@agent-native/core 0.85.6 → 0.86.0

package/dist/db/migrations.js

@@ -15,7 +15,18 @@ let _migrationExecPromise = null;
 let _migrationExecRefCount = 0;
 async function acquireMigrationExec() {
     if (!_migrationExecPromise) {
-        _migrationExecPromise = createDbExec({ url: getMigrationDatabaseUrl() });
+        const opened = createDbExec({ url: getMigrationDatabaseUrl() });
+        _migrationExecPromise = opened;
+        opened.catch(() => {
+            // Opening the connection failed. Reset the shared state so the next
+            // caller retries with a fresh connection instead of awaiting this
+            // permanently rejected promise — and zero the ref count, because none
+            // of the awaiters that failed here will ever call release.
+            if (_migrationExecPromise === opened) {
+                _migrationExecPromise = null;
+                _migrationExecRefCount = 0;
+            }
+        });
     }
     _migrationExecRefCount++;
     return _migrationExecPromise;
@@ -149,6 +160,63 @@ function resolveMigrationSql(sql, pg) {
     const raw = pg ? sql.postgres : sql.sqlite;
     return raw ?? null;
 }
+/**
+ * Runs a list of migrations against the configured database, gated by a
+ * per-table bookkeeping row (`options.table`) so repeated boots only apply
+ * new migrations.
+ *
+ * ## Name-based tracking (why it exists)
+ *
+ * The legacy gate is purely numeric: `SELECT MAX(version)` from the
+ * bookkeeping table, then apply every entry whose `version` is greater. That
+ * scheme silently breaks down when **two independent branches each extend the
+ * same migration list with different DDL under the same version numbers** —
+ * exactly what happened to the analytics template's v75-v83 range. Branch A
+ * shipped alert-rule tables as v75-v78; branch B shipped unrelated DDL as its
+ * own v75-v83. Whichever branch deployed first recorded "v75..v83 applied"
+ * in the bookkeeping table. When the other branch merged and deployed, its
+ * migrations at those same version numbers were never applied — `MAX(version)`
+ * was already ≥ their version, so the gate treated them as done even though
+ * their actual DDL had never run. The result: `analytics_migrations` showed
+ * rows for 1..83 with no gaps, yet `analytics_alert_rules`,
+ * `analytics_alert_incidents`, and `session_recordings.network_error_count`
+ * did not exist in production. Version numbers are not a stable identity —
+ * they're just sequence position, and sequence position collides across
+ * branches.
+ *
+ * Name-based tracking fixes this by keying application on a stable, unique
+ * **string slug** instead of a position in a shared integer sequence:
+ *
+ * - Entries with a `name` are recorded in a companion table,
+ *   `${table}_named` (`name TEXT PRIMARY KEY`), and APPLY IFF their name is
+ *   absent from that table — completely independent of version numbers or
+ *   the legacy `MAX(version)` gate. Two branches can both ship a migration
+ *   named `"analytics-alert-rules-table"` at version 75, or one at version 75
+ *   and the other at version 90 after a rebase — either way it applies
+ *   exactly once per database, keyed on the name.
+ * - Entries WITHOUT a `name` keep the exact legacy behavior
+ *   (`version > MAX(recorded version)`), so nothing changes for existing
+ *   unnamed migrations.
+ * - Named migrations still execute in list order, interleaved with unnamed
+ *   ones exactly as written.
+ * - When a named migration's DDL runs, we record BOTH the named row (always)
+ *   and — if its `version` is greater than the current legacy max — the
+ *   legacy version row too, in the SAME atomic batch/transaction as the DDL.
+ *   This keeps the legacy `MAX(version)` gate monotonically advancing for
+ *   any unnamed migrations that come after it in the list, while ensuring a
+ *   named migration is never "double recorded" in a way that would let it
+ *   re-apply.
+ * - A duplicate `name` across the migration list throws at startup — that's
+ *   a programmer error (copy-paste or merge mistake), not a runtime data
+ *   problem, and failing loud beats silently tracking the wrong row.
+ *
+ * New migrations should always set a `name`. Legacy unnamed migrations don't
+ * need to be renamed retroactively — the two gating strategies coexist in the
+ * same list — but if a table is EVER at risk of being shared across parallel
+ * branches (any template's own migrations qualify, since branches routinely
+ * extend the same list concurrently), giving new entries a name is what makes
+ * them immune to the collision class described above.
+ */
 export function runMigrations(migrations, options) {
     const table = options?.table;
     if (!table ||
@@ -158,6 +226,21 @@ export function runMigrations(migrations, options) {
             '(e.g. `{ table: "slides_migrations" }`). See packages/core/src/db/migrations.ts ' +
             "for why this is required (shared-DB version-collision bug).");
     }
+    // Duplicate-name detection — programmer error, fail loud at startup rather
+    // than silently tracking the wrong migration's applied state.
+    {
+        const seenNames = new Set();
+        for (const m of migrations) {
+            if (!m.name)
+                continue;
+            if (seenNames.has(m.name)) {
+                throw new Error(`runMigrations: duplicate migration name "${m.name}" in the migration list for table "${table}". ` +
+                    "Migration names must be unique — pick a different stable slug.");
+            }
+            seenNames.add(m.name);
+        }
+    }
+    const namedTable = `${table}_named`;
     return async () => {
         try {
             // Check for Cloudflare D1 binding (only if DATABASE_URL not set)
@@ -166,19 +249,39 @@ export function runMigrations(migrations, options) {
                 await d1
                     .prepare(`CREATE TABLE IF NOT EXISTS ${table} (version INTEGER PRIMARY KEY)`)
                     .run();
+                await d1
+                    .prepare(`CREATE TABLE IF NOT EXISTS ${namedTable} (name TEXT PRIMARY KEY, version INTEGER, applied_at TEXT NOT NULL DEFAULT (datetime('now')))`)
+                    .run();
                 const firstRow = await d1
                     .prepare(`SELECT MAX(version) as v FROM ${table}`)
                     .first();
                 const current = firstRow?.v ?? 0;
-                for (const m of migrations.filter((m) => m.version > current)) {
+                const appliedNamesRows = await d1
+                    .prepare(`SELECT name FROM ${namedTable}`)
+                    .all();
+                const appliedNames = new Set((appliedNamesRows?.results ?? []).map((r) => String(r.name)));
+                const pending = migrations.filter((m) => m.name ? !appliedNames.has(m.name) : m.version > current);
+                for (const m of pending) {
                     try {
                         // D1 is SQLite-compatible
                         const raw = resolveMigrationSql(m.sql, false);
+                        const recordStatements = [
+                            m.name
+                                ? d1
+                                    .prepare(`INSERT OR IGNORE INTO ${namedTable} (name, version) VALUES (?, ?)`)
+                                    .bind(m.name, m.version)
+                                : null,
+                            m.version > current
+                                ? d1
+                                    .prepare(`INSERT OR IGNORE INTO ${table} VALUES (?)`)
+                                    .bind(m.version)
+                                : null,
+                        ].filter((s) => s != null);
                         if (raw == null) {
-                            await d1
-                                .prepare(`INSERT OR IGNORE INTO ${table} VALUES (?)`)
-                                .bind(m.version)
-                                .run();
+                            // Dialect-gated migration with no SQL for this dialect; still
+                            // record it so we don't retry forever.
+                            for (const stmt of recordStatements)
+                                await stmt.run();
                             continue;
                         }
                         const originalStatements = splitSqlStatements(raw);
@@ -203,26 +306,22 @@ export function runMigrations(migrations, options) {
                                     throw err;
                                 }
                             }
-                            await d1
-                                .prepare(`INSERT OR IGNORE INTO ${table} VALUES (?)`)
-                                .bind(m.version)
-                                .run();
+                            for (const stmt of recordStatements)
+                                await stmt.run();
                         }
                         else {
-                            // Atomic batch: all statements + version-row insert land in
+                            // Atomic batch: all statements + bookkeeping inserts land in
                             // the same transaction. A failing statement rolls the whole
-                            // migration back, so we never record a half-applied version.
+                            // migration back, so we never record a half-applied migration.
                             await d1.batch([
                                 ...statements.map((s) => d1.prepare(s.sql)),
-                                d1
-                                    .prepare(`INSERT OR IGNORE INTO ${table} VALUES (?)`)
-                                    .bind(m.version),
+                                ...recordStatements,
                             ]);
                         }
-                        console.log(`[db] Applied migration v${m.version} (${statements.length} statement${statements.length === 1 ? "" : "s"})`);
+                        console.log(`[db] Applied migration ${m.name ? `"${m.name}" ` : ""}v${m.version} (${statements.length} statement${statements.length === 1 ? "" : "s"})`);
                     }
                     catch (err) {
-                        console.error(`[db] Migration v${m.version} FAILED:`, err.message, "\nSQL:", JSON.stringify(m.sql));
+                        console.error(`[db] Migration ${m.name ? `"${m.name}" ` : ""}v${m.version} FAILED:`, err.message, "\nSQL:", JSON.stringify(m.sql));
                         throw err;
                     }
                 }
@@ -249,6 +348,11 @@ export function runMigrations(migrations, options) {
             // caller via releaseMigrationExec().
             // ---------------------------------------------------------------------------
             let current = -1; // sentinel: "table missing" → treat all as pending
+            let namedRowsMissing = false; // sentinel: "named table missing" → no names applied yet
+            // Any migration with a `name` is a candidate regardless of version, so
+            // the fast-path "anything pending?" check must also account for names.
+            const hasNamedMigrations = migrations.some((m) => m.name);
+            let appliedNames = new Set();
             if (pg) {
                 try {
                     const { rows } = await getDbExec().execute(`SELECT MAX(version) as v FROM ${table}`);
@@ -257,11 +361,22 @@ export function runMigrations(migrations, options) {
                 catch {
                     // Table doesn't exist yet — leave current = -1 so all migrations apply.
                 }
+                if (hasNamedMigrations) {
+                    try {
+                        const { rows } = await getDbExec().execute(`SELECT name FROM ${namedTable}`);
+                        appliedNames = new Set(rows.map((r) => String(r.name)));
+                    }
+                    catch {
+                        // Named table doesn't exist yet — leave appliedNames empty so all
+                        // named migrations apply.
+                        namedRowsMissing = true;
+                    }
+                }
             }
             // For SQLite we still use getDbExec() as exec throughout (no pooler concern).
             // For Postgres we only open the direct exec when there are pending migrations.
             const pendingFast = pg
-                ? migrations.filter((m) => m.version > current)
+                ? migrations.filter((m) => m.name ? !appliedNames.has(m.name) : m.version > current)
                 : null; // SQLite: compute after table creation below
             // Short-circuit: Postgres with nothing to do — skip the direct connection entirely.
             if (pg && pendingFast !== null && pendingFast.length === 0) {
@@ -275,31 +390,71 @@ export function runMigrations(migrations, options) {
                 // Retry initial table creation — SQLITE_BUSY_RECOVERY can occur on HMR
                 // restarts when WAL files from the previous process haven't been released yet.
                 await retrySqliteBusy(() => exec.execute(`CREATE TABLE IF NOT EXISTS ${table} (version INTEGER PRIMARY KEY)`), { maxAttempts: 6, baseDelayMs: 1000, rethrow: true });
+                // Companion name-keyed bookkeeping table — never alters the existing
+                // `${table}`'s PRIMARY KEY, so legacy version rows keep working exactly
+                // as before. See the `runMigrations` doc comment for why this exists.
+                await retrySqliteBusy(() => exec.execute(`CREATE TABLE IF NOT EXISTS ${namedTable} (name TEXT PRIMARY KEY, version INTEGER, applied_at ${pg ? "TIMESTAMP NOT NULL DEFAULT now()" : "TEXT NOT NULL DEFAULT (datetime('now'))"})`), { maxAttempts: 6, baseDelayMs: 1000, rethrow: true });
                 // For Postgres, current was already set by the fast-path SELECT above.
                 // For SQLite we run the SELECT now (via the same exec, which is the singleton).
                 if (!pg) {
                     const { rows } = await exec.execute(`SELECT MAX(version) as v FROM ${table}`);
                     current = rows[0]?.v ?? 0;
+                    if (hasNamedMigrations) {
+                        const { rows: nameRows } = await exec.execute(`SELECT name FROM ${namedTable}`);
+                        appliedNames = new Set(nameRows.map((r) => String(r.name)));
+                    }
                 }
-                else if (current === -1) {
+                else if (current === -1 || (hasNamedMigrations && namedRowsMissing)) {
                     // Fast-path read failed (table was absent on the pooler): re-read via the
                     // direct exec now that CREATE TABLE IF NOT EXISTS has ensured it exists.
-                    const { rows } = await exec.execute(`SELECT MAX(version) as v FROM ${table}`);
-                    current = rows[0]?.v ?? 0;
+                    if (current === -1) {
+                        const { rows } = await exec.execute(`SELECT MAX(version) as v FROM ${table}`);
+                        current = rows[0]?.v ?? 0;
+                    }
+                    if (hasNamedMigrations && namedRowsMissing) {
+                        const { rows: nameRows } = await exec.execute(`SELECT name FROM ${namedTable}`);
+                        appliedNames = new Set(nameRows.map((r) => String(r.name)));
+                    }
                 }
-                const insertSql = pg
+                const insertVersionSql = pg
                     ? `INSERT INTO ${table} VALUES (?) ON CONFLICT DO NOTHING`
                     : `INSERT OR IGNORE INTO ${table} VALUES (?)`;
-                const pending = migrations.filter((m) => m.version > current);
+                const insertNamedSql = pg
+                    ? `INSERT INTO ${namedTable} (name, version) VALUES (?, ?) ON CONFLICT DO NOTHING`
+                    : `INSERT OR IGNORE INTO ${namedTable} (name, version) VALUES (?, ?)`;
+                const pending = migrations.filter((m) => m.name ? !appliedNames.has(m.name) : m.version > current);
                 if (pending.length > 0) {
                     console.log(`[db] Applying ${pending.length} migration(s) on ${pg ? "Postgres" : "SQLite/libsql"}…`);
                 }
                 for (const m of pending) {
                     const raw = resolveMigrationSql(m.sql, pg);
+                    const label = m.name
+                        ? `"${m.name}" (v${m.version})`
+                        : `v${m.version}`;
+                    // Record BOTH the named row (always, when named) and the legacy
+                    // version row (only if this migration actually advances the legacy
+                    // MAX) — atomically with the DDL below. This keeps the legacy gate
+                    // monotonic for any unnamed migrations later in the list, while a
+                    // named migration is tracked by name regardless of version.
+                    const recordSql = [];
+                    if (m.name) {
+                        recordSql.push({
+                            sql: insertNamedSql,
+                            args: [m.name, m.version],
+                        });
+                    }
+                    if (m.version > current) {
+                        recordSql.push({ sql: insertVersionSql, args: [m.version] });
+                    }
                     if (raw == null) {
                         // Dialect-gated migration with no SQL for this dialect; still mark
                         // as applied so we don't retry forever.
-                        await exec.execute({ sql: insertSql, args: [m.version] });
+                        for (const stmt of recordSql)
+                            await exec.execute(stmt);
+                        if (m.version > current)
+                            current = m.version;
+                        if (m.name)
+                            appliedNames.add(m.name);
                         continue;
                     }
                     // Split BEFORE adapting so we can remember which original statements
@@ -326,26 +481,34 @@ export function runMigrations(migrations, options) {
                                 throw err;
                             }
                         }
-                        await exec.execute({ sql: insertSql, args: [m.version] });
-                        console.log(`[db] Applied migration v${m.version} (${statements.length} statement${statements.length === 1 ? "" : "s"})`);
+                        for (const stmt of recordSql)
+                            await exec.execute(stmt);
+                        if (m.version > current)
+                            current = m.version;
+                        if (m.name)
+                            appliedNames.add(m.name);
+                        console.log(`[db] Applied migration ${label} (${statements.length} statement${statements.length === 1 ? "" : "s"})`);
                     }
                     catch (err) {
                         if (pg && isPermissionError(err)) {
                             // The connected role lacks privilege for this migration (e.g. a
                             // permission-limited dev/replica role that doesn't own the table).
                             // Don't crash-loop the whole server over it — warn and STOP here.
-                            // We must NOT continue to later migrations: pending work is computed
-                            // as `version > MAX(recorded version)`, so applying a later migration
-                            // would advance MAX past this unrecorded one and orphan it forever.
-                            // Stopping leaves MAX at the last recorded version, so a properly-
-                            // privileged role resumes from this exact migration, in order.
-                            console.warn(`[db] Migration v${m.version} skipped — insufficient privilege: ${err.message}. ` +
+                            // We must NOT continue to later migrations: unnamed pending work is
+                            // computed as `version > MAX(recorded version)`, so applying a later
+                            // unnamed migration would advance MAX past this unrecorded one and
+                            // orphan it forever. Stopping leaves MAX at the last recorded
+                            // version, so a properly-privileged role resumes from this exact
+                            // migration, in order. (A named migration skipped here simply
+                            // isn't recorded by name either, so it's retried next boot same as
+                            // the legacy gate — no orphaning risk from name-based tracking.)
+                            console.warn(`[db] Migration ${label} skipped — insufficient privilege: ${err.message}. ` +
                                 `Apply it with a DB role that owns the table. ` +
                                 `Halting further migrations so this one isn't orphaned. ` +
                                 `Set <APP_NAME>_DATABASE_URL (e.g. PLAN_DATABASE_URL) to a database this app owns — a file: URL uses local SQLite.`, "\nStatement:", currentStmt);
                             break;
                         }
-                        console.error(`[db] Migration v${m.version} FAILED:`, err.message, "\nStatement:", currentStmt);
+                        console.error(`[db] Migration ${label} FAILED:`, err.message, "\nStatement:", currentStmt);
                         throw err;
                     }
                 }

package/dist/db/migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/db/migrations.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,uBAAuB,EACvB,eAAe,GAEhB,MAAM,aAAa,CAAC;AAErB,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,oEAAoE;AACpE,uEAAuE;AACvE,mEAAmE;AACnE,2EAA2E;AAC3E,uEAAuE;AACvE,wEAAwE;AACxE,8EAA8E;AAE9E,IAAI,qBAAqB,GAA2B,IAAI,CAAC;AACzD,IAAI,sBAAsB,GAAG,CAAC,CAAC;AAE/B,KAAK,UAAU,oBAAoB;IACjC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,qBAAqB,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,sBAAsB,EAAE,CAAC;IACzB,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,sBAAsB,EAAE,CAAC;IACzB,IAAI,sBAAsB,GAAG,CAAC;QAAE,OAAO;IACvC,sEAAsE;IACtE,MAAM,WAAW,GAAG,qBAAqB,CAAC;IAC1C,qBAAqB,GAAG,IAAI,CAAC;IAC7B,sBAAsB,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;QAC/B,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,8DAA8D;IAChE,CAAC;AACH,CAAC;AAID;;;GAGG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,GAAG;SACP,OAAO,CAAC,8BAA8B,EAAE,mBAAmB,CAAC;SAC5D,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC;SAClC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,2BAA2B,GAAG,mCAAmC,CAAC;AAExE;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,OAAO,CAAC,oCAAoC,EAAE,YAAY,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,MAAM,GAAG,GAAI,GAAyB,EAAE,OAAO,IAAI,EAAE,CAAC;IACtD,OAAO,CACL,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,CAAC,GAAG,GAAsD,CAAC;IACjE,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;IAC7B,OAAO,CACL,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7B,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,QAAQ,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC5C,sBAAsB;YACtB,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,GAAG,IAAI,EAAE,CAAC;YACV,IAAI,QAAQ,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC7B,GAAG,IAAI,IAAI,CAAC;gBACZ,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,OAAO;gBAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,GAAG,GAAG,EAAE,CAAC;YACT,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,GAAG,IAAI,EAAE,CAAC;QACV,CAAC,EAAE,CAAC;IACN,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,GAAG,CAAC;AACb,CAAC;AAoCD,SAAS,mBAAmB,CAAC,GAAiB,EAAE,EAAW;IACzD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IAC3C,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,UAAiC,EACjC,OAA6B;IAE7B,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IACE,CAAC,KAAK;QACN,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EACvC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+EAA+E;YAC7E,kFAAkF;YAClF,6DAA6D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC;YACH,iEAAiE;YACjE,MAAM,EAAE,GAAG,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAClE,IAAI,EAAE,EAAE,CAAC;gBACP,MAAM,EAAE;qBACL,OAAO,CACN,8BAA8B,KAAK,gCAAgC,CACpE;qBACA,GAAG,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAG,MAAM,EAAE;qBACtB,OAAO,CAAC,iCAAiC,KAAK,EAAE,CAAC;qBACjD,KAAK,EAAkB,CAAC;gBAC3B,MAAM,OAAO,GAAI,QAAQ,EAAE,CAAY,IAAI,CAAC,CAAC;gBAE7C,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC;oBAC9D,IAAI,CAAC;wBACH,0BAA0B;wBAC1B,MAAM,GAAG,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;wBAC9C,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;4BAChB,MAAM,EAAE;iCACL,OAAO,CAAC,yBAAyB,KAAK,aAAa,CAAC;iCACpD,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;iCACf,GAAG,EAAE,CAAC;4BACT,SAAS;wBACX,CAAC;wBACD,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;wBACnD,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;4BACnD,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC;4BAC5B,cAAc,EAAE,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;yBACvD,CAAC,CAAC,CAAC;wBACJ,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;wBAChE,IAAI,cAAc,EAAE,CAAC;4BACnB,4DAA4D;4BAC5D,gDAAgD;4BAChD,6DAA6D;4BAC7D,0DAA0D;4BAC1D,oDAAoD;4BACpD,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,UAAU,EAAE,CAAC;gCACvD,IAAI,CAAC;oCACH,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;gCAC/B,CAAC;gCAAC,OAAO,GAAG,EAAE,CAAC;oCACb,IAAI,cAAc,IAAI,sBAAsB,CAAC,GAAG,CAAC;wCAAE,SAAS;oCAC5D,MAAM,GAAG,CAAC;gCACZ,CAAC;4BACH,CAAC;4BACD,MAAM,EAAE;iCACL,OAAO,CAAC,yBAAyB,KAAK,aAAa,CAAC;iCACpD,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;iCACf,GAAG,EAAE,CAAC;wBACX,CAAC;6BAAM,CAAC;4BACN,4DAA4D;4BAC5D,4DAA4D;4BAC5D,6DAA6D;4BAC7D,MAAM,EAAE,CAAC,KAAK,CAAC;gCACb,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gCAC3C,EAAE;qCACC,OAAO,CAAC,yBAAyB,KAAK,aAAa,CAAC;qCACpD,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;6BACnB,CAAC,CAAC;wBACL,CAAC;wBACD,OAAO,CAAC,GAAG,CACT,2BAA2B,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,MAAM,aAAa,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAC7G,CAAC;oBACJ,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,CAAC,KAAK,CACX,mBAAmB,CAAC,CAAC,OAAO,UAAU,EACrC,GAAa,CAAC,OAAO,EACtB,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CACtB,CAAC;wBACF,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;gBACD,OAAO;YACT,CAAC;YAED,+CAA+C;YAC/C,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YAExB,8EAA8E;YAC9E,8EAA8E;YAC9E,0CAA0C;YAC1C,EAAE;YACF,8EAA8E;YAC9E,sEAAsE;YACtE,0EAA0E;YAC1E,4EAA4E;YAC5E,6DAA6D;YAC7D,EAAE;YACF,2EAA2E;YAC3E,yEAAyE;YACzE,6EAA6E;YAC7E,4EAA4E;YAC5E,2EAA2E;YAC3E,0EAA0E;YAC1E,qCAAqC;YACrC,8EAA8E;YAE9E,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,mDAAmD;YAErE,IAAI,EAAE,EAAE,CAAC;gBACP,IAAI,CAAC;oBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CACxC,iCAAiC,KAAK,EAAE,CACzC,CAAC;oBACF,OAAO,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAY,IAAI,CAAC,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,wEAAwE;gBAC1E,CAAC;YACH,CAAC;YAED,8EAA8E;YAC9E,+EAA+E;YAC/E,MAAM,WAAW,GAAG,EAAE;gBACpB,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC;gBAC/C,CAAC,CAAC,IAAI,CAAC,CAAC,6CAA6C;YAEvD,oFAAoF;YACpF,IAAI,EAAE,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3D,OAAO;YACT,CAAC;YAED,gDAAgD;YAChD,+EAA+E;YAC/E,oEAAoE;YACpE,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YAE7D,IAAI,CAAC;gBACH,uEAAuE;gBACvE,+EAA+E;gBAC/E,MAAM,eAAe,CACnB,GAAG,EAAE,CACH,IAAI,CAAC,OAAO,CACV,8BAA8B,KAAK,gCAAgC,CACpE,EACH,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CACrD,CAAC;gBAEF,uEAAuE;gBACvE,gFAAgF;gBAChF,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,iCAAiC,KAAK,EAAE,CACzC,CAAC;oBACF,OAAO,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAY,IAAI,CAAC,CAAC;gBACxC,CAAC;qBAAM,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC1B,0EAA0E;oBAC1E,yEAAyE;oBACzE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,iCAAiC,KAAK,EAAE,CACzC,CAAC;oBACF,OAAO,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAY,IAAI,CAAC,CAAC;gBACxC,CAAC;gBAED,MAAM,SAAS,GAAG,EAAE;oBAClB,CAAC,CAAC,eAAe,KAAK,oCAAoC;oBAC1D,CAAC,CAAC,yBAAyB,KAAK,aAAa,CAAC;gBAEhD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC;gBAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvB,OAAO,CAAC,GAAG,CACT,iBAAiB,OAAO,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,GAAG,CACxF,CAAC;gBACJ,CAAC;gBAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,GAAG,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBAC3C,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;wBAChB,mEAAmE;wBACnE,wCAAwC;wBACxC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;wBAC1D,SAAS;oBACX,CAAC;oBACD,qEAAqE;oBACrE,sEAAsE;oBACtE,iEAAiE;oBACjE,oCAAoC;oBACpC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;oBACnD,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBACnD,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC;wBAC7D,cAAc,EAAE,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;qBACvD,CAAC,CAAC,CAAC;oBACJ,IAAI,WAAW,GAAG,EAAE,CAAC;oBACrB,IAAI,CAAC;wBACH,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,UAAU,EAAE,CAAC;4BACvD,WAAW,GAAG,IAAI,CAAC;4BACnB,IAAI,CAAC;gCACH,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;4BAC3B,CAAC;4BAAC,OAAO,GAAG,EAAE,CAAC;gCACb,IAAI,CAAC,EAAE,IAAI,cAAc,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;oCACzD,wDAAwD;oCACxD,SAAS;gCACX,CAAC;gCACD,MAAM,GAAG,CAAC;4BACZ,CAAC;wBACH,CAAC;wBACD,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;wBAC1D,OAAO,CAAC,GAAG,CACT,2BAA2B,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,MAAM,aAAa,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAC7G,CAAC;oBACJ,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,EAAE,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;4BACjC,gEAAgE;4BAChE,mEAAmE;4BACnE,kEAAkE;4BAClE,qEAAqE;4BACrE,sEAAsE;4BACtE,oEAAoE;4BACpE,mEAAmE;4BACnE,+DAA+D;4BAC/D,OAAO,CAAC,IAAI,CACV,mBAAmB,CAAC,CAAC,OAAO,sCAAuC,GAAa,CAAC,OAAO,IAAI;gCAC1F,+CAA+C;gCAC/C,yDAAyD;gCACzD,mHAAmH,EACrH,cAAc,EACd,WAAW,CACZ,CAAC;4BACF,MAAM;wBACR,CAAC;wBACD,OAAO,CAAC,KAAK,CACX,mBAAmB,CAAC,CAAC,OAAO,UAAU,EACrC,GAAa,CAAC,OAAO,EACtB,cAAc,EACd,WAAW,CACZ,CAAC;wBACF,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,2EAA2E;gBAC3E,6EAA6E;gBAC7E,+EAA+E;gBAC/E,IAAI,EAAE;oBAAE,MAAM,oBAAoB,EAAE,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YAChE,uEAAuE;YACvE,oEAAoE;YACpE,oEAAoE;YACpE,sEAAsE;YACtE,kEAAkE;YAClE,qDAAqD;YACrD,MAAM,YAAY,GAChB,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO;gBAClC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,wBAAwB;gBACnD,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM;gBACjC,UAAU,IAAI,UAAU,CAAC;YAC3B,IAAI,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  getDbExec,\n  createDbExec,\n  isPostgres,\n  getDialect,\n  getMigrationDatabaseUrl,\n  retrySqliteBusy,\n  type DbExec,\n} from \"./client.js\";\n\n// ---------------------------------------------------------------------------\n// Shared direct-endpoint exec across concurrent migration runners per boot.\n//\n// On each serverless cold start THREE plugins call runMigrations (core,\n// org, context-xray). Without coordination each would open an independent\n// direct-endpoint Neon connection AND leave it idle for ~10 s after\n// migrations finish. We avoid that by sharing a single direct exec for\n// the duration of the migration window: the first caller opens it,\n// subsequent callers reuse the same promise, and the last caller closes it\n// via reference-counting. The exec is nulled out after the window so a\n// second cold start (e.g. after a Lambda thaw) gets a fresh connection.\n// ---------------------------------------------------------------------------\n\nlet _migrationExecPromise: Promise<DbExec> | null = null;\nlet _migrationExecRefCount = 0;\n\nasync function acquireMigrationExec(): Promise<DbExec> {\n  if (!_migrationExecPromise) {\n    _migrationExecPromise = createDbExec({ url: getMigrationDatabaseUrl() });\n  }\n  _migrationExecRefCount++;\n  return _migrationExecPromise;\n}\n\nasync function releaseMigrationExec(): Promise<void> {\n  _migrationExecRefCount--;\n  if (_migrationExecRefCount > 0) return;\n  // Last caller — close and reset so next boot gets a fresh connection.\n  const execPromise = _migrationExecPromise;\n  _migrationExecPromise = null;\n  _migrationExecRefCount = 0;\n  if (!execPromise) return;\n  try {\n    const exec = await execPromise;\n    await exec.close?.();\n  } catch {\n    // Swallow close errors — the migrations themselves already succeeded or\n    // failed; a cleanup error should not surface as a boot crash.\n  }\n}\n\ntype NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\n/**\n * Rewrite SQLite-specific SQL to Postgres-compatible equivalents.\n * Handles: datetime('now') → CURRENT_TIMESTAMP, AUTOINCREMENT → GENERATED, etc.\n */\nfunction adaptSqlForPostgres(sql: string): string {\n  return sql\n    .replace(/datetime\\s*\\(\\s*'now'\\s*\\)/gi, \"CURRENT_TIMESTAMP\")\n    .replace(/\\bAUTOINCREMENT\\b/gi, \"\")\n    .replace(/\\bINTEGER\\b/gi, \"BIGINT\");\n}\n\nconst IF_NOT_EXISTS_ADD_COLUMN_RE = /ADD\\s+COLUMN\\s+IF\\s+NOT\\s+EXISTS/i;\n\n/**\n * Strip Postgres-only syntax that SQLite doesn't support.\n * Handles: ALTER TABLE ... ADD COLUMN IF NOT EXISTS → ADD COLUMN\n *\n * Note: SQLite does not have a native equivalent, so the idempotent\n * semantic is emulated at the executor level by swallowing the\n * \"duplicate column name\" error for statements that originally carried\n * the clause. See `hadIfNotExists` tracking in the run loop.\n */\nfunction adaptSqlForSqlite(sql: string): string {\n  return sql.replace(/ADD\\s+COLUMN\\s+IF\\s+NOT\\s+EXISTS/gi, \"ADD COLUMN\");\n}\n\n/**\n * True when an error from `ALTER TABLE ... ADD COLUMN` indicates the\n * column already existed. Recognizes both SQLite (\"duplicate column\n * name\") and Postgres (\"column ... already exists\" — exact text varies\n * by error code 42701, but the substring is stable). Exported so other\n * idempotent column-upgrade loops in the codebase don't reinvent this\n * regex with subtly different shapes.\n */\nexport function isDuplicateColumnError(err: unknown): boolean {\n  const msg = (err as Error | undefined)?.message ?? \"\";\n  return (\n    /duplicate column name/i.test(msg) || /column .* already exists/i.test(msg)\n  );\n}\n\n/**\n * True when a migration statement failed because the connected DB ROLE lacks\n * privilege — e.g. a permission-limited dev/replica role that doesn't own the\n * table. Postgres raises SQLSTATE 42501 (\"insufficient_privilege\", routine\n * aclcheck_error, message \"must be owner of table …\"). We treat these as\n * NON-FATAL so a perms-limited database can't crash-loop the whole server: the\n * migration is skipped (left unrecorded) and a properly-privileged role applies\n * it later. Production, where the role owns its tables, never hits this path.\n */\nexport function isPermissionError(err: unknown): boolean {\n  const e = err as { code?: string; message?: string } | undefined;\n  if (e?.code === \"42501\") return true;\n  const msg = e?.message ?? \"\";\n  return (\n    /must be owner of/i.test(msg) ||\n    /permission denied/i.test(msg) ||\n    /insufficient privilege/i.test(msg)\n  );\n}\n\n/**\n * Split a multi-statement SQL blob into individual statements.\n *\n * libsql's `execute(sql)` only runs the first statement in a multi-statement\n * string. This splitter is intentionally simple: it respects single-quoted\n * string literals (with `''` escaping) and `--` line comments, and splits on\n * top-level `;`. It does NOT attempt to parse `$$`-quoted Postgres function\n * bodies — migrations that define functions/triggers with `;` inside bodies\n * should pass a single-statement migration per entry instead.\n */\nfunction splitSqlStatements(sql: string): string[] {\n  const out: string[] = [];\n  let buf = \"\";\n  let i = 0;\n  let inSingle = false;\n  while (i < sql.length) {\n    const ch = sql[i];\n    const next = sql[i + 1];\n    if (!inSingle && ch === \"-\" && next === \"-\") {\n      // Skip to end of line\n      while (i < sql.length && sql[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (ch === \"'\") {\n      buf += ch;\n      if (inSingle && next === \"'\") {\n        buf += next;\n        i += 2;\n        continue;\n      }\n      inSingle = !inSingle;\n      i++;\n      continue;\n    }\n    if (ch === \";\" && !inSingle) {\n      const trimmed = buf.trim();\n      if (trimmed) out.push(trimmed);\n      buf = \"\";\n      i++;\n      continue;\n    }\n    buf += ch;\n    i++;\n  }\n  const tail = buf.trim();\n  if (tail) out.push(tail);\n  return out;\n}\n\nexport interface RunMigrationsOptions {\n  /**\n   * Name of the migrations bookkeeping table. REQUIRED — there is intentionally\n   * no default. Two templates that share a database (e.g. via the same Neon URL)\n   * each have their own version space starting at v1, and a single shared\n   * `_migrations` table will silently skip the second template's migrations if\n   * the first has already advanced past those version numbers. This caused the\n   * design template's migrations to be skipped entirely on a Neon DB that\n   * slides had already populated up to v15 (PR #320 era).\n   *\n   * Use one bookkeeping table per template, e.g. `slides_migrations`. Core\n   * feature plugins (e.g. the org module) follow the same convention with\n   * their own prefix, e.g. `_org_migrations`.\n   */\n  table: string;\n}\n\n/**\n * A single migration entry.\n *\n * `sql` can be a string (runs on every dialect) or an object with dialect\n * keys for dialect-gated SQL. Useful when Postgres needs an ALTER that\n * SQLite can't parse.\n *\n *   { version: 14, sql: { postgres: \"ALTER TABLE …\" } }  // no-op on sqlite\n *   { version: 15, sql: { sqlite: \"…\", postgres: \"…\" } } // both dialects\n */\nexport type MigrationSql = string | { postgres?: string; sqlite?: string };\n\nexport interface MigrationEntry {\n  version: number;\n  sql: MigrationSql;\n}\n\nfunction resolveMigrationSql(sql: MigrationSql, pg: boolean): string | null {\n  if (typeof sql === \"string\") return sql;\n  const raw = pg ? sql.postgres : sql.sqlite;\n  return raw ?? null;\n}\n\nexport function runMigrations(\n  migrations: Array<MigrationEntry>,\n  options: RunMigrationsOptions,\n): NitroPluginDef {\n  const table = options?.table;\n  if (\n    !table ||\n    typeof table !== \"string\" ||\n    !/^[A-Za-z_][A-Za-z0-9_]*$/.test(table)\n  ) {\n    throw new Error(\n      \"runMigrations: `table` option is required and must be a valid SQL identifier \" +\n        '(e.g. `{ table: \"slides_migrations\" }`). See packages/core/src/db/migrations.ts ' +\n        \"for why this is required (shared-DB version-collision bug).\",\n    );\n  }\n  return async () => {\n    try {\n      // Check for Cloudflare D1 binding (only if DATABASE_URL not set)\n      const d1 = getDialect() === \"d1\" ? globalThis.__cf_env?.DB : null;\n      if (d1) {\n        await d1\n          .prepare(\n            `CREATE TABLE IF NOT EXISTS ${table} (version INTEGER PRIMARY KEY)`,\n          )\n          .run();\n        const firstRow = await d1\n          .prepare(`SELECT MAX(version) as v FROM ${table}`)\n          .first<{ v?: number }>();\n        const current = (firstRow?.v as number) ?? 0;\n\n        for (const m of migrations.filter((m) => m.version > current)) {\n          try {\n            // D1 is SQLite-compatible\n            const raw = resolveMigrationSql(m.sql, false);\n            if (raw == null) {\n              await d1\n                .prepare(`INSERT OR IGNORE INTO ${table} VALUES (?)`)\n                .bind(m.version)\n                .run();\n              continue;\n            }\n            const originalStatements = splitSqlStatements(raw);\n            const statements = originalStatements.map((orig) => ({\n              sql: adaptSqlForSqlite(orig),\n              hadIfNotExists: IF_NOT_EXISTS_ADD_COLUMN_RE.test(orig),\n            }));\n            const hasIfNotExists = statements.some((s) => s.hadIfNotExists);\n            if (hasIfNotExists) {\n              // Per-statement path: we need to swallow \"duplicate column\"\n              // errors for statements that originally carried\n              // `ADD COLUMN IF NOT EXISTS`, which a batch() can't express.\n              // Loses atomicity, but the idempotent-ADD-COLUMN semantic\n              // means a partial re-run resolves cleanly on retry.\n              for (const { sql: stmt, hadIfNotExists } of statements) {\n                try {\n                  await d1.prepare(stmt).run();\n                } catch (err) {\n                  if (hadIfNotExists && isDuplicateColumnError(err)) continue;\n                  throw err;\n                }\n              }\n              await d1\n                .prepare(`INSERT OR IGNORE INTO ${table} VALUES (?)`)\n                .bind(m.version)\n                .run();\n            } else {\n              // Atomic batch: all statements + version-row insert land in\n              // the same transaction. A failing statement rolls the whole\n              // migration back, so we never record a half-applied version.\n              await d1.batch([\n                ...statements.map((s) => d1.prepare(s.sql)),\n                d1\n                  .prepare(`INSERT OR IGNORE INTO ${table} VALUES (?)`)\n                  .bind(m.version),\n              ]);\n            }\n            console.log(\n              `[db] Applied migration v${m.version} (${statements.length} statement${statements.length === 1 ? \"\" : \"s\"})`,\n            );\n          } catch (err) {\n            console.error(\n              `[db] Migration v${m.version} FAILED:`,\n              (err as Error).message,\n              \"\\nSQL:\",\n              JSON.stringify(m.sql),\n            );\n            throw err;\n          }\n        }\n        return;\n      }\n\n      // Generic path — works for libsql and Postgres\n      const pg = isPostgres();\n\n      // ---------------------------------------------------------------------------\n      // Fast-path: read migration state through the regular pooled singleton before\n      // opening the direct-endpoint connection.\n      //\n      // On Postgres every cold start previously opened a fresh direct-endpoint Neon\n      // connection (bypassing PgBouncer, which is needed only for DDL), ran\n      // CREATE TABLE IF NOT EXISTS + SELECT MAX(version) even with zero pending\n      // migrations, and never closed the pool — it idled for ~10 s. Three runners\n      // (core, org, context-xray) did this independently per boot.\n      //\n      // Now: use the pooled singleton (getDbExec) for the bookkeeping SELECT. If\n      // the migrations table does not yet exist we treat it as \"all migrations\n      // pending\" (current = -1). Only when there are pending migrations do we open\n      // the direct-endpoint exec (DDL is the only thing Neon's PgBouncer blocks —\n      // documented at getMigrationDatabaseUrl). The direct exec is shared across\n      // concurrent runners via acquireMigrationExec() and closed after the last\n      // caller via releaseMigrationExec().\n      // ---------------------------------------------------------------------------\n\n      let current = -1; // sentinel: \"table missing\" → treat all as pending\n\n      if (pg) {\n        try {\n          const { rows } = await getDbExec().execute(\n            `SELECT MAX(version) as v FROM ${table}`,\n          );\n          current = (rows[0]?.v as number) ?? 0;\n        } catch {\n          // Table doesn't exist yet — leave current = -1 so all migrations apply.\n        }\n      }\n\n      // For SQLite we still use getDbExec() as exec throughout (no pooler concern).\n      // For Postgres we only open the direct exec when there are pending migrations.\n      const pendingFast = pg\n        ? migrations.filter((m) => m.version > current)\n        : null; // SQLite: compute after table creation below\n\n      // Short-circuit: Postgres with nothing to do — skip the direct connection entirely.\n      if (pg && pendingFast !== null && pendingFast.length === 0) {\n        return;\n      }\n\n      // Acquire the exec appropriate for the dialect.\n      // For Postgres: the shared direct-endpoint exec (DDL-safe, closed on release).\n      // For SQLite/libsql: the singleton pooled exec (no pooler concern).\n      const exec = pg ? await acquireMigrationExec() : getDbExec();\n\n      try {\n        // Retry initial table creation — SQLITE_BUSY_RECOVERY can occur on HMR\n        // restarts when WAL files from the previous process haven't been released yet.\n        await retrySqliteBusy(\n          () =>\n            exec.execute(\n              `CREATE TABLE IF NOT EXISTS ${table} (version INTEGER PRIMARY KEY)`,\n            ),\n          { maxAttempts: 6, baseDelayMs: 1000, rethrow: true },\n        );\n\n        // For Postgres, current was already set by the fast-path SELECT above.\n        // For SQLite we run the SELECT now (via the same exec, which is the singleton).\n        if (!pg) {\n          const { rows } = await exec.execute(\n            `SELECT MAX(version) as v FROM ${table}`,\n          );\n          current = (rows[0]?.v as number) ?? 0;\n        } else if (current === -1) {\n          // Fast-path read failed (table was absent on the pooler): re-read via the\n          // direct exec now that CREATE TABLE IF NOT EXISTS has ensured it exists.\n          const { rows } = await exec.execute(\n            `SELECT MAX(version) as v FROM ${table}`,\n          );\n          current = (rows[0]?.v as number) ?? 0;\n        }\n\n        const insertSql = pg\n          ? `INSERT INTO ${table} VALUES (?) ON CONFLICT DO NOTHING`\n          : `INSERT OR IGNORE INTO ${table} VALUES (?)`;\n\n        const pending = migrations.filter((m) => m.version > current);\n        if (pending.length > 0) {\n          console.log(\n            `[db] Applying ${pending.length} migration(s) on ${pg ? \"Postgres\" : \"SQLite/libsql\"}…`,\n          );\n        }\n\n        for (const m of pending) {\n          const raw = resolveMigrationSql(m.sql, pg);\n          if (raw == null) {\n            // Dialect-gated migration with no SQL for this dialect; still mark\n            // as applied so we don't retry forever.\n            await exec.execute({ sql: insertSql, args: [m.version] });\n            continue;\n          }\n          // Split BEFORE adapting so we can remember which original statements\n          // carried `ADD COLUMN IF NOT EXISTS` — SQLite drops the clause, so we\n          // emulate the idempotent semantic by swallowing duplicate-column\n          // errors only for those statements.\n          const originalStatements = splitSqlStatements(raw);\n          const statements = originalStatements.map((orig) => ({\n            sql: pg ? adaptSqlForPostgres(orig) : adaptSqlForSqlite(orig),\n            hadIfNotExists: IF_NOT_EXISTS_ADD_COLUMN_RE.test(orig),\n          }));\n          let currentStmt = \"\";\n          try {\n            for (const { sql: stmt, hadIfNotExists } of statements) {\n              currentStmt = stmt;\n              try {\n                await exec.execute(stmt);\n              } catch (err) {\n                if (!pg && hadIfNotExists && isDuplicateColumnError(err)) {\n                  // IF NOT EXISTS semantic: column already present, skip.\n                  continue;\n                }\n                throw err;\n              }\n            }\n            await exec.execute({ sql: insertSql, args: [m.version] });\n            console.log(\n              `[db] Applied migration v${m.version} (${statements.length} statement${statements.length === 1 ? \"\" : \"s\"})`,\n            );\n          } catch (err) {\n            if (pg && isPermissionError(err)) {\n              // The connected role lacks privilege for this migration (e.g. a\n              // permission-limited dev/replica role that doesn't own the table).\n              // Don't crash-loop the whole server over it — warn and STOP here.\n              // We must NOT continue to later migrations: pending work is computed\n              // as `version > MAX(recorded version)`, so applying a later migration\n              // would advance MAX past this unrecorded one and orphan it forever.\n              // Stopping leaves MAX at the last recorded version, so a properly-\n              // privileged role resumes from this exact migration, in order.\n              console.warn(\n                `[db] Migration v${m.version} skipped — insufficient privilege: ${(err as Error).message}. ` +\n                  `Apply it with a DB role that owns the table. ` +\n                  `Halting further migrations so this one isn't orphaned. ` +\n                  `Set <APP_NAME>_DATABASE_URL (e.g. PLAN_DATABASE_URL) to a database this app owns — a file: URL uses local SQLite.`,\n                \"\\nStatement:\",\n                currentStmt,\n              );\n              break;\n            }\n            console.error(\n              `[db] Migration v${m.version} FAILED:`,\n              (err as Error).message,\n              \"\\nStatement:\",\n              currentStmt,\n            );\n            throw err;\n          }\n        }\n      } finally {\n        // Release the direct-endpoint exec (Postgres only). For SQLite getDbExec()\n        // returns the process-lifetime singleton, so releaseMigrationExec is a no-op\n        // (refCount never incremented for SQLite path, guard in releaseMigrationExec).\n        if (pg) await releaseMigrationExec();\n      }\n    } catch (err) {\n      console.error(\"[db] Migration failed:\", (err as Error).message);\n      // In local dev, hard-fail so the developer catches errors immediately.\n      // On serverless runtimes (Netlify Functions, Vercel, CF Workers) we\n      // keep the process alive — the app will return 500s for routes that\n      // depend on the missing tables, but at least other routes still work.\n      // Note: Node.js 21+ defines globalThis.navigator, so we check for\n      // serverless env vars instead of navigator presence.\n      const isServerless =\n        !!globalThis.process?.env?.NETLIFY ||\n        !!globalThis.process?.env?.AWS_LAMBDA_FUNCTION_NAME ||\n        !!globalThis.process?.env?.VERCEL ||\n        \"__cf_env\" in globalThis;\n      if (typeof globalThis.process?.exit === \"function\" && !isServerless) {\n        process.exit(1);\n      }\n    }\n  };\n}\n"]}
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/db/migrations.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,uBAAuB,EACvB,eAAe,GAEhB,MAAM,aAAa,CAAC;AAErB,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,oEAAoE;AACpE,uEAAuE;AACvE,mEAAmE;AACnE,2EAA2E;AAC3E,uEAAuE;AACvE,wEAAwE;AACxE,8EAA8E;AAE9E,IAAI,qBAAqB,GAA2B,IAAI,CAAC;AACzD,IAAI,sBAAsB,GAAG,CAAC,CAAC;AAE/B,KAAK,UAAU,oBAAoB;IACjC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;QAChE,qBAAqB,GAAG,MAAM,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,oEAAoE;YACpE,kEAAkE;YAClE,sEAAsE;YACtE,2DAA2D;YAC3D,IAAI,qBAAqB,KAAK,MAAM,EAAE,CAAC;gBACrC,qBAAqB,GAAG,IAAI,CAAC;gBAC7B,sBAAsB,GAAG,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,sBAAsB,EAAE,CAAC;IACzB,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,sBAAsB,EAAE,CAAC;IACzB,IAAI,sBAAsB,GAAG,CAAC;QAAE,OAAO;IACvC,sEAAsE;IACtE,MAAM,WAAW,GAAG,qBAAqB,CAAC;IAC1C,qBAAqB,GAAG,IAAI,CAAC;IAC7B,sBAAsB,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;QAC/B,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,8DAA8D;IAChE,CAAC;AACH,CAAC;AAID;;;GAGG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,GAAG;SACP,OAAO,CAAC,8BAA8B,EAAE,mBAAmB,CAAC;SAC5D,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC;SAClC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,2BAA2B,GAAG,mCAAmC,CAAC;AAExE;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,OAAO,CAAC,oCAAoC,EAAE,YAAY,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,MAAM,GAAG,GAAI,GAAyB,EAAE,OAAO,IAAI,EAAE,CAAC;IACtD,OAAO,CACL,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,MAAM,CAAC,GAAG,GAAsD,CAAC;IACjE,IAAI,CAAC,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;IAC7B,OAAO,CACL,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7B,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,QAAQ,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC5C,sBAAsB;YACtB,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,GAAG,IAAI,EAAE,CAAC;YACV,IAAI,QAAQ,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC7B,GAAG,IAAI,IAAI,CAAC;gBACZ,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,OAAO;gBAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,GAAG,GAAG,EAAE,CAAC;YACT,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,GAAG,IAAI,EAAE,CAAC;QACV,CAAC,EAAE,CAAC;IACN,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,GAAG,CAAC;AACb,CAAC;AAiDD,SAAS,mBAAmB,CAAC,GAAiB,EAAE,EAAW;IACzD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IAC3C,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAiC,EACjC,OAA6B;IAE7B,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IACE,CAAC,KAAK;QACN,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EACvC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+EAA+E;YAC7E,kFAAkF;YAClF,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,8DAA8D;IAC9D,CAAC;QACC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,SAAS;YACtB,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,4CAA4C,CAAC,CAAC,IAAI,sCAAsC,KAAK,KAAK;oBAChG,gEAAgE,CACnE,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,KAAK,QAAQ,CAAC;IAEpC,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC;YACH,iEAAiE;YACjE,MAAM,EAAE,GAAG,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAClE,IAAI,EAAE,EAAE,CAAC;gBACP,MAAM,EAAE;qBACL,OAAO,CACN,8BAA8B,KAAK,gCAAgC,CACpE;qBACA,GAAG,EAAE,CAAC;gBACT,MAAM,EAAE;qBACL,OAAO,CACN,8BAA8B,UAAU,+FAA+F,CACxI;qBACA,GAAG,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAG,MAAM,EAAE;qBACtB,OAAO,CAAC,iCAAiC,KAAK,EAAE,CAAC;qBACjD,KAAK,EAAkB,CAAC;gBAC3B,MAAM,OAAO,GAAI,QAAQ,EAAE,CAAY,IAAI,CAAC,CAAC;gBAE7C,MAAM,gBAAgB,GAAG,MAAM,EAAE;qBAC9B,OAAO,CAAC,oBAAoB,UAAU,EAAE,CAAC;qBACzC,GAAG,EAAE,CAAC;gBACT,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,CAAC,gBAAgB,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAC7D,CAAC;gBAEF,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACtC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,OAAO,CACzD,CAAC;gBAEF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,IAAI,CAAC;wBACH,0BAA0B;wBAC1B,MAAM,GAAG,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;wBAC9C,MAAM,gBAAgB,GAAG;4BACvB,CAAC,CAAC,IAAI;gCACJ,CAAC,CAAC,EAAE;qCACC,OAAO,CACN,yBAAyB,UAAU,gCAAgC,CACpE;qCACA,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;gCAC5B,CAAC,CAAC,IAAI;4BACR,CAAC,CAAC,OAAO,GAAG,OAAO;gCACjB,CAAC,CAAC,EAAE;qCACC,OAAO,CAAC,yBAAyB,KAAK,aAAa,CAAC;qCACpD,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;gCACpB,CAAC,CAAC,IAAI;yBACT,CAAC,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;wBAEvD,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;4BAChB,8DAA8D;4BAC9D,uCAAuC;4BACvC,KAAK,MAAM,IAAI,IAAI,gBAAgB;gCAAE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;4BACtD,SAAS;wBACX,CAAC;wBACD,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;wBACnD,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;4BACnD,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC;4BAC5B,cAAc,EAAE,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;yBACvD,CAAC,CAAC,CAAC;wBACJ,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;wBAChE,IAAI,cAAc,EAAE,CAAC;4BACnB,4DAA4D;4BAC5D,gDAAgD;4BAChD,6DAA6D;4BAC7D,0DAA0D;4BAC1D,oDAAoD;4BACpD,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,UAAU,EAAE,CAAC;gCACvD,IAAI,CAAC;oCACH,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;gCAC/B,CAAC;gCAAC,OAAO,GAAG,EAAE,CAAC;oCACb,IAAI,cAAc,IAAI,sBAAsB,CAAC,GAAG,CAAC;wCAAE,SAAS;oCAC5D,MAAM,GAAG,CAAC;gCACZ,CAAC;4BACH,CAAC;4BACD,KAAK,MAAM,IAAI,IAAI,gBAAgB;gCAAE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;wBACxD,CAAC;6BAAM,CAAC;4BACN,6DAA6D;4BAC7D,4DAA4D;4BAC5D,+DAA+D;4BAC/D,MAAM,EAAE,CAAC,KAAK,CAAC;gCACb,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gCAC3C,GAAG,gBAAgB;6BACpB,CAAC,CAAC;wBACL,CAAC;wBACD,OAAO,CAAC,GAAG,CACT,0BAA0B,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,MAAM,aAAa,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAC5I,CAAC;oBACJ,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,CAAC,KAAK,CACX,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,UAAU,EACpE,GAAa,CAAC,OAAO,EACtB,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CACtB,CAAC;wBACF,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;gBACD,OAAO;YACT,CAAC;YAED,+CAA+C;YAC/C,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YAExB,8EAA8E;YAC9E,8EAA8E;YAC9E,0CAA0C;YAC1C,EAAE;YACF,8EAA8E;YAC9E,sEAAsE;YACtE,0EAA0E;YAC1E,4EAA4E;YAC5E,6DAA6D;YAC7D,EAAE;YACF,2EAA2E;YAC3E,yEAAyE;YACzE,6EAA6E;YAC7E,4EAA4E;YAC5E,2EAA2E;YAC3E,0EAA0E;YAC1E,qCAAqC;YACrC,8EAA8E;YAE9E,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,mDAAmD;YACrE,IAAI,gBAAgB,GAAG,KAAK,CAAC,CAAC,yDAAyD;YAEvF,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,kBAAkB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;YAErC,IAAI,EAAE,EAAE,CAAC;gBACP,IAAI,CAAC;oBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CACxC,iCAAiC,KAAK,EAAE,CACzC,CAAC;oBACF,OAAO,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAY,IAAI,CAAC,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,wEAAwE;gBAC1E,CAAC;gBACD,IAAI,kBAAkB,EAAE,CAAC;oBACvB,IAAI,CAAC;wBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CACxC,oBAAoB,UAAU,EAAE,CACjC,CAAC;wBACF,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC1D,CAAC;oBAAC,MAAM,CAAC;wBACP,kEAAkE;wBAClE,0BAA0B;wBAC1B,gBAAgB,GAAG,IAAI,CAAC;oBAC1B,CAAC;gBACH,CAAC;YACH,CAAC;YAED,8EAA8E;YAC9E,+EAA+E;YAC/E,MAAM,WAAW,GAAG,EAAE;gBACpB,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACtB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,OAAO,CACzD;gBACH,CAAC,CAAC,IAAI,CAAC,CAAC,6CAA6C;YAEvD,oFAAoF;YACpF,IAAI,EAAE,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3D,OAAO;YACT,CAAC;YAED,gDAAgD;YAChD,+EAA+E;YAC/E,oEAAoE;YACpE,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YAE7D,IAAI,CAAC;gBACH,uEAAuE;gBACvE,+EAA+E;gBAC/E,MAAM,eAAe,CACnB,GAAG,EAAE,CACH,IAAI,CAAC,OAAO,CACV,8BAA8B,KAAK,gCAAgC,CACpE,EACH,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CACrD,CAAC;gBACF,qEAAqE;gBACrE,wEAAwE;gBACxE,sEAAsE;gBACtE,MAAM,eAAe,CACnB,GAAG,EAAE,CACH,IAAI,CAAC,OAAO,CACV,8BAA8B,UAAU,wDAAwD,EAAE,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,yCAAyC,GAAG,CACvL,EACH,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CACrD,CAAC;gBAEF,uEAAuE;gBACvE,gFAAgF;gBAChF,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,iCAAiC,KAAK,EAAE,CACzC,CAAC;oBACF,OAAO,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAY,IAAI,CAAC,CAAC;oBACtC,IAAI,kBAAkB,EAAE,CAAC;wBACvB,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAC3C,oBAAoB,UAAU,EAAE,CACjC,CAAC;wBACF,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9D,CAAC;gBACH,CAAC;qBAAM,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,IAAI,gBAAgB,CAAC,EAAE,CAAC;oBACtE,0EAA0E;oBAC1E,yEAAyE;oBACzE,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;wBACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC,iCAAiC,KAAK,EAAE,CACzC,CAAC;wBACF,OAAO,GAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAY,IAAI,CAAC,CAAC;oBACxC,CAAC;oBACD,IAAI,kBAAkB,IAAI,gBAAgB,EAAE,CAAC;wBAC3C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAC3C,oBAAoB,UAAU,EAAE,CACjC,CAAC;wBACF,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9D,CAAC;gBACH,CAAC;gBAED,MAAM,gBAAgB,GAAG,EAAE;oBACzB,CAAC,CAAC,eAAe,KAAK,oCAAoC;oBAC1D,CAAC,CAAC,yBAAyB,KAAK,aAAa,CAAC;gBAChD,MAAM,cAAc,GAAG,EAAE;oBACvB,CAAC,CAAC,eAAe,UAAU,uDAAuD;oBAClF,CAAC,CAAC,yBAAyB,UAAU,gCAAgC,CAAC;gBAExE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACtC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,OAAO,CACzD,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvB,OAAO,CAAC,GAAG,CACT,iBAAiB,OAAO,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,GAAG,CACxF,CAAC;gBACJ,CAAC;gBAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,GAAG,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI;wBAClB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,GAAG;wBAC/B,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;oBAEpB,gEAAgE;oBAChE,mEAAmE;oBACnE,mEAAmE;oBACnE,kEAAkE;oBAClE,4DAA4D;oBAC5D,MAAM,SAAS,GAA4C,EAAE,CAAC;oBAC9D,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;wBACX,SAAS,CAAC,IAAI,CAAC;4BACb,GAAG,EAAE,cAAc;4BACnB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;yBAC1B,CAAC,CAAC;oBACL,CAAC;oBACD,IAAI,CAAC,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;wBACxB,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC/D,CAAC;oBAED,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;wBAChB,mEAAmE;wBACnE,wCAAwC;wBACxC,KAAK,MAAM,IAAI,IAAI,SAAS;4BAAE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBACvD,IAAI,CAAC,CAAC,OAAO,GAAG,OAAO;4BAAE,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;wBAC7C,IAAI,CAAC,CAAC,IAAI;4BAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;wBACrC,SAAS;oBACX,CAAC;oBACD,qEAAqE;oBACrE,sEAAsE;oBACtE,iEAAiE;oBACjE,oCAAoC;oBACpC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;oBACnD,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;wBACnD,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC;wBAC7D,cAAc,EAAE,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;qBACvD,CAAC,CAAC,CAAC;oBACJ,IAAI,WAAW,GAAG,EAAE,CAAC;oBACrB,IAAI,CAAC;wBACH,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,UAAU,EAAE,CAAC;4BACvD,WAAW,GAAG,IAAI,CAAC;4BACnB,IAAI,CAAC;gCACH,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;4BAC3B,CAAC;4BAAC,OAAO,GAAG,EAAE,CAAC;gCACb,IAAI,CAAC,EAAE,IAAI,cAAc,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;oCACzD,wDAAwD;oCACxD,SAAS;gCACX,CAAC;gCACD,MAAM,GAAG,CAAC;4BACZ,CAAC;wBACH,CAAC;wBACD,KAAK,MAAM,IAAI,IAAI,SAAS;4BAAE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBACvD,IAAI,CAAC,CAAC,OAAO,GAAG,OAAO;4BAAE,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;wBAC7C,IAAI,CAAC,CAAC,IAAI;4BAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;wBACrC,OAAO,CAAC,GAAG,CACT,0BAA0B,KAAK,KAAK,UAAU,CAAC,MAAM,aAAa,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CACxG,CAAC;oBACJ,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,EAAE,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;4BACjC,gEAAgE;4BAChE,mEAAmE;4BACnE,kEAAkE;4BAClE,oEAAoE;4BACpE,qEAAqE;4BACrE,mEAAmE;4BACnE,8DAA8D;4BAC9D,iEAAiE;4BACjE,8DAA8D;4BAC9D,mEAAmE;4BACnE,iEAAiE;4BACjE,OAAO,CAAC,IAAI,CACV,kBAAkB,KAAK,sCAAuC,GAAa,CAAC,OAAO,IAAI;gCACrF,+CAA+C;gCAC/C,yDAAyD;gCACzD,mHAAmH,EACrH,cAAc,EACd,WAAW,CACZ,CAAC;4BACF,MAAM;wBACR,CAAC;wBACD,OAAO,CAAC,KAAK,CACX,kBAAkB,KAAK,UAAU,EAChC,GAAa,CAAC,OAAO,EACtB,cAAc,EACd,WAAW,CACZ,CAAC;wBACF,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,2EAA2E;gBAC3E,6EAA6E;gBAC7E,+EAA+E;gBAC/E,IAAI,EAAE;oBAAE,MAAM,oBAAoB,EAAE,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YAChE,uEAAuE;YACvE,oEAAoE;YACpE,oEAAoE;YACpE,sEAAsE;YACtE,kEAAkE;YAClE,qDAAqD;YACrD,MAAM,YAAY,GAChB,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO;gBAClC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,wBAAwB;gBACnD,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM;gBACjC,UAAU,IAAI,UAAU,CAAC;YAC3B,IAAI,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  getDbExec,\n  createDbExec,\n  isPostgres,\n  getDialect,\n  getMigrationDatabaseUrl,\n  retrySqliteBusy,\n  type DbExec,\n} from \"./client.js\";\n\n// ---------------------------------------------------------------------------\n// Shared direct-endpoint exec across concurrent migration runners per boot.\n//\n// On each serverless cold start THREE plugins call runMigrations (core,\n// org, context-xray). Without coordination each would open an independent\n// direct-endpoint Neon connection AND leave it idle for ~10 s after\n// migrations finish. We avoid that by sharing a single direct exec for\n// the duration of the migration window: the first caller opens it,\n// subsequent callers reuse the same promise, and the last caller closes it\n// via reference-counting. The exec is nulled out after the window so a\n// second cold start (e.g. after a Lambda thaw) gets a fresh connection.\n// ---------------------------------------------------------------------------\n\nlet _migrationExecPromise: Promise<DbExec> | null = null;\nlet _migrationExecRefCount = 0;\n\nasync function acquireMigrationExec(): Promise<DbExec> {\n  if (!_migrationExecPromise) {\n    const opened = createDbExec({ url: getMigrationDatabaseUrl() });\n    _migrationExecPromise = opened;\n    opened.catch(() => {\n      // Opening the connection failed. Reset the shared state so the next\n      // caller retries with a fresh connection instead of awaiting this\n      // permanently rejected promise — and zero the ref count, because none\n      // of the awaiters that failed here will ever call release.\n      if (_migrationExecPromise === opened) {\n        _migrationExecPromise = null;\n        _migrationExecRefCount = 0;\n      }\n    });\n  }\n  _migrationExecRefCount++;\n  return _migrationExecPromise;\n}\n\nasync function releaseMigrationExec(): Promise<void> {\n  _migrationExecRefCount--;\n  if (_migrationExecRefCount > 0) return;\n  // Last caller — close and reset so next boot gets a fresh connection.\n  const execPromise = _migrationExecPromise;\n  _migrationExecPromise = null;\n  _migrationExecRefCount = 0;\n  if (!execPromise) return;\n  try {\n    const exec = await execPromise;\n    await exec.close?.();\n  } catch {\n    // Swallow close errors — the migrations themselves already succeeded or\n    // failed; a cleanup error should not surface as a boot crash.\n  }\n}\n\ntype NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\n/**\n * Rewrite SQLite-specific SQL to Postgres-compatible equivalents.\n * Handles: datetime('now') → CURRENT_TIMESTAMP, AUTOINCREMENT → GENERATED, etc.\n */\nfunction adaptSqlForPostgres(sql: string): string {\n  return sql\n    .replace(/datetime\\s*\\(\\s*'now'\\s*\\)/gi, \"CURRENT_TIMESTAMP\")\n    .replace(/\\bAUTOINCREMENT\\b/gi, \"\")\n    .replace(/\\bINTEGER\\b/gi, \"BIGINT\");\n}\n\nconst IF_NOT_EXISTS_ADD_COLUMN_RE = /ADD\\s+COLUMN\\s+IF\\s+NOT\\s+EXISTS/i;\n\n/**\n * Strip Postgres-only syntax that SQLite doesn't support.\n * Handles: ALTER TABLE ... ADD COLUMN IF NOT EXISTS → ADD COLUMN\n *\n * Note: SQLite does not have a native equivalent, so the idempotent\n * semantic is emulated at the executor level by swallowing the\n * \"duplicate column name\" error for statements that originally carried\n * the clause. See `hadIfNotExists` tracking in the run loop.\n */\nfunction adaptSqlForSqlite(sql: string): string {\n  return sql.replace(/ADD\\s+COLUMN\\s+IF\\s+NOT\\s+EXISTS/gi, \"ADD COLUMN\");\n}\n\n/**\n * True when an error from `ALTER TABLE ... ADD COLUMN` indicates the\n * column already existed. Recognizes both SQLite (\"duplicate column\n * name\") and Postgres (\"column ... already exists\" — exact text varies\n * by error code 42701, but the substring is stable). Exported so other\n * idempotent column-upgrade loops in the codebase don't reinvent this\n * regex with subtly different shapes.\n */\nexport function isDuplicateColumnError(err: unknown): boolean {\n  const msg = (err as Error | undefined)?.message ?? \"\";\n  return (\n    /duplicate column name/i.test(msg) || /column .* already exists/i.test(msg)\n  );\n}\n\n/**\n * True when a migration statement failed because the connected DB ROLE lacks\n * privilege — e.g. a permission-limited dev/replica role that doesn't own the\n * table. Postgres raises SQLSTATE 42501 (\"insufficient_privilege\", routine\n * aclcheck_error, message \"must be owner of table …\"). We treat these as\n * NON-FATAL so a perms-limited database can't crash-loop the whole server: the\n * migration is skipped (left unrecorded) and a properly-privileged role applies\n * it later. Production, where the role owns its tables, never hits this path.\n */\nexport function isPermissionError(err: unknown): boolean {\n  const e = err as { code?: string; message?: string } | undefined;\n  if (e?.code === \"42501\") return true;\n  const msg = e?.message ?? \"\";\n  return (\n    /must be owner of/i.test(msg) ||\n    /permission denied/i.test(msg) ||\n    /insufficient privilege/i.test(msg)\n  );\n}\n\n/**\n * Split a multi-statement SQL blob into individual statements.\n *\n * libsql's `execute(sql)` only runs the first statement in a multi-statement\n * string. This splitter is intentionally simple: it respects single-quoted\n * string literals (with `''` escaping) and `--` line comments, and splits on\n * top-level `;`. It does NOT attempt to parse `$$`-quoted Postgres function\n * bodies — migrations that define functions/triggers with `;` inside bodies\n * should pass a single-statement migration per entry instead.\n */\nfunction splitSqlStatements(sql: string): string[] {\n  const out: string[] = [];\n  let buf = \"\";\n  let i = 0;\n  let inSingle = false;\n  while (i < sql.length) {\n    const ch = sql[i];\n    const next = sql[i + 1];\n    if (!inSingle && ch === \"-\" && next === \"-\") {\n      // Skip to end of line\n      while (i < sql.length && sql[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (ch === \"'\") {\n      buf += ch;\n      if (inSingle && next === \"'\") {\n        buf += next;\n        i += 2;\n        continue;\n      }\n      inSingle = !inSingle;\n      i++;\n      continue;\n    }\n    if (ch === \";\" && !inSingle) {\n      const trimmed = buf.trim();\n      if (trimmed) out.push(trimmed);\n      buf = \"\";\n      i++;\n      continue;\n    }\n    buf += ch;\n    i++;\n  }\n  const tail = buf.trim();\n  if (tail) out.push(tail);\n  return out;\n}\n\nexport interface RunMigrationsOptions {\n  /**\n   * Name of the migrations bookkeeping table. REQUIRED — there is intentionally\n   * no default. Two templates that share a database (e.g. via the same Neon URL)\n   * each have their own version space starting at v1, and a single shared\n   * `_migrations` table will silently skip the second template's migrations if\n   * the first has already advanced past those version numbers. This caused the\n   * design template's migrations to be skipped entirely on a Neon DB that\n   * slides had already populated up to v15 (PR #320 era).\n   *\n   * Use one bookkeeping table per template, e.g. `slides_migrations`. Core\n   * feature plugins (e.g. the org module) follow the same convention with\n   * their own prefix, e.g. `_org_migrations`.\n   */\n  table: string;\n}\n\n/**\n * A single migration entry.\n *\n * `sql` can be a string (runs on every dialect) or an object with dialect\n * keys for dialect-gated SQL. Useful when Postgres needs an ALTER that\n * SQLite can't parse.\n *\n *   { version: 14, sql: { postgres: \"ALTER TABLE …\" } }  // no-op on sqlite\n *   { version: 15, sql: { sqlite: \"…\", postgres: \"…\" } } // both dialects\n *\n * `name` is an optional stable, unique slug that opts a migration into\n * **name-based tracking** instead of the legacy version-number gate. See the\n * \"Name-based tracking\" section on `runMigrations` for why this exists and\n * exactly how the two gating strategies interact.\n */\nexport type MigrationSql = string | { postgres?: string; sqlite?: string };\n\nexport interface MigrationEntry {\n  version: number;\n  sql: MigrationSql;\n  /**\n   * Stable, unique slug for this migration (e.g. `\"analytics-alert-rules-table\"`).\n   * When present, this migration is tracked by NAME instead of by version\n   * number — see the `runMigrations` doc comment for the full rationale and\n   * gating rules. Must be unique across the migration list; a duplicate name\n   * throws at startup (programmer error, not a runtime data problem).\n   */\n  name?: string;\n}\n\nfunction resolveMigrationSql(sql: MigrationSql, pg: boolean): string | null {\n  if (typeof sql === \"string\") return sql;\n  const raw = pg ? sql.postgres : sql.sqlite;\n  return raw ?? null;\n}\n\n/**\n * Runs a list of migrations against the configured database, gated by a\n * per-table bookkeeping row (`options.table`) so repeated boots only apply\n * new migrations.\n *\n * ## Name-based tracking (why it exists)\n *\n * The legacy gate is purely numeric: `SELECT MAX(version)` from the\n * bookkeeping table, then apply every entry whose `version` is greater. That\n * scheme silently breaks down when **two independent branches each extend the\n * same migration list with different DDL under the same version numbers** —\n * exactly what happened to the analytics template's v75-v83 range. Branch A\n * shipped alert-rule tables as v75-v78; branch B shipped unrelated DDL as its\n * own v75-v83. Whichever branch deployed first recorded \"v75..v83 applied\"\n * in the bookkeeping table. When the other branch merged and deployed, its\n * migrations at those same version numbers were never applied — `MAX(version)`\n * was already ≥ their version, so the gate treated them as done even though\n * their actual DDL had never run. The result: `analytics_migrations` showed\n * rows for 1..83 with no gaps, yet `analytics_alert_rules`,\n * `analytics_alert_incidents`, and `session_recordings.network_error_count`\n * did not exist in production. Version numbers are not a stable identity —\n * they're just sequence position, and sequence position collides across\n * branches.\n *\n * Name-based tracking fixes this by keying application on a stable, unique\n * **string slug** instead of a position in a shared integer sequence:\n *\n * - Entries with a `name` are recorded in a companion table,\n *   `${table}_named` (`name TEXT PRIMARY KEY`), and APPLY IFF their name is\n *   absent from that table — completely independent of version numbers or\n *   the legacy `MAX(version)` gate. Two branches can both ship a migration\n *   named `\"analytics-alert-rules-table\"` at version 75, or one at version 75\n *   and the other at version 90 after a rebase — either way it applies\n *   exactly once per database, keyed on the name.\n * - Entries WITHOUT a `name` keep the exact legacy behavior\n *   (`version > MAX(recorded version)`), so nothing changes for existing\n *   unnamed migrations.\n * - Named migrations still execute in list order, interleaved with unnamed\n *   ones exactly as written.\n * - When a named migration's DDL runs, we record BOTH the named row (always)\n *   and — if its `version` is greater than the current legacy max — the\n *   legacy version row too, in the SAME atomic batch/transaction as the DDL.\n *   This keeps the legacy `MAX(version)` gate monotonically advancing for\n *   any unnamed migrations that come after it in the list, while ensuring a\n *   named migration is never \"double recorded\" in a way that would let it\n *   re-apply.\n * - A duplicate `name` across the migration list throws at startup — that's\n *   a programmer error (copy-paste or merge mistake), not a runtime data\n *   problem, and failing loud beats silently tracking the wrong row.\n *\n * New migrations should always set a `name`. Legacy unnamed migrations don't\n * need to be renamed retroactively — the two gating strategies coexist in the\n * same list — but if a table is EVER at risk of being shared across parallel\n * branches (any template's own migrations qualify, since branches routinely\n * extend the same list concurrently), giving new entries a name is what makes\n * them immune to the collision class described above.\n */\nexport function runMigrations(\n  migrations: Array<MigrationEntry>,\n  options: RunMigrationsOptions,\n): NitroPluginDef {\n  const table = options?.table;\n  if (\n    !table ||\n    typeof table !== \"string\" ||\n    !/^[A-Za-z_][A-Za-z0-9_]*$/.test(table)\n  ) {\n    throw new Error(\n      \"runMigrations: `table` option is required and must be a valid SQL identifier \" +\n        '(e.g. `{ table: \"slides_migrations\" }`). See packages/core/src/db/migrations.ts ' +\n        \"for why this is required (shared-DB version-collision bug).\",\n    );\n  }\n\n  // Duplicate-name detection — programmer error, fail loud at startup rather\n  // than silently tracking the wrong migration's applied state.\n  {\n    const seenNames = new Set<string>();\n    for (const m of migrations) {\n      if (!m.name) continue;\n      if (seenNames.has(m.name)) {\n        throw new Error(\n          `runMigrations: duplicate migration name \"${m.name}\" in the migration list for table \"${table}\". ` +\n            \"Migration names must be unique — pick a different stable slug.\",\n        );\n      }\n      seenNames.add(m.name);\n    }\n  }\n\n  const namedTable = `${table}_named`;\n\n  return async () => {\n    try {\n      // Check for Cloudflare D1 binding (only if DATABASE_URL not set)\n      const d1 = getDialect() === \"d1\" ? globalThis.__cf_env?.DB : null;\n      if (d1) {\n        await d1\n          .prepare(\n            `CREATE TABLE IF NOT EXISTS ${table} (version INTEGER PRIMARY KEY)`,\n          )\n          .run();\n        await d1\n          .prepare(\n            `CREATE TABLE IF NOT EXISTS ${namedTable} (name TEXT PRIMARY KEY, version INTEGER, applied_at TEXT NOT NULL DEFAULT (datetime('now')))`,\n          )\n          .run();\n        const firstRow = await d1\n          .prepare(`SELECT MAX(version) as v FROM ${table}`)\n          .first<{ v?: number }>();\n        const current = (firstRow?.v as number) ?? 0;\n\n        const appliedNamesRows = await d1\n          .prepare(`SELECT name FROM ${namedTable}`)\n          .all();\n        const appliedNames = new Set(\n          (appliedNamesRows?.results ?? []).map((r) => String(r.name)),\n        );\n\n        const pending = migrations.filter((m) =>\n          m.name ? !appliedNames.has(m.name) : m.version > current,\n        );\n\n        for (const m of pending) {\n          try {\n            // D1 is SQLite-compatible\n            const raw = resolveMigrationSql(m.sql, false);\n            const recordStatements = [\n              m.name\n                ? d1\n                    .prepare(\n                      `INSERT OR IGNORE INTO ${namedTable} (name, version) VALUES (?, ?)`,\n                    )\n                    .bind(m.name, m.version)\n                : null,\n              m.version > current\n                ? d1\n                    .prepare(`INSERT OR IGNORE INTO ${table} VALUES (?)`)\n                    .bind(m.version)\n                : null,\n            ].filter((s): s is NonNullable<typeof s> => s != null);\n\n            if (raw == null) {\n              // Dialect-gated migration with no SQL for this dialect; still\n              // record it so we don't retry forever.\n              for (const stmt of recordStatements) await stmt.run();\n              continue;\n            }\n            const originalStatements = splitSqlStatements(raw);\n            const statements = originalStatements.map((orig) => ({\n              sql: adaptSqlForSqlite(orig),\n              hadIfNotExists: IF_NOT_EXISTS_ADD_COLUMN_RE.test(orig),\n            }));\n            const hasIfNotExists = statements.some((s) => s.hadIfNotExists);\n            if (hasIfNotExists) {\n              // Per-statement path: we need to swallow \"duplicate column\"\n              // errors for statements that originally carried\n              // `ADD COLUMN IF NOT EXISTS`, which a batch() can't express.\n              // Loses atomicity, but the idempotent-ADD-COLUMN semantic\n              // means a partial re-run resolves cleanly on retry.\n              for (const { sql: stmt, hadIfNotExists } of statements) {\n                try {\n                  await d1.prepare(stmt).run();\n                } catch (err) {\n                  if (hadIfNotExists && isDuplicateColumnError(err)) continue;\n                  throw err;\n                }\n              }\n              for (const stmt of recordStatements) await stmt.run();\n            } else {\n              // Atomic batch: all statements + bookkeeping inserts land in\n              // the same transaction. A failing statement rolls the whole\n              // migration back, so we never record a half-applied migration.\n              await d1.batch([\n                ...statements.map((s) => d1.prepare(s.sql)),\n                ...recordStatements,\n              ]);\n            }\n            console.log(\n              `[db] Applied migration ${m.name ? `\"${m.name}\" ` : \"\"}v${m.version} (${statements.length} statement${statements.length === 1 ? \"\" : \"s\"})`,\n            );\n          } catch (err) {\n            console.error(\n              `[db] Migration ${m.name ? `\"${m.name}\" ` : \"\"}v${m.version} FAILED:`,\n              (err as Error).message,\n              \"\\nSQL:\",\n              JSON.stringify(m.sql),\n            );\n            throw err;\n          }\n        }\n        return;\n      }\n\n      // Generic path — works for libsql and Postgres\n      const pg = isPostgres();\n\n      // ---------------------------------------------------------------------------\n      // Fast-path: read migration state through the regular pooled singleton before\n      // opening the direct-endpoint connection.\n      //\n      // On Postgres every cold start previously opened a fresh direct-endpoint Neon\n      // connection (bypassing PgBouncer, which is needed only for DDL), ran\n      // CREATE TABLE IF NOT EXISTS + SELECT MAX(version) even with zero pending\n      // migrations, and never closed the pool — it idled for ~10 s. Three runners\n      // (core, org, context-xray) did this independently per boot.\n      //\n      // Now: use the pooled singleton (getDbExec) for the bookkeeping SELECT. If\n      // the migrations table does not yet exist we treat it as \"all migrations\n      // pending\" (current = -1). Only when there are pending migrations do we open\n      // the direct-endpoint exec (DDL is the only thing Neon's PgBouncer blocks —\n      // documented at getMigrationDatabaseUrl). The direct exec is shared across\n      // concurrent runners via acquireMigrationExec() and closed after the last\n      // caller via releaseMigrationExec().\n      // ---------------------------------------------------------------------------\n\n      let current = -1; // sentinel: \"table missing\" → treat all as pending\n      let namedRowsMissing = false; // sentinel: \"named table missing\" → no names applied yet\n\n      // Any migration with a `name` is a candidate regardless of version, so\n      // the fast-path \"anything pending?\" check must also account for names.\n      const hasNamedMigrations = migrations.some((m) => m.name);\n      let appliedNames = new Set<string>();\n\n      if (pg) {\n        try {\n          const { rows } = await getDbExec().execute(\n            `SELECT MAX(version) as v FROM ${table}`,\n          );\n          current = (rows[0]?.v as number) ?? 0;\n        } catch {\n          // Table doesn't exist yet — leave current = -1 so all migrations apply.\n        }\n        if (hasNamedMigrations) {\n          try {\n            const { rows } = await getDbExec().execute(\n              `SELECT name FROM ${namedTable}`,\n            );\n            appliedNames = new Set(rows.map((r) => String(r.name)));\n          } catch {\n            // Named table doesn't exist yet — leave appliedNames empty so all\n            // named migrations apply.\n            namedRowsMissing = true;\n          }\n        }\n      }\n\n      // For SQLite we still use getDbExec() as exec throughout (no pooler concern).\n      // For Postgres we only open the direct exec when there are pending migrations.\n      const pendingFast = pg\n        ? migrations.filter((m) =>\n            m.name ? !appliedNames.has(m.name) : m.version > current,\n          )\n        : null; // SQLite: compute after table creation below\n\n      // Short-circuit: Postgres with nothing to do — skip the direct connection entirely.\n      if (pg && pendingFast !== null && pendingFast.length === 0) {\n        return;\n      }\n\n      // Acquire the exec appropriate for the dialect.\n      // For Postgres: the shared direct-endpoint exec (DDL-safe, closed on release).\n      // For SQLite/libsql: the singleton pooled exec (no pooler concern).\n      const exec = pg ? await acquireMigrationExec() : getDbExec();\n\n      try {\n        // Retry initial table creation — SQLITE_BUSY_RECOVERY can occur on HMR\n        // restarts when WAL files from the previous process haven't been released yet.\n        await retrySqliteBusy(\n          () =>\n            exec.execute(\n              `CREATE TABLE IF NOT EXISTS ${table} (version INTEGER PRIMARY KEY)`,\n            ),\n          { maxAttempts: 6, baseDelayMs: 1000, rethrow: true },\n        );\n        // Companion name-keyed bookkeeping table — never alters the existing\n        // `${table}`'s PRIMARY KEY, so legacy version rows keep working exactly\n        // as before. See the `runMigrations` doc comment for why this exists.\n        await retrySqliteBusy(\n          () =>\n            exec.execute(\n              `CREATE TABLE IF NOT EXISTS ${namedTable} (name TEXT PRIMARY KEY, version INTEGER, applied_at ${pg ? \"TIMESTAMP NOT NULL DEFAULT now()\" : \"TEXT NOT NULL DEFAULT (datetime('now'))\"})`,\n            ),\n          { maxAttempts: 6, baseDelayMs: 1000, rethrow: true },\n        );\n\n        // For Postgres, current was already set by the fast-path SELECT above.\n        // For SQLite we run the SELECT now (via the same exec, which is the singleton).\n        if (!pg) {\n          const { rows } = await exec.execute(\n            `SELECT MAX(version) as v FROM ${table}`,\n          );\n          current = (rows[0]?.v as number) ?? 0;\n          if (hasNamedMigrations) {\n            const { rows: nameRows } = await exec.execute(\n              `SELECT name FROM ${namedTable}`,\n            );\n            appliedNames = new Set(nameRows.map((r) => String(r.name)));\n          }\n        } else if (current === -1 || (hasNamedMigrations && namedRowsMissing)) {\n          // Fast-path read failed (table was absent on the pooler): re-read via the\n          // direct exec now that CREATE TABLE IF NOT EXISTS has ensured it exists.\n          if (current === -1) {\n            const { rows } = await exec.execute(\n              `SELECT MAX(version) as v FROM ${table}`,\n            );\n            current = (rows[0]?.v as number) ?? 0;\n          }\n          if (hasNamedMigrations && namedRowsMissing) {\n            const { rows: nameRows } = await exec.execute(\n              `SELECT name FROM ${namedTable}`,\n            );\n            appliedNames = new Set(nameRows.map((r) => String(r.name)));\n          }\n        }\n\n        const insertVersionSql = pg\n          ? `INSERT INTO ${table} VALUES (?) ON CONFLICT DO NOTHING`\n          : `INSERT OR IGNORE INTO ${table} VALUES (?)`;\n        const insertNamedSql = pg\n          ? `INSERT INTO ${namedTable} (name, version) VALUES (?, ?) ON CONFLICT DO NOTHING`\n          : `INSERT OR IGNORE INTO ${namedTable} (name, version) VALUES (?, ?)`;\n\n        const pending = migrations.filter((m) =>\n          m.name ? !appliedNames.has(m.name) : m.version > current,\n        );\n        if (pending.length > 0) {\n          console.log(\n            `[db] Applying ${pending.length} migration(s) on ${pg ? \"Postgres\" : \"SQLite/libsql\"}…`,\n          );\n        }\n\n        for (const m of pending) {\n          const raw = resolveMigrationSql(m.sql, pg);\n          const label = m.name\n            ? `\"${m.name}\" (v${m.version})`\n            : `v${m.version}`;\n\n          // Record BOTH the named row (always, when named) and the legacy\n          // version row (only if this migration actually advances the legacy\n          // MAX) — atomically with the DDL below. This keeps the legacy gate\n          // monotonic for any unnamed migrations later in the list, while a\n          // named migration is tracked by name regardless of version.\n          const recordSql: Array<{ sql: string; args: unknown[] }> = [];\n          if (m.name) {\n            recordSql.push({\n              sql: insertNamedSql,\n              args: [m.name, m.version],\n            });\n          }\n          if (m.version > current) {\n            recordSql.push({ sql: insertVersionSql, args: [m.version] });\n          }\n\n          if (raw == null) {\n            // Dialect-gated migration with no SQL for this dialect; still mark\n            // as applied so we don't retry forever.\n            for (const stmt of recordSql) await exec.execute(stmt);\n            if (m.version > current) current = m.version;\n            if (m.name) appliedNames.add(m.name);\n            continue;\n          }\n          // Split BEFORE adapting so we can remember which original statements\n          // carried `ADD COLUMN IF NOT EXISTS` — SQLite drops the clause, so we\n          // emulate the idempotent semantic by swallowing duplicate-column\n          // errors only for those statements.\n          const originalStatements = splitSqlStatements(raw);\n          const statements = originalStatements.map((orig) => ({\n            sql: pg ? adaptSqlForPostgres(orig) : adaptSqlForSqlite(orig),\n            hadIfNotExists: IF_NOT_EXISTS_ADD_COLUMN_RE.test(orig),\n          }));\n          let currentStmt = \"\";\n          try {\n            for (const { sql: stmt, hadIfNotExists } of statements) {\n              currentStmt = stmt;\n              try {\n                await exec.execute(stmt);\n              } catch (err) {\n                if (!pg && hadIfNotExists && isDuplicateColumnError(err)) {\n                  // IF NOT EXISTS semantic: column already present, skip.\n                  continue;\n                }\n                throw err;\n              }\n            }\n            for (const stmt of recordSql) await exec.execute(stmt);\n            if (m.version > current) current = m.version;\n            if (m.name) appliedNames.add(m.name);\n            console.log(\n              `[db] Applied migration ${label} (${statements.length} statement${statements.length === 1 ? \"\" : \"s\"})`,\n            );\n          } catch (err) {\n            if (pg && isPermissionError(err)) {\n              // The connected role lacks privilege for this migration (e.g. a\n              // permission-limited dev/replica role that doesn't own the table).\n              // Don't crash-loop the whole server over it — warn and STOP here.\n              // We must NOT continue to later migrations: unnamed pending work is\n              // computed as `version > MAX(recorded version)`, so applying a later\n              // unnamed migration would advance MAX past this unrecorded one and\n              // orphan it forever. Stopping leaves MAX at the last recorded\n              // version, so a properly-privileged role resumes from this exact\n              // migration, in order. (A named migration skipped here simply\n              // isn't recorded by name either, so it's retried next boot same as\n              // the legacy gate — no orphaning risk from name-based tracking.)\n              console.warn(\n                `[db] Migration ${label} skipped — insufficient privilege: ${(err as Error).message}. ` +\n                  `Apply it with a DB role that owns the table. ` +\n                  `Halting further migrations so this one isn't orphaned. ` +\n                  `Set <APP_NAME>_DATABASE_URL (e.g. PLAN_DATABASE_URL) to a database this app owns — a file: URL uses local SQLite.`,\n                \"\\nStatement:\",\n                currentStmt,\n              );\n              break;\n            }\n            console.error(\n              `[db] Migration ${label} FAILED:`,\n              (err as Error).message,\n              \"\\nStatement:\",\n              currentStmt,\n            );\n            throw err;\n          }\n        }\n      } finally {\n        // Release the direct-endpoint exec (Postgres only). For SQLite getDbExec()\n        // returns the process-lifetime singleton, so releaseMigrationExec is a no-op\n        // (refCount never incremented for SQLite path, guard in releaseMigrationExec).\n        if (pg) await releaseMigrationExec();\n      }\n    } catch (err) {\n      console.error(\"[db] Migration failed:\", (err as Error).message);\n      // In local dev, hard-fail so the developer catches errors immediately.\n      // On serverless runtimes (Netlify Functions, Vercel, CF Workers) we\n      // keep the process alive — the app will return 500s for routes that\n      // depend on the missing tables, but at least other routes still work.\n      // Note: Node.js 21+ defines globalThis.navigator, so we check for\n      // serverless env vars instead of navigator presence.\n      const isServerless =\n        !!globalThis.process?.env?.NETLIFY ||\n        !!globalThis.process?.env?.AWS_LAMBDA_FUNCTION_NAME ||\n        !!globalThis.process?.env?.VERCEL ||\n        \"__cf_env\" in globalThis;\n      if (typeof globalThis.process?.exit === \"function\" && !isServerless) {\n        process.exit(1);\n      }\n    }\n  };\n}\n"]}

package/dist/jobs/scheduler.js

@@ -353,13 +353,12 @@ async function executeJob(resource, meta, body, deps, now) {
             const softTimeoutMs = resolveRunSoftTimeoutMs(undefined, {
                 useHostedDefault: true,
             });
-            // Hard-abort backstop: 5 minutes. On hosted runtimes the soft-timeout
-            // will fire first; locally this is the only guard.
-            const hardAbortTimer = setTimeout(() => {
-                // startRun's abort controller handles this below, but we still need
-                // the handle to clear it in the finally block.
-            }, 5 * 60 * 1000);
             let jobError = null;
+            // Hard-abort backstop: 5 minutes. On hosted runtimes the soft-timeout
+            // will fire first; locally this is the only guard. Cleared when the
+            // run completes so finished jobs don't leave a live timer keeping the
+            // process/event loop alive for the remainder of the window.
+            let hardAbortTimer = null;
             await new Promise((resolve, reject) => {
                 const activeRun = startRun(runId, thread.id, async (send, signal) => {
                     try {
@@ -381,6 +380,10 @@ async function executeJob(resource, meta, body, deps, now) {
                 }, 
                 // onComplete: run finished (completed or aborted)
                 async (run) => {
+                    if (hardAbortTimer) {
+                        clearTimeout(hardAbortTimer);
+                        hardAbortTimer = null;
+                    }
                     if (run.status === "completed") {
                         resolve();
                     }
@@ -391,10 +394,10 @@ async function executeJob(resource, meta, body, deps, now) {
                     softTimeoutMs,
                     // turnId defaults to runId — fine for single-turn jobs
                 });
-                // Hard-abort backstop: abort the run-manager's own controller after
-                // 5 minutes if it hasn't finished naturally.
-                clearTimeout(hardAbortTimer);
-                setTimeout(() => {
+                // Abort the run-manager's own controller after 5 minutes if the
+                // run hasn't finished naturally.
+                hardAbortTimer = setTimeout(() => {
+                    hardAbortTimer = null;
                     if (activeRun.status === "running") {
                         activeRun.abort.abort("job_hard_timeout");
                         reject(new Error("Job timed out after 5 minutes"));
@@ -403,6 +406,10 @@ async function executeJob(resource, meta, body, deps, now) {
             }).catch((err) => {
                 jobError = err;
             });
+            if (hardAbortTimer) {
+                clearTimeout(hardAbortTimer);
+                hardAbortTimer = null;
+            }
             if (jobError)
                 throw jobError;
             // Success — update status. Compute the next run from completion time,