@capybara-hq/kernel 0.0.0-stage → 0.1.0-rc.1

package/src/migrations/0042_rename_directory_to_catalog.sql

@@ -0,0 +1,80 @@
+-- Phase 0a terminology: catalog sources become marketplaces, then the enterprise directory becomes
+-- the catalog (in that order: the catalog_* names are free only once the sources are renamed).
+-- Columns directory_item_id / directory_version / catalog_source_id become catalog_item_id /
+-- catalog_version / marketplace_id. Index, FK and PK names are not renamed (as in 0033). A catalog
+-- item version's `source` value 'catalog' (imported from a catalog source) becomes 'marketplace'.
+-- directory_exclusions belongs to directory sync (directory@1) and is not touched. No compatibility
+-- views (nothing is released yet).
+
+-- capybara:allow-destructive table rename; code is renamed in the same release (project not released, no compatibility layer)
+ALTER TABLE IF EXISTS catalog_sources RENAME TO marketplaces;
+-- capybara:allow-destructive table rename; code is renamed in the same release (project not released, no compatibility layer)
+ALTER TABLE IF EXISTS catalog_entries RENAME TO marketplace_entries;
+-- capybara:allow-destructive table rename; code is renamed in the same release (project not released, no compatibility layer)
+ALTER TABLE IF EXISTS directory_items RENAME TO catalog_items;
+-- capybara:allow-destructive table rename; code is renamed in the same release (project not released, no compatibility layer)
+ALTER TABLE IF EXISTS directory_item_versions RENAME TO catalog_item_versions;
+-- capybara:allow-destructive table rename; code is renamed in the same release (project not released, no compatibility layer)
+ALTER TABLE IF EXISTS directory_requests RENAME TO catalog_requests;
+-- capybara:allow-destructive table rename; code is renamed in the same release (project not released, no compatibility layer)
+ALTER TABLE IF EXISTS directory_org_grants RENAME TO catalog_org_grants;
+
+-- RENAME COLUMN has no IF EXISTS: check information_schema first, so a second run does nothing.
+-- capybara:allow-destructive column rename; code is renamed in the same release (project not released, no compatibility layer)
+DO $$
+DECLARE
+  r record;
+BEGIN
+  FOR r IN
+    SELECT * FROM (VALUES
+      ('connectors', 'directory_item_id', 'catalog_item_id'),
+      ('connectors', 'directory_version', 'catalog_version'),
+      ('skills', 'directory_item_id', 'catalog_item_id'),
+      ('skills', 'directory_version', 'catalog_version'),
+      ('skill_versions', 'directory_item_id', 'catalog_item_id'),
+      ('skill_versions', 'directory_version', 'catalog_version'),
+      ('extension_installs', 'directory_item_id', 'catalog_item_id'),
+      ('catalog_items', 'catalog_source_id', 'marketplace_id')
+    ) AS c(t, old_name, new_name)
+  LOOP
+    IF EXISTS (
+      SELECT 1 FROM information_schema.columns
+      WHERE table_schema = 'capybara' AND table_name = r.t AND column_name = r.old_name
+    ) THEN
+      EXECUTE format('ALTER TABLE capybara.%I RENAME COLUMN %I TO %I', r.t, r.old_name, r.new_name);
+    END IF;
+  END LOOP;
+END
+$$;
+
+-- source 'catalog' -> 'marketplace': drop the CHECK (under its 0035 name, or ours on a second run),
+-- rewrite the rows, add it back. The whole file runs in one transaction, so this is repeatable.
+ALTER TABLE catalog_item_versions DROP CONSTRAINT IF EXISTS directory_item_versions_source_check;
+ALTER TABLE catalog_item_versions DROP CONSTRAINT IF EXISTS catalog_item_versions_source_check;
+UPDATE catalog_item_versions SET source = 'marketplace' WHERE source = 'catalog';
+ALTER TABLE catalog_item_versions ADD CONSTRAINT catalog_item_versions_source_check
+  CHECK (source IN ('file', 'npm', 'marketplace'));
+
+-- App bundles staged before this migration (rows live 24 hours) keep their source as JSON: kind
+-- 'catalog' becomes 'marketplace' and the key catalogSourceId becomes marketplaceId, so confirming
+-- one still writes a valid version source. Skipped when the table is gone (renamed by a later
+-- migration), so a second run is harmless.
+-- capybara:allow-destructive rewrites one JSON value of staged rows (24-hour TTL); the DO block only adds the table existence check
+DO $$
+BEGIN
+  IF to_regclass('capybara.app_import_staging') IS NOT NULL THEN
+    UPDATE capybara.app_import_staging
+      SET source = (source - 'catalogSourceId')
+        || jsonb_build_object(
+          'kind',
+          CASE WHEN source->>'kind' = 'catalog' THEN 'marketplace' ELSE source->>'kind' END
+        )
+        || CASE
+          WHEN source ? 'catalogSourceId'
+            THEN jsonb_build_object('marketplaceId', source->'catalogSourceId')
+          ELSE '{}'::jsonb
+        END
+      WHERE source->>'kind' = 'catalog' OR source ? 'catalogSourceId';
+  END IF;
+END
+$$;

package/src/migrations/0043_rename_app_installs_to_plugin_installs.sql

@@ -0,0 +1,20 @@
+-- Phase 0a terminology: app bundles become plugins. app_installs / app_install_components /
+-- app_import_staging become plugin_installs / plugin_install_components / plugin_import_staging
+-- (plugin_installs is free since 0041 renamed the old one to extension_installs). A component's
+-- kind 'plugin' (an extension the bundle installed) becomes 'extension'. Index, FK and PK names are
+-- not renamed (as in 0033). No compatibility views (nothing is released yet).
+
+-- capybara:allow-destructive table rename; code is renamed in the same release (project not released, no compatibility layer)
+ALTER TABLE IF EXISTS app_installs RENAME TO plugin_installs;
+-- capybara:allow-destructive table rename; code is renamed in the same release (project not released, no compatibility layer)
+ALTER TABLE IF EXISTS app_install_components RENAME TO plugin_install_components;
+-- capybara:allow-destructive table rename; code is renamed in the same release (project not released, no compatibility layer)
+ALTER TABLE IF EXISTS app_import_staging RENAME TO plugin_import_staging;
+
+-- kind 'plugin' -> 'extension': drop the CHECK (under its 0037 name, or ours on a second run),
+-- rewrite the rows, add it back. The whole file runs in one transaction, so this is repeatable.
+ALTER TABLE plugin_install_components DROP CONSTRAINT IF EXISTS app_install_components_kind_check;
+ALTER TABLE plugin_install_components DROP CONSTRAINT IF EXISTS plugin_install_components_kind_check;
+UPDATE plugin_install_components SET kind = 'extension' WHERE kind = 'plugin';
+ALTER TABLE plugin_install_components ADD CONSTRAINT plugin_install_components_kind_check
+  CHECK (kind IN ('extension', 'connector', 'skill'));

package/src/migrations/0044_catalog_one_kind.sql

@@ -0,0 +1,90 @@
+-- Phase 0b: the catalog holds one kind, the plugin (package ecosystem spec §4). Every catalog row
+-- before this migration is in a pre-0.1.0 format (an extension tgz, a skill / connector-template
+-- package, an app.yaml bundle) that 0b no longer reads, so the catalog content is removed and the
+-- tables lose their kind:
+-- - deleted, in FK order: org plugin installs and their components, requests, grants, extension
+--   catalog sources, import staging, versions, items, cached marketplace entries (refetched at the
+--   next refresh: each marketplace's ETag is cleared and its status reset to 'never'). Org skills / connectors / skill versions and deployment extension installs stay,
+--   with their catalog link set to NULL. Objects under deployment/directory/ are left in object
+--   storage, unreachable.
+-- - catalog_items: no kind; one live item per name.
+-- - catalog_item_versions: manifest (the normalized plugin.json), no section / resolved,
+--   plugin_sha256 becomes extension_sha256.
+-- - marketplace_entries: no kind; one entry is one version, keyed (source_id, name, version) with
+--   '' for an entry without a version (marketplace.json §5.2); npm is NULL for non-npm sources.
+-- - plugin_import_staging: manifest instead of bundle.
+-- The deletes run only while catalog_items still has its kind column, so a second run is a no-op.
+
+-- capybara:allow-destructive pre-0.1.0 catalog content is in a format 0b removes; nothing is released
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'capybara' AND table_name = 'catalog_items' AND column_name = 'kind'
+  ) THEN
+    DELETE FROM capybara.plugin_install_components;
+    DELETE FROM capybara.plugin_installs;
+    DELETE FROM capybara.catalog_requests;
+    DELETE FROM capybara.catalog_org_grants;
+    DELETE FROM capybara.extension_catalog_sources;
+    DELETE FROM capybara.plugin_import_staging;
+    UPDATE capybara.connectors SET catalog_item_id = NULL, catalog_version = NULL
+      WHERE catalog_item_id IS NOT NULL OR catalog_version IS NOT NULL;
+    UPDATE capybara.skills SET catalog_item_id = NULL, catalog_version = NULL
+      WHERE catalog_item_id IS NOT NULL OR catalog_version IS NOT NULL;
+    UPDATE capybara.skill_versions SET catalog_item_id = NULL, catalog_version = NULL
+      WHERE catalog_item_id IS NOT NULL OR catalog_version IS NOT NULL;
+    UPDATE capybara.extension_installs SET catalog_item_id = NULL
+      WHERE catalog_item_id IS NOT NULL;
+    DELETE FROM capybara.catalog_item_versions;
+    DELETE FROM capybara.catalog_items;
+    DELETE FROM capybara.marketplace_entries;
+    -- The entries are gone, so the next refresh must not get a 304 for them
+    UPDATE capybara.marketplaces SET etag = NULL, last_status = 'never', last_error = NULL
+      WHERE etag IS NOT NULL OR last_status <> 'never';
+  END IF;
+END
+$$;
+
+-- catalog_items: one kind; the live-name index moves from (kind, name) to name.
+DROP INDEX IF EXISTS directory_items_live_name_uq;
+-- capybara:allow-destructive pre-0.1.0 catalog content is in a format 0b removes; nothing is released
+ALTER TABLE catalog_items DROP COLUMN IF EXISTS kind;
+CREATE UNIQUE INDEX IF NOT EXISTS catalog_items_live_name_uq
+  ON catalog_items (name)
+  WHERE deleted_at IS NULL;
+
+-- catalog_item_versions: the normalized plugin manifest; the extension's package.
+ALTER TABLE catalog_item_versions ADD COLUMN IF NOT EXISTS manifest jsonb NOT NULL;
+-- capybara:allow-destructive pre-0.1.0 catalog content is in a format 0b removes; nothing is released
+ALTER TABLE catalog_item_versions DROP COLUMN IF EXISTS section;
+-- capybara:allow-destructive pre-0.1.0 catalog content is in a format 0b removes; nothing is released
+ALTER TABLE catalog_item_versions DROP COLUMN IF EXISTS resolved;
+-- RENAME COLUMN has no IF EXISTS: check information_schema first, so a second run does nothing.
+-- capybara:allow-destructive pre-0.1.0 catalog content is in a format 0b removes; nothing is released
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'capybara' AND table_name = 'catalog_item_versions'
+      AND column_name = 'plugin_sha256'
+  ) THEN
+    ALTER TABLE capybara.catalog_item_versions RENAME COLUMN plugin_sha256 TO extension_sha256;
+  END IF;
+END
+$$;
+
+-- marketplace_entries: one entry per (source, name, version).
+ALTER TABLE marketplace_entries DROP CONSTRAINT IF EXISTS catalog_entries_pkey;
+ALTER TABLE marketplace_entries DROP CONSTRAINT IF EXISTS marketplace_entries_pkey;
+-- capybara:allow-destructive pre-0.1.0 catalog content is in a format 0b removes; nothing is released
+ALTER TABLE marketplace_entries DROP COLUMN IF EXISTS kind;
+ALTER TABLE marketplace_entries ADD COLUMN IF NOT EXISTS version text NOT NULL DEFAULT '';
+ALTER TABLE marketplace_entries ALTER COLUMN npm DROP NOT NULL;
+ALTER TABLE marketplace_entries
+  ADD CONSTRAINT marketplace_entries_pkey PRIMARY KEY (source_id, name, version);
+
+-- plugin_import_staging: the plugin manifest instead of the app bundle.
+-- capybara:allow-destructive pre-0.1.0 catalog content is in a format 0b removes; nothing is released
+ALTER TABLE plugin_import_staging DROP COLUMN IF EXISTS bundle;
+ALTER TABLE plugin_import_staging ADD COLUMN IF NOT EXISTS manifest jsonb NOT NULL;

package/src/migrations/0045_plugin_dependencies.sql

@@ -0,0 +1,9 @@
+-- Phase 0b: a plugin's dependencies are installed in the org before it, each as its own
+-- plugin_installs row, and recorded as a component of the parent install with kind 'plugin'
+-- (ref = the dependency's install id). The CHECK is dropped and added back under the same name,
+-- so a second run is a no-op.
+
+-- capybara:allow-destructive the CHECK is re-added with one more allowed value in the same transaction
+ALTER TABLE plugin_install_components DROP CONSTRAINT IF EXISTS plugin_install_components_kind_check;
+ALTER TABLE plugin_install_components ADD CONSTRAINT plugin_install_components_kind_check
+  CHECK (kind IN ('extension', 'connector', 'skill', 'plugin'));

package/src/migrations/0046_git_sources.sql

@@ -0,0 +1,25 @@
+-- Phase A1: git marketplaces and git plugin sources (package ecosystem spec §5.1, §5.3).
+-- - marketplaces: the form (http = a marketplace.json URL, git = a repository), the git ref it
+--   follows (NULL = the remote HEAD), the commit of the last refresh (an unchanged commit skips the
+--   refresh) and the manifest's owner name (the publisher of skills-only plugins).
+-- - catalog_item_versions: source 'git'; where the plugin came from (source_detail: host, repo,
+--   path, ref, commit and followsBranch for git; the archive URL; the npm registry) and the content
+--   digest of the imported files (filled from phase A1 task 4).
+-- - catalog_items: package_name may be NULL (a git plugin without package.json).
+-- Every statement is repeatable: columns are added with IF NOT EXISTS, the CHECKs are dropped and
+-- added back under the same name in the same transaction.
+
+ALTER TABLE marketplaces ADD COLUMN IF NOT EXISTS form text NOT NULL DEFAULT 'http';
+ALTER TABLE marketplaces DROP CONSTRAINT IF EXISTS marketplaces_form_check;
+ALTER TABLE marketplaces ADD CONSTRAINT marketplaces_form_check CHECK (form IN ('http', 'git'));
+ALTER TABLE marketplaces ADD COLUMN IF NOT EXISTS ref text NULL;
+ALTER TABLE marketplaces ADD COLUMN IF NOT EXISTS last_commit text NULL;
+ALTER TABLE marketplaces ADD COLUMN IF NOT EXISTS owner_name text NULL;
+
+ALTER TABLE catalog_item_versions ADD COLUMN IF NOT EXISTS source_detail jsonb NULL;
+ALTER TABLE catalog_item_versions ADD COLUMN IF NOT EXISTS content_digest text NULL;
+ALTER TABLE catalog_item_versions DROP CONSTRAINT IF EXISTS catalog_item_versions_source_check;
+ALTER TABLE catalog_item_versions ADD CONSTRAINT catalog_item_versions_source_check
+  CHECK (source IN ('file', 'npm', 'marketplace', 'git'));
+
+ALTER TABLE catalog_items ALTER COLUMN package_name DROP NOT NULL;

package/src/migrations/0047_marketplace_entry_heads.sql

@@ -0,0 +1,7 @@
+-- Phase A1: the branch head of a marketplace entry that follows a git branch (spec §5.3 "content
+-- changed at the same version"). A refresh resolves it for entries already imported, so an
+-- imported version whose recorded commit differs from the head shows the content changed; NULL
+-- when not resolved (not imported, pinned to a commit, not git, or the lookup failed).
+-- Repeatable: the column is added with IF NOT EXISTS.
+
+ALTER TABLE marketplace_entries ADD COLUMN IF NOT EXISTS head_commit text NULL;

package/src/migrations/0048_marketplace_entry_trees.sql

@@ -0,0 +1,8 @@
+-- Phase A1: the git tree oid of a marketplace entry's plugin directory (spec §5.3 "content
+-- changed at the same version"). A path entry gets it at each refresh of its git marketplace; an
+-- imported git entry with a path gets it with its branch head. Compared with the tree recorded on
+-- the imported version, so a monorepo commit that leaves a plugin's directory alone does not mark
+-- that plugin changed. NULL when unknown (then commits are compared).
+-- Repeatable: the column is added with IF NOT EXISTS.
+
+ALTER TABLE marketplace_entries ADD COLUMN IF NOT EXISTS tree_oid text NULL;

package/src/migrations/0049_plugin_upgrades.sql

@@ -0,0 +1,37 @@
+-- Phase A1: org in-place upgrades of installed plugins (package ecosystem spec §10).
+-- - plugin_installs.status gains 'upgrading' (set under the org lock while an upgrade runs; one
+--   upgrade or uninstall per install at a time).
+-- - plugin_installs.upgrade: the journal of the running upgrade ({ id, from, to, startedAt, done }),
+--   NULL otherwise. A replica that crashed midway leaves it behind; once older than
+--   catalog.staleInstallMinutes it is undone (the install back at its old version).
+-- - plugin_install_components.template_id: the connector template a connector component was
+--   created from (NULL for other kinds and for installs before this migration), so an upgrade maps
+--   a template to its connector.
+-- - plugin_install_components.dropped: a component an upgrade removed from the plugin but kept
+--   because an agent uses it ("no longer in the plugin").
+-- The status CHECK was created inline in 0037 under the table's name at the time (0043 renamed the
+-- table, not the constraint), so it is found by its definition, dropped and added back under a
+-- fixed name in the same transaction; a second run is a no-op.
+
+-- capybara:allow-destructive the status CHECK is re-added with one more allowed value in the same transaction
+DO $$
+DECLARE
+  c record;
+BEGIN
+  FOR c IN
+    SELECT conname FROM pg_constraint
+    WHERE conrelid = 'plugin_installs'::regclass
+      AND contype = 'c'
+      AND pg_get_constraintdef(oid) LIKE '%status%'
+  LOOP
+    EXECUTE format('ALTER TABLE plugin_installs DROP CONSTRAINT %I', c.conname);
+  END LOOP;
+END $$;
+ALTER TABLE plugin_installs ADD CONSTRAINT plugin_installs_status_check
+  CHECK (status IN ('installing', 'installed', 'failed', 'uninstalling', 'upgrading'));
+ALTER TABLE plugin_installs ADD COLUMN IF NOT EXISTS upgrade jsonb NULL;
+
+ALTER TABLE plugin_install_components ADD COLUMN IF NOT EXISTS template_id text NULL;
+-- An upgrade that removes a skill or connector an agent still uses keeps it, marked "no longer in
+-- the plugin"; the install still owns it (uninstall removes it once nothing uses it).
+ALTER TABLE plugin_install_components ADD COLUMN IF NOT EXISTS dropped boolean NOT NULL DEFAULT false;

package/src/migrations/0050_bootstrap.sql

@@ -0,0 +1,53 @@
+-- Phase A2: bootstrap plugins replace built-in extensions (package ecosystem spec §7).
+-- - Source 'bootstrap' for packages, install records, permission snapshots and catalog versions
+--   written by the bootstrap step (packages baked into the image, pinned by packages/kernel/
+--   bootstrap.json).
+-- - extension_installs.required: a required bootstrap plugin is enabled in every org without an
+--   org config row and cannot be disabled or uninstalled (the bootstrap step sets and clears it).
+-- - extension_replica_status: the kernel no longer loads 'builtin' extensions; a bootstrap plugin
+--   is an install record and is reported as 'install'. The status table is rebuilt by each
+--   replica's reconcile, so the 'builtin' rows are dropped.
+-- - bootstrap_runs: one row per manifest (sha256 of bootstrap.json) the bootstrap step completed;
+--   "bootstrap done" = a row for the current manifest.
+-- Every CHECK is dropped under each name it may have (its creation name, or ours on a second run)
+-- and added back in the same transaction, so a second run is a no-op.
+
+-- capybara:allow-destructive the source CHECK is re-added with one more allowed value in the same transaction
+ALTER TABLE extension_packages DROP CONSTRAINT IF EXISTS extension_packages_source_check;
+ALTER TABLE extension_packages ADD CONSTRAINT extension_packages_source_check
+  CHECK (source IN ('npm', 'file', 'catalog', 'bootstrap'));
+
+-- capybara:allow-destructive the source CHECK is re-added with one more allowed value in the same transaction
+ALTER TABLE extension_installs DROP CONSTRAINT IF EXISTS extension_installs_source_check;
+ALTER TABLE extension_installs ADD CONSTRAINT extension_installs_source_check
+  CHECK (source IN ('npm', 'file', 'catalog', 'bootstrap'));
+
+-- capybara:allow-destructive the source CHECK is re-added with one more allowed value in the same transaction
+ALTER TABLE extension_permission_snapshots
+  DROP CONSTRAINT IF EXISTS plugin_permission_snapshots_source_check;
+ALTER TABLE extension_permission_snapshots
+  DROP CONSTRAINT IF EXISTS extension_permission_snapshots_source_check;
+ALTER TABLE extension_permission_snapshots ADD CONSTRAINT extension_permission_snapshots_source_check
+  CHECK (source IN ('cli', 'auto', 'web', 'bootstrap'));
+
+-- capybara:allow-destructive the source CHECK is re-added with one more allowed value in the same transaction
+ALTER TABLE catalog_item_versions DROP CONSTRAINT IF EXISTS catalog_item_versions_source_check;
+ALTER TABLE catalog_item_versions ADD CONSTRAINT catalog_item_versions_source_check
+  CHECK (source IN ('file', 'npm', 'marketplace', 'git', 'bootstrap'));
+
+-- capybara:allow-destructive replica status rows are rebuilt by every replica's reconcile; 'builtin' is no longer a load source
+DELETE FROM extension_replica_status WHERE source = 'builtin';
+-- capybara:allow-destructive the source CHECK is re-added without 'builtin' in the same transaction
+ALTER TABLE extension_replica_status DROP CONSTRAINT IF EXISTS plugin_replica_status_source_check;
+ALTER TABLE extension_replica_status
+  DROP CONSTRAINT IF EXISTS extension_replica_status_source_check;
+ALTER TABLE extension_replica_status ADD CONSTRAINT extension_replica_status_source_check
+  CHECK (source IN ('config', 'install'));
+
+ALTER TABLE extension_installs ADD COLUMN IF NOT EXISTS required boolean NOT NULL DEFAULT false;
+
+CREATE TABLE IF NOT EXISTS bootstrap_runs (
+  manifest_sha256 text PRIMARY KEY CHECK (manifest_sha256 ~ '^[0-9a-f]{64}$'),
+  completed_at timestamptz NOT NULL,
+  results jsonb NOT NULL
+);

package/src/migrations/0051_claude_compat.sql

@@ -0,0 +1,26 @@
+-- Phase B: Claude Code plugin compatibility (package ecosystem spec §8, §9).
+-- - catalog_item_versions.source_format: the format the version was read from ('capybara', or
+--   'claude-code' for a translated Claude Code plugin); translation: its translation report (null
+--   for a native plugin); license_text: the root LICENSE text (at most 64 KiB; any plugin);
+--   license_truncated: the root LICENSE was longer (or not UTF-8), so license_text is null.
+-- - skill_versions.source_format: the format of the plugin the version came from (org skills and
+--   agent skills stay 'capybara'); suggest_pinned: the plugin suggests pinning it (spec §9.1).
+-- - marketplace_entries.claude: the Claude marketplace entry's overlay (strict, component fields,
+--   publisher; null for a Capybara entry).
+-- - marketplaces.skipped: the entries the last successful refresh could not store
+--   ({ name, reason }[]), replaced on every refresh.
+-- Additive only: every column is nullable or has a default, so a running older version keeps
+-- working during a rolling upgrade.
+
+ALTER TABLE catalog_item_versions ADD COLUMN IF NOT EXISTS source_format text NOT NULL DEFAULT 'capybara'
+  CONSTRAINT catalog_item_versions_source_format_check CHECK (source_format IN ('capybara', 'claude-code'));
+ALTER TABLE catalog_item_versions ADD COLUMN IF NOT EXISTS translation jsonb;
+ALTER TABLE catalog_item_versions ADD COLUMN IF NOT EXISTS license_text text;
+ALTER TABLE catalog_item_versions ADD COLUMN IF NOT EXISTS license_truncated boolean NOT NULL DEFAULT false;
+
+ALTER TABLE skill_versions ADD COLUMN IF NOT EXISTS source_format text NOT NULL DEFAULT 'capybara'
+  CONSTRAINT skill_versions_source_format_check CHECK (source_format IN ('capybara', 'claude-code'));
+ALTER TABLE skill_versions ADD COLUMN IF NOT EXISTS suggest_pinned boolean NOT NULL DEFAULT false;
+
+ALTER TABLE marketplace_entries ADD COLUMN IF NOT EXISTS claude jsonb;
+ALTER TABLE marketplaces ADD COLUMN IF NOT EXISTS skipped jsonb NOT NULL DEFAULT '[]'::jsonb;

package/src/migrations/0052_conversations_account_agent_idx.sql

@@ -0,0 +1,5 @@
+-- The sidebar's grouped conversation list (GET /conversations/groups, GET /conversations?agentId=):
+-- my chat conversations per agent, newest first.
+CREATE INDEX IF NOT EXISTS conversations_account_agent_idx
+  ON capybara.conversations (org_id, account_id, agent_id, updated_at DESC, id DESC)
+  WHERE kind = 'chat';

package/src/migrations/0053_subagents.sql

@@ -0,0 +1,73 @@
+-- Phase C: sub-agents (spec docs/superpowers/specs/2026-10-26-subagents-design.md §6, §16.3, §18).
+-- - conversations: kind gains 'subagent' (a child conversation, read-only for people), with the
+--   parent conversation (deleting it deletes its children) and the dispatched type name.
+-- - runs.subagent_tokens_used: the parent run's sub-agent token counter (§8.3).
+-- - subagent_dispatches: one row per dispatch (an `agent` call of a parent run).
+-- - agent_templates / agent_template_versions: agent templates installed from plugins.
+-- - plugin_install_components.kind gains 'agent_template'.
+-- Additive only: new columns are nullable or have a default and the CHECKs only widen, so a
+-- running older version keeps working during a rolling upgrade. 0052 is taken by another branch.
+-- The widened CHECKs are re-added NOT VALID: the old CHECK implies the new one, so existing rows
+-- need no scan under the ACCESS EXCLUSIVE lock; new writes are checked as usual.
+
+-- capybara:allow-destructive the CHECK is re-added with one more allowed value in the same transaction
+ALTER TABLE conversations DROP CONSTRAINT IF EXISTS conversations_kind_check;
+ALTER TABLE conversations ADD CONSTRAINT conversations_kind_check
+  CHECK (kind IN ('chat', 'eval', 'subagent')) NOT VALID;
+ALTER TABLE conversations ADD COLUMN IF NOT EXISTS parent_conversation_id text
+  REFERENCES conversations(id) ON DELETE CASCADE;
+ALTER TABLE conversations ADD COLUMN IF NOT EXISTS subagent_type text;
+CREATE INDEX IF NOT EXISTS conversations_parent_idx ON conversations (parent_conversation_id)
+  WHERE kind = 'subagent';
+
+ALTER TABLE runs ADD COLUMN IF NOT EXISTS subagent_tokens_used bigint NOT NULL DEFAULT 0;
+
+CREATE TABLE IF NOT EXISTS subagent_dispatches (
+  parent_run_id text NOT NULL,
+  parent_call_id text NOT NULL,
+  parent_conversation_id text NOT NULL REFERENCES conversations(id) ON DELETE CASCADE,
+  step integer NOT NULL,
+  child_conversation_id text NOT NULL REFERENCES conversations(id) ON DELETE CASCADE,
+  child_run_id text NOT NULL,
+  resumed boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (parent_run_id, parent_call_id)
+);
+CREATE INDEX IF NOT EXISTS subagent_dispatches_child_run_idx ON subagent_dispatches (child_run_id);
+CREATE INDEX IF NOT EXISTS subagent_dispatches_child_conv_idx
+  ON subagent_dispatches (child_conversation_id);
+
+-- catalog_item_id / plugin_name: the plugin the template came from (provenance); every template
+-- is installed from a plugin, so plugin_name is required (NULLs would escape the unique index)
+CREATE TABLE IF NOT EXISTS agent_templates (
+  id text PRIMARY KEY,
+  org_id text NOT NULL REFERENCES orgs(id) ON DELETE CASCADE,
+  name text NOT NULL,
+  catalog_item_id text,
+  plugin_name text NOT NULL,
+  current_version integer NOT NULL CHECK (current_version >= 1),
+  deleted_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX IF NOT EXISTS agent_templates_live_name_uq
+  ON agent_templates (org_id, plugin_name, name)
+  WHERE deleted_at IS NULL;
+
+-- definition: the parsed template (frontmatter and body); catalog_version: the plugin version
+CREATE TABLE IF NOT EXISTS agent_template_versions (
+  template_id text NOT NULL REFERENCES agent_templates(id) ON DELETE CASCADE,
+  version integer NOT NULL CHECK (version >= 1),
+  definition jsonb NOT NULL,
+  source_format text NOT NULL DEFAULT 'capybara'
+    CONSTRAINT agent_template_versions_source_format_check
+    CHECK (source_format IN ('capybara', 'claude-code')),
+  catalog_version text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (template_id, version)
+);
+
+-- capybara:allow-destructive the CHECK is re-added with one more allowed value in the same transaction
+ALTER TABLE plugin_install_components DROP CONSTRAINT IF EXISTS plugin_install_components_kind_check;
+ALTER TABLE plugin_install_components ADD CONSTRAINT plugin_install_components_kind_check
+  CHECK (kind IN ('extension', 'connector', 'skill', 'plugin', 'agent_template')) NOT VALID;

package/src/migrations/0054_subagent_wait_expiry.sql

@@ -0,0 +1,7 @@
+-- Phase C: the expiry of a run's sub-agents wait (spec §7.2), so the wait sweep can expire it when
+-- its timeout job was lost (approvals and questions keep theirs in their own rows). Set when a run
+-- suspends on a `subagents` wait, cleared when it resumes. Additive and nullable: older versions
+-- ignore it.
+ALTER TABLE runs ADD COLUMN IF NOT EXISTS wait_expires_at timestamptz;
+CREATE INDEX IF NOT EXISTS runs_wait_expires_idx ON runs (wait_expires_at)
+  WHERE status = 'waiting' AND wait_expires_at IS NOT NULL;

package/src/migrations/0055_subagent_parent_indexes.sql

@@ -0,0 +1,10 @@
+-- Final review I2: the ON DELETE CASCADE of conversations.parent_conversation_id and of
+-- subagent_dispatches.parent_conversation_id runs `... WHERE $1 = parent_conversation_id` with no
+-- `kind` predicate, so the partial index conversations_parent_idx (WHERE kind = 'subagent') cannot
+-- serve it and every conversation delete scanned both tables. These indexes carry no kind
+-- predicate; the app's `parent = $x AND kind = 'subagent'` queries can use the first one too, so
+-- conversations_parent_idx can be dropped in a later release. Additive: older versions ignore them.
+CREATE INDEX IF NOT EXISTS conversations_parent_conv_idx ON conversations (parent_conversation_id)
+  WHERE parent_conversation_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS subagent_dispatches_parent_conv_idx
+  ON subagent_dispatches (parent_conversation_id);

package/src/migrations/0056_approval_reason.sql

@@ -0,0 +1,3 @@
+-- UI refresh B (Task 6): the optional reason a person gives when denying a tool call. Shown on the
+-- handled approval and appended to the denied call's tool result.
+ALTER TABLE capybara.approvals ADD COLUMN IF NOT EXISTS deny_reason text;

package/src/migrations/0057_conversation_titles.sql

@@ -0,0 +1,11 @@
+-- UI refresh B (Task 7): model-generated titles and create-on-first-send.
+-- title_source: who wrote `title` (null = nobody yet; a manual rename is never regenerated).
+-- title_attempts: title-generation attempts made (bounded retry, claimed per attempt).
+-- create_request_id: the first message's clientMessageId, so a retried first send is idempotent.
+ALTER TABLE capybara.conversations ADD COLUMN IF NOT EXISTS title_source text
+  CHECK (title_source IN ('generated', 'manual'));
+ALTER TABLE capybara.conversations ADD COLUMN IF NOT EXISTS title_attempts int NOT NULL DEFAULT 0;
+ALTER TABLE capybara.conversations ADD COLUMN IF NOT EXISTS create_request_id text;
+CREATE UNIQUE INDEX IF NOT EXISTS conversations_create_request_idx
+  ON capybara.conversations (org_id, account_id, create_request_id)
+  WHERE create_request_id IS NOT NULL;

package/src/migrations/0058_conversation_selection.sql

@@ -0,0 +1,4 @@
+-- UI refresh B (Task 8): the model / effort a person switched the conversation to, as of the latest
+-- `model_switched` event (the log is the source of truth; this column serves the conversation view).
+-- { "model": { "provider", "model" } | null, "effort": string | null }; NULL = never switched.
+ALTER TABLE capybara.conversations ADD COLUMN IF NOT EXISTS selection jsonb;

package/src/migrations/0059_conversation_queue.sql

@@ -0,0 +1,22 @@
+-- UI refresh B (Task 9): queued messages. A queued message is not in the event log until it is sent
+-- (the model has not seen it); it is conversation state another replica may dispatch, so it lives
+-- here. `content` holds the blocks after the text (`@` resources read at queue time, uploaded file
+-- refs); `attachments` the `@` resource metadata for user_message.payload.attachments; `files` the
+-- uploaded files' display metadata. queue_paused: a run failed or was stopped with items queued.
+CREATE TABLE IF NOT EXISTS capybara.conversation_queue (
+  id text PRIMARY KEY,
+  conversation_id text NOT NULL REFERENCES capybara.conversations(id) ON DELETE CASCADE,
+  account_id text NOT NULL,
+  position bigint NOT NULL,
+  text text NOT NULL,
+  content jsonb NOT NULL,
+  attachments jsonb NOT NULL DEFAULT '[]',
+  files jsonb NOT NULL DEFAULT '[]',
+  client_message_id text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (conversation_id, client_message_id)
+);
+CREATE INDEX IF NOT EXISTS conversation_queue_position_idx
+  ON capybara.conversation_queue (conversation_id, position);
+ALTER TABLE capybara.conversations ADD COLUMN IF NOT EXISTS queue_paused boolean NOT NULL DEFAULT false;

package/src/migrations/0060_file_previewers.sql

@@ -0,0 +1,10 @@
+-- UI refresh B (Task 11): an org's order of file-preview@1 previewers. A previewer without a row comes
+-- after every ordered one, in provider order; `disabled` hides it from the org's file previews.
+CREATE TABLE IF NOT EXISTS capybara.file_previewers (
+  org_id text NOT NULL REFERENCES capybara.orgs(id) ON DELETE CASCADE,
+  plugin text NOT NULL,
+  previewer_id text NOT NULL,
+  position int NOT NULL,
+  disabled boolean NOT NULL DEFAULT false,
+  PRIMARY KEY (org_id, plugin, previewer_id)
+);

package/src/migrations/0061_queue_selection.sql

@@ -0,0 +1,5 @@
+-- UI refresh B (final review I1): a queued message carries the model / effort pick it was queued
+-- with. At dispatch the kernel writes the `model_switched` before the message, as a direct send
+-- does. { "provider", "model" } / the effort value; NULL = the message picks nothing.
+ALTER TABLE capybara.conversation_queue ADD COLUMN IF NOT EXISTS model jsonb;
+ALTER TABLE capybara.conversation_queue ADD COLUMN IF NOT EXISTS effort text;

package/src/migrations/0062_queued_skill.sql

@@ -0,0 +1,8 @@
+-- Phase D (Task 9): a queued message can invoke a skill. It is rendered when queued (like queued
+-- `@` resources), so `content` starts with the rendered text and `skill` holds the
+-- user_message.skill record `{ id, version, source, name, plugin?, arguments, mode, agentType? }`;
+-- NULL = a plain message. queue_pause_reason says why the queue paused: `run_ended` (a run failed
+-- or was stopped), `author_cannot_send`, `skill_not_invocable` (re-checked at dispatch); NULL when
+-- not paused or paused by an older replica. Additive: older replicas never write either column.
+ALTER TABLE capybara.conversation_queue ADD COLUMN IF NOT EXISTS skill jsonb;
+ALTER TABLE capybara.conversations ADD COLUMN IF NOT EXISTS queue_pause_reason text;