@agent-native/core 0.209.2 → 0.209.3-nightly-20261016212700

package/dist/provider-api/actions/provider-api.d.ts

@@ -316,6 +316,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
+        id?: undefined;
+        deleted?: undefined;
         message?: undefined;
         providers: {
             id: string;
@@ -329,33 +331,31 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         count: number;
         provider?: undefined;
         found?: undefined;
-        deleted?: undefined;
         registered?: undefined;
-        id?: undefined;
         label?: undefined;
     } | {
-        message?: undefined;
+        id?: undefined;
+        deleted?: undefined;
         count?: undefined;
+        message?: undefined;
         providers?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
-        deleted?: undefined;
         registered?: undefined;
-        id?: undefined;
         label?: undefined;
     } | {
-        message?: undefined;
+        deleted?: undefined;
         count?: undefined;
+        message?: undefined;
         providers?: undefined;
         provider?: undefined;
         found: boolean;
         id: string;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
     } | {
-        message?: undefined;
         count?: undefined;
+        message?: undefined;
         providers?: undefined;
         provider?: undefined;
         found?: undefined;
@@ -364,11 +364,11 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         registered?: undefined;
         label?: undefined;
     } | {
+        deleted?: undefined;
         count?: undefined;
         providers?: undefined;
         provider?: undefined;
         found?: undefined;
-        deleted?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/resources/store.js

@@ -3,6 +3,7 @@ import { getDbExec } from "../db/client.js";
 import { ensureColumnExists, ensureIndexExists, ensureTableExists, } from "../db/ddl-guard.js";
 import { isMigrationAuthorizedRuntime } from "../db/migration-runtime.js";
 import { retainRequestDbPoolScope } from "../db/request-pool-context.js";
+import { isRecordingStoreMigration } from "../db/runtime-facts.js";
 import { defineStore } from "../db/store-registry.js";
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 import { noteJobFrontmatterWrite } from "../jobs/frontmatter-loss.js";
@@ -866,8 +867,9 @@ export const resourcesStore = defineStore({
             run: async () => {
                 await ensureIndexExists("resources_visibility_expires_idx", `CREATE INDEX IF NOT EXISTS resources_visibility_expires_idx ON resources (visibility, expires_at)`).catch((err) => {
                     // At release, fail so the ledger never records an index that was not built.
-                    if (isMigrationAuthorizedRuntime())
+                    if (isMigrationAuthorizedRuntime() || isRecordingStoreMigration()) {
                         throw err;
+                    }
                     // An index is an optimization, not a correctness requirement: a
                     // concurrent creator or a permissions edge must not fail table init and
                     // take the app down with it. The scan it avoids is slow, not wrong — but
@@ -889,8 +891,9 @@ export const resourcesStore = defineStore({
                 // `CREATE INDEX CONCURRENTLY` without creating anything (see the matching
                 // note in chat-threads/store.ts). A plain build is the form that lands.
                 await ensureIndexExists("resources_path_pattern_idx", `CREATE INDEX IF NOT EXISTS resources_path_pattern_idx ON resources (path text_pattern_ops)`).catch((err) => {
-                    if (isMigrationAuthorizedRuntime())
+                    if (isMigrationAuthorizedRuntime() || isRecordingStoreMigration()) {
                         throw err;
+                    }
                     // coercion-ok: absence of an index degrades latency, never correctness
                     console.warn("[resources] could not ensure resources_path_pattern_idx; prefix reads such as the jobs/ fingerprint will full-scan:", err?.message ?? err);
                 });

package/dist/server/agent-access.js

@@ -1,5 +1,5 @@
 import { DEFAULT_AGENT_ACCESS_TTL_SECONDS, scopedAgentAccessResourceId, } from "../shared/agent-access.js";
-import { signCompactShortLivedToken, verifyCompactShortLivedToken, verifyShortLivedToken, } from "./short-lived-token.js";
+import { signCompactShortLivedToken, verifyCompactShortLivedToken, } from "./short-lived-token.js";
 export { AGENT_ACCESS_PARAM, DEFAULT_AGENT_ACCESS_TTL_SECONDS, appendAgentAccessParam, buildAgentAccessApiUrl, buildAgentAccessUrl, normalizeAgentAccessBasePath, normalizeAgentAccessOrigin, scopedAgentAccessResourceId, toAgentAccessUrl, } from "../shared/agent-access.js";
 export function signScopedAgentAccessToken({ resourceKind, resourceId, viewerEmail, agentLabel, ttlSeconds = DEFAULT_AGENT_ACCESS_TTL_SECONDS, }) {
     return signCompactShortLivedToken({
@@ -12,11 +12,7 @@ export function signScopedAgentAccessToken({ resourceKind, resourceId, viewerEma
 export function verifyScopedAgentAccessToken(token, scope) {
     if (!token)
         return { ok: false, reason: "missing" };
-    const resourceId = scopedAgentAccessResourceId(scope.resourceKind, scope.resourceId);
-    const compact = verifyCompactShortLivedToken(token, resourceId);
-    if (compact.ok || compact.reason !== "bad_signature")
-        return compact;
-    return verifyShortLivedToken(token, resourceId);
+    return verifyCompactShortLivedToken(token, scopedAgentAccessResourceId(scope.resourceKind, scope.resourceId));
 }
 export function createScopedAgentAccessGrant(options) {
     const ttlSeconds = options.ttlSeconds ?? DEFAULT_AGENT_ACCESS_TTL_SECONDS;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -67,12 +67,12 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     code: any;
 } | {
     errorCode?: undefined;
-    error?: undefined;
     code?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
     defaultModel?: import("./agent-engine-default-model-route.js").SavedKeyDefaultModelOutcome;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/agent-engine-default-model-route.d.ts

@@ -8,8 +8,8 @@ export declare const AGENT_ENGINE_API_KEY_ACTION_NAME = "agent-engine-api-key";
  * resolveEngine's credential detection.
  */
 export declare function createAgentEngineDisconnectHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
     scope?: undefined;
 } | {
     ok: boolean;

package/dist/server/auth-plugin.js

@@ -1,12 +1,8 @@
-import { runMigrations } from "../db/migrations.js";
-import { ORG_MIGRATIONS } from "../org/migrations.js";
+import { orgStore } from "../org/schema-store.js";
 import { authSessionHandler, autoMountAuth } from "./auth.js";
 import { runBetterAuthMigrations } from "./better-auth-migrations.js";
 import { FRAMEWORK_AUTH_EARLY_PATHS, getH3App, markDefaultPluginProvided, markFrameworkRoutesReadyBeforeBootstrap, trackPluginInit, } from "./framework-request-handler.js";
 export function createAuthPlugin(options) {
-    const migrateOrgSchema = runMigrations(ORG_MIGRATIONS, {
-        table: "_org_migrations",
-    });
     return (nitroApp) => {
         markDefaultPluginProvided(nitroApp, "auth");
         const isByoa = Boolean(options?.getSession);
@@ -38,7 +34,7 @@ export function createAuthPlugin(options) {
             // transaction, where a missing table aborts the sign-up. The org
             // plugin migrates only after the whole bootstrap, too late for that.
             const mountPromise = runBetterAuthMigrations(nitroApp)
-                .then(() => migrateOrgSchema(nitroApp))
+                .then(() => orgStore.ready())
                 .then(() => autoMountAuth(app, options));
             markFrameworkRoutesReadyBeforeBootstrap(nitroApp, FRAMEWORK_AUTH_EARLY_PATHS);
             await mountPromise;

package/dist/server/auth.js

@@ -802,11 +802,21 @@ export async function getMcpOAuthBearerSession(event) {
     const bearerToken = getBearerSessionToken(event);
     if (!bearerToken)
         return null;
+    let identityVerificationUnavailableErrorClass;
+    let identityVerificationRefusedErrorClass;
+    let connectUrl;
     try {
-        const [{ getMcpConnectUrl, getMcpOAuthAudiences }, { verifyAuth, resolveMcpIdentityOrgId },] = await Promise.all([
+        const [oauthRoute, mcp] = await Promise.all([
             import("../mcp/oauth-route.js"),
             import("../mcp/build-server.js"),
         ]);
+        connectUrl = oauthRoute.getMcpConnectUrl(event);
+        identityVerificationUnavailableErrorClass =
+            mcp.McpIdentityVerificationUnavailableError;
+        identityVerificationRefusedErrorClass =
+            mcp.McpIdentityVerificationRefusedError;
+        const { getMcpOAuthAudiences } = oauthRoute;
+        const { verifyAuth, resolveMcpIdentityOrgId } = mcp;
         const result = await verifyAuth(authHeader, undefined, {
             resourceUrl: getMcpOAuthAudiences(event),
             allowDevOpen: false,
@@ -818,7 +828,7 @@ export async function getMcpOAuthBearerSession(event) {
         }
         if (!result.authed) {
             if (result.refusal) {
-                markBearerCredentialRefused(event, result.refusal, getMcpConnectUrl(event));
+                markBearerCredentialRefused(event, result.refusal, connectUrl);
             }
             return null;
         }
@@ -843,6 +853,16 @@ export async function getMcpOAuthBearerSession(event) {
         };
     }
     catch (e) {
+        if (identityVerificationRefusedErrorClass &&
+            e instanceof identityVerificationRefusedErrorClass) {
+            markBearerCredentialRefused(event, "invalid", connectUrl);
+            return null;
+        }
+        if (identityVerificationUnavailableErrorClass &&
+            e instanceof identityVerificationUnavailableErrorClass) {
+            markCredentialMembershipUnavailable(event);
+            return null;
+        }
         console.error("[auth] MCP OAuth bearer verification error:", e);
         return null;
     }

package/dist/server/better-auth-migrations.d.ts

@@ -1,4 +1,4 @@
-import { type MigrationEntry } from "../db/migrations.js";
+import type { MigrationEntry } from "../db/migrations.js";
 /**
  * Better Auth encrypts persisted JWT private keys with the current auth
  * secret. If that secret is rotated, the old row remains the newest key and
@@ -19,4 +19,6 @@ export declare function expireJwksKeysAfterAuthSecretRotation(): Promise<void>;
  * be able to construct the auth adapter without probing or creating tables.
  */
 export declare const BETTER_AUTH_MIGRATIONS: MigrationEntry[];
-export declare function runBetterAuthMigrations(nitroApp: unknown): Promise<void>;
+export declare const betterAuthStore: import("../db/store-registry.js").Store;
+/** Kept for callers of the public export; the store owns these migrations. */
+export declare function runBetterAuthMigrations(_nitroApp?: unknown): Promise<void>;

package/dist/server/better-auth-migrations.js

@@ -1,4 +1,5 @@
-import { runMigrations } from "../db/migrations.js";
+import { defineStore } from "../db/store-registry.js";
+import { fromMigrationEntries } from "../db/versioned-store-migrations.js";
 async function assertBetterAuthUserIdentityColumns() {
     const { getDbExec } = await import("../db/client.js");
     const { rows } = await getDbExec().execute(`SELECT column_name FROM information_schema.columns WHERE table_schema = current_schema() AND table_name = 'user' AND column_name IN ('id', 'email')`);
@@ -170,7 +171,9 @@ export const BETTER_AUTH_MIGRATIONS = [
         },
     },
     {
-        version: 5,
+        // Shipped as a second v5. Named entries are gated by name, so the new
+        // number changes nothing for databases that already applied it.
+        version: 11,
         name: "better-auth-user-lower-email-index",
         sql: {
             postgres: 'CREATE INDEX IF NOT EXISTS better_auth_user_lower_email_idx ON "user" (LOWER(email))',
@@ -447,8 +450,17 @@ export const BETTER_AUTH_MIGRATIONS = [
         },
     },
 ];
-export async function runBetterAuthMigrations(nitroApp) {
-    await runMigrations(BETTER_AUTH_MIGRATIONS, {
-        table: "_better_auth_migrations",
-    })(nitroApp);
+export const betterAuthStore = defineStore({
+    id: "better_auth",
+    // v3 creates the legacy `sessions` table the auth-sessions store owns; on
+    // main every store ran before this list.
+    after: ["auth_sessions"],
+    migrations: fromMigrationEntries("_better_auth_migrations", BETTER_AUTH_MIGRATIONS, 
+    // v4 expires every active signing key: it must run at most once per
+    // database, which the ledger (or the imported old bookkeeping) guarantees.
+    { ranAtBoot: true, data: [4] }),
+});
+/** Kept for callers of the public export; the store owns these migrations. */
+export async function runBetterAuthMigrations(_nitroApp) {
+    await betterAuthStore.ready();
 }

package/dist/server/identity-sso-store.js

@@ -2,6 +2,8 @@ import { randomBytes } from "node:crypto";
 import { getDbExec, isConnectionError } from "../db/client.js";
 import { ensureTableExists } from "../db/ddl-guard.js";
 import { defineStore } from "../db/store-registry.js";
+import { fromMigrationEntries } from "../db/versioned-store-migrations.js";
+import { IDENTITY_SSO_MIGRATIONS } from "./identity-sso-migrations.js";
 const DESKTOP_SSO_USER_AGENT = /AgentNativeDesktop(?:SsoCanary)?\//i;
 const DESKTOP_SSO_CANARY_USER_AGENT = /AgentNativeDesktopSsoCanary\//i;
 export const CANONICAL_IDENTITY_SSO_HUB_URL = "https://dispatch.agent-native.com";
@@ -223,6 +225,7 @@ export const identitySsoStore = defineStore({
                 await ensureTableExists("identity_sso_jti", buildIdentitySsoJtiCreateSql());
             },
         },
+        ...fromMigrationEntries("_identity_sso_migrations", IDENTITY_SSO_MIGRATIONS),
     ],
 });
 export function ensureTable() {

package/dist/server/realtime-token.d.ts

@@ -54,8 +54,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/server/release-migrations.d.ts

@@ -1 +1 @@
-export declare function runFrameworkReleaseMigrations(nitroApp: unknown): Promise<void>;
+export declare function runFrameworkReleaseMigrations(_nitroApp?: unknown): Promise<void>;

package/dist/server/release-migrations.js

@@ -1,26 +1,8 @@
-import { CONTEXT_XRAY_MIGRATIONS } from "../agent/context-xray/migrations.js";
-import { AGENT_HARNESS_SESSION_MIGRATIONS, AGENT_HARNESS_SESSION_MIGRATIONS_TABLE, } from "../agent/harness/migrations.js";
-import { OBSERVATIONAL_MEMORY_MIGRATIONS } from "../agent/observational-memory/migrations.js";
-import { AGENT_RUN_MIGRATIONS, AGENT_RUN_MIGRATIONS_TABLE, } from "../agent/run-migrations.js";
-import { AGENT_TOOL_APPROVAL_MIGRATIONS, AGENT_TOOL_APPROVAL_MIGRATIONS_TABLE, } from "../agent/tool-approval-migrations.js";
 import { getAppConfig } from "../app-config/index.js";
-import { CHAT_THREAD_SCHEMA_MIGRATIONS, CHAT_THREAD_SCHEMA_MIGRATIONS_TABLE, } from "../chat-threads/schema-migrations.js";
 import { getDatabaseUrl } from "../db/client.js";
-import { runMigrations } from "../db/migrations.js";
 import { withStoreMigrationLock } from "../db/store-registry.js";
-import { REMOTE_DEVICE_MIGRATIONS, REMOTE_DEVICE_MIGRATIONS_TABLE, } from "../integrations/remote-device-migrations.js";
-import { runAutomationRunMigrations } from "../jobs/run-history.js";
-import { runAutomationSchedulerHealthMigrations } from "../jobs/scheduler-health.js";
-import { OAUTH_TOKEN_MIGRATIONS, OAUTH_TOKEN_MIGRATIONS_TABLE, } from "../oauth-tokens/migrations.js";
-import { OBSERVABILITY_MIGRATIONS, OBSERVABILITY_MIGRATIONS_TABLE, } from "../observability/migrations.js";
-import { ORG_MIGRATIONS } from "../org/migrations.js";
 import { ensureSharingAccessIndexes } from "../sharing/indexes.js";
-import { runAutomationTriggerEventMigrations } from "../triggers/event-queue.js";
-import { USAGE_ALERT_MIGRATIONS, USAGE_ALERT_MIGRATIONS_TABLE, } from "../usage/migrations.js";
-import { WORKSPACE_CONNECTIONS_MIGRATIONS, WORKSPACE_CONNECTIONS_MIGRATIONS_TABLE, } from "../workspace-connections/migrations.js";
-import { runBetterAuthMigrations } from "./better-auth-migrations.js";
 import { recordDatabaseIdentity } from "./database-identity.js";
-import { IDENTITY_SSO_MIGRATIONS } from "./identity-sso-migrations.js";
 import { runFrameworkSchemaEnsures } from "./release-schema.js";
 /**
  * A release deploy whose `DATABASE_URL` resolves to a local development
@@ -62,57 +44,13 @@ function describeReleaseMigrationUrl(url) {
     const scheme = url.includes("://") ? url.split("://")[0] : undefined;
     return scheme ? `${scheme} url` : "no scheme — likely a masked secret";
 }
-export async function runFrameworkReleaseMigrations(nitroApp) {
+export async function runFrameworkReleaseMigrations(_nitroApp) {
     assertReleaseMigrationTargetsRemoteDatabase();
-    // One lease for the whole release: the store pass, Better Auth and every
-    // versioned list, so two deploys against one database never interleave.
+    // One lease for the whole release, so two deploys against one database
+    // never interleave.
     await withStoreMigrationLock(async () => {
-        // First: the versioned migration lists below only cover the tables that have
-        // one. Most framework tables are defined by their store's `ensureTable()`,
-        // which production serverless can never run — see `./release-schema.ts`.
         await runFrameworkSchemaEnsures();
         await recordDatabaseIdentity();
-        await runBetterAuthMigrations(nitroApp);
-        await runMigrations(AGENT_TOOL_APPROVAL_MIGRATIONS, {
-            table: AGENT_TOOL_APPROVAL_MIGRATIONS_TABLE,
-        })(nitroApp);
-        await runMigrations(OAUTH_TOKEN_MIGRATIONS, {
-            table: OAUTH_TOKEN_MIGRATIONS_TABLE,
-        })(nitroApp);
-        await runMigrations(CHAT_THREAD_SCHEMA_MIGRATIONS, {
-            table: CHAT_THREAD_SCHEMA_MIGRATIONS_TABLE,
-        })(nitroApp);
-        await runMigrations(OBSERVABILITY_MIGRATIONS, {
-            table: OBSERVABILITY_MIGRATIONS_TABLE,
-        })(nitroApp);
-        await runMigrations(AGENT_RUN_MIGRATIONS, {
-            table: AGENT_RUN_MIGRATIONS_TABLE,
-        })(nitroApp);
-        await runMigrations(AGENT_HARNESS_SESSION_MIGRATIONS, {
-            table: AGENT_HARNESS_SESSION_MIGRATIONS_TABLE,
-        })(nitroApp);
-        await runMigrations(USAGE_ALERT_MIGRATIONS, {
-            table: USAGE_ALERT_MIGRATIONS_TABLE,
-        })(nitroApp);
-        await runMigrations(ORG_MIGRATIONS, { table: "_org_migrations" })(nitroApp);
-        await runMigrations(REMOTE_DEVICE_MIGRATIONS, {
-            table: REMOTE_DEVICE_MIGRATIONS_TABLE,
-        })(nitroApp);
-        await runMigrations(IDENTITY_SSO_MIGRATIONS, {
-            table: "_identity_sso_migrations",
-        })(nitroApp);
-        await runMigrations(CONTEXT_XRAY_MIGRATIONS, {
-            table: "_context_xray_migrations",
-        })(nitroApp);
-        await runMigrations(OBSERVATIONAL_MEMORY_MIGRATIONS, {
-            table: "_observational_memory_migrations",
-        })(nitroApp);
-        await runMigrations(WORKSPACE_CONNECTIONS_MIGRATIONS, {
-            table: WORKSPACE_CONNECTIONS_MIGRATIONS_TABLE,
-        })(nitroApp);
-        await runAutomationRunMigrations(nitroApp);
-        await runAutomationTriggerEventMigrations(nitroApp);
-        await runAutomationSchedulerHealthMigrations(nitroApp);
         // Last, so the framework's own share and owner tables exist. An app's tables
         // are indexed by the release after the one that creates them.
         await ensureSharingAccessIndexes();

package/dist/server/release-schema.js

@@ -9,11 +9,16 @@
  */
 import { isMigrationAuthorizedRuntime } from "../db/migration-runtime.js";
 import { FRAMEWORK_STORES } from "../db/store-registry.generated.js";
-import { SchemaNotMigratedError, findUnappliedStoreMigrations, withStoreMigrationLock, } from "../db/store-registry.js";
+import { SchemaNotMigratedError, findUnappliedStoreMigrations, orderStoresForRelease, withStoreMigrationLock, } from "../db/store-registry.js";
 const FRAMEWORK_SCHEMA_ENSURES = FRAMEWORK_STORES.map(([id, load]) => [id, () => load().then((store) => store.ready())]);
 export function frameworkSchemaEnsureNames() {
     return FRAMEWORK_SCHEMA_ENSURES.map(([name]) => name);
 }
+/** Every registered store, loaded and ordered by its `after` dependencies. */
+async function orderedFrameworkEnsures() {
+    const stores = await Promise.all(FRAMEWORK_STORES.map(([, load]) => load()));
+    return orderStoresForRelease(stores).map((store) => [store.id, () => store.ready()]);
+}
 /**
  * Create every framework-owned table, in one pass, before the app serves
  * traffic. Callers must hold migration duty via `withMigrationRuntime`; without
@@ -31,8 +36,11 @@ export async function runFrameworkSchemaEnsures(ensures = FRAMEWORK_SCHEMA_ENSUR
     if (!isMigrationAuthorizedRuntime()) {
         throw new Error("runFrameworkSchemaEnsures must run inside withMigrationRuntime(); outside it no store is migrated.");
     }
+    const pass = ensures === FRAMEWORK_SCHEMA_ENSURES
+        ? await orderedFrameworkEnsures()
+        : ensures;
     await withStoreMigrationLock(async () => {
-        for (const [name, run] of ensures) {
+        for (const [name, run] of pass) {
             try {
                 await run();
             }

package/dist/server/short-lived-token.d.ts

@@ -34,8 +34,9 @@ export declare function verifyShortLivedToken(token: string, expectedResourceId:
 export declare function signCompactShortLivedToken(claims: ShortLivedTokenClaims): string;
 /**
  * Verify a token produced by {@link signCompactShortLivedToken}. A token for a
- * different resource, and any legacy token, fails as `bad_signature` — the id
- * is not in the payload, so a mismatch is indistinguishable from tampering.
+ * different resource, and any `signShortLivedToken` token, fails as
+ * `bad_signature` — the id is not in the payload, so a mismatch is
+ * indistinguishable from tampering.
  */
 export declare function verifyCompactShortLivedToken(token: string, expectedResourceId: string): VerifyResult;
 /** Payload `typ` discriminator for realtime subscribe tokens. */

package/dist/server/short-lived-token.js

@@ -123,8 +123,9 @@ export function signCompactShortLivedToken(claims) {
 }
 /**
  * Verify a token produced by {@link signCompactShortLivedToken}. A token for a
- * different resource, and any legacy token, fails as `bad_signature` — the id
- * is not in the payload, so a mismatch is indistinguishable from tampering.
+ * different resource, and any `signShortLivedToken` token, fails as
+ * `bad_signature` — the id is not in the payload, so a mismatch is
+ * indistinguishable from tampering.
  */
 export function verifyCompactShortLivedToken(token, expectedResourceId) {
     if (typeof token !== "string" || !token.includes(".")) {

package/dist/triggers/actions/manage-automation.d.ts

@@ -14,6 +14,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     executionCwd?: string;
 }, {
     deleted?: undefined;
+    enabled?: undefined;
     created: boolean;
     name: string;
     scope: "organization" | "personal";
@@ -24,25 +25,24 @@ declare const _default: import("../../action.js").ActionDefinition<{
     reasoningEffort: "auto" | "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh";
     webhookPath: string;
     nextRun: string;
-    enabled?: undefined;
     executionHostId?: undefined;
     executionEngine?: undefined;
     executionCwd?: undefined;
 } | {
+    enabled?: undefined;
+    nextRun?: undefined;
     created?: undefined;
     scope?: undefined;
     triggerType?: undefined;
     event?: undefined;
     deleted: boolean;
     name: string;
-    enabled?: undefined;
     schedule?: undefined;
     timezone?: undefined;
     reasoningEffort?: undefined;
     executionHostId?: undefined;
     executionEngine?: undefined;
     executionCwd?: undefined;
-    nextRun?: undefined;
     webhookPath?: undefined;
 } | {
     deleted?: undefined;

package/dist/triggers/event-queue.d.ts

@@ -1,11 +1,13 @@
-import { type MigrationEntry } from "../db/migrations.js";
+import type { MigrationEntry } from "../db/migrations.js";
 export declare const AUTOMATION_TRIGGER_EVENT_DEDUPE_RETENTION_MS: number;
 export declare const AUTOMATION_TRIGGER_EVENT_PURGE_BATCH_SIZE = 1000;
 export declare const AUTOMATION_TRIGGER_EVENT_EXPIRY_BATCH_SIZE = 1000;
 export declare const MAX_AUTOMATION_TRIGGER_EVENT_FAILURES = 8;
 declare const CLAIM_LEASE_MS: () => number;
 export declare const AUTOMATION_TRIGGER_EVENT_MIGRATIONS: MigrationEntry[];
-export declare function runAutomationTriggerEventMigrations(nitroApp: unknown): Promise<void>;
+export declare const automationTriggerEventsStore: import("../db/store-registry.js").Store;
+/** Kept for callers of the export; the store owns these migrations. */
+export declare function runAutomationTriggerEventMigrations(_nitroApp?: unknown): Promise<void>;
 export declare function ensureAutomationTriggerEventQueue(): Promise<void>;
 export interface EnqueueAutomationTriggerEventInput {
     triggerId: string;

package/dist/triggers/event-queue.js

@@ -1,10 +1,9 @@
-// guard:allow-unreleased-schema — owned by the versioned AUTOMATION_TRIGGER_EVENT_MIGRATIONS list in release-migrations.ts until Phase 2 folds versioned lists into stores
 import { randomUUID } from "node:crypto";
 import { resolveBackgroundRunHardTimeoutMs } from "../agent/run-manager.js";
 import { getDbExec } from "../db/client.js";
 import { ensureColumnExists, ensureIndexExists, ensureTableExists, } from "../db/ddl-guard.js";
-import { runMigrations } from "../db/migrations.js";
-import { retainRequestDbPoolScope } from "../db/request-pool-context.js";
+import { defineStore } from "../db/store-registry.js";
+import { fromMigrationEntries } from "../db/versioned-store-migrations.js";
 const TABLE = "automation_trigger_event_queue";
 const SWEEP_STATE_TABLE = "automation_trigger_event_queue_sweep_state";
 const COMPLETED_PAYLOAD = '{"kind":"completed"}';
@@ -91,42 +90,43 @@ export const AUTOMATION_TRIGGER_EVENT_MIGRATIONS = [
       WHERE status IN ('pending', 'processing')`,
     },
 ];
-export async function runAutomationTriggerEventMigrations(nitroApp) {
-    await runMigrations(AUTOMATION_TRIGGER_EVENT_MIGRATIONS, {
-        table: "_automation_trigger_event_migrations",
-    })(nitroApp);
+export const automationTriggerEventsStore = defineStore({
+    id: "automation_trigger_events",
+    migrations: [
+        {
+            name: "baseline",
+            run: async () => {
+                await ensureTableExists(TABLE, CREATE_TABLE_SQL);
+                await ensureTableExists(SWEEP_STATE_TABLE, CREATE_SWEEP_STATE_TABLE_SQL);
+                await ensureColumnExists(TABLE, "failure_attempts", `ALTER TABLE ${TABLE}
+            ADD COLUMN IF NOT EXISTS failure_attempts BIGINT NOT NULL DEFAULT 0`);
+                await ensureIndexExists(UNIQUE_INDEX, `CREATE UNIQUE INDEX IF NOT EXISTS ${UNIQUE_INDEX}
+            ON ${TABLE} (trigger_id, event_id)`);
+                await ensureIndexExists(ORDER_INDEX, `CREATE INDEX IF NOT EXISTS ${ORDER_INDEX}
+            ON ${TABLE} (trigger_id, sequence_id, status)`);
+                await ensureIndexExists(READY_INDEX, `CREATE INDEX IF NOT EXISTS ${READY_INDEX}
+            ON ${TABLE} (app_id, status, available_at, claimed_at)`);
+                await ensureIndexExists(ACTIVE_HEAD_INDEX, `CREATE INDEX IF NOT EXISTS ${ACTIVE_HEAD_INDEX}
+            ON ${TABLE} (app_id, trigger_id, sequence_id)
+            WHERE status IN ('pending', 'processing')`);
+                await ensureIndexExists(FAILED_INDEX, `CREATE INDEX IF NOT EXISTS ${FAILED_INDEX}
+            ON ${TABLE} (completed_at) WHERE status = 'failed'`);
+                await ensureIndexExists(STALE_EVENT_INDEX, `CREATE INDEX IF NOT EXISTS ${STALE_EVENT_INDEX}
+            ON ${TABLE} (app_id, event_name, emitted_at)
+            WHERE status = 'pending'`);
+                await ensureIndexExists(COMPLETED_INDEX, `CREATE INDEX IF NOT EXISTS ${COMPLETED_INDEX}
+            ON ${TABLE} (completed_at) WHERE status = 'completed'`);
+            },
+        },
+        ...fromMigrationEntries("_automation_trigger_event_migrations", AUTOMATION_TRIGGER_EVENT_MIGRATIONS),
+    ],
+});
+/** Kept for callers of the export; the store owns these migrations. */
+export async function runAutomationTriggerEventMigrations(_nitroApp) {
+    await automationTriggerEventsStore.ready();
 }
-let _initPromise;
-export async function ensureAutomationTriggerEventQueue() {
-    if (!_initPromise) {
-        const _initPromiseWithRequestDbPoolScope = (async () => {
-            await ensureTableExists(TABLE, CREATE_TABLE_SQL);
-            await ensureTableExists(SWEEP_STATE_TABLE, CREATE_SWEEP_STATE_TABLE_SQL);
-            await ensureColumnExists(TABLE, "failure_attempts", `ALTER TABLE ${TABLE}
-          ADD COLUMN IF NOT EXISTS failure_attempts BIGINT NOT NULL DEFAULT 0`);
-            await ensureIndexExists(UNIQUE_INDEX, `CREATE UNIQUE INDEX IF NOT EXISTS ${UNIQUE_INDEX}
-          ON ${TABLE} (trigger_id, event_id)`);
-            await ensureIndexExists(ORDER_INDEX, `CREATE INDEX IF NOT EXISTS ${ORDER_INDEX}
-          ON ${TABLE} (trigger_id, sequence_id, status)`);
-            await ensureIndexExists(READY_INDEX, `CREATE INDEX IF NOT EXISTS ${READY_INDEX}
-          ON ${TABLE} (app_id, status, available_at, claimed_at)`);
-            await ensureIndexExists(ACTIVE_HEAD_INDEX, `CREATE INDEX IF NOT EXISTS ${ACTIVE_HEAD_INDEX}
-          ON ${TABLE} (app_id, trigger_id, sequence_id)
-          WHERE status IN ('pending', 'processing')`);
-            await ensureIndexExists(FAILED_INDEX, `CREATE INDEX IF NOT EXISTS ${FAILED_INDEX}
-          ON ${TABLE} (completed_at) WHERE status = 'failed'`);
-            await ensureIndexExists(STALE_EVENT_INDEX, `CREATE INDEX IF NOT EXISTS ${STALE_EVENT_INDEX}
-          ON ${TABLE} (app_id, event_name, emitted_at)
-          WHERE status = 'pending'`);
-            await ensureIndexExists(COMPLETED_INDEX, `CREATE INDEX IF NOT EXISTS ${COMPLETED_INDEX}
-          ON ${TABLE} (completed_at) WHERE status = 'completed'`);
-        })().catch((error) => {
-            _initPromise = undefined;
-            throw error;
-        });
-        _initPromise = retainRequestDbPoolScope(_initPromiseWithRequestDbPoolScope);
-    }
-    return _initPromise;
+export function ensureAutomationTriggerEventQueue() {
+    return automationTriggerEventsStore.ready();
 }
 function rowToEvent(row) {
     if (row.claimed_at == null || !Number.isFinite(Number(row.claimed_at))) {

package/dist/usage/alerts-store.js

@@ -1,8 +1,10 @@
 import { getDbExec } from "../db/client.js";
 import { ensureColumnExists, ensureIndexExists, ensureTableExists, } from "../db/ddl-guard.js";
 import { defineStore } from "../db/store-registry.js";
+import { fromMigrationEntries } from "../db/versioned-store-migrations.js";
 import { deleteNotification, notifyWithDelivery, } from "../notifications/index.js";
 import { ForbiddenError } from "../sharing/access.js";
+import { USAGE_ALERT_MIGRATIONS, USAGE_ALERT_MIGRATIONS_TABLE, } from "./migrations.js";
 import { builderCreditsFromCostCents } from "./store.js";
 const DAY_MS = 86_400_000;
 const DEFAULT_DAILY_USD = 100;
@@ -128,6 +130,7 @@ export const usageAlertsStore = defineStore({
                 }
             },
         },
+        ...fromMigrationEntries(USAGE_ALERT_MIGRATIONS_TABLE, USAGE_ALERT_MIGRATIONS),
     ],
 });
 export function ensureTables() {

package/dist/workspace-connections/groups.js

@@ -2,8 +2,10 @@ import { randomUUID } from "node:crypto";
 import { getDbExec, isUniqueViolation, retryOnDdlRace, safeJsonParse, } from "../db/client.js";
 import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
 import { defineStore } from "../db/store-registry.js";
+import { fromMigrationEntries } from "../db/versioned-store-migrations.js";
 import { isOrgMember } from "../org/membership.js";
 import { getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
+import { WORKSPACE_CONNECTIONS_MIGRATIONS, WORKSPACE_CONNECTIONS_MIGRATIONS_TABLE, } from "./migrations.js";
 export function workspaceUserGroupsTable() {
     return "public.workspace_user_groups";
 }
@@ -124,6 +126,7 @@ async function ensureWorkspaceUserGroupNameTrigger(client) {
 }
 export const workspaceUserGroupsStore = defineStore({
     id: "workspace_user_groups",
+    after: ["workspace_connections"],
     // Hosted requests never created these tables on main, release-owned or not.
     releaseOnly: true,
     migrations: [
@@ -153,6 +156,7 @@ export const workspaceUserGroupsStore = defineStore({
              WHERE normalized_name IS NOT NULL`);
             },
         },
+        ...fromMigrationEntries(WORKSPACE_CONNECTIONS_MIGRATIONS_TABLE, WORKSPACE_CONNECTIONS_MIGRATIONS.filter((entry) => entry.version >= 8)),
     ],
 });
 export function ensureWorkspaceUserGroupsTable() {