@executor-js/sdk 0.0.1 → 0.1.0

package/dist/promise-executor.d.ts

@@ -1,139 +1,37 @@
-import { Context, Effect } from "effect";
-import { type ToolRegistry as CoreToolRegistry, type SourceRegistry as CoreSourceRegistry, type SecretStore as CoreSecretStore, type PolicyEngine as CorePolicyEngine, type ExecutorPlugin, type ElicitationContext, type ToolInvocationResult, type ToolMetadata, type ToolAnnotations, type SourceManager as EffectSourceManager, type Policy, type SecretRef, type SecretProvider as EffectSecretProvider, type Scope, type ToolId as ToolIdType, type SecretId as SecretIdType, type ScopeId as ScopeIdType, type PolicyId as PolicyIdType } from "./index";
-/** Replace branded IDs with plain strings in parameter types */
-type UnbrandParam<T> = T extends ToolIdType ? string : T extends SecretIdType ? string : T extends ScopeIdType ? string : T extends PolicyIdType ? string : T extends readonly (infer U)[] ? readonly UnbrandParam<U>[] : T;
-/** Convert an Effect service interface to Promise-based, unbranding ID params */
-type PromisifyService<T> = {
-    readonly [K in keyof T]: NonNullable<T[K]> extends (...args: infer A) => Effect.Effect<infer R, infer _E> ? (...args: {
-        [I in keyof A]: UnbrandParam<A[I]>;
-    }) => Promise<R> : T[K];
-};
-type CoreToolRegistryService = Context.Tag.Service<typeof CoreToolRegistry>;
-type CoreSourceRegistryService = Context.Tag.Service<typeof CoreSourceRegistry>;
-type CoreSecretStoreService = Context.Tag.Service<typeof CoreSecretStore>;
-type CorePolicyEngineService = Context.Tag.Service<typeof CorePolicyEngine>;
-export interface ElicitationResponse {
-    readonly action: "accept" | "decline" | "cancel";
-    readonly content?: Record<string, unknown>;
-}
-export type ElicitationHandler = (ctx: ElicitationContext) => Promise<ElicitationResponse>;
-export interface InvokeOptions {
-    readonly onElicitation: ElicitationHandler | "accept-all";
-}
-export interface ToolInvoker {
-    readonly invoke: (toolId: string, args: unknown, options: InvokeOptions) => Promise<ToolInvocationResult>;
-    readonly resolveAnnotations?: (toolId: string) => Promise<ToolAnnotations | undefined>;
-}
-export interface RuntimeToolHandler {
-    readonly invoke: (args: unknown, options: InvokeOptions) => Promise<ToolInvocationResult>;
-    readonly resolveAnnotations?: () => Promise<ToolAnnotations | undefined>;
-}
-export type SourceManager = PromisifyService<EffectSourceManager>;
-export type SecretProvider = PromisifyService<EffectSecretProvider>;
-export interface PluginContext {
-    readonly scope: Scope;
-    readonly tools: ToolRegistry;
-    readonly sources: SourceRegistry;
-    readonly secrets: SecretStore;
-    readonly policies: PolicyEngine;
-}
-export interface ToolRegistry extends Omit<PromisifyService<CoreToolRegistryService>, "list" | "invoke" | "registerInvoker" | "registerRuntimeHandler"> {
-    readonly list: (filter?: {
-        sourceId?: string;
-        query?: string;
-    }) => Promise<readonly ToolMetadata[]>;
-    readonly invoke: (toolId: string, args: unknown, options: InvokeOptions) => Promise<ToolInvocationResult>;
-    readonly registerInvoker: (pluginKey: string, invoker: ToolInvoker) => Promise<void>;
-    readonly registerRuntimeHandler: (toolId: string, handler: RuntimeToolHandler) => Promise<void>;
-}
-export interface SourceRegistry extends Omit<PromisifyService<CoreSourceRegistryService>, "addManager"> {
-    readonly addManager: (manager: SourceManager) => Promise<void>;
-}
-export interface SecretStore extends Omit<PromisifyService<CoreSecretStoreService>, "set" | "addProvider"> {
-    readonly set: (input: {
-        readonly id: string;
-        readonly scopeId: string;
-        readonly name: string;
-        readonly value: string;
-        readonly provider?: string;
-        readonly purpose?: string;
-    }) => Promise<SecretRef>;
-    readonly addProvider: (provider: SecretProvider) => Promise<void>;
-}
-export interface PolicyEngine extends Omit<PromisifyService<CorePolicyEngineService>, "check"> {
-    readonly check: (input: {
-        scopeId: string;
-        toolId: string;
-    }) => Promise<void>;
-}
-export interface Plugin<TKey extends string = string, TExtension extends object = object> {
-    readonly key: TKey;
-    /** @internal */
-    readonly _promise?: true;
-    readonly init: (ctx: PluginContext) => Promise<PluginHandle<TExtension>>;
-}
-export interface PluginHandle<TExtension extends object = object> {
-    readonly extension: TExtension;
-    readonly close?: () => Promise<void>;
-}
-export declare const definePlugin: <const TKey extends string, TExtension extends object>(plugin: Plugin<TKey, TExtension>) => Plugin<TKey, TExtension>;
-type Promisified<T> = T extends (...args: infer A) => Effect.Effect<infer R, infer _E> ? (...args: A) => Promise<R> : T extends object ? {
+import { Brand, Effect } from "effect";
+import { type Executor as EffectExecutor, type OnElicitation } from "./executor";
+import type { AnyPlugin } from "./plugin";
+type Unbrand<T> = T extends Brand.Brand<string> ? string : T extends readonly (infer U)[] ? readonly Unbrand<U>[] : T extends ReadonlyMap<infer K, infer V> ? ReadonlyMap<Unbrand<K>, Unbrand<V>> : T extends ReadonlySet<infer U> ? ReadonlySet<Unbrand<U>> : T extends Date ? T : T extends (...args: infer A) => infer R ? (...args: {
+    [I in keyof A]: Unbrand<A[I]>;
+}) => Unbrand<R> : T extends object ? {
+    readonly [K in keyof T]: Unbrand<T[K]>;
+} : T;
+export type Promisified<T> = T extends (...args: infer A) => Effect.Effect<infer R, infer _E> ? (...args: {
+    [I in keyof A]: Unbrand<A[I]>;
+}) => Promise<R> : T extends readonly unknown[] ? T : T extends object ? {
     readonly [K in keyof T]: Promisified<T[K]>;
 } : T;
-export type AnyPlugin = Plugin<string, object> | ExecutorPlugin<string, object>;
-export type Executor<TPlugins extends readonly AnyPlugin[] = []> = {
-    readonly scope: Scope;
-    readonly tools: Pick<ToolRegistry, "list" | "schema" | "definitions" | "invoke">;
-    readonly sources: Pick<SourceRegistry, "list" | "remove" | "refresh" | "detect">;
-    readonly policies: {
-        readonly list: () => Promise<readonly Policy[]>;
-        readonly add: (policy: Omit<Policy, "id" | "createdAt">) => Promise<Policy>;
-        readonly remove: (policyId: string) => Promise<boolean>;
-    };
-    readonly secrets: {
-        readonly list: () => Promise<readonly SecretRef[]>;
-        readonly resolve: (secretId: string) => Promise<string>;
-        readonly status: (secretId: string) => Promise<"resolved" | "missing">;
-        readonly set: (input: {
-            readonly id: string;
-            readonly name: string;
-            readonly value: string;
-            readonly provider?: string;
-            readonly purpose?: string;
-        }) => Promise<SecretRef>;
-        readonly remove: (secretId: string) => Promise<boolean>;
-        readonly addProvider: (provider: SecretProvider) => Promise<void>;
-        readonly providers: () => Promise<readonly string[]>;
-    };
-    readonly close: () => Promise<void>;
-} & PluginExtensions<TPlugins>;
-type PluginExtensions<TPlugins extends readonly AnyPlugin[]> = {
-    readonly [P in TPlugins[number] as P["key"]]: P extends Plugin<string, infer TExt> ? TExt : P extends ExecutorPlugin<string, infer TExt> ? Promisified<TExt> : never;
-};
+export type Executor<TPlugins extends readonly AnyPlugin[] = []> = Promisified<EffectExecutor<TPlugins>>;
 export interface ExecutorConfig<TPlugins extends readonly AnyPlugin[] = []> {
-    readonly scope?: {
+    /**
+     * Precedence-ordered scope stack (innermost first). Optional — defaults
+     * to a single-element stack with id "default-scope". Pass an array of
+     * `{ id, name }` partials to build a multi-scope executor.
+     */
+    readonly scopes?: readonly {
         readonly id?: string;
         readonly name?: string;
-    };
+    }[];
     readonly plugins?: TPlugins;
     /**
-     * Custom tool registry implementation. Defaults to an in-memory store.
-     * Implement the promise-shaped `ToolRegistry` interface to persist tool
-     * metadata to a database, remote service, etc.
-     */
-    readonly tools?: ToolRegistry;
-    /** Custom source registry implementation. Defaults to an in-memory store. */
-    readonly sources?: SourceRegistry;
-    /**
-     * Custom secret store implementation. Defaults to an in-memory store.
-     * For most use cases, prefer passing a custom `SecretProvider` via
-     * `executor.secrets.addProvider(...)` — only replace the whole store if you
-     * need to persist the `SecretRef` metadata itself.
+     * How to respond when a tool requests user input mid-invocation. Pass
+     * `"accept-all"` for tests / non-interactive hosts, or a handler
+     * `(ctx) => Promise<ElicitationResponse>` for interactive ones.
+     * Required at construction so per-invoke calls don't have to thread
+     * an options arg.
      */
-    readonly secrets?: SecretStore;
-    /** Custom policy engine implementation. Defaults to an in-memory store. */
-    readonly policies?: PolicyEngine;
+    readonly onElicitation: OnElicitation;
 }
-export declare const createExecutor: <const TPlugins extends readonly AnyPlugin[] = []>(config?: ExecutorConfig<TPlugins>) => Promise<Executor<TPlugins>>;
+export declare const createExecutor: <const TPlugins extends readonly AnyPlugin[] = []>(config: ExecutorConfig<TPlugins>) => Promise<Executor<TPlugins>>;
 export {};
 //# sourceMappingURL=promise-executor.d.ts.map

package/dist/promise-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"promise-executor.d.ts","sourceRoot":"","sources":["../src/promise-executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EAWL,KAAK,YAAY,IAAI,gBAAgB,EACrC,KAAK,cAAc,IAAI,kBAAkB,EACzC,KAAK,WAAW,IAAI,eAAe,EACnC,KAAK,YAAY,IAAI,gBAAgB,EAErC,KAAK,cAAc,EAGnB,KAAK,kBAAkB,EAEvB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,eAAe,EAIpB,KAAK,aAAa,IAAI,mBAAmB,EACzC,KAAK,MAAM,EACX,KAAK,SAAS,EACd,KAAK,cAAc,IAAI,oBAAoB,EAE3C,KAAK,KAAK,EACV,KAAK,MAAM,IAAI,UAAU,EACzB,KAAK,QAAQ,IAAI,YAAY,EAC7B,KAAK,OAAO,IAAI,WAAW,EAC3B,KAAK,QAAQ,IAAI,YAAY,EAS9B,MAAM,SAAS,CAAC;AAgEjB,gEAAgE;AAChE,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,UAAU,GACvC,MAAM,GACN,CAAC,SAAS,YAAY,GACpB,MAAM,GACN,CAAC,SAAS,WAAW,GACnB,MAAM,GACN,CAAC,SAAS,YAAY,GACpB,MAAM,GACN,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GAC5B,SAAS,YAAY,CAAC,CAAC,CAAC,EAAE,GAC1B,CAAC,CAAC;AAEd,iFAAiF;AACjF,KAAK,gBAAgB,CAAC,CAAC,IAAI;IACzB,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CACjD,GAAG,IAAI,EAAE,MAAM,CAAC,KACb,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,GACjC,CAAC,GAAG,IAAI,EAAE;SAAG,CAAC,IAAI,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GAC/D,CAAC,CAAC,CAAC,CAAC;CACT,CAAC;AAEF,KAAK,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC5E,KAAK,yBAAyB,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAChF,KAAK,sBAAsB,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,eAAe,CAAC,CAAC;AAC1E,KAAK,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM5E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,kBAAkB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAE3F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,aAAa,EAAE,kBAAkB,GAAG,YAAY,CAAC;CAC3D;AAyBD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,CACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,aAAa,KACnB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;CAC1E;AAED,MAAM,MAAM,aAAa,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;AAElE,MAAM,MAAM,cAAc,GAAG,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;AA6LpE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;CACjC;AAED,MAAM,WAAW,YAAa,SAAQ,IAAI,CACxC,gBAAgB,CAAC,uBAAuB,CAAC,EACzC,MAAM,GAAG,QAAQ,GAAG,iBAAiB,GAAG,wBAAwB,CACjE;IACC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,KAAK,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,CACf,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,aAAa,KACnB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,QAAQ,CAAC,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjG;AAED,MAAM,WAAW,cAAe,SAAQ,IAAI,CAC1C,gBAAgB,CAAC,yBAAyB,CAAC,EAC3C,YAAY,CACb;IACC,QAAQ,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,WAAY,SAAQ,IAAI,CACvC,gBAAgB,CAAC,sBAAsB,CAAC,EACxC,KAAK,GAAG,aAAa,CACtB;IACC,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,YAAa,SAAQ,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC5F,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/E;AAkED,MAAM,WAAW,MAAM,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,EAAE,UAAU,SAAS,MAAM,GAAG,MAAM;IACtF,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB,gBAAgB;IAChB,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,YAAY,CAAC,UAAU,SAAS,MAAM,GAAG,MAAM;IAC9D,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED,eAAO,MAAM,YAAY,GAAI,KAAK,CAAC,IAAI,SAAS,MAAM,EAAE,UAAU,SAAS,MAAM,EAC/E,QAAQ,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,KAC/B,MAAM,CAAC,IAAI,EAAE,UAAU,CAA6C,CAAC;AAwBxE,KAAK,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,GAClF,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC1B,CAAC,SAAS,MAAM,GACd;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GAC9C,CAAC,CAAC;AAER,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEhF,MAAM,MAAM,QAAQ,CAAC,QAAQ,SAAS,SAAS,SAAS,EAAE,GAAG,EAAE,IAAI;IACjE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,QAAQ,GAAG,aAAa,GAAG,QAAQ,CAAC,CAAC;IACjF,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC,CAAC;IACjF,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;QAChD,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,WAAW,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5E,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KACzD,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;QACnD,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QACxD,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;QACvE,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE;YACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;SAC3B,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QACxD,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAClE,QAAQ,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;KACtD,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AAE/B,KAAK,gBAAgB,CAAC,QAAQ,SAAS,SAAS,SAAS,EAAE,IAAI;IAC7D,QAAQ,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,GAC9E,IAAI,GACJ,CAAC,SAAS,cAAc,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,GAC1C,WAAW,CAAC,IAAI,CAAC,GACjB,KAAK;CACZ,CAAC;AAwBF,MAAM,WAAW,cAAc,CAAC,QAAQ,SAAS,SAAS,SAAS,EAAE,GAAG,EAAE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;CAClC;AAID,eAAO,MAAM,cAAc,GAAU,KAAK,CAAC,QAAQ,SAAS,SAAS,SAAS,EAAE,GAAG,EAAE,EACnF,SAAQ,cAAc,CAAC,QAAQ,CAAM,KACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAuE5B,CAAC"}
+{"version":3,"file":"promise-executor.d.ts","sourceRoot":"","sources":["../src/promise-executor.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAKvC,OAAO,EAGL,KAAK,QAAQ,IAAI,cAAc,EAC/B,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAgB1C,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAC3C,MAAM,GACN,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,GAC5B,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,GACrB,CAAC,SAAS,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,GACrC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GACnC,CAAC,SAAS,WAAW,CAAC,MAAM,CAAC,CAAC,GAC5B,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GACvB,CAAC,SAAS,IAAI,GACZ,CAAC,GACD,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,GACrC,CAAC,GAAG,IAAI,EAAE;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GAC1D,CAAC,SAAS,MAAM,GACd;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GAC1C,CAAC,CAAC;AAElB,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,CACrC,GAAG,IAAI,EAAE,MAAM,CAAC,KACb,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,GACjC,CAAC,GAAG,IAAI,EAAE;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GAC1D,CAAC,SAAS,SAAS,OAAO,EAAE,GAC1B,CAAC,GACD,CAAC,SAAS,MAAM,GACd;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GAC9C,CAAC,CAAC;AAEV,MAAM,MAAM,QAAQ,CAAC,QAAQ,SAAS,SAAS,SAAS,EAAE,GAAG,EAAE,IAAI,WAAW,CAC5E,cAAc,CAAC,QAAQ,CAAC,CACzB,CAAC;AAEF,MAAM,WAAW,cAAc,CAAC,QAAQ,SAAS,SAAS,SAAS,EAAE,GAAG,EAAE;IACxE;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;CACvC;AAyDD,eAAO,MAAM,cAAc,GACzB,KAAK,CAAC,QAAQ,SAAS,SAAS,SAAS,EAAE,GAAG,EAAE,EAEhD,QAAQ,cAAc,CAAC,QAAQ,CAAC,KAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAyC5B,CAAC"}

package/dist/promise.d.ts

@@ -1,7 +1,13 @@
-export { createExecutor, type Executor, type ExecutorConfig, type AnyPlugin, } from "./promise-executor";
-export { definePlugin, type Plugin, type PluginContext, type PluginHandle, } from "./promise-executor";
-export type { ToolRegistry, SourceRegistry, SecretStore, PolicyEngine } from "./promise-executor";
-export type { ToolInvoker, RuntimeToolHandler, SourceManager, SecretProvider, } from "./promise-executor";
-export type { InvokeOptions, ElicitationHandler, ElicitationResponse } from "./promise-executor";
-export { ToolRegistration, ToolInvocationResult, ToolMetadata, ToolSchema, ToolAnnotations, ToolListFilter, ToolId, SecretId, ScopeId, PolicyId, Source, SourceDetectionResult, SecretRef, Policy, Scope, FormElicitation, UrlElicitation, type ElicitationContext, type ElicitationRequest, ToolNotFoundError, ToolInvocationError, SecretNotFoundError, SecretResolutionError, PolicyDeniedError, ElicitationDeclinedError, } from "./index";
+export { createExecutor, type Executor, type ExecutorConfig, type Promisified, } from "./promise-executor";
+export { ScopeId, ToolId, SecretId, PolicyId } from "./ids";
+export { Scope } from "./scope";
+export { SecretRef, SetSecretInput } from "./secrets";
+export { ToolSchema, SourceDetectionResult, type Source, type Tool, type ToolListFilter, } from "./types";
+export type { ToolAnnotations } from "./core-schema";
+export type { AnyPlugin, PluginExtensions } from "./plugin";
+export type { OnElicitation, InvokeOptions } from "./executor";
+export { FormElicitation, UrlElicitation, ElicitationAction, ElicitationResponse, type ElicitationRequest, type ElicitationContext, type ElicitationHandler, } from "./elicitation";
+export { SecretBackedValue, SecretBackedMap, isSecretBackedRef, resolveSecretBackedMap, type ResolveSecretBackedMapOptions, } from "./secret-backed-value";
+export { defineExecutorConfig, type ExecutorCliConfig, type ExecutorDialect, } from "./config";
+export { ToolNotFoundError, ToolInvocationError, NoHandlerError, SourceNotFoundError, SourceRemovalNotAllowedError, PluginNotLoadedError, SecretNotFoundError, SecretResolutionError, type ExecutorError, } from "./errors";
 //# sourceMappingURL=promise.d.ts.map

package/dist/promise.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"promise.d.ts","sourceRoot":"","sources":["../src/promise.ts"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,EACd,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,YAAY,EACZ,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlG,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,GACf,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGjG,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,cAAc,EACd,MAAM,EACN,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,MAAM,EACN,qBAAqB,EACrB,SAAS,EACT,MAAM,EACN,KAAK,EACL,eAAe,EACf,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EAEvB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"promise.d.ts","sourceRoot":"","sources":["../src/promise.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,cAAc,EACd,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,KAAK,MAAM,EACX,KAAK,IAAI,EACT,KAAK,cAAc,GACpB,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI/D,OAAO,EACL,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,GACrB,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,aAAa,GACnB,MAAM,UAAU,CAAC"}

package/dist/promise.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=promise.test.d.ts.map

package/dist/promise.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promise.test.d.ts","sourceRoot":"","sources":["../src/promise.test.ts"],"names":[],"mappings":""}

package/dist/schema-types.d.ts

@@ -11,14 +11,15 @@ export type TypeScriptSchemaPreview = {
 };
 export declare const schemaToTypeScriptPreview: (schema: unknown, options?: TypeScriptRenderOptions) => TypeScriptSchemaPreview;
 export declare const schemaToTypeScriptPreviewWithDefs: (schema: unknown, defs: ReadonlyMap<string, unknown>, options?: TypeScriptRenderOptions) => TypeScriptSchemaPreview;
+export type ToolTypeScriptPreview = {
+    inputTypeScript?: string;
+    outputTypeScript?: string;
+    typeScriptDefinitions?: Record<string, string>;
+};
 export declare const buildToolTypeScriptPreview: (input: {
     inputSchema?: unknown;
     outputSchema?: unknown;
     defs: ReadonlyMap<string, unknown>;
     options?: TypeScriptRenderOptions;
-}) => {
-    inputTypeScript?: string;
-    outputTypeScript?: string;
-    typeScriptDefinitions?: Record<string, string>;
-};
+}) => ToolTypeScriptPreview;
 //# sourceMappingURL=schema-types.d.ts.map

package/dist/schema-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-types.d.ts","sourceRoot":"","sources":["../src/schema-types.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C,CAAC;AAgGF,eAAO,MAAM,yBAAyB,GACpC,QAAQ,OAAO,EACf,UAAS,uBAA4B,KACpC,uBAGF,CAAC;AAEF,eAAO,MAAM,iCAAiC,GAC5C,QAAQ,OAAO,EACf,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,UAAS,uBAA4B,KACpC,uBAmPF,CAAC;AAEF,eAAO,MAAM,0BAA0B,GAAI,OAAO;IAChD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,uBAAuB,CAAC;CACnC,KAAG;IACF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAuBhD,CAAC"}
+{"version":3,"file":"schema-types.d.ts","sourceRoot":"","sources":["../src/schema-types.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C,CAAC;AAgGF,eAAO,MAAM,yBAAyB,GACpC,QAAQ,OAAO,EACf,UAAS,uBAA4B,KACpC,uBAGF,CAAC;AAEF,eAAO,MAAM,iCAAiC,GAC5C,QAAQ,OAAO,EACf,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,UAAS,uBAA4B,KACpC,uBAmPF,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChD,CAAC;AAEF,eAAO,MAAM,0BAA0B,GAAI,OAAO;IAChD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,uBAAuB,CAAC;CACnC,KAAG,qBAsBH,CAAC"}

package/dist/scope.d.ts

@@ -1,19 +1,9 @@
 import { Schema } from "effect";
-declare const Scope_base: Schema.Class<Scope, {
-    id: Schema.brand<typeof Schema.String, "ScopeId">;
-    name: typeof Schema.String;
-    createdAt: typeof Schema.DateFromNumber;
-}, Schema.Struct.Encoded<{
-    id: Schema.brand<typeof Schema.String, "ScopeId">;
-    name: typeof Schema.String;
-    createdAt: typeof Schema.DateFromNumber;
-}>, never, {
-    readonly id: string & import("effect/Brand").Brand<"ScopeId">;
-} & {
-    readonly name: string;
-} & {
-    readonly createdAt: Date;
-}, {}, {}>;
+declare const Scope_base: Schema.Class<Scope, Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "ScopeId">;
+    readonly name: Schema.String;
+    readonly createdAt: Schema.Date;
+}>, {}>;
 export declare class Scope extends Scope_base {
 }
 export {};

package/dist/scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;;;;;;;;;;;;;;;;AAIhC,qBAAa,KAAM,SAAQ,UAIzB;CAAG"}
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;;;;;;AAIhC,qBAAa,KAAM,SAAQ,UAIzB;CAAG"}

package/dist/scoped-adapter.d.ts

@@ -0,0 +1,13 @@
+import { type DBAdapter, type DBSchema } from "@executor-js/storage-core";
+export interface ScopeContext {
+    /**
+     * Precedence-ordered list of scope ids the wrapper accepts on reads
+     * and writes. Innermost first. Reads walk every scope in the list
+     * (via `scope_id IN (...)`); writes must name one of them explicitly
+     * via `scope_id` in the payload.
+     */
+    readonly scopes: readonly string[];
+}
+export declare const scopeAdapter: (inner: DBAdapter, ctx: ScopeContext, schema: DBSchema) => DBAdapter;
+export declare const __scopeField = "scope_id";
+//# sourceMappingURL=scoped-adapter.d.ts.map

package/dist/scoped-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-adapter.d.ts","sourceRoot":"","sources":["../src/scoped-adapter.ts"],"names":[],"mappings":"AAuBA,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,QAAQ,EAGd,MAAM,2BAA2B,CAAC;AAInC,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AA0KD,eAAO,MAAM,YAAY,GACvB,OAAO,SAAS,EAChB,KAAK,YAAY,EACjB,QAAQ,QAAQ,KACf,SAiBF,CAAC;AAEF,eAAO,MAAM,YAAY,aAAc,CAAC"}

package/dist/scoped-adapter.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scoped-adapter.test.d.ts.map

package/dist/scoped-adapter.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-adapter.test.d.ts","sourceRoot":"","sources":["../src/scoped-adapter.test.ts"],"names":[],"mappings":""}

package/dist/secret-backed-value.d.ts

@@ -0,0 +1,27 @@
+import { Effect, Schema } from "effect";
+export declare const SecretBackedValue: Schema.Union<readonly [Schema.String, Schema.Struct<{
+    readonly secretId: Schema.String;
+    readonly prefix: Schema.optional<Schema.String>;
+}>]>;
+export type SecretBackedValue = typeof SecretBackedValue.Type;
+export declare const SecretBackedMap: Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+    readonly secretId: Schema.String;
+    readonly prefix: Schema.optional<Schema.String>;
+}>]>>;
+export type SecretBackedMap = typeof SecretBackedMap.Type;
+export declare const isSecretBackedRef: (value: SecretBackedValue) => value is Extract<SecretBackedValue, {
+    readonly secretId: string;
+}>;
+export type ResolveSecretBackedMapOptions<E, E2> = {
+    readonly values: Record<string, SecretBackedValue> | undefined;
+    readonly getSecret: (secretId: string) => Effect.Effect<string | null, E>;
+    readonly onMissing: (name: string, value: Extract<SecretBackedValue, {
+        readonly secretId: string;
+    }>) => E2;
+    readonly onError?: (error: E, name: string, value: Extract<SecretBackedValue, {
+        readonly secretId: string;
+    }>) => E | E2;
+    readonly missing?: "fail" | "drop";
+};
+export declare const resolveSecretBackedMap: <E, E2 = E>({ values, getSecret, onMissing, onError, missing, }: ResolveSecretBackedMapOptions<E, E2>) => Effect.Effect<Record<string, string> | undefined, E | E2>;
+//# sourceMappingURL=secret-backed-value.d.ts.map

package/dist/secret-backed-value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-backed-value.d.ts","sourceRoot":"","sources":["../src/secret-backed-value.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,eAAO,MAAM,iBAAiB;;;IAM5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAC;AAE9D,eAAO,MAAM,eAAe;;;KAAkD,CAAC;AAC/E,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAC;AAE1D,eAAO,MAAM,iBAAiB,GAC5B,OAAO,iBAAiB,KACvB,KAAK,IAAI,OAAO,CAAC,iBAAiB,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAA8B,CAAC;AAEnG,MAAM,MAAM,6BAA6B,CAAC,CAAC,EAAE,EAAE,IAAI;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1E,QAAQ,CAAC,SAAS,EAAE,CAClB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,KAC7D,EAAE,CAAC;IACR,QAAQ,CAAC,OAAO,CAAC,EAAE,CACjB,KAAK,EAAE,CAAC,EACR,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,KAC7D,CAAC,GAAG,EAAE,CAAC;IACZ,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACpC,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,qDAM/C,6BAA6B,CAAC,CAAC,EAAE,EAAE,CAAC,KAAG,MAAM,CAAC,MAAM,CACrD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAClC,CAAC,GAAG,EAAE,CA2BP,CAAC"}

package/dist/secrets.d.ts

@@ -1,118 +1,64 @@
-import { Context, Effect, Schema } from "effect";
-import { SecretId, ScopeId } from "./ids";
-import { SecretNotFoundError, SecretResolutionError } from "./errors";
+import { Effect, Schema } from "effect";
+import type { StorageFailure } from "@executor-js/storage-core";
 export interface SecretProvider {
-    /** Unique key (e.g. "keychain", "env", "1password", "memory") */
+    /** Unique key (e.g. "keychain", "env", "1password", "memory"). */
     readonly key: string;
-    /** Whether this provider supports writing */
+    /** If false, `set` and `delete` are never called. The executor
+     *  honours this before routing writes — trying to write to a
+     *  read-only provider is an error, not a silent drop. */
     readonly writable: boolean;
-    /** Get a secret value by key. Returns null if not found. */
-    readonly get: (key: string) => Effect.Effect<string | null>;
-    /** Set a secret value. Only called on writable providers. */
-    readonly set?: (key: string, value: string) => Effect.Effect<void>;
-    /** Delete a secret. Only called on writable providers. */
-    readonly delete?: (key: string) => Effect.Effect<boolean>;
-    /** List known secret entries. Optional — not all providers can enumerate. */
+    /** Get a secret value. `scope` is the executor scope the lookup is
+     *  being made on behalf of — providers that partition their storage
+     *  by scope (memory, keychain via service name, per-vault in
+     *  1password) use it; providers without tenancy ignore it and fall
+     *  back to a flat lookup. Failures (provider unreachable, decryption
+     *  failed, etc.) surface as `StorageFailure` — the executor treats
+     *  a provider call the same as a DB call; `StorageError` is captured
+     *  at the HTTP edge to `InternalError`, `UniqueViolationError` dies. */
+    readonly get: (id: string, scope: string) => Effect.Effect<string | null, StorageFailure>;
+    /** Check whether a provider has a backing value without returning it.
+     *  Providers that can answer this cheaply should implement it so
+     *  stale core routing rows don't appear as selectable secrets. */
+    readonly has?: (id: string, scope: string) => Effect.Effect<boolean, StorageFailure>;
+    /** Set a secret value at a named scope. Only called on writable
+     *  providers. Providers that partition by scope use this arg to
+     *  decide where to write; flat providers ignore it. */
+    readonly set?: (id: string, value: string, scope: string) => Effect.Effect<void, StorageFailure>;
+    /** Delete a secret at a named scope. Only called on writable providers.
+     *  Returns true if something was deleted. */
+    readonly delete?: (id: string, scope: string) => Effect.Effect<boolean, StorageFailure>;
+    /** Enumerate known secret entries. Optional — not all backends can
+     *  enumerate (env-backed providers, for example). */
     readonly list?: () => Effect.Effect<readonly {
-        id: string;
-        name: string;
-    }[]>;
+        readonly id: string;
+        readonly name: string;
+    }[], StorageFailure>;
 }
-declare const SecretRef_base: Schema.Class<SecretRef, {
-    id: Schema.brand<typeof Schema.String, "SecretId">;
-    scopeId: Schema.brand<typeof Schema.String, "ScopeId">;
+declare const SecretRef_base: Schema.Class<SecretRef, Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "SecretId">;
+    readonly scopeId: Schema.brand<Schema.String, "ScopeId">;
     /** Human-readable label (e.g. "Cloudflare API Token") */
-    name: typeof Schema.String;
-    /** Optional: pin to a specific provider */
-    provider: Schema.optionalWith<typeof Schema.String, {
-        as: "Option";
-    }>;
-    /** What this secret is for */
-    purpose: Schema.optional<typeof Schema.String>;
-    createdAt: typeof Schema.DateFromNumber;
-}, Schema.Struct.Encoded<{
-    id: Schema.brand<typeof Schema.String, "SecretId">;
-    scopeId: Schema.brand<typeof Schema.String, "ScopeId">;
-    /** Human-readable label (e.g. "Cloudflare API Token") */
-    name: typeof Schema.String;
-    /** Optional: pin to a specific provider */
-    provider: Schema.optionalWith<typeof Schema.String, {
-        as: "Option";
-    }>;
-    /** What this secret is for */
-    purpose: Schema.optional<typeof Schema.String>;
-    createdAt: typeof Schema.DateFromNumber;
-}>, never, {
-    readonly id: string & import("effect/Brand").Brand<"SecretId">;
-} & {
-    readonly scopeId: string & import("effect/Brand").Brand<"ScopeId">;
-} & {
-    readonly name: string;
-} & {
-    readonly createdAt: Date;
-} & {
-    readonly provider: import("effect/Option").Option<string>;
-} & {
-    readonly purpose?: string | undefined;
-}, {}, {}>;
+    readonly name: Schema.String;
+    /** Which provider holds the value */
+    readonly provider: Schema.String;
+    readonly createdAt: Schema.Date;
+}>, {}>;
 export declare class SecretRef extends SecretRef_base {
 }
-declare const SetSecretInput_base: Schema.Class<SetSecretInput, {
-    id: Schema.brand<typeof Schema.String, "SecretId">;
-    scopeId: Schema.brand<typeof Schema.String, "ScopeId">;
-    name: typeof Schema.String;
-    value: typeof Schema.String;
-    provider: Schema.optional<typeof Schema.String>;
-    purpose: Schema.optional<typeof Schema.String>;
-}, Schema.Struct.Encoded<{
-    id: Schema.brand<typeof Schema.String, "SecretId">;
-    scopeId: Schema.brand<typeof Schema.String, "ScopeId">;
-    name: typeof Schema.String;
-    value: typeof Schema.String;
-    provider: Schema.optional<typeof Schema.String>;
-    purpose: Schema.optional<typeof Schema.String>;
-}>, never, {
-    readonly value: string;
-} & {
-    readonly id: string & import("effect/Brand").Brand<"SecretId">;
-} & {
-    readonly scopeId: string & import("effect/Brand").Brand<"ScopeId">;
-} & {
-    readonly name: string;
-} & {
-    readonly provider?: string | undefined;
-} & {
-    readonly purpose?: string | undefined;
-}, {}, {}>;
+declare const SetSecretInput_base: Schema.Class<SetSecretInput, Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "SecretId">;
+    /** Scope id to own this secret. Must be one of the executor's
+     *  configured scopes. */
+    readonly scope: Schema.brand<Schema.String, "ScopeId">;
+    /** Display name shown in secret-list UI. */
+    readonly name: Schema.String;
+    /** The secret value itself — never persisted outside the provider. */
+    readonly value: Schema.String;
+    /** Optional provider routing. If unset the executor picks the first
+     *  writable provider in registration order. */
+    readonly provider: Schema.optional<Schema.String>;
+}>, {}>;
 export declare class SetSecretInput extends SetSecretInput_base {
 }
-declare const SecretStore_base: Context.TagClass<SecretStore, "@executor-js/sdk/SecretStore", {
-    /** List all secret refs for a scope */
-    readonly list: (scopeId: ScopeId) => Effect.Effect<readonly SecretRef[]>;
-    /** Get a specific secret ref by id */
-    readonly get: (secretId: SecretId) => Effect.Effect<SecretRef, SecretNotFoundError>;
-    /**
-     * Resolve a secret value by id.
-     * Walks the provider chain (and optionally scope chain) to find the value.
-     */
-    readonly resolve: (secretId: SecretId, scopeId: ScopeId) => Effect.Effect<string, SecretNotFoundError | SecretResolutionError>;
-    /**
-     * Check if a secret can be resolved.
-     */
-    readonly status: (secretId: SecretId, scopeId: ScopeId) => Effect.Effect<"resolved" | "missing">;
-    /**
-     * Store a secret value. Creates a ref and writes the value to the
-     * preferred writable provider.
-     */
-    readonly set: (input: SetSecretInput) => Effect.Effect<SecretRef, SecretResolutionError>;
-    /** Remove a secret ref and its value from the provider */
-    readonly remove: (secretId: SecretId) => Effect.Effect<boolean, SecretNotFoundError>;
-    /** Register a secret provider */
-    readonly addProvider: (provider: SecretProvider) => Effect.Effect<void>;
-    /** List registered provider keys */
-    readonly providers: () => Effect.Effect<readonly string[]>;
-}>;
-export declare class SecretStore extends SecretStore_base {
-}
 export {};
 //# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEjD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAMtE,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5D,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnE,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;CAC9E;;;;IASC,yDAAyD;;IAEzD,2CAA2C;;;;IAE3C,8BAA8B;;;;;;IAJ9B,yDAAyD;;IAEzD,2CAA2C;;;;IAE3C,8BAA8B;;;;;;;;;;;;;;;;AAPhC,qBAAa,SAAU,SAAQ,cAU7B;CAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAML,qBAAa,cAAe,SAAQ,mBAOlC;CAAG;;IASD,uCAAuC;mBACxB,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,SAAS,EAAE,CAAC;IAExE,sCAAsC;kBACxB,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,CAAC;IAEnF;;;OAGG;sBACe,CAChB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,KACb,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,qBAAqB,CAAC;IAEvE;;OAEG;qBACc,CACf,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,KACb,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IAE1C;;;OAGG;kBACW,CAAC,KAAK,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAExF,0DAA0D;qBACzC,CAAC,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAIpF,iCAAiC;0BACX,CAAC,QAAQ,EAAE,cAAc,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;IAEvE,oCAAoC;wBAChB,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,EAAE,CAAC;;AAzC9D,qBAAa,WAAY,SAAQ,gBA2C9B;CAAG"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAehE,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;6DAEyD;IACzD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;;;;4EAOwE;IACxE,QAAQ,CAAC,GAAG,EAAE,CACZ,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,KACV,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,cAAc,CAAC,CAAC;IAClD;;sEAEkE;IAClE,QAAQ,CAAC,GAAG,CAAC,EAAE,CACb,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,KACV,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC5C;;2DAEuD;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,CACb,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,KACV,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACzC;iDAC6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,CAChB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,KACV,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC5C;yDACqD;IACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,CACjC,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,EACzD,cAAc,CACf,CAAC;CACH;;;;IAWC,yDAAyD;;IAEzD,qCAAqC;;;;AALvC,qBAAa,SAAU,SAAQ,cAQ7B;CAAG;;;IAiBH;6BACyB;;IAEzB,4CAA4C;;IAE5C,sEAAsE;;IAEtE;mDAC+C;;;AAZjD,qBAAa,cAAe,SAAQ,mBAclC;CAAG"}

package/dist/testing.d.ts

@@ -1,7 +1,9 @@
 import type { ExecutorConfig } from "./executor";
-import type { ExecutorPlugin } from "./plugin";
-export declare const makeTestConfig: <const TPlugins extends readonly ExecutorPlugin<string, object>[] = []>(options?: {
-    readonly cwd?: string;
+import type { AnyPlugin } from "./plugin";
+import { Scope } from "./scope";
+export declare const makeTestConfig: <const TPlugins extends readonly AnyPlugin[] = []>(options?: {
+    readonly scopeName?: string;
+    readonly scopes?: readonly Scope[];
     readonly plugins?: TPlugins;
 }) => ExecutorConfig<TPlugins>;
 //# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAW/C,eAAO,MAAM,cAAc,GACzB,KAAK,CAAC,QAAQ,SAAS,SAAS,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,EACrE,UAAU;IACV,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC;CAC7B,KAAG,cAAc,CAAC,QAAQ,CAgB1B,CAAC"}
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAGjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAWhC,eAAO,MAAM,cAAc,GACzB,KAAK,CAAC,QAAQ,SAAS,SAAS,SAAS,EAAE,GAAG,EAAE,EAChD,UAAU;IACV,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC;CAC7B,KAAG,cAAc,CAAC,QAAQ,CAsB1B,CAAC"}