// ---------------------------------------------------------------------------// Garbage collection + backfill for legacy Dynamic Client Registration (DCR)// `oauth_client` rows (issue #1120, Part C).//// Old always-register behavior minted a fresh `oauth_client` per connect// attempt ("cloudflare-mcp", "cloudflare-mcp-2", …). Parts A+B stopped the// multiplication (per-AS reuse) and hid the rows from pickers, but the dead// rows remain and legacy rows have `origin_issuer = NULL`, so the reuse lookup// can't key on them. This module supplies the shared, testable predicates that// both host paths (local libSQL boot migration, cloud Drizzle SQL migration)// encode:////   1. GC: delete a row that is classified DCR AND has ZERO referencing//      connections. The predicate is conjunctive and fail-safe — an ambiguous//      row (manual, or DCR but still referenced) is always KEPT.//   2. Backfill: for a surviving DCR row with `origin_issuer IS NULL`, set it//      to the registrable origin of `token_url` so the per-AS reuse lookup can//      find it and mint no new duplicate.//// The predicates here are the SINGLE source of truth, imported (never// re-encoded) by every call site: `oauth-service`'s `parseOAuthClientOrigin`// calls `isDcrClassifiedRow` for the runtime reuse lookup, and BOTH GC// migrations (the local libSQL boot migration and the cloud code migration)// import `classifyOAuthClientGc` / `registrableOriginOfUrl` and decide in// process rather than rewriting the logic as SQL. There is no parallel SQL copy// to drift: changing a predicate here changes all three call sites at once.// --------------------------------------------------------------------------- import { getDomain } from "tldts"; /** Parse a string into a URL, or null when it is not a valid absolute URL. */export const parseUrl = (value: string): URL | null => {  if (!URL.canParse(value)) return null;  return new URL(value);}; /** Canonicalize a discovered issuer to `origin` + path with trailing slashes *  stripped (RFC 8414 issuers are compared without a trailing slash). Null for *  a blank or unparseable value. Part A's DCR-identity canonicalization. */export const canonicalIssuerUrl = (value: string | null | undefined): string | null => {  if (value == null) return null;  const trimmed = value.trim();  if (trimmed.length === 0) return null;  const url = parseUrl(trimmed);  if (url === null) return null;  const path = url.pathname.replace(/\/+$/g, "");  return path.length > 0 ? `${url.origin}${path}` : url.origin;}; export const hostOfUrl = (value: string): string | null =>  parseUrl(value)?.host.toLowerCase() ?? null; /** The registrable domain of a hostname (eTLD+1), backed by the full Public *  Suffix List via `tldts` (so `api.foo.co.uk` → `foo.co.uk`, `x.co.in` → *  `x.co.in`, etc., not a hardcoded suffix subset). `tldts.getDomain` returns *  null for hosts with no registrable domain (`localhost`, bare IPv4/IPv6, *  single-label hosts); those fall back to the raw lowercase hostname so *  local-dev token hosts still key on their exact host. This mirrors how *  `packages/react/src/plugins/use-effective-oauth-client.tsx` uses tldts. */export const registrableHostname = (hostname: string): string => {  const host = hostname.toLowerCase();  return getDomain(host) ?? host;}; /** The registrable ORIGIN of a URL: its scheme + the registrable host (dropping *  any subdomain). Used to backfill a legacy DCR row's `origin_issuer` from its *  `token_url`, so the per-AS reuse lookup can find it. Null when not a URL. * *  Preserves scheme and port (a loopback `http://127.0.0.1:8787` token host *  keeps its port). Reuses `registrableHostname` — no duplicated eTLD logic. */export const registrableOriginOfUrl = (value: string): string | null => {  const url = parseUrl(value);  if (url === null) return null;  const registrable = registrableHostname(url.hostname);  // When the hostname collapses to a registrable domain, rebuild the origin  // from scheme + registrable host + original port; otherwise keep url.origin  // verbatim (covers localhost / IPv4 / already-registrable hosts, incl. port).  if (registrable === url.hostname.toLowerCase()) return url.origin;  const port = url.port.length > 0 ? `:${url.port}` : "";  return `${url.protocol}//${registrable}${port}`;}; /** The minimal shape the DCR classifier reads off an `oauth_client` row. Every *  field is optional/unknown so it applies equally to a fuma row, a raw SQL *  row, or a hand-built test fixture. */export interface OAuthClientGcRow {  readonly grant?: unknown;  readonly resource?: unknown;  readonly origin_kind?: unknown;} /** * Is this `oauth_client` row a Dynamic Client Registration client? * * True when EITHER: *  - it carries the explicit `origin_kind = 'dynamic_client_registration'` *    stamp (rows minted after Part A), OR *  - it is a legacy null-origin row with an `authorization_code` grant AND a *    non-empty `resource`. * * The `resource` parameter (RFC 8707) is only ever set by the DCR/MCP connect * path, never by the manual app form: a hand-registered app has no resource. * So on a legacy (null origin_kind) row, an auth-code grant carrying a resource * is a DCR client. This was validated against the production database: of the * 394 rows that carry an explicit origin_kind stamp, `grant = * 'authorization_code' AND resource IS NOT NULL` matches all 329 stamped DCR * rows (100% recall). It also matches a handful of stamped-manual BYO rows * that point at MCP servers, but those never reach this arm: an explicit * stamp always wins. The earlier slug/resource `…mcp…` regex heuristic had * bad recall (it missed legacy rows whose slug was a bare provider name like * `linear` / `notion` / `cloudflare`), so it is gone; the resource presence * check subsumes it. * * Explicit stamps always win (arm 1): a stamped `manual` BYO row keeps its * classification even when it carries a resource, and a stamped DCR row is DCR * even with no resource. The resource heuristic only decides legacy null-origin * rows. A legacy row that does not match either arm is treated as manual and is * NEVER a GC candidate — the conservative default that protects hand-registered * apps. */export const isDcrClassifiedRow = (row: OAuthClientGcRow): boolean => {  if (row.origin_kind === "dynamic_client_registration") return true;  if (row.origin_kind != null) return false;  if (row.grant !== "authorization_code") return false;  const resource = row.resource == null ? "" : String(row.resource);  return resource.length > 0;}; /** The GC decision for one `oauth_client` row. */export type OAuthClientGcDecision =  /** Classified DCR AND unreferenced — safe to delete. */  | { readonly action: "delete"; readonly reason: "dcr-orphaned" }  /** Kept — either not DCR, or DCR but still referenced by a connection. */  | { readonly action: "keep"; readonly reason: "not-dcr" | "referenced" }; /** * Decide whether a single `oauth_client` row should be garbage-collected. * * The deletion predicate is strictly conjunctive and fail-safe: *   delete ⇔ isDcrClassifiedRow(row) AND referencingConnectionCount === 0 * * Anything else is kept. A manual app is kept even when orphaned (users delete * their own apps deliberately); a DCR app is kept while any connection still * references it (deleting it would break refresh/reconnect for that * connection). `referencingConnectionCount` is the number of `connection` rows * whose stored `(oauth_client_owner, oauth_client)` reference resolves to this * row's `(owner, slug)`. */export const classifyOAuthClientGc = (  row: OAuthClientGcRow,  referencingConnectionCount: number,): OAuthClientGcDecision => {  if (!isDcrClassifiedRow(row)) return { action: "keep", reason: "not-dcr" };  if (referencingConnectionCount > 0) return { action: "keep", reason: "referenced" };  return { action: "delete", reason: "dcr-orphaned" };};