feat(db): add oauth_clients table for dynamic client registration

* Introduced oauth_clients table with fields for client_id, client_name, redirect_uris, and created_at.
* Updated agent_persona_parts, agent_persona_skills, agent_persona_guardrails, agent_persona_traits, and arc_stage_parts tables to use unique constraints instead of primary keys for composite indexes.

internal/app/app.go

@@ -100,7 +100,7 @@ func Run(ctx context.Context, configPath string) error {
 		}
 	}
 	authCodes := auth.NewAuthCodeStore()
-	dynClients := auth.NewDynamicClientStore()
+	dynClients := auth.NewPostgresClientStore(db.Pool())
 	activeProjects := session.NewActiveProjects()
 
 	logger.Info("ai providers initialised",
@@ -183,7 +183,7 @@ func Run(ctx context.Context, configPath string) error {
 	}
 }
 
-func routes(logger *slog.Logger, cfg *config.Config, info buildinfo.Info, db *store.DB, embeddings *ai.EmbeddingRunner, metadata *ai.MetadataRunner, bgEmbeddings *ai.EmbeddingRunner, bgMetadata *ai.MetadataRunner, keyring *auth.Keyring, oauthRegistry *auth.OAuthRegistry, tokenStore *auth.TokenStore, authCodes *auth.AuthCodeStore, dynClients *auth.DynamicClientStore, activeProjects *session.ActiveProjects) (http.Handler, error) {
+func routes(logger *slog.Logger, cfg *config.Config, info buildinfo.Info, db *store.DB, embeddings *ai.EmbeddingRunner, metadata *ai.MetadataRunner, bgEmbeddings *ai.EmbeddingRunner, bgMetadata *ai.MetadataRunner, keyring *auth.Keyring, oauthRegistry *auth.OAuthRegistry, tokenStore *auth.TokenStore, authCodes *auth.AuthCodeStore, dynClients auth.ClientStore, activeProjects *session.ActiveProjects) (http.Handler, error) {
 	mux := http.NewServeMux()
 	accessTracker := auth.NewAccessTracker()
 	oauthEnabled := oauthRegistry != nil

internal/app/oauth.go

@@ -83,7 +83,7 @@ func oauthMetadataHandler() http.HandlerFunc {
 
 // oauthRegisterHandler serves POST /oauth/register per RFC 7591
 // (OAuth 2.0 Dynamic Client Registration).
-func oauthRegisterHandler(dynClients *auth.DynamicClientStore, log *slog.Logger) http.HandlerFunc {
+func oauthRegisterHandler(dynClients auth.ClientStore, log *slog.Logger) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodPost {
 			w.Header().Set("Allow", http.MethodPost)
@@ -130,7 +130,7 @@ func oauthRegisterHandler(dynClients *auth.DynamicClientStore, log *slog.Logger)
 
 // oauthAuthorizeHandler serves GET and POST /oauth/authorize.
 // GET shows an approval page; POST processes the user's approve/deny action.
-func oauthAuthorizeHandler(dynClients *auth.DynamicClientStore, authCodes *auth.AuthCodeStore, log *slog.Logger) http.HandlerFunc {
+func oauthAuthorizeHandler(dynClients auth.ClientStore, authCodes *auth.AuthCodeStore, log *slog.Logger) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		switch r.Method {
 		case http.MethodGet:
@@ -144,7 +144,7 @@ func oauthAuthorizeHandler(dynClients *auth.DynamicClientStore, authCodes *auth.
 	}
 }
 
-func handleAuthorizeGET(w http.ResponseWriter, r *http.Request, dynClients *auth.DynamicClientStore) {
+func handleAuthorizeGET(w http.ResponseWriter, r *http.Request, dynClients auth.ClientStore) {
 	q := r.URL.Query()
 	clientID := q.Get("client_id")
 	redirectURI := q.Get("redirect_uri")
@@ -178,7 +178,7 @@ func handleAuthorizeGET(w http.ResponseWriter, r *http.Request, dynClients *auth
 	serveAuthorizePage(w, client.ClientName, clientID, redirectURI, state, codeChallenge, codeChallengeMethod, scope)
 }
 
-func handleAuthorizePOST(w http.ResponseWriter, r *http.Request, dynClients *auth.DynamicClientStore, authCodes *auth.AuthCodeStore, log *slog.Logger) {
+func handleAuthorizePOST(w http.ResponseWriter, r *http.Request, dynClients auth.ClientStore, authCodes *auth.AuthCodeStore, log *slog.Logger) {
 	if err := r.ParseForm(); err != nil {
 		http.Error(w, "invalid form", http.StatusBadRequest)
 		return

internal/app/resolvespec_models_generated.go

@@ -20,6 +20,7 @@ func resolveSpecModels() []resolveSpecModel {
 		{schema: "public", entity: "chat_histories", model: generatedmodels.ModelPublicChatHistories{}},
 		{schema: "public", entity: "embeddings", model: generatedmodels.ModelPublicEmbeddings{}},
 		{schema: "public", entity: "learnings", model: generatedmodels.ModelPublicLearnings{}},
+		{schema: "public", entity: "oauth_clients", model: generatedmodels.ModelPublicOauthClients{}},
 		{schema: "public", entity: "persona_arc", model: generatedmodels.ModelPublicPersonaArc{}},
 		{schema: "public", entity: "plan_dependencies", model: generatedmodels.ModelPublicPlanDependencies{}},
 		{schema: "public", entity: "plan_guardrails", model: generatedmodels.ModelPublicPlanGuardrails{}},

internal/auth/dynamic_client_store.go

@@ -26,6 +26,12 @@ func (c *DynamicClient) HasRedirectURI(uri string) bool {
 	return false
 }
 
+// ClientStore is the interface implemented by both DynamicClientStore and PostgresClientStore.
+type ClientStore interface {
+	Register(name string, redirectURIs []string) (DynamicClient, error)
+	Lookup(clientID string) (DynamicClient, bool)
+}
+
 // DynamicClientStore holds dynamically registered OAuth clients in memory.
 type DynamicClientStore struct {
 	mu      sync.RWMutex

internal/auth/middleware.go

@@ -17,6 +17,22 @@ type contextKey string
 
 const keyIDContextKey contextKey = "auth.key_id"
 
+// wwwAuthenticate returns the value for a WWW-Authenticate header.
+// It advertises Bearer and, when a public URL is known, the OAuth metadata URL per RFC 9728.
+func wwwAuthenticate(r *http.Request, publicURL string) string {
+	base := publicURL
+	if base == "" {
+		scheme := "https"
+		if proto := r.Header.Get("X-Forwarded-Proto"); proto != "" {
+			scheme = strings.ToLower(proto)
+		} else if r.TLS == nil {
+			scheme = "http"
+		}
+		base = scheme + "://" + r.Host
+	}
+	return `Bearer resource_metadata="` + base + `/.well-known/oauth-authorization-server"`
+}
+
 func Middleware(cfg config.AuthConfig, keyring *Keyring, oauthRegistry *OAuthRegistry, tokenStore *TokenStore, tracker *AccessTracker, log *slog.Logger) func(http.Handler) http.Handler {
 	headerName := cfg.HeaderName
 	if headerName == "" {
@@ -69,6 +85,7 @@ func Middleware(cfg config.AuthConfig, keyring *Keyring, oauthRegistry *OAuthReg
 					}
 				}
 				log.Warn("bearer token rejected", slog.String("remote_addr", remoteAddr))
+				w.Header().Set("WWW-Authenticate", wwwAuthenticate(r, "")+`, error="invalid_token"`)
 				http.Error(w, "invalid token or API key", http.StatusUnauthorized)
 				return
 			}
@@ -105,6 +122,7 @@ func Middleware(cfg config.AuthConfig, keyring *Keyring, oauthRegistry *OAuthReg
 				}
 			}
 
+			w.Header().Set("WWW-Authenticate", wwwAuthenticate(r, ""))
 			http.Error(w, "authentication required", http.StatusUnauthorized)
 		})
 	}

internal/auth/postgres_client_store.go

@@ -0,0 +1,50 @@
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"fmt"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// PostgresClientStore persists dynamically registered OAuth clients (RFC 7591) in PostgreSQL.
+type PostgresClientStore struct {
+	pool *pgxpool.Pool
+}
+
+func NewPostgresClientStore(pool *pgxpool.Pool) *PostgresClientStore {
+	return &PostgresClientStore{pool: pool}
+}
+
+func (s *PostgresClientStore) Register(name string, redirectURIs []string) (DynamicClient, error) {
+	b := make([]byte, 16)
+	if _, err := rand.Read(b); err != nil {
+		return DynamicClient{}, err
+	}
+	clientID := fmt.Sprintf("%x-%x-%x-%x-%x", b[0:4], b[4:6], b[6:8], b[8:10], b[10:])
+
+	var client DynamicClient
+	row := s.pool.QueryRow(context.Background(), `
+		insert into oauth_clients (client_id, client_name, redirect_uris)
+		values ($1, $2, $3)
+		returning client_id, client_name, redirect_uris, created_at
+	`, clientID, name, redirectURIs)
+	if err := row.Scan(&client.ClientID, &client.ClientName, &client.RedirectURIs, &client.CreatedAt); err != nil {
+		return DynamicClient{}, fmt.Errorf("register oauth client: %w", err)
+	}
+	return client, nil
+}
+
+func (s *PostgresClientStore) Lookup(clientID string) (DynamicClient, bool) {
+	var client DynamicClient
+	row := s.pool.QueryRow(context.Background(), `
+		select client_id, client_name, redirect_uris, created_at
+		from oauth_clients
+		where client_id = $1
+	`, clientID)
+	if err := row.Scan(&client.ClientID, &client.ClientName, &client.RedirectURIs, &client.CreatedAt); err != nil {
+		return DynamicClient{}, false
+	}
+	return client, true
+}

internal/generatedmodels/sql_public_agent_persona_guardrails.go

@@ -2,11 +2,14 @@
 package generatedmodels
 
 import (
+	"fmt"
+	resolvespec_common "github.com/bitechdev/ResolveSpec/pkg/spectypes"
 	"github.com/uptrace/bun"
 )
 
 type ModelPublicAgentPersonaGuardrails struct {
 	bun.BaseModel  `bun:"table:public.agent_persona_guardrails,alias:agent_persona_guardrails"`
+	ID             resolvespec_common.SqlInt64 `bun:"id,type:bigserial,pk,autoincrement," json:"id"`
 	GuardrailID    int64                       `bun:"guardrail_id,type:bigint,notnull," json:"guardrail_id"`
 	PersonaID      int64                       `bun:"persona_id,type:bigint,notnull," json:"persona_id"`
 	RelGuardrailID *ModelPublicAgentGuardrails `bun:"rel:has-one,join:guardrail_id=id" json:"relguardrailid,omitempty"` // Has one ModelPublicAgentGuardrails
@@ -28,6 +31,31 @@ func (m ModelPublicAgentPersonaGuardrails) SchemaName() string {
 	return "public"
 }
 
+// GetID returns the primary key value
+func (m ModelPublicAgentPersonaGuardrails) GetID() int64 {
+	return m.ID.Int64()
+}
+
+// GetIDStr returns the primary key as a string
+func (m ModelPublicAgentPersonaGuardrails) GetIDStr() string {
+	return fmt.Sprintf("%v", m.ID)
+}
+
+// SetID sets the primary key value
+func (m ModelPublicAgentPersonaGuardrails) SetID(newid int64) {
+	m.UpdateID(newid)
+}
+
+// UpdateID updates the primary key value
+func (m *ModelPublicAgentPersonaGuardrails) UpdateID(newid int64) {
+	m.ID.FromString(fmt.Sprintf("%d", newid))
+}
+
+// GetIDName returns the name of the primary key column
+func (m ModelPublicAgentPersonaGuardrails) GetIDName() string {
+	return "id"
+}
+
 // GetPrefix returns the table prefix
 func (m ModelPublicAgentPersonaGuardrails) GetPrefix() string {
 	return "APG"

internal/generatedmodels/sql_public_agent_persona_parts.go

@@ -2,17 +2,20 @@
 package generatedmodels
 
 import (
+	"fmt"
+	resolvespec_common "github.com/bitechdev/ResolveSpec/pkg/spectypes"
 	"github.com/uptrace/bun"
 )
 
 type ModelPublicAgentPersonaParts struct {
 	bun.BaseModel `bun:"table:public.agent_persona_parts,alias:agent_persona_parts"`
-	PartID        int64                     `bun:"part_id,type:bigint,notnull," json:"part_id"`
+	ID            resolvespec_common.SqlInt64 `bun:"id,type:bigserial,pk,autoincrement," json:"id"`
-	PartOrder     int32                     `bun:"part_order,type:int,default:0,notnull," json:"part_order"`
+	PartID        int64                       `bun:"part_id,type:bigint,notnull," json:"part_id"`
-	PersonaID     int64                     `bun:"persona_id,type:bigint,notnull," json:"persona_id"`
+	PartOrder     int32                       `bun:"part_order,type:int,default:0,notnull," json:"part_order"`
-	Priority      int32                     `bun:"priority,type:int,default:0,notnull," json:"priority"`
+	PersonaID     int64                       `bun:"persona_id,type:bigint,notnull," json:"persona_id"`
-	RelPartID     *ModelPublicAgentParts    `bun:"rel:has-one,join:part_id=id" json:"relpartid,omitempty"`       // Has one ModelPublicAgentParts
+	Priority      int32                       `bun:"priority,type:int,default:0,notnull," json:"priority"`
-	RelPersonaID  *ModelPublicAgentPersonas `bun:"rel:has-one,join:persona_id=id" json:"relpersonaid,omitempty"` // Has one ModelPublicAgentPersonas
+	RelPartID     *ModelPublicAgentParts      `bun:"rel:has-one,join:part_id=id" json:"relpartid,omitempty"`       // Has one ModelPublicAgentParts
+	RelPersonaID  *ModelPublicAgentPersonas   `bun:"rel:has-one,join:persona_id=id" json:"relpersonaid,omitempty"` // Has one ModelPublicAgentPersonas
 }
 
 // TableName returns the table name for ModelPublicAgentPersonaParts
@@ -30,6 +33,31 @@ func (m ModelPublicAgentPersonaParts) SchemaName() string {
 	return "public"
 }
 
+// GetID returns the primary key value
+func (m ModelPublicAgentPersonaParts) GetID() int64 {
+	return m.ID.Int64()
+}
+
+// GetIDStr returns the primary key as a string
+func (m ModelPublicAgentPersonaParts) GetIDStr() string {
+	return fmt.Sprintf("%v", m.ID)
+}
+
+// SetID sets the primary key value
+func (m ModelPublicAgentPersonaParts) SetID(newid int64) {
+	m.UpdateID(newid)
+}
+
+// UpdateID updates the primary key value
+func (m *ModelPublicAgentPersonaParts) UpdateID(newid int64) {
+	m.ID.FromString(fmt.Sprintf("%d", newid))
+}
+
+// GetIDName returns the name of the primary key column
+func (m ModelPublicAgentPersonaParts) GetIDName() string {
+	return "id"
+}
+
 // GetPrefix returns the table prefix
 func (m ModelPublicAgentPersonaParts) GetPrefix() string {
 	return "APP"

internal/generatedmodels/sql_public_agent_persona_skills.go

@@ -2,15 +2,18 @@
 package generatedmodels
 
 import (
+	"fmt"
+	resolvespec_common "github.com/bitechdev/ResolveSpec/pkg/spectypes"
 	"github.com/uptrace/bun"
 )
 
 type ModelPublicAgentPersonaSkills struct {
 	bun.BaseModel `bun:"table:public.agent_persona_skills,alias:agent_persona_skills"`
-	PersonaID     int64                     `bun:"persona_id,type:bigint,notnull," json:"persona_id"`
+	ID            resolvespec_common.SqlInt64 `bun:"id,type:bigserial,pk,autoincrement," json:"id"`
-	SkillID       int64                     `bun:"skill_id,type:bigint,notnull," json:"skill_id"`
+	PersonaID     int64                       `bun:"persona_id,type:bigint,notnull," json:"persona_id"`
-	RelPersonaID  *ModelPublicAgentPersonas `bun:"rel:has-one,join:persona_id=id" json:"relpersonaid,omitempty"` // Has one ModelPublicAgentPersonas
+	SkillID       int64                       `bun:"skill_id,type:bigint,notnull," json:"skill_id"`
-	RelSkillID    *ModelPublicAgentSkills   `bun:"rel:has-one,join:skill_id=id" json:"relskillid,omitempty"`     // Has one ModelPublicAgentSkills
+	RelPersonaID  *ModelPublicAgentPersonas   `bun:"rel:has-one,join:persona_id=id" json:"relpersonaid,omitempty"` // Has one ModelPublicAgentPersonas
+	RelSkillID    *ModelPublicAgentSkills     `bun:"rel:has-one,join:skill_id=id" json:"relskillid,omitempty"`     // Has one ModelPublicAgentSkills
 }
 
 // TableName returns the table name for ModelPublicAgentPersonaSkills
@@ -28,6 +31,31 @@ func (m ModelPublicAgentPersonaSkills) SchemaName() string {
 	return "public"
 }
 
+// GetID returns the primary key value
+func (m ModelPublicAgentPersonaSkills) GetID() int64 {
+	return m.ID.Int64()
+}
+
+// GetIDStr returns the primary key as a string
+func (m ModelPublicAgentPersonaSkills) GetIDStr() string {
+	return fmt.Sprintf("%v", m.ID)
+}
+
+// SetID sets the primary key value
+func (m ModelPublicAgentPersonaSkills) SetID(newid int64) {
+	m.UpdateID(newid)
+}
+
+// UpdateID updates the primary key value
+func (m *ModelPublicAgentPersonaSkills) UpdateID(newid int64) {
+	m.ID.FromString(fmt.Sprintf("%d", newid))
+}
+
+// GetIDName returns the name of the primary key column
+func (m ModelPublicAgentPersonaSkills) GetIDName() string {
+	return "id"
+}
+
 // GetPrefix returns the table prefix
 func (m ModelPublicAgentPersonaSkills) GetPrefix() string {
 	return "APS"

internal/generatedmodels/sql_public_agent_persona_traits.go

@@ -2,15 +2,18 @@
 package generatedmodels
 
 import (
+	"fmt"
+	resolvespec_common "github.com/bitechdev/ResolveSpec/pkg/spectypes"
 	"github.com/uptrace/bun"
 )
 
 type ModelPublicAgentPersonaTraits struct {
 	bun.BaseModel `bun:"table:public.agent_persona_traits,alias:agent_persona_traits"`
-	PersonaID     int64                     `bun:"persona_id,type:bigint,notnull," json:"persona_id"`
+	ID            resolvespec_common.SqlInt64 `bun:"id,type:bigserial,pk,autoincrement," json:"id"`
-	TraitID       int64                     `bun:"trait_id,type:bigint,notnull," json:"trait_id"`
+	PersonaID     int64                       `bun:"persona_id,type:bigint,notnull," json:"persona_id"`
-	RelPersonaID  *ModelPublicAgentPersonas `bun:"rel:has-one,join:persona_id=id" json:"relpersonaid,omitempty"` // Has one ModelPublicAgentPersonas
+	TraitID       int64                       `bun:"trait_id,type:bigint,notnull," json:"trait_id"`
-	RelTraitID    *ModelPublicAgentTraits   `bun:"rel:has-one,join:trait_id=id" json:"reltraitid,omitempty"`     // Has one ModelPublicAgentTraits
+	RelPersonaID  *ModelPublicAgentPersonas   `bun:"rel:has-one,join:persona_id=id" json:"relpersonaid,omitempty"` // Has one ModelPublicAgentPersonas
+	RelTraitID    *ModelPublicAgentTraits     `bun:"rel:has-one,join:trait_id=id" json:"reltraitid,omitempty"`     // Has one ModelPublicAgentTraits
 }
 
 // TableName returns the table name for ModelPublicAgentPersonaTraits
@@ -28,6 +31,31 @@ func (m ModelPublicAgentPersonaTraits) SchemaName() string {
 	return "public"
 }
 
+// GetID returns the primary key value
+func (m ModelPublicAgentPersonaTraits) GetID() int64 {
+	return m.ID.Int64()
+}
+
+// GetIDStr returns the primary key as a string
+func (m ModelPublicAgentPersonaTraits) GetIDStr() string {
+	return fmt.Sprintf("%v", m.ID)
+}
+
+// SetID sets the primary key value
+func (m ModelPublicAgentPersonaTraits) SetID(newid int64) {
+	m.UpdateID(newid)
+}
+
+// UpdateID updates the primary key value
+func (m *ModelPublicAgentPersonaTraits) UpdateID(newid int64) {
+	m.ID.FromString(fmt.Sprintf("%d", newid))
+}
+
+// GetIDName returns the name of the primary key column
+func (m ModelPublicAgentPersonaTraits) GetIDName() string {
+	return "id"
+}
+
 // GetPrefix returns the table prefix
 func (m ModelPublicAgentPersonaTraits) GetPrefix() string {
 	return "APT"

internal/generatedmodels/sql_public_arc_stage_parts.go

@@ -2,15 +2,18 @@
 package generatedmodels
 
 import (
+	"fmt"
+	resolvespec_common "github.com/bitechdev/ResolveSpec/pkg/spectypes"
 	"github.com/uptrace/bun"
 )
 
 type ModelPublicArcStageParts struct {
 	bun.BaseModel `bun:"table:public.arc_stage_parts,alias:arc_stage_parts"`
-	PartID        int64                  `bun:"part_id,type:bigint,notnull," json:"part_id"`
+	ID            resolvespec_common.SqlInt64 `bun:"id,type:bigserial,pk,autoincrement," json:"id"`
-	StageID       int64                  `bun:"stage_id,type:bigint,notnull," json:"stage_id"`
+	PartID        int64                       `bun:"part_id,type:bigint,notnull," json:"part_id"`
-	RelPartID     *ModelPublicAgentParts `bun:"rel:has-one,join:part_id=id" json:"relpartid,omitempty"`   // Has one ModelPublicAgentParts
+	StageID       int64                       `bun:"stage_id,type:bigint,notnull," json:"stage_id"`
-	RelStageID    *ModelPublicArcStages  `bun:"rel:has-one,join:stage_id=id" json:"relstageid,omitempty"` // Has one ModelPublicArcStages
+	RelPartID     *ModelPublicAgentParts      `bun:"rel:has-one,join:part_id=id" json:"relpartid,omitempty"`   // Has one ModelPublicAgentParts
+	RelStageID    *ModelPublicArcStages       `bun:"rel:has-one,join:stage_id=id" json:"relstageid,omitempty"` // Has one ModelPublicArcStages
 }
 
 // TableName returns the table name for ModelPublicArcStageParts
@@ -28,6 +31,31 @@ func (m ModelPublicArcStageParts) SchemaName() string {
 	return "public"
 }
 
+// GetID returns the primary key value
+func (m ModelPublicArcStageParts) GetID() int64 {
+	return m.ID.Int64()
+}
+
+// GetIDStr returns the primary key as a string
+func (m ModelPublicArcStageParts) GetIDStr() string {
+	return fmt.Sprintf("%v", m.ID)
+}
+
+// SetID sets the primary key value
+func (m ModelPublicArcStageParts) SetID(newid int64) {
+	m.UpdateID(newid)
+}
+
+// UpdateID updates the primary key value
+func (m *ModelPublicArcStageParts) UpdateID(newid int64) {
+	m.ID.FromString(fmt.Sprintf("%d", newid))
+}
+
+// GetIDName returns the name of the primary key column
+func (m ModelPublicArcStageParts) GetIDName() string {
+	return "id"
+}
+
 // GetPrefix returns the table prefix
 func (m ModelPublicArcStageParts) GetPrefix() string {
 	return "ASP"

internal/generatedmodels/sql_public_oauth_clients.go

@@ -0,0 +1,62 @@
+// Code generated by relspecgo. DO NOT EDIT.
+package generatedmodels
+
+import (
+	"fmt"
+	resolvespec_common "github.com/bitechdev/ResolveSpec/pkg/spectypes"
+	"github.com/uptrace/bun"
+)
+
+type ModelPublicOauthClients struct {
+	bun.BaseModel `bun:"table:public.oauth_clients,alias:oauth_clients"`
+	ID            resolvespec_common.SqlInt64       `bun:"id,type:bigserial,pk,autoincrement," json:"id"`
+	ClientID      resolvespec_common.SqlString      `bun:"client_id,type:text,notnull," json:"client_id"`
+	ClientName    resolvespec_common.SqlString      `bun:"client_name,type:text,default:'',notnull," json:"client_name"`
+	CreatedAt     resolvespec_common.SqlTimeStamp   `bun:"created_at,type:timestamptz,default:now(),notnull," json:"created_at"`
+	RedirectUris  resolvespec_common.SqlStringArray `bun:"redirect_uris,type:text,default:'{}',notnull," json:"redirect_uris"`
+}
+
+// TableName returns the table name for ModelPublicOauthClients
+func (m ModelPublicOauthClients) TableName() string {
+	return "public.oauth_clients"
+}
+
+// TableNameOnly returns the table name without schema for ModelPublicOauthClients
+func (m ModelPublicOauthClients) TableNameOnly() string {
+	return "oauth_clients"
+}
+
+// SchemaName returns the schema name for ModelPublicOauthClients
+func (m ModelPublicOauthClients) SchemaName() string {
+	return "public"
+}
+
+// GetID returns the primary key value
+func (m ModelPublicOauthClients) GetID() int64 {
+	return m.ID.Int64()
+}
+
+// GetIDStr returns the primary key as a string
+func (m ModelPublicOauthClients) GetIDStr() string {
+	return fmt.Sprintf("%v", m.ID)
+}
+
+// SetID sets the primary key value
+func (m ModelPublicOauthClients) SetID(newid int64) {
+	m.UpdateID(newid)
+}
+
+// UpdateID updates the primary key value
+func (m *ModelPublicOauthClients) UpdateID(newid int64) {
+	m.ID.FromString(fmt.Sprintf("%d", newid))
+}
+
+// GetIDName returns the name of the primary key column
+func (m ModelPublicOauthClients) GetIDName() string {
+	return "id"
+}
+
+// GetPrefix returns the table prefix
+func (m ModelPublicOauthClients) GetPrefix() string {
+	return "OCA"
+}

internal/generatedmodels/sql_public_persona_arc.go

@@ -9,6 +9,7 @@ import (
 
 type ModelPublicPersonaArc struct {
 	bun.BaseModel     `bun:"table:public.persona_arc,alias:persona_arc"`
+	ID                resolvespec_common.SqlInt64     `bun:"id,type:bigserial,pk,autoincrement," json:"id"`
 	PersonaID         int64                           `bun:"persona_id,type:bigint,pk," json:"persona_id"`
 	ArcID             int64                           `bun:"arc_id,type:bigint,notnull," json:"arc_id"`
 	CurrentStageID    int64                           `bun:"current_stage_id,type:bigint,notnull," json:"current_stage_id"`
@@ -35,12 +36,12 @@ func (m ModelPublicPersonaArc) SchemaName() string {
 
 // GetID returns the primary key value
 func (m ModelPublicPersonaArc) GetID() int64 {
-	return int64(m.PersonaID)
+	return m.ID.Int64()
 }
 
 // GetIDStr returns the primary key as a string
 func (m ModelPublicPersonaArc) GetIDStr() string {
-	return fmt.Sprintf("%d", m.PersonaID)
+	return fmt.Sprintf("%v", m.ID)
 }
 
 // SetID sets the primary key value
@@ -50,12 +51,12 @@ func (m ModelPublicPersonaArc) SetID(newid int64) {
 
 // UpdateID updates the primary key value
 func (m *ModelPublicPersonaArc) UpdateID(newid int64) {
-	m.PersonaID = newid
+	m.ID.FromString(fmt.Sprintf("%d", newid))
 }
 
 // GetIDName returns the name of the primary key column
 func (m ModelPublicPersonaArc) GetIDName() string {
-	return "persona_id"
+	return "id"
 }
 
 // GetPrefix returns the table prefix

internal/store/db.go

@@ -131,3 +131,10 @@ func (db *DB) Bun() *bun.DB {
 	}
 	return db.bun
 }
+
+func (db *DB) Pool() *pgxpool.Pool {
+	if db == nil {
+		return nil
+	}
+	return db.pool
+}

schema/agent_personas.dbml

@@ -27,33 +27,35 @@ Table agent_parts {
 }
 
 Table agent_persona_parts {
+  id bigserial [pk]
   persona_id bigint [not null, ref: > agent_personas.id]
   part_id bigint [not null, ref: > agent_parts.id]
   part_order int [not null, default: 0]
   priority int [not null, default: 0]
 
   indexes {
-    (persona_id, part_id) [pk]
+    (persona_id, part_id) [uk]
     persona_id
   }
 }
 
 Table agent_persona_skills {
+  id bigserial [pk]
   persona_id bigint [not null, ref: > agent_personas.id]
   skill_id bigint [not null, ref: > agent_skills.id]
 
   indexes {
-    (persona_id, skill_id) [pk]
+    (persona_id, skill_id) [uk]
     persona_id
   }
 }
 
 Table agent_persona_guardrails {
+  id bigserial [pk]
   persona_id bigint [not null, ref: > agent_personas.id]
   guardrail_id bigint [not null, ref: > agent_guardrails.id]
 
   indexes {
-    (persona_id, guardrail_id) [pk]
     persona_id
   }
 }
@@ -71,11 +73,11 @@ Table agent_traits {
 }
 
 Table agent_persona_traits {
+  id bigserial [pk]
   persona_id bigint [not null, ref: > agent_personas.id]
   trait_id bigint [not null, ref: > agent_traits.id]
 
   indexes {
-    (persona_id, trait_id) [pk]
     persona_id
   }
 }
@@ -100,15 +102,17 @@ Table arc_stages {
 }
 
 Table arc_stage_parts {
+  id bigserial [pk]
   stage_id bigint [not null, ref: > arc_stages.id]
   part_id bigint [not null, ref: > agent_parts.id]
 
   indexes {
-    (stage_id, part_id) [pk]
+    (stage_id, part_id)
   }
 }
 
 Table persona_arc {
+  id bigserial [pk]
   persona_id bigint [pk, ref: > agent_personas.id]
   arc_id bigint [not null, ref: > character_arcs.id]
   current_stage_id bigint [not null, ref: > arc_stages.id]

schema/oauth_clients.dbml

@@ -0,0 +1,8 @@
+// OAuth 2.0 Dynamic Client Registration (RFC 7591)
+Table oauth_clients {
+  id            bigserial    [pk]
+  client_id     text         [unique, not null]
+  client_name   text         [not null, default: '']
+  redirect_uris "text[]"     [not null, default: `'{}'`]
+  created_at    timestamptz  [not null, default: `now()`]
+}