@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.4

package/migrations/d1/0009_normalize_cloudflare_plugin_installations.sql

@@ -0,0 +1,137 @@
+-- Cloudflare OAuth is represented by two distinct account-scoped plugin
+-- installations. Preserve the row IDs so historic health evidence remains
+-- attached while normalizing the public plugin contract.
+
+ALTER TABLE agentsam_cloudflare_oauth_state ADD COLUMN return_to TEXT;
+
+-- Local Studio's public PKCE client is the executable AgentSam MCP plugin.
+UPDATE agentsam_plugins
+SET plugin_key = 'agentsam-mcp',
+    provider_key = 'cloudflare',
+    plugin_kind = 'oauth',
+    category = 'developer_platform',
+    display_name = 'AgentSam MCP',
+    short_name = 'AgentSam MCP',
+    description = 'Connect a Cloudflare account to AgentSam through the Local Studio PKCE approval flow.',
+    mention_aliases_json = '["@agentsam-mcp","agentsam mcp"]',
+    endpoint_url = 'https://api.cloudflare.com/client/v4',
+    transport = 'http_rest',
+    auth_type = 'oauth',
+    oauth_connect_url = '/api/connections/cloudflare/start',
+    capabilities_json = '["cloudflare.api.docs","cloudflare.api.search","cloudflare.api.execute"]',
+    tool_lanes_json = '["typed","mcp","api","codemode"]',
+    resource_scope_json = '{"owner":"account","oauth_connection_table":"agentsam_cloudflare_connections"}',
+    config_json = '{"oauth_authority":"cloudflare","oauth_client_id":"c0704bd7a7aab7216b362603e1985499","authorization_endpoint":"https://dash.cloudflare.com/oauth2/auth","token_endpoint":"https://dash.cloudflare.com/oauth2/token","revoke_endpoint":"https://dash.cloudflare.com/oauth2/revoke","userinfo_endpoint":"https://dash.cloudflare.com/oauth2/userinfo","callback_url":"https://agentsam.inneranimalmedia.com/api/connections/cloudflare/callback","token_auth_method":"none_pkce"}',
+    metadata_json = '{"execution_strategy":"runtime_selected","client_name":"AgentSam Local Studio","client_uri":"https://agentsam.inneranimalmedia.com"}',
+    health_strategy = 'oauth_probe',
+    updated_at = unixepoch()
+WHERE plugin_key = 'cloudflare'
+  AND provider_key = 'cloudflare'
+  AND installation_key = 'local-studio-pkce'
+  AND auth_type = 'oauth';
+
+-- Inner Animal Media Platform uses its own confidential Cloudflare client and
+-- host-owned token resolver. It is intentionally distinct from AgentSam MCP.
+UPDATE agentsam_plugins
+SET plugin_key = 'inneranimalmedia-cf-oauth',
+    installation_key = 'default',
+    provider_key = 'cloudflare',
+    plugin_kind = 'oauth',
+    category = 'developer_platform',
+    display_name = 'Inner Animal Media Cloudflare OAuth',
+    short_name = 'IAM Cloudflare',
+    description = 'Inner Animal Media Platform confidential Cloudflare OAuth connection.',
+    mention_aliases_json = '["@inneranimalmedia-cf-oauth"]',
+    endpoint_url = 'https://dash.cloudflare.com/oauth2/auth',
+    transport = 'http_rest',
+    auth_type = 'oauth_via_iam',
+    oauth_connect_url = 'https://inneranimalmedia.com/api/oauth/cloudflare/start',
+    resource_scope_json = '{"owner":"account","token_authority":"inneranimalmedia_platform"}',
+    config_json = '{"oauth_client_id":"0f2f3c826d800118b70863d8d59e12cc","client_name":"Inner Animal Media Platform","client_uri":"https://inneranimalmedia.com","callback_url":"https://inneranimalmedia.com/api/oauth/cloudflare/callback","authorization_endpoint":"https://dash.cloudflare.com/oauth2/auth","token_endpoint":"https://dash.cloudflare.com/oauth2/token","token_auth_method":"client_secret_basic","secret_authority":"inneranimalmedia_platform_vault"}',
+    metadata_json = '{"execution_strategy":"host_owned","client_visibility":"public"}',
+    health_strategy = 'oauth_probe',
+    updated_at = unixepoch()
+WHERE plugin_key = 'cloudflare'
+  AND provider_key = 'cloudflare'
+  AND installation_key = 'iam-oauth'
+  AND auth_type = 'oauth_via_iam';
+
+INSERT INTO agentsam_capabilities (capability_key, domain, verb, description, is_mutating, is_active, created_at, updated_at)
+VALUES
+  ('cloudflare.api.docs', 'cloudflare', 'read', 'Search Cloudflare developer documentation.', 0, 1, unixepoch(), unixepoch()),
+  ('cloudflare.api.search', 'cloudflare', 'search', 'Search Cloudflare OpenAPI operations.', 0, 1, unixepoch(), unixepoch()),
+  ('cloudflare.api.execute', 'cloudflare', 'execute', 'Execute an approved Cloudflare API program.', 1, 1, unixepoch(), unixepoch())
+ON CONFLICT(capability_key) DO UPDATE SET
+  domain=excluded.domain, verb=excluded.verb, description=excluded.description,
+  is_mutating=excluded.is_mutating, is_active=1, updated_at=unixepoch();
+
+INSERT INTO agentsam_tools (
+  id, tool_name, display_name, tool_category, handler_type, description,
+  input_schema, handler_config, intent_tags, risk_level, requires_approval,
+  requires_confirmation, is_active, tool_key, capability_key, handler_key,
+  domain, oauth_visible, dispatch_target, connector_visible, connector_priority,
+  connector_access_class, account_id, plugin_key, plugin_id, created_at, updated_at
+)
+SELECT
+  'ast_' || lower(hex(randomblob(8))),
+  'agentsam_mcp_docs__' || p.id,
+  'Cloudflare docs', 'integrations', 'cf', 'Search Cloudflare developer documentation.',
+  '{"type":"object","properties":{"query":{"type":"string"}},"required":["query"],"additionalProperties":false}',
+  '{"server_url":"https://mcp.cloudflare.com/mcp","remote_tool":"docs"}',
+  '["cloudflare","docs","search"]', 'low', 0, 0, 1,
+  'agentsam-mcp.docs', 'cloudflare.api.docs', 'agentsam-mcp.docs',
+  'cloudflare', 1, 'mcp', 1, 50, 'read', p.account_id, p.plugin_key, p.id, unixepoch(), unixepoch()
+FROM agentsam_plugins p
+WHERE p.plugin_key = 'agentsam-mcp' AND p.installation_key = 'local-studio-pkce'
+  AND NOT EXISTS (SELECT 1 FROM agentsam_tools t WHERE t.plugin_id = p.id AND t.tool_key = 'agentsam-mcp.docs');
+
+INSERT INTO agentsam_tools (
+  id, tool_name, display_name, tool_category, handler_type, description,
+  input_schema, handler_config, intent_tags, risk_level, requires_approval,
+  requires_confirmation, is_active, tool_key, capability_key, handler_key,
+  domain, oauth_visible, dispatch_target, connector_visible, connector_priority,
+  connector_access_class, account_id, plugin_key, plugin_id, created_at, updated_at
+)
+SELECT
+  'ast_' || lower(hex(randomblob(8))),
+  'agentsam_mcp_search__' || p.id,
+  'Search Cloudflare API', 'integrations', 'cf', 'Search Cloudflare OpenAPI operations before executing code.',
+  '{"type":"object","properties":{"query":{"type":"string"}},"required":["query"],"additionalProperties":false}',
+  '{"server_url":"https://mcp.cloudflare.com/mcp","remote_tool":"search","network":"none"}',
+  '["cloudflare","openapi","search"]', 'low', 0, 0, 1,
+  'agentsam-mcp.search', 'cloudflare.api.search', 'agentsam-mcp.search',
+  'cloudflare', 1, 'plugin', 1, 50, 'read', p.account_id, p.plugin_key, p.id, unixepoch(), unixepoch()
+FROM agentsam_plugins p
+WHERE p.plugin_key = 'agentsam-mcp' AND p.installation_key = 'local-studio-pkce'
+  AND NOT EXISTS (SELECT 1 FROM agentsam_tools t WHERE t.plugin_id = p.id AND t.tool_key = 'agentsam-mcp.search');
+
+INSERT INTO agentsam_tools (
+  id, tool_name, display_name, tool_category, handler_type, description,
+  input_schema, handler_config, intent_tags, risk_level, requires_approval,
+  requires_confirmation, is_active, tool_key, capability_key, handler_key,
+  domain, oauth_visible, dispatch_target, connector_visible, connector_priority,
+  connector_access_class, account_id, plugin_key, plugin_id, created_at, updated_at
+)
+SELECT
+  'ast_' || lower(hex(randomblob(8))),
+  'agentsam_mcp_execute__' || p.id,
+  'Execute Cloudflare API', 'integrations', 'cf', 'Run an approved AgentSam Cloudflare API program.',
+  '{"type":"object","properties":{"code":{"type":"string"},"account_id":{"type":"string"}},"required":["code"],"additionalProperties":false}',
+  '{"server_url":"https://mcp.cloudflare.com/mcp","remote_tool":"execute","network":"cloudflare_api_only"}',
+  '["cloudflare","api","execute"]', 'high', 1, 1, 1,
+  'agentsam-mcp.execute', 'cloudflare.api.execute', 'agentsam-mcp.execute',
+  'cloudflare', 1, 'codemode', 1, 50, 'write', p.account_id, p.plugin_key, p.id, unixepoch(), unixepoch()
+FROM agentsam_plugins p
+WHERE p.plugin_key = 'agentsam-mcp' AND p.installation_key = 'local-studio-pkce'
+  AND NOT EXISTS (SELECT 1 FROM agentsam_tools t WHERE t.plugin_id = p.id AND t.tool_key = 'agentsam-mcp.execute');
+
+INSERT INTO agentsam_tool_capabilities (tool_id, capability_key, requirement_type, is_primary, operations_json, created_at)
+SELECT t.id, t.capability_key, 'required', 1, json_array(t.handler_key), unixepoch()
+FROM agentsam_tools t
+JOIN agentsam_plugins p ON p.id = t.plugin_id
+WHERE p.plugin_key = 'agentsam-mcp' AND p.installation_key = 'local-studio-pkce'
+  AND t.tool_key IN ('agentsam-mcp.docs', 'agentsam-mcp.search', 'agentsam-mcp.execute')
+  AND NOT EXISTS (
+    SELECT 1 FROM agentsam_tool_capabilities c
+    WHERE c.tool_id = t.id AND c.capability_key = t.capability_key
+  );

package/migrations/d1/0010_portable_tickets_memory.sql

@@ -0,0 +1,140 @@
+-- 0010_portable_tickets_memory.sql
+-- Portable GOAP / ticket + memory spine for new AgentSam projects (local SQLite or D1).
+-- Account-owned tickets — NOT Inner Animal Media's shared platform DB.
+-- Every write path MUST populate account_id and repository_id (NULL = broken implementation).
+
+CREATE TABLE IF NOT EXISTS agentsam_tickets (
+  id TEXT PRIMARY KEY,
+  title TEXT NOT NULL,
+  status TEXT NOT NULL
+    CHECK (status IN ('backlog', 'active', 'blocked', 'in_review', 'shipped', 'abandoned')),
+  status_reason TEXT,
+  project TEXT,
+  subsystem TEXT,
+  tags TEXT,
+  priority TEXT,
+  doc_path TEXT,
+  blocks TEXT,
+  blocked_by TEXT,
+  supersedes TEXT,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  closed_at INTEGER,
+  dedup_key TEXT,
+  consecutive_pass_count INTEGER,
+  last_gate_run_id INTEGER,
+  last_gate_ok_at INTEGER,
+  required_pass_count INTEGER,
+  description TEXT,
+  client_id TEXT,
+  due_at INTEGER,
+  surface TEXT NOT NULL DEFAULT 'platform',
+  start_at INTEGER,
+  estimated_minutes INTEGER,
+  percent_complete INTEGER NOT NULL DEFAULT 0,
+  owner_kind TEXT NOT NULL DEFAULT 'unassigned',
+  owner_ref TEXT,
+  parent_ticket_id TEXT,
+  agent_run_id TEXT,
+  worktree TEXT,
+  linked_commit TEXT,
+  source TEXT NOT NULL DEFAULT 'manual',
+  account_id TEXT NOT NULL,
+  repository_id TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_agentsam_tickets_account_repository
+  ON agentsam_tickets(account_id, repository_id, updated_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_agentsam_tickets_status
+  ON agentsam_tickets(account_id, status, updated_at DESC);
+
+CREATE TABLE IF NOT EXISTS agentsam_ticket_events (
+  id TEXT PRIMARY KEY,
+  ticket_id TEXT NOT NULL REFERENCES agentsam_tickets(id) ON DELETE CASCADE,
+  event_type TEXT NOT NULL,
+  from_status TEXT,
+  to_status TEXT,
+  detail TEXT,
+  commit_sha TEXT,
+  created_at INTEGER NOT NULL,
+  actor_type TEXT,
+  actor_id TEXT,
+  media_asset_id TEXT,
+  account_id TEXT NOT NULL,
+  repository_id TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_agentsam_ticket_events_ticket
+  ON agentsam_ticket_events(ticket_id, created_at);
+
+CREATE TABLE IF NOT EXISTS agentsam_memory (
+  id TEXT PRIMARY KEY NOT NULL,
+  account_id TEXT NOT NULL,
+  repository_id TEXT NOT NULL,
+  project_id TEXT,
+  memory_key TEXT NOT NULL,
+  memory_type TEXT NOT NULL
+    CHECK (memory_type IN (
+      'fact', 'preference', 'decision', 'policy', 'state', 'procedure'
+    )),
+  title TEXT,
+  content TEXT NOT NULL,
+  summary TEXT,
+  importance INTEGER NOT NULL DEFAULT 5
+    CHECK (importance BETWEEN 1 AND 10),
+  tags TEXT NOT NULL DEFAULT '[]',
+  status TEXT NOT NULL DEFAULT 'active'
+    CHECK (status IN ('active', 'archived', 'deleted')),
+  is_pinned INTEGER NOT NULL DEFAULT 0,
+  content_hash TEXT NOT NULL,
+  source TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  revision INTEGER NOT NULL DEFAULT 1,
+  semantic_hash TEXT,
+  sensitivity TEXT NOT NULL DEFAULT 'normal'
+    CHECK (sensitivity IN ('normal','internal','confidential','secret')),
+  source_client TEXT,
+  source_ref TEXT,
+  supersedes_id TEXT,
+  expires_at INTEGER,
+  scope_type TEXT,
+  scope_id TEXT,
+  idempotency_key TEXT,
+  metadata_json TEXT NOT NULL DEFAULT '{}'
+    CHECK (json_valid(metadata_json)),
+  UNIQUE(account_id, memory_key)
+);
+
+CREATE INDEX IF NOT EXISTS idx_agentsam_memory_account_repo
+  ON agentsam_memory(account_id, repository_id, updated_at DESC);
+
+CREATE TABLE IF NOT EXISTS agentsam_memory_outbox (
+  id TEXT PRIMARY KEY NOT NULL,
+  memory_id TEXT NOT NULL,
+  account_id TEXT NOT NULL,
+  repository_id TEXT NOT NULL,
+  revision INTEGER NOT NULL,
+  content_hash TEXT NOT NULL,
+  semantic_hash TEXT NOT NULL,
+  operation TEXT NOT NULL DEFAULT 'upsert'
+    CHECK (operation IN ('upsert','deactivate','delete')),
+  projection_target TEXT NOT NULL DEFAULT 'node_api_pgvector'
+    CHECK (projection_target = 'node_api_pgvector'),
+  payload_json TEXT NOT NULL DEFAULT '{}'
+    CHECK (json_valid(payload_json)),
+  status TEXT NOT NULL DEFAULT 'pending'
+    CHECK (status IN ('pending','processing','completed','failed')),
+  attempts INTEGER NOT NULL DEFAULT 0,
+  next_attempt_at INTEGER,
+  locked_at INTEGER,
+  last_error TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  UNIQUE(memory_id, revision, operation)
+);
+
+CREATE INDEX IF NOT EXISTS idx_agentsam_memory_outbox_pending
+  ON agentsam_memory_outbox(status, next_attempt_at)
+  WHERE status IN ('pending','failed');

package/migrations/d1/0011_agentsam_skill_v2.sql

@@ -0,0 +1,185 @@
+-- 0011_agentsam_skill_v2.sql
+-- Skill redesign: identity/config · metrics · retrieval (three tables).
+-- Fresh installs: apply this file directly.
+-- Production hosts with legacy agentsam_skill: use 0011b_agentsam_skill_v2_cutover.sql
+--
+-- Ownership: account_id only (no tenant_id / user_id / person_uuid / workspace_id / scope).
+-- No FK to agentsam_account — that table is not present on IAM D1; account_id aligns with
+-- accounts.id (au_*) when the row is account-owned.
+--
+-- Published npm lane: partial unique on slash_trigger WHERE is_published = 1
+-- (two accounts cannot both publish the same /trigger).
+
+CREATE TABLE IF NOT EXISTS agentsam_skill (
+  id                 TEXT PRIMARY KEY,
+  account_id         TEXT NOT NULL,
+
+  name               TEXT NOT NULL,
+  slash_trigger      TEXT NOT NULL
+                       CHECK (slash_trigger GLOB '/[a-z0-9][a-z0-9-]*'),
+
+  npm_package_name   TEXT,
+  npm_version        TEXT,
+  is_published       INTEGER NOT NULL DEFAULT 0 CHECK (is_published IN (0,1)),
+
+  description        TEXT NOT NULL DEFAULT '',
+  content_markdown   TEXT NOT NULL DEFAULT '',
+  file_path          TEXT NOT NULL DEFAULT '',
+  content_checksum   TEXT NOT NULL DEFAULT '',
+
+  globs              TEXT NOT NULL DEFAULT '[]',
+  always_apply       INTEGER NOT NULL DEFAULT 0 CHECK (always_apply IN (0,1)),
+  task_types_json    TEXT NOT NULL DEFAULT '[]',
+  route_keys_json    TEXT NOT NULL DEFAULT '[]',
+
+  access_mode        TEXT NOT NULL DEFAULT 'read_write'
+                       CHECK (access_mode IN ('read_only','read_write')),
+
+  icon               TEXT NOT NULL DEFAULT '',
+  tags_json          TEXT NOT NULL DEFAULT '[]',
+  metadata_json      TEXT NOT NULL DEFAULT '{}',
+
+  invocation_count   INTEGER NOT NULL DEFAULT 0,
+  last_invoked_at    TEXT,
+
+  version            INTEGER NOT NULL DEFAULT 1,
+  is_active          INTEGER NOT NULL DEFAULT 1 CHECK (is_active IN (0,1)),
+  sort_order         INTEGER NOT NULL DEFAULT 0,
+
+  created_at         TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at         TEXT NOT NULL DEFAULT (datetime('now')),
+
+  UNIQUE (account_id, slash_trigger),
+  UNIQUE (npm_package_name, npm_version)
+);
+
+CREATE INDEX IF NOT EXISTS idx_skill_account ON agentsam_skill(account_id);
+CREATE INDEX IF NOT EXISTS idx_skill_active ON agentsam_skill(is_active) WHERE is_active = 1;
+CREATE INDEX IF NOT EXISTS idx_skill_published ON agentsam_skill(is_published) WHERE is_published = 1;
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_skill_published_slash
+  ON agentsam_skill(slash_trigger) WHERE is_published = 1;
+
+CREATE TABLE IF NOT EXISTS agentsam_skill_metrics (
+  skill_id           TEXT PRIMARY KEY REFERENCES agentsam_skill(id) ON DELETE CASCADE,
+  byte_size          INTEGER NOT NULL DEFAULT 0,
+  char_count         INTEGER NOT NULL DEFAULT 0,
+  line_count         INTEGER NOT NULL DEFAULT 0,
+  estimated_tokens   INTEGER NOT NULL DEFAULT 0,
+  estimation_method  TEXT NOT NULL DEFAULT 'chars_div_4'
+                       CHECK (estimation_method IN ('chars_div_4','tiktoken_cl100k','tiktoken_o200k','provider_reported')),
+  computed_at        TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS agentsam_skill_retrieval (
+  id                 TEXT PRIMARY KEY,
+  skill_id           TEXT NOT NULL REFERENCES agentsam_skill(id) ON DELETE CASCADE,
+
+  provider           TEXT NOT NULL CHECK (provider IN (
+                        'local_fs',
+                        'cloudflare_d1',
+                        'cloudflare_hyperdrive',
+                        'cloudflare_r2',
+                        'cloudflare_vectorize',
+                        'supabase_postgres',
+                        'supabase_vectorize'
+                      )),
+  strategy           TEXT NOT NULL CHECK (strategy IN (
+                        'relational',
+                        'object_store',
+                        'vector_index',
+                        'none'
+                      )),
+
+  is_primary         INTEGER NOT NULL DEFAULT 0 CHECK (is_primary IN (0,1)),
+
+  index_name         TEXT,
+  namespace          TEXT,
+  connection_ref     TEXT,
+  embedding_model    TEXT,
+  dimensions         INTEGER,
+
+  config_json        TEXT NOT NULL DEFAULT '{}',
+  last_synced_at     TEXT,
+  created_at         TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at         TEXT NOT NULL DEFAULT (datetime('now')),
+
+  UNIQUE (skill_id, provider, strategy)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_skill_retrieval_primary
+  ON agentsam_skill_retrieval(skill_id) WHERE is_primary = 1;
+
+CREATE INDEX IF NOT EXISTS idx_skill_retrieval_skill ON agentsam_skill_retrieval(skill_id);
+
+CREATE TABLE IF NOT EXISTS agentsam_skill_revision (
+  id               TEXT PRIMARY KEY DEFAULT ('skillrev_' || lower(hex(randomblob(8)))),
+  skill_id         TEXT NOT NULL REFERENCES agentsam_skill(id) ON DELETE CASCADE,
+  content_markdown TEXT NOT NULL,
+  version          INTEGER NOT NULL,
+  changed_by       TEXT NOT NULL DEFAULT 'system',
+  change_note      TEXT,
+  created_at       TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_skill_revision_skill_id ON agentsam_skill_revision(skill_id);
+CREATE INDEX IF NOT EXISTS idx_skill_revision_version ON agentsam_skill_revision(skill_id, version);
+
+CREATE TABLE IF NOT EXISTS agentsam_skill_invocation (
+  id              TEXT PRIMARY KEY DEFAULT ('skillinv_' || lower(hex(randomblob(8)))),
+  skill_id        TEXT NOT NULL REFERENCES agentsam_skill(id) ON DELETE CASCADE,
+  account_id      TEXT NOT NULL,
+  repository_id   TEXT,
+  conversation_id TEXT,
+  trigger_method  TEXT NOT NULL DEFAULT 'slash'
+    CHECK (trigger_method IN ('slash','at','auto','api')),
+  input_summary   TEXT,
+  success         INTEGER NOT NULL DEFAULT 1,
+  error_message   TEXT,
+  duration_ms     INTEGER,
+  model_used      TEXT,
+  tokens_in       INTEGER DEFAULT 0,
+  tokens_out      INTEGER DEFAULT 0,
+  cost_usd        REAL DEFAULT 0.0,
+  invoked_at      TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_skill_invoc_skill_id ON agentsam_skill_invocation(skill_id);
+CREATE INDEX IF NOT EXISTS idx_skill_invoc_account ON agentsam_skill_invocation(account_id);
+CREATE INDEX IF NOT EXISTS idx_skill_invoc_invoked ON agentsam_skill_invocation(invoked_at);
+
+-- updated_at bump (D1/SQLite)
+-- Avoid recursion: only bump when the statement did not already set updated_at.
+CREATE TRIGGER IF NOT EXISTS trg_skill_updated_at
+AFTER UPDATE ON agentsam_skill
+WHEN NEW.updated_at IS OLD.updated_at
+BEGIN
+  UPDATE agentsam_skill SET updated_at = datetime('now') WHERE id = NEW.id;
+END;
+
+-- Auto metrics on insert/content change (chars/4 heuristic)
+CREATE TRIGGER IF NOT EXISTS trg_skill_metrics_insert
+AFTER INSERT ON agentsam_skill
+BEGIN
+  INSERT INTO agentsam_skill_metrics (skill_id, byte_size, char_count, line_count, estimated_tokens)
+  VALUES (
+    NEW.id,
+    LENGTH(CAST(NEW.content_markdown AS BLOB)),
+    LENGTH(NEW.content_markdown),
+    LENGTH(NEW.content_markdown) - LENGTH(REPLACE(NEW.content_markdown, char(10), '')) + 1,
+    CAST(LENGTH(NEW.content_markdown) / 4.0 AS INTEGER)
+  );
+END;
+
+CREATE TRIGGER IF NOT EXISTS trg_skill_metrics_update
+AFTER UPDATE OF content_markdown ON agentsam_skill
+BEGIN
+  UPDATE agentsam_skill_metrics SET
+    byte_size         = LENGTH(CAST(NEW.content_markdown AS BLOB)),
+    char_count        = LENGTH(NEW.content_markdown),
+    line_count        = LENGTH(NEW.content_markdown) - LENGTH(REPLACE(NEW.content_markdown, char(10), '')) + 1,
+    estimated_tokens  = CAST(LENGTH(NEW.content_markdown) / 4.0 AS INTEGER),
+    estimation_method = 'chars_div_4',
+    computed_at       = datetime('now')
+  WHERE skill_id = NEW.id;
+END;

package/migrations/d1/0011b_agentsam_skill_v2_cutover.sql

@@ -0,0 +1,22 @@
+-- 0011b_agentsam_skill_v2_cutover.sql
+-- ORCHESTRATION NOTES (do not run this whole file via wrangler --file on large DBs —
+-- D1 import may D1_RESET_DO). Apply in steps:
+--
+--   1) RENAME (one statement each):
+--        ALTER TABLE agentsam_skill RENAME TO agentsam_skill_legacy;
+--        ALTER TABLE agentsam_skill_revision RENAME TO agentsam_skill_revision_legacy;
+--        ALTER TABLE agentsam_skill_invocation RENAME TO agentsam_skill_invocation_legacy;
+--   2) DDL:     --file migrations/d1/0011_agentsam_skill_v2.sql
+--   3) Backfill skills: --file migrations/d1/0011c_agentsam_skill_v2_backfill.sql
+--   4) Retrieval+revisions: --file migrations/d1/0011d_agentsam_skill_v2_retrieval_revisions.sql
+--   5) Verify counts: skill == legacy == metrics == retrieval; revisions match legacy.
+--   6) Keep *_legacy until verified. Drop only after a bake period.
+--
+-- Applied remotely on inneranimalmedia-business 2026-09-25 (88 skills).
+-- Notes:
+--   - No FK to agentsam_account (table absent); account_id aligns with accounts.au_* when present.
+--   - Partial unique idx_skill_published_slash included (published slash triggers globally unique).
+--   - Empty slash_trigger → /skill-{id-slug}; dual vectorize → /vectorize-lanes-dual.
+--   - Dropped columns preserved under metadata_json.legacy.
+
+SELECT 'see header comments — run cutover in steps' AS note;

package/migrations/d1/0011c_agentsam_skill_v2_backfill.sql

@@ -0,0 +1,76 @@
+-- Backfill agentsam_skill v2 from agentsam_skill_legacy (run after 0011 DDL + rename).
+-- Empty slash_trigger → derive from skill id (avoids /unnamed collisions).
+
+INSERT INTO agentsam_skill (
+  id, account_id, name, slash_trigger,
+  description, content_markdown, file_path, content_checksum,
+  globs, always_apply, task_types_json, route_keys_json,
+  access_mode, icon, tags_json, metadata_json,
+  invocation_count, last_invoked_at, version, is_active, sort_order,
+  created_at, updated_at
+)
+SELECT
+  l.id,
+  CASE
+    WHEN l.user_id GLOB 'au_*' THEN l.user_id
+    WHEN l.user_id = 'sam_primeaux' THEN 'au_8a5b76b737a9f14c'
+    WHEN l.user_id IN ('platform', 'system') THEN l.user_id
+    WHEN l.person_uuid IS NOT NULL AND TRIM(l.person_uuid) != '' THEN 'person:' || l.person_uuid
+    WHEN l.tenant_id IS NOT NULL AND TRIM(l.tenant_id) != '' THEN 'tenant:' || l.tenant_id
+    ELSE 'account_orphan'
+  END,
+  COALESCE(NULLIF(TRIM(l.name), ''), l.id),
+  CASE
+    WHEN l.id = 'skill_agentsam_dual_vectorize_lanes' THEN '/vectorize-lanes-dual'
+    WHEN l.slash_trigger IS NULL OR TRIM(l.slash_trigger) = ''
+      THEN '/skill-' || lower(substr(replace(replace(l.id, 'skill_', ''), '_', '-'), 1, 40))
+    WHEN lower(CASE
+           WHEN l.slash_trigger GLOB '/*' THEN l.slash_trigger
+           ELSE '/' || l.slash_trigger
+         END) GLOB '/[a-z0-9][a-z0-9-]*'
+      THEN lower(CASE
+           WHEN l.slash_trigger GLOB '/*' THEN l.slash_trigger
+           ELSE '/' || l.slash_trigger
+         END)
+    ELSE '/skill-' || lower(substr(replace(replace(l.id, 'skill_', ''), '_', '-'), 1, 40))
+  END,
+  COALESCE(l.description, ''),
+  COALESCE(l.content_markdown, ''),
+  COALESCE(l.file_path, ''),
+  '',
+  CASE
+    WHEN l.globs IS NULL OR TRIM(l.globs) = '' THEN '[]'
+    WHEN l.globs GLOB '[*' THEN l.globs
+    ELSE json_array(l.globs)
+  END,
+  COALESCE(l.always_apply, 0),
+  COALESCE(NULLIF(TRIM(l.task_types_json), ''), '[]'),
+  COALESCE(NULLIF(TRIM(l.route_keys_json), ''), '[]'),
+  CASE
+    WHEN l.access_mode IN ('read_only', 'read_write') THEN l.access_mode
+    ELSE 'read_write'
+  END,
+  COALESCE(l.icon, ''),
+  COALESCE(NULLIF(TRIM(l.tags_json), ''), '[]'),
+  json_object(
+    'legacy', json_object(
+      'tenant_id', l.tenant_id,
+      'user_id', l.user_id,
+      'person_uuid', l.person_uuid,
+      'workspace_id', l.workspace_id,
+      'scope', l.scope,
+      'default_model_key', l.default_model_key,
+      'model_constraints_json', l.model_constraints_json,
+      'token_estimate', l.token_estimate,
+      'retrieval_strategy', l.retrieval_strategy,
+      'slash_trigger_raw', l.slash_trigger
+    )
+  ),
+  COALESCE(l.invocation_count, 0),
+  l.last_invoked_at,
+  COALESCE(l.version, 1),
+  COALESCE(l.is_active, 1),
+  COALESCE(l.sort_order, 0),
+  COALESCE(l.created_at, datetime('now')),
+  COALESCE(l.updated_at, datetime('now'))
+FROM agentsam_skill_legacy l;

package/migrations/d1/0011d_agentsam_skill_v2_retrieval_revisions.sql

@@ -0,0 +1,50 @@
+-- Retrieval + revision backfill after skill rows exist.
+
+INSERT INTO agentsam_skill_retrieval (
+  id, skill_id, provider, strategy, is_primary,
+  index_name, connection_ref, config_json
+)
+SELECT
+  'skillret_' || lower(hex(randomblob(8))),
+  s.id,
+  CASE
+    WHEN lower(COALESCE(json_extract(s.metadata_json, '$.legacy.retrieval_strategy'), '')) IN ('r2', 'object_store')
+      THEN 'cloudflare_r2'
+    WHEN lower(COALESCE(json_extract(s.metadata_json, '$.legacy.retrieval_strategy'), '')) IN ('vectorize', 'vector')
+      THEN 'cloudflare_vectorize'
+    ELSE 'cloudflare_d1'
+  END,
+  CASE
+    WHEN lower(COALESCE(json_extract(s.metadata_json, '$.legacy.retrieval_strategy'), '')) IN ('r2', 'object_store')
+      THEN 'object_store'
+    WHEN lower(COALESCE(json_extract(s.metadata_json, '$.legacy.retrieval_strategy'), '')) IN ('vectorize', 'vector')
+      THEN 'vector_index'
+    ELSE 'relational'
+  END,
+  1,
+  NULLIF(TRIM(s.file_path), ''),
+  CASE
+    WHEN lower(COALESCE(json_extract(s.metadata_json, '$.legacy.retrieval_strategy'), '')) IN ('r2', 'object_store')
+      THEN 'WEBSITE_ASSETS'
+    ELSE 'DB'
+  END,
+  '{}'
+FROM agentsam_skill s
+WHERE NOT EXISTS (
+  SELECT 1 FROM agentsam_skill_retrieval r WHERE r.skill_id = s.id
+);
+
+INSERT INTO agentsam_skill_revision (
+  id, skill_id, content_markdown, version, changed_by, change_note, created_at
+)
+SELECT
+  r.id,
+  r.skill_id,
+  r.content_markdown,
+  r.version,
+  COALESCE(NULLIF(TRIM(r.changed_by), ''), 'system'),
+  r.change_note,
+  COALESCE(r.created_at, datetime('now'))
+FROM agentsam_skill_revision_legacy r
+WHERE EXISTS (SELECT 1 FROM agentsam_skill s WHERE s.id = r.skill_id)
+  AND NOT EXISTS (SELECT 1 FROM agentsam_skill_revision x WHERE x.id = r.id);