fix(oauth): serialize version-guard date in slack fan-out sql

[TheodoreSpeaks]

Summary

• The version-guarded Slack fan-out (fix(oauth): coalesce slack token refresh per installation and preserve provider refresh errors #5723) passed a bare `Date` as a raw sql parameter; raw fragments skip drizzle's column mapping and the driver rejects Date instances (`The "string" argument must be of type string or an instance of Buffer...`), failing every guarded fan-out at runtime
• Serialize the guard timestamp to ISO explicitly in the fragment
• Caught in staging testing (run failed with the generic refresh error; CloudWatch showed the failed query). Verified end-to-end against a real database: guard timestamp keeps ms precision and the guarded fan-out updates all installation rows

Type of Change

• Bug fix

Testing

Local repro script against a real Postgres reproduced the driver error pre-fix and passes post-fix (guarded fan-out writes all rows, chainVersion keeps millisecond precision). Unit suites pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 17, 2026 7:19pm

[cursor]

PR Summary

Low Risk
Single-parameter serialization fix in an existing guard clause; no change to fan-out logic or OAuth flow beyond fixing the broken SQL binding.

Overview
Fixes a runtime failure in version-guarded Slack token fan-out when ifChainUnchangedSince is set (refresh coalescing path).

The NOT EXISTS guard compared sibling.updated_at to a raw SQL parameter that was a bare Date. Drizzle does not map types inside sql fragments, so the driver rejected the value and every guarded fan-out failed. The guard timestamp is now passed as since.toISOString(), with a short comment explaining why.

Connect-time fan-out (no guard) is unchanged; only refresh paths that pass ifChainUnchangedSince were affected.

^{Reviewed by Cursor Bugbot for commit 16344b0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR fixes the Slack token fan-out version guard.

• Serializes the guard timestamp as an ISO string.
• Prevents raw SQL from passing an unsupported Date parameter to the driver.
• Preserves the existing guarded updated_at comparison.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.
• Guarded refresh callers provide valid database-derived dates.
• ISO serialization retains the timestamp precision available through JavaScript Date.

Important Files Changed

Filename	Overview
apps/sim/lib/oauth/slack.ts	Serializes the database-derived guard timestamp before binding it in the raw Slack fan-out SQL.

_{Reviews (1): Last reviewed commit: "fix(oauth): serialize version-guard date..." | Re-trigger Greptile}