agor-live 0.23.1 → 0.23.2

package/dist/core/seed/index.js

@@ -7191,6 +7191,63 @@ var BranchRepository = class {
     }
     return Array.from(userIds);
   }
+  /**
+   * Find non-archived branches whose explicit filesystem access set can change
+   * when membership in the given group changes.
+   *
+   * Keep this inverse lookup in lockstep with findExplicitFsAccessUserIds():
+   * both encode which group grants materialize into branch-folder access.
+   * App-only grants (`fs_access = 'none'`) are intentionally excluded because
+   * membership changes for those grants do not require branch-folder mutation.
+   */
+  async findExplicitFsAccessBranchIdsForGroup(groupId) {
+    const directRows = await select(this.db, { branch_id: branchGroupGrants3.branch_id }).from(branchGroupGrants3).innerJoin(branches3, eq8(branches3.branch_id, branchGroupGrants3.branch_id)).innerJoin(
+      groups3,
+      and8(eq8(groups3.group_id, branchGroupGrants3.group_id), eq8(groups3.archived, false))
+    ).where(
+      and8(
+        eq8(branchGroupGrants3.group_id, groupId),
+        eq8(branches3.archived, false),
+        inArray3(
+          sql7`coalesce(${branchGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const boardRows = await select(this.db, { branch_id: branches3.branch_id }).from(boardGroupGrants3).innerJoin(
+      groups3,
+      and8(eq8(groups3.group_id, boardGroupGrants3.group_id), eq8(groups3.archived, false))
+    ).innerJoin(
+      boards3,
+      and8(
+        eq8(boards3.board_id, boardGroupGrants3.board_id),
+        eq8(sql7`coalesce(${jsonExtract(this.db, boards3.data, "access_mode")}, 'shared')`, "shared")
+      )
+    ).innerJoin(
+      branches3,
+      and8(
+        eq8(branches3.board_id, boardGroupGrants3.board_id),
+        eq8(branches3.permission_source, "board"),
+        eq8(branches3.archived, false)
+      )
+    ).where(
+      and8(
+        eq8(boardGroupGrants3.group_id, groupId),
+        inArray3(
+          sql7`coalesce(${boardGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const branchIds = /* @__PURE__ */ new Set();
+    for (const row of directRows) {
+      branchIds.add(row.branch_id);
+    }
+    for (const row of boardRows) {
+      branchIds.add(row.branch_id);
+    }
+    return Array.from(branchIds);
+  }
   async findBoardAlignedBranches(boardId) {
     const rows = await select(this.db).from(branches3).where(
       and8(
@@ -8198,6 +8255,60 @@ var BoardRepository = class {
       );
     }
   }
+  /**
+   * Shallow-merge field patches into existing board objects in a single
+   * read-modify-write.
+   *
+   * Unlike upsertBoardObject (which fully replaces the object value, dropping
+   * omitted fields), this overwrites ONLY the provided keys and leaves the rest
+   * of each object intact — so a narrow change (e.g. a zIndex reorder) has a
+   * smaller blast radius and won't clobber a field edited via a different patch
+   * call. Multiple objects in one call are merged before a single write, so a
+   * forward/backward swap touches both neighbors in one update.
+   *
+   * Objects that no longer exist are SKIPPED, never re-created — so a swap can't
+   * resurrect a neighbor deleted between the client's read and this write.
+   *
+   * Only an explicit allowlist of fields can be merged (currently just `zIndex`,
+   * which is also clamped into the board-object band [1, 499] so it can never be
+   * pushed onto the card (500) / comment (1000) layers). Any other key in a
+   * patch is ignored, so this narrow action cannot reshape an object (e.g. flip
+   * its `type`) the way a full upsert could.
+   *
+   * NOTE: this is NOT atomic against concurrent writers. Like every other board
+   * writer, the findById → update sequence has a lost-update window: a write
+   * that lands between the read and the update can be overwritten (last-write-
+   * wins). Merging only the patched keys narrows that window's blast radius
+   * versus a full-object upsert, but does not close it.
+   */
+  async mergeBoardObjectFields(boardId, patches) {
+    const Z_MIN = 1;
+    const Z_MAX = 499;
+    try {
+      const fullId = await this.resolveId(boardId);
+      const current = await this.findById(fullId);
+      if (!current) {
+        throw new EntityNotFoundError("Board", boardId);
+      }
+      const updatedObjects = { ...current.objects || {} };
+      for (const [objectId, fields] of Object.entries(patches)) {
+        const existing = updatedObjects[objectId];
+        if (!existing) continue;
+        const { zIndex } = fields;
+        if (typeof zIndex !== "number" || !Number.isFinite(zIndex)) continue;
+        const safeZIndex = Math.min(Z_MAX, Math.max(Z_MIN, zIndex));
+        updatedObjects[objectId] = { ...existing, zIndex: safeZIndex };
+      }
+      return this.update(fullId, { objects: updatedObjects });
+    } catch (error) {
+      if (error instanceof RepositoryError) throw error;
+      if (error instanceof EntityNotFoundError) throw error;
+      throw new RepositoryError(
+        `Failed to merge board object fields: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
   /**
    * DEPRECATED: Delete a zone and handle associated sessions
    * TODO: Reimplement using board-objects table
@@ -8819,11 +8930,71 @@ init_schema();
 // src/db/repositories/mcp-servers.ts
 init_esm_shims();
 init_ids();
-import { and as and15, eq as eq17, like as like10 } from "drizzle-orm";
+import { and as and16, eq as eq19, like as like10 } from "drizzle-orm";
 
 // src/tools/mcp/auth-secrets.ts
 init_esm_shims();
 
+// src/mcp/template-resolver.ts
+init_esm_shims();
+
+// src/config/env-resolver.ts
+init_esm_shims();
+init_database_wrapper();
+import { eq as eq18 } from "drizzle-orm";
+
+// src/db/repositories/session-env-selections.ts
+init_esm_shims();
+init_database_wrapper();
+init_schema();
+import { and as and15, eq as eq17 } from "drizzle-orm";
+
+// src/config/env-resolver.ts
+init_schema();
+
+// src/config/env-blocklist.ts
+init_esm_shims();
+var BLOCKED_ENV_PATTERNS = Object.freeze([
+  /^LD_/i,
+  /^DYLD_/i,
+  /^PYTHON(?!_AGOR_)/i
+]);
+
+// src/config/env-vars.ts
+init_esm_shims();
+var V05_SCOPES = ["global", "session"];
+var V05_SCOPE_SET = new Set(V05_SCOPES);
+function normalizeStoredEnvVar(raw) {
+  if (typeof raw === "string") {
+    return { value_encrypted: raw, scope: "global" };
+  }
+  return {
+    value_encrypted: raw.value_encrypted,
+    scope: raw.scope,
+    resource_id: raw.resource_id ?? null,
+    extra_config: raw.extra_config ?? null
+  };
+}
+function normalizeStoredEnvMap(raw) {
+  const out = {};
+  if (!raw) return out;
+  for (const [key, value] of Object.entries(raw)) {
+    try {
+      out[key] = normalizeStoredEnvVar(value);
+    } catch (err) {
+      console.warn(`[env-vars] Skipping malformed env var entry ${key}:`, err);
+    }
+  }
+  return out;
+}
+
+// src/templates/handlebars-helpers.ts
+init_esm_shims();
+import Handlebars from "handlebars";
+
+// src/mcp/template-patterns.ts
+init_esm_shims();
+
 // src/tools/mcp/http-headers.ts
 init_esm_shims();
 
@@ -8835,7 +9006,7 @@ init_schema();
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and16, eq as eq18, inArray as inArray7 } from "drizzle-orm";
+import { and as and17, eq as eq20, inArray as inArray7 } from "drizzle-orm";
 var MessagesRepository = class {
   constructor(db) {
     this.db = db;
@@ -8901,7 +9072,7 @@ var MessagesRepository = class {
    * Get message by ID
    */
   async findById(messageId) {
-    const row = await select(this.db).from(messages3).where(eq18(messages3.message_id, messageId)).one();
+    const row = await select(this.db).from(messages3).where(eq20(messages3.message_id, messageId)).one();
     return row ? this.rowToMessage(row) : null;
   }
   /**
@@ -8910,19 +9081,19 @@ var MessagesRepository = class {
   async findAll(filter) {
     if (filter?.sessionIds !== void 0 && filter.sessionIds.length === 0) return [];
     const conditions = [];
-    if (filter?.sessionId) conditions.push(eq18(messages3.session_id, filter.sessionId));
+    if (filter?.sessionId) conditions.push(eq20(messages3.session_id, filter.sessionId));
     if (filter?.sessionIds !== void 0)
       conditions.push(inArray7(messages3.session_id, filter.sessionIds));
-    if (filter?.taskId) conditions.push(eq18(messages3.task_id, filter.taskId));
-    if (filter?.type) conditions.push(eq18(messages3.type, filter.type));
-    if (filter?.role) conditions.push(eq18(messages3.role, filter.role));
+    if (filter?.taskId) conditions.push(eq20(messages3.task_id, filter.taskId));
+    if (filter?.type) conditions.push(eq20(messages3.type, filter.type));
+    if (filter?.role) conditions.push(eq20(messages3.role, filter.role));
     if (filter?.visibleToUserId) {
       conditions.push(
         visibleSessionReferenceAccessExists(this.db, filter.visibleToUserId, messages3.session_id)
       );
     }
     let query = select(this.db).from(messages3);
-    if (conditions.length > 0) query = query.where(and16(...conditions));
+    if (conditions.length > 0) query = query.where(and17(...conditions));
     const rows = await query.orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
@@ -8930,21 +9101,21 @@ var MessagesRepository = class {
    * Get all messages for a session (ordered by index)
    */
   async findBySessionId(sessionId) {
-    const rows = await select(this.db).from(messages3).where(eq18(messages3.session_id, sessionId)).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where(eq20(messages3.session_id, sessionId)).orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
   /**
    * Get all messages for a session filtered by type (ordered by index)
    */
   async findBySessionIdAndType(sessionId, type) {
-    const rows = await select(this.db).from(messages3).where(and16(eq18(messages3.session_id, sessionId), eq18(messages3.type, type))).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where(and17(eq20(messages3.session_id, sessionId), eq20(messages3.type, type))).orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
   /**
    * Get all messages for a task (ordered by index)
    */
   async findByTaskId(taskId) {
-    const rows = await select(this.db).from(messages3).where(eq18(messages3.task_id, taskId)).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where(eq20(messages3.task_id, taskId)).orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
   /**
@@ -8952,7 +9123,7 @@ var MessagesRepository = class {
    * Used for task message_range queries
    */
   async findByRange(sessionId, startIndex, endIndex) {
-    const rows = await select(this.db).from(messages3).where(eq18(messages3.session_id, sessionId)).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where(eq20(messages3.session_id, sessionId)).orderBy(messages3.index).all();
     return rows.filter((r) => r.index >= startIndex && r.index <= endIndex).map((r) => this.rowToMessage(r));
   }
   /**
@@ -8965,33 +9136,33 @@ var MessagesRepository = class {
     }
     const updated = { ...existing, ...updates };
     const row = this.messageToRow(updated);
-    const result = await update(this.db, messages3).set(row).where(eq18(messages3.message_id, messageId)).returning().one();
+    const result = await update(this.db, messages3).set(row).where(eq20(messages3.message_id, messageId)).returning().one();
     return this.rowToMessage(result);
   }
   /**
    * Update message task assignment
    */
   async assignToTask(messageId, taskId) {
-    const updated = await update(this.db, messages3).set({ task_id: taskId }).where(eq18(messages3.message_id, messageId)).returning().one();
+    const updated = await update(this.db, messages3).set({ task_id: taskId }).where(eq20(messages3.message_id, messageId)).returning().one();
     return this.rowToMessage(updated);
   }
   /**
    * Delete all messages for a session (cascades automatically via FK)
    */
   async deleteBySessionId(sessionId) {
-    await deleteFrom(this.db, messages3).where(eq18(messages3.session_id, sessionId)).run();
+    await deleteFrom(this.db, messages3).where(eq20(messages3.session_id, sessionId)).run();
   }
   /**
    * Delete a single message
    */
   async delete(messageId) {
-    await deleteFrom(this.db, messages3).where(eq18(messages3.message_id, messageId)).run();
+    await deleteFrom(this.db, messages3).where(eq20(messages3.message_id, messageId)).run();
   }
 };
 
 // src/db/repositories/repos.ts
 init_esm_shims();
-import { eq as eq19, like as like11, sql as sql10 } from "drizzle-orm";
+import { eq as eq21, like as like11, sql as sql10 } from "drizzle-orm";
 
 // src/config/variant-resolver.ts
 init_esm_shims();
@@ -9152,7 +9323,7 @@ var RepoRepository = class {
     try {
       const insertData = this.repoToInsert(data);
       await insert(this.db, repos3).values(insertData).run();
-      const row = await select(this.db).from(repos3).where(eq19(repos3.repo_id, insertData.repo_id)).one();
+      const row = await select(this.db).from(repos3).where(eq21(repos3.repo_id, insertData.repo_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created repo");
       }
@@ -9171,7 +9342,7 @@ var RepoRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(repos3).where(eq19(repos3.repo_id, fullId)).one();
+      const row = await select(this.db).from(repos3).where(eq21(repos3.repo_id, fullId)).one();
       return row ? this.rowToRepo(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -9187,7 +9358,7 @@ var RepoRepository = class {
    */
   async findBySlug(slug) {
     try {
-      const row = await select(this.db).from(repos3).where(eq19(repos3.slug, slug)).one();
+      const row = await select(this.db).from(repos3).where(eq21(repos3.slug, slug)).one();
       return row ? this.rowToRepo(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -9255,8 +9426,8 @@ var RepoRepository = class {
       let changed = 0;
       for (const finding of scan.findings) {
         await this.db.transaction(async (tx) => {
-          await lockRowForUpdate(txAsDb(tx), this.db, repos3, eq19(repos3.repo_id, finding.repo_id));
-          const currentRow = await select(txAsDb(tx)).from(repos3).where(eq19(repos3.repo_id, finding.repo_id)).one();
+          await lockRowForUpdate(txAsDb(tx), this.db, repos3, eq21(repos3.repo_id, finding.repo_id));
+          const currentRow = await select(txAsDb(tx)).from(repos3).where(eq21(repos3.repo_id, finding.repo_id)).one();
           if (!currentRow) return;
           const data = currentRow.data;
           if (typeof data.remote_url !== "string" || !httpUrlHasUserinfo(data.remote_url)) {
@@ -9268,7 +9439,7 @@ var RepoRepository = class {
               ...data,
               remote_url: stripHttpUrlUserinfo(data.remote_url)
             }
-          }).where(eq19(repos3.repo_id, finding.repo_id)).run();
+          }).where(eq21(repos3.repo_id, finding.repo_id)).run();
           changed += 1;
         });
       }
@@ -9290,8 +9461,8 @@ var RepoRepository = class {
     try {
       const fullId = await this.resolveId(id);
       return await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, repos3, eq19(repos3.repo_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(repos3).where(eq19(repos3.repo_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, repos3, eq21(repos3.repo_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(repos3).where(eq21(repos3.repo_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Repo", id);
         }
@@ -9305,7 +9476,7 @@ var RepoRepository = class {
           repo_type: insertData.repo_type,
           unix_group: merged.unix_group ?? null,
           data: insertData.data
-        }).where(eq19(repos3.repo_id, fullId)).run();
+        }).where(eq21(repos3.repo_id, fullId)).run();
         merged.clone_error = insertData.data.clone_error;
         merged.remote_url = insertData.data.remote_url;
         merged.last_updated = newUpdatedAt.toISOString();
@@ -9339,8 +9510,8 @@ var RepoRepository = class {
     try {
       const fullId = await this.resolveId(id);
       return await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, repos3, eq19(repos3.repo_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(repos3).where(eq19(repos3.repo_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, repos3, eq21(repos3.repo_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(repos3).where(eq21(repos3.repo_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Repo", id);
         }
@@ -9354,7 +9525,7 @@ var RepoRepository = class {
           repo_type: insertData.repo_type,
           unix_group: next.unix_group ?? null,
           data: insertData.data
-        }).where(eq19(repos3.repo_id, fullId)).run();
+        }).where(eq21(repos3.repo_id, fullId)).run();
         next.environment = insertData.data.environment;
         next.environment_config = insertData.data.environment_config;
         next.remote_url = insertData.data.remote_url;
@@ -9394,7 +9565,7 @@ var RepoRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, repos3).where(eq19(repos3.repo_id, fullId)).run();
+      const result = await deleteFrom(this.db, repos3).where(eq21(repos3.repo_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Repo", id);
       }
@@ -9441,33 +9612,27 @@ init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and17, asc as asc2, desc as desc3, eq as eq20, isNull as isNull6, like as like12, lte, or as or7, sql as sql11 } from "drizzle-orm";
+import { and as and18, asc as asc2, desc as desc3, eq as eq22, isNull as isNull6, like as like12, lte, or as or7, sql as sql11 } from "drizzle-orm";
 
 // src/db/repositories/serialized-sessions.ts
 init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and18, desc as desc4, eq as eq21, lt } from "drizzle-orm";
-
-// src/db/repositories/session-env-selections.ts
-init_esm_shims();
-init_database_wrapper();
-init_schema();
-import { and as and19, eq as eq22 } from "drizzle-orm";
+import { and as and19, desc as desc4, eq as eq23, lt } from "drizzle-orm";
 
 // src/db/repositories/session-mcp-servers.ts
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and21, eq as eq24 } from "drizzle-orm";
+import { and as and21, eq as eq25 } from "drizzle-orm";
 
 // src/db/repositories/sessions.ts
 init_esm_shims();
 init_types();
 init_config_manager();
 init_ids();
-import { and as and20, desc as desc5, eq as eq23, inArray as inArray8, like as like13, or as or8, sql as sql12 } from "drizzle-orm";
+import { and as and20, desc as desc5, eq as eq24, inArray as inArray8, like as like13, or as or8, sql as sql12 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
 function isSessionTimestampNeutralPatch(updates) {
@@ -9492,40 +9657,43 @@ var SessionRepository = class {
     const sessionId = row.session_id;
     const boardId = branchBoardId ?? null;
     const url = baseUrl && boardId ? getSessionUrl(sessionId, baseUrl) : null;
-    return {
-      session_id: sessionId,
-      status: row.status,
-      agentic_tool: row.agentic_tool,
-      created_at: new Date(row.created_at).toISOString(),
-      last_updated: row.updated_at ? new Date(row.updated_at).toISOString() : new Date(row.created_at).toISOString(),
-      created_by: row.created_by,
-      unix_username: row.unix_username || null,
-      branch_id: row.branch_id,
-      branch_board_id: boardId,
-      url,
-      ...row.data,
-      tasks: row.data.tasks.map((id) => id),
-      genealogy: {
-        parent_session_id: row.parent_session_id,
-        forked_from_session_id: row.forked_from_session_id,
-        fork_point_task_id: genealogyData.fork_point_task_id,
-        fork_point_message_index: genealogyData.fork_point_message_index,
-        spawn_point_task_id: genealogyData.spawn_point_task_id,
-        spawn_point_message_index: genealogyData.spawn_point_message_index,
-        children: genealogyData.children.map((id) => id)
+    return attachHiddenTenant(
+      {
+        session_id: sessionId,
+        status: row.status,
+        agentic_tool: row.agentic_tool,
+        created_at: new Date(row.created_at).toISOString(),
+        last_updated: row.updated_at ? new Date(row.updated_at).toISOString() : new Date(row.created_at).toISOString(),
+        created_by: row.created_by,
+        unix_username: row.unix_username || null,
+        branch_id: row.branch_id,
+        branch_board_id: boardId,
+        url,
+        ...row.data,
+        tasks: row.data.tasks.map((id) => id),
+        genealogy: {
+          parent_session_id: row.parent_session_id,
+          forked_from_session_id: row.forked_from_session_id,
+          fork_point_task_id: genealogyData.fork_point_task_id,
+          fork_point_message_index: genealogyData.fork_point_message_index,
+          spawn_point_task_id: genealogyData.spawn_point_task_id,
+          spawn_point_message_index: genealogyData.spawn_point_message_index,
+          children: genealogyData.children.map((id) => id)
+        },
+        permission_config: row.data.permission_config,
+        scheduled_run_at: row.scheduled_run_at ?? void 0,
+        scheduled_from_branch: row.scheduled_from_branch ?? false,
+        schedule_id: row.schedule_id ?? void 0,
+        ready_for_prompt: row.ready_for_prompt ?? false,
+        archived: Boolean(row.archived),
+        // Convert SQLite integer (0/1) to boolean
+        archived_reason: row.archived_reason ?? void 0,
+        current_context_usage: row.data.current_context_usage,
+        context_window_limit: row.data.context_window_limit,
+        last_context_update_at: row.data.last_context_update_at
       },
-      permission_config: row.data.permission_config,
-      scheduled_run_at: row.scheduled_run_at ?? void 0,
-      scheduled_from_branch: row.scheduled_from_branch ?? false,
-      schedule_id: row.schedule_id ?? void 0,
-      ready_for_prompt: row.ready_for_prompt ?? false,
-      archived: Boolean(row.archived),
-      // Convert SQLite integer (0/1) to boolean
-      archived_reason: row.archived_reason ?? void 0,
-      current_context_usage: row.data.current_context_usage,
-      context_window_limit: row.data.context_window_limit,
-      last_context_update_at: row.data.last_context_update_at
-    };
+      row
+    );
   }
   /**
    * Convert Session to database insert format
@@ -9613,7 +9781,7 @@ var SessionRepository = class {
       const insertData = this.sessionToInsert(data);
       await insert(this.db, sessions3).values(insertData).run();
       const baseUrl = await getBaseUrl();
-      const result = await select(this.db).from(sessions3).leftJoin(branches3, eq23(sessions3.branch_id, branches3.branch_id)).where(eq23(sessions3.session_id, insertData.session_id)).one();
+      const result = await select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).where(eq24(sessions3.session_id, insertData.session_id)).one();
       if (!result) {
         throw new RepositoryError("Failed to retrieve created session");
       }
@@ -9638,7 +9806,7 @@ var SessionRepository = class {
     try {
       const fullId = await this.resolveId(id);
       const baseUrl = await getBaseUrl();
-      const result = await select(this.db).from(sessions3).leftJoin(branches3, eq23(sessions3.branch_id, branches3.branch_id)).where(eq23(sessions3.session_id, fullId)).one();
+      const result = await select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).where(eq24(sessions3.session_id, fullId)).one();
       if (!result) {
         return null;
       }
@@ -9661,7 +9829,7 @@ var SessionRepository = class {
   async findBranchIdBySessionId(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db, { branch_id: sessions3.branch_id }).from(sessions3).where(eq23(sessions3.session_id, fullId)).one();
+      const row = await select(this.db, { branch_id: sessions3.branch_id }).from(sessions3).where(eq24(sessions3.session_id, fullId)).one();
       return row?.branch_id ?? null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -9672,6 +9840,26 @@ var SessionRepository = class {
       );
     }
   }
+  /**
+   * Resolve the owning user id for a session without hydrating the full row.
+   * Used by realtime delivery to offer streaming events to the session
+   * creator's own connections as a fallback, so their open tabs keep updating
+   * even before they subscribe to the per-session stream channel.
+   */
+  async findCreatedByBySessionId(id) {
+    try {
+      const fullId = await this.resolveId(id);
+      const row = await select(this.db, { created_by: sessions3.created_by }).from(sessions3).where(eq24(sessions3.session_id, fullId)).one();
+      return row?.created_by ?? null;
+    } catch (error) {
+      if (error instanceof EntityNotFoundError) return null;
+      if (error instanceof AmbiguousIdError) throw error;
+      throw new RepositoryError(
+        `Failed to find session owner: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
   /**
    * Find all sessions
    *
@@ -9684,13 +9872,13 @@ var SessionRepository = class {
       if (filter?.visibleToUserId) {
         conditions.push(visibleBranchAccessCondition(this.db, filter.visibleToUserId));
       }
-      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).leftJoin(branches3, eq23(sessions3.branch_id, branches3.branch_id)).leftJoin(
+      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).leftJoin(
         branchOwners3,
         and20(
-          eq23(branchOwners3.branch_id, branches3.branch_id),
-          eq23(branchOwners3.user_id, filter.visibleToUserId)
+          eq24(branchOwners3.branch_id, branches3.branch_id),
+          eq24(branchOwners3.user_id, filter.visibleToUserId)
         )
-      ) : select(this.db).from(sessions3).leftJoin(branches3, eq23(sessions3.branch_id, branches3.branch_id));
+      ) : select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id));
       const results = conditions.length > 0 ? await query.where(and20(...conditions)).all() : await query.all();
       return results.map(
         (result) => {
@@ -9714,7 +9902,7 @@ var SessionRepository = class {
   async findByStatus(status) {
     try {
       const baseUrl = await getBaseUrl();
-      const results = await select(this.db).from(sessions3).leftJoin(branches3, eq23(sessions3.branch_id, branches3.branch_id)).where(eq23(sessions3.status, status)).all();
+      const results = await select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).where(eq24(sessions3.status, status)).all();
       return results.map(
         (result) => {
           const sessionRow = result.sessions;
@@ -9742,17 +9930,17 @@ var SessionRepository = class {
   async findByBoard(boardId, filter) {
     try {
       const baseUrl = await getBaseUrl();
-      const conditions = [eq23(branches3.board_id, boardId)];
+      const conditions = [eq24(branches3.board_id, boardId)];
       if (filter?.visibleToUserId) {
         conditions.push(visibleBranchAccessCondition(this.db, filter.visibleToUserId));
       }
-      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).innerJoin(branches3, eq23(sessions3.branch_id, branches3.branch_id)).leftJoin(
+      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).innerJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).leftJoin(
         branchOwners3,
         and20(
-          eq23(branchOwners3.branch_id, branches3.branch_id),
-          eq23(branchOwners3.user_id, filter.visibleToUserId)
+          eq24(branchOwners3.branch_id, branches3.branch_id),
+          eq24(branchOwners3.user_id, filter.visibleToUserId)
         )
-      ) : select(this.db).from(sessions3).innerJoin(branches3, eq23(sessions3.branch_id, branches3.branch_id));
+      ) : select(this.db).from(sessions3).innerJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id));
       const results = await query.where(and20(...conditions)).all();
       return results.map(
         (result) => {
@@ -9789,31 +9977,31 @@ var SessionRepository = class {
     try {
       const baseUrl = await getBaseUrl();
       const conditions = [];
-      if (opts.boardId !== void 0) conditions.push(eq23(branches3.board_id, opts.boardId));
-      if (opts.archived !== void 0) conditions.push(eq23(sessions3.archived, opts.archived));
+      if (opts.boardId !== void 0) conditions.push(eq24(branches3.board_id, opts.boardId));
+      if (opts.archived !== void 0) conditions.push(eq24(sessions3.archived, opts.archived));
       if (opts.visibleToUserId) {
         conditions.push(visibleBranchAccessCondition(this.db, opts.visibleToUserId));
       }
       const whereClause = conditions.length > 0 ? and20(...conditions) : void 0;
-      let countQuery = select(this.db, { count: sql12`count(*)` }).from(sessions3).leftJoin(branches3, eq23(sessions3.branch_id, branches3.branch_id));
+      let countQuery = select(this.db, { count: sql12`count(*)` }).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id));
       if (opts.visibleToUserId) {
         countQuery = countQuery.leftJoin(
           branchOwners3,
           and20(
-            eq23(branchOwners3.branch_id, branches3.branch_id),
-            eq23(branchOwners3.user_id, opts.visibleToUserId)
+            eq24(branchOwners3.branch_id, branches3.branch_id),
+            eq24(branchOwners3.user_id, opts.visibleToUserId)
           )
         );
       }
       const countRow = await (whereClause ? countQuery.where(whereClause) : countQuery).one();
       const total = Number(countRow?.count ?? 0);
-      let dataQuery = select(this.db).from(sessions3).leftJoin(branches3, eq23(sessions3.branch_id, branches3.branch_id));
+      let dataQuery = select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id));
       if (opts.visibleToUserId) {
         dataQuery = dataQuery.leftJoin(
           branchOwners3,
           and20(
-            eq23(branchOwners3.branch_id, branches3.branch_id),
-            eq23(branchOwners3.user_id, opts.visibleToUserId)
+            eq24(branchOwners3.branch_id, branches3.branch_id),
+            eq24(branchOwners3.user_id, opts.visibleToUserId)
           )
         );
       }
@@ -9850,7 +10038,7 @@ var SessionRepository = class {
       const fullId = await this.resolveId(sessionId);
       const baseUrl = await getBaseUrl();
       const { jsonExtract: jsonExtract2 } = await Promise.resolve().then(() => (init_database_wrapper(), database_wrapper_exports));
-      const results = await select(this.db).from(sessions3).leftJoin(branches3, eq23(sessions3.branch_id, branches3.branch_id)).where(
+      const results = await select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).where(
         or8(
           sql12`${jsonExtract2(this.db, sessions3.data, "genealogy.parent_session_id")} = ${fullId}`,
           sql12`${jsonExtract2(this.db, sessions3.data, "genealogy.forked_from_session_id")} = ${fullId}`
@@ -9919,8 +10107,8 @@ var SessionRepository = class {
       const statusInfo = updates.status ? ` (status: ${updates.status}, ready_for_prompt: ${updates.ready_for_prompt})` : "";
       console.debug(`\u{1F504} [SessionRepo] Updating session ${shortId(fullId)}${statusInfo}`);
       const result = await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, sessions3, eq23(sessions3.session_id, fullId));
-        const currentResult = await select(txAsDb(tx)).from(sessions3).leftJoin(branches3, eq23(sessions3.branch_id, branches3.branch_id)).where(eq23(sessions3.session_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, sessions3, eq24(sessions3.session_id, fullId));
+        const currentResult = await select(txAsDb(tx)).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).where(eq24(sessions3.session_id, fullId)).one();
         if (!currentResult) {
           throw new EntityNotFoundError("Session", id);
         }
@@ -9933,12 +10121,12 @@ var SessionRepository = class {
         if (shouldRefreshLastUpdated) {
           insertData.updated_at = /* @__PURE__ */ new Date();
         }
-        await update(txAsDb(tx), sessions3).set(insertData).where(eq23(sessions3.session_id, fullId)).run();
+        await update(txAsDb(tx), sessions3).set(insertData).where(eq24(sessions3.session_id, fullId)).run();
         if (!insertData.updated_at) {
           throw new RepositoryError("Session update did not produce an updated_at timestamp");
         }
         merged.last_updated = insertData.updated_at.toISOString();
-        return merged;
+        return attachHiddenTenant(merged, currentRow);
       });
       return result;
     } catch (error) {
@@ -9957,7 +10145,7 @@ var SessionRepository = class {
     const fullId = await this.resolveId(sessionId);
     const result = await select(this.db, {
       count: sql12`count(*)`
-    }).from(messages3).where(eq23(messages3.session_id, fullId)).one();
+    }).from(messages3).where(eq24(messages3.session_id, fullId)).one();
     return Number(result?.count ?? 0);
   }
   /**
@@ -9966,7 +10154,7 @@ var SessionRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, sessions3).where(eq23(sessions3.session_id, fullId)).run();
+      const result = await deleteFrom(this.db, sessions3).where(eq24(sessions3.session_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Session", id);
       }
@@ -10013,8 +10201,8 @@ var SessionRepository = class {
   async findScheduleRun(scheduleId, scheduledRunAt) {
     try {
       const baseUrl = await getBaseUrl();
-      const result = await select(this.db).from(sessions3).leftJoin(branches3, eq23(sessions3.branch_id, branches3.branch_id)).where(
-        and20(eq23(sessions3.schedule_id, scheduleId), eq23(sessions3.scheduled_run_at, scheduledRunAt))
+      const result = await select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).where(
+        and20(eq24(sessions3.schedule_id, scheduleId), eq24(sessions3.scheduled_run_at, scheduledRunAt))
       ).one();
       if (!result) return null;
       const r = result;
@@ -10037,7 +10225,7 @@ var SessionRepository = class {
   async findByScheduleId(scheduleId, opts = {}) {
     try {
       const baseUrl = await getBaseUrl();
-      let query = select(this.db).from(sessions3).leftJoin(branches3, eq23(sessions3.branch_id, branches3.branch_id)).where(eq23(sessions3.schedule_id, scheduleId));
+      let query = select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).where(eq24(sessions3.schedule_id, scheduleId));
       if (opts.orderByScheduledRunAt === "desc") {
         query = query.orderBy(desc5(sessions3.scheduled_run_at));
       } else if (opts.orderByScheduledRunAt === "asc") {
@@ -10064,7 +10252,7 @@ var SessionRepository = class {
    */
   async countByScheduleId(scheduleId) {
     try {
-      const result = await select(this.db, { count: sql12`count(*)` }).from(sessions3).where(eq23(sessions3.schedule_id, scheduleId)).one();
+      const result = await select(this.db, { count: sql12`count(*)` }).from(sessions3).where(eq24(sessions3.schedule_id, scheduleId)).one();
       return Number(result?.count ?? 0);
     } catch (error) {
       throw new RepositoryError(
@@ -10086,7 +10274,7 @@ var SessionRepository = class {
   async existsInBranchWithStatuses(branchId, statuses) {
     if (statuses.length === 0) return false;
     try {
-      const row = await select(this.db, { one: sql12`1` }).from(sessions3).where(and20(eq23(sessions3.branch_id, branchId), inArray8(sessions3.status, [...statuses]))).limit(1).one();
+      const row = await select(this.db, { one: sql12`1` }).from(sessions3).where(and20(eq24(sessions3.branch_id, branchId), inArray8(sessions3.status, [...statuses]))).limit(1).one();
       return row != null;
     } catch (error) {
       throw new RepositoryError(
@@ -10102,7 +10290,7 @@ var SessionRepository = class {
   async existsInScheduleWithStatuses(scheduleId, statuses) {
     if (statuses.length === 0) return false;
     try {
-      const row = await select(this.db, { one: sql12`1` }).from(sessions3).where(and20(eq23(sessions3.schedule_id, scheduleId), inArray8(sessions3.status, [...statuses]))).limit(1).one();
+      const row = await select(this.db, { one: sql12`1` }).from(sessions3).where(and20(eq24(sessions3.schedule_id, scheduleId), inArray8(sessions3.status, [...statuses]))).limit(1).one();
       return row != null;
     } catch (error) {
       throw new RepositoryError(
@@ -10133,10 +10321,10 @@ var SessionRepository = class {
   async findAccessibleSessions(userId, boardId) {
     const baseUrl = await getBaseUrl();
     const accessCondition = visibleBranchAccessCondition(this.db, userId);
-    const whereCondition = boardId ? and20(accessCondition, eq23(branches3.board_id, boardId)) : accessCondition;
-    const results = await select(this.db).from(sessions3).innerJoin(branches3, eq23(sessions3.branch_id, branches3.branch_id)).leftJoin(
+    const whereCondition = boardId ? and20(accessCondition, eq24(branches3.board_id, boardId)) : accessCondition;
+    const results = await select(this.db).from(sessions3).innerJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).leftJoin(
       branchOwners3,
-      and20(eq23(branchOwners3.branch_id, branches3.branch_id), eq23(branchOwners3.user_id, userId))
+      and20(eq24(branchOwners3.branch_id, branches3.branch_id), eq24(branchOwners3.user_id, userId))
     ).where(whereCondition).all();
     const seen = /* @__PURE__ */ new Set();
     const sessionsOut = [];
@@ -10179,7 +10367,7 @@ var SessionRepository = class {
       for (const sessionId of sessionIds) {
         const query = select(this.db, {
           data: messagesTable.data
-        }).from(messagesTable).where(and20(eq23(messagesTable.session_id, sessionId), eq23(messagesTable.role, "assistant")));
+        }).from(messagesTable).where(and20(eq24(messagesTable.session_id, sessionId), eq24(messagesTable.role, "assistant")));
         const lastMessage = await query.orderBy(desc5(messagesTable.index)).limit(1).one();
         if (lastMessage) {
           const messageData = lastMessage.data;
@@ -10214,7 +10402,7 @@ var SessionRepository = class {
    */
   async exists(sessionId) {
     try {
-      const row = await select(this.db).from(sessions3).where(eq23(sessions3.session_id, sessionId)).one();
+      const row = await select(this.db).from(sessions3).where(eq24(sessions3.session_id, sessionId)).one();
       return row != null;
     } catch (error) {
       throw new RepositoryError(
@@ -10230,7 +10418,7 @@ init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and22, eq as eq25, inArray as inArray9, or as or9 } from "drizzle-orm";
+import { and as and22, eq as eq26, inArray as inArray9, or as or9 } from "drizzle-orm";
 
 // src/db/repositories/tasks.ts
 init_esm_shims();
@@ -10238,7 +10426,7 @@ init_types();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and23, eq as eq26, inArray as inArray10, like as like14, sql as sql13 } from "drizzle-orm";
+import { and as and23, eq as eq27, inArray as inArray10, like as like14, sql as sql13 } from "drizzle-orm";
 var TaskRepository = class {
   constructor(db) {
     this.db = db;
@@ -10334,7 +10522,7 @@ var TaskRepository = class {
     try {
       const insertData = this.taskToInsert(data);
       await insert(this.db, tasks3).values(insertData).run();
-      const row = await select(this.db).from(tasks3).where(eq26(tasks3.task_id, insertData.task_id)).one();
+      const row = await select(this.db).from(tasks3).where(eq27(tasks3.task_id, insertData.task_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created task");
       }
@@ -10374,7 +10562,7 @@ var TaskRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(tasks3).where(eq26(tasks3.task_id, fullId)).one();
+      const row = await select(this.db).from(tasks3).where(eq27(tasks3.task_id, fullId)).one();
       return row ? this.rowToTask(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -10392,10 +10580,10 @@ var TaskRepository = class {
     try {
       if (filter?.sessionIds !== void 0 && filter.sessionIds.length === 0) return [];
       const conditions = [];
-      if (filter?.sessionId) conditions.push(eq26(tasks3.session_id, filter.sessionId));
+      if (filter?.sessionId) conditions.push(eq27(tasks3.session_id, filter.sessionId));
       if (filter?.sessionIds !== void 0)
         conditions.push(inArray10(tasks3.session_id, filter.sessionIds));
-      if (filter?.status) conditions.push(eq26(tasks3.status, filter.status));
+      if (filter?.status) conditions.push(eq27(tasks3.status, filter.status));
       if (filter?.visibleToUserId) {
         conditions.push(
           visibleSessionReferenceAccessExists(this.db, filter.visibleToUserId, tasks3.session_id)
@@ -10416,7 +10604,7 @@ var TaskRepository = class {
    */
   async findBySession(sessionId) {
     try {
-      const rows = await select(this.db).from(tasks3).where(eq26(tasks3.session_id, sessionId)).orderBy(tasks3.created_at).all();
+      const rows = await select(this.db).from(tasks3).where(eq27(tasks3.session_id, sessionId)).orderBy(tasks3.created_at).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -10430,7 +10618,7 @@ var TaskRepository = class {
    */
   async findRunning() {
     try {
-      const rows = await select(this.db).from(tasks3).where(eq26(tasks3.status, TaskStatus.RUNNING)).all();
+      const rows = await select(this.db).from(tasks3).where(eq27(tasks3.status, TaskStatus.RUNNING)).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -10486,7 +10674,7 @@ var TaskRepository = class {
    */
   async findByStatus(status) {
     try {
-      const rows = await select(this.db).from(tasks3).where(eq26(tasks3.status, status)).all();
+      const rows = await select(this.db).from(tasks3).where(eq27(tasks3.status, status)).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -10508,8 +10696,8 @@ var TaskRepository = class {
         `\u{1F504} [TaskRepo] Updating task ${shortId(fullId)}${updates.status ? ` (status: ${updates.status})` : ""}`
       );
       const result = await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, tasks3, eq26(tasks3.task_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(tasks3).where(eq26(tasks3.task_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, tasks3, eq27(tasks3.task_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(tasks3).where(eq27(tasks3.task_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Task", id);
         }
@@ -10523,7 +10711,7 @@ var TaskRepository = class {
           last_executor_heartbeat_at: insertData.last_executor_heartbeat_at,
           session_md5: insertData.session_md5,
           data: insertData.data
-        }).where(eq26(tasks3.task_id, fullId)).run();
+        }).where(eq27(tasks3.task_id, fullId)).run();
         return merged;
       });
       return result;
@@ -10542,7 +10730,7 @@ var TaskRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, tasks3).where(eq26(tasks3.task_id, fullId)).run();
+      const result = await deleteFrom(this.db, tasks3).where(eq27(tasks3.task_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Task", id);
       }
@@ -10604,7 +10792,7 @@ var TaskRepository = class {
         queue_position: nextPosition
       });
       await insert(txAsDb(tx), tasks3).values(insertData).run();
-      const row = await select(txAsDb(tx)).from(tasks3).where(eq26(tasks3.task_id, insertData.task_id)).one();
+      const row = await select(txAsDb(tx)).from(tasks3).where(eq27(tasks3.task_id, insertData.task_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created queued task");
       }
@@ -10645,7 +10833,7 @@ var TaskRepository = class {
    */
   async countBySession(sessionId) {
     try {
-      const result = await select(this.db, { count: sql13`count(*)` }).from(tasks3).where(eq26(tasks3.session_id, sessionId)).one();
+      const result = await select(this.db, { count: sql13`count(*)` }).from(tasks3).where(eq27(tasks3.session_id, sessionId)).one();
       return result?.count ?? 0;
     } catch (error) {
       throw new RepositoryError(
@@ -10662,7 +10850,7 @@ init_types();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and24, eq as eq27, like as like15, lt as lt2 } from "drizzle-orm";
+import { and as and24, eq as eq28, like as like15, lt as lt2 } from "drizzle-orm";
 
 // src/db/repositories/user-api-keys.ts
 init_esm_shims();
@@ -10672,48 +10860,18 @@ init_schema();
 init_tenant_context();
 import { randomBytes as randomBytes3 } from "crypto";
 import bcrypt2 from "bcryptjs";
-import { and as and25, eq as eq28 } from "drizzle-orm";
+import { and as and25, eq as eq29 } from "drizzle-orm";
 
 // src/db/repositories/user-mcp-oauth-tokens.ts
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and26, eq as eq29, isNull as isNull7 } from "drizzle-orm";
+import { and as and26, eq as eq30, isNull as isNull7 } from "drizzle-orm";
 
 // src/db/repositories/users.ts
 init_esm_shims();
 init_types();
-import { eq as eq30, like as like16, sql as sql14 } from "drizzle-orm";
-
-// src/config/env-vars.ts
-init_esm_shims();
-var V05_SCOPES = ["global", "session"];
-var V05_SCOPE_SET = new Set(V05_SCOPES);
-function normalizeStoredEnvVar(raw) {
-  if (typeof raw === "string") {
-    return { value_encrypted: raw, scope: "global" };
-  }
-  return {
-    value_encrypted: raw.value_encrypted,
-    scope: raw.scope,
-    resource_id: raw.resource_id ?? null,
-    extra_config: raw.extra_config ?? null
-  };
-}
-function normalizeStoredEnvMap(raw) {
-  const out = {};
-  if (!raw) return out;
-  for (const [key, value] of Object.entries(raw)) {
-    try {
-      out[key] = normalizeStoredEnvVar(value);
-    } catch (err) {
-      console.warn(`[env-vars] Skipping malformed env var entry ${key}:`, err);
-    }
-  }
-  return out;
-}
-
-// src/db/repositories/users.ts
+import { eq as eq31, like as like16, sql as sql14 } from "drizzle-orm";
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -10824,7 +10982,7 @@ var UsersRepository = class {
    * Check if unix_username is already taken by another user
    */
   async isUnixUsernameTaken(unixUsername, excludeUserId) {
-    const result = await select(this.db).from(users3).where(eq30(users3.unix_username, unixUsername)).one();
+    const result = await select(this.db).from(users3).where(eq31(users3.unix_username, unixUsername)).one();
     if (!result) {
       return false;
     }
@@ -10847,7 +11005,7 @@ var UsersRepository = class {
     }
     const insertData = this.userToInsert(data);
     await insert(this.db, users3).values(insertData).run();
-    const row = await select(this.db).from(users3).where(eq30(users3.user_id, insertData.user_id)).one();
+    const row = await select(this.db).from(users3).where(eq31(users3.user_id, insertData.user_id)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve created user");
     }
@@ -10859,7 +11017,7 @@ var UsersRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where(eq30(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where(eq31(users3.user_id, fullId)).one();
       if (!result) {
         return null;
       }
@@ -10875,7 +11033,7 @@ var UsersRepository = class {
    * Find user by email
    */
   async findByEmail(email) {
-    const result = await select(this.db).from(users3).where(eq30(users3.email, email)).one();
+    const result = await select(this.db).from(users3).where(eq31(users3.email, email)).one();
     if (!result) {
       return null;
     }
@@ -10946,8 +11104,8 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       ...insertData,
       updated_at: /* @__PURE__ */ new Date()
-    }).where(eq30(users3.user_id, fullId)).run();
-    const row = await select(this.db).from(users3).where(eq30(users3.user_id, fullId)).one();
+    }).where(eq31(users3.user_id, fullId)).run();
+    const row = await select(this.db).from(users3).where(eq31(users3.user_id, fullId)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve updated user");
     }
@@ -10958,7 +11116,7 @@ var UsersRepository = class {
    */
   async delete(id) {
     const fullId = await this.resolveId(id);
-    await deleteFrom(this.db, users3).where(eq30(users3.user_id, fullId)).run();
+    await deleteFrom(this.db, users3).where(eq31(users3.user_id, fullId)).run();
   }
   /**
    * Get raw database row (internal use only - includes encrypted keys)
@@ -10966,7 +11124,7 @@ var UsersRepository = class {
   async getRawRow(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where(eq30(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where(eq31(users3.user_id, fullId)).one();
       return result;
     } catch (error) {
       if (error instanceof EntityNotFoundError) {
@@ -11048,7 +11206,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where(eq30(users3.user_id, fullId)).run();
+    }).where(eq31(users3.user_id, fullId)).run();
   }
   /**
    * Delete a single credential field for a tool.
@@ -11074,7 +11232,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where(eq30(users3.user_id, fullId)).run();
+    }).where(eq31(users3.user_id, fullId)).run();
   }
 };
 
@@ -11791,23 +11949,9 @@ import fs2 from "fs";
 init_config_manager();
 init_constants();
 
-// src/config/env-blocklist.ts
-init_esm_shims();
-var BLOCKED_ENV_PATTERNS = Object.freeze([
-  /^LD_/i,
-  /^DYLD_/i,
-  /^PYTHON(?!_AGOR_)/i
-]);
-
 // src/config/env-locking.ts
 init_esm_shims();
 
-// src/config/env-resolver.ts
-init_esm_shims();
-init_database_wrapper();
-import { eq as eq31 } from "drizzle-orm";
-init_schema();
-
 // src/config/env-validation.ts
 init_esm_shims();
 var ENV_VAR_CONSTRAINTS = {