@prismshadow/penguin-server 0.2.11 → 0.2.15

package/dist/chunk-NVWAYYRX.js

@@ -0,0 +1,981 @@
+// src/db/database.ts
+import { mkdirSync } from "fs";
+import path from "path";
+
+// src/db/migrations.ts
+var MIGRATIONS = [
+  {
+    version: 1,
+    name: "messaging-bindings",
+    // Purely additive: one new table plus three indexes, no column of any existing table
+    // touched. A platform that rolls back to a predecessor without messaging simply never
+    // queries them.
+    swapSafe: true,
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS messaging_bindings (
+          session_id       TEXT NOT NULL,
+          channel          TEXT NOT NULL,
+          account_id       TEXT NOT NULL,
+          config_json      TEXT NOT NULL,
+          enabled          INTEGER NOT NULL DEFAULT 0,
+          line_per_message INTEGER NOT NULL DEFAULT 0,
+          last_chat_id     TEXT,
+          last_chat_is_direct INTEGER NOT NULL DEFAULT 1,
+          last_inbound_message_id TEXT,
+          created_at       TEXT NOT NULL,
+          updated_at       TEXT NOT NULL,
+          PRIMARY KEY (session_id, channel)
+        );
+        CREATE INDEX IF NOT EXISTS idx_messaging_by_account ON messaging_bindings(channel, account_id);
+        CREATE INDEX IF NOT EXISTS idx_auth_sessions_expires ON auth_sessions(expires_at);
+        CREATE INDEX IF NOT EXISTS idx_auth_sessions_user ON auth_sessions(user_id);
+      `);
+    },
+    // LOSES every messaging binding: the channel credentials, the enabled flag and the
+    // last-chat memory all live in the table this drops. The auth_sessions indexes are
+    // derived and cost nothing to lose.
+    down(db) {
+      db.exec(`
+        DROP INDEX IF EXISTS idx_auth_sessions_user;
+        DROP INDEX IF EXISTS idx_auth_sessions_expires;
+        DROP INDEX IF EXISTS idx_messaging_by_account;
+        DROP TABLE IF EXISTS messaging_bindings;
+      `);
+    }
+  },
+  {
+    version: 2,
+    name: "messaging-delivery-flags",
+    // Two columns with defaults on an existing table: a rollback to a predecessor that
+    // does not know them leaves them at their defaults and reads nothing.
+    swapSafe: true,
+    up(db) {
+      ensureColumn(db, "messaging_bindings", "final_reply_only", "INTEGER NOT NULL DEFAULT 0");
+      ensureColumn(db, "messaging_bindings", "render_markdown", "INTEGER NOT NULL DEFAULT 1");
+    },
+    // LOSES both delivery preferences on every binding; the bindings themselves survive.
+    // Dropped in reverse order for symmetry with `up`. Neither column is indexed, which is
+    // what lets SQLite drop them at all.
+    down(db) {
+      db.exec("ALTER TABLE messaging_bindings DROP COLUMN render_markdown");
+      db.exec("ALTER TABLE messaging_bindings DROP COLUMN final_reply_only");
+    }
+  },
+  {
+    version: 3,
+    name: "drop-goal-state",
+    // Narrowing: drops a table. A pushed platform rolled back to 0.2.9 mid-process would
+    // prepare its goal statements against a table that is gone (its declarative track only
+    // runs at the runtime's own open, never at a platform boot), so this is the first
+    // restart-only migration: refused on the swap path, applied by the runtime's open.
+    swapSafe: false,
+    up(db) {
+      db.exec(`
+        DROP INDEX IF EXISTS idx_goal_session;
+        DROP TABLE IF EXISTS goal_state;
+      `);
+    },
+    // Recreates the table exactly as 0.2.9 declared it — EMPTY. LOSES every goal run ever
+    // recorded (objective, status, budget, used, rounds per run): the rows only ever fed the
+    // banner of a finished goal, and a build with this migration reads the goal file instead.
+    down(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS goal_state (
+          id          INTEGER PRIMARY KEY AUTOINCREMENT,
+          session_id  TEXT NOT NULL,
+          project_id  TEXT NOT NULL,
+          agent_id    TEXT NOT NULL,
+          objective   TEXT NOT NULL,
+          status      TEXT NOT NULL,
+          budget      INTEGER NOT NULL,
+          used        INTEGER NOT NULL DEFAULT 0,
+          rounds      INTEGER NOT NULL DEFAULT 0,
+          created_at  TEXT NOT NULL,
+          updated_at  TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_goal_session ON goal_state(session_id);
+      `);
+    }
+  },
+  {
+    version: 4,
+    name: "machines",
+    // Three new tables, nothing existing touched: a platform rolled back to one without
+    // machines never queries them. Swap-safe on its own; a database still behind
+    // drop-goal-state is refused whole by that one first, which is the rule.
+    swapSafe: true,
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS machine (
+          singleton  INTEGER PRIMARY KEY CHECK (singleton = 1),
+          machine_id TEXT NOT NULL
+        );
+        CREATE TABLE IF NOT EXISTS machines (
+          address      TEXT PRIMARY KEY,
+          machine_id   TEXT,
+          version      TEXT,
+          installed_at TEXT,
+          session_pid  INTEGER,
+          remote_port  INTEGER,
+          platform     TEXT
+        );
+        CREATE TABLE IF NOT EXISTS machine_project (
+          project_id TEXT PRIMARY KEY REFERENCES projects(project_id) ON DELETE CASCADE,
+          addresses  TEXT NOT NULL
+        );
+      `);
+    },
+    // LOSES this server's own machine id (every stored reference to it on other machines
+    // then points at nothing), what was installed where, the sessions held, and which
+    // machines each Project used.
+    down(db) {
+      db.exec(`
+        DROP TABLE IF EXISTS machine_project;
+        DROP TABLE IF EXISTS machines;
+        DROP TABLE IF EXISTS machine;
+      `);
+    }
+  },
+  {
+    version: 5,
+    name: "user-profile",
+    // Two nullable columns on `users`, no default and nothing existing rewritten: a platform
+    // rolled back to a predecessor that does not know them never selects or writes them, and
+    // every existing account simply reads NULL — no profile yet.
+    swapSafe: true,
+    up(db) {
+      ensureColumn(db, "users", "display_name", "TEXT");
+      ensureColumn(db, "users", "avatar", "TEXT");
+    },
+    // LOSES every stored nickname and avatar: both live entirely in the two columns this
+    // drops, and nothing else on disk holds a copy. Dropped in reverse order for symmetry
+    // with `up`; neither column is indexed, which is what lets SQLite drop them at all.
+    down(db) {
+      const cols = db.prepare("PRAGMA table_info(users)").all();
+      const has = (name) => cols.some((c) => c.name === name);
+      if (has("avatar")) db.exec("ALTER TABLE users DROP COLUMN avatar");
+      if (has("display_name")) db.exec("ALTER TABLE users DROP COLUMN display_name");
+    }
+  },
+  {
+    version: 6,
+    name: "company-mode-org-caches",
+    // Additive: seven new tables for company mode (organizations of Agents), no change to any
+    // existing table. Every row is either rebuildable from the organization's files (desks.toml,
+    // the tickets' Sessions headers, the calendar files, usage records) or a user's own read
+    // cursor; a predecessor build never touches them.
+    swapSafe: true,
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS org_sessions (      -- DERIVED CACHE (company mode): desk sessions, rebuilt from each organization's desks.toml (current + previous); trigger_hop is chat-chain accounting and reads 0 after a rebuild
+          session_id  TEXT PRIMARY KEY,
+          project_id  TEXT NOT NULL,
+          org_id      TEXT NOT NULL,
+          agent_id    TEXT NOT NULL,
+          current     INTEGER NOT NULL DEFAULT 1,
+          trigger_hop INTEGER NOT NULL DEFAULT 0
+        );
+        CREATE INDEX IF NOT EXISTS idx_org_sessions_org ON org_sessions(project_id, org_id);
+        CREATE TABLE IF NOT EXISTS org_ticket_sessions ( -- DERIVED CACHE (company mode): ticket <-> contributing session, rebuilt from each ticket's Sessions header
+          project_id  TEXT NOT NULL,
+          org_id      TEXT NOT NULL,
+          ticket_id   TEXT NOT NULL,
+          session_id  TEXT NOT NULL,
+          agent_id    TEXT NOT NULL,
+          trigger_hop INTEGER NOT NULL DEFAULT 0,
+          PRIMARY KEY (project_id, org_id, ticket_id, session_id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_org_ticket_sessions_session ON org_ticket_sessions(session_id);
+        CREATE TABLE IF NOT EXISTS org_calendar_state ( -- calendar run state (company mode; the files are declarative intent), same rules as schedule_state
+          project_id     TEXT NOT NULL,
+          org_id         TEXT NOT NULL,
+          agent_id       TEXT NOT NULL,
+          name           TEXT NOT NULL,
+          start_at_ms    INTEGER NOT NULL,
+          def_hash       TEXT NOT NULL,
+          last_slot_ms   INTEGER,
+          last_fired_at  TEXT,
+          fired_once     INTEGER NOT NULL DEFAULT 0,
+          missed         INTEGER NOT NULL DEFAULT 0,
+          invalid_reason TEXT,
+          last_outcome   TEXT,
+          PRIMARY KEY (project_id, org_id, agent_id, name)
+        );
+        CREATE TABLE IF NOT EXISTS org_ticket_state (   -- DERIVED CACHE (company mode): the last (status, owner, blocked) seen per ticket, so a change is notified once; rebuilt silently from the ticket files
+          project_id  TEXT NOT NULL,
+          org_id      TEXT NOT NULL,
+          ticket_id   TEXT NOT NULL,
+          status      TEXT NOT NULL,
+          owner       TEXT NOT NULL DEFAULT '',
+          blocked     TEXT NOT NULL DEFAULT '',
+          blocked_by  TEXT NOT NULL DEFAULT '',
+          PRIMARY KEY (project_id, org_id, ticket_id)
+        );
+        CREATE TABLE IF NOT EXISTS org_chat_state (     -- DERIVED CACHE (company mode): tail-scan byte cursor per chat day file
+          project_id   TEXT NOT NULL,
+          org_id       TEXT NOT NULL,
+          date         TEXT NOT NULL,
+          offset_bytes INTEGER NOT NULL DEFAULT 0,
+          PRIMARY KEY (project_id, org_id, date)
+        );
+        CREATE TABLE IF NOT EXISTS org_chat_reads (     -- user data (company mode): each user's read cursor in an organization's chat
+          project_id   TEXT NOT NULL,
+          org_id       TEXT NOT NULL,
+          user_id      TEXT NOT NULL,
+          last_read_id TEXT NOT NULL,
+          PRIMARY KEY (project_id, org_id, user_id)
+        );
+        CREATE TABLE IF NOT EXISTS org_budget_state (   -- DERIVED CACHE (company mode): warn / pause marks per employee and period, recomputed from usage and the chart's budgets
+          project_id TEXT NOT NULL,
+          org_id     TEXT NOT NULL,
+          agent_id   TEXT NOT NULL,
+          period     TEXT NOT NULL,
+          warned_at  TEXT,
+          paused_at  TEXT,
+          PRIMARY KEY (project_id, org_id, agent_id, period)
+        );
+      `);
+    },
+    // Drops the seven tables. LOSES: chat read cursors (each user's "read up to here" marks) and
+    // the run marks that stop a calendar slot, a ticket change or a budget alert from firing
+    // twice — a build with this migration re-registers everything from the files, without
+    // backfilling missed slots, and users see every chat message as unread once.
+    down(db) {
+      db.exec(`
+        DROP INDEX IF EXISTS idx_org_ticket_sessions_session;
+        DROP INDEX IF EXISTS idx_org_sessions_org;
+        DROP TABLE IF EXISTS org_budget_state;
+        DROP TABLE IF EXISTS org_chat_reads;
+        DROP TABLE IF EXISTS org_chat_state;
+        DROP TABLE IF EXISTS org_ticket_state;
+        DROP TABLE IF EXISTS org_calendar_state;
+        DROP TABLE IF EXISTS org_ticket_sessions;
+        DROP TABLE IF EXISTS org_sessions;
+      `);
+    }
+  },
+  {
+    version: 7,
+    name: "company-mode-channels",
+    // The organization's single group chat became channels: a message lives in
+    // `channels/<channel_id>/<date>.jsonl`, so the tail-scan cursor and each user's read
+    // cursor are per channel. `org_chat_state` / `org_chat_reads` are dropped for
+    // `org_channel_state` / `org_channel_reads`: the tables are renamed and the channel
+    // belongs in the primary key, neither of which SQLite does in place. Nothing is carried
+    // over: company mode is unreleased, and every row was either rebuildable from the files
+    // (the scan cursor) or one pass of "everything looks unread" (the read cursor). A
+    // predecessor build reads neither table's shape, only its own writes, so this is
+    // swap-safe.
+    swapSafe: true,
+    up(db) {
+      db.exec(`
+        DROP TABLE IF EXISTS org_chat_state;
+        DROP TABLE IF EXISTS org_chat_reads;
+        CREATE TABLE IF NOT EXISTS org_channel_state ( -- DERIVED CACHE (company mode): tail-scan byte cursor per channel and day file
+          project_id   TEXT NOT NULL,
+          org_id       TEXT NOT NULL,
+          channel_id   TEXT NOT NULL,
+          date         TEXT NOT NULL,
+          offset_bytes INTEGER NOT NULL DEFAULT 0,
+          PRIMARY KEY (project_id, org_id, channel_id, date)
+        );
+        CREATE TABLE IF NOT EXISTS org_channel_reads ( -- user data (company mode): each user's read cursor in one channel
+          project_id   TEXT NOT NULL,
+          org_id       TEXT NOT NULL,
+          channel_id   TEXT NOT NULL,
+          user_id      TEXT NOT NULL,
+          last_read_id TEXT NOT NULL,
+          PRIMARY KEY (project_id, org_id, channel_id, user_id)
+        );
+      `);
+    },
+    // Recreates the two tables under their old names, exactly as migration 6 declared them —
+    // EMPTY. LOSES every scan cursor (re-derived by the next pass, which republishes the
+    // messages it re-reads) and every read cursor (users see the recent days as unread once).
+    down(db) {
+      db.exec(`
+        DROP TABLE IF EXISTS org_channel_state;
+        DROP TABLE IF EXISTS org_channel_reads;
+        CREATE TABLE IF NOT EXISTS org_chat_state (     -- DERIVED CACHE (company mode): tail-scan byte cursor per chat day file
+          project_id   TEXT NOT NULL,
+          org_id       TEXT NOT NULL,
+          date         TEXT NOT NULL,
+          offset_bytes INTEGER NOT NULL DEFAULT 0,
+          PRIMARY KEY (project_id, org_id, date)
+        );
+        CREATE TABLE IF NOT EXISTS org_chat_reads ( -- user data (company mode): each user's read cursor in an organization's chat
+          project_id   TEXT NOT NULL,
+          org_id       TEXT NOT NULL,
+          user_id      TEXT NOT NULL,
+          last_read_id TEXT NOT NULL,
+          PRIMARY KEY (project_id, org_id, user_id)
+        );
+      `);
+    }
+  },
+  {
+    version: 8,
+    name: "company-mode-desk-notices",
+    // Additive: one new table and its index. A ticket change no longer starts a work run at
+    // the owner's desk; it is queued here and delivered inside the body of that employee's
+    // next calendar sweep. A predecessor build never reads the table, so a rollback survives
+    // it — with whatever rows are in it left undelivered.
+    swapSafe: true,
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS org_desk_notices (   -- DERIVED CACHE (company mode): ticket changes waiting for an employee's next calendar sweep; dropping it loses only the digests not delivered yet
+          seq        INTEGER PRIMARY KEY AUTOINCREMENT,
+          project_id TEXT NOT NULL,
+          org_id     TEXT NOT NULL,
+          agent_id   TEXT NOT NULL,
+          ticket_id  TEXT NOT NULL,
+          change     TEXT NOT NULL,
+          at         TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_org_desk_notices_agent ON org_desk_notices(project_id, org_id, agent_id);
+      `);
+    },
+    // LOSES every queued notice: the ticket changes an employee has not been told about yet.
+    // The change itself is in the ticket file and its history either way; what
+    // goes is the "Since your last sweep" line that would have named it.
+    down(db) {
+      db.exec(`
+        DROP INDEX IF EXISTS idx_org_desk_notices_agent;
+        DROP TABLE IF EXISTS org_desk_notices;
+      `);
+    }
+  },
+  {
+    version: 9,
+    name: "model-promotions",
+    // Additive: one new table, nothing existing touched. A predecessor build never reads it
+    // and prices every row at the number in its Project file, so a rollback survives it.
+    swapSafe: true,
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS model_promotions ( -- NOT a cache rebuildable from files: the only record of a Project row's running promotion (.project_config.toml keeps the list price), written by preset seeding at Project creation, "sync presets" and Penguin Go authorization / sync, and read by cost; lost rows price usage at list until the next sync writes them back
+          project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+          provider   TEXT NOT NULL,
+          model_id   TEXT NOT NULL,
+          discount   REAL NOT NULL CHECK (discount > 0 AND discount < 1),
+          updated_at TEXT NOT NULL,
+          PRIMARY KEY (project_id, provider, model_id)
+        );
+      `);
+    },
+    // LOSES every stored promotion: no file holds a copy of the fractions, so usage is priced
+    // at the Project files' list prices until the next "sync presets" or Penguin Go sync
+    // writes them back.
+    down(db) {
+      db.exec("DROP TABLE IF EXISTS model_promotions");
+    }
+  },
+  {
+    version: 10,
+    name: "model-provider-auth-tokens",
+    // Additive: one new table, nothing existing touched. A predecessor build never reads it;
+    // the access token already written into .project_config.toml keeps working until it
+    // expires, so rollback only loses silent refresh state.
+    // KEEP until every supported upgrade starts from schema 10 or newer. The release that
+    // raises the minimum database baseline past 9 owns removing this migration block and its
+    // version-9 fixture; the table itself remains while provider token refresh uses it.
+    swapSafe: true,
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS model_provider_auth_tokens ( -- Server-side OAuth refresh metadata for provider groups. The current request token remains in .project_config.toml as api_key; this table holds only the refresh material that must never be returned to the frontend or written into Project files.
+          project_id              TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+          provider                TEXT NOT NULL,
+          refresh_token           TEXT NOT NULL,
+          access_token_expires_at TEXT,
+          updated_at              TEXT NOT NULL,
+          PRIMARY KEY (project_id, provider)
+        );
+      `);
+    },
+    // LOSES every stored refresh token and access-token expiry. Existing access tokens in
+    // Project files remain until they expire; users re-authorize to restore silent refresh.
+    down(db) {
+      db.exec("DROP TABLE IF EXISTS model_provider_auth_tokens");
+    }
+  },
+  {
+    version: 11,
+    name: "sessions-sandbox",
+    // The Session's own sandbox policy (JSON), snapshotted from the server's settings when
+    // the Session is created, so a later settings change leaves running Sessions alone.
+    // NULL = a row from before this column: it takes the settings in force at its next
+    // command and keeps them from then on. Swap-safe: a pushed platform boots against the
+    // runtime's already-open database, so the column has to arrive by a migration.
+    swapSafe: true,
+    up(db) {
+      ensureColumn(db, "sessions", "sandbox", "TEXT");
+    },
+    // Not a DROP: schema.ts declares the column, and dropping it would put every Session
+    // back under whatever the settings say.
+    down() {
+    }
+  },
+  {
+    version: 12,
+    name: "machines-columns",
+    // A machines table can predate migration 4 — a data root that ran the machines line
+    // before it was released kept forwards, not sessions — and that migration's IF NOT
+    // EXISTS adopted it whatever its columns were, so the first connect failed on the row's
+    // insert. Adds what is missing, nullable; a platform rolled back to 4 declared these
+    // columns itself, so there is nothing for it to mind.
+    swapSafe: true,
+    up(db) {
+      ensureColumn(db, "machines", "session_pid", "INTEGER");
+      ensureColumn(db, "machines", "platform", "TEXT");
+    },
+    // Nothing to undo: what this added, 4 already declares, and a column it found in place
+    // was never this migration's to take away.
+    down() {
+    }
+  },
+  {
+    version: 13,
+    name: "browser-extensions",
+    // Additive: one new table and its index. The Chrome backend's pairings — one row per
+    // PenguinHarness Browser extension a user paired, its token stored hashed. A predecessor
+    // build never reads the table, so a rollback survives it; the paired extensions then simply
+    // fail to connect until a build that knows them is back.
+    swapSafe: true,
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS browser_extensions ( -- one row per Chrome paired to a user (builtin-browser/extension-pairing.ts): the PenguinHarness Browser extension's long-lived credential, stored only hashed; NOT rebuildable \u2014 a lost row means pairing that Chrome again
+          extension_id TEXT PRIMARY KEY,
+          user_id      TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+          token_hash   TEXT NOT NULL UNIQUE,
+          name         TEXT NOT NULL,
+          version      TEXT NOT NULL,
+          created_at   TEXT NOT NULL,
+          last_seen_at TEXT,
+          revoked_at   TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_browser_extensions_user ON browser_extensions(user_id);
+      `);
+    },
+    // LOSES every pairing: each user's Chrome has to be paired again (a new code from the
+    // Browser panel) before agents can drive it.
+    down(db) {
+      db.exec(`
+        DROP INDEX IF EXISTS idx_browser_extensions_user;
+        DROP TABLE IF EXISTS browser_extensions;
+      `);
+    }
+  },
+  {
+    version: 14,
+    name: "agent-api",
+    // Additive: two new tables and an index. The Agent API's per-Agent settings (the switch,
+    // keyless access, the approval mode API Sessions are created with) and its keys, stored
+    // hashed. A predecessor build never reads them and serves no /api/amsp route, so a
+    // rollback survives it: callers get 404 until a build that knows the tables is back.
+    swapSafe: true,
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS agent_api (          -- per-Agent public API settings (amsp/routes.ts); NOT rebuildable from files
+          project_id    TEXT NOT NULL,
+          agent_id      TEXT NOT NULL,
+          enabled       INTEGER NOT NULL DEFAULT 0,
+          open          INTEGER NOT NULL DEFAULT 0,
+          approval_mode TEXT NOT NULL DEFAULT 'allow-all',
+          updated_at    TEXT NOT NULL,
+          PRIMARY KEY (project_id, agent_id)
+        );
+        CREATE TABLE IF NOT EXISTS agent_api_keys (     -- one row per key the API tab or the CLI minted; the caller alone holds the key
+          key_id       TEXT PRIMARY KEY,
+          project_id   TEXT NOT NULL,
+          agent_id     TEXT NOT NULL,
+          token_hash   TEXT NOT NULL UNIQUE,
+          prefix       TEXT NOT NULL,
+          name         TEXT NOT NULL,
+          created_by   TEXT NOT NULL REFERENCES users(user_id),
+          created_at   TEXT NOT NULL,
+          last_used_at TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_agent_api_keys_agent ON agent_api_keys(project_id, agent_id);
+      `);
+    },
+    // LOSES every Agent's API settings and every key: each exposed Agent reads as disabled
+    // again (404 to its callers), and every caller needs a newly created key once it is back
+    // on — no file holds a copy of either.
+    down(db) {
+      db.exec(`
+        DROP INDEX IF EXISTS idx_agent_api_keys_agent;
+        DROP TABLE IF EXISTS agent_api_keys;
+        DROP TABLE IF EXISTS agent_api;
+      `);
+    }
+  },
+  {
+    version: 15,
+    name: "messaging-conversations",
+    // Additive: one new table. The WeChat connector's per-(bot, user) delivery state — the
+    // context token every send must echo, how many sends it has funded, and replies held for
+    // the user's next message. A predecessor build never reads it and keeps its tokens in
+    // memory as it always did, so a rollback survives it.
+    swapSafe: true,
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS messaging_conversations ( -- per-(bot, chat) delivery state a connector must keep across reconnects and restarts (WeChat: the context token, its send count, held replies); deleted once no messaging_bindings row references (channel, account_id) \u2014 see MessagingBindingsRepo
+          channel    TEXT NOT NULL,
+          account_id TEXT NOT NULL,
+          chat_id    TEXT NOT NULL,
+          state_json TEXT NOT NULL,
+          updated_at TEXT NOT NULL,
+          PRIMARY KEY (channel, account_id, chat_id)
+        );
+      `);
+    },
+    // LOSES every stored context token and every held reply: replies sent before each user's
+    // next message are refused again, and what was held never arrives.
+    down(db) {
+      db.exec("DROP TABLE IF EXISTS messaging_conversations");
+    }
+  },
+  {
+    version: 16,
+    name: "sessions-kept-at",
+    // The "keep in sidebar" mark: written when the user unarchives a Session, cleared when they
+    // archive it. The listing rule files a background Session (api / schedule / cli) away unless
+    // it carries the mark, so existing rows are listed by the rule as they stand and nothing is
+    // rewritten. Swap-safe: a pushed platform boots against the runtime's already-open database,
+    // so the column has to arrive by a migration.
+    swapSafe: true,
+    up(db) {
+      ensureColumn(db, "sessions", "kept_at", "TEXT");
+    },
+    // Not a DROP: schema.ts declares the column, and dropping it would file every kept
+    // background Session away again.
+    down() {
+    }
+  }
+];
+var LATEST_VERSION = MIGRATIONS.reduce((n, m) => Math.max(n, m.version), 0);
+function schemaVersion(db) {
+  const row = db.prepare("PRAGMA user_version").get();
+  return row?.user_version ?? 0;
+}
+var RestartRequiredError = class extends Error {
+  constructor(migration) {
+    super(
+      `migration ${migration.version} (${migration.name}) is restart-only and cannot be applied while a pushed platform boots: it is not safe to leave behind if this boot is rolled back. Restart the runtime on a build that carries it, then push again.`
+    );
+    this.migration = migration;
+    this.name = "RestartRequiredError";
+  }
+  migration;
+};
+function migrate(db, { swapPath = false } = {}) {
+  const from = schemaVersion(db);
+  const pending = [...MIGRATIONS].sort((a, b) => a.version - b.version).filter((m) => m.version > from);
+  if (swapPath) {
+    const blocked = pending.find((m) => !m.swapSafe);
+    if (blocked) throw new RestartRequiredError(blocked);
+  }
+  const applied = [];
+  for (const m of pending) {
+    db.exec("BEGIN");
+    try {
+      m.up(db);
+      db.exec(`PRAGMA user_version = ${m.version}`);
+      db.exec("COMMIT");
+    } catch (err) {
+      db.exec("ROLLBACK");
+      throw new Error(`migration ${m.version} (${m.name}) failed: ${String(err)}`, { cause: err });
+    }
+    applied.push(m.name);
+  }
+  return { from, to: schemaVersion(db), applied };
+}
+
+// src/db/schema.ts
+var MODEL_PROMOTIONS_SQL = `
+CREATE TABLE IF NOT EXISTS model_promotions ( -- NOT a cache rebuildable from files: the only record of a Project row's running promotion (.project_config.toml keeps the list price), written by preset seeding at Project creation, "sync presets" and Penguin Go authorization / sync, and read by cost; lost rows price usage at list until the next sync writes them back
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  provider   TEXT NOT NULL,
+  model_id   TEXT NOT NULL,
+  discount   REAL NOT NULL CHECK (discount > 0 AND discount < 1),  -- fraction off the row's list price: billed = list \xD7 (1 \u2212 discount)
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, provider, model_id)
+);`;
+var MODEL_PROVIDER_AUTH_TOKENS_SQL = `
+CREATE TABLE IF NOT EXISTS model_provider_auth_tokens ( -- Server-side OAuth refresh metadata for provider groups. The current request token remains in .project_config.toml as api_key; this table holds only the refresh material that must never be returned to the frontend or written into Project files.
+  project_id              TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  provider                TEXT NOT NULL,
+  refresh_token           TEXT NOT NULL,
+  access_token_expires_at TEXT,
+  updated_at              TEXT NOT NULL,
+  PRIMARY KEY (project_id, provider)
+);`;
+var SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS users (
+  user_id             TEXT PRIMARY KEY,            -- semantic id doubles as login name: ^[a-z][a-z0-9_-]{1,31}$
+  password_hash       TEXT NOT NULL,               -- scrypt$N$r$p$salt$hash(base64)
+  is_admin            INTEGER NOT NULL DEFAULT 0,  -- 1 for the built-in admin (seeded at startup)
+  password_is_initial INTEGER NOT NULL DEFAULT 0,  -- 1=initial password (seeded/admin-set); cleared once the user changes it
+  display_name        TEXT,                        -- nickname shown in place of user_id (1-32 characters); NULL = never set, surfaces show the id
+  avatar              TEXT,                        -- avatar as a data URL (image/png|jpeg|webp, <= 131072 characters); NULL = never set, surfaces draw the letter placeholder
+  created_at          TEXT NOT NULL
+);
+-- Server-side sessions backing the HttpOnly cookie: the cookie carries a 32-byte random
+-- token, the row stores only its sha256. A session outlives a restart (it is on disk), which
+-- is why the model is a row and not a signed statement.
+CREATE TABLE IF NOT EXISTS auth_sessions (
+  token_hash TEXT PRIMARY KEY,               -- sha256(token) hex; the cookie stores only the raw token
+  user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,                  -- 30-day sliding renewal, topped up in place when <29 days remain
+  via        TEXT                            -- 'password'|'desktop'|'setup'|'cli'; NULL = legacy (password)
+);
+-- deleteExpired runs on every login and mint, deleteByUser on every admin reset; without
+-- these both scan the whole table.
+CREATE INDEX IF NOT EXISTS idx_auth_sessions_expires ON auth_sessions(expires_at);
+CREATE INDEX IF NOT EXISTS idx_auth_sessions_user ON auth_sessions(user_id);
+
+CREATE TABLE IF NOT EXISTS projects (
+  project_id    TEXT PRIMARY KEY,            -- directory name doubles as id; display name lives in project_config.toml
+  owner_user_id TEXT NOT NULL REFERENCES users(user_id),
+  created_at    TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS project_members (  -- member grants only; owners are not stored here
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, user_id)
+);
+${MODEL_PROMOTIONS_SQL}
+${MODEL_PROVIDER_AUTH_TOKENS_SQL}
+CREATE TABLE IF NOT EXISTS agents (           -- index only; name/description live in system_config.yaml
+  project_id TEXT NOT NULL,
+  agent_id   TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, agent_id)
+);
+CREATE TABLE IF NOT EXISTS sessions (
+  session_id    TEXT PRIMARY KEY,
+  project_id    TEXT NOT NULL,
+  agent_id      TEXT NOT NULL,
+  provider      TEXT NOT NULL,                     -- provider group of the session's CURRENT model (paired with model_id as a model reference; moves with each in-session switch)
+  model_id      TEXT NOT NULL,                     -- upstream model id of the current model (sent to MMSP as-is; never concatenate <provider>/<id>)
+  workspace     TEXT NOT NULL,
+  approval_mode TEXT NOT NULL DEFAULT 'allow-all',   -- allow-all|deny-all|read-only|always-ask
+  thinking_level TEXT,                               -- level pinned for THIS session (none|low|medium|high|xhigh|max); NULL=not pinned, runs follow the Agent config
+  title         TEXT,                                -- auto-generated by the model after the first exchange; NULL=not yet (frontend shows "New chat")
+  archived_at   TEXT,                                -- the user archived it (ISO time); NULL = not archived by hand (the listing rule may still file it away)
+  kept_at       TEXT,                                -- "keep in sidebar": set when the user unarchives, cleared when they archive; NULL = the listing rule decides (a background source is archived, a user Session is active). Never written by a run.
+  client        TEXT,                                -- creating client: 'web' (created via the Web App) | 'cli' (adopted from a CLI Trace) | 'org' (company mode) | 'api' (an Agent API run); NULL = legacy row, treated as web
+  has_trace     INTEGER NOT NULL DEFAULT 0,          -- cache: a Trace record exists (set at task start / adoption / subagent registration; lazily backfilled by list hydration)
+  fork_count    INTEGER NOT NULL DEFAULT 0,          -- monotonically allocated child-fork number for this source Session; never decremented when a fork is deleted
+  sandbox       TEXT,                                -- the Session's sandbox policy snapshot (JSON SandboxSettings); NULL = legacy row, snapshotted at its next command
+  last_active_at TEXT,                               -- last activity this server drove for the session (ISO; stamped once when a run starts and once when it ends, initialized to created_at); monotonic, never moves backwards; NULL only before openDatabase's one-time backfill
+  created_at    TEXT NOT NULL
+);                                            -- the Session's SOURCE (user/api/schedule/subagent/cli/company) is NOT stored: session_meta in the Trace is the single source of truth (see runtime/session-sources.ts); "client" is a different, DB-only axis (who created the row), read for the source only where the Trace records none ('org' \u2192 company)
+CREATE INDEX IF NOT EXISTS idx_sessions_agent_created ON sessions(project_id, agent_id, created_at DESC);
+CREATE TABLE IF NOT EXISTS usage_records (
+  id                INTEGER PRIMARY KEY AUTOINCREMENT,
+  ts                TEXT NOT NULL,
+  date              TEXT NOT NULL,            -- local date yyyy-mm-dd (aggregation key; same convention as Trace date directories)
+  project_id        TEXT NOT NULL,
+  agent_id          TEXT NOT NULL,
+  session_id        TEXT NOT NULL,            -- top-level Session (child-session usage counts toward its main Session)
+  origin_session_id TEXT,                     -- immediate source child Session (last of the origin chain); NULL=main session
+  provider          TEXT NOT NULL,            -- provider group: paired with model_id as the attribution key; always GROUP BY provider, model_id
+  model_id          TEXT NOT NULL,            -- upstream model id (paired with provider; same model_id across providers aggregates separately)
+  cache_read        INTEGER NOT NULL,
+  cache_write       INTEGER NOT NULL,
+  output            INTEGER NOT NULL,
+  total             INTEGER NOT NULL,         -- from token_usage.request (one row per Request)
+  status            TEXT NOT NULL DEFAULT 'completed'  -- request outcome: completed=success (with tokens); others=failure (0 tokens, for success rate)
+);                                            -- cost is not stored: computed at query time from current pricing
+CREATE INDEX IF NOT EXISTS idx_usage_project_date ON usage_records(project_id, date);
+CREATE INDEX IF NOT EXISTS idx_usage_session_ts ON usage_records(session_id, ts);  -- (session_id) alone was idx_usage_session (dropped on open): ts makes the last_active_at backfill's MAX(ts) a covering index scan instead of a random row lookup per usage record
+CREATE TABLE IF NOT EXISTS error_records (     -- server-side error capture (the Costs page's "Errors" tab)
+  id         INTEGER PRIMARY KEY AUTOINCREMENT,
+  ts         TEXT NOT NULL,
+  date       TEXT NOT NULL,            -- local date yyyy-mm-dd (same convention as usage_records)
+  project_id TEXT,                     -- nullable: sign-in/registration and process-level errors have no Project context
+  agent_id   TEXT,
+  session_id TEXT,
+  source     TEXT NOT NULL,            -- http | session | usage | title | subagent | process | llm | environment | compaction | schedule | messaging | organization | id_suggest | plugin
+  kind       TEXT NOT NULL,            -- expected (HttpError, business 4xx) | unexpected (500/runtime)
+  code       TEXT NOT NULL,            -- HttpError.code / internal / session_run_failed / ...
+  status     INTEGER,                  -- HTTP status code; NULL for non-HTTP sources
+  message    TEXT NOT NULL             -- truncated to 500 chars (no stack stored: stacks go to logs only)
+);
+CREATE INDEX IF NOT EXISTS idx_error_project_date ON error_records(project_id, date);
+CREATE TABLE IF NOT EXISTS schedule_state (    -- schedule runtime state (files are declarative intent; the system never writes back)
+  project_id      TEXT NOT NULL,
+  agent_id        TEXT NOT NULL,
+  name            TEXT NOT NULL,               -- file name (without .toml) doubles as the identifier
+  creator_user_id TEXT,                        -- creator (recorded on API create; hand-edited file reconciliation falls back to the Project owner)
+  start_at_ms     INTEGER NOT NULL,            -- defines identity: a start_at change counts as a new task instance, resetting fire state
+  def_hash        TEXT NOT NULL,               -- file content fingerprint: any change clears the invalid flag (the file takes effect again after edits)
+  last_slot_ms    INTEGER,                     -- latest due slot already consumed (advances on fire or skip; no re-fire across restarts)
+  last_fired_at   TEXT,                        -- last actual fire time (for display)
+  fired_once      INTEGER NOT NULL DEFAULT 0,  -- one-shot task has fired
+  missed          INTEGER NOT NULL DEFAULT 0,  -- one-shot task was missed (flagged by startup/registration reconciliation; not backfilled)
+  invalid_reason  TEXT,                        -- invalidation reason (e.g. the bound Session was deleted); NULL=healthy
+  PRIMARY KEY (project_id, agent_id, name)
+);
+CREATE TABLE IF NOT EXISTS messaging_bindings ( -- Session \u2194 messaging-channel bot bindings (runtime/messaging/ holds the long connections)
+  session_id       TEXT NOT NULL,              -- a Session keeps at most one saved config PER channel (composite PK below); at most ONE of them is enabled at a time (route-enforced, 409 another_channel_enabled), and enabling is what binds the account to this Session
+  channel          TEXT NOT NULL,              -- messaging channel discriminator ('feishu' | 'telegram' | 'qq' | 'wechat')
+  account_id       TEXT NOT NULL,              -- channel-scoped bot/app identity (feishu: app_id; telegram: the bot token's numeric id; qq: the bot's App ID; wechat: the scanned bot id); NOT unique \u2014 any number of Sessions may keep the same account saved side by side, each with its own config and last-chat memory; only ENABLING is exclusive (route-enforced, 409 account_enabled_elsewhere: one account has one event stream, two live connections on it would race)
+  config_json      TEXT NOT NULL,              -- channel-specific credentials/config JSON (feishu: appId/appSecret/baseDomain; telegram: botToken; qq: appId/appSecret; wechat: botId/botToken/baseUrl/userId); secrets plaintext at rest (same trade-off as the proxy address in server_settings), masked at every API surface; a cleared secret is stored as "" (the row and its account identity stay)
+  enabled          INTEGER NOT NULL DEFAULT 0, -- INTENT state (the connection's runtime status stays in memory): new bindings start disabled \u2014 saving credentials never opens a connection, the explicit state toggle does
+  line_per_message INTEGER NOT NULL DEFAULT 0, -- delivery preference: 1 = every non-blank line of a relayed assistant reply is sent as its own message (a reply written as spoken lines arrives as spoken lines), 0 = one message per reply. Channel-agnostic, so it lives here rather than in config_json, which each connector owns
+  final_reply_only INTEGER NOT NULL DEFAULT 0, -- delivery preference: 1 = a run's intermediate assistant messages are held and only its LAST completed one is sent, at the run's end, 0 = every completed assistant message mirrors the moment it completes. Channel-agnostic like the column above and independent of it: with both set, that one final text is the one split per line
+  render_markdown  INTEGER NOT NULL DEFAULT 1, -- delivery preference: 1 = a relayed reply's Markdown is rendered in the channel's own markup (Telegram HTML, a Feishu card, QQ markdown, the subset WeChat itself reads), 0 = the reply's characters are sent as written. DEFAULT 1 because the model writes Markdown and showing it raw was the defect; the per-channel subsets and the plain-text fallback live in the connectors
+  last_chat_id     TEXT,                       -- most recent inbound chat (NULL until the bot is messaged once; replies and test messages target it); CONNECTOR-OPAQUE, not necessarily a bare chat id \u2014 telegram appends the forum topic (see telegram-connector.ts chatRefOf), so only that channel's connector may interpret it
+  last_chat_is_direct INTEGER NOT NULL DEFAULT 1, -- 1 = direct chat (reply by chat id), 0 = group chat (prefer reply-to-message)
+  last_inbound_message_id TEXT,                 -- channel id of the most recently PROCESSED inbound message (NULL until one arrives); the durable half of the bridge's redelivery guard, so a channel replaying an event this server already turned into a Task after a restart does not run it twice
+  created_at       TEXT NOT NULL,
+  updated_at       TEXT NOT NULL,
+  PRIMARY KEY (session_id, channel)
+);
+CREATE INDEX IF NOT EXISTS idx_messaging_by_account ON messaging_bindings(channel, account_id);  -- serves the enable guard's by-account lookup; deliberately NOT unique, unlike its predecessor idx_messaging_account (dropped on open) which made an account exclusive to one Session forever
+CREATE TABLE IF NOT EXISTS messaging_conversations ( -- per-(bot, chat) delivery state a connector must keep across reconnects and restarts (WeChat: the context token, its send count, held replies); deleted once no messaging_bindings row references (channel, account_id) \u2014 see MessagingBindingsRepo
+  channel    TEXT NOT NULL,                     -- messaging channel discriminator (only 'wechat' writes rows today)
+  account_id TEXT NOT NULL,                     -- the bot, as messaging_bindings.account_id names it
+  chat_id    TEXT NOT NULL,                     -- the connector's own chat id (wechat: the user's ilink_user_id)
+  state_json TEXT NOT NULL,                     -- connector-owned JSON (wechat: {contextToken, tokenAt, spent, held, heldSince}); the token is a conversation handle at rest, same trade-off as config_json's credentials
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (channel, account_id, chat_id)
+);
+CREATE TABLE IF NOT EXISTS ui_prefs (
+  user_id    TEXT PRIMARY KEY REFERENCES users(user_id) ON DELETE CASCADE,
+  prefs_json TEXT NOT NULL                    -- {theme?, lastProjectId?, ...} free-form JSON
+);
+CREATE TABLE IF NOT EXISTS browser_extensions ( -- one row per Chrome paired to a user (builtin-browser/extension-pairing.ts): the PenguinHarness Browser extension's long-lived credential, stored only hashed; NOT rebuildable \u2014 a lost row means pairing that Chrome again
+  extension_id TEXT PRIMARY KEY,              -- random id shown in the Web App's list
+  user_id      TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+  token_hash   TEXT NOT NULL UNIQUE,          -- sha256(token) hex; the extension alone holds the token
+  name         TEXT NOT NULL,                 -- how the extension names this Chrome ("Chrome 130 on macOS")
+  version      TEXT NOT NULL,                 -- the extension's version, as of its last hello
+  created_at   TEXT NOT NULL,
+  last_seen_at TEXT,                          -- last connect or disconnect; NULL = never connected
+  revoked_at   TEXT                           -- set by Revoke; a revoked token's socket is closed 4003
+);
+CREATE INDEX IF NOT EXISTS idx_browser_extensions_user ON browser_extensions(user_id);
+CREATE TABLE IF NOT EXISTS agent_api (          -- per-Agent public API settings (amsp/routes.ts); NOT rebuildable from files
+  project_id    TEXT NOT NULL,
+  agent_id      TEXT NOT NULL,
+  enabled       INTEGER NOT NULL DEFAULT 0,     -- the API tab's switch; off = every /api/amsp request for it is 404 agent_not_found
+  open          INTEGER NOT NULL DEFAULT 0,     -- keyless access: a request without Authorization is accepted; off = 401 unauthorized
+  approval_mode TEXT NOT NULL DEFAULT 'allow-all', -- the approval mode an API Session is CREATED with (allow-all|deny-all|read-only|always-ask); copied onto sessions.approval_mode, never read per decision
+  updated_at    TEXT NOT NULL,
+  PRIMARY KEY (project_id, agent_id)
+);
+CREATE TABLE IF NOT EXISTS agent_api_keys (     -- one row per key the API tab or the CLI minted; the caller alone holds the key
+  key_id       TEXT PRIMARY KEY,                -- 16 base64url chars, shown in the list
+  project_id   TEXT NOT NULL,
+  agent_id     TEXT NOT NULL,
+  token_hash   TEXT NOT NULL UNIQUE,            -- sha256(key) hex
+  prefix       TEXT NOT NULL,                   -- the key's first 16 characters ("penguin_" + 8), shown in the list
+  name         TEXT NOT NULL,                   -- 1-64 characters
+  created_by   TEXT NOT NULL REFERENCES users(user_id),
+  created_at   TEXT NOT NULL,
+  last_used_at TEXT                             -- stamped once per run request that authenticated with it; NULL = never
+);
+CREATE INDEX IF NOT EXISTS idx_agent_api_keys_agent ON agent_api_keys(project_id, agent_id);
+CREATE TABLE IF NOT EXISTS server_settings (   -- admin-level server-global settings (GET/PUT /api/admin/settings)
+  key   TEXT PRIMARY KEY,                     -- setting name, e.g. 'proxy_for_app'
+  value TEXT NOT NULL                         -- JSON-encoded value; an absent row means the setting's built-in default
+);
+CREATE TABLE IF NOT EXISTS machine (           -- this server's OWN identity, minted here and never assigned from outside (what 'penguin server status' reports)
+  singleton  INTEGER PRIMARY KEY CHECK (singleton = 1),  -- exactly one row, enforced by the schema rather than by convention
+  machine_id TEXT NOT NULL                    -- 16 base64url characters; what every stored reference to this machine points at
+);
+CREATE TABLE IF NOT EXISTS machines (          -- one row per machine this server installed on or reached (machines/service.ts)
+  address      TEXT PRIMARY KEY,               -- 'ssh:<alias>'
+  machine_id   TEXT,                           -- that machine's own id, once heard
+  version      TEXT,                           -- what this server last installed there; NULL = never
+  installed_at TEXT,
+  session_pid  INTEGER,                        -- the ssh session this server holds to it; what a successor App closes after a hot swap
+  remote_port  INTEGER,                        -- its server's port over there, as of the last connect
+  platform     TEXT                            -- linux | darwin | win32, as the install found it: the shell dialect the status probe speaks to it in
+);
+CREATE TABLE IF NOT EXISTS machine_project (   -- which machines a Project uses; no row = none yet. Follows the Project out, like project_members
+  project_id TEXT PRIMARY KEY REFERENCES projects(project_id) ON DELETE CASCADE,
+  addresses  TEXT NOT NULL                     -- JSON array of 'ssh:<alias>'
+);
+CREATE TABLE IF NOT EXISTS trace_files (       -- DERIVED CACHE of the on-disk Trace tree (services/trace-index.ts): the directories stay the single source of truth, every row is rebuildable from disk, and a row is never authority for absence \u2014 consumers reconcile + retry on a miss, so a stale index costs one extra scan, never a false 404
+  project_id TEXT NOT NULL,
+  agent_id   TEXT NOT NULL,
+  session_id TEXT NOT NULL,
+  file_index INTEGER NOT NULL,               -- shard index NNN of <session_id>_NNN.jsonl (name/path are reconstructed from the row, never stored: the data root may move)
+  date       TEXT NOT NULL,                  -- date directory name (local yyyy-mm-dd)
+  size_bytes INTEGER NOT NULL,               -- last observed size (listings stat-refresh the returned page and write back; an actively-appended shard may lag in between)
+  page_stats TEXT,                           -- cached message-window scan state at this shard's END (services/message-window.ts ShardPrefixRecord JSON); immutable shards only, NULL = not yet computed, nulled whenever size_bytes changes
+  PRIMARY KEY (project_id, agent_id, session_id, file_index)
+);
+CREATE INDEX IF NOT EXISTS idx_trace_files_agent_date ON trace_files(project_id, agent_id, date);
+CREATE INDEX IF NOT EXISTS idx_trace_files_session ON trace_files(session_id);
+CREATE TABLE IF NOT EXISTS trace_sessions (    -- per-session facts read ONCE at registration from the earliest shard's head (same derived-cache rules as trace_files; listing needs zero head-reads)
+  session_id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  agent_id   TEXT NOT NULL,
+  source     TEXT,                           -- session_meta source as the head carried it: 'user' | 'api' | 'schedule' | 'subagent' | 'cli' | 'company'; NULL = the head records none (written before the source was required: read as 'company' for an 'org' row, else 'user' \u2014 readRecordedSource); 'benchmark' from older rows reads as 'cli' (normalizeSessionSource; meaningless while meta_read = 0)
+  workspace  TEXT NOT NULL DEFAULT '',
+  title      TEXT,                           -- first-prompt fallback title (sessions.title always wins when present)
+  provider   TEXT,                           -- model reference from session_meta: the model the Session was created on (CLI adoption reads it from here, and the runtime's own answer corrects the row at load; NULL = meta unreadable / legacy without provider)
+  model_id   TEXT,
+  first_ts   TEXT,                           -- first record's timestamp (adoption's createdAt fallback when the id embeds no time)
+  meta_read  INTEGER NOT NULL DEFAULT 0      -- 1 once the head parsed; 0 = facts unknown, retried by the next reconcile that touches the session
+);
+CREATE INDEX IF NOT EXISTS idx_trace_sessions_agent ON trace_sessions(project_id, agent_id);
+CREATE TABLE IF NOT EXISTS org_sessions (      -- DERIVED CACHE (company mode): desk sessions, rebuilt from each organization's desks.toml (current + previous); trigger_hop is mention-chain accounting and reads 0 after a rebuild
+  session_id  TEXT PRIMARY KEY,
+  project_id  TEXT NOT NULL,
+  org_id      TEXT NOT NULL,
+  agent_id    TEXT NOT NULL,
+  current     INTEGER NOT NULL DEFAULT 1,
+  trigger_hop INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS idx_org_sessions_org ON org_sessions(project_id, org_id);
+CREATE TABLE IF NOT EXISTS org_ticket_sessions ( -- DERIVED CACHE (company mode): ticket <-> contributing session, rebuilt from each ticket's Sessions header
+  project_id  TEXT NOT NULL,
+  org_id      TEXT NOT NULL,
+  ticket_id   TEXT NOT NULL,
+  session_id  TEXT NOT NULL,
+  agent_id    TEXT NOT NULL,
+  trigger_hop INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (project_id, org_id, ticket_id, session_id)
+);
+CREATE INDEX IF NOT EXISTS idx_org_ticket_sessions_session ON org_ticket_sessions(session_id);
+CREATE TABLE IF NOT EXISTS org_calendar_state ( -- calendar run state (company mode; the files are declarative intent), same rules as schedule_state
+  project_id     TEXT NOT NULL,
+  org_id         TEXT NOT NULL,
+  agent_id       TEXT NOT NULL,
+  name           TEXT NOT NULL,
+  start_at_ms    INTEGER NOT NULL,
+  def_hash       TEXT NOT NULL,
+  last_slot_ms   INTEGER,
+  last_fired_at  TEXT,
+  fired_once     INTEGER NOT NULL DEFAULT 0,
+  missed         INTEGER NOT NULL DEFAULT 0,
+  invalid_reason TEXT,
+  last_outcome   TEXT,
+  PRIMARY KEY (project_id, org_id, agent_id, name)
+);
+CREATE TABLE IF NOT EXISTS org_ticket_state (   -- DERIVED CACHE (company mode): the last (status, owner, blocked) seen per ticket, so a change is notified once; rebuilt silently from the ticket files
+  project_id  TEXT NOT NULL,
+  org_id      TEXT NOT NULL,
+  ticket_id   TEXT NOT NULL,
+  status      TEXT NOT NULL,
+  owner       TEXT NOT NULL DEFAULT '',
+  blocked     TEXT NOT NULL DEFAULT '',
+  blocked_by  TEXT NOT NULL DEFAULT '',
+  PRIMARY KEY (project_id, org_id, ticket_id)
+);
+CREATE TABLE IF NOT EXISTS org_channel_state ( -- DERIVED CACHE (company mode): tail-scan byte cursor per channel and day file
+  project_id   TEXT NOT NULL,
+  org_id       TEXT NOT NULL,
+  channel_id   TEXT NOT NULL,
+  date         TEXT NOT NULL,
+  offset_bytes INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (project_id, org_id, channel_id, date)
+);
+CREATE TABLE IF NOT EXISTS org_channel_reads ( -- user data (company mode): each user's read cursor in one channel
+  project_id   TEXT NOT NULL,
+  org_id       TEXT NOT NULL,
+  channel_id   TEXT NOT NULL,
+  user_id      TEXT NOT NULL,
+  last_read_id TEXT NOT NULL,
+  PRIMARY KEY (project_id, org_id, channel_id, user_id)
+);
+CREATE TABLE IF NOT EXISTS org_budget_state (   -- DERIVED CACHE (company mode): warn / pause marks per employee and period, recomputed from usage and the chart's budgets
+  project_id TEXT NOT NULL,
+  org_id     TEXT NOT NULL,
+  agent_id   TEXT NOT NULL,
+  period     TEXT NOT NULL,
+  warned_at  TEXT,
+  paused_at  TEXT,
+  PRIMARY KEY (project_id, org_id, agent_id, period)
+);
+CREATE TABLE IF NOT EXISTS org_desk_notices (   -- DERIVED CACHE (company mode): ticket changes waiting for an employee's next calendar sweep; dropping it loses only the digests not delivered yet
+  seq        INTEGER PRIMARY KEY AUTOINCREMENT,
+  project_id TEXT NOT NULL,
+  org_id     TEXT NOT NULL,
+  agent_id   TEXT NOT NULL,
+  ticket_id  TEXT NOT NULL,
+  change     TEXT NOT NULL,
+  at         TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_org_desk_notices_agent ON org_desk_notices(project_id, org_id, agent_id);
+`;
+
+// src/db/database.ts
+var sqlite = process.getBuiltinModule("node:sqlite");
+function openExistingDatabase(dbPath) {
+  const db = new sqlite.DatabaseSync(dbPath);
+  db.exec("PRAGMA foreign_keys = ON;");
+  db.exec("PRAGMA busy_timeout = 5000;");
+  return db;
+}
+function openDatabaseReadOnly(dbPath) {
+  const db = new sqlite.DatabaseSync(dbPath, { readOnly: true });
+  db.exec("PRAGMA busy_timeout = 5000;");
+  return db;
+}
+function openDatabase(dbPath) {
+  if (dbPath !== ":memory:") {
+    mkdirSync(path.dirname(dbPath), { recursive: true });
+  }
+  const db = new sqlite.DatabaseSync(dbPath);
+  db.exec("PRAGMA journal_mode = WAL;");
+  db.exec("PRAGMA busy_timeout = 5000;");
+  db.exec("PRAGMA foreign_keys = ON;");
+  db.exec(SCHEMA_SQL);
+  ensureColumn(db, "sessions", "client", "TEXT");
+  ensureColumn(db, "sessions", "has_trace", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn(db, "sessions", "fork_count", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn(db, "sessions", "thinking_level", "TEXT");
+  ensureColumn(db, "sessions", "sandbox", "TEXT");
+  ensureColumn(db, "auth_sessions", "via", "TEXT");
+  ensureColumn(db, "trace_files", "page_stats", "TEXT");
+  ensureColumn(db, "messaging_bindings", "line_per_message", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn(db, "messaging_bindings", "final_reply_only", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn(db, "messaging_bindings", "render_markdown", "INTEGER NOT NULL DEFAULT 1");
+  ensureColumn(db, "messaging_bindings", "last_inbound_message_id", "TEXT");
+  db.exec("DROP INDEX IF EXISTS idx_usage_session");
+  db.exec("DROP INDEX IF EXISTS idx_messaging_account");
+  upgradeLastActiveAt(db);
+  migrate(db);
+  return db;
+}
+function upgradeLastActiveAt(db) {
+  db.exec("BEGIN");
+  try {
+    if (ensureColumn(db, "sessions", "last_active_at", "TEXT")) {
+      db.exec(
+        `UPDATE sessions SET last_active_at = COALESCE(
+           (SELECT MAX(ts) FROM usage_records WHERE usage_records.session_id = sessions.session_id),
+           created_at
+         )`
+      );
+    }
+    db.exec("COMMIT");
+  } catch (err) {
+    db.exec("ROLLBACK");
+    throw err;
+  }
+}
+function ensureColumn(db, table, column, ddl) {
+  const cols = db.prepare(`PRAGMA table_info(${table})`).all();
+  if (cols.some((c) => c.name === column)) return false;
+  db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${ddl}`);
+  return true;
+}
+
+export {
+  migrate,
+  openExistingDatabase,
+  openDatabaseReadOnly,
+  openDatabase
+};
+//# sourceMappingURL=chunk-NVWAYYRX.js.map