@agent-native/core 0.77.7 → 0.77.10

package/corpus/core/src/server/embed-session.ts

@@ -9,7 +9,8 @@ import {
   setResponseHeader,
 } from "h3";
 
-import { getDbExec, intType } from "../db/client.js";
+import { getDbExec, intType, isPostgres } from "../db/client.js";
+import { ensureTableExists } from "../db/ddl-guard.js";
 import {
   EMBED_MODE_QUERY_PARAM,
   EMBED_SESSION_COOKIE,
@@ -103,8 +104,10 @@ export type ResolvedEmbedSession = {
 async function ensureTable(): Promise<void> {
   if (!_initPromise) {
     _initPromise = (async () => {
-      const client = getDbExec();
-      await client.execute(`
+      // Build the CREATE SQL here (not at module scope) so intType() runs at
+      // RUNTIME, not import time — a module-scope call breaks any consumer whose
+      // db/client mock doesn't stub intType (e.g. db-admin specs).
+      const embedTicketsCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_native_embed_tickets (
           ticket_hash TEXT PRIMARY KEY,
           owner_email TEXT NOT NULL,
@@ -115,7 +118,19 @@ async function ensureTable(): Promise<void> {
           expires_at ${intType()} NOT NULL,
           consumed_at ${intType()}
         )
-      `);
+      `;
+      if (isPostgres()) {
+        // PG guard: probe → guarded DDL → re-probe; skips lock on already-migrated path
+        await ensureTableExists(
+          "agent_native_embed_tickets",
+          embedTicketsCreateSql,
+        );
+        return;
+      }
+
+      // SQLite (local dev): no lock problem — keep the original behaviour.
+      const client = getDbExec();
+      await client.execute(embedTicketsCreateSql);
     })().catch((err) => {
       _initPromise = undefined;
       throw err;

package/corpus/core/src/server/identity-sso-store.ts

@@ -24,7 +24,13 @@
 
 import { randomBytes } from "node:crypto";
 
-import { getDbExec, isConnectionError, intType } from "../db/client.js";
+import {
+  getDbExec,
+  isConnectionError,
+  intType,
+  isPostgres,
+} from "../db/client.js";
+import { ensureTableExists } from "../db/ddl-guard.js";
 
 let _initPromise: Promise<void> | undefined;
 
@@ -98,13 +104,11 @@ export const SSO_STATE_TTL_MS = 10 * 60_000;
 export const SSO_LOGIN_MAX = 60;
 export const SSO_LOGIN_WINDOW_MS = 60_000;
 
-async function ensureTable(): Promise<void> {
-  if (!_initPromise) {
-    _initPromise = (async () => {
-      const client = getDbExec();
-      // Additive only. Never DROP / ALTER — this DB is shared across every
-      // deploy context (preview/branch/prod) for hosted templates.
-      await client.execute(`
+// Build the CREATE SQL lazily (not at module scope) so intType() runs at
+// RUNTIME, not import time — a module-scope call breaks any consumer whose
+// db/client mock doesn't stub intType (e.g. db-admin specs).
+function buildIdentitySsoStateCreateSql(): string {
+  return `
         CREATE TABLE IF NOT EXISTS identity_sso_state (
           state TEXT PRIMARY KEY,
           return_path TEXT,
@@ -112,13 +116,38 @@ async function ensureTable(): Promise<void> {
           expires_at ${intType()},
           consumed_at ${intType()}
         )
-      `);
-      await client.execute(`
+      `;
+}
+function buildIdentitySsoJtiCreateSql(): string {
+  return `
         CREATE TABLE IF NOT EXISTS identity_sso_jti (
           jti TEXT PRIMARY KEY,
           seen_at ${intType()}
         )
-      `);
+      `;
+}
+
+async function ensureTable(): Promise<void> {
+  if (!_initPromise) {
+    _initPromise = (async () => {
+      const client = getDbExec();
+      const identitySsoStateCreateSql = buildIdentitySsoStateCreateSql();
+      const identitySsoJtiCreateSql = buildIdentitySsoJtiCreateSql();
+      // Additive only. Never DROP / ALTER — this DB is shared across every
+      // deploy context (preview/branch/prod) for hosted templates.
+      if (isPostgres()) {
+        // PG guard: probe → guarded DDL → re-probe; skips lock on already-migrated path
+        await ensureTableExists(
+          "identity_sso_state",
+          identitySsoStateCreateSql,
+        );
+        await ensureTableExists("identity_sso_jti", identitySsoJtiCreateSql);
+        return;
+      }
+
+      // SQLite (local dev): no lock problem — keep the original behaviour.
+      await client.execute(identitySsoStateCreateSql);
+      await client.execute(identitySsoJtiCreateSql);
     })().catch((err) => {
       // Don't cache a rejection — let the next caller retry a fresh init.
       _initPromise = undefined;

package/corpus/core/src/server/recap-image-store.ts

@@ -19,7 +19,13 @@
  */
 import { randomBytes } from "node:crypto";
 
-import { getDbExec, intType, retryOnDdlRace } from "../db/client.js";
+import {
+  getDbExec,
+  intType,
+  isPostgres,
+  retryOnDdlRace,
+} from "../db/client.js";
+import { ensureTableExists } from "../db/ddl-guard.js";
 
 /** Maximum stored image size (~5 MB of raw PNG bytes). */
 export const RECAP_IMAGE_MAX_BYTES = 5 * 1024 * 1024;
@@ -44,12 +50,11 @@ const TOKEN_PATTERN = /^[0-9a-f]{32,128}$/;
 
 let _initPromise: Promise<void> | undefined;
 
-export async function ensureRecapImageTable(): Promise<void> {
-  if (!_initPromise) {
-    _initPromise = (async () => {
-      const client = getDbExec();
-      await retryOnDdlRace(() =>
-        client.execute(`
+// Build the CREATE SQL lazily (not at module scope) so intType() runs at
+// RUNTIME, not import time — a module-scope call breaks any consumer whose
+// db/client mock doesn't stub intType (e.g. db-admin specs).
+function buildRecapImagesCreateSql(): string {
+  return `
         CREATE TABLE IF NOT EXISTS recap_images (
           token TEXT PRIMARY KEY,
           png_base64 TEXT NOT NULL,
@@ -58,8 +63,22 @@ export async function ensureRecapImageTable(): Promise<void> {
           owner_email TEXT,
           created_at ${intType()} NOT NULL
         )
-      `),
-      );
+      `;
+}
+
+export async function ensureRecapImageTable(): Promise<void> {
+  if (!_initPromise) {
+    _initPromise = (async () => {
+      const recapImagesCreateSql = buildRecapImagesCreateSql();
+      if (isPostgres()) {
+        // PG guard: probe → guarded DDL → re-probe; skips lock on already-migrated path
+        await ensureTableExists("recap_images", recapImagesCreateSql);
+        return;
+      }
+
+      // SQLite (local dev): no lock problem — keep the original behaviour.
+      const client = getDbExec();
+      await retryOnDdlRace(() => client.execute(recapImagesCreateSql));
     })().catch((error) => {
       // Allow a later call to retry if the first init lost a DDL race.
       _initPromise = undefined;

package/corpus/core/src/settings/store.ts

@@ -1,6 +1,7 @@
 import { EventEmitter } from "events";
 
 import { getDbExec, isPostgres, intType } from "../db/client.js";
+import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 
 let _initPromise: Promise<void> | undefined;
@@ -20,17 +21,45 @@ async function ensureTable(): Promise<void> {
     _initPromise = (async () => {
       const client = getDbExec();
       const table = settingsTable();
-      await client.execute(`
+      const createSql = `
         CREATE TABLE IF NOT EXISTS ${table} (
           key TEXT PRIMARY KEY,
           value TEXT NOT NULL,
           updated_at ${intType()} NOT NULL
         )
-      `);
-      // Older deployments (pre BIGINT-compat) have a 32-bit `updated_at`; on
-      // Postgres the `Date.now()` written on every setSetting overflows int4.
-      // Widen in place (no-op once done / on fresh DBs). Pass the unqualified
-      // name — the helper scopes to the `public` schema.
+      `;
+
+      if (isPostgres()) {
+        // Hot path: the `settings` table and its poll index are virtually
+        // always already present in production. Issuing `CREATE TABLE`/
+        // `CREATE INDEX` still takes a lock that, in a fresh background-worker
+        // process behind a concurrent connection on the shared Neon DB, can
+        // block ~indefinitely (ACCESS EXCLUSIVE for CREATE TABLE; a write-
+        // blocking SHARE lock for CREATE INDEX). `ensureTableExists` /
+        // `ensureIndexExists` probe `information_schema`/`pg_indexes` first
+        // (plain reads, no lock) and run DDL ONLY for what is actually missing,
+        // bounding any DDL with a transaction-scoped `lock_timeout`. They also
+        // re-probe after a swallowed lock-timeout and THROW if the schema is
+        // still missing, so a timed-out DDL never poisons this init memo with
+        // missing schema. `settingsTable()` is `public.settings` on Postgres;
+        // the existence checks use the unqualified table name.
+        await ensureTableExists("settings", createSql);
+        // Older deployments (pre BIGINT-compat) have a 32-bit `updated_at`; on
+        // Postgres the `Date.now()` written on every setSetting overflows int4.
+        // widenIntColumnsToBigInt already probes information_schema and only
+        // ALTERs columns that are still int4 — a no-op on fresh/widened DBs.
+        await widenIntColumnsToBigInt("settings", ["updated_at"]);
+        // Index for the poll watermark query: `SELECT MAX(updated_at)`.
+        await ensureIndexExists(
+          "settings_updated_at_idx",
+          `CREATE INDEX IF NOT EXISTS settings_updated_at_idx ON ${table} (updated_at)`,
+        );
+        return;
+      }
+
+      // SQLite (local dev): no lock problem — keep the original behaviour.
+      await client.execute(createSql);
+      // No-op on SQLite (INTEGER is already 64-bit).
       await widenIntColumnsToBigInt("settings", ["updated_at"]);
       // Index for the poll watermark query: `SELECT MAX(updated_at) FROM settings`.
       // MAX on an indexed column avoids a full-table scan on every poll cycle.

package/corpus/core/src/usage/store.ts

@@ -8,6 +8,11 @@
  * Cost is stored as "centicents" (1/100th of a cent) for integer precision.
  */
 import { getDbExec, intType, isPostgres } from "../db/client.js";
+import {
+  ensureColumnExists,
+  ensureIndexExists,
+  ensureTableExists,
+} from "../db/ddl-guard.js";
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 
 /**
@@ -191,7 +196,7 @@ async function ensureUsageTable(): Promise<void> {
   if (!_initPromise) {
     _initPromise = (async () => {
       const client = getDbExec();
-      await client.execute(`
+      const createSql = `
         CREATE TABLE IF NOT EXISTS token_usage (
           id ${intType()} PRIMARY KEY,
           owner_email TEXT NOT NULL,
@@ -206,11 +211,9 @@ async function ensureUsageTable(): Promise<void> {
           ref_id TEXT NOT NULL DEFAULT '',
           created_at ${intType()} NOT NULL
         )
-      `);
+      `;
 
-      // Add columns on older deployments that pre-date the label/cache
-      // fields. Each ALTER is wrapped so a dialect without IF NOT EXISTS
-      // (SQLite) still makes progress if only some columns are missing.
+      // Additive columns for older deployments that pre-date the label/cache fields.
       const additions: Array<[string, string]> = [
         ["cache_read_tokens", `${intType()} NOT NULL DEFAULT 0`],
         ["cache_write_tokens", `${intType()} NOT NULL DEFAULT 0`],
@@ -218,27 +221,59 @@ async function ensureUsageTable(): Promise<void> {
         ["app", `TEXT NOT NULL DEFAULT ''`],
         ["ref_id", `TEXT NOT NULL DEFAULT ''`],
       ];
+
+      if (isPostgres()) {
+        // Hot path: the `token_usage` table and its index are virtually always
+        // already present in production. Issuing `CREATE TABLE`/`ALTER TABLE`/
+        // `CREATE INDEX` still takes a lock that, in a fresh background-worker
+        // process behind a concurrent connection on the shared Neon DB, can
+        // block ~indefinitely. The ensure* wrappers probe `information_schema`/
+        // `pg_indexes` first (plain reads, no lock) and run DDL ONLY for what is
+        // actually missing, bounded by a transaction-scoped `lock_timeout`. If a
+        // swallowed lock-timeout leaves the schema still missing they RE-PROBE
+        // and THROW rather than letting init memoize success against absent
+        // schema.
+        await ensureTableExists("token_usage", createSql);
+        // Add columns on older deployments — guarded so the hot path (columns
+        // already present) skips the ACCESS EXCLUSIVE ALTER.
+        for (const [col, def] of additions) {
+          await ensureColumnExists(
+            "token_usage",
+            col,
+            `ALTER TABLE token_usage ADD COLUMN IF NOT EXISTS ${col} ${def}`,
+          );
+        }
+        // Older deployments created `created_at` as 32-bit `INTEGER`; on Postgres
+        // the `Date.now()` written per run by recordUsage() overflows int4. Widen
+        // it in place (no-op once done / on fresh BIGINT databases).
+        await widenIntColumnsToBigInt("token_usage", ["created_at"]);
+        // Probe pg_indexes first (no lock) and skip the SHARE-locking CREATE
+        // INDEX when the index is already present.
+        await ensureIndexExists(
+          "idx_token_usage_owner_created",
+          `CREATE INDEX IF NOT EXISTS idx_token_usage_owner_created ON token_usage (owner_email, created_at)`,
+        );
+        return;
+      }
+
+      // SQLite (local dev): no lock problem — keep the original behaviour.
+      await client.execute(createSql);
+      // Add columns on older deployments that pre-date the label/cache
+      // fields. Each ALTER is wrapped so a dialect without IF NOT EXISTS
+      // (SQLite) still makes progress if only some columns are missing.
       for (const [col, def] of additions) {
         try {
-          if (isPostgres()) {
-            await client.execute(
-              `ALTER TABLE token_usage ADD COLUMN IF NOT EXISTS ${col} ${def}`,
-            );
-          } else {
-            await client.execute(
-              `ALTER TABLE token_usage ADD COLUMN ${col} ${def}`,
-            );
-          }
+          await client.execute(
+            `ALTER TABLE token_usage ADD COLUMN ${col} ${def}`,
+          );
         } catch {
           // Column already exists — ignore
         }
       }
-
       // Older deployments created `created_at` as 32-bit `INTEGER`; on Postgres
       // the `Date.now()` written per run by recordUsage() overflows int4. Widen
       // it in place (no-op once done / on fresh BIGINT databases).
       await widenIntColumnsToBigInt("token_usage", ["created_at"]);
-
       try {
         await client.execute(
           `CREATE INDEX IF NOT EXISTS idx_token_usage_owner_created ON token_usage (owner_email, created_at)`,

package/corpus/core/src/workspace-connections/store.ts

@@ -15,6 +15,11 @@ import {
   safeJsonParse,
   type DbExec,
 } from "../db/client.js";
+import {
+  ensureColumnExists,
+  ensureIndexExists,
+  ensureTableExists,
+} from "../db/ddl-guard.js";
 import {
   getRequestOrgId,
   getRequestUserEmail,
@@ -459,8 +464,8 @@ export async function ensureWorkspaceConnectionsTable(): Promise<void> {
       const client = getDbExec();
       const table = workspaceConnectionsTable();
       const grantsTable = workspaceConnectionGrantsTable();
-      await retryOnDdlRace(() =>
-        client.execute(`
+
+      const createConnectionsSql = `
           CREATE TABLE IF NOT EXISTS ${table} (
             id TEXT PRIMARY KEY,
             provider TEXT NOT NULL DEFAULT '',
@@ -480,23 +485,8 @@ export async function ensureWorkspaceConnectionsTable(): Promise<void> {
             last_checked_at ${intType()},
             last_error TEXT
           )
-        `),
-      );
-
-      await ensureWorkspaceConnectionColumns(client, table);
-
-      await retryOnDdlRace(() =>
-        client.execute(
-          `CREATE INDEX IF NOT EXISTS idx_workspace_connections_scope_provider ON ${table} (org_id, owner_email, provider)`,
-        ),
-      );
-      await retryOnDdlRace(() =>
-        client.execute(
-          `CREATE INDEX IF NOT EXISTS idx_workspace_connections_updated_at ON ${table} (updated_at)`,
-        ),
-      );
-      await retryOnDdlRace(() =>
-        client.execute(`
+        `;
+      const createGrantsSql = `
           CREATE TABLE IF NOT EXISTS ${grantsTable} (
             id TEXT PRIMARY KEY,
             connection_id TEXT NOT NULL DEFAULT '',
@@ -512,11 +502,199 @@ export async function ensureWorkspaceConnectionsTable(): Promise<void> {
             updated_at ${intType()} NOT NULL DEFAULT 0,
             last_used_at ${intType()}
           )
-        `),
-      );
+        `;
+
+      if (isPostgres()) {
+        // PG-guard: probe information_schema / pg_indexes first (no lock) and
+        // only issue DDL when the table/column/index is actually missing,
+        // wrapped in a transaction-scoped lock_timeout so a contended lock
+        // fails fast. Uses unqualified table names for the probe (the helpers
+        // always search the `public` schema).
+
+        // --- workspace_connections ---
+        await ensureTableExists("workspace_connections", createConnectionsSql);
+        await ensureColumnExists(
+          "workspace_connections",
+          "provider",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS provider TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "label",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS label TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "account_id",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS account_id TEXT`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "account_label",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS account_label TEXT`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "status",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS status TEXT NOT NULL DEFAULT 'connected'`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "scopes_json",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS scopes_json TEXT NOT NULL DEFAULT '[]'`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "config_json",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS config_json TEXT NOT NULL DEFAULT '{}'`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "allowed_apps_json",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS allowed_apps_json TEXT NOT NULL DEFAULT '[]'`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "credential_refs_json",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS credential_refs_json TEXT NOT NULL DEFAULT '[]'`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "owner_email",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS owner_email TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "org_id",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS org_id TEXT`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "created_at",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS created_at ${intType()} NOT NULL DEFAULT 0`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "updated_at",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS updated_at ${intType()} NOT NULL DEFAULT 0`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "last_checked_at",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS last_checked_at ${intType()}`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "last_used_at",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS last_used_at ${intType()}`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "last_error",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS last_error TEXT`,
+        );
+        await ensureIndexExists(
+          "idx_workspace_connections_scope_provider",
+          `CREATE INDEX IF NOT EXISTS idx_workspace_connections_scope_provider ON ${table} (org_id, owner_email, provider)`,
+        );
+        await ensureIndexExists(
+          "idx_workspace_connections_updated_at",
+          `CREATE INDEX IF NOT EXISTS idx_workspace_connections_updated_at ON ${table} (updated_at)`,
+        );
 
-      await ensureWorkspaceConnectionGrantColumns(client, grantsTable);
+        // --- workspace_connection_grants ---
+        await ensureTableExists("workspace_connection_grants", createGrantsSql);
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "connection_id",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS connection_id TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "provider",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS provider TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "app_id",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS app_id TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "scopes_json",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS scopes_json TEXT NOT NULL DEFAULT '[]'`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "config_json",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS config_json TEXT NOT NULL DEFAULT '{}'`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "credential_refs_json",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS credential_refs_json TEXT NOT NULL DEFAULT '[]'`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "granted_by_email",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS granted_by_email TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "owner_email",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS owner_email TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "org_id",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS org_id TEXT`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "created_at",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS created_at ${intType()} NOT NULL DEFAULT 0`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "updated_at",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS updated_at ${intType()} NOT NULL DEFAULT 0`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "last_used_at",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS last_used_at ${intType()}`,
+        );
+        await ensureIndexExists(
+          "idx_workspace_connection_grants_connection_app",
+          `CREATE UNIQUE INDEX IF NOT EXISTS idx_workspace_connection_grants_connection_app ON ${grantsTable} (connection_id, app_id)`,
+        );
+        await ensureIndexExists(
+          "idx_workspace_connection_grants_scope_app",
+          `CREATE INDEX IF NOT EXISTS idx_workspace_connection_grants_scope_app ON ${grantsTable} (org_id, owner_email, app_id)`,
+        );
+        await ensureIndexExists(
+          "idx_workspace_connection_grants_updated_at",
+          `CREATE INDEX IF NOT EXISTS idx_workspace_connection_grants_updated_at ON ${grantsTable} (updated_at)`,
+        );
+        return;
+      }
 
+      // SQLite (local dev): no ACCESS EXCLUSIVE lock problem — keep existing
+      // retryOnDdlRace + ensureColumn behaviour.
+      await retryOnDdlRace(() => client.execute(createConnectionsSql));
+      await ensureWorkspaceConnectionColumns(client, table);
+      await retryOnDdlRace(() =>
+        client.execute(
+          `CREATE INDEX IF NOT EXISTS idx_workspace_connections_scope_provider ON ${table} (org_id, owner_email, provider)`,
+        ),
+      );
+      await retryOnDdlRace(() =>
+        client.execute(
+          `CREATE INDEX IF NOT EXISTS idx_workspace_connections_updated_at ON ${table} (updated_at)`,
+        ),
+      );
+      await retryOnDdlRace(() => client.execute(createGrantsSql));
+      await ensureWorkspaceConnectionGrantColumns(client, grantsTable);
       await retryOnDdlRace(() =>
         client.execute(
           `CREATE UNIQUE INDEX IF NOT EXISTS idx_workspace_connection_grants_connection_app ON ${grantsTable} (connection_id, app_id)`,

package/corpus/templates/calendar/changelog/2026-06-25-booking-link-previews-now-show-the-content-directly-on-the-g.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-06-25
+---
+
+Booking link previews now show the content directly on the grid background.

package/corpus/templates/calendar/server/lib/booking-og-image.ts

@@ -267,8 +267,6 @@ export function renderBookingOgImageSvg(input: BookingOgImageInput): string {
   </defs>
   <rect width="${WIDTH}" height="${HEIGHT}" fill="${BG}"/>
   <rect width="${WIDTH}" height="${HEIGHT}" fill="url(#grid)"/>
-  <rect x="64" y="64" width="1072" height="502" rx="28" fill="${BG}" fill-opacity="0.72" stroke="${BORDER}" stroke-width="1"/>
-  <path d="M80 154 H1120" stroke="${BORDER}"/>
   <g transform="translate(80 86)">
     <g transform="scale(0.62)">
       ${LOGO_MARK}

package/corpus/templates/forms/changelog/2026-06-25-form-previews-now-show-the-content-directly-on-the-grid-back.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-06-25
+---
+
+Form previews now show the content directly on the grid background.

package/corpus/templates/forms/server/lib/form-og-image.ts

@@ -168,8 +168,6 @@ export function renderFormOgImageSvg(input: FormOgImageInput = {}): string {
   </defs>
   <rect width="${WIDTH}" height="${HEIGHT}" fill="${BG}"/>
   <rect width="${WIDTH}" height="${HEIGHT}" fill="url(#grid)"/>
-  <rect x="64" y="64" width="1072" height="502" rx="28" fill="${BG}" fill-opacity="0.72" stroke="${BORDER}" stroke-width="1"/>
-  <path d="M80 154 H1120" stroke="${BORDER}"/>
   <g transform="translate(80 86)">
     <g transform="scale(0.62)">
       ${LOGO_MARK}