agor-live 0.23.1 → 0.23.2

package/dist/core/db/index.cjs

@@ -791,6 +791,21 @@ var init_file = __esm({
 });
 
 // src/types/gateway.ts
+function getRequiredSecretFields(channelType, config) {
+  switch (channelType) {
+    case "slack": {
+      const wantsInbound = config.connection_mode === "socket" || config.enable_channels === true || config.enable_groups === true || config.enable_mpim === true;
+      const outboundOnly = config.outbound_enabled === true && !wantsInbound;
+      return outboundOnly ? ["bot_token"] : ["bot_token", "app_token"];
+    }
+    case "github":
+      return ["private_key"];
+    case "teams":
+      return ["app_password"];
+    default:
+      return [];
+  }
+}
 var GATEWAY_SENSITIVE_CONFIG_FIELDS, GATEWAY_REDACTED_SENTINEL;
 var init_gateway = __esm({
   "src/types/gateway.ts"() {
@@ -4927,11 +4942,11 @@ __export(db_exports, {
   activeGroupGrantAccessExists: () => activeGroupGrantAccessExists,
   advisoryLockKeyForUuid: () => advisoryLockKeyForUuid,
   alignedBoardDefaultVisible: () => alignedBoardDefaultVisible,
-  and: () => import_drizzle_orm36.and,
+  and: () => import_drizzle_orm37.and,
   appVariables: () => appVariables3,
   artifactTrustGrants: () => artifactTrustGrants3,
   artifacts: () => artifacts3,
-  asc: () => import_drizzle_orm36.asc,
+  asc: () => import_drizzle_orm37.asc,
   assertUsableBootstrapAdminPassword: () => assertUsableBootstrapAdminPassword,
   attachHiddenTenant: () => attachHiddenTenant,
   boardComments: () => boardComments3,
@@ -4947,7 +4962,7 @@ __export(db_exports, {
   cards: () => cards3,
   checkMigrationStatus: () => checkMigrationStatus,
   compare: () => compare,
-  count: () => import_drizzle_orm36.count,
+  count: () => import_drizzle_orm37.count,
   createDatabase: () => createDatabase,
   createDatabaseAsync: () => createDatabaseAsync,
   createDefaultAdminUser: () => createDefaultAdminUser,
@@ -4958,10 +4973,10 @@ __export(db_exports, {
   dateTruncUtc: () => dateTruncUtc,
   decryptApiKey: () => decryptApiKey,
   deleteFrom: () => deleteFrom,
-  desc: () => import_drizzle_orm36.desc,
+  desc: () => import_drizzle_orm37.desc,
   encryptApiKey: () => encryptApiKey,
   enqueueTenantDatabasePostCommitCallback: () => enqueueTenantDatabasePostCommitCallback,
-  eq: () => import_drizzle_orm36.eq,
+  eq: () => import_drizzle_orm37.eq,
   executeAll: () => executeAll,
   executeGet: () => executeGet,
   executeRaw: () => executeRaw,
@@ -4982,11 +4997,11 @@ __export(db_exports, {
   getUserByEmail: () => getUserByEmail,
   groupMemberships: () => groupMemberships3,
   groups: () => groups3,
-  gt: () => import_drizzle_orm36.gt,
-  gte: () => import_drizzle_orm36.gte,
+  gt: () => import_drizzle_orm37.gt,
+  gte: () => import_drizzle_orm37.gte,
   hash: () => hash,
   identifyUrlParam: () => identifyUrlParam,
-  inArray: () => import_drizzle_orm36.inArray,
+  inArray: () => import_drizzle_orm37.inArray,
   initializeDatabase: () => initializeDatabase,
   insert: () => insert,
   insertOne: () => insertOne,
@@ -5005,13 +5020,13 @@ __export(db_exports, {
   kbGraphNodes: () => kbGraphNodes3,
   kbNamespaceAcl: () => kbNamespaceAcl3,
   kbNamespaces: () => kbNamespaces3,
-  like: () => import_drizzle_orm36.like,
+  like: () => import_drizzle_orm37.like,
   lockRowForUpdate: () => lockRowForUpdate,
-  lt: () => import_drizzle_orm36.lt,
-  lte: () => import_drizzle_orm36.lte,
+  lt: () => import_drizzle_orm37.lt,
+  lte: () => import_drizzle_orm37.lte,
   mcpServers: () => mcpServers3,
   messages: () => messages3,
-  or: () => import_drizzle_orm36.or,
+  or: () => import_drizzle_orm37.or,
   reattributeLegacyAnonymousRows: () => reattributeLegacyAnonymousRows,
   repos: () => repos3,
   requireCurrentTenantId: () => requireCurrentTenantId,
@@ -5030,7 +5045,7 @@ __export(db_exports, {
   sessionRelationships: () => sessionRelationships3,
   sessions: () => sessions3,
   shortId: () => shortId,
-  sql: () => import_drizzle_orm36.sql,
+  sql: () => import_drizzle_orm37.sql,
   tasks: () => tasks3,
   tenantDatabaseScope: () => tenantDatabaseScope,
   threadSessionMap: () => threadSessionMap3,
@@ -5053,7 +5068,7 @@ __export(db_exports, {
 });
 module.exports = __toCommonJS(db_exports);
 init_cjs_shims();
-var import_drizzle_orm36 = require("drizzle-orm");
+var import_drizzle_orm37 = require("drizzle-orm");
 var import_bcryptjs3 = __toESM(require("bcryptjs"), 1);
 init_ids();
 
@@ -8204,6 +8219,63 @@ var BranchRepository = class {
     }
     return Array.from(userIds);
   }
+  /**
+   * Find non-archived branches whose explicit filesystem access set can change
+   * when membership in the given group changes.
+   *
+   * Keep this inverse lookup in lockstep with findExplicitFsAccessUserIds():
+   * both encode which group grants materialize into branch-folder access.
+   * App-only grants (`fs_access = 'none'`) are intentionally excluded because
+   * membership changes for those grants do not require branch-folder mutation.
+   */
+  async findExplicitFsAccessBranchIdsForGroup(groupId) {
+    const directRows = await select(this.db, { branch_id: branchGroupGrants3.branch_id }).from(branchGroupGrants3).innerJoin(branches3, (0, import_drizzle_orm15.eq)(branches3.branch_id, branchGroupGrants3.branch_id)).innerJoin(
+      groups3,
+      (0, import_drizzle_orm15.and)((0, import_drizzle_orm15.eq)(groups3.group_id, branchGroupGrants3.group_id), (0, import_drizzle_orm15.eq)(groups3.archived, false))
+    ).where(
+      (0, import_drizzle_orm15.and)(
+        (0, import_drizzle_orm15.eq)(branchGroupGrants3.group_id, groupId),
+        (0, import_drizzle_orm15.eq)(branches3.archived, false),
+        (0, import_drizzle_orm15.inArray)(
+          import_drizzle_orm15.sql`coalesce(${branchGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const boardRows = await select(this.db, { branch_id: branches3.branch_id }).from(boardGroupGrants3).innerJoin(
+      groups3,
+      (0, import_drizzle_orm15.and)((0, import_drizzle_orm15.eq)(groups3.group_id, boardGroupGrants3.group_id), (0, import_drizzle_orm15.eq)(groups3.archived, false))
+    ).innerJoin(
+      boards3,
+      (0, import_drizzle_orm15.and)(
+        (0, import_drizzle_orm15.eq)(boards3.board_id, boardGroupGrants3.board_id),
+        (0, import_drizzle_orm15.eq)(import_drizzle_orm15.sql`coalesce(${jsonExtract(this.db, boards3.data, "access_mode")}, 'shared')`, "shared")
+      )
+    ).innerJoin(
+      branches3,
+      (0, import_drizzle_orm15.and)(
+        (0, import_drizzle_orm15.eq)(branches3.board_id, boardGroupGrants3.board_id),
+        (0, import_drizzle_orm15.eq)(branches3.permission_source, "board"),
+        (0, import_drizzle_orm15.eq)(branches3.archived, false)
+      )
+    ).where(
+      (0, import_drizzle_orm15.and)(
+        (0, import_drizzle_orm15.eq)(boardGroupGrants3.group_id, groupId),
+        (0, import_drizzle_orm15.inArray)(
+          import_drizzle_orm15.sql`coalesce(${boardGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const branchIds = /* @__PURE__ */ new Set();
+    for (const row of directRows) {
+      branchIds.add(row.branch_id);
+    }
+    for (const row of boardRows) {
+      branchIds.add(row.branch_id);
+    }
+    return Array.from(branchIds);
+  }
   async findBoardAlignedBranches(boardId) {
     const rows = await select(this.db).from(branches3).where(
       (0, import_drizzle_orm15.and)(
@@ -9211,6 +9283,60 @@ var BoardRepository = class {
       );
     }
   }
+  /**
+   * Shallow-merge field patches into existing board objects in a single
+   * read-modify-write.
+   *
+   * Unlike upsertBoardObject (which fully replaces the object value, dropping
+   * omitted fields), this overwrites ONLY the provided keys and leaves the rest
+   * of each object intact — so a narrow change (e.g. a zIndex reorder) has a
+   * smaller blast radius and won't clobber a field edited via a different patch
+   * call. Multiple objects in one call are merged before a single write, so a
+   * forward/backward swap touches both neighbors in one update.
+   *
+   * Objects that no longer exist are SKIPPED, never re-created — so a swap can't
+   * resurrect a neighbor deleted between the client's read and this write.
+   *
+   * Only an explicit allowlist of fields can be merged (currently just `zIndex`,
+   * which is also clamped into the board-object band [1, 499] so it can never be
+   * pushed onto the card (500) / comment (1000) layers). Any other key in a
+   * patch is ignored, so this narrow action cannot reshape an object (e.g. flip
+   * its `type`) the way a full upsert could.
+   *
+   * NOTE: this is NOT atomic against concurrent writers. Like every other board
+   * writer, the findById → update sequence has a lost-update window: a write
+   * that lands between the read and the update can be overwritten (last-write-
+   * wins). Merging only the patched keys narrows that window's blast radius
+   * versus a full-object upsert, but does not close it.
+   */
+  async mergeBoardObjectFields(boardId, patches) {
+    const Z_MIN = 1;
+    const Z_MAX = 499;
+    try {
+      const fullId = await this.resolveId(boardId);
+      const current = await this.findById(fullId);
+      if (!current) {
+        throw new EntityNotFoundError("Board", boardId);
+      }
+      const updatedObjects = { ...current.objects || {} };
+      for (const [objectId, fields] of Object.entries(patches)) {
+        const existing = updatedObjects[objectId];
+        if (!existing) continue;
+        const { zIndex } = fields;
+        if (typeof zIndex !== "number" || !Number.isFinite(zIndex)) continue;
+        const safeZIndex = Math.min(Z_MAX, Math.max(Z_MIN, zIndex));
+        updatedObjects[objectId] = { ...existing, zIndex: safeZIndex };
+      }
+      return this.update(fullId, { objects: updatedObjects });
+    } catch (error) {
+      if (error instanceof RepositoryError) throw error;
+      if (error instanceof EntityNotFoundError) throw error;
+      throw new RepositoryError(
+        `Failed to merge board object fields: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
   /**
    * DEPRECATED: Delete a zone and handle associated sessions
    * TODO: Reimplement using board-objects table
@@ -9945,6 +10071,28 @@ var GatewayChannelRepository = class {
       agentic_config: encryptedAgenticConfig
     };
   }
+  /**
+   * Enforce the "enabled requires secrets" invariant on every write path.
+   *
+   * An enabled channel can never exist without the secrets its type needs to
+   * function. Runs on the post-merge, decrypted config so a patch that only
+   * flips `enabled: true` on a channel with already-stored tokens passes.
+   * Disabled ("draft") channels are exempt.
+   */
+  assertRequiredSecretsWhenEnabled(channel) {
+    if (channel.enabled === false) return;
+    const channelType = channel.channel_type ?? "slack";
+    const config = channel.config ?? {};
+    const missing = getRequiredSecretFields(channelType, config).filter((field) => {
+      const value = config[field];
+      return typeof value !== "string" || value.trim() === "" || value === GATEWAY_REDACTED_SENTINEL;
+    });
+    if (missing.length > 0) {
+      throw new RepositoryError(
+        `Cannot enable ${channelType} gateway channel: missing required secret(s) ${missing.join(", ")}`
+      );
+    }
+  }
   /**
    * Resolve short ID to full ID
    */
@@ -9976,6 +10124,7 @@ var GatewayChannelRepository = class {
         id: data.id ?? generateId(),
         channel_key: data.channel_key ?? generateId()
       });
+      this.assertRequiredSecretsWhenEnabled(data);
       await insert(this.db, gatewayChannels3).values(insertData).run();
       const row = await select(this.db).from(gatewayChannels3).where((0, import_drizzle_orm19.eq)(gatewayChannels3.id, insertData.id)).one();
       if (!row) {
@@ -10042,6 +10191,7 @@ var GatewayChannelRepository = class {
         }
         merged.config = mergedConfig;
       }
+      this.assertRequiredSecretsWhenEnabled(merged);
       const insertData = this.channelToInsert(merged);
       await update(this.db, gatewayChannels3).set({
         name: insertData.name,
@@ -11550,12 +11700,165 @@ var KnowledgeGraphRepository = class {
 
 // src/db/repositories/mcp-servers.ts
 init_cjs_shims();
-var import_drizzle_orm22 = require("drizzle-orm");
+var import_drizzle_orm24 = require("drizzle-orm");
 init_ids();
 
 // src/tools/mcp/auth-secrets.ts
 init_cjs_shims();
 
+// src/mcp/template-resolver.ts
+init_cjs_shims();
+
+// src/config/env-resolver.ts
+init_cjs_shims();
+var import_drizzle_orm23 = require("drizzle-orm");
+init_database_wrapper();
+
+// src/db/repositories/session-env-selections.ts
+init_cjs_shims();
+var import_drizzle_orm22 = require("drizzle-orm");
+init_database_wrapper();
+init_schema();
+var SessionEnvSelectionRepository = class {
+  constructor(db) {
+    this.db = db;
+  }
+  /** Shared SELECT for a session's rows — single source of truth for reads. */
+  async fetchRows(sessionId) {
+    try {
+      return await select(this.db).from(sessionEnvSelections3).where((0, import_drizzle_orm22.eq)(sessionEnvSelections3.session_id, sessionId)).all();
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to list session env selections: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  /** List selected env var names for a session (not hydrated). */
+  async listNames(sessionId) {
+    const rows = await this.fetchRows(sessionId);
+    return rows.map((r) => r.env_var_name);
+  }
+  /** Return a Set for fast membership checks in the env resolver. */
+  async asSet(sessionId) {
+    const names = await this.listNames(sessionId);
+    return new Set(names);
+  }
+  /** Full rows with timestamps — for the REST API response. */
+  async list(sessionId) {
+    const rows = await this.fetchRows(sessionId);
+    return rows.map((r) => ({
+      session_id: r.session_id,
+      env_var_name: r.env_var_name,
+      created_at: new Date(r.created_at)
+    }));
+  }
+  /** Add a selection. No-op if it already exists. */
+  async add(sessionId, envVarName) {
+    try {
+      const existing = await select(this.db).from(sessionEnvSelections3).where(
+        (0, import_drizzle_orm22.and)(
+          (0, import_drizzle_orm22.eq)(sessionEnvSelections3.session_id, sessionId),
+          (0, import_drizzle_orm22.eq)(sessionEnvSelections3.env_var_name, envVarName)
+        )
+      ).one();
+      if (existing) return;
+      await insert(this.db, sessionEnvSelections3).values({
+        session_id: sessionId,
+        env_var_name: envVarName,
+        created_at: /* @__PURE__ */ new Date()
+      }).run();
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to add session env selection: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  /** Remove a selection. No-op if it doesn't exist. */
+  async remove(sessionId, envVarName) {
+    try {
+      await deleteFrom(this.db, sessionEnvSelections3).where(
+        (0, import_drizzle_orm22.and)(
+          (0, import_drizzle_orm22.eq)(sessionEnvSelections3.session_id, sessionId),
+          (0, import_drizzle_orm22.eq)(sessionEnvSelections3.env_var_name, envVarName)
+        )
+      ).run();
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to remove session env selection: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  /** Bulk replace — deletes all existing rows, inserts the new set. */
+  async setAll(sessionId, envVarNames) {
+    try {
+      await deleteFrom(this.db, sessionEnvSelections3).where((0, import_drizzle_orm22.eq)(sessionEnvSelections3.session_id, sessionId)).run();
+      if (envVarNames.length === 0) return;
+      const now = /* @__PURE__ */ new Date();
+      await insert(this.db, sessionEnvSelections3).values(
+        envVarNames.map((name) => ({
+          session_id: sessionId,
+          env_var_name: name,
+          created_at: now
+        }))
+      ).run();
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to set session env selections: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+};
+
+// src/config/env-resolver.ts
+init_schema();
+
+// src/config/env-blocklist.ts
+init_cjs_shims();
+var BLOCKED_ENV_PATTERNS = Object.freeze([
+  /^LD_/i,
+  /^DYLD_/i,
+  /^PYTHON(?!_AGOR_)/i
+]);
+
+// src/config/env-vars.ts
+init_cjs_shims();
+var V05_SCOPES = ["global", "session"];
+var V05_SCOPE_SET = new Set(V05_SCOPES);
+function normalizeStoredEnvVar(raw) {
+  if (typeof raw === "string") {
+    return { value_encrypted: raw, scope: "global" };
+  }
+  return {
+    value_encrypted: raw.value_encrypted,
+    scope: raw.scope,
+    resource_id: raw.resource_id ?? null,
+    extra_config: raw.extra_config ?? null
+  };
+}
+function normalizeStoredEnvMap(raw) {
+  const out = {};
+  if (!raw) return out;
+  for (const [key, value] of Object.entries(raw)) {
+    try {
+      out[key] = normalizeStoredEnvVar(value);
+    } catch (err) {
+      console.warn(`[env-vars] Skipping malformed env var entry ${key}:`, err);
+    }
+  }
+  return out;
+}
+
+// src/templates/handlebars-helpers.ts
+init_cjs_shims();
+var import_handlebars = __toESM(require("handlebars"), 1);
+
+// src/mcp/template-patterns.ts
+init_cjs_shims();
+
 // src/tools/mcp/http-headers.ts
 init_cjs_shims();
 var MCP_HEADER_REDACTED_SENTINEL = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
@@ -11706,7 +12009,7 @@ var MCPServerRepository = class {
    */
   async resolveId(id) {
     return resolveByShortIdPrefix(id, "MCPServer", async (pattern) => {
-      const rows = await select(this.db).from(mcpServers3).where((0, import_drizzle_orm22.like)(mcpServers3.mcp_server_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      const rows = await select(this.db).from(mcpServers3).where((0, import_drizzle_orm24.like)(mcpServers3.mcp_server_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
       return rows.map((r) => r.mcp_server_id);
     });
   }
@@ -11717,7 +12020,7 @@ var MCPServerRepository = class {
     try {
       const insertData = this.mcpServerToInsert(data);
       await insert(this.db, mcpServers3).values(insertData).run();
-      const row = await select(this.db).from(mcpServers3).where((0, import_drizzle_orm22.eq)(mcpServers3.mcp_server_id, insertData.mcp_server_id)).one();
+      const row = await select(this.db).from(mcpServers3).where((0, import_drizzle_orm24.eq)(mcpServers3.mcp_server_id, insertData.mcp_server_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created MCP server");
       }
@@ -11736,7 +12039,7 @@ var MCPServerRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(mcpServers3).where((0, import_drizzle_orm22.eq)(mcpServers3.mcp_server_id, fullId)).one();
+      const row = await select(this.db).from(mcpServers3).where((0, import_drizzle_orm24.eq)(mcpServers3.mcp_server_id, fullId)).one();
       return row ? this.rowToMCPServer(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -11755,24 +12058,24 @@ var MCPServerRepository = class {
       let query = select(this.db).from(mcpServers3);
       const conditions = [];
       if (filters?.scope) {
-        conditions.push((0, import_drizzle_orm22.eq)(mcpServers3.scope, filters.scope));
+        conditions.push((0, import_drizzle_orm24.eq)(mcpServers3.scope, filters.scope));
       }
       if (filters?.scopeId) {
         if (filters.scope === "global") {
-          conditions.push((0, import_drizzle_orm22.eq)(mcpServers3.owner_user_id, filters.scopeId));
+          conditions.push((0, import_drizzle_orm24.eq)(mcpServers3.owner_user_id, filters.scopeId));
         }
       }
       if (filters?.transport) {
-        conditions.push((0, import_drizzle_orm22.eq)(mcpServers3.transport, filters.transport));
+        conditions.push((0, import_drizzle_orm24.eq)(mcpServers3.transport, filters.transport));
       }
       if (filters?.enabled !== void 0) {
-        conditions.push((0, import_drizzle_orm22.eq)(mcpServers3.enabled, filters.enabled));
+        conditions.push((0, import_drizzle_orm24.eq)(mcpServers3.enabled, filters.enabled));
       }
       if (filters?.source) {
-        conditions.push((0, import_drizzle_orm22.eq)(mcpServers3.source, filters.source));
+        conditions.push((0, import_drizzle_orm24.eq)(mcpServers3.source, filters.source));
       }
       if (conditions.length > 0) {
-        query = query.where((0, import_drizzle_orm22.and)(...conditions));
+        query = query.where((0, import_drizzle_orm24.and)(...conditions));
       }
       const rows = await query.all();
       return rows.map((row) => this.rowToMCPServer(row));
@@ -11819,7 +12122,7 @@ var MCPServerRepository = class {
         transport: insertData.transport,
         updated_at: /* @__PURE__ */ new Date(),
         data: insertData.data
-      }).where((0, import_drizzle_orm22.eq)(mcpServers3.mcp_server_id, fullId)).run();
+      }).where((0, import_drizzle_orm24.eq)(mcpServers3.mcp_server_id, fullId)).run();
       const updated = await this.findById(fullId);
       if (!updated) {
         throw new RepositoryError("Failed to retrieve updated MCP server");
@@ -11840,7 +12143,7 @@ var MCPServerRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, mcpServers3).where((0, import_drizzle_orm22.eq)(mcpServers3.mcp_server_id, fullId)).run();
+      const result = await deleteFrom(this.db, mcpServers3).where((0, import_drizzle_orm24.eq)(mcpServers3.mcp_server_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("MCPServer", id);
       }
@@ -11870,7 +12173,7 @@ var MCPServerRepository = class {
 
 // src/db/repositories/messages.ts
 init_cjs_shims();
-var import_drizzle_orm23 = require("drizzle-orm");
+var import_drizzle_orm25 = require("drizzle-orm");
 init_database_wrapper();
 init_schema();
 var MessagesRepository = class {
@@ -11938,7 +12241,7 @@ var MessagesRepository = class {
    * Get message by ID
    */
   async findById(messageId) {
-    const row = await select(this.db).from(messages3).where((0, import_drizzle_orm23.eq)(messages3.message_id, messageId)).one();
+    const row = await select(this.db).from(messages3).where((0, import_drizzle_orm25.eq)(messages3.message_id, messageId)).one();
     return row ? this.rowToMessage(row) : null;
   }
   /**
@@ -11947,19 +12250,19 @@ var MessagesRepository = class {
   async findAll(filter) {
     if (filter?.sessionIds !== void 0 && filter.sessionIds.length === 0) return [];
     const conditions = [];
-    if (filter?.sessionId) conditions.push((0, import_drizzle_orm23.eq)(messages3.session_id, filter.sessionId));
+    if (filter?.sessionId) conditions.push((0, import_drizzle_orm25.eq)(messages3.session_id, filter.sessionId));
     if (filter?.sessionIds !== void 0)
-      conditions.push((0, import_drizzle_orm23.inArray)(messages3.session_id, filter.sessionIds));
-    if (filter?.taskId) conditions.push((0, import_drizzle_orm23.eq)(messages3.task_id, filter.taskId));
-    if (filter?.type) conditions.push((0, import_drizzle_orm23.eq)(messages3.type, filter.type));
-    if (filter?.role) conditions.push((0, import_drizzle_orm23.eq)(messages3.role, filter.role));
+      conditions.push((0, import_drizzle_orm25.inArray)(messages3.session_id, filter.sessionIds));
+    if (filter?.taskId) conditions.push((0, import_drizzle_orm25.eq)(messages3.task_id, filter.taskId));
+    if (filter?.type) conditions.push((0, import_drizzle_orm25.eq)(messages3.type, filter.type));
+    if (filter?.role) conditions.push((0, import_drizzle_orm25.eq)(messages3.role, filter.role));
     if (filter?.visibleToUserId) {
       conditions.push(
         visibleSessionReferenceAccessExists(this.db, filter.visibleToUserId, messages3.session_id)
       );
     }
     let query = select(this.db).from(messages3);
-    if (conditions.length > 0) query = query.where((0, import_drizzle_orm23.and)(...conditions));
+    if (conditions.length > 0) query = query.where((0, import_drizzle_orm25.and)(...conditions));
     const rows = await query.orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
@@ -11967,21 +12270,21 @@ var MessagesRepository = class {
    * Get all messages for a session (ordered by index)
    */
   async findBySessionId(sessionId) {
-    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm23.eq)(messages3.session_id, sessionId)).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm25.eq)(messages3.session_id, sessionId)).orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
   /**
    * Get all messages for a session filtered by type (ordered by index)
    */
   async findBySessionIdAndType(sessionId, type) {
-    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm23.and)((0, import_drizzle_orm23.eq)(messages3.session_id, sessionId), (0, import_drizzle_orm23.eq)(messages3.type, type))).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm25.and)((0, import_drizzle_orm25.eq)(messages3.session_id, sessionId), (0, import_drizzle_orm25.eq)(messages3.type, type))).orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
   /**
    * Get all messages for a task (ordered by index)
    */
   async findByTaskId(taskId) {
-    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm23.eq)(messages3.task_id, taskId)).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm25.eq)(messages3.task_id, taskId)).orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
   /**
@@ -11989,7 +12292,7 @@ var MessagesRepository = class {
    * Used for task message_range queries
    */
   async findByRange(sessionId, startIndex, endIndex) {
-    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm23.eq)(messages3.session_id, sessionId)).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm25.eq)(messages3.session_id, sessionId)).orderBy(messages3.index).all();
     return rows.filter((r) => r.index >= startIndex && r.index <= endIndex).map((r) => this.rowToMessage(r));
   }
   /**
@@ -12002,33 +12305,33 @@ var MessagesRepository = class {
     }
     const updated = { ...existing, ...updates };
     const row = this.messageToRow(updated);
-    const result = await update(this.db, messages3).set(row).where((0, import_drizzle_orm23.eq)(messages3.message_id, messageId)).returning().one();
+    const result = await update(this.db, messages3).set(row).where((0, import_drizzle_orm25.eq)(messages3.message_id, messageId)).returning().one();
     return this.rowToMessage(result);
   }
   /**
    * Update message task assignment
    */
   async assignToTask(messageId, taskId) {
-    const updated = await update(this.db, messages3).set({ task_id: taskId }).where((0, import_drizzle_orm23.eq)(messages3.message_id, messageId)).returning().one();
+    const updated = await update(this.db, messages3).set({ task_id: taskId }).where((0, import_drizzle_orm25.eq)(messages3.message_id, messageId)).returning().one();
     return this.rowToMessage(updated);
   }
   /**
    * Delete all messages for a session (cascades automatically via FK)
    */
   async deleteBySessionId(sessionId) {
-    await deleteFrom(this.db, messages3).where((0, import_drizzle_orm23.eq)(messages3.session_id, sessionId)).run();
+    await deleteFrom(this.db, messages3).where((0, import_drizzle_orm25.eq)(messages3.session_id, sessionId)).run();
   }
   /**
    * Delete a single message
    */
   async delete(messageId) {
-    await deleteFrom(this.db, messages3).where((0, import_drizzle_orm23.eq)(messages3.message_id, messageId)).run();
+    await deleteFrom(this.db, messages3).where((0, import_drizzle_orm25.eq)(messages3.message_id, messageId)).run();
   }
 };
 
 // src/db/repositories/repos.ts
 init_cjs_shims();
-var import_drizzle_orm24 = require("drizzle-orm");
+var import_drizzle_orm26 = require("drizzle-orm");
 
 // src/config/variant-resolver.ts
 init_cjs_shims();
@@ -12178,7 +12481,7 @@ var RepoRepository = class {
    */
   async resolveId(id) {
     return resolveByShortIdPrefix(id, "Repo", async (pattern) => {
-      const rows = await select(this.db).from(repos3).where((0, import_drizzle_orm24.like)(repos3.repo_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      const rows = await select(this.db).from(repos3).where((0, import_drizzle_orm26.like)(repos3.repo_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
       return rows.map((r) => r.repo_id);
     });
   }
@@ -12189,7 +12492,7 @@ var RepoRepository = class {
     try {
       const insertData = this.repoToInsert(data);
       await insert(this.db, repos3).values(insertData).run();
-      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm24.eq)(repos3.repo_id, insertData.repo_id)).one();
+      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm26.eq)(repos3.repo_id, insertData.repo_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created repo");
       }
@@ -12208,7 +12511,7 @@ var RepoRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm24.eq)(repos3.repo_id, fullId)).one();
+      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm26.eq)(repos3.repo_id, fullId)).one();
       return row ? this.rowToRepo(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -12224,7 +12527,7 @@ var RepoRepository = class {
    */
   async findBySlug(slug) {
     try {
-      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm24.eq)(repos3.slug, slug)).one();
+      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm26.eq)(repos3.slug, slug)).one();
       return row ? this.rowToRepo(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -12292,8 +12595,8 @@ var RepoRepository = class {
       let changed = 0;
       for (const finding of scan.findings) {
         await this.db.transaction(async (tx) => {
-          await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm24.eq)(repos3.repo_id, finding.repo_id));
-          const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm24.eq)(repos3.repo_id, finding.repo_id)).one();
+          await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm26.eq)(repos3.repo_id, finding.repo_id));
+          const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm26.eq)(repos3.repo_id, finding.repo_id)).one();
           if (!currentRow) return;
           const data = currentRow.data;
           if (typeof data.remote_url !== "string" || !httpUrlHasUserinfo(data.remote_url)) {
@@ -12305,7 +12608,7 @@ var RepoRepository = class {
               ...data,
               remote_url: stripHttpUrlUserinfo(data.remote_url)
             }
-          }).where((0, import_drizzle_orm24.eq)(repos3.repo_id, finding.repo_id)).run();
+          }).where((0, import_drizzle_orm26.eq)(repos3.repo_id, finding.repo_id)).run();
           changed += 1;
         });
       }
@@ -12327,8 +12630,8 @@ var RepoRepository = class {
     try {
       const fullId = await this.resolveId(id);
       return await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm24.eq)(repos3.repo_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm24.eq)(repos3.repo_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm26.eq)(repos3.repo_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm26.eq)(repos3.repo_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Repo", id);
         }
@@ -12342,7 +12645,7 @@ var RepoRepository = class {
           repo_type: insertData.repo_type,
           unix_group: merged.unix_group ?? null,
           data: insertData.data
-        }).where((0, import_drizzle_orm24.eq)(repos3.repo_id, fullId)).run();
+        }).where((0, import_drizzle_orm26.eq)(repos3.repo_id, fullId)).run();
         merged.clone_error = insertData.data.clone_error;
         merged.remote_url = insertData.data.remote_url;
         merged.last_updated = newUpdatedAt.toISOString();
@@ -12376,8 +12679,8 @@ var RepoRepository = class {
     try {
       const fullId = await this.resolveId(id);
       return await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm24.eq)(repos3.repo_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm24.eq)(repos3.repo_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm26.eq)(repos3.repo_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm26.eq)(repos3.repo_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Repo", id);
         }
@@ -12391,7 +12694,7 @@ var RepoRepository = class {
           repo_type: insertData.repo_type,
           unix_group: next.unix_group ?? null,
           data: insertData.data
-        }).where((0, import_drizzle_orm24.eq)(repos3.repo_id, fullId)).run();
+        }).where((0, import_drizzle_orm26.eq)(repos3.repo_id, fullId)).run();
         next.environment = insertData.data.environment;
         next.environment_config = insertData.data.environment_config;
         next.remote_url = insertData.data.remote_url;
@@ -12431,7 +12734,7 @@ var RepoRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, repos3).where((0, import_drizzle_orm24.eq)(repos3.repo_id, fullId)).run();
+      const result = await deleteFrom(this.db, repos3).where((0, import_drizzle_orm26.eq)(repos3.repo_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Repo", id);
       }
@@ -12462,7 +12765,7 @@ var RepoRepository = class {
    */
   async count() {
     try {
-      const result = await select(this.db, { count: import_drizzle_orm24.sql`count(*)` }).from(repos3).one();
+      const result = await select(this.db, { count: import_drizzle_orm26.sql`count(*)` }).from(repos3).one();
       return result?.count ?? 0;
     } catch (error) {
       throw new RepositoryError(
@@ -12475,7 +12778,7 @@ var RepoRepository = class {
 
 // src/db/repositories/schedules.ts
 init_cjs_shims();
-var import_drizzle_orm25 = require("drizzle-orm");
+var import_drizzle_orm27 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -12554,7 +12857,7 @@ var ScheduleRepository = class {
    */
   async resolveId(id) {
     return resolveByShortIdPrefix(id, "Schedule", async (pattern) => {
-      const rows = await select(this.db).from(schedules3).where((0, import_drizzle_orm25.like)(schedules3.schedule_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      const rows = await select(this.db).from(schedules3).where((0, import_drizzle_orm27.like)(schedules3.schedule_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
       return rows.map((r) => r.schedule_id);
     });
   }
@@ -12577,7 +12880,7 @@ var ScheduleRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(schedules3).where((0, import_drizzle_orm25.eq)(schedules3.schedule_id, fullId)).one();
+      const row = await select(this.db).from(schedules3).where((0, import_drizzle_orm27.eq)(schedules3.schedule_id, fullId)).one();
       if (!row) return null;
       return this.rowToSchedule(row);
     } catch (error) {
@@ -12594,18 +12897,18 @@ var ScheduleRepository = class {
    */
   async findAll(filter) {
     const conditions = [];
-    if (filter?.branch_id) conditions.push((0, import_drizzle_orm25.eq)(schedules3.branch_id, filter.branch_id));
-    if (filter?.enabled !== void 0) conditions.push((0, import_drizzle_orm25.eq)(schedules3.enabled, filter.enabled));
-    if (filter?.created_by) conditions.push((0, import_drizzle_orm25.eq)(schedules3.created_by, filter.created_by));
+    if (filter?.branch_id) conditions.push((0, import_drizzle_orm27.eq)(schedules3.branch_id, filter.branch_id));
+    if (filter?.enabled !== void 0) conditions.push((0, import_drizzle_orm27.eq)(schedules3.enabled, filter.enabled));
+    if (filter?.created_by) conditions.push((0, import_drizzle_orm27.eq)(schedules3.created_by, filter.created_by));
     const query = select(this.db).from(schedules3);
-    const rows = conditions.length > 0 ? await query.where((0, import_drizzle_orm25.and)(...conditions)).all() : await query.all();
+    const rows = conditions.length > 0 ? await query.where((0, import_drizzle_orm27.and)(...conditions)).all() : await query.all();
     return rows.map((row) => this.rowToSchedule(row));
   }
   /**
    * All schedules on a branch (newest first by created_at).
    */
   async findByBranchId(branchId) {
-    const rows = await select(this.db).from(schedules3).where((0, import_drizzle_orm25.eq)(schedules3.branch_id, branchId)).orderBy((0, import_drizzle_orm25.desc)(schedules3.created_at)).all();
+    const rows = await select(this.db).from(schedules3).where((0, import_drizzle_orm27.eq)(schedules3.branch_id, branchId)).orderBy((0, import_drizzle_orm27.desc)(schedules3.created_at)).all();
     return rows.map((row) => this.rowToSchedule(row));
   }
   /**
@@ -12621,13 +12924,13 @@ var ScheduleRepository = class {
    * Uses the `schedules_enabled_next_run_idx` covering index.
    */
   dueCondition(now) {
-    return (0, import_drizzle_orm25.and)(
-      (0, import_drizzle_orm25.eq)(schedules3.enabled, true),
-      (0, import_drizzle_orm25.or)((0, import_drizzle_orm25.isNull)(schedules3.next_run_at), (0, import_drizzle_orm25.lte)(schedules3.next_run_at, now))
+    return (0, import_drizzle_orm27.and)(
+      (0, import_drizzle_orm27.eq)(schedules3.enabled, true),
+      (0, import_drizzle_orm27.or)((0, import_drizzle_orm27.isNull)(schedules3.next_run_at), (0, import_drizzle_orm27.lte)(schedules3.next_run_at, now))
     );
   }
   async findDue(now = Date.now()) {
-    const rows = await select(this.db).from(schedules3).where(this.dueCondition(now)).orderBy((0, import_drizzle_orm25.asc)(schedules3.next_run_at)).all();
+    const rows = await select(this.db).from(schedules3).where(this.dueCondition(now)).orderBy((0, import_drizzle_orm27.asc)(schedules3.next_run_at)).all();
     return rows.map((row) => this.rowToSchedule(row));
   }
   /**
@@ -12638,7 +12941,7 @@ var ScheduleRepository = class {
   async findDueRefs(now = Date.now()) {
     const tenantColumn = schedules3.tenant_id;
     const columns = isPostgresDatabase(this.db) && tenantColumn ? { schedule_id: schedules3.schedule_id, tenant_id: tenantColumn } : { schedule_id: schedules3.schedule_id };
-    const rows = await select(this.db, columns).from(schedules3).where(this.dueCondition(now)).orderBy((0, import_drizzle_orm25.asc)(schedules3.next_run_at)).all();
+    const rows = await select(this.db, columns).from(schedules3).where(this.dueCondition(now)).orderBy((0, import_drizzle_orm27.asc)(schedules3.next_run_at)).all();
     return rows.map((row) => ({
       schedule_id: row.schedule_id,
       ...typeof row.tenant_id === "string" && row.tenant_id.length > 0 ? { tenant_id: row.tenant_id } : {}
@@ -12656,13 +12959,13 @@ var ScheduleRepository = class {
    */
   async findAccessibleSchedules(userId, filter) {
     const conditions = [visibleBranchAccessCondition(this.db, userId)];
-    if (filter?.branch_id) conditions.push((0, import_drizzle_orm25.eq)(schedules3.branch_id, filter.branch_id));
-    if (filter?.enabled !== void 0) conditions.push((0, import_drizzle_orm25.eq)(schedules3.enabled, filter.enabled));
-    if (filter?.created_by) conditions.push((0, import_drizzle_orm25.eq)(schedules3.created_by, filter.created_by));
-    const results = await select(this.db).from(schedules3).innerJoin(branches3, (0, import_drizzle_orm25.eq)(schedules3.branch_id, branches3.branch_id)).leftJoin(
+    if (filter?.branch_id) conditions.push((0, import_drizzle_orm27.eq)(schedules3.branch_id, filter.branch_id));
+    if (filter?.enabled !== void 0) conditions.push((0, import_drizzle_orm27.eq)(schedules3.enabled, filter.enabled));
+    if (filter?.created_by) conditions.push((0, import_drizzle_orm27.eq)(schedules3.created_by, filter.created_by));
+    const results = await select(this.db).from(schedules3).innerJoin(branches3, (0, import_drizzle_orm27.eq)(schedules3.branch_id, branches3.branch_id)).leftJoin(
       branchOwners3,
-      (0, import_drizzle_orm25.and)((0, import_drizzle_orm25.eq)(branchOwners3.branch_id, branches3.branch_id), (0, import_drizzle_orm25.eq)(branchOwners3.user_id, userId))
-    ).where((0, import_drizzle_orm25.and)(...conditions)).all();
+      (0, import_drizzle_orm27.and)((0, import_drizzle_orm27.eq)(branchOwners3.branch_id, branches3.branch_id), (0, import_drizzle_orm27.eq)(branchOwners3.user_id, userId))
+    ).where((0, import_drizzle_orm27.and)(...conditions)).all();
     const seen = /* @__PURE__ */ new Set();
     const out = [];
     for (const r of results) {
@@ -12683,8 +12986,8 @@ var ScheduleRepository = class {
   async update(id, updates) {
     const fullId = await this.resolveId(id);
     return await this.db.transaction(async (tx) => {
-      await lockRowForUpdate(txAsDb(tx), this.db, schedules3, (0, import_drizzle_orm25.eq)(schedules3.schedule_id, fullId));
-      const currentRow = await select(txAsDb(tx)).from(schedules3).where((0, import_drizzle_orm25.eq)(schedules3.schedule_id, fullId)).one();
+      await lockRowForUpdate(txAsDb(tx), this.db, schedules3, (0, import_drizzle_orm27.eq)(schedules3.schedule_id, fullId));
+      const currentRow = await select(txAsDb(tx)).from(schedules3).where((0, import_drizzle_orm27.eq)(schedules3.schedule_id, fullId)).one();
       if (!currentRow) throw new EntityNotFoundError("Schedule", id);
       const current = this.rowToSchedule(currentRow);
       const merged = deepMerge(current, {
@@ -12698,13 +13001,13 @@ var ScheduleRepository = class {
       });
       const insertData = this.scheduleToInsert(merged);
       insertData.updated_at = /* @__PURE__ */ new Date();
-      const row = await update(txAsDb(tx), schedules3).set(insertData).where((0, import_drizzle_orm25.eq)(schedules3.schedule_id, fullId)).returning().one();
+      const row = await update(txAsDb(tx), schedules3).set(insertData).where((0, import_drizzle_orm27.eq)(schedules3.schedule_id, fullId)).returning().one();
       return this.rowToSchedule(row);
     });
   }
   async delete(id) {
     const fullId = await this.resolveId(id);
-    const result = await deleteFrom(this.db, schedules3).where((0, import_drizzle_orm25.eq)(schedules3.schedule_id, fullId)).run();
+    const result = await deleteFrom(this.db, schedules3).where((0, import_drizzle_orm27.eq)(schedules3.schedule_id, fullId)).run();
     if (result.rowsAffected === 0) throw new EntityNotFoundError("Schedule", id);
   }
   /**
@@ -12712,17 +13015,17 @@ var ScheduleRepository = class {
    */
   async count(filter) {
     const conditions = [];
-    if (filter?.branch_id) conditions.push((0, import_drizzle_orm25.eq)(schedules3.branch_id, filter.branch_id));
-    if (filter?.enabled !== void 0) conditions.push((0, import_drizzle_orm25.eq)(schedules3.enabled, filter.enabled));
-    const query = select(this.db, { count: import_drizzle_orm25.sql`count(*)` }).from(schedules3);
-    const row = conditions.length > 0 ? await query.where((0, import_drizzle_orm25.and)(...conditions)).one() : await query.one();
+    if (filter?.branch_id) conditions.push((0, import_drizzle_orm27.eq)(schedules3.branch_id, filter.branch_id));
+    if (filter?.enabled !== void 0) conditions.push((0, import_drizzle_orm27.eq)(schedules3.enabled, filter.enabled));
+    const query = select(this.db, { count: import_drizzle_orm27.sql`count(*)` }).from(schedules3);
+    const row = conditions.length > 0 ? await query.where((0, import_drizzle_orm27.and)(...conditions)).one() : await query.one();
     return Number(row?.count ?? 0);
   }
 };
 
 // src/db/repositories/serialized-sessions.ts
 init_cjs_shims();
-var import_drizzle_orm26 = require("drizzle-orm");
+var import_drizzle_orm28 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -12749,8 +13052,8 @@ var SerializedSessionRepository = class {
   async findLatestDone(sessionId) {
     try {
       const row = await select(this.db).from(serializedSessions3).where(
-        (0, import_drizzle_orm26.and)((0, import_drizzle_orm26.eq)(serializedSessions3.session_id, sessionId), (0, import_drizzle_orm26.eq)(serializedSessions3.status, "done"))
-      ).orderBy((0, import_drizzle_orm26.desc)(serializedSessions3.turn_index), (0, import_drizzle_orm26.desc)(serializedSessions3.created_at)).limit(1).one();
+        (0, import_drizzle_orm28.and)((0, import_drizzle_orm28.eq)(serializedSessions3.session_id, sessionId), (0, import_drizzle_orm28.eq)(serializedSessions3.status, "done"))
+      ).orderBy((0, import_drizzle_orm28.desc)(serializedSessions3.turn_index), (0, import_drizzle_orm28.desc)(serializedSessions3.created_at)).limit(1).one();
       return row ? rowToSerializedSession(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -12764,7 +13067,7 @@ var SerializedSessionRepository = class {
    */
   async findLatest(sessionId) {
     try {
-      const row = await select(this.db).from(serializedSessions3).where((0, import_drizzle_orm26.eq)(serializedSessions3.session_id, sessionId)).orderBy((0, import_drizzle_orm26.desc)(serializedSessions3.turn_index), (0, import_drizzle_orm26.desc)(serializedSessions3.created_at)).limit(1).one();
+      const row = await select(this.db).from(serializedSessions3).where((0, import_drizzle_orm28.eq)(serializedSessions3.session_id, sessionId)).orderBy((0, import_drizzle_orm28.desc)(serializedSessions3.turn_index), (0, import_drizzle_orm28.desc)(serializedSessions3.created_at)).limit(1).one();
       return row ? rowToSerializedSession(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -12815,7 +13118,7 @@ var SerializedSessionRepository = class {
    */
   async markDone(id, payload) {
     try {
-      await update(this.db, serializedSessions3).set({ status: "done", payload }).where((0, import_drizzle_orm26.eq)(serializedSessions3.id, id)).run();
+      await update(this.db, serializedSessions3).set({ status: "done", payload }).where((0, import_drizzle_orm28.eq)(serializedSessions3.id, id)).run();
     } catch (error) {
       throw new RepositoryError(
         `Failed to mark serialized session as done: ${error instanceof Error ? error.message : String(error)}`,
@@ -12828,7 +13131,7 @@ var SerializedSessionRepository = class {
    */
   async deleteById(id) {
     try {
-      await deleteFrom(this.db, serializedSessions3).where((0, import_drizzle_orm26.eq)(serializedSessions3.id, id)).run();
+      await deleteFrom(this.db, serializedSessions3).where((0, import_drizzle_orm28.eq)(serializedSessions3.id, id)).run();
     } catch (error) {
       throw new RepositoryError(
         `Failed to delete serialized session: ${error instanceof Error ? error.message : String(error)}`,
@@ -12843,9 +13146,9 @@ var SerializedSessionRepository = class {
   async deletePreviousTurns(sessionId, beforeTurnIndex) {
     try {
       await deleteFrom(this.db, serializedSessions3).where(
-        (0, import_drizzle_orm26.and)(
-          (0, import_drizzle_orm26.eq)(serializedSessions3.session_id, sessionId),
-          (0, import_drizzle_orm26.lt)(serializedSessions3.turn_index, beforeTurnIndex)
+        (0, import_drizzle_orm28.and)(
+          (0, import_drizzle_orm28.eq)(serializedSessions3.session_id, sessionId),
+          (0, import_drizzle_orm28.lt)(serializedSessions3.turn_index, beforeTurnIndex)
         )
       ).run();
     } catch (error) {
@@ -12857,115 +13160,16 @@ var SerializedSessionRepository = class {
   }
 };
 
-// src/db/repositories/session-env-selections.ts
-init_cjs_shims();
-var import_drizzle_orm27 = require("drizzle-orm");
-init_database_wrapper();
-init_schema();
-var SessionEnvSelectionRepository = class {
-  constructor(db) {
-    this.db = db;
-  }
-  /** Shared SELECT for a session's rows — single source of truth for reads. */
-  async fetchRows(sessionId) {
-    try {
-      return await select(this.db).from(sessionEnvSelections3).where((0, import_drizzle_orm27.eq)(sessionEnvSelections3.session_id, sessionId)).all();
-    } catch (error) {
-      throw new RepositoryError(
-        `Failed to list session env selections: ${error instanceof Error ? error.message : String(error)}`,
-        error
-      );
-    }
-  }
-  /** List selected env var names for a session (not hydrated). */
-  async listNames(sessionId) {
-    const rows = await this.fetchRows(sessionId);
-    return rows.map((r) => r.env_var_name);
-  }
-  /** Return a Set for fast membership checks in the env resolver. */
-  async asSet(sessionId) {
-    const names = await this.listNames(sessionId);
-    return new Set(names);
-  }
-  /** Full rows with timestamps — for the REST API response. */
-  async list(sessionId) {
-    const rows = await this.fetchRows(sessionId);
-    return rows.map((r) => ({
-      session_id: r.session_id,
-      env_var_name: r.env_var_name,
-      created_at: new Date(r.created_at)
-    }));
-  }
-  /** Add a selection. No-op if it already exists. */
-  async add(sessionId, envVarName) {
-    try {
-      const existing = await select(this.db).from(sessionEnvSelections3).where(
-        (0, import_drizzle_orm27.and)(
-          (0, import_drizzle_orm27.eq)(sessionEnvSelections3.session_id, sessionId),
-          (0, import_drizzle_orm27.eq)(sessionEnvSelections3.env_var_name, envVarName)
-        )
-      ).one();
-      if (existing) return;
-      await insert(this.db, sessionEnvSelections3).values({
-        session_id: sessionId,
-        env_var_name: envVarName,
-        created_at: /* @__PURE__ */ new Date()
-      }).run();
-    } catch (error) {
-      throw new RepositoryError(
-        `Failed to add session env selection: ${error instanceof Error ? error.message : String(error)}`,
-        error
-      );
-    }
-  }
-  /** Remove a selection. No-op if it doesn't exist. */
-  async remove(sessionId, envVarName) {
-    try {
-      await deleteFrom(this.db, sessionEnvSelections3).where(
-        (0, import_drizzle_orm27.and)(
-          (0, import_drizzle_orm27.eq)(sessionEnvSelections3.session_id, sessionId),
-          (0, import_drizzle_orm27.eq)(sessionEnvSelections3.env_var_name, envVarName)
-        )
-      ).run();
-    } catch (error) {
-      throw new RepositoryError(
-        `Failed to remove session env selection: ${error instanceof Error ? error.message : String(error)}`,
-        error
-      );
-    }
-  }
-  /** Bulk replace — deletes all existing rows, inserts the new set. */
-  async setAll(sessionId, envVarNames) {
-    try {
-      await deleteFrom(this.db, sessionEnvSelections3).where((0, import_drizzle_orm27.eq)(sessionEnvSelections3.session_id, sessionId)).run();
-      if (envVarNames.length === 0) return;
-      const now = /* @__PURE__ */ new Date();
-      await insert(this.db, sessionEnvSelections3).values(
-        envVarNames.map((name) => ({
-          session_id: sessionId,
-          env_var_name: name,
-          created_at: now
-        }))
-      ).run();
-    } catch (error) {
-      throw new RepositoryError(
-        `Failed to set session env selections: ${error instanceof Error ? error.message : String(error)}`,
-        error
-      );
-    }
-  }
-};
-
 // src/db/repositories/session-mcp-servers.ts
 init_cjs_shims();
-var import_drizzle_orm29 = require("drizzle-orm");
+var import_drizzle_orm30 = require("drizzle-orm");
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/sessions.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm28 = require("drizzle-orm");
+var import_drizzle_orm29 = require("drizzle-orm");
 init_config_manager();
 init_ids();
 init_database_wrapper();
@@ -12992,40 +13196,43 @@ var SessionRepository = class {
     const sessionId = row.session_id;
     const boardId = branchBoardId ?? null;
     const url = baseUrl && boardId ? getSessionUrl(sessionId, baseUrl) : null;
-    return {
-      session_id: sessionId,
-      status: row.status,
-      agentic_tool: row.agentic_tool,
-      created_at: new Date(row.created_at).toISOString(),
-      last_updated: row.updated_at ? new Date(row.updated_at).toISOString() : new Date(row.created_at).toISOString(),
-      created_by: row.created_by,
-      unix_username: row.unix_username || null,
-      branch_id: row.branch_id,
-      branch_board_id: boardId,
-      url,
-      ...row.data,
-      tasks: row.data.tasks.map((id) => id),
-      genealogy: {
-        parent_session_id: row.parent_session_id,
-        forked_from_session_id: row.forked_from_session_id,
-        fork_point_task_id: genealogyData.fork_point_task_id,
-        fork_point_message_index: genealogyData.fork_point_message_index,
-        spawn_point_task_id: genealogyData.spawn_point_task_id,
-        spawn_point_message_index: genealogyData.spawn_point_message_index,
-        children: genealogyData.children.map((id) => id)
+    return attachHiddenTenant(
+      {
+        session_id: sessionId,
+        status: row.status,
+        agentic_tool: row.agentic_tool,
+        created_at: new Date(row.created_at).toISOString(),
+        last_updated: row.updated_at ? new Date(row.updated_at).toISOString() : new Date(row.created_at).toISOString(),
+        created_by: row.created_by,
+        unix_username: row.unix_username || null,
+        branch_id: row.branch_id,
+        branch_board_id: boardId,
+        url,
+        ...row.data,
+        tasks: row.data.tasks.map((id) => id),
+        genealogy: {
+          parent_session_id: row.parent_session_id,
+          forked_from_session_id: row.forked_from_session_id,
+          fork_point_task_id: genealogyData.fork_point_task_id,
+          fork_point_message_index: genealogyData.fork_point_message_index,
+          spawn_point_task_id: genealogyData.spawn_point_task_id,
+          spawn_point_message_index: genealogyData.spawn_point_message_index,
+          children: genealogyData.children.map((id) => id)
+        },
+        permission_config: row.data.permission_config,
+        scheduled_run_at: row.scheduled_run_at ?? void 0,
+        scheduled_from_branch: row.scheduled_from_branch ?? false,
+        schedule_id: row.schedule_id ?? void 0,
+        ready_for_prompt: row.ready_for_prompt ?? false,
+        archived: Boolean(row.archived),
+        // Convert SQLite integer (0/1) to boolean
+        archived_reason: row.archived_reason ?? void 0,
+        current_context_usage: row.data.current_context_usage,
+        context_window_limit: row.data.context_window_limit,
+        last_context_update_at: row.data.last_context_update_at
       },
-      permission_config: row.data.permission_config,
-      scheduled_run_at: row.scheduled_run_at ?? void 0,
-      scheduled_from_branch: row.scheduled_from_branch ?? false,
-      schedule_id: row.schedule_id ?? void 0,
-      ready_for_prompt: row.ready_for_prompt ?? false,
-      archived: Boolean(row.archived),
-      // Convert SQLite integer (0/1) to boolean
-      archived_reason: row.archived_reason ?? void 0,
-      current_context_usage: row.data.current_context_usage,
-      context_window_limit: row.data.context_window_limit,
-      last_context_update_at: row.data.last_context_update_at
-    };
+      row
+    );
   }
   /**
    * Convert Session to database insert format
@@ -13101,7 +13308,7 @@ var SessionRepository = class {
    */
   async resolveId(id) {
     return resolveByShortIdPrefix(id, "Session", async (pattern) => {
-      const rows = await select(this.db).from(sessions3).where((0, import_drizzle_orm28.like)(sessions3.session_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      const rows = await select(this.db).from(sessions3).where((0, import_drizzle_orm29.like)(sessions3.session_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
       return rows.map((r) => r.session_id);
     });
   }
@@ -13113,7 +13320,7 @@ var SessionRepository = class {
       const insertData = this.sessionToInsert(data);
       await insert(this.db, sessions3).values(insertData).run();
       const baseUrl = await getBaseUrl();
-      const result = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm28.eq)(sessions3.session_id, insertData.session_id)).one();
+      const result = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm29.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm29.eq)(sessions3.session_id, insertData.session_id)).one();
       if (!result) {
         throw new RepositoryError("Failed to retrieve created session");
       }
@@ -13138,7 +13345,7 @@ var SessionRepository = class {
     try {
       const fullId = await this.resolveId(id);
       const baseUrl = await getBaseUrl();
-      const result = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm28.eq)(sessions3.session_id, fullId)).one();
+      const result = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm29.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm29.eq)(sessions3.session_id, fullId)).one();
       if (!result) {
         return null;
       }
@@ -13161,7 +13368,7 @@ var SessionRepository = class {
   async findBranchIdBySessionId(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db, { branch_id: sessions3.branch_id }).from(sessions3).where((0, import_drizzle_orm28.eq)(sessions3.session_id, fullId)).one();
+      const row = await select(this.db, { branch_id: sessions3.branch_id }).from(sessions3).where((0, import_drizzle_orm29.eq)(sessions3.session_id, fullId)).one();
       return row?.branch_id ?? null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -13172,6 +13379,26 @@ var SessionRepository = class {
       );
     }
   }
+  /**
+   * Resolve the owning user id for a session without hydrating the full row.
+   * Used by realtime delivery to offer streaming events to the session
+   * creator's own connections as a fallback, so their open tabs keep updating
+   * even before they subscribe to the per-session stream channel.
+   */
+  async findCreatedByBySessionId(id) {
+    try {
+      const fullId = await this.resolveId(id);
+      const row = await select(this.db, { created_by: sessions3.created_by }).from(sessions3).where((0, import_drizzle_orm29.eq)(sessions3.session_id, fullId)).one();
+      return row?.created_by ?? null;
+    } catch (error) {
+      if (error instanceof EntityNotFoundError) return null;
+      if (error instanceof AmbiguousIdError) throw error;
+      throw new RepositoryError(
+        `Failed to find session owner: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
   /**
    * Find all sessions
    *
@@ -13184,14 +13411,14 @@ var SessionRepository = class {
       if (filter?.visibleToUserId) {
         conditions.push(visibleBranchAccessCondition(this.db, filter.visibleToUserId));
       }
-      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).leftJoin(
+      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm29.eq)(sessions3.branch_id, branches3.branch_id)).leftJoin(
         branchOwners3,
-        (0, import_drizzle_orm28.and)(
-          (0, import_drizzle_orm28.eq)(branchOwners3.branch_id, branches3.branch_id),
-          (0, import_drizzle_orm28.eq)(branchOwners3.user_id, filter.visibleToUserId)
+        (0, import_drizzle_orm29.and)(
+          (0, import_drizzle_orm29.eq)(branchOwners3.branch_id, branches3.branch_id),
+          (0, import_drizzle_orm29.eq)(branchOwners3.user_id, filter.visibleToUserId)
         )
-      ) : select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id));
-      const results = conditions.length > 0 ? await query.where((0, import_drizzle_orm28.and)(...conditions)).all() : await query.all();
+      ) : select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm29.eq)(sessions3.branch_id, branches3.branch_id));
+      const results = conditions.length > 0 ? await query.where((0, import_drizzle_orm29.and)(...conditions)).all() : await query.all();
       return results.map(
         (result) => {
           const sessionRow = result.sessions;
@@ -13214,7 +13441,7 @@ var SessionRepository = class {
   async findByStatus(status) {
     try {
       const baseUrl = await getBaseUrl();
-      const results = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm28.eq)(sessions3.status, status)).all();
+      const results = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm29.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm29.eq)(sessions3.status, status)).all();
       return results.map(
         (result) => {
           const sessionRow = result.sessions;
@@ -13242,18 +13469,18 @@ var SessionRepository = class {
   async findByBoard(boardId, filter) {
     try {
       const baseUrl = await getBaseUrl();
-      const conditions = [(0, import_drizzle_orm28.eq)(branches3.board_id, boardId)];
+      const conditions = [(0, import_drizzle_orm29.eq)(branches3.board_id, boardId)];
       if (filter?.visibleToUserId) {
         conditions.push(visibleBranchAccessCondition(this.db, filter.visibleToUserId));
       }
-      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).innerJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).leftJoin(
+      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).innerJoin(branches3, (0, import_drizzle_orm29.eq)(sessions3.branch_id, branches3.branch_id)).leftJoin(
         branchOwners3,
-        (0, import_drizzle_orm28.and)(
-          (0, import_drizzle_orm28.eq)(branchOwners3.branch_id, branches3.branch_id),
-          (0, import_drizzle_orm28.eq)(branchOwners3.user_id, filter.visibleToUserId)
+        (0, import_drizzle_orm29.and)(
+          (0, import_drizzle_orm29.eq)(branchOwners3.branch_id, branches3.branch_id),
+          (0, import_drizzle_orm29.eq)(branchOwners3.user_id, filter.visibleToUserId)
         )
-      ) : select(this.db).from(sessions3).innerJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id));
-      const results = await query.where((0, import_drizzle_orm28.and)(...conditions)).all();
+      ) : select(this.db).from(sessions3).innerJoin(branches3, (0, import_drizzle_orm29.eq)(sessions3.branch_id, branches3.branch_id));
+      const results = await query.where((0, import_drizzle_orm29.and)(...conditions)).all();
       return results.map(
         (result) => {
           const sessionRow = result.sessions;
@@ -13289,38 +13516,38 @@ var SessionRepository = class {
     try {
       const baseUrl = await getBaseUrl();
       const conditions = [];
-      if (opts.boardId !== void 0) conditions.push((0, import_drizzle_orm28.eq)(branches3.board_id, opts.boardId));
-      if (opts.archived !== void 0) conditions.push((0, import_drizzle_orm28.eq)(sessions3.archived, opts.archived));
+      if (opts.boardId !== void 0) conditions.push((0, import_drizzle_orm29.eq)(branches3.board_id, opts.boardId));
+      if (opts.archived !== void 0) conditions.push((0, import_drizzle_orm29.eq)(sessions3.archived, opts.archived));
       if (opts.visibleToUserId) {
         conditions.push(visibleBranchAccessCondition(this.db, opts.visibleToUserId));
       }
-      const whereClause = conditions.length > 0 ? (0, import_drizzle_orm28.and)(...conditions) : void 0;
-      let countQuery = select(this.db, { count: import_drizzle_orm28.sql`count(*)` }).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id));
+      const whereClause = conditions.length > 0 ? (0, import_drizzle_orm29.and)(...conditions) : void 0;
+      let countQuery = select(this.db, { count: import_drizzle_orm29.sql`count(*)` }).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm29.eq)(sessions3.branch_id, branches3.branch_id));
       if (opts.visibleToUserId) {
         countQuery = countQuery.leftJoin(
           branchOwners3,
-          (0, import_drizzle_orm28.and)(
-            (0, import_drizzle_orm28.eq)(branchOwners3.branch_id, branches3.branch_id),
-            (0, import_drizzle_orm28.eq)(branchOwners3.user_id, opts.visibleToUserId)
+          (0, import_drizzle_orm29.and)(
+            (0, import_drizzle_orm29.eq)(branchOwners3.branch_id, branches3.branch_id),
+            (0, import_drizzle_orm29.eq)(branchOwners3.user_id, opts.visibleToUserId)
           )
         );
       }
       const countRow = await (whereClause ? countQuery.where(whereClause) : countQuery).one();
       const total = Number(countRow?.count ?? 0);
-      let dataQuery = select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id));
+      let dataQuery = select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm29.eq)(sessions3.branch_id, branches3.branch_id));
       if (opts.visibleToUserId) {
         dataQuery = dataQuery.leftJoin(
           branchOwners3,
-          (0, import_drizzle_orm28.and)(
-            (0, import_drizzle_orm28.eq)(branchOwners3.branch_id, branches3.branch_id),
-            (0, import_drizzle_orm28.eq)(branchOwners3.user_id, opts.visibleToUserId)
+          (0, import_drizzle_orm29.and)(
+            (0, import_drizzle_orm29.eq)(branchOwners3.branch_id, branches3.branch_id),
+            (0, import_drizzle_orm29.eq)(branchOwners3.user_id, opts.visibleToUserId)
           )
         );
       }
       if (whereClause) dataQuery = dataQuery.where(whereClause);
       if (opts.sortUpdatedAt !== void 0) {
         dataQuery = dataQuery.orderBy(
-          opts.sortUpdatedAt === -1 ? (0, import_drizzle_orm28.desc)(sessions3.updated_at) : sessions3.updated_at
+          opts.sortUpdatedAt === -1 ? (0, import_drizzle_orm29.desc)(sessions3.updated_at) : sessions3.updated_at
         );
       }
       if (opts.limit !== void 0) dataQuery = dataQuery.limit(opts.limit);
@@ -13350,10 +13577,10 @@ var SessionRepository = class {
       const fullId = await this.resolveId(sessionId);
       const baseUrl = await getBaseUrl();
       const { jsonExtract: jsonExtract2 } = await Promise.resolve().then(() => (init_database_wrapper(), database_wrapper_exports));
-      const results = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).where(
-        (0, import_drizzle_orm28.or)(
-          import_drizzle_orm28.sql`${jsonExtract2(this.db, sessions3.data, "genealogy.parent_session_id")} = ${fullId}`,
-          import_drizzle_orm28.sql`${jsonExtract2(this.db, sessions3.data, "genealogy.forked_from_session_id")} = ${fullId}`
+      const results = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm29.eq)(sessions3.branch_id, branches3.branch_id)).where(
+        (0, import_drizzle_orm29.or)(
+          import_drizzle_orm29.sql`${jsonExtract2(this.db, sessions3.data, "genealogy.parent_session_id")} = ${fullId}`,
+          import_drizzle_orm29.sql`${jsonExtract2(this.db, sessions3.data, "genealogy.forked_from_session_id")} = ${fullId}`
         )
       ).all();
       return results.map(
@@ -13419,8 +13646,8 @@ var SessionRepository = class {
       const statusInfo = updates.status ? ` (status: ${updates.status}, ready_for_prompt: ${updates.ready_for_prompt})` : "";
       console.debug(`\u{1F504} [SessionRepo] Updating session ${shortId(fullId)}${statusInfo}`);
       const result = await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, sessions3, (0, import_drizzle_orm28.eq)(sessions3.session_id, fullId));
-        const currentResult = await select(txAsDb(tx)).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm28.eq)(sessions3.session_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, sessions3, (0, import_drizzle_orm29.eq)(sessions3.session_id, fullId));
+        const currentResult = await select(txAsDb(tx)).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm29.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm29.eq)(sessions3.session_id, fullId)).one();
         if (!currentResult) {
           throw new EntityNotFoundError("Session", id);
         }
@@ -13433,12 +13660,12 @@ var SessionRepository = class {
         if (shouldRefreshLastUpdated) {
           insertData.updated_at = /* @__PURE__ */ new Date();
         }
-        await update(txAsDb(tx), sessions3).set(insertData).where((0, import_drizzle_orm28.eq)(sessions3.session_id, fullId)).run();
+        await update(txAsDb(tx), sessions3).set(insertData).where((0, import_drizzle_orm29.eq)(sessions3.session_id, fullId)).run();
         if (!insertData.updated_at) {
           throw new RepositoryError("Session update did not produce an updated_at timestamp");
         }
         merged.last_updated = insertData.updated_at.toISOString();
-        return merged;
+        return attachHiddenTenant(merged, currentRow);
       });
       return result;
     } catch (error) {
@@ -13456,8 +13683,8 @@ var SessionRepository = class {
   async countMessages(sessionId) {
     const fullId = await this.resolveId(sessionId);
     const result = await select(this.db, {
-      count: import_drizzle_orm28.sql`count(*)`
-    }).from(messages3).where((0, import_drizzle_orm28.eq)(messages3.session_id, fullId)).one();
+      count: import_drizzle_orm29.sql`count(*)`
+    }).from(messages3).where((0, import_drizzle_orm29.eq)(messages3.session_id, fullId)).one();
     return Number(result?.count ?? 0);
   }
   /**
@@ -13466,7 +13693,7 @@ var SessionRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, sessions3).where((0, import_drizzle_orm28.eq)(sessions3.session_id, fullId)).run();
+      const result = await deleteFrom(this.db, sessions3).where((0, import_drizzle_orm29.eq)(sessions3.session_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Session", id);
       }
@@ -13490,7 +13717,7 @@ var SessionRepository = class {
    */
   async count() {
     try {
-      const result = await select(this.db, { count: import_drizzle_orm28.sql`count(*)` }).from(sessions3).one();
+      const result = await select(this.db, { count: import_drizzle_orm29.sql`count(*)` }).from(sessions3).one();
       return result?.count ?? 0;
     } catch (error) {
       throw new RepositoryError(
@@ -13513,8 +13740,8 @@ var SessionRepository = class {
   async findScheduleRun(scheduleId, scheduledRunAt) {
     try {
       const baseUrl = await getBaseUrl();
-      const result = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).where(
-        (0, import_drizzle_orm28.and)((0, import_drizzle_orm28.eq)(sessions3.schedule_id, scheduleId), (0, import_drizzle_orm28.eq)(sessions3.scheduled_run_at, scheduledRunAt))
+      const result = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm29.eq)(sessions3.branch_id, branches3.branch_id)).where(
+        (0, import_drizzle_orm29.and)((0, import_drizzle_orm29.eq)(sessions3.schedule_id, scheduleId), (0, import_drizzle_orm29.eq)(sessions3.scheduled_run_at, scheduledRunAt))
       ).one();
       if (!result) return null;
       const r = result;
@@ -13537,9 +13764,9 @@ var SessionRepository = class {
   async findByScheduleId(scheduleId, opts = {}) {
     try {
       const baseUrl = await getBaseUrl();
-      let query = select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm28.eq)(sessions3.schedule_id, scheduleId));
+      let query = select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm29.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm29.eq)(sessions3.schedule_id, scheduleId));
       if (opts.orderByScheduledRunAt === "desc") {
-        query = query.orderBy((0, import_drizzle_orm28.desc)(sessions3.scheduled_run_at));
+        query = query.orderBy((0, import_drizzle_orm29.desc)(sessions3.scheduled_run_at));
       } else if (opts.orderByScheduledRunAt === "asc") {
         query = query.orderBy(sessions3.scheduled_run_at);
       }
@@ -13564,7 +13791,7 @@ var SessionRepository = class {
    */
   async countByScheduleId(scheduleId) {
     try {
-      const result = await select(this.db, { count: import_drizzle_orm28.sql`count(*)` }).from(sessions3).where((0, import_drizzle_orm28.eq)(sessions3.schedule_id, scheduleId)).one();
+      const result = await select(this.db, { count: import_drizzle_orm29.sql`count(*)` }).from(sessions3).where((0, import_drizzle_orm29.eq)(sessions3.schedule_id, scheduleId)).one();
       return Number(result?.count ?? 0);
     } catch (error) {
       throw new RepositoryError(
@@ -13586,7 +13813,7 @@ var SessionRepository = class {
   async existsInBranchWithStatuses(branchId, statuses) {
     if (statuses.length === 0) return false;
     try {
-      const row = await select(this.db, { one: import_drizzle_orm28.sql`1` }).from(sessions3).where((0, import_drizzle_orm28.and)((0, import_drizzle_orm28.eq)(sessions3.branch_id, branchId), (0, import_drizzle_orm28.inArray)(sessions3.status, [...statuses]))).limit(1).one();
+      const row = await select(this.db, { one: import_drizzle_orm29.sql`1` }).from(sessions3).where((0, import_drizzle_orm29.and)((0, import_drizzle_orm29.eq)(sessions3.branch_id, branchId), (0, import_drizzle_orm29.inArray)(sessions3.status, [...statuses]))).limit(1).one();
       return row != null;
     } catch (error) {
       throw new RepositoryError(
@@ -13602,7 +13829,7 @@ var SessionRepository = class {
   async existsInScheduleWithStatuses(scheduleId, statuses) {
     if (statuses.length === 0) return false;
     try {
-      const row = await select(this.db, { one: import_drizzle_orm28.sql`1` }).from(sessions3).where((0, import_drizzle_orm28.and)((0, import_drizzle_orm28.eq)(sessions3.schedule_id, scheduleId), (0, import_drizzle_orm28.inArray)(sessions3.status, [...statuses]))).limit(1).one();
+      const row = await select(this.db, { one: import_drizzle_orm29.sql`1` }).from(sessions3).where((0, import_drizzle_orm29.and)((0, import_drizzle_orm29.eq)(sessions3.schedule_id, scheduleId), (0, import_drizzle_orm29.inArray)(sessions3.status, [...statuses]))).limit(1).one();
       return row != null;
     } catch (error) {
       throw new RepositoryError(
@@ -13633,10 +13860,10 @@ var SessionRepository = class {
   async findAccessibleSessions(userId, boardId) {
     const baseUrl = await getBaseUrl();
     const accessCondition = visibleBranchAccessCondition(this.db, userId);
-    const whereCondition = boardId ? (0, import_drizzle_orm28.and)(accessCondition, (0, import_drizzle_orm28.eq)(branches3.board_id, boardId)) : accessCondition;
-    const results = await select(this.db).from(sessions3).innerJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).leftJoin(
+    const whereCondition = boardId ? (0, import_drizzle_orm29.and)(accessCondition, (0, import_drizzle_orm29.eq)(branches3.board_id, boardId)) : accessCondition;
+    const results = await select(this.db).from(sessions3).innerJoin(branches3, (0, import_drizzle_orm29.eq)(sessions3.branch_id, branches3.branch_id)).leftJoin(
       branchOwners3,
-      (0, import_drizzle_orm28.and)((0, import_drizzle_orm28.eq)(branchOwners3.branch_id, branches3.branch_id), (0, import_drizzle_orm28.eq)(branchOwners3.user_id, userId))
+      (0, import_drizzle_orm29.and)((0, import_drizzle_orm29.eq)(branchOwners3.branch_id, branches3.branch_id), (0, import_drizzle_orm29.eq)(branchOwners3.user_id, userId))
     ).where(whereCondition).all();
     const seen = /* @__PURE__ */ new Set();
     const sessionsOut = [];
@@ -13679,8 +13906,8 @@ var SessionRepository = class {
       for (const sessionId of sessionIds) {
         const query = select(this.db, {
           data: messagesTable.data
-        }).from(messagesTable).where((0, import_drizzle_orm28.and)((0, import_drizzle_orm28.eq)(messagesTable.session_id, sessionId), (0, import_drizzle_orm28.eq)(messagesTable.role, "assistant")));
-        const lastMessage = await query.orderBy((0, import_drizzle_orm28.desc)(messagesTable.index)).limit(1).one();
+        }).from(messagesTable).where((0, import_drizzle_orm29.and)((0, import_drizzle_orm29.eq)(messagesTable.session_id, sessionId), (0, import_drizzle_orm29.eq)(messagesTable.role, "assistant")));
+        const lastMessage = await query.orderBy((0, import_drizzle_orm29.desc)(messagesTable.index)).limit(1).one();
         if (lastMessage) {
           const messageData = lastMessage.data;
           let fullText = "";
@@ -13714,7 +13941,7 @@ var SessionRepository = class {
    */
   async exists(sessionId) {
     try {
-      const row = await select(this.db).from(sessions3).where((0, import_drizzle_orm28.eq)(sessions3.session_id, sessionId)).one();
+      const row = await select(this.db).from(sessions3).where((0, import_drizzle_orm29.eq)(sessions3.session_id, sessionId)).one();
       return row != null;
     } catch (error) {
       throw new RepositoryError(
@@ -13748,16 +13975,16 @@ var SessionMCPServerRepository = class {
         throw new EntityNotFoundError("MCPServer", serverId);
       }
       const existing = await select(this.db).from(sessionMcpServers3).where(
-        (0, import_drizzle_orm29.and)(
-          (0, import_drizzle_orm29.eq)(sessionMcpServers3.session_id, sessionId),
-          (0, import_drizzle_orm29.eq)(sessionMcpServers3.mcp_server_id, serverId)
+        (0, import_drizzle_orm30.and)(
+          (0, import_drizzle_orm30.eq)(sessionMcpServers3.session_id, sessionId),
+          (0, import_drizzle_orm30.eq)(sessionMcpServers3.mcp_server_id, serverId)
         )
       ).one();
       if (existing) {
         await update(this.db, sessionMcpServers3).set({ enabled: true }).where(
-          (0, import_drizzle_orm29.and)(
-            (0, import_drizzle_orm29.eq)(sessionMcpServers3.session_id, sessionId),
-            (0, import_drizzle_orm29.eq)(sessionMcpServers3.mcp_server_id, serverId)
+          (0, import_drizzle_orm30.and)(
+            (0, import_drizzle_orm30.eq)(sessionMcpServers3.session_id, sessionId),
+            (0, import_drizzle_orm30.eq)(sessionMcpServers3.mcp_server_id, serverId)
           )
         ).run();
         return;
@@ -13783,9 +14010,9 @@ var SessionMCPServerRepository = class {
   async removeServer(sessionId, serverId) {
     try {
       const result = await deleteFrom(this.db, sessionMcpServers3).where(
-        (0, import_drizzle_orm29.and)(
-          (0, import_drizzle_orm29.eq)(sessionMcpServers3.session_id, sessionId),
-          (0, import_drizzle_orm29.eq)(sessionMcpServers3.mcp_server_id, serverId)
+        (0, import_drizzle_orm30.and)(
+          (0, import_drizzle_orm30.eq)(sessionMcpServers3.session_id, sessionId),
+          (0, import_drizzle_orm30.eq)(sessionMcpServers3.mcp_server_id, serverId)
         )
       ).run();
       if (result.rowsAffected === 0) {
@@ -13805,9 +14032,9 @@ var SessionMCPServerRepository = class {
   async toggleServer(sessionId, serverId, enabled) {
     try {
       const result = await update(this.db, sessionMcpServers3).set({ enabled }).where(
-        (0, import_drizzle_orm29.and)(
-          (0, import_drizzle_orm29.eq)(sessionMcpServers3.session_id, sessionId),
-          (0, import_drizzle_orm29.eq)(sessionMcpServers3.mcp_server_id, serverId)
+        (0, import_drizzle_orm30.and)(
+          (0, import_drizzle_orm30.eq)(sessionMcpServers3.session_id, sessionId),
+          (0, import_drizzle_orm30.eq)(sessionMcpServers3.mcp_server_id, serverId)
         )
       ).run();
       if (result.rowsAffected === 0) {
@@ -13826,11 +14053,11 @@ var SessionMCPServerRepository = class {
    */
   async listServers(sessionId, enabledOnly = false) {
     try {
-      const conditions = [(0, import_drizzle_orm29.eq)(sessionMcpServers3.session_id, sessionId)];
+      const conditions = [(0, import_drizzle_orm30.eq)(sessionMcpServers3.session_id, sessionId)];
       if (enabledOnly) {
-        conditions.push((0, import_drizzle_orm29.eq)(sessionMcpServers3.enabled, true));
+        conditions.push((0, import_drizzle_orm30.eq)(sessionMcpServers3.enabled, true));
       }
-      const relationships = await select(this.db).from(sessionMcpServers3).where((0, import_drizzle_orm29.and)(...conditions)).all();
+      const relationships = await select(this.db).from(sessionMcpServers3).where((0, import_drizzle_orm30.and)(...conditions)).all();
       const servers = [];
       for (const rel of relationships) {
         const server = await this.mcpServerRepo.findById(rel.mcp_server_id);
@@ -13852,11 +14079,11 @@ var SessionMCPServerRepository = class {
    */
   async listServersWithMetadata(sessionId, enabledOnly = false) {
     try {
-      const conditions = [(0, import_drizzle_orm29.eq)(sessionMcpServers3.session_id, sessionId)];
+      const conditions = [(0, import_drizzle_orm30.eq)(sessionMcpServers3.session_id, sessionId)];
       if (enabledOnly) {
-        conditions.push((0, import_drizzle_orm29.eq)(sessionMcpServers3.enabled, true));
+        conditions.push((0, import_drizzle_orm30.eq)(sessionMcpServers3.enabled, true));
       }
-      const relationships = await select(this.db).from(sessionMcpServers3).where((0, import_drizzle_orm29.and)(...conditions)).all();
+      const relationships = await select(this.db).from(sessionMcpServers3).where((0, import_drizzle_orm30.and)(...conditions)).all();
       const results = [];
       for (const rel of relationships) {
         const server = await this.mcpServerRepo.findById(rel.mcp_server_id);
@@ -13887,7 +14114,7 @@ var SessionMCPServerRepository = class {
       if (!session) {
         throw new EntityNotFoundError("Session", sessionId);
       }
-      await deleteFrom(this.db, sessionMcpServers3).where((0, import_drizzle_orm29.eq)(sessionMcpServers3.session_id, sessionId)).run();
+      await deleteFrom(this.db, sessionMcpServers3).where((0, import_drizzle_orm30.eq)(sessionMcpServers3.session_id, sessionId)).run();
       if (serverIds.length > 0) {
         const inserts = serverIds.map((serverId) => ({
           session_id: sessionId,
@@ -13911,9 +14138,9 @@ var SessionMCPServerRepository = class {
   async getRelationship(sessionId, serverId) {
     try {
       const row = await select(this.db).from(sessionMcpServers3).where(
-        (0, import_drizzle_orm29.and)(
-          (0, import_drizzle_orm29.eq)(sessionMcpServers3.session_id, sessionId),
-          (0, import_drizzle_orm29.eq)(sessionMcpServers3.mcp_server_id, serverId)
+        (0, import_drizzle_orm30.and)(
+          (0, import_drizzle_orm30.eq)(sessionMcpServers3.session_id, sessionId),
+          (0, import_drizzle_orm30.eq)(sessionMcpServers3.mcp_server_id, serverId)
         )
       ).one();
       if (!row) {
@@ -13950,7 +14177,7 @@ var SessionMCPServerRepository = class {
 
 // src/db/repositories/session-relationships.ts
 init_cjs_shims();
-var import_drizzle_orm30 = require("drizzle-orm");
+var import_drizzle_orm31 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -13998,7 +14225,7 @@ var SessionRelationshipRepository = class {
   }
   async get(relationshipId) {
     try {
-      const row = await select(this.db).from(sessionRelationships3).where((0, import_drizzle_orm30.eq)(sessionRelationships3.relationship_id, relationshipId)).one();
+      const row = await select(this.db).from(sessionRelationships3).where((0, import_drizzle_orm31.eq)(sessionRelationships3.relationship_id, relationshipId)).one();
       if (!row) throw new EntityNotFoundError("SessionRelationship", relationshipId);
       return this.rowToRelationship(row);
     } catch (error) {
@@ -14012,9 +14239,9 @@ var SessionRelationshipRepository = class {
   async findForSession(sessionId) {
     try {
       const rows = await select(this.db).from(sessionRelationships3).where(
-        (0, import_drizzle_orm30.or)(
-          (0, import_drizzle_orm30.eq)(sessionRelationships3.source_session_id, sessionId),
-          (0, import_drizzle_orm30.eq)(sessionRelationships3.target_session_id, sessionId)
+        (0, import_drizzle_orm31.or)(
+          (0, import_drizzle_orm31.eq)(sessionRelationships3.source_session_id, sessionId),
+          (0, import_drizzle_orm31.eq)(sessionRelationships3.target_session_id, sessionId)
         )
       ).all();
       return rows.map((row) => this.rowToRelationship(row));
@@ -14029,9 +14256,9 @@ var SessionRelationshipRepository = class {
     if (sessionIds.length === 0) return [];
     try {
       const rows = await select(this.db).from(sessionRelationships3).where(
-        (0, import_drizzle_orm30.or)(
-          (0, import_drizzle_orm30.inArray)(sessionRelationships3.source_session_id, sessionIds),
-          (0, import_drizzle_orm30.inArray)(sessionRelationships3.target_session_id, sessionIds)
+        (0, import_drizzle_orm31.or)(
+          (0, import_drizzle_orm31.inArray)(sessionRelationships3.source_session_id, sessionIds),
+          (0, import_drizzle_orm31.inArray)(sessionRelationships3.target_session_id, sessionIds)
         )
       ).all();
       return rows.map((row) => this.rowToRelationship(row));
@@ -14045,9 +14272,9 @@ var SessionRelationshipRepository = class {
   async findRemoteChildren(sourceSessionId) {
     try {
       const rows = await select(this.db).from(sessionRelationships3).where(
-        (0, import_drizzle_orm30.and)(
-          (0, import_drizzle_orm30.eq)(sessionRelationships3.source_session_id, sourceSessionId),
-          (0, import_drizzle_orm30.eq)(sessionRelationships3.relationship_type, "remote_create")
+        (0, import_drizzle_orm31.and)(
+          (0, import_drizzle_orm31.eq)(sessionRelationships3.source_session_id, sourceSessionId),
+          (0, import_drizzle_orm31.eq)(sessionRelationships3.relationship_type, "remote_create")
         )
       ).all();
       return rows.map((row) => this.rowToRelationship(row));
@@ -14061,9 +14288,9 @@ var SessionRelationshipRepository = class {
   async findRemoteParents(targetSessionId) {
     try {
       const rows = await select(this.db).from(sessionRelationships3).where(
-        (0, import_drizzle_orm30.and)(
-          (0, import_drizzle_orm30.eq)(sessionRelationships3.target_session_id, targetSessionId),
-          (0, import_drizzle_orm30.eq)(sessionRelationships3.relationship_type, "remote_create")
+        (0, import_drizzle_orm31.and)(
+          (0, import_drizzle_orm31.eq)(sessionRelationships3.target_session_id, targetSessionId),
+          (0, import_drizzle_orm31.eq)(sessionRelationships3.relationship_type, "remote_create")
         )
       ).all();
       return rows.map((row) => this.rowToRelationship(row));
@@ -14076,11 +14303,11 @@ var SessionRelationshipRepository = class {
   }
   async setCallbackEnabled(relationshipId, callbackEnabled) {
     try {
-      const result = await update(this.db, sessionRelationships3).set({ callback_enabled: callbackEnabled, updated_at: /* @__PURE__ */ new Date() }).where((0, import_drizzle_orm30.eq)(sessionRelationships3.relationship_id, relationshipId)).run();
+      const result = await update(this.db, sessionRelationships3).set({ callback_enabled: callbackEnabled, updated_at: /* @__PURE__ */ new Date() }).where((0, import_drizzle_orm31.eq)(sessionRelationships3.relationship_id, relationshipId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("SessionRelationship", relationshipId);
       }
-      const row = await select(this.db).from(sessionRelationships3).where((0, import_drizzle_orm30.eq)(sessionRelationships3.relationship_id, relationshipId)).one();
+      const row = await select(this.db).from(sessionRelationships3).where((0, import_drizzle_orm31.eq)(sessionRelationships3.relationship_id, relationshipId)).one();
       if (!row) throw new EntityNotFoundError("SessionRelationship", relationshipId);
       return this.rowToRelationship(row);
     } catch (error) {
@@ -14094,9 +14321,9 @@ var SessionRelationshipRepository = class {
   async setCallbackEnabledForTargetSession(targetSessionId, callbackEnabled) {
     try {
       await update(this.db, sessionRelationships3).set({ callback_enabled: callbackEnabled, updated_at: /* @__PURE__ */ new Date() }).where(
-        (0, import_drizzle_orm30.and)(
-          (0, import_drizzle_orm30.eq)(sessionRelationships3.target_session_id, targetSessionId),
-          (0, import_drizzle_orm30.eq)(sessionRelationships3.relationship_type, "remote_create")
+        (0, import_drizzle_orm31.and)(
+          (0, import_drizzle_orm31.eq)(sessionRelationships3.target_session_id, targetSessionId),
+          (0, import_drizzle_orm31.eq)(sessionRelationships3.relationship_type, "remote_create")
         )
       ).run();
     } catch (error) {
@@ -14111,7 +14338,7 @@ var SessionRelationshipRepository = class {
 // src/db/repositories/tasks.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm31 = require("drizzle-orm");
+var import_drizzle_orm32 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -14199,7 +14426,7 @@ var TaskRepository = class {
    */
   async resolveId(id) {
     return resolveByShortIdPrefix(id, "Task", async (pattern) => {
-      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm31.like)(tasks3.task_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm32.like)(tasks3.task_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
       return rows.map((r) => r.task_id);
     });
   }
@@ -14210,7 +14437,7 @@ var TaskRepository = class {
     try {
       const insertData = this.taskToInsert(data);
       await insert(this.db, tasks3).values(insertData).run();
-      const row = await select(this.db).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.task_id, insertData.task_id)).one();
+      const row = await select(this.db).from(tasks3).where((0, import_drizzle_orm32.eq)(tasks3.task_id, insertData.task_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created task");
       }
@@ -14234,7 +14461,7 @@ var TaskRepository = class {
       const inserts = taskList.map((task) => this.taskToInsert(task));
       await insert(this.db, tasks3).values(inserts).run();
       const taskIds = inserts.map((t3) => t3.task_id);
-      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm31.inArray)(tasks3.task_id, taskIds)).all();
+      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm32.inArray)(tasks3.task_id, taskIds)).all();
       const rowsById = new Map(rows.map((r) => [r.task_id, r]));
       return taskIds.map((id) => this.rowToTask(rowsById.get(id)));
     } catch (error) {
@@ -14250,7 +14477,7 @@ var TaskRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.task_id, fullId)).one();
+      const row = await select(this.db).from(tasks3).where((0, import_drizzle_orm32.eq)(tasks3.task_id, fullId)).one();
       return row ? this.rowToTask(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -14268,17 +14495,17 @@ var TaskRepository = class {
     try {
       if (filter?.sessionIds !== void 0 && filter.sessionIds.length === 0) return [];
       const conditions = [];
-      if (filter?.sessionId) conditions.push((0, import_drizzle_orm31.eq)(tasks3.session_id, filter.sessionId));
+      if (filter?.sessionId) conditions.push((0, import_drizzle_orm32.eq)(tasks3.session_id, filter.sessionId));
       if (filter?.sessionIds !== void 0)
-        conditions.push((0, import_drizzle_orm31.inArray)(tasks3.session_id, filter.sessionIds));
-      if (filter?.status) conditions.push((0, import_drizzle_orm31.eq)(tasks3.status, filter.status));
+        conditions.push((0, import_drizzle_orm32.inArray)(tasks3.session_id, filter.sessionIds));
+      if (filter?.status) conditions.push((0, import_drizzle_orm32.eq)(tasks3.status, filter.status));
       if (filter?.visibleToUserId) {
         conditions.push(
           visibleSessionReferenceAccessExists(this.db, filter.visibleToUserId, tasks3.session_id)
         );
       }
       const query = select(this.db).from(tasks3);
-      const rows = conditions.length > 0 ? await query.where((0, import_drizzle_orm31.and)(...conditions)).all() : await query.all();
+      const rows = conditions.length > 0 ? await query.where((0, import_drizzle_orm32.and)(...conditions)).all() : await query.all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14292,7 +14519,7 @@ var TaskRepository = class {
    */
   async findBySession(sessionId) {
     try {
-      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.session_id, sessionId)).orderBy(tasks3.created_at).all();
+      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm32.eq)(tasks3.session_id, sessionId)).orderBy(tasks3.created_at).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14306,7 +14533,7 @@ var TaskRepository = class {
    */
   async findRunning() {
     try {
-      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.status, TaskStatus.RUNNING)).all();
+      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm32.eq)(tasks3.status, TaskStatus.RUNNING)).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14327,7 +14554,7 @@ var TaskRepository = class {
   async findOrphaned() {
     try {
       const rows = await select(this.db).from(tasks3).where(
-        import_drizzle_orm31.sql`${tasks3.status} IN ('running', 'stopping', 'awaiting_permission', 'awaiting_input')`
+        import_drizzle_orm32.sql`${tasks3.status} IN ('running', 'stopping', 'awaiting_permission', 'awaiting_input')`
       ).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
@@ -14347,7 +14574,7 @@ var TaskRepository = class {
   async findActiveWithExecutorHeartbeat() {
     try {
       const rows = await select(this.db).from(tasks3).where(
-        import_drizzle_orm31.sql`${tasks3.status} IN ('running', 'stopping', 'awaiting_permission', 'awaiting_input') AND ${tasks3.last_executor_heartbeat_at} IS NOT NULL`
+        import_drizzle_orm32.sql`${tasks3.status} IN ('running', 'stopping', 'awaiting_permission', 'awaiting_input') AND ${tasks3.last_executor_heartbeat_at} IS NOT NULL`
       ).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
@@ -14362,7 +14589,7 @@ var TaskRepository = class {
    */
   async findByStatus(status) {
     try {
-      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.status, status)).all();
+      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm32.eq)(tasks3.status, status)).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14384,8 +14611,8 @@ var TaskRepository = class {
         `\u{1F504} [TaskRepo] Updating task ${shortId(fullId)}${updates.status ? ` (status: ${updates.status})` : ""}`
       );
       const result = await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, tasks3, (0, import_drizzle_orm31.eq)(tasks3.task_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.task_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, tasks3, (0, import_drizzle_orm32.eq)(tasks3.task_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(tasks3).where((0, import_drizzle_orm32.eq)(tasks3.task_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Task", id);
         }
@@ -14399,7 +14626,7 @@ var TaskRepository = class {
           last_executor_heartbeat_at: insertData.last_executor_heartbeat_at,
           session_md5: insertData.session_md5,
           data: insertData.data
-        }).where((0, import_drizzle_orm31.eq)(tasks3.task_id, fullId)).run();
+        }).where((0, import_drizzle_orm32.eq)(tasks3.task_id, fullId)).run();
         return merged;
       });
       return result;
@@ -14418,7 +14645,7 @@ var TaskRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, tasks3).where((0, import_drizzle_orm31.eq)(tasks3.task_id, fullId)).run();
+      const result = await deleteFrom(this.db, tasks3).where((0, import_drizzle_orm32.eq)(tasks3.task_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Task", id);
       }
@@ -14472,15 +14699,15 @@ var TaskRepository = class {
     }
     return this.db.transaction(async (tx) => {
       const positionRow = await select(txAsDb(tx), {
-        maxPos: import_drizzle_orm31.sql`max(${tasks3.queue_position})`
-      }).from(tasks3).where(import_drizzle_orm31.sql`${tasks3.session_id} = ${input.session_id} AND ${tasks3.status} = 'queued'`).one();
+        maxPos: import_drizzle_orm32.sql`max(${tasks3.queue_position})`
+      }).from(tasks3).where(import_drizzle_orm32.sql`${tasks3.session_id} = ${input.session_id} AND ${tasks3.status} = 'queued'`).one();
       const nextPosition = (positionRow?.maxPos ?? 0) + 1;
       const insertData = this.taskToInsert({
         ...taskBase,
         queue_position: nextPosition
       });
       await insert(txAsDb(tx), tasks3).values(insertData).run();
-      const row = await select(txAsDb(tx)).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.task_id, insertData.task_id)).one();
+      const row = await select(txAsDb(tx)).from(tasks3).where((0, import_drizzle_orm32.eq)(tasks3.task_id, insertData.task_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created queued task");
       }
@@ -14492,7 +14719,7 @@ var TaskRepository = class {
    */
   async findQueued(sessionId) {
     try {
-      const rows = await select(this.db).from(tasks3).where(import_drizzle_orm31.sql`${tasks3.session_id} = ${sessionId} AND ${tasks3.status} = 'queued'`).orderBy(tasks3.queue_position).all();
+      const rows = await select(this.db).from(tasks3).where(import_drizzle_orm32.sql`${tasks3.session_id} = ${sessionId} AND ${tasks3.status} = 'queued'`).orderBy(tasks3.queue_position).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14507,7 +14734,7 @@ var TaskRepository = class {
    */
   async getNextQueued(sessionId) {
     try {
-      const row = await select(this.db).from(tasks3).where(import_drizzle_orm31.sql`${tasks3.session_id} = ${sessionId} AND ${tasks3.status} = 'queued'`).orderBy(tasks3.queue_position).limit(1).one();
+      const row = await select(this.db).from(tasks3).where(import_drizzle_orm32.sql`${tasks3.session_id} = ${sessionId} AND ${tasks3.status} = 'queued'`).orderBy(tasks3.queue_position).limit(1).one();
       return row ? this.rowToTask(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -14521,7 +14748,7 @@ var TaskRepository = class {
    */
   async countBySession(sessionId) {
     try {
-      const result = await select(this.db, { count: import_drizzle_orm31.sql`count(*)` }).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.session_id, sessionId)).one();
+      const result = await select(this.db, { count: import_drizzle_orm32.sql`count(*)` }).from(tasks3).where((0, import_drizzle_orm32.eq)(tasks3.session_id, sessionId)).one();
       return result?.count ?? 0;
     } catch (error) {
       throw new RepositoryError(
@@ -14535,7 +14762,7 @@ var TaskRepository = class {
 // src/db/repositories/thread-session-map.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm32 = require("drizzle-orm");
+var import_drizzle_orm33 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -14585,7 +14812,7 @@ var ThreadSessionMapRepository = class {
       return id;
     }
     const pattern = prefixToLikePattern(id);
-    const results = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm32.like)(threadSessionMap3.id, pattern)).all();
+    const results = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm33.like)(threadSessionMap3.id, pattern)).all();
     if (results.length === 0) {
       throw new EntityNotFoundError("ThreadSessionMap", id);
     }
@@ -14608,7 +14835,7 @@ var ThreadSessionMapRepository = class {
         id: data.id ?? generateId()
       });
       await insert(this.db, threadSessionMap3).values(insertData).run();
-      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm32.eq)(threadSessionMap3.id, insertData.id)).one();
+      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm33.eq)(threadSessionMap3.id, insertData.id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created thread-session mapping");
       }
@@ -14627,7 +14854,7 @@ var ThreadSessionMapRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm32.eq)(threadSessionMap3.id, fullId)).one();
+      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm33.eq)(threadSessionMap3.id, fullId)).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -14668,7 +14895,7 @@ var ThreadSessionMapRepository = class {
         status: insertData.status,
         last_message_at: insertData.last_message_at,
         metadata: insertData.metadata
-      }).where((0, import_drizzle_orm32.eq)(threadSessionMap3.id, fullId)).run();
+      }).where((0, import_drizzle_orm33.eq)(threadSessionMap3.id, fullId)).run();
       const updated = await this.findById(fullId);
       if (!updated) {
         throw new RepositoryError("Failed to retrieve updated thread-session mapping");
@@ -14689,7 +14916,7 @@ var ThreadSessionMapRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, threadSessionMap3).where((0, import_drizzle_orm32.eq)(threadSessionMap3.id, fullId)).run();
+      const result = await deleteFrom(this.db, threadSessionMap3).where((0, import_drizzle_orm33.eq)(threadSessionMap3.id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("ThreadSessionMap", id);
       }
@@ -14707,7 +14934,7 @@ var ThreadSessionMapRepository = class {
   async findByChannelAndThread(channelId, threadId) {
     try {
       const row = await select(this.db).from(threadSessionMap3).where(
-        (0, import_drizzle_orm32.and)((0, import_drizzle_orm32.eq)(threadSessionMap3.channel_id, channelId), (0, import_drizzle_orm32.eq)(threadSessionMap3.thread_id, threadId))
+        (0, import_drizzle_orm33.and)((0, import_drizzle_orm33.eq)(threadSessionMap3.channel_id, channelId), (0, import_drizzle_orm33.eq)(threadSessionMap3.thread_id, threadId))
       ).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
@@ -14724,7 +14951,7 @@ var ThreadSessionMapRepository = class {
    */
   async findByThread(threadId) {
     try {
-      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm32.eq)(threadSessionMap3.thread_id, threadId)).one();
+      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm33.eq)(threadSessionMap3.thread_id, threadId)).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -14738,7 +14965,7 @@ var ThreadSessionMapRepository = class {
    */
   async findBySession(sessionId) {
     try {
-      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm32.eq)(threadSessionMap3.session_id, sessionId)).one();
+      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm33.eq)(threadSessionMap3.session_id, sessionId)).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -14752,11 +14979,11 @@ var ThreadSessionMapRepository = class {
    */
   async findByChannel(channelId, status) {
     try {
-      const conditions = [(0, import_drizzle_orm32.eq)(threadSessionMap3.channel_id, channelId)];
+      const conditions = [(0, import_drizzle_orm33.eq)(threadSessionMap3.channel_id, channelId)];
       if (status) {
-        conditions.push((0, import_drizzle_orm32.eq)(threadSessionMap3.status, status));
+        conditions.push((0, import_drizzle_orm33.eq)(threadSessionMap3.status, status));
       }
-      const rows = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm32.and)(...conditions)).all();
+      const rows = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm33.and)(...conditions)).all();
       return rows.map((row) => this.rowToMapping(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14772,7 +14999,7 @@ var ThreadSessionMapRepository = class {
     try {
       await update(this.db, threadSessionMap3).set({
         last_message_at: /* @__PURE__ */ new Date()
-      }).where((0, import_drizzle_orm32.eq)(threadSessionMap3.id, id)).run();
+      }).where((0, import_drizzle_orm33.eq)(threadSessionMap3.id, id)).run();
     } catch (error) {
       throw new RepositoryError(
         `Failed to update last message timestamp: ${error instanceof Error ? error.message : String(error)}`,
@@ -14785,7 +15012,7 @@ var ThreadSessionMapRepository = class {
    */
   async updateMetadata(id, metadata) {
     try {
-      await update(this.db, threadSessionMap3).set({ metadata }).where((0, import_drizzle_orm32.eq)(threadSessionMap3.id, id)).run();
+      await update(this.db, threadSessionMap3).set({ metadata }).where((0, import_drizzle_orm33.eq)(threadSessionMap3.id, id)).run();
     } catch (error) {
       throw new RepositoryError(
         `Failed to update metadata: ${error instanceof Error ? error.message : String(error)}`,
@@ -14800,7 +15027,7 @@ var ThreadSessionMapRepository = class {
     try {
       const cutoff = new Date(Date.now() - daysInactive * 24 * 60 * 60 * 1e3);
       const rows = await select(this.db).from(threadSessionMap3).where(
-        (0, import_drizzle_orm32.and)((0, import_drizzle_orm32.eq)(threadSessionMap3.status, "active"), (0, import_drizzle_orm32.lt)(threadSessionMap3.last_message_at, cutoff))
+        (0, import_drizzle_orm33.and)((0, import_drizzle_orm33.eq)(threadSessionMap3.status, "active"), (0, import_drizzle_orm33.lt)(threadSessionMap3.last_message_at, cutoff))
       ).all();
       return rows.map((row) => this.rowToMapping(row));
     } catch (error) {
@@ -14815,7 +15042,7 @@ var ThreadSessionMapRepository = class {
    */
   async findByBranch(branchId) {
     try {
-      const rows = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm32.eq)(threadSessionMap3.branch_id, branchId)).all();
+      const rows = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm33.eq)(threadSessionMap3.branch_id, branchId)).all();
       return rows.map((row) => this.rowToMapping(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14830,7 +15057,7 @@ var ThreadSessionMapRepository = class {
 init_cjs_shims();
 var import_node_crypto5 = require("crypto");
 var import_bcryptjs2 = __toESM(require("bcryptjs"), 1);
-var import_drizzle_orm33 = require("drizzle-orm");
+var import_drizzle_orm34 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -14871,7 +15098,7 @@ var UserApiKeysRepository = class {
   }
   /** List all API keys for a user (never returns hashes) */
   async listByUser(userId) {
-    const rows = await select(this.db).from(userApiKeys3).where((0, import_drizzle_orm33.eq)(userApiKeys3.user_id, userId)).all();
+    const rows = await select(this.db).from(userApiKeys3).where((0, import_drizzle_orm34.eq)(userApiKeys3.user_id, userId)).all();
     return rows.map((r) => ({
       id: r.id,
       name: r.name,
@@ -14882,7 +15109,7 @@ var UserApiKeysRepository = class {
   }
   /** Find a key by prefix (for auth lookup). Returns rows with hash for verification. */
   async findByPrefix(prefix) {
-    return select(this.db).from(userApiKeys3).where((0, import_drizzle_orm33.eq)(userApiKeys3.prefix, prefix)).all();
+    return select(this.db).from(userApiKeys3).where((0, import_drizzle_orm34.eq)(userApiKeys3.prefix, prefix)).all();
   }
   /** Verify a raw API key against stored hashes. Returns the matching row or null. */
   async verifyKey(rawKey) {
@@ -14911,25 +15138,25 @@ var UserApiKeysRepository = class {
     await this.updateLastUsedNow(id);
   }
   async updateLastUsedNow(id) {
-    await update(this.db, userApiKeys3).set({ last_used_at: /* @__PURE__ */ new Date() }).where((0, import_drizzle_orm33.eq)(userApiKeys3.id, id)).run();
+    await update(this.db, userApiKeys3).set({ last_used_at: /* @__PURE__ */ new Date() }).where((0, import_drizzle_orm34.eq)(userApiKeys3.id, id)).run();
   }
   /** Update key name */
   async updateName(id, userId, name) {
-    await update(this.db, userApiKeys3).set({ name }).where((0, import_drizzle_orm33.and)((0, import_drizzle_orm33.eq)(userApiKeys3.id, id), (0, import_drizzle_orm33.eq)(userApiKeys3.user_id, userId))).run();
+    await update(this.db, userApiKeys3).set({ name }).where((0, import_drizzle_orm34.and)((0, import_drizzle_orm34.eq)(userApiKeys3.id, id), (0, import_drizzle_orm34.eq)(userApiKeys3.user_id, userId))).run();
   }
   /** Delete a key */
   async delete(id, userId) {
-    await deleteFrom(this.db, userApiKeys3).where((0, import_drizzle_orm33.and)((0, import_drizzle_orm33.eq)(userApiKeys3.id, id), (0, import_drizzle_orm33.eq)(userApiKeys3.user_id, userId))).run();
+    await deleteFrom(this.db, userApiKeys3).where((0, import_drizzle_orm34.and)((0, import_drizzle_orm34.eq)(userApiKeys3.id, id), (0, import_drizzle_orm34.eq)(userApiKeys3.user_id, userId))).run();
   }
   /** Delete all keys for a user */
   async deleteAllForUser(userId) {
-    await deleteFrom(this.db, userApiKeys3).where((0, import_drizzle_orm33.eq)(userApiKeys3.user_id, userId)).run();
+    await deleteFrom(this.db, userApiKeys3).where((0, import_drizzle_orm34.eq)(userApiKeys3.user_id, userId)).run();
   }
 };
 
 // src/db/repositories/user-mcp-oauth-tokens.ts
 init_cjs_shims();
-var import_drizzle_orm34 = require("drizzle-orm");
+var import_drizzle_orm35 = require("drizzle-orm");
 init_database_wrapper();
 init_schema();
 function rowToToken(row) {
@@ -14946,9 +15173,9 @@ function rowToToken(row) {
   };
 }
 function matchKey(userId, serverId) {
-  return (0, import_drizzle_orm34.and)(
-    userId === null ? (0, import_drizzle_orm34.isNull)(userMcpOauthTokens3.user_id) : (0, import_drizzle_orm34.eq)(userMcpOauthTokens3.user_id, userId),
-    (0, import_drizzle_orm34.eq)(userMcpOauthTokens3.mcp_server_id, serverId)
+  return (0, import_drizzle_orm35.and)(
+    userId === null ? (0, import_drizzle_orm35.isNull)(userMcpOauthTokens3.user_id) : (0, import_drizzle_orm35.eq)(userMcpOauthTokens3.user_id, userId),
+    (0, import_drizzle_orm35.eq)(userMcpOauthTokens3.mcp_server_id, serverId)
   );
 }
 var UserMCPOAuthTokenRepository = class {
@@ -15065,7 +15292,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async deleteAllForUser(userId) {
     try {
-      const result = await deleteFrom(this.db, userMcpOauthTokens3).where((0, import_drizzle_orm34.eq)(userMcpOauthTokens3.user_id, userId)).run();
+      const result = await deleteFrom(this.db, userMcpOauthTokens3).where((0, import_drizzle_orm35.eq)(userMcpOauthTokens3.user_id, userId)).run();
       return result.rowsAffected;
     } catch (error) {
       throw new RepositoryError(
@@ -15076,7 +15303,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async deleteAllForServer(serverId) {
     try {
-      const result = await deleteFrom(this.db, userMcpOauthTokens3).where((0, import_drizzle_orm34.eq)(userMcpOauthTokens3.mcp_server_id, serverId)).run();
+      const result = await deleteFrom(this.db, userMcpOauthTokens3).where((0, import_drizzle_orm35.eq)(userMcpOauthTokens3.mcp_server_id, serverId)).run();
       return result.rowsAffected;
     } catch (error) {
       throw new RepositoryError(
@@ -15087,7 +15314,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async listForUser(userId) {
     try {
-      const rows = await select(this.db).from(userMcpOauthTokens3).where((0, import_drizzle_orm34.eq)(userMcpOauthTokens3.user_id, userId)).all();
+      const rows = await select(this.db).from(userMcpOauthTokens3).where((0, import_drizzle_orm35.eq)(userMcpOauthTokens3.user_id, userId)).all();
       return rows.map(rowToToken);
     } catch (error) {
       throw new RepositoryError(
@@ -15105,37 +15332,7 @@ var UserMCPOAuthTokenRepository = class {
 // src/db/repositories/users.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm35 = require("drizzle-orm");
-
-// src/config/env-vars.ts
-init_cjs_shims();
-var V05_SCOPES = ["global", "session"];
-var V05_SCOPE_SET = new Set(V05_SCOPES);
-function normalizeStoredEnvVar(raw) {
-  if (typeof raw === "string") {
-    return { value_encrypted: raw, scope: "global" };
-  }
-  return {
-    value_encrypted: raw.value_encrypted,
-    scope: raw.scope,
-    resource_id: raw.resource_id ?? null,
-    extra_config: raw.extra_config ?? null
-  };
-}
-function normalizeStoredEnvMap(raw) {
-  const out = {};
-  if (!raw) return out;
-  for (const [key, value] of Object.entries(raw)) {
-    try {
-      out[key] = normalizeStoredEnvVar(value);
-    } catch (err) {
-      console.warn(`[env-vars] Skipping malformed env var entry ${key}:`, err);
-    }
-  }
-  return out;
-}
-
-// src/db/repositories/users.ts
+var import_drizzle_orm36 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -15238,7 +15435,7 @@ var UsersRepository = class {
    */
   async resolveId(id) {
     return resolveByShortIdPrefix(id, "User", async (pattern) => {
-      const rows = await select(this.db).from(users3).where((0, import_drizzle_orm35.like)(users3.user_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      const rows = await select(this.db).from(users3).where((0, import_drizzle_orm36.like)(users3.user_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
       return rows.map((r) => r.user_id);
     });
   }
@@ -15246,7 +15443,7 @@ var UsersRepository = class {
    * Check if unix_username is already taken by another user
    */
   async isUnixUsernameTaken(unixUsername, excludeUserId) {
-    const result = await select(this.db).from(users3).where((0, import_drizzle_orm35.eq)(users3.unix_username, unixUsername)).one();
+    const result = await select(this.db).from(users3).where((0, import_drizzle_orm36.eq)(users3.unix_username, unixUsername)).one();
     if (!result) {
       return false;
     }
@@ -15269,7 +15466,7 @@ var UsersRepository = class {
     }
     const insertData = this.userToInsert(data);
     await insert(this.db, users3).values(insertData).run();
-    const row = await select(this.db).from(users3).where((0, import_drizzle_orm35.eq)(users3.user_id, insertData.user_id)).one();
+    const row = await select(this.db).from(users3).where((0, import_drizzle_orm36.eq)(users3.user_id, insertData.user_id)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve created user");
     }
@@ -15281,7 +15478,7 @@ var UsersRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where((0, import_drizzle_orm35.eq)(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where((0, import_drizzle_orm36.eq)(users3.user_id, fullId)).one();
       if (!result) {
         return null;
       }
@@ -15297,7 +15494,7 @@ var UsersRepository = class {
    * Find user by email
    */
   async findByEmail(email) {
-    const result = await select(this.db).from(users3).where((0, import_drizzle_orm35.eq)(users3.email, email)).one();
+    const result = await select(this.db).from(users3).where((0, import_drizzle_orm36.eq)(users3.email, email)).one();
     if (!result) {
       return null;
     }
@@ -15318,7 +15515,7 @@ var UsersRepository = class {
     if (!normalizedEmail) return null;
     const exact = await this.findByEmail(normalizedEmail);
     if (exact) return exact;
-    const results = await select(this.db).from(users3).where(import_drizzle_orm35.sql`LOWER(${users3.email}) = ${normalizedEmail}`).all();
+    const results = await select(this.db).from(users3).where(import_drizzle_orm36.sql`LOWER(${users3.email}) = ${normalizedEmail}`).all();
     if (results.length !== 1) {
       if (results.length > 1) {
         console.warn(
@@ -15368,8 +15565,8 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       ...insertData,
       updated_at: /* @__PURE__ */ new Date()
-    }).where((0, import_drizzle_orm35.eq)(users3.user_id, fullId)).run();
-    const row = await select(this.db).from(users3).where((0, import_drizzle_orm35.eq)(users3.user_id, fullId)).one();
+    }).where((0, import_drizzle_orm36.eq)(users3.user_id, fullId)).run();
+    const row = await select(this.db).from(users3).where((0, import_drizzle_orm36.eq)(users3.user_id, fullId)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve updated user");
     }
@@ -15380,7 +15577,7 @@ var UsersRepository = class {
    */
   async delete(id) {
     const fullId = await this.resolveId(id);
-    await deleteFrom(this.db, users3).where((0, import_drizzle_orm35.eq)(users3.user_id, fullId)).run();
+    await deleteFrom(this.db, users3).where((0, import_drizzle_orm36.eq)(users3.user_id, fullId)).run();
   }
   /**
    * Get raw database row (internal use only - includes encrypted keys)
@@ -15388,7 +15585,7 @@ var UsersRepository = class {
   async getRawRow(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where((0, import_drizzle_orm35.eq)(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where((0, import_drizzle_orm36.eq)(users3.user_id, fullId)).one();
       return result;
     } catch (error) {
       if (error instanceof EntityNotFoundError) {
@@ -15470,7 +15667,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where((0, import_drizzle_orm35.eq)(users3.user_id, fullId)).run();
+    }).where((0, import_drizzle_orm36.eq)(users3.user_id, fullId)).run();
   }
   /**
    * Delete a single credential field for a tool.
@@ -15496,7 +15693,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where((0, import_drizzle_orm35.eq)(users3.user_id, fullId)).run();
+    }).where((0, import_drizzle_orm36.eq)(users3.user_id, fullId)).run();
   }
 };