@das-org/dascode 0.0.36 → 0.0.37-nightly.20260831.36

package/dist/bin.mjs

@@ -17973,7 +17973,7 @@ const make$155 = () => {
 const layer$111 = sync$2(NetService, make$155);
 //#endregion
 //#region package.json
-var version$1 = "0.0.36";
+var version$1 = "0.0.37-nightly.20260831.36";
 //#endregion
 //#region ../../packages/contracts/src/baseSchemas.ts
 const TrimmedString = String$1.pipe(decodeTo(String$1, transformOrFail({
@@ -18197,7 +18197,10 @@ const ProviderAccountsMutation = Union([
 		alias: ProviderModelName
 	})
 ]);
-const ProviderOAuthStartInput = Struct({ provider: CredentialProvider });
+const ProviderOAuthStartInput = Struct({
+	provider: CredentialProvider,
+	accountId: optionalKey(ProviderAccountId)
+});
 const ProviderOAuthStartResult = Struct({
 	attemptId: ProviderOAuthAttemptId,
 	provider: CredentialProvider,
@@ -18239,6 +18242,7 @@ const ProviderAccountExportResult = Struct({ files: ArraySchema(Struct({
 	content: String$1
 })) });
 const ProviderAccountQuotaRefreshInput = Struct({ accountIds: optionalKey(ArraySchema(ProviderAccountId)) });
+const ProviderAccountOAuthRefreshInput = Struct({ accountId: ProviderAccountId });
 //#endregion
 //#region ../../packages/contracts/src/providerInstance.ts
 /**
@@ -41257,6 +41261,7 @@ const WS_METHODS = {
 	providerAccountsMutate: "providerAccounts.mutate",
 	providerAccountsOAuthStart: "providerAccounts.oauth.start",
 	providerAccountsOAuthComplete: "providerAccounts.oauth.complete",
+	providerAccountsOAuthRefresh: "providerAccounts.oauth.refresh",
 	providerAccountsImport: "providerAccounts.import",
 	providerAccountsExport: "providerAccounts.export",
 	providerAccountsQuotaRefresh: "providerAccounts.quota.refresh",
@@ -41736,6 +41741,11 @@ const WsProviderAccountsOAuthCompleteRpc = make$129(WS_METHODS.providerAccountsO
 	success: ProviderAccountsSnapshot,
 	error: Union([ProviderAccountsError, EnvironmentAuthorizationError])
 });
+const WsProviderAccountsOAuthRefreshRpc = make$129(WS_METHODS.providerAccountsOAuthRefresh, {
+	payload: ProviderAccountOAuthRefreshInput,
+	success: ProviderAccountsSnapshot,
+	error: Union([ProviderAccountsError, EnvironmentAuthorizationError])
+});
 const WsProviderAccountsImportRpc = make$129(WS_METHODS.providerAccountsImport, {
 	payload: ProviderAccountImportInput,
 	success: ProviderAccountImportResult,
@@ -42007,7 +42017,7 @@ const WsOrchestrationSubscribeThreadRpc = make$129(ORCHESTRATION_WS_METHODS.subs
 	error: Union([OrchestrationGetSnapshotError, EnvironmentAuthorizationError]),
 	stream: true
 });
-const WsRpcGroup = make$128(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpdateServerWithProgressRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerGetResourceTelemetryHistoryRpc, WsServerRetryResourceTelemetryRpc, WsServerGetUsageSummaryRpc, WsServerSignalProcessRpc, WsServerReportClientActivityRpc, WsServerReportHostPowerStateRpc, WsServerGetBackgroundPolicyRpc, WsCloudGetRelayClientStatusRpc, WsCloudInstallRelayClientRpc, WsPullRequestsListRpc, WsPullRequestsListStatsRpc, WsPullRequestsDetailRpc, WsPullRequestsActivityRpc, WsPullRequestsThreadCommentsRpc, WsPullRequestsDiffFileContentsRpc, WsPullRequestsRunActionRpc, WsPullRequestsUpdateRpc, WsPullRequestsCommentRpc, WsPullRequestsUpdateCommentRpc, WsPullRequestsSubmitReviewRpc, WsPullRequestsRunQuickActionsRpc, WsPullRequestsReplyToThreadRpc, WsPullRequestsSetThreadResolutionRpc, WsPullRequestsSetReactionRpc, WsPullRequestsInvalidateRpc, WsPullRequestsReviewerCandidatesRpc, WsPullRequestsRequestReviewersRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchContentsRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsProjectRepositoryInventoryGetRpc, WsSubscribeProjectRepositoryInventoryRpc, WsProjectRepositoryPreviewRpc, WsProjectRepositoryPreviewAdoptRpc, WsProjectRepositoryMembershipSetRpc, WsProjectRepositoryMembershipRulesReplaceRpc, WsProjectRepositoryDetailsGetRpc, WsProjectRepositoryBulkPrepareRpc, WsProjectRepositoryBulkExecuteRpc, WsProjectRepositoryBulkOperationGetRpc, WsProjectRepositoryBulkCancelRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsAttachmentsCreateUploadUrlRpc, WsAttachmentsDeleteRpc, WsProviderUploadFeedbackRpc, WsProviderAccountsGetRpc, WsProviderAccountsMutateRpc, WsProviderAccountsOAuthStartRpc, WsProviderAccountsOAuthCompleteRpc, WsProviderAccountsImportRpc, WsProviderAccountsExportRpc, WsProviderAccountsQuotaRefreshRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsVcsWorkspaceStatusRpc, WsVcsWorkspacePullRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsListRepositoriesRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsVcsFileDiffRpc, WsVcsStagePathsRpc, WsVcsUnstagePathsRpc, WsVcsDiscardPathsRpc, WsReviewGetDiffPreviewRpc, WsReviewGetDiffFileContentsRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, make$129(WS_METHODS.subscribeTerminalEvents, {
+const WsRpcGroup = make$128(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpdateServerWithProgressRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerGetResourceTelemetryHistoryRpc, WsServerRetryResourceTelemetryRpc, WsServerGetUsageSummaryRpc, WsServerSignalProcessRpc, WsServerReportClientActivityRpc, WsServerReportHostPowerStateRpc, WsServerGetBackgroundPolicyRpc, WsCloudGetRelayClientStatusRpc, WsCloudInstallRelayClientRpc, WsPullRequestsListRpc, WsPullRequestsListStatsRpc, WsPullRequestsDetailRpc, WsPullRequestsActivityRpc, WsPullRequestsThreadCommentsRpc, WsPullRequestsDiffFileContentsRpc, WsPullRequestsRunActionRpc, WsPullRequestsUpdateRpc, WsPullRequestsCommentRpc, WsPullRequestsUpdateCommentRpc, WsPullRequestsSubmitReviewRpc, WsPullRequestsRunQuickActionsRpc, WsPullRequestsReplyToThreadRpc, WsPullRequestsSetThreadResolutionRpc, WsPullRequestsSetReactionRpc, WsPullRequestsInvalidateRpc, WsPullRequestsReviewerCandidatesRpc, WsPullRequestsRequestReviewersRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchContentsRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsProjectRepositoryInventoryGetRpc, WsSubscribeProjectRepositoryInventoryRpc, WsProjectRepositoryPreviewRpc, WsProjectRepositoryPreviewAdoptRpc, WsProjectRepositoryMembershipSetRpc, WsProjectRepositoryMembershipRulesReplaceRpc, WsProjectRepositoryDetailsGetRpc, WsProjectRepositoryBulkPrepareRpc, WsProjectRepositoryBulkExecuteRpc, WsProjectRepositoryBulkOperationGetRpc, WsProjectRepositoryBulkCancelRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsAttachmentsCreateUploadUrlRpc, WsAttachmentsDeleteRpc, WsProviderUploadFeedbackRpc, WsProviderAccountsGetRpc, WsProviderAccountsMutateRpc, WsProviderAccountsOAuthStartRpc, WsProviderAccountsOAuthCompleteRpc, WsProviderAccountsOAuthRefreshRpc, WsProviderAccountsImportRpc, WsProviderAccountsExportRpc, WsProviderAccountsQuotaRefreshRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsVcsWorkspaceStatusRpc, WsVcsWorkspacePullRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsListRepositoriesRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsVcsFileDiffRpc, WsVcsStagePathsRpc, WsVcsUnstagePathsRpc, WsVcsDiscardPathsRpc, WsReviewGetDiffPreviewRpc, WsReviewGetDiffFileContentsRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, make$129(WS_METHODS.subscribeTerminalEvents, {
 	payload: Struct({}),
 	success: TerminalEvent,
 	error: EnvironmentAuthorizationError,
@@ -79671,7 +79681,7 @@ const getTelemetryIdentifier = suspend(() => getTelemetryIdentifierForHome(NodeO
 */
 const buildPosthogKey = "phc_tQx3z65MxLAkdmfnx39JZhVAyxW8huPzoNFKKafC3bhy".trim();
 const buildPosthogHost = "https://eu.i.posthog.com".trim();
-const buildReleaseChannel = "stable".trim();
+const buildReleaseChannel = "nightly".trim();
 const TelemetryEnvConfig = all$1({
 	posthogKey: string$4("T3CODE_POSTHOG_KEY").pipe(withDefault$3(buildPosthogKey)),
 	posthogHost: string$4("T3CODE_POSTHOG_HOST").pipe(withDefault$3(buildPosthogHost)),
@@ -93339,6 +93349,7 @@ const layer$61 = effectContext(gen(function* () {
 			provider: input.credential.provider,
 			providerAccountId: input.credential.accountId
 		});
+		if (input.expectedAccountId && (isNone(existing) || existing.value.id !== input.expectedAccountId)) return yield* providerMessageError("save credential", "The OAuth login returned a different provider account. Sign in with the account being reconnected.");
 		const timestamp = nowIso$6();
 		const id = isSome(existing) ? existing.value.id : ProviderAccountId.make(yield* crypto.randomUUIDv4);
 		yield* secrets.set(accountSecretName(id), encoder.encode(JSON.stringify(input.credential)));
@@ -93485,6 +93496,11 @@ const layer$61 = effectContext(gen(function* () {
 		return yield* list;
 	}).pipe(mapError((cause) => providerError("mutate", cause)), tap((snapshot) => publish(changes, snapshot)));
 	const startOAuth = (input) => gen(function* () {
+		if (input.accountId) {
+			const account = (yield* listAccountRows(void 0)).find((candidate) => candidate.id === input.accountId);
+			if (!account) return yield* providerMessageError("start OAuth", "The account being reconnected no longer exists in this environment.");
+			if (account.provider !== input.provider) return yield* providerMessageError("start OAuth", `A ${account.provider} account cannot be reconnected with ${input.provider} OAuth.`);
+		}
 		const attemptId = ProviderOAuthAttemptId.make(yield* crypto.randomUUIDv4);
 		const state = yield* crypto.randomUUIDv4;
 		const verifier = Buffer.from(yield* crypto.randomBytes(64)).toString("base64url");
@@ -93517,6 +93533,7 @@ const layer$61 = effectContext(gen(function* () {
 		oauthAttempts.set(attemptId, {
 			id: attemptId,
 			provider: input.provider,
+			...input.accountId ? { accountId: input.accountId } : {},
 			state,
 			verifier,
 			redirectUri,
@@ -93633,7 +93650,8 @@ const layer$61 = effectContext(gen(function* () {
 		yield* upsertCredential({
 			credential,
 			label: input.label ?? credential.email ?? `${attempt.provider} account`,
-			source: "oauth"
+			source: "oauth",
+			...attempt.accountId ? { expectedAccountId: attempt.accountId } : {}
 		});
 		return yield* list;
 	}).pipe(mapError((cause) => providerError("complete OAuth", cause)), tap((snapshot) => publish(changes, snapshot)));
@@ -93840,20 +93858,17 @@ const layer$61 = effectContext(gen(function* () {
 			}, null, 2)
 		}] };
 	}).pipe(mapError((cause) => providerError("export credentials", cause)));
-	const refreshCredential = (account, current, force) => refreshSemaphore.withPermit(gen(function* () {
+	const refreshCredential = (account, force) => refreshSemaphore.withPermit(gen(function* () {
 		const credential = yield* readSecret(account.id);
 		const expiresAtMs = credential.expiresAt ? Date.parse(credential.expiresAt) : Number.POSITIVE_INFINITY;
 		if (!force && expiresAtMs > Date.now() + 6e4) return credential;
 		if (!credential.refreshToken) {
-			if (expiresAtMs <= Date.now() + 6e4) {
-				yield* sql`
+			if (expiresAtMs <= Date.now() + 6e4) yield* sql`
               UPDATE provider_accounts SET status = 'expired',
-                last_error = 'OAuth access token expired and has no refresh token.',
+                last_error = 'OAuth credential has no refresh token. Reconnect the account to sign in again.',
                 updated_at = ${nowIso$6()} WHERE id = ${account.id}
             `;
-				return yield* providerMessageError("refresh credential", "OAuth access token expired and has no refresh token.");
-			}
-			return current;
+			return yield* providerMessageError("refresh credential", "OAuth credential has no refresh token. Reconnect the account to sign in again.");
 		}
 		const raw = yield* tryPromise({
 			try: () => credential.provider === "codex" ? fetchJson(CODEX_TOKEN_URL, {
@@ -93899,11 +93914,16 @@ const layer$61 = effectContext(gen(function* () {
         `;
 		return refreshed;
 	}));
+	const refreshOAuth = (input) => gen(function* () {
+		const account = (yield* list).accounts.find((candidate) => candidate.id === input.accountId);
+		if (!account) return yield* providerMessageError("refresh OAuth", "The account being refreshed no longer exists in this environment.");
+		yield* refreshCredential(account, true);
+		return yield* list;
+	}).pipe(mapError((cause) => providerError("refresh OAuth", cause)), tap((snapshot) => publish(changes, snapshot)));
 	const routingMaterial = (accountId, options) => gen(function* () {
 		const account = (yield* list).accounts.find((candidate) => candidate.id === accountId);
 		if (!account) return yield* providerMessageError("read routing material", "Credential account was not found.");
-		const credential = yield* readSecret(accountId);
-		const refreshed = yield* refreshCredential(account, credential, options?.forceRefresh === true);
+		const refreshed = yield* refreshCredential(account, options?.forceRefresh === true);
 		return {
 			account: {
 				...account,
@@ -93959,6 +93979,7 @@ const layer$61 = effectContext(gen(function* () {
 		mutate,
 		startOAuth,
 		completeOAuth,
+		refreshOAuth,
 		importFiles,
 		exportFiles,
 		refreshQuota,
@@ -115233,6 +115254,7 @@ const RPC_REQUIRED_SCOPES = {
 	[WS_METHODS.providerAccountsMutate]: AuthOrchestrationOperateScope,
 	[WS_METHODS.providerAccountsOAuthStart]: AuthOrchestrationOperateScope,
 	[WS_METHODS.providerAccountsOAuthComplete]: AuthOrchestrationOperateScope,
+	[WS_METHODS.providerAccountsOAuthRefresh]: AuthOrchestrationOperateScope,
 	[WS_METHODS.providerAccountsImport]: AuthOrchestrationOperateScope,
 	[WS_METHODS.providerAccountsExport]: AuthOrchestrationOperateScope,
 	[WS_METHODS.providerAccountsQuotaRefresh]: AuthOrchestrationOperateScope,
@@ -175295,6 +175317,7 @@ const makeWsRpcLayer = (currentSession, clientOrigin, previewAutomationBroker, p
 		[WS_METHODS.providerAccountsMutate]: ({ mutation }) => observeRpcEffect$1(WS_METHODS.providerAccountsMutate, providerAccounts.mutate(mutation), { "rpc.aggregate": "provider-accounts" }),
 		[WS_METHODS.providerAccountsOAuthStart]: (input) => observeRpcEffect$1(WS_METHODS.providerAccountsOAuthStart, providerAccounts.startOAuth(input), { "rpc.aggregate": "provider-accounts" }),
 		[WS_METHODS.providerAccountsOAuthComplete]: (input) => observeRpcEffect$1(WS_METHODS.providerAccountsOAuthComplete, providerAccounts.completeOAuth(input), { "rpc.aggregate": "provider-accounts" }),
+		[WS_METHODS.providerAccountsOAuthRefresh]: (input) => observeRpcEffect$1(WS_METHODS.providerAccountsOAuthRefresh, providerAccounts.refreshOAuth(input), { "rpc.aggregate": "provider-accounts" }),
 		[WS_METHODS.providerAccountsImport]: (input) => observeRpcEffect$1(WS_METHODS.providerAccountsImport, providerAccounts.importFiles(input), { "rpc.aggregate": "provider-accounts" }),
 		[WS_METHODS.providerAccountsExport]: (input) => observeRpcEffect$1(WS_METHODS.providerAccountsExport, providerAccounts.exportFiles(input), { "rpc.aggregate": "provider-accounts" }),
 		[WS_METHODS.providerAccountsQuotaRefresh]: (input) => observeRpcEffect$1(WS_METHODS.providerAccountsQuotaRefresh, providerAccounts.refreshQuota(input), { "rpc.aggregate": "provider-accounts" }),
@@ -175662,6 +175685,7 @@ const makeEnvironmentRpcHandlerLayer = (session, clientOrigin, previewAutomation
 	mutate: () => die$1(/* @__PURE__ */ new Error("Provider accounts are unavailable in this test runtime.")),
 	startOAuth: () => die$1(/* @__PURE__ */ new Error("Provider accounts are unavailable in this test runtime.")),
 	completeOAuth: () => die$1(/* @__PURE__ */ new Error("Provider accounts are unavailable in this test runtime.")),
+	refreshOAuth: () => die$1(/* @__PURE__ */ new Error("Provider accounts are unavailable in this test runtime.")),
 	importFiles: () => die$1(/* @__PURE__ */ new Error("Provider accounts are unavailable in this test runtime.")),
 	exportFiles: () => die$1(/* @__PURE__ */ new Error("Provider accounts are unavailable in this test runtime.")),
 	refreshQuota: () => die$1(/* @__PURE__ */ new Error("Provider accounts are unavailable in this test runtime.")),