretMaterial = yield* SecretMaterialDeleterService;
3707	const runtimeLocalWorkspace = yield* getRuntimeLocalWorkspaceOption();	3781	const runtimeLocalScope = yield* getRuntimeLocalScopeOption();
3708		3782
3709	return createRuntimeSourceAuthService({	3783	return createRuntimeSourceAuthService({
3710	executorState,	3784	executorState,
@@ -3715,7 +3789,7 @@ export const RuntimeSourceAuthServiceLive = (input: { · 4 unmodified lines
3715	storeSecretMaterial,	3789	storeSecretMaterial,
3716	deleteSecretMaterial,	3790	deleteSecretMaterial,
3717	getLocalServerBaseUrl: input.getLocalServerBaseUrl,	3791	getLocalServerBaseUrl: input.getLocalServerBaseUrl,
3718	localWorkspaceState: runtimeLocalWorkspace ?? undefined,	3792	localScopeState: runtimeLocalScope ?? undefined,
3719	});	3793	});
3720	}),	3794	}),
3721	);	3795	);

packages/platform/sdk/src/runtime/sources/source-credential-interactions.ts+4−1

@@ -1,4 +1,7 @@
1	import { SecretRefSchema, type SecretRef } from "#schema";	1	import {
		2	SecretRefSchema,
		3	type SecretRef,
		4	} from "#schema";
2	import * as Schema from "effect/Schema";	5	import * as Schema from "effect/Schema";
3		6
4	export const SourceCredentialSelectionContentSchema = Schema.Union(	7	export const SourceCredentialSelectionContentSchema = Schema.Union(

packages/platform/sdk/src/runtime/sources/source-definitions.test.ts+20−14

-import { describe, expect, it } from "@effect/vitest";
+import {
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import {
   CredentialIdSchema,
   decodeBuiltInAuthArtifactConfig,
   SourceIdSchema,
-  WorkspaceIdSchema,
+  ScopeIdSchema,
   type Source,
 } from "#schema";
   stableSourceCatalogRevisionId,
   updateSourceFromPayload,
 } from "./source-definitions";
-import { namespaceFromSourceName } from "./source-names";
+import {
+  namespaceFromSourceName,
+} from "./source-names";
 const openApiBinding = (
   specUrl = "https://api.github.com/openapi.json",
 const makeSource = (overrides: Partial<Source> = {}): Source => ({
   id: SourceIdSchema.make("src_source_definitions"),
-  workspaceId: WorkspaceIdSchema.make("ws_source_definitions"),
+  scopeId: ScopeIdSchema.make("ws_source_definitions"),
   name: "GitHub",
   kind: "openapi",
   endpoint: "https://api.github.com",
         name: "Renamed GitHub",
       });
       const differentWorkspace = makeSource({
-        workspaceId: WorkspaceIdSchema.make("ws_source_definitions_other"),
+        scopeId: ScopeIdSchema.make("ws_source_definitions_other"),
       });
       expect(stableSourceCatalogId(source)).toBe(stableSourceCatalogId(source));
       () =>
         Effect.gen(function* () {
           const source = yield* createSourceFromPayload({
-            workspaceId: WorkspaceIdSchema.make("ws_create_defaults"),
+            scopeId: ScopeIdSchema.make("ws_create_defaults"),
             sourceId: SourceIdSchema.make("src_create_defaults"),
             payload: {
               name: "  GitHub  ",
       () =>
         Effect.gen(function* () {
           const source = yield* createSourceFromPayload({
-            workspaceId: WorkspaceIdSchema.make("ws_create_oauth_defaults"),
+            scopeId: ScopeIdSchema.make("ws_create_oauth_defaults"),
             sourceId: SourceIdSchema.make("src_create_oauth_defaults"),
             payload: {
               name: "GraphQL Demo",
       Effect.gen(function* () {
         const invalidBearer = yield* Effect.flip(
           createSourceFromPayload({
-            workspaceId: WorkspaceIdSchema.make("ws_invalid_bearer"),
+            scopeId: ScopeIdSchema.make("ws_invalid_bearer"),
             sourceId: SourceIdSchema.make("src_invalid_bearer"),
             payload: {
               name: "Bad Bearer",
         const invalidRefresh = yield* Effect.flip(
           createSourceFromPayload({
-            workspaceId: WorkspaceIdSchema.make("ws_invalid_refresh"),
+            scopeId: ScopeIdSchema.make("ws_invalid_refresh"),
             sourceId: SourceIdSchema.make("src_invalid_refresh"),
             payload: {
               name: "Bad OAuth",
       Effect.gen(function* () {
         const invalidMcp = yield* Effect.flip(
           createSourceFromPayload({
-            workspaceId: WorkspaceIdSchema.make("ws_invalid_mcp"),
+            scopeId: ScopeIdSchema.make("ws_invalid_mcp"),
             sourceId: SourceIdSchema.make("src_invalid_mcp"),
             payload: {
               name: "MCP",
         const invalidOpenApiSpec = yield* Effect.flip(
           createSourceFromPayload({
-            workspaceId: WorkspaceIdSchema.make("ws_invalid_openapi_spec"),
+            scopeId: ScopeIdSchema.make("ws_invalid_openapi_spec"),
             sourceId: SourceIdSchema.make("src_invalid_openapi_spec"),
             payload: {
               name: "OpenAPI",
         const invalidOpenApiTransport = yield* Effect.flip(
           createSourceFromPayload({
-            workspaceId: WorkspaceIdSchema.make("ws_invalid_openapi_transport"),
+            scopeId: ScopeIdSchema.make("ws_invalid_openapi_transport"),
             sourceId: SourceIdSchema.make("src_invalid_openapi_transport"),
             payload: {
               name: "OpenAPI",
         const invalidGraphql = yield* Effect.flip(
           createSourceFromPayload({
-            workspaceId: WorkspaceIdSchema.make("ws_invalid_graphql"),
+            scopeId: ScopeIdSchema.make("ws_invalid_graphql"),
             sourceId: SourceIdSchema.make("src_invalid_graphql"),
             payload: {
               name: "GraphQL",
         const invalidInternal = yield* Effect.flip(
           createSourceFromPayload({
-            workspaceId: WorkspaceIdSchema.make("ws_invalid_internal"),
+            scopeId: ScopeIdSchema.make("ws_invalid_internal"),
             sourceId: SourceIdSchema.make("src_invalid_internal"),
             payload: {
               name: "Internal",

packages/platform/sdk/src/runtime/sources/source-definitions.ts+20−14

-import { sha256Hex } from "@executor/codemode-core";
+import {
+  sha256Hex,
+} from "@executor/codemode-core";
 import type {
   CreateSourcePayload,
   UpdateSourcePayload,
 } from "../../sources/contracts";
 import type {
-  AccountId,
+  ScopeId,
   AuthArtifact,
   Source,
   SourceAuth,
   StoredSourceRecord,
   StoredSourceCatalogRecord,
   StoredSourceCatalogRevisionRecord,
-  WorkspaceId,
 } from "#schema";
 import {
   AuthArtifactIdSchema,
 } from "#schema";
 import * as Effect from "effect/Effect";
-import { getSourceAdapter, getSourceAdapterForSource } from "./source-adapters";
+import {
+  getSourceAdapter,
+  getSourceAdapterForSource,
+} from "./source-adapters";
 import {
   authArtifactFromSourceAuth,
   sourceAuthFromAuthArtifact,
 } from "../auth/auth-artifacts";
-import { runtimeEffectError } from "../effect-errors";
+import {
+  runtimeEffectError,
+} from "../effect-errors";
 const trimOrNull = (value: string | null | undefined): string | null => {
   if (value === null || value === undefined) {
   );
 export const createSourceFromPayload = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: Source["id"];
   payload: CreateSourcePayload;
   now: number;
     return yield* validateSourceByKind({
       id: input.sourceId,
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       name: input.payload.name.trim(),
       kind: input.payload.kind,
       endpoint: input.payload.endpoint.trim(),
   providerKey: sourceCatalogProviderKeyFromSource(input.source),
   name: input.source.name,
   summary: null,
-  visibility: "workspace",
+  visibility: "scope",
   latestRevisionId: input.latestRevisionId,
   createdAt: input.source.createdAt,
   updatedAt: input.source.updatedAt,
   source: Source;
   catalogId: SourceCatalogId;
   catalogRevisionId: SourceCatalogRevisionId;
-  actorAccountId?: AccountId | null;
+  actorScopeId?: ScopeId | null;
   existingRuntimeAuthArtifactId?: AuthArtifact["id"] | null;
   existingImportAuthArtifactId?: AuthArtifact["id"] | null;
 }): {
 } => {
   const sourceRecord: StoredSourceRecord = {
     id: input.source.id,
-    workspaceId: input.source.workspaceId,
+    scopeId: input.source.scopeId,
     catalogId: input.catalogId,
     catalogRevisionId: input.catalogRevisionId,
     name: input.source.name,
       source: input.source,
       auth: input.source.auth,
       slot: "runtime",
-      actorAccountId: input.actorAccountId,
+      actorScopeId: input.actorScopeId,
       existingAuthArtifactId: input.existingRuntimeAuthArtifactId
         ?? AuthArtifactIdSchema.make(`auth_art_${crypto.randomUUID()}`),
     }),
           source: input.source,
           auth: input.source.importAuth,
           slot: "import",
-          actorAccountId: input.actorAccountId,
+          actorScopeId: input.actorScopeId,
           existingAuthArtifactId: input.existingImportAuthArtifactId
             ?? AuthArtifactIdSchema.make(`auth_art_${crypto.randomUUID()}`),
         })
     return {
       id: input.sourceRecord.id,
-      workspaceId: input.sourceRecord.workspaceId,
+      scopeId: input.sourceRecord.scopeId,
       name: input.sourceRecord.name,
       kind: input.sourceRecord.kind,
       endpoint: input.sourceRecord.endpoint,
       import: null,
     };
     const current = authArtifact.slot === "runtime" ? existing.runtime : existing.import;
-    if (current === null || (current.actorAccountId === null && authArtifact.actorAccountId !== null)) {
+    if (current === null || (current.actorScopeId === null && authArtifact.actorScopeId !== null)) {
       authArtifactsBySourceId.set(authArtifact.sourceId, {
         ...existing,
         [authArtifact.slot]: authArtifact,

packages/platform/sdk/src/runtime/sources/source-discovery.test.ts+8−2

   type ServerResponse,
 } from "node:http";
-import { describe, expect, it } from "@effect/vitest";
+import {
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
 import * as Effect from "effect/Effect";
-import { discoverSource } from "./source-discovery";
+import {
+  discoverSource,
+} from "./source-discovery";
 type TestServer = {
   url: string;

packages/platform/sdk/src/runtime/sources/source-inspection.test.ts+11−3

-import { describe, expect, it } from "@effect/vitest";
+import {
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
 import * as Effect from "effect/Effect";
-import type { LoadedSourceCatalogTool } from "../catalog/source/runtime";
+import type {
-import { inspectionToolDetailFromTool } from "./source-inspection";
+  LoadedSourceCatalogTool,
+} from "../catalog/source/runtime";
+import {
+  inspectionToolDetailFromTool,
+} from "./source-inspection";
 describe("source inspection", () => {
   it.effect("keeps the shared TypeScript contract first-class on tool detail", () =>

packages/platform/sdk/src/runtime/sources/source-store.test.ts+20−10

-import { describe, expect, it } from "@effect/vitest";
+import {
+  describe,
+  expect,
+  it,
+} from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import {
   SourceIdSchema,
-  WorkspaceIdSchema,
+  ScopeIdSchema,
   type Source,
 } from "#schema";
-import type { LoadedLocalExecutorConfig } from "../workspace-config";
+import type {
-import { buildLocalSourceRecord } from "./source-store";
+  LoadedLocalExecutorConfig,
-import type { LocalWorkspaceState } from "../workspace-state";
+} from "../scope-config";
+import {
+  buildLocalSourceRecord,
+} from "./source-store";
+import type {
+  LocalScopeState,
+} from "../scope-state";
-const workspaceId = WorkspaceIdSchema.make("ws_source_store");
+const scopeId = ScopeIdSchema.make("ws_source_store");
 const sourceId = SourceIdSchema.make("linear");
 const loadedConfig: LoadedLocalExecutorConfig = {
   projectConfigPath: "/tmp/project-config.jsonc",
 };
-const workspaceState: LocalWorkspaceState = {
+const scopeState: LocalScopeState = {
   version: 1,
   sources: {
     [sourceId]: {
   it.effect("projects configured sources without reading local artifacts", () =>
     Effect.gen(function* () {
       const result = yield* buildLocalSourceRecord({
-        workspaceId,
+        scopeId,
         loadedConfig,
-        workspaceState,
+        scopeState,
         sourceId,
         authArtifacts: [],
       });
       expect(result.source).toEqual({
         id: sourceId,
-        workspaceId,
+        scopeId,
         name: "Linear GraphQL",
         kind: "graphql",
         endpoint: "https://api.linear.app/graphql",

packages/platform/sdk/src/runtime/sources/source-store.ts+60−52

 import type {
-  AccountId,
+  ScopeId,
   Source,
-  WorkspaceId,
 } from "#schema";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { SourceTypeDeclarationsRefresherService } from "../catalog/source/type-declarations";
+import {
+  SourceTypeDeclarationsRefresherService,
+} from "../catalog/source/type-declarations";
 import {
   SourceArtifactStore,
-  type WorkspaceStorageServices,
+  type ScopeStorageServices,
-  WorkspaceConfigStore,
+  ScopeConfigStore,
-  WorkspaceStateStore,
+  ScopeStateStore,
-} from "../workspace/storage";
+} from "../scope/storage";
-import { SecretMaterialDeleterService } from "../workspace/secret-material-providers";
+import {
-import { RuntimeLocalWorkspaceService } from "../workspace/runtime-context";
+  SecretMaterialDeleterService,
-import { ExecutorStateStore, type ExecutorStateStoreShape } from "../executor-state-store";
+} from "../scope/secret-material-providers";
+import {
+  RuntimeLocalScopeService,
+} from "../scope/runtime-context";
+import {
+  ExecutorStateStore,
+  type ExecutorStateStoreShape,
+} from "../executor-state-store";
 import {
   loadRuntimeSourceStoreDeps,
   type RuntimeSourceStoreDeps,
 export { buildLocalSourceRecord } from "./source-store/records";
 type RuntimeSourceStoreShape = {
-  loadSourcesInWorkspace: (
+  loadSourcesInScope: (
-    workspaceId: WorkspaceId,
+    scopeId: ScopeId,
-    options?: { actorAccountId?: AccountId | null },
+    options?: { actorScopeId?: ScopeId | null },
   ) => ReturnType<typeof loadSourcesInWorkspaceWithDeps>;
-  listLinkedSecretSourcesInWorkspace: (
+  listLinkedSecretSourcesInScope: (
-    workspaceId: WorkspaceId,
+    scopeId: ScopeId,
-    options?: { actorAccountId?: AccountId | null },
+    options?: { actorScopeId?: ScopeId | null },
   ) => ReturnType<typeof listLinkedSecretSourcesInWorkspaceWithDeps>;
   loadSourceById: (input: {
-    workspaceId: WorkspaceId;
+    scopeId: ScopeId;
     sourceId: Source["id"];
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
   }) => ReturnType<typeof loadSourceByIdWithDeps>;
   removeSourceById: (input: {
-    workspaceId: WorkspaceId;
+    scopeId: ScopeId;
     sourceId: Source["id"];
   }) => ReturnType<typeof removeSourceByIdWithDeps>;
   persistSource: (
     source: Source,
-    options?: { actorAccountId?: AccountId | null },
+    options?: { actorScopeId?: ScopeId | null },
   ) => ReturnType<typeof persistSourceWithDeps>;
 };
 export type RuntimeSourceStore = RuntimeSourceStoreShape;
-export const loadSourcesInWorkspace = (
+export const loadSourcesInScope = (
   executorState: ExecutorStateStoreShape,
-  workspaceId: WorkspaceId,
+  scopeId: ScopeId,
   options: {
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
   } = {},
 ): Effect.Effect<
   readonly Source[],
   Error,
-  WorkspaceStorageServices | SourceTypeDeclarationsRefresherService
+  ScopeStorageServices | SourceTypeDeclarationsRefresherService
 > =>
   Effect.flatMap(
-    loadRuntimeSourceStoreDeps(executorState, workspaceId),
+    loadRuntimeSourceStoreDeps(executorState, scopeId),
-    (deps) => loadSourcesInWorkspaceWithDeps(deps, workspaceId, options),
+    (deps) => loadSourcesInWorkspaceWithDeps(deps, scopeId, options),
   );
-export const listLinkedSecretSourcesInWorkspace = (
+export const listLinkedSecretSourcesInScope = (
   executorState: ExecutorStateStoreShape,
-  workspaceId: WorkspaceId,
+  scopeId: ScopeId,
   options: {
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
   } = {},
 ): Effect.Effect<
   Map<string, Array<{ sourceId: string; sourceName: string }>>,
   Error,
-  WorkspaceStorageServices | SourceTypeDeclarationsRefresherService
+  ScopeStorageServices | SourceTypeDeclarationsRefresherService
 > =>
   Effect.flatMap(
-    loadRuntimeSourceStoreDeps(executorState, workspaceId),
+    loadRuntimeSourceStoreDeps(executorState, scopeId),
-    (deps) => listLinkedSecretSourcesInWorkspaceWithDeps(deps, workspaceId, options),
+    (deps) => listLinkedSecretSourcesInWorkspaceWithDeps(deps, scopeId, options),
   );
 export const loadSourceById = (
   executorState: ExecutorStateStoreShape,
   input: {
-    workspaceId: WorkspaceId;
+    scopeId: ScopeId;
     sourceId: Source["id"];
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
   },
 ): Effect.Effect<
   Source,
   Error,
-  WorkspaceStorageServices | SourceTypeDeclarationsRefresherService
+  ScopeStorageServices | SourceTypeDeclarationsRefresherService
 > =>
   Effect.flatMap(
-    loadRuntimeSourceStoreDeps(executorState, input.workspaceId),
+    loadRuntimeSourceStoreDeps(executorState, input.scopeId),
     (deps) => loadSourceByIdWithDeps(deps, input),
   );
 export const removeSourceById = (
   executorState: ExecutorStateStoreShape,
   input: {
-    workspaceId: WorkspaceId;
+    scopeId: ScopeId;
     sourceId: Source["id"];
   },
 ): Effect.Effect<
   boolean,
   Error,
-  | WorkspaceStorageServices
+  | ScopeStorageServices
   | SourceTypeDeclarationsRefresherService
   | SecretMaterialDeleterService
 > =>
   Effect.gen(function* () {
-    const deps = yield* loadRuntimeSourceStoreDeps(executorState, input.workspaceId);
+    const deps = yield* loadRuntimeSourceStoreDeps(executorState, input.scopeId);
     const deleteSecretMaterial = yield* SecretMaterialDeleterService;
     return yield* removeSourceByIdWithDeps(deps, input, deleteSecretMaterial);
   });
   executorState: ExecutorStateStoreShape,
   source: Source,
   options: {
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
   } = {},
 ): Effect.Effect<
   Source,
   Error,
-  | WorkspaceStorageServices
+  | ScopeStorageServices
   | SourceTypeDeclarationsRefresherService
   | SecretMaterialDeleterService
 > =>
   Effect.gen(function* () {
-    const deps = yield* loadRuntimeSourceStoreDeps(executorState, source.workspaceId);
+    const deps = yield* loadRuntimeSourceStoreDeps(executorState, source.scopeId);
     const deleteSecretMaterial = yield* SecretMaterialDeleterService;
     return yield* persistSourceWithDeps(deps, source, options, deleteSecretMaterial);
   });
   RuntimeSourceStoreService,
   Effect.gen(function* () {
     const executorState = yield* ExecutorStateStore;
-    const runtimeLocalWorkspace = yield* RuntimeLocalWorkspaceService;
+    const runtimeLocalScope = yield* RuntimeLocalScopeService;
-    const workspaceConfigStore = yield* WorkspaceConfigStore;
+    const scopeConfigStore = yield* ScopeConfigStore;
-    const workspaceStateStore = yield* WorkspaceStateStore;
+    const scopeStateStore = yield* ScopeStateStore;
     const sourceArtifactStore = yield* SourceArtifactStore;
     const sourceTypeDeclarationsRefresher =
       yield* SourceTypeDeclarationsRefresherService;
     const deps: RuntimeSourceStoreDeps = {
       executorState,
-      runtimeLocalWorkspace,
+      runtimeLocalScope,
-      workspaceConfigStore,
+      scopeConfigStore,
-      workspaceStateStore,
+      scopeStateStore,
       sourceArtifactStore,
       sourceTypeDeclarationsRefresher,
     };
     return RuntimeSourceStoreService.of({
-      loadSourcesInWorkspace: (workspaceId, options = {}) =>
+      loadSourcesInScope: (scopeId, options = {}) =>
-        loadSourcesInWorkspaceWithDeps(deps, workspaceId, options),
+        loadSourcesInWorkspaceWithDeps(deps, scopeId, options),
-      listLinkedSecretSourcesInWorkspace: (workspaceId, options = {}) =>
+      listLinkedSecretSourcesInScope: (scopeId, options = {}) =>
-        listLinkedSecretSourcesInWorkspaceWithDeps(deps, workspaceId, options),
+        listLinkedSecretSourcesInWorkspaceWithDeps(deps, scopeId, options),
       loadSourceById: (input) =>
         loadSourceByIdWithDeps(deps, input),
       removeSourceById: (input) =>

packages/platform/sdk/src/runtime/sources/source-store/auth.ts+27−18

 import type {
-  AccountId,
+  ScopeId,
   AuthArtifact,
   CredentialSlot,
   ProviderAuthGrant,
   Source,
-  WorkspaceId,
 } from "#schema";
-import { decodeProviderGrantRefAuthArtifactConfig } from "#schema";
+import {
+  decodeProviderGrantRefAuthArtifactConfig,
+} from "#schema";
 import * as Effect from "effect/Effect";
-import { authArtifactSecretMaterialRefs } from "../../auth/auth-artifacts";
+import {
-import { removeAuthLeaseAndSecrets } from "../../auth/auth-leases";
+  authArtifactSecretMaterialRefs,
-import type { DeleteSecretMaterial } from "../../workspace/secret-material-providers";
+} from "../../auth/auth-artifacts";
-import type { ExecutorStateStoreShape } from "../../executor-state-store";
+import {
+  removeAuthLeaseAndSecrets,
+} from "../../auth/auth-leases";
+import type {
+  DeleteSecretMaterial,
+} from "../../scope/secret-material-providers";
+import type {
+  ExecutorStateStoreShape,
+} from "../../executor-state-store";
 const secretRefKey = (ref: { providerId: string; handle: string }): string =>
   `${ref.providerId}:${ref.handle}`;
 export const selectPreferredAuthArtifact = (input: {
   authArtifacts: ReadonlyArray<AuthArtifact>;
-  actorAccountId?: AccountId | null;
+  actorScopeId?: ScopeId | null;
   slot: CredentialSlot;
 }): AuthArtifact | null => {
   const matchingSlot = input.authArtifacts.filter(
     (artifact) => artifact.slot === input.slot,
   );
-  if (input.actorAccountId !== undefined) {
+  if (input.actorScopeId !== undefined) {
     const exact = matchingSlot.find(
-      (artifact) => artifact.actorAccountId === input.actorAccountId,
+      (artifact) => artifact.actorScopeId === input.actorScopeId,
     );
     if (exact) {
       return exact;
     }
   }
-  return matchingSlot.find((artifact) => artifact.actorAccountId === null) ?? null;
+  return matchingSlot.find((artifact) => artifact.actorScopeId === null) ?? null;
 };
 export const selectExactAuthArtifact = (input: {
   authArtifacts: ReadonlyArray<AuthArtifact>;
-  actorAccountId?: AccountId | null;
+  actorScopeId?: ScopeId | null;
   slot: CredentialSlot;
 }): AuthArtifact | null =>
   input.authArtifacts.find(
     (artifact) =>
       artifact.slot === input.slot &&
-      artifact.actorAccountId === (input.actorAccountId ?? null),
+      artifact.actorScopeId === (input.actorScopeId ?? null),
   ) ?? null;
 export const removeAuthArtifactsForSource = (
   executorState: ExecutorStateStoreShape,
   input: {
-    workspaceId: WorkspaceId;
+    scopeId: ScopeId;
     sourceId: Source["id"];
   },
   deleteSecretMaterial: DeleteSecretMaterial,
 ) =>
   Effect.gen(function* () {
-    const existingAuthArtifacts = yield* executorState.authArtifacts.listByWorkspaceAndSourceId({
+    const existingAuthArtifacts = yield* executorState.authArtifacts.listByScopeAndSourceId({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       sourceId: input.sourceId,
     });
-    yield* executorState.authArtifacts.removeByWorkspaceAndSourceId({
+    yield* executorState.authArtifacts.removeByScopeAndSourceId({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       sourceId: input.sourceId,
     });

packages/platform/sdk/src/runtime/sources/source-store/config.ts+16−6

   Source,
   SourceId,
 } from "#schema";
-import { SourceIdSchema } from "#schema";
+import {
+  SourceIdSchema,
+} from "#schema";
-import type { LoadedLocalExecutorConfig } from "../../workspace-config";
+import type {
-import { LocalUnsupportedSourceKindError } from "../../workspace-errors";
+  LoadedLocalExecutorConfig,
+} from "../../scope-config";
+import {
+  LocalUnsupportedSourceKindError,
+} from "../../scope-errors";
 import {
   fromConfigSecretProviderId,
   toConfigSecretProviderId,
-} from "../../workspace/config-secrets";
+} from "../../scope/config-secrets";
-import { getSourceAdapterForSource } from "../source-adapters";
+import {
-import { slugify } from "../slug";
+  getSourceAdapterForSource,
+} from "../source-adapters";
+import {
+  slugify,
+} from "../slug";
 export const trimOrNull = (value: string | null | undefined): string | null => {
   if (value == null) {

packages/platform/sdk/src/runtime/sources/source-store/deps.ts+60−52

@@ -1,112 +1,120 @@
1	import type { AccountId, WorkspaceId } from "#schema";	1	import type {
		2	ScopeId,
		3	} from "#schema";
2	import * as Effect from "effect/Effect";	4	import * as Effect from "effect/Effect";
3		5
4	import type { LoadedLocalExecutorConfig } from "../../workspace-config";	6	import type {
		7	LoadedLocalExecutorConfig,
		8	} from "../../scope-config";
5	import {	9	import {
6	SourceTypeDeclarationsRefresherService,	10	SourceTypeDeclarationsRefresherService,
7	type SourceTypeDeclarationsRefresherShape,	11	type SourceTypeDeclarationsRefresherShape,
8	} from "../../catalog/source/type-declarations";	12	} from "../../catalog/source/type-declarations";
9	import {	13	import {
10	RuntimeLocalWorkspaceMismatchError,	14	RuntimeLocalScopeMismatchError,
11	RuntimeLocalWorkspaceUnavailableError,	15	RuntimeLocalScopeUnavailableError,
12	} from "../../workspace-errors";	16	} from "../../scope-errors";
13	import {	17	import {
14	requireRuntimeLocalWorkspace,	18	requireRuntimeLocalScope,
15	type RuntimeLocalWorkspaceState,	19	type RuntimeLocalScopeState,
16	} from "../../workspace/runtime-context";	20	} from "../../scope/runtime-context";
17	import type {	21	import type {
18	SourceArtifactStoreShape,	22	SourceArtifactStoreShape,
19	WorkspaceStorageServices,	23	ScopeStorageServices,
20	WorkspaceConfigStoreShape,	24	ScopeConfigStoreShape,
21	WorkspaceStateStoreShape,	25	ScopeStateStoreShape,
22	} from "../../workspace/storage";	26	} from "../../scope/storage";
23	import {	27	import {
24	SourceArtifactStore,	28	SourceArtifactStore,
25	WorkspaceConfigStore,	29	ScopeConfigStore,
26	WorkspaceStateStore,	30	ScopeStateStore,
27	} from "../../workspace/storage";	31	} from "../../scope/storage";
28	import type { LocalWorkspaceState } from "../../workspace-state";	32	import type {
29	import type { ExecutorStateStoreShape } from "../../executor-state-store";	33	LocalScopeState,
		34	} from "../../scope-state";
		35	import type {
		36	ExecutorStateStoreShape,
		37	} from "../../executor-state-store";
30		38
31	export type RuntimeSourceStoreDeps = {	39	export type RuntimeSourceStoreDeps = {
32	executorState: ExecutorStateStoreShape;	40	executorState: ExecutorStateStoreShape;
33	runtimeLocalWorkspace: RuntimeLocalWorkspaceState;	41	runtimeLocalScope: RuntimeLocalScopeState;
34	workspaceConfigStore: WorkspaceConfigStoreShape;	42	scopeConfigStore: ScopeConfigStoreShape;
35	workspaceStateStore: WorkspaceStateStoreShape;	43	scopeStateStore: ScopeStateStoreShape;
36	sourceArtifactStore: SourceArtifactStoreShape;	44	sourceArtifactStore: SourceArtifactStoreShape;
37	sourceTypeDeclarationsRefresher: SourceTypeDeclarationsRefresherShape;	45	sourceTypeDeclarationsRefresher: SourceTypeDeclarationsRefresherShape;
38	};	46	};
39		47
40	export type ResolvedSourceStoreWorkspace = {	48	export type ResolvedSourceStoreScope = {
41	installation: {	49	installation: {
42	workspaceId: WorkspaceId;	50	scopeId: ScopeId;
43	accountId: AccountId;	51	actorScopeId: ScopeId;
44	};	52	};
45	workspaceConfigStore: WorkspaceConfigStoreShape;	53	scopeConfigStore: ScopeConfigStoreShape;
46	workspaceStateStore: WorkspaceStateStoreShape;	54	scopeStateStore: ScopeStateStoreShape;
47	sourceArtifactStore: SourceArtifactStoreShape;	55	sourceArtifactStore: SourceArtifactStoreShape;
48	loadedConfig: LoadedLocalExecutorConfig;	56	loadedConfig: LoadedLocalExecutorConfig;
49	workspaceState: LocalWorkspaceState;	57	scopeState: LocalScopeState;
50	};	58	};
51		59
52	export type RuntimeSourceStoreServices =	60	export type RuntimeSourceStoreServices =
53	WorkspaceStorageServices \| SourceTypeDeclarationsRefresherService;	61	ScopeStorageServices \| SourceTypeDeclarationsRefresherService;
54		62
55	export const resolveRuntimeLocalWorkspaceFromDeps = (	63	export const resolveRuntimeLocalScopeFromDeps = (
56	deps: RuntimeSourceStoreDeps,	64	deps: RuntimeSourceStoreDeps,
57	workspaceId: WorkspaceId,	65	scopeId: ScopeId,
58	): Effect.Effect<	66	): Effect.Effect<
59	ResolvedSourceStoreWorkspace,	67	ResolvedSourceStoreScope,
60	\| RuntimeLocalWorkspaceUnavailableError	68	\| RuntimeLocalScopeUnavailableError
61	\| RuntimeLocalWorkspaceMismatchError	69	\| RuntimeLocalScopeMismatchError
62	\| Error,	70	\| Error,
63	never	71	never
64	> =>	72	> =>
65	Effect.gen(function* () {	73	Effect.gen(function* () {
66	if (deps.runtimeLocalWorkspace.installation.workspaceId !== workspaceId) {	74	if (deps.runtimeLocalScope.installation.scopeId !== scopeId) {
67	return yield* new RuntimeLocalWorkspaceMismatchError({	75	return yield* new RuntimeLocalScopeMismatchError({
68	message: `Runtime local workspace mismatch: expected ${workspaceId}, got ${deps.runtimeLocalWorkspace.installation.workspaceId}`,	76	message: `Runtime local scope mismatch: expected ${scopeId}, got ${deps.runtimeLocalScope.installation.scopeId}`,
69	requestedWorkspaceId: workspaceId,	77	requestedScopeId: scopeId,
70	activeWorkspaceId: deps.runtimeLocalWorkspace.installation.workspaceId,	78	activeScopeId: deps.runtimeLocalScope.installation.scopeId,
71	});	79	});
72	}	80	}
73		81
74	const loadedConfig = yield* deps.workspaceConfigStore.load();	82	const loadedConfig = yield* deps.scopeConfigStore.load();
75	const workspaceState = yield* deps.workspaceStateStore.load();	83	const scopeState = yield* deps.scopeStateStore.load();
76		84
77	return {	85	return {
78	installation: deps.runtimeLocalWorkspace.installation,	86	installation: deps.runtimeLocalScope.installation,
79	workspaceConfigStore: deps.workspaceConfigStore,	87	scopeConfigStore: deps.scopeConfigStore,
80	workspaceStateStore: deps.workspaceStateStore,	88	scopeStateStore: deps.scopeStateStore,
81	sourceArtifactStore: deps.sourceArtifactStore,	89	sourceArtifactStore: deps.sourceArtifactStore,
82	loadedConfig,	90	loadedConfig,
83	workspaceState,	91	scopeState,
84	};	92	};
85	});	93	});
86		94
87	export const loadRuntimeSourceStoreDeps = (	95	export const loadRuntimeSourceStoreDeps = (
88	executorState: ExecutorStateStoreShape,	96	executorState: ExecutorStateStoreShape,
89	workspaceId: WorkspaceId,	97	scopeId: ScopeId,
90	): Effect.Effect<	98	): Effect.Effect<
91	RuntimeSourceStoreDeps,	99	RuntimeSourceStoreDeps,
92	\| RuntimeLocalWorkspaceUnavailableError	100	\| RuntimeLocalScopeUnavailableError
93	\| RuntimeLocalWorkspaceMismatchError	101	\| RuntimeLocalScopeMismatchError
94	\| Error,	102	\| Error,
95	RuntimeSourceStoreServices	103	RuntimeSourceStoreServices
96	> =>	104	> =>
97	Effect.gen(function* () {	105	Effect.gen(function* () {
98	const runtimeLocalWorkspace = yield* requireRuntimeLocalWorkspace(workspaceId);	106	const runtimeLocalScope = yield* requireRuntimeLocalScope(scopeId);
99	const workspaceConfigStore = yield* WorkspaceConfigStore;	107	const scopeConfigStore = yield* ScopeConfigStore;
100	const workspaceStateStore = yield* WorkspaceStateStore;	108	const scopeStateStore = yield* ScopeStateStore;
101	const sourceArtifactStore = yield* SourceArtifactStore;	109	const sourceArtifactStore = yield* SourceArtifactStore;
102	const sourceTypeDeclarationsRefresher =	110	const sourceTypeDeclarationsRefresher =
103	yield* SourceTypeDeclarationsRefresherService;	111	yield* SourceTypeDeclarationsRefresherService;
104		112
105	return {	113	return {
106	executorState,	114	executorState,
107	runtimeLocalWorkspace,	115	runtimeLocalScope,
108	workspaceConfigStore,	116	scopeConfigStore,
109	workspaceStateStore,	117	scopeStateStore,
110	sourceArtifactStore,	118	sourceArtifactStore,
111	sourceTypeDeclarationsRefresher,	119	sourceTypeDeclarationsRefresher,
112	};	120	};

packages/platform/sdk/src/runtime/sources/source-store/lifecycle.ts+69−60

-import type { AccountId, Source, WorkspaceId } from "#schema";
+import type {
+  ScopeId,
+  Source,
+} from "#schema";
 import * as Effect from "effect/Effect";
-import { removeAuthLeaseAndSecrets } from "../../auth/auth-leases";
+import {
+  removeAuthLeaseAndSecrets,
+} from "../../auth/auth-leases";
 import {
   clearProviderGrantOrphanedAt,
   markProviderGrantOrphanedIfUnused,
 } from "../../auth/provider-grant-lifecycle";
-import type { DeleteSecretMaterial } from "../../workspace/secret-material-providers";
+import type {
-import type { LocalWorkspaceState } from "../../workspace-state";
+  DeleteSecretMaterial,
+} from "../../scope/secret-material-providers";
+import type {
+  LocalScopeState,
+} from "../../scope-state";
 import {
   stableSourceCatalogId,
   stableSourceCatalogRevisionId,
 } from "./config";
 import {
   type RuntimeSourceStoreDeps,
-  resolveRuntimeLocalWorkspaceFromDeps,
+  resolveRuntimeLocalScopeFromDeps,
 } from "./deps";
 import {
   loadSourceByIdWithDeps,
-  shouldRefreshWorkspaceDeclarationsAfterPersist,
+  shouldRefreshScopeDeclarationsAfterPersist,
-  syncWorkspaceSourceTypeDeclarationsWithDeps,
+  syncScopeSourceTypeDeclarationsWithDeps,
 } from "./records";
 export const removeSourceByIdWithDeps = (
   deps: RuntimeSourceStoreDeps,
   input: {
-    workspaceId: WorkspaceId;
+    scopeId: ScopeId;
     sourceId: Source["id"];
   },
   deleteSecretMaterial: DeleteSecretMaterial,
 ): Effect.Effect<boolean, Error, never> =>
   Effect.gen(function* () {
-    const localWorkspace = yield* resolveRuntimeLocalWorkspaceFromDeps(
+    const localScope = yield* resolveRuntimeLocalScopeFromDeps(
       deps,
-      input.workspaceId,
+      input.scopeId,
     );
-    if (!localWorkspace.loadedConfig.config?.sources?.[input.sourceId]) {
+    if (!localScope.loadedConfig.config?.sources?.[input.sourceId]) {
       return false;
     }
-    const projectConfig = cloneJson(localWorkspace.loadedConfig.projectConfig ?? {});
+    const projectConfig = cloneJson(localScope.loadedConfig.projectConfig ?? {});
     const sources = {
       ...projectConfig.sources,
     };
     delete sources[input.sourceId];
-    yield* localWorkspace.workspaceConfigStore.writeProject({
+    yield* localScope.scopeConfigStore.writeProject({
       config: {
         ...projectConfig,
         sources,
     });
     const { [input.sourceId]: _removedSource, ...remainingSources } =
-      localWorkspace.workspaceState.sources;
+      localScope.scopeState.sources;
-    const workspaceState: LocalWorkspaceState = {
+    const scopeState: LocalScopeState = {
-      ...localWorkspace.workspaceState,
+      ...localScope.scopeState,
       sources: remainingSources,
     };
-    yield* localWorkspace.workspaceStateStore.write({
+    yield* localScope.scopeStateStore.write({
-      state: workspaceState,
+      state: scopeState,
     });
-    yield* localWorkspace.sourceArtifactStore.remove({
+    yield* localScope.sourceArtifactStore.remove({
       sourceId: input.sourceId,
     });
     const existingAuthArtifacts =
-      yield* deps.executorState.authArtifacts.listByWorkspaceAndSourceId({
+      yield* deps.executorState.authArtifacts.listByScopeAndSourceId({
-        workspaceId: input.workspaceId,
+        scopeId: input.scopeId,
         sourceId: input.sourceId,
       });
     const removedGrantIds = providerGrantIdsFromArtifacts(existingAuthArtifacts);
-    yield* deps.executorState.sourceAuthSessions.removeByWorkspaceAndSourceId(
+    yield* deps.executorState.sourceAuthSessions.removeByScopeAndSourceId(
-      input.workspaceId,
+      input.scopeId,
       input.sourceId,
     );
-    yield* deps.executorState.sourceOauthClients.removeByWorkspaceAndSourceId({
+    yield* deps.executorState.sourceOauthClients.removeByScopeAndSourceId({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       sourceId: input.sourceId,
     });
     yield* removeAuthArtifactsForSource(deps.executorState, input, deleteSecretMaterial);
       [...removedGrantIds],
       (grantId) =>
         markProviderGrantOrphanedIfUnused(deps.executorState, {
-          workspaceId: input.workspaceId,
+          scopeId: input.scopeId,
           grantId,
         }),
       { discard: true },
     );
-    yield* syncWorkspaceSourceTypeDeclarationsWithDeps(deps, input.workspaceId);
+    yield* syncScopeSourceTypeDeclarationsWithDeps(deps, input.scopeId);
     return true;
   });
   deps: RuntimeSourceStoreDeps,
   source: Source,
   options: {
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
   } = {},
   deleteSecretMaterial: DeleteSecretMaterial,
 ): Effect.Effect<Source, Error, never> =>
   Effect.gen(function* () {
-    const localWorkspace = yield* resolveRuntimeLocalWorkspaceFromDeps(
+    const localScope = yield* resolveRuntimeLocalScopeFromDeps(
       deps,
-      source.workspaceId,
+      source.scopeId,
     );
     const nextSource = {
       ...source,
       id:
-        localWorkspace.loadedConfig.config?.sources?.[source.id] ||
+        localScope.loadedConfig.config?.sources?.[source.id] ||
-        localWorkspace.workspaceState.sources[source.id]
+        localScope.scopeState.sources[source.id]
           ? source.id
           : deriveLocalSourceId(
               source,
-              new Set(Object.keys(localWorkspace.loadedConfig.config?.sources ?? {})),
+              new Set(Object.keys(localScope.loadedConfig.config?.sources ?? {})),
             ),
     } satisfies Source;
     const existingAuthArtifacts =
-      yield* deps.executorState.authArtifacts.listByWorkspaceAndSourceId({
+      yield* deps.executorState.authArtifacts.listByScopeAndSourceId({
-        workspaceId: nextSource.workspaceId,
+        scopeId: nextSource.scopeId,
         sourceId: nextSource.id,
       });
     const existingRuntimeAuthArtifact = selectExactAuthArtifact({
       authArtifacts: existingAuthArtifacts,
-      actorAccountId: options.actorAccountId,
+      actorScopeId: options.actorScopeId,
       slot: "runtime",
     });
     const existingImportAuthArtifact = selectExactAuthArtifact({
       authArtifacts: existingAuthArtifacts,
-      actorAccountId: options.actorAccountId,
+      actorScopeId: options.actorScopeId,
       slot: "import",
     });
-    const projectConfig = cloneJson(localWorkspace.loadedConfig.projectConfig ?? {});
+    const projectConfig = cloneJson(localScope.loadedConfig.projectConfig ?? {});
     const sources = {
       ...projectConfig.sources,
     };
     sources[nextSource.id] = configSourceFromLocalSource({
       source: nextSource,
       existingConfigAuth: existingConfigSource?.connection.auth,
-      config: localWorkspace.loadedConfig.config,
+      config: localScope.loadedConfig.config,
     });
-    yield* localWorkspace.workspaceConfigStore.writeProject({
+    yield* localScope.scopeConfigStore.writeProject({
       config: {
         ...projectConfig,
         sources,
       source: nextSource,
       catalogId: stableSourceCatalogId(nextSource),
       catalogRevisionId: stableSourceCatalogRevisionId(nextSource),
-      actorAccountId: options.actorAccountId,
+      actorScopeId: options.actorScopeId,
       existingRuntimeAuthArtifactId: existingRuntimeAuthArtifact?.id ?? null,
       existingImportAuthArtifactId: existingImportAuthArtifact?.id ?? null,
     });
           authArtifactId: existingRuntimeAuthArtifact.id,
         }, deleteSecretMaterial);
       }
-      yield* deps.executorState.authArtifacts.removeByWorkspaceSourceAndActor({
+      yield* deps.executorState.authArtifacts.removeByScopeSourceAndActor({
-        workspaceId: nextSource.workspaceId,
+        scopeId: nextSource.scopeId,
         sourceId: nextSource.id,
-        actorAccountId: options.actorAccountId ?? null,
+        actorScopeId: options.actorScopeId ?? null,
         slot: "runtime",
       });
     } else {
           authArtifactId: existingImportAuthArtifact.id,
         }, deleteSecretMaterial);
       }
-      yield* deps.executorState.authArtifacts.removeByWorkspaceSourceAndActor({
+      yield* deps.executorState.authArtifacts.removeByScopeSourceAndActor({
-        workspaceId: nextSource.workspaceId,
+        scopeId: nextSource.scopeId,
         sourceId: nextSource.id,
-        actorAccountId: options.actorAccountId ?? null,
+        actorScopeId: options.actorScopeId ?? null,
         slot: "import",
       });
     } else {
       [...previousGrantIds].filter((grantId) => !nextGrantIds.has(grantId)),
       (grantId) =>
         markProviderGrantOrphanedIfUnused(deps.executorState, {
-          workspaceId: nextSource.workspaceId,
+          scopeId: nextSource.scopeId,
           grantId,
         }),
       { discard: true },
     );
-    const existingSourceState = localWorkspace.workspaceState.sources[nextSource.id];
+    const existingSourceState = localScope.scopeState.sources[nextSource.id];
-    const workspaceState: LocalWorkspaceState = {
+    const scopeState: LocalScopeState = {
-      ...localWorkspace.workspaceState,
+      ...localScope.scopeState,
       sources: {
-        ...localWorkspace.workspaceState.sources,
+        ...localScope.scopeState.sources,
         [nextSource.id]: {
           status: nextSource.status,
           lastError: nextSource.lastError,
         },
       },
     };
-    yield* localWorkspace.workspaceStateStore.write({
+    yield* localScope.scopeStateStore.write({
-      state: workspaceState,
+      state: scopeState,
     });
-    if (shouldRefreshWorkspaceDeclarationsAfterPersist(nextSource)) {
+    if (shouldRefreshScopeDeclarationsAfterPersist(nextSource)) {
-      yield* syncWorkspaceSourceTypeDeclarationsWithDeps(
+      yield* syncScopeSourceTypeDeclarationsWithDeps(
         deps,
-        nextSource.workspaceId,
+        nextSource.scopeId,
         options,
       );
     }
     return yield* loadSourceByIdWithDeps(deps, {
-      workspaceId: nextSource.workspaceId,
+      scopeId: nextSource.scopeId,
       sourceId: nextSource.id,
-      actorAccountId: options.actorAccountId,
+      actorScopeId: options.actorScopeId,
     });
   }).pipe(
     Effect.withSpan("source.store.persist", {
       attributes: {
-        "executor.workspace.id": source.workspaceId,
+        "executor.scope.id": source.scopeId,
         "executor.source.id": source.id,
         "executor.source.kind": source.kind,
         "executor.source.status": source.status,

packages/platform/sdk/src/runtime/sources/source-store/records.ts+76−65

 import type {
-  AccountId,
+  ScopeId,
   AuthArtifact,
   Source,
   SourceId,
-  WorkspaceId,
 } from "#schema";
-import { SourceIdSchema } from "#schema";
+import {
+  SourceIdSchema,
+} from "#schema";
 import * as Effect from "effect/Effect";
-import { sourceAuthFromAuthArtifact } from "../../auth/auth-artifacts";
+import {
-import { authArtifactSecretMaterialRefs } from "../../auth/auth-artifacts";
+  sourceAuthFromAuthArtifact,
-import type { LoadedLocalExecutorConfig } from "../../workspace-config";
+} from "../../auth/auth-artifacts";
+import {
+  authArtifactSecretMaterialRefs,
+} from "../../auth/auth-artifacts";
+import type {
+  LoadedLocalExecutorConfig,
+} from "../../scope-config";
 import {
   LocalConfiguredSourceNotFoundError,
-  RuntimeLocalWorkspaceMismatchError,
+  RuntimeLocalScopeMismatchError,
-  RuntimeLocalWorkspaceUnavailableError,
+  RuntimeLocalScopeUnavailableError,
-} from "../../workspace-errors";
+} from "../../scope-errors";
-import type { LocalWorkspaceState } from "../../workspace-state";
+import type {
-import { getSourceAdapter } from "../source-adapters";
+  LocalScopeState,
+} from "../../scope-state";
+import {
+  getSourceAdapter,
+} from "../source-adapters";
 import {
-  resolveRuntimeLocalWorkspaceFromDeps,
+  resolveRuntimeLocalScopeFromDeps,
   type RuntimeSourceStoreDeps,
 } from "./deps";
 import {
 } from "./config";
 export const buildLocalSourceRecord = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   loadedConfig: LoadedLocalExecutorConfig;
-  workspaceState: LocalWorkspaceState;
+  scopeState: LocalScopeState;
   sourceId: SourceId;
-  actorAccountId?: AccountId | null;
+  actorScopeId?: ScopeId | null;
   authArtifacts: ReadonlyArray<AuthArtifact>;
 }): Effect.Effect<
   {
         });
     }
-    const existingState = input.workspaceState.sources[input.sourceId];
+    const existingState = input.scopeState.sources[input.sourceId];
     const adapter = getSourceAdapter(sourceConfig.kind);
     const baseSource = (yield* adapter.validateSource({
       id: SourceIdSchema.make(input.sourceId),
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       name: trimOrNull(sourceConfig.name) ?? input.sourceId,
       kind: sourceConfig.kind,
       endpoint: sourceConfig.connection.endpoint.trim(),
       authArtifacts: input.authArtifacts.filter(
         (artifactItem) => artifactItem.sourceId === baseSource.id,
       ),
-      actorAccountId: input.actorAccountId,
+      actorScopeId: input.actorScopeId,
       slot: "runtime",
     });
     const importAuthArtifact = selectPreferredAuthArtifact({
       authArtifacts: input.authArtifacts.filter(
         (artifactItem) => artifactItem.sourceId === baseSource.id,
       ),
-      actorAccountId: input.actorAccountId,
+      actorScopeId: input.actorScopeId,
       slot: "import",
     });
 export const loadSourcesInWorkspaceWithDeps = (
   deps: RuntimeSourceStoreDeps,
-  workspaceId: WorkspaceId,
+  scopeId: ScopeId,
   options: {
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
   } = {},
 ): Effect.Effect<
   readonly Source[],
-  | RuntimeLocalWorkspaceUnavailableError
+  | RuntimeLocalScopeUnavailableError
-  | RuntimeLocalWorkspaceMismatchError
+  | RuntimeLocalScopeMismatchError
   | LocalConfiguredSourceNotFoundError
   | Error,
   never
 > =>
   Effect.gen(function* () {
-    const localWorkspace = yield* resolveRuntimeLocalWorkspaceFromDeps(
+    const localScope = yield* resolveRuntimeLocalScopeFromDeps(
       deps,
-      workspaceId,
+      scopeId,
     );
-    const authArtifacts = yield* deps.executorState.authArtifacts.listByWorkspaceId(
+    const authArtifacts = yield* deps.executorState.authArtifacts.listByScopeId(
-      workspaceId,
+      scopeId,
     );
     const sources = yield* Effect.forEach(
-      Object.keys(localWorkspace.loadedConfig.config?.sources ?? {}),
+      Object.keys(localScope.loadedConfig.config?.sources ?? {}),
       (sourceId) =>
         Effect.map(
           buildLocalSourceRecord({
-            workspaceId,
+            scopeId,
-            loadedConfig: localWorkspace.loadedConfig,
+            loadedConfig: localScope.loadedConfig,
-            workspaceState: localWorkspace.workspaceState,
+            scopeState: localScope.scopeState,
             sourceId: SourceIdSchema.make(sourceId),
-            actorAccountId: options.actorAccountId,
+            actorScopeId: options.actorScopeId,
             authArtifacts,
           }),
           ({ source }) => source,
     yield* Effect.annotateCurrentSpan("executor.source.count", sources.length);
     return sources;
   }).pipe(
-    Effect.withSpan("source.store.load_workspace", {
+    Effect.withSpan("source.store.load_scope", {
       attributes: {
-        "executor.workspace.id": workspaceId,
+        "executor.scope.id": scopeId,
       },
     }),
   );
-export const syncWorkspaceSourceTypeDeclarationsWithDeps = (
+export const syncScopeSourceTypeDeclarationsWithDeps = (
   deps: RuntimeSourceStoreDeps,
-  workspaceId: WorkspaceId,
+  scopeId: ScopeId,
   options: {
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
   } = {},
 ): Effect.Effect<void, Error, never> =>
   Effect.gen(function* () {
-    const localWorkspace = yield* resolveRuntimeLocalWorkspaceFromDeps(
+    const localScope = yield* resolveRuntimeLocalScopeFromDeps(
       deps,
-      workspaceId,
+      scopeId,
     );
     const sources = yield* loadSourcesInWorkspaceWithDeps(
       deps,
-      workspaceId,
+      scopeId,
       options,
     );
     const entries = yield* Effect.forEach(sources, (source) =>
       ),
     });
   }).pipe(
-    Effect.withSpan("source.types.refresh_workspace.schedule", {
+    Effect.withSpan("source.types.refresh_scope.schedule", {
       attributes: {
-        "executor.workspace.id": workspaceId,
+        "executor.scope.id": scopeId,
       },
     }),
   );
-export const shouldRefreshWorkspaceDeclarationsAfterPersist = (source: Source): boolean =>
+export const shouldRefreshScopeDeclarationsAfterPersist = (source: Source): boolean =>
   source.enabled === false ||
   source.status === "auth_required" ||
   source.status === "error" ||
 export const listLinkedSecretSourcesInWorkspaceWithDeps = (
   deps: RuntimeSourceStoreDeps,
-  workspaceId: WorkspaceId,
+  scopeId: ScopeId,
   options: {
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
   } = {},
 ): Effect.Effect<
   Map<string, Array<{ sourceId: string; sourceName: string }>>,
-  | RuntimeLocalWorkspaceUnavailableError
+  | RuntimeLocalScopeUnavailableError
-  | RuntimeLocalWorkspaceMismatchError
+  | RuntimeLocalScopeMismatchError
   | LocalConfiguredSourceNotFoundError
   | Error,
   never
 > =>
   Effect.gen(function* () {
     const [sources, authArtifacts, materialIds] = yield* Effect.all([
-      loadSourcesInWorkspaceWithDeps(deps, workspaceId, {
+      loadSourcesInWorkspaceWithDeps(deps, scopeId, {
-        actorAccountId: options.actorAccountId,
+        actorScopeId: options.actorScopeId,
       }),
-      deps.executorState.authArtifacts.listByWorkspaceId(workspaceId),
+      deps.executorState.authArtifacts.listByScopeId(scopeId),
       deps.executorState.secretMaterials.listAll().pipe(
         Effect.map(
           (materials) => new Set(materials.map((material) => String(material.id))),
 export const loadSourceByIdWithDeps = (
   deps: RuntimeSourceStoreDeps,
   input: {
-    workspaceId: WorkspaceId;
+    scopeId: ScopeId;
     sourceId: Source["id"];
-    actorAccountId?: AccountId | null;
+    actorScopeId?: ScopeId | null;
   },
 ): Effect.Effect<
   Source,
-  | RuntimeLocalWorkspaceUnavailableError
+  | RuntimeLocalScopeUnavailableError
-  | RuntimeLocalWorkspaceMismatchError
+  | RuntimeLocalScopeMismatchError
   | LocalConfiguredSourceNotFoundError
   | Error,
   never
 > =>
   Effect.gen(function* () {
-    const localWorkspace = yield* resolveRuntimeLocalWorkspaceFromDeps(
+    const localScope = yield* resolveRuntimeLocalScopeFromDeps(
       deps,
-      input.workspaceId,
+      input.scopeId,
     );
-    const authArtifacts = yield* deps.executorState.authArtifacts.listByWorkspaceId(
+    const authArtifacts = yield* deps.executorState.authArtifacts.listByScopeId(
-      input.workspaceId,
+      input.scopeId,
     );
-    if (!localWorkspace.loadedConfig.config?.sources?.[input.sourceId]) {
+    if (!localScope.loadedConfig.config?.sources?.[input.sourceId]) {
       return yield* new LocalConfiguredSourceNotFoundError({
-          message: `Source not found: workspaceId=${input.workspaceId} sourceId=${input.sourceId}`,
+          message: `Source not found: scopeId=${input.scopeId} sourceId=${input.sourceId}`,
           sourceId: input.sourceId,
         });
     }
     const localSource = yield* buildLocalSourceRecord({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
-      loadedConfig: localWorkspace.loadedConfig,
+      loadedConfig: localScope.loadedConfig,
-      workspaceState: localWorkspace.workspaceState,
+      scopeState: localScope.scopeState,
       sourceId: input.sourceId,
-      actorAccountId: input.actorAccountId,
+      actorScopeId: input.actorScopeId,
       authArtifacts,
     });
   }).pipe(
     Effect.withSpan("source.store.load_by_id", {
       attributes: {
-        "executor.workspace.id": input.workspaceId,
+        "executor.scope.id": input.scopeId,
         "executor.source.id": input.sourceId,
       },
     }),

packages/platform/sdk/src/runtime/workspace/runtime-context.ts+0−78

@@ -1,78 +0,0 @@
1	import * as Context from "effect/Context";
2	import * as Effect from "effect/Effect";
3	import * as Layer from "effect/Layer";
4	import * as Option from "effect/Option";
5
6	import type { AccountId, WorkspaceId } from "#schema";
7	import type { ExecutorWorkspaceContext } from "../../workspace";
8	import type { LoadedLocalExecutorConfig } from "../workspace-config";
9	import {
10	RuntimeLocalWorkspaceMismatchError,
11	RuntimeLocalWorkspaceUnavailableError,
12	} from "../workspace-errors";
13
14	export type RuntimeLocalWorkspaceState = {
15	workspace: ExecutorWorkspaceContext;
16	installation: {
17	workspaceId: WorkspaceId;
18	accountId: AccountId;
19	};
20	loadedConfig: LoadedLocalExecutorConfig;
21	};
22
23	export class RuntimeLocalWorkspaceService extends Context.Tag(
24	"#runtime/RuntimeLocalWorkspaceService",
25	)<RuntimeLocalWorkspaceService, RuntimeLocalWorkspaceState>() {}
26
27	export const RuntimeLocalWorkspaceLive = (
28	runtimeLocalWorkspace: RuntimeLocalWorkspaceState,
29	) => Layer.succeed(RuntimeLocalWorkspaceService, runtimeLocalWorkspace);
30
31	export const provideOptionalRuntimeLocalWorkspace = <A, E, R>(
32	effect: Effect.Effect<A, E, R>,
33	runtimeLocalWorkspace: RuntimeLocalWorkspaceState \| null \| undefined,
34	): Effect.Effect<A, E, R> =>
35	runtimeLocalWorkspace === null \|\| runtimeLocalWorkspace === undefined
36	? effect
37	: effect.pipe(Effect.provide(RuntimeLocalWorkspaceLive(runtimeLocalWorkspace)));
38
39	export const getRuntimeLocalWorkspaceOption = () =>
40	Effect.contextWith((context) =>
41	Context.getOption(context, RuntimeLocalWorkspaceService),
42	).pipe(
43	Effect.map((option) => (Option.isSome(option) ? option.value : null)),
44	) as Effect.Effect<RuntimeLocalWorkspaceState \| null, never, never>;
45
46	export const requireRuntimeLocalWorkspace = (
47	workspaceId?: WorkspaceId,
48	): Effect.Effect<
49	RuntimeLocalWorkspaceState,
50	RuntimeLocalWorkspaceUnavailableError \| RuntimeLocalWorkspaceMismatchError,
51	never
52	> =>
53	Effect.gen(function* () {
54	const runtimeLocalWorkspace = yield* getRuntimeLocalWorkspaceOption();
55	if (runtimeLocalWorkspace === null) {
56	return yield* new RuntimeLocalWorkspaceUnavailableError({
57	message: "Runtime local workspace is unavailable",
58	});
59	}
60
61	if (
62	workspaceId !== undefined
63	&& runtimeLocalWorkspace.installation.workspaceId !== workspaceId
64	) {
65	return yield* new RuntimeLocalWorkspaceMismatchError({
66	message: `Workspace ${workspaceId} is not the active local workspace ${runtimeLocalWorkspace.installation.workspaceId}`,
67	requestedWorkspaceId: workspaceId,
68	activeWorkspaceId: runtimeLocalWorkspace.installation.workspaceId,
69	});
70	}
71
72	return runtimeLocalWorkspace;
73	});
74
75	export const requireRuntimeLocalAccountId = (workspaceId?: WorkspaceId) =>
76	requireRuntimeLocalWorkspace(workspaceId).pipe(
77	Effect.map((runtimeLocalWorkspace) => runtimeLocalWorkspace.installation.accountId),
78	);

packages/platform/sdk/src/schema/common.ts+3−1

@@ -1,4 +1,6 @@
1	import { Schema } from "effect";	1	import {
		2	Schema,
		3	} from "effect";
2		4
3	export const TimestampMsSchema = Schema.Number;	5	export const TimestampMsSchema = Schema.Number;
4		6

packages/platform/sdk/src/schema/enums.ts+4−4

@@ -54,8 +54,8 @@ export { · 53 unmodified lines
54	type SourceAuthSessionStatus,	54	type SourceAuthSessionStatus,
55	} from "./models/source-auth-session";	55	} from "./models/source-auth-session";
56	export {	56	export {
57	LocalWorkspacePolicyApprovalModeSchema,	57	LocalScopePolicyApprovalModeSchema,
58	LocalWorkspacePolicyEffectSchema,	58	LocalScopePolicyEffectSchema,
59	type LocalWorkspacePolicyApprovalMode,	59	type LocalScopePolicyApprovalMode,
60	type LocalWorkspacePolicyEffect,	60	type LocalScopePolicyEffect,
61	} from "./models/policy";	61	} from "./models/policy";

packages/platform/sdk/src/schema/ids.ts+11−11

-import { Schema } from "effect";
+import {
+  Schema,
+} from "effect";
-export const AccountIdSchema = Schema.String.pipe(Schema.brand("AccountId"));
+export const ScopeIdSchema = Schema.String.pipe(Schema.brand("ScopeId"));
-export const WorkspaceIdSchema = Schema.String.pipe(Schema.brand("WorkspaceId"));
 export const SourceIdSchema = Schema.String.pipe(Schema.brand("SourceId"));
 export const SourceCatalogIdSchema = Schema.String.pipe(Schema.brand("SourceCatalogId"));
 export const SourceCatalogRevisionIdSchema = Schema.String.pipe(
   Schema.brand("AuthLeaseId"),
 );
 export const CredentialIdSchema = AuthArtifactIdSchema;
-export const WorkspaceSourceOauthClientIdSchema = Schema.String.pipe(
+export const ScopedSourceOauthClientIdSchema = Schema.String.pipe(
-  Schema.brand("WorkspaceSourceOauthClientId"),
+  Schema.brand("ScopedSourceOauthClientId"),
 );
-export const WorkspaceOauthClientIdSchema = Schema.String.pipe(
+export const ScopeOauthClientIdSchema = Schema.String.pipe(
-  Schema.brand("WorkspaceOauthClientId"),
+  Schema.brand("ScopeOauthClientId"),
 );
 export const ProviderAuthGrantIdSchema = Schema.String.pipe(
   Schema.brand("ProviderAuthGrantId"),
   Schema.brand("ExecutionStepId"),
 );
-export type AccountId = typeof AccountIdSchema.Type;
+export type ScopeId = typeof ScopeIdSchema.Type;
-export type WorkspaceId = typeof WorkspaceIdSchema.Type;
 export type SourceId = typeof SourceIdSchema.Type;
 export type SourceCatalogId = typeof SourceCatalogIdSchema.Type;
 export type SourceCatalogRevisionId = typeof SourceCatalogRevisionIdSchema.Type;
 export type AuthArtifactId = typeof AuthArtifactIdSchema.Type;
 export type AuthLeaseId = typeof AuthLeaseIdSchema.Type;
 export type CredentialId = typeof CredentialIdSchema.Type;
-export type WorkspaceSourceOauthClientId = typeof WorkspaceSourceOauthClientIdSchema.Type;
+export type ScopedSourceOauthClientId = typeof ScopedSourceOauthClientIdSchema.Type;
-export type WorkspaceOauthClientId = typeof WorkspaceOauthClientIdSchema.Type;
+export type ScopeOauthClientId = typeof ScopeOauthClientIdSchema.Type;
 export type ProviderAuthGrantId = typeof ProviderAuthGrantIdSchema.Type;
 export type SecretMaterialId = typeof SecretMaterialIdSchema.Type;
 export type PolicyId = typeof PolicyIdSchema.Type;

packages/platform/sdk/src/schema/index.ts+1−1

@@ -7,7 +7,7 @@ export * from "./models/source-catalog"; · 6 unmodified lines
7	export * from "./models/auth-artifact";	7	export * from "./models/auth-artifact";
8	export * from "./models/auth-lease";	8	export * from "./models/auth-lease";
9	export * from "./models/source-oauth-client";	9	export * from "./models/source-oauth-client";
10	export * from "./models/workspace-oauth-client";	10	export * from "./models/scope-oauth-client";
11	export * from "./models/provider-auth-grant";	11	export * from "./models/provider-auth-grant";
12	export * from "./models/secret-material";	12	export * from "./models/secret-material";
13	export * from "./models/source-auth-session";	13	export * from "./models/source-auth-session";

packages/platform/sdk/src/schema/models/auth-artifact.ts+9−6

-import { Schema } from "effect";
+import {
+  Schema,
+} from "effect";
 import * as Option from "effect/Option";
-import { TimestampMsSchema } from "../common";
 import {
-  AccountIdSchema,
+  TimestampMsSchema,
+} from "../common";
+import {
+  ScopeIdSchema,
   AuthArtifactIdSchema,
   ProviderAuthGrantIdSchema,
   SourceIdSchema,
-  WorkspaceIdSchema,
 } from "../ids";
 export const SecretRefSchema = Schema.Struct({
 export const AuthArtifactSchema = Schema.Struct({
   id: AuthArtifactIdSchema,
-  workspaceId: WorkspaceIdSchema,
+  scopeId: ScopeIdSchema,
   sourceId: SourceIdSchema,
-  actorAccountId: Schema.NullOr(AccountIdSchema),
+  actorScopeId: Schema.NullOr(ScopeIdSchema),
   slot: AuthArtifactSlotSchema,
   artifactKind: AuthArtifactKindSchema,
   configJson: Schema.String,

packages/platform/sdk/src/schema/models/auth-lease.ts+9−6

-import { Schema } from "effect";
+import {
+  Schema,
+} from "effect";
 import * as Option from "effect/Option";
-import { TimestampMsSchema } from "../common";
 import {
-  AccountIdSchema,
+  TimestampMsSchema,
+} from "../common";
+import {
+  ScopeIdSchema,
   AuthArtifactIdSchema,
   AuthLeaseIdSchema,
   SourceIdSchema,
-  WorkspaceIdSchema,
 } from "../ids";
 import {
 export const AuthLeaseSchema = Schema.Struct({
   id: AuthLeaseIdSchema,
   authArtifactId: AuthArtifactIdSchema,
-  workspaceId: WorkspaceIdSchema,
+  scopeId: ScopeIdSchema,
   sourceId: SourceIdSchema,
-  actorAccountId: Schema.NullOr(AccountIdSchema),
+  actorScopeId: Schema.NullOr(ScopeIdSchema),
   slot: AuthArtifactSlotSchema,
   placementsTemplateJson: Schema.String,
   expiresAt: Schema.NullOr(TimestampMsSchema),

packages/platform/sdk/src/schema/models/code-migration.ts+6−2

-import { Schema } from "effect";
+import {
+  Schema,
+} from "effect";
-import { TimestampMsSchema } from "../common";
+import {
+  TimestampMsSchema,
+} from "../common";
 export const StoredCodeMigrationRecordSchema = Schema.Struct({
   id: Schema.String,

packages/platform/sdk/src/schema/models/execution.ts+9−6

-import { Schema } from "effect";
+import {
+  Schema,
+} from "effect";
-import { TimestampMsSchema } from "../common";
 import {
-  AccountIdSchema,
+  TimestampMsSchema,
+} from "../common";
+import {
   ExecutionIdSchema,
   ExecutionInteractionIdSchema,
   ExecutionStepIdSchema,
-  WorkspaceIdSchema,
+  ScopeIdSchema,
 } from "../ids";
 export const ExecutionStatusSchema = Schema.Literal(
 export const ExecutionSchema = Schema.Struct({
   id: ExecutionIdSchema,
-  workspaceId: WorkspaceIdSchema,
+  scopeId: ScopeIdSchema,
-  createdByAccountId: AccountIdSchema,
+  createdByScopeId: ScopeIdSchema,
   status: ExecutionStatusSchema,
   code: Schema.String,
   resultJson: Schema.NullOr(Schema.String),

packages/platform/sdk/src/schema/models/local-config.ts+6−2

-import { Schema } from "effect";
+import {
+  Schema,
+} from "effect";
-import { localConfigurableSourceAdapters } from "../../runtime/sources/source-adapters";
+import {
+  localConfigurableSourceAdapters,
+} from "../../runtime/sources/source-adapters";
 export const LocalExecutorRuntimeSchema = Schema.Literal(
   "quickjs",

packages/platform/sdk/src/schema/models/local-installation.ts+4−4

 import * as Schema from "effect/Schema";
 import {
-  AccountIdSchema,
+  ScopeIdSchema,
-  WorkspaceIdSchema,
 } from "../ids";
 export const LocalInstallationSchema = Schema.Struct({
-  accountId: AccountIdSchema,
+  scopeId: ScopeIdSchema,
-  workspaceId: WorkspaceIdSchema,
+  actorScopeId: ScopeIdSchema,
+  resolutionScopeIds: Schema.Array(ScopeIdSchema),
 });
 export const LocalInstallationInsertSchema = LocalInstallationSchema;

packages/platform/sdk/src/schema/models/policy.ts+22−15

@@ -1,28 +1,35 @@
1	import { Schema } from "effect";	1	import {
		2	Schema,
		3	} from "effect";
2		4
3	import { TimestampMsSchema } from "../common";	5	import {
4	import { PolicyIdSchema, WorkspaceIdSchema } from "../ids";	6	TimestampMsSchema,
		7	} from "../common";
		8	import {
		9	PolicyIdSchema,
		10	ScopeIdSchema,
		11	} from "../ids";
5		12
6	export const LocalWorkspacePolicyEffectSchema = Schema.Literal("allow", "deny");	13	export const LocalScopePolicyEffectSchema = Schema.Literal("allow", "deny");
7	export const LocalWorkspacePolicyApprovalModeSchema = Schema.Literal("auto", "required");	14	export const LocalScopePolicyApprovalModeSchema = Schema.Literal("auto", "required");
8		15
9	export const LocalWorkspacePolicySchema = Schema.Struct({	16	export const LocalScopePolicySchema = Schema.Struct({
10	id: PolicyIdSchema,	17	id: PolicyIdSchema,
11	key: Schema.String,	18	key: Schema.String,
12	workspaceId: WorkspaceIdSchema,	19	scopeId: ScopeIdSchema,
13	resourcePattern: Schema.String,	20	resourcePattern: Schema.String,
14	effect: LocalWorkspacePolicyEffectSchema,	21	effect: LocalScopePolicyEffectSchema,
15	approvalMode: LocalWorkspacePolicyApprovalModeSchema,	22	approvalMode: LocalScopePolicyApprovalModeSchema,
16	priority: Schema.Number,	23	priority: Schema.Number,
17	enabled: Schema.Boolean,	24	enabled: Schema.Boolean,
18	createdAt: TimestampMsSchema,	25	createdAt: TimestampMsSchema,
19	updatedAt: TimestampMsSchema,	26	updatedAt: TimestampMsSchema,
20	});	27	});
21		28
22	export const LocalWorkspacePolicyInsertSchema = LocalWorkspacePolicySchema;	29	export const LocalScopePolicyInsertSchema = LocalScopePolicySchema;
23	export const LocalWorkspacePolicyUpdateSchema = Schema.partial(LocalWorkspacePolicySchema);	30	export const LocalScopePolicyUpdateSchema = Schema.partial(LocalScopePolicySchema);
24		31
25	export type LocalWorkspacePolicyEffect = typeof LocalWorkspacePolicyEffectSchema.Type;	32	export type LocalScopePolicyEffect = typeof LocalScopePolicyEffectSchema.Type;
26	export type LocalWorkspacePolicyApprovalMode =	33	export type LocalScopePolicyApprovalMode =
27	typeof LocalWorkspacePolicyApprovalModeSchema.Type;	34	typeof LocalScopePolicyApprovalModeSchema.Type;
28	export type LocalWorkspacePolicy = typeof LocalWorkspacePolicySchema.Type;	35	export type LocalScopePolicy = typeof LocalScopePolicySchema.Type;

packages/platform/sdk/src/schema/models/provider-auth-grant.ts+11−8

-import { Schema } from "effect";
+import {
+  Schema,
+} from "effect";
-import { TimestampMsSchema } from "../common";
 import {
-  AccountIdSchema,
+  TimestampMsSchema,
+} from "../common";
+import {
+  ScopeIdSchema,
   ProviderAuthGrantIdSchema,
-  WorkspaceIdSchema,
+  ScopeOauthClientIdSchema,
-  WorkspaceOauthClientIdSchema,
 } from "../ids";
 import {
 export const ProviderAuthGrantSchema = Schema.Struct({
   id: ProviderAuthGrantIdSchema,
-  workspaceId: WorkspaceIdSchema,
+  scopeId: ScopeIdSchema,
-  actorAccountId: Schema.NullOr(AccountIdSchema),
+  actorScopeId: Schema.NullOr(ScopeIdSchema),
   providerKey: Schema.String,
-  oauthClientId: WorkspaceOauthClientIdSchema,
+  oauthClientId: ScopeOauthClientIdSchema,
   tokenEndpoint: Schema.String,
   clientAuthentication: OAuth2ClientAuthenticationMethodSchema,
   headerName: Schema.String,

packages/platform/sdk/src/schema/models/scope-oauth-client.tsrenamed from packages/platform/sdk/src/schema/models/workspace-oauth-client.ts+12−8

-import { Schema } from "effect";
+import {
+  Schema,
+} from "effect";
-import { TimestampMsSchema } from "../common";
 import {
-  WorkspaceIdSchema,
+  TimestampMsSchema,
-  WorkspaceOauthClientIdSchema,
+} from "../common";
+import {
+  ScopeIdSchema,
+  ScopeOauthClientIdSchema,
 } from "../ids";
-export const WorkspaceOauthClientSchema = Schema.Struct({
+export const ScopeOauthClientSchema = Schema.Struct({
-  id: WorkspaceOauthClientIdSchema,
+  id: ScopeOauthClientIdSchema,
-  workspaceId: WorkspaceIdSchema,
+  scopeId: ScopeIdSchema,
   providerKey: Schema.String,
   label: Schema.NullOr(Schema.String),
   clientId: Schema.String,
   updatedAt: TimestampMsSchema,
 });
-export type WorkspaceOauthClient = typeof WorkspaceOauthClientSchema.Type;
+export type ScopeOauthClient = typeof ScopeOauthClientSchema.Type;

packages/platform/sdk/src/schema/models/secret-material.ts+9−3

-import { Schema } from "effect";
+import {
+  Schema,
+} from "effect";
-import { TimestampMsSchema } from "../common";
+import {
-import { SecretMaterialIdSchema } from "../ids";
+  TimestampMsSchema,
+} from "../common";
+import {
+  SecretMaterialIdSchema,
+} from "../ids";
 export const SecretMaterialPurposeSchema = Schema.Literal(
   "auth_material",

packages/platform/sdk/src/schema/models/source-auth-session.ts+11−8

-import { Schema } from "effect";
+import {
+  Schema,
+} from "effect";
-import { TimestampMsSchema } from "../common";
 import {
-  AccountIdSchema,
+  TimestampMsSchema,
+} from "../common";
+import {
+  ScopeIdSchema,
   ExecutionIdSchema,
   ExecutionInteractionIdSchema,
   SourceIdSchema,
   SourceAuthSessionIdSchema,
-  WorkspaceOauthClientIdSchema,
+  ScopeOauthClientIdSchema,
-  WorkspaceIdSchema,
 } from "../ids";
 import {
   CredentialSlotSchema,
   authorizationEndpoint: Schema.String,
   tokenEndpoint: Schema.String,
   redirectUri: Schema.String,
-  oauthClientId: WorkspaceOauthClientIdSchema,
+  oauthClientId: ScopeOauthClientIdSchema,
   clientAuthentication: OAuth2ClientAuthenticationMethodSchema,
   scopes: Schema.Array(Schema.String),
   headerName: Schema.String,
 export const SourceAuthSessionSchema = Schema.Struct({
   id: SourceAuthSessionIdSchema,
-  workspaceId: WorkspaceIdSchema,
+  scopeId: ScopeIdSchema,
   sourceId: SourceIdSchema,
-  actorAccountId: Schema.NullOr(AccountIdSchema),
+  actorScopeId: Schema.NullOr(ScopeIdSchema),
   credentialSlot: CredentialSlotSchema,
   executionId: Schema.NullOr(ExecutionIdSchema),
   interactionId: Schema.NullOr(ExecutionInteractionIdSchema),

packages/platform/sdk/src/schema/models/source-catalog.ts+7−3

-import { Schema } from "effect";
+import {
+  Schema,
+} from "effect";
-import { TimestampMsSchema } from "../common";
+import {
+  TimestampMsSchema,
+} from "../common";
 import {
   SourceCatalogIdSchema,
   SourceCatalogRevisionIdSchema,
 export const SourceCatalogVisibilitySchema = Schema.Literal(
   "private",
-  "workspace",
+  "scope",
   "organization",
   "public",
 );

packages/platform/sdk/src/schema/models/source-inspection.ts+6−2

@@ -1,6 +1,10 @@
1	import { Schema } from "effect";	1	import {
		2	Schema,
		3	} from "effect";
2		4
3	import { SourceSchema } from "./source";	5	import {
		6	SourceSchema,
		7	} from "./source";
4		8
5	export const SourceInspectionPipelineKindSchema = Schema.Literal("ir");	9	export const SourceInspectionPipelineKindSchema = Schema.Literal("ir");
6		10

packages/platform/sdk/src/schema/models/source-oauth-client.ts+22−18

@@ -1,31 +1,35 @@
1	import { Schema } from "effect";	1	import {
		2	Schema,
		3	} from "effect";
2	export {	4	export {
3	SourceOauthClientInputSchema,	5	SourceOauthClientInputSchema,
4	WorkspaceSourceOauthClientRedirectModeSchema,	6	ScopedSourceOauthClientRedirectModeSchema,
5	} from "@executor/source-core";	7	} from "@executor/source-core";
6	import {	8	import {
7	SourceOauthClientInputSchema,	9	SourceOauthClientInputSchema,
8	WorkspaceSourceOauthClientRedirectModeSchema,	10	ScopedSourceOauthClientRedirectModeSchema,
9	} from "@executor/source-core";	11	} from "@executor/source-core";
10		12
11	import { TimestampMsSchema } from "../common";	13	import {
		14	TimestampMsSchema,
		15	} from "../common";
12	import {	16	import {
13	SourceIdSchema,	17	SourceIdSchema,
14	WorkspaceIdSchema,	18	ScopeIdSchema,
15	WorkspaceSourceOauthClientIdSchema,	19	ScopedSourceOauthClientIdSchema,
16	} from "../ids";	20	} from "../ids";
17		21
18	export const WorkspaceSourceOauthClientMetadataSchema = Schema.Struct({	22	export const ScopedSourceOauthClientMetadataSchema = Schema.Struct({
19	redirectMode: Schema.optional(WorkspaceSourceOauthClientRedirectModeSchema),	23	redirectMode: Schema.optional(ScopedSourceOauthClientRedirectModeSchema),
20	});	24	});
21		25
22	export const WorkspaceSourceOauthClientMetadataJsonSchema = Schema.parseJson(	26	export const ScopedSourceOauthClientMetadataJsonSchema = Schema.parseJson(
23	WorkspaceSourceOauthClientMetadataSchema,	27	ScopedSourceOauthClientMetadataSchema,
24	);	28	);
25		29
26	export const WorkspaceSourceOauthClientSchema = Schema.Struct({	30	export const ScopedSourceOauthClientSchema = Schema.Struct({
27	id: WorkspaceSourceOauthClientIdSchema,	31	id: ScopedSourceOauthClientIdSchema,
28	workspaceId: WorkspaceIdSchema,	32	scopeId: ScopeIdSchema,
29	sourceId: SourceIdSchema,	33	sourceId: SourceIdSchema,
30	providerKey: Schema.String,	34	providerKey: Schema.String,
31	clientId: Schema.String,	35	clientId: Schema.String,
@@ -36,9 +40,9 @@ export const WorkspaceSourceOauthClientSchema = Schema.Struct({ · 4 unmodified lines
36	updatedAt: TimestampMsSchema,	40	updatedAt: TimestampMsSchema,
37	});	41	});
38		42
39	export type WorkspaceSourceOauthClient = typeof WorkspaceSourceOauthClientSchema.Type;	43	export type ScopedSourceOauthClient = typeof ScopedSourceOauthClientSchema.Type;
40	export type WorkspaceSourceOauthClientRedirectMode =	44	export type ScopedSourceOauthClientRedirectMode =
41	typeof WorkspaceSourceOauthClientRedirectModeSchema.Type;	45	typeof ScopedSourceOauthClientRedirectModeSchema.Type;
42	export type WorkspaceSourceOauthClientMetadata =	46	export type ScopedSourceOauthClientMetadata =
43	typeof WorkspaceSourceOauthClientMetadataSchema.Type;	47	typeof ScopedSourceOauthClientMetadataSchema.Type;
44	export type SourceOauthClientInput = typeof SourceOauthClientInputSchema.Type;	48	export type SourceOauthClientInput = typeof SourceOauthClientInputSchema.Type;

packages/platform/sdk/src/schema/models/source.ts+18−10

-import { Schema } from "effect";
+import {
+  Schema,
+} from "effect";
 export {
   SourceImportAuthPolicySchema,
   SourceTransportSchema,
   StringMapSchema,
 } from "@executor/source-core";
-import { TimestampMsSchema } from "../common";
+import {
+  TimestampMsSchema,
+} from "../common";
 import {
   ProviderAuthGrantIdSchema,
   SourceIdSchema,
   SourceCatalogIdSchema,
   SourceCatalogRevisionIdSchema,
-  WorkspaceIdSchema,
+  ScopeIdSchema,
 } from "../ids";
-import { SecretRefSchema } from "./auth-artifact";
+import {
-import { JsonObjectSchema } from "./source-auth-session";
+  SecretRefSchema,
+} from "./auth-artifact";
+import {
+  JsonObjectSchema,
+} from "./source-auth-session";
 export const SourceKindSchema = Schema.String;
 });
 const SourceStorageRowSchema = Schema.Struct({
-  workspaceId: WorkspaceIdSchema,
+  scopeId: ScopeIdSchema,
   sourceId: SourceIdSchema,
   catalogId: SourceCatalogIdSchema,
   catalogRevisionId: SourceCatalogRevisionIdSchema,
   SourceStorageRowSchema,
   Schema.Struct({
     id: SourceIdSchema,
-    workspaceId: WorkspaceIdSchema,
+    scopeId: ScopeIdSchema,
     catalogId: SourceCatalogIdSchema,
     catalogRevisionId: SourceCatalogRevisionIdSchema,
     name: Schema.String,
     strict: false,
     decode: (row) => ({
       id: row.sourceId,
-      workspaceId: row.workspaceId,
+      scopeId: row.scopeId,
       catalogId: row.catalogId,
       catalogRevisionId: row.catalogRevisionId,
       name: row.name,
       updatedAt: row.updatedAt,
     }),
     encode: (source) => ({
-      workspaceId: source.workspaceId,
+      scopeId: source.scopeId,
       sourceId: source.id,
       catalogId: source.catalogId,
       catalogRevisionId: source.catalogRevisionId,
 export const SourceSchema = Schema.Struct({
   id: SourceIdSchema,
-  workspaceId: WorkspaceIdSchema,
+  scopeId: ScopeIdSchema,
   name: Schema.String,
   kind: SourceKindSchema,
   endpoint: Schema.String,

packages/platform/sdk/src/schema/schema.test.ts+5−1

@@ -1,4 +1,8 @@
1	import { describe, expect, it } from "@effect/vitest";	1	import {
		2	describe,
		3	expect,
		4	it,
		5	} from "@effect/vitest";
2	import * as Either from "effect/Either";	6	import * as Either from "effect/Either";
3	import * as Schema from "effect/Schema";	7	import * as Schema from "effect/Schema";
4		8

packages/platform/sdk/src/scope.ts+17−0

@@ -0,0 +1,17 @@
	1	import type {
	2	ScopeId,
	3	} from "./schema";
	4
	5	export type ExecutorScopeDescriptor = {
	6	scopeName: string;
	7	scopeRoot?: string \| null;
	8	actorScopeId?: ScopeId \| null;
	9	resolutionScopeIds?: ReadonlyArray<ScopeId>;
	10	metadata?: Readonly<Record<string, unknown>>;
	11	};
	12
	13	export type ExecutorScopeContext = ExecutorScopeDescriptor & {
	14	scopeId: ScopeId;
	15	actorScopeId: ScopeId \| null;
	16	resolutionScopeIds: ReadonlyArray<ScopeId>;
	17	};

packages/platform/sdk/src/sources/contracts.ts+11−11

@@ -12,9 +12,9 @@ import { · 11 unmodified lines
12	SourceSchema,	12	SourceSchema,
13	SourceStatusSchema,	13	SourceStatusSchema,
14	SourceOauthClientInputSchema,	14	SourceOauthClientInputSchema,
15	WorkspaceIdSchema,	15	ScopeIdSchema,
16	WorkspaceOauthClientIdSchema,	16	ScopeOauthClientIdSchema,
17	WorkspaceOauthClientSchema,	17	ScopeOauthClientSchema,
18	} from "../schema";	18	} from "../schema";
19	import {	19	import {
20	ConnectSourcePayloadSchema,	20	ConnectSourcePayloadSchema,
@@ -84,20 +84,20 @@ export const CredentialOauthCompleteUrlParamsSchema = Schema.Struct({ · 63 unmodified lines
84	error_description: Schema.optional(Schema.String),	84	error_description: Schema.optional(Schema.String),
85	});	85	});
86		86
87	export const WorkspaceOauthClientQuerySchema = Schema.Struct({	87	export const ScopeOauthClientQuerySchema = Schema.Struct({
88	providerKey: Schema.String,	88	providerKey: Schema.String,
89	});	89	});
90		90
91	export const CreateWorkspaceOauthClientPayloadSchema = Schema.Struct({	91	export const CreateScopeOauthClientPayloadSchema = Schema.Struct({
92	providerKey: Schema.String,	92	providerKey: Schema.String,
93	label: Schema.optional(Schema.NullOr(Schema.String)),	93	label: Schema.optional(Schema.NullOr(Schema.String)),
94	oauthClient: SourceOauthClientInputSchema,	94	oauthClient: SourceOauthClientInputSchema,
95	});	95	});
96		96
97	export type CreateWorkspaceOauthClientPayload =	97	export type CreateScopeOauthClientPayload =
98	typeof CreateWorkspaceOauthClientPayloadSchema.Type;	98	typeof CreateScopeOauthClientPayloadSchema.Type;
99		99
100	export const oauthClientIdParam = WorkspaceOauthClientIdSchema;	100	export const oauthClientIdParam = ScopeOauthClientIdSchema;
101	export const grantIdParam = ProviderAuthGrantIdSchema;	101	export const grantIdParam = ProviderAuthGrantIdSchema;
102		102
103	const ConnectGoogleDiscoveryBatchSourceSchema = Schema.Struct({	103	const ConnectGoogleDiscoveryBatchSourceSchema = Schema.Struct({
@@ -110,7 +110,7 @@ const ConnectGoogleDiscoveryBatchSourceSchema = Schema.Struct({ · 6 unmodified lines
110	});	110	});
111		111
112	export const ConnectSourceBatchPayloadSchema = Schema.Struct({	112	export const ConnectSourceBatchPayloadSchema = Schema.Struct({
113	workspaceOauthClientId: WorkspaceOauthClientIdSchema,	113	scopeOauthClientId: ScopeOauthClientIdSchema,
114	sources: Schema.Array(ConnectGoogleDiscoveryBatchSourceSchema),	114	sources: Schema.Array(ConnectGoogleDiscoveryBatchSourceSchema),
115	});	115	});
116		116
@@ -165,6 +165,6 @@ export { · 48 unmodified lines
165	ConnectSourcePayloadSchema,	165	ConnectSourcePayloadSchema,
166	type ConnectSourcePayload,	166	type ConnectSourcePayload,
167	SourceDiscoveryResultSchema,	167	SourceDiscoveryResultSchema,
168	WorkspaceIdSchema,	168	ScopeIdSchema,
169	WorkspaceOauthClientSchema,	169	ScopeOauthClientSchema,
170	};	170	};

packages/platform/sdk/src/sources/discovery.ts+3−1

@@ -9,7 +9,9 @@ import { · 8 unmodified lines
9	type SourceDiscoveryResult,	9	type SourceDiscoveryResult,
10	} from "@executor/source-core";	10	} from "@executor/source-core";
11		11
12	import { builtInSourceAdapters } from "../runtime/sources/source-adapters";	12	import {
		13	builtInSourceAdapters,
		14	} from "../runtime/sources/source-adapters";
13		15
14	type DiscoverableSourceAdapter = SourceAdapter & {	16	type DiscoverableSourceAdapter = SourceAdapter & {
15	detectSource: NonNullable<SourceAdapter["detectSource"]>;	17	detectSource: NonNullable<SourceAdapter["detectSource"]>;

packages/platform/sdk/src/sources/inspection.ts+25−19

   SourceInspectionToolDetail,
   SourceInspectionToolListItem,
   SourceInspectionToolSummary,
-  WorkspaceId,
+  ScopeId,
 } from "../schema";
 import {
   ControlPlaneNotFoundError,
 } from "../errors";
 import * as Effect from "effect/Effect";
-import { LocalSourceArtifactMissingError } from "../runtime/workspace-errors";
+import {
-import { operationErrors } from "../runtime/policy/operation-errors";
+  LocalSourceArtifactMissingError,
+} from "../runtime/scope-errors";
+import {
+  operationErrors,
+} from "../runtime/policy/operation-errors";
 import {
   buildLoadedSourceCatalogToolContract,
   expandCatalogToolByPath,
   loadSourceWithCatalog,
   type LoadedSourceCatalogTool,
 } from "../runtime/catalog/source/runtime";
-import { RuntimeSourceStoreService } from "../runtime/sources/source-store";
+import {
+  RuntimeSourceStoreService,
+} from "../runtime/sources/source-store";
 const sourceInspectOps = {
   bundle: operationErrors("sources.inspect.bundle"),
   source.status === "auth_required";
 const loadSourceForMissingCatalog = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: SourceId;
   cause: LocalSourceArtifactMissingError;
 }) =>
   Effect.gen(function* () {
     const sourceStore = yield* RuntimeSourceStoreService;
     const source = yield* sourceStore.loadSourceById({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       sourceId: input.sourceId,
     });
   });
 const loadSourceCatalogOrEmpty = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: SourceId;
 }) =>
   loadSourceWithCatalog({
-    workspaceId: input.workspaceId,
+    scopeId: input.scopeId,
     sourceId: input.sourceId,
   }).pipe(
     Effect.map((catalogEntry) => ({
     Effect.catchTag("LocalSourceArtifactMissingError", (cause) =>
       Effect.gen(function* () {
         const source = yield* loadSourceForMissingCatalog({
-          workspaceId: input.workspaceId,
+          scopeId: input.scopeId,
           sourceId: input.sourceId,
           cause,
         });
   });
 const resolveSourceInspection = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: SourceId;
   includeSchemas: boolean;
   includeTypePreviews: boolean;
 }) =>
   Effect.gen(function* () {
     const loaded = yield* loadSourceCatalogOrEmpty({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       sourceId: input.sourceId,
     });
   });
 const resolveSourceInspectionTool = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: SourceId;
   toolPath: string;
 }) =>
   Effect.gen(function* () {
     const loaded = yield* loadSourceCatalogOrEmpty({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       sourceId: input.sourceId,
     });
 };
 export const getSourceInspection = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: SourceId;
 }) =>
   Effect.gen(function* () {
   );
 export const getSourceInspectionToolDetail = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: SourceId;
   toolPath: string;
 }) =>
   Effect.gen(function* () {
     const inspection = yield* resolveSourceInspectionTool({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       sourceId: input.sourceId,
       toolPath: input.toolPath,
     });
     if (!tool) {
       return yield* sourceInspectOps.tool.notFound(
         "Tool not found",
-        `workspaceId=${input.workspaceId} sourceId=${input.sourceId} path=${input.toolPath}`,
+        `scopeId=${input.scopeId} sourceId=${input.sourceId} path=${input.toolPath}`,
       );
     }
   );
 export const discoverSourceInspectionTools = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: SourceId;
   payload: SourceInspectionDiscoverPayload;
 }) =>
   Effect.gen(function* () {
     const inspection = yield* resolveSourceInspection({
-      workspaceId: input.workspaceId,
+      scopeId: input.scopeId,
       sourceId: input.sourceId,
       includeSchemas: false,
       includeTypePreviews: false,

packages/platform/sdk/src/sources/operations.ts+43−34

   UpdateSourcePayload,
 } from "./contracts";
 import {
-  type AccountId,
+  type ScopeId,
   SourceIdSchema,
   type Source,
   type SourceId,
-  type WorkspaceId,
 } from "../schema";
 import * as Either from "effect/Either";
 import * as Effect from "effect/Effect";
   createSourceFromPayload,
   updateSourceFromPayload,
 } from "../runtime/sources/source-definitions";
-import { getSourceAdapterForSource } from "../runtime/sources/source-adapters";
+import {
-import { mapPersistenceError } from "../runtime/policy/operations-shared";
+  getSourceAdapterForSource,
-import { operationErrors } from "../runtime/policy/operation-errors";
+} from "../runtime/sources/source-adapters";
+import {
+  mapPersistenceError,
+} from "../runtime/policy/operations-shared";
+import {
+  operationErrors,
+} from "../runtime/policy/operation-errors";
 import {
   ExecutorStateStore,
   type ExecutorStateStoreShape,
 } from "../runtime/executor-state-store";
-import { RuntimeSourceCatalogSyncService } from "../runtime/catalog/source/sync";
+import {
-import { RuntimeSourceStoreService } from "../runtime/sources/source-store";
+  RuntimeSourceCatalogSyncService,
+} from "../runtime/catalog/source/sync";
+import {
+  RuntimeSourceStoreService,
+} from "../runtime/sources/source-store";
 const sourceOps = {
   list: operationErrors("sources.list"),
   store: ExecutorStateStoreShape;
   sourceStore: Effect.Effect.Success<typeof RuntimeSourceStoreService>;
   source: Source;
-  actorAccountId: AccountId;
+  actorScopeId: ScopeId;
   operation: typeof sourceOps.create | typeof sourceOps.update;
 }) =>
   Effect.gen(function* () {
     const synced = yield* Effect.either(
       catalogSyncService.sync({
         source: sourceForSync,
-        actorAccountId: input.actorAccountId,
+        actorScopeId: input.actorScopeId,
       }),
     );
             yield* mapPersistenceError(
               input.operation.child("source_connected"),
               input.sourceStore.persistSource(connectedSource, {
-                actorAccountId: input.actorAccountId,
+                actorScopeId: input.actorScopeId,
               }),
             );
             return connectedSource;
             yield* mapPersistenceError(
               input.operation.child("source_error"),
               input.sourceStore.persistSource(erroredSource, {
-                actorAccountId: input.actorAccountId,
+                actorScopeId: input.actorScopeId,
               }),
             );
           }
   });
 export const listSources = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
-  accountId: AccountId;
+  actorScopeId: ScopeId;
 }) =>
   Effect.flatMap(ExecutorStateStore, () =>
     Effect.gen(function* () {
       const sourceStore = yield* RuntimeSourceStoreService;
       return yield* sourceStore
-        .loadSourcesInWorkspace(input.workspaceId, {
+        .loadSourcesInScope(input.scopeId, {
-          actorAccountId: input.accountId,
+          actorScopeId: input.actorScopeId,
         })
         .pipe(
           Effect.mapError((error) =>
   );
 export const createSource = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
-  accountId: AccountId;
+  actorScopeId: ScopeId;
   payload: CreateSourcePayload;
 }) =>
   Effect.flatMap(ExecutorStateStore, (store) =>
       const now = Date.now();
       const source = yield* createSourceFromPayload({
-        workspaceId: input.workspaceId,
+        scopeId: input.scopeId,
         sourceId: SourceIdSchema.make(`src_${crypto.randomUUID()}`),
         payload: input.payload,
         now,
       const persistedSource = yield* mapPersistenceError(
         sourceOps.create.child("persist"),
         sourceStore.persistSource(source, {
-          actorAccountId: input.accountId,
+          actorScopeId: input.actorScopeId,
         }),
       );
         store,
         sourceStore,
         source: persistedSource,
-        actorAccountId: input.accountId,
+        actorScopeId: input.actorScopeId,
         operation: sourceOps.create,
       });
   );
 export const getSource = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: SourceId;
-  accountId: AccountId;
+  actorScopeId: ScopeId;
 }) =>
   Effect.flatMap(ExecutorStateStore, () =>
     Effect.gen(function* () {
       return yield* sourceStore
         .loadSourceById({
-          workspaceId: input.workspaceId,
+          scopeId: input.scopeId,
           sourceId: input.sourceId,
-          actorAccountId: input.accountId,
+          actorScopeId: input.actorScopeId,
         })
         .pipe(
           Effect.mapError((cause) =>
             cause.message.startsWith("Source not found:")
               ? sourceOps.get.notFound(
                   "Source not found",
-                  `workspaceId=${input.workspaceId} sourceId=${input.sourceId}`,
+                  `scopeId=${input.scopeId} sourceId=${input.sourceId}`,
                 )
               : sourceOps.get.unknownStorage(
                   cause,
   );
 export const updateSource = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: SourceId;
-  accountId: AccountId;
+  actorScopeId: ScopeId;
   payload: UpdateSourcePayload;
 }) =>
   Effect.flatMap(ExecutorStateStore, (store) =>
       const sourceStore = yield* RuntimeSourceStoreService;
       const existingSource = yield* sourceStore
         .loadSourceById({
-          workspaceId: input.workspaceId,
+          scopeId: input.scopeId,
           sourceId: input.sourceId,
-          actorAccountId: input.accountId,
+          actorScopeId: input.actorScopeId,
         })
         .pipe(
           Effect.mapError((cause) =>
             cause.message.startsWith("Source not found:")
               ? sourceOps.update.notFound(
                   "Source not found",
-                  `workspaceId=${input.workspaceId} sourceId=${input.sourceId}`,
+                  `scopeId=${input.scopeId} sourceId=${input.sourceId}`,
                 )
               : sourceOps.update.unknownStorage(
                   cause,
       const persistedSource = yield* mapPersistenceError(
         sourceOps.update.child("persist"),
         sourceStore.persistSource(updatedSource, {
-          actorAccountId: input.accountId,
+          actorScopeId: input.actorScopeId,
         }),
       );
         store,
         sourceStore,
         source: persistedSource,
-        actorAccountId: input.accountId,
+        actorScopeId: input.actorScopeId,
         operation: sourceOps.update,
       });
   );
 export const removeSource = (input: {
-  workspaceId: WorkspaceId;
+  scopeId: ScopeId;
   sourceId: SourceId;
 }) =>
   Effect.flatMap(ExecutorStateStore, () =>
       const removed = yield* mapPersistenceError(
         sourceOps.remove.child("remove"),
         sourceStore.removeSourceById({
-          workspaceId: input.workspaceId,
+          scopeId: input.scopeId,
           sourceId: input.sourceId,
         }),
       );

packages/platform/sdk/src/workspace.ts+0−15

@@ -1,15 +0,0 @@
1	import type {
2	AccountId,
3	WorkspaceId,
4	} from "./schema";
5
6	export type ExecutorWorkspaceDescriptor = {
7	workspaceName: string;
8	workspaceRoot?: string \| null;
9	metadata?: Readonly<Record<string, unknown>>;
10	};
11
12	export type ExecutorWorkspaceContext = ExecutorWorkspaceDescriptor & {
13	workspaceId: WorkspaceId;
14	accountId: AccountId;
15	};

packages/sources/core/src/source-models.ts+6−6

@@ -134,7 +134,7 @@ export const SourceBindingSchema = Schema.Struct({ · 133 unmodified lines
134		134
135	export const SourceSchema = Schema.Struct({	135	export const SourceSchema = Schema.Struct({
136	id: Schema.String,	136	id: Schema.String,
137	workspaceId: Schema.String,	137	scopeId: Schema.String,
138	name: Schema.String,	138	name: Schema.String,
139	kind: SourceKindSchema,	139	kind: SourceKindSchema,
140	endpoint: Schema.String,	140	endpoint: Schema.String,
@@ -157,19 +157,19 @@ export const StoredSourceRecordSchema = Schema.Struct({ · 16 unmodified lines
157	bindingConfigJson: Schema.NullOr(Schema.String),	157	bindingConfigJson: Schema.NullOr(Schema.String),
158	});	158	});
159		159
160	export const WorkspaceSourceOauthClientRedirectModeSchema = Schema.Literal(	160	export const ScopedSourceOauthClientRedirectModeSchema = Schema.Literal(
161	"app_callback",	161	"app_callback",
162	"loopback",	162	"loopback",
163	);	163	);
164		164
165	export const WorkspaceOauthClientIdSchema = Schema.String;	165	export const ScopeOauthClientIdSchema = Schema.String;
166		166
167	export const SourceOauthClientInputSchema = Schema.Struct({	167	export const SourceOauthClientInputSchema = Schema.Struct({
168	clientId: Schema.Trim.pipe(Schema.nonEmptyString()),	168	clientId: Schema.Trim.pipe(Schema.nonEmptyString()),
169	clientSecret: Schema.optional(	169	clientSecret: Schema.optional(
170	Schema.NullOr(Schema.Trim.pipe(Schema.nonEmptyString())),	170	Schema.NullOr(Schema.Trim.pipe(Schema.nonEmptyString())),
171	),	171	),
172	redirectMode: Schema.optional(WorkspaceSourceOauthClientRedirectModeSchema),	172	redirectMode: Schema.optional(ScopedSourceOauthClientRedirectModeSchema),
173	});	173	});
174		174
175	export type SecretRef = typeof SecretRefSchema.Type;	175	export type SecretRef = typeof SecretRefSchema.Type;
@@ -185,6 +185,6 @@ export type SourceAuth = typeof SourceAuthSchema.Type; · 9 unmodified lines
185	export type SourceBinding = typeof SourceBindingSchema.Type;	185	export type SourceBinding = typeof SourceBindingSchema.Type;
186	export type Source = typeof SourceSchema.Type;	186	export type Source = typeof SourceSchema.Type;
187	export type StoredSourceRecord = typeof StoredSourceRecordSchema.Type;	187	export type StoredSourceRecord = typeof StoredSourceRecordSchema.Type;
188	export type WorkspaceSourceOauthClientRedirectMode =	188	export type ScopedSourceOauthClientRedirectMode =
189	typeof WorkspaceSourceOauthClientRedirectModeSchema.Type;	189	typeof ScopedSourceOauthClientRedirectModeSchema.Type;
190	export type SourceOauthClientInput = typeof SourceOauthClientInputSchema.Type;	190	export type SourceOauthClientInput = typeof SourceOauthClientInputSchema.Type;

packages/sources/google-discovery/src/adapter.test.ts+1−1

@@ -81,7 +81,7 @@ const withJsonServer = async <T>(handler: (input: { · 80 unmodified lines
81		81
82	const makeGoogleDiscoverySource = (discoveryUrl: string): Source => ({	82	const makeGoogleDiscoverySource = (discoveryUrl: string): Source => ({
83	id: "src_google_gmail",	83	id: "src_google_gmail",
84	workspaceId: "ws_test",	84	scopeId: "ws_test",
85	name: "Gmail",	85	name: "Gmail",
86	kind: "google_discovery",	86	kind: "google_discovery",
87	endpoint: discoveryUrl,	87	endpoint: discoveryUrl,

packages/sources/google-discovery/src/adapter.ts+3−3

@@ -38,7 +38,7 @@ import { · 37 unmodified lines
38	OptionalNullableStringSchema,	38	OptionalNullableStringSchema,
39	SourceCredentialRequiredError,	39	SourceCredentialRequiredError,
40	StringMapSchema,	40	StringMapSchema,
41	WorkspaceOauthClientIdSchema,	41	ScopeOauthClientIdSchema,
42	createCatalogImportMetadata,	42	createCatalogImportMetadata,
43	EXECUTABLE_BINDING_VERSION,	43	EXECUTABLE_BINDING_VERSION,
44	sourceCoreEffectError,	44	sourceCoreEffectError,
@@ -60,8 +60,8 @@ const GoogleDiscoveryConnectPayloadSchema = Schema.extend( · 15 unmodified lines
60	scopes: Schema.optional(	60	scopes: Schema.optional(
61	Schema.Array(Schema.Trim.pipe(Schema.nonEmptyString())),	61	Schema.Array(Schema.Trim.pipe(Schema.nonEmptyString())),
62	),	62	),
63	workspaceOauthClientId: Schema.optional(	63	scopeOauthClientId: Schema.optional(
64	Schema.NullOr(WorkspaceOauthClientIdSchema),	64	Schema.NullOr(ScopeOauthClientIdSchema),
65	),	65	),
66	oauthClient: ConnectOauthClientSchema,	66	oauthClient: ConnectOauthClientSchema,
67	name: OptionalNullableStringSchema,	67	name: OptionalNullableStringSchema,

tools/oxlint/README.md+2−0

@@ -14,6 +14,8 @@ Current rules: · 13 unmodified lines
14	- `executor-monorepo/no-cross-workspace-relative-imports`	14	- `executor-monorepo/no-cross-workspace-relative-imports`
15	- `executor-monorepo/no-direct-effect-tag-read`	15	- `executor-monorepo/no-direct-effect-tag-read`
16	- `executor-monorepo/no-effect-run-in-effect-vitest-tests`	16	- `executor-monorepo/no-effect-run-in-effect-vitest-tests`
		17	- `executor-monorepo/no-manual-httpapi-openapi-bridge`
		18	- `executor-monorepo/no-manual-openapi-documents`
17	- `executor-monorepo/no-node-fs-with-effect-imports`	19	- `executor-monorepo/no-node-fs-with-effect-imports`
18	- `executor-monorepo/no-raw-effect-fail-errors`	20	- `executor-monorepo/no-raw-effect-fail-errors`
19	- `executor-monorepo/no-yield-effect-fail`	21	- `executor-monorepo/no-yield-effect-fail`

tools/oxlint/plugin.mjs+4−0

 import noAsyncEffectVitestTests from "./rules/no-async-effect-vitest-tests.mjs";
 import noDirectEffectTagRead from "./rules/no-direct-effect-tag-read.mjs";
 import noEffectRunInEffectVitestTests from "./rules/no-effect-run-in-effect-vitest-tests.mjs";
+import noManualHttpApiOpenApiBridge from "./rules/no-manual-httpapi-openapi-bridge.mjs";
+import noManualOpenApiDocuments from "./rules/no-manual-openapi-documents.mjs";
 import noNodeFsWithEffectImports from "./rules/no-node-fs-with-effect-imports.mjs";
 import noRawEffectFailErrors from "./rules/no-raw-effect-fail-errors.mjs";
 import noYieldEffectFail from "./rules/no-yield-effect-fail.mjs";
     "no-cross-workspace-relative-imports": noCrossWorkspaceRelativeImports,
     "no-direct-effect-tag-read": noDirectEffectTagRead,
     "no-effect-run-in-effect-vitest-tests": noEffectRunInEffectVitestTests,
+    "no-manual-httpapi-openapi-bridge": noManualHttpApiOpenApiBridge,
+    "no-manual-openapi-documents": noManualOpenApiDocuments,
     "no-node-fs-with-effect-imports": noNodeFsWithEffectImports,
     "no-raw-effect-fail-errors": noRawEffectFailErrors,
     "no-yield-effect-fail": noYieldEffectFail,

tools/oxlint/rules/no-manual-httpapi-openapi-bridge.mjs+65−0

@@ -0,0 +1,65 @@
	1	import { readFileSync } from "node:fs";
	2	import { defineRule } from "@oxlint/plugins";
	3
	4	const isTestLikeFile = (filename) =>
	5	filename.includes(".test.")
	6	\|\| filename.includes(".spec.")
	7	\|\| filename.endsWith(".test.ts")
	8	\|\| filename.endsWith(".test.tsx")
	9	\|\| filename.endsWith(".spec.ts")
	10	\|\| filename.endsWith(".spec.tsx");
	11
	12	const readsLikeOpenApiHttpApiTest = (filename) => {
	13	try {
	14	const sourceText = readFileSync(filename, "utf8");
	15	return sourceText.includes("HttpApiBuilder.middlewareOpenApi(")
	16	\|\| sourceText.includes("OpenApi.fromApi(");
	17	} catch {
	18	return false;
	19	}
	20	};
	21
	22	const isHttpApiBuilderCall = (node, methodName) =>
	23	node?.type === "CallExpression"
	24	&& node.callee?.type === "MemberExpression"
	25	&& node.callee.computed === false
	26	&& node.callee.object?.type === "Identifier"
	27	&& node.callee.object.name === "HttpApiBuilder"
	28	&& node.callee.property?.type === "Identifier"
	29	&& node.callee.property.name === methodName;
	30
	31	export default defineRule({
	32	meta: {
	33	type: "problem",
	34	docs: {
	35	description:
	36	"Disallow manual Node/Web bridges around Effect HttpApi when serving OpenAPI test servers.",
	37	recommended: true,
	38	},
	39	messages: {
	40	noManualHttpApiOpenApiBridge:
	41	"Do not serve OpenAPI test servers by manually bridging `HttpApiBuilder.toWebHandler(...)` to Node HTTP. Use `@executor/effect-test-utils` (`startOpenApiTestServer` / `makeOpenApiTestServer`) instead.",
	42	},
	43	},
	44	create(context) {
	45	if (
	46	!isTestLikeFile(context.filename)
	47	\|\| !readsLikeOpenApiHttpApiTest(context.filename)
	48	) {
	49	return {};
	50	}
	51
	52	return {
	53	CallExpression(node) {
	54	if (!isHttpApiBuilderCall(node, "toWebHandler")) {
	55	return;
	56	}
	57
	58	context.report({
	59	node,
	60	messageId: "noManualHttpApiOpenApiBridge",
	61	});
	62	},
	63	};
	64	},
	65	});

tools/oxlint/rules/no-manual-openapi-documents.mjs+108−0

@@ -0,0 +1,108 @@
	1	import path from "node:path";
	2	import { defineRule } from "@oxlint/plugins";
	3
	4	const MANUAL_OPENAPI_RULE_ALLOWED_PATH_SEGMENTS = [
	5	`${path.sep}packages${path.sep}sources${path.sep}openapi${path.sep}`,
	6	`${path.sep}packages${path.sep}platform${path.sep}sdk${path.sep}src${path.sep}runtime${path.sep}sources${path.sep}source-adapter-fixture-matrix.test.ts`,
	7	`${path.sep}packages${path.sep}platform${path.sep}sdk${path.sep}src${path.sep}runtime${path.sep}sources${path.sep}source-discovery.test.ts`,
	8	];
	9
	10	const OPENAPI_MARKER_KEYS = new Set(["openapi", "swagger"]);
	11	const OPENAPI_SHAPE_KEYS = new Set([
	12	"components",
	13	"info",
	14	"paths",
	15	"responses",
	16	"security",
	17	"servers",
	18	"tags",
	19	]);
	20
	21	const isTestLikeFile = (filename) =>
	22	filename.includes(".test.")
	23	\|\| filename.includes(".spec.")
	24	\|\| filename.endsWith(".test.ts")
	25	\|\| filename.endsWith(".test.tsx")
	26	\|\| filename.endsWith(".spec.ts")
	27	\|\| filename.endsWith(".spec.tsx");
	28
	29	const isAllowedFile = (filename) =>
	30	MANUAL_OPENAPI_RULE_ALLOWED_PATH_SEGMENTS.some((segment) =>
	31	filename.includes(segment)
	32	);
	33
	34	const readPropertyKey = (node) => {
	35	if (!node \|\| node.type !== "Property" \|\| node.computed) {
	36	return null;
	37	}
	38
	39	const key = node.key;
	40	if (!key) {
	41	return null;
	42	}
	43
	44	if (key.type === "Identifier") {
	45	return key.name;
	46	}
	47
	48	if (key.type === "Literal" && typeof key.value === "string") {
	49	return key.value;
	50	}
	51
	52	return null;
	53	};
	54
	55	const objectExpressionKeys = (node) => {
	56	if (!node \|\| node.type !== "ObjectExpression") {
	57	return [];
	58	}
	59
	60	return node.properties
	61	.map(readPropertyKey)
	62	.filter((key) => typeof key === "string");
	63	};
	64
	65	const looksLikeOpenApiDocument = (node) => {
	66	if (!node \|\| node.type !== "ObjectExpression") {
	67	return false;
	68	}
	69
	70	const keys = new Set(objectExpressionKeys(node));
	71	const hasOpenApiMarker = [...OPENAPI_MARKER_KEYS].some((key) => keys.has(key));
	72	const hasOpenApiShape = [...OPENAPI_SHAPE_KEYS].some((key) => keys.has(key));
	73
	74	return hasOpenApiMarker && hasOpenApiShape;
	75	};
	76
	77	export default defineRule({
	78	meta: {
	79	type: "problem",
	80	docs: {
	81	description:
	82	"Disallow hand-authored inline OpenAPI documents in normal test files.",
	83	recommended: true,
	84	},
	85	messages: {
	86	noManualOpenApiDocuments:
	87	"Do not hand-author inline OpenAPI documents here. Use Effect's HttpApi/OpenApi builders, such as `OpenApi.fromApi(...)`, instead. Raw OpenAPI fixtures should live only in dedicated OpenAPI parser/import tests.",
	88	},
	89	},
	90	create(context) {
	91	if (!isTestLikeFile(context.filename) \|\| isAllowedFile(context.filename)) {
	92	return {};
	93	}
	94
	95	return {
	96	ObjectExpression(node) {
	97	if (!looksLikeOpenApiDocument(node)) {
	98	return;
	99	}
	100
	101	context.report({
	102	node,
	103	messageId: "noManualOpenApiDocuments",
	104	});
	105	},
	106	};
	107	},
	108	});