@executor-js/sdk 1.5.15 → 1.5.16

package/dist/{chunk-QEKKFEJL.js → chunk-VICUTMT6.js}

@@ -4041,6 +4041,13 @@ var looseDb = (db) => db;
 var accessItemId = (owner, integration, name) => `oauth:${owner}:${integration}:${name}`;
 var refreshItemIdFor = (accessId) => `${accessId}:refresh`;
 var dedupeScopes = (scopes) => [...new Set(scopes)];
+var recordedOAuthScope = (token, requestedScopes) => {
+  if (token.scope == null) return requestedScopes.join(" ") || null;
+  const granted = token.scope.split(/\s+/).filter(Boolean);
+  const coveredByRefreshToken = token.refresh_token && requestedScopes.includes("offline_access") ? ["offline_access"] : [];
+  const recorded = dedupeScopes([...granted, ...coveredByRefreshToken]);
+  return recorded.join(" ") || null;
+};
 var decodeJsonPayload = Schema4.decodeUnknownOption(Schema4.UnknownFromJsonString);
 var requestedScopesFromPayload = (payload) => {
   const decoded = typeof payload === "string" ? decodeJsonPayload(payload).pipe(Option2.getOrElse(() => payload)) : payload;
@@ -4516,12 +4523,11 @@ var makeOAuthService = (deps) => {
       oauthClientOwner: clientOwner,
       refreshItemId,
       expiresAt: expiresAtFrom(token),
-      // Benign fallback (kept by design): record the granted scope the AS
-      // echoed back; when it omits `scope` (some servers do), fall back to the
-      // scopes we requested (declared ∪ client). This only affects the recorded
-      // scope label, not what the token can do, so a guess here masks no
-      // misconfiguration.
-      oauthScope: token.scope ?? (requestedScopes.join(" ") || null)
+      // Record the granted scope the AS echoed back. Some providers, including
+      // Microsoft, issue a refresh token for `offline_access` but omit that
+      // non-resource scope from the token `scope` string, so preserve it when
+      // the refresh token proves it was granted.
+      oauthScope: recordedOAuthScope(token, requestedScopes)
     });
   });
   const deleteSession = (state) => deps.fuma.use(
@@ -4573,6 +4579,7 @@ var makeOAuthService = (deps) => {
 
 // src/executor.ts
 var PLUGIN_STORAGE_DELETE_KEY_BATCH_SIZE = 90;
+var PLUGIN_STORAGE_CREATE_ROW_BATCH_SIZE = 90;
 var MAX_APPROVAL_ARGUMENT_PREVIEW_CHARS = 4e3;
 var acceptAllHandler = () => Effect8.succeed(ElicitationResponse.make({ action: "accept" }));
 var resolveElicitationHandler = (onElicitation) => onElicitation === "accept-all" ? acceptAllHandler : onElicitation;
@@ -4970,20 +4977,26 @@ var makePluginStorageFacade = (input) => {
     if (uniqueEntries.length === 0) return;
     yield* deleteManyImpl(owner, os.subject, uniqueEntries);
     const now = /* @__PURE__ */ new Date();
-    yield* input.core.createMany(
-      "plugin_storage",
-      uniqueEntries.map((entry) => ({
-        tenant,
-        owner: os.owner,
-        subject: os.subject,
-        plugin_id: input.pluginId,
-        collection: entry.collection,
-        key: entry.key,
-        data: entry.data,
-        created_at: now,
-        updated_at: now
-      }))
-    );
+    for (let offset = 0; offset < uniqueEntries.length; offset += PLUGIN_STORAGE_CREATE_ROW_BATCH_SIZE) {
+      const batchEntries = uniqueEntries.slice(
+        offset,
+        offset + PLUGIN_STORAGE_CREATE_ROW_BATCH_SIZE
+      );
+      yield* input.core.createMany(
+        "plugin_storage",
+        batchEntries.map((entry) => ({
+          tenant,
+          owner: os.owner,
+          subject: os.subject,
+          plugin_id: input.pluginId,
+          collection: entry.collection,
+          key: entry.key,
+          data: entry.data,
+          created_at: now,
+          updated_at: now
+        }))
+      );
+    }
   });
   const removeManyImpl = (owner, entries) => Effect8.gen(function* () {
     const os = ownerSubject(owner);
@@ -6672,4 +6685,4 @@ export {
   collectTables,
   createExecutor
 };
-//# sourceMappingURL=chunk-QEKKFEJL.js.map
+//# sourceMappingURL=chunk-VICUTMT6.js.map