@agent-native/core 0.209.2 → 0.209.3-nightly-20261016212700

package/dist/db/store-registry.js

@@ -16,8 +16,9 @@ import { getAsyncLocalStorageCtor } from "../shared/optional-node-builtins.js";
 import { getDbExec } from "./client.js";
 import { appMigratesAtRelease, schemaEnsureSkipRequested, } from "./migration-policy.js";
 import { isHostedFunctionInvocationRuntime, isMigrationAuthorizedRuntime, isProductionServerlessFunctionRuntime, withMigrationExecutionRuntime, } from "./migration-runtime.js";
+import { runMigrations } from "./migrations.js";
 import { retainRequestDbPoolScope } from "./request-pool-context.js";
-import { dbClientGeneration, retryOnDdlRace } from "./runtime-facts.js";
+import { dbClientGeneration, retryOnDdlRace, runRecordingStoreMigration, } from "./runtime-facts.js";
 export const STORE_MIGRATIONS_TABLE = "_an_store_migrations";
 // checksum, kind, source and core_version are written now because Phase 2
 // (snapshot installs, checksum enforcement) needs them for rows that already
@@ -65,10 +66,12 @@ export function schemaIsReleaseOwned() {
  * the caller's transaction, so a ledger row written there could claim a
  * migration that production never kept.
  */
+function isReleaseStep() {
+    return isMigrationAuthorizedRuntime() && !isHostedFunctionInvocationRuntime();
+}
 function readiness() {
-    if (isMigrationAuthorizedRuntime() && !isHostedFunctionInvocationRuntime()) {
+    if (isReleaseStep())
         return "apply";
-    }
     // No ledger read here: a cold start does zero schema queries, and a missed
     // release is caught by the release step's own verification, not turned into
     // a sitewide error by every request.
@@ -76,7 +79,13 @@ function readiness() {
         return "trust";
     if (schemaEnsureSkipRequested())
         return "skip";
-    return isHostedRuntime() ? "hosted-replay" : "replay";
+    // Hosted requests never write the ledger: PR previews share production's
+    // database and a request's writes can roll back with its caller.
+    if (isHostedRuntime())
+        return "hosted-replay";
+    // Local dev, tests and self-hosted servers own their database, so they
+    // record migrations like the release step: each runs once per database.
+    return "apply";
 }
 function statementsOf(migration) {
     if (migration.sql === undefined)
@@ -113,66 +122,279 @@ async function runMigration(migration, exec) {
     if (migration.run)
         await retryOnDdlRace(() => migration.run(exec));
 }
-async function applyWithLedger(store) {
-    const exec = getDbExec();
-    if (!ledgerPresent) {
+async function applyWithLedger(store, exec) {
+    try {
+        await applyPending(store, exec);
+    }
+    catch (err) {
+        // The ledger can vanish behind a long-lived executor (a database dropped
+        // and recreated under the same client). Rebuild this executor's view once
+        // rather than failing every store until the process restarts.
+        if (!isMissingLedger(err))
+            throw err;
+        ledgerStates.delete(exec);
+        await applyPending(store, exec);
+    }
+}
+function isMissingLedger(err) {
+    for (let e = err, depth = 0; e && depth < 4; e = e.cause, depth++) {
+        if ((e.code === "42P01" ||
+            /relation .* does not exist/i.test(String(e.message ?? ""))) &&
+            String(e.message ?? "").includes(STORE_MIGRATIONS_TABLE)) {
+            return true;
+        }
+    }
+    return false;
+}
+async function applyPending(store, exec) {
+    const state = ledgerStateFor(exec);
+    if (!state.present) {
         await retryOnDdlRace(() => exec.execute(LEDGER_DDL));
-        ledgerPresent = true;
+        state.present = true;
     }
-    const recorded = (await readLedgerSnapshot()).get(store.id);
+    const recorded = (await readLedgerSnapshot(exec)).get(store.id);
     if (recorded && store.migrations.every((m) => recorded.has(m.name)))
         return;
     const applied = new Set(recorded);
+    const legacy = new LegacyBookkeeping(exec);
+    const isRelease = isReleaseStep();
+    let ran = 0;
     for (const migration of store.migrations) {
         if (applied.has(migration.name))
             continue;
+        // An entry carried over from a `runMigrations` list ran only in the release
+        // step on main; local runtimes get those tables from the store's own
+        // migrations, and running the list there would need its release-only order.
+        if (migration.legacy && !migration.legacy.ranAtBoot && !isRelease) {
+            continue;
+        }
+        if (migration.legacy && (await legacy.recorded(migration.legacy))) {
+            await recordMigration(exec, store, migration, "legacy");
+            applied.add(migration.name);
+            continue;
+        }
         try {
-            await runMigration(migration, exec);
+            await runRecordingStoreMigration(() => runMigration(migration, exec));
         }
         catch (err) {
             throw new Error(`Store "${store.id}" migration "${migration.name}" failed: ${err?.message ?? String(err)}`, { cause: err });
         }
+        await recordMigration(exec, store, migration, "step");
+        // Hosted apps without release migrations still replay boot lists against
+        // their old table; without this row they would run this entry again.
+        if (migration.legacy?.ranAtBoot) {
+            await recordLegacyMigrationEntry(exec, migration.legacy.table, {
+                version: migration.legacy.version,
+                name: migration.legacy.name,
+            });
+        }
+        applied.add(migration.name);
+        ran++;
+    }
+    state.snapshot = undefined;
+    if (ran > 0) {
+        console.log(`[db] Applied ${ran} migration(s) to store "${store.id}"`);
+    }
+}
+/**
+ * A deployed server with no hosted database refuses every database open, and
+ * its sign-in page explains the fix; rejecting here would keep the auth and org
+ * plugins from mounting that page, as `runMigrations` never did. Every later
+ * query raises the same refusal, so nothing downstream reads as migrated.
+ */
+// By name rather than `instanceof`: this module must not import the class from
+// `client.js`, which nearly every spec mocks, and the runner wraps the error.
+function databaseRefusal(err) {
+    for (let cause = err; cause; cause = cause.cause) {
+        if (cause.name === "HostedRuntimeLocalDatabaseError") {
+            return cause;
+        }
+    }
+    return undefined;
+}
+async function tolerateRefusedDatabase(storeId, apply) {
+    try {
+        await apply();
+    }
+    catch (err) {
+        const refusal = databaseRefusal(err);
+        if (!refusal || isReleaseStep())
+            throw err;
+        console.error(`[db] Skipping store "${storeId}". ${refusal.message}`);
+    }
+}
+/**
+ * Records an entry in a `runMigrations` list's own bookkeeping as that runner
+ * would after applying it: by name when named, and the version only when it
+ * advances `MAX(version)`, the one value that gates unnamed entries.
+ */
+async function recordLegacyMigrationEntry(exec, table, entry) {
+    await retryOnDdlRace(() => exec.execute(`CREATE TABLE IF NOT EXISTS ${table} (version BIGINT PRIMARY KEY)`));
+    await retryOnDdlRace(() => exec.execute(`CREATE TABLE IF NOT EXISTS ${table}_named (name TEXT PRIMARY KEY, version BIGINT, applied_at TIMESTAMP NOT NULL DEFAULT now())`));
+    if (entry.name) {
         await exec.execute({
-            sql: `INSERT INTO ${STORE_MIGRATIONS_TABLE} (store_id, name, applied_at, checksum, kind, source) VALUES (?, ?, ?, ?, ?, 'step') ON CONFLICT (store_id, name) DO NOTHING`,
-            args: [
-                store.id,
-                migration.name,
-                Date.now(),
-                migrationChecksum(migration),
-                migration.kind ?? "schema",
-            ],
+            sql: `INSERT INTO ${table}_named (name, version) VALUES (?, ?) ON CONFLICT DO NOTHING`,
+            args: [entry.name, entry.version],
         });
-        applied.add(migration.name);
     }
-    ledgerSnapshot = undefined;
+    const { rows } = await exec.execute(`SELECT MAX(version) AS v FROM ${table}`);
+    if (entry.version > Number(rows[0]?.v ?? 0)) {
+        await exec.execute({
+            sql: `INSERT INTO ${table} (version) VALUES (?) ON CONFLICT DO NOTHING`,
+            args: [entry.version],
+        });
+    }
+}
+async function recordMigration(exec, store, migration, source) {
+    await exec.execute({
+        sql: `INSERT INTO ${STORE_MIGRATIONS_TABLE} (store_id, name, applied_at, checksum, kind, source) VALUES (?, ?, ?, ?, ?, ?) ON CONFLICT (store_id, name) DO NOTHING`,
+        args: [
+            store.id,
+            migration.name,
+            Date.now(),
+            migrationChecksum(migration),
+            migration.kind ?? "schema",
+            source,
+        ],
+    });
+}
+/**
+ * Reads a `runMigrations` table's bookkeeping with its own gating: an unnamed
+ * entry counts as applied when its version is at or below `MAX(version)`, a
+ * named one only when its name is in `${table}_named`. A missing table means
+ * nothing was applied. Existence is checked with `to_regclass` so a missing
+ * table never aborts a caller's open transaction.
+ */
+class LegacyBookkeeping {
+    exec;
+    cache = new Map();
+    constructor(exec) {
+        this.exec = exec;
+    }
+    async recorded(ref) {
+        const state = await this.read(ref.table);
+        return ref.name
+            ? state.names.has(ref.name)
+            : ref.version <= state.maxVersion;
+    }
+    read(table) {
+        let pending = this.cache.get(table);
+        if (!pending)
+            this.cache.set(table, (pending = this.load(table)));
+        return pending;
+    }
+    async load(table) {
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(table)) {
+            throw new Error(`Invalid legacy migration table "${table}"`);
+        }
+        const exists = async (name) => {
+            const { rows } = await this.exec.execute({
+                sql: "SELECT to_regclass(?) IS NOT NULL AS present",
+                args: [name],
+            });
+            const present = rows[0]?.present;
+            return present === true || present === "t";
+        };
+        let maxVersion = 0;
+        const names = new Set();
+        if (await exists(table)) {
+            const { rows } = await this.exec.execute(`SELECT MAX(version) AS v FROM ${table}`);
+            maxVersion = Number(rows[0]?.v ?? 0);
+        }
+        if (await exists(`${table}_named`)) {
+            const { rows } = await this.exec.execute(
+            // guard:allow-unbounded-read — one row per applied entry of one migration list
+            `SELECT name FROM ${table}_named`);
+            for (const row of rows)
+                names.add(String(row.name));
+        }
+        return { maxVersion, names };
+    }
 }
 async function replay(store) {
     const exec = getDbExec();
+    const bootLists = new Map();
     for (const migration of store.migrations) {
+        if (migration.legacy?.ranAtBoot && migration.legacy.entry) {
+            const list = bootLists.get(migration.legacy.table) ?? [];
+            list.push(migration.legacy.entry);
+            bootLists.set(migration.legacy.table, list);
+            continue;
+        }
+        // A request never runs a backfill or seed, nor an entry carried over from
+        // a release-only `runMigrations` list: neither ever ran in these apps'
+        // requests, and versioned entries are not all safe to repeat.
+        if (migration.kind === "data" || migration.legacy)
+            continue;
         await runMigration(migration, exec);
     }
+    // Lists that ran at boot on main keep their own bookkeeping here, so these
+    // apps neither re-run nor skip an entry when they upgrade.
+    for (const [table, entries] of bootLists) {
+        await runMigrations(entries, { table })(undefined);
+    }
+}
+/**
+ * Registry order with each store's `after` dependencies first. Fails on an
+ * unknown id or a cycle rather than guessing an order.
+ */
+export function orderStoresForRelease(stores) {
+    const byId = new Map(stores.map((store) => [store.id, store]));
+    const ordered = [];
+    const state = new Map();
+    const visit = (store, path) => {
+        const seen = state.get(store.id);
+        if (seen === "done")
+            return;
+        if (seen === "visiting") {
+            throw new Error(`Store order cycle: ${[...path, store.id].join(" -> ")}`);
+        }
+        state.set(store.id, "visiting");
+        for (const dependency of store.after ?? []) {
+            const before = byId.get(dependency);
+            if (!before) {
+                throw new Error(`Store "${store.id}" must run after unknown store "${dependency}"`);
+            }
+            visit(before, [...path, store.id]);
+        }
+        state.set(store.id, "done");
+        ordered.push(store);
+    };
+    for (const store of stores)
+        visit(store, []);
+    return ordered;
 }
-let ledgerSnapshot;
-let ledgerPresent = false;
+/**
+ * Ledger state is per database executor, not per process. A transaction
+ * (`withDbExec(tx, ...)`) gets its own, so nothing it records can outlive a
+ * rollback; tests that hand each case a fresh database get a fresh ledger
+ * view; and `closeDbExec()` replaces the shared executor, which starts over.
+ */
+let ledgerStates = new WeakMap();
 const allPending = new Set();
 let stateGeneration;
+function ledgerStateFor(exec) {
+    let state = ledgerStates.get(exec);
+    if (!state)
+        ledgerStates.set(exec, (state = { present: false }));
+    return state;
+}
 /**
- * Ledger state and every store's memo describe one database. Closing the
- * database clients (tests, dev reloads, a process that migrates several
- * databases) may point the next query at another, so start over.
+ * Process-wide memos (hosted replay, trust, skip) describe one database.
+ * Closing the database clients (tests, dev reloads) may point the next query
+ * at another, so start over.
  */
 function syncWithDatabaseGeneration() {
     const generation = dbClientGeneration();
     if (stateGeneration === generation)
         return;
     stateGeneration = generation;
-    ledgerSnapshot = undefined;
-    ledgerPresent = false;
+    ledgerStates = new WeakMap();
     for (const pending of allPending)
         pending.clear();
 }
-async function loadLedger() {
-    const { rows } = await getDbExec().execute(
+async function loadLedger(exec) {
+    const { rows } = await exec.execute(
     // guard:allow-unbounded-read — one row per declared migration; this is the single shared read
     `SELECT store_id, name FROM ${STORE_MIGRATIONS_TABLE}`);
     const ledger = new Map();
@@ -185,11 +407,12 @@ async function loadLedger() {
     }
     return ledger;
 }
-function readLedgerSnapshot() {
-    const snapshot = (ledgerSnapshot ??= loadLedger());
+function readLedgerSnapshot(exec) {
+    const state = ledgerStateFor(exec);
+    const snapshot = (state.snapshot ??= loadLedger(exec));
     snapshot.catch(() => {
-        if (ledgerSnapshot === snapshot)
-            ledgerSnapshot = undefined;
+        if (state.snapshot === snapshot)
+            state.snapshot = undefined;
     });
     return snapshot;
 }
@@ -199,8 +422,9 @@ function readLedgerSnapshot() {
  * with the code it is about to publish fails there instead of in a request.
  */
 export async function findUnappliedStoreMigrations(stores) {
-    ledgerSnapshot = undefined;
-    const ledger = await readLedgerSnapshot();
+    const exec = getDbExec();
+    ledgerStateFor(exec).snapshot = undefined;
+    const ledger = await readLedgerSnapshot(exec);
     return stores
         .map((store) => ({
         storeId: store.id,
@@ -313,25 +537,42 @@ export function defineStore(definition) {
     }
     const pending = new Map();
     allPending.add(pending);
+    // The release step also runs list-origin migrations that local runtimes
+    // skip, so its readiness is memoized separately.
+    let applied = new WeakMap();
+    let appliedAtRelease = new WeakMap();
     const store = {
         id,
+        after: definition.after,
         releaseOnly: definition.releaseOnly,
         migrations,
         ready() {
             syncWithDatabaseGeneration();
             const mode = readiness();
+            if (mode === "apply") {
+                return tolerateRefusedDatabase(id, () => {
+                    const exec = getDbExec();
+                    const memo = isReleaseStep() ? appliedAtRelease : applied;
+                    const existing = memo.get(exec);
+                    if (existing)
+                        return existing;
+                    const tracked = retainRequestDbPoolScope(applyWithLedger(store, exec).catch((err) => {
+                        if (memo.get(exec) === tracked)
+                            memo.delete(exec);
+                        throw err;
+                    }));
+                    memo.set(exec, tracked);
+                    return tracked;
+                });
+            }
             const existing = pending.get(mode);
             if (existing)
                 return existing;
-            const run = mode === "apply"
-                ? applyWithLedger(store)
-                : mode === "hosted-replay"
-                    ? definition.releaseOnly
-                        ? Promise.resolve()
-                        : withMigrationExecutionRuntime(() => replay(store))
-                    : mode === "replay"
-                        ? replay(store)
-                        : Promise.resolve();
+            const run = mode === "hosted-replay"
+                ? definition.releaseOnly
+                    ? Promise.resolve()
+                    : withMigrationExecutionRuntime(() => replay(store))
+                : Promise.resolve();
             // The memo outlives the request that started it; on Workers that
             // request's pool must stay open until the work settles.
             const tracked = retainRequestDbPoolScope(run.catch((err) => {
@@ -344,11 +585,12 @@ export function defineStore(definition) {
         },
         reset() {
             pending.clear();
+            applied = new WeakMap();
+            appliedAtRelease = new WeakMap();
         },
     };
     return store;
 }
 export function __resetStoreLedgerSnapshotForTests() {
-    ledgerSnapshot = undefined;
-    ledgerPresent = false;
+    ledgerStates = new WeakMap();
 }

package/dist/db/versioned-store-migrations.d.ts

@@ -0,0 +1,14 @@
+import { type MigrationEntry } from "./migrations.js";
+import type { StoreMigration } from "./store-registry.js";
+/**
+ * Turns `runMigrations` entries into store migrations that keep each entry's
+ * identity: a named entry keeps its name, an unnamed one becomes `v<version>`,
+ * and each carries a `legacy` reference so a database that already applied it
+ * through the old list records it instead of running it again. Multi-statement
+ * SQL is split here because the store runner sends one statement per call.
+ */
+export declare function fromMigrationEntries(table: string, entries: readonly MigrationEntry[], options?: {
+    data?: readonly (string | number)[];
+    /** The list also ran at plugin boot on main, not only at release. */
+    ranAtBoot?: boolean;
+}): StoreMigration[];

package/dist/db/versioned-store-migrations.js

@@ -0,0 +1,37 @@
+import { MIGRATION_DEFERRED, splitSqlStatements, } from "./migrations.js";
+/**
+ * Turns `runMigrations` entries into store migrations that keep each entry's
+ * identity: a named entry keeps its name, an unnamed one becomes `v<version>`,
+ * and each carries a `legacy` reference so a database that already applied it
+ * through the old list records it instead of running it again. Multi-statement
+ * SQL is split here because the store runner sends one statement per call.
+ */
+export function fromMigrationEntries(table, entries, options = {}) {
+    const data = new Set(options.data ?? []);
+    return entries.map((entry) => {
+        const raw = typeof entry.sql === "string" ? entry.sql : entry.sql.postgres;
+        const name = entry.name ?? `v${entry.version}`;
+        const run = entry.run;
+        return {
+            name,
+            kind: data.has(name) || data.has(entry.version)
+                ? "data"
+                : undefined,
+            sql: raw ? splitSqlStatements(raw) : undefined,
+            run: run
+                ? async (exec) => {
+                    if ((await run(exec)) === MIGRATION_DEFERRED) {
+                        throw new Error(`Migration "${name}" deferred itself; store migrations cannot be deferred.`);
+                    }
+                }
+                : undefined,
+            legacy: {
+                table,
+                version: entry.version,
+                name: entry.name,
+                ranAtBoot: options.ranAtBoot,
+                entry: options.ranAtBoot ? entry : undefined,
+            },
+        };
+    });
+}

package/dist/db/widen-columns.js

@@ -1,5 +1,6 @@
 import { getDbExec } from "./client.js";
 import { isHostedFunctionInvocationRuntime, isMigrationExecutingRuntime, isMigrationAuthorizedRuntime, isProductionServerlessFunctionRuntime, } from "./migration-runtime.js";
+import { isRecordingStoreMigration } from "./runtime-facts.js";
 const PLAIN_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /**
  * Widen pre-existing 32-bit `integer` columns to 64-bit `BIGINT` in place on
@@ -48,8 +49,9 @@ export async function widenIntColumnsToBigInt(table, columns, injectedClient) {
     }
     catch (err) {
         // At release the store ledger records success, so a skipped widen must fail.
-        if (isMigrationAuthorizedRuntime())
+        if (isMigrationAuthorizedRuntime() || isRecordingStoreMigration()) {
             throw err;
+        }
         return;
     }
     for (const col of columns) {
@@ -59,8 +61,9 @@ export async function widenIntColumnsToBigInt(table, columns, injectedClient) {
             await client.execute(`ALTER TABLE ${table} ALTER COLUMN ${col} TYPE BIGINT`);
         }
         catch (err) {
-            if (isMigrationAuthorizedRuntime())
+            if (isMigrationAuthorizedRuntime() || isRecordingStoreMigration()) {
                 throw err;
+            }
             // A concurrent boot already widened it, or the role lacks ALTER — both
             // are safe to ignore; a later boot retries if still needed.
         }

package/dist/extensions/html-shell.js

@@ -517,6 +517,16 @@ export function buildExtensionHtml(content, themeVars, isDark, extensionId, bind
 
     var _extensionId = ${extensionIdJson};
     var _extensionBinding = ${bindingJson};
+    // Proves an open-url request comes from this shell document, not from a
+    // page the iframe later navigated to. Announced with the binding below.
+    // Without secure randomness there is no token, the host never offers to
+    // open links, and links keep their native behavior.
+    var _openUrlToken =
+      window.crypto && typeof window.crypto.getRandomValues === 'function'
+        ? Array.prototype.map.call(window.crypto.getRandomValues(new Uint8Array(16)), function(b) {
+            return ('0' + b.toString(16)).slice(-2);
+          }).join('')
+        : '';
     window.extensionBinding = _extensionBinding;
     // Legacy alias for extension bodies authored before the rename.
     window.toolBinding = _extensionBinding;
@@ -532,10 +542,67 @@ export function buildExtensionHtml(content, themeVars, isDark, extensionId, bind
           type: 'agent-native-extension-binding',
           extensionId: _extensionId,
           binding: _extensionBinding,
+          openUrlToken: _openUrlToken,
         },
         '*',
       );
     } catch (_) {}
+    // A tab opened from this sandboxed iframe inherits the sandbox (an opaque
+    // origin with no cookies), so apps like HubSpot render blank. Once the host
+    // says it can, hand new-tab web links to it: it opens them unsandboxed with
+    // noopener, so the new tab gets no handle on the host page. Without that
+    // reply (no host, a standalone /render, or no token) links stay native, and
+    // window.open is never touched. Set up here, before extension content runs,
+    // so the reply can't be missed and extension globals can't interfere.
+    (function(token) {
+      if (!token) return;
+      var hostOpensLinks = false;
+      window.addEventListener('message', function(event) {
+        if (event.source !== window.parent) return;
+        var msg = event.data;
+        if (msg && msg.type === 'agent-native-extension-open-url-ready') hostOpensLinks = true;
+      });
+      function linkOf(e) {
+        var path = typeof e.composedPath === 'function' ? e.composedPath() : [e.target];
+        for (var i = 0; i < path.length; i++) {
+          var node = path[i];
+          if (node instanceof HTMLAnchorElement || node instanceof HTMLAreaElement) {
+            if (node.hasAttribute('href')) return { element: node, url: node };
+          } else if (node && node.namespaceURI === 'http://www.w3.org/2000/svg' && node.localName === 'a') {
+            // An SVG link's href isn't a URL string; resolve it the way an HTML
+            // link would, against the document's base URL.
+            var raw = node.getAttribute('href') || node.getAttributeNS('http://www.w3.org/1999/xlink', 'href');
+            if (raw) {
+              var resolved = document.createElement('a');
+              resolved.href = raw;
+              return { element: node, url: resolved };
+            }
+          }
+        }
+        return null;
+      }
+      function targetOf(link) {
+        if (link.hasAttribute('target')) return link.getAttribute('target');
+        var base = document.querySelector('base[target]');
+        return base ? base.getAttribute('target') : '';
+      }
+      function route(e) {
+        if (!hostOpensLinks || e.defaultPrevented) return;
+        var link = linkOf(e);
+        if (!link || link.element.hasAttribute('download')) return;
+        if (link.url.protocol !== 'http:' && link.url.protocol !== 'https:') return;
+        var newTab = e.type === 'auxclick'
+          ? e.button === 1
+          : e.button === 0 && !e.altKey &&
+            (e.metaKey || e.ctrlKey || e.shiftKey || /^_blank$/i.test(targetOf(link.element)));
+        if (!newTab) return;
+        e.preventDefault();
+        window.parent.postMessage({ type: 'agent-native-extension-open-url', url: link.url.href, token: token }, '*');
+      }
+      // On window, so extension handlers delegated on document run first.
+      window.addEventListener('click', route);
+      window.addEventListener('auxclick', route);
+    })(_openUrlToken);
     // SECURITY: when the viewer is not the author of this extension, emit a
     // clear console warning. The bridge currently runs every helper with the
     // viewer's session — a malicious shared extension can call any action,

package/dist/integrations/remote-devices-store.js

@@ -1,6 +1,8 @@
 import { getDbExec } from "../db/client.js";
 import { ensureColumnExists, ensureIndexExists, ensureTableExists, } from "../db/ddl-guard.js";
 import { defineStore } from "../db/store-registry.js";
+import { fromMigrationEntries } from "../db/versioned-store-migrations.js";
+import { REMOTE_DEVICE_MIGRATIONS, REMOTE_DEVICE_MIGRATIONS_TABLE, } from "./remote-device-migrations.js";
 export const remoteDevicesStore = defineStore({
     id: "remote_devices",
     migrations: [
@@ -35,6 +37,7 @@ export const remoteDevicesStore = defineStore({
                 await ensureIndexExists("idx_remote_devices_owner", `CREATE INDEX IF NOT EXISTS idx_remote_devices_owner ON integration_remote_devices(owner_email, org_id)`);
             },
         },
+        ...fromMigrationEntries(REMOTE_DEVICE_MIGRATIONS_TABLE, REMOTE_DEVICE_MIGRATIONS),
     ],
 });
 export function ensureTable() {

package/dist/jobs/run-history.d.ts

@@ -1,5 +1,5 @@
 import { type DbExec } from "../db/client.js";
-import { type MigrationEntry } from "../db/migrations.js";
+import type { MigrationEntry } from "../db/migrations.js";
 export type AutomationRunStatus = "running" | "success" | "error" | "interrupted" | "skipped";
 export interface AutomationRun {
     id: string;
@@ -42,7 +42,8 @@ export declare function automationRunClaimLeaseMs(): number;
 /** How many finished runs each automation retains, in addition to unfinished runs. */
 export declare const RUNS_RETAINED_PER_AUTOMATION = 50;
 export declare const AUTOMATION_RUN_MIGRATIONS: MigrationEntry[];
-export declare function runAutomationRunMigrations(nitroApp: unknown): Promise<void>;
+/** Kept for callers of the public export; the store owns these migrations. */
+export declare function runAutomationRunMigrations(_nitroApp?: unknown): Promise<void>;
 export declare const automationRunHistoryStore: import("../db/store-registry.js").Store;
 export declare function ensureTable(): Promise<void>;
 export interface StartAutomationRunOptions {

package/dist/jobs/run-history.js

@@ -3,8 +3,8 @@ import { z } from "zod";
 import { resolveBackgroundRunHardTimeoutMs } from "../agent/run-manager.js";
 import { getDbExec } from "../db/client.js";
 import { ensureColumnExists, ensureIndexExists, ensureTableExists, } from "../db/ddl-guard.js";
-import { runMigrations } from "../db/migrations.js";
 import { defineStore } from "../db/store-registry.js";
+import { fromMigrationEntries } from "../db/versioned-store-migrations.js";
 import { emit as emitBusEvent, registerEvent } from "../event-bus/index.js";
 import { automationRecoveryMessagesForLocale } from "../localization/automation-recovery-messages.js";
 import { decryptSecretValue, encryptSecretValue } from "../secrets/crypto.js";
@@ -122,10 +122,9 @@ export const AUTOMATION_RUN_MIGRATIONS = [
       ADD COLUMN IF NOT EXISTS failure_alert_unsubscribe_token TEXT`,
     },
 ];
-export async function runAutomationRunMigrations(nitroApp) {
-    await runMigrations(AUTOMATION_RUN_MIGRATIONS, {
-        table: "_automation_run_migrations",
-    })(nitroApp);
+/** Kept for callers of the public export; the store owns these migrations. */
+export async function runAutomationRunMigrations(_nitroApp) {
+    await automationRunHistoryStore.ready();
 }
 export const automationRunHistoryStore = defineStore({
     id: "automation_run_history",
@@ -179,6 +178,7 @@ export const automationRunHistoryStore = defineStore({
                 await ensureIndexExists(`idx_${TABLE}_owner_automation`, indexSql);
             },
         },
+        ...fromMigrationEntries("_automation_run_migrations", AUTOMATION_RUN_MIGRATIONS),
     ],
 });
 export function ensureTable() {