Enforce WorkOS Vault style rules with oxlint

[RhysSullivan]

Summary

• split the local oxlint plugin into scripts/oxlint-plugin-executor/ with one rule module per preference
• enforce WorkOS Vault with repo-local rules for inline object assertions, tagged-error instanceof, manual _tag checks, raw throw new Error, redundant error factories, unknown shape probing, Promise-shaped client surfaces, test if statements, and direct vitest imports
• keep the WorkOS Vault public/test client surface Effect-only and make the Promise-shaped WorkOS SDK adapter type file-private
• clean the WorkOS Vault error helpers, metadata assertion, and contract test to satisfy those rules

Validation

• bun run lint
• bun run --cwd packages/plugins/workos-vault typecheck
• bunx vitest run src/sdk/secret-store.test.ts from packages/plugins/workos-vault
• bunx vitest run src/sdk/workos-vault.contract.test.ts --reporter=verbose from packages/plugins/workos-vault

[RhysSullivan]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Enforce WorkOS Vault style rules with oxlint #425 👈 (View in Graphite)
• Add shared WorkOS Vault test client #424
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	7e1858c	Commit Preview URL Branch Preview URL	Apr 28 2026, 06:01 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	7e1858c	Apr 28 2026, 06:00 AM

[pkg-pr-new]

Open in StackBlitz

@executor/sdk

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/sdk@425

@executor/plugin-file-secrets

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-file-secrets@425

@executor/plugin-google-discovery

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-google-discovery@425

@executor/plugin-graphql

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-graphql@425

@executor/plugin-keychain

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-keychain@425

@executor/plugin-mcp

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-mcp@425

@executor/plugin-oauth2

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-oauth2@425

@executor/plugin-onepassword

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-onepassword@425

@executor/plugin-openapi

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-openapi@425

@executor/plugin-workos-vault

npm i https://pkg.pr.new/RhysSullivan/executor/@executor/plugin-workos-vault@425

executor

npm i https://pkg.pr.new/RhysSullivan/executor@425

commit: 7e1858c