refactor(core): generic executor-wrapper seam; move toolkit narrowing into the plugin

Core no longer contains any toolkit vocabulary. The MCP narrowing seam (toolkit-scope.ts: ResolvedToolkitScope/applyToolkitScope/EMPTY_TOOLKIT_SCOPE) moves out of @executor-js/sdk into the toolkits plugin, where 'toolkit' naming belongs. In its place core gains a domain-agnostic hook: a plugin may expose a `wrapExecutor` method on its extension; the assembler collects these into the executor and the execution stack runs each before the engine is built, threading a per-request `selector` string. Core knows nothing about what a wrapper narrows to. The toolkits plugin contributes the wrapper (its resolveScope + applyToolkitScope, fail-closed to the empty slice). - removes the hardcoded `base.toolkits` plugin-id lookup in execution-stack - renames the core/host build option toolkitId -> selector (neutral) - ExecutorWrapper exported from @executor-js/sdk Behavior unchanged: full repo typecheck green; all 12 toolkit e2e files (13 tests) pass.

Rhys Sullivan committed 4 months ago

Commit ef950471 parent 30c6c278 files · +971 −381Browse files

Unified · Split

8 files

packages/core/api/src/server/execution-stack.ts +56 −31
packages/core/api/src/server/mcp-build.ts +18 −7
packages/core/sdk/src/executor.ts +632 −209
packages/core/sdk/src/index.ts +21 −14
packages/core/sdk/src/tool.ts +10 −4
packages/hosts/mcp/src/in-memory-session-store.ts +84 −30
packages/plugins/toolkits/src/server.ts +110 −58
packages/plugins/toolkits/src/toolkit-scope.ts +40 −28

packages/core/api/src/server/execution-stack.ts+56−31

 import type * as Cause from "effect/Cause";
 import {
-  applyToolkitScope,
-  EMPTY_TOOLKIT_SCOPE,
   type AnyPlugin,
   type Executor,
+  type ExecutorWrapper,
   type StorageFailure,
-  type ToolkitResolver,
 } from "@executor-js/sdk";
 import {
   createExecutionEngine,
 } from "@executor-js/execution";
 import { DbProvider } from "./executor-fuma-db";
-import { HostConfig, PluginsProvider, makeScopedExecutor } from "./scoped-executor";
+import {
+  HostConfig,
+  PluginsProvider,
+  makeScopedExecutor,
+} from "./scoped-executor";
 // ---------------------------------------------------------------------------
 // CodeExecutorProvider seam — the host's code-execution substrate. Typed to the
 // assigns structurally.
 // ---------------------------------------------------------------------------
-export type CodeExecutor = ExecutionEngineConfig<Cause.YieldableError>["codeExecutor"];
+export type CodeExecutor =
+  ExecutionEngineConfig<Cause.YieldableError>["codeExecutor"];
-export class CodeExecutorProvider extends Context.Service<CodeExecutorProvider, CodeExecutor>()(
+export class CodeExecutorProvider extends Context.Service<
-  "@executor-js/api/CodeExecutorProvider",
+  CodeExecutorProvider,
-) {}
+  CodeExecutor
+>()("@executor-js/api/CodeExecutorProvider") {}
 // ---------------------------------------------------------------------------
 // EngineDecorator seam — wrap the freshly built engine (e.g. with usage
   ) => ExecutionEngine<E>;
 }
-export class EngineDecorator extends Context.Service<EngineDecorator, EngineDecoratorShape>()(
+export class EngineDecorator extends Context.Service<
-  "@executor-js/api/EngineDecorator",
+  EngineDecorator,
-) {}
+  EngineDecoratorShape
+>()("@executor-js/api/EngineDecorator") {}
 /** No-op decorator: the engine passes through unchanged. */
-export const EngineDecoratorNoop: Layer.Layer<EngineDecorator> = Layer.succeed(EngineDecorator)({
+export const EngineDecoratorNoop: Layer.Layer<EngineDecorator> = Layer.succeed(
+  EngineDecorator,
+)({
   decorate: (engine) => engine,
 });
   accountId: string,
   organizationId: string,
   organizationName: string,
-  /** Optional toolkit selector (slug or id). When set, the executor is narrowed
+  /** Optional per-request narrowing selector (e.g. an MCP `?toolkit=` value).
-   *  to that toolkit's slice before the engine is built — so listing, search,
+   *  When set, the executor is run through every plugin-contributed
-   *  description, core-tools, AND execute all see only the slice. Resolves via
+   *  `ExecutorWrapper` before the engine is built — so listing, search,
-   *  the `toolkits` plugin extension; an unknown/unauthorized selector applies
+   *  description, core-tools, AND execute all see only the narrowed view. Core
-   *  an EMPTY slice (fail-closed — never the full account). */
+   *  is agnostic about what a wrapper narrows to; a plugin (e.g. toolkits) owns
-  toolkitId?: string,
+   *  that, including fail-closed behavior for an unknown selector. */
+  selector?: string,
 ): Effect.Effect<
-  { readonly executor: Executor<TPlugins>; readonly engine: ExecutionEngine<Cause.YieldableError> },
+  {
+    readonly executor: Executor<TPlugins>;
+    readonly engine: ExecutionEngine<Cause.YieldableError>;
+  },
   StorageFailure,
-  DbProvider | PluginsProvider | HostConfig | CodeExecutorProvider | EngineDecorator
+  | DbProvider
+  | PluginsProvider
+  | HostConfig
+  | CodeExecutorProvider
+  | EngineDecorator
 > =>
   Effect.gen(function* () {
-    const base = yield* makeScopedExecutor<TPlugins>(accountId, organizationId, organizationName);
+    const base = yield* makeScopedExecutor<TPlugins>(
-    const executor = toolkitId ? yield* narrowToToolkit(base, toolkitId) : base;
+      accountId,
+      organizationId,
+      organizationName,
+    );
+    const executor = selector
+      ? yield* applyExecutorWrappers(base, selector)
+      : base;
     const codeExecutor = yield* CodeExecutorProvider;
     const { decorate } = yield* EngineDecorator;
     const engine = decorate(createExecutionEngine({ executor, codeExecutor }), {
     return { executor, engine };
   });
-// Resolve the toolkit slice via the `toolkits` plugin extension (stamped on the
+// Run every plugin-contributed executor wrapper (collected on the executor at
-// executor) and wrap the executor. Fail-closed: no extension or no match -> an
+// assembly) with the request selector. Core does not know what any wrapper
-// empty slice, so a bad/cross-tenant selector exposes only static tools, never
+// narrows to — the toolkits plugin's wrapper, for instance, fails closed to an
-// the full account.
+// empty slice for an unknown/cross-tenant selector. With no wrapper registered,
-const narrowToToolkit = <TPlugins extends readonly AnyPlugin[]>(
+// the executor passes through unchanged.
+const applyExecutorWrappers = <TPlugins extends readonly AnyPlugin[]>(
   base: Executor<TPlugins>,
-  toolkitId: string,
+  selector: string,
 ): Effect.Effect<Executor<TPlugins>, StorageFailure> =>
   Effect.gen(function* () {
-    const resolver = (base as { toolkits?: ToolkitResolver }).toolkits;
+    const wrappers = (base as { executorWrappers?: readonly ExecutorWrapper[] })
-    const scope = resolver?.resolveScope ? yield* resolver.resolveScope(toolkitId) : null;
+      .executorWrappers;
-    return yield* applyToolkitScope(base, scope ?? EMPTY_TOOLKIT_SCOPE);
+    let executor = base;
+    for (const wrap of wrappers ?? [])
+      executor = yield* wrap(executor, selector);
+    return executor;
   });

packages/core/api/src/server/mcp-build.ts+18−7

 import { createExecutorMcpServer } from "@executor-js/host-mcp/tool-server";
 import { ErrorCapture } from "../observability";
-import { CodeExecutorProvider, EngineDecorator, makeExecutionStack } from "./execution-stack";
+import {
+  CodeExecutorProvider,
+  EngineDecorator,
+  makeExecutionStack,
+} from "./execution-stack";
 import { DbProvider } from "./executor-fuma-db";
 import { HostConfig, PluginsProvider } from "./scoped-executor";
 /** The five execution-stack seams a host fully provides (no residual). */
 export type McpExecutionStackLayer = Layer.Layer<
-  DbProvider | PluginsProvider | HostConfig | CodeExecutorProvider | EngineDecorator
+  | DbProvider
+  | PluginsProvider
+  | HostConfig
+  | CodeExecutorProvider
+  | EngineDecorator
 >;
 /**
 export const makeMcpBuildServer =
   (executionStack: McpExecutionStackLayer): McpBuildServer =>
   (principal: Principal, options?: McpBuildServerOptions) => {
-    // `toolkitId` narrows the engine in `makeExecutionStack`; the rest of the
+    // `selector` narrows the engine in `makeExecutionStack` (a plugin's
-    // options configure the MCP server (elicitation/approval).
+    // executor wrapper applies it); the rest configure the MCP server
-    const { toolkitId, ...serverOptions } = options ?? {};
+    // (elicitation/approval).
+    const { selector, ...serverOptions } = options ?? {};
     return makeExecutionStack(
       principal.accountId,
       principal.organizationId,
       principal.organizationName,
-      toolkitId,
+      selector,
     ).pipe(
       Effect.map(({ engine }) => engine),
       Effect.provide(executionStack),
     McpErrorReporter,
     Effect.gen(function* () {
       const capture = yield* ErrorCapture;
-      return { report: (cause) => Effect.asVoid(capture.captureException(cause)) };
+      return {
+        report: (cause) => Effect.asVoid(capture.captureException(cause)),
+      };
     }),
   ).pipe(Layer.provide(errorCapture));

packages/core/sdk/src/executor.ts+632−209

 import { FetchHttpClient, type HttpClient } from "effect/unstable/http";
 import { fumadb } from "@executor-js/fumadb";
 import { memoryAdapter } from "@executor-js/fumadb/adapters/memory";
-import { withQueryContext, type Condition, type ConditionBuilder } from "@executor-js/fumadb/query";
+import {
-import { schema as fumaSchema, type RelationsMap } from "@executor-js/fumadb/schema";
+  withQueryContext,
+  type Condition,
+  type ConditionBuilder,
+} from "@executor-js/fumadb/query";
+import {
+  schema as fumaSchema,
+  type RelationsMap,
+} from "@executor-js/fumadb/schema";
 import type { AnyColumn } from "@executor-js/fumadb/schema";
 import { generateKeyBetween } from "fractional-indexing";
   type FumaTables,
   type StorageFailure,
 } from "./fuma-runtime";
-import { makeFumaBlobStore, pluginBlobStore, type BlobStore, type OwnerPartitions } from "./blob";
+import {
+  makeFumaBlobStore,
+  pluginBlobStore,
+  type BlobStore,
+  type OwnerPartitions,
+} from "./blob";
 import { coreToolsPlugin } from "./core-tools";
 import type {
   Connection,
   IntegrationConfig,
   RegisterIntegrationInput,
 } from "./integration";
-import { makeOAuthService, type MintOAuthConnectionInput } from "./oauth-service";
+import {
+  makeOAuthService,
+  type MintOAuthConnectionInput,
+} from "./oauth-service";
 import type { OAuthService } from "./oauth-client";
 import {
   comparePolicyRow,
   type ExecutorOwnerPolicyContext,
 } from "./owner-policy";
 import { ToolSchemaView, type IntegrationDetectionResult } from "./types";
-import { type Tool, type ToolAnnotations, type ToolDef, type ToolListFilter } from "./tool";
+import {
+  type Tool,
+  type ToolAnnotations,
+  type ToolDef,
+  type ToolListFilter,
+} from "./tool";
 import { buildToolTypeScriptPreview } from "./schema-types";
 import { collectReferencedDefinitions } from "./schema-refs";
 import {
 const acceptAllHandler: ElicitationHandler = () =>
   Effect.succeed(ElicitationResponse.make({ action: "accept" }));
-const resolveElicitationHandler = (onElicitation: OnElicitation): ElicitationHandler =>
+const resolveElicitationHandler = (
+  onElicitation: OnElicitation,
+): ElicitationHandler =>
   onElicitation === "accept-all" ? acceptAllHandler : onElicitation;
 // ---------------------------------------------------------------------------
   readonly tool: ToolName;
 }
-const isOwner = (value: string): value is Owner => value === "org" || value === "user";
+const isOwner = (value: string): value is Owner =>
+  value === "org" || value === "user";
 /** Parse a callable address; null when it's not a well-formed
  *  `tools.<integration>.<owner>.<connection>.<tool>`.
     cut = address.indexOf(".", cut + 1);
     if (cut === -1) return null;
   }
-  const [prefix, integration, owner, connection] = address.slice(0, cut).split(".") as [
+  const [prefix, integration, owner, connection] = address
-    string,
+    .slice(0, cut)
-    string,
+    .split(".") as [string, string, string, string];
-    string,
-    string,
-  ];
   const tool = address.slice(cut + 1);
   if (prefix !== ADDRESS_PREFIX) return null;
   if (!isOwner(owner)) return null;
-  if (integration.length === 0 || connection.length === 0 || tool.length === 0) {
+  if (
+    integration.length === 0 ||
+    connection.length === 0 ||
+    tool.length === 0
+  ) {
     return null;
   }
   return {
   integration: IntegrationSlug,
   connection: ConnectionName,
 ): ConnectionAddress =>
-  ConnectionAddress.make(`${ADDRESS_PREFIX}.${integration}.${owner}.${connection}`);
+  ConnectionAddress.make(
+    `${ADDRESS_PREFIX}.${integration}.${owner}.${connection}`,
+  );
 export const toolAddress = (
   owner: Owner,
   connection: ConnectionName,
   tool: ToolName,
 ): ToolAddress =>
-  ToolAddress.make(`${ADDRESS_PREFIX}.${integration}.${owner}.${connection}.${tool}`);
+  ToolAddress.make(
+    `${ADDRESS_PREFIX}.${integration}.${owner}.${connection}.${tool}`,
+  );
 // ---------------------------------------------------------------------------
 // Owner key helpers — every owned-row write stamps `tenant`, `owner`,
 // core-table query unioned with the in-memory static pool.
 // ---------------------------------------------------------------------------
+// ExecutorWrapper — a plugin-contributed executor middleware. Given the
+// assembled executor and the per-request selector string (e.g. an MCP
+// `?toolkit=` value), it returns a possibly-narrowed executor. A plugin
+// contributes one by exposing a `wrapExecutor` method on its extension; the
+// assembler collects them and the execution stack runs each before the engine
+// is built. Core knows nothing about what a wrapper narrows to — that domain
+// (toolkits, etc.) lives entirely in the contributing plugin.
+export type ExecutorWrapper = <TPlugins extends readonly AnyPlugin[]>(
+  base: Executor<TPlugins>,
+  selector: string,
+) => Effect.Effect<Executor<TPlugins>, StorageFailure>;
 export type Executor<TPlugins extends readonly AnyPlugin[] = readonly []> = {
   readonly integrations: {
     readonly list: () => Effect.Effect<readonly Integration[], StorageFailure>;
-    readonly get: (slug: IntegrationSlug) => Effect.Effect<Integration | null, StorageFailure>;
+    readonly get: (
+      slug: IntegrationSlug,
+    ) => Effect.Effect<Integration | null, StorageFailure>;
     readonly update: (
       slug: IntegrationSlug,
       patch: { readonly name?: string; readonly description?: string },
     ) => Effect.Effect<void, IntegrationNotFoundError | StorageFailure>;
     readonly remove: (
       slug: IntegrationSlug,
-    ) => Effect.Effect<void, IntegrationRemovalNotAllowedError | StorageFailure>;
+    ) => Effect.Effect<
+      void,
+      IntegrationRemovalNotAllowedError | StorageFailure
+    >;
     readonly detect: (
       url: string,
     ) => Effect.Effect<readonly IntegrationDetectionResult[], StorageFailure>;
       readonly integration?: IntegrationSlug;
       readonly owner?: Owner;
     }) => Effect.Effect<readonly Connection[], StorageFailure>;
-    readonly get: (ref: ConnectionRef) => Effect.Effect<Connection | null, StorageFailure>;
+    readonly get: (
+      ref: ConnectionRef,
+    ) => Effect.Effect<Connection | null, StorageFailure>;
     /** Edit user-curated metadata (description, identityLabel). Credentials and
      *  OAuth lifecycle fields are not editable here. */
     readonly update: (
   readonly oauth: OAuthService;
   readonly tools: {
-    readonly list: (filter?: ToolListFilter) => Effect.Effect<readonly Tool[], StorageFailure>;
+    readonly list: (
-    readonly schema: (address: ToolAddress) => Effect.Effect<ToolSchemaView | null, StorageFailure>;
+      filter?: ToolListFilter,
+    ) => Effect.Effect<readonly Tool[], StorageFailure>;
+    readonly schema: (
+      address: ToolAddress,
+    ) => Effect.Effect<ToolSchemaView | null, StorageFailure>;
   };
   readonly providers: {
     readonly list: () => Effect.Effect<readonly ProviderKey[]>;
-    readonly items: (key: ProviderKey) => Effect.Effect<readonly ProviderEntry[], StorageFailure>;
+    readonly items: (
+      key: ProviderKey,
+    ) => Effect.Effect<readonly ProviderEntry[], StorageFailure>;
   };
   readonly policies: {
     readonly list: () => Effect.Effect<readonly ToolPolicy[], StorageFailure>;
-    readonly create: (input: CreateToolPolicyInput) => Effect.Effect<ToolPolicy, StorageFailure>;
+    readonly create: (
-    readonly update: (input: UpdateToolPolicyInput) => Effect.Effect<ToolPolicy, StorageFailure>;
+      input: CreateToolPolicyInput,
-    readonly remove: (input: RemoveToolPolicyInput) => Effect.Effect<void, StorageFailure>;
+    ) => Effect.Effect<ToolPolicy, StorageFailure>;
-    readonly resolve: (address: ToolAddress) => Effect.Effect<EffectivePolicy, StorageFailure>;
+    readonly update: (
+      input: UpdateToolPolicyInput,
+    ) => Effect.Effect<ToolPolicy, StorageFailure>;
+    readonly remove: (
+      input: RemoveToolPolicyInput,
+    ) => Effect.Effect<void, StorageFailure>;
+    readonly resolve: (
+      address: ToolAddress,
+    ) => Effect.Effect<EffectivePolicy, StorageFailure>;
   };
   readonly execute: (
 export interface ExecutorDb {
   readonly db: FumaDb<any>;
-  readonly close?: () => Effect.Effect<void, StorageFailure> | Promise<void> | void;
+  readonly close?: () =>
+    | Effect.Effect<void, StorageFailure>
+    | Promise<void>
+    | void;
 }
 export type ExecutorDbInput = FumaDb<any> | ExecutorDb;
   readonly tables: FumaTables;
 }) => ExecutorDbInput | Effect.Effect<ExecutorDbInput, StorageFailure>;
-export interface ExecutorConfig<TPlugins extends readonly AnyPlugin[] = readonly []> {
+export interface ExecutorConfig<
+  TPlugins extends readonly AnyPlugin[] = readonly [],
+> {
   /** The org / workspace this executor is bound to. `owner: "org"` rows file
    *  here. */
   readonly tenant: Tenant;
   }
 };
-const validateExecutorDbTables = (required: FumaTables, actual: FumaTables): void => {
+const validateExecutorDbTables = (
+  required: FumaTables,
+  actual: FumaTables,
+): void => {
   const missing = Object.keys(required)
     .filter((tableName) => !actual[tableName])
     .sort();
   });
 };
-const storageFailureFromUnknown = (message: string, cause: unknown): StorageFailure =>
+const storageFailureFromUnknown = (
+  message: string,
+  cause: unknown,
+): StorageFailure =>
   isStorageFailure(cause) ? cause : new StorageError({ message, cause });
-const pluginStorageFailure = (pluginId: string, hook: string, cause: unknown): StorageFailure =>
+const pluginStorageFailure = (
+  pluginId: string,
+  hook: string,
+  cause: unknown,
+): StorageFailure =>
   storageFailureFromUnknown(`${hook} failed for plugin ${pluginId}`, cause);
 const createDefaultMemoryDb = (tables: FumaTables): ExecutorDb => {
   const version = "1.0.0";
-  const latestSchema = fumaSchema<string, FumaTables, RelationsMap<FumaTables>>({
+  const latestSchema = fumaSchema<string, FumaTables, RelationsMap<FumaTables>>(
-    version,
+    {
-    tables,
+      version,
-  });
+      tables,
+    },
+  );
   const factory = fumadb({
     namespace: "executor_memory",
     schemas: [latestSchema],
 // JSON helpers + row → public projection conversions
 // ---------------------------------------------------------------------------
-const decodeJsonFromString = Schema.decodeUnknownOption(Schema.UnknownFromJsonString);
+const decodeJsonFromString = Schema.decodeUnknownOption(
+  Schema.UnknownFromJsonString,
+);
 const decodeJsonColumn = (value: unknown): unknown => {
   if (value === null || value === undefined) return undefined;
     identityLabel: row.identity_label ?? null,
     description: row.description ?? null,
     expiresAt: row.expires_at == null ? null : Number(row.expires_at),
-    oauthClient: row.oauth_client == null ? null : OAuthClientSlug.make(String(row.oauth_client)),
+    oauthClient:
+      row.oauth_client == null
+        ? null
+        : OAuthClientSlug.make(String(row.oauth_client)),
     oauthClientOwner:
-      row.oauth_client_owner == null ? null : (String(row.oauth_client_owner) as Owner),
+      row.oauth_client_owner == null
+        ? null
+        : (String(row.oauth_client_owner) as Owner),
     oauthScope: row.oauth_scope == null ? null : String(row.oauth_scope),
   };
 };
   input: ConnectionValueInput,
 ): readonly NormalizedConnectionInput[] => {
   if ("inputs" in input) {
-    return Object.entries(input.inputs).map(([variable, origin]) => ({ variable, origin }));
+    return Object.entries(input.inputs).map(([variable, origin]) => ({
+      variable,
+      origin,
+    }));
   }
   if ("values" in input) {
     return Object.entries(input.values).map(([variable, value]) => ({
 // schema columns); `Tool.inputSchema`/`outputSchema` are optional and stay
 // absent for those callers — `tools.schema` is the schema-bearing surface.
 const rowToTool = (
-  row: ToolInvocationRow & Partial<Pick<ToolRow, "input_schema" | "output_schema">>,
+  row: ToolInvocationRow &
+    Partial<Pick<ToolRow, "input_schema" | "output_schema">>,
   annotations?: ToolAnnotations,
 ): Tool => {
   const owner = row.owner as Owner;
     description: row.description,
     inputSchema: decodeJsonColumn(row.input_schema),
     outputSchema: decodeJsonColumn(row.output_schema),
-    annotations: annotations ?? (decodeJsonColumn(row.annotations) as ToolAnnotations | undefined),
+    annotations:
+      annotations ??
+      (decodeJsonColumn(row.annotations) as ToolAnnotations | undefined),
   };
 };
 >;
 /** The narrowed row a projected query returns: the selected columns keep
  *  their types, everything else is absent. */
-type CoreProjectedRow<TName extends CoreTableName, TSelect> = TSelect extends readonly (infer K)[]
+type CoreProjectedRow<
+  TName extends CoreTableName,
+  TSelect,
+> = TSelect extends readonly (infer K)[]
   ? Pick<CoreRow<TName>, Extract<K, keyof CoreRow<TName>>>
   : CoreRow<TName>;
     tableName: TName,
     options?: { readonly where?: CoreWhere },
   ): Effect.Effect<number, StorageFailure> =>
-    fuma.use(`${tableName}.count`, (db) => asLooseStorageDb(db).count(tableName, options)),
+    fuma.use(`${tableName}.count`, (db) =>
+      asLooseStorageDb(db).count(tableName, options),
+    ),
   create: <TName extends CoreTableName>(
     tableName: TName,
     row: Record<string, unknown>,
     rows.length === 0
       ? Effect.void
       : fuma
-          .use(`${tableName}.createMany`, (db) => asLooseStorageDb(db).createMany(tableName, rows))
+          .use(`${tableName}.createMany`, (db) =>
+            asLooseStorageDb(db).createMany(tableName, rows),
+          )
           .pipe(Effect.asVoid),
   deleteMany: <TName extends CoreTableName>(
     tableName: TName,
     fuma.use(`${tableName}.deleteMany`, (db) =>
       asLooseStorageDb(db).deleteMany(tableName, options),
     ),
-  findFirst: <TName extends CoreTableName, const TOptions extends CoreFindFirstOptions<TName>>(
+  findFirst: <
+    TName extends CoreTableName,
+    const TOptions extends CoreFindFirstOptions<TName>,
+  >(
     tableName: TName,
     options: TOptions,
-  ): Effect.Effect<CoreProjectedRow<TName, TOptions["select"]> | null, StorageFailure> =>
+  ): Effect.Effect<
+    CoreProjectedRow<TName, TOptions["select"]> | null,
+    StorageFailure
+  > =>
     fuma.use(`${tableName}.findFirst`, (db) =>
       asLooseStorageDb(db).findFirst(tableName, options),
-    ) as Effect.Effect<CoreProjectedRow<TName, TOptions["select"]> | null, StorageFailure>,
+    ) as Effect.Effect<
-  findMany: <TName extends CoreTableName, const TOptions extends CoreFindManyOptions<TName>>(
+      CoreProjectedRow<TName, TOptions["select"]> | null,
+      StorageFailure
+    >,
+  findMany: <
+    TName extends CoreTableName,
+    const TOptions extends CoreFindManyOptions<TName>,
+  >(
     tableName: TName,
     options: TOptions = {} as TOptions,
-  ): Effect.Effect<readonly CoreProjectedRow<TName, TOptions["select"]>[], StorageFailure> =>
+  ): Effect.Effect<
+    readonly CoreProjectedRow<TName, TOptions["select"]>[],
+    StorageFailure
+  > =>
     fuma.use(`${tableName}.findMany`, (db) =>
       asLooseStorageDb(db).findMany(tableName, options),
-    ) as Effect.Effect<readonly CoreProjectedRow<TName, TOptions["select"]>[], StorageFailure>,
+    ) as Effect.Effect<
+      readonly CoreProjectedRow<TName, TOptions["select"]>[],
+      StorageFailure
+    >,
   updateMany: <TName extends CoreTableName>(
     tableName: TName,
     options: {
 // [user, org]; writes/deletes name an explicit owner.
 // ---------------------------------------------------------------------------
-const pluginStorageEntryFromRow = <T>(row: CoreRow<"plugin_storage">): PluginStorageEntry<T> => ({
+const pluginStorageEntryFromRow = <T>(
+  row: CoreRow<"plugin_storage">,
+): PluginStorageEntry<T> => ({
   id: pluginStorageId({
     pluginId: row.plugin_id,
     collection: row.collection,
   collection: row.collection,
   key: row.key,
   data: row.data as T,
-  createdAt: row.created_at instanceof Date ? row.created_at : new Date(row.created_at),
+  createdAt:
-  updatedAt: row.updated_at instanceof Date ? row.updated_at : new Date(row.updated_at),
+    row.created_at instanceof Date ? row.created_at : new Date(row.created_at),
+  updatedAt:
+    row.updated_at instanceof Date ? row.updated_at : new Date(row.updated_at),
 });
-const pluginStorageIndexSpecFields = (spec: PluginStorageRuntimeIndexSpec): readonly string[] =>
+const pluginStorageIndexSpecFields = (
-  typeof spec === "string" ? [spec] : spec;
+  spec: PluginStorageRuntimeIndexSpec,
+): readonly string[] => (typeof spec === "string" ? [spec] : spec);
 const pluginStorageCollectionIndexedFields = (
   definition: PluginStorageRuntimeCollectionDefinition,
 ): ReadonlySet<string> =>
-  new Set(definition.indexes.flatMap((spec) => pluginStorageIndexSpecFields(spec)));
+  new Set(
+    definition.indexes.flatMap((spec) => pluginStorageIndexSpecFields(spec)),
+  );
 const pluginStorageQueryValidationError = (
   definition: PluginStorageRuntimeCollectionDefinition,
-  query: PluginStorageCollectionQueryInput<PluginStorageCollectionDefinition> | undefined,
+  query:
+    | PluginStorageCollectionQueryInput<PluginStorageCollectionDefinition>
+    | undefined,
 ): StorageError | null => {
   if (!query) return null;
   const indexedFields = pluginStorageCollectionIndexedFields(definition);
       });
     }
   }
-  if (query.limit !== undefined && (!Number.isInteger(query.limit) || query.limit < 0)) {
+  if (
+    query.limit !== undefined &&
+    (!Number.isInteger(query.limit) || query.limit < 0)
+  ) {
     return new StorageError({
       message: `Plugin storage collection "${definition.name}" received an invalid query limit`,
       cause: undefined,
     });
   }
-  if (query.offset !== undefined && (!Number.isInteger(query.offset) || query.offset < 0)) {
+  if (
+    query.offset !== undefined &&
+    (!Number.isInteger(query.offset) || query.offset < 0)
+  ) {
     return new StorageError({
       message: `Plugin storage collection "${definition.name}" received an invalid query offset`,
       cause: undefined,
   return null;
 };
-const isPluginStorageRecord = (value: unknown): value is Readonly<Record<string, unknown>> =>
+const isPluginStorageRecord = (
+  value: unknown,
+): value is Readonly<Record<string, unknown>> =>
   value !== null && typeof value === "object" && !Array.isArray(value);
-const pluginStorageWhereOperators = ["eq", "in", "gt", "gte", "lt", "lte"] as const;
+const pluginStorageWhereOperators = [
+  "eq",
+  "in",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+] as const;
-const isPluginStorageWhereFilter = (value: unknown): value is Readonly<Record<string, unknown>> =>
+const isPluginStorageWhereFilter = (
-  isPluginStorageRecord(value) && pluginStorageWhereOperators.some((operator) => operator in value);
+  value: unknown,
+): value is Readonly<Record<string, unknown>> =>
+  isPluginStorageRecord(value) &&
+  pluginStorageWhereOperators.some((operator) => operator in value);
-const pluginStorageComparableValue = (value: unknown): string | number | boolean | null => {
+const pluginStorageComparableValue = (
+  value: unknown,
+): string | number | boolean | null => {
   if (value instanceof Date) return value.getTime();
-  if (typeof value === "number" || typeof value === "string" || typeof value === "boolean") {
+  if (
+    typeof value === "number" ||
+    typeof value === "string" ||
+    typeof value === "boolean"
+  ) {
     return value;
   }
   if (value == null) return null;
 const pluginStorageDataField = (data: unknown, field: string): unknown =>
   isPluginStorageRecord(data) ? data[field] : undefined;
-const matchesWhereOperator = (operator: string, value: unknown, operand: unknown): boolean => {
+const matchesWhereOperator = (
-  if (operator === "eq") return comparePluginStorageValues(value, operand) === 0;
+  operator: string,
+  value: unknown,
+  operand: unknown,
+): boolean => {
+  if (operator === "eq")
+    return comparePluginStorageValues(value, operand) === 0;
   if (operator === "in") {
     return (
       Array.isArray(operand) &&
     );
   }
   if (operator === "gt") return comparePluginStorageValues(value, operand) > 0;
-  if (operator === "gte") return comparePluginStorageValues(value, operand) >= 0;
+  if (operator === "gte")
+    return comparePluginStorageValues(value, operand) >= 0;
   if (operator === "lt") return comparePluginStorageValues(value, operand) < 0;
-  if (operator === "lte") return comparePluginStorageValues(value, operand) <= 0;
+  if (operator === "lte")
+    return comparePluginStorageValues(value, operand) <= 0;
   return false;
 };
   readonly owner: OwnerBinding;
 }): PluginStorageFacade => {
   // Owner partitions: org always, plus this subject's user partition.
-  const readOwners: readonly Owner[] = input.owner.subject == null ? ["org"] : ["user", "org"];
+  const readOwners: readonly Owner[] =
+    input.owner.subject == null ? ["org"] : ["user", "org"];
-  const ownerSubject = (owner: Owner): { owner: Owner; subject: string } | null => {
+  const ownerSubject = (
+    owner: Owner,
+  ): { owner: Owner; subject: string } | null => {
     if (owner === "org") return { owner: "org", subject: ORG_SUBJECT };
     if (input.owner.subject == null) return null;
     return { owner: "user", subject: String(input.owner.subject) };
         key === undefined ? true : b("key", "=", key),
       );
-  const whereOwner = (owner: Owner, collection: string, key: string): CoreWhere => {
+  const whereOwner = (
+    owner: Owner,
+    collection: string,
+    key: string,
+  ): CoreWhere => {
     const os = ownerSubject(owner);
     return (b: AnyCb) =>
       b.and(
     });
   const getVisible = <T>(collection: string, key: string) =>
-    input.core.findMany("plugin_storage", { where: whereFor(collection, key) }).pipe(
+    input.core
-      Effect.map((rows) => sortByOwnerPrecedence(rows)[0] ?? null),
+      .findMany("plugin_storage", { where: whereFor(collection, key) })
-      Effect.map((row) => (row ? pluginStorageEntryFromRow<T>(row) : null)),
+      .pipe(
-    );
+        Effect.map((rows) => sortByOwnerPrecedence(rows)[0] ?? null),
+        Effect.map((row) => (row ? pluginStorageEntryFromRow<T>(row) : null)),
+      );
   const getForOwnerImpl = <T>(owner: Owner, collection: string, key: string) =>
     input.core
       .findFirst("plugin_storage", {
         where: whereOwner(owner, collection, key),
       })
-      .pipe(Effect.map((row) => (row ? pluginStorageEntryFromRow<T>(row) : null)));
+      .pipe(
+        Effect.map((row) => (row ? pluginStorageEntryFromRow<T>(row) : null)),
+      );
-  const putImpl = <T>(owner: Owner, collection: string, key: string, data: unknown) =>
+  const putImpl = <T>(
+    owner: Owner,
+    collection: string,
+    key: string,
+    data: unknown,
+  ) =>
     Effect.gen(function* () {
       const os = ownerSubject(owner);
       if (!os) {
           offset < uniqueKeys.length;
           offset += PLUGIN_STORAGE_DELETE_KEY_BATCH_SIZE
         ) {
-          const batchKeys = uniqueKeys.slice(offset, offset + PLUGIN_STORAGE_DELETE_KEY_BATCH_SIZE);
+          const batchKeys = uniqueKeys.slice(
+            offset,
+            offset + PLUGIN_STORAGE_DELETE_KEY_BATCH_SIZE,
+          );
           yield* input.core.deleteMany("plugin_storage", {
             where: (b) =>
               b.and(
       yield* deleteManyImpl(owner, os.subject, entries);
     });
-  const queryCollection = <TDefinition extends PluginStorageCollectionDefinition>(
+  const queryCollection = <
+    TDefinition extends PluginStorageCollectionDefinition,
+  >(
     definition: TDefinition,
     queryInput?: PluginStorageCollectionQueryInput<TDefinition>,
   ) =>
       });
       const filtered = sortByOwnerPrecedence(rows)
         .filter((row) =>
-          queryInput?.keyPrefix === undefined ? true : row.key.startsWith(queryInput.keyPrefix),
+          queryInput?.keyPrefix === undefined
+            ? true
+            : row.key.startsWith(queryInput.keyPrefix),
         )
         .filter((row) =>
           rowMatchesPluginStorageWhere(
                 if (compared !== 0) return compared;
               }
               return (
-                ownerRank(left.owner as Owner) - ownerRank(right.owner as Owner) ||
+                ownerRank(left.owner as Owner) -
+                  ownerRank(right.owner as Owner) ||
                 left.key.localeCompare(right.key)
               );
             })
           ? sorted.slice(offset)
           : sorted.slice(offset, offset + queryInput.limit);
       return limited.map((row) =>
-        pluginStorageEntryFromRow<PluginStorageCollectionData<TDefinition>>(row),
+        pluginStorageEntryFromRow<PluginStorageCollectionData<TDefinition>>(
+          row,
+        ),
       );
     });
     collection: (definition) => ({
       get: (storageInput) =>
         getVisible(definition.name, storageInput.key) as Effect.Effect<
-          PluginStorageEntry<PluginStorageCollectionData<typeof definition>> | null,
+          PluginStorageEntry<
+            PluginStorageCollectionData<typeof definition>
+          > | null,
           StorageFailure
         >,
       getForOwner: (storageInput) =>
-        getForOwnerImpl(storageInput.owner, definition.name, storageInput.key) as Effect.Effect<
+        getForOwnerImpl(
-          PluginStorageEntry<PluginStorageCollectionData<typeof definition>> | null,
+          storageInput.owner,
+          definition.name,
+          storageInput.key,
+        ) as Effect.Effect<
+          PluginStorageEntry<
+            PluginStorageCollectionData<typeof definition>
+          > | null,
           StorageFailure
         >,
-      list: (storageInput) => queryCollection(definition, { keyPrefix: storageInput?.keyPrefix }),
+      list: (storageInput) =>
+        queryCollection(definition, { keyPrefix: storageInput?.keyPrefix }),
       put: (storageInput) =>
         putImpl(
           storageInput.owner,
         >,
       query: (storageInput) => queryCollection(definition, storageInput),
       count: (storageInput) =>
-        queryCollection(definition, storageInput).pipe(Effect.map((rows) => rows.length)),
+        queryCollection(definition, storageInput).pipe(
-      remove: (storageInput) => removeImpl(storageInput.owner, definition.name, storageInput.key),
+          Effect.map((rows) => rows.length),
+        ),
+      remove: (storageInput) =>
+        removeImpl(storageInput.owner, definition.name, storageInput.key),
     }),
-    get: (storageInput) => getVisible(storageInput.collection, storageInput.key),
+    get: (storageInput) =>
+      getVisible(storageInput.collection, storageInput.key),
     getForOwner: (storageInput) =>
-      getForOwnerImpl(storageInput.owner, storageInput.collection, storageInput.key),
+      getForOwnerImpl(
+        storageInput.owner,
+        storageInput.collection,
+        storageInput.key,
+      ),
     list: (storageInput) =>
       Effect.gen(function* () {
         const rows = yield* input.core.findMany("plugin_storage", {
           .map((row) => pluginStorageEntryFromRow(row));
       }),
     put: (storageInput) =>
-      putImpl(storageInput.owner, storageInput.collection, storageInput.key, storageInput.data),
+      putImpl(
-    putMany: (storageInput) => putManyImpl(storageInput.owner, storageInput.entries),
+        storageInput.owner,
+        storageInput.collection,
+        storageInput.key,
+        storageInput.data,
+      ),
+    putMany: (storageInput) =>
+      putManyImpl(storageInput.owner, storageInput.entries),
     remove: (storageInput) =>
       removeImpl(storageInput.owner, storageInput.collection, storageInput.key),
-    removeMany: (storageInput) => removeManyImpl(storageInput.owner, storageInput.entries),
+    removeMany: (storageInput) =>
+      removeManyImpl(storageInput.owner, storageInput.entries),
   };
 };
   tools: [],
 };
-const isReadonlyRecord = (value: unknown): value is Readonly<Record<PropertyKey, unknown>> =>
+const isReadonlyRecord = (
+  value: unknown,
+): value is Readonly<Record<PropertyKey, unknown>> =>
   typeof value === "object" && value !== null;
 type StandardJsonSchemaSide = "input" | "output";
   const jsonSchema = standard["jsonSchema"];
   if (!isReadonlyRecord(jsonSchema)) return schema;
   const materialize = (jsonSchema as StandardJsonSchemaFns)[side];
-  return typeof materialize === "function" ? materialize({ target: "draft-07" }) : jsonSchema;
+  return typeof materialize === "function"
+    ? materialize({ target: "draft-07" })
+    : jsonSchema;
 };
-export const createExecutor = <const TPlugins extends readonly AnyPlugin[] = readonly []>(
+export const createExecutor = <
+  const TPlugins extends readonly AnyPlugin[] = readonly [],
+>(
   config: ExecutorConfig<TPlugins>,
 ): Effect.Effect<Executor<TPlugins>, StorageFailure> =>
   Effect.gen(function* () {
       return { tenant, owner, subject };
     };
-    const requireUserSubject = (owner: Owner): Effect.Effect<void, StorageFailure> =>
+    const requireUserSubject = (
+      owner: Owner,
+    ): Effect.Effect<void, StorageFailure> =>
       owner === "user" && subject == null
         ? Effect.fail(
             new StorageError({
     const tables = yield* Effect.try({
       try: () => collectTables(),
-      catch: (cause) => storageFailureFromUnknown("Failed to collect executor tables", cause),
+      catch: (cause) =>
+        storageFailureFromUnknown("Failed to collect executor tables", cause),
     });
     const dbInput = yield* Effect.suspend(() => {
       if (!config.db) return Effect.succeed(createDefaultMemoryDb(tables));
         validateExecutorDbTables(tables, rootDbUntyped.internal.tables);
         validateExecutorOwnerPolicyTables(rootDbUntyped.internal.tables);
       },
-      catch: (cause) => storageFailureFromUnknown("Failed to validate executor tables", cause),
+      catch: (cause) =>
+        storageFailureFromUnknown("Failed to validate executor tables", cause),
     });
     const ownerContext: ExecutorOwnerPolicyContext = { tenant, subject };
     const fuma = makeFumaClient(rootDb);
     const core = makeCoreDb(fuma);
     const blobs = config.blobs ?? makeFumaBlobStore(fuma);
-    const transaction = <A, E>(effect: Effect.Effect<A, E>) => fuma.transaction(effect);
+    const transaction = <A, E>(effect: Effect.Effect<A, E>) =>
+      fuma.transaction(effect);
     // Populated once, never mutated after startup.
     const staticTools = new Map<string, StaticTools>();
     const staticToolOwner = (): Owner => (subject == null ? "org" : "user");
     const staticToolConnection = (source: StaticSourceDecl): ConnectionName =>
-      ConnectionName.make(source.id === EXECUTOR_SOURCE_ID ? "coreTools" : "static");
+      ConnectionName.make(
+        source.id === EXECUTOR_SOURCE_ID ? "coreTools" : "static",
+      );
     const staticSources = (): readonly StaticSourceDecl[] => {
       const byId = new Map<string, StaticSourceDecl>();
       return [...byId.values()];
     };
-    const staticSourceToIntegration = (source: StaticSourceDecl): Integration => ({
+    const staticSourceToIntegration = (
+      source: StaticSourceDecl,
+    ): Integration => ({
       slug: IntegrationSlug.make(source.id),
       name: source.name,
       description: source.name,
     };
     const extensions: Record<string, object> = {};
+    // Generic executor-wrapper hook: a plugin may expose `wrapExecutor` on its
+    // extension to narrow the executor per request (the toolkits plugin does).
+    // Collected here, run by the execution stack — core stays domain-agnostic.
+    const executorWrappers: ExecutorWrapper[] = [];
     // ------------------------------------------------------------------
     // Owner condition builders. The owner policy already restricts reads to
     const performTokenRefresh = (
       row: ConnectionRow,
       provider: CredentialProvider,
-    ): Effect.Effect<string | null, StorageFailure | CredentialResolutionError> =>
+    ): Effect.Effect<
+      string | null,
+      StorageFailure | CredentialResolutionError
+    > =>
       Effect.gen(function* () {
         const owner = row.owner as Owner;
         const reauth = (message: string): CredentialResolutionError =>
         // Load the backing app by the owner STORED on the connection (a Personal
         // connection may be backed by a shared Workspace app) — no derivation.
         const clientOwner = (row.oauth_client_owner ?? row.owner) as Owner;
-        const clientRow = yield* loadOAuthClientRow(clientOwner, String(row.oauth_client));
+        const clientRow = yield* loadOAuthClientRow(
+          clientOwner,
+          String(row.oauth_client),
+        );
         if (!clientRow) {
-          return yield* reauth(`OAuth client "${row.oauth_client}" is no longer registered.`);
+          return yield* reauth(
+            `OAuth client "${row.oauth_client}" is no longer registered.`,
+          );
         }
         // The secret is stored in the provider (a vault item id), not inline.
         const clientSecret = clientRow.client_secret_item_id
-          ? ((yield* provider.get(ProviderItemId.make(String(clientRow.client_secret_item_id)))) ??
+          ? ((yield* provider.get(
-            "")
+              ProviderItemId.make(String(clientRow.client_secret_item_id)),
+            )) ?? "")
           : "";
         // Re-request the scopes this connection was GRANTED (RFC 6749 §6: a
         // refresh must not exceed the originally-granted scope). Empty → omit
                 clientId: String(clientRow.client_id),
                 clientSecret,
                 scopes: grantedScopes,
-                resource: clientRow.resource ? String(clientRow.resource) : undefined,
+                resource: clientRow.resource
+                  ? String(clientRow.resource)
+                  : undefined,
                 endpointUrlPolicy: config.oauthEndpointUrlPolicy,
               }).pipe(
                 // A client_credentials failure is never a rotated-refresh-token
               )
             : yield* Effect.gen(function* () {
                 if (!row.refresh_item_id) {
-                  return yield* reauth("No refresh token is stored for this connection.");
+                  return yield* reauth(
+                    "No refresh token is stored for this connection.",
+                  );
                 }
-                const refreshToken = yield* provider.get(ProviderItemId.make(row.refresh_item_id));
+                const refreshToken = yield* provider.get(
+                  ProviderItemId.make(row.refresh_item_id),
+                );
                 if (!refreshToken) {
-                  return yield* reauth("Stored refresh token could not be resolved.");
+                  return yield* reauth(
+                    "Stored refresh token could not be resolved.",
+                  );
                 }
                 return yield* refreshAccessToken({
                   tokenUrl: String(clientRow.token_url),
                   scopes: grantedScopes,
                   // RFC 8707: keep the re-minted token bound to the same resource
                   // (MCP servers require this on refresh).
-                  resource: clientRow.resource ? String(clientRow.resource) : undefined,
+                  resource: clientRow.resource
+                    ? String(clientRow.resource)
+                    : undefined,
                   endpointUrlPolicy: config.oauthEndpointUrlPolicy,
                 }).pipe(
                   Effect.mapError((cause) =>
           const tokenItemId =
             connectionItemIds(row)[PRIMARY_INPUT_VARIABLE] ??
             `connection:${row.owner}:${row.integration}:${row.name}:${PRIMARY_INPUT_VARIABLE}`;
-          yield* provider.set(ProviderItemId.make(tokenItemId), token.access_token);
+          yield* provider.set(
+            ProviderItemId.make(tokenItemId),
+            token.access_token,
+          );
           if (token.refresh_token && row.refresh_item_id) {
-            yield* provider.set(ProviderItemId.make(row.refresh_item_id), token.refresh_token);
+            yield* provider.set(
+              ProviderItemId.make(row.refresh_item_id),
+              token.refresh_token,
+            );
           }
         }
         const nextExpiresAt =
-          typeof token.expires_in === "number" ? Date.now() + token.expires_in * 1000 : null;
+          typeof token.expires_in === "number"
+            ? Date.now() + token.expires_in * 1000
+            : null;
         const set: Record<string, unknown> = {
           expires_at: nextExpiresAt,
           updated_at: new Date(),
     const refreshConnectionToken = (
       row: ConnectionRow,
       provider: CredentialProvider,
-    ): Effect.Effect<string | null, StorageFailure | CredentialResolutionError> =>
+    ): Effect.Effect<
+      string | null,
+      StorageFailure | CredentialResolutionError
+    > =>
       // Share a single refresh per connection so concurrent resolves of the same
       // connection all await one refresh-token grant (the AS rotates the refresh
       // token; parallel grants would race on a consumed token — v1's refresh
         if (existing) return yield* existing;
         // `Effect.cached` memoizes the grant onto a deferred: it runs once and
         // replays to every awaiter sharing this entry.
-        const memoized = yield* Effect.cached(performTokenRefresh(row, provider));
+        const memoized = yield* Effect.cached(
+          performTokenRefresh(row, provider),
+        );
         const gated = memoized.pipe(
           Effect.ensuring(Effect.sync(() => refreshInFlight.delete(key))),
         );
     // first (always single-input → `{ token: <access> }`).
     const resolveConnectionValues = (
       row: ConnectionRow,
-    ): Effect.Effect<Record<string, string | null>, StorageFailure | CredentialResolutionError> =>
+    ): Effect.Effect<
+      Record<string, string | null>,
+      StorageFailure | CredentialResolutionError
+    > =>
       Effect.gen(function* () {
         const provider = credentialProviders.get(row.provider);
         if (!provider) {
         }
         // OAuth connections refresh their access token before resolving when
         // it has expired (or is within the skew window).
-        const expiresAt = row.expires_at == null ? null : Number(row.expires_at);
+        const expiresAt =
+          row.expires_at == null ? null : Number(row.expires_at);
         if (row.oauth_client != null && shouldRefreshToken({ expiresAt })) {
           const access = yield* refreshConnectionToken(row, provider);
           return { [PRIMARY_INPUT_VARIABLE]: access };
         }
         const out: Record<string, string | null> = {};
-        for (const [variable, itemId] of Object.entries(connectionItemIds(row))) {
+        for (const [variable, itemId] of Object.entries(
+          connectionItemIds(row),
+        )) {
           out[variable] = yield* provider.get(ProviderItemId.make(itemId));
         }
         return out;
      *  callers that only ever need one value. */
     const resolveConnectionValue = (
       row: ConnectionRow,
-    ): Effect.Effect<string | null, StorageFailure | CredentialResolutionError> =>
+    ): Effect.Effect<
+      string | null,
+      StorageFailure | CredentialResolutionError
+    > =>
       resolveConnectionValues(row).pipe(
         Effect.map((values) => values[PRIMARY_INPUT_VARIABLE] ?? null),
       );
     // plugin's `describeAuthMethods` hook. The hook is plugin-authored, so a
     // throw (malformed config it didn't guard) degrades to `[]` rather than
     // failing the catalog read.
-    const describeAuthMethodsForRow = (row: IntegrationRow): readonly AuthMethodDescriptor[] => {
+    const describeAuthMethodsForRow = (
+      row: IntegrationRow,
+    ): readonly AuthMethodDescriptor[] => {
       const runtime = runtimes.get(row.plugin_id);
       const describe = runtime?.plugin.describeAuthMethods;
       if (!describe) return [];
       }
     };
-    const describeDisplayUrlForRow = (row: IntegrationRow): string | undefined => {
+    const describeDisplayUrlForRow = (
+      row: IntegrationRow,
+    ): string | undefined => {
       const runtime = runtimes.get(row.plugin_id);
       const describe = runtime?.plugin.describeIntegrationDisplay;
       if (!describe) return undefined;
       }
     };
-    const integrationsList = (): Effect.Effect<readonly Integration[], StorageFailure> =>
+    const integrationsList = (): Effect.Effect<
+      readonly Integration[],
+      StorageFailure
+    > =>
       core
         .findMany("integration", {})
         .pipe(
           Effect.map((rows) => [
             ...staticSources().map(staticSourceToIntegration),
             ...rows.map((row) =>
-              rowToIntegration(row, describeAuthMethodsForRow(row), describeDisplayUrlForRow(row)),
+              rowToIntegration(
+                row,
+                describeAuthMethodsForRow(row),
+                describeDisplayUrlForRow(row),
+              ),
             ),
           ]),
         );
       slug: IntegrationSlug,
     ): Effect.Effect<Integration | null, StorageFailure> =>
       Effect.gen(function* () {
-        const staticSource = staticSources().find((source) => source.id === String(slug));
+        const staticSource = staticSources().find(
+          (source) => source.id === String(slug),
+        );
         if (staticSource) return staticSourceToIntegration(staticSource);
         const row = yield* findIntegrationRow(slug);
         return row
-          ? rowToIntegration(row, describeAuthMethodsForRow(row), describeDisplayUrlForRow(row))
+          ? rowToIntegration(
+              row,
+              describeAuthMethodsForRow(row),
+              describeDisplayUrlForRow(row),
+            )
           : null;
       });
     ): Effect.Effect<IntegrationRecord | null, StorageFailure> =>
       findIntegrationRow(slug).pipe(
         Effect.map((row) =>
-          row ? rowToIntegrationRecord(row, describeAuthMethodsForRow(row)) : null,
+          row
+            ? rowToIntegrationRecord(row, describeAuthMethodsForRow(row))
+            : null,
         ),
       );
         const now = new Date();
         const set: Record<string, unknown> = { updated_at: now };
         if (patch.name !== undefined) set.name = patch.name;
-        if (patch.description !== undefined) set.description = patch.description;
+        if (patch.description !== undefined)
+          set.description = patch.description;
         if (patch.config !== undefined) {
           set.config = patch.config;
           // A config change can change the derived tools. The writer can only
     const integrationsRemove = (
       slug: IntegrationSlug,
-    ): Effect.Effect<void, IntegrationRemovalNotAllowedError | StorageFailure> =>
+    ): Effect.Effect<
+      void,
+      IntegrationRemovalNotAllowedError | StorageFailure
+    > =>
       transaction(
         Effect.gen(function* () {
           const existing = yield* findIntegrationRow(slug);
           const result = yield* runtime.plugin
             .detect({ ctx: runtime.ctx, url })
             .pipe(
-              Effect.mapError((cause) => pluginStorageFailure(runtime.plugin.id, "detect", cause)),
+              Effect.mapError((cause) =>
+                pluginStorageFailure(runtime.plugin.id, "detect", cause),
+              ),
             );
           if (result) results.push(result);
         }
     const produceConnectionTools = (
       integrationRow: IntegrationRow,
       ref: ConnectionRef,
-    ): Effect.Effect<readonly Tool[], IntegrationNotFoundError | StorageFailure> =>
+    ): Effect.Effect<
+      readonly Tool[],
+      IntegrationNotFoundError | StorageFailure
+    > =>
       Effect.gen(function* () {
         const runtime = runtimes.get(integrationRow.plugin_id);
         const keys = yield* Effect.try({
             integration: rowToIntegration(integrationRow),
             config: decodeJsonColumn(integrationRow.config),
             connection: ref,
-            template: existingRow ? AuthTemplateSlug.make(existingRow.template) : null,
+            template: existingRow
+              ? AuthTemplateSlug.make(existingRow.template)
+              : null,
             storage: runtime.storage,
             getValue: () => resolveConnectionValueByRef(ref),
             getValues: () => resolveConnectionValuesByRef(ref),
           })
           .pipe(
             Effect.mapError((cause) =>
-              pluginStorageFailure(integrationRow.plugin_id, "resolveTools", cause),
+              pluginStorageFailure(
+                integrationRow.plugin_id,
+                "resolveTools",
+                cause,
+              ),
             ),
           );
           updated_at: now,
         }));
-        const definitionRows = Object.entries(result.definitions ?? {}).map(([name, schema]) => ({
+        const definitionRows = Object.entries(result.definitions ?? {}).map(
-          tenant: keys.tenant,
+          ([name, schema]) => ({
-          owner: keys.owner,
+            tenant: keys.tenant,
-          subject: keys.subject,
+            owner: keys.owner,
-          integration: String(ref.integration),
+            subject: keys.subject,
-          connection: String(ref.name),
+            integration: String(ref.integration),
-          plugin_id: integrationRow.plugin_id,
+            connection: String(ref.name),
-          name,
+            plugin_id: integrationRow.plugin_id,
-          schema,
+            name,
-          created_at: now,
+            schema,
-        }));
+            created_at: now,
+          }),
+        );
         yield* transaction(
           Effect.gen(function* () {
         const itemIds: Record<string, string> = {};
         if (external.length > 0 && pasted.length > 0) {
           return yield* new InvalidConnectionInputError({
-            message: "A connection cannot mix pasted and external-provider inputs.",
+            message:
+              "A connection cannot mix pasted and external-provider inputs.",
           });
         }
         if (external.length > 0) {
           const providers = new Set(
-            external.map((i) => ("from" in i.origin ? String(i.origin.from.provider) : "")),
+            external.map((i) =>
+              "from" in i.origin ? String(i.origin.from.provider) : "",
+            ),
           );
           if (providers.size > 1) {
             return yield* new InvalidConnectionInputError({
-              message: "A connection's inputs must all use the same external provider.",
+              message:
+                "A connection's inputs must all use the same external provider.",
             });
           }
           const [only] = [...providers];
           }
           providerKey = only ?? "";
           for (const i of external) {
-            if ("from" in i.origin) itemIds[i.variable] = String(i.origin.from.id);
+            if ("from" in i.origin)
+              itemIds[i.variable] = String(i.origin.from.id);
           }
         } else {
           const provider = defaultWritableProvider();
               identity_label: input.identityLabel ?? null,
               // Re-saving a credential keeps an existing curated description
               // unless the caller explicitly provides one.
-              ...(input.description !== undefined ? { description: input.description } : {}),
+              ...(input.description !== undefined
+                ? { description: input.description }
+                : {}),
               updated_at: now,
             };
             if (existing) {
         };
         // Produce + persist tools for the new connection.
         yield* produceConnectionTools(integrationRow, ref).pipe(
-          Effect.catchTag("IntegrationNotFoundError", () => Effect.succeed([] as readonly Tool[])),
+          Effect.catchTag("IntegrationNotFoundError", () =>
+            Effect.succeed([] as readonly Tool[]),
+          ),
         );
         const row = yield* findConnectionRow(ref);
         // Produce + persist tools for the minted connection (same path
         // connections.create uses).
         yield* produceConnectionTools(integrationRow, ref).pipe(
-          Effect.catchTag("IntegrationNotFoundError", () => Effect.succeed([] as readonly Tool[])),
+          Effect.catchTag("IntegrationNotFoundError", () =>
+            Effect.succeed([] as readonly Tool[]),
+          ),
         );
         const row = yield* findConnectionRow(ref);
               filter?.integration === undefined
                 ? true
                 : b("integration", "=", String(filter.integration)),
-              filter?.owner === undefined ? true : b("owner", "=", filter.owner),
+              filter?.owner === undefined
+                ? true
+                : b("owner", "=", filter.owner),
             ),
         })
         .pipe(Effect.map((rows) => rows.map(rowToConnection)));
-    const connectionsGet = (ref: ConnectionRef): Effect.Effect<Connection | null, StorageFailure> =>
+    const connectionsGet = (
-      findConnectionRow(ref).pipe(Effect.map((row) => (row ? rowToConnection(row) : null)));
+      ref: ConnectionRef,
+    ): Effect.Effect<Connection | null, StorageFailure> =>
+      findConnectionRow(ref).pipe(
+        Effect.map((row) => (row ? rowToConnection(row) : null)),
+      );
     const connectionsUpdate = (
       ref: ConnectionRef,
           });
         }
         const set: Record<string, unknown> = { updated_at: new Date() };
-        if (input.description !== undefined) set.description = input.description;
+        if (input.description !== undefined)
-        if (input.identityLabel !== undefined) set.identity_label = input.identityLabel;
+          set.description = input.description;
+        if (input.identityLabel !== undefined)
+          set.identity_label = input.identityLabel;
         yield* core.updateMany("connection", {
           where: (b: AnyCb) =>
             b.and(
             });
           }
           const integrationRow = yield* findIntegrationRow(ref.integration);
-          const runtime = integrationRow ? runtimes.get(integrationRow.plugin_id) : undefined;
+          const runtime = integrationRow
+            ? runtimes.get(integrationRow.plugin_id)
+            : undefined;
           if (integrationRow && runtime?.plugin.removeConnection) {
             yield* runtime.plugin
               .removeConnection({
               })
               .pipe(
                 Effect.mapError((cause) =>
-                  pluginStorageFailure(integrationRow.plugin_id, "removeConnection", cause),
+                  pluginStorageFailure(
+                    integrationRow.plugin_id,
+                    "removeConnection",
+                    cause,
+                  ),
                 ),
               );
           }
     // Tools (read surface)
     // ------------------------------------------------------------------
-    const matchesToolFilter = (tool: Tool, filter: ToolListFilter | undefined): boolean => {
+    const matchesToolFilter = (
+      tool: Tool,
+      filter: ToolListFilter | undefined,
+    ): boolean => {
       if (!filter) return true;
-      if (filter.integration !== undefined && tool.integration !== filter.integration) return false;
+      if (
-      if (filter.owner !== undefined && tool.owner !== filter.owner) return false;
+        filter.integration !== undefined &&
-      if (filter.connection !== undefined && tool.connection !== filter.connection) return false;
+        tool.integration !== filter.integration
+      )
+        return false;
+      if (filter.owner !== undefined && tool.owner !== filter.owner)
+        return false;
+      if (
+        filter.connection !== undefined &&
+        tool.connection !== filter.connection
+      )
+        return false;
       if (filter.query !== undefined) {
         const q = filter.query.toLowerCase();
         const hay = `${tool.name} ${tool.description}`.toLowerCase();
       });
       if (revised.length === 0) return;
       const revisedAt = new Map(
-        revised.map((row) => [row.slug, Number(row.config_revised_at)] as const),
+        revised.map(
+          (row) => [row.slug, Number(row.config_revised_at)] as const,
+        ),
       );
       const connections = yield* core.findMany("connection", {
-        where: (b: AnyCb) => b.or(...revised.map((row) => b("integration", "=", row.slug))),
+        where: (b: AnyCb) =>
+          b.or(...revised.map((row) => b("integration", "=", row.slug))),
       });
       for (const connection of connections) {
         const revisedTime = revisedAt.get(connection.integration);
         if (revisedTime === undefined) continue;
         const syncedAt =
-          connection.tools_synced_at == null ? 0 : Number(connection.tools_synced_at);
+          connection.tools_synced_at == null
+            ? 0
+            : Number(connection.tools_synced_at);
         if (syncedAt >= revisedTime) continue;
-        const integrationRow = revised.find((row) => row.slug === connection.integration);
+        const integrationRow = revised.find(
+          (row) => row.slug === connection.integration,
+        );
         if (!integrationRow) continue;
         yield* produceConnectionTools(integrationRow, {
           owner: connection.owner as Owner,
       }
     });
-    const toolsList = (filter?: ToolListFilter): Effect.Effect<readonly Tool[], StorageFailure> =>
+    const toolsList = (
+      filter?: ToolListFilter,
+    ): Effect.Effect<readonly Tool[], StorageFailure> =>
       Effect.gen(function* () {
         yield* syncStaleConnectionTools;
         // Projected: the list surface is metadata (address, description,
               filter?.integration === undefined
                 ? true
                 : b("integration", "=", String(filter.integration)),
-              filter?.owner === undefined ? true : b("owner", "=", filter.owner),
+              filter?.owner === undefined
+                ? true
+                : b("owner", "=", filter.owner),
               filter?.connection === undefined
                 ? true
                 : b("connection", "=", String(filter.connection)),
                 defs: new Map(),
               }),
             catch: (cause) =>
-              storageFailureFromUnknown("Failed to build static tool TypeScript preview", cause),
+              storageFailureFromUnknown(
+                "Failed to build static tool TypeScript preview",
+                cause,
+              ),
           }).pipe(Effect.option);
           return ToolSchemaView.make({
             address,
             outputSchema: tool.outputSchema,
             inputTypeScript: Option.getOrUndefined(preview)?.inputTypeScript,
             outputTypeScript: Option.getOrUndefined(preview)?.outputTypeScript,
-            typeScriptDefinitions: Option.getOrUndefined(preview)?.typeScriptDefinitions,
+            typeScriptDefinitions:
+              Option.getOrUndefined(preview)?.typeScriptDefinitions,
           });
         }
             ),
         });
         const defs = new Map<string, unknown>();
-        for (const def of definitionRows) defs.set(def.name, decodeJsonColumn(def.schema));
+        for (const def of definitionRows)
+          defs.set(def.name, decodeJsonColumn(def.schema));
         const referenced = collectReferencedDefinitions(
           [tool.inputSchema, tool.outputSchema],
               defs,
             }),
           catch: (cause) =>
-            storageFailureFromUnknown("Failed to build tool TypeScript preview", cause),
+            storageFailureFromUnknown(
+              "Failed to build tool TypeScript preview",
+              cause,
+            ),
         }).pipe(Effect.option);
         const view = preview;
               : undefined,
           inputTypeScript: Option.getOrUndefined(view)?.inputTypeScript,
           outputTypeScript: Option.getOrUndefined(view)?.outputTypeScript,
-          typeScriptDefinitions: Option.getOrUndefined(view)?.typeScriptDefinitions,
+          typeScriptDefinitions:
+            Option.getOrUndefined(view)?.typeScriptDefinitions,
         });
       });
     // ------------------------------------------------------------------
     const providersList = (): Effect.Effect<readonly ProviderKey[]> =>
-      Effect.sync(() => credentialProviderOrder.map((key) => ProviderKey.make(key)));
+      Effect.sync(() =>
+        credentialProviderOrder.map((key) => ProviderKey.make(key)),
+      );
     const providersItems = (
       key: ProviderKey,
         ? String(tool.address)
         : `${tool.integration}.${tool.owner}.${tool.connection}.${tool.name}`;
-    const policiesList = (): Effect.Effect<readonly ToolPolicy[], StorageFailure> =>
+    const policiesList = (): Effect.Effect<
+      readonly ToolPolicy[],
+      StorageFailure
+    > =>
       core
         .findMany("tool_policy", {})
         .pipe(
           Effect.map((rows) =>
             [...rows]
-              .sort((a, b) => ownerRankForRow(a) - ownerRankForRow(b) || comparePolicyRow(a, b))
+              .sort(
+                (a, b) =>
+                  ownerRankForRow(a) - ownerRankForRow(b) ||
+                  comparePolicyRow(a, b),
+              )
               .map(rowToToolPolicy),
           ),
         );
           .map((row) => row.position)
           .sort()
           .at(0);
-        const position = input.position ?? generateKeyBetween(null, minPosition ?? null);
+        const position =
+          input.position ?? generateKeyBetween(null, minPosition ?? null);
         const id = PolicyId.make(
           `pol_${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`,
         );
             cause: undefined,
           });
         }
-        const where = (b: AnyCb) => b.and(byOwner(input.owner)(b), b("id", "=", input.id));
+        const where = (b: AnyCb) =>
+          b.and(byOwner(input.owner)(b), b("id", "=", input.id));
         const existing = yield* core.findFirst("tool_policy", { where });
         if (!existing) {
           return yield* new StorageError({
         if (input.position !== undefined) set.position = input.position;
         yield* core.updateMany("tool_policy", { where, set });
         const updated = yield* core.findFirst("tool_policy", { where });
-        return rowToToolPolicy(updated ?? ({ ...existing, ...set } as ToolPolicyRow));
+        return rowToToolPolicy(
+          updated ?? ({ ...existing, ...set } as ToolPolicyRow),
+        );
       });
-    const policiesRemove = (input: RemoveToolPolicyInput): Effect.Effect<void, StorageFailure> =>
+    const policiesRemove = (
+      input: RemoveToolPolicyInput,
+    ): Effect.Effect<void, StorageFailure> =>
       core.deleteMany("tool_policy", {
-        where: (b: AnyCb) => b.and(byOwner(input.owner)(b), b("id", "=", input.id)),
+        where: (b: AnyCb) =>
+          b.and(byOwner(input.owner)(b), b("id", "=", input.id)),
       });
     const policiesResolve = (
               ),
           });
           if (row) {
-            const annotations = decodeJsonColumn(row.annotations) as ToolAnnotations | undefined;
+            const annotations = decodeJsonColumn(row.annotations) as
+              | ToolAnnotations
+              | undefined;
             requiresApproval = annotations?.requiresApproval;
           }
         }
-        return resolveEffectivePolicy(toolId, policyRows, ownerRankForRow, requiresApproval);
+        return resolveEffectivePolicy(
+          toolId,
+          policyRows,
+          ownerRankForRow,
+          requiresApproval,
+        );
       });
     // ------------------------------------------------------------------
     // Elicitation
     // ------------------------------------------------------------------
-    const defaultElicitationHandler = resolveElicitationHandler(config.onElicitation);
+    const defaultElicitationHandler = resolveElicitationHandler(
+      config.onElicitation,
+    );
-    const pickHandler = (options: InvokeOptions | undefined): ElicitationHandler =>
+    const pickHandler = (
+      options: InvokeOptions | undefined,
+    ): ElicitationHandler =>
       options?.onElicitation
         ? resolveElicitationHandler(options.onElicitation)
         : defaultElicitationHandler;
     const TOOL_SUGGESTION_LIMIT = 5;
-    const toolSuggestions = (rows: readonly ToolInvocationRow[]): readonly ToolAddress[] =>
+    const toolSuggestions = (
-      rows.map((row) => rowToTool(row).address);
+      rows: readonly ToolInvocationRow[],
+    ): readonly ToolAddress[] => rows.map((row) => rowToTool(row).address);
-    const toolRowsForConnectionWhere = (parsed: ParsedToolAddress) => (b: AnyCb) =>
+    const toolRowsForConnectionWhere =
-      b.and(
+      (parsed: ParsedToolAddress) => (b: AnyCb) =>
-        byOwner(parsed.owner)(b),
+        b.and(
-        b("integration", "=", String(parsed.integration)),
+          byOwner(parsed.owner)(b),
-        b("connection", "=", String(parsed.connection)),
+          b("integration", "=", String(parsed.integration)),
-      );
+          b("connection", "=", String(parsed.connection)),
+        );
     const searchToolRowsForConnection = (
       parsed: ParsedToolAddress,
       return Effect.gen(function* () {
         // oxlint-disable executor/no-instanceof-error, executor/no-unknown-error-message, executor/no-manual-tag-check -- boundary: normalize arbitrary unknown plugin failures into a human-readable message for ToolInvocationError/telemetry
         const formatInvocationCauseMessage = (cause: unknown): string => {
-          if (cause instanceof Error && cause.message.length > 0) return cause.message;
+          if (cause instanceof Error && cause.message.length > 0)
+            return cause.message;
           // Non-Error / empty-message causes: `String(plainObject)` renders
           // "[object Object]", which is what telemetry then shows as the only
           // label for the failure. Prefer the tag, else stringify structurally.
               pattern: policy.pattern ?? "*",
             });
           }
-          yield* enforceApproval(staticEntry.tool.annotations, address, args, policy, handler);
+          yield* enforceApproval(
+            staticEntry.tool.annotations,
+            address,
+            args,
+            policy,
+            handler,
+          );
           return yield* wrapInvocationError(
             staticEntry.tool.handler({
               ctx: staticEntry.ctx,
         if (!row) {
           const searchMatches = yield* searchToolRowsForConnection(parsed);
           const connectionTools =
-            searchMatches.length > 0 ? searchMatches : yield* findToolRowsForConnection(parsed);
+            searchMatches.length > 0
+              ? searchMatches
+              : yield* findToolRowsForConnection(parsed);
           return yield* new ToolNotFoundError({
             address,
             suggestions: toolSuggestions(connectionTools),
         // Resolve policy (owner-ranked).
         const toolForPolicy = rowToTool(row);
         const policyRows = yield* core.findMany("tool_policy", {});
-        const annotations = decodeJsonColumn(row.annotations) as ToolAnnotations | undefined;
+        const annotations = decodeJsonColumn(row.annotations) as
+          | ToolAnnotations
+          | undefined;
         const policy = resolveEffectivePolicy(
           normalizedPolicyId(toolForPolicy),
           policyRows,
             .pipe(wrapInvocationError);
           resolvedAnnotations = map[String(parsed.tool)] ?? annotations;
         }
-        yield* enforceApproval(resolvedAnnotations, address, args, policy, handler);
+        yield* enforceApproval(
+          resolvedAnnotations,
+          address,
+          args,
+          policy,
+          handler,
+        );
         // Resolve every named credential input (`variable → value`); `value` is
         // the primary `token` for single-input + OAuth callers.
           template: AuthTemplateSlug.make(connectionRow.template),
           value: values[PRIMARY_INPUT_VARIABLE] ?? null,
           values,
-          config: integrationRow ? decodeJsonColumn(integrationRow.config) : undefined,
+          config: integrationRow
+            ? decodeJsonColumn(integrationRow.config)
+            : undefined,
         };
         return yield* wrapInvocationError(
       subject,
       ownedKeys: (owner: Owner) => ownedKeys(owner),
       defaultWritableProvider,
-      mintOAuthConnection: (input: MintOAuthConnectionInput) => mintOAuthConnection(input),
+      mintOAuthConnection: (input: MintOAuthConnectionInput) =>
+        mintOAuthConnection(input),
       // Resolve the integration's DECLARED oauth scopes for a (integration,
       // template): load the row, run the owning plugin's auth-method projector,
       // and return the matching oauth method's declared `oauth.scopes`. Drives
       // client on a broad integration still requests the integration's full
       // scope set. Empty (no row / no oauth method / no declared scopes) ⇒ the
       // union collapses to the client's scopes (current behavior).
-      resolveDeclaredOAuthScopes: (integration: IntegrationSlug, template: AuthTemplateSlug) =>
+      resolveDeclaredOAuthScopes: (
+        integration: IntegrationSlug,
+        template: AuthTemplateSlug,
+      ) =>
         findIntegrationRow(integration).pipe(
           Effect.map((row): readonly string[] => {
             if (!row) return [];
             const methods = describeAuthMethodsForRow(row);
             const match =
               methods.find(
-                (m: AuthMethodDescriptor) => m.kind === "oauth" && m.template === String(template),
+                (m: AuthMethodDescriptor) =>
-              ) ?? methods.find((m: AuthMethodDescriptor) => m.kind === "oauth");
+                  m.kind === "oauth" && m.template === String(template),
+              ) ??
+              methods.find((m: AuthMethodDescriptor) => m.kind === "oauth");
             return match?.oauth?.scopes ?? [];
           }),
         ),
         httpClientLayer: config.httpClientLayer ?? FetchHttpClient.layer,
         core: {
           integrations: {
-            register: (input: RegisterIntegrationInput) => integrationsRegister(plugin.id, input),
+            register: (input: RegisterIntegrationInput) =>
+              integrationsRegister(plugin.id, input),
             update: (slug, patch) => integrationsUpdate(slug, patch),
             list: () => integrationsList(),
             get: (slug) => integrationsGetRecord(slug),
       if (plugin.extension) {
         extensions[plugin.id] = extension;
       }
+      // A plugin that narrows the executor exposes `wrapExecutor` on its
+      // extension; collect it into the generic hook the execution stack runs.
+      const wrapExecutor = (extension as { wrapExecutor?: ExecutorWrapper })
+        .wrapExecutor;
+      if (typeof wrapExecutor === "function")
+        executorWrappers.push(wrapExecutor);
       const decls = plugin.staticSources ? plugin.staticSources(extension) : [];
       for (const source of decls) {
             yield* runtime.plugin
               .close()
               .pipe(
-                Effect.mapError((cause) => pluginStorageFailure(runtime.plugin.id, "close", cause)),
+                Effect.mapError((cause) =>
+                  pluginStorageFailure(runtime.plugin.id, "close", cause),
+                ),
               );
           }
         }
       close,
     };
-    const toExecutor = (value: unknown): Executor<TPlugins> => value as Executor<TPlugins>;
+    const toExecutor = (value: unknown): Executor<TPlugins> =>
-    return toExecutor(Object.assign(base, extensions));
+      value as Executor<TPlugins>;
+    return toExecutor(Object.assign(base, extensions, { executorWrappers }));
   });
 // Helper alias so the inline literal used for the optimistic projection in

packages/core/sdk/src/index.ts+21−14

 // FumaDB integration.
 export { fumadb } from "@executor-js/fumadb";
 export type { FumaDB } from "@executor-js/fumadb";
-export type { AbstractQuery, Condition, ConditionBuilder } from "@executor-js/fumadb/query";
+export type {
-export { column, idColumn, schema as fumaSchema, table } from "@executor-js/fumadb/schema";
+  AbstractQuery,
+  Condition,
+  ConditionBuilder,
+} from "@executor-js/fumadb/query";
+export {
+  column,
+  idColumn,
+  schema as fumaSchema,
+  table,
+} from "@executor-js/fumadb/schema";
 export type {
   AnyColumn,
   AnySchema,
   IFumaClient,
   StorageFailure,
 } from "./fuma-runtime";
-export { StorageError, UniqueViolationError, isStorageFailure } from "./fuma-runtime";
+export {
+  StorageError,
+  UniqueViolationError,
+  isStorageFailure,
+} from "./fuma-runtime";
 // IDs (branded) — the v2 set.
 export {
   Subject,
   Owner,
 } from "./ids";
-export { connectionIdentifier, isConnectionIdentifier } from "./connection-name-identifier";
+export {
+  connectionIdentifier,
+  isConnectionIdentifier,
+} from "./connection-name-identifier";
 // Errors (tagged) — the ExecuteError set + integration lifecycle.
 export {
 // uses it; the host surface (`@executor-js/api/server`) re-exports it.
 export {
   type Executor,
+  type ExecutorWrapper,
   type ExecutorConfig,
   type ExecutorDb,
   type ExecutorDbFactory,
   type AuthToolFailureCode,
   type AuthToolFailureInput,
 } from "./auth-tool-failure";
-export {
-  applyToolkitScope,
-  EMPTY_TOOLKIT_SCOPE,
-  type ResolvedToolkitScope,
-  type ToolkitAccess,
-  type ToolkitPolicyAction,
-  type ToolkitPolicyRule,
-  type ToolkitResolver,
-  type ToolkitScopeEntry,
-} from "./toolkit-scope";

packages/core/sdk/src/tool.ts+10−4

-import type { ConnectionName, IntegrationSlug, Owner, ToolAddress, ToolName } from "./ids";
+import type {
+  ConnectionName,
+  IntegrationSlug,
+  Owner,
+  ToolAddress,
+  ToolName,
+} from "./ids";
 /* Tools belong to a connection and are PERSISTED, like v1 — not resolved live on
  * every list. A plugin produces them at create/refresh (openapi from the
   readonly approvalDescription?: string;
   readonly mayElicit?: boolean;
   /** True when the tool only reads (no side effects). Set by the owning plugin
-   *  (e.g. OpenAPI classifies GET/HEAD/OPTIONS as read-only). Toolkits use this
+   *  (e.g. OpenAPI classifies GET/HEAD/OPTIONS as read-only). Consumers that
-   *  to enforce read-only access: in a read-only slice a tool is hidden unless
+   *  offer a read-only mode use this fail-closed: a tool is hidden unless
-   *  `readOnly === true` (fail-closed — unclassified counts as write). */
+   *  `readOnly === true` (unclassified counts as write). */
   readonly readOnly?: boolean;
 }

packages/hosts/mcp/src/in-memory-session-store.ts+84−30

 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-import { formatPausedExecution, type ExecutionEngine } from "@executor-js/execution";
+import {
+  formatPausedExecution,
+  type ExecutionEngine,
+} from "@executor-js/execution";
 import {
   buildResumeApprovalUrl,
 // ---------------------------------------------------------------------------
 /** Engine construction failed for a principal. The store surfaces it as a 500. */
-export class McpEngineBuildError extends Data.TaggedError("McpEngineBuildError")<{
+export class McpEngineBuildError extends Data.TaggedError(
+  "McpEngineBuildError",
+)<{
   readonly cause: unknown;
 }> {}
 /** The browser-mode wiring the store hands a build call when a session opts in. */
 export interface McpBuildServerOptions {
   readonly elicitationMode?:
-    | { readonly mode: "browser"; readonly approvalUrl: (executionId: string) => string }
+    | {
+        readonly mode: "browser";
+        readonly approvalUrl: (executionId: string) => string;
+      }
     | { readonly mode: "model" }
     | { readonly mode: "native" };
   readonly browserApprovalStore?: BrowserApprovalStore;
-  /** Toolkit selector (slug or id) pinned for this session — narrows the engine
+  /** Per-request narrowing selector (the MCP `?toolkit=` value) pinned for this
-   *  to that toolkit's slice. Read once at session create from the request. */
+   *  session. Core forwards it to plugin executor wrappers; an unset selector
-  readonly toolkitId?: string;
+   *  leaves the executor unnarrowed. Read once at session create. */
+  readonly selector?: string;
 }
 /** Build the per-session `McpServer` + engine for a principal (the host's engine + tools). */
   readonly close: () => Promise<void>;
 }
-const ignoreClose = (close: (() => Promise<void>) | undefined): Promise<void> =>
+const ignoreClose = (
+  close: (() => Promise<void>) | undefined,
+): Promise<void> =>
   close
-    ? Effect.runPromise(Effect.ignore(Effect.tryPromise({ try: close, catch: () => undefined })))
+    ? Effect.runPromise(
+        Effect.ignore(
+          Effect.tryPromise({ try: close, catch: () => undefined }),
+        ),
+      )
     : Promise.resolve();
 const formatBoundaryError = (error: unknown): unknown =>
 // The store's error bodies are INNER responses (no CORS): the serving envelope
 // re-wraps the store `Response` with CORS before it leaves the origin, so the
 // canonical renderer is called with `cors: false` (content-type only).
-const jsonRpcError = (status: number, code: number, message: string): Response =>
+const jsonRpcError = (
-  jsonRpcErrorBody(status, code, message, { cors: false });
+  status: number,
+  code: number,
+  message: string,
+): Response => jsonRpcErrorBody(status, code, message, { cors: false });
 const json = (value: unknown, status = 200): Response =>
-  new Response(JSON.stringify(value), { status, headers: { "content-type": "application/json" } });
+  new Response(JSON.stringify(value), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
 const PAUSED_PATH = /^\/api\/mcp-sessions\/([^/?#]+)\/executions\/([^/?#]+)$/;
-const RESUME_PATH = /^\/api\/mcp-sessions\/([^/?#]+)\/executions\/([^/?#]+)\/resume$/;
+const RESUME_PATH =
+  /^\/api\/mcp-sessions\/([^/?#]+)\/executions\/([^/?#]+)\/resume$/;
 /**
  * Build the in-process session store plus an explicit `close()` that disposes
   // loopback hosts (local/desktop), where the request URL is already correct.
   options: { readonly webBaseUrl?: string } = {},
 ): InMemoryMcpSessionStore => {
-  const transports = new Map<string, WebStandardStreamableHTTPServerTransport>();
+  const transports = new Map<
+    string,
+    WebStandardStreamableHTTPServerTransport
+  >();
   const servers = new Map<string, McpServer>();
   const owners = new Map<string, Principal>();
   const engines = new Map<string, ExecutionEngine<Cause.YieldableError>>();
-  const approvals: InProcessBrowserApprovalStore = makeInProcessBrowserApprovalStore();
+  const approvals: InProcessBrowserApprovalStore =
+    makeInProcessBrowserApprovalStore();
-  const dispose = async (id: string, opts: { transport?: boolean; server?: boolean } = {}) => {
+  const dispose = async (
+    id: string,
+    opts: { transport?: boolean; server?: boolean } = {},
+  ) => {
     const transport = transports.get(id);
     const server = servers.get(id);
     transports.delete(id);
     servers.delete(id);
     owners.delete(id);
     engines.delete(id);
-    if (opts.transport) await ignoreClose(transport ? () => transport.close() : undefined);
+    if (opts.transport)
-    if (opts.server) await ignoreClose(server ? () => server.close() : undefined);
+      await ignoreClose(transport ? () => transport.close() : undefined);
+    if (opts.server)
+      await ignoreClose(server ? () => server.close() : undefined);
   };
   /**
       Effect.tap(() => Effect.sync(finish)),
       Effect.catchCause((cause) =>
         Effect.sync(() => {
-          console.error("[mcp] handleRequest error:", formatBoundaryError(cause));
+          console.error(
+            "[mcp] handleRequest error:",
+            formatBoundaryError(cause),
+          );
           finish();
           return jsonRpcError(500, -32603, "Internal server error");
         }),
     request: Request,
     sessionId: () => string | null,
   ): McpBuildServerOptions => {
-    if (readElicitationMode(request) !== "browser") return { elicitationMode: { mode: "model" } };
+    if (readElicitationMode(request) !== "browser")
+      return { elicitationMode: { mode: "model" } };
     return {
       elicitationMode: {
         mode: "browser",
   };
   /** Open a new session: build the server, connect a transport, drive the request. */
-  const create = (principal: Principal, request: Request): Effect.Effect<McpDispatchResult> => {
+  const create = (
+    principal: Principal,
+    request: Request,
+  ): Effect.Effect<McpDispatchResult> => {
     let createdSessionId: string | null = null;
     const baseOptions = buildOptionsFor(request, () => createdSessionId);
-    const toolkitId = readToolkitSelector(request);
+    const selector = readToolkitSelector(request);
-    return buildServer(principal, toolkitId ? { ...baseOptions, toolkitId } : baseOptions).pipe(
+    return buildServer(
+      principal,
+      selector ? { ...baseOptions, selector } : baseOptions,
+    ).pipe(
       Effect.flatMap(({ mcpServer, engine }) =>
         Effect.gen(function* () {
           const transport = new WebStandardStreamableHTTPServerTransport({
   const store: McpSessionStore["Service"] = {
     dispatch: ({ request, principal, sessionId }: McpDispatchInput) =>
-      sessionId ? forward(sessionId, principal, request) : create(principal, request),
+      sessionId
+        ? forward(sessionId, principal, request)
+        : create(principal, request),
     dispose: (sessionId) =>
-      Effect.promise(() => dispose(sessionId, { transport: true, server: true })),
+      Effect.promise(() =>
+        dispose(sessionId, { transport: true, server: true }),
+      ),
   };
   const ownerAccess = (
   ): Promise<Response | null> => {
     const match = PAUSED_PATH.exec(new URL(request.url).pathname);
     if (!match) return null;
-    if (request.method !== "GET") return json({ error: "Method not allowed" }, 405);
+    if (request.method !== "GET")
+      return json({ error: "Method not allowed" }, 405);
     const sessionId = decodeURIComponent(match[1]!);
     const access = ownerAccess(sessionId, principal);
     if (access === "forbidden") return json({ error: "Forbidden" }, 403);
-    if (access === "not-found") return json({ error: "Paused execution not found" }, 404);
+    if (access === "not-found")
-    const paused = await pausedFromSession(sessionId, decodeURIComponent(match[2]!));
+      return json({ error: "Paused execution not found" }, 404);
+    const paused = await pausedFromSession(
+      sessionId,
+      decodeURIComponent(match[2]!),
+    );
     if (!paused) return json({ error: "Paused execution not found" }, 404);
     return json({ text: paused.text, structured: paused.structured });
   };
   ): Promise<Response | null> => {
     const match = RESUME_PATH.exec(new URL(request.url).pathname);
     if (!match) return null;
-    if (request.method !== "POST") return json({ error: "Method not allowed" }, 405);
+    if (request.method !== "POST")
+      return json({ error: "Method not allowed" }, 405);
     const sessionId = decodeURIComponent(match[1]!);
     const executionId = decodeURIComponent(match[2]!);
     const access = ownerAccess(sessionId, principal);
     if (access === "forbidden") return json({ error: "Forbidden" }, 403);
-    if (access === "not-found") return json({ error: "Paused execution not found" }, 404);
+    if (access === "not-found")
+      return json({ error: "Paused execution not found" }, 404);
     // The session must still hold the paused execution — guards stale ids and
     // confirms the execution belongs to this session before recording.
     const paused = await pausedFromSession(sessionId, executionId);
     handleApprovalRequest,
     close: async () => {
       const ids = new Set([...transports.keys(), ...servers.keys()]);
-      await Promise.all([...ids].map((id) => dispose(id, { transport: true, server: true })));
+      await Promise.all(
+        [...ids].map((id) => dispose(id, { transport: true, server: true })),
+      );
     },
   };
 };

packages/plugins/toolkits/src/server.ts+110−58

 // ---------------------------------------------------------------------------
 import { Schema } from "effect";
-import { Context, definePlugin, Effect, HttpApiBuilder } from "@executor-js/sdk/core";
+import {
+  Context,
+  definePlugin,
+  Effect,
+  HttpApiBuilder,
+} from "@executor-js/sdk/core";
 import {
   definePluginStorageCollection,
   Owner,
+  type ExecutorWrapper,
   type PluginCtx,
-  type ResolvedToolkitScope,
   type StorageFailure,
 } from "@executor-js/sdk";
 import { addGroup, capture } from "@executor-js/api";
   type ToolkitView,
   type UpdateToolkitPayload,
 } from "./shared";
+import {
+  applyToolkitScope,
+  EMPTY_TOOLKIT_SCOPE,
+  type ResolvedToolkitScope,
+} from "./toolkit-scope";
 const ORG = Owner.make("org");
 const USER = Owner.make("user");
   action: Schema.String,
 });
-const TOOLKITS = definePluginStorageCollection("toolkits", ToolkitRow, { indexes: ["slug"] });
+const TOOLKITS = definePluginStorageCollection("toolkits", ToolkitRow, {
-const CONNECTIONS = definePluginStorageCollection("connections", ConnectionRow, {
+  indexes: ["slug"],
+});
+const CONNECTIONS = definePluginStorageCollection(
+  "connections",
+  ConnectionRow,
+  {
+    indexes: ["toolkitId"],
+  },
+);
+const POLICIES = definePluginStorageCollection("policies", PolicyRow, {
   indexes: ["toolkitId"],
 });
-const POLICIES = definePluginStorageCollection("policies", PolicyRow, { indexes: ["toolkitId"] });
 const newId = Effect.sync(() => crypto.randomUUID());
-const scopeOfOwner = (owner: Owner): ToolkitScope => (owner === ORG ? "workspace" : "personal");
+const scopeOfOwner = (owner: Owner): ToolkitScope =>
+  owner === ORG ? "workspace" : "personal";
 // ---------------------------------------------------------------------------
 // Extension — the canonical implementation. Handlers (and later the MCP
   // candidate connections honoring scope: a workspace toolkit may use only
   // org connections; a personal toolkit may use org + the caller's own.
   const candidateConnections = (scope: ToolkitScope) =>
-    scope === "workspace" ? ctx.connections.list({ owner: ORG }) : ctx.connections.list();
+    scope === "workspace"
+      ? ctx.connections.list({ owner: ORG })
+      : ctx.connections.list();
-  const validate = (scope: ToolkitScope, entries: ReadonlyArray<ToolkitConnectionEntryInput>) =>
+  const validate = (
+    scope: ToolkitScope,
+    entries: ReadonlyArray<ToolkitConnectionEntryInput>,
+  ) =>
     Effect.gen(function* () {
       const allowed = yield* candidateConnections(scope);
       const pairs = new Set(allowed.map((c) => `${c.integration}/${c.name}`));
     });
   const list = () =>
-    toolkits.list().pipe(Effect.flatMap((rows) => Effect.forEach(rows, viewFromRow)));
+    toolkits
+      .list()
+      .pipe(Effect.flatMap((rows) => Effect.forEach(rows, viewFromRow)));
   const update = (id: string, patch: UpdateToolkitPayload) =>
     Effect.gen(function* () {
       const data = {
         slug: row.data.slug,
         name: patch.name ?? row.data.name,
-        inheritOrgPolicies: patch.inheritOrgPolicies ?? row.data.inheritOrgPolicies,
+        inheritOrgPolicies:
-        briefing: patch.briefing === undefined ? row.data.briefing : patch.briefing,
+          patch.inheritOrgPolicies ?? row.data.inheritOrgPolicies,
+        briefing:
+          patch.briefing === undefined ? row.data.briefing : patch.briefing,
       };
       yield* toolkits.put({ key: id, owner: row.owner, data });
       if (patch.connections !== undefined) {
       }
       if (patch.policies !== undefined) {
         const existing = yield* policies.query({ where: { toolkitId: id } });
-        yield* Effect.forEach(existing, (p) => policies.remove({ key: p.key, owner: row.owner }));
+        yield* Effect.forEach(existing, (p) =>
+          policies.remove({ key: p.key, owner: row.owner }),
+        );
         yield* putPolicies(id, row.owner, patch.policies);
       }
       return yield* viewFromRow({ key: id, owner: row.owner, data });
       const row = yield* toolkits.get({ key: id });
       if (row == null) return yield* new ToolkitNotFound({ id });
       const conns = yield* connections.query({ where: { toolkitId: id } });
-      yield* Effect.forEach(conns, (c) => connections.remove({ key: c.key, owner: row.owner }));
+      yield* Effect.forEach(conns, (c) =>
+        connections.remove({ key: c.key, owner: row.owner }),
+      );
       const pols = yield* policies.query({ where: { toolkitId: id } });
-      yield* Effect.forEach(pols, (p) => policies.remove({ key: p.key, owner: row.owner }));
+      yield* Effect.forEach(pols, (p) =>
+        policies.remove({ key: p.key, owner: row.owner }),
+      );
       yield* toolkits.remove({ key: id, owner: row.owner });
       return { removed: true };
     });
     selector: string,
   ): Effect.Effect<ResolvedToolkitScope | null, StorageFailure> =>
     Effect.gen(function* () {
-      const bySlug = yield* toolkits.query({ where: { slug: selector }, limit: 1 });
+      const bySlug = yield* toolkits.query({
+        where: { slug: selector },
+        limit: 1,
+      });
       const row = bySlug[0] ?? (yield* toolkits.get({ key: selector }));
       if (row == null) return null;
       const conns = yield* connections.query({ where: { toolkitId: row.key } });
       };
     });
-  return { create, get, list, update, remove, resolveScope };
+  // The plugin's contribution to core's generic executor-wrapper seam: given a
+  // selector, resolve it to a scope (fail-closed to the empty slice when it
+  // doesn't resolve for this caller) and narrow the executor. Core collects and
+  // runs this without knowing it's about toolkits.
+  const wrapExecutor: ExecutorWrapper = (base, selector) =>
+    resolveScope(selector).pipe(
+      Effect.flatMap((scope) =>
+        applyToolkitScope(base, scope ?? EMPTY_TOOLKIT_SCOPE),
+      ),
+    );
+  return { create, get, list, update, remove, resolveScope, wrapExecutor };
 };
 // Local aliases so the storage/extension layer stays decoupled from the wire
 // schema's branded types without re-importing them everywhere.
-type ToolkitConnectionIntegration = ToolkitView["connections"][number]["integration"];
+type ToolkitConnectionIntegration =
+  ToolkitView["connections"][number]["integration"];
 type ToolkitConnectionEntryInput = {
   readonly integration: ToolkitConnectionIntegration;
   readonly connection: string;
 // the host's composed API requires) — not a standalone single-group bundle.
 const ExecutorApiWithToolkits = addGroup(ToolkitsApi);
-const ToolkitsHandlers = HttpApiBuilder.group(ExecutorApiWithToolkits, "toolkits", (h) =>
+const ToolkitsHandlers = HttpApiBuilder.group(
-  h
+  ExecutorApiWithToolkits,
-    .handle("list", () =>
+  "toolkits",
-      capture(
+  (h) =>
-        Effect.gen(function* () {
+    h
-          const ext = yield* ToolkitsExtensionService;
+      .handle("list", () =>
-          return yield* ext.list();
+        capture(
-        }),
+          Effect.gen(function* () {
-      ),
+            const ext = yield* ToolkitsExtensionService;
-    )
+            return yield* ext.list();
-    .handle("create", ({ payload }) =>
+          }),
-      capture(
+        ),
-        Effect.gen(function* () {
+      )
-          const ext = yield* ToolkitsExtensionService;
+      .handle("create", ({ payload }) =>
-          return yield* ext.create(payload);
+        capture(
-        }),
+          Effect.gen(function* () {
-      ),
+            const ext = yield* ToolkitsExtensionService;
-    )
+            return yield* ext.create(payload);
-    .handle("get", ({ params }) =>
+          }),
-      capture(
+        ),
-        Effect.gen(function* () {
+      )
-          const ext = yield* ToolkitsExtensionService;
+      .handle("get", ({ params }) =>
-          return yield* ext.get(params.id);
+        capture(
-        }),
+          Effect.gen(function* () {
-      ),
+            const ext = yield* ToolkitsExtensionService;
-    )
+            return yield* ext.get(params.id);
-    .handle("update", ({ params, payload }) =>
+          }),
-      capture(
+        ),
-        Effect.gen(function* () {
+      )
-          const ext = yield* ToolkitsExtensionService;
+      .handle("update", ({ params, payload }) =>
-          return yield* ext.update(params.id, payload);
+        capture(
-        }),
+          Effect.gen(function* () {
-      ),
+            const ext = yield* ToolkitsExtensionService;
-    )
+            return yield* ext.update(params.id, payload);
-    .handle("remove", ({ params }) =>
+          }),
-      capture(
+        ),
-        Effect.gen(function* () {
+      )
-          const ext = yield* ToolkitsExtensionService;
+      .handle("remove", ({ params }) =>
-          return yield* ext.remove(params.id);
+        capture(
-        }),
+          Effect.gen(function* () {
+            const ext = yield* ToolkitsExtensionService;
+            return yield* ext.remove(params.id);
+          }),
+        ),
       ),
-    ),
 );
 export const toolkitsPlugin = definePlugin(() => ({

packages/plugins/toolkits/src/toolkit-scope.tsrenamed from packages/core/sdk/src/toolkit-scope.ts+40−28

 // ---------------------------------------------------------------------------
 // Toolkit scope — wraps an Executor so the MCP surface only sees, and can only
-// run, a toolkit's slice of connections. Toolkit-agnostic: it operates on a
+// run, a toolkit's slice of connections. This is the toolkits plugin's
-// plain ResolvedToolkitScope (produced by the toolkits plugin's `resolveScope`)
+// implementation of core's generic `ExecutorWrapper` seam: the plugin
-// and the base Executor. Because the wrapped Executor is handed to the engine
+// contributes `wrapExecutor` (server.ts) and core runs it without ever knowing
+// what "toolkit" means. Because the wrapped Executor is handed to the engine
 // before construction, EVERY surface (tools.list, search, describe,
 // sources/connections/integrations.list, core-tools, and execute) flows through
 // it — enforcement is at execute, not just listing, so guessed out-of-slice
 import { Effect } from "effect";
-import { ToolBlockedError } from "./errors";
+import {
-import type { Executor } from "./executor";
+  ToolBlockedError,
-import type { ToolAddress } from "./ids";
+  type AnyPlugin,
-import type { AnyPlugin } from "./plugin";
+  type Executor,
-import type { StorageFailure } from "./fuma-runtime";
+  type StorageFailure,
+  type ToolAddress,
+} from "@executor-js/sdk";
-export type ToolkitAccess = "off" | "read" | "full";
+import type { ToolkitAccess, ToolkitPolicyAction } from "./shared";
-export type ToolkitPolicyAction = "approve" | "require_approval" | "block";
 export interface ToolkitPolicyRule {
   /** Glob over `<integration>.<connection>.<tool>` — `*` matches one segment,
     if (p[i] === "*" && i === p.length - 1) return true;
     if (a[i] === undefined) return false;
     const re = new RegExp(
-      "^" + p[i].replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*") + "$",
+      "^" +
+        p[i].replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*") +
+        "$",
     );
     if (!re.test(a[i])) return false;
   }
   return p.length === a.length;
 };
-/** A plugin extension capable of resolving a selector (slug or id) to a scope,
- *  scoped to the caller. `resolveScope` returns null when nothing matches. */
-export interface ToolkitResolver {
-  readonly resolveScope: (
-    selector: string,
-  ) => Effect.Effect<ResolvedToolkitScope | null, StorageFailure>;
-}
 const accessFor = (
   scope: ResolvedToolkitScope,
   integration: string,
   connection: string,
 ): ToolkitAccess => {
   for (const e of scope.entries) {
-    if (e.integration === integration && e.connection === connection) return e.access;
+    if (e.integration === integration && e.connection === connection)
+      return e.access;
   }
   for (const e of scope.entries) {
     if (e.integration === integration && e.connection === "*") return e.access;
   Effect.gen(function* () {
     const blockRules = scope.policies.filter((p) => p.action === "block");
     const isBlocked = (integration: string, connection: string, name: string) =>
-      blockRules.some((p) => matchPattern(p.pattern, `${integration}.${connection}.${name}`));
+      blockRules.some((p) =>
+        matchPattern(p.pattern, `${integration}.${connection}.${name}`),
+      );
     const all = yield* base.tools.list();
     const allowed = new Set<string>();
         allowed.add(String(t.address));
         continue;
       }
-      if (isBlocked(String(t.integration), String(t.connection), String(t.name))) continue;
+      if (
+        isBlocked(String(t.integration), String(t.connection), String(t.name))
+      )
+        continue;
       const a = accessFor(scope, String(t.integration), String(t.connection));
       if (a === "full" || (a === "read" && t.annotations?.readOnly === true)) {
         allowed.add(String(t.address));
         list: () =>
           base.integrations
             .list()
-            .pipe(Effect.map((xs) => xs.filter((i) => allowedIntegrations.has(String(i.slug))))),
+            .pipe(
+              Effect.map((xs) =>
+                xs.filter((i) => allowedIntegrations.has(String(i.slug))),
+              ),
+            ),
         get: (slug) =>
           allowedIntegrations.has(String(slug))
             ? base.integrations.get(slug)
           base.connections
             .list(filter)
             .pipe(
-              Effect.map((xs) => xs.filter((c) => connOk(String(c.integration), String(c.name)))),
+              Effect.map((xs) =>
+                xs.filter((c) => connOk(String(c.integration), String(c.name))),
+              ),
             ),
         get: (ref) =>
           base.connections
             .get(ref)
             .pipe(
-              Effect.map((c) => (c && connOk(String(c.integration), String(c.name)) ? c : null)),
+              Effect.map((c) =>
+                c && connOk(String(c.integration), String(c.name)) ? c : null,
+              ),
             ),
       },
       tools: {
         ...base.tools,
         list: (filter) =>
-          base.tools.list(filter).pipe(Effect.map((xs) => xs.filter((t) => addrOk(t.address)))),
+          base.tools
-        schema: (address) => (addrOk(address) ? base.tools.schema(address) : Effect.succeed(null)),
+            .list(filter)
+            .pipe(Effect.map((xs) => xs.filter((t) => addrOk(t.address)))),
+        schema: (address) =>
+          addrOk(address) ? base.tools.schema(address) : Effect.succeed(null),
       },
       execute: (address, args, options) =>
         addrOk(address)