@das-org/dascode 0.0.36 → 0.0.37-nightly.20260831.35

package/dist/bin.mjs

@@ -17973,7 +17973,7 @@ const make$155 = () => {
 const layer$111 = sync$2(NetService, make$155);
 //#endregion
 //#region package.json
-var version$1 = "0.0.36";
+var version$1 = "0.0.37-nightly.20260831.35";
 //#endregion
 //#region ../../packages/contracts/src/baseSchemas.ts
 const TrimmedString = String$1.pipe(decodeTo(String$1, transformOrFail({
@@ -18197,7 +18197,10 @@ const ProviderAccountsMutation = Union([
 		alias: ProviderModelName
 	})
 ]);
-const ProviderOAuthStartInput = Struct({ provider: CredentialProvider });
+const ProviderOAuthStartInput = Struct({
+	provider: CredentialProvider,
+	accountId: optionalKey(ProviderAccountId)
+});
 const ProviderOAuthStartResult = Struct({
 	attemptId: ProviderOAuthAttemptId,
 	provider: CredentialProvider,
@@ -79671,7 +79674,7 @@ const getTelemetryIdentifier = suspend(() => getTelemetryIdentifierForHome(NodeO
 */
 const buildPosthogKey = "phc_tQx3z65MxLAkdmfnx39JZhVAyxW8huPzoNFKKafC3bhy".trim();
 const buildPosthogHost = "https://eu.i.posthog.com".trim();
-const buildReleaseChannel = "stable".trim();
+const buildReleaseChannel = "nightly".trim();
 const TelemetryEnvConfig = all$1({
 	posthogKey: string$4("T3CODE_POSTHOG_KEY").pipe(withDefault$3(buildPosthogKey)),
 	posthogHost: string$4("T3CODE_POSTHOG_HOST").pipe(withDefault$3(buildPosthogHost)),
@@ -93339,6 +93342,7 @@ const layer$61 = effectContext(gen(function* () {
 			provider: input.credential.provider,
 			providerAccountId: input.credential.accountId
 		});
+		if (input.expectedAccountId && (isNone(existing) || existing.value.id !== input.expectedAccountId)) return yield* providerMessageError("save credential", "The OAuth login returned a different provider account. Sign in with the account being refreshed.");
 		const timestamp = nowIso$6();
 		const id = isSome(existing) ? existing.value.id : ProviderAccountId.make(yield* crypto.randomUUIDv4);
 		yield* secrets.set(accountSecretName(id), encoder.encode(JSON.stringify(input.credential)));
@@ -93485,6 +93489,11 @@ const layer$61 = effectContext(gen(function* () {
 		return yield* list;
 	}).pipe(mapError((cause) => providerError("mutate", cause)), tap((snapshot) => publish(changes, snapshot)));
 	const startOAuth = (input) => gen(function* () {
+		if (input.accountId) {
+			const account = (yield* listAccountRows(void 0)).find((candidate) => candidate.id === input.accountId);
+			if (!account) return yield* providerMessageError("start OAuth", "The account being refreshed no longer exists in this environment.");
+			if (account.provider !== input.provider) return yield* providerMessageError("start OAuth", `A ${account.provider} account cannot be refreshed with ${input.provider} OAuth.`);
+		}
 		const attemptId = ProviderOAuthAttemptId.make(yield* crypto.randomUUIDv4);
 		const state = yield* crypto.randomUUIDv4;
 		const verifier = Buffer.from(yield* crypto.randomBytes(64)).toString("base64url");
@@ -93517,6 +93526,7 @@ const layer$61 = effectContext(gen(function* () {
 		oauthAttempts.set(attemptId, {
 			id: attemptId,
 			provider: input.provider,
+			...input.accountId ? { accountId: input.accountId } : {},
 			state,
 			verifier,
 			redirectUri,
@@ -93633,7 +93643,8 @@ const layer$61 = effectContext(gen(function* () {
 		yield* upsertCredential({
 			credential,
 			label: input.label ?? credential.email ?? `${attempt.provider} account`,
-			source: "oauth"
+			source: "oauth",
+			...attempt.accountId ? { expectedAccountId: attempt.accountId } : {}
 		});
 		return yield* list;
 	}).pipe(mapError((cause) => providerError("complete OAuth", cause)), tap((snapshot) => publish(changes, snapshot)));