@executor-js/sdk 1.5.11 → 1.5.13

package/dist/{chunk-YPVKRUZV.js → chunk-WKKKHDH2.js}

@@ -24,7 +24,7 @@ import {
   isValidPattern,
   resolveEffectivePolicy,
   rowToToolPolicy
-} from "./chunk-UKOTOKXM.js";
+} from "./chunk-6EED5LAL.js";
 import {
   OAUTH2_DEFAULT_TIMEOUT_MS,
   assertSupportedOAuthEndpointUrl,
@@ -496,8 +496,23 @@ var coreTables = defineTables({
     {
       slug: keyColumn("slug"),
       plugin_id: textColumn("plugin_id"),
-      description: textColumn("description"),
+      // Display name. The pre-split field: `description` used to hold the
+      // name, so cloud backfills `name` from it (migration 0006) and other
+      // hosts fall back at read time (see rowToIntegration). Nullable because
+      // SQLite boot-ensure hosts cannot add a NOT NULL column to existing
+      // tables, so the column stays nullable even though it is always present
+      // in practice.
+      name: nullableTextColumn("name"),
+      // Actual prose description, now distinct from the name. Nullable: absent
+      // until a user/spec supplies one (cloud clears the old duplicated title
+      // to NULL in 0006).
+      description: nullableTextColumn("description"),
       config: nullableJsonColumn("config"),
+      // Epoch ms of the last tool-affecting config change (spec update, auth
+      // template edit). Compared against each connection's `tools_synced_at`
+      // so OTHER subjects' connections — whose tool rows the updater cannot
+      // write under the owner policy — lazily rebuild on their next read.
+      config_revised_at: nullableBigintColumn("config_revised_at"),
       can_remove: boolColumn("can_remove", true),
       can_refresh: boolColumn("can_refresh", false),
       created_at: dateColumn("created_at"),
@@ -519,6 +534,12 @@ var coreTables = defineTables({
       provider: textColumn("provider"),
       item_ids: jsonColumn("item_ids"),
       identity_label: nullableTextColumn("identity_label"),
+      // User-curated, agent-visible "what is this connection for". Settable at
+      // create, editable after; never reset by OAuth re-mints.
+      description: nullableTextColumn("description"),
+      // Epoch ms of the last tool (re)production for this connection. Stale
+      // vs the integration's `config_revised_at` → re-produced on next read.
+      tools_synced_at: nullableBigintColumn("tools_synced_at"),
       oauth_client: nullableTextColumn("oauth_client"),
       // The OWNER of `oauth_client` (a Personal connection may be minted through
       // a shared Workspace app), set together with `oauth_client`; null for
@@ -2984,8 +3005,50 @@ var buildToolTypeScriptPreview = async (input) => {
   );
 };
 
+// src/tool-result.ts
+import { Effect as Effect4, Schema } from "effect";
+var ToolErrorSchema = Schema.Struct({
+  code: Schema.String,
+  message: Schema.String,
+  status: Schema.optional(Schema.Number),
+  details: Schema.optional(Schema.Unknown),
+  retryable: Schema.optional(Schema.Boolean)
+});
+var ToolHttpMetaSchema = Schema.Struct({
+  status: Schema.Number,
+  headers: Schema.Record(Schema.String, Schema.String)
+});
+var ToolResult = {
+  ok: (data, meta) => ({
+    ok: true,
+    data,
+    ...meta?.http ? { http: meta.http } : {}
+  }),
+  fail: (error) => ({ ok: false, error })
+};
+var ToolResultSchema = Schema.Union([
+  Schema.Struct({
+    ok: Schema.Literal(true),
+    data: Schema.Unknown,
+    http: Schema.optional(ToolHttpMetaSchema)
+  }),
+  Schema.Struct({ ok: Schema.Literal(false), error: ToolErrorSchema })
+]);
+var isUnknownToolResult = Schema.is(ToolResultSchema);
+var isToolResult = (value) => isUnknownToolResult(value);
+var annotateToolResultOutcome = (value) => {
+  if (isToolResult(value) && !value.ok) {
+    return Effect4.annotateCurrentSpan({
+      "executor.tool.outcome": "fail",
+      "executor.tool.error_code": value.error.code,
+      ...value.error.status != null ? { "executor.tool.error_status": value.error.status } : {}
+    });
+  }
+  return Effect4.annotateCurrentSpan({ "executor.tool.outcome": "ok" });
+};
+
 // src/executor.ts
-import { Effect as Effect7, Option as Option3, Predicate as Predicate3, Schema as Schema4 } from "effect";
+import { Effect as Effect8, Inspectable, Option as Option3, Predicate as Predicate3, Schema as Schema5 } from "effect";
 import { FetchHttpClient as FetchHttpClient3 } from "effect/unstable/http";
 import { fumadb } from "@executor-js/fumadb";
 import { memoryAdapter } from "@executor-js/fumadb/adapters/memory";
@@ -2994,77 +3057,78 @@ import { schema as fumaSchema } from "@executor-js/fumadb/schema";
 import { generateKeyBetween } from "fractional-indexing";
 
 // src/core-tools.ts
-import { Effect as Effect4, Schema } from "effect";
-var schemaToStandard = (schema) => Schema.toStandardSchemaV1(Schema.toStandardJSONSchemaV1(schema));
-var OwnerSchema = Schema.Literals(["org", "user"]);
-var OAuthGrantSchema = Schema.Literals(["authorization_code", "client_credentials"]);
-var IntegrationOutput = Schema.Struct({
-  slug: Schema.String,
-  description: Schema.String,
-  kind: Schema.String,
-  canRemove: Schema.Boolean,
-  canRefresh: Schema.Boolean
+import { Effect as Effect5, Schema as Schema2 } from "effect";
+var schemaToStandard = (schema) => Schema2.toStandardSchemaV1(Schema2.toStandardJSONSchemaV1(schema));
+var OwnerSchema = Schema2.Literals(["org", "user"]);
+var OAuthGrantSchema = Schema2.Literals(["authorization_code", "client_credentials"]);
+var IntegrationOutput = Schema2.Struct({
+  slug: Schema2.String,
+  description: Schema2.String,
+  kind: Schema2.String,
+  canRemove: Schema2.Boolean,
+  canRefresh: Schema2.Boolean
 });
-var IntegrationsListOutput = Schema.Struct({
-  integrations: Schema.Array(IntegrationOutput)
+var IntegrationsListOutput = Schema2.Struct({
+  integrations: Schema2.Array(IntegrationOutput)
 });
-var DetectInput = Schema.Struct({ url: Schema.String });
-var DetectOutput = Schema.Struct({
-  results: Schema.Array(
-    Schema.Struct({
-      kind: Schema.String,
-      confidence: Schema.Literals(["high", "medium", "low"]),
-      endpoint: Schema.String,
-      name: Schema.String,
-      slug: Schema.String
+var DetectInput = Schema2.Struct({ url: Schema2.String });
+var DetectOutput = Schema2.Struct({
+  results: Schema2.Array(
+    Schema2.Struct({
+      kind: Schema2.String,
+      confidence: Schema2.Literals(["high", "medium", "low"]),
+      endpoint: Schema2.String,
+      name: Schema2.String,
+      slug: Schema2.String
     })
   )
 });
-var ConnectionOutput = Schema.Struct({
+var ConnectionOutput = Schema2.Struct({
   owner: OwnerSchema,
-  name: Schema.String,
-  integration: Schema.String,
-  template: Schema.String,
-  provider: Schema.String,
-  address: Schema.String,
-  identityLabel: Schema.optional(Schema.NullOr(Schema.String)),
-  expiresAt: Schema.NullOr(Schema.Number),
-  oauthClient: Schema.NullOr(Schema.String),
-  oauthClientOwner: Schema.NullOr(OwnerSchema),
-  oauthScope: Schema.NullOr(Schema.String)
+  name: Schema2.String,
+  integration: Schema2.String,
+  template: Schema2.String,
+  provider: Schema2.String,
+  address: Schema2.String,
+  identityLabel: Schema2.optional(Schema2.NullOr(Schema2.String)),
+  description: Schema2.optional(Schema2.NullOr(Schema2.String)),
+  expiresAt: Schema2.NullOr(Schema2.Number),
+  oauthClient: Schema2.NullOr(Schema2.String),
+  oauthClientOwner: Schema2.NullOr(OwnerSchema),
+  oauthScope: Schema2.NullOr(Schema2.String)
 });
-var ConnectionsListInput = Schema.Struct({
-  integration: Schema.optional(Schema.String),
-  owner: Schema.optional(OwnerSchema)
+var ConnectionsListInput = Schema2.Struct({
+  integration: Schema2.optional(Schema2.String),
+  owner: Schema2.optional(OwnerSchema)
 });
-var ConnectionsListOutput = Schema.Struct({
-  connections: Schema.Array(ConnectionOutput)
+var ConnectionsListOutput = Schema2.Struct({
+  connections: Schema2.Array(ConnectionOutput)
 });
-var ConnectionCreateHandoffInput = Schema.Struct({
-  integration: Schema.String,
-  owner: Schema.optional(OwnerSchema),
-  template: Schema.optional(Schema.String),
-  label: Schema.optional(Schema.String)
+var ConnectionCreateHandoffInput = Schema2.Struct({
+  integration: Schema2.String,
+  owner: Schema2.optional(OwnerSchema),
+  template: Schema2.optional(Schema2.String),
+  label: Schema2.optional(Schema2.String)
 });
-var ConnectionCreateHandoffOutput = Schema.Struct({
-  url: Schema.String,
-  instructions: Schema.String
+var ConnectionCreateHandoffOutput = Schema2.Struct({
+  url: Schema2.String,
+  instructions: Schema2.String
 });
-var ConnectionFromInput = Schema.Struct({
-  provider: Schema.String,
-  id: Schema.String
+var ConnectionFromInput = Schema2.Struct({
+  provider: Schema2.String,
+  id: Schema2.String
 });
-var ConnectionInputOriginInput = Schema.Struct({ from: ConnectionFromInput });
-var ConnectionCreateInput = Schema.Struct({
+var ConnectionInputOriginInput = Schema2.Struct({ from: ConnectionFromInput });
+var ConnectionCreateInput = Schema2.Struct({
   owner: OwnerSchema,
-  name: Schema.String,
-  integration: Schema.String,
-  template: Schema.String,
-  identityLabel: Schema.optional(Schema.NullOr(Schema.String)),
-  from: Schema.optional(ConnectionFromInput),
-  inputs: Schema.optional(Schema.Record(Schema.String, ConnectionInputOriginInput))
+  name: Schema2.String,
+  integration: Schema2.String,
+  template: Schema2.String,
+  identityLabel: Schema2.optional(Schema2.NullOr(Schema2.String)),
+  from: Schema2.optional(ConnectionFromInput),
+  inputs: Schema2.optional(Schema2.Record(Schema2.String, ConnectionInputOriginInput))
 }).check(
-  Schema.makeFilter((payload) => {
+  Schema2.makeFilter((payload) => {
     const originCount = (payload.from === void 0 ? 0 : 1) + (payload.inputs === void 0 ? 0 : 1);
     if (originCount !== 1) return "Expected exactly one provider credential origin";
     if (payload.inputs !== void 0 && Object.keys(payload.inputs).length === 0) {
@@ -3073,140 +3137,140 @@ var ConnectionCreateInput = Schema.Struct({
     return void 0;
   })
 );
-var ConnectionRefInput = Schema.Struct({
+var ConnectionRefInput = Schema2.Struct({
   owner: OwnerSchema,
-  name: Schema.String,
-  integration: Schema.String
+  name: Schema2.String,
+  integration: Schema2.String
 });
-var ToolOutput = Schema.Struct({
-  address: Schema.String,
+var ToolOutput = Schema2.Struct({
+  address: Schema2.String,
   owner: OwnerSchema,
-  integration: Schema.String,
-  connection: Schema.String,
-  name: Schema.String,
-  pluginId: Schema.String,
-  description: Schema.String
+  integration: Schema2.String,
+  connection: Schema2.String,
+  name: Schema2.String,
+  pluginId: Schema2.String,
+  description: Schema2.String
 });
-var ConnectionsRefreshOutput = Schema.Struct({
-  tools: Schema.Array(ToolOutput)
+var ConnectionsRefreshOutput = Schema2.Struct({
+  tools: Schema2.Array(ToolOutput)
 });
-var RemovedOutput = Schema.Struct({ removed: Schema.Boolean });
-var CancelledOutput = Schema.Struct({ cancelled: Schema.Boolean });
-var ProvidersOutput = Schema.Struct({
-  providers: Schema.Array(Schema.String)
+var RemovedOutput = Schema2.Struct({ removed: Schema2.Boolean });
+var CancelledOutput = Schema2.Struct({ cancelled: Schema2.Boolean });
+var ProvidersOutput = Schema2.Struct({
+  providers: Schema2.Array(Schema2.String)
 });
-var ProviderItemsInput = Schema.Struct({ provider: Schema.String });
-var ProviderItemsOutput = Schema.Struct({
-  items: Schema.Array(Schema.Struct({ id: Schema.String, name: Schema.String }))
+var ProviderItemsInput = Schema2.Struct({ provider: Schema2.String });
+var ProviderItemsOutput = Schema2.Struct({
+  items: Schema2.Array(Schema2.Struct({ id: Schema2.String, name: Schema2.String }))
 });
-var PolicyOutput = Schema.Struct({
-  id: Schema.String,
+var PolicyOutput = Schema2.Struct({
+  id: Schema2.String,
   owner: OwnerSchema,
-  pattern: Schema.String,
-  action: Schema.String,
-  position: Schema.String
+  pattern: Schema2.String,
+  action: Schema2.String,
+  position: Schema2.String
 });
-var PoliciesListOutput = Schema.Struct({
-  policies: Schema.Array(PolicyOutput)
+var PoliciesListOutput = Schema2.Struct({
+  policies: Schema2.Array(PolicyOutput)
 });
-var PolicyCreateInput = Schema.Struct({
+var PolicyCreateInput = Schema2.Struct({
   owner: OwnerSchema,
-  pattern: Schema.String,
+  pattern: Schema2.String,
   action: ToolPolicyActionSchema
 });
-var PolicyUpdateInput = Schema.Struct({
-  id: Schema.String,
+var PolicyUpdateInput = Schema2.Struct({
+  id: Schema2.String,
   owner: OwnerSchema,
-  pattern: Schema.optional(Schema.String),
-  action: Schema.optional(ToolPolicyActionSchema)
+  pattern: Schema2.optional(Schema2.String),
+  action: Schema2.optional(ToolPolicyActionSchema)
 });
-var PolicyRemoveInput = Schema.Struct({
-  id: Schema.String,
+var PolicyRemoveInput = Schema2.Struct({
+  id: Schema2.String,
   owner: OwnerSchema
 });
-var OAuthClientOutput = Schema.Struct({
+var OAuthClientOutput = Schema2.Struct({
   owner: OwnerSchema,
-  slug: Schema.String,
+  slug: Schema2.String,
   grant: OAuthGrantSchema,
-  authorizationUrl: Schema.String,
-  tokenUrl: Schema.String,
-  resource: Schema.optional(Schema.NullOr(Schema.String)),
-  clientId: Schema.String,
-  origin: Schema.Union([
-    Schema.Struct({ kind: Schema.Literal("manual") }),
-    Schema.Struct({
-      kind: Schema.Literal("dynamic_client_registration"),
-      integration: Schema.optional(Schema.NullOr(Schema.String))
+  authorizationUrl: Schema2.String,
+  tokenUrl: Schema2.String,
+  resource: Schema2.optional(Schema2.NullOr(Schema2.String)),
+  clientId: Schema2.String,
+  origin: Schema2.Union([
+    Schema2.Struct({ kind: Schema2.Literal("manual") }),
+    Schema2.Struct({
+      kind: Schema2.Literal("dynamic_client_registration"),
+      integration: Schema2.optional(Schema2.NullOr(Schema2.String))
     })
   ])
 });
-var OAuthClientsListOutput = Schema.Struct({
-  clients: Schema.Array(OAuthClientOutput)
+var OAuthClientsListOutput = Schema2.Struct({
+  clients: Schema2.Array(OAuthClientOutput)
 });
-var OAuthCreateClientInput = Schema.Struct({
+var OAuthCreateClientInput = Schema2.Struct({
   owner: OwnerSchema,
-  slug: Schema.String,
-  authorizationUrl: Schema.String,
-  tokenUrl: Schema.String,
+  slug: Schema2.String,
+  authorizationUrl: Schema2.String,
+  tokenUrl: Schema2.String,
   grant: OAuthGrantSchema,
-  clientId: Schema.String,
-  clientSecret: Schema.String,
-  resource: Schema.optional(Schema.NullOr(Schema.String))
+  clientId: Schema2.String,
+  clientSecret: Schema2.String,
+  resource: Schema2.optional(Schema2.NullOr(Schema2.String))
 });
-var OAuthClientOutputRef = Schema.Struct({
-  client: Schema.String
+var OAuthClientOutputRef = Schema2.Struct({
+  client: Schema2.String
 });
-var OAuthRegisterDynamicInput = Schema.Struct({
+var OAuthRegisterDynamicInput = Schema2.Struct({
   owner: OwnerSchema,
-  slug: Schema.String,
-  registrationEndpoint: Schema.String,
-  authorizationUrl: Schema.String,
-  tokenUrl: Schema.String,
-  resource: Schema.optional(Schema.NullOr(Schema.String)),
-  scopes: Schema.Array(Schema.String),
-  tokenEndpointAuthMethodsSupported: Schema.optional(Schema.Array(Schema.String)),
-  clientName: Schema.optional(Schema.String),
-  redirectUri: Schema.optional(Schema.NullOr(Schema.String)),
-  originIntegration: Schema.optional(Schema.NullOr(Schema.String))
+  slug: Schema2.String,
+  registrationEndpoint: Schema2.String,
+  authorizationUrl: Schema2.String,
+  tokenUrl: Schema2.String,
+  resource: Schema2.optional(Schema2.NullOr(Schema2.String)),
+  scopes: Schema2.Array(Schema2.String),
+  tokenEndpointAuthMethodsSupported: Schema2.optional(Schema2.Array(Schema2.String)),
+  clientName: Schema2.optional(Schema2.String),
+  redirectUri: Schema2.optional(Schema2.NullOr(Schema2.String)),
+  originIntegration: Schema2.optional(Schema2.NullOr(Schema2.String))
 });
-var OAuthRemoveClientInput = Schema.Struct({
+var OAuthRemoveClientInput = Schema2.Struct({
   owner: OwnerSchema,
-  slug: Schema.String
+  slug: Schema2.String
 });
-var OAuthProbeInput = Schema.Struct({
-  url: Schema.String
+var OAuthProbeInput = Schema2.Struct({
+  url: Schema2.String
 });
-var OAuthProbeOutput = Schema.Struct({
-  authorizationUrl: Schema.String,
-  tokenUrl: Schema.String,
-  resource: Schema.optional(Schema.NullOr(Schema.String)),
-  scopesSupported: Schema.optional(Schema.Array(Schema.String)),
-  registrationEndpoint: Schema.optional(Schema.NullOr(Schema.String)),
-  tokenEndpointAuthMethodsSupported: Schema.optional(Schema.Array(Schema.String))
+var OAuthProbeOutput = Schema2.Struct({
+  authorizationUrl: Schema2.String,
+  tokenUrl: Schema2.String,
+  resource: Schema2.optional(Schema2.NullOr(Schema2.String)),
+  scopesSupported: Schema2.optional(Schema2.Array(Schema2.String)),
+  registrationEndpoint: Schema2.optional(Schema2.NullOr(Schema2.String)),
+  tokenEndpointAuthMethodsSupported: Schema2.optional(Schema2.Array(Schema2.String))
 });
-var OAuthStartInput = Schema.Struct({
-  client: Schema.String,
+var OAuthStartInput = Schema2.Struct({
+  client: Schema2.String,
   clientOwner: OwnerSchema,
   owner: OwnerSchema,
-  name: Schema.String,
-  integration: Schema.String,
-  template: Schema.String,
-  identityLabel: Schema.optional(Schema.NullOr(Schema.String)),
-  redirectUri: Schema.optional(Schema.NullOr(Schema.String))
+  name: Schema2.String,
+  integration: Schema2.String,
+  template: Schema2.String,
+  identityLabel: Schema2.optional(Schema2.NullOr(Schema2.String)),
+  redirectUri: Schema2.optional(Schema2.NullOr(Schema2.String))
 });
-var OAuthStartOutput = Schema.Union([
-  Schema.Struct({
-    status: Schema.Literal("connected"),
+var OAuthStartOutput = Schema2.Union([
+  Schema2.Struct({
+    status: Schema2.Literal("connected"),
     connection: ConnectionOutput
   }),
-  Schema.Struct({
-    status: Schema.Literal("redirect"),
-    authorizationUrl: Schema.String,
-    state: Schema.String
+  Schema2.Struct({
+    status: Schema2.Literal("redirect"),
+    authorizationUrl: Schema2.String,
+    state: Schema2.String
   })
 ]);
-var OAuthCancelInput = Schema.Struct({
-  state: Schema.String
+var OAuthCancelInput = Schema2.Struct({
+  state: Schema2.String
 });
 var IntegrationsListOutputStd = schemaToStandard(IntegrationsListOutput);
 var DetectInputStd = schemaToStandard(DetectInput);
@@ -3247,6 +3311,7 @@ var connectionToOutput = (connection) => ({
   provider: String(connection.provider),
   address: String(connection.address),
   identityLabel: connection.identityLabel ?? null,
+  description: connection.description ?? null,
   expiresAt: connection.expiresAt ?? null,
   oauthClient: connection.oauthClient == null ? null : String(connection.oauthClient),
   oauthClientOwner: connection.oauthClientOwner ?? null,
@@ -3323,7 +3388,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           name: "integrations.list",
           description: "List integrations in the workspace catalog (slug, description, owning plugin kind). Connections authenticate against these.",
           outputSchema: IntegrationsListOutputStd,
-          execute: (_args, { ctx }) => Effect4.map(ctx.core.integrations.list(), (integrations) => ({
+          execute: (_args, { ctx }) => Effect5.map(ctx.core.integrations.list(), (integrations) => ({
             integrations: integrations.map((i) => ({
               slug: String(i.slug),
               description: i.description,
@@ -3338,7 +3403,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Given a URL, ask every plugin whether it recognizes it, returning best-confidence matches so the UI can pre-fill onboarding for the right plugin.",
           inputSchema: DetectInputStd,
           outputSchema: DetectOutputStd,
-          execute: (input, { ctx }) => Effect4.map(ctx.core.integrations.detect(input.url), (results) => ({
+          execute: (input, { ctx }) => Effect5.map(ctx.core.integrations.detect(input.url), (results) => ({
             results: results.map((r) => ({
               kind: r.kind,
               confidence: r.confidence,
@@ -3353,7 +3418,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "List saved connections (the credential for one integration). Never returns the credential value. Optionally filter by integration or owner.",
           inputSchema: ConnectionsListInputStd,
           outputSchema: ConnectionsListOutputStd,
-          execute: (input, { ctx }) => Effect4.map(
+          execute: (input, { ctx }) => Effect5.map(
             ctx.connections.list({
               integration: input.integration === void 0 ? void 0 : IntegrationSlug.make(input.integration),
               owner: input.owner === void 0 ? void 0 : input.owner
@@ -3368,7 +3433,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Low-level create or replace for a saved connection from provider item references. For normal API keys/tokens, use `connections.createHandoff` so the user enters the credential in the web UI. OAuth credentials should use `oauth.start`.",
           inputSchema: ConnectionCreateInputStd,
           outputSchema: ConnectionOutputStd,
-          execute: (input, { ctx }) => Effect4.map(
+          execute: (input, { ctx }) => Effect5.map(
             ctx.connections.create(createConnectionInputFromTool(input)),
             connectionToOutput
           )
@@ -3380,7 +3445,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           outputSchema: ConnectionCreateHandoffOutputStd,
           execute: (input) => {
             const url = connectionCreateHandoffUrl(options.webBaseUrl, input);
-            return Effect4.succeed({
+            return Effect5.succeed({
               url,
               instructions: "Ask the user to open this URL and add the account in the Executor web UI. Do not ask them to paste the credential value into chat. After they finish, call connections.list for the integration to discover the created connection."
             });
@@ -3391,7 +3456,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Remove a saved connection and its produced tools by owner, integration, and connection name.",
           inputSchema: ConnectionRefInputStd,
           outputSchema: RemovedOutputStd,
-          execute: (input, { ctx }) => Effect4.map(ctx.connections.remove(connectionRefFromInput(input)), () => ({
+          execute: (input, { ctx }) => Effect5.map(ctx.connections.remove(connectionRefFromInput(input)), () => ({
             removed: true
           }))
         }),
@@ -3400,7 +3465,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Re-run an integration's tool production for a saved connection, replacing that connection's persisted tools.",
           inputSchema: ConnectionRefInputStd,
           outputSchema: ConnectionsRefreshOutputStd,
-          execute: (input, { ctx }) => Effect4.map(ctx.connections.refresh(connectionRefFromInput(input)), (tools) => ({
+          execute: (input, { ctx }) => Effect5.map(ctx.connections.refresh(connectionRefFromInput(input)), (tools) => ({
             tools: tools.map(toolToOutput)
           }))
         }),
@@ -3411,7 +3476,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
             name: "providers.list",
             description: "List registered credential provider keys (the storage backends, not API vendors). Use `providers.items` to browse a backend's entries.",
             outputSchema: ProvidersOutputStd,
-            execute: (_args, { ctx }) => Effect4.map(ctx.providers.list(), (providers) => ({
+            execute: (_args, { ctx }) => Effect5.map(ctx.providers.list(), (providers) => ({
               providers: providers.map((p) => String(p))
             }))
           }),
@@ -3420,7 +3485,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
             description: "Browse a credential provider's items for discovery (pick a 1Password / keychain entry). Returns opaque ids and labels, never values.",
             inputSchema: ProviderItemsInputStd,
             outputSchema: ProviderItemsOutputStd,
-            execute: (input, { ctx }) => Effect4.map(ctx.providers.items(ProviderKey.make(input.provider)), (items) => ({
+            execute: (input, { ctx }) => Effect5.map(ctx.providers.items(ProviderKey.make(input.provider)), (items) => ({
               items: items.map((i) => ({ id: String(i.id), name: i.name }))
             }))
           })
@@ -3429,7 +3494,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           name: "oauth.clients.list",
           description: "List registered OAuth clients visible to this executor. Returns metadata only; client secrets are never returned.",
           outputSchema: OAuthClientsListOutputStd,
-          execute: (_args, { ctx }) => Effect4.map(ctx.oauth.listClients(), (clients) => ({
+          execute: (_args, { ctx }) => Effect5.map(ctx.oauth.listClients(), (clients) => ({
             clients: clients.map((client) => ({
               owner: client.owner,
               slug: String(client.slug),
@@ -3446,7 +3511,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Register or replace an owner-scoped OAuth client from explicit client credentials. Use grant `client_credentials` for machine OAuth or `authorization_code` for browser consent flows.",
           inputSchema: OAuthCreateClientInputStd,
           outputSchema: OAuthClientOutputRefStd,
-          execute: (input, { ctx }) => Effect4.map(
+          execute: (input, { ctx }) => Effect5.map(
             ctx.oauth.createClient({
               owner: input.owner,
               slug: OAuthClientSlug.make(input.slug),
@@ -3465,7 +3530,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Register an OAuth client through RFC 7591 Dynamic Client Registration and save the minted client for later `oauth.start` calls.",
           inputSchema: OAuthRegisterDynamicInputStd,
           outputSchema: OAuthClientOutputRefStd,
-          execute: (input, { ctx }) => Effect4.map(
+          execute: (input, { ctx }) => Effect5.map(
             ctx.oauth.registerDynamicClient({
               owner: input.owner,
               slug: OAuthClientSlug.make(input.slug),
@@ -3487,7 +3552,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Remove an owner-scoped OAuth client by owner and slug. Existing connections are not cascaded.",
           inputSchema: OAuthRemoveClientInputStd,
           outputSchema: RemovedOutputStd,
-          execute: (input, { ctx }) => Effect4.map(
+          execute: (input, { ctx }) => Effect5.map(
             ctx.oauth.removeClient(input.owner, OAuthClientSlug.make(input.slug)),
             () => ({ removed: true })
           )
@@ -3497,7 +3562,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Discover OAuth authorization-server metadata from an issuer or protected-resource URL so client registration can be pre-filled.",
           inputSchema: OAuthProbeInputStd,
           outputSchema: OAuthProbeOutputStd,
-          execute: (input, { ctx }) => Effect4.map(ctx.oauth.probe({ url: input.url }), (result) => ({
+          execute: (input, { ctx }) => Effect5.map(ctx.oauth.probe({ url: input.url }), (result) => ({
             authorizationUrl: result.authorizationUrl,
             tokenUrl: result.tokenUrl,
             resource: result.resource ?? null,
@@ -3511,7 +3576,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Start OAuth through a registered client to mint a connection for an integration. `client_credentials` clients return `connected`; authorization-code clients return an authorization URL and state.",
           inputSchema: OAuthStartInputStd,
           outputSchema: OAuthStartOutputStd,
-          execute: (input, { ctx }) => Effect4.map(
+          execute: (input, { ctx }) => Effect5.map(
             ctx.oauth.start({
               client: OAuthClientSlug.make(input.client),
               clientOwner: input.clientOwner,
@@ -3537,13 +3602,13 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Cancel an in-flight OAuth authorization-code session by state after the user abandons the flow.",
           inputSchema: OAuthCancelInputStd,
           outputSchema: CancelledOutputStd,
-          execute: (input, { ctx }) => Effect4.map(ctx.oauth.cancel(OAuthState.make(input.state)), () => ({ cancelled: true }))
+          execute: (input, { ctx }) => Effect5.map(ctx.oauth.cancel(OAuthState.make(input.state)), () => ({ cancelled: true }))
         }),
         tool({
           name: "policies.list",
           description: "List tool policies (approve / require_approval / block) for org and user owners, in evaluation order.",
           outputSchema: PoliciesListOutputStd,
-          execute: (_args, { ctx }) => Effect4.map(ctx.core.policies.list(), (policies) => ({
+          execute: (_args, { ctx }) => Effect5.map(ctx.core.policies.list(), (policies) => ({
             policies: policies.map((p) => ({
               id: String(p.id),
               owner: p.owner,
@@ -3558,7 +3623,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Create a tool policy. `pattern` matches a tool address tail (`integration.connection.tool`, `integration.*`, `*`); `action` is approve/require_approval/block. `owner` is org (workspace guardrail) or user (personal).",
           inputSchema: PolicyCreateInputStd,
           outputSchema: PolicyOutputStd,
-          execute: (input, { ctx }) => Effect4.map(
+          execute: (input, { ctx }) => Effect5.map(
             ctx.core.policies.create({
               owner: input.owner,
               pattern: input.pattern,
@@ -3578,7 +3643,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Update a tool policy's pattern and/or action by id + owner.",
           inputSchema: PolicyUpdateInputStd,
           outputSchema: PolicyOutputStd,
-          execute: (input, { ctx }) => Effect4.map(
+          execute: (input, { ctx }) => Effect5.map(
             ctx.core.policies.update({
               id: input.id,
               owner: input.owner,
@@ -3599,7 +3664,7 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
           description: "Remove a tool policy by id + owner.",
           inputSchema: PolicyRemoveInputStd,
           outputSchema: RemovedOutputStd,
-          execute: (input, { ctx }) => Effect4.map(
+          execute: (input, { ctx }) => Effect5.map(
             ctx.core.policies.remove({
               id: input.id,
               owner: input.owner
@@ -3613,67 +3678,67 @@ var coreToolsPlugin = definePlugin((options = {}) => ({
 }));
 
 // src/oauth-service.ts
-import { Effect as Effect6, Option as Option2, Schema as Schema3 } from "effect";
+import { Effect as Effect7, Option as Option2, Schema as Schema4 } from "effect";
 import { FetchHttpClient as FetchHttpClient2 } from "effect/unstable/http";
 
 // src/oauth-discovery.ts
-import { Data as Data2, Duration, Effect as Effect5, Option, Predicate as Predicate2, Result, Schema as Schema2 } from "effect";
+import { Data as Data2, Duration, Effect as Effect6, Option, Predicate as Predicate2, Result, Schema as Schema3 } from "effect";
 import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http";
 var OAuthDiscoveryError = class extends Data2.TaggedError("OAuthDiscoveryError") {
 };
-var StringArray = Schema2.Array(Schema2.String);
-var OAuthProtectedResourceMetadataSchema = Schema2.Struct({
-  resource: Schema2.optional(Schema2.String),
-  authorization_servers: Schema2.optional(StringArray),
-  scopes_supported: Schema2.optional(StringArray),
-  bearer_methods_supported: Schema2.optional(StringArray),
-  resource_documentation: Schema2.optional(Schema2.String)
+var StringArray = Schema3.Array(Schema3.String);
+var OAuthProtectedResourceMetadataSchema = Schema3.Struct({
+  resource: Schema3.optional(Schema3.String),
+  authorization_servers: Schema3.optional(StringArray),
+  scopes_supported: Schema3.optional(StringArray),
+  bearer_methods_supported: Schema3.optional(StringArray),
+  resource_documentation: Schema3.optional(Schema3.String)
 }).annotate({ identifier: "OAuthProtectedResourceMetadata" });
-var OAuthAuthorizationServerMetadataSchema = Schema2.Struct({
-  issuer: Schema2.String,
-  authorization_endpoint: Schema2.String,
-  token_endpoint: Schema2.String,
-  registration_endpoint: Schema2.optional(Schema2.String),
-  scopes_supported: Schema2.optional(StringArray),
-  response_types_supported: Schema2.optional(StringArray),
-  grant_types_supported: Schema2.optional(StringArray),
-  code_challenge_methods_supported: Schema2.optional(StringArray),
-  token_endpoint_auth_methods_supported: Schema2.optional(StringArray),
-  revocation_endpoint: Schema2.optional(Schema2.String),
-  introspection_endpoint: Schema2.optional(Schema2.String),
-  userinfo_endpoint: Schema2.optional(Schema2.String),
-  id_token_signing_alg_values_supported: Schema2.optional(StringArray)
+var OAuthAuthorizationServerMetadataSchema = Schema3.Struct({
+  issuer: Schema3.String,
+  authorization_endpoint: Schema3.String,
+  token_endpoint: Schema3.String,
+  registration_endpoint: Schema3.optional(Schema3.String),
+  scopes_supported: Schema3.optional(StringArray),
+  response_types_supported: Schema3.optional(StringArray),
+  grant_types_supported: Schema3.optional(StringArray),
+  code_challenge_methods_supported: Schema3.optional(StringArray),
+  token_endpoint_auth_methods_supported: Schema3.optional(StringArray),
+  revocation_endpoint: Schema3.optional(Schema3.String),
+  introspection_endpoint: Schema3.optional(Schema3.String),
+  userinfo_endpoint: Schema3.optional(Schema3.String),
+  id_token_signing_alg_values_supported: Schema3.optional(StringArray)
 }).annotate({ identifier: "OAuthAuthorizationServerMetadata" });
-var OAuthClientInformationSchema = Schema2.Struct({
-  client_id: Schema2.String,
-  client_secret: Schema2.optional(Schema2.String),
-  client_id_issued_at: Schema2.optional(Schema2.Number),
-  client_secret_expires_at: Schema2.optional(Schema2.Number),
-  registration_access_token: Schema2.optional(Schema2.String),
-  registration_client_uri: Schema2.optional(Schema2.String),
-  token_endpoint_auth_method: Schema2.optional(Schema2.String),
-  grant_types: Schema2.optional(StringArray),
-  response_types: Schema2.optional(StringArray),
-  redirect_uris: Schema2.optional(StringArray),
-  client_name: Schema2.optional(Schema2.String),
-  scope: Schema2.optional(Schema2.String)
+var OAuthClientInformationSchema = Schema3.Struct({
+  client_id: Schema3.String,
+  client_secret: Schema3.optional(Schema3.String),
+  client_id_issued_at: Schema3.optional(Schema3.Number),
+  client_secret_expires_at: Schema3.optional(Schema3.Number),
+  registration_access_token: Schema3.optional(Schema3.String),
+  registration_client_uri: Schema3.optional(Schema3.String),
+  token_endpoint_auth_method: Schema3.optional(Schema3.String),
+  grant_types: Schema3.optional(StringArray),
+  response_types: Schema3.optional(StringArray),
+  redirect_uris: Schema3.optional(StringArray),
+  client_name: Schema3.optional(Schema3.String),
+  scope: Schema3.optional(Schema3.String)
 }).annotate({ identifier: "OAuthClientInformation" });
-var decodeResourceMetadataJson = Schema2.decodeUnknownEffect(
-  Schema2.fromJsonString(OAuthProtectedResourceMetadataSchema)
+var decodeResourceMetadataJson = Schema3.decodeUnknownEffect(
+  Schema3.fromJsonString(OAuthProtectedResourceMetadataSchema)
 );
-var decodeAuthServerMetadata = Schema2.decodeUnknownEffect(OAuthAuthorizationServerMetadataSchema);
-var decodeClientInformationJson = Schema2.decodeUnknownEffect(
-  Schema2.fromJsonString(OAuthClientInformationSchema)
+var decodeAuthServerMetadata = Schema3.decodeUnknownEffect(OAuthAuthorizationServerMetadataSchema);
+var decodeClientInformationJson = Schema3.decodeUnknownEffect(
+  Schema3.fromJsonString(OAuthClientInformationSchema)
 );
 var MCP_PROTOCOL_VERSION_HEADER = "mcp-protocol-version";
-var validateEndpointUrl = (value, label, policy = {}) => Effect5.try({
+var validateEndpointUrl = (value, label, policy = {}) => Effect6.try({
   try: () => assertSupportedOAuthEndpointUrl(value, label, policy),
   catch: (cause) => new OAuthDiscoveryError({
     message: `${label} must use https: or loopback http:`,
     cause
   })
 });
-var validateAuthorizationServerMetadata = (metadata, policy = {}) => Effect5.gen(function* () {
+var validateAuthorizationServerMetadata = (metadata, policy = {}) => Effect6.gen(function* () {
   yield* validateEndpointUrl(metadata.issuer, "issuer", policy);
   yield* validateEndpointUrl(metadata.authorization_endpoint, "authorization_endpoint", policy);
   yield* validateEndpointUrl(metadata.token_endpoint, "token_endpoint", policy);
@@ -3681,21 +3746,21 @@ var validateAuthorizationServerMetadata = (metadata, policy = {}) => Effect5.gen
     yield* validateEndpointUrl(metadata.registration_endpoint, "registration_endpoint", policy);
   }
 });
-var provideHttpClient = (effect, options) => effect.pipe(Effect5.provide(options.httpClientLayer ?? FetchHttpClient.layer));
+var provideHttpClient = (effect, options) => effect.pipe(Effect6.provide(options.httpClientLayer ?? FetchHttpClient.layer));
 var executeText = (request, options, errorMessage) => provideHttpClient(
-  Effect5.gen(function* () {
+  Effect6.gen(function* () {
     const client = yield* HttpClient.HttpClient;
     const response = yield* client.execute(request).pipe(
-      Effect5.timeoutOrElse({
+      Effect6.timeoutOrElse({
         duration: Duration.millis(options.timeoutMs ?? OAUTH2_DEFAULT_TIMEOUT_MS),
-        orElse: () => Effect5.fail(
+        orElse: () => Effect6.fail(
           new OAuthDiscoveryError({
             message: errorMessage,
             cause: "timeout"
           })
         )
       }),
-      Effect5.mapError(
+      Effect6.mapError(
         (cause) => Predicate2.isTagged(cause, "OAuthDiscoveryError") ? cause : new OAuthDiscoveryError({
           message: errorMessage,
           cause
@@ -3703,8 +3768,8 @@ var executeText = (request, options, errorMessage) => provideHttpClient(
       )
     );
     const body = yield* response.text.pipe(
-      Effect5.catch(() => Effect5.succeed("")),
-      Effect5.mapError(
+      Effect6.catch(() => Effect6.succeed("")),
+      Effect6.mapError(
         (cause) => new OAuthDiscoveryError({
           message: `${errorMessage}: response body could not be read`,
           status: response.status,
@@ -3735,7 +3800,7 @@ var withResourceQueryParams = (url, queryParams) => {
   }
   return parsed.toString();
 };
-var discoverProtectedResourceMetadata = (resourceUrl, options = {}) => Effect5.gen(function* () {
+var discoverProtectedResourceMetadata = (resourceUrl, options = {}) => Effect6.gen(function* () {
   for (const url of buildResourceMetadataUrls(resourceUrl)) {
     const requestUrl = withResourceQueryParams(url, options.resourceQueryParams);
     let request = HttpClientRequest.get(requestUrl).pipe(
@@ -3764,7 +3829,7 @@ var discoverProtectedResourceMetadata = (resourceUrl, options = {}) => Effect5.g
       });
     }
     const metadata = yield* decodeResourceMetadataJson(result.body).pipe(
-      Effect5.mapError(
+      Effect6.mapError(
         (err) => new OAuthDiscoveryError({
           message: "Protected resource metadata is malformed",
           cause: err
@@ -3779,7 +3844,7 @@ var wellKnownUrlFor = (issuerOrigin, algorithm, issuerPath) => {
   const suffix = algorithm === "oauth2" ? "oauth-authorization-server" : "openid-configuration";
   return issuerPath && issuerPath !== "/" ? `${issuerOrigin}/.well-known/${suffix}${issuerPath}` : `${issuerOrigin}/.well-known/${suffix}`;
 };
-var discoverAuthorizationServerMetadata = (issuer, options = {}) => Effect5.gen(function* () {
+var discoverAuthorizationServerMetadata = (issuer, options = {}) => Effect6.gen(function* () {
   yield* validateEndpointUrl(issuer, "issuer", options.endpointUrlPolicy);
   const issuerUrl = new URL(issuer);
   const issuerOrigin = `${issuerUrl.protocol}//${issuerUrl.host}`;
@@ -3801,22 +3866,22 @@ var discoverAuthorizationServerMetadata = (issuer, options = {}) => Effect5.gen(
       options,
       `Discovery (${algorithm}) failed for ${issuer}`
     ).pipe(
-      Effect5.map((response2) => {
+      Effect6.map((response2) => {
         if (response2.status === 404 || response2.status === 405) return null;
         return response2;
       }),
       // If one algorithm fails mid-roundtrip (network, parse, issuer
       // mismatch) we still want to try the other before giving up.
-      Effect5.result
+      Effect6.result
     );
     if (Result.isFailure(result)) continue;
     const response = result.success;
     if (response === null) continue;
     if (response.status < 200 || response.status >= 300) continue;
-    const raw = yield* Schema2.decodeUnknownEffect(Schema2.fromJsonString(Schema2.Unknown))(
+    const raw = yield* Schema3.decodeUnknownEffect(Schema3.fromJsonString(Schema3.Unknown))(
       response.body
     ).pipe(
-      Effect5.mapError(
+      Effect6.mapError(
         (err) => new OAuthDiscoveryError({
           message: "Authorization server metadata is malformed",
           cause: err
@@ -3824,7 +3889,7 @@ var discoverAuthorizationServerMetadata = (issuer, options = {}) => Effect5.gen(
       )
     );
     const metadata = yield* decodeAuthServerMetadata(raw).pipe(
-      Effect5.mapError(
+      Effect6.mapError(
         (err) => new OAuthDiscoveryError({
           message: "Authorization server metadata is malformed",
           cause: err
@@ -3840,11 +3905,11 @@ var DcrErrorBody = class extends Data2.TaggedError("DcrErrorBody") {
 };
 var DcrTransport = class extends Data2.TaggedError("DcrTransport") {
 };
-var DcrErrorBodyJson = Schema2.Struct({
-  error: Schema2.String,
-  error_description: Schema2.optional(Schema2.String)
+var DcrErrorBodyJson = Schema3.Struct({
+  error: Schema3.String,
+  error_description: Schema3.optional(Schema3.String)
 });
-var decodeDcrErrorBodyJson = Schema2.decodeUnknownOption(Schema2.fromJsonString(DcrErrorBodyJson));
+var decodeDcrErrorBodyJson = Schema3.decodeUnknownOption(Schema3.fromJsonString(DcrErrorBodyJson));
 var buildDcrBody = (m) => {
   const body = { redirect_uris: [...m.redirect_uris] };
   if (m.client_name !== void 0) body.client_name = m.client_name;
@@ -3886,13 +3951,13 @@ var interpretDcrFailure = (status, text) => {
     status
   });
 };
-var registerDynamicClient = (input, options = {}) => Effect5.gen(function* () {
+var registerDynamicClient = (input, options = {}) => Effect6.gen(function* () {
   yield* validateEndpointUrl(
     input.registrationEndpoint,
     "registration_endpoint",
     options.endpointUrlPolicy
   ).pipe(
-    Effect5.mapError(
+    Effect6.mapError(
       (cause) => new DcrTransport({
         detail: "registration_endpoint must use https: or loopback http:",
         cause
@@ -3917,7 +3982,7 @@ var registerDynamicClient = (input, options = {}) => Effect5.gen(function* () {
     options,
     "Dynamic Client Registration request failed"
   ).pipe(
-    Effect5.mapError(
+    Effect6.mapError(
       (cause) => new DcrTransport({
         detail: "Dynamic Client Registration request failed",
         cause
@@ -3928,7 +3993,7 @@ var registerDynamicClient = (input, options = {}) => Effect5.gen(function* () {
     return yield* interpretDcrFailure(response.status, response.body);
   }
   return yield* decodeClientInformationJson(response.body).pipe(
-    Effect5.mapError(
+    Effect6.mapError(
       (err) => new OAuthDiscoveryError({
         message: "Dynamic Client Registration response is malformed",
         cause: err
@@ -3936,8 +4001,8 @@ var registerDynamicClient = (input, options = {}) => Effect5.gen(function* () {
     )
   );
 }).pipe(
-  Effect5.catchTags({
-    DcrErrorBody: (err) => Effect5.fail(
+  Effect6.catchTags({
+    DcrErrorBody: (err) => Effect6.fail(
       new OAuthDiscoveryError({
         message: `Dynamic Client Registration failed: ${err.error}${err.error_description ? ` \u2014 ${err.error_description}` : ""}`,
         status: err.status,
@@ -3946,7 +4011,7 @@ var registerDynamicClient = (input, options = {}) => Effect5.gen(function* () {
         cause: err
       })
     ),
-    DcrTransport: (err) => Effect5.fail(
+    DcrTransport: (err) => Effect6.fail(
       new OAuthDiscoveryError({
         message: `Dynamic Client Registration failed: ${err.detail}`,
         status: err.status,
@@ -3961,7 +4026,7 @@ var looseDb = (db) => db;
 var accessItemId = (owner, integration, name) => `oauth:${owner}:${integration}:${name}`;
 var refreshItemIdFor = (accessId) => `${accessId}:refresh`;
 var dedupeScopes = (scopes) => [...new Set(scopes)];
-var decodeJsonPayload = Schema3.decodeUnknownOption(Schema3.UnknownFromJsonString);
+var decodeJsonPayload = Schema4.decodeUnknownOption(Schema4.UnknownFromJsonString);
 var requestedScopesFromPayload = (payload) => {
   const decoded = typeof payload === "string" ? decodeJsonPayload(payload).pipe(Option2.getOrElse(() => payload)) : payload;
   if (decoded === null || typeof decoded !== "object") return null;
@@ -4001,14 +4066,14 @@ var isWellKnownOAuthMetadataUrl = (value) => {
   const path = new URL(value.trim()).pathname.toLowerCase();
   return path.includes("/.well-known/oauth-authorization-server") || path.includes("/.well-known/openid-configuration") || path.includes("/.well-known/oauth-protected-resource");
 };
-var validateSupportedEndpoint = (value, label, endpointUrlPolicy) => Effect6.try({
+var validateSupportedEndpoint = (value, label, endpointUrlPolicy) => Effect7.try({
   try: () => assertSupportedOAuthEndpointUrl(value, label, endpointUrlPolicy),
   catch: (cause) => new StorageError({
     message: `Invalid OAuth client endpoint configuration: ${label} must use https: or loopback http:.`,
     cause
   })
-}).pipe(Effect6.asVoid);
-var validateClientEndpoints = (input, endpointUrlPolicy) => Effect6.gen(function* () {
+}).pipe(Effect7.asVoid);
+var validateClientEndpoints = (input, endpointUrlPolicy) => Effect7.gen(function* () {
   yield* validateSupportedEndpoint(input.tokenUrl, "token_url", endpointUrlPolicy);
   if (input.resource != null && input.resource.trim().length > 0) {
     yield* validateSupportedEndpoint(input.resource, "resource", endpointUrlPolicy);
@@ -4035,9 +4100,9 @@ var validateClientEndpoints = (input, endpointUrlPolicy) => Effect6.gen(function
 var makeOAuthService = (deps) => {
   const httpClientLayer = deps.httpClientLayer ?? FetchHttpClient2.layer;
   const redirectUri = deps.redirectUri;
-  const createClient = (input) => Effect6.gen(function* () {
+  const createClient = (input) => Effect7.gen(function* () {
     yield* validateClientEndpoints(input, deps.endpointUrlPolicy);
-    const keys = yield* Effect6.try({
+    const keys = yield* Effect7.try({
       try: () => deps.ownedKeys(input.owner),
       catch: (cause) => new StorageError({
         message: "Cannot write oauth_client for owner without a subject",
@@ -4062,7 +4127,7 @@ var makeOAuthService = (deps) => {
       (db) => looseDb(db).deleteMany("oauth_client", {
         where: (b) => b.and(b("owner", "=", input.owner), b("slug", "=", String(input.slug)))
       })
-    ).pipe(Effect6.catch(() => Effect6.void));
+    ).pipe(Effect7.catch(() => Effect7.void));
     yield* deps.fuma.use(
       "oauth_client.create",
       (db) => looseDb(db).create("oauth_client", {
@@ -4083,20 +4148,20 @@ var makeOAuthService = (deps) => {
     );
     return input.slug;
   });
-  const removeClient = (owner, slug) => Effect6.gen(function* () {
+  const removeClient = (owner, slug) => Effect7.gen(function* () {
     yield* deps.fuma.use(
       "oauth_client.delete",
       (db) => looseDb(db).deleteMany("oauth_client", {
         where: (b) => b.and(b("owner", "=", owner), b("slug", "=", String(slug)))
       })
-    ).pipe(Effect6.asVoid);
+    ).pipe(Effect7.asVoid);
     const provider = deps.defaultWritableProvider();
     if (provider?.delete) {
-      yield* provider.delete(ProviderItemId.make(clientSecretItemId(owner, slug))).pipe(Effect6.catch(() => Effect6.void));
+      yield* provider.delete(ProviderItemId.make(clientSecretItemId(owner, slug))).pipe(Effect7.catch(() => Effect7.void));
     }
   });
   const pickDcrAuthMethod = (advertised) => !advertised || advertised.length === 0 || advertised.includes("none") ? "none" : "client_secret_post";
-  const registerDynamicClient2 = (input) => Effect6.gen(function* () {
+  const registerDynamicClient2 = (input) => Effect7.gen(function* () {
     const flowRedirectUri = input.redirectUri ?? redirectUri;
     if (flowRedirectUri == null) {
       return yield* new OAuthRegisterDynamicError({
@@ -4118,7 +4183,7 @@ var makeOAuthService = (deps) => {
       },
       { httpClientLayer, endpointUrlPolicy: deps.endpointUrlPolicy }
     ).pipe(
-      Effect6.mapError(
+      Effect7.mapError(
         (cause) => new OAuthRegisterDynamicError({
           // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: OAuthDiscoveryError carries a typed `message` field
           message: `Dynamic Client Registration failed: ${cause.message}`
@@ -4142,18 +4207,18 @@ var makeOAuthService = (deps) => {
     return input.slug;
   });
   const listClients = () => deps.fuma.use("oauth_client.findMany", (db) => looseDb(db).findMany("oauth_client", {})).pipe(
-    Effect6.flatMap(
-      (rows) => Effect6.forEach(rows, (row) => {
+    Effect7.flatMap(
+      (rows) => Effect7.forEach(rows, (row) => {
         const grant = parseGrant(row.grant);
         if (grant === null) {
-          return Effect6.fail(
+          return Effect7.fail(
             new StorageError({
               message: `oauth_client ${String(row.slug)} has an unknown grant: ${String(row.grant)}`,
               cause: void 0
             })
           );
         }
-        return Effect6.succeed({
+        return Effect7.succeed({
           owner: String(row.owner),
           slug: OAuthClientSlug.make(String(row.slug)),
           grant,
@@ -4172,18 +4237,18 @@ var makeOAuthService = (deps) => {
       where: (b) => b.and(b("owner", "=", owner), b("slug", "=", String(slug)))
     })
   ).pipe(
-    Effect6.flatMap((row) => {
-      if (!row) return Effect6.succeed(null);
+    Effect7.flatMap((row) => {
+      if (!row) return Effect7.succeed(null);
       const grant = parseGrant(row.grant);
       if (grant === null) {
-        return Effect6.fail(
+        return Effect7.fail(
           new StorageError({
             message: `oauth_client ${String(slug)} has an unknown grant: ${String(row.grant)}`,
             cause: void 0
           })
         );
       }
-      return Effect6.gen(function* () {
+      return Effect7.gen(function* () {
         let clientSecret = "";
         if (row.client_secret_item_id != null) {
           const provider = deps.defaultWritableProvider();
@@ -4203,8 +4268,8 @@ var makeOAuthService = (deps) => {
       });
     })
   );
-  const start = (input) => Effect6.gen(function* () {
-    const keys = yield* Effect6.try({
+  const start = (input) => Effect7.gen(function* () {
+    const keys = yield* Effect7.try({
       try: () => deps.ownedKeys(input.owner),
       catch: (cause) => new StorageError({
         message: "Cannot start OAuth flow for owner without a subject",
@@ -4223,7 +4288,7 @@ var makeOAuthService = (deps) => {
       });
     }
     const declaredScopes = yield* deps.resolveDeclaredOAuthScopes(input.integration, input.template).pipe(
-      Effect6.mapError(
+      Effect7.mapError(
         (cause) => new OAuthStartError({
           // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: StorageFailure carries a typed `message` field
           message: `Failed to resolve declared OAuth scopes: ${cause.message}`
@@ -4240,7 +4305,7 @@ var makeOAuthService = (deps) => {
         resource: client.resource ?? void 0,
         endpointUrlPolicy: deps.endpointUrlPolicy
       }).pipe(
-        Effect6.mapError(
+        Effect7.mapError(
           (cause) => new OAuthStartError({
             // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: OAuth2Error carries a typed `message` field
             message: `OAuth client-credentials exchange failed: ${cause.message}`
@@ -4254,7 +4319,7 @@ var makeOAuthService = (deps) => {
         requestedScopes,
         input.clientOwner
       ).pipe(
-        Effect6.mapError(
+        Effect7.mapError(
           (cause) => new OAuthStartError({
             // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: StorageFailure carries a typed `message` field
             message: `Failed to mint OAuth connection: ${cause.message}`
@@ -4270,7 +4335,7 @@ var makeOAuthService = (deps) => {
       });
     }
     const verifier = createPkceCodeVerifier();
-    const challenge = yield* Effect6.promise(() => createPkceCodeChallenge(verifier));
+    const challenge = yield* Effect7.promise(() => createPkceCodeChallenge(verifier));
     const state = OAuthState.make(createOAuthState());
     const now = /* @__PURE__ */ new Date();
     const expiresAt = Date.now() + OAUTH2_SESSION_TTL_MS;
@@ -4297,7 +4362,7 @@ var makeOAuthService = (deps) => {
         created_at: now
       })
     );
-    const authorizationUrl = yield* Effect6.try({
+    const authorizationUrl = yield* Effect7.try({
       try: () => buildAuthorizationUrl({
         authorizationUrl: client.authorizationUrl,
         clientId: client.clientId,
@@ -4319,7 +4384,7 @@ var makeOAuthService = (deps) => {
     });
     return { status: "redirect", authorizationUrl, state };
   });
-  const complete = (input) => Effect6.gen(function* () {
+  const complete = (input) => Effect7.gen(function* () {
     const sessionRow = yield* deps.fuma.use(
       "oauth_session.findFirst",
       (db) => looseDb(db).findFirst("oauth_session", {
@@ -4375,7 +4440,7 @@ var makeOAuthService = (deps) => {
       resource: client.resource ?? void 0,
       endpointUrlPolicy: deps.endpointUrlPolicy
     }).pipe(
-      Effect6.mapError(
+      Effect7.mapError(
         (cause) => new OAuthCompleteError({
           // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: OAuth2Error carries a typed `message` field
           message: `OAuth code exchange failed: ${cause.message}`,
@@ -4398,7 +4463,7 @@ var makeOAuthService = (deps) => {
       session.requestedScopes ?? [],
       session.clientOwner
     ).pipe(
-      Effect6.mapError(
+      Effect7.mapError(
         (cause) => new OAuthCompleteError({
           // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: StorageFailure carries a typed `message` field
           message: `Failed to mint OAuth connection: ${cause.message}`,
@@ -4409,7 +4474,7 @@ var makeOAuthService = (deps) => {
     yield* deleteSession(input.state);
     return connection;
   });
-  const mintFromToken = (target, client, token, requestedScopes, clientOwner) => Effect6.gen(function* () {
+  const mintFromToken = (target, client, token, requestedScopes, clientOwner) => Effect7.gen(function* () {
     const provider = deps.defaultWritableProvider();
     if (!provider || !provider.set) {
       return yield* new StorageError({
@@ -4449,16 +4514,16 @@ var makeOAuthService = (deps) => {
     (db) => looseDb(db).deleteMany("oauth_session", {
       where: (b) => b("state", "=", String(state))
     })
-  ).pipe(Effect6.asVoid);
+  ).pipe(Effect7.asVoid);
   const cancel = (state) => deleteSession(state);
-  const probe = (input) => Effect6.gen(function* () {
+  const probe = (input) => Effect7.gen(function* () {
     const options = { endpointUrlPolicy: deps.endpointUrlPolicy };
     const resource = yield* discoverProtectedResourceMetadata(input.url, options).pipe(
-      Effect6.catch(() => Effect6.succeed(null))
+      Effect7.catch(() => Effect7.succeed(null))
     );
     const issuerCandidate = resource?.metadata.authorization_servers?.[0] ?? input.url;
     const as = yield* discoverAuthorizationServerMetadata(issuerCandidate, options).pipe(
-      Effect6.mapError(
+      Effect7.mapError(
         (cause) => new OAuthProbeError({
           // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: OAuthDiscoveryError carries a typed `message` field
           message: `OAuth discovery failed: ${cause.message}`
@@ -4478,7 +4543,7 @@ var makeOAuthService = (deps) => {
       registrationEndpoint: as.metadata.registration_endpoint ?? null,
       tokenEndpointAuthMethodsSupported: as.metadata.token_endpoint_auth_methods_supported
     };
-  }).pipe(Effect6.provide(httpClientLayer));
+  }).pipe(Effect7.provide(httpClientLayer));
   return {
     createClient,
     removeClient,
@@ -4494,7 +4559,7 @@ var makeOAuthService = (deps) => {
 // src/executor.ts
 var PLUGIN_STORAGE_DELETE_KEY_BATCH_SIZE = 90;
 var MAX_APPROVAL_ARGUMENT_PREVIEW_CHARS = 4e3;
-var acceptAllHandler = () => Effect7.succeed(ElicitationResponse.make({ action: "accept" }));
+var acceptAllHandler = () => Effect8.succeed(ElicitationResponse.make({ action: "accept" }));
 var resolveElicitationHandler = (onElicitation) => onElicitation === "accept-all" ? acceptAllHandler : onElicitation;
 var ADDRESS_PREFIX = "tools";
 var isOwner = (value) => value === "org" || value === "user";
@@ -4555,7 +4620,7 @@ var createDefaultMemoryDb = (tables) => {
   const db = factory.client(memoryAdapter()).orm(version);
   return { db };
 };
-var decodeJsonFromString = Schema4.decodeUnknownOption(Schema4.UnknownFromJsonString);
+var decodeJsonFromString = Schema5.decodeUnknownOption(Schema5.UnknownFromJsonString);
 var decodeJsonColumn = (value) => {
   if (value === null || value === void 0) return void 0;
   if (typeof value !== "string") return value;
@@ -4563,7 +4628,11 @@ var decodeJsonColumn = (value) => {
 };
 var rowToIntegration = (row, authMethods = [], displayUrl) => ({
   slug: IntegrationSlug.make(row.slug),
-  description: row.description,
+  // Pre-split rows have no `name`; their description WAS the display name.
+  name: row.name ?? row.description ?? row.slug,
+  // `description` is now nullable (cleared where it only held a duplicated
+  // title); present it as "" so the public Integration type stays a string.
+  description: row.description ?? "",
   kind: row.plugin_id,
   canRemove: Boolean(row.can_remove),
   canRefresh: Boolean(row.can_refresh),
@@ -4586,6 +4655,7 @@ var rowToConnection = (row) => {
     provider: ProviderKey.make(row.provider),
     address: connectionAddress(owner, integration, name),
     identityLabel: row.identity_label ?? null,
+    description: row.description ?? null,
     expiresAt: row.expires_at == null ? null : Number(row.expires_at),
     oauthClient: row.oauth_client == null ? null : OAuthClientSlug.make(String(row.oauth_client)),
     oauthClientOwner: row.oauth_client_owner == null ? null : String(row.oauth_client_owner),
@@ -4638,7 +4708,7 @@ var makeCoreDb = (fuma) => ({
     `${tableName}.create`,
     (db) => asLooseStorageDb(db).create(tableName, row)
   ),
-  createMany: (tableName, rows) => rows.length === 0 ? Effect7.void : fuma.use(`${tableName}.createMany`, (db) => asLooseStorageDb(db).createMany(tableName, rows)).pipe(Effect7.asVoid),
+  createMany: (tableName, rows) => rows.length === 0 ? Effect8.void : fuma.use(`${tableName}.createMany`, (db) => asLooseStorageDb(db).createMany(tableName, rows)).pipe(Effect8.asVoid),
   deleteMany: (tableName, options = {}) => fuma.use(
     `${tableName}.deleteMany`,
     (db) => asLooseStorageDb(db).deleteMany(tableName, options)
@@ -4780,13 +4850,13 @@ var makePluginStorageFacade = (input) => {
     return l - r || left.key.localeCompare(right.key);
   });
   const getVisible = (collection, key) => input.core.findMany("plugin_storage", { where: whereFor(collection, key) }).pipe(
-    Effect7.map((rows) => sortByOwnerPrecedence(rows)[0] ?? null),
-    Effect7.map((row) => row ? pluginStorageEntryFromRow(row) : null)
+    Effect8.map((rows) => sortByOwnerPrecedence(rows)[0] ?? null),
+    Effect8.map((row) => row ? pluginStorageEntryFromRow(row) : null)
   );
   const getForOwnerImpl = (owner, collection, key) => input.core.findFirst("plugin_storage", {
     where: whereOwner(owner, collection, key)
-  }).pipe(Effect7.map((row) => row ? pluginStorageEntryFromRow(row) : null));
-  const putImpl = (owner, collection, key, data) => Effect7.gen(function* () {
+  }).pipe(Effect8.map((row) => row ? pluginStorageEntryFromRow(row) : null));
+  const putImpl = (owner, collection, key, data) => Effect8.gen(function* () {
     const os = ownerSubject(owner);
     if (!os) {
       return yield* new StorageError({
@@ -4822,7 +4892,7 @@ var makePluginStorageFacade = (input) => {
     });
     return pluginStorageEntryFromRow(created);
   });
-  const removeImpl = (owner, collection, key) => Effect7.gen(function* () {
+  const removeImpl = (owner, collection, key) => Effect8.gen(function* () {
     const os = ownerSubject(owner);
     if (!os) {
       return yield* new StorageError({
@@ -4846,7 +4916,7 @@ var makePluginStorageFacade = (input) => {
     }
     return grouped;
   };
-  const deleteManyImpl = (owner, subject, entries) => Effect7.gen(function* () {
+  const deleteManyImpl = (owner, subject, entries) => Effect8.gen(function* () {
     for (const [collection, keys] of keysByCollection(entries)) {
       const uniqueKeys = [...keys];
       for (let offset = 0; offset < uniqueKeys.length; offset += PLUGIN_STORAGE_DELETE_KEY_BATCH_SIZE) {
@@ -4863,7 +4933,7 @@ var makePluginStorageFacade = (input) => {
       }
     }
   });
-  const putManyImpl = (owner, entries) => Effect7.gen(function* () {
+  const putManyImpl = (owner, entries) => Effect8.gen(function* () {
     const os = ownerSubject(owner);
     if (!os) {
       return yield* new StorageError({
@@ -4900,7 +4970,7 @@ var makePluginStorageFacade = (input) => {
       }))
     );
   });
-  const removeManyImpl = (owner, entries) => Effect7.gen(function* () {
+  const removeManyImpl = (owner, entries) => Effect8.gen(function* () {
     const os = ownerSubject(owner);
     if (!os) {
       return yield* new StorageError({
@@ -4910,7 +4980,7 @@ var makePluginStorageFacade = (input) => {
     }
     yield* deleteManyImpl(owner, os.subject, entries);
   });
-  const queryCollection = (definition, queryInput) => Effect7.gen(function* () {
+  const queryCollection = (definition, queryInput) => Effect8.gen(function* () {
     const validationError = pluginStorageQueryValidationError(
       definition,
       queryInput
@@ -4956,12 +5026,12 @@ var makePluginStorageFacade = (input) => {
         storageInput.data
       ),
       query: (storageInput) => queryCollection(definition, storageInput),
-      count: (storageInput) => queryCollection(definition, storageInput).pipe(Effect7.map((rows) => rows.length)),
+      count: (storageInput) => queryCollection(definition, storageInput).pipe(Effect8.map((rows) => rows.length)),
       remove: (storageInput) => removeImpl(storageInput.owner, definition.name, storageInput.key)
     }),
     get: (storageInput) => getVisible(storageInput.collection, storageInput.key),
     getForOwner: (storageInput) => getForOwnerImpl(storageInput.owner, storageInput.collection, storageInput.key),
-    list: (storageInput) => Effect7.gen(function* () {
+    list: (storageInput) => Effect8.gen(function* () {
       const rows = yield* input.core.findMany("plugin_storage", {
         where: whereFor(storageInput.collection)
       });
@@ -4999,7 +5069,7 @@ var staticToolSchemaRoot = (schema, side) => {
   const materialize = jsonSchema[side];
   return typeof materialize === "function" ? materialize({ target: "draft-07" }) : jsonSchema;
 };
-var createExecutor = (config) => Effect7.gen(function* () {
+var createExecutor = (config) => Effect8.gen(function* () {
   const defaultPlugins = () => {
     const empty = [];
     return empty;
@@ -5021,12 +5091,12 @@ var createExecutor = (config) => Effect7.gen(function* () {
     }
     return { tenant, owner, subject };
   };
-  const requireUserSubject = (owner) => owner === "user" && subject == null ? Effect7.fail(
+  const requireUserSubject = (owner) => owner === "user" && subject == null ? Effect8.fail(
     new StorageError({
       message: `Cannot target owner "user": executor has no subject.`,
       cause: void 0
     })
-  ) : Effect7.void;
+  ) : Effect8.void;
   const plugins = config.coreTools ? [
     coreToolsPlugin({
       webBaseUrl: config.coreTools.webBaseUrl,
@@ -5034,19 +5104,19 @@ var createExecutor = (config) => Effect7.gen(function* () {
     }),
     ...userPlugins
   ] : userPlugins;
-  const tables = yield* Effect7.try({
+  const tables = yield* Effect8.try({
     try: () => collectTables(),
     catch: (cause) => storageFailureFromUnknown("Failed to collect executor tables", cause)
   });
-  const dbInput = yield* Effect7.suspend(() => {
-    if (!config.db) return Effect7.succeed(createDefaultMemoryDb(tables));
-    if (typeof config.db !== "function") return Effect7.succeed(config.db);
+  const dbInput = yield* Effect8.suspend(() => {
+    if (!config.db) return Effect8.succeed(createDefaultMemoryDb(tables));
+    if (typeof config.db !== "function") return Effect8.succeed(config.db);
     const out = config.db({ tables });
-    return Effect7.isEffect(out) ? out : Effect7.succeed(out);
+    return Effect8.isEffect(out) ? out : Effect8.succeed(out);
   });
   const rootDbUntyped = "db" in dbInput ? dbInput.db : dbInput;
   const closeDb = "db" in dbInput ? dbInput.close : void 0;
-  yield* Effect7.try({
+  yield* Effect8.try({
     try: () => {
       validateExecutorDbTables(tables, rootDbUntyped.internal.tables);
       validateExecutorOwnerPolicyTables(rootDbUntyped.internal.tables);
@@ -5074,6 +5144,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
   };
   const staticSourceToIntegration = (source) => ({
     slug: IntegrationSlug.make(source.id),
+    name: source.name,
     description: source.name,
     kind: source.kind,
     canRemove: source.canRemove ?? false,
@@ -5096,7 +5167,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
   const registerCredentialProvider = (provider, sourceLabel) => {
     const key = String(provider.key);
     if (credentialProviders.has(key)) {
-      return Effect7.fail(
+      return Effect8.fail(
         new StorageError({
           message: `Duplicate credential provider key: ${key} (from ${sourceLabel})`,
           cause: void 0
@@ -5105,7 +5176,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
     }
     credentialProviders.set(key, provider);
     credentialProviderOrder.push(key);
-    return Effect7.void;
+    return Effect8.void;
   };
   for (const provider of config.providers ?? []) {
     yield* registerCredentialProvider(provider, "config");
@@ -5134,7 +5205,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
   const loadOAuthClientRow = (owner, slug) => core.findFirst("oauth_client", {
     where: (b) => b.and(byOwner(owner)(b), b("slug", "=", slug))
   });
-  const performTokenRefresh = (row, provider) => Effect7.gen(function* () {
+  const performTokenRefresh = (row, provider) => Effect8.gen(function* () {
     const owner = row.owner;
     const reauth = (message) => new CredentialResolutionError({
       owner,
@@ -5162,14 +5233,14 @@ var createExecutor = (config) => Effect7.gen(function* () {
       // problem, so do NOT map invalid_grant → reauth. Surface as a
       // StorageError; the in-flight gate clears on settle, so the next
       // invoke retries (handles transient AS/network blips).
-      Effect7.mapError(
+      Effect8.mapError(
         (cause) => new StorageError({
           // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: OAuth2Error carries a typed `message`
           message: `Client-credentials token request failed: ${cause.message}`,
           cause
         })
       )
-    ) : yield* Effect7.gen(function* () {
+    ) : yield* Effect8.gen(function* () {
       if (!row.refresh_item_id) {
         return yield* reauth("No refresh token is stored for this connection.");
       }
@@ -5188,7 +5259,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
         resource: clientRow.resource ? String(clientRow.resource) : void 0,
         endpointUrlPolicy: config.oauthEndpointUrlPolicy
       }).pipe(
-        Effect7.mapError(
+        Effect8.mapError(
           (cause) => cause.error === "invalid_grant" ? reauth(
             // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: OAuth2Error carries a typed `message`
             `OAuth token refresh was rejected (invalid_grant): ${cause.message}`
@@ -5229,20 +5300,20 @@ var createExecutor = (config) => Effect7.gen(function* () {
     // token; parallel grants would race on a consumed token — v1's refresh
     // deferred-map). The gate is cleared once the refresh settles so a later
     // expiry can refresh again.
-    Effect7.gen(function* () {
+    Effect8.gen(function* () {
       const key = connectionKey(row);
       const existing = refreshInFlight.get(key);
       if (existing) return yield* existing;
-      const memoized = yield* Effect7.cached(performTokenRefresh(row, provider));
+      const memoized = yield* Effect8.cached(performTokenRefresh(row, provider));
       const gated = memoized.pipe(
-        Effect7.ensuring(Effect7.sync(() => refreshInFlight.delete(key)))
+        Effect8.ensuring(Effect8.sync(() => refreshInFlight.delete(key)))
       );
       const winner = refreshInFlight.get(key) ?? gated;
       if (winner === gated) refreshInFlight.set(key, gated);
       return yield* winner;
     })
   );
-  const resolveConnectionValues = (row) => Effect7.gen(function* () {
+  const resolveConnectionValues = (row) => Effect8.gen(function* () {
     const provider = credentialProviders.get(row.provider);
     if (!provider) {
       return yield* new CredentialProviderNotRegisteredError({
@@ -5262,9 +5333,9 @@ var createExecutor = (config) => Effect7.gen(function* () {
   }).pipe(
     // CredentialProviderNotRegisteredError is part of CredentialResolution
     // for ctx.connections.resolveValue's StorageFailure channel — fold it.
-    Effect7.catchTag(
+    Effect8.catchTag(
       "CredentialProviderNotRegisteredError",
-      (err) => Effect7.fail(
+      (err) => Effect8.fail(
         new StorageError({
           message: `Credential provider "${err.provider}" is not registered.`,
           cause: err
@@ -5273,12 +5344,12 @@ var createExecutor = (config) => Effect7.gen(function* () {
     )
   );
   const resolveConnectionValue = (row) => resolveConnectionValues(row).pipe(
-    Effect7.map((values) => values[PRIMARY_INPUT_VARIABLE] ?? null)
+    Effect8.map((values) => values[PRIMARY_INPUT_VARIABLE] ?? null)
   );
   const foldResolutionFailure = (effect) => effect.pipe(
-    Effect7.catchTag(
+    Effect8.catchTag(
       "CredentialResolutionError",
-      (err) => Effect7.fail(
+      (err) => Effect8.fail(
         new StorageError({
           // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: CredentialResolutionError carries a typed `message` field
           message: err.message,
@@ -5288,14 +5359,14 @@ var createExecutor = (config) => Effect7.gen(function* () {
     )
   );
   const resolveConnectionValueByRef = (ref) => foldResolutionFailure(
-    Effect7.gen(function* () {
+    Effect8.gen(function* () {
       const row = yield* findConnectionRow(ref);
       if (!row) return null;
       return yield* resolveConnectionValue(row);
     })
   );
   const resolveConnectionValuesByRef = (ref) => foldResolutionFailure(
-    Effect7.gen(function* () {
+    Effect8.gen(function* () {
       const row = yield* findConnectionRow(ref);
       if (!row) return {};
       return yield* resolveConnectionValues(row);
@@ -5328,26 +5399,26 @@ var createExecutor = (config) => Effect7.gen(function* () {
     }
   };
   const integrationsList = () => core.findMany("integration", {}).pipe(
-    Effect7.map((rows) => [
+    Effect8.map((rows) => [
       ...staticSources().map(staticSourceToIntegration),
       ...rows.map(
         (row) => rowToIntegration(row, describeAuthMethodsForRow(row), describeDisplayUrlForRow(row))
       )
     ])
   );
-  const integrationsGet = (slug) => Effect7.gen(function* () {
+  const integrationsGet = (slug) => Effect8.gen(function* () {
     const staticSource = staticSources().find((source) => source.id === String(slug));
     if (staticSource) return staticSourceToIntegration(staticSource);
     const row = yield* findIntegrationRow(slug);
     return row ? rowToIntegration(row, describeAuthMethodsForRow(row), describeDisplayUrlForRow(row)) : null;
   });
   const integrationsGetRecord = (slug) => findIntegrationRow(slug).pipe(
-    Effect7.map(
+    Effect8.map(
       (row) => row ? rowToIntegrationRecord(row, describeAuthMethodsForRow(row)) : null
     )
   );
   const integrationsRegister = (pluginId, input) => transaction(
-    Effect7.gen(function* () {
+    Effect8.gen(function* () {
       const now = /* @__PURE__ */ new Date();
       const existing = yield* findIntegrationRow(input.slug);
       const config2 = input.config === void 0 ? null : input.config;
@@ -5356,6 +5427,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
           where: (b) => b("slug", "=", String(input.slug)),
           set: {
             plugin_id: pluginId,
+            name: input.name ?? existing.name ?? null,
             description: input.description,
             config: config2,
             can_remove: input.canRemove ?? Boolean(existing.can_remove),
@@ -5369,6 +5441,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
         tenant,
         slug: String(input.slug),
         plugin_id: pluginId,
+        name: input.name ?? null,
         description: input.description,
         config: config2,
         can_remove: input.canRemove ?? true,
@@ -5378,22 +5451,27 @@ var createExecutor = (config) => Effect7.gen(function* () {
       });
     })
   );
-  const integrationsUpdate = (slug, patch) => Effect7.gen(function* () {
-    const set = { updated_at: /* @__PURE__ */ new Date() };
+  const integrationsUpdate = (slug, patch) => Effect8.gen(function* () {
+    const now = /* @__PURE__ */ new Date();
+    const set = { updated_at: now };
+    if (patch.name !== void 0) set.name = patch.name;
     if (patch.description !== void 0) set.description = patch.description;
-    if (patch.config !== void 0) set.config = patch.config;
+    if (patch.config !== void 0) {
+      set.config = patch.config;
+      set.config_revised_at = now.getTime();
+    }
     yield* core.updateMany("integration", {
       where: (b) => b("slug", "=", String(slug)),
       set
     });
   });
-  const integrationsUpdatePublic = (slug, patch) => Effect7.gen(function* () {
+  const integrationsUpdatePublic = (slug, patch) => Effect8.gen(function* () {
     const existing = yield* findIntegrationRow(slug);
     if (!existing) return yield* new IntegrationNotFoundError({ slug });
     yield* integrationsUpdate(slug, patch);
   });
   const integrationsRemove = (slug) => transaction(
-    Effect7.gen(function* () {
+    Effect8.gen(function* () {
       const existing = yield* findIntegrationRow(slug);
       if (!existing) return;
       if (!existing.can_remove) {
@@ -5408,20 +5486,20 @@ var createExecutor = (config) => Effect7.gen(function* () {
       });
     })
   );
-  const integrationsDetect = (url) => Effect7.gen(function* () {
+  const integrationsDetect = (url) => Effect8.gen(function* () {
     const results = [];
     for (const runtime of runtimes.values()) {
       if (!runtime.plugin.detect) continue;
       const result = yield* runtime.plugin.detect({ ctx: runtime.ctx, url }).pipe(
-        Effect7.mapError((cause) => pluginStorageFailure(runtime.plugin.id, "detect", cause))
+        Effect8.mapError((cause) => pluginStorageFailure(runtime.plugin.id, "detect", cause))
       );
       if (result) results.push(result);
     }
     return results;
   });
-  const produceConnectionTools = (integrationRow, ref) => Effect7.gen(function* () {
+  const produceConnectionTools = (integrationRow, ref) => Effect8.gen(function* () {
     const runtime = runtimes.get(integrationRow.plugin_id);
-    const keys = yield* Effect7.try({
+    const keys = yield* Effect8.try({
       try: () => ownedKeys(ref.owner),
       catch: (cause) => storageFailureFromUnknown("invalid owner", cause)
     });
@@ -5431,21 +5509,31 @@ var createExecutor = (config) => Effect7.gen(function* () {
       b("integration", "=", String(ref.integration)),
       b("connection", "=", String(ref.name))
     );
+    const stampSynced = core.updateMany("connection", {
+      where: (b) => b.and(
+        byOwner(owner)(b),
+        b("integration", "=", String(ref.integration)),
+        b("name", "=", String(ref.name))
+      ),
+      set: { tools_synced_at: Date.now() }
+    });
     const existingRow = yield* findConnectionRow(ref);
     if (existingRow && existingRow.oauth_client == null && existingRow.template !== String(NO_AUTH_TEMPLATE) && Object.keys(connectionItemIds(existingRow)).length === 0) {
       yield* transaction(
-        Effect7.gen(function* () {
+        Effect8.gen(function* () {
           yield* core.deleteMany("tool", { where });
           yield* core.deleteMany("definition", { where });
+          yield* stampSynced;
         })
       );
       return [];
     }
     if (!runtime?.plugin.resolveTools) {
       yield* transaction(
-        Effect7.gen(function* () {
+        Effect8.gen(function* () {
           yield* core.deleteMany("tool", { where });
           yield* core.deleteMany("definition", { where });
+          yield* stampSynced;
         })
       );
       return [];
@@ -5459,7 +5547,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
       getValue: () => resolveConnectionValueByRef(ref),
       getValues: () => resolveConnectionValuesByRef(ref)
     }).pipe(
-      Effect7.mapError(
+      Effect8.mapError(
         (cause) => pluginStorageFailure(integrationRow.plugin_id, "resolveTools", cause)
       )
     );
@@ -5491,11 +5579,12 @@ var createExecutor = (config) => Effect7.gen(function* () {
       created_at: now
     }));
     yield* transaction(
-      Effect7.gen(function* () {
+      Effect8.gen(function* () {
         yield* core.deleteMany("tool", { where });
         yield* core.deleteMany("definition", { where });
         yield* core.createMany("tool", toolRows);
         yield* core.createMany("definition", definitionRows);
+        yield* stampSynced;
       })
     );
     return result.tools.map(
@@ -5519,7 +5608,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
       )
     );
   });
-  const connectionsCreate = (input) => Effect7.gen(function* () {
+  const connectionsCreate = (input) => Effect8.gen(function* () {
     const name = connectionIdentifier(String(input.name));
     if (input.owner === "user" && subject == null) {
       return yield* new InvalidConnectionInputError({
@@ -5584,13 +5673,13 @@ var createExecutor = (config) => Effect7.gen(function* () {
         itemIds[i.variable] = itemId;
       }
     }
-    const keys = yield* Effect7.try({
+    const keys = yield* Effect8.try({
       try: () => ownedKeys(input.owner),
       catch: (cause) => storageFailureFromUnknown("invalid owner", cause)
     });
     const now = /* @__PURE__ */ new Date();
     yield* transaction(
-      Effect7.gen(function* () {
+      Effect8.gen(function* () {
         const existing = yield* findConnectionRow({
           owner: input.owner,
           integration: input.integration,
@@ -5601,6 +5690,9 @@ var createExecutor = (config) => Effect7.gen(function* () {
           provider: providerKey,
           item_ids: itemIds,
           identity_label: input.identityLabel ?? null,
+          // Re-saving a credential keeps an existing curated description
+          // unless the caller explicitly provides one.
+          ...input.description !== void 0 ? { description: input.description } : {},
           updated_at: now
         };
         if (existing) {
@@ -5623,6 +5715,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
             provider: providerKey,
             item_ids: itemIds,
             identity_label: input.identityLabel ?? null,
+            description: input.description ?? null,
             oauth_client: null,
             refresh_item_id: null,
             expires_at: null,
@@ -5640,7 +5733,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
       name
     };
     yield* produceConnectionTools(integrationRow, ref).pipe(
-      Effect7.catchTag("IntegrationNotFoundError", () => Effect7.succeed([]))
+      Effect8.catchTag("IntegrationNotFoundError", () => Effect8.succeed([]))
     );
     const row = yield* findConnectionRow(ref);
     return row ? rowToConnection(row) : rowToConnection({
@@ -5653,6 +5746,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
       provider: providerKey,
       item_ids: itemIds,
       identity_label: input.identityLabel ?? null,
+      description: input.description ?? null,
       oauth_client: null,
       refresh_item_id: null,
       expires_at: null,
@@ -5662,7 +5756,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
       updated_at: now
     });
   });
-  const mintOAuthConnection = (input) => Effect7.gen(function* () {
+  const mintOAuthConnection = (input) => Effect8.gen(function* () {
     const name = connectionIdentifier(String(input.name));
     yield* requireUserSubject(input.owner);
     const integrationRow = yield* findIntegrationRow(input.integration);
@@ -5672,7 +5766,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
         cause: void 0
       });
     }
-    const keys = yield* Effect7.try({
+    const keys = yield* Effect8.try({
       try: () => ownedKeys(input.owner),
       catch: (cause) => storageFailureFromUnknown("invalid owner", cause)
     });
@@ -5683,7 +5777,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
       name
     };
     yield* transaction(
-      Effect7.gen(function* () {
+      Effect8.gen(function* () {
         const existing = yield* findConnectionRow(ref);
         const set = {
           template: String(input.template),
@@ -5717,6 +5811,9 @@ var createExecutor = (config) => Effect7.gen(function* () {
             provider: input.provider,
             item_ids: { [PRIMARY_INPUT_VARIABLE]: input.itemId },
             identity_label: input.identityLabel ?? null,
+            // Curated description: never stamped by a mint — a reconnect
+            // or token refresh must not erase what the user wrote.
+            description: null,
             oauth_client: String(input.oauthClient),
             oauth_client_owner: input.oauthClientOwner,
             refresh_item_id: input.refreshItemId,
@@ -5730,7 +5827,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
       })
     );
     yield* produceConnectionTools(integrationRow, ref).pipe(
-      Effect7.catchTag("IntegrationNotFoundError", () => Effect7.succeed([]))
+      Effect8.catchTag("IntegrationNotFoundError", () => Effect8.succeed([]))
     );
     const row = yield* findConnectionRow(ref);
     return row ? rowToConnection(row) : rowToConnection({
@@ -5743,6 +5840,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
       provider: input.provider,
       item_ids: { [PRIMARY_INPUT_VARIABLE]: input.itemId },
       identity_label: input.identityLabel ?? null,
+      description: null,
       oauth_client: String(input.oauthClient),
       oauth_client_owner: input.oauthClientOwner,
       refresh_item_id: input.refreshItemId,
@@ -5758,10 +5856,33 @@ var createExecutor = (config) => Effect7.gen(function* () {
       filter?.integration === void 0 ? true : b("integration", "=", String(filter.integration)),
       filter?.owner === void 0 ? true : b("owner", "=", filter.owner)
     )
-  }).pipe(Effect7.map((rows) => rows.map(rowToConnection)));
-  const connectionsGet = (ref) => findConnectionRow(ref).pipe(Effect7.map((row) => row ? rowToConnection(row) : null));
+  }).pipe(Effect8.map((rows) => rows.map(rowToConnection)));
+  const connectionsGet = (ref) => findConnectionRow(ref).pipe(Effect8.map((row) => row ? rowToConnection(row) : null));
+  const connectionsUpdate = (ref, input) => Effect8.gen(function* () {
+    const row = yield* findConnectionRow(ref);
+    if (!row) {
+      return yield* new ConnectionNotFoundError({
+        owner: ref.owner,
+        integration: ref.integration,
+        name: ref.name
+      });
+    }
+    const set = { updated_at: /* @__PURE__ */ new Date() };
+    if (input.description !== void 0) set.description = input.description;
+    if (input.identityLabel !== void 0) set.identity_label = input.identityLabel;
+    yield* core.updateMany("connection", {
+      where: (b) => b.and(
+        byOwner(ref.owner)(b),
+        b("integration", "=", String(ref.integration)),
+        b("name", "=", String(ref.name))
+      ),
+      set
+    });
+    const updated = yield* findConnectionRow(ref);
+    return rowToConnection(updated ?? row);
+  });
   const connectionsRemove = (ref) => transaction(
-    Effect7.gen(function* () {
+    Effect8.gen(function* () {
       const row = yield* findConnectionRow(ref);
       if (!row) {
         return yield* new ConnectionNotFoundError({
@@ -5778,7 +5899,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
           integration: ref.integration,
           connection: ref
         }).pipe(
-          Effect7.mapError(
+          Effect8.mapError(
             (cause) => pluginStorageFailure(integrationRow.plugin_id, "removeConnection", cause)
           )
         );
@@ -5799,7 +5920,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
       });
     })
   );
-  const connectionsRefresh = (ref) => Effect7.gen(function* () {
+  const connectionsRefresh = (ref) => Effect8.gen(function* () {
     const row = yield* findConnectionRow(ref);
     if (!row) {
       return yield* new ConnectionNotFoundError({
@@ -5826,7 +5947,41 @@ var createExecutor = (config) => Effect7.gen(function* () {
     }
     return true;
   };
-  const toolsList = (filter) => Effect7.gen(function* () {
+  const syncStaleConnectionTools = Effect8.gen(function* () {
+    const revised = yield* core.findMany("integration", {
+      where: (b) => b.isNotNull("config_revised_at")
+    });
+    if (revised.length === 0) return;
+    const revisedAt = new Map(
+      revised.map((row) => [row.slug, Number(row.config_revised_at)])
+    );
+    const connections = yield* core.findMany("connection", {
+      where: (b) => b.or(...revised.map((row) => b("integration", "=", row.slug)))
+    });
+    for (const connection of connections) {
+      const revisedTime = revisedAt.get(connection.integration);
+      if (revisedTime === void 0) continue;
+      const syncedAt = connection.tools_synced_at == null ? 0 : Number(connection.tools_synced_at);
+      if (syncedAt >= revisedTime) continue;
+      const integrationRow = revised.find((row) => row.slug === connection.integration);
+      if (!integrationRow) continue;
+      yield* produceConnectionTools(integrationRow, {
+        owner: connection.owner,
+        integration: IntegrationSlug.make(connection.integration),
+        name: ConnectionName.make(connection.name)
+      }).pipe(
+        Effect8.catch(() => Effect8.succeed([])),
+        Effect8.withSpan("executor.tools.sync_stale", {
+          attributes: {
+            "executor.integration": connection.integration,
+            "executor.connection": connection.name
+          }
+        })
+      );
+    }
+  });
+  const toolsList = (filter) => Effect8.gen(function* () {
+    yield* syncStaleConnectionTools;
     const rows = yield* core.findMany("tool", {
       where: (b) => b.and(
         filter?.integration === void 0 ? true : b("integration", "=", String(filter.integration)),
@@ -5868,18 +6023,18 @@ var createExecutor = (config) => Effect7.gen(function* () {
     }
     return tools;
   });
-  const toolSchema = (address) => Effect7.gen(function* () {
+  const toolSchema = (address) => Effect8.gen(function* () {
     const staticEntry = staticTools.get(String(address));
     if (staticEntry) {
       const tool3 = staticToolToTool(staticEntry);
-      const preview2 = yield* Effect7.tryPromise({
+      const preview2 = yield* Effect8.tryPromise({
         try: () => buildToolTypeScriptPreview({
           inputSchema: tool3.inputSchema,
           outputSchema: tool3.outputSchema,
           defs: /* @__PURE__ */ new Map()
         }),
         catch: (cause) => storageFailureFromUnknown("Failed to build static tool TypeScript preview", cause)
-      }).pipe(Effect7.option);
+      }).pipe(Effect8.option);
       return ToolSchemaView.make({
         address,
         name: tool3.name,
@@ -5916,14 +6071,14 @@ var createExecutor = (config) => Effect7.gen(function* () {
       [tool2.inputSchema, tool2.outputSchema],
       defs
     );
-    const preview = yield* Effect7.tryPromise({
+    const preview = yield* Effect8.tryPromise({
       try: () => buildToolTypeScriptPreview({
         inputSchema: tool2.inputSchema,
         outputSchema: tool2.outputSchema,
         defs
       }),
       catch: (cause) => storageFailureFromUnknown("Failed to build tool TypeScript preview", cause)
-    }).pipe(Effect7.option);
+    }).pipe(Effect8.option);
     const view = preview;
     return ToolSchemaView.make({
       address,
@@ -5937,8 +6092,8 @@ var createExecutor = (config) => Effect7.gen(function* () {
       typeScriptDefinitions: Option3.getOrUndefined(view)?.typeScriptDefinitions
     });
   });
-  const providersList = () => Effect7.sync(() => credentialProviderOrder.map((key) => ProviderKey.make(key)));
-  const providersItems = (key) => Effect7.gen(function* () {
+  const providersList = () => Effect8.sync(() => credentialProviderOrder.map((key) => ProviderKey.make(key)));
+  const providersItems = (key) => Effect8.gen(function* () {
     const provider = credentialProviders.get(String(key));
     if (!provider || !provider.list) return [];
     return yield* provider.list();
@@ -5946,11 +6101,11 @@ var createExecutor = (config) => Effect7.gen(function* () {
   const ownerRankForRow = (row) => row.owner === "user" ? 0 : 1;
   const normalizedPolicyId = (tool2) => tool2.static ? String(tool2.address) : `${tool2.integration}.${tool2.owner}.${tool2.connection}.${tool2.name}`;
   const policiesList = () => core.findMany("tool_policy", {}).pipe(
-    Effect7.map(
+    Effect8.map(
       (rows) => [...rows].sort((a, b) => ownerRankForRow(a) - ownerRankForRow(b) || comparePolicyRow(a, b)).map(rowToToolPolicy)
     )
   );
-  const policiesCreate = (input) => Effect7.gen(function* () {
+  const policiesCreate = (input) => Effect8.gen(function* () {
     if (!isValidPattern(input.pattern)) {
       return yield* new StorageError({
         message: `Invalid tool policy pattern: ${input.pattern}`,
@@ -5964,7 +6119,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
       });
     }
     yield* requireUserSubject(input.owner);
-    const keys = yield* Effect7.try({
+    const keys = yield* Effect8.try({
       try: () => ownedKeys(input.owner),
       catch: (cause) => storageFailureFromUnknown("invalid owner", cause)
     });
@@ -5990,7 +6145,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
     });
     return rowToToolPolicy(created);
   });
-  const policiesUpdate = (input) => Effect7.gen(function* () {
+  const policiesUpdate = (input) => Effect8.gen(function* () {
     if (input.pattern !== void 0 && !isValidPattern(input.pattern)) {
       return yield* new StorageError({
         message: `Invalid tool policy pattern: ${input.pattern}`,
@@ -6016,7 +6171,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
   const policiesRemove = (input) => core.deleteMany("tool_policy", {
     where: (b) => b.and(byOwner(input.owner)(b), b("id", "=", input.id))
   });
-  const policiesResolve = (address) => Effect7.gen(function* () {
+  const policiesResolve = (address) => Effect8.gen(function* () {
     const parsed = parseToolAddress(String(address));
     const policyRows = yield* core.findMany("tool_policy", {});
     const toolId = parsed ? `${parsed.integration}.${parsed.owner}.${parsed.connection}.${parsed.tool}` : String(address);
@@ -6040,7 +6195,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
   const defaultElicitationHandler = resolveElicitationHandler(config.onElicitation);
   const pickHandler = (options) => options?.onElicitation ? resolveElicitationHandler(options.onElicitation) : defaultElicitationHandler;
   const buildElicit = (address, args, handler) => {
-    return (request) => Effect7.gen(function* () {
+    return (request) => Effect8.gen(function* () {
       const response = yield* handler({
         address,
         args,
@@ -6055,7 +6210,7 @@ var createExecutor = (config) => Effect7.gen(function* () {
       return response;
     });
   };
-  const enforceApproval = (annotations, address, args, policy, handler) => Effect7.gen(function* () {
+  const enforceApproval = (annotations, address, args, policy, handler) => Effect8.gen(function* () {
     if (policy.action === "approve") return;
     const policyForcesApproval = policy.action === "require_approval";
     if (!policyForcesApproval && !annotations?.requiresApproval) return;
@@ -6102,12 +6257,18 @@ ${approvalArgumentPreview(args)}`,
   });
   const execute = (address, args, options) => {
     const handler = pickHandler(options);
-    return Effect7.gen(function* () {
+    return Effect8.gen(function* () {
       const formatInvocationCauseMessage = (cause) => {
-        return cause instanceof Error ? cause.message : String(cause);
+        if (cause instanceof Error && cause.message.length > 0) return cause.message;
+        if (typeof cause === "object" && cause !== null) {
+          const tag = cause._tag;
+          if (typeof tag === "string") return tag;
+          return Inspectable.toStringUnknown(cause, 0);
+        }
+        return String(cause);
       };
       const wrapInvocationError = (effect) => effect.pipe(
-        Effect7.mapError(
+        Effect8.mapError(
           (cause) => new ToolInvocationError({
             address,
             message: formatInvocationCauseMessage(cause),
@@ -6232,8 +6393,18 @@ ${approvalArgumentPreview(args)}`,
         })
       );
     }).pipe(
-      Effect7.withSpan("executor.tool.execute", {
-        attributes: { "mcp.tool.name": String(address) }
+      // Expected tool failures (`ToolResult.fail`) resolve through the
+      // success channel, so the tracer alone would record them as healthy
+      // spans. Stamp the outcome + error code so telemetry can distinguish
+      // "tool ran fine" from "user hit an upstream error / auth wall"
+      // without parsing response bodies.
+      Effect8.tap(annotateToolResultOutcome),
+      Effect8.withSpan("executor.tool.execute", {
+        attributes: {
+          "mcp.tool.name": String(address),
+          "executor.tenant": tenant,
+          ...subject != null ? { "executor.subject": subject } : {}
+        }
       })
     );
   };
@@ -6253,7 +6424,7 @@ ${approvalArgumentPreview(args)}`,
     // scope set. Empty (no row / no oauth method / no declared scopes) ⇒ the
     // union collapses to the client's scopes (current behavior).
     resolveDeclaredOAuthScopes: (integration, template) => findIntegrationRow(integration).pipe(
-      Effect7.map((row) => {
+      Effect8.map((row) => {
         if (!row) return [];
         const methods = describeAuthMethodsForRow(row);
         const match = methods.find(
@@ -6330,6 +6501,7 @@ ${approvalArgumentPreview(args)}`,
         create: (input) => connectionsCreate(input),
         list: (filter) => connectionsList(filter),
         get: (ref) => connectionsGet(ref),
+        update: (ref, input) => connectionsUpdate(ref, input),
         remove: (ref) => connectionsRemove(ref),
         refresh: (ref) => connectionsRefresh(ref),
         resolveValue: (ref) => resolveConnectionValueByRef(ref)
@@ -6369,8 +6541,8 @@ ${approvalArgumentPreview(args)}`,
     runtimes.set(plugin.id, { plugin, storage, ctx });
     if (plugin.credentialProviders) {
       const raw = typeof plugin.credentialProviders === "function" ? plugin.credentialProviders(ctx) : plugin.credentialProviders;
-      const providers = Effect7.isEffect(raw) ? yield* raw.pipe(
-        Effect7.mapError(
+      const providers = Effect8.isEffect(raw) ? yield* raw.pipe(
+        Effect8.mapError(
           (cause) => pluginStorageFailure(plugin.id, "credentialProviders", cause)
         )
       ) : raw;
@@ -6379,20 +6551,20 @@ ${approvalArgumentPreview(args)}`,
       }
     }
   }
-  const close = () => Effect7.gen(function* () {
+  const close = () => Effect8.gen(function* () {
     for (const runtime of runtimes.values()) {
       if (runtime.plugin.close) {
         yield* runtime.plugin.close().pipe(
-          Effect7.mapError((cause) => pluginStorageFailure(runtime.plugin.id, "close", cause))
+          Effect8.mapError((cause) => pluginStorageFailure(runtime.plugin.id, "close", cause))
         );
       }
     }
     if (closeDb) {
       const out = closeDb();
-      if (Effect7.isEffect(out)) {
+      if (Effect8.isEffect(out)) {
         yield* out;
       } else if (out instanceof Promise) {
-        yield* Effect7.tryPromise({
+        yield* Effect8.tryPromise({
           try: () => out,
           catch: (cause) => new StorageError({
             message: "Executor database close failed",
@@ -6414,6 +6586,7 @@ ${approvalArgumentPreview(args)}`,
       create: connectionsCreate,
       list: connectionsList,
       get: connectionsGet,
+      update: connectionsUpdate,
       remove: connectionsRemove,
       refresh: connectionsRefresh
     },
@@ -6472,10 +6645,13 @@ export {
   definePluginStorageCollection,
   pluginStorageId,
   buildToolTypeScriptPreview,
+  ToolResult,
+  isToolResult,
+  annotateToolResultOutcome,
   parseToolAddress,
   connectionAddress,
   toolAddress,
   collectTables,
   createExecutor
 };
-//# sourceMappingURL=chunk-YPVKRUZV.js.map
+//# sourceMappingURL=chunk-WKKKHDH2.js.map