feat(connections)!: delete duplicate-grant reconcile custom flow

packages/connections/package.json

@@ -14,7 +14,6 @@
     "./mcp-presets": "./src/mcp-presets.ts",
     "./connect-github-routes": "./src/connect-github-routes.ts",
     "./connect-github-setup": "./src/connect-github-setup.ts",
-    "./reconcile-duplicate-repo-grants": "./src/reconcile-duplicate-repo-grants.ts",
     "./credential-test": "./src/credential-test.ts",
     "./token-session": "./src/token-session.ts",
     "./model-capability": "./src/model-capability.ts",

packages/connections/src/connections-shrink.test.ts

@@ -0,0 +1,22 @@
+// CL-7593: shrink @corbits/connections to the PKCE OAuth client +
+// callback surface. Guards the cutover: the one-time CL-7242
+// duplicate-grant cleanup entry point must stay gone (module file and
+// export-map subpath) so no caller can drift back onto a custom grant
+// flow outside the native credential/grant routes.
+import { expect, test } from "bun:test";
+
+const here = new URL(".", import.meta.url);
+
+test("duplicate-grant reconcile entry point stays deleted", async () => {
+  expect(
+    await Bun.file(
+      new URL("./reconcile-duplicate-repo-grants.ts", here),
+    ).exists(),
+  ).toBe(false);
+  const pkg = JSON.parse(
+    await Bun.file(new URL("../package.json", here)).text(),
+  ) as { exports?: Record<string, string> };
+  expect(
+    Object.hasOwn(pkg.exports ?? {}, "./reconcile-duplicate-repo-grants"),
+  ).toBe(false);
+});

scripts/db-setup.ts

@@ -30,7 +30,6 @@ import { readdir } from "node:fs/promises";
 
 import { applyChatMigrations } from "../packages/chat/src/migrations";
 import { applyWebhookTriggersMigrations } from "../packages/webhook-triggers/src/migrations";
-import { reconcileDuplicateRepoGrants } from "../packages/connections/src/reconcile-duplicate-repo-grants";
 import { applyNotifyMigrations } from "../packages/notify/src/migrations";
 import {
   applyInboxMigrations,
@@ -107,21 +106,10 @@ async function applyInstalledPackageMigrations(
     }
   }
 
-  // CL-7242: not a package migration (no schema, no ledger, no DDL at
-  // all) -- a plain, always-safe-to-re-run DELETE against the
-  // platform's own `grant` table through @intx/db's published export,
-  // cleaning up any repo grants CL-7242's race duplicated before this
-  // fix's lease started preventing new ones. See
-  // reconcile-duplicate-repo-grants.ts for why this is DML, not DDL,
-  // and why that distinction is what keeps it off the vendored-delta
-  // ledger.
-  const { removedIds } = await reconcileDuplicateRepoGrants(databaseUrl);
-  if (removedIds.length > 0) {
-    console.log(
-      `db-setup: removed ${removedIds.length} duplicate repo grant(s): ` +
-        removedIds.join(", "),
-    );
-  }
+  // CL-7593: the one-time CL-7242 duplicate-grant cleanup ran its era
+  // (the repo_review_lease now prevents new duplicates at write time),
+  // so db-setup no longer performs it: setup applies migrations only,
+  // and grant state stays on the native grant routes.
 
   await dropRoutinesSchemaAfterDigestHandoff(databaseUrl);
 }