neotoma 0.20.0 → 0.21.2

package/dist/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAuC9B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,4BAA4B,CAAC;AA4BpC,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAC;AAkDpC,OAAO,EAGL,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAWtC,OAAO,EAiCL,KAAK,wBAAwB,EAE9B,MAAM,4BAA4B,CAAC;AA8CpC,6FAA6F;AAC7F,wBAAgB,qBAAqB,IAAI,sBAAsB,GAAG,IAAI,CAErE;AAED,eAAO,MAAM,GAAG,6CAAY,CAAC;AAqwB7B,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMtE;AAoBD,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMlE;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,GAC7F,IAAI,CA4IN;AAuBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA+B1F;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CA2B5D;AAGD;+EAC+E;AAC/E,eAAO,MAAM,gBAAgB,sBAA6B,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,QAAc,CAAC;AAE3D;;;gEAGgE;AAChE,eAAO,MAAM,2BAA2B,QAAgB,CAAC;AAEzD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKzE;AA4OD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAgBR;AAED,gGAAgG;AAChG,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,SAAS,CAKhF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA2BhD;AAylDD,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AA2CrD,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CAqBjG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAST;AAED,oHAAoH;AACpH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAWT;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAanE;AAoBD;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAIT;AA+GD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB;AAu+FD,KAAK,oBAAoB,GAAG;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAuDF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,4BAA4B,EAAE,iBAAiB,CAAC;IAC3E,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;;;;;;;;;;;;;;;;qBAu9BgB,MAAM;eACZ,MAAM;2BACM,MAAM;;;;;;cAtBnB,MAAM;iBACH,MAAM;2BACI,MAAM;qBACZ,MAAM;mBACR,MAAM;kBAIP,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;cAnC3B,MAAM;gBACJ,MAAM;2BACK,MAAM;qBACZ,MAAM;mBACR,MAAM;wBACD,MAAM;uBACP,MAAM;;;;;mBAhSV,MAAM;qBACJ,MAAM;wBACH,MAAM,GAAG,IAAI;2BACV,MAAM;;wBAET,MAAM;uBACP,MAAM,EAAE;wBACP,MAAM;uBACP,MAAM;;kBAxYX,MAAM;oBACJ,MAAM;yBACD,MAAM;4BACH,MAAM;2BACP,MAAM;;;kBAQf,MAAM;yBACC,MAAM;iCACE,MAAM;sCACD,MAAM;;+BA4Xb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;;;2BAwMlC,MAAM;0BACP,MAAM;0BACN,MAAM;;;;;;;;GA4e3B;AAwhHD,wBAAsB,eAAe;;;eAmOpC"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAuC9B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,4BAA4B,CAAC;AA4BpC,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAC;AAkDpC,OAAO,EAGL,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAWtC,OAAO,EAiCL,KAAK,wBAAwB,EAE9B,MAAM,4BAA4B,CAAC;AA8CpC,6FAA6F;AAC7F,wBAAgB,qBAAqB,IAAI,sBAAsB,GAAG,IAAI,CAErE;AAED,eAAO,MAAM,GAAG,6CAAY,CAAC;AA0wB7B,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMtE;AAoBD,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMlE;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,GAC7F,IAAI,CA4IN;AAuBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA+B1F;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CA2B5D;AAGD;+EAC+E;AAC/E,eAAO,MAAM,gBAAgB,sBAA6B,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,QAAc,CAAC;AAE3D;;;gEAGgE;AAChE,eAAO,MAAM,2BAA2B,QAAgB,CAAC;AAEzD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKzE;AA4OD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAgBR;AAED,gGAAgG;AAChG,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,SAAS,CAKhF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA2BhD;AAylDD,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AA2CrD,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CAqBjG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAST;AAED,oHAAoH;AACpH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAWT;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAanE;AAoBD;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAIT;AAiHD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB;AAu+FD,KAAK,oBAAoB,GAAG;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAuDF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,4BAA4B,EAAE,iBAAiB,CAAC;IAC3E,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;;;;;;;;;;;;;;;;qBAu9BgB,MAAM;eACZ,MAAM;2BACM,MAAM;;;;;;cAtBnB,MAAM;iBACH,MAAM;2BACI,MAAM;qBACZ,MAAM;mBACR,MAAM;kBAIP,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;cAnC3B,MAAM;gBACJ,MAAM;2BACK,MAAM;qBACZ,MAAM;mBACR,MAAM;wBACD,MAAM;uBACP,MAAM;;;;;mBAhSV,MAAM;qBACJ,MAAM;wBACH,MAAM,GAAG,IAAI;2BACV,MAAM;;wBAET,MAAM;uBACP,MAAM,EAAE;wBACP,MAAM;uBACP,MAAM;;kBAxYX,MAAM;oBACJ,MAAM;yBACD,MAAM;4BACH,MAAM;2BACP,MAAM;;;kBAQf,MAAM;yBACC,MAAM;iCACE,MAAM;sCACD,MAAM;;+BA4Xb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;;;2BAwMlC,MAAM;0BACP,MAAM;0BACN,MAAM;;;;;;;;GA4e3B;AAwhHD,wBAAsB,eAAe;;;eA+QpC"}

package/dist/actions.js

@@ -51,7 +51,7 @@ import { installInspectorLegacyRedirect, installInspectorRootStaticAssets, insta
 import { EMBED_ALLOWED_ORIGINS_ENV, applyFrameAncestorsToCsp, buildFrameAncestorsDirective, embedCorsHeaders, isEmbedReadEndpoint, isEmbedShellPath, isOriginAllowed, parseAllowedEmbedOrigins, } from "./services/embed_cross_origin.js";
 import { getSandboxTermsResponse } from "./services/sandbox/terms.js";
 import { resolveSandboxReportTransport } from "./services/sandbox/transport.js";
-import { getSqliteDb } from "./repositories/sqlite/sqlite_client.js";
+import { getDb } from "./repositories/db/connection.js";
 import { getMcpAuthToken } from "./crypto/mcp_auth_token.js";
 import { isOauthKeyCredentialValid, normalizeOauthNextPath, OAuthKeySessionStore, } from "./services/oauth_key_gate.js";
 import { buildGoogleAuthorizeUrl, createGoogleSigninNonce, consumeGoogleSigninNonce, exchangeGoogleAuthorizationCode, getSharedGraphUserId, GoogleIdTokenError, isGoogleSigninEnabled, verifyGoogleIdToken, } from "./services/google_oidc.js";
@@ -251,7 +251,7 @@ if (isSandboxMode()) {
         validate: { trustProxy: false },
     });
     const createAndSeedSession = async (packId) => {
-        const session = createSandboxSession(packId);
+        const session = await createSandboxSession(packId);
         const pack = getSandboxPack(session.packId);
         // Packs with seedPolicy "none" (e.g. the empty pack) legitimately seed
         // nothing — that is "skipped", not a failure.
@@ -298,14 +298,14 @@ if (isSandboxMode()) {
                 .json({ error_code: "SESSION_CREATE_FAILED", message: err.message });
         }
     });
-    app.post("/sandbox/session/redeem", (req, res) => {
+    app.post("/sandbox/session/redeem", async (req, res) => {
         try {
             const code = typeof req.body?.code === "string" ? req.body.code : "";
             if (!code) {
                 res.status(400).json({ error_code: "MISSING_CODE", message: "code is required" });
                 return;
             }
-            const result = redeemOneTimeCode(code);
+            const result = await redeemOneTimeCode(code);
             if (!result) {
                 res
                     .status(404)
@@ -332,8 +332,8 @@ if (isSandboxMode()) {
                 .json({ error_code: "SESSION_REDEEM_FAILED", message: err.message });
         }
     });
-    app.get("/sandbox/session", (req, res) => {
-        const session = resolveSessionFromRequest(req);
+    app.get("/sandbox/session", async (req, res) => {
+        const session = await resolveSessionFromRequest(req);
         if (!session) {
             res.status(401).json({ error_code: "NO_SESSION", message: "No active sandbox session" });
             return;
@@ -346,13 +346,13 @@ if (isSandboxMode()) {
         });
     });
     app.post("/sandbox/session/reset", async (req, res) => {
-        const session = resolveSessionFromRequest(req);
+        const session = await resolveSessionFromRequest(req);
         if (!session) {
             res.status(401).json({ error_code: "NO_SESSION", message: "No active sandbox session" });
             return;
         }
         const packId = typeof req.body?.pack_id === "string" ? req.body.pack_id : undefined;
-        purgeSessionUserData(session.userId);
+        await purgeSessionUserData(session.userId);
         const { session: newSession, seedStatus } = await createAndSeedSession(packId ?? session.packId);
         res.cookie(SESSION_COOKIE_NAME, newSession.bearerToken, {
             httpOnly: true,
@@ -367,22 +367,27 @@ if (isSandboxMode()) {
             seed_status: seedStatus,
         });
     });
-    app.delete("/sandbox/session", (req, res) => {
-        const session = resolveSessionFromRequest(req);
+    app.delete("/sandbox/session", async (req, res) => {
+        const session = await resolveSessionFromRequest(req);
         if (!session) {
             res.status(401).json({ error_code: "NO_SESSION", message: "No active sandbox session" });
             return;
         }
-        revokeSession(session.userId);
-        purgeSessionUserData(session.userId);
+        await revokeSession(session.userId);
+        await purgeSessionUserData(session.userId);
         res.clearCookie(SESSION_COOKIE_NAME, { path: "/" });
         res.json({ ok: true });
     });
     setInterval(() => {
-        const purged = sweepExpiredSessions();
-        if (purged > 0) {
-            logger.info(`[Sandbox] Swept ${purged} expired session(s)`);
-        }
+        sweepExpiredSessions()
+            .then((purged) => {
+            if (purged > 0) {
+                logger.info(`[Sandbox] Swept ${purged} expired session(s)`);
+            }
+        })
+            .catch((err) => {
+            logger.error(`[Sandbox] session sweep failed: ${err.message}`);
+        });
     }, 15 * 60 * 1000);
     logger.info("[Sandbox] Session endpoints registered");
 }
@@ -2372,7 +2377,7 @@ app.get("/mcp/oauth/google/callback", async (req, res) => {
         // with it) — generate an unguessable throwaway so createLocalAuthUser's
         // shared code path is satisfied without weakening any other account.
         const throwawayPassword = randomBytes(32).toString("hex");
-        const perEmailUser = createLocalAuthUser(email, throwawayPassword);
+        const perEmailUser = await createLocalAuthUser(email, throwawayPassword);
         // Shared-graph opt-in: when NEOTOMA_SHARED_GRAPH_USER_ID is set, an
         // approved teammate (the email already passed the allowlist inside
         // verifyGoogleIdToken) is bound to the shared graph's user_id instead of
@@ -2579,7 +2584,7 @@ app.get("/mcp/oauth/local-login", async (req, res) => {
         // (no Google session on this cookie — the default, and the only
         // possibility when the Google feature flag is off) is unchanged.
         const googleUserId = getGoogleVerifiedUserId(req);
-        const resolvedUserId = googleUserId ?? ensureLocalDevUser().id;
+        const resolvedUserId = googleUserId ?? (await ensureLocalDevUser()).id;
         const { completeLocalAuthorization } = await import("./services/mcp_oauth.js");
         const { connectionId, redirectUri, clientState } = await completeLocalAuthorization(state, resolvedUserId);
         const frontendBase = process.env.NEOTOMA_FRONTEND_URL || process.env.FRONTEND_URL || "http://localhost:5195";
@@ -2789,10 +2794,10 @@ app.get("/mcp/oauth/authorization-details", async (req, res) => {
         // Validate token and get user (ensures user is authenticated)
         const { validateSessionToken } = await import("./services/mcp_auth.js");
         await validateSessionToken(token);
-        const db = getSqliteDb();
-        const stateData = db
+        const db = await getDb();
+        const stateData = (await db
             .prepare("SELECT redirect_uri FROM mcp_oauth_state WHERE state = ?")
-            .get(authorization_id);
+            .get(authorization_id));
         if (!stateData?.redirect_uri) {
             return res.status(404).json({
                 error: "Authorization not found",
@@ -3030,7 +3035,9 @@ async function resolveRoutePrincipal(req, accept) {
         if (routeAllowsLocalIssueWriteFallback(req) &&
             isLocalRequest(req) &&
             !headerAuth.startsWith("Bearer ")) {
-            const userId = _localSandboxActive ? ensureLocalSandboxUser().id : ensureLocalDevUser().id;
+            const userId = _localSandboxActive
+                ? (await ensureLocalSandboxUser()).id
+                : (await ensureLocalDevUser()).id;
             // Stamp the principal so a later `getAuthenticatedUserId` in the handler
             // resolves the same local user without re-tripping the missing-Bearer gate.
             stampUserPrincipal(req, userId);
@@ -3086,9 +3093,9 @@ export async function resolveGuestUserId(req, principal) {
         // shared nil-UUID LOCAL_DEV_USER_ID. Outside local_sandbox mode (e.g. pure
         // dev with explicit auth configured) continue to use the nil-UUID fallback.
         if (_localSandboxActive) {
-            return ensureLocalSandboxUser().id;
+            return (await ensureLocalSandboxUser()).id;
         }
-        return ensureLocalDevUser().id;
+        return (await ensureLocalDevUser()).id;
     }
     throw new Error("Not authenticated - guest principal cannot resolve a user_id: no valid token grant and not a local request");
 }
@@ -3215,12 +3222,12 @@ app.use(async (req, res, next) => {
             return next();
         }
         if (_localSandboxActive) {
-            const sandboxUser = ensureLocalSandboxUser();
+            const sandboxUser = await ensureLocalSandboxUser();
             stampUserPrincipal(req, sandboxUser.id);
             logger.info(`[Auth] ${req.method} ${req.path} auth_method=local_sandbox user_id=${sandboxUser.id}`);
             return next();
         }
-        const devUser = ensureLocalDevUser();
+        const devUser = await ensureLocalDevUser();
         stampUserPrincipal(req, devUser.id);
         logger.info(`[Auth] ${req.method} ${req.path} auth_method=local_no_bearer user_id=${devUser.id}`);
         return next();
@@ -3228,7 +3235,7 @@ app.use(async (req, res, next) => {
     // Sandbox ephemeral session: resolve from cookie or Bearer token before
     // falling back to the shared public user. Expired/revoked sessions 401.
     if (isSandboxMode()) {
-        const sessionInfo = resolveSessionFromRequest(req);
+        const sessionInfo = await resolveSessionFromRequest(req);
         if (sessionInfo) {
             stampUserPrincipal(req, sessionInfo.userId);
             logger.info(`[Auth] ${req.method} ${req.path} auth_method=sandbox_session user_id=${sessionInfo.userId}`);
@@ -3250,12 +3257,12 @@ app.use(async (req, res, next) => {
         // queries by req.authenticatedUserId.
         const aauthCtx = req.aauth;
         if (aauthCtx?.verified === true && typeof aauthCtx.thumbprint === "string") {
-            const aauthUser = ensureSandboxAauthUser(aauthCtx.thumbprint);
+            const aauthUser = await ensureSandboxAauthUser(aauthCtx.thumbprint);
             stampUserPrincipal(req, aauthUser.id);
             logger.info(`[Auth] ${req.method} ${req.path} auth_method=sandbox_aauth user_id=${aauthUser.id} thumbprint=${aauthCtx.thumbprint}`);
             return next();
         }
-        const sandboxUser = ensureSandboxPublicUser();
+        const sandboxUser = await ensureSandboxPublicUser();
         stampUserPrincipal(req, sandboxUser.id);
         logger.info(`[Auth] ${req.method} ${req.path} auth_method=sandbox_public user_id=${sandboxUser.id}`);
         return next();
@@ -3268,7 +3275,7 @@ app.use(async (req, res, next) => {
     if (headerAuth.startsWith("Bearer ") && mcpExpectedToken) {
         const token = headerAuth.slice(7).trim();
         if (safeCompareTokens(token, mcpExpectedToken)) {
-            const devUser = ensureLocalDevUser();
+            const devUser = await ensureLocalDevUser();
             stampUserPrincipal(req, devUser.id);
             logger.info(`[Auth] ${req.method} ${req.path} auth_method=bearer_mcp_token user_id=${devUser.id}`);
             return next();
@@ -3285,12 +3292,12 @@ app.use(async (req, res, next) => {
             }
             if (isLocalRequest(req)) {
                 if (_localSandboxActive) {
-                    const sandboxUser = ensureLocalSandboxUser();
+                    const sandboxUser = await ensureLocalSandboxUser();
                     stampUserPrincipal(req, sandboxUser.id);
                     logger.info(`[Auth] ${req.method} ${req.path} auth_method=local_sandbox user_id=${sandboxUser.id}`);
                     return next();
                 }
-                const devUser = ensureLocalDevUser();
+                const devUser = await ensureLocalDevUser();
                 stampUserPrincipal(req, devUser.id);
                 logger.info(`[Auth] ${req.method} ${req.path} auth_method=local_no_bearer user_id=${devUser.id}`);
                 return next();
@@ -3299,7 +3306,7 @@ app.use(async (req, res, next) => {
         if (headerAuth.startsWith("Bearer ") && process.env.NEOTOMA_BEARER_TOKEN) {
             const token = headerAuth.slice(7).trim();
             if (safeCompareTokens(token, process.env.NEOTOMA_BEARER_TOKEN)) {
-                const devUser = ensureLocalDevUser();
+                const devUser = await ensureLocalDevUser();
                 stampUserPrincipal(req, devUser.id);
                 logger.info(`[Auth] ${req.method} ${req.path} auth_method=bearer_env user_id=${devUser.id}`);
                 return next();
@@ -3403,7 +3410,7 @@ app.use(async (req, res, next) => {
             // sandboxDestructiveGuard, and AAuth-only routes by aauthRequired.
             if (isSandboxMode()) {
                 res.clearCookie(SESSION_COOKIE_NAME, { path: "/" });
-                const sandboxUser = ensureSandboxPublicUser();
+                const sandboxUser = await ensureSandboxPublicUser();
                 stampUserPrincipal(req, sandboxUser.id);
                 logger.info(`[Auth] ${req.method} ${req.path} auth_method=sandbox_public_stale_bearer user_id=${sandboxUser.id}`);
                 return next();
@@ -4575,7 +4582,7 @@ app.get("/record_activity", async (req, res) => {
         const limit = parseInt(String(req.query.limit ?? "50"), 10) || 50;
         const offset = parseInt(String(req.query.offset ?? "0"), 10) || 0;
         const recordTypes = parseRecordActivityTypesQuery(req.query.record_types);
-        const result = listRecentRecordActivity(userId, {
+        const result = await listRecentRecordActivity(userId, {
             limit,
             offset,
             ...(recordTypes?.length ? { recordTypes } : {}),
@@ -4591,7 +4598,7 @@ app.get("/record_activity", async (req, res) => {
 app.get("/agents", async (req, res) => {
     try {
         const userId = await getAuthenticatedUserId(req, req.query.user_id);
-        const result = listAgents(userId);
+        const result = await listAgents(userId);
         return res.json(result);
     }
     catch (error) {
@@ -4737,7 +4744,7 @@ app.get("/agents/:key", async (req, res) => {
     try {
         const userId = await getAuthenticatedUserId(req, req.query.user_id);
         const agentKey = decodeURIComponent(req.params.key);
-        const agent = getAgent(userId, agentKey);
+        const agent = await getAgent(userId, agentKey);
         if (!agent) {
             return sendError(res, 404, "RESOURCE_NOT_FOUND", `Agent not found: ${agentKey}`);
         }
@@ -4757,7 +4764,7 @@ app.get("/agents/:key/records", async (req, res) => {
         const agentKey = decodeURIComponent(req.params.key);
         const limit = parseInt(String(req.query.limit ?? "50"), 10) || 50;
         const offset = parseInt(String(req.query.offset ?? "0"), 10) || 0;
-        const result = listAgentRecords(userId, agentKey, limit, offset);
+        const result = await listAgentRecords(userId, agentKey, limit, offset);
         return res.json(result);
     }
     catch (error) {
@@ -4769,7 +4776,7 @@ app.get("/recent_conversations/:conversation_id", async (req, res) => {
     try {
         const userId = await getAuthenticatedUserId(req, req.query.user_id);
         const conversationId = String(req.params.conversation_id ?? "").trim();
-        const item = getRecentConversationById(userId, conversationId);
+        const item = await getRecentConversationById(userId, conversationId);
         if (!item) {
             return sendError(res, 404, "RESOURCE_NOT_FOUND", "Conversation not found");
         }
@@ -4792,7 +4799,7 @@ app.get("/recent_conversations", async (req, res) => {
         const agentKeyRaw = typeof req.query.agent_key === "string" ? req.query.agent_key.trim() : "";
         // UI and bookmarks may send agent_key=all; never treat that as a real deriveAgentKey value.
         const agent_key = agentKeyRaw.length > 0 && agentKeyRaw.toLowerCase() !== "all" ? agentKeyRaw : null;
-        const result = listRecentConversations(userId, limit, offset, {
+        const result = await listRecentConversations(userId, limit, offset, {
             activity_after,
             activity_before,
             agent_key,
@@ -4851,7 +4858,7 @@ app.get("/turns", async (req, res) => {
         const activity_before = typeof req.query.activity_before === "string"
             ? req.query.activity_before.trim() || null
             : null;
-        const result = listConversationTurns(userId, limit, offset, {
+        const result = await listConversationTurns(userId, limit, offset, {
             harness,
             status,
             activity_after,
@@ -4868,7 +4875,7 @@ app.get("/turns/:turn_key", async (req, res) => {
     try {
         const userId = await getAuthenticatedUserId(req, req.query.user_id);
         const turnKey = decodeURIComponent(req.params.turn_key);
-        const result = getConversationTurn(userId, turnKey);
+        const result = await getConversationTurn(userId, turnKey);
         if (!result) {
             return res.status(404).json({ error: "Turn not found", code: "NOT_FOUND" });
         }
@@ -4890,7 +4897,7 @@ app.get("/admin/compliance/scorecard", async (req, res) => {
         const top_missed_steps = parseInt(String(req.query.top_missed_steps ?? ""), 10);
         const include_synthetic = req.query.include_synthetic === "1" ||
             String(req.query.include_synthetic).toLowerCase() === "true";
-        const result = buildComplianceScorecard(userId, {
+        const result = await buildComplianceScorecard(userId, {
             since,
             until,
             group_by,
@@ -8152,7 +8159,7 @@ const handleIssuesSubmitHttp = async (req, res) => {
             parsed.data.local_issue_id ||
             parsed.data.submission_timestamp);
         const userId = principal.kind === "guest" && !principal.accessToken
-            ? ensureLocalDevUser().id
+            ? (await ensureLocalDevUser()).id
             : principal.kind === "guest" || guestSubmitPayload
                 ? ((await resolveGuestUserId(req, principal)) ??
                     (await getAuthenticatedUserId(req, parsed.data.user_id)))
@@ -9129,7 +9136,7 @@ app.get("/events/stream", async (req, res) => {
         };
         if (lastEventId !== undefined && !ringHasId(lastEventId)) {
             const cursorSeq = Number(lastEventId);
-            if (Number.isFinite(cursorSeq) && hasDurableCursor(userId, cursorSeq)) {
+            if (Number.isFinite(cursorSeq) && (await hasDurableCursor(userId, cursorSeq))) {
                 // Recoverable from durable storage: replay from the log, paging until
                 // drained, then continue from the ring tail for anything newer.
                 // Push the subscription's column-backed predicates into SQL so a narrow
@@ -9142,7 +9149,7 @@ app.get("/events/stream", async (req, res) => {
                 };
                 let after = cursorSeq;
                 for (;;) {
-                    const batch = getEventsAfterSeq(userId, after, 1000, durableFilter);
+                    const batch = await getEventsAfterSeq(userId, after, 1000, durableFilter);
                     if (batch.length === 0)
                         break;
                     for (const d of batch) {
@@ -9554,6 +9561,36 @@ export async function startHTTPServer() {
     }
     // Initialize encryption service
     await initServerKeys();
+    // Seed the built-in schema registry from ENTITY_SCHEMAS (issue #1968).
+    //
+    // Runs FIRST among the boot-time seeders so an unseeded instance has its
+    // core types registered before the service-specific seeders below extend
+    // them. `loadActiveSchema` is DB-only with no code fallback, so without this
+    // a fresh instance silently loses store-time auto-linking. Seeding here (as
+    // opposed to only in a Fly `release_command` or the RC redeploy script)
+    // covers every deploy path, including ones not yet written.
+    //
+    // Strictly additive: entity types that already have an active global schema
+    // are left untouched, so an operator's custom schema is never reverted.
+    try {
+        const { seedSchemaRegistryIfEmpty } = await import("./services/schema_registry_bootstrap.js");
+        const summary = await seedSchemaRegistryIfEmpty();
+        if (summary.registered.length > 0) {
+            logger.info(`[SchemaRegistry] registry empty for ${summary.registered.length} type(s) → seeding: ` +
+                `${summary.registered.join(", ")} (preserved ${summary.preserved.length} existing)`);
+        }
+        else {
+            logger.info(`[SchemaRegistry] all ${summary.preserved.length} built-in schema(s) already registered; nothing to seed`);
+        }
+        if (summary.failed.length > 0) {
+            logger.warn(`[SchemaRegistry] ${summary.failed.length} schema(s) failed to seed: ` +
+                summary.failed.map((f) => `${f.entity_type} (${f.error})`).join("; "));
+        }
+    }
+    catch (err) {
+        // Never block boot — a briefly-unavailable DB must not stop the server.
+        logger.warn(`[SchemaRegistry] failed to seed built-in schemas: ${err.message}`);
+    }
     // Seed `issue` schema for the GitHub Issues integration.
     try {
         const { seedIssueSchema } = await import("./services/issues/seed_schema.js");
@@ -9572,6 +9609,15 @@ export async function startHTTPServer() {
     catch (err) {
         logger.warn(`[Plans] failed to seed plan schema: ${err.message}`);
     }
+    // Seed `agent_session` + `session_transcript` schemas (transcript ingest).
+    try {
+        const { seedSessionSchemas } = await import("./services/sessions/seed_schema.js");
+        await seedSessionSchemas();
+        logger.info("[Sessions] agent_session + session_transcript schemas seeded");
+    }
+    catch (err) {
+        logger.warn(`[Sessions] failed to seed session schemas: ${err.message}`);
+    }
     // Seed `skill` schema (harness-mirrored skills, slash-command palette).
     try {
         const { seedSkillSchema } = await import("./services/skills/seed_schema.js");
@@ -9683,7 +9729,7 @@ export async function startHTTPServer() {
             // user rather than the shared nil-UUID LOCAL_DEV_USER_ID fallback.
             _localSandboxActive = true;
             try {
-                const sandboxUser = ensureLocalSandboxUser();
+                const sandboxUser = await ensureLocalSandboxUser();
                 logger.info(`[sandbox_mode] local_sandbox principal provisioned: ${sandboxUser.id}`);
             }
             catch (err) {
@@ -9738,6 +9784,42 @@ export async function startHTTPServer() {
 // Only auto-start if not disabled AND if this is the main module
 const isMainModule = import.meta.url === `file://${process.argv[1]}`;
 if (process.env.NEOTOMA_ACTIONS_DISABLE_AUTOSTART !== "1" && isMainModule) {
+    // Exit diagnostics. A long-running server should never reach `beforeExit`:
+    // that event only fires when the event loop has drained, i.e. nothing is
+    // left holding the process open. In production this happened silently and
+    // repeatedly — the process exited with code 0 every ~12 minutes with no
+    // error and no signal, and because the exit was CLEAN the platform read it
+    // as success and declined to restart, turning it into an outage
+    // (neotoma#2094).
+    //
+    // Logging the active resources at that moment names what the loop was (and
+    // was no longer) waiting on, which is the one piece of evidence needed to
+    // find the handle that stops holding the server up. `exit` is logged too so
+    // the code and reason are attributable even when the cause is external.
+    process.on("beforeExit", (code) => {
+        let resources = [];
+        try {
+            const getResources = process
+                .getActiveResourcesInfo;
+            if (typeof getResources === "function")
+                resources = getResources.call(process);
+        }
+        catch {
+            /* diagnostics must never themselves throw */
+        }
+        console.error(`[neotoma] beforeExit code=${code} — event loop drained; a long-running ` +
+            `server should not reach here. activeResources=${JSON.stringify(resources)} ` +
+            `uptime=${process.uptime().toFixed(1)}s`);
+    });
+    process.on("exit", (code) => {
+        console.error(`[neotoma] exit code=${code} uptime=${process.uptime().toFixed(1)}s`);
+    });
+    for (const sig of ["SIGTERM", "SIGINT", "SIGHUP"]) {
+        process.on(sig, () => {
+            console.error(`[neotoma] received ${sig} uptime=${process.uptime().toFixed(1)}s`);
+            process.exit(0);
+        });
+    }
     startHTTPServer().catch((err) => {
         console.error("Failed to start HTTP server:", err);
         process.exit(1);