@agent-native/core 0.77.8 → 0.77.10

package/dist/oauth-tokens/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/oauth-tokens/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAE9B,IAAI,YAAuC,CAAC;AAE5C;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,MAA+B;IACtD,OAAO,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CACxB,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,cAAc,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;YACjC,MAAM,MAAM,CAAC,OAAO,CAAC;qCACU,KAAK;;;;;uBAKnB,OAAO,EAAE;;;OAGzB,CAAC,CAAC;YACH,iDAAiD;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,wBAAwB,CAAC,CAAC;YACrE,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;YACD,qCAAqC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,eAAe,KAAK,+BAA+B,CACpD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;YACD,sEAAsE;YACtE,MAAM,MAAM,CAAC,OAAO,CAClB,UAAU,KAAK,6CAA6C,CAC7D,CAAC;YACF,gEAAgE;YAChE,0EAA0E;YAC1E,yEAAyE;YACzE,0BAA0B;YAC1B,MAAM,uBAAuB,CAAC,cAAc,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,sDAAsD;YACtD,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,SAAiB;IAEjB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sBAAsB,KAAK,wCAAwC;QACxE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IACjD,UAAU,GAAG,GAAG,CAAC;IACjB,QAAQ,CAAS;IACjB,SAAS,CAAS;IAClB,aAAa,CAAS;IACtB,cAAc,CAAS;IAChC,YAAY,IAKX;QACC,KAAK,CACH,iBAAiB,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,uEAAuE,CACxH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,SAAiB,EACjB,MAA+B,EAC/B,KAAc;IAEd,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IAEjC,qEAAqE;IACrE,qEAAqE;IACrE,sEAAsE;IACtE,4CAA4C;IAC5C,IAAI,aAAa,GAAG,KAAK,IAAI,SAAS,CAAC;IACvC,IAAI,mBAAmB,GAAkB,IAAI,CAAC;IAC9C,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,cAAc,GAAmC,IAAI,CAAC;IAC1D,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAC9C,GAAG,EAAE,2CAA2C,KAAK,wCAAwC;QAC7F,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,aAAa,GAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAgB,IAAI,IAAI,CAAC;QACtD,mBAAmB,GAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAuB,IAAI,IAAI,CAAC;QACnE,cAAc,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,qEAAqE;QACrE,IAAI,aAAa;YAAE,aAAa,GAAG,aAAa,CAAC;IACnD,CAAC;SAAM,IAAI,aAAa,IAAI,KAAK,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;QAC7D,kEAAkE;QAClE,2DAA2D;QAC3D,6DAA6D;QAC7D,gEAAgE;QAChE,MAAM,IAAI,iCAAiC,CAAC;YAC1C,QAAQ;YACR,SAAS;YACT,aAAa;YACb,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,qBAAqB,GAAG,MAAM,CAAC,WAAW,CAC9C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAClE,CAAC;IACF,MAAM,aAAa,GAAG;QACpB,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACzB,GAAG,qBAAqB;KACzB,CAAC;IAEF,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,UAAU,EAAE;YACf,CAAC,CAAC,eAAe,KAAK,kNAAkN,KAAK,wEAAwE;YACrT,CAAC,CAAC,0BAA0B,KAAK,4FAA4F;QAC/H,IAAI,EAAE;YACJ,QAAQ;YACR,SAAS;YACT,aAAa;YACb,mBAAmB;YACnB,eAAe,CAAC,aAAa,CAAC;YAC9B,IAAI,CAAC,GAAG,EAAE;SACX;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,SAAkB;IAElB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,eAAe,KAAK,wCAAwC;YACjE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,eAAe,KAAK,qBAAqB;QAC9C,IAAI,EAAE,CAAC,QAAQ,CAAC;KACjB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,YAAY,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IAOtD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,yCAAyC,KAAK,qBAAqB;QACxE,IAAI,EAAE,CAAC,QAAQ,CAAC;KACjB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,SAAS,EAAE,GAAG,CAAC,UAAoB;QACnC,KAAK,EAAG,GAAG,CAAC,KAAgB,IAAI,IAAI;QACpC,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,MAAgB,CAAC;KAChD,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,KAAa;IAQb,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,gDAAgD,KAAK,mCAAmC;QAC7F,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,SAAS,EAAE,GAAG,CAAC,UAAoB;QACnC,WAAW,EAAG,GAAG,CAAC,YAAuB,IAAI,IAAI;QACjD,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,MAAgB,CAAC;KAChD,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,SAAiB,EACjB,WAAmB;IAEnB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,UAAU,KAAK,6DAA6D;QACjF,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,KAAa;IAEb,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,iBAAiB,KAAK,2CAA2C;QACtE,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC","sourcesContent":["import { getDbExec, isPostgres, intType } from \"../db/client.js\";\nimport { widenIntColumnsToBigInt } from \"../db/widen-columns.js\";\nimport {\n  encryptSecretValue,\n  decryptSecretValue,\n  isEncryptedSecretValue,\n} from \"../secrets/crypto.js\";\n\nlet _initPromise: Promise<void> | undefined;\n\n/**\n * Encrypt the token bundle (AES-256-GCM) before it goes to the `tokens`\n * column. OAuth access/refresh tokens are long-lived, high-value credentials;\n * encrypting at rest means a leaked DB backup / pg_dump / read replica no\n * longer exposes them in plaintext. {@link parseStoredTokens} decrypts\n * transparently on read.\n */\nfunction serializeTokens(tokens: Record<string, unknown>): string {\n  return encryptSecretValue(JSON.stringify(tokens));\n}\n\n/**\n * Parse a stored `tokens` value. Encrypted rows are decrypted; rows written\n * before encryption — or mirrored from Better Auth's `account` table — are\n * plaintext JSON and read transparently (the `db-migrate-encrypt-oauth-tokens`\n * script re-encrypts them in place). A row that can't be decrypted (key\n * rotated / corrupt / tampered) is treated as empty rather than throwing into\n * every token lookup.\n */\nfunction parseStoredTokens(\n  stored: string | null | undefined,\n): Record<string, unknown> {\n  if (!stored) return {};\n  if (isEncryptedSecretValue(stored)) {\n    try {\n      return JSON.parse(decryptSecretValue(stored));\n    } catch {\n      return {};\n    }\n  }\n  try {\n    return JSON.parse(stored);\n  } catch {\n    return {};\n  }\n}\n\nfunction oauthTokensTable(): string {\n  return isPostgres() ? \"public.oauth_tokens\" : \"oauth_tokens\";\n}\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const table = oauthTokensTable();\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS ${table} (\n          provider TEXT NOT NULL,\n          account_id TEXT NOT NULL,\n          owner TEXT,\n          tokens TEXT NOT NULL,\n          updated_at ${intType()} NOT NULL,\n          PRIMARY KEY (provider, account_id)\n        )\n      `);\n      // Migration: add owner column to existing tables\n      try {\n        await client.execute(`ALTER TABLE ${table} ADD COLUMN owner TEXT`);\n      } catch {\n        // Column already exists\n      }\n      // Migration: add display_name column\n      try {\n        await client.execute(\n          `ALTER TABLE ${table} ADD COLUMN display_name TEXT`,\n        );\n      } catch {\n        // Column already exists\n      }\n      // Backfill: set owner = account_id for existing rows without an owner\n      await client.execute(\n        `UPDATE ${table} SET owner = account_id WHERE owner IS NULL`,\n      );\n      // Older deployments have a 32-bit `updated_at`; on Postgres the\n      // `Date.now()` written on every token save overflows int4. Widen in place\n      // (no-op once done / on fresh DBs). Unqualified name — the helper scopes\n      // to the `public` schema.\n      await widenIntColumnsToBigInt(\"oauth_tokens\", [\"updated_at\"]);\n    })().catch((err) => {\n      // Retry init on the next call after a failed startup.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nexport async function getOAuthTokens(\n  provider: string,\n  accountId: string,\n): Promise<Record<string, unknown> | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = oauthTokensTable();\n  const { rows } = await client.execute({\n    sql: `SELECT tokens FROM ${table} WHERE provider = ? AND account_id = ?`,\n    args: [provider, accountId],\n  });\n  if (rows.length === 0) return null;\n  return parseStoredTokens(rows[0].tokens as string);\n}\n\n/**\n * Thrown when an OAuth save would re-bind an `(provider, account_id)` row\n * to a different owner than already holds it. Callers should catch this and\n * surface a clean \"this account is already linked to another user\" message\n * to the requester rather than letting it propagate as a 500.\n *\n * Carries `statusCode = 409` so route handlers using h3's `createError` can\n * pass it straight through.\n */\nexport class OAuthAccountOwnedByOtherUserError extends Error {\n  readonly statusCode = 409;\n  readonly provider: string;\n  readonly accountId: string;\n  readonly existingOwner: string;\n  readonly attemptedOwner: string;\n  constructor(opts: {\n    provider: string;\n    accountId: string;\n    existingOwner: string;\n    attemptedOwner: string;\n  }) {\n    super(\n      `OAuth account ${opts.provider}:${opts.accountId} is already linked to another user — refusing to overwrite the owner.`,\n    );\n    this.name = \"OAuthAccountOwnedByOtherUserError\";\n    this.provider = opts.provider;\n    this.accountId = opts.accountId;\n    this.existingOwner = opts.existingOwner;\n    this.attemptedOwner = opts.attemptedOwner;\n  }\n}\n\n/**\n * Save OAuth tokens. The `owner` parameter specifies which user owns this\n * account — defaults to `accountId` (the account itself is the owner).\n * For multi-account support, pass the logged-in user's email as owner.\n *\n * If the account already exists and is owned by a different user, throws\n * `OAuthAccountOwnedByOtherUserError` (statusCode 409) to prevent silently\n * stealing another user's linked account.\n *\n * Read + write happen as a single linearised batch (Postgres) or paired\n * statements (SQLite). On both backends the per-row PK serialises concurrent\n * writes for the same `(provider, account_id)` so the owner check cannot be\n * raced by an attacker calling saveOAuthTokens twice in flight — the second\n * caller sees the first caller's owner row and raises 409.\n */\nexport async function saveOAuthTokens(\n  provider: string,\n  accountId: string,\n  tokens: Record<string, unknown>,\n  owner?: string,\n): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = oauthTokensTable();\n\n  // Read the current row before deciding what to write. We use this to\n  // (a) preserve owner / display_name when this is a token refresh (no\n  // owner argument), and (b) reject the write when the caller is trying\n  // to overwrite a row owned by someone else.\n  let resolvedOwner = owner ?? accountId;\n  let existingDisplayName: string | null = null;\n  let existingOwner: string | null = null;\n  let existingTokens: Record<string, unknown> | null = null;\n  const { rows: existing } = await client.execute({\n    sql: `SELECT owner, display_name, tokens FROM ${table} WHERE provider = ? AND account_id = ?`,\n    args: [provider, accountId],\n  });\n  if (existing.length > 0) {\n    existingOwner = (existing[0].owner as string) ?? null;\n    existingDisplayName = (existing[0].display_name as string) ?? null;\n    existingTokens = parseStoredTokens(existing[0].tokens as string);\n  }\n\n  if (!owner) {\n    // Token-refresh path: keep the existing owner/displayName unchanged.\n    if (existingOwner) resolvedOwner = existingOwner;\n  } else if (existingOwner && owner && existingOwner !== owner) {\n    // Refuse to silently re-bind an account from one user to another.\n    // This is the case the docstring promised but the previous\n    // implementation didn't enforce — `ON CONFLICT DO UPDATE SET\n    // owner=EXCLUDED.owner` would have overwritten the prior owner.\n    throw new OAuthAccountOwnedByOtherUserError({\n      provider,\n      accountId,\n      existingOwner,\n      attemptedOwner: owner,\n    });\n  }\n\n  const cleanedIncomingTokens = Object.fromEntries(\n    Object.entries(tokens).filter(([, value]) => value !== undefined),\n  );\n  const tokensToStore = {\n    ...(existingTokens ?? {}),\n    ...cleanedIncomingTokens,\n  };\n\n  await client.execute({\n    sql: isPostgres()\n      ? `INSERT INTO ${table} (provider, account_id, owner, display_name, tokens, updated_at) VALUES (?, ?, ?, ?, ?, ?) ON CONFLICT (provider, account_id) DO UPDATE SET owner=EXCLUDED.owner, display_name=COALESCE(EXCLUDED.display_name, ${table}.display_name), tokens=EXCLUDED.tokens, updated_at=EXCLUDED.updated_at`\n      : `INSERT OR REPLACE INTO ${table} (provider, account_id, owner, display_name, tokens, updated_at) VALUES (?, ?, ?, ?, ?, ?)`,\n    args: [\n      provider,\n      accountId,\n      resolvedOwner,\n      existingDisplayName,\n      serializeTokens(tokensToStore),\n      Date.now(),\n    ],\n  });\n}\n\nexport async function deleteOAuthTokens(\n  provider: string,\n  accountId?: string,\n): Promise<number> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = oauthTokensTable();\n  if (accountId) {\n    const result = await client.execute({\n      sql: `DELETE FROM ${table} WHERE provider = ? AND account_id = ?`,\n      args: [provider, accountId],\n    });\n    return result.rowsAffected;\n  }\n  const result = await client.execute({\n    sql: `DELETE FROM ${table} WHERE provider = ?`,\n    args: [provider],\n  });\n  return result.rowsAffected;\n}\n\nexport async function listOAuthAccounts(provider: string): Promise<\n  Array<{\n    accountId: string;\n    owner: string | null;\n    tokens: Record<string, unknown>;\n  }>\n> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = oauthTokensTable();\n  const { rows } = await client.execute({\n    sql: `SELECT account_id, owner, tokens FROM ${table} WHERE provider = ?`,\n    args: [provider],\n  });\n  return rows.map((row) => ({\n    accountId: row.account_id as string,\n    owner: (row.owner as string) ?? null,\n    tokens: parseStoredTokens(row.tokens as string),\n  }));\n}\n\n/**\n * List all OAuth accounts owned by a specific user.\n * In multi-account mode, a user may have connected multiple Google accounts.\n */\nexport async function listOAuthAccountsByOwner(\n  provider: string,\n  owner: string,\n): Promise<\n  Array<{\n    accountId: string;\n    displayName: string | null;\n    tokens: Record<string, unknown>;\n  }>\n> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = oauthTokensTable();\n  const { rows } = await client.execute({\n    sql: `SELECT account_id, display_name, tokens FROM ${table} WHERE provider = ? AND owner = ?`,\n    args: [provider, owner],\n  });\n  return rows.map((row) => ({\n    accountId: row.account_id as string,\n    displayName: (row.display_name as string) ?? null,\n    tokens: parseStoredTokens(row.tokens as string),\n  }));\n}\n\n/**\n * Set the display name for an OAuth account (e.g. Google profile name).\n */\nexport async function setOAuthDisplayName(\n  provider: string,\n  accountId: string,\n  displayName: string,\n): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = oauthTokensTable();\n  await client.execute({\n    sql: `UPDATE ${table} SET display_name = ? WHERE provider = ? AND account_id = ?`,\n    args: [displayName, provider, accountId],\n  });\n}\n\n/**\n * Check whether a specific user has tokens for a provider.\n *\n * `owner` is REQUIRED. The previous unscoped form leaked information\n * across users — the onboarding banner would mark the OAuth secret as\n * \"set\" for user B as soon as ANY user in the deployment connected the\n * provider, and user B would never see the prompt to connect.\n */\nexport async function hasOAuthTokens(\n  provider: string,\n  owner: string,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = oauthTokensTable();\n  const { rows } = await client.execute({\n    sql: `SELECT 1 FROM ${table} WHERE provider = ? AND owner = ? LIMIT 1`,\n    args: [provider, owner],\n  });\n  return rows.length > 0;\n}\n"]}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/oauth-tokens/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAE9B,IAAI,YAAuC,CAAC;AAE5C;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,MAA+B;IACtD,OAAO,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CACxB,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,cAAc,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG;qCACa,KAAK;;;;;uBAKnB,OAAO,EAAE;;;OAGzB,CAAC;YAEF,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,kEAAkE;gBAClE,kEAAkE;gBAClE,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,yEAAyE;gBACzE,4DAA4D;gBAC5D,sEAAsE;gBACtE,mEAAmE;gBACnE,yDAAyD;gBACzD,uEAAuE;gBACvE,cAAc;gBACd,MAAM,iBAAiB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;gBACnD,sEAAsE;gBACtE,kEAAkE;gBAClE,MAAM,kBAAkB,CACtB,cAAc,EACd,OAAO,EACP,eAAe,KAAK,sCAAsC,CAC3D,CAAC;gBACF,qCAAqC;gBACrC,MAAM,kBAAkB,CACtB,cAAc,EACd,cAAc,EACd,eAAe,KAAK,6CAA6C,CAClE,CAAC;gBACF,sEAAsE;gBACtE,MAAM,MAAM,CAAC,OAAO,CAClB,UAAU,KAAK,6CAA6C,CAC7D,CAAC;gBACF,gEAAgE;gBAChE,0EAA0E;gBAC1E,yEAAyE;gBACzE,0BAA0B;gBAC1B,MAAM,uBAAuB,CAAC,cAAc,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,qEAAqE;YACrE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,iDAAiD;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,wBAAwB,CAAC,CAAC;YACrE,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;YACD,qCAAqC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,eAAe,KAAK,+BAA+B,CACpD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;YACD,sEAAsE;YACtE,MAAM,MAAM,CAAC,OAAO,CAClB,UAAU,KAAK,6CAA6C,CAC7D,CAAC;YACF,gEAAgE;YAChE,0EAA0E;YAC1E,yEAAyE;YACzE,0BAA0B;YAC1B,MAAM,uBAAuB,CAAC,cAAc,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,sDAAsD;YACtD,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,SAAiB;IAEjB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sBAAsB,KAAK,wCAAwC;QACxE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IACjD,UAAU,GAAG,GAAG,CAAC;IACjB,QAAQ,CAAS;IACjB,SAAS,CAAS;IAClB,aAAa,CAAS;IACtB,cAAc,CAAS;IAChC,YAAY,IAKX;QACC,KAAK,CACH,iBAAiB,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,uEAAuE,CACxH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,SAAiB,EACjB,MAA+B,EAC/B,KAAc;IAEd,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IAEjC,qEAAqE;IACrE,qEAAqE;IACrE,sEAAsE;IACtE,4CAA4C;IAC5C,IAAI,aAAa,GAAG,KAAK,IAAI,SAAS,CAAC;IACvC,IAAI,mBAAmB,GAAkB,IAAI,CAAC;IAC9C,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,cAAc,GAAmC,IAAI,CAAC;IAC1D,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAC9C,GAAG,EAAE,2CAA2C,KAAK,wCAAwC;QAC7F,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,aAAa,GAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAgB,IAAI,IAAI,CAAC;QACtD,mBAAmB,GAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAuB,IAAI,IAAI,CAAC;QACnE,cAAc,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,qEAAqE;QACrE,IAAI,aAAa;YAAE,aAAa,GAAG,aAAa,CAAC;IACnD,CAAC;SAAM,IAAI,aAAa,IAAI,KAAK,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;QAC7D,kEAAkE;QAClE,2DAA2D;QAC3D,6DAA6D;QAC7D,gEAAgE;QAChE,MAAM,IAAI,iCAAiC,CAAC;YAC1C,QAAQ;YACR,SAAS;YACT,aAAa;YACb,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,qBAAqB,GAAG,MAAM,CAAC,WAAW,CAC9C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAClE,CAAC;IACF,MAAM,aAAa,GAAG;QACpB,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACzB,GAAG,qBAAqB;KACzB,CAAC;IAEF,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,UAAU,EAAE;YACf,CAAC,CAAC,eAAe,KAAK,kNAAkN,KAAK,wEAAwE;YACrT,CAAC,CAAC,0BAA0B,KAAK,4FAA4F;QAC/H,IAAI,EAAE;YACJ,QAAQ;YACR,SAAS;YACT,aAAa;YACb,mBAAmB;YACnB,eAAe,CAAC,aAAa,CAAC;YAC9B,IAAI,CAAC,GAAG,EAAE;SACX;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,SAAkB;IAElB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,eAAe,KAAK,wCAAwC;YACjE,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,eAAe,KAAK,qBAAqB;QAC9C,IAAI,EAAE,CAAC,QAAQ,CAAC;KACjB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,YAAY,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IAOtD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,yCAAyC,KAAK,qBAAqB;QACxE,IAAI,EAAE,CAAC,QAAQ,CAAC;KACjB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,SAAS,EAAE,GAAG,CAAC,UAAoB;QACnC,KAAK,EAAG,GAAG,CAAC,KAAgB,IAAI,IAAI;QACpC,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,MAAgB,CAAC;KAChD,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,KAAa;IAQb,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,gDAAgD,KAAK,mCAAmC;QAC7F,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,SAAS,EAAE,GAAG,CAAC,UAAoB;QACnC,WAAW,EAAG,GAAG,CAAC,YAAuB,IAAI,IAAI;QACjD,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,MAAgB,CAAC;KAChD,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,SAAiB,EACjB,WAAmB;IAEnB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,UAAU,KAAK,6DAA6D;QACjF,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC;KACzC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,KAAa;IAEb,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,iBAAiB,KAAK,2CAA2C;QACtE,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC","sourcesContent":["import { getDbExec, isPostgres, intType } from \"../db/client.js\";\nimport { ensureColumnExists, ensureTableExists } from \"../db/ddl-guard.js\";\nimport { widenIntColumnsToBigInt } from \"../db/widen-columns.js\";\nimport {\n  encryptSecretValue,\n  decryptSecretValue,\n  isEncryptedSecretValue,\n} from \"../secrets/crypto.js\";\n\nlet _initPromise: Promise<void> | undefined;\n\n/**\n * Encrypt the token bundle (AES-256-GCM) before it goes to the `tokens`\n * column. OAuth access/refresh tokens are long-lived, high-value credentials;\n * encrypting at rest means a leaked DB backup / pg_dump / read replica no\n * longer exposes them in plaintext. {@link parseStoredTokens} decrypts\n * transparently on read.\n */\nfunction serializeTokens(tokens: Record<string, unknown>): string {\n  return encryptSecretValue(JSON.stringify(tokens));\n}\n\n/**\n * Parse a stored `tokens` value. Encrypted rows are decrypted; rows written\n * before encryption — or mirrored from Better Auth's `account` table — are\n * plaintext JSON and read transparently (the `db-migrate-encrypt-oauth-tokens`\n * script re-encrypts them in place). A row that can't be decrypted (key\n * rotated / corrupt / tampered) is treated as empty rather than throwing into\n * every token lookup.\n */\nfunction parseStoredTokens(\n  stored: string | null | undefined,\n): Record<string, unknown> {\n  if (!stored) return {};\n  if (isEncryptedSecretValue(stored)) {\n    try {\n      return JSON.parse(decryptSecretValue(stored));\n    } catch {\n      return {};\n    }\n  }\n  try {\n    return JSON.parse(stored);\n  } catch {\n    return {};\n  }\n}\n\nfunction oauthTokensTable(): string {\n  return isPostgres() ? \"public.oauth_tokens\" : \"oauth_tokens\";\n}\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const table = oauthTokensTable();\n      const createSql = `\n        CREATE TABLE IF NOT EXISTS ${table} (\n          provider TEXT NOT NULL,\n          account_id TEXT NOT NULL,\n          owner TEXT,\n          tokens TEXT NOT NULL,\n          updated_at ${intType()} NOT NULL,\n          PRIMARY KEY (provider, account_id)\n        )\n      `;\n\n      if (isPostgres()) {\n        // Hot path: the `oauth_tokens` table and its additive columns are\n        // virtually always already present in production. Issuing `CREATE\n        // TABLE`/`ALTER TABLE` still takes an ACCESS EXCLUSIVE lock that, in a\n        // fresh background-worker process behind a concurrent connection on the\n        // shared Neon DB, can block ~indefinitely. The ensure* wrappers probe\n        // `information_schema` first (plain reads, no lock) and run DDL ONLY for\n        // what is actually missing, bounded by a transaction-scoped\n        // `lock_timeout`. If a swallowed lock-timeout leaves the schema still\n        // missing they RE-PROBE and THROW rather than letting init memoize\n        // success against absent schema. `oauthTokensTable()` is\n        // `public.oauth_tokens` on Postgres; the wrappers take the unqualified\n        // table name.\n        await ensureTableExists(\"oauth_tokens\", createSql);\n        // Migration: add owner column to existing tables — guarded so the hot\n        // path (column already present) skips the ACCESS EXCLUSIVE ALTER.\n        await ensureColumnExists(\n          \"oauth_tokens\",\n          \"owner\",\n          `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS owner TEXT`,\n        );\n        // Migration: add display_name column\n        await ensureColumnExists(\n          \"oauth_tokens\",\n          \"display_name\",\n          `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS display_name TEXT`,\n        );\n        // Backfill: set owner = account_id for existing rows without an owner\n        await client.execute(\n          `UPDATE ${table} SET owner = account_id WHERE owner IS NULL`,\n        );\n        // Older deployments have a 32-bit `updated_at`; on Postgres the\n        // `Date.now()` written on every token save overflows int4. Widen in place\n        // (no-op once done / on fresh DBs). Unqualified name — the helper scopes\n        // to the `public` schema.\n        await widenIntColumnsToBigInt(\"oauth_tokens\", [\"updated_at\"]);\n        return;\n      }\n\n      // SQLite (local dev): no lock problem — keep the original behaviour.\n      await client.execute(createSql);\n      // Migration: add owner column to existing tables\n      try {\n        await client.execute(`ALTER TABLE ${table} ADD COLUMN owner TEXT`);\n      } catch {\n        // Column already exists\n      }\n      // Migration: add display_name column\n      try {\n        await client.execute(\n          `ALTER TABLE ${table} ADD COLUMN display_name TEXT`,\n        );\n      } catch {\n        // Column already exists\n      }\n      // Backfill: set owner = account_id for existing rows without an owner\n      await client.execute(\n        `UPDATE ${table} SET owner = account_id WHERE owner IS NULL`,\n      );\n      // Older deployments have a 32-bit `updated_at`; on Postgres the\n      // `Date.now()` written on every token save overflows int4. Widen in place\n      // (no-op once done / on fresh DBs). Unqualified name — the helper scopes\n      // to the `public` schema.\n      await widenIntColumnsToBigInt(\"oauth_tokens\", [\"updated_at\"]);\n    })().catch((err) => {\n      // Retry init on the next call after a failed startup.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nexport async function getOAuthTokens(\n  provider: string,\n  accountId: string,\n): Promise<Record<string, unknown> | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = oauthTokensTable();\n  const { rows } = await client.execute({\n    sql: `SELECT tokens FROM ${table} WHERE provider = ? AND account_id = ?`,\n    args: [provider, accountId],\n  });\n  if (rows.length === 0) return null;\n  return parseStoredTokens(rows[0].tokens as string);\n}\n\n/**\n * Thrown when an OAuth save would re-bind an `(provider, account_id)` row\n * to a different owner than already holds it. Callers should catch this and\n * surface a clean \"this account is already linked to another user\" message\n * to the requester rather than letting it propagate as a 500.\n *\n * Carries `statusCode = 409` so route handlers using h3's `createError` can\n * pass it straight through.\n */\nexport class OAuthAccountOwnedByOtherUserError extends Error {\n  readonly statusCode = 409;\n  readonly provider: string;\n  readonly accountId: string;\n  readonly existingOwner: string;\n  readonly attemptedOwner: string;\n  constructor(opts: {\n    provider: string;\n    accountId: string;\n    existingOwner: string;\n    attemptedOwner: string;\n  }) {\n    super(\n      `OAuth account ${opts.provider}:${opts.accountId} is already linked to another user — refusing to overwrite the owner.`,\n    );\n    this.name = \"OAuthAccountOwnedByOtherUserError\";\n    this.provider = opts.provider;\n    this.accountId = opts.accountId;\n    this.existingOwner = opts.existingOwner;\n    this.attemptedOwner = opts.attemptedOwner;\n  }\n}\n\n/**\n * Save OAuth tokens. The `owner` parameter specifies which user owns this\n * account — defaults to `accountId` (the account itself is the owner).\n * For multi-account support, pass the logged-in user's email as owner.\n *\n * If the account already exists and is owned by a different user, throws\n * `OAuthAccountOwnedByOtherUserError` (statusCode 409) to prevent silently\n * stealing another user's linked account.\n *\n * Read + write happen as a single linearised batch (Postgres) or paired\n * statements (SQLite). On both backends the per-row PK serialises concurrent\n * writes for the same `(provider, account_id)` so the owner check cannot be\n * raced by an attacker calling saveOAuthTokens twice in flight — the second\n * caller sees the first caller's owner row and raises 409.\n */\nexport async function saveOAuthTokens(\n  provider: string,\n  accountId: string,\n  tokens: Record<string, unknown>,\n  owner?: string,\n): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = oauthTokensTable();\n\n  // Read the current row before deciding what to write. We use this to\n  // (a) preserve owner / display_name when this is a token refresh (no\n  // owner argument), and (b) reject the write when the caller is trying\n  // to overwrite a row owned by someone else.\n  let resolvedOwner = owner ?? accountId;\n  let existingDisplayName: string | null = null;\n  let existingOwner: string | null = null;\n  let existingTokens: Record<string, unknown> | null = null;\n  const { rows: existing } = await client.execute({\n    sql: `SELECT owner, display_name, tokens FROM ${table} WHERE provider = ? AND account_id = ?`,\n    args: [provider, accountId],\n  });\n  if (existing.length > 0) {\n    existingOwner = (existing[0].owner as string) ?? null;\n    existingDisplayName = (existing[0].display_name as string) ?? null;\n    existingTokens = parseStoredTokens(existing[0].tokens as string);\n  }\n\n  if (!owner) {\n    // Token-refresh path: keep the existing owner/displayName unchanged.\n    if (existingOwner) resolvedOwner = existingOwner;\n  } else if (existingOwner && owner && existingOwner !== owner) {\n    // Refuse to silently re-bind an account from one user to another.\n    // This is the case the docstring promised but the previous\n    // implementation didn't enforce — `ON CONFLICT DO UPDATE SET\n    // owner=EXCLUDED.owner` would have overwritten the prior owner.\n    throw new OAuthAccountOwnedByOtherUserError({\n      provider,\n      accountId,\n      existingOwner,\n      attemptedOwner: owner,\n    });\n  }\n\n  const cleanedIncomingTokens = Object.fromEntries(\n    Object.entries(tokens).filter(([, value]) => value !== undefined),\n  );\n  const tokensToStore = {\n    ...(existingTokens ?? {}),\n    ...cleanedIncomingTokens,\n  };\n\n  await client.execute({\n    sql: isPostgres()\n      ? `INSERT INTO ${table} (provider, account_id, owner, display_name, tokens, updated_at) VALUES (?, ?, ?, ?, ?, ?) ON CONFLICT (provider, account_id) DO UPDATE SET owner=EXCLUDED.owner, display_name=COALESCE(EXCLUDED.display_name, ${table}.display_name), tokens=EXCLUDED.tokens, updated_at=EXCLUDED.updated_at`\n      : `INSERT OR REPLACE INTO ${table} (provider, account_id, owner, display_name, tokens, updated_at) VALUES (?, ?, ?, ?, ?, ?)`,\n    args: [\n      provider,\n      accountId,\n      resolvedOwner,\n      existingDisplayName,\n      serializeTokens(tokensToStore),\n      Date.now(),\n    ],\n  });\n}\n\nexport async function deleteOAuthTokens(\n  provider: string,\n  accountId?: string,\n): Promise<number> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = oauthTokensTable();\n  if (accountId) {\n    const result = await client.execute({\n      sql: `DELETE FROM ${table} WHERE provider = ? AND account_id = ?`,\n      args: [provider, accountId],\n    });\n    return result.rowsAffected;\n  }\n  const result = await client.execute({\n    sql: `DELETE FROM ${table} WHERE provider = ?`,\n    args: [provider],\n  });\n  return result.rowsAffected;\n}\n\nexport async function listOAuthAccounts(provider: string): Promise<\n  Array<{\n    accountId: string;\n    owner: string | null;\n    tokens: Record<string, unknown>;\n  }>\n> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = oauthTokensTable();\n  const { rows } = await client.execute({\n    sql: `SELECT account_id, owner, tokens FROM ${table} WHERE provider = ?`,\n    args: [provider],\n  });\n  return rows.map((row) => ({\n    accountId: row.account_id as string,\n    owner: (row.owner as string) ?? null,\n    tokens: parseStoredTokens(row.tokens as string),\n  }));\n}\n\n/**\n * List all OAuth accounts owned by a specific user.\n * In multi-account mode, a user may have connected multiple Google accounts.\n */\nexport async function listOAuthAccountsByOwner(\n  provider: string,\n  owner: string,\n): Promise<\n  Array<{\n    accountId: string;\n    displayName: string | null;\n    tokens: Record<string, unknown>;\n  }>\n> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = oauthTokensTable();\n  const { rows } = await client.execute({\n    sql: `SELECT account_id, display_name, tokens FROM ${table} WHERE provider = ? AND owner = ?`,\n    args: [provider, owner],\n  });\n  return rows.map((row) => ({\n    accountId: row.account_id as string,\n    displayName: (row.display_name as string) ?? null,\n    tokens: parseStoredTokens(row.tokens as string),\n  }));\n}\n\n/**\n * Set the display name for an OAuth account (e.g. Google profile name).\n */\nexport async function setOAuthDisplayName(\n  provider: string,\n  accountId: string,\n  displayName: string,\n): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = oauthTokensTable();\n  await client.execute({\n    sql: `UPDATE ${table} SET display_name = ? WHERE provider = ? AND account_id = ?`,\n    args: [displayName, provider, accountId],\n  });\n}\n\n/**\n * Check whether a specific user has tokens for a provider.\n *\n * `owner` is REQUIRED. The previous unscoped form leaked information\n * across users — the onboarding banner would mark the OAuth secret as\n * \"set\" for user B as soon as ANY user in the deployment connected the\n * provider, and user B would never see the prompt to connect.\n */\nexport async function hasOAuthTokens(\n  provider: string,\n  owner: string,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = oauthTokensTable();\n  const { rows } = await client.execute({\n    sql: `SELECT 1 FROM ${table} WHERE provider = ? AND owner = ? LIMIT 1`,\n    args: [provider, owner],\n  });\n  return rows.length > 0;\n}\n"]}

package/dist/observability/routes.d.ts

@@ -41,28 +41,28 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
-    id?: undefined;
     error?: undefined;
-    ok?: undefined;
+    id?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
     error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
-    id?: undefined;
     error: any;
-    ok?: undefined;
+    id?: undefined;
 } | {
     summary?: undefined;
     spans?: undefined;
-    id?: undefined;
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
+    id?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/observability/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/observability/store.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACV,SAAS,EACT,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AA0CpB,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAoN/D;AAID,wBAAsB,eAAe,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BpE;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA8E7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC,CAyBD;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC,SAAS,EAAE,CAAC,CAStB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAkB1B;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAU9B;AAID,wBAAsB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBxE;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CA6B3B;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC;IACT,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC,CAAC,CA2BD;AAID,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAsDf;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAyB/B;AAID,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBxE;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC,UAAU,EAAE,CAAC,CASvB;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC;IACT,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1E,CAAC,CA+BD;AAID,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB3E;AAED,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAO/D;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAS5E;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC,GACtE,OAAO,CAAC,IAAI,CAAC,CAwBf;AAID,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBrE;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,CACd,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC,CACzE,GACA,OAAO,CAAC,IAAI,CAAC,CAmCf;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAO7D;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAS1E;AAID,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,oBAAoB,GAC/B,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED,wBAAsB,aAAa,CACjC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAgBtC;AAID,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAUnC;AAID,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC;IACT,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CA6DD"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/observability/store.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,SAAS,EACT,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AA0CpB,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CA0T/D;AAID,wBAAsB,eAAe,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BpE;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA8E7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC,CAyBD;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC,SAAS,EAAE,CAAC,CAStB;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAkB1B;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAU9B;AAID,wBAAsB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBxE;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CA6B3B;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC;IACT,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC,CAAC,CA2BD;AAID,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAsDf;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAyB/B;AAID,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBxE;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC,UAAU,EAAE,CAAC,CASvB;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC;IACT,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1E,CAAC,CA+BD;AAID,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB3E;AAED,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAO/D;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAS5E;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC,GACtE,OAAO,CAAC,IAAI,CAAC,CAwBf;AAID,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBrE;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,CACd,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC,CACzE,GACA,OAAO,CAAC,IAAI,CAAC,CAmCf;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAO7D;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAS1E;AAID,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,oBAAoB,GAC/B,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED,wBAAsB,aAAa,CACjC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAgBtC;AAID,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAUnC;AAID,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,OAAO,CAAC;IACT,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CA6DD"}

package/dist/observability/store.js

@@ -7,6 +7,7 @@
  * rather than Drizzle ORM (which is for template-level schemas).
  */
 import { getDbExec, intType, isPostgres, retryOnDdlRace, } from "../db/client.js";
+import { ensureTableExists, ensureColumnExists, ensureIndexExists, } from "../db/ddl-guard.js";
 import { isDuplicateColumnError } from "../db/migrations.js";
 function safeJsonParse(value, fallback) {
     if (!value)
@@ -47,7 +48,7 @@ export async function ensureObservabilityTables() {
     if (!_initPromise) {
         _initPromise = (async () => {
             const client = getDbExec();
-            await retryOnDdlRace(() => client.execute(`
+            const traceSpansCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_trace_spans (
           id TEXT PRIMARY KEY,
           run_id TEXT NOT NULL,
@@ -67,8 +68,8 @@ export async function ensureObservabilityTables() {
           metadata TEXT,
           created_at ${intType()} NOT NULL
         )
-      `));
-            await retryOnDdlRace(() => client.execute(`
+      `;
+            const traceSummariesCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_trace_summaries (
           run_id TEXT PRIMARY KEY,
           thread_id TEXT,
@@ -85,8 +86,8 @@ export async function ensureObservabilityTables() {
           model TEXT NOT NULL DEFAULT '',
           created_at ${intType()} NOT NULL
         )
-      `));
-            await retryOnDdlRace(() => client.execute(`
+      `;
+            const feedbackCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_feedback (
           id TEXT PRIMARY KEY,
           run_id TEXT,
@@ -97,8 +98,8 @@ export async function ensureObservabilityTables() {
           user_id TEXT,
           created_at ${intType()} NOT NULL
         )
-      `));
-            await retryOnDdlRace(() => client.execute(`
+      `;
+            const satisfactionScoresCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_satisfaction_scores (
           id TEXT PRIMARY KEY,
           thread_id TEXT NOT NULL,
@@ -110,8 +111,8 @@ export async function ensureObservabilityTables() {
           length_trend_score REAL NOT NULL DEFAULT 0,
           computed_at ${intType()} NOT NULL
         )
-      `));
-            await retryOnDdlRace(() => client.execute(`
+      `;
+            const evalsCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_evals (
           id TEXT PRIMARY KEY,
           run_id TEXT NOT NULL,
@@ -124,8 +125,8 @@ export async function ensureObservabilityTables() {
           metadata TEXT,
           created_at ${intType()} NOT NULL
         )
-      `));
-            await retryOnDdlRace(() => client.execute(`
+      `;
+            const evalDatasetsCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_eval_datasets (
           id TEXT PRIMARY KEY,
           name TEXT NOT NULL,
@@ -134,8 +135,8 @@ export async function ensureObservabilityTables() {
           created_at ${intType()} NOT NULL,
           updated_at ${intType()} NOT NULL
         )
-      `));
-            await retryOnDdlRace(() => client.execute(`
+      `;
+            const experimentsCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_experiments (
           id TEXT PRIMARY KEY,
           name TEXT NOT NULL,
@@ -148,19 +149,8 @@ export async function ensureObservabilityTables() {
           created_at ${intType()} NOT NULL,
           owner_email TEXT
         )
-      `));
-            // Additive migration for DBs created before the owner column shipped
-            // (any pre-existing rows have NULL owner — see `updateExperiment` for
-            // the migration semantics). Mutations on those rows fall back to the
-            // standard authentication gate but cannot enforce per-owner scoping
-            // until they're re-saved.
-            try {
-                await client.execute(`ALTER TABLE agent_experiments ADD COLUMN owner_email TEXT`);
-            }
-            catch {
-                // Column already exists — expected after first run.
-            }
-            await retryOnDdlRace(() => client.execute(`
+      `;
+            const experimentAssignmentsCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_experiment_assignments (
           experiment_id TEXT NOT NULL,
           user_id TEXT NOT NULL,
@@ -168,8 +158,8 @@ export async function ensureObservabilityTables() {
           assigned_at ${intType()} NOT NULL,
           PRIMARY KEY (experiment_id, user_id)
         )
-      `));
-            await retryOnDdlRace(() => client.execute(`
+      `;
+            const experimentResultsCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_experiment_results (
           id TEXT PRIMARY KEY,
           experiment_id TEXT NOT NULL,
@@ -181,7 +171,60 @@ export async function ensureObservabilityTables() {
           confidence_high REAL NOT NULL DEFAULT 0,
           computed_at ${intType()} NOT NULL
         )
-      `));
+      `;
+            if (isPostgres()) {
+                // PG guard: probe → guarded DDL → re-probe; skips lock on already-migrated path
+                await ensureTableExists("agent_trace_spans", traceSpansCreateSql);
+                await ensureTableExists("agent_trace_summaries", traceSummariesCreateSql);
+                await ensureTableExists("agent_feedback", feedbackCreateSql);
+                await ensureTableExists("agent_satisfaction_scores", satisfactionScoresCreateSql);
+                await ensureTableExists("agent_evals", evalsCreateSql);
+                await ensureTableExists("agent_eval_datasets", evalDatasetsCreateSql);
+                await ensureTableExists("agent_experiments", experimentsCreateSql);
+                await ensureTableExists("agent_experiment_assignments", experimentAssignmentsCreateSql);
+                await ensureTableExists("agent_experiment_results", experimentResultsCreateSql);
+                await ensureColumnExists("agent_experiments", "owner_email", `ALTER TABLE agent_experiments ADD COLUMN IF NOT EXISTS owner_email TEXT`);
+                for (const table of USER_SCOPED_TABLES) {
+                    await ensureColumnExists(table, "user_id", `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS user_id TEXT`);
+                }
+                await ensureIndexExists("idx_trace_spans_run", `CREATE INDEX IF NOT EXISTS idx_trace_spans_run ON agent_trace_spans (run_id)`);
+                await ensureIndexExists("idx_trace_spans_thread", `CREATE INDEX IF NOT EXISTS idx_trace_spans_thread ON agent_trace_spans (thread_id)`);
+                await ensureIndexExists("idx_trace_spans_created", `CREATE INDEX IF NOT EXISTS idx_trace_spans_created ON agent_trace_spans (created_at)`);
+                await ensureIndexExists("idx_trace_summaries_created", `CREATE INDEX IF NOT EXISTS idx_trace_summaries_created ON agent_trace_summaries (created_at)`);
+                await ensureIndexExists("idx_trace_summaries_user", `CREATE INDEX IF NOT EXISTS idx_trace_summaries_user ON agent_trace_summaries (user_id, created_at)`);
+                await ensureIndexExists("idx_trace_spans_user", `CREATE INDEX IF NOT EXISTS idx_trace_spans_user ON agent_trace_spans (user_id)`);
+                await ensureIndexExists("idx_feedback_thread", `CREATE INDEX IF NOT EXISTS idx_feedback_thread ON agent_feedback (thread_id)`);
+                await ensureIndexExists("idx_feedback_created", `CREATE INDEX IF NOT EXISTS idx_feedback_created ON agent_feedback (created_at)`);
+                await ensureIndexExists("idx_feedback_user", `CREATE INDEX IF NOT EXISTS idx_feedback_user ON agent_feedback (user_id, created_at)`);
+                await ensureIndexExists("idx_satisfaction_thread", `CREATE INDEX IF NOT EXISTS idx_satisfaction_thread ON agent_satisfaction_scores (thread_id)`);
+                await ensureIndexExists("idx_satisfaction_user", `CREATE INDEX IF NOT EXISTS idx_satisfaction_user ON agent_satisfaction_scores (user_id, computed_at)`);
+                await ensureIndexExists("idx_evals_run", `CREATE INDEX IF NOT EXISTS idx_evals_run ON agent_evals (run_id)`);
+                await ensureIndexExists("idx_evals_created", `CREATE INDEX IF NOT EXISTS idx_evals_created ON agent_evals (created_at)`);
+                await ensureIndexExists("idx_evals_user", `CREATE INDEX IF NOT EXISTS idx_evals_user ON agent_evals (user_id, created_at)`);
+                await ensureIndexExists("idx_experiment_results_exp", `CREATE INDEX IF NOT EXISTS idx_experiment_results_exp ON agent_experiment_results (experiment_id)`);
+                return;
+            }
+            // SQLite (local dev): no lock problem — keep the original behaviour.
+            await retryOnDdlRace(() => client.execute(traceSpansCreateSql));
+            await retryOnDdlRace(() => client.execute(traceSummariesCreateSql));
+            await retryOnDdlRace(() => client.execute(feedbackCreateSql));
+            await retryOnDdlRace(() => client.execute(satisfactionScoresCreateSql));
+            await retryOnDdlRace(() => client.execute(evalsCreateSql));
+            await retryOnDdlRace(() => client.execute(evalDatasetsCreateSql));
+            await retryOnDdlRace(() => client.execute(experimentsCreateSql));
+            // Additive migration for DBs created before the owner column shipped
+            // (any pre-existing rows have NULL owner — see `updateExperiment` for
+            // the migration semantics). Mutations on those rows fall back to the
+            // standard authentication gate but cannot enforce per-owner scoping
+            // until they're re-saved.
+            try {
+                await client.execute(`ALTER TABLE agent_experiments ADD COLUMN owner_email TEXT`);
+            }
+            catch {
+                // Column already exists — expected after first run.
+            }
+            await retryOnDdlRace(() => client.execute(experimentAssignmentsCreateSql));
+            await retryOnDdlRace(() => client.execute(experimentResultsCreateSql));
             // Idempotent column upgrades for DBs created before per-user
             // isolation. SQLite has no `ADD COLUMN IF NOT EXISTS`; Postgres
             // surfaces "column ... already exists". `isDuplicateColumnError`