agor-live 0.17.2 → 0.17.3

package/dist/core/tools/mcp/oauth-mcp-transport.js

@@ -57,6 +57,59 @@ async function resolveResourceMetadataUrl(wwwAuthenticateHeader, mcpUrl) {
   }
   return null;
 }
+async function discoverAuthorizationServerFromMcpOrigin(mcpUrl) {
+  const url = new URL(mcpUrl);
+  const origin = url.origin;
+  const path = url.pathname === "/" ? "" : url.pathname.replace(/\/$/, "");
+  const candidates = [];
+  if (path) {
+    candidates.push(`${origin}/.well-known/oauth-authorization-server${path}`);
+  }
+  candidates.push(`${origin}/.well-known/oauth-authorization-server`);
+  if (path) {
+    candidates.push(`${origin}${path}/.well-known/openid-configuration`);
+  }
+  candidates.push(`${origin}/.well-known/openid-configuration`);
+  const unique = Array.from(new Set(candidates));
+  for (const candidate of unique) {
+    try {
+      console.log("[MCP OAuth] Trying AS-direct discovery:", candidate);
+      const response = await fetch(candidate, { signal: AbortSignal.timeout(1e4) });
+      if (!response.ok) continue;
+      const data = await response.json();
+      if (typeof data.authorization_endpoint === "string" && typeof data.token_endpoint === "string") {
+        console.log("[MCP OAuth] \u2713 Discovered AS metadata at:", candidate);
+        return {
+          metadata: data,
+          discoveredAt: candidate
+        };
+      }
+    } catch (err) {
+      console.log(
+        "[MCP OAuth] AS-direct discovery failed for",
+        candidate,
+        ":",
+        err instanceof Error ? err.message : String(err)
+      );
+    }
+  }
+  return null;
+}
+async function resolveMCPOAuthDiscovery(wwwAuthenticateHeader, mcpUrl) {
+  const rfc9728 = await resolveResourceMetadataUrl(wwwAuthenticateHeader, mcpUrl);
+  if (rfc9728) {
+    return { kind: "resource-metadata", ...rfc9728 };
+  }
+  const asDirect = await discoverAuthorizationServerFromMcpOrigin(mcpUrl);
+  if (asDirect) {
+    return {
+      kind: "authorization-server",
+      authServerMetadata: asDirect.metadata,
+      discoveredAt: asDirect.discoveredAt
+    };
+  }
+  return null;
+}
 async function fetchResourceMetadata(metadataUrl) {
   const response = await fetch(metadataUrl, { signal: AbortSignal.timeout(15e3) });
   if (!response.ok) {
@@ -486,101 +539,72 @@ function getAuthCodeTokenCacheStats() {
     expiredEntries
   };
 }
-async function startMCPOAuthFlow(wwwAuthenticateHeader, clientId, redirectUri, options) {
-  console.log("[MCP OAuth] Starting two-phase OAuth 2.1 flow");
-  const metadataUrl = parseWWWAuthenticate(wwwAuthenticateHeader) || options?.resourceMetadataUrl;
-  if (!metadataUrl) {
-    throw new Error(
-      "Could not determine OAuth resource metadata URL. The WWW-Authenticate header does not contain resource_metadata, and no pre-discovered metadata URL was provided."
-    );
-  }
-  console.log("[MCP OAuth] Resource metadata URL:", metadataUrl);
-  const resourceMetadata = await fetchResourceMetadata(metadataUrl);
-  console.log("[MCP OAuth] Resource metadata:", resourceMetadata);
-  if (!resourceMetadata.authorization_servers || resourceMetadata.authorization_servers.length === 0) {
-    throw new Error("No authorization servers found in resource metadata");
-  }
-  const authServerUrl = resourceMetadata.authorization_servers[0];
-  console.log("[MCP OAuth] Authorization server:", authServerUrl);
-  const hasFullOverrides = options?.authorizationUrlOverride && options?.tokenUrlOverride;
-  let authServerMetadata = null;
-  if (hasFullOverrides) {
-    console.log("[MCP OAuth] Skipping auth server metadata fetch \u2014 manual overrides provided:", {
-      authorization: options.authorizationUrlOverride,
-      token: options.tokenUrlOverride
-    });
-  } else {
-    try {
-      authServerMetadata = await fetchAuthorizationServerMetadata(authServerUrl);
-      console.log("[MCP OAuth] Authorization server metadata:", authServerMetadata);
-    } catch (metadataError) {
-      if (options?.authorizationUrlOverride || options?.tokenUrlOverride) {
-        console.log(
-          "[MCP OAuth] Auth server metadata fetch failed, but partial overrides available:",
-          metadataError instanceof Error ? metadataError.message : String(metadataError)
-        );
-      } else {
-        throw metadataError;
-      }
-    }
-  }
+async function startMCPOAuthFlowWithAS(opts) {
+  const {
+    authServerMetadata,
+    cacheKey,
+    clientId,
+    redirectUri,
+    authorizationUrlOverride,
+    tokenUrlOverride,
+    fallbackRegistrationEndpoint,
+    resourceScopesSupported
+  } = opts;
+  const hasFullOverrides = !!(authorizationUrlOverride && tokenUrlOverride);
   const pkce = generatePKCE();
   const actualRedirectUri = redirectUri || "http://127.0.0.1:0/oauth/callback";
-  const scopeString = options?.scope ? options.scope : !clientId && resourceMetadata.scopes_supported && resourceMetadata.scopes_supported.length > 0 ? resourceMetadata.scopes_supported.join(" ") : void 0;
+  const scopeString = opts.scope ? opts.scope : !clientId && resourceScopesSupported && resourceScopesSupported.length > 0 ? resourceScopesSupported.join(" ") : void 0;
   let actualClientId = clientId;
-  let clientSecret = options?.clientSecret;
+  let resolvedClientSecret = opts.clientSecret;
   if (!actualClientId) {
-    if (authServerMetadata?.registration_endpoint) {
-      console.log("[MCP OAuth] Server supports Dynamic Client Registration");
-      const registration = await registerDynamicClient(
-        authServerMetadata.registration_endpoint,
-        actualRedirectUri,
-        "Agor MCP Client",
-        scopeString
-      );
-      actualClientId = registration.client_id;
-      clientSecret = registration.client_secret;
-    } else if (!hasFullOverrides) {
-      const mcpRegisterEndpoint = `${authServerUrl}/register`;
-      console.log("[MCP OAuth] Trying MCP-style registration endpoint:", mcpRegisterEndpoint);
+    const registrationEndpoint = authServerMetadata?.registration_endpoint || fallbackRegistrationEndpoint;
+    if (registrationEndpoint) {
+      console.log("[MCP OAuth] Using DCR endpoint:", registrationEndpoint);
       try {
         const registration = await registerDynamicClient(
-          mcpRegisterEndpoint,
+          registrationEndpoint,
           actualRedirectUri,
           "Agor MCP Client",
           scopeString
         );
         actualClientId = registration.client_id;
-        clientSecret = registration.client_secret;
-      } catch (_regError) {
+        resolvedClientSecret = registration.client_secret;
+      } catch (regError) {
+        const detail = regError instanceof Error ? regError.message : String(regError);
         throw new Error(
-          "OAuth client_id is required but the authorization server does not support Dynamic Client Registration.\n\nRegister an OAuth app in the provider's developer portal and enter the Client ID (and Client Secret if required) in the MCP server configuration."
+          `Dynamic Client Registration failed.
+
+Registration endpoint: ${registrationEndpoint}
+Error: ${detail}
+
+Register an OAuth app in the provider's developer portal and enter the Client ID (and Client Secret if required) in the MCP server configuration.`
         );
       }
-    } else {
+    } else if (hasFullOverrides) {
       throw new Error(
         "OAuth client_id is required when using manual OAuth URL overrides.\n\nPlease provide a client_id in the MCP server configuration."
       );
+    } else {
+      throw new Error(
+        "OAuth client_id is required but the authorization server does not advertise a Dynamic Client Registration endpoint (RFC 7591).\n\nRegister an OAuth app in the provider's developer portal and enter the Client ID (and Client Secret if required) in the MCP server configuration."
+      );
     }
   }
   const state = crypto.randomUUID();
-  const tokenEndpoint = options?.tokenUrlOverride || authServerMetadata?.token_endpoint;
+  const tokenEndpoint = tokenUrlOverride || authServerMetadata?.token_endpoint;
   if (!tokenEndpoint) {
     throw new Error(
       "No token endpoint available. Either provide oauth_token_url in the MCP server config, or ensure the authorization server supports RFC 8414 metadata discovery."
     );
   }
-  console.log("[MCP OAuth] Using token endpoint:", tokenEndpoint);
-  if (options?.tokenUrlOverride) {
-    console.log("[MCP OAuth] (overridden from:", authServerMetadata?.token_endpoint, ")");
-  }
-  const authorizationEndpoint = options?.authorizationUrlOverride || authServerMetadata?.authorization_endpoint;
+  const authorizationEndpoint = authorizationUrlOverride || authServerMetadata?.authorization_endpoint;
   if (!authorizationEndpoint) {
     throw new Error(
       "No authorization endpoint available. Either provide oauth_authorization_url in the MCP server config, or ensure the authorization server supports RFC 8414 metadata discovery."
     );
   }
   console.log("[MCP OAuth] Using authorization endpoint:", authorizationEndpoint);
+  console.log("[MCP OAuth] Using token endpoint:", tokenEndpoint);
   const authUrl = new URL(authorizationEndpoint);
   authUrl.searchParams.set("response_type", "code");
   authUrl.searchParams.set("client_id", actualClientId);
@@ -593,16 +617,88 @@ async function startMCPOAuthFlow(wwwAuthenticateHeader, clientId, redirectUri, o
   }
   console.log("[MCP OAuth] Authorization URL:", authUrl.toString());
   return {
-    metadataUrl,
+    metadataUrl: cacheKey,
     tokenEndpoint,
     redirectUri: actualRedirectUri,
     pkceVerifier: pkce.verifier,
     clientId: actualClientId,
-    clientSecret,
+    clientSecret: resolvedClientSecret,
     state,
     authorizationUrl: authUrl.toString()
   };
 }
+async function startMCPOAuthFlow(wwwAuthenticateHeader, clientId, redirectUri, options) {
+  console.log("[MCP OAuth] Starting two-phase OAuth 2.1 flow");
+  if (options?.prefetchedAuthServerMetadata) {
+    if (!options.cacheKey) {
+      throw new Error(
+        "startMCPOAuthFlow: cacheKey is required when prefetchedAuthServerMetadata is provided (typically pass the MCP server URL)."
+      );
+    }
+    console.log(
+      "[MCP OAuth] Using prefetched AS metadata (RFC 9728 skipped):",
+      options.prefetchedAuthServerMetadata
+    );
+    return startMCPOAuthFlowWithAS({
+      authServerMetadata: options.prefetchedAuthServerMetadata,
+      cacheKey: options.cacheKey,
+      clientId,
+      redirectUri,
+      authorizationUrlOverride: options.authorizationUrlOverride,
+      tokenUrlOverride: options.tokenUrlOverride,
+      clientSecret: options.clientSecret,
+      scope: options.scope
+    });
+  }
+  const metadataUrl = parseWWWAuthenticate(wwwAuthenticateHeader) || options?.resourceMetadataUrl;
+  if (!metadataUrl) {
+    throw new Error(
+      "Could not determine OAuth resource metadata URL. The WWW-Authenticate header does not contain resource_metadata, and no pre-discovered metadata URL was provided."
+    );
+  }
+  console.log("[MCP OAuth] Resource metadata URL:", metadataUrl);
+  const resourceMetadata = await fetchResourceMetadata(metadataUrl);
+  console.log("[MCP OAuth] Resource metadata:", resourceMetadata);
+  if (!resourceMetadata.authorization_servers || resourceMetadata.authorization_servers.length === 0) {
+    throw new Error("No authorization servers found in resource metadata");
+  }
+  const authServerUrl = resourceMetadata.authorization_servers[0];
+  console.log("[MCP OAuth] Authorization server:", authServerUrl);
+  const hasFullOverrides = options?.authorizationUrlOverride && options?.tokenUrlOverride;
+  let authServerMetadata = null;
+  if (hasFullOverrides) {
+    console.log("[MCP OAuth] Skipping auth server metadata fetch \u2014 manual overrides provided:", {
+      authorization: options.authorizationUrlOverride,
+      token: options.tokenUrlOverride
+    });
+  } else {
+    try {
+      authServerMetadata = await fetchAuthorizationServerMetadata(authServerUrl);
+      console.log("[MCP OAuth] Authorization server metadata:", authServerMetadata);
+    } catch (metadataError) {
+      if (options?.authorizationUrlOverride || options?.tokenUrlOverride) {
+        console.log(
+          "[MCP OAuth] Auth server metadata fetch failed, but partial overrides available:",
+          metadataError instanceof Error ? metadataError.message : String(metadataError)
+        );
+      } else {
+        throw metadataError;
+      }
+    }
+  }
+  return startMCPOAuthFlowWithAS({
+    authServerMetadata,
+    cacheKey: metadataUrl,
+    clientId,
+    redirectUri,
+    authorizationUrlOverride: options?.authorizationUrlOverride,
+    tokenUrlOverride: options?.tokenUrlOverride,
+    clientSecret: options?.clientSecret,
+    scope: options?.scope,
+    fallbackRegistrationEndpoint: hasFullOverrides ? void 0 : `${authServerUrl}/register`,
+    resourceScopesSupported: resourceMetadata.scopes_supported
+  });
+}
 async function completeMCPOAuthFlow(context, code, state) {
   console.log("[MCP OAuth] Completing OAuth flow with authorization code");
   console.log("[MCP OAuth] Token endpoint:", context.tokenEndpoint);
@@ -661,12 +757,15 @@ function parseOAuthCallback(callbackUrl) {
 export {
   clearAuthCodeTokenCache,
   completeMCPOAuthFlow,
+  discoverAuthorizationServerFromMcpOrigin,
   discoverResourceMetadataUrl,
+  fetchAuthorizationServerMetadata,
   getAuthCodeTokenCacheStats,
   getCachedOAuth21Token,
   isOAuthRequired,
   parseOAuthCallback,
   performMCPOAuthFlow,
+  resolveMCPOAuthDiscovery,
   resolveResourceMetadataUrl,
   startMCPOAuthFlow
 };

package/dist/core/tools/mcp/oauth-refresh.cjs

@@ -48,26 +48,6 @@ var init_id = __esm({
   }
 });
 
-// src/lib/ids.ts
-function generateId() {
-  return (0, import_uuid.v7)();
-}
-function shortId(uuid, length = 8) {
-  return toShortId(uuid, length);
-}
-function formatShortId(uuid, length = 8) {
-  return shortId(uuid, length);
-}
-var import_uuid;
-var init_ids = __esm({
-  "src/lib/ids.ts"() {
-    "use strict";
-    init_cjs_shims();
-    import_uuid = require("uuid");
-    init_id();
-  }
-});
-
 // src/db/database-wrapper.ts
 function isSQLiteDatabase(db) {
   return "run" in db && typeof db.run === "function";
@@ -520,6 +500,7 @@ var init_schema_postgres = __esm({
         completed_at: t.timestamp("completed_at"),
         status: (0, import_pg_core.text)("status", {
           enum: [
+            "queued",
             "created",
             "running",
             "stopping",
@@ -531,6 +512,8 @@ var init_schema_postgres = __esm({
             "stopped"
           ]
         }).notNull(),
+        // Queue position (lower drains first); only populated for status='queued'
+        queue_position: (0, import_pg_core.integer)("queue_position"),
         // User attribution
         created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull().default("anonymous"),
         // MD5 of SDK session file at task completion (only populated when stateless_fs_mode is enabled)
@@ -540,7 +523,12 @@ var init_schema_postgres = __esm({
       (table) => ({
         sessionIdx: (0, import_pg_core.index)("tasks_session_idx").on(table.session_id),
         statusIdx: (0, import_pg_core.index)("tasks_status_idx").on(table.status),
-        createdIdx: (0, import_pg_core.index)("tasks_created_idx").on(table.created_at)
+        createdIdx: (0, import_pg_core.index)("tasks_created_idx").on(table.created_at),
+        queueIdx: (0, import_pg_core.index)("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
+        // Partial unique index — defense-in-depth for `tasks.createPending` race
+        // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
+        // rows have NULL queue_position and are unaffected.
+        queuedPositionUnique: (0, import_pg_core.uniqueIndex)("tasks_queued_position_unique").on(table.session_id, table.queue_position).where(import_drizzle_orm2.sql`${table.status} = 'queued'`)
       })
     );
     serializedSessions = (0, import_pg_core.pgTable)(
@@ -600,11 +588,9 @@ var init_schema_postgres = __esm({
         // First 200 chars for list views
         // Parent tool use ID (for nested tool calls - e.g., Task tool spawning Read/Grep)
         parent_tool_use_id: (0, import_pg_core.text)("parent_tool_use_id"),
-        // Message queueing fields
-        status: (0, import_pg_core.text)("status", { enum: ["queued"] }),
-        // 'queued' or null (normal message)
-        queue_position: (0, import_pg_core.integer)("queue_position"),
-        // Position in queue (1, 2, 3, ...)
+        // NOTE: queueing moved off `messages` and onto `tasks.status='queued'` as
+        // of migration sqlite/0040 (postgres/0030). The legacy `status` and
+        // `queue_position` columns are gone — see `tasks.queue_position` instead.
         // Full data (JSON blob)
         data: t.json("data").$type().notNull()
       },
@@ -612,8 +598,7 @@ var init_schema_postgres = __esm({
         // Indexes for efficient lookups
         sessionIdx: (0, import_pg_core.index)("messages_session_id_idx").on(table.session_id),
         taskIdx: (0, import_pg_core.index)("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: (0, import_pg_core.index)("messages_session_index_idx").on(table.session_id, table.index),
-        queueIdx: (0, import_pg_core.index)("messages_queue_idx").on(table.session_id, table.status, table.queue_position)
+        sessionIndexIdx: (0, import_pg_core.index)("messages_session_index_idx").on(table.session_id, table.index)
       })
     );
     boards = (0, import_pg_core.pgTable)(
@@ -1250,6 +1235,7 @@ var init_schema_sqlite = __esm({
         completed_at: t2.timestamp("completed_at"),
         status: (0, import_sqlite_core.text)("status", {
           enum: [
+            "queued",
             "created",
             "running",
             "stopping",
@@ -1261,6 +1247,8 @@ var init_schema_sqlite = __esm({
             "stopped"
           ]
         }).notNull(),
+        // Queue position (lower drains first); only populated for status='queued'
+        queue_position: (0, import_sqlite_core.integer)("queue_position"),
         // User attribution
         created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).notNull().default("anonymous"),
         // MD5 of SDK session file at task completion (only populated when stateless_fs_mode is enabled)
@@ -1270,7 +1258,12 @@ var init_schema_sqlite = __esm({
       (table) => ({
         sessionIdx: (0, import_sqlite_core.index)("tasks_session_idx").on(table.session_id),
         statusIdx: (0, import_sqlite_core.index)("tasks_status_idx").on(table.status),
-        createdIdx: (0, import_sqlite_core.index)("tasks_created_idx").on(table.created_at)
+        createdIdx: (0, import_sqlite_core.index)("tasks_created_idx").on(table.created_at),
+        queueIdx: (0, import_sqlite_core.index)("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
+        // Partial unique index — defense-in-depth for `tasks.createPending` race
+        // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
+        // rows have NULL queue_position and are unaffected.
+        queuedPositionUnique: (0, import_sqlite_core.uniqueIndex)("tasks_queued_position_unique").on(table.session_id, table.queue_position).where(import_drizzle_orm3.sql`${table.status} = 'queued'`)
       })
     );
     serializedSessions2 = (0, import_sqlite_core.sqliteTable)(
@@ -1330,11 +1323,9 @@ var init_schema_sqlite = __esm({
         // First 200 chars for list views
         // Parent tool use ID (for nested tool calls - e.g., Task tool spawning Read/Grep)
         parent_tool_use_id: (0, import_sqlite_core.text)("parent_tool_use_id"),
-        // Message queueing fields
-        status: (0, import_sqlite_core.text)("status", { enum: ["queued"] }),
-        // 'queued' or null (normal message)
-        queue_position: (0, import_sqlite_core.integer)("queue_position"),
-        // Position in queue (1, 2, 3, ...)
+        // NOTE: queueing moved off `messages` and onto `tasks.status='queued'` as
+        // of migration sqlite/0040 (postgres/0030). The legacy `status` and
+        // `queue_position` columns are gone — see `tasks.queue_position` instead.
         // Full data (JSON blob)
         data: t2.json("data").$type().notNull()
       },
@@ -1342,8 +1333,7 @@ var init_schema_sqlite = __esm({
         // Indexes for efficient lookups
         sessionIdx: (0, import_sqlite_core.index)("messages_session_id_idx").on(table.session_id),
         taskIdx: (0, import_sqlite_core.index)("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: (0, import_sqlite_core.index)("messages_session_index_idx").on(table.session_id, table.index),
-        queueIdx: (0, import_sqlite_core.index)("messages_queue_idx").on(table.session_id, table.status, table.queue_position)
+        sessionIndexIdx: (0, import_sqlite_core.index)("messages_session_index_idx").on(table.session_id, table.index)
       })
     );
     boards2 = (0, import_sqlite_core.sqliteTable)(
@@ -2068,7 +2058,22 @@ init_cjs_shims();
 // src/db/repositories/artifacts.ts
 init_cjs_shims();
 var import_drizzle_orm4 = require("drizzle-orm");
-init_ids();
+
+// src/lib/ids.ts
+init_cjs_shims();
+var import_uuid = require("uuid");
+init_id();
+function generateId() {
+  return (0, import_uuid.v7)();
+}
+function shortId(uuid, length = 8) {
+  return toShortId(uuid, length);
+}
+function formatShortId(uuid, length = 8) {
+  return shortId(uuid, length);
+}
+
+// src/db/repositories/artifacts.ts
 init_database_wrapper();
 init_schema();
 
@@ -2104,14 +2109,12 @@ var AmbiguousIdError = class extends RepositoryError {
 // src/db/repositories/board-comments.ts
 init_cjs_shims();
 var import_drizzle_orm5 = require("drizzle-orm");
-init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/board-objects.ts
 init_cjs_shims();
 var import_drizzle_orm6 = require("drizzle-orm");
-init_ids();
 
 // src/utils/board-placement.ts
 init_cjs_shims();
@@ -2126,14 +2129,12 @@ init_types();
 var import_drizzle_orm7 = require("drizzle-orm");
 var yaml2 = __toESM(require("js-yaml"), 1);
 init_config_manager();
-init_ids();
 
 // src/lib/slugs.ts
 init_cjs_shims();
 
 // src/utils/url.ts
 init_cjs_shims();
-init_ids();
 
 // src/db/repositories/boards.ts
 init_database_wrapper();
@@ -2142,21 +2143,18 @@ init_schema();
 // src/db/repositories/card-types.ts
 init_cjs_shims();
 var import_drizzle_orm8 = require("drizzle-orm");
-init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/cards.ts
 init_cjs_shims();
 var import_drizzle_orm9 = require("drizzle-orm");
-init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/gateway-channels.ts
 init_cjs_shims();
 var import_drizzle_orm10 = require("drizzle-orm");
-init_ids();
 init_database_wrapper();
 
 // src/db/encryption.ts
@@ -2169,7 +2167,6 @@ init_schema();
 // src/db/repositories/mcp-servers.ts
 init_cjs_shims();
 var import_drizzle_orm11 = require("drizzle-orm");
-init_ids();
 init_database_wrapper();
 init_schema();
 var MCPServerRepository = class {
@@ -2433,7 +2430,6 @@ var dump2 = import_js_yaml2.default.dump;
 var YAMLException = import_js_yaml2.default.YAMLException;
 
 // src/db/repositories/repos.ts
-init_ids();
 init_database_wrapper();
 init_schema();
 
@@ -2443,7 +2439,6 @@ init_cjs_shims();
 // src/db/repositories/serialized-sessions.ts
 init_cjs_shims();
 var import_drizzle_orm14 = require("drizzle-orm");
-init_ids();
 init_database_wrapper();
 init_schema();
 
@@ -2464,7 +2459,6 @@ init_cjs_shims();
 init_types();
 var import_drizzle_orm16 = require("drizzle-orm");
 init_config_manager();
-init_ids();
 init_database_wrapper();
 init_schema();
 
@@ -2472,14 +2466,12 @@ init_schema();
 init_cjs_shims();
 init_types();
 var import_drizzle_orm18 = require("drizzle-orm");
-init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/thread-session-map.ts
 init_cjs_shims();
 var import_drizzle_orm19 = require("drizzle-orm");
-init_ids();
 init_database_wrapper();
 init_schema();
 
@@ -2488,7 +2480,6 @@ init_cjs_shims();
 var import_node_crypto2 = require("crypto");
 var import_bcryptjs = __toESM(require("bcryptjs"), 1);
 var import_drizzle_orm20 = require("drizzle-orm");
-init_ids();
 init_database_wrapper();
 init_schema();
 
@@ -2664,6 +2655,7 @@ var UserMCPOAuthTokenRepository = class {
 
 // src/db/repositories/users.ts
 init_cjs_shims();
+init_types();
 var import_drizzle_orm22 = require("drizzle-orm");
 
 // src/config/env-vars.ts
@@ -2672,7 +2664,6 @@ var V05_SCOPES = ["global", "session"];
 var V05_SCOPE_SET = new Set(V05_SCOPES);
 
 // src/db/repositories/users.ts
-init_ids();
 init_database_wrapper();
 init_schema();
 
@@ -2680,7 +2671,6 @@ init_schema();
 init_cjs_shims();
 init_types();
 var import_drizzle_orm23 = require("drizzle-orm");
-init_ids();
 init_database_wrapper();
 init_schema();
 

package/dist/core/tools/mcp/oauth-refresh.d.cts

@@ -1,15 +1,15 @@
-import { j as Database } from '../../client-B5PyIvNc.cjs';
+import { j as Database } from '../../client-CemqXk0v.cjs';
 import { f as UserID } from '../../id-CoIbY_uc.cjs';
 import { h as MCPServerID } from '../../mcp-DC7GLAg2.cjs';
 import 'drizzle-orm/libsql';
 import 'drizzle-orm/postgres-js';
 import 'drizzle-orm';
-import '../../message-DinITA7a.cjs';
+import '../../message-CSWOsdcZ.cjs';
 import '../../agentic-tool-BulhIUGb.cjs';
 import '../../board-D7SnPqp-.cjs';
 import '../../session-MNU4BQv4.cjs';
 import '../../context-BpkCELpO.cjs';
-import '../../task-wht1RJEL.cjs';
+import '../../task-C2Hy7H6u.cjs';
 import 'drizzle-orm/pg-core';
 import 'drizzle-orm/sqlite-core';
 

package/dist/core/tools/mcp/oauth-refresh.d.ts

@@ -1,15 +1,15 @@
-import { j as Database } from '../../client-C1CsRi19.js';
+import { j as Database } from '../../client-uYEOha6g.js';
 import { f as UserID } from '../../id-CoIbY_uc.js';
 import { h as MCPServerID } from '../../mcp-z5v19H-r.js';
 import 'drizzle-orm/libsql';
 import 'drizzle-orm/postgres-js';
 import 'drizzle-orm';
-import '../../message-CHUUP6OS.js';
+import '../../message-DZa8g0s0.js';
 import '../../agentic-tool-cYqsU5i5.js';
 import '../../board-D3YJ0_ih.js';
 import '../../session-CAfhv1qL.js';
 import '../../context-BpkCELpO.js';
-import '../../task-BLPFCORT.js';
+import '../../task-BHV-YHg1.js';
 import 'drizzle-orm/pg-core';
 import 'drizzle-orm/sqlite-core';