@desplega.ai/agent-swarm 1.165.0 → 1.167.0

package/dist/{cli-xtgtyafv.js → cli-577bxkf6.js}

@@ -4,76 +4,82 @@ import {
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
+import {
+  DEFAULT_MODEL,
+  resolveCredential
+} from "./cli-7mhy3ths.js";
 import {
   detachedProcessGroup,
   registerProcessGroup,
   terminateProcessGroup
 } from "./cli-zt3w1cn1.js";
-import {
-  DEFAULT_MODEL,
-  resolveCredential
-} from "./cli-xb3c6aat.js";
-import {
-  DEFAULT_OPENROUTER_BASE_URL,
-  getOpenRouterBaseUrl
-} from "./cli-3dpj7atn.js";
-import {
-  embedScript
-} from "./cli-jqt9hrnz.js";
 import {
   calculatePKCECodeChallenge,
   ensureAuthorizationTokenOrThrow,
   generateRandomCodeVerifier,
   generateRandomState,
-  getAuthorizationById,
-  getOAuthApp,
-  getOAuthAppById,
-  oauthAppRowToProviderConfig,
-  updateAuthorizationTokens,
-  upsertAuthorization
-} from "./cli-a87b04k8.js";
+  oauthAppRowToProviderConfig
+} from "./cli-kw0jcfje.js";
 import {
   getSlackApp
-} from "./cli-0n4fasz0.js";
+} from "./cli-c8r99akr.js";
 import {
   CredentialBroker,
   DEFAULT_CREDENTIAL_BINDINGS,
   claimApprovalCancellationNotification,
   completeApprovalCancellationNotificationClaim,
-  computeContentHash,
   createTaskExtended,
   decryptSecret,
   encryptSecret,
+  getAuthorizationById,
   getDb,
   getDbClient,
   getEncryptionKey,
   getLeadAgent,
   getMcpServerById,
+  getOAuthApp,
+  getOAuthAppById,
   getResolvedConfig,
+  getScriptById,
   getTaskById,
   init_credential_broker,
   init_crypto,
   init_date_utils,
   init_db,
+  init_db1 as init_db2,
+  init_oauth,
+  init_secret_registry,
   normalizeDateRequired,
+  oauthSecretName,
   placeholderForConfigKey,
+  registerStoredSecret,
   releaseApprovalCancellationNotificationClaim,
+  restoreScratchScriptLastUsedIfUnchanged,
+  touchScratchScriptLastUsed,
+  updateAuthorizationTokens,
+  upsertAuthorization,
   upsertSwarmConfig
-} from "./cli-qdv8kgz7.js";
+} from "./cli-mkdsy1nq.js";
 import {
   TERMINAL_TASK_STATUSES,
   defaultAssetKey,
   init_key,
   init_types
-} from "./cli-9s3h836g.js";
-import {
-  getAppUrl,
-  init_constants
-} from "./cli-gd4favx9.js";
+} from "./cli-xvdgasgy.js";
 import {
   init_resolver,
   resolveTemplate
 } from "./cli-5c2j5yvx.js";
+import {
+  DEFAULT_OPENROUTER_BASE_URL,
+  getOpenRouterAttributionHeaders,
+  getOpenRouterBaseUrl,
+  init_openrouter_base_url
+} from "./cli-a35hzdve.js";
+import {
+  getAppUrl,
+  init_constants
+} from "./cli-gd4favx9.js";
 import {
   init_env_flag,
   isEnvFlagEnabled
@@ -102,7 +108,7 @@ import {
   registerVolatileSecret,
   scrubObject,
   scrubSecrets
-} from "./cli-h1spv8v4.js";
+} from "./cli-wt7ccy4r.js";
 import {
   __commonJS,
   __require,
@@ -175203,6 +175209,7 @@ Additional information: BADCLIENT: Bad error code, ${badCode} not found in range
 
 // src/workflows/executors/system-one-decision.ts
 init_zod();
+init_openrouter_base_url();
 init_secret_scrubber();
 
 // src/workflows/executors/base.ts
@@ -175254,7 +175261,7 @@ init_constants();
 init_secret_scrubber();
 
 // src/workflows/approval-notifications.ts
-init_db();
+init_db2();
 init_resolver();
 init_types();
 init_secret_scrubber();
@@ -175590,7 +175597,7 @@ class HumanInTheLoopExecutor extends BaseExecutor {
       }
       if (notification.channel === "slack") {
         try {
-          const { getSlackApp: getSlackApp2 } = await import("./app-75hm5cfa.js");
+          const { getSlackApp: getSlackApp2 } = await import("./app-nctetn1e.js");
           const slackApp = getSlackApp2();
           if (!slackApp) {
             console.warn("[HITL] Slack not initialized — cannot send notification");
@@ -175677,6 +175684,9 @@ function formatTimeout(seconds) {
   return mins > 0 ? `${hours}h ${mins}m` : `${hours}h`;
 }
 
+// src/workflows/executors/system-one-providers.ts
+init_openrouter_base_url();
+
 // src/workflows/executors/system-one-wire.ts
 class SystemOneWireError extends Error {
 }
@@ -175852,6 +175862,7 @@ var OPENAI_DECISIONS_WIRE = {
 };
 
 // src/workflows/executors/workflow-llm.ts
+init_openrouter_base_url();
 async function resolveWorkflowLlmConfig(requestedModel, env = process.env, options = {}) {
   const credential = await resolveCredential({ env });
   if (!credential) {
@@ -175865,9 +175876,11 @@ async function resolveWorkflowLlmConfig(requestedModel, env = process.env, optio
   }
   const providerPrefix = `${credential.kind}/`;
   const model = requestedModel ?? DEFAULT_MODEL[credential.kind];
+  const baseURL = credential.kind === "openrouter" ? getOpenRouterBaseUrl(env) : undefined;
   return {
     apiKey: credential.apiKey,
-    baseURL: credential.kind === "openrouter" ? getOpenRouterBaseUrl(env) : undefined,
+    baseURL,
+    headers: baseURL ? getOpenRouterAttributionHeaders(baseURL, env) : {},
     model: model.startsWith(providerPrefix) ? model.slice(providerPrefix.length) : model
   };
 }
@@ -176822,6 +176835,7 @@ class SystemOneDecisionExecutor extends BaseExecutor {
       res = await doFetch(endpoint, {
         method: "POST",
         headers: {
+          ...getOpenRouterAttributionHeaders(endpoint, this.providerContext().env),
           "content-type": "application/json",
           accept: "application/json",
           authorization: `Bearer ${apiKey}`
@@ -177233,7 +177247,8 @@ function applyDefinitionPatch(def, patch) {
 
 // src/be/script-connections.ts
 init_zod();
-init_db();
+init_db2();
+init_oauth();
 
 // src/oauth/mcp-wrapper.ts
 init_env_flag();
@@ -177602,13 +177617,15 @@ init_credential_broker();
 init_secret_scrubber();
 
 // src/be/mcp-proxy.ts
-init_db();
+init_db2();
 
 // src/be/db-queries/mcp-oauth.ts
 init_secret_scrubber();
 init_crypto();
 init_date_utils();
-init_db();
+init_db2();
+init_secret_registry();
+init_oauth();
 function parseObject(value) {
   try {
     const parsed = JSON.parse(value || "{}");
@@ -177695,6 +177712,7 @@ async function upsertMcpApp(input) {
     invalidated: false
   });
   const encryptedClientSecret = input.dcrClientSecret == null || input.dcrClientSecret === "" ? existing?.clientSecret ?? null : encryptSecret(input.dcrClientSecret, getEncryptionKey());
+  registerStoredSecret(input.dcrClientSecret, oauthSecretName(`mcp-${input.mcpServerId}`, "client_secret"));
   const source = "dcr";
   if (existing) {
     await getDbClient().run(`UPDATE oauth_apps SET
@@ -179557,9 +179575,10 @@ ${members.join(`
 // src/be/script-credential-broker.ts
 init_credential_broker();
 init_secret_scrubber();
-init_db();
+init_db2();
 
 // src/be/oauth-credential-bindings.ts
+init_oauth();
 var OAUTH_BINDING_REFRESH_BUFFER_MS = 5 * 60 * 1000;
 function oauthAppToProviderConfig(app) {
   return oauthAppRowToProviderConfig(app);
@@ -179622,419 +179641,6 @@ async function buildScriptCredentialBindings(input) {
   return (await buildScriptCredentialBindingsWithFailures(input)).egressSecrets;
 }
 
-// src/be/scripts/db.ts
-init_key();
-init_secret_scrubber();
-
-// src/utils/short-id.ts
-import { randomBytes } from "node:crypto";
-var LETTERS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
-var BASE62 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
-function generateShortId(len = 12) {
-  let out = "";
-  while (out.length < len) {
-    for (const byte of randomBytes((len - out.length) * 2)) {
-      if (byte < 208) {
-        out += LETTERS[byte % 52];
-        if (out.length === len)
-          break;
-      }
-    }
-  }
-  return out;
-}
-function base62(bytes) {
-  let out = "";
-  for (const byte of bytes)
-    out += BASE62[byte % 62];
-  return out;
-}
-function generateBearerToken() {
-  return `xsk_${base62(randomBytes(24))}`;
-}
-
-// src/be/scripts/db.ts
-init_crypto();
-init_db();
-function normalizeScopeId(scope, scopeId) {
-  if (scope === "global")
-    return null;
-  if (!scopeId) {
-    throw new Error("scopeId is required for agent-scoped scripts");
-  }
-  return scopeId;
-}
-function rowToScript(row) {
-  return {
-    ...row,
-    scopeId: row.scopeId ?? null,
-    isScratch: row.isScratch === 1,
-    typeChecked: row.typeChecked === 1,
-    createdByAgentId: row.createdByAgentId ?? null
-  };
-}
-function rowToScriptVersion(row) {
-  return {
-    ...row,
-    changedByAgentId: row.changedByAgentId ?? null,
-    changeReason: row.changeReason ?? null
-  };
-}
-async function insertScriptVersion(args) {
-  await getDbClient().run(`INSERT INTO script_versions (
-        id, scriptId, version, source, description, intent, signatureJson,
-        contentHash, changedByAgentId, changedAt, changeReason
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
-    crypto.randomUUID(),
-    args.scriptId,
-    args.version,
-    args.source,
-    args.description,
-    args.intent,
-    args.signatureJson,
-    args.contentHash,
-    args.changedByAgentId ?? null,
-    new Date().toISOString(),
-    args.changeReason ?? null
-  ]);
-}
-async function insertScript(args) {
-  const now = new Date().toISOString();
-  const id = crypto.randomUUID();
-  const scopeId = normalizeScopeId(args.scope, args.scopeId);
-  const contentHash = computeContentHash(args.source);
-  const fsMode = args.fsMode ?? "none";
-  const isScratch = args.isScratch ? 1 : 0;
-  const typeChecked = args.typeChecked ? 1 : 0;
-  return await getDbClient().transaction(async (tx) => {
-    const row = await tx.get(`INSERT INTO scripts (
-          id, "key", name, scope, scopeId, source, description, intent, signatureJson,
-          argsJsonSchema, contentHash, isScratch, typeChecked, fsMode, createdByAgentId, createdAt, updatedAt,
-          created_by, updated_by
-        )
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-        RETURNING *`, [
-      id,
-      defaultAssetKey("script", id),
-      args.name,
-      args.scope,
-      scopeId,
-      args.source,
-      args.description,
-      args.intent,
-      args.signatureJson,
-      args.argsJsonSchema ?? null,
-      contentHash,
-      isScratch,
-      typeChecked,
-      fsMode,
-      args.agentId ?? null,
-      now,
-      now,
-      args.createdBy ?? null,
-      args.createdBy ?? null
-    ]);
-    if (!row)
-      throw new Error("Failed to insert script");
-    await insertScriptVersion({
-      scriptId: row.id,
-      version: row.version,
-      source: row.source,
-      description: row.description,
-      intent: row.intent,
-      signatureJson: row.signatureJson,
-      contentHash: row.contentHash,
-      changedByAgentId: args.agentId ?? null,
-      changeReason: args.changeReason ?? "Initial creation"
-    });
-    return rowToScript(row);
-  });
-}
-async function upsertScriptByName(args) {
-  const shouldEmbed = args.embeddingMode !== "skip";
-  const existing = await getScript(args);
-  if (!existing) {
-    const script2 = await insertScript(args);
-    if (!script2.isScratch && shouldEmbed) {
-      await embedScript(script2);
-    }
-    return {
-      script: script2,
-      isNew: true,
-      contentDeduped: false
-    };
-  }
-  const contentHash = computeContentHash(args.source);
-  if (existing.contentHash === contentHash) {
-    const fsMode2 = args.fsMode ?? existing.fsMode;
-    const isScratch2 = args.isScratch ?? existing.isScratch;
-    const typeChecked2 = args.typeChecked ?? existing.typeChecked;
-    const argsJsonSchema2 = args.argsJsonSchema !== undefined ? args.argsJsonSchema : existing.argsJsonSchema;
-    const trackedMetadataChanged = args.description !== existing.description || args.intent !== existing.intent || args.signatureJson !== existing.signatureJson || argsJsonSchema2 !== existing.argsJsonSchema;
-    const promotedFromScratch = existing.isScratch && !isScratch2;
-    const refreshScratchLastUsed = existing.scope === "agent" && existing.name.startsWith("scratch-") && existing.isScratch && isScratch2;
-    if (fsMode2 !== existing.fsMode || isScratch2 !== existing.isScratch || typeChecked2 !== existing.typeChecked || trackedMetadataChanged || refreshScratchLastUsed) {
-      const row = await getDbClient().get(`UPDATE scripts
-        SET description = ?, intent = ?, signatureJson = ?, argsJsonSchema = ?,
-          isScratch = ?, typeChecked = ?, fsMode = ?, updatedAt = ?, updated_by = ?
-        WHERE id = ?
-        RETURNING *`, [
-        args.description,
-        args.intent,
-        args.signatureJson,
-        argsJsonSchema2 ?? null,
-        isScratch2 ? 1 : 0,
-        typeChecked2 ? 1 : 0,
-        fsMode2,
-        new Date().toISOString(),
-        args.createdBy ?? null,
-        existing.id
-      ]);
-      if (!row)
-        throw new Error("Failed to update script metadata");
-      const script2 = rowToScript(row);
-      if (!script2.isScratch && shouldEmbed && (trackedMetadataChanged || promotedFromScratch)) {
-        await embedScript(script2);
-      }
-      return {
-        script: script2,
-        isNew: false,
-        contentDeduped: true
-      };
-    }
-    return {
-      script: existing,
-      isNew: false,
-      contentDeduped: true
-    };
-  }
-  const now = new Date().toISOString();
-  const newVersion = existing.version + 1;
-  const fsMode = args.fsMode ?? existing.fsMode;
-  const isScratch = args.isScratch ?? existing.isScratch;
-  const typeChecked = args.typeChecked ?? existing.typeChecked;
-  const argsJsonSchema = args.argsJsonSchema !== undefined ? args.argsJsonSchema : existing.argsJsonSchema;
-  const script = await getDbClient().transaction(async (tx) => {
-    const row = await tx.get(`UPDATE scripts
-        SET source = ?, description = ?, intent = ?, signatureJson = ?, argsJsonSchema = ?,
-          contentHash = ?, version = ?, isScratch = ?, typeChecked = ?, fsMode = ?, updatedAt = ?, updated_by = ?
-        WHERE id = ?
-        RETURNING *`, [
-      args.source,
-      args.description,
-      args.intent,
-      args.signatureJson,
-      argsJsonSchema ?? null,
-      contentHash,
-      newVersion,
-      isScratch ? 1 : 0,
-      typeChecked ? 1 : 0,
-      fsMode,
-      now,
-      args.createdBy ?? null,
-      existing.id
-    ]);
-    if (!row)
-      throw new Error("Failed to update script");
-    await insertScriptVersion({
-      scriptId: row.id,
-      version: row.version,
-      source: row.source,
-      description: row.description,
-      intent: row.intent,
-      signatureJson: row.signatureJson,
-      contentHash: row.contentHash,
-      changedByAgentId: args.agentId ?? null,
-      changeReason: args.changeReason ?? null
-    });
-    return rowToScript(row);
-  });
-  if (!script.isScratch && shouldEmbed) {
-    await embedScript(script);
-  }
-  return {
-    script,
-    isNew: false,
-    contentDeduped: false
-  };
-}
-async function getScript(args) {
-  const scopeId = normalizeScopeId(args.scope, args.scopeId);
-  const row = scopeId === null ? await getDbClient().get("SELECT * FROM scripts WHERE name = ? AND scope = ? AND scopeId IS NULL", [args.name, args.scope]) : await getDbClient().get("SELECT * FROM scripts WHERE name = ? AND scope = ? AND scopeId = ?", [args.name, args.scope, scopeId]);
-  return row ? rowToScript(row) : null;
-}
-async function getScriptById(id) {
-  const row = await getDbClient().get("SELECT * FROM scripts WHERE id = ?", [id]);
-  return row ? rowToScript(row) : null;
-}
-async function getScriptVersion(args) {
-  if (args.version === undefined && args.contentHash === undefined) {
-    throw new Error("version or contentHash is required");
-  }
-  const row = args.version !== undefined ? await getDbClient().get("SELECT * FROM script_versions WHERE scriptId = ? AND version = ?", [args.scriptId, args.version]) : await getDbClient().get("SELECT * FROM script_versions WHERE scriptId = ? AND contentHash = ? ORDER BY version DESC LIMIT 1", [args.scriptId, args.contentHash]);
-  return row ? rowToScriptVersion(row) : null;
-}
-async function listScripts(args) {
-  const conditions = [];
-  const params = [];
-  if (args?.scope) {
-    conditions.push("scope = ?");
-    params.push(args.scope);
-    if (args.scope === "global") {
-      conditions.push("scopeId IS NULL");
-    } else if (args.scopeId !== undefined) {
-      conditions.push("scopeId = ?");
-      params.push(normalizeScopeId(args.scope, args.scopeId));
-    }
-  } else if (args?.scopeId !== undefined) {
-    conditions.push("scopeId = ?");
-    params.push(args.scopeId ?? "");
-  }
-  if (!args?.includeScratch) {
-    conditions.push("isScratch = 0");
-  }
-  const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
-  const rows = await getDbClient().query(`SELECT * FROM scripts ${whereClause} ORDER BY scope ASC, scopeId ASC, name ASC`, params);
-  return rows.map(rowToScript);
-}
-async function listScriptVersions(scriptId) {
-  const rows = await getDbClient().query("SELECT * FROM script_versions WHERE scriptId = ? ORDER BY version DESC", [scriptId]);
-  return rows.map(rowToScriptVersion);
-}
-async function deleteScript(args) {
-  const existing = await getScript(args);
-  if (!existing)
-    return false;
-  const result = await getDbClient().run("DELETE FROM scripts WHERE id = ?", [existing.id]);
-  return result.changes > 0;
-}
-async function touchScratchScriptLastUsed(id, at = new Date().toISOString()) {
-  const result = await getDbClient().run(`UPDATE scripts SET updatedAt = ?
-     WHERE id = ? AND scope = 'agent' AND isScratch = 1 AND name GLOB 'scratch-*'`, [at, id]);
-  return result.changes > 0 ? at : null;
-}
-async function restoreScratchScriptLastUsedIfUnchanged(id, priorUpdatedAt, expectedUpdatedAt) {
-  const result = await getDbClient().run(`UPDATE scripts SET updatedAt = ?
-     WHERE id = ? AND scope = 'agent' AND isScratch = 1 AND name GLOB 'scratch-*' AND updatedAt = ?`, [priorUpdatedAt, id, expectedUpdatedAt]);
-  return result.changes > 0;
-}
-var SCRIPT_API_ID_LEN = 12;
-function rowToScriptApi(row) {
-  return {
-    id: row.id,
-    scriptId: row.scriptId,
-    agentId: row.agentId,
-    authMode: row.authMode,
-    enabled: row.enabled === 1,
-    label: row.label ?? null,
-    callCount: row.callCount,
-    lastUsedAt: row.lastUsedAt ?? null,
-    createdAt: row.createdAt
-  };
-}
-function isUniqueConstraintError(err) {
-  return err instanceof Error && /UNIQUE constraint failed/i.test(err.message);
-}
-async function createScriptApi(args) {
-  const now = new Date().toISOString();
-  const token = args.authMode === "bearer" ? generateBearerToken() : null;
-  const encrypted = token ? encryptSecret(token, getEncryptionKey()) : null;
-  const createdBy = args.createdBy ?? null;
-  for (let attempt = 0;attempt < 5; attempt++) {
-    const id = generateShortId(SCRIPT_API_ID_LEN);
-    try {
-      const row = await getDbClient().get(`INSERT INTO script_apis
-           (id, scriptId, agentId, authMode, bearerTokenEncrypted, enabled, label,
-            callCount, lastUsedAt, createdAt, created_by, updated_by)
-         VALUES (?, ?, ?, ?, ?, 1, ?, 0, NULL, ?, ?, ?)
-         RETURNING *`, [
-        id,
-        args.scriptId,
-        args.agentId,
-        args.authMode,
-        encrypted,
-        args.label ?? null,
-        now,
-        createdBy,
-        createdBy
-      ]);
-      if (!row)
-        throw new Error("Failed to create script API endpoint");
-      if (token)
-        registerVolatileSecret(token, `script-api:${id}`);
-      return { ...rowToScriptApi(row), token };
-    } catch (err) {
-      if (isUniqueConstraintError(err) && attempt < 4)
-        continue;
-      throw err;
-    }
-  }
-  throw new Error("Failed to allocate a unique script API endpoint id");
-}
-async function listScriptApisForScript(scriptId) {
-  const rows = await getDbClient().query("SELECT * FROM script_apis WHERE scriptId = ? ORDER BY createdAt DESC", [scriptId]);
-  return rows.map(rowToScriptApi);
-}
-async function getScriptApiById(id) {
-  const row = await getDbClient().get("SELECT * FROM script_apis WHERE id = ?", [id]);
-  if (!row)
-    return null;
-  return { ...rowToScriptApi(row), bearerTokenEncrypted: row.bearerTokenEncrypted ?? null };
-}
-async function getScriptApiSecret(id) {
-  const row = await getDbClient().get("SELECT bearerTokenEncrypted FROM script_apis WHERE id = ?", [id]);
-  if (!row?.bearerTokenEncrypted)
-    return null;
-  const token = decryptSecret(row.bearerTokenEncrypted, getEncryptionKey());
-  registerVolatileSecret(token, `script-api:${id}`);
-  return token;
-}
-async function updateScriptApi(id, args) {
-  const sets = [];
-  const vals = [];
-  if (args.enabled !== undefined) {
-    sets.push("enabled = ?");
-    vals.push(args.enabled ? 1 : 0);
-  }
-  if (args.label !== undefined) {
-    sets.push("label = ?");
-    vals.push(args.label);
-  }
-  if (args.updatedBy !== undefined) {
-    sets.push("updated_by = ?");
-    vals.push(args.updatedBy);
-  }
-  if (sets.length === 0) {
-    const row2 = await getDbClient().get("SELECT * FROM script_apis WHERE id = ?", [
-      id
-    ]);
-    return row2 ? rowToScriptApi(row2) : null;
-  }
-  vals.push(id);
-  const row = await getDbClient().get(`UPDATE script_apis SET ${sets.join(", ")} WHERE id = ? RETURNING *`, vals);
-  return row ? rowToScriptApi(row) : null;
-}
-async function rotateScriptApiSecret(id, updatedBy) {
-  const existing = await getScriptApiById(id);
-  if (!existing || existing.authMode !== "bearer")
-    return null;
-  const token = generateBearerToken();
-  const encrypted = encryptSecret(token, getEncryptionKey());
-  const row = await getDbClient().get("UPDATE script_apis SET bearerTokenEncrypted = ?, updated_by = ? WHERE id = ? RETURNING *", [encrypted, updatedBy ?? null, id]);
-  if (!row)
-    return null;
-  registerVolatileSecret(token, `script-api:${id}`);
-  return { ...rowToScriptApi(row), token };
-}
-async function deleteScriptApi(id) {
-  const result = await getDbClient().run("DELETE FROM script_apis WHERE id = ?", [id]);
-  return result.changes > 0;
-}
-async function recordScriptApiUsage(id) {
-  await getDbClient().run("UPDATE script_apis SET callCount = callCount + 1, lastUsedAt = ? WHERE id = ?", [new Date().toISOString(), id]);
-}
-
 // src/scripts-runtime/import-allowlist.ts
 var import_typescript = __toESM(require_typescript(), 1);
 var SCRIPT_ALLOWED_BARE_IMPORTS = ["swarm-sdk", "stdlib", "zod"];
@@ -180436,9 +180042,162 @@ class NativeScriptExecutor {
   }
 }
 
+// src/scripts-runtime/executors/quickjs.ts
+var POOL_SIZE = 4;
+var UNRESPONSIVE_GRACE_MS = 5000;
+var RECYCLE_WASM_HEAP_BYTES = 64 * 1024 * 1024;
+function workerSpecifier() {
+  if (import.meta.url.includes("/$bunfs/"))
+    return "./scripts-runtime/executors/quickjs-worker.ts";
+  return new URL("./quickjs-worker.ts", import.meta.url).href;
+}
+function emptyOutput(error, stderr = "") {
+  return {
+    result: undefined,
+    stdout: "",
+    stderr,
+    truncated: { stdout: false, stderr: false },
+    durationMs: 0,
+    exitCode: 1,
+    error
+  };
+}
+
+class QuickJSWorkerPool {
+  size;
+  slots = [];
+  waiters = [];
+  constructor(size) {
+    this.size = size;
+  }
+  spawn() {
+    const worker = new Worker(workerSpecifier());
+    worker.unref?.();
+    const ready = new Promise((resolve, reject) => {
+      const onMessage = (event) => {
+        if (event.data.type === "ready")
+          resolve();
+        else if (event.data.type === "fatal" && event.data.id === undefined) {
+          reject(new Error(event.data.message));
+        } else
+          return;
+        worker.removeEventListener("message", onMessage);
+      };
+      worker.addEventListener("message", onMessage);
+      worker.addEventListener("error", (event) => reject(new Error(event.message)), { once: true });
+    });
+    ready.catch(() => {});
+    const slot = { worker, ready, busy: true };
+    this.slots.push(slot);
+    return slot;
+  }
+  acquire() {
+    const idle = this.slots.find((slot) => !slot.busy);
+    if (idle) {
+      idle.busy = true;
+      return Promise.resolve(idle);
+    }
+    if (this.slots.length < this.size)
+      return Promise.resolve(this.spawn());
+    return new Promise((resolve) => this.waiters.push(resolve));
+  }
+  release(slot) {
+    const waiter = this.waiters.shift();
+    if (waiter)
+      waiter(slot);
+    else
+      slot.busy = false;
+  }
+  get workerCount() {
+    return this.slots.length;
+  }
+  discard(slot) {
+    slot.worker.terminate();
+    const index = this.slots.indexOf(slot);
+    if (index !== -1)
+      this.slots.splice(index, 1);
+    const waiter = this.waiters.shift();
+    if (waiter)
+      waiter(this.spawn());
+  }
+}
+var sharedPool;
+var requestSeq = 0;
+
+class QuickJSScriptExecutor {
+  name = "quickjs";
+  async run(input) {
+    if (input.fsMode === "workspace-rw") {
+      return emptyOutput("executor_error", "workspace-rw not supported by quickjs executor");
+    }
+    if (input.signal?.aborted)
+      return emptyOutput("killed");
+    sharedPool ??= new QuickJSWorkerPool(POOL_SIZE);
+    const pool = sharedPool;
+    const slot = await pool.acquire();
+    if (input.signal?.aborted) {
+      pool.release(slot);
+      return emptyOutput("killed");
+    }
+    try {
+      await slot.ready;
+    } catch (error) {
+      pool.discard(slot);
+      return emptyOutput("executor_error", `quickjs worker failed to start: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const id = ++requestSeq;
+    const start = performance.now();
+    return await new Promise((resolve) => {
+      let settled = false;
+      const settle = (output, healthy) => {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(watchdog);
+        slot.worker.removeEventListener("message", onMessage);
+        slot.worker.removeEventListener("error", onError);
+        input.signal?.removeEventListener("abort", onAbort);
+        if (healthy)
+          pool.release(slot);
+        else
+          pool.discard(slot);
+        resolve(output);
+      };
+      const elapsed = () => Math.round(performance.now() - start);
+      const onMessage = (event) => {
+        const message = event.data;
+        if (message.type === "result" && message.id === id) {
+          const reusable = message.leakedHostCalls === 0 && (message.wasmHeapBytes ?? 0) <= RECYCLE_WASM_HEAP_BYTES;
+          settle(message.output, reusable);
+        } else if (message.type === "fatal" && message.id === id) {
+          settle({ ...emptyOutput("executor_error", message.message), durationMs: elapsed() }, false);
+        }
+      };
+      const onError = (event) => {
+        settle({ ...emptyOutput("executor_error", event.message), durationMs: elapsed() }, false);
+      };
+      const onAbort = () => settle({ ...emptyOutput("killed"), durationMs: elapsed() }, false);
+      const watchdog = setTimeout(() => settle({ ...emptyOutput("timeout"), exitCode: 124, durationMs: elapsed() }, false), input.resources.wallClockMs + UNRESPONSIVE_GRACE_MS);
+      slot.worker.addEventListener("message", onMessage);
+      slot.worker.addEventListener("error", onError);
+      input.signal?.addEventListener("abort", onAbort, { once: true });
+      slot.worker.postMessage({
+        id,
+        job: {
+          source: input.source,
+          args: input.args,
+          configPayload: input.configPayload,
+          resources: input.resources
+        }
+      });
+    });
+  }
+}
+
 // src/scripts-runtime/executors/registry.ts
 var EXECUTORS = {
-  native: () => new NativeScriptExecutor
+  native: () => new NativeScriptExecutor,
+  quickjs: () => new QuickJSScriptExecutor
 };
 function getScriptExecutor(name = process.env.SCRIPT_EXECUTOR ?? "native") {
   const factory = EXECUTORS[name];
@@ -180646,8 +180405,10 @@ import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/apps/definition.ts
 init_zod();
+init_db();
 
 // src/be/scripts/run-saved.ts
+init_db();
 function getSavedScriptOwnerAgentId(script) {
   return script.scopeId ?? script.createdByAgentId;
 }
@@ -183042,7 +182803,7 @@ function validatePage(definition, catalog, target) {
 }
 
 // src/apps/sync-run-as.ts
-init_db();
+init_db2();
 async function resolveSyncRunAs(script) {
   return getSavedScriptOwnerAgentId(script) ?? (await getLeadAgent())?.id ?? "app-sync";
 }
@@ -183764,7 +183525,7 @@ function applyAppDefinitionPatch(stored, patch) {
 
 // src/apps/store.ts
 init_key();
-init_db();
+init_db2();
 
 // src/apps/format-upgrades.ts
 var CURRENT_APP_SCHEMA_VERSION = 1;
@@ -185166,4 +184927,4 @@ void _scriptMain;
   });
 }
 
-export { require_dist, isInvalidClientError, assertUrlSafe, publicEndpointSsrfOptions, discoverProtectedResourceMetadata, discoverAuthorizationServerMetadata, normalizeTokenEndpointAuthMethod, resolveAdvertisedTokenEndpointAuthMethod, authMethodForStoredClient, selectDcrTokenEndpointAuthMethod, registerClient, buildAuthorizeUrl, exchangeCodeForTokens, refreshMcpToken, revokeMcpToken, computeExpiresAt, getMcpOAuthToken, findReusableMcpOAuthClient, invalidateMcpOAuthClient, upsertMcpOAuthToken, applyMcpOAuthRefresh, markMcpOAuthTokenStatus, deleteMcpOAuthToken, insertMcpOAuthPending, consumeMcpOAuthPending, gcMcpOAuthPending, setMcpServerAuthMethod, ensureMcpToken, callMcpServerTool, listVendoredOpenapiEntries, ConnectionAuthInputSchema, connectionAuthSummary, listRelationalCredentialBindings, getCredentialBindingById, findCredentialBindingByIdentity, upsertCredentialBinding, disableCredentialBinding, listScriptConnections, listScriptConnectionsAsync, getScriptConnectionById, ScriptConnectionConflictError, connectionAuthInputFromFlat, upsertScriptConnection, refreshScriptConnection, setScriptConnectionEnabled, getScriptApiConnectionDescriptors, getScriptMcpConnectionDescriptors, getScriptApiTypes, getScriptMcpTypes, oauthAppToProviderConfig, getOAuthProviderConfig, getOAuthBindingTokenStatus, buildScriptCredentialBindingsWithFailures, buildScriptCredentialBindings, upsertScriptByName, getScript, getScriptById, getScriptVersion, listScripts, listScriptVersions, deleteScript, touchScratchScriptLastUsed, restoreScratchScriptLastUsedIfUnchanged, createScriptApi, listScriptApisForScript, getScriptApiById, getScriptApiSecret, updateScriptApi, rotateScriptApiSecret, deleteScriptApi, recordScriptApiUsage, buildSandboxedCommand, sandboxSpawnEnv, createCappedStreamState, snapshotCapped, readStreamCapped, writeBareImportShim, MIN_SCRIPT_WALL_CLOCK_MS, SCRIPT_LONG_TIMEOUT_HINT_MS, MAX_SCRIPT_WALL_CLOCK_MS, DEFAULT_SCRIPT_RESOURCES, require_typescript, checkImportAllowlist, validateScriptImports, runScript, BaseExecutor, postApprovalCancellationUpdates, createApprovalFollowUpTask, HumanInTheLoopExecutor, resolveWorkflowLlmConfig, SYSTEM_ONE_DECISION_NODE_TYPE, systemOneRetryViolations, systemOneUnresolvedError, SystemOneDecisionExecutor, getNextTargets, generateEdges, findEntryNodes, resolveValidationPort, getSuccessors, definitionNodeIds, validateDefinition, applyDefinitionPatch, extractScriptSignature, extractArgsJsonSchema, getSavedScriptOwnerAgentId, runSavedScriptAsAgent, resolveSyncRunAs, AppNameSchema, ColumnKindSchema, isIso8601Date, SYSTEM_COLUMN_KINDS, SORTABLE_SYSTEM_DATE_COLUMNS, AppElementsSchema, AppDefinitionSchema, collectScriptReferences, parseAppDefinition, applyAppDefinitionPatch, upgradeAppDefinition, decodeAppDefinition, appDefinitionNeedsRepair, createApp, getApp, listApps, listAppRecords, updateApp, deleteApp, getScriptAppTypes, SCRIPT_SDK_TYPES, scriptSdkTypesWithGeneratedApis, SCRIPT_STDLIB_MODULE_TYPES, scriptStdlibTypesWithGeneratedApis, typecheckWithAmbient, typecheckScript };
+export { require_dist, isInvalidClientError, assertUrlSafe, publicEndpointSsrfOptions, discoverProtectedResourceMetadata, discoverAuthorizationServerMetadata, normalizeTokenEndpointAuthMethod, resolveAdvertisedTokenEndpointAuthMethod, authMethodForStoredClient, selectDcrTokenEndpointAuthMethod, registerClient, buildAuthorizeUrl, exchangeCodeForTokens, refreshMcpToken, revokeMcpToken, computeExpiresAt, getMcpOAuthToken, findReusableMcpOAuthClient, invalidateMcpOAuthClient, upsertMcpOAuthToken, applyMcpOAuthRefresh, markMcpOAuthTokenStatus, deleteMcpOAuthToken, insertMcpOAuthPending, consumeMcpOAuthPending, gcMcpOAuthPending, setMcpServerAuthMethod, ensureMcpToken, callMcpServerTool, listVendoredOpenapiEntries, ConnectionAuthInputSchema, connectionAuthSummary, listRelationalCredentialBindings, getCredentialBindingById, findCredentialBindingByIdentity, upsertCredentialBinding, disableCredentialBinding, listScriptConnections, listScriptConnectionsAsync, getScriptConnectionById, ScriptConnectionConflictError, connectionAuthInputFromFlat, upsertScriptConnection, refreshScriptConnection, setScriptConnectionEnabled, getScriptApiConnectionDescriptors, getScriptMcpConnectionDescriptors, getScriptApiTypes, getScriptMcpTypes, oauthAppToProviderConfig, getOAuthProviderConfig, getOAuthBindingTokenStatus, buildScriptCredentialBindingsWithFailures, buildScriptCredentialBindings, buildSandboxedCommand, sandboxSpawnEnv, createCappedStreamState, snapshotCapped, readStreamCapped, writeBareImportShim, MIN_SCRIPT_WALL_CLOCK_MS, SCRIPT_LONG_TIMEOUT_HINT_MS, MAX_SCRIPT_WALL_CLOCK_MS, DEFAULT_SCRIPT_RESOURCES, require_typescript, checkImportAllowlist, validateScriptImports, runScript, BaseExecutor, postApprovalCancellationUpdates, createApprovalFollowUpTask, HumanInTheLoopExecutor, resolveWorkflowLlmConfig, SYSTEM_ONE_DECISION_NODE_TYPE, systemOneRetryViolations, systemOneUnresolvedError, SystemOneDecisionExecutor, getNextTargets, generateEdges, findEntryNodes, resolveValidationPort, getSuccessors, definitionNodeIds, validateDefinition, applyDefinitionPatch, extractScriptSignature, extractArgsJsonSchema, getSavedScriptOwnerAgentId, runSavedScriptAsAgent, resolveSyncRunAs, AppNameSchema, ColumnKindSchema, isIso8601Date, SYSTEM_COLUMN_KINDS, SORTABLE_SYSTEM_DATE_COLUMNS, AppElementsSchema, AppDefinitionSchema, collectScriptReferences, parseAppDefinition, applyAppDefinitionPatch, upgradeAppDefinition, decodeAppDefinition, appDefinitionNeedsRepair, createApp, getApp, listApps, listAppRecords, updateApp, deleteApp, getScriptAppTypes, SCRIPT_SDK_TYPES, scriptSdkTypesWithGeneratedApis, SCRIPT_STDLIB_MODULE_TYPES, scriptStdlibTypesWithGeneratedApis, typecheckWithAmbient, typecheckScript };