@agent-native/core 0.122.1 → 0.122.2

package/corpus/templates/analytics/server/lib/dashboard-time-scope.ts

@@ -14,7 +14,7 @@ type DashboardFilterLike = {
   default?: unknown;
 };
 
-type DashboardPanelLike = {
+export type DashboardPanelLike = {
   id?: unknown;
   title?: unknown;
   chartType?: unknown;
@@ -64,6 +64,241 @@ function hasExplicitLowerBound(sql: string): boolean {
   );
 }
 
+const ANALYTICS_SCAN_RE = /\b(?:FROM|JOIN)\s+analytics_events\b/gi;
+const TOP_LEVEL_CTE_HEAD_RE = /^\s*WITH\b/i;
+const CTE_NAME_RE =
+  /^\s*((?:[A-Za-z_]\w*|"(?:[^"]|"")*"|`(?:[^`]|``)*`|\[(?:[^\]]|\]\])*\]))\s*(?:\([^)]*\)\s*)?AS\s*(?:(?:NOT\s+)?MATERIALIZED\s*)?\(/i;
+
+type TopLevelCte = { name: string; bodyStart: number; bodyEnd: number };
+
+type TopLevelCteParse = {
+  ctes: TopLevelCte[];
+  outerQueryStart: number;
+};
+
+function findClosingParenthesis(sql: string, bodyStart: number): number {
+  let depth = 1;
+  let quote: "'" | '"' | "`" | null = null;
+  let lineComment = false;
+  let blockComment = false;
+
+  for (let i = bodyStart; i < sql.length; i += 1) {
+    const char = sql[i];
+    const next = sql[i + 1];
+
+    if (lineComment) {
+      if (char === "\n") lineComment = false;
+      continue;
+    }
+    if (blockComment) {
+      if (char === "*" && next === "/") {
+        blockComment = false;
+        i += 1;
+      }
+      continue;
+    }
+    if (quote) {
+      if (char === quote) {
+        if (next === quote) {
+          i += 1;
+        } else {
+          quote = null;
+        }
+      }
+      continue;
+    }
+    if (char === "-" && next === "-") {
+      lineComment = true;
+      i += 1;
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      blockComment = true;
+      i += 1;
+      continue;
+    }
+    if (char === "'" || char === '"' || char === "`") {
+      quote = char;
+      continue;
+    }
+    if (char === "(") depth += 1;
+    else if (char === ")") {
+      depth -= 1;
+      if (depth === 0) return i;
+    }
+  }
+
+  return -1;
+}
+
+function skipSqlTrivia(sql: string, start: number): number {
+  let i = start;
+  while (i < sql.length) {
+    if (/\s/.test(sql[i])) {
+      i += 1;
+      continue;
+    }
+    if (sql[i] === "-" && sql[i + 1] === "-") {
+      i += 2;
+      while (i < sql.length && sql[i] !== "\n") i += 1;
+      continue;
+    }
+    if (sql[i] === "/" && sql[i + 1] === "*") {
+      const end = sql.indexOf("*/", i + 2);
+      if (end === -1) return sql.length;
+      i = end + 2;
+      continue;
+    }
+    break;
+  }
+  return i;
+}
+
+function splitTopLevelUnionBranches(sql: string): string[] {
+  const branches: string[] = [];
+  let start = 0;
+  let depth = 0;
+  let quote: "'" | '"' | "`" | null = null;
+  let lineComment = false;
+  let blockComment = false;
+
+  for (let i = 0; i < sql.length; i += 1) {
+    const char = sql[i];
+    const next = sql[i + 1];
+
+    if (lineComment) {
+      if (char === "\n") lineComment = false;
+      continue;
+    }
+    if (blockComment) {
+      if (char === "*" && next === "/") {
+        blockComment = false;
+        i += 1;
+      }
+      continue;
+    }
+    if (quote) {
+      if (char === quote) {
+        if (next === quote) i += 1;
+        else quote = null;
+      }
+      continue;
+    }
+    if (char === "-" && next === "-") {
+      lineComment = true;
+      i += 1;
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      blockComment = true;
+      i += 1;
+      continue;
+    }
+    if (char === "'" || char === '"' || char === "`") {
+      quote = char;
+      continue;
+    }
+    if (char === "(") {
+      depth += 1;
+      continue;
+    }
+    if (char === ")") {
+      depth = Math.max(0, depth - 1);
+      continue;
+    }
+    if (depth !== 0) continue;
+
+    const union = /^UNION\b/i.exec(sql.slice(i));
+    if (!union) continue;
+    branches.push(sql.slice(start, i));
+    start = skipSqlTrivia(sql, i + union[0].length);
+    const modifier = /^(?:ALL|DISTINCT)\b/i.exec(sql.slice(start));
+    if (modifier) start = skipSqlTrivia(sql, start + modifier[0].length);
+    i = start - 1;
+  }
+
+  branches.push(sql.slice(start));
+  return branches;
+}
+
+/** One top-level `name AS (...)` common-table-expression's body span. */
+function topLevelCtes(sql: string): TopLevelCteParse | null {
+  const sqlStart = skipSqlTrivia(sql, 0);
+  const head = TOP_LEVEL_CTE_HEAD_RE.exec(sql.slice(sqlStart));
+  if (!head) return null;
+  const ctes: TopLevelCte[] = [];
+  let i = skipSqlTrivia(sql, sqlStart + head[0].length);
+  const recursive = /^RECURSIVE\b/i.exec(sql.slice(i));
+  if (recursive) i = skipSqlTrivia(sql, i + recursive[0].length);
+  while (i < sql.length) {
+    const nameMatch = CTE_NAME_RE.exec(sql.slice(i));
+    if (!nameMatch) return null;
+    const name = nameMatch[1];
+    const bodyStart = i + nameMatch[0].length;
+    const bodyEnd = findClosingParenthesis(sql, bodyStart);
+    if (bodyEnd === -1) return null;
+    ctes.push({ name, bodyStart, bodyEnd });
+    const k = skipSqlTrivia(sql, bodyEnd + 1);
+    if (sql[k] === ",") {
+      i = k + 1;
+      continue;
+    }
+    return { ctes, outerQueryStart: k };
+  }
+  return null;
+}
+
+function hasAnyTimeBound(text: string): boolean {
+  // .search() ignores the shared global-flagged regex's lastIndex state,
+  // unlike .test(), which would otherwise give wrong results across calls.
+  return (
+    text.search(TEMPORAL_VARIABLE_RE) !== -1 || hasExplicitLowerBound(text)
+  );
+}
+
+/**
+ * True if every `analytics_events` scan in `sql` has its own time bound.
+ *
+ * `hasExplicitLowerBound`/time-variable checks used to run against the whole
+ * SQL string: a multi-CTE panel with a bound ANYWHERE (e.g. only on the
+ * final SELECT, or only on one of several sibling CTEs) passed validation
+ * even though an earlier, unbounded sibling CTE still did a full-table scan
+ * — the exact shape of several production incidents (2026-07-25 org-wide
+ * audit). This only tightens the check for that specific shape: sibling
+ * top-level CTEs each need their own bound. It deliberately does NOT require
+ * every nested subquery to be independently bounded — a correlated lookup
+ * nested inside an already-bounded outer query (e.g. "has this id EVER
+ * appeared as a referrer") is a legitimate, intentionally all-time pattern,
+ * and over-flagging it would make this check untrustworthy.
+ */
+function everyScanIsBounded(sql: string): boolean {
+  const parsed = topLevelCtes(sql);
+  if (!parsed) {
+    // A WITH query that we cannot parse must fail closed. Falling back to a
+    // whole-query bound lets a bounded sibling hide an unbounded CTE.
+    if (TOP_LEVEL_CTE_HEAD_RE.test(sql.slice(skipSqlTrivia(sql, 0)))) {
+      return false;
+    }
+    return hasAnyTimeBound(sql);
+  }
+  const units = [
+    ...parsed.ctes.map(({ bodyStart, bodyEnd }) =>
+      sql.slice(bodyStart, bodyEnd),
+    ),
+    sql.slice(parsed.outerQueryStart),
+  ];
+  return units.every((unit) =>
+    splitTopLevelUnionBranches(unit).every((branch) => {
+      const scans = branch.match(ANALYTICS_SCAN_RE) ?? [];
+      if (scans.length === 0) return true;
+      // A single lower bound cannot prove that every scan in a join or nested
+      // branch is bounded. Fail closed until the SQL has one scan per branch.
+      if (scans.length > 1) return false;
+      return hasAnyTimeBound(branch);
+    }),
+  );
+}
+
 function hasIntentionalHistoryDescription(
   panel: DashboardPanelLike,
   config: Record<string, unknown>,
@@ -166,5 +401,19 @@ export function validateFirstPartyDashboardTimeScope(
     return `panel[${index}] ${label} reads first-party analytics without a time bound; use {{timeRange}} with a non-empty default filter, or explicitly set config.timeScope to "cohort-history" or "all-time" for intentional history scans`;
   }
 
+  // A bound anywhere in the SQL text (checked above) is not the same as
+  // every CTE/subquery that reads analytics_events having its own bound — a
+  // multi-CTE panel can look bound overall while an earlier CTE still does a
+  // full-table scan. Skip this for "all-time" and "cohort-history": both are
+  // explicit escape hatches, and a cohort-defining CTE (e.g. "first ever
+  // active date per user") is legitimately unbounded by design.
+  if (
+    scope !== "all-time" &&
+    scope !== "cohort-history" &&
+    !everyScanIsBounded(sql)
+  ) {
+    return `panel[${index}] ${label} has at least one analytics_events read (in a CTE or subquery) without its own time bound — a {{timeRange}} reference or literal bound elsewhere in the SQL does not cover it; add a bound to every analytics_events scan, or set config.timeScope to "all-time" for an intentional full-history scan`;
+  }
+
   return null;
 }

package/corpus/templates/analytics/server/lib/first-party-analytics-cache.ts

@@ -0,0 +1,167 @@
+import { createHash } from "crypto";
+
+import { getDbExec } from "@agent-native/core/db";
+
+import type { AnalyticsQueryResult } from "./first-party-analytics.js";
+
+/**
+ * First-party dashboard panel query cache.
+ *
+ * `analytics_events` grows unbounded and several panels (rolling-window and
+ * cohort self-joins) are inherently expensive, so a page with many panels or
+ * a daily report screenshot capturing many panels at once repeatedly
+ * recomputes the same rows under concurrent load — that contention, not any
+ * single query alone, is what was pushing panels past their timeout budget.
+ * This mirrors bigquery.ts's L1 (in-process) + L2 (SQL-backed, shared across
+ * serverless invocations) cache, but keyed per scoped+interpolated SQL text
+ * (which already embeds org_id/owner_email via query args) and with a much
+ * shorter TTL since this is the app's own live data, not an immutable
+ * warehouse result.
+ */
+
+interface L1Entry {
+  result: AnalyticsQueryResult;
+  createdAt: number;
+}
+
+const CACHE_TTL_MS = 5 * 60 * 1000;
+const MAX_L1_ENTRIES = 500;
+
+const l1Cache = new Map<string, L1Entry>();
+// De-dupes identical concurrent cache misses (e.g. the same panel query fired
+// by several viewers, or by the report capture's 4-panel concurrent window)
+// so only one of them actually hits the database.
+const inFlight = new Map<string, Promise<AnalyticsQueryResult>>();
+
+function inFlightKey(key: string, timeoutMs?: number): string {
+  return `${key}:${timeoutMs ?? "unbounded"}`;
+}
+
+export interface FirstPartyCacheOptions {
+  timeoutMs?: number;
+}
+
+export function firstPartyCacheKey(
+  scopedSql: string,
+  args: Array<string | null>,
+): string {
+  return createHash("sha256")
+    .update(`${scopedSql}\n${JSON.stringify(args)}`)
+    .digest("hex");
+}
+
+function getL1(key: string): AnalyticsQueryResult | null {
+  const entry = l1Cache.get(key);
+  if (!entry) return null;
+  if (Date.now() - entry.createdAt > CACHE_TTL_MS) {
+    l1Cache.delete(key);
+    return null;
+  }
+  return entry.result;
+}
+
+function setL1(key: string, result: AnalyticsQueryResult): void {
+  if (l1Cache.size >= MAX_L1_ENTRIES) {
+    const oldest = l1Cache.keys().next().value;
+    if (oldest) l1Cache.delete(oldest);
+  }
+  l1Cache.set(key, { result, createdAt: Date.now() });
+}
+
+async function getL2(
+  key: string,
+  timeoutMs?: number,
+): Promise<AnalyticsQueryResult | null> {
+  try {
+    const db = getDbExec();
+    const nowIso = new Date().toISOString();
+    const { rows } = await db.execute({
+      sql: "SELECT result FROM first_party_analytics_cache WHERE key = ? AND expires_at > ?",
+      args: [key, nowIso],
+      timeoutMs,
+    });
+    if (!rows.length) return null;
+    const raw = (rows[0] as { result: string }).result;
+    return JSON.parse(raw) as AnalyticsQueryResult;
+  } catch (err) {
+    console.warn("[first-party-analytics] L2 cache read failed:", err);
+    return null;
+  }
+}
+
+async function setL2(
+  key: string,
+  sql: string,
+  result: AnalyticsQueryResult,
+  timeoutMs?: number,
+): Promise<void> {
+  try {
+    const db = getDbExec();
+    const now = new Date();
+    const expiresAt = new Date(now.getTime() + CACHE_TTL_MS);
+    const serialized = JSON.stringify(result);
+    // Upsert via delete+insert to stay dialect-agnostic (SQLite/Postgres).
+    await db.execute({
+      sql: "DELETE FROM first_party_analytics_cache WHERE key = ?",
+      args: [key],
+      timeoutMs,
+    });
+    await db.execute({
+      sql: "INSERT INTO first_party_analytics_cache (key, sql, result, created_at, expires_at) VALUES (?, ?, ?, ?, ?)",
+      args: [key, sql, serialized, now.toISOString(), expiresAt.toISOString()],
+      timeoutMs,
+    });
+    // Opportunistically prune expired rows so the table doesn't grow
+    // unbounded — the keyspace is effectively every distinct panel/filter
+    // combination. Run ~1% of the time to avoid thrashing on every write.
+    if (Math.random() < 0.01) {
+      await db.execute({
+        sql: "DELETE FROM first_party_analytics_cache WHERE expires_at <= ?",
+        args: [now.toISOString()],
+        timeoutMs,
+      });
+    }
+  } catch (err) {
+    console.warn("[first-party-analytics] L2 cache write failed:", err);
+  }
+}
+
+/**
+ * Returns a cached result for (key, sql) if fresh, otherwise runs `compute`
+ * exactly once — even under concurrent callers with the same key — and
+ * caches the result.
+ */
+export async function withFirstPartyCache(
+  key: string,
+  sql: string,
+  compute: () => Promise<AnalyticsQueryResult>,
+  options: FirstPartyCacheOptions = {},
+): Promise<AnalyticsQueryResult> {
+  const l1Hit = getL1(key);
+  if (l1Hit) return l1Hit;
+
+  // A report prewarm may have a shorter deadline than a normal panel request;
+  // never let those callers inherit one another's database timeout.
+  const requestKey = inFlightKey(key, options.timeoutMs);
+  const existing = inFlight.get(requestKey);
+  if (existing) return existing;
+
+  // Register the in-flight promise synchronously (before any `await`) so two
+  // callers racing on the same key can't both slip past the check above and
+  // both hit L2/compute.
+  const promise = (async () => {
+    const l2Hit = await getL2(key, options.timeoutMs);
+    if (l2Hit) {
+      setL1(key, l2Hit);
+      return l2Hit;
+    }
+    const result = await compute();
+    setL1(key, result);
+    await setL2(key, sql, result, options.timeoutMs);
+    return result;
+  })().finally(() => {
+    inFlight.delete(requestKey);
+  });
+  inFlight.set(requestKey, promise);
+  return promise;
+}

package/corpus/templates/analytics/server/lib/first-party-analytics.ts

@@ -8,6 +8,10 @@ import {
   ingestAnalyticsExceptionEvents,
   type DerivedExceptionFields,
 } from "./error-capture.js";
+import {
+  firstPartyCacheKey,
+  withFirstPartyCache,
+} from "./first-party-analytics-cache.js";
 
 export interface AnalyticsScope {
   userEmail: string;
@@ -29,6 +33,13 @@ export interface AnalyticsQueryResult {
   schema: { name: string; type: string }[];
 }
 
+export interface AnalyticsQueryOptions {
+  /** Cache only callers with a stable dashboard-panel lifecycle. */
+  cache?: boolean;
+  /** Bound the database work for callers with a smaller delivery deadline. */
+  timeoutMs?: number;
+}
+
 const MAX_EVENTS_PER_REQUEST = 100;
 const MAX_QUERY_ROWS = 5_000;
 const FIRST_PARTY_QUERY_TABLES = new Set([
@@ -636,16 +647,30 @@ function inferSchema(rows: Record<string, unknown>[]): {
 export async function queryFirstPartyAnalytics(
   sql: string,
   scope: AnalyticsScope,
+  options: AnalyticsQueryOptions = {},
 ): Promise<AnalyticsQueryResult> {
   validateFirstPartyAnalyticsSql(sql);
   const scoped = scopedAnalyticsSql(sql, scope);
-  const exec = getDbExec();
-  const result = await exec.execute({
-    sql: `SELECT * FROM (${scoped.sql}) AS first_party_analytics_query LIMIT ${MAX_QUERY_ROWS}`,
-    args: scoped.args,
-    timeoutMs: FIRST_PARTY_ANALYTICS_QUERY_TIMEOUT_MS,
-    maxAttempts: 1,
-  });
-  const rows = result.rows as Record<string, unknown>[];
-  return { rows, schema: inferSchema(rows) };
+  const wrappedSql = `SELECT * FROM (${scoped.sql}) AS first_party_analytics_query LIMIT ${MAX_QUERY_ROWS}`;
+  const timeoutMs = Math.max(
+    1,
+    options.timeoutMs ?? FIRST_PARTY_ANALYTICS_QUERY_TIMEOUT_MS,
+  );
+  // The cache key is the fully scoped SQL + args, which already embeds
+  // org_id/owner_email (see scopeClause) — a cache hit can only ever return
+  // rows the same tenant was already entitled to query.
+  const cacheKey = firstPartyCacheKey(wrappedSql, scoped.args);
+  const compute = async (): Promise<AnalyticsQueryResult> => {
+    const exec = getDbExec();
+    const result = await exec.execute({
+      sql: wrappedSql,
+      args: scoped.args,
+      timeoutMs,
+      maxAttempts: 1,
+    });
+    const rows = result.rows as Record<string, unknown>[];
+    return { rows, schema: inferSchema(rows) };
+  };
+  if (!options.cache) return compute();
+  return withFirstPartyCache(cacheKey, wrappedSql, compute, { timeoutMs });
 }

package/corpus/templates/analytics/server/lib/first-party-dashboard-repair.ts

@@ -1,40 +1,47 @@
 import { randomUUID } from "node:crypto";
 
+import { getDialect } from "@agent-native/core/db";
 import { recordChange } from "@agent-native/core/server";
 import { and, desc, eq } from "drizzle-orm";
 
 import { getDb, schema } from "../db/index.js";
 import { repairCanonicalFirstPartyDashboardQueries } from "./canonical-first-party-dashboard-repair";
 import { FIRST_PARTY_DASHBOARD_ID } from "./first-party-metric-catalog";
+import { repairUnboundedFirstPartyPanels } from "./first-party-unbounded-panel-repair.js";
 
-export async function repairPersistedFirstPartyDashboardQueries(): Promise<boolean> {
-  // guard:allow-unscoped — startup repair targets one fixed canonical dashboard
-  // and only replaces the exact shipped legacy SQL under an optimistic fence.
-  const db = getDb() as any;
-  const [row] = await db
-    .select({
-      id: schema.dashboards.id,
-      config: schema.dashboards.config,
-      kind: schema.dashboards.kind,
-      title: schema.dashboards.title,
-      updatedAt: schema.dashboards.updatedAt,
-      ownerEmail: schema.dashboards.ownerEmail,
-      orgId: schema.dashboards.orgId,
-      visibility: schema.dashboards.visibility,
-    })
-    .from(schema.dashboards)
-    .where(eq(schema.dashboards.id, FIRST_PARTY_DASHBOARD_ID));
-  if (!row || row.kind !== "sql" || typeof row.config !== "string") {
-    return false;
-  }
+type DashboardRepairRow = {
+  id: string;
+  config: string;
+  kind: string;
+  title: string;
+  updatedAt: string;
+  ownerEmail: string;
+  orgId: string | null;
+  visibility: string;
+};
 
+/**
+ * Apply `repairFn` to one already-fetched dashboard row inside a transaction,
+ * guarded by an optimistic-concurrency fence on (config, updatedAt) so a
+ * concurrent human/agent edit always wins over the repair. Snapshots the
+ * pre-repair config into dashboard_revisions (bounded to the 50 most recent)
+ * before committing, so any repair is one click away from undo.
+ */
+async function applyRepairToDashboardRow(
+  row: DashboardRepairRow,
+  repairFn: (config: Record<string, unknown>) => {
+    config: Record<string, unknown>;
+    changed: boolean;
+  },
+): Promise<boolean> {
+  const db = getDb() as any;
   let config: Record<string, unknown>;
   try {
     config = JSON.parse(row.config) as Record<string, unknown>;
   } catch {
     return false;
   }
-  const repaired = repairCanonicalFirstPartyDashboardQueries(config);
+  const repaired = repairFn(config);
   if (!repaired.changed) return false;
 
   const repairedAt = new Date().toISOString();
@@ -49,7 +56,7 @@ export async function repairPersistedFirstPartyDashboardQueries(): Promise<boole
       })
       .where(
         and(
-          eq(schema.dashboards.id, FIRST_PARTY_DASHBOARD_ID),
+          eq(schema.dashboards.id, row.id),
           eq(schema.dashboards.config, row.config),
           eq(schema.dashboards.updatedAt, row.updatedAt),
         ),
@@ -104,9 +111,84 @@ export async function repairPersistedFirstPartyDashboardQueries(): Promise<boole
     });
   } catch (err) {
     console.warn(
-      "[db] Canonical dashboard repair committed without a live change event:",
+      "[db] Dashboard repair committed without a live change event:",
       err instanceof Error ? err.message : err,
     );
   }
   return true;
 }
+
+export async function repairPersistedFirstPartyDashboardQueries(): Promise<boolean> {
+  // guard:allow-unscoped — startup repair targets one fixed canonical dashboard
+  // and only replaces the exact shipped legacy SQL under an optimistic fence.
+  const db = getDb() as any;
+  const [row] = await db
+    .select({
+      id: schema.dashboards.id,
+      config: schema.dashboards.config,
+      kind: schema.dashboards.kind,
+      title: schema.dashboards.title,
+      updatedAt: schema.dashboards.updatedAt,
+      ownerEmail: schema.dashboards.ownerEmail,
+      orgId: schema.dashboards.orgId,
+      visibility: schema.dashboards.visibility,
+    })
+    .from(schema.dashboards)
+    .where(eq(schema.dashboards.id, FIRST_PARTY_DASHBOARD_ID));
+  if (!row || row.kind !== "sql" || typeof row.config !== "string") {
+    return false;
+  }
+  return applyRepairToDashboardRow(
+    row,
+    repairCanonicalFirstPartyDashboardQueries,
+  );
+}
+
+/**
+ * Scan every SQL dashboard (not just the one canonical dashboard above) for
+ * first-party panels whose SQL exactly matches a known-unbounded pattern —
+ * see first-party-unbounded-panel-repair.ts for how these were found (a
+ * full-org audit, 2026-07-25) and why exact-string matching, not a general
+ * SQL rewrite, is the safe way to fix panels this repair didn't author.
+ * Returns the number of dashboards actually changed.
+ */
+export async function repairUnboundedFirstPartyPanelsAcrossDashboards(): Promise<number> {
+  // guard:allow-unscoped — this is an org-wide startup repair: it may touch
+  // any dashboard's persisted panel SQL, but only ever replaces an exact
+  // known-bad SQL string under the same optimistic (config, updatedAt) fence
+  // used by the canonical repair above, so a concurrent edit always wins.
+  const db = getDb() as any;
+  const dialect = getDialect();
+  const rows = await db
+    .select({
+      id: schema.dashboards.id,
+      config: schema.dashboards.config,
+      kind: schema.dashboards.kind,
+      title: schema.dashboards.title,
+      updatedAt: schema.dashboards.updatedAt,
+      ownerEmail: schema.dashboards.ownerEmail,
+      orgId: schema.dashboards.orgId,
+      visibility: schema.dashboards.visibility,
+    })
+    .from(schema.dashboards)
+    .where(eq(schema.dashboards.kind, "sql"));
+
+  let repairedCount = 0;
+  for (const row of rows as DashboardRepairRow[]) {
+    if (typeof row.config !== "string") continue;
+    try {
+      const wasRepaired = await applyRepairToDashboardRow(row, (config) =>
+        repairUnboundedFirstPartyPanels(config, dialect),
+      );
+      if (wasRepaired) repairedCount += 1;
+    } catch (err) {
+      // One dashboard's malformed config or a lost optimistic-concurrency
+      // race must not block repairing every other dashboard.
+      console.warn(
+        `[db] Unbounded first-party panel repair failed for dashboard "${row.id}" (non-fatal):`,
+        err instanceof Error ? err.message : err,
+      );
+    }
+  }
+  return repairedCount;
+}