@agent-native/core 0.77.8 → 0.77.10

package/corpus/core/src/mcp/oauth-store.ts

@@ -8,7 +8,13 @@
 
 import { randomBytes, randomUUID, createHash } from "node:crypto";
 
-import { getDbExec, isConnectionError, intType } from "../db/client.js";
+import {
+  getDbExec,
+  isConnectionError,
+  intType,
+  isPostgres,
+} from "../db/client.js";
+import { ensureTableExists } from "../db/ddl-guard.js";
 
 let _initPromise: Promise<void> | undefined;
 
@@ -79,7 +85,7 @@ async function ensureTable(): Promise<void> {
   if (!_initPromise) {
     _initPromise = (async () => {
       const client = getDbExec();
-      await client.execute(`
+      const createClientsSql = `
         CREATE TABLE IF NOT EXISTS mcp_oauth_clients (
           client_id TEXT PRIMARY KEY,
           client_name TEXT,
@@ -89,8 +95,8 @@ async function ensureTable(): Promise<void> {
           token_endpoint_auth_method TEXT,
           created_at ${intType()}
         )
-      `);
-      await client.execute(`
+      `;
+      const createCodesSql = `
         CREATE TABLE IF NOT EXISTS mcp_oauth_codes (
           code TEXT PRIMARY KEY,
           client_id TEXT NOT NULL,
@@ -106,8 +112,8 @@ async function ensureTable(): Promise<void> {
           expires_at ${intType()},
           consumed_at ${intType()}
         )
-      `);
-      await client.execute(`
+      `;
+      const createRefreshTokensSql = `
         CREATE TABLE IF NOT EXISTS mcp_oauth_refresh_tokens (
           id TEXT PRIMARY KEY,
           token_hash TEXT UNIQUE NOT NULL,
@@ -123,7 +129,26 @@ async function ensureTable(): Promise<void> {
           revoked_at ${intType()},
           replaced_by_hash TEXT
         )
-      `);
+      `;
+
+      if (isPostgres()) {
+        // PG-guard: probe information_schema first (no lock) and only issue
+        // DDL when the table is actually missing, wrapped in a
+        // transaction-scoped lock_timeout so a contended lock fails fast.
+        await ensureTableExists("mcp_oauth_clients", createClientsSql);
+        await ensureTableExists("mcp_oauth_codes", createCodesSql);
+        await ensureTableExists(
+          "mcp_oauth_refresh_tokens",
+          createRefreshTokensSql,
+        );
+        return;
+      }
+
+      // SQLite (local dev): no ACCESS EXCLUSIVE lock problem — keep existing
+      // create-then-execute behaviour.
+      await client.execute(createClientsSql);
+      await client.execute(createCodesSql);
+      await client.execute(createRefreshTokensSql);
     })().catch((err) => {
       _initPromise = undefined;
       throw err;

package/corpus/core/src/notifications/store.ts

@@ -3,9 +3,11 @@ import { randomUUID } from "node:crypto";
 import {
   getDbExec,
   intType,
+  isPostgres,
   retryOnDdlRace,
   safeJsonParse,
 } from "../db/client.js";
+import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
 import { recordChange } from "../server/poll.js";
 import type { Notification, NotificationSeverity } from "./types.js";
 
@@ -24,8 +26,7 @@ async function ensureTable(): Promise<void> {
   if (!_initPromise) {
     _initPromise = (async () => {
       const client = getDbExec();
-      await retryOnDdlRace(() =>
-        client.execute(`
+      const createSql = `
           CREATE TABLE IF NOT EXISTS notifications (
             id TEXT PRIMARY KEY,
             owner TEXT NOT NULL,
@@ -37,8 +38,23 @@ async function ensureTable(): Promise<void> {
             created_at ${intType()} NOT NULL,
             read_at ${intType()}
           )
-        `),
-      );
+        `;
+
+      if (isPostgres()) {
+        // PG-guard: probe information_schema / pg_indexes first (no lock) and
+        // only issue DDL when the table/index is actually missing, wrapped in
+        // a transaction-scoped lock_timeout so a contended lock fails fast.
+        await ensureTableExists("notifications", createSql);
+        await ensureIndexExists(
+          "idx_notifications_owner_unread",
+          `CREATE INDEX IF NOT EXISTS idx_notifications_owner_unread ON notifications (owner, read_at)`,
+        );
+        return;
+      }
+
+      // SQLite (local dev): no ACCESS EXCLUSIVE lock problem — keep existing
+      // retryOnDdlRace behaviour.
+      await retryOnDdlRace(() => client.execute(createSql));
       await retryOnDdlRace(() =>
         client.execute(
           `CREATE INDEX IF NOT EXISTS idx_notifications_owner_unread ON notifications (owner, read_at)`,

package/corpus/core/src/oauth-tokens/store.ts

@@ -1,4 +1,5 @@
 import { getDbExec, isPostgres, intType } from "../db/client.js";
+import { ensureColumnExists, ensureTableExists } from "../db/ddl-guard.js";
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 import {
   encryptSecretValue,
@@ -54,7 +55,7 @@ async function ensureTable(): Promise<void> {
     _initPromise = (async () => {
       const client = getDbExec();
       const table = oauthTokensTable();
-      await client.execute(`
+      const createSql = `
         CREATE TABLE IF NOT EXISTS ${table} (
           provider TEXT NOT NULL,
           account_id TEXT NOT NULL,
@@ -63,7 +64,49 @@ async function ensureTable(): Promise<void> {
           updated_at ${intType()} NOT NULL,
           PRIMARY KEY (provider, account_id)
         )
-      `);
+      `;
+
+      if (isPostgres()) {
+        // Hot path: the `oauth_tokens` table and its additive columns are
+        // virtually always already present in production. Issuing `CREATE
+        // TABLE`/`ALTER TABLE` still takes an ACCESS EXCLUSIVE lock that, in a
+        // fresh background-worker process behind a concurrent connection on the
+        // shared Neon DB, can block ~indefinitely. The ensure* wrappers probe
+        // `information_schema` first (plain reads, no lock) and run DDL ONLY for
+        // what is actually missing, bounded by a transaction-scoped
+        // `lock_timeout`. If a swallowed lock-timeout leaves the schema still
+        // missing they RE-PROBE and THROW rather than letting init memoize
+        // success against absent schema. `oauthTokensTable()` is
+        // `public.oauth_tokens` on Postgres; the wrappers take the unqualified
+        // table name.
+        await ensureTableExists("oauth_tokens", createSql);
+        // Migration: add owner column to existing tables — guarded so the hot
+        // path (column already present) skips the ACCESS EXCLUSIVE ALTER.
+        await ensureColumnExists(
+          "oauth_tokens",
+          "owner",
+          `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS owner TEXT`,
+        );
+        // Migration: add display_name column
+        await ensureColumnExists(
+          "oauth_tokens",
+          "display_name",
+          `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS display_name TEXT`,
+        );
+        // Backfill: set owner = account_id for existing rows without an owner
+        await client.execute(
+          `UPDATE ${table} SET owner = account_id WHERE owner IS NULL`,
+        );
+        // Older deployments have a 32-bit `updated_at`; on Postgres the
+        // `Date.now()` written on every token save overflows int4. Widen in place
+        // (no-op once done / on fresh DBs). Unqualified name — the helper scopes
+        // to the `public` schema.
+        await widenIntColumnsToBigInt("oauth_tokens", ["updated_at"]);
+        return;
+      }
+
+      // SQLite (local dev): no lock problem — keep the original behaviour.
+      await client.execute(createSql);
       // Migration: add owner column to existing tables
       try {
         await client.execute(`ALTER TABLE ${table} ADD COLUMN owner TEXT`);

package/corpus/core/src/observability/store.ts

@@ -12,6 +12,11 @@ import {
   isPostgres,
   retryOnDdlRace,
 } from "../db/client.js";
+import {
+  ensureTableExists,
+  ensureColumnExists,
+  ensureIndexExists,
+} from "../db/ddl-guard.js";
 import { isDuplicateColumnError } from "../db/migrations.js";
 import type {
   TraceSpan,
@@ -70,8 +75,7 @@ export async function ensureObservabilityTables(): Promise<void> {
     _initPromise = (async () => {
       const client = getDbExec();
 
-      await retryOnDdlRace(() =>
-        client.execute(`
+      const traceSpansCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_trace_spans (
           id TEXT PRIMARY KEY,
           run_id TEXT NOT NULL,
@@ -91,11 +95,9 @@ export async function ensureObservabilityTables(): Promise<void> {
           metadata TEXT,
           created_at ${intType()} NOT NULL
         )
-      `),
-      );
+      `;
 
-      await retryOnDdlRace(() =>
-        client.execute(`
+      const traceSummariesCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_trace_summaries (
           run_id TEXT PRIMARY KEY,
           thread_id TEXT,
@@ -112,11 +114,9 @@ export async function ensureObservabilityTables(): Promise<void> {
           model TEXT NOT NULL DEFAULT '',
           created_at ${intType()} NOT NULL
         )
-      `),
-      );
+      `;
 
-      await retryOnDdlRace(() =>
-        client.execute(`
+      const feedbackCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_feedback (
           id TEXT PRIMARY KEY,
           run_id TEXT,
@@ -127,11 +127,9 @@ export async function ensureObservabilityTables(): Promise<void> {
           user_id TEXT,
           created_at ${intType()} NOT NULL
         )
-      `),
-      );
+      `;
 
-      await retryOnDdlRace(() =>
-        client.execute(`
+      const satisfactionScoresCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_satisfaction_scores (
           id TEXT PRIMARY KEY,
           thread_id TEXT NOT NULL,
@@ -143,11 +141,9 @@ export async function ensureObservabilityTables(): Promise<void> {
           length_trend_score REAL NOT NULL DEFAULT 0,
           computed_at ${intType()} NOT NULL
         )
-      `),
-      );
+      `;
 
-      await retryOnDdlRace(() =>
-        client.execute(`
+      const evalsCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_evals (
           id TEXT PRIMARY KEY,
           run_id TEXT NOT NULL,
@@ -160,11 +156,9 @@ export async function ensureObservabilityTables(): Promise<void> {
           metadata TEXT,
           created_at ${intType()} NOT NULL
         )
-      `),
-      );
+      `;
 
-      await retryOnDdlRace(() =>
-        client.execute(`
+      const evalDatasetsCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_eval_datasets (
           id TEXT PRIMARY KEY,
           name TEXT NOT NULL,
@@ -173,11 +167,9 @@ export async function ensureObservabilityTables(): Promise<void> {
           created_at ${intType()} NOT NULL,
           updated_at ${intType()} NOT NULL
         )
-      `),
-      );
+      `;
 
-      await retryOnDdlRace(() =>
-        client.execute(`
+      const experimentsCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_experiments (
           id TEXT PRIMARY KEY,
           name TEXT NOT NULL,
@@ -190,23 +182,9 @@ export async function ensureObservabilityTables(): Promise<void> {
           created_at ${intType()} NOT NULL,
           owner_email TEXT
         )
-      `),
-      );
-      // Additive migration for DBs created before the owner column shipped
-      // (any pre-existing rows have NULL owner — see `updateExperiment` for
-      // the migration semantics). Mutations on those rows fall back to the
-      // standard authentication gate but cannot enforce per-owner scoping
-      // until they're re-saved.
-      try {
-        await client.execute(
-          `ALTER TABLE agent_experiments ADD COLUMN owner_email TEXT`,
-        );
-      } catch {
-        // Column already exists — expected after first run.
-      }
+      `;
 
-      await retryOnDdlRace(() =>
-        client.execute(`
+      const experimentAssignmentsCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_experiment_assignments (
           experiment_id TEXT NOT NULL,
           user_id TEXT NOT NULL,
@@ -214,11 +192,9 @@ export async function ensureObservabilityTables(): Promise<void> {
           assigned_at ${intType()} NOT NULL,
           PRIMARY KEY (experiment_id, user_id)
         )
-      `),
-      );
+      `;
 
-      await retryOnDdlRace(() =>
-        client.execute(`
+      const experimentResultsCreateSql = `
         CREATE TABLE IF NOT EXISTS agent_experiment_results (
           id TEXT PRIMARY KEY,
           experiment_id TEXT NOT NULL,
@@ -230,9 +206,140 @@ export async function ensureObservabilityTables(): Promise<void> {
           confidence_high REAL NOT NULL DEFAULT 0,
           computed_at ${intType()} NOT NULL
         )
-      `),
+      `;
+
+      if (isPostgres()) {
+        // PG guard: probe → guarded DDL → re-probe; skips lock on already-migrated path
+        await ensureTableExists("agent_trace_spans", traceSpansCreateSql);
+        await ensureTableExists(
+          "agent_trace_summaries",
+          traceSummariesCreateSql,
+        );
+        await ensureTableExists("agent_feedback", feedbackCreateSql);
+        await ensureTableExists(
+          "agent_satisfaction_scores",
+          satisfactionScoresCreateSql,
+        );
+        await ensureTableExists("agent_evals", evalsCreateSql);
+        await ensureTableExists("agent_eval_datasets", evalDatasetsCreateSql);
+        await ensureTableExists("agent_experiments", experimentsCreateSql);
+        await ensureTableExists(
+          "agent_experiment_assignments",
+          experimentAssignmentsCreateSql,
+        );
+        await ensureTableExists(
+          "agent_experiment_results",
+          experimentResultsCreateSql,
+        );
+        await ensureColumnExists(
+          "agent_experiments",
+          "owner_email",
+          `ALTER TABLE agent_experiments ADD COLUMN IF NOT EXISTS owner_email TEXT`,
+        );
+        for (const table of USER_SCOPED_TABLES) {
+          await ensureColumnExists(
+            table,
+            "user_id",
+            `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS user_id TEXT`,
+          );
+        }
+        await ensureIndexExists(
+          "idx_trace_spans_run",
+          `CREATE INDEX IF NOT EXISTS idx_trace_spans_run ON agent_trace_spans (run_id)`,
+        );
+        await ensureIndexExists(
+          "idx_trace_spans_thread",
+          `CREATE INDEX IF NOT EXISTS idx_trace_spans_thread ON agent_trace_spans (thread_id)`,
+        );
+        await ensureIndexExists(
+          "idx_trace_spans_created",
+          `CREATE INDEX IF NOT EXISTS idx_trace_spans_created ON agent_trace_spans (created_at)`,
+        );
+        await ensureIndexExists(
+          "idx_trace_summaries_created",
+          `CREATE INDEX IF NOT EXISTS idx_trace_summaries_created ON agent_trace_summaries (created_at)`,
+        );
+        await ensureIndexExists(
+          "idx_trace_summaries_user",
+          `CREATE INDEX IF NOT EXISTS idx_trace_summaries_user ON agent_trace_summaries (user_id, created_at)`,
+        );
+        await ensureIndexExists(
+          "idx_trace_spans_user",
+          `CREATE INDEX IF NOT EXISTS idx_trace_spans_user ON agent_trace_spans (user_id)`,
+        );
+        await ensureIndexExists(
+          "idx_feedback_thread",
+          `CREATE INDEX IF NOT EXISTS idx_feedback_thread ON agent_feedback (thread_id)`,
+        );
+        await ensureIndexExists(
+          "idx_feedback_created",
+          `CREATE INDEX IF NOT EXISTS idx_feedback_created ON agent_feedback (created_at)`,
+        );
+        await ensureIndexExists(
+          "idx_feedback_user",
+          `CREATE INDEX IF NOT EXISTS idx_feedback_user ON agent_feedback (user_id, created_at)`,
+        );
+        await ensureIndexExists(
+          "idx_satisfaction_thread",
+          `CREATE INDEX IF NOT EXISTS idx_satisfaction_thread ON agent_satisfaction_scores (thread_id)`,
+        );
+        await ensureIndexExists(
+          "idx_satisfaction_user",
+          `CREATE INDEX IF NOT EXISTS idx_satisfaction_user ON agent_satisfaction_scores (user_id, computed_at)`,
+        );
+        await ensureIndexExists(
+          "idx_evals_run",
+          `CREATE INDEX IF NOT EXISTS idx_evals_run ON agent_evals (run_id)`,
+        );
+        await ensureIndexExists(
+          "idx_evals_created",
+          `CREATE INDEX IF NOT EXISTS idx_evals_created ON agent_evals (created_at)`,
+        );
+        await ensureIndexExists(
+          "idx_evals_user",
+          `CREATE INDEX IF NOT EXISTS idx_evals_user ON agent_evals (user_id, created_at)`,
+        );
+        await ensureIndexExists(
+          "idx_experiment_results_exp",
+          `CREATE INDEX IF NOT EXISTS idx_experiment_results_exp ON agent_experiment_results (experiment_id)`,
+        );
+        return;
+      }
+
+      // SQLite (local dev): no lock problem — keep the original behaviour.
+      await retryOnDdlRace(() => client.execute(traceSpansCreateSql));
+
+      await retryOnDdlRace(() => client.execute(traceSummariesCreateSql));
+
+      await retryOnDdlRace(() => client.execute(feedbackCreateSql));
+
+      await retryOnDdlRace(() => client.execute(satisfactionScoresCreateSql));
+
+      await retryOnDdlRace(() => client.execute(evalsCreateSql));
+
+      await retryOnDdlRace(() => client.execute(evalDatasetsCreateSql));
+
+      await retryOnDdlRace(() => client.execute(experimentsCreateSql));
+
+      // Additive migration for DBs created before the owner column shipped
+      // (any pre-existing rows have NULL owner — see `updateExperiment` for
+      // the migration semantics). Mutations on those rows fall back to the
+      // standard authentication gate but cannot enforce per-owner scoping
+      // until they're re-saved.
+      try {
+        await client.execute(
+          `ALTER TABLE agent_experiments ADD COLUMN owner_email TEXT`,
+        );
+      } catch {
+        // Column already exists — expected after first run.
+      }
+
+      await retryOnDdlRace(() =>
+        client.execute(experimentAssignmentsCreateSql),
       );
 
+      await retryOnDdlRace(() => client.execute(experimentResultsCreateSql));
+
       // Idempotent column upgrades for DBs created before per-user
       // isolation. SQLite has no `ADD COLUMN IF NOT EXISTS`; Postgres
       // surfaces "column ... already exists". `isDuplicateColumnError`

package/corpus/core/src/progress/store.ts

@@ -3,10 +3,11 @@ import { randomUUID } from "node:crypto";
 import {
   getDbExec,
   intType,
+  isPostgres,
   isUniqueViolation,
-  retryOnDdlRace,
   safeJsonParse,
 } from "../db/client.js";
+import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
 import { recordChange } from "../server/poll.js";
 import type {
   AgentRun,
@@ -42,32 +43,46 @@ async function ensureTable(): Promise<void> {
   if (!_initPromise) {
     _initPromise = (async () => {
       const client = getDbExec();
-      await retryOnDdlRace(() =>
-        client.execute(`
-          CREATE TABLE IF NOT EXISTS progress_runs (
-            id TEXT PRIMARY KEY,
-            owner TEXT NOT NULL,
-            title TEXT NOT NULL,
-            step TEXT,
-            percent ${intType()},
-            status TEXT NOT NULL DEFAULT 'running',
-            metadata TEXT,
-            started_at ${intType()} NOT NULL,
-            updated_at ${intType()} NOT NULL,
-            completed_at ${intType()}
-          )
-        `),
-      );
-      await retryOnDdlRace(() =>
-        client.execute(
+      const createSql = `
+        CREATE TABLE IF NOT EXISTS progress_runs (
+          id TEXT PRIMARY KEY,
+          owner TEXT NOT NULL,
+          title TEXT NOT NULL,
+          step TEXT,
+          percent ${intType()},
+          status TEXT NOT NULL DEFAULT 'running',
+          metadata TEXT,
+          started_at ${intType()} NOT NULL,
+          updated_at ${intType()} NOT NULL,
+          completed_at ${intType()}
+        )
+      `;
+
+      if (isPostgres()) {
+        // PG-guard: probe information_schema / pg_indexes before issuing DDL to
+        // avoid ACCESS EXCLUSIVE lock contention in fresh background-worker processes.
+        await ensureTableExists("progress_runs", createSql);
+        await ensureIndexExists(
+          "idx_progress_runs_owner_status",
           `CREATE INDEX IF NOT EXISTS idx_progress_runs_owner_status ON progress_runs (owner, status, started_at)`,
-        ),
-      );
+        );
+        return;
+      }
+
+      // SQLite (local dev): no lock problem — keep the original behaviour.
       // NOTE: table name is `progress_runs` (not `agent_runs`) to avoid
       // colliding with core's existing agent/run-store.ts which uses
       // `agent_runs` for agent-chat turn lifecycle tracking. These are
       // separate concerns — progress = user-facing task status, agent_runs =
       // internal chat turn bookkeeping.
+      await client.execute(createSql);
+      try {
+        await client.execute(
+          `CREATE INDEX IF NOT EXISTS idx_progress_runs_owner_status ON progress_runs (owner, status, started_at)`,
+        );
+      } catch {
+        // Index already exists or the dialect rejected a duplicate.
+      }
     })().catch((err) => {
       // Reset on failure so a transient DB outage doesn't poison the cached
       // promise and reject every future insert/update call for the lifetime

package/corpus/core/src/provider-api/corpus-jobs-store.ts

@@ -8,6 +8,7 @@
  */
 
 import { getDbExec, intType, isPostgres, type DbExec } from "../db/client.js";
+import { ensureTableExists, ensureIndexExists } from "../db/ddl-guard.js";
 
 export type ProviderCorpusJobStatus =
   | "running"
@@ -81,7 +82,7 @@ async function ensureTables(): Promise<void> {
     initPromise = (async () => {
       const db = getDbExec();
       const integerType = intType();
-      await db.execute(`
+      const createJobsSql = `
         CREATE TABLE IF NOT EXISTS provider_corpus_jobs (
           id TEXT NOT NULL,
           app_id TEXT NOT NULL,
@@ -108,18 +109,37 @@ async function ensureTables(): Promise<void> {
           updated_at ${integerType} NOT NULL,
           PRIMARY KEY (id)
         )
-      `);
-      await db.execute(`
+      `;
+      const createHitsSql = `
         CREATE TABLE IF NOT EXISTS provider_corpus_job_hits (
           job_id TEXT NOT NULL,
           hit_index ${integerType} NOT NULL,
           hit_data TEXT NOT NULL,
           PRIMARY KEY (job_id, hit_index)
         )
-      `);
+      `;
       if (isPostgres()) {
-        await widenPostgresIntegerColumns(db);
+        // PG guard: probe via information_schema, only issue DDL if missing, bounded lock_timeout
+        await ensureTableExists("provider_corpus_jobs", createJobsSql);
+        await ensureTableExists("provider_corpus_job_hits", createHitsSql);
+        await widenPostgresIntegerColumns(db); // best-effort type widening — unchanged
+        await ensureIndexExists(
+          "provider_corpus_jobs_scope_idx",
+          `CREATE INDEX IF NOT EXISTS provider_corpus_jobs_scope_idx ON provider_corpus_jobs (app_id, owner_email, updated_at)`,
+        );
+        await ensureIndexExists(
+          "provider_corpus_jobs_status_idx",
+          `CREATE INDEX IF NOT EXISTS provider_corpus_jobs_status_idx ON provider_corpus_jobs (app_id, owner_email, status)`,
+        );
+        await ensureIndexExists(
+          "provider_corpus_job_hits_job_idx",
+          `CREATE INDEX IF NOT EXISTS provider_corpus_job_hits_job_idx ON provider_corpus_job_hits (job_id)`,
+        );
+        return;
       }
+      // SQLite (local dev): keep existing behavior
+      await db.execute(createJobsSql);
+      await db.execute(createHitsSql);
       for (const ddl of [
         `CREATE INDEX IF NOT EXISTS provider_corpus_jobs_scope_idx ON provider_corpus_jobs (app_id, owner_email, updated_at)`,
         `CREATE INDEX IF NOT EXISTS provider_corpus_jobs_status_idx ON provider_corpus_jobs (app_id, owner_email, status)`,

package/corpus/core/src/provider-api/custom-registry.ts

@@ -21,6 +21,7 @@
  */
 
 import { getDbExec, isPostgres } from "../db/client.js";
+import { ensureTableExists } from "../db/ddl-guard.js";
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 import { isBlockedExtensionUrlWithDns } from "../extensions/url-safety.js";
 
@@ -91,10 +92,20 @@ async function ensureTable(): Promise<void> {
   if (!_initPromise) {
     _initPromise = (async () => {
       const client = getDbExec();
-      const sql = isPostgres()
-        ? CREATE_SQL.replace(/\bINTEGER\b/g, "BIGINT")
-        : CREATE_SQL;
-      await client.execute(sql);
+
+      if (isPostgres()) {
+        const pgSql = CREATE_SQL.replace(/\bINTEGER\b/g, "BIGINT");
+        // PG guard: probe via information_schema, only issue DDL if missing, bounded lock_timeout
+        await ensureTableExists("custom_api_providers", pgSql);
+        // Widen any pre-existing int4 timestamp columns to BIGINT (no-op once done)
+        await widenIntColumnsToBigInt("custom_api_providers", [
+          "created_at",
+          "updated_at",
+        ]);
+        return;
+      }
+      // SQLite (local dev): keep existing behavior
+      await client.execute(CREATE_SQL);
       // Fresh Postgres tables get BIGINT via the replace above, but tables
       // created before that compat existed kept int4 timestamp columns; widen
       // them so `Date.now()` writes don't overflow. No-op once done.

package/corpus/core/src/provider-api/quota-governor.ts

@@ -1,7 +1,8 @@
 import { createHash } from "node:crypto";
 
 import type { CredentialContext } from "../credentials/index.js";
-import { getDbExec, intType } from "../db/client.js";
+import { getDbExec, intType, isPostgres } from "../db/client.js";
+import { ensureTableExists, ensureIndexExists } from "../db/ddl-guard.js";
 
 export interface ProviderQuotaIdentityInput {
   appId: string;
@@ -398,7 +399,7 @@ async function ensureCooldownTable(): Promise<void> {
     state.initPromise = (async () => {
       const db = getDbExec();
       const integerType = intType();
-      await db.execute(`
+      const createSql = `
         CREATE TABLE IF NOT EXISTS provider_api_cooldowns (
           quota_key TEXT NOT NULL,
           provider_id TEXT NOT NULL,
@@ -409,7 +410,18 @@ async function ensureCooldownTable(): Promise<void> {
           updated_at ${integerType} NOT NULL,
           PRIMARY KEY (quota_key)
         )
-      `);
+      `;
+      if (isPostgres()) {
+        // PG guard: probe via information_schema, only issue DDL if missing, bounded lock_timeout
+        await ensureTableExists("provider_api_cooldowns", createSql);
+        await ensureIndexExists(
+          "provider_api_cooldowns_provider_idx",
+          `CREATE INDEX IF NOT EXISTS provider_api_cooldowns_provider_idx ON provider_api_cooldowns (provider_id, cooldown_until)`,
+        );
+        return;
+      }
+      // SQLite (local dev): keep existing behavior
+      await db.execute(createSql);
       try {
         await db.execute(
           `CREATE INDEX IF NOT EXISTS provider_api_cooldowns_provider_idx ON provider_api_cooldowns (provider_id, cooldown_until)`,