Function createExecutor

packages/core/sdk/src/executor.ts:1876–7087

(
  config: ExecutorConfig<TPlugins>,
)

};

export const createExecutor = <const TPlugins extends readonly AnyPlugin[] = readonly []>(
  config: ExecutorConfig<TPlugins>,
): Effect.Effect<Executor<TPlugins>, StorageFailure> =>
  Effect.gen(function* () {
    const defaultPlugins = (): TPlugins => {
      const empty: readonly AnyPlugin[] = [];
      return empty as TPlugins;
    };
    const { plugins: userPlugins = defaultPlugins() } = config;

    const tenant = String(config.tenant);
    const subject = config.subject != null ? String(config.subject) : null;

    const ownerBinding: OwnerBinding = {
      tenant: config.tenant,
      subject: config.subject ?? null,
    };

    const ownedKeys = (owner: Owner): OwnedKeys => {
      if (owner === "org") return { tenant, owner, subject: ORG_SUBJECT };
      if (subject == null) {
        // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: programmer error caught and surfaced as StorageError below by callers
        throw new StorageError({
          message: `Cannot target owner "user": executor has no subject.`,
          cause: undefined,
        });
      }
      return { tenant, owner, subject };
    };

    const requireUserSubject = (owner: Owner): Effect.Effect<void, StorageFailure> =>
      owner === "user" && subject == null
        ? Effect.fail(
            new StorageError({
              message: `Cannot target owner "user": executor has no subject.`,
              cause: undefined,
            }),
          )
        : Effect.void;

    // Workspace-settings gate (`ExecutorConfig.orgWrites`). Called at the top
    // of every user-intent workspace-level mutation: with an explicit owner it
    // refuses only `"org"` targets; with no owner it guards a tenant-shared
    // surface outright. Deliberately NOT wired into the storage owner policy —
    // operational org-row writes (token refresh, tool-catalog re-sync) must
    // keep working for a denied member.
    const guardOrgWrite = (owner?: Owner): Effect.Effect<void, OrgWriteDeniedError> =>
      Effect.gen(function* () {
        const access =
          config.orgWrites === "request" ? yield* currentOrgWriteAccess : config.orgWrites;
        if (access === "denied" && (owner === undefined || owner === "org")) {
          return yield* new OrgWriteDeniedError();
        }
      });

    // Built-in core-tools plugin: agent-facing static tools over the v2 surface.
    const plugins: readonly AnyPlugin[] = config.coreTools
      ? ([