import type {  AccountId,  AuthArtifact,  CredentialSlot,  LocalConfigSecretInput,  ProviderAuthGrant,  LocalConfigSource,  Source,  SourceId,  WorkspaceId,} from "#schema";import {  decodeProviderGrantRefAuthArtifactConfig,  SourceIdSchema,} from "#schema";import * as Context from "effect/Context";import * as Effect from "effect/Effect";import * as Layer from "effect/Layer"; import {  stableSourceCatalogId,  stableSourceCatalogRevisionId,  splitSourceForStorage,} from "./source-definitions";import {  sourceAuthFromAuthArtifact,} from "./auth-artifacts";import {  type LoadedLocalExecutorConfig,  type ResolvedLocalWorkspaceContext,} from "./local-config";import {  LocalConfiguredSourceNotFoundError,  LocalExecutorConfigDecodeError,  LocalFileSystemError,  LocalUnsupportedSourceKindError,  LocalWorkspaceStateDecodeError,  RuntimeLocalWorkspaceMismatchError,  RuntimeLocalWorkspaceUnavailableError,} from "./local-errors";import {  requireRuntimeLocalWorkspace,  RuntimeLocalWorkspaceService,  type RuntimeLocalWorkspaceState,} from "./local-runtime-context";import type {  SourceArtifactStoreShape,  WorkspaceStorageServices,  WorkspaceConfigStoreShape,  WorkspaceStateStoreShape,} from "./local-storage";import {  SourceArtifactStore,  WorkspaceConfigStore,  WorkspaceStateStore,} from "./local-storage";import {  type LocalWorkspaceState,} from "./local-workspace-state";import {  fromConfigSecretProviderId,  toConfigSecretProviderId,} from "./local-config-secrets";import { createDefaultSecretMaterialDeleter } from "./secret-material-providers";import { authArtifactSecretMaterialRefs } from "./auth-artifacts";import { removeAuthLeaseAndSecrets } from "./auth-leases";import {  clearProviderGrantOrphanedAt,  markProviderGrantOrphanedIfUnused,} from "./provider-grant-lifecycle";import { ControlPlaneStore, type ControlPlaneStoreShape } from "./store";import { getSourceAdapter } from "./source-adapters";import { refreshWorkspaceSourceTypeDeclarationsInBackground } from "./source-type-declarations";import { slugify } from "./slug"; const secretRefKey = (ref: { providerId: string; handle: string }): string =>  `${ref.providerId}:${ref.handle}`; const cleanupAuthArtifactSecretRefs = (rows: ControlPlaneStoreShape, input: {  previous: AuthArtifact | null;  next: AuthArtifact | null;}) =>  Effect.gen(function* () {    if (input.previous === null) {      return;    }     const deleteSecretMaterial = createDefaultSecretMaterialDeleter({ rows });    const nextRefKeys = new Set(      (input.next === null ? [] : authArtifactSecretMaterialRefs(input.next)).map(secretRefKey),    );    const refsToDelete = authArtifactSecretMaterialRefs(input.previous).filter(      (ref) => !nextRefKeys.has(secretRefKey(ref)),    );     yield* Effect.forEach(      refsToDelete,      (ref) => Effect.either(deleteSecretMaterial(ref)),      { discard: true },    );  }); const providerGrantIdsFromArtifacts = (  artifacts: ReadonlyArray<Pick<AuthArtifact, "artifactKind" | "configJson"> | null>,): ReadonlySet<ProviderAuthGrant["id"]> =>  new Set(    artifacts      .flatMap((artifact) => artifact ? [decodeProviderGrantRefAuthArtifactConfig(artifact)] : [])      .flatMap((config) => config ? [config.grantId] : []),  ); const selectPreferredAuthArtifact = (input: {  authArtifacts: ReadonlyArray<AuthArtifact>;  actorAccountId?: AccountId | null;  slot: CredentialSlot;}): AuthArtifact | null => {  const matchingSlot = input.authArtifacts.filter((artifact) => artifact.slot === input.slot);   if (input.actorAccountId !== undefined) {    const exact = matchingSlot.find((artifact) => artifact.actorAccountId === input.actorAccountId);    if (exact) {      return exact;    }  }   return matchingSlot.find((artifact) => artifact.actorAccountId === null) ?? null;}; const selectExactAuthArtifact = (input: {  authArtifacts: ReadonlyArray<AuthArtifact>;  actorAccountId?: AccountId | null;  slot: CredentialSlot;}): AuthArtifact | null =>  input.authArtifacts.find(    (artifact) =>      artifact.slot === input.slot      && artifact.actorAccountId === (input.actorAccountId ?? null),  ) ?? null; const trimOrNull = (value: string | null | undefined): string | null => {  if (value == null) {    return null;  }   const trimmed = value.trim();  return trimmed.length > 0 ? trimmed : null;}; const cloneJson = <T>(value: T): T =>  JSON.parse(JSON.stringify(value)) as T; const deriveLocalSourceId = (  source: Pick<Source, "namespace" | "name">,  used: ReadonlySet<string>,): SourceId => {  const base =    trimOrNull(source.namespace)    ?? trimOrNull(source.name)    ?? "source";  const slugBase = slugify(base) || "source";  let candidate = slugBase;  let counter = 2;  while (used.has(candidate)) {    candidate = `${slugBase}-${counter}`;    counter += 1;  }  return SourceIdSchema.make(candidate);}; type RuntimeSourceStoreDeps = {  rows: ControlPlaneStoreShape;  runtimeLocalWorkspace: RuntimeLocalWorkspaceState;  workspaceConfigStore: WorkspaceConfigStoreShape;  workspaceStateStore: WorkspaceStateStoreShape;  sourceArtifactStore: SourceArtifactStoreShape;}; type ResolvedSourceStoreWorkspace = {  context: ResolvedLocalWorkspaceContext;  installation: {    workspaceId: WorkspaceId;    accountId: AccountId;  };  workspaceConfigStore: WorkspaceConfigStoreShape;  workspaceStateStore: WorkspaceStateStoreShape;  sourceArtifactStore: SourceArtifactStoreShape;  loadedConfig: LoadedLocalExecutorConfig;  workspaceState: LocalWorkspaceState;}; const resolveLocalConfigSecretProviderAlias = (config: LoadedLocalExecutorConfig["config"]): string | null => {  const defaultAlias = trimOrNull(config?.secrets?.defaults?.env);  if (defaultAlias !== null && config?.secrets?.providers?.[defaultAlias]) {    return defaultAlias;  }   return config?.secrets?.providers?.default ? "default" : null;}; const sourceAuthFromConfigInput = (input: {  auth: unknown;  config: LoadedLocalExecutorConfig["config"];  existing: Source["auth"] | null;}): Source["auth"] => {  if (input.auth === undefined) {    return input.existing ?? { kind: "none" };  }   if (typeof input.auth === "string") {    const providerAlias = resolveLocalConfigSecretProviderAlias(input.config);    return {      kind: "bearer",      headerName: "Authorization",      prefix: "Bearer ",      token: {        providerId: providerAlias ? toConfigSecretProviderId(providerAlias) : "env",        handle: input.auth,      },    };  }   if (typeof input.auth === "object" && input.auth !== null) {    const explicit = input.auth as {      source?: string;      provider?: string;      id?: string;    };    const providerAlias = trimOrNull(explicit.provider);    const providerId = providerAlias      ? (providerAlias === "params" ? "params" : toConfigSecretProviderId(providerAlias))      : explicit.source === "env"        ? "env"        : explicit.source === "params"          ? "params"        : null;    const handle = trimOrNull(explicit.id);    if (providerId && handle) {      return {        kind: "bearer",        headerName: "Authorization",        prefix: "Bearer ",        token: {          providerId,          handle,        },      };    }  }   return input.existing ?? { kind: "none" };}; const configAuthFromSource = (input: {  source: Source;  existingConfigAuth: LocalConfigSecretInput | undefined;  config: LoadedLocalExecutorConfig["config"];}): LocalConfigSecretInput | undefined => {  if (input.source.auth.kind !== "bearer") {    return input.existingConfigAuth;  }   if (input.source.auth.token.providerId === "env") {    return input.source.auth.token.handle;  }   if (input.source.auth.token.providerId === "params") {    return {      source: "params",      provider: "params",      id: input.source.auth.token.handle,    };  }   const provider = fromConfigSecretProviderId(input.source.auth.token.providerId);  if (provider !== null) {    const configuredProvider = input.config?.secrets?.providers?.[provider];    if (configuredProvider) {      return {        source: configuredProvider.source,        provider,        id: input.source.auth.token.handle,      };    }  }   return input.existingConfigAuth;}; const resolveRuntimeLocalWorkspaceFromDeps = (  deps: RuntimeSourceStoreDeps,  workspaceId: WorkspaceId,): Effect.Effect<ResolvedSourceStoreWorkspace,  | RuntimeLocalWorkspaceUnavailableError  | RuntimeLocalWorkspaceMismatchError  | LocalFileSystemError  | LocalExecutorConfigDecodeError  | LocalWorkspaceStateDecodeError  | Error,never> =>  Effect.gen(function* () {    if (deps.runtimeLocalWorkspace.installation.workspaceId !== workspaceId) {      return yield* Effect.fail(        new RuntimeLocalWorkspaceMismatchError({          message: `Runtime local workspace mismatch: expected ${workspaceId}, got ${deps.runtimeLocalWorkspace.installation.workspaceId}`,          requestedWorkspaceId: workspaceId,          activeWorkspaceId: deps.runtimeLocalWorkspace.installation.workspaceId,        }),      );    }     const loadedConfig = yield* deps.workspaceConfigStore.load(      deps.runtimeLocalWorkspace.context,    );    const workspaceState = yield* deps.workspaceStateStore.load(      deps.runtimeLocalWorkspace.context,    );     return {      context: deps.runtimeLocalWorkspace.context,      installation: deps.runtimeLocalWorkspace.installation,      workspaceConfigStore: deps.workspaceConfigStore,      workspaceStateStore: deps.workspaceStateStore,      sourceArtifactStore: deps.sourceArtifactStore,      loadedConfig,      workspaceState,    };  }); const loadRuntimeSourceStoreDeps = (  rows: ControlPlaneStoreShape,  workspaceId: WorkspaceId,): Effect.Effect<  RuntimeSourceStoreDeps,  | RuntimeLocalWorkspaceUnavailableError  | RuntimeLocalWorkspaceMismatchError  | LocalFileSystemError  | LocalExecutorConfigDecodeError  | LocalWorkspaceStateDecodeError  | Error,  WorkspaceStorageServices> =>  Effect.gen(function* () {    const runtimeLocalWorkspace = yield* requireRuntimeLocalWorkspace(workspaceId);    const workspaceConfigStore = yield* WorkspaceConfigStore;    const workspaceStateStore = yield* WorkspaceStateStore;    const sourceArtifactStore = yield* SourceArtifactStore;     return {      rows,      runtimeLocalWorkspace,      workspaceConfigStore,      workspaceStateStore,      sourceArtifactStore,    };  }); export const buildLocalSourceRecord = (input: {  workspaceId: WorkspaceId;  loadedConfig: LoadedLocalExecutorConfig;  workspaceState: LocalWorkspaceState;  sourceId: SourceId;  actorAccountId?: AccountId | null;  authArtifacts: ReadonlyArray<AuthArtifact>;}): Effect.Effect<{  source: Source;  sourceId: SourceId;}, LocalConfiguredSourceNotFoundError | Error, never> =>  Effect.gen(function* () {    const sourceConfig = input.loadedConfig.config?.sources?.[input.sourceId];    if (!sourceConfig) {      return yield* Effect.fail(        new LocalConfiguredSourceNotFoundError({          message: `Configured source not found for id ${input.sourceId}`,          sourceId: input.sourceId,        }),      );    }     const existingState = input.workspaceState.sources[input.sourceId];    const adapter = getSourceAdapter(sourceConfig.kind);    const baseSource = yield* adapter.validateSource({      id: SourceIdSchema.make(input.sourceId),      workspaceId: input.workspaceId,      name: trimOrNull(sourceConfig.name) ?? input.sourceId,      kind: sourceConfig.kind,      endpoint: sourceConfig.connection.endpoint.trim(),      status: existingState?.status ?? ((sourceConfig.enabled ?? true) ? "connected" : "draft"),      enabled: sourceConfig.enabled ?? true,      namespace: trimOrNull(sourceConfig.namespace) ?? input.sourceId,      bindingVersion: adapter.bindingConfigVersion,      binding: sourceConfig.binding,      importAuthPolicy: adapter.defaultImportAuthPolicy,      importAuth: { kind: "none" },      auth: sourceAuthFromConfigInput({        auth: sourceConfig.connection.auth,        config: input.loadedConfig.config,        existing: null,      }),      sourceHash: existingState?.sourceHash ?? null,      lastError: existingState?.lastError ?? null,      createdAt: existingState?.createdAt ?? Date.now(),      updatedAt: existingState?.updatedAt ?? Date.now(),    });     const runtimeAuthArtifact = selectPreferredAuthArtifact({      authArtifacts: input.authArtifacts.filter((artifactItem) => artifactItem.sourceId === baseSource.id),      actorAccountId: input.actorAccountId,      slot: "runtime",    });    const importAuthArtifact = selectPreferredAuthArtifact({      authArtifacts: input.authArtifacts.filter((artifactItem) => artifactItem.sourceId === baseSource.id),      actorAccountId: input.actorAccountId,      slot: "import",    });     const source: Source = {      ...baseSource,      auth:        runtimeAuthArtifact === null          ? baseSource.auth          : sourceAuthFromAuthArtifact(runtimeAuthArtifact),      importAuth:        baseSource.importAuthPolicy === "separate"          ? importAuthArtifact === null            ? baseSource.importAuth            : sourceAuthFromAuthArtifact(importAuthArtifact)          : { kind: "none" },    };     return {      source,      sourceId: input.sourceId,    };  }); const loadSourcesInWorkspaceWithDeps = (  deps: RuntimeSourceStoreDeps,  workspaceId: WorkspaceId,  options: {    actorAccountId?: AccountId | null;  } = {},): Effect.Effect<  readonly Source[],  | RuntimeLocalWorkspaceUnavailableError  | RuntimeLocalWorkspaceMismatchError  | LocalFileSystemError  | LocalExecutorConfigDecodeError  | LocalWorkspaceStateDecodeError  | LocalConfiguredSourceNotFoundError  | Error,  never> =>  Effect.gen(function* () {    const localWorkspace = yield* resolveRuntimeLocalWorkspaceFromDeps(deps, workspaceId);    const authArtifacts = yield* deps.rows.authArtifacts.listByWorkspaceId(workspaceId);    const sources = yield* Effect.forEach(      Object.keys(localWorkspace.loadedConfig.config?.sources ?? {}),      (sourceId) =>        Effect.map(          buildLocalSourceRecord({            workspaceId,            loadedConfig: localWorkspace.loadedConfig,            workspaceState: localWorkspace.workspaceState,            sourceId: SourceIdSchema.make(sourceId),            actorAccountId: options.actorAccountId,            authArtifacts,          }),          ({ source }) => source,        ),    );    yield* Effect.annotateCurrentSpan("executor.source.count", sources.length);    return sources;  }).pipe(    Effect.withSpan("source.store.load_workspace", {      attributes: {        "executor.workspace.id": workspaceId,      },    }),  ); const syncWorkspaceSourceTypeDeclarationsWithDeps = (  deps: RuntimeSourceStoreDeps,  workspaceId: WorkspaceId,  options: {    actorAccountId?: AccountId | null;  } = {},): Effect.Effect<void, Error, never> =>  Effect.gen(function* () {    const localWorkspace = yield* resolveRuntimeLocalWorkspaceFromDeps(deps, workspaceId);    const sources = yield* loadSourcesInWorkspaceWithDeps(deps, workspaceId, options);    const entries = yield* Effect.forEach(sources, (source) =>      Effect.map(        deps.sourceArtifactStore.read({          context: localWorkspace.context,          sourceId: source.id,        }),        (artifact) =>          artifact === null            ? null            : {

Lines 1–500 of 1123. Load more