@agent-native/core 0.77.8 → 0.77.10

package/corpus/core/src/usage/store.ts

@@ -8,6 +8,11 @@
  * Cost is stored as "centicents" (1/100th of a cent) for integer precision.
  */
 import { getDbExec, intType, isPostgres } from "../db/client.js";
+import {
+  ensureColumnExists,
+  ensureIndexExists,
+  ensureTableExists,
+} from "../db/ddl-guard.js";
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 
 /**
@@ -191,7 +196,7 @@ async function ensureUsageTable(): Promise<void> {
   if (!_initPromise) {
     _initPromise = (async () => {
       const client = getDbExec();
-      await client.execute(`
+      const createSql = `
         CREATE TABLE IF NOT EXISTS token_usage (
           id ${intType()} PRIMARY KEY,
           owner_email TEXT NOT NULL,
@@ -206,11 +211,9 @@ async function ensureUsageTable(): Promise<void> {
           ref_id TEXT NOT NULL DEFAULT '',
           created_at ${intType()} NOT NULL
         )
-      `);
+      `;
 
-      // Add columns on older deployments that pre-date the label/cache
-      // fields. Each ALTER is wrapped so a dialect without IF NOT EXISTS
-      // (SQLite) still makes progress if only some columns are missing.
+      // Additive columns for older deployments that pre-date the label/cache fields.
       const additions: Array<[string, string]> = [
         ["cache_read_tokens", `${intType()} NOT NULL DEFAULT 0`],
         ["cache_write_tokens", `${intType()} NOT NULL DEFAULT 0`],
@@ -218,27 +221,59 @@ async function ensureUsageTable(): Promise<void> {
         ["app", `TEXT NOT NULL DEFAULT ''`],
         ["ref_id", `TEXT NOT NULL DEFAULT ''`],
       ];
+
+      if (isPostgres()) {
+        // Hot path: the `token_usage` table and its index are virtually always
+        // already present in production. Issuing `CREATE TABLE`/`ALTER TABLE`/
+        // `CREATE INDEX` still takes a lock that, in a fresh background-worker
+        // process behind a concurrent connection on the shared Neon DB, can
+        // block ~indefinitely. The ensure* wrappers probe `information_schema`/
+        // `pg_indexes` first (plain reads, no lock) and run DDL ONLY for what is
+        // actually missing, bounded by a transaction-scoped `lock_timeout`. If a
+        // swallowed lock-timeout leaves the schema still missing they RE-PROBE
+        // and THROW rather than letting init memoize success against absent
+        // schema.
+        await ensureTableExists("token_usage", createSql);
+        // Add columns on older deployments — guarded so the hot path (columns
+        // already present) skips the ACCESS EXCLUSIVE ALTER.
+        for (const [col, def] of additions) {
+          await ensureColumnExists(
+            "token_usage",
+            col,
+            `ALTER TABLE token_usage ADD COLUMN IF NOT EXISTS ${col} ${def}`,
+          );
+        }
+        // Older deployments created `created_at` as 32-bit `INTEGER`; on Postgres
+        // the `Date.now()` written per run by recordUsage() overflows int4. Widen
+        // it in place (no-op once done / on fresh BIGINT databases).
+        await widenIntColumnsToBigInt("token_usage", ["created_at"]);
+        // Probe pg_indexes first (no lock) and skip the SHARE-locking CREATE
+        // INDEX when the index is already present.
+        await ensureIndexExists(
+          "idx_token_usage_owner_created",
+          `CREATE INDEX IF NOT EXISTS idx_token_usage_owner_created ON token_usage (owner_email, created_at)`,
+        );
+        return;
+      }
+
+      // SQLite (local dev): no lock problem — keep the original behaviour.
+      await client.execute(createSql);
+      // Add columns on older deployments that pre-date the label/cache
+      // fields. Each ALTER is wrapped so a dialect without IF NOT EXISTS
+      // (SQLite) still makes progress if only some columns are missing.
       for (const [col, def] of additions) {
         try {
-          if (isPostgres()) {
-            await client.execute(
-              `ALTER TABLE token_usage ADD COLUMN IF NOT EXISTS ${col} ${def}`,
-            );
-          } else {
-            await client.execute(
-              `ALTER TABLE token_usage ADD COLUMN ${col} ${def}`,
-            );
-          }
+          await client.execute(
+            `ALTER TABLE token_usage ADD COLUMN ${col} ${def}`,
+          );
         } catch {
           // Column already exists — ignore
         }
       }
-
       // Older deployments created `created_at` as 32-bit `INTEGER`; on Postgres
       // the `Date.now()` written per run by recordUsage() overflows int4. Widen
       // it in place (no-op once done / on fresh BIGINT databases).
       await widenIntColumnsToBigInt("token_usage", ["created_at"]);
-
       try {
         await client.execute(
           `CREATE INDEX IF NOT EXISTS idx_token_usage_owner_created ON token_usage (owner_email, created_at)`,

package/corpus/core/src/workspace-connections/store.ts

@@ -15,6 +15,11 @@ import {
   safeJsonParse,
   type DbExec,
 } from "../db/client.js";
+import {
+  ensureColumnExists,
+  ensureIndexExists,
+  ensureTableExists,
+} from "../db/ddl-guard.js";
 import {
   getRequestOrgId,
   getRequestUserEmail,
@@ -459,8 +464,8 @@ export async function ensureWorkspaceConnectionsTable(): Promise<void> {
       const client = getDbExec();
       const table = workspaceConnectionsTable();
       const grantsTable = workspaceConnectionGrantsTable();
-      await retryOnDdlRace(() =>
-        client.execute(`
+
+      const createConnectionsSql = `
           CREATE TABLE IF NOT EXISTS ${table} (
             id TEXT PRIMARY KEY,
             provider TEXT NOT NULL DEFAULT '',
@@ -480,23 +485,8 @@ export async function ensureWorkspaceConnectionsTable(): Promise<void> {
             last_checked_at ${intType()},
             last_error TEXT
           )
-        `),
-      );
-
-      await ensureWorkspaceConnectionColumns(client, table);
-
-      await retryOnDdlRace(() =>
-        client.execute(
-          `CREATE INDEX IF NOT EXISTS idx_workspace_connections_scope_provider ON ${table} (org_id, owner_email, provider)`,
-        ),
-      );
-      await retryOnDdlRace(() =>
-        client.execute(
-          `CREATE INDEX IF NOT EXISTS idx_workspace_connections_updated_at ON ${table} (updated_at)`,
-        ),
-      );
-      await retryOnDdlRace(() =>
-        client.execute(`
+        `;
+      const createGrantsSql = `
           CREATE TABLE IF NOT EXISTS ${grantsTable} (
             id TEXT PRIMARY KEY,
             connection_id TEXT NOT NULL DEFAULT '',
@@ -512,11 +502,199 @@ export async function ensureWorkspaceConnectionsTable(): Promise<void> {
             updated_at ${intType()} NOT NULL DEFAULT 0,
             last_used_at ${intType()}
           )
-        `),
-      );
+        `;
+
+      if (isPostgres()) {
+        // PG-guard: probe information_schema / pg_indexes first (no lock) and
+        // only issue DDL when the table/column/index is actually missing,
+        // wrapped in a transaction-scoped lock_timeout so a contended lock
+        // fails fast. Uses unqualified table names for the probe (the helpers
+        // always search the `public` schema).
+
+        // --- workspace_connections ---
+        await ensureTableExists("workspace_connections", createConnectionsSql);
+        await ensureColumnExists(
+          "workspace_connections",
+          "provider",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS provider TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "label",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS label TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "account_id",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS account_id TEXT`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "account_label",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS account_label TEXT`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "status",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS status TEXT NOT NULL DEFAULT 'connected'`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "scopes_json",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS scopes_json TEXT NOT NULL DEFAULT '[]'`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "config_json",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS config_json TEXT NOT NULL DEFAULT '{}'`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "allowed_apps_json",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS allowed_apps_json TEXT NOT NULL DEFAULT '[]'`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "credential_refs_json",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS credential_refs_json TEXT NOT NULL DEFAULT '[]'`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "owner_email",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS owner_email TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "org_id",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS org_id TEXT`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "created_at",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS created_at ${intType()} NOT NULL DEFAULT 0`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "updated_at",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS updated_at ${intType()} NOT NULL DEFAULT 0`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "last_checked_at",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS last_checked_at ${intType()}`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "last_used_at",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS last_used_at ${intType()}`,
+        );
+        await ensureColumnExists(
+          "workspace_connections",
+          "last_error",
+          `ALTER TABLE workspace_connections ADD COLUMN IF NOT EXISTS last_error TEXT`,
+        );
+        await ensureIndexExists(
+          "idx_workspace_connections_scope_provider",
+          `CREATE INDEX IF NOT EXISTS idx_workspace_connections_scope_provider ON ${table} (org_id, owner_email, provider)`,
+        );
+        await ensureIndexExists(
+          "idx_workspace_connections_updated_at",
+          `CREATE INDEX IF NOT EXISTS idx_workspace_connections_updated_at ON ${table} (updated_at)`,
+        );
 
-      await ensureWorkspaceConnectionGrantColumns(client, grantsTable);
+        // --- workspace_connection_grants ---
+        await ensureTableExists("workspace_connection_grants", createGrantsSql);
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "connection_id",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS connection_id TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "provider",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS provider TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "app_id",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS app_id TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "scopes_json",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS scopes_json TEXT NOT NULL DEFAULT '[]'`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "config_json",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS config_json TEXT NOT NULL DEFAULT '{}'`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "credential_refs_json",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS credential_refs_json TEXT NOT NULL DEFAULT '[]'`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "granted_by_email",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS granted_by_email TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "owner_email",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS owner_email TEXT NOT NULL DEFAULT ''`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "org_id",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS org_id TEXT`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "created_at",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS created_at ${intType()} NOT NULL DEFAULT 0`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "updated_at",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS updated_at ${intType()} NOT NULL DEFAULT 0`,
+        );
+        await ensureColumnExists(
+          "workspace_connection_grants",
+          "last_used_at",
+          `ALTER TABLE workspace_connection_grants ADD COLUMN IF NOT EXISTS last_used_at ${intType()}`,
+        );
+        await ensureIndexExists(
+          "idx_workspace_connection_grants_connection_app",
+          `CREATE UNIQUE INDEX IF NOT EXISTS idx_workspace_connection_grants_connection_app ON ${grantsTable} (connection_id, app_id)`,
+        );
+        await ensureIndexExists(
+          "idx_workspace_connection_grants_scope_app",
+          `CREATE INDEX IF NOT EXISTS idx_workspace_connection_grants_scope_app ON ${grantsTable} (org_id, owner_email, app_id)`,
+        );
+        await ensureIndexExists(
+          "idx_workspace_connection_grants_updated_at",
+          `CREATE INDEX IF NOT EXISTS idx_workspace_connection_grants_updated_at ON ${grantsTable} (updated_at)`,
+        );
+        return;
+      }
 
+      // SQLite (local dev): no ACCESS EXCLUSIVE lock problem — keep existing
+      // retryOnDdlRace + ensureColumn behaviour.
+      await retryOnDdlRace(() => client.execute(createConnectionsSql));
+      await ensureWorkspaceConnectionColumns(client, table);
+      await retryOnDdlRace(() =>
+        client.execute(
+          `CREATE INDEX IF NOT EXISTS idx_workspace_connections_scope_provider ON ${table} (org_id, owner_email, provider)`,
+        ),
+      );
+      await retryOnDdlRace(() =>
+        client.execute(
+          `CREATE INDEX IF NOT EXISTS idx_workspace_connections_updated_at ON ${table} (updated_at)`,
+        ),
+      );
+      await retryOnDdlRace(() => client.execute(createGrantsSql));
+      await ensureWorkspaceConnectionGrantColumns(client, grantsTable);
       await retryOnDdlRace(() =>
         client.execute(
           `CREATE UNIQUE INDEX IF NOT EXISTS idx_workspace_connection_grants_connection_app ON ${grantsTable} (connection_id, app_id)`,

package/corpus/templates/calendar/changelog/2026-06-25-booking-link-previews-now-show-the-content-directly-on-the-g.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-06-25
+---
+
+Booking link previews now show the content directly on the grid background.

package/corpus/templates/calendar/server/lib/booking-og-image.ts

@@ -267,8 +267,6 @@ export function renderBookingOgImageSvg(input: BookingOgImageInput): string {
   </defs>
   <rect width="${WIDTH}" height="${HEIGHT}" fill="${BG}"/>
   <rect width="${WIDTH}" height="${HEIGHT}" fill="url(#grid)"/>
-  <rect x="64" y="64" width="1072" height="502" rx="28" fill="${BG}" fill-opacity="0.72" stroke="${BORDER}" stroke-width="1"/>
-  <path d="M80 154 H1120" stroke="${BORDER}"/>
   <g transform="translate(80 86)">
     <g transform="scale(0.62)">
       ${LOGO_MARK}

package/corpus/templates/forms/changelog/2026-06-25-form-previews-now-show-the-content-directly-on-the-grid-back.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-06-25
+---
+
+Form previews now show the content directly on the grid background.

package/corpus/templates/forms/server/lib/form-og-image.ts

@@ -168,8 +168,6 @@ export function renderFormOgImageSvg(input: FormOgImageInput = {}): string {
   </defs>
   <rect width="${WIDTH}" height="${HEIGHT}" fill="${BG}"/>
   <rect width="${WIDTH}" height="${HEIGHT}" fill="url(#grid)"/>
-  <rect x="64" y="64" width="1072" height="502" rx="28" fill="${BG}" fill-opacity="0.72" stroke="${BORDER}" stroke-width="1"/>
-  <path d="M80 154 H1120" stroke="${BORDER}"/>
   <g transform="translate(80 86)">
     <g transform="scale(0.62)">
       ${LOGO_MARK}

package/corpus/templates/plan/app/global.css

@@ -486,8 +486,10 @@
   padding-inline-start: 0.75rem;
 }
 
-/* Narrow-width stand-in for the contents rail; swapped in/out by the queries below. */
+/* Hidden below the rail breakpoint: the document should use the full reading
+ * width instead of replacing the rail with an inline contents widget. */
 .plan-document-toc-inline {
+  display: none;
   margin-top: 1.25rem;
   border: 1px solid var(--plan-line);
   border-radius: 0.75rem;
@@ -548,23 +550,16 @@
   list-style: none;
 }
 
-/* Hide the accordion once its rail shows, and in screenshot capture. */
+/* Hide the accordion in screenshot capture too. */
 .plan-content-surface[data-recap-screenshot-theme] .plan-document-toc-inline {
   display: none;
 }
-@container plan-doc (min-width: 48rem) {
-  .plan-content-surface:not([data-recap-screenshot-theme])
-    .plan-document-body[data-has-toc]
-    > .plan-document-toc-inline {
-    display: none;
-  }
-}
 
 /* Wide layout: the contents rail is a real grid column. A matching empty left
  * column balances the rail so the document itself remains visually centered. */
 
 /* Shared cell placement. Inert until the parent is a grid. */
-@container plan-doc (min-width: 48rem) {
+@container plan-doc (min-width: 1200px) {
   .plan-content-surface:not([data-recap-screenshot-theme])
     .plan-document-body
     > header {
@@ -588,7 +583,7 @@
 }
 
 /* Document + contents rail. The empty first column balances the right rail. */
-@container plan-doc (min-width: 48rem) {
+@container plan-doc (min-width: 1200px) {
   .plan-content-surface:not([data-recap-screenshot-theme])
     .plan-document-body[data-has-toc] {
     display: grid;

package/corpus/templates/plan/app/pages/PlansPage.tsx

@@ -593,22 +593,25 @@ export function shouldShowPlanLoadError(input: {
   hasSelectedId: boolean;
   localPlanMode: boolean;
   hasBundle: boolean;
-  planQueryPending: boolean;
+  planQueryInitialPending: boolean;
   planQueryError: boolean;
   planQueryPaused: boolean;
-  accessStatusPending: boolean;
+  accessStatusInitialPending: boolean;
   accessStatusPaused: boolean;
   accessDenied: boolean;
 }): boolean {
   if (!input.hasSelectedId || input.localPlanMode || input.hasBundle) {
     return false;
   }
-  // While a read is actively in flight, keep showing the skeleton.
-  if (input.planQueryPending) return false;
   if (input.planQueryError) return true;
+  if (!input.accessStatusInitialPending && input.accessDenied) return true;
+  // While the first read is actively in flight, keep showing the skeleton.
+  // Background refetches must not hide a settled access/error card.
+  if (input.planQueryInitialPending || input.accessStatusInitialPending) {
+    return false;
+  }
   // Paused/stalled read that will never settle on its own input.
   if (input.planQueryPaused || input.accessStatusPaused) return true;
-  if (!input.accessStatusPending && input.accessDenied) return true;
   return false;
 }
 
@@ -3120,17 +3123,16 @@ export function PlansPage({ localPlanSlug }: { localPlanSlug?: string } = {}) {
     Boolean(selectedId && !bundle && !localPlanMode),
   );
   const planAccessStatus = planAccessStatusQuery.data ?? null;
-  const planQueryPending = planQuery.isLoading || planQuery.isFetching;
-  const planAccessStatusPending =
-    planAccessStatusQuery.isLoading || planAccessStatusQuery.isFetching;
+  const planQueryInitialPending = planQuery.isLoading;
+  const planAccessStatusInitialPending = planAccessStatusQuery.isLoading;
   const showPlanLoadError = shouldShowPlanLoadError({
     hasSelectedId: Boolean(selectedId),
     localPlanMode,
     hasBundle: Boolean(bundle),
-    planQueryPending,
+    planQueryInitialPending,
     planQueryError: planQuery.isError,
     planQueryPaused: planQuery.isPaused,
-    accessStatusPending: planAccessStatusPending,
+    accessStatusInitialPending: planAccessStatusInitialPending,
     accessStatusPaused: planAccessStatusQuery.isPaused,
     accessDenied: Boolean(planAccessStatus && !planAccessStatus.hasAccess),
   });

package/corpus/templates/plan/changelog/2026-06-25-plan-access-request-pages-stay-visible-during-background-ref.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-06-25
+---
+
+Plan access request pages stay visible during background refreshes instead of flashing back to loading.

package/corpus/templates/plan/changelog/2026-06-25-plan-documents-keep-their-full-reading-width-below-1200px-an.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-06-25
+---
+
+Plan documents keep their full reading width below 1200px and show the contents rail only on wider screens.

package/dist/a2a/task-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-store.d.ts","sourceRoot":"","sources":["../../src/a2a/task-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AA2ErE,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GACzB,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUrE;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAwBtB;AAED,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IACjE,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,IAAI,CAAC,CAeR;AAED,wBAAsB,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa7E;AAED,wBAAsB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAazE;AAED,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,MAAM,EACV,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAsBlB;AAED,wBAAsB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAS9D;AAED,wBAAsB,UAAU,CAC9B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE;IACN,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;CACxB,GACA,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CA4CtB;AAED,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAgBnE"}
+{"version":3,"file":"task-store.d.ts","sourceRoot":"","sources":["../../src/a2a/task-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAgGrE,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GACzB,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUrE;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAwBtB;AAED,wBAAsB,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IACjE,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,IAAI,CAAC,CAeR;AAED,wBAAsB,0BAA0B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa7E;AAED,wBAAsB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAazE;AAED,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,MAAM,EACV,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,gBAAgB,EAAE,MAAM,EACxB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAsBlB;AAED,wBAAsB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAS9D;AAED,wBAAsB,UAAU,CAC9B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE;IACN,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;CACxB,GACA,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CA4CtB;AAED,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAgBnE"}

package/dist/a2a/task-store.js

@@ -1,11 +1,12 @@
 import crypto from "crypto";
-import { getDbExec, intType } from "../db/client.js";
+import { getDbExec, intType, isPostgres } from "../db/client.js";
+import { ensureTableExists, ensureColumnExists } from "../db/ddl-guard.js";
 let _initPromise;
 async function ensureTable() {
     if (!_initPromise) {
         _initPromise = (async () => {
             const client = getDbExec();
-            await client.execute(`
+            const createSql = `
         CREATE TABLE IF NOT EXISTS a2a_tasks (
           id TEXT PRIMARY KEY,
           context_id TEXT,
@@ -18,7 +19,22 @@ async function ensureTable() {
           created_at ${intType()} NOT NULL,
           updated_at ${intType()} NOT NULL
         )
-      `);
+      `;
+            if (isPostgres()) {
+                // PG-guard: probe information_schema before issuing DDL to avoid ACCESS
+                // EXCLUSIVE lock contention in fresh background-worker processes.
+                await ensureTableExists("a2a_tasks", createSql);
+                // Additive migration: owner_email column. Bound to the JWT-verified
+                // caller at task-creation time so handleGet / handleCancel can reject
+                // mismatched callers (the IDOR class fixed in PR #369). Existing rows
+                // have NULL owner_email and remain accessible to legacy callers via
+                // the legacy-token apiKeyEnv path; new rows are scoped from this point
+                // forward.
+                await ensureColumnExists("a2a_tasks", "owner_email", `ALTER TABLE a2a_tasks ADD COLUMN IF NOT EXISTS owner_email TEXT`);
+                return;
+            }
+            // SQLite (local dev): no lock problem — keep the original behaviour.
+            await client.execute(createSql);
             // Additive migration: owner_email column. Bound to the JWT-verified
             // caller at task-creation time so handleGet / handleCancel can reject
             // mismatched callers (the IDOR class fixed in PR #369). Existing rows