@desplega.ai/agent-swarm 1.130.0 → 1.131.0

package/dist/{cli-hntzdchd.js → cli-bqw0mt1n.js}

@@ -1,7 +1,7 @@
 import {
   init_env_flag,
   isEnvFlagEnabled
-} from "./cli-4n4mdv21.js";
+} from "./cli-xpxde7rm.js";
 import {
   init_zod
 } from "./cli-zsspvvm2.js";

package/dist/{cli-mhr8tq3v.js → cli-cdeg08wx.js}

@@ -3,7 +3,7 @@ import {
   getAgentById,
   getInProgressTasksByContextKey,
   init_db
-} from "./cli-s18zzkfp.js";
+} from "./cli-a4jzdpa3.js";
 
 // src/tasks/sibling-awareness.ts
 init_db();

package/dist/{cli-qcsjdppx.js → cli-cvgjwnh1.js}

@@ -37,11 +37,11 @@ import {
   setSlackMessageTracking,
   slackContextKey,
   updateSlackMessageRecord
-} from "./cli-s18zzkfp.js";
+} from "./cli-a4jzdpa3.js";
 import {
   init_env_flag,
   isEnvFlagEnabled
-} from "./cli-4n4mdv21.js";
+} from "./cli-xpxde7rm.js";
 import {
   getAppUrl,
   init_constants
@@ -55420,13 +55420,13 @@ async function initSlackApp() {
     socketMode: true,
     logLevel: import_bolt.LogLevel.DEBUG
   });
-  const { registerMessageHandler } = await import("./handlers-eev4nng0.js");
-  const { registerCommandHandler } = await import("./commands-yfpwt11g.js");
-  const { registerActionHandlers } = await import("./actions-73ee723n.js");
+  const { registerMessageHandler } = await import("./handlers-fkr6swat.js");
+  const { registerCommandHandler } = await import("./commands-c3nrc5hg.js");
+  const { registerActionHandlers } = await import("./actions-w53mbns9.js");
   registerMessageHandler(app);
   registerCommandHandler(app);
   registerActionHandlers(app);
-  const { createAssistant } = await import("./assistant-08mr16yp.js");
+  const { createAssistant } = await import("./assistant-bp65m6f3.js");
   app.assistant(createAssistant());
   return app;
 }
@@ -55435,7 +55435,7 @@ async function startSlackApp() {
     await initSlackApp();
   }
   if (app) {
-    const { isSlackRenderV2Enabled: isSlackRenderV2Enabled2 } = await import("./render-v2-d675cp9r.js");
+    const { isSlackRenderV2Enabled: isSlackRenderV2Enabled2 } = await import("./render-v2-xm457ng1.js");
     if (isSlackRenderV2Enabled2())
       ensureSlackRenderV2Activation();
     await app.start();

package/dist/{cli-z9q7pb38.js → cli-d2tfkcga.js}

@@ -7,11 +7,11 @@ import {
   getPinCandidateAgent,
   getResumeGeneration,
   repointTrackerSyncBySwarmId
-} from "./cli-tfw3c0y1.js";
+} from "./cli-nm5gtp1x.js";
 import {
   getExecutorRegistry,
   recoverIncompleteRuns
-} from "./cli-xdrmxvd4.js";
+} from "./cli-yw8vghx2.js";
 import {
   MAX_EMPTY_POLLS,
   assignUnassignedTaskPending,
@@ -51,13 +51,13 @@ import {
   releaseStaleReviewingTasks,
   supersedeTask,
   updateAgentStatus
-} from "./cli-s18zzkfp.js";
+} from "./cli-a4jzdpa3.js";
 import {
   init_registry,
   init_resolver,
   registerTemplate,
   resolveTemplate
-} from "./cli-4n4mdv21.js";
+} from "./cli-xpxde7rm.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-r62me33w.js → cli-d3x3x1c9.js}

@@ -3,11 +3,11 @@ import {
   getAgentWorkingOnThread,
   getAllAgents,
   init_db
-} from "./cli-s18zzkfp.js";
+} from "./cli-a4jzdpa3.js";
 import {
   init_env_flag,
   isEnvFlagEnabled
-} from "./cli-4n4mdv21.js";
+} from "./cli-xpxde7rm.js";
 
 // src/slack/router.ts
 init_db();

package/dist/{cli-6nh2qxvh.js → cli-darcwax3.js}

@@ -1,6 +1,6 @@
 import {
   lazyApi
-} from "./cli-w10fkrf1.js";
+} from "./cli-akdvwc9v.js";
 
 // node_modules/@earendil-works/pi-ai/dist/api/bedrock-converse-stream.lazy.js
 var __rewriteRelativeImportExtension = function(path, preserveJsx) {

package/dist/{cli-326083vb.js → cli-e7ckcg4v.js}

@@ -1,9 +1,9 @@
 import {
   renderSteeringDelivery
-} from "./cli-xg2eezyv.js";
+} from "./cli-f1am9szv.js";
 import {
   checkCodexCredentials
-} from "./cli-h3e66g5b.js";
+} from "./cli-5kx36evn.js";
 import {
   checkClaudeManagedCredentials
 } from "./cli-qmdnhpej.js";
@@ -15,7 +15,7 @@ import {
 } from "./cli-n6h8qt8n.js";
 import {
   checkClaudeCredentials
-} from "./cli-e5p3es48.js";
+} from "./cli-3kf51j15.js";
 import {
   MAX_RATE_LIMIT_RESET_MS,
   isCodexCreditsExhaustedMessage,
@@ -35,7 +35,7 @@ import {
   withSpan,
   withSpanContext,
   writeSkillsToFilesystem
-} from "./cli-haanc4qd.js";
+} from "./cli-t76vw5db.js";
 import {
   authJsonToCredentialSelection,
   credentialsToAuthJson,
@@ -44,10 +44,10 @@ import {
 import {
   ensure,
   initialize
-} from "./cli-dakxgk70.js";
+} from "./cli-5ze9rv97.js";
 import {
   validateJsonSchema
-} from "./cli-xdrmxvd4.js";
+} from "./cli-yw8vghx2.js";
 import {
   getOpenRouterBaseUrl
 } from "./cli-3dpj7atn.js";
@@ -78,7 +78,7 @@ import {
   init_types,
   resolveTaskModelSelection,
   telemetry
-} from "./cli-s18zzkfp.js";
+} from "./cli-a4jzdpa3.js";
 import {
   configureHttpResolver,
   init_resolver,
@@ -88,7 +88,7 @@ import {
   interpolate,
   isSteeringEnabled,
   resolveTemplateAsync
-} from "./cli-4n4mdv21.js";
+} from "./cli-xpxde7rm.js";
 import {
   getMcpBaseUrl,
   init_constants
@@ -495,15 +495,15 @@ async function materializeCodexAuthJson(_slot, creds, deps = {}) {
 async function createProviderAdapter(provider) {
   switch (provider) {
     case "claude": {
-      const { ClaudeAdapter } = await import("./claude-adapter-qr0k17km.js");
+      const { ClaudeAdapter } = await import("./claude-adapter-2y47mrkd.js");
       return new ClaudeAdapter;
     }
     case "pi": {
-      const { PiMonoAdapter } = await import("./pi-mono-adapter-bpfrn6d7.js");
+      const { PiMonoAdapter } = await import("./pi-mono-adapter-t091s27g.js");
       return new PiMonoAdapter;
     }
     case "codex": {
-      const { CodexAdapter } = await import("./codex-adapter-6pc50x9q.js");
+      const { CodexAdapter } = await import("./codex-adapter-d24q75wk.js");
       return new CodexAdapter;
     }
     case "claude-managed": {
@@ -1201,7 +1201,7 @@ async function checkProviderCredentials(provider, env, opts) {
     case "opencode":
       return checkOpencodeCredentials(env, opts);
     case "pi": {
-      const { checkPiMonoCredentials } = await import("./pi-mono-adapter-bpfrn6d7.js");
+      const { checkPiMonoCredentials } = await import("./pi-mono-adapter-t091s27g.js");
       return checkPiMonoCredentials(env, opts);
     }
     default:

package/dist/{cli-fs153s3x.js → cli-efxfnq6q.js}

@@ -1,12 +1,12 @@
 import {
   SYSTEM_COLUMN_KINDS,
   listAppRecords
-} from "./cli-brebbsen.js";
+} from "./cli-2q72qz2s.js";
 import {
   getScriptApiTypes,
   getScriptMcpTypes,
   require_typescript
-} from "./cli-q8zwffx0.js";
+} from "./cli-pm6xbh84.js";
 import {
   deleteSwarmConfigByKey,
   getAgentById,
@@ -15,7 +15,7 @@ import {
   getSwarmConfigs,
   init_db,
   upsertSwarmConfig
-} from "./cli-s18zzkfp.js";
+} from "./cli-a4jzdpa3.js";
 import {
   init_secret_scrubber,
   scrubSecrets

package/dist/{cli-xg2eezyv.js → cli-f1am9szv.js}

@@ -2,7 +2,7 @@ import {
   init_resolver,
   init_session_templates,
   resolveTemplateAsync
-} from "./cli-4n4mdv21.js";
+} from "./cli-xpxde7rm.js";
 
 // src/prompts/steering-delivery.ts
 init_session_templates();

package/dist/{cli-2pa5w9b6.js → cli-fywms69x.js}

@@ -1,7 +1,7 @@
 import {
   init_package,
   package_default
-} from "./cli-7v5dhmc8.js";
+} from "./cli-72q8m8gk.js";
 
 // src/commands/shared/client-config.ts
 init_package();

package/dist/{cli-1mj7yz1r.js → cli-g6b8x1h8.js}

@@ -7,7 +7,7 @@ import {
   init_date_utils,
   init_db,
   normalizeDateRequired
-} from "./cli-s18zzkfp.js";
+} from "./cli-a4jzdpa3.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,

package/dist/{cli-epsvdckx.js → cli-gm9cbhbq.js}

@@ -10,13 +10,13 @@ import {
   resolveGrammarConstrainedSampling,
   resolveJsonSchemaStrictSampling,
   transformMessages
-} from "./cli-vgexpfsr.js";
+} from "./cli-57khth04.js";
 import {
   sanitizeSurrogates
 } from "./cli-y2apkfe2.js";
 import {
   calculateCost
-} from "./cli-w10fkrf1.js";
+} from "./cli-akdvwc9v.js";
 
 // node_modules/@earendil-works/pi-ai/dist/api/openai-responses-shared.js
 function encodeTextSignatureV1(id, phase) {
@@ -418,8 +418,12 @@ async function processResponsesStream(openaiStream, output, stream, model, optio
       options.applyServiceTierPricing(output.usage, serviceTier);
     }
     const status = response?.status;
-    output.rawStopReason = status;
-    output.stopReason = mapStopReason(status);
+    const incompleteDetails = response?.incomplete_details;
+    const incompleteReason = typeof incompleteDetails?.reason === "string" ? incompleteDetails.reason : undefined;
+    output.rawStopReason = incompleteReason ? `${status}.${incompleteReason}` : status;
+    const mappedStop = mapStopReason(status, incompleteReason);
+    output.stopReason = mappedStop.stopReason;
+    output.errorMessage = mappedStop.errorMessage;
     if (output.content.some((b) => b.type === "toolCall") && output.stopReason === "stop") {
       output.stopReason = "toolUse";
     }
@@ -586,20 +590,26 @@ async function processResponsesStream(openaiStream, output, stream, model, optio
     throw new Error("OpenAI Responses stream ended before a terminal response event");
   }
 }
-function mapStopReason(status) {
+function mapStopReason(status, incompleteReason) {
   if (!status)
-    return "stop";
+    return { stopReason: "stop" };
   switch (status) {
     case "completed":
-      return "stop";
+      return { stopReason: "stop" };
     case "incomplete":
-      return "length";
+      if (incompleteReason === "max_output_tokens") {
+        return { stopReason: "length" };
+      }
+      return {
+        stopReason: "error",
+        errorMessage: incompleteReason ? `Response incomplete: ${incompleteReason}` : "Response incomplete without a provider reason"
+      };
     case "failed":
     case "cancelled":
-      return "error";
+      return { stopReason: "error" };
     case "in_progress":
     case "queued":
-      return "stop";
+      return { stopReason: "stop" };
     default: {
       const _exhaustive = status;
       throw new Error(`Unhandled stop reason: ${_exhaustive}`);

package/dist/{cli-tfw3c0y1.js → cli-nm5gtp1x.js}

@@ -16,13 +16,13 @@ import {
   init_db,
   init_templates1 as init_templates,
   normalizeDateRequired
-} from "./cli-s18zzkfp.js";
+} from "./cli-a4jzdpa3.js";
 import {
   init_env_flag,
   init_resolver,
   isEnvFlagEnabled,
   resolveTemplate
-} from "./cli-4n4mdv21.js";
+} from "./cli-xpxde7rm.js";
 
 // src/be/db-queries/tracker.ts
 init_date_utils();

package/dist/{cli-q8zwffx0.js → cli-pm6xbh84.js}

@@ -6,7 +6,7 @@ import {
 } from "./cli-f14fvzag.js";
 import {
   embedScript
-} from "./cli-1px8pn1s.js";
+} from "./cli-qv61hp37.js";
 import {
   calculatePKCECodeChallenge,
   ensureAuthorizationTokenOrThrow,
@@ -18,12 +18,13 @@ import {
   oauthAppRowToProviderConfig,
   updateAuthorizationTokens,
   upsertAuthorization
-} from "./cli-1mj7yz1r.js";
+} from "./cli-g6b8x1h8.js";
 import {
   CredentialBroker,
   DEFAULT_CREDENTIAL_BINDINGS,
   computeContentHash,
   decryptSecret,
+  defaultAssetKey,
   encryptSecret,
   getDb,
   getEncryptionKey,
@@ -33,14 +34,15 @@ import {
   init_crypto,
   init_date_utils,
   init_db,
+  init_key,
   normalizeDateRequired,
   placeholderForConfigKey,
   upsertSwarmConfig
-} from "./cli-s18zzkfp.js";
+} from "./cli-a4jzdpa3.js";
 import {
   init_env_flag,
   isEnvFlagEnabled
-} from "./cli-4n4mdv21.js";
+} from "./cli-xpxde7rm.js";
 import {
   init_zod
 } from "./cli-zsspvvm2.js";
@@ -168933,6 +168935,75 @@ async function discoverAuthorizationServerMetadata(issuer) {
   }
   throw lastError ?? new Error(`Authorization server metadata not found at ${issuer}`);
 }
+var KNOWN_TOKEN_ENDPOINT_AUTH_METHODS = [
+  "client_secret_basic",
+  "client_secret_post",
+  "none"
+];
+var DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD = "client_secret_basic";
+function normalizeTokenEndpointAuthMethod(value) {
+  return KNOWN_TOKEN_ENDPOINT_AUTH_METHODS.includes(value ?? "") ? value : DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD;
+}
+
+class UnsupportedTokenEndpointAuthMethodError extends Error {
+  constructor(value, source) {
+    super(`Authorization server ${source} token_endpoint_auth_method "${value}", which agent-swarm cannot perform. ` + `Supported methods: ${KNOWN_TOKEN_ENDPOINT_AUTH_METHODS.join(", ")}. ` + `Register a client manually via POST /api/mcp-oauth/:id/manual-client with a supported method.`);
+    this.name = "UnsupportedTokenEndpointAuthMethodError";
+  }
+}
+function resolveAdvertisedTokenEndpointAuthMethod(value, source) {
+  if (value == null || value === "")
+    return DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD;
+  if (!KNOWN_TOKEN_ENDPOINT_AUTH_METHODS.includes(value)) {
+    throw new UnsupportedTokenEndpointAuthMethodError(value, source);
+  }
+  return value;
+}
+function authMethodForStoredClient(value) {
+  if (value == null || value === "")
+    return "client_secret_post";
+  return normalizeTokenEndpointAuthMethod(value);
+}
+function selectDcrTokenEndpointAuthMethod(supportedMethods) {
+  if (!supportedMethods || supportedMethods.length === 0) {
+    return DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD;
+  }
+  for (const method of KNOWN_TOKEN_ENDPOINT_AUTH_METHODS) {
+    if (supportedMethods.includes(method))
+      return method;
+  }
+  throw new UnsupportedTokenEndpointAuthMethodError(supportedMethods.join(", "), "advertises only");
+}
+function formUrlEncodeComponent(value) {
+  return new URLSearchParams({ v: value }).toString().slice(2);
+}
+function redactSentCredentials(text, sent) {
+  let out = scrubSecrets(text);
+  for (const value of sent) {
+    if (!value)
+      continue;
+    for (const shape of new Set([value, formUrlEncodeComponent(value)])) {
+      out = out.split(shape).join("[REDACTED]");
+    }
+  }
+  return out;
+}
+function applyClientAuthentication(method, clientId, clientSecret, body, headers) {
+  if (method === "client_secret_basic" && clientSecret) {
+    const encodedSecret = formUrlEncodeComponent(clientSecret);
+    const credentials = `${formUrlEncodeComponent(clientId)}:${encodedSecret}`;
+    const encoded = Buffer.from(credentials).toString("base64");
+    registerVolatileSecret(encoded, "mcp_oauth_basic_credential");
+    headers.Authorization = `Basic ${encoded}`;
+    return [clientSecret, encodedSecret, encoded, credentials];
+  }
+  body.set("client_id", clientId);
+  if (method === "client_secret_post" && clientSecret) {
+    body.set("client_secret", clientSecret);
+    return [clientSecret, formUrlEncodeComponent(clientSecret)];
+  }
+  return [];
+}
 async function registerClient(registrationEndpoint, req) {
   const res = await safeFetch(registrationEndpoint, {
     method: "POST",
@@ -168985,27 +169056,33 @@ async function buildAuthorizeUrl(input) {
   return { url: url.toString(), state, codeVerifier, codeChallenge };
 }
 async function exchangeCodeForTokens(input) {
+  if (input.clientSecret)
+    registerVolatileSecret(input.clientSecret, "mcp_oauth_client_secret");
+  const method = normalizeTokenEndpointAuthMethod(input.tokenEndpointAuthMethod);
   const body = new URLSearchParams({
     grant_type: "authorization_code",
     code: input.code,
     redirect_uri: input.redirectUri,
-    client_id: input.clientId,
     code_verifier: input.codeVerifier,
     resource: input.resource
   });
-  if (input.clientSecret)
-    body.set("client_secret", input.clientSecret);
+  const headers = {
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json"
+  };
+  const sentCredentials = applyClientAuthentication(method, input.clientId, input.clientSecret, body, headers);
   const res = await safeFetch(input.tokenUrl, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
+    headers,
     body: body.toString()
   });
   if (!res.ok) {
     const text = await res.text().catch(() => "");
-    throw new Error(`Token exchange failed (${res.status}): ${text}`);
+    throw new Error(`Token exchange failed (${res.status}): ${redactSentCredentials(text, [
+      ...sentCredentials,
+      input.code,
+      input.codeVerifier
+    ])}`);
   }
   return await res.json();
 }
@@ -169013,50 +169090,57 @@ async function refreshMcpToken(input) {
   if (input.clientSecret)
     registerVolatileSecret(input.clientSecret, "mcp_oauth_client_secret");
   registerVolatileSecret(input.refreshToken, "mcp_oauth_refresh_token");
+  const method = normalizeTokenEndpointAuthMethod(input.tokenEndpointAuthMethod);
   const body = new URLSearchParams({
     grant_type: "refresh_token",
     refresh_token: input.refreshToken,
-    client_id: input.clientId,
     resource: input.resource
   });
-  if (input.clientSecret)
-    body.set("client_secret", input.clientSecret);
   if (input.scopes && input.scopes.length > 0)
     body.set("scope", input.scopes.join(" "));
+  const headers = {
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json"
+  };
+  const sentCredentials = applyClientAuthentication(method, input.clientId, input.clientSecret, body, headers);
   const res = await safeFetch(input.tokenUrl, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
+    headers,
     body: body.toString()
   });
   if (!res.ok) {
     const text = await res.text().catch(() => "");
-    throw new Error(`Token refresh failed (${res.status}): ${scrubSecrets(text)}`);
+    throw new Error(`Token refresh failed (${res.status}): ${redactSentCredentials(text, [
+      ...sentCredentials,
+      input.refreshToken
+    ])}`);
   }
   return await res.json();
 }
 async function revokeMcpToken(input) {
-  const body = new URLSearchParams({
-    token: input.token,
-    client_id: input.clientId
-  });
+  if (input.clientSecret)
+    registerVolatileSecret(input.clientSecret, "mcp_oauth_client_secret");
+  registerVolatileSecret(input.token, "mcp_oauth_revoked_token");
+  const method = normalizeTokenEndpointAuthMethod(input.tokenEndpointAuthMethod);
+  const body = new URLSearchParams({ token: input.token });
   if (input.tokenTypeHint)
     body.set("token_type_hint", input.tokenTypeHint);
-  if (input.clientSecret)
-    body.set("client_secret", input.clientSecret);
+  const headers = {
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json"
+  };
+  const sentCredentials = applyClientAuthentication(method, input.clientId, input.clientSecret, body, headers);
   const res = await safeFetch(input.revocationUrl, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
+    headers,
     body: body.toString()
   });
   if (!res.ok && res.status !== 200 && res.status !== 204) {
     const text = await res.text().catch(() => "");
-    throw new Error(`Token revocation failed (${res.status}): ${text}`);
+    throw new Error(`Token revocation failed (${res.status}): ${redactSentCredentials(text, [
+      ...sentCredentials,
+      input.token
+    ])}`);
   }
 }
 function computeExpiresAt(expiresInSeconds) {
@@ -169136,6 +169220,7 @@ function decryptTokenRow(row) {
     revocationUrl: row.revocationUrl,
     dcrClientId: row.clientId || null,
     dcrClientSecret: row.clientSecret == null ? null : clientKey ? decryptSecret(row.clientSecret, clientKey) : row.clientSecret,
+    tokenEndpointAuthMethod: typeof metadata.tokenEndpointAuthMethod === "string" ? metadata.tokenEndpointAuthMethod : null,
     clientSource,
     status: statusFromUnified(row.status),
     lastErrorMessage: row.lastErrorMessage,
@@ -169157,6 +169242,7 @@ function upsertMcpApp(input) {
     authorizationServerIssuer: input.authorizationServerIssuer,
     registrationEndpoint: input.registrationEndpoint ?? null,
     clientSource: input.clientSource,
+    ...input.tokenEndpointAuthMethod !== undefined ? { tokenEndpointAuthMethod: input.tokenEndpointAuthMethod } : {},
     registeredScopes: input.registeredScopes !== undefined ? input.registeredScopes : existingMetadata.registeredScopes ?? null,
     invalidated: false
   });
@@ -169216,6 +169302,7 @@ function readMcpOAuthApp(appId) {
     authorizationServerIssuer: typeof metadata.authorizationServerIssuer === "string" ? metadata.authorizationServerIssuer : "",
     registrationEndpoint: typeof metadata.registrationEndpoint === "string" ? metadata.registrationEndpoint : null,
     registeredScopes: Array.isArray(metadata.registeredScopes) ? metadata.registeredScopes : null,
+    tokenEndpointAuthMethod: typeof metadata.tokenEndpointAuthMethod === "string" ? metadata.tokenEndpointAuthMethod : null,
     clientSource
   };
 }
@@ -169277,6 +169364,7 @@ function upsertMcpOAuthToken(input) {
       registeredScopes: input.registeredScopes,
       dcrClientId: input.dcrClientId,
       dcrClientSecret: input.dcrClientSecret,
+      tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
       clientSource: input.clientSource
     });
     upsertAuthorization({
@@ -169359,6 +169447,7 @@ function insertMcpOAuthPending(input) {
       registeredScopes: input.registeredScopes,
       dcrClientId: input.dcrClientId,
       dcrClientSecret: input.dcrClientSecret,
+      tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
       clientSource,
       redirectUri: input.redirectUri
     });
@@ -169373,6 +169462,7 @@ function insertMcpOAuthPending(input) {
       registeredScopes: input.registeredScopes ?? null,
       dcrClientId: input.dcrClientId ?? null,
       dcrClientSecret: input.dcrClientSecret == null ? null : encryptSecret(input.dcrClientSecret, getEncryptionKey()),
+      tokenEndpointAuthMethod: input.tokenEndpointAuthMethod ?? null,
       clientSource
     });
     getDb().query(`INSERT INTO oauth_pending (
@@ -169420,6 +169510,7 @@ function consumeMcpOAuthPending(state) {
       registeredScopes: Array.isArray(context.registeredScopes) ? context.registeredScopes : null,
       dcrClientId: typeof context.dcrClientId === "string" ? context.dcrClientId : null,
       dcrClientSecret: encryptedClientSecret ? decryptSecret(encryptedClientSecret, getEncryptionKey()) : null,
+      tokenEndpointAuthMethod: typeof context.tokenEndpointAuthMethod === "string" ? context.tokenEndpointAuthMethod : null,
       redirectUri: row.redirectUri,
       finalRedirect: row.finalRedirect,
       createdAt: normalizeDateRequired(row.createdAt)
@@ -169465,6 +169556,7 @@ async function ensureMcpToken(mcpServerId, opts = {}) {
         tokenUrl: token.tokenUrl,
         clientId: token.dcrClientId ?? "",
         clientSecret: token.dcrClientSecret ?? undefined,
+        tokenEndpointAuthMethod: authMethodForStoredClient(token.tokenEndpointAuthMethod),
         refreshToken: token.refreshToken,
         resource: token.resourceUrl,
         scopes: token.scope ? token.scope.split(" ").filter(Boolean) : undefined
@@ -170915,6 +171007,7 @@ ${members.join(`
 }
 
 // src/be/scripts/db.ts
+init_key();
 init_secret_scrubber();
 
 // src/utils/short-id.ts
@@ -170988,12 +171081,12 @@ function insertScript(args) {
   const typeChecked = args.typeChecked ? 1 : 0;
   const txn = getDb().transaction(() => {
     const row = getDb().prepare(`INSERT INTO scripts (
-          id, name, scope, scopeId, source, description, intent, signatureJson,
+          id, "key", name, scope, scopeId, source, description, intent, signatureJson,
           argsJsonSchema, contentHash, isScratch, typeChecked, fsMode, createdByAgentId, createdAt, updatedAt,
           created_by, updated_by
         )
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-        RETURNING *`).get(id, args.name, args.scope, scopeId, args.source, args.description, args.intent, args.signatureJson, args.argsJsonSchema ?? null, contentHash, isScratch, typeChecked, fsMode, args.agentId ?? null, now, now, args.createdBy ?? null, args.createdBy ?? null);
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        RETURNING *`).get(id, defaultAssetKey("script", id), args.name, args.scope, scopeId, args.source, args.description, args.intent, args.signatureJson, args.argsJsonSchema ?? null, contentHash, isScratch, typeChecked, fsMode, args.agentId ?? null, now, now, args.createdBy ?? null, args.createdBy ?? null);
     if (!row)
       throw new Error("Failed to insert script");
     insertScriptVersion({
@@ -171729,4 +171822,4 @@ async function buildScriptCredentialBindings(input) {
   return (await buildScriptCredentialBindingsWithFailures(input)).egressSecrets;
 }
 
-export { MIN_SCRIPT_WALL_CLOCK_MS, SCRIPT_LONG_TIMEOUT_HINT_MS, MAX_SCRIPT_WALL_CLOCK_MS, DEFAULT_SCRIPT_RESOURCES, isInvalidClientError, assertUrlSafe, publicEndpointSsrfOptions, discoverProtectedResourceMetadata, discoverAuthorizationServerMetadata, registerClient, buildAuthorizeUrl, exchangeCodeForTokens, refreshMcpToken, revokeMcpToken, computeExpiresAt, getMcpOAuthToken, findReusableMcpOAuthClient, invalidateMcpOAuthClient, upsertMcpOAuthToken, applyMcpOAuthRefresh, markMcpOAuthTokenStatus, deleteMcpOAuthToken, insertMcpOAuthPending, consumeMcpOAuthPending, gcMcpOAuthPending, setMcpServerAuthMethod, ensureMcpToken, callMcpServerTool, listVendoredOpenapiEntries, ConnectionAuthInputSchema, connectionAuthSummary, listRelationalCredentialBindings, upsertCredentialBinding, disableCredentialBinding, listScriptConnections, getScriptConnectionById, connectionAuthInputFromFlat, upsertScriptConnection, refreshScriptConnection, setScriptConnectionEnabled, getScriptApiConnectionDescriptors, getScriptMcpConnectionDescriptors, getScriptApiTypes, getScriptMcpTypes, upsertScriptByName, getScript, getScriptById, getScriptVersion, listScripts, listScriptVersions, deleteScript, createScriptApi, listScriptApisForScript, getScriptApiById, getScriptApiSecret, updateScriptApi, rotateScriptApiSecret, deleteScriptApi, recordScriptApiUsage, buildSandboxedCommand, sandboxSpawnEnv, createCappedStreamState, snapshotCapped, readStreamCapped, require_typescript, validateScriptImports, runScript, oauthAppToProviderConfig, getOAuthProviderConfig, getOAuthBindingTokenStatus, buildScriptCredentialBindingsWithFailures, buildScriptCredentialBindings };
+export { MIN_SCRIPT_WALL_CLOCK_MS, SCRIPT_LONG_TIMEOUT_HINT_MS, MAX_SCRIPT_WALL_CLOCK_MS, DEFAULT_SCRIPT_RESOURCES, isInvalidClientError, assertUrlSafe, publicEndpointSsrfOptions, discoverProtectedResourceMetadata, discoverAuthorizationServerMetadata, normalizeTokenEndpointAuthMethod, resolveAdvertisedTokenEndpointAuthMethod, authMethodForStoredClient, selectDcrTokenEndpointAuthMethod, registerClient, buildAuthorizeUrl, exchangeCodeForTokens, refreshMcpToken, revokeMcpToken, computeExpiresAt, getMcpOAuthToken, findReusableMcpOAuthClient, invalidateMcpOAuthClient, upsertMcpOAuthToken, applyMcpOAuthRefresh, markMcpOAuthTokenStatus, deleteMcpOAuthToken, insertMcpOAuthPending, consumeMcpOAuthPending, gcMcpOAuthPending, setMcpServerAuthMethod, ensureMcpToken, callMcpServerTool, listVendoredOpenapiEntries, ConnectionAuthInputSchema, connectionAuthSummary, listRelationalCredentialBindings, upsertCredentialBinding, disableCredentialBinding, listScriptConnections, getScriptConnectionById, connectionAuthInputFromFlat, upsertScriptConnection, refreshScriptConnection, setScriptConnectionEnabled, getScriptApiConnectionDescriptors, getScriptMcpConnectionDescriptors, getScriptApiTypes, getScriptMcpTypes, upsertScriptByName, getScript, getScriptById, getScriptVersion, listScripts, listScriptVersions, deleteScript, createScriptApi, listScriptApisForScript, getScriptApiById, getScriptApiSecret, updateScriptApi, rotateScriptApiSecret, deleteScriptApi, recordScriptApiUsage, buildSandboxedCommand, sandboxSpawnEnv, createCappedStreamState, snapshotCapped, readStreamCapped, require_typescript, validateScriptImports, runScript, oauthAppToProviderConfig, getOAuthProviderConfig, getOAuthBindingTokenStatus, buildScriptCredentialBindingsWithFailures, buildScriptCredentialBindings };