@knpkv/codecommit-core 0.18.0 → 0.19.0

package/dist/IdentityLifecycle.d.ts

@@ -0,0 +1,288 @@
+/**
+ * The caller-identity lifecycle as one state machine: the only writer of `AppState.callerIdentities`
+ * and `AppState.currentUser`. Services and handlers emit {@link IdentityEvent}s through
+ * {@link applyIdentityEvent}; nothing else writes those fields.
+ *
+ * Per profile, the state is a {@link CallerIdentityState}: Resolved, or Unresolved with a lookup reason
+ * (`CredentialsUnavailable`, `StsRejected`, `Throttled`), `RefreshAuthFailed` or `SignedOut`. A
+ * profile with no entry is absent: not enabled, or not looked up yet.
+ *
+ * **Generation rule.** `RefreshStarted`, `SignedIn` and `SignedOut` bump the generation. Every other
+ * event carries the generation of the refresh that produced it and applies only while that generation
+ * is current and its profile is enabled, so a newer refresh, login or logout makes older in-flight
+ * work a no-op.
+ *
+ * **Invariants**, after every event:
+ * - a profile with an entry is in the enabled set;
+ * - `currentUser` is the owner's (first enabled profile's) username when it is Resolved, else unset.
+ *
+ * @category Domain
+ * @module
+ */
+import { Data } from "effect";
+import type { AppState, CallerIdentityState, CallerIdentityUnresolvedReason } from "./Domain.js";
+/** The identity facts STS returns for a caller. */
+export interface ResolvedIdentity {
+    readonly accountId: string;
+    readonly arn: string;
+    readonly username: string;
+}
+/** Why a caller-identity lookup itself failed. */
+export type LookupFailureReason = Extract<CallerIdentityUnresolvedReason, {
+    readonly _tag: "CredentialsUnavailable" | "StsRejected" | "Throttled";
+}>;
+/** The identity slice of application state that {@link transition} owns. */
+export interface IdentityLifecycle {
+    readonly generation: number;
+    /** Enabled profiles in config order, as of the latest refresh. The first one is the owner. */
+    readonly enabled: ReadonlyArray<string>;
+    readonly profiles: Readonly<Record<string, CallerIdentityState>>;
+    /** Whether a resolution pass has finished since start; until then the wire field is absent. */
+    readonly firstRefreshDone: boolean;
+}
+/** Every event that changes caller identity. */
+export type IdentityEvent = Data.TaggedEnum<{
+    /** A refresh read the enabled profiles from config; it bumps the generation and returns the new one. */
+    RefreshStarted: {
+        readonly enabled: ReadonlyArray<string>;
+    };
+    LookupSucceeded: {
+        readonly generation: number;
+        readonly profile: string;
+        readonly identity: ResolvedIdentity;
+    };
+    LookupFailed: {
+        readonly generation: number;
+        readonly profile: string;
+        readonly reason: LookupFailureReason;
+    };
+    /** A refresh call for this profile hit an error saying its credentials are invalid. */
+    RefreshAuthFailed: {
+        readonly generation: number;
+        readonly profile: string;
+    };
+    ResolutionFinished: {
+        readonly generation: number;
+    };
+    /**
+     * `aws sso login` succeeded. Without an identity (its lookup failed) the session still changed, maybe
+     * to another principal: in-flight work goes stale and the profile is absent until the next refresh.
+     */
+    SignedIn: {
+        readonly profile: string;
+        readonly identity: ResolvedIdentity | undefined;
+    };
+    /** `aws sso logout` succeeded. */
+    SignedOut: {};
+}>;
+export declare const IdentityEvent: {
+    readonly $is: <Tag extends "LookupFailed" | "LookupSucceeded" | "RefreshAuthFailed" | "RefreshStarted" | "ResolutionFinished" | "SignedIn" | "SignedOut">(tag: Tag) => (u: unknown) => u is Extract<{
+        readonly _tag: "LookupFailed";
+        readonly generation: number;
+        readonly profile: string;
+        readonly reason: LookupFailureReason;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "LookupSucceeded";
+        readonly generation: number;
+        readonly profile: string;
+        readonly identity: ResolvedIdentity;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "RefreshAuthFailed";
+        readonly generation: number;
+        readonly profile: string;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "RefreshStarted";
+        readonly enabled: ReadonlyArray<string>;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "ResolutionFinished";
+        readonly generation: number;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "SignedIn";
+        readonly profile: string;
+        readonly identity: ResolvedIdentity | undefined;
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
+        readonly _tag: "SignedOut";
+    }, {
+        readonly _tag: Tag;
+    }>;
+    readonly $match: {
+        <Cases extends { readonly [Tag in "LookupFailed" | "LookupSucceeded" | "RefreshAuthFailed" | "RefreshStarted" | "ResolutionFinished" | "SignedIn" | "SignedOut"]: (args: Extract<{
+            readonly _tag: "LookupFailed";
+            readonly generation: number;
+            readonly profile: string;
+            readonly reason: LookupFailureReason;
+        } | {
+            readonly _tag: "LookupSucceeded";
+            readonly generation: number;
+            readonly profile: string;
+            readonly identity: ResolvedIdentity;
+        } | {
+            readonly _tag: "RefreshAuthFailed";
+            readonly generation: number;
+            readonly profile: string;
+        } | {
+            readonly _tag: "RefreshStarted";
+            readonly enabled: ReadonlyArray<string>;
+        } | {
+            readonly _tag: "ResolutionFinished";
+            readonly generation: number;
+        } | {
+            readonly _tag: "SignedIn";
+            readonly profile: string;
+            readonly identity: ResolvedIdentity | undefined;
+        } | {
+            readonly _tag: "SignedOut";
+        }, {
+            readonly _tag: Tag;
+        }>) => any; }>(cases: Cases): (value: {
+            readonly _tag: "LookupFailed";
+            readonly generation: number;
+            readonly profile: string;
+            readonly reason: LookupFailureReason;
+        } | {
+            readonly _tag: "LookupSucceeded";
+            readonly generation: number;
+            readonly profile: string;
+            readonly identity: ResolvedIdentity;
+        } | {
+            readonly _tag: "RefreshAuthFailed";
+            readonly generation: number;
+            readonly profile: string;
+        } | {
+            readonly _tag: "RefreshStarted";
+            readonly enabled: ReadonlyArray<string>;
+        } | {
+            readonly _tag: "ResolutionFinished";
+            readonly generation: number;
+        } | {
+            readonly _tag: "SignedIn";
+            readonly profile: string;
+            readonly identity: ResolvedIdentity | undefined;
+        } | {
+            readonly _tag: "SignedOut";
+        }) => import("effect/Unify").Unify<ReturnType<Cases["LookupFailed" | "LookupSucceeded" | "RefreshAuthFailed" | "RefreshStarted" | "ResolutionFinished" | "SignedIn" | "SignedOut"]>>;
+        <Cases extends { readonly [Tag in "LookupFailed" | "LookupSucceeded" | "RefreshAuthFailed" | "RefreshStarted" | "ResolutionFinished" | "SignedIn" | "SignedOut"]: (args: Extract<{
+            readonly _tag: "LookupFailed";
+            readonly generation: number;
+            readonly profile: string;
+            readonly reason: LookupFailureReason;
+        } | {
+            readonly _tag: "LookupSucceeded";
+            readonly generation: number;
+            readonly profile: string;
+            readonly identity: ResolvedIdentity;
+        } | {
+            readonly _tag: "RefreshAuthFailed";
+            readonly generation: number;
+            readonly profile: string;
+        } | {
+            readonly _tag: "RefreshStarted";
+            readonly enabled: ReadonlyArray<string>;
+        } | {
+            readonly _tag: "ResolutionFinished";
+            readonly generation: number;
+        } | {
+            readonly _tag: "SignedIn";
+            readonly profile: string;
+            readonly identity: ResolvedIdentity | undefined;
+        } | {
+            readonly _tag: "SignedOut";
+        }, {
+            readonly _tag: Tag;
+        }>) => any; }>(value: {
+            readonly _tag: "LookupFailed";
+            readonly generation: number;
+            readonly profile: string;
+            readonly reason: LookupFailureReason;
+        } | {
+            readonly _tag: "LookupSucceeded";
+            readonly generation: number;
+            readonly profile: string;
+            readonly identity: ResolvedIdentity;
+        } | {
+            readonly _tag: "RefreshAuthFailed";
+            readonly generation: number;
+            readonly profile: string;
+        } | {
+            readonly _tag: "RefreshStarted";
+            readonly enabled: ReadonlyArray<string>;
+        } | {
+            readonly _tag: "ResolutionFinished";
+            readonly generation: number;
+        } | {
+            readonly _tag: "SignedIn";
+            readonly profile: string;
+            readonly identity: ResolvedIdentity | undefined;
+        } | {
+            readonly _tag: "SignedOut";
+        }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["LookupFailed" | "LookupSucceeded" | "RefreshAuthFailed" | "RefreshStarted" | "ResolutionFinished" | "SignedIn" | "SignedOut"]>>;
+    };
+    readonly LookupFailed: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "LookupFailed";
+        readonly generation: number;
+        readonly profile: string;
+        readonly reason: LookupFailureReason;
+    }, "_tag">;
+    readonly LookupSucceeded: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "LookupSucceeded";
+        readonly generation: number;
+        readonly profile: string;
+        readonly identity: ResolvedIdentity;
+    }, "_tag">;
+    readonly RefreshAuthFailed: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RefreshAuthFailed";
+        readonly generation: number;
+        readonly profile: string;
+    }, "_tag">;
+    readonly RefreshStarted: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RefreshStarted";
+        readonly enabled: ReadonlyArray<string>;
+    }, "_tag">;
+    readonly ResolutionFinished: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "ResolutionFinished";
+        readonly generation: number;
+    }, "_tag">;
+    readonly SignedIn: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "SignedIn";
+        readonly profile: string;
+        readonly identity: ResolvedIdentity | undefined;
+    }, "_tag">;
+    readonly SignedOut: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "SignedOut";
+    }, "_tag">;
+};
+export declare const initialIdentityLifecycle: IdentityLifecycle;
+/** The single transition function over the lifecycle table. */
+export declare const transition: (s: IdentityLifecycle, event: IdentityEvent) => IdentityLifecycle;
+/** The owner's username when its identity is resolved: the only source of `currentUser`. */
+export declare const currentUserOf: (s: IdentityLifecycle) => string | undefined;
+/** Apply one event and project the identity slice onto the application state it owns. */
+export declare const applyIdentityEvent: (state: AppState, event: IdentityEvent) => AppState;
+/**
+ * Start a refresh over the enabled profiles: apply `RefreshStarted` and return the new generation,
+ * which every event this refresh produces must carry. For use with `SubscriptionRef.modify`.
+ */
+export declare const startRefresh: (state: AppState, enabled: ReadonlyArray<string>) => readonly [number, AppState];
+/**
+ * A login that just succeeded, before its identity is known: apply `SignedIn` without an identity and
+ * return the new generation. The identity found afterwards is applied as a `LookupSucceeded` of that
+ * generation, so a logout during the lookup still wins. For use with `SubscriptionRef.modify`.
+ */
+export declare const beginSignIn: (state: AppState, profile: string) => readonly [number, AppState];
+/** The state after a successful SSO login to one account, with its identity when the lookup found it. */
+export declare const signInState: (state: AppState, profile: string, identity: ResolvedIdentity | undefined) => AppState;
+/** The state after a successful SSO logout, which ends every SSO session. */
+export declare const signOutState: (state: AppState) => AppState;
+//# sourceMappingURL=IdentityLifecycle.d.ts.map

package/dist/IdentityLifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityLifecycle.d.ts","sourceRoot":"","sources":["../src/IdentityLifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,IAAI,EAAS,MAAM,QAAQ,CAAA;AACpC,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAA;AAEhG,mDAAmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,kDAAkD;AAClD,MAAM,MAAM,mBAAmB,GAAG,OAAO,CACvC,8BAA8B,EAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,wBAAwB,GAAG,aAAa,GAAG,WAAW,CAAA;CAAE,CAC1E,CAAA;AAED,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAA;IAChE,+FAA+F;IAC/F,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;CACnC;AAED,gDAAgD;AAChD,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC;IAC1C,wGAAwG;IACxG,cAAc,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;KAAE,CAAA;IAC3D,eAAe,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;KAAE,CAAA;IAC/G,YAAY,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;KAAE,CAAA;IAC7G,uFAAuF;IACvF,iBAAiB,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5E,kBAAkB,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD;;;OAGG;IACH,QAAQ,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,CAAA;KAAE,CAAA;IACvF,kCAAkC;IAClC,SAAS,EAAE,EAAE,CAAA;CACd,CAAC,CAAA;AAEF,eAAO,MAAM,aAAa;;;6BAba,MAAM;0BAAoB,MAAM;yBAAmB,mBAAmB;;;;;6BADnE,MAAM;0BAAoB,MAAM;2BAAqB,gBAAgB;;;;;6BAGnE,MAAM;0BAAoB,MAAM;;;;;0BAJtC,aAAa,CAAC,MAAM,CAAC;;;;;6BAKd,MAAM;;;;;0BAKnB,MAAM;2BAAqB,gBAAgB,GAAG,SAAS;;;;;;;;;;;iCARhD,MAAM;8BAAoB,MAAM;6BAAmB,mBAAmB;;;iCADnE,MAAM;8BAAoB,MAAM;+BAAqB,gBAAgB;;;iCAGnE,MAAM;8BAAoB,MAAM;;;8BAJtC,aAAa,CAAC,MAAM,CAAC;;;iCAKd,MAAM;;;8BAKnB,MAAM;+BAAqB,gBAAgB,GAAG,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCARhD,MAAM;8BAAoB,MAAM;6BAAmB,mBAAmB;;;iCADnE,MAAM;8BAAoB,MAAM;+BAAqB,gBAAgB;;;iCAGnE,MAAM;8BAAoB,MAAM;;;8BAJtC,aAAa,CAAC,MAAM,CAAC;;;iCAKd,MAAM;;;8BAKnB,MAAM;+BAAqB,gBAAgB,GAAG,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BARhD,MAAM;0BAAoB,MAAM;yBAAmB,mBAAmB;;;;6BADnE,MAAM;0BAAoB,MAAM;2BAAqB,gBAAgB;;;;6BAGnE,MAAM;0BAAoB,MAAM;;;;0BAJtC,aAAa,CAAC,MAAM,CAAC;;;;6BAKd,MAAM;;;;0BAKnB,MAAM;2BAAqB,gBAAgB,GAAG,SAAS;;;;;CAK1B,CAAA;AAE7D,eAAO,MAAM,wBAAwB,EAAE,iBAKtC,CAAA;AAmBD,+DAA+D;AAC/D,eAAO,MAAM,UAAU,MAAO,iBAAiB,SAAS,aAAa,KAAG,iBAqCpE,CAAA;AAEJ,4FAA4F;AAC5F,eAAO,MAAM,aAAa,MAAO,iBAAiB,KAAG,MAAM,GAAG,SAI7D,CAAA;AAmBD,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,UAAW,QAAQ,SAAS,aAAa,KAAG,QACa,CAAA;AAExF;;;GAGG;AACH,eAAO,MAAM,YAAY,UAAW,QAAQ,WAAW,aAAa,CAAC,MAAM,CAAC,KAAG,SAAS,CAAC,MAAM,EAAE,QAAQ,CAMxG,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,WAAW,UAAW,QAAQ,WAAW,MAAM,KAAG,SAAS,CAAC,MAAM,EAAE,QAAQ,CAMxF,CAAA;AAED,yGAAyG;AACzG,eAAO,MAAM,WAAW,UAAW,QAAQ,WAAW,MAAM,YAAY,gBAAgB,GAAG,SAAS,KAAG,QAC7B,CAAA;AAE1E,6EAA6E;AAC7E,eAAO,MAAM,YAAY,UAAW,QAAQ,KAAG,QAAgE,CAAA"}

package/dist/IdentityLifecycle.js

@@ -0,0 +1,125 @@
+/**
+ * The caller-identity lifecycle as one state machine: the only writer of `AppState.callerIdentities`
+ * and `AppState.currentUser`. Services and handlers emit {@link IdentityEvent}s through
+ * {@link applyIdentityEvent}; nothing else writes those fields.
+ *
+ * Per profile, the state is a {@link CallerIdentityState}: Resolved, or Unresolved with a lookup reason
+ * (`CredentialsUnavailable`, `StsRejected`, `Throttled`), `RefreshAuthFailed` or `SignedOut`. A
+ * profile with no entry is absent: not enabled, or not looked up yet.
+ *
+ * **Generation rule.** `RefreshStarted`, `SignedIn` and `SignedOut` bump the generation. Every other
+ * event carries the generation of the refresh that produced it and applies only while that generation
+ * is current and its profile is enabled, so a newer refresh, login or logout makes older in-flight
+ * work a no-op.
+ *
+ * **Invariants**, after every event:
+ * - a profile with an entry is in the enabled set;
+ * - `currentUser` is the owner's (first enabled profile's) username when it is Resolved, else unset.
+ *
+ * @category Domain
+ * @module
+ */
+import { Data, Match } from "effect";
+export const IdentityEvent = Data.taggedEnum();
+export const initialIdentityLifecycle = {
+    generation: 0,
+    enabled: [],
+    profiles: {},
+    firstRefreshDone: false
+};
+const resolvedState = (identity) => ({ _tag: "Resolved", ...identity });
+const unresolvedState = (reason) => ({
+    _tag: "Unresolved",
+    reason
+});
+const signedOut = unresolvedState({ _tag: "SignedOut" });
+const refreshAuthFailed = unresolvedState({ _tag: "RefreshAuthFailed" });
+const withProfile = (s, profile, next) => ({
+    ...s,
+    profiles: { ...s.profiles, [profile]: next }
+});
+/** A stamped event applies only while its generation is current and, when it names one, its profile is enabled. */
+const applies = (s, generation, profile) => generation === s.generation && (profile === undefined || s.enabled.includes(profile));
+/** The single transition function over the lifecycle table. */
+export const transition = (s, event) => Match.valueTags(event, {
+    RefreshStarted: ({ enabled }) => ({
+        ...s,
+        generation: s.generation + 1,
+        enabled,
+        profiles: Object.fromEntries(Object.entries(s.profiles).filter(([profile]) => enabled.includes(profile)))
+    }),
+    LookupSucceeded: ({ generation, identity, profile }) => applies(s, generation, profile) ? withProfile(s, profile, resolvedState(identity)) : s,
+    LookupFailed: ({ generation, profile, reason }) => {
+        if (!applies(s, generation, profile))
+            return s;
+        // After a logout, failing for lack of credentials is the logout's expected result, not news.
+        const current = s.profiles[profile];
+        const staysSignedOut = current?._tag === "Unresolved" && current.reason._tag === "SignedOut" &&
+            reason._tag === "CredentialsUnavailable";
+        return staysSignedOut ? s : withProfile(s, profile, unresolvedState(reason));
+    },
+    RefreshAuthFailed: ({ generation, profile }) => applies(s, generation, profile) && s.profiles[profile]?._tag === "Resolved"
+        ? withProfile(s, profile, refreshAuthFailed)
+        : s,
+    ResolutionFinished: ({ generation }) => applies(s, generation) ? { ...s, firstRefreshDone: true } : s,
+    SignedIn: ({ identity, profile }) => {
+        const bumped = { ...s, generation: s.generation + 1 };
+        if (!s.enabled.includes(profile))
+            return bumped;
+        if (identity !== undefined)
+            return withProfile(bumped, profile, resolvedState(identity));
+        // The old identity may belong to the previous principal, so it is not kept.
+        const { [profile]: _, ...rest } = bumped.profiles;
+        return { ...bumped, profiles: rest };
+    },
+    SignedOut: () => ({
+        ...s,
+        generation: s.generation + 1,
+        // Every enabled account is signed out, including one whose first lookup is still in flight.
+        profiles: Object.fromEntries(s.enabled.map((profile) => [profile, signedOut]))
+    })
+});
+/** The owner's username when its identity is resolved: the only source of `currentUser`. */
+export const currentUserOf = (s) => {
+    const owner = s.enabled[0];
+    const identity = owner === undefined ? undefined : s.profiles[owner];
+    return identity?._tag === "Resolved" ? identity.username : undefined;
+};
+/** The wire field: absent until something is known or a resolution pass has finished. */
+const callerIdentitiesOf = (s) => s.firstRefreshDone || Object.keys(s.profiles).length > 0 ? s.profiles : undefined;
+/** Project the identity slice onto the application state fields it owns. */
+const project = (state, lifecycle) => {
+    const { callerIdentities: _, currentUser: __, ...rest } = state;
+    const callerIdentities = callerIdentitiesOf(lifecycle);
+    const currentUser = currentUserOf(lifecycle);
+    return {
+        ...rest,
+        identityLifecycle: lifecycle,
+        ...(callerIdentities !== undefined && { callerIdentities }),
+        ...(currentUser !== undefined && { currentUser })
+    };
+};
+/** Apply one event and project the identity slice onto the application state it owns. */
+export const applyIdentityEvent = (state, event) => project(state, transition(state.identityLifecycle ?? initialIdentityLifecycle, event));
+/**
+ * Start a refresh over the enabled profiles: apply `RefreshStarted` and return the new generation,
+ * which every event this refresh produces must carry. For use with `SubscriptionRef.modify`.
+ */
+export const startRefresh = (state, enabled) => {
+    const lifecycle = transition(state.identityLifecycle ?? initialIdentityLifecycle, IdentityEvent.RefreshStarted({ enabled }));
+    return [lifecycle.generation, project(state, lifecycle)];
+};
+/**
+ * A login that just succeeded, before its identity is known: apply `SignedIn` without an identity and
+ * return the new generation. The identity found afterwards is applied as a `LookupSucceeded` of that
+ * generation, so a logout during the lookup still wins. For use with `SubscriptionRef.modify`.
+ */
+export const beginSignIn = (state, profile) => {
+    const lifecycle = transition(state.identityLifecycle ?? initialIdentityLifecycle, IdentityEvent.SignedIn({ profile, identity: undefined }));
+    return [lifecycle.generation, project(state, lifecycle)];
+};
+/** The state after a successful SSO login to one account, with its identity when the lookup found it. */
+export const signInState = (state, profile, identity) => applyIdentityEvent(state, IdentityEvent.SignedIn({ profile, identity }));
+/** The state after a successful SSO logout, which ends every SSO session. */
+export const signOutState = (state) => applyIdentityEvent(state, IdentityEvent.SignedOut());
+//# sourceMappingURL=IdentityLifecycle.js.map

package/dist/IdentityLifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityLifecycle.js","sourceRoot":"","sources":["../src/IdentityLifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AA4CpC,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAiB,CAAA;AAE7D,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,UAAU,EAAE,CAAC;IACb,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,EAAE;IACZ,gBAAgB,EAAE,KAAK;CACxB,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,QAA0B,EAAuB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAA;AAC9G,MAAM,eAAe,GAAG,CAAC,MAAsC,EAAuB,EAAE,CAAC,CAAC;IACxF,IAAI,EAAE,YAAY;IAClB,MAAM;CACP,CAAC,CAAA;AACF,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;AACxD,MAAM,iBAAiB,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAA;AAExE,MAAM,WAAW,GAAG,CAAC,CAAoB,EAAE,OAAe,EAAE,IAAyB,EAAqB,EAAE,CAAC,CAAC;IAC5G,GAAG,CAAC;IACJ,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;CAC7C,CAAC,CAAA;AAEF,mHAAmH;AACnH,MAAM,OAAO,GAAG,CAAC,CAAoB,EAAE,UAAkB,EAAE,OAAgB,EAAW,EAAE,CACtF,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;AAEvF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAoB,EAAE,KAAoB,EAAqB,EAAE,CAC1F,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE;IACrB,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,EAAqB,EAAE,CAAC,CAAC;QACnD,GAAG,CAAC;QACJ,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC;QAC5B,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;KAC1G,CAAC;IACF,eAAe,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CACrD,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAChD,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC;YAAE,OAAO,CAAC,CAAA;QAC9C,6FAA6F;QAC7F,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACnC,MAAM,cAAc,GAAG,OAAO,EAAE,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW;YAC1F,MAAM,CAAC,IAAI,KAAK,wBAAwB,CAAA;QAC1C,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAA;IAC9E,CAAC;IACD,iBAAiB,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7C,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,UAAU;QACzE,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC;QAC5C,CAAC,CAAC,CAAC;IACP,kBAAkB,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrG,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC,EAAE,CAAA;QACrD,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,MAAM,CAAA;QAC/C,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;QACxF,4EAA4E;QAC5E,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAA;QACjD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IACtC,CAAC;IACD,SAAS,EAAE,GAAsB,EAAE,CAAC,CAAC;QACnC,GAAG,CAAC;QACJ,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC;QAC5B,4FAA4F;QAC5F,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;KAC/E,CAAC;CACH,CAAC,CAAA;AAEJ,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAoB,EAAsB,EAAE;IACxE,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC1B,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpE,OAAO,QAAQ,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;AACtE,CAAC,CAAA;AAED,yFAAyF;AACzF,MAAM,kBAAkB,GAAG,CAAC,CAAoB,EAAgC,EAAE,CAChF,CAAC,CAAC,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;AAEnF,4EAA4E;AAC5E,MAAM,OAAO,GAAG,CAAC,KAAe,EAAE,SAA4B,EAAY,EAAE;IAC1E,MAAM,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAA;IAC/D,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;IACtD,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;IAC5C,OAAO;QACL,GAAG,IAAI;QACP,iBAAiB,EAAE,SAAS;QAC5B,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAC3D,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;KAClD,CAAA;AACH,CAAC,CAAA;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAe,EAAE,KAAoB,EAAY,EAAE,CACpF,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,iBAAiB,IAAI,wBAAwB,EAAE,KAAK,CAAC,CAAC,CAAA;AAExF;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAe,EAAE,OAA8B,EAA+B,EAAE;IAC3G,MAAM,SAAS,GAAG,UAAU,CAC1B,KAAK,CAAC,iBAAiB,IAAI,wBAAwB,EACnD,aAAa,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAC1C,CAAA;IACD,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;AAC1D,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAe,EAAE,OAAe,EAA+B,EAAE;IAC3F,MAAM,SAAS,GAAG,UAAU,CAC1B,KAAK,CAAC,iBAAiB,IAAI,wBAAwB,EACnD,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CACzD,CAAA;IACD,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;AAC1D,CAAC,CAAA;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAe,EAAE,OAAe,EAAE,QAAsC,EAAY,EAAE,CAChH,kBAAkB,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;AAE1E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAe,EAAY,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,EAAE,CAAC,CAAA"}

package/dist/PRService/refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/PRService/refresh.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAmB,MAAM,EAA8C,MAAM,QAAQ,CAAA;AAC5F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEtD,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAA;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAA;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAA;AAChF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAA;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAE9D,OAAO,EAAkB,KAAK,OAAO,EAAE,MAAM,eAAe,CAAA;AA8C5D,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,SAAS,GACT,eAAe,GACf,WAAW,GACX,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,SAAS,CAAA;AAEb,eAAO,MAAM,WAAW,gLAoEvB,CAAA"}
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/PRService/refresh.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAmB,MAAM,EAA8C,MAAM,QAAQ,CAAA;AAC5F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEtD,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAA;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAA;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAA;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAA;AAChF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAA;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAE9D,OAAO,EAAkB,KAAK,OAAO,EAAE,MAAM,eAAe,CAAA;AA8C5D,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,SAAS,GACT,eAAe,GACf,WAAW,GACX,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,SAAS,CAAA;AAEb,eAAO,MAAM,WAAW,gLAqEvB,CAAA"}

package/dist/PRService/refresh.js

@@ -46,7 +46,7 @@ export const makeRefresh = Effect.fn("PRService.refresh")(function* (state) {
     const resolved = yield* resolveAccounts(state);
     if (resolved === undefined)
         return;
-    const { accountIdMap, currentUser, enabledAccounts, subscribedRef } = resolved;
+    const { accountIdMap, currentUser, enabledAccounts, identityGeneration, subscribedRef } = resolved;
     const staleNow = yield* Clock.currentTimeMillis;
     const staleThreshold = DateTime.toDate(DateTime.makeUnsafe(staleNow)).toISOString().slice(0, 19) + "Z";
     const { published, scopes: successfulRefreshScopes } = yield* hub.batch(Effect.gen(function* () {
@@ -56,6 +56,7 @@ export const makeRefresh = Effect.fn("PRService.refresh")(function* (state) {
             accountIdMap,
             subscribedRef,
             currentUser,
+            identityGeneration,
             staleThreshold
         });
         yield* enrichComments({ state, subscribedRef });

package/dist/PRService/refresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../src/PRService/refresh.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AAG5F,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAA;AAGxD,OAAO,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAA;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAA;AAG5E,OAAO,EAAE,cAAc,EAAgB,MAAM,eAAe,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEpG,MAAM,UAAU,GAAc,MAAM,CAAA;AACpC,MAAM,WAAW,GAAc,OAAO,CAAA;AAEtC,MAAM,mBAAmB,GAAG,CAAgB,KAAoB,EAAU,EAAE,CAC1E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,CAAC,IAAI,CAChG,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CACxC,CAAA;AAEH,MAAM,wBAAwB,GAAG,CAAgB,KAAc,EAAE,KAAoB,EAAE,EAAE,CACvF,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1C,GAAG,OAAO;IACV,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;CAClC,CAAC,CAAC,CAAA;AAEL;;;;;;;;GAQG;AACH,MAAM,yBAAyB,GAAG,CAChC,KAAc,EACuD,EAAE,CACvE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,eAAe,CAAA;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;IACpC,sEAAsE;IACtE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAA;IAC7C,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAA;IACpG,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAA;IACjF,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA;AAYJ,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CACvD,QAAQ,CAAC,EAAC,KAAc;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAA;IAC5B,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAA;IAEhD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAM;IAElC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,QAAQ,CAAA;IAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC/C,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAA;IAEtG,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CACrE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;YACtC,KAAK;YACL,eAAe;YACf,YAAY;YACZ,aAAa;YACb,WAAW;YACX,cAAc;SACf,CAAC,CAAA;QACF,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAA;QAC/C,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QACzB,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACnC,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAA;QACzD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC,CAAC,CACH,CAAA;IAED,6EAA6E;IAC7E,oEAAoE;IACpE,+CAA+C;IAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC1C,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC;QACJ,MAAM,EAAE,UAAU;QAClB,GAAG,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,EAAE;YACrF,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;KACjC,CAAC,CAAC,CAAA;IAEH,gBAAgB;IAChB,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,eAAe,EACf,CAAC,OAAO,EAAE,EAAE;QACV,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAA;QACzE,OAAO,MAAM,CAAC,OAAO,CACnB,OAAO,CAAC,OAAO,IAAI,EAAE,EACrB,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,EACzD,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAA;IACH,CAAC,EACD,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;AACvD,CAAC,EACD,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAChB,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAC7B,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAC/D,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAC1B,MAAM,CAAC,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,IAAI,CACtD,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CACxD,CACF,CACF,CACJ,CAAA"}
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../src/PRService/refresh.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AAG5F,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAA;AAGxD,OAAO,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAA;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAA;AAG5E,OAAO,EAAE,cAAc,EAAgB,MAAM,eAAe,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEpG,MAAM,UAAU,GAAc,MAAM,CAAA;AACpC,MAAM,WAAW,GAAc,OAAO,CAAA;AAEtC,MAAM,mBAAmB,GAAG,CAAgB,KAAoB,EAAU,EAAE,CAC1E,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,CAAC,IAAI,CAChG,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CACxC,CAAA;AAEH,MAAM,wBAAwB,GAAG,CAAgB,KAAc,EAAE,KAAoB,EAAE,EAAE,CACvF,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1C,GAAG,OAAO;IACV,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;CAClC,CAAC,CAAC,CAAA;AAEL;;;;;;;;GAQG;AACH,MAAM,yBAAyB,GAAG,CAChC,KAAc,EACuD,EAAE,CACvE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,eAAe,CAAA;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;IACpC,sEAAsE;IACtE,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAAA;IAC7C,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAA;IACpG,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAA;IACjF,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA;AAYJ,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CACvD,QAAQ,CAAC,EAAC,KAAc;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAA;IAC5B,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAA;IAEhD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC9C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAM;IAElC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,GAAG,QAAQ,CAAA;IAClG,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC/C,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAA;IAEtG,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,CACrE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;YACtC,KAAK;YACL,eAAe;YACf,YAAY;YACZ,aAAa;YACb,WAAW;YACX,kBAAkB;YAClB,cAAc;SACf,CAAC,CAAA;QACF,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAA;QAC/C,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QACzB,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACnC,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAA;QACzD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC9B,CAAC,CAAC,CACH,CAAA;IAED,6EAA6E;IAC7E,oEAAoE;IACpE,+CAA+C;IAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;IAC1C,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC;QACJ,MAAM,EAAE,UAAU;QAClB,GAAG,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,EAAE;YACrF,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;KACjC,CAAC,CAAC,CAAA;IAEH,gBAAgB;IAChB,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,eAAe,EACf,CAAC,OAAO,EAAE,EAAE;QACV,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAA;QACzE,OAAO,MAAM,CAAC,OAAO,CACnB,OAAO,CAAC,OAAO,IAAI,EAAE,EACrB,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,EACzD,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAA;IACH,CAAC,EACD,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;AACvD,CAAC,EACD,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAChB,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAC7B,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAC/D,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAC1B,MAAM,CAAC,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,IAAI,CACtD,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CACxD,CACF,CACF,CACJ,CAAA"}

package/dist/PRService/refreshFetch.d.ts

@@ -20,6 +20,8 @@ export declare const fetchAndUpsertPRs: (params: {
     readonly accountIdMap: Map<string, string>;
     readonly subscribedRef: Ref.Ref<Set<string>>;
     readonly currentUser: string | undefined;
+    /** The refresh's identity generation, from `resolveAccounts`. */
+    readonly identityGeneration: number;
     readonly staleThreshold: string;
 }) => Effect.Effect<ReadonlyArray<PullRequestRefreshScope>, never, AwsClient | PullRequestRepo | NotificationRepo | SubscriptionRepo>;
 //# sourceMappingURL=refreshFetch.d.ts.map

package/dist/PRService/refreshFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refreshFetch.d.ts","sourceRoot":"","sources":["../../src/PRService/refreshFetch.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAuB,MAAM,EAAqB,GAAG,EAA2B,MAAM,QAAQ,CAAA;AACrG,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAIjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAA;AAC5E,OAAO,EAEL,eAAe,EAEhB,MAAM,gDAAgD,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAA;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AACjE,OAAO,KAAK,EAAE,uBAAuB,EAA0B,MAAM,cAAc,CAAA;AAEnF,OAAO,EAAE,KAAK,OAAO,EAAmB,MAAM,eAAe,CAAA;AAqC7D,eAAO,MAAM,iBAAiB,WAAY;IACxC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;IACtD,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC,KAAG,MAAM,CAAC,MAAM,CACf,aAAa,CAAC,uBAAuB,CAAC,EACtC,KAAK,EACL,SAAS,GAAG,eAAe,GAAG,gBAAgB,GAAG,gBAAgB,CA0ShE,CAAA"}
+{"version":3,"file":"refreshFetch.d.ts","sourceRoot":"","sources":["../../src/PRService/refreshFetch.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAuB,MAAM,EAAqB,GAAG,EAA2B,MAAM,QAAQ,CAAA;AACrG,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAKjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAA;AAC5E,OAAO,EAEL,eAAe,EAEhB,MAAM,gDAAgD,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAA;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AACjE,OAAO,KAAK,EAAE,uBAAuB,EAA0B,MAAM,cAAc,CAAA;AAGnF,OAAO,EAAE,KAAK,OAAO,EAAmB,MAAM,eAAe,CAAA;AAiD7D,eAAO,MAAM,iBAAiB,WAAY;IACxC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,aAAa,CAAC,CAAA;IACtD,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,iEAAiE;IACjE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC,KAAG,MAAM,CAAC,MAAM,CACf,aAAa,CAAC,uBAAuB,CAAC,EACtC,KAAK,EACL,SAAS,GAAG,eAAe,GAAG,gBAAgB,GAAG,gBAAgB,CAuThE,CAAA"}

package/dist/PRService/refreshFetch.js

@@ -8,12 +8,22 @@
  */
 import { Array as Arr, Cause, Effect, Option, Predicate, Ref, Stream, SubscriptionRef } from "effect";
 import { AwsClient } from "../AwsClient/index.js";
+import { isCredentialInvalidCause } from "../AwsCredentialErrors.js";
 import { diffApprovalPools, diffPR } from "../CacheService/diff.js";
 import { NotificationRepo } from "../CacheService/repos/NotificationRepo.js";
 import { PullRequestRepo } from "../CacheService/repos/PullRequestRepo/index.js";
 import { SubscriptionRepo } from "../CacheService/repos/SubscriptionRepo.js";
+import { applyIdentityEvent, IdentityEvent } from "../IdentityLifecycle.js";
 import { prToUpsertInput } from "./internal.js";
 import { isSubscribedForCoordinates, subscriptionKey } from "./refreshResolve.js";
+/**
+ * Whether a refresh failure means the account's credentials no longer work, decided from its type: a
+ * credential failure, or a provider error saying so, directly or inside a failed approval evaluation.
+ */
+const isAuthFailure = (error) => error._tag === "AwsCredentialError" ||
+    (error._tag === "AwsApiError" && (isCredentialInvalidCause(error.cause) ||
+        (Predicate.isTagged(error.cause, "ApprovalEvaluationError") && Predicate.hasProperty(error.cause, "cause") &&
+            isCredentialInvalidCause(error.cause.cause))));
 /** A pull-request read that failed only because its approval rules could not be evaluated. */
 const failedOnlyOnApprovalEvaluation = (error) => error._tag === "AwsApiError" && Predicate.isTagged(error.cause, "ApprovalEvaluationError");
 /** The evaluation failure's own message, which names the operation and the provider's reason. */
@@ -31,7 +41,7 @@ export const fetchAndUpsertPRs = (params) => Effect.gen(function* () {
     const prRepo = yield* PullRequestRepo;
     const notificationRepo = yield* NotificationRepo;
     const subscriptionRepo = yield* SubscriptionRepo;
-    const { accountIdMap, currentUser, enabledAccounts, staleThreshold, state, subscribedRef } = params;
+    const { accountIdMap, currentUser, enabledAccounts, identityGeneration, staleThreshold, state, subscribedRef } = params;
     // Stale rows are safe to reconcile only when their owning list operation
     // completed successfully. A failed account stream says nothing about which
     // cached PRs remain open and must never turn into cache deletion.
@@ -49,6 +59,9 @@ export const fetchAndUpsertPRs = (params) => Effect.gen(function* () {
         next.delete(accountRegionKey(profile, region));
         return next;
     });
+    // The account's credentials stopped working during this refresh: an identity event of this
+    // refresh's generation, so it does nothing once a newer refresh, login or logout has happened.
+    const markAuthFailed = (profile) => SubscriptionRef.update(state, (s) => applyIdentityEvent(s, IdentityEvent.RefreshAuthFailed({ generation: identityGeneration, profile })));
     const accountLabels = enabledAccounts.flatMap((a) => (a.regions ?? []).map((r) => `${a.profile}(${r})`));
     yield* SubscriptionRef.update(state, (s) => ({
         ...s,
@@ -67,7 +80,8 @@ export const fetchAndUpsertPRs = (params) => Effect.gen(function* () {
                 region,
                 cause: causeStr
             });
-            const isAuthError = /ExpiredToken|Unauthorized|AuthFailure|credentials/i.test(causeStr);
+            const isAuthError = isAuthFailure(error) ||
+                /ExpiredToken|Unauthorized|AuthFailure|credentials/i.test(causeStr);
             return Stream.fromEffectDrain(Effect.gen(function* () {
                 yield* Ref.update(successfullyFetchedScopes, (scopes) => {
                     const next = new Set(scopes);
@@ -81,9 +95,9 @@ export const fetchAndUpsertPRs = (params) => Effect.gen(function* () {
                     profile: account.profile,
                     deduplicate: true
                 }).pipe(Effect.catch(() => Effect.void));
-                if (isAuthError) {
-                    yield* SubscriptionRef.update(state, ({ currentUser: _, ...rest }) => rest);
-                }
+                // Typed first (credential failure, or a provider auth error), with the older text match as fallback.
+                if (isAuthError)
+                    yield* markAuthFailed(account.profile);
             }));
         }));
     }));
@@ -98,6 +112,9 @@ export const fetchAndUpsertPRs = (params) => Effect.gen(function* () {
         }]), { discard: true }), { discard: true });
     yield* Stream.mergeAll(streams, { concurrency: 2 }).pipe(Stream.runForEach(({ awsAccountId, item, label, profile, region }) => Effect.gen(function* () {
         if (item._tag === "EvaluationFailed") {
+            // An evaluation that failed because the credentials stopped working is an auth failure too.
+            if (isCredentialInvalidCause(item.error.cause))
+                yield* markAuthFailed(profile);
             // Only this pull request is unknown: its cached row stays as it was, the account's other
             // pull requests carry on, and the account's refresh counts as partial rather than successful.
             yield* Ref.update(unevaluated, (all) => [...all, {
@@ -159,7 +176,9 @@ export const fetchAndUpsertPRs = (params) => Effect.gen(function* () {
     })
         .pipe(Effect.flatMap((detail) => detail.repositoryName === pr.repositoryName
         ? resolveStaleStatus(prRepo, detail, pr.awsAccountId, pr.id, pr.repositoryName, pr.accountRegion)
-        : Effect.void), Effect.catch((error) => withholdScopeSuccess(pr.accountProfile, pr.accountRegion).pipe(Effect.andThen(
+        : Effect.void), Effect.catch((error) => withholdScopeSuccess(pr.accountProfile, pr.accountRegion).pipe(
+    // Credentials that stopped working while stale rows are re-read are an auth failure too.
+    Effect.andThen(isAuthFailure(error) ? markAuthFailed(pr.accountProfile) : Effect.void), Effect.andThen(
     // The pull request was read; only its approval enrichment failed. That is not
     // evidence it is gone, so the row stays for the next refresh to settle.
     failedOnlyOnApprovalEvaluation(error)