@desplega.ai/agent-swarm 1.165.0 → 1.166.0

package/dist/cli-a87b04k8.js

@@ -1,951 +0,0 @@
-import {
-  decryptSecret,
-  encryptSecret,
-  getDbClient,
-  getEncryptionKey,
-  init_crypto,
-  init_date_utils,
-  init_db,
-  normalizeDateRequired
-} from "./cli-qdv8kgz7.js";
-import {
-  init_secret_scrubber,
-  registerVolatileSecret,
-  scrubSecrets
-} from "./cli-h1spv8v4.js";
-
-// src/be/db-queries/oauth.ts
-init_crypto();
-init_date_utils();
-init_db();
-function parseScopeList(value) {
-  try {
-    const parsed = JSON.parse(value);
-    if (Array.isArray(parsed)) {
-      return parsed.filter((item) => typeof item === "string");
-    }
-  } catch {}
-  return value.split(",").map((scope) => scope.trim()).filter(Boolean);
-}
-function storeScopeList(value) {
-  return JSON.stringify(Array.isArray(value) ? value : parseScopeList(value));
-}
-function parseObject(value) {
-  try {
-    const parsed = JSON.parse(value || "{}");
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function storageMetadata(metadata) {
-  const parsed = parseObject(metadata);
-  const extraParams = parsed.extraParams && typeof parsed.extraParams === "object" && !Array.isArray(parsed.extraParams) ? parsed.extraParams : null;
-  const tokenAuthStyle = parsed.tokenAuthStyle === "basic" ? "basic" : "body";
-  const tokenBodyFormat = parsed.tokenBodyFormat === "json" ? "json" : "form";
-  const revocationUrl = typeof parsed.revocationUrl === "string" ? parsed.revocationUrl : null;
-  const hasLiftedFields = [
-    "extraParams",
-    "tokenAuthStyle",
-    "tokenBodyFormat",
-    "revocationUrl"
-  ].some((key) => Object.hasOwn(parsed, key));
-  if (hasLiftedFields) {
-    delete parsed.extraParams;
-    delete parsed.tokenAuthStyle;
-    delete parsed.tokenBodyFormat;
-    delete parsed.revocationUrl;
-  }
-  return {
-    metadata: hasLiftedFields ? JSON.stringify(parsed) : metadata,
-    extraParamsJson: extraParams ? JSON.stringify(extraParams) : null,
-    tokenAuthStyle,
-    tokenBodyFormat,
-    revocationUrl
-  };
-}
-function normalizeOAuthApp(row) {
-  const encrypted = row.clientSecretEncrypted === 1;
-  return {
-    ...row,
-    clientSecret: row.clientSecret == null ? "" : encrypted ? decryptSecret(row.clientSecret, getEncryptionKey()) : row.clientSecret,
-    clientSecretEncrypted: encrypted,
-    scopes: parseScopeList(row.scopes).join(","),
-    requiresRefreshTokenRotation: row.requiresRefreshTokenRotation === 1,
-    createdAt: normalizeDateRequired(row.createdAt),
-    updatedAt: normalizeDateRequired(row.updatedAt)
-  };
-}
-function normalizeAuthorization(row) {
-  const encrypted = row.tokensEncrypted === 1;
-  const key = encrypted ? getEncryptionKey() : null;
-  return {
-    ...row,
-    accessToken: key ? decryptSecret(row.accessToken, key) : row.accessToken,
-    refreshToken: row.refreshToken == null ? null : key ? decryptSecret(row.refreshToken, key) : row.refreshToken,
-    tokensEncrypted: encrypted,
-    createdAt: normalizeDateRequired(row.createdAt),
-    updatedAt: normalizeDateRequired(row.updatedAt)
-  };
-}
-async function rawOAuthAppByProvider(provider) {
-  return await getDbClient().get(`SELECT * FROM oauth_apps
-       WHERE provider = ? AND mcpServerId IS NULL
-       ORDER BY createdAt ASC, id ASC
-       LIMIT 1`, [provider]);
-}
-async function rawOAuthAppById(id) {
-  return await getDbClient().get("SELECT * FROM oauth_apps WHERE id = ? AND mcpServerId IS NULL", [id]);
-}
-async function rawDefaultAuthorizationForApp(appId) {
-  return await getDbClient().get("SELECT * FROM oauth_authorizations WHERE appId = ? AND label = 'default'", [appId]);
-}
-async function rawDefaultAuthorizationForProvider(provider) {
-  return await getDbClient().get(`SELECT z.*
-       FROM oauth_authorizations z
-       JOIN oauth_apps a ON a.id = z.appId
-       WHERE a.provider = ? AND a.mcpServerId IS NULL AND z.label = 'default'
-       ORDER BY a.createdAt ASC, a.id ASC
-       LIMIT 1`, [provider]);
-}
-async function getDefaultAuthorizationIdForProvider(provider) {
-  return (await rawDefaultAuthorizationForProvider(provider))?.id ?? null;
-}
-async function getOAuthApp(provider) {
-  const row = await rawOAuthAppByProvider(provider);
-  return row ? normalizeOAuthApp(row) : null;
-}
-async function getOAuthAppById(id) {
-  const row = await getDbClient().get("SELECT * FROM oauth_apps WHERE id = ?", [id]);
-  return row ? normalizeOAuthApp(row) : null;
-}
-async function getOAuthAppIdByProvider(provider) {
-  return (await rawOAuthAppByProvider(provider))?.id ?? null;
-}
-async function writeOAuthApp(existing, provider, data) {
-  const metadataProvided = data.metadata !== undefined;
-  const lifted = metadataProvided ? storageMetadata(data.metadata) : null;
-  const encryptedSecret = encryptSecret(data.clientSecret, getEncryptionKey());
-  const scopeSeparator = data.scopeSeparator ?? existing?.scopeSeparator ?? (provider === "linear" ? "," : " ");
-  const rotation = data.requiresRefreshTokenRotation ?? (existing ? existing.requiresRefreshTokenRotation === 1 : provider === "jira");
-  const tokenAuthStyle = data.tokenAuthStyle ?? lifted?.tokenAuthStyle ?? existing?.tokenAuthStyle ?? "body";
-  const tokenBodyFormat = data.tokenBodyFormat ?? lifted?.tokenBodyFormat ?? existing?.tokenBodyFormat ?? "form";
-  const extraParamsJson = data.extraParams !== undefined ? data.extraParams == null ? null : JSON.stringify(data.extraParams) : lifted ? lifted.extraParamsJson : existing?.extraParamsJson ?? null;
-  const revocationUrl = data.revocationUrl !== undefined ? data.revocationUrl : lifted ? lifted.revocationUrl : existing?.revocationUrl ?? null;
-  if (existing) {
-    await getDbClient().run(`UPDATE oauth_apps SET
-           displayName = ?, clientId = ?, clientSecret = ?, clientSecretEncrypted = 1,
-           authorizeUrl = ?, tokenUrl = ?, revocationUrl = ?, userinfoUrl = ?,
-           redirectUri = ?, scopes = ?, scopeSeparator = ?, tokenAuthStyle = ?,
-           tokenBodyFormat = ?, requiresRefreshTokenRotation = ?, extraParamsJson = ?,
-           source = ?, metadata = ?, updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-         WHERE id = ?`, [
-      data.displayName !== undefined ? data.displayName : existing.displayName,
-      data.clientId,
-      encryptedSecret,
-      data.authorizeUrl,
-      data.tokenUrl,
-      revocationUrl,
-      data.userinfoUrl !== undefined ? data.userinfoUrl : existing.userinfoUrl,
-      data.redirectUri,
-      storeScopeList(data.scopes),
-      scopeSeparator,
-      tokenAuthStyle,
-      tokenBodyFormat,
-      rotation ? 1 : 0,
-      extraParamsJson,
-      data.source ?? existing.source,
-      lifted?.metadata ?? existing.metadata,
-      existing.id
-    ]);
-    return existing.id;
-  }
-  const inserted = await getDbClient().get(`INSERT INTO oauth_apps (
-         provider, displayName, clientId, clientSecret, clientSecretEncrypted,
-         authorizeUrl, tokenUrl, revocationUrl, userinfoUrl, redirectUri, scopes,
-         scopeSeparator, tokenAuthStyle, tokenBodyFormat,
-         requiresRefreshTokenRotation, extraParamsJson, source, metadata
-       ) VALUES (?, ?, ?, ?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-       RETURNING id`, [
-    provider,
-    data.displayName ?? null,
-    data.clientId,
-    encryptedSecret,
-    data.authorizeUrl,
-    data.tokenUrl,
-    revocationUrl,
-    data.userinfoUrl ?? null,
-    data.redirectUri,
-    storeScopeList(data.scopes),
-    scopeSeparator,
-    tokenAuthStyle,
-    tokenBodyFormat,
-    rotation ? 1 : 0,
-    extraParamsJson,
-    data.source ?? "manual",
-    lifted?.metadata ?? "{}"
-  ]);
-  return inserted.id;
-}
-async function createOAuthApp(provider, data) {
-  return await writeOAuthApp(null, provider, data);
-}
-async function updateOAuthAppById(id, data) {
-  const existing = await rawOAuthAppById(id);
-  if (!existing) {
-    throw new Error(`OAuth app ${id} not found.`);
-  }
-  await writeOAuthApp(existing, existing.provider, data);
-}
-async function upsertOAuthApp(provider, data) {
-  await writeOAuthApp(await rawOAuthAppByProvider(provider), provider, data);
-}
-async function listAuthorizationsForApp(appId) {
-  const rows = await getDbClient().query("SELECT * FROM oauth_authorizations WHERE appId = ? ORDER BY createdAt ASC, id ASC", [appId]);
-  return rows.map(normalizeAuthorization);
-}
-async function getAuthorizationById(id) {
-  const row = await getDbClient().get("SELECT * FROM oauth_authorizations WHERE id = ?", [id]);
-  return row ? normalizeAuthorization(row) : null;
-}
-async function upsertAuthorization(data) {
-  const label = data.label ?? "default";
-  const existing = data.id ? await getAuthorizationById(data.id) : (await listAuthorizationsForApp(data.appId)).find((row) => row.label === label);
-  const key = getEncryptionKey();
-  const accessToken = encryptSecret(data.accessToken, key);
-  const refreshToken = data.refreshToken === undefined ? undefined : data.refreshToken == null ? null : encryptSecret(data.refreshToken, key);
-  if (existing) {
-    await getDbClient().run(`UPDATE oauth_authorizations SET
-           userId = ?, accountEmail = ?, identityJson = ?, accessToken = ?,
-           refreshToken = ?, tokenType = ?, expiresAt = ?, scope = ?,
-           tokensEncrypted = 1, tokenVersion = tokenVersion + 1, status = ?,
-           lastErrorMessage = ?, lastRefreshedAt = ?, connectedByUserId = ?,
-           updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-         WHERE id = ?`, [
-      data.userId !== undefined ? data.userId : existing.userId,
-      data.accountEmail !== undefined ? data.accountEmail : existing.accountEmail,
-      data.identityJson !== undefined ? data.identityJson : existing.identityJson,
-      accessToken,
-      refreshToken === undefined ? existing.refreshToken == null ? null : encryptSecret(existing.refreshToken, key) : refreshToken,
-      data.tokenType ?? existing.tokenType,
-      data.expiresAt !== undefined ? data.expiresAt : existing.expiresAt,
-      data.scope !== undefined ? data.scope : existing.scope,
-      data.status ?? existing.status,
-      data.lastErrorMessage !== undefined ? data.lastErrorMessage : existing.lastErrorMessage,
-      data.lastRefreshedAt !== undefined ? data.lastRefreshedAt : existing.lastRefreshedAt,
-      data.connectedByUserId !== undefined ? data.connectedByUserId : existing.connectedByUserId,
-      existing.id
-    ]);
-    return await getAuthorizationById(existing.id);
-  }
-  const id = data.id ?? crypto.randomUUID();
-  await getDbClient().run(`INSERT INTO oauth_authorizations (
-         id, appId, label, userId, accountEmail, identityJson,
-         accessToken, refreshToken, tokenType, expiresAt, scope,
-         tokensEncrypted, tokenVersion, status, lastErrorMessage,
-         lastRefreshedAt, connectedByUserId
-       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, 1, ?, ?, ?, ?)`, [
-    id,
-    data.appId,
-    label,
-    data.userId ?? null,
-    data.accountEmail ?? null,
-    data.identityJson ?? null,
-    accessToken,
-    refreshToken ?? null,
-    data.tokenType ?? "Bearer",
-    data.expiresAt ?? null,
-    data.scope ?? null,
-    data.status ?? "active",
-    data.lastErrorMessage ?? null,
-    data.lastRefreshedAt ?? null,
-    data.connectedByUserId ?? null
-  ]);
-  return await getAuthorizationById(id);
-}
-async function updateAuthorizationTokens(id, data) {
-  const existing = await getAuthorizationById(id);
-  if (!existing)
-    return null;
-  const expectedVersion = data.expectedTokenVersion ?? existing.tokenVersion;
-  const key = getEncryptionKey();
-  const encryptedRefresh = data.refreshToken === undefined ? existing.refreshToken == null ? null : encryptSecret(existing.refreshToken, key) : data.refreshToken == null ? null : encryptSecret(data.refreshToken, key);
-  const result = await getDbClient().run(`UPDATE oauth_authorizations SET
-         accessToken = ?, refreshToken = ?, expiresAt = ?, scope = ?,
-         tokensEncrypted = 1, tokenVersion = tokenVersion + 1,
-         status = 'active', lastErrorMessage = NULL,
-         lastRefreshedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now'),
-         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ? AND tokenVersion = ?`, [
-    encryptSecret(data.accessToken, key),
-    encryptedRefresh,
-    data.expiresAt !== undefined ? data.expiresAt : existing.expiresAt,
-    data.scope !== undefined ? data.scope : existing.scope,
-    id,
-    expectedVersion
-  ]);
-  return result.changes === 1 ? await getAuthorizationById(id) : null;
-}
-async function updateAuthorizationIdentity(id, data) {
-  await getDbClient().run(`UPDATE oauth_authorizations SET
-         accountEmail = ?, identityJson = ?,
-         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ?`, [data.accountEmail ?? null, data.identityJson ?? null, id]);
-}
-async function deleteAuthorizationById(id) {
-  const result = await getDbClient().run("DELETE FROM oauth_authorizations WHERE id = ?", [id]);
-  return result.changes > 0;
-}
-async function deleteAuthorizationsForApp(appId) {
-  return (await getDbClient().run("DELETE FROM oauth_authorizations WHERE appId = ?", [appId])).changes;
-}
-var OAUTH_PENDING_TTL_MS = 10 * 60 * 1000;
-async function createOAuthPending(input) {
-  await getDbClient().run(`INSERT INTO oauth_pending (
-         state, appId, label, flow, codeVerifier, nonce,
-         redirectUri, finalRedirect, userId, contextJson
-       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
-    input.state,
-    input.appId,
-    input.label ?? "default",
-    input.flow ?? "generic",
-    encryptSecret(input.codeVerifier, getEncryptionKey()),
-    input.nonce ?? null,
-    input.redirectUri,
-    input.finalRedirect ?? null,
-    input.userId ?? null,
-    input.contextJson ?? "{}"
-  ]);
-}
-async function consumeOAuthPending(state) {
-  return await getDbClient().transaction(async (tx) => {
-    const row = await tx.get(`SELECT state, appId, label, flow, codeVerifier, nonce, redirectUri,
-              finalRedirect, userId, contextJson, createdAt
-       FROM oauth_pending
-       WHERE state = ? AND flow IN ('generic', 'tracker')`, [state]);
-    if (!row)
-      return null;
-    await tx.run("DELETE FROM oauth_pending WHERE state = ?", [state]);
-    const createdAt = normalizeDateRequired(row.createdAt);
-    const createdMs = new Date(createdAt).getTime();
-    if (Number.isNaN(createdMs) || Date.now() - createdMs > OAUTH_PENDING_TTL_MS) {
-      return null;
-    }
-    return {
-      ...row,
-      codeVerifier: decryptSecret(row.codeVerifier, getEncryptionKey()),
-      createdAt
-    };
-  });
-}
-async function gcOAuthPending(olderThanMs = 10 * 60 * 1000) {
-  const cutoff = new Date(Date.now() - olderThanMs).toISOString();
-  const result = await getDbClient().run("DELETE FROM oauth_pending WHERE flow IN ('generic', 'tracker') AND createdAt < ?", [cutoff]);
-  return result.changes;
-}
-async function markAuthorizationRefreshFailed(id, message) {
-  const result = await getDbClient().run(`UPDATE oauth_authorizations SET
-         status = 'refresh-failed', lastErrorMessage = ?,
-         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ? AND status != 'revoked'`, [message, id]);
-  return result.changes === 1 ? await getAuthorizationById(id) : null;
-}
-async function getOAuthTokens(provider) {
-  const row = await rawDefaultAuthorizationForProvider(provider);
-  if (!row)
-    return null;
-  const authorization = normalizeAuthorization(row);
-  if (authorization.status === "revoked")
-    return null;
-  return {
-    id: authorization.id,
-    provider,
-    accessToken: authorization.accessToken,
-    refreshToken: authorization.refreshToken,
-    expiresAt: authorization.expiresAt ?? "",
-    scope: authorization.scope,
-    tokenVersion: authorization.tokenVersion,
-    createdAt: authorization.createdAt,
-    updatedAt: authorization.updatedAt
-  };
-}
-async function listAuthorizationSweepRows() {
-  const rows = await getDbClient().query(`SELECT z.id AS authorizationId,
-              z.appId AS appId,
-              a.provider AS provider,
-              z.label AS label,
-              z.status AS status,
-              CASE WHEN z.refreshToken IS NOT NULL AND z.refreshToken != '' THEN 1 ELSE 0 END AS hasRefreshToken,
-              COALESCE(z.expiresAt, '') AS expiresAt,
-              z.updatedAt AS updatedAt
-       FROM oauth_authorizations z
-       JOIN oauth_apps a ON a.id = z.appId
-       WHERE a.mcpServerId IS NULL
-       ORDER BY a.provider ASC, z.label ASC`);
-  return rows.map((row) => ({
-    authorizationId: row.authorizationId,
-    appId: row.appId,
-    provider: row.provider,
-    label: row.label,
-    status: row.status,
-    hasRefreshToken: row.hasRefreshToken === 1,
-    expiresAt: normalizeDateRequired(row.expiresAt),
-    updatedAt: normalizeDateRequired(row.updatedAt)
-  }));
-}
-async function listKeepAliveAuthorizations() {
-  const rows = await getDbClient().query(`SELECT z.id AS authorizationId,
-              z.appId AS appId,
-              a.provider AS provider,
-              z.label AS label,
-              a.displayName AS displayName
-       FROM oauth_authorizations z
-       JOIN oauth_apps a ON a.id = z.appId
-       WHERE a.mcpServerId IS NULL
-         AND z.status = 'active'
-         AND z.refreshToken IS NOT NULL AND z.refreshToken != ''
-         AND (
-           a.requiresRefreshTokenRotation = 1
-           OR (json_valid(a.metadata) = 1 AND json_extract(a.metadata, '$.keepAlive') IN (1, 'true'))
-         )
-       ORDER BY a.provider ASC, z.label ASC`);
-  return rows.map((row) => ({
-    authorizationId: row.authorizationId,
-    appId: row.appId,
-    provider: row.provider,
-    label: row.label,
-    displayName: row.displayName
-  }));
-}
-async function deleteOAuthTokens(provider) {
-  const app = await rawOAuthAppByProvider(provider);
-  if (!app)
-    return;
-  const existing = await rawDefaultAuthorizationForApp(app.id);
-  if (!existing)
-    return;
-  await getDbClient().run(`UPDATE oauth_authorizations SET
-         accessToken = ?, refreshToken = NULL, expiresAt = NULL, scope = NULL,
-         tokensEncrypted = 1, tokenVersion = tokenVersion + 1,
-         status = 'revoked', lastErrorMessage = NULL, lastRefreshedAt = NULL,
-         updatedAt = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-       WHERE id = ?`, [encryptSecret("", getEncryptionKey()), existing.id]);
-}
-async function acquireOAuthRefreshLock(lockKey, ttlMs) {
-  const owner = crypto.randomUUID();
-  const now = Date.now();
-  const expiresAt = new Date(now + ttlMs).toISOString();
-  const nowIso = new Date(now).toISOString();
-  await getDbClient().run(`INSERT INTO oauth_refresh_locks (lockKey, owner, expiresAt, createdAt, updatedAt)
-       VALUES (?, ?, ?, ?, ?)
-       ON CONFLICT(lockKey) DO UPDATE SET
-         owner = excluded.owner,
-         expiresAt = excluded.expiresAt,
-         updatedAt = excluded.updatedAt
-       WHERE oauth_refresh_locks.expiresAt <= ?`, [lockKey, owner, expiresAt, nowIso, nowIso, nowIso]);
-  const row = await getDbClient().get("SELECT owner FROM oauth_refresh_locks WHERE lockKey = ?", [lockKey]);
-  return row?.owner === owner ? owner : null;
-}
-async function releaseOAuthRefreshLock(lockKey, owner) {
-  await getDbClient().run("DELETE FROM oauth_refresh_locks WHERE lockKey = ? AND owner = ?", [
-    lockKey,
-    owner
-  ]);
-}
-
-// src/oauth/ensure-token.ts
-init_secret_scrubber();
-
-// node_modules/oauth4webapi/build/index.js
-var USER_AGENT;
-if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
-  const NAME = "oauth4webapi";
-  const VERSION = "v3.8.5";
-  USER_AGENT = `${NAME}/${VERSION}`;
-}
-var ERR_INVALID_ARG_VALUE = "ERR_INVALID_ARG_VALUE";
-var ERR_INVALID_ARG_TYPE = "ERR_INVALID_ARG_TYPE";
-function CodedTypeError(message, code, cause) {
-  const err = new TypeError(message, { cause });
-  Object.assign(err, { code });
-  return err;
-}
-var allowInsecureRequests = Symbol();
-var clockSkew = Symbol();
-var clockTolerance = Symbol();
-var customFetch = Symbol();
-var modifyAssertion = Symbol();
-var jweDecrypt = Symbol();
-var jwksCache = Symbol();
-var encoder = new TextEncoder;
-var decoder = new TextDecoder;
-function buf(input) {
-  if (typeof input === "string") {
-    return encoder.encode(input);
-  }
-  return decoder.decode(input);
-}
-var encodeBase64Url;
-if (Uint8Array.prototype.toBase64) {
-  encodeBase64Url = (input) => {
-    if (input instanceof ArrayBuffer) {
-      input = new Uint8Array(input);
-    }
-    return input.toBase64({ alphabet: "base64url", omitPadding: true });
-  };
-} else {
-  const CHUNK_SIZE = 32768;
-  encodeBase64Url = (input) => {
-    if (input instanceof ArrayBuffer) {
-      input = new Uint8Array(input);
-    }
-    const arr = [];
-    for (let i = 0;i < input.byteLength; i += CHUNK_SIZE) {
-      arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
-    }
-    return btoa(arr.join("")).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
-  };
-}
-var decodeBase64Url;
-if (Uint8Array.fromBase64) {
-  decodeBase64Url = (input) => {
-    try {
-      return Uint8Array.fromBase64(input, { alphabet: "base64url" });
-    } catch (cause) {
-      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
-    }
-  };
-} else {
-  decodeBase64Url = (input) => {
-    try {
-      const binary = atob(input.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, ""));
-      const bytes = new Uint8Array(binary.length);
-      for (let i = 0;i < binary.length; i++) {
-        bytes[i] = binary.charCodeAt(i);
-      }
-      return bytes;
-    } catch (cause) {
-      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
-    }
-  };
-}
-function b64u(input) {
-  if (typeof input === "string") {
-    return decodeBase64Url(input);
-  }
-  return encodeBase64Url(input);
-}
-class OperationProcessingError extends Error {
-  code;
-  constructor(message, options) {
-    super(message, options);
-    this.name = this.constructor.name;
-    if (options?.code) {
-      this.code = options?.code;
-    }
-    Error.captureStackTrace?.(this, this.constructor);
-  }
-}
-function OPE(message, code, cause) {
-  return new OperationProcessingError(message, { code, cause });
-}
-function assertString(input, it, code, cause) {
-  try {
-    if (typeof input !== "string") {
-      throw CodedTypeError(`${it} must be a string`, ERR_INVALID_ARG_TYPE, cause);
-    }
-    if (input.length === 0) {
-      throw CodedTypeError(`${it} must not be empty`, ERR_INVALID_ARG_VALUE, cause);
-    }
-  } catch (err) {
-    if (code) {
-      throw OPE(err.message, code, cause);
-    }
-    throw err;
-  }
-}
-function randomBytes() {
-  return b64u(crypto.getRandomValues(new Uint8Array(32)));
-}
-function generateRandomCodeVerifier() {
-  return randomBytes();
-}
-function generateRandomState() {
-  return randomBytes();
-}
-async function calculatePKCECodeChallenge(codeVerifier) {
-  assertString(codeVerifier, "codeVerifier");
-  return b64u(await crypto.subtle.digest("SHA-256", buf(codeVerifier)));
-}
-var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) => {
-  try {
-    return new URL(url, base);
-  } catch {
-    return null;
-  }
-};
-var tokenMatch = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+";
-var token68Match = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}";
-var quotedMatch = '"((?:[^"\\\\]|\\\\[\\s\\S])*)"';
-var quotedParamMatcher = "(" + tokenMatch + ")\\s*=\\s*" + quotedMatch;
-var paramMatcher = "(" + tokenMatch + ")\\s*=\\s*(" + tokenMatch + ")";
-var schemeRE = new RegExp("^[,\\s]*(" + tokenMatch + ")");
-var quotedParamRE = new RegExp("^[,\\s]*" + quotedParamMatcher + "[,\\s]*(.*)");
-var unquotedParamRE = new RegExp("^[,\\s]*" + paramMatcher + "[,\\s]*(.*)");
-var token68ParamRE = new RegExp("^(" + token68Match + ")(?:$|[,\\s])(.*)");
-var skipSubjectCheck = Symbol();
-var idTokenClaims = new WeakMap;
-var jwtRefs = new WeakMap;
-var branded = new WeakSet;
-var nopkce = Symbol();
-var expectNoNonce = Symbol();
-var skipAuthTimeCheck = Symbol();
-var skipStateCheck = Symbol();
-var expectNoState = Symbol();
-var _nodiscoverycheck = Symbol();
-var _expectedIssuer = Symbol();
-
-// src/oauth/wrapper.ts
-async function buildAuthorizationUrl(config, options = {}) {
-  const state = generateRandomState();
-  const codeVerifier = generateRandomCodeVerifier();
-  const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);
-  const appId = options.appId ?? await getOAuthAppIdByProvider(config.provider);
-  if (!appId) {
-    throw new Error(`OAuth app ${config.provider} is not configured`);
-  }
-  await createOAuthPending({
-    state,
-    appId,
-    label: options.label ?? "default",
-    flow: options.flow ?? "generic",
-    codeVerifier,
-    nonce: options.nonce ?? null,
-    redirectUri: config.redirectUri,
-    finalRedirect: options.finalRedirect ?? null,
-    userId: options.userId ?? null
-  });
-  const url = new URL(config.authorizeUrl);
-  url.searchParams.set("client_id", config.clientId);
-  url.searchParams.set("redirect_uri", config.redirectUri);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("scope", config.scopes.join(config.scopeSeparator ?? ","));
-  url.searchParams.set("state", state);
-  url.searchParams.set("code_challenge", codeChallenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  if (config.extraParams) {
-    for (const [key, value] of Object.entries(config.extraParams)) {
-      url.searchParams.set(key, value);
-    }
-  }
-  return { url: url.toString(), state, codeVerifier };
-}
-function tokenRequestInit(config, params) {
-  const useBasic = config.tokenAuthStyle === "basic";
-  const bodyParams = useBasic ? params : { ...params, client_id: config.clientId, client_secret: config.clientSecret };
-  const headers = { Accept: "application/json" };
-  if (useBasic) {
-    headers.Authorization = `Basic ${Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64")}`;
-  }
-  if (config.tokenBodyFormat === "json") {
-    headers["Content-Type"] = "application/json";
-    return { headers, body: JSON.stringify(bodyParams) };
-  }
-  headers["Content-Type"] = "application/x-www-form-urlencoded";
-  return { headers, body: new URLSearchParams(bodyParams).toString() };
-}
-async function exchangeAuthorizationCode(config, params) {
-  const response = await fetch(config.tokenUrl, {
-    method: "POST",
-    ...tokenRequestInit(config, {
-      grant_type: "authorization_code",
-      redirect_uri: params.redirectUri,
-      code: params.code,
-      code_verifier: params.codeVerifier
-    })
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(`Token exchange failed (${response.status}): ${errorText}`);
-  }
-  const data = await response.json();
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresIn: data.expires_in,
-    scope: data.scope,
-    tokenType: data.token_type,
-    idToken: data.id_token
-  };
-}
-async function performTokenRefreshRequest(config, refreshToken) {
-  const response = await fetch(config.tokenUrl, {
-    method: "POST",
-    ...tokenRequestInit(config, {
-      grant_type: "refresh_token",
-      refresh_token: refreshToken
-    })
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(`Token refresh failed (${response.status}): ${errorText}`);
-  }
-  const data = await response.json();
-  if (typeof data.access_token !== "string" || data.access_token.length === 0) {
-    throw new Error(`Token refresh failed: ${config.provider} response missing access_token`);
-  }
-  if (config.requiresRefreshTokenRotation && (typeof data.refresh_token !== "string" || data.refresh_token.length === 0)) {
-    throw new Error(`Token refresh failed: ${config.provider} response did not include a rotated refresh_token`);
-  }
-  const expiresAt = data.expires_in ? new Date(Date.now() + data.expires_in * 1000).toISOString() : null;
-  return {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresIn: data.expires_in,
-    scope: data.scope,
-    expiresAt
-  };
-}
-
-// src/oauth/ensure-token.ts
-function parseMetadata(metadataJson) {
-  try {
-    const parsed = JSON.parse(metadataJson || "{}");
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function stringRecord(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    return;
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, String(item)]));
-}
-function oauthAppRowToProviderConfig(app) {
-  const metadata = parseMetadata(app.metadata);
-  const liftedExtraParams = stringRecord(parseMetadata(app.extraParamsJson));
-  const extraParams = {
-    ...typeof metadata.actor === "string" ? { actor: metadata.actor } : {},
-    ...liftedExtraParams
-  };
-  return {
-    provider: app.provider,
-    clientId: app.clientId,
-    clientSecret: app.clientSecret,
-    authorizeUrl: app.authorizeUrl,
-    tokenUrl: app.tokenUrl,
-    redirectUri: app.redirectUri,
-    scopes: app.scopes.split(",").map((scope) => scope.trim()).filter(Boolean),
-    extraParams: Object.keys(extraParams).length > 0 ? extraParams : undefined,
-    scopeSeparator: app.scopeSeparator,
-    tokenAuthStyle: app.tokenAuthStyle,
-    tokenBodyFormat: app.tokenBodyFormat,
-    requiresRefreshTokenRotation: app.requiresRefreshTokenRotation
-  };
-}
-
-class OAuthRefreshError extends Error {
-  authorizationId;
-  appId;
-  reason;
-  authorizationLabel;
-  constructor(authorizationId, appId, reason, authorizationLabel, message) {
-    super(message ?? `OAuth authorization '${authorizationLabel}' refresh failed (${reason})`);
-    this.authorizationId = authorizationId;
-    this.appId = appId;
-    this.reason = reason;
-    this.authorizationLabel = authorizationLabel;
-    this.name = "OAuthRefreshError";
-  }
-}
-function authorizationLabelFor(app, authorization) {
-  const base = app.displayName?.trim() || app.provider;
-  return authorization.label && authorization.label !== "default" ? `${base} (${authorization.label})` : base;
-}
-var refreshLocks = new Map;
-var REFRESH_LOCK_TTL_MS = 2 * 60 * 1000;
-var REFRESH_LOCK_WAIT_MS = 30 * 1000;
-var REFRESH_LOCK_POLL_MS = 250;
-var DEFAULT_REFRESH_BUFFER_MS = 5 * 60 * 1000;
-async function withAuthorizationRefreshLock(authorizationId, fn) {
-  const previous = refreshLocks.get(authorizationId) ?? Promise.resolve();
-  let release;
-  const current = new Promise((resolve) => {
-    release = resolve;
-  });
-  const next = previous.catch(() => {
-    return;
-  }).then(() => current);
-  refreshLocks.set(authorizationId, next);
-  await previous.catch(() => {
-    return;
-  });
-  try {
-    return await fn();
-  } finally {
-    release();
-    if (refreshLocks.get(authorizationId) === next) {
-      refreshLocks.delete(authorizationId);
-    }
-  }
-}
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function authorizationNeedsRefresh(authorization, bufferMs = DEFAULT_REFRESH_BUFFER_MS, force = false) {
-  if (authorization.status === "refresh-failed" || authorization.status === "expired")
-    return true;
-  if (force)
-    return true;
-  if (!authorization.expiresAt)
-    return false;
-  const expiresAt = new Date(authorization.expiresAt).getTime();
-  if (Number.isNaN(expiresAt))
-    return true;
-  return expiresAt - Date.now() < bufferMs;
-}
-var authorizationRefreshedListeners = new Set;
-function onAuthorizationRefreshed(listener) {
-  authorizationRefreshedListeners.add(listener);
-  return () => {
-    authorizationRefreshedListeners.delete(listener);
-  };
-}
-function notifyAuthorizationRefreshed(event) {
-  for (const listener of authorizationRefreshedListeners) {
-    try {
-      listener(event);
-    } catch (err) {
-      console.error(scrubSecrets(`[OAuth] authorization-refreshed listener failed for ${event.provider}: ${err instanceof Error ? err.message : String(err)}`));
-    }
-  }
-}
-async function ensureAuthorizationTokenOrThrow(authorizationId, bufferMs, force = false) {
-  const initial = await getAuthorizationById(authorizationId);
-  if (!initial || initial.status === "revoked")
-    return;
-  if (!authorizationNeedsRefresh(initial, bufferMs, force))
-    return;
-  await withAuthorizationRefreshLock(authorizationId, async () => {
-    const waitStartedAt = Date.now();
-    while (true) {
-      const current = await getAuthorizationById(authorizationId);
-      if (!current || current.status === "revoked")
-        return;
-      if (current.tokenVersion !== initial.tokenVersion)
-        return;
-      if (!authorizationNeedsRefresh(current, bufferMs, force))
-        return;
-      const app = await getOAuthAppById(current.appId);
-      if (!app || app.mcpServerId !== null)
-        return;
-      if (!current.refreshToken) {
-        const label = authorizationLabelFor(app, current);
-        const message = `OAuth authorization '${label}' cannot refresh: no refresh token stored`;
-        await markAuthorizationRefreshFailed(authorizationId, message);
-        throw new OAuthRefreshError(authorizationId, app.id, "no_refresh_token", label, message);
-      }
-      const lockOwner = await acquireOAuthRefreshLock(`authz:${authorizationId}`, REFRESH_LOCK_TTL_MS);
-      if (!lockOwner) {
-        if (Date.now() - waitStartedAt > REFRESH_LOCK_WAIT_MS) {
-          const label = authorizationLabelFor(app, current);
-          const message = `Timed out waiting for OAuth refresh lock for '${label}'`;
-          await markAuthorizationRefreshFailed(authorizationId, message);
-          throw new OAuthRefreshError(authorizationId, app.id, "lock_timeout", label, message);
-        }
-        await sleep(REFRESH_LOCK_POLL_MS);
-        continue;
-      }
-      try {
-        const locked = await getAuthorizationById(authorizationId);
-        if (!locked || locked.status === "revoked")
-          return;
-        if (locked.tokenVersion !== initial.tokenVersion)
-          return;
-        if (!authorizationNeedsRefresh(locked, bufferMs, force))
-          return;
-        const lockedApp = await getOAuthAppById(locked.appId);
-        if (!lockedApp || lockedApp.mcpServerId !== null)
-          return;
-        if (!locked.refreshToken) {
-          const label = authorizationLabelFor(lockedApp, locked);
-          const message = `OAuth authorization '${label}' cannot refresh: no refresh token stored`;
-          await markAuthorizationRefreshFailed(authorizationId, message);
-          throw new OAuthRefreshError(authorizationId, lockedApp.id, "no_refresh_token", label, message);
-        }
-        const config = oauthAppRowToProviderConfig(lockedApp);
-        try {
-          const refreshed = await performTokenRefreshRequest(config, locked.refreshToken);
-          const persisted = await updateAuthorizationTokens(authorizationId, {
-            accessToken: refreshed.accessToken,
-            refreshToken: refreshed.refreshToken ?? locked.refreshToken,
-            expiresAt: refreshed.expiresAt,
-            scope: refreshed.scope ?? null,
-            expectedTokenVersion: locked.tokenVersion
-          });
-          if (!persisted) {
-            continue;
-          }
-          notifyAuthorizationRefreshed({
-            authorizationId,
-            appId: lockedApp.id,
-            provider: lockedApp.provider
-          });
-          return;
-        } catch (err) {
-          const label = authorizationLabelFor(lockedApp, locked);
-          if (locked.refreshToken)
-            registerVolatileSecret(locked.refreshToken, "oauth-refresh-token");
-          if (locked.accessToken)
-            registerVolatileSecret(locked.accessToken, "oauth-access-token");
-          if (lockedApp.clientSecret)
-            registerVolatileSecret(lockedApp.clientSecret, "oauth-client-secret");
-          const message = scrubSecrets(err instanceof Error ? err.message : String(err));
-          await markAuthorizationRefreshFailed(authorizationId, message);
-          if (err instanceof OAuthRefreshError)
-            throw err;
-          throw new OAuthRefreshError(authorizationId, lockedApp.id, "refresh_rejected", label, message);
-        }
-      } finally {
-        await releaseOAuthRefreshLock(`authz:${authorizationId}`, lockOwner);
-      }
-    }
-  });
-}
-async function forceRefreshAuthorizationOrThrow(authorizationId) {
-  await ensureAuthorizationTokenOrThrow(authorizationId, undefined, true);
-}
-async function ensureToken(provider, bufferMs) {
-  try {
-    await ensureTokenOrThrow(provider, bufferMs);
-  } catch (err) {
-    console.error(`[OAuth] Failed to refresh ${provider} token:`, err instanceof Error ? err.message : err);
-  }
-}
-async function ensureTokenOrThrow(provider, bufferMs) {
-  const authorizationId = await getDefaultAuthorizationIdForProvider(provider);
-  if (!authorizationId)
-    return;
-  try {
-    await ensureAuthorizationTokenOrThrow(authorizationId, bufferMs);
-  } catch (err) {
-    if (err instanceof OAuthRefreshError && err.reason === "no_refresh_token") {
-      return;
-    }
-    throw err;
-  }
-}
-async function forceRefreshTokenOrThrow(provider) {
-  const authorizationId = await getDefaultAuthorizationIdForProvider(provider);
-  if (!authorizationId)
-    return;
-  try {
-    await forceRefreshAuthorizationOrThrow(authorizationId);
-  } catch (err) {
-    if (err instanceof OAuthRefreshError && err.reason === "no_refresh_token")
-      return;
-    throw err;
-  }
-}
-
-export { getDefaultAuthorizationIdForProvider, getOAuthApp, getOAuthAppById, getOAuthAppIdByProvider, createOAuthApp, updateOAuthAppById, upsertOAuthApp, listAuthorizationsForApp, getAuthorizationById, upsertAuthorization, updateAuthorizationTokens, updateAuthorizationIdentity, deleteAuthorizationById, deleteAuthorizationsForApp, consumeOAuthPending, gcOAuthPending, getOAuthTokens, listAuthorizationSweepRows, listKeepAliveAuthorizations, deleteOAuthTokens, acquireOAuthRefreshLock, releaseOAuthRefreshLock, generateRandomCodeVerifier, generateRandomState, calculatePKCECodeChallenge, buildAuthorizationUrl, exchangeAuthorizationCode, oauthAppRowToProviderConfig, onAuthorizationRefreshed, ensureAuthorizationTokenOrThrow, forceRefreshAuthorizationOrThrow, ensureToken, ensureTokenOrThrow, forceRefreshTokenOrThrow };