@digitalpaws/starr 0.0.1

package/src/content-types/registry.ts

@@ -0,0 +1,194 @@
+// SPDX-License-Identifier: 0BSD
+// SPDX-FileCopyrightText: 2025 Digi <digitalpaws@proton.me>
+
+import type { ContentTypeDescriptor, NamingRule } from "@digitalpaws/starr-types-core";
+
+/**
+ * Pure validation function. Returns null if valid, or an error message string.
+ *
+ * Checks in order:
+ * - id is truthy
+ * - name is truthy
+ * - identity is a non-empty array (DS2)
+ * - Each field: key, label, type are truthy
+ * - list fields must have itemType (FT2)
+ * - enum fields must have non-empty options (FT2)
+ */
+export function validateDescriptor(descriptor: ContentTypeDescriptor): string | null {
+  // Check required fields (as unknown for runtime validation of TS-required fields).
+  const d = descriptor as unknown as Record<string, unknown>;
+
+  if (!d.id) return "content-type id is required";
+  if (!d.name) return "content-type name is required";
+  if (!Array.isArray(d.identity) || (d.identity as unknown[]).length === 0) {
+    return "content-type identity must be a non-empty array";
+  }
+
+  const fields = d.fields as Array<Record<string, unknown>> | undefined;
+  if (Array.isArray(fields)) {
+    for (let i = 0; i < fields.length; i++) {
+      const f = fields[i];
+      if (!f.key) return `field[${i}]: key is required`;
+      if (!f.label) return `field[${i}]: label is required`;
+      if (!f.type) return `field[${i}]: type is required`;
+      if (f.type === "list" && !f.itemType) {
+        return `field[${i}] (list): itemType is required`;
+      }
+      if (f.type === "enum") {
+        if (!Array.isArray(f.options) || (f.options as unknown[]).length === 0) {
+          return `field[${i}] (enum): non-empty options is required`;
+        }
+      }
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Full content-type registry implementation.
+ *
+ * Plugins call register() via ctx.contentTypes.register. The host internally
+ * uses get(), list(), and rollbackPlugin().
+ */
+export class ContentTypeRegistryImpl {
+  private descriptors = new Map<string, ContentTypeDescriptor>();
+  private pluginToIds = new Map<string, string[]>();
+
+  /**
+   * Register a descriptor. Optionally associates it with a pluginId for
+   * rollback support.
+   */
+  register(descriptor: ContentTypeDescriptor, pluginId?: string): void {
+    // 1. Validate
+    const err = validateDescriptor(descriptor);
+    if (err) throw new Error(`Invalid content-type descriptor: ${err}`);
+
+    // 2. Duplicate check (CT5, RC2)
+    if (this.descriptors.has(descriptor.id)) {
+      throw new Error(`Duplicate content-type id: ${descriptor.id}`);
+    }
+
+    // 3. Store
+    this.descriptors.set(descriptor.id, descriptor);
+    if (pluginId) {
+      const ids = this.pluginToIds.get(pluginId) ?? [];
+      ids.push(descriptor.id);
+      this.pluginToIds.set(pluginId, ids);
+    }
+  }
+
+  /** Retrieve a descriptor by id. Returns undefined if not found. */
+  get(id: string): ContentTypeDescriptor | undefined {
+    return this.descriptors.get(id);
+  }
+
+  /** List all registered descriptors. */
+  list(): ContentTypeDescriptor[] {
+    return [...this.descriptors.values()];
+  }
+
+  /**
+   * Roll back (remove) all descriptors registered by a given plugin.
+   * Safe to call for unknown pluginIds (no-op).
+   */
+  rollbackPlugin(pluginId: string): void {
+    const ids = this.pluginToIds.get(pluginId);
+    if (ids) {
+      for (const id of ids) this.descriptors.delete(id);
+      this.pluginToIds.delete(pluginId);
+    }
+  }
+}
+
+/**
+ * Build a sorted external ids string for fallback identity computation.
+ * Produces: "key1=val1|key2=val2|..." sorted alphabetically by key.
+ */
+function sortedExternalIdsString(externalIds: Record<string, string>): string {
+  return Object.keys(externalIds)
+    .sort()
+    .map((k) => `${k}=${externalIds[k]}`)
+    .join("|");
+}
+
+/**
+ * Compute a deterministic content-identity string for an item.
+ *
+ * Algorithm:
+ * 1. Look up the descriptor for item.contentTypeId.
+ * 2. If descriptor exists: walk descriptor.identity in order. For each key,
+ *    if item.externalIds[key] is present and non-empty, return
+ *    "${contentTypeId}::${key}=${value}".
+ * 3. If no identity key is present in the item's externalIds (or descriptor
+ *    not found): return "${contentTypeId}::undecidable::${sortedExternalIds}"
+ *    where sortedExternalIds is all externalId pairs sorted by key.
+ */
+export function computeContentIdentity(
+  item: { contentTypeId: string; externalIds: Record<string, string> },
+  registry: ContentTypeRegistryImpl,
+): string {
+  const descriptor = registry.get(item.contentTypeId);
+
+  if (descriptor) {
+    for (const key of descriptor.identity) {
+      const value = item.externalIds[key];
+      if (value && value.length > 0) {
+        return `${item.contentTypeId}::${key}=${value}`;
+      }
+    }
+  }
+
+  // Fallback: undecidable or unknown type
+  return `${item.contentTypeId}::undecidable::${sortedExternalIdsString(item.externalIds)}`;
+}
+
+/**
+ * Compare two content items for identity.
+ *
+ * Algorithm:
+ * 1. If contentTypeId differs → false (ID2).
+ * 2. Look up descriptor. If not found → false.
+ * 3. Walk descriptor.identity in order. For each key, if BOTH items have a
+ *    truthy value, return whether they are equal.
+ * 4. No mutually-present key → false (ID1 — undecidable).
+ */
+export function areSameItem(
+  a: { contentTypeId: string; externalIds: Record<string, string> },
+  b: { contentTypeId: string; externalIds: Record<string, string> },
+  registry: ContentTypeRegistryImpl,
+): boolean {
+  if (a.contentTypeId !== b.contentTypeId) return false; // ID2
+
+  const descriptor = registry.get(a.contentTypeId);
+  if (!descriptor) return false; // Unknown type → conservative
+
+  for (const key of descriptor.identity) {
+    const aVal = a.externalIds[key];
+    const bVal = b.externalIds[key];
+    if (aVal && aVal.length > 0 && bVal && bVal.length > 0) {
+      return aVal === bVal;
+    }
+  }
+
+  return false; // ID1 — no mutually-present key
+}
+
+/** Default naming: "{Title}/{Title}.{ext}" */
+function defaultNamingRule(): NamingRule {
+  return {
+    directory: [[{ type: "field", value: "Title" }]],
+    filename: [[{ type: "field", value: "Title" }]],
+  };
+}
+
+/**
+ * Get the naming rule for a content type, falling back to a safe default.
+ */
+export function getNamingRule(
+  contentTypeId: string,
+  registry: ContentTypeRegistryImpl,
+): NamingRule {
+  const descriptor = registry.get(contentTypeId);
+  return descriptor?.naming ?? defaultNamingRule();
+}

package/src/datastore/db.ts

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: 0BSD
+// SPDX-FileCopyrightText: 2025 Digi <digitalpaws@proton.me>
+
+import Database from "better-sqlite3";
+import { mkdirSync, existsSync } from "node:fs";
+import path from "node:path";
+import type { Logger } from "../types/plugin.js";
+
+function ensureDir(dir: string): void {
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+}
+
+export interface Datastore {
+  readonly db: Database.Database;
+  readonly dbPath: string;
+  close(): void;
+}
+
+export function openDatastore(dataDir: string, logger: Logger): Datastore {
+  ensureDir(dataDir);
+  const dbPath = path.join(dataDir, "starr.db");
+  logger.info("opening datastore", { dbPath });
+
+  const db = new Database(dbPath);
+  db.pragma("journal_mode = WAL");
+  db.pragma("foreign_keys = ON");
+
+  return {
+    db,
+    dbPath,
+    close() {
+      logger.info("closing datastore");
+      db.close();
+    },
+  };
+}

package/src/datastore/encrypt.ts

@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: 0BSD
+// SPDX-FileCopyrightText: 2025 Digi <digitalpaws@proton.me>
+
+import {
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+} from "node:crypto";
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import path from "node:path";
+import type { Logger } from "../types/plugin.js";
+
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+const KEY_LENGTH = 32; // bytes
+
+let _key: Buffer | null = null;
+
+export function loadEncryptionKey(
+  dataDir: string,
+  logger: Logger,
+): Buffer {
+  if (_key) return _key;
+
+  // 1. Env var
+  const envKey = process.env.STARR_ENCRYPTION_KEY;
+  if (envKey) {
+    const buf = Buffer.from(envKey, "base64");
+    if (buf.length !== KEY_LENGTH) {
+      throw new Error(
+        `STARR_ENCRYPTION_KEY must decode to ${KEY_LENGTH} bytes, got ${buf.length}`,
+      );
+    }
+    _key = buf;
+    logger.info("encryption key loaded from STARR_ENCRYPTION_KEY");
+    return _key;
+  }
+
+  // 2. Key file
+  const keyPath = path.join(dataDir, "starr.key");
+  if (existsSync(keyPath)) {
+    const fileContent = readFileSync(keyPath, "utf8").trim();
+    const buf = Buffer.from(fileContent, "base64");
+    if (buf.length !== KEY_LENGTH) {
+      throw new Error(
+        `Key file ${keyPath} must decode to ${KEY_LENGTH} bytes, got ${buf.length}`,
+      );
+    }
+    _key = buf;
+    logger.info("encryption key loaded from file", { keyPath });
+    return _key;
+  }
+
+  // 3. Auto-generate
+  const newKey = randomBytes(KEY_LENGTH);
+  const encoded = newKey.toString("base64");
+  writeFileSync(keyPath, encoded + "\n", { mode: 0o600 });
+  _key = newKey;
+  logger.info(
+    "auto-generated encryption key (no STARR_ENCRYPTION_KEY set)",
+    { keyPath },
+  );
+  return _key;
+}
+
+/**
+ * Reset the cached encryption key. For testing only.
+ */
+export function resetEncryptionKey(): void {
+  _key = null;
+}
+
+export function encrypt(plaintext: string): string {
+  if (!_key) throw new Error("encryption key not loaded");
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv(ALGORITHM, _key, iv, {
+    authTagLength: AUTH_TAG_LENGTH,
+  });
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext, "utf8"),
+    cipher.final(),
+  ]);
+  const authTag = cipher.getAuthTag();
+  // Pack: iv (12) + authTag (16) + ciphertext (variable)
+  const blob = Buffer.concat([iv, authTag, encrypted]);
+  return blob.toString("base64");
+}
+
+export function decrypt(blob: string): string {
+  if (!_key) throw new Error("encryption key not loaded");
+  const buf = Buffer.from(blob, "base64");
+  if (buf.length < IV_LENGTH + AUTH_TAG_LENGTH) {
+    throw new Error("invalid encrypted blob: too short");
+  }
+  const iv = buf.subarray(0, IV_LENGTH);
+  const authTag = buf.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+  const ciphertext = buf.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
+  const decipher = createDecipheriv(ALGORITHM, _key, iv, {
+    authTagLength: AUTH_TAG_LENGTH,
+  });
+  decipher.setAuthTag(authTag);
+  return (
+    decipher.update(ciphertext, undefined, "utf8") +
+    decipher.final("utf8")
+  );
+}

package/src/datastore/migrations.ts

@@ -0,0 +1,367 @@
+// SPDX-License-Identifier: 0BSD
+// SPDX-FileCopyrightText: 2025 Digi <digitalpaws@proton.me>
+
+import type Database from "better-sqlite3";
+import type { Logger } from "../types/plugin.js";
+
+export interface Migration {
+  id: number;
+  name: string;
+  up: string;
+}
+
+const CREATE_MIGRATIONS_TABLE = `
+  CREATE TABLE IF NOT EXISTS _migrations (
+    id         INTEGER PRIMARY KEY,
+    name       TEXT    NOT NULL UNIQUE,
+    applied_at TEXT    NOT NULL DEFAULT (datetime('now'))
+  );
+`;
+
+export function runMigrations(
+  db: Database.Database,
+  migrations: Migration[],
+  logger: Logger,
+): void {
+  db.exec(CREATE_MIGRATIONS_TABLE);
+
+  const applied = new Set(
+    db
+      .prepare("SELECT id FROM _migrations")
+      .all()
+      .map((row: unknown) => (row as { id: number }).id),
+  );
+
+  const pending = migrations
+    .filter((m) => !applied.has(m.id))
+    .sort((a, b) => a.id - b.id);
+
+  if (pending.length === 0) {
+    logger.debug("no pending migrations");
+    return;
+  }
+
+  logger.info("running migrations", { count: pending.length });
+
+  const insert = db.prepare(
+    "INSERT INTO _migrations (id, name) VALUES (@id, @name)",
+  );
+
+  const runOne = db.transaction((migrations: Migration[]) => {
+    for (const m of migrations) {
+      logger.debug("applying migration", { id: m.id, name: m.name });
+      db.exec(m.up);
+      insert.run({ id: m.id, name: m.name });
+    }
+  });
+
+  runOne(pending);
+  logger.info("migrations complete");
+}
+
+// ── Core migrations ──────────────────────────────────────────
+
+export const CORE_MIGRATIONS: Migration[] = [
+  {
+    id: 1,
+    name: "create_plugin_storage",
+    up: `
+      CREATE TABLE IF NOT EXISTS plugin_storage (
+        plugin_id  TEXT NOT NULL,
+        key        TEXT NOT NULL,
+        value      TEXT NOT NULL,
+        updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+        PRIMARY KEY (plugin_id, key)
+      );
+    `,
+  },
+  {
+    id: 2,
+    name: "create_plugin_config",
+    up: `
+      CREATE TABLE IF NOT EXISTS plugin_config (
+        plugin_id  TEXT NOT NULL PRIMARY KEY,
+        schema     TEXT NOT NULL DEFAULT '{}',
+        "values"     TEXT NOT NULL DEFAULT '{}',
+        updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+    `,
+  },
+  {
+    id: 3,
+    name: "create_tracked_requests",
+    up: `
+      CREATE TABLE IF NOT EXISTS tracked_requests (
+        request_id        TEXT NOT NULL PRIMARY KEY,
+        content_type_id   TEXT NOT NULL,
+        content_identity  TEXT NOT NULL,
+        item              TEXT NOT NULL,
+        owner_user_id     TEXT NOT NULL,
+        watchers          TEXT NOT NULL DEFAULT '[]',
+        status            TEXT NOT NULL,
+        status_detail     TEXT,
+        chosen_release_id TEXT,
+        attempts          INTEGER NOT NULL DEFAULT 0,
+        created_at        TEXT NOT NULL DEFAULT (datetime('now')),
+        updated_at        TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+      CREATE INDEX IF NOT EXISTS idx_tracked_requests_identity
+        ON tracked_requests(content_identity);
+    `,
+  },
+  {
+    id: 4,
+    name: "create_trace_log",
+    up: `
+      CREATE TABLE IF NOT EXISTS trace_log (
+        id           INTEGER PRIMARY KEY AUTOINCREMENT,
+        trace_id     TEXT NOT NULL,
+        request_id   TEXT NOT NULL,
+        event_type   TEXT NOT NULL,
+        event_data   TEXT NOT NULL,
+        timestamp    TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_trace_log_request
+        ON trace_log(request_id);
+      CREATE INDEX IF NOT EXISTS idx_trace_log_trace
+        ON trace_log(trace_id, id);
+    `,
+  },
+  {
+    id: 5,
+    name: "create_accounts_and_sessions",
+    up: `
+      CREATE TABLE IF NOT EXISTS admin_accounts (
+        username      TEXT NOT NULL PRIMARY KEY,
+        password_hash TEXT NOT NULL,
+        created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+        updated_at    TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+
+      CREATE TABLE IF NOT EXISTS sessions (
+        session_id TEXT NOT NULL PRIMARY KEY,
+        user_id    TEXT NOT NULL REFERENCES admin_accounts(username) ON DELETE CASCADE,
+        created_at TEXT NOT NULL DEFAULT (datetime('now')),
+        expires_at TEXT NOT NULL
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_sessions_user_id
+        ON sessions(user_id);
+    `,
+  },
+  {
+    id: 6,
+    name: "create_users_and_oidc_providers",
+    up: `
+      -- Users table: unified account for local admin and OIDC users
+      CREATE TABLE IF NOT EXISTS users (
+        id               TEXT NOT NULL PRIMARY KEY,  -- UUID
+        username         TEXT NOT NULL UNIQUE,
+        display_name     TEXT,
+        avatar_url       TEXT,
+        role             TEXT NOT NULL DEFAULT 'user' CHECK(role IN ('admin', 'user')),
+        provider         TEXT NOT NULL DEFAULT 'local' CHECK(provider IN ('local', 'oidc')),
+        oidc_sub         TEXT,  -- OIDC 'sub' claim (unique per provider)
+        oidc_provider_id TEXT REFERENCES oidc_providers(id) ON DELETE SET NULL,
+        created_at       TEXT NOT NULL DEFAULT (datetime('now')),
+        updated_at       TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_users_oidc_sub
+        ON users(oidc_sub, oidc_provider_id);
+
+      -- OIDC provider configuration
+      CREATE TABLE IF NOT EXISTS oidc_providers (
+        id              TEXT NOT NULL PRIMARY KEY,  -- UUID
+        name            TEXT NOT NULL,
+        issuer_url      TEXT NOT NULL,
+        client_id       TEXT NOT NULL,
+        client_secret   TEXT NOT NULL,  -- encrypted at rest
+        scopes          TEXT NOT NULL DEFAULT 'openid profile email',
+        role_attribute  TEXT,  -- JSONPath to a claim, e.g. "$.starr_roles"
+        default_role    TEXT NOT NULL DEFAULT 'user' CHECK(default_role IN ('admin', 'user')),
+        enabled         INTEGER NOT NULL DEFAULT 1,
+        created_at      TEXT NOT NULL DEFAULT (datetime('now')),
+        updated_at      TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+
+      -- Temporary state for in-flight OIDC authorization flows
+      CREATE TABLE IF NOT EXISTS oidc_auth_states (
+        state         TEXT NOT NULL PRIMARY KEY,  -- random CSRF token
+        nonce         TEXT NOT NULL,
+        code_verifier TEXT NOT NULL,
+        provider_id   TEXT NOT NULL REFERENCES oidc_providers(id) ON DELETE CASCADE,
+        redirect_to   TEXT NOT NULL DEFAULT '/browse',
+        created_at    TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_oidc_auth_states_created
+        ON oidc_auth_states(created_at);
+
+      -- Recreate sessions table without FK constraint so OIDC user UUIDs work
+      CREATE TABLE IF NOT EXISTS sessions_new (
+        session_id TEXT NOT NULL PRIMARY KEY,
+        user_id    TEXT NOT NULL,
+        created_at TEXT NOT NULL DEFAULT (datetime('now')),
+        expires_at TEXT NOT NULL
+      );
+      INSERT INTO sessions_new (session_id, user_id, created_at, expires_at)
+        SELECT session_id, user_id, created_at, expires_at FROM sessions;
+      DROP TABLE sessions;
+      ALTER TABLE sessions_new RENAME TO sessions;
+
+      CREATE INDEX IF NOT EXISTS idx_sessions_user_id
+        ON sessions(user_id);
+
+      -- Migrate existing admin to users table
+      INSERT OR IGNORE INTO users (id, username, display_name, role, provider, created_at, updated_at)
+      SELECT
+        'admin',                                              -- id (fixed key for the local admin)
+        username,                                             -- username from admin_accounts
+        username,                                             -- display_name (same as username)
+        'admin',                                              -- role
+        'local',                                              -- provider
+        COALESCE(created_at, datetime('now')),
+        COALESCE(updated_at, datetime('now'))
+      FROM admin_accounts;
+    `,
+  },
+  {
+    id: 7,
+    name: "create_library_tracking",
+    up: `
+      -- Track the on-disk library path for each imported request
+      CREATE TABLE IF NOT EXISTS library_paths (
+        request_id     TEXT NOT NULL PRIMARY KEY REFERENCES tracked_requests(request_id) ON DELETE CASCADE,
+        library_path   TEXT NOT NULL,
+        library_root   TEXT NOT NULL,
+        file_size      INTEGER,
+        checksum       TEXT,
+        imported_at    TEXT NOT NULL DEFAULT (datetime('now')),
+        updated_at     TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+
+      -- Add library_path column to tracked_requests for quick access
+      ALTER TABLE tracked_requests ADD COLUMN library_path TEXT;
+    `,
+  },
+  {
+    id: 8,
+    name: "create_library_cache",
+    up: `
+      -- Cache of imported item metadata for fast Browse loading.
+      -- Populated on import and refreshed on host start.
+      CREATE TABLE IF NOT EXISTS library_cache (
+        request_id       TEXT NOT NULL PRIMARY KEY REFERENCES tracked_requests(request_id) ON DELETE CASCADE,
+        content_type_id  TEXT NOT NULL,
+        content_identity TEXT NOT NULL,
+        title            TEXT NOT NULL,
+        sort_title       TEXT,
+        summary          TEXT,
+        release_date     TEXT,
+        images           TEXT,  -- JSON array of ContentImage
+        external_ids     TEXT NOT NULL,  -- JSON Record<string, string>
+        fields           TEXT,  -- JSON Record<string, unknown>
+        library_path     TEXT NOT NULL,
+        file_size        INTEGER,
+        imported_at      TEXT NOT NULL,
+        updated_at       TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_library_cache_content_type
+        ON library_cache(content_type_id);
+
+      CREATE INDEX IF NOT EXISTS idx_library_cache_identity
+        ON library_cache(content_identity);
+    `,
+  },
+  {
+    id: 9,
+    name: "create_libraries",
+    up: `
+      CREATE TABLE IF NOT EXISTS libraries (
+        id                    TEXT NOT NULL PRIMARY KEY,
+        name                  TEXT NOT NULL UNIQUE,
+        description           TEXT,
+        is_default            INTEGER NOT NULL DEFAULT 0,
+        default_library_root  TEXT NOT NULL DEFAULT '/media/library',
+        roots                 TEXT NOT NULL DEFAULT '{}',
+        link_type             TEXT NOT NULL DEFAULT 'hardlink' CHECK(link_type IN ('move','hardlink','symlink','copy')),
+        import_subtitles      INTEGER NOT NULL DEFAULT 1,
+        subtitle_extensions   TEXT NOT NULL DEFAULT '["srt","ass","ssa","sub","vtt"]',
+        created_at            TEXT NOT NULL DEFAULT (datetime('now')),
+        updated_at            TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+
+      CREATE TABLE IF NOT EXISTS library_content_type_defaults (
+        library_id      TEXT NOT NULL REFERENCES libraries(id) ON DELETE CASCADE,
+        content_type_id TEXT NOT NULL,
+        PRIMARY KEY (content_type_id)
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_library_content_type_defaults_library
+        ON library_content_type_defaults(library_id);
+    `,
+  },
+  {
+    id: 10,
+    name: "add_instance_id_to_plugin_tables",
+    up: `
+      CREATE TABLE IF NOT EXISTS plugin_config_new (
+        plugin_id   TEXT NOT NULL,
+        instance_id TEXT NOT NULL DEFAULT 'default',
+        schema      TEXT NOT NULL DEFAULT '{}',
+        "values"    TEXT NOT NULL DEFAULT '{}',
+        updated_at  TEXT NOT NULL DEFAULT (datetime('now')),
+        PRIMARY KEY (plugin_id, instance_id)
+      );
+
+      INSERT INTO plugin_config_new (plugin_id, instance_id, schema, "values", updated_at)
+      SELECT plugin_id, 'default', schema, "values", updated_at FROM plugin_config;
+
+      DROP TABLE plugin_config;
+      ALTER TABLE plugin_config_new RENAME TO plugin_config;
+
+      CREATE TABLE IF NOT EXISTS plugin_storage_new (
+        plugin_id   TEXT NOT NULL,
+        instance_id TEXT NOT NULL DEFAULT 'default',
+        key         TEXT NOT NULL,
+        value       TEXT NOT NULL,
+        updated_at  TEXT NOT NULL DEFAULT (datetime('now')),
+        PRIMARY KEY (plugin_id, instance_id, key)
+      );
+
+      INSERT INTO plugin_storage_new (plugin_id, instance_id, key, value, updated_at)
+      SELECT plugin_id, 'default', key, value, updated_at FROM plugin_storage;
+
+      DROP TABLE plugin_storage;
+      ALTER TABLE plugin_storage_new RENAME TO plugin_storage;
+    `,
+  },
+  {
+    id: 11,
+    name: "add_library_id_to_tracked_requests",
+    up: `
+      ALTER TABLE tracked_requests ADD COLUMN library_id TEXT REFERENCES libraries(id);
+    `,
+  },
+  {
+    id: 12,
+    name: "migrate_existing_imported_to_downloaded",
+    up: `
+      UPDATE tracked_requests
+      SET status = 'downloaded', updated_at = datetime('now')
+      WHERE status = 'imported';
+    `,
+  },
+  {
+    id: 13,
+    name: "remove_orphaned_core_configs",
+    up: `
+      -- Remove leftover _core.* config rows that were replaced by the
+      -- library service and multi-instance systems (Task 039).
+      DELETE FROM plugin_config WHERE plugin_id IN ('_core.library', '_core.downloads');
+      DELETE FROM plugin_storage WHERE plugin_id IN ('_core.library', '_core.downloads');
+    `,
+  },
+];