@prismshadow/penguin-server 0.2.16 → 0.2.18

package/dist/chunk-3SFJKLQU.js

@@ -1,1016 +0,0 @@
-// src/db/database.ts
-import { mkdirSync } from "fs";
-import path from "path";
-
-// src/db/migrations.ts
-var MIGRATIONS = [
-  {
-    version: 1,
-    name: "messaging-bindings",
-    // Purely additive: one new table plus three indexes, no column of any existing table
-    // touched. A platform that rolls back to a predecessor without messaging simply never
-    // queries them.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS messaging_bindings (
-          session_id       TEXT NOT NULL,
-          channel          TEXT NOT NULL,
-          account_id       TEXT NOT NULL,
-          config_json      TEXT NOT NULL,
-          enabled          INTEGER NOT NULL DEFAULT 0,
-          line_per_message INTEGER NOT NULL DEFAULT 0,
-          last_chat_id     TEXT,
-          last_chat_is_direct INTEGER NOT NULL DEFAULT 1,
-          last_inbound_message_id TEXT,
-          created_at       TEXT NOT NULL,
-          updated_at       TEXT NOT NULL,
-          PRIMARY KEY (session_id, channel)
-        );
-        CREATE INDEX IF NOT EXISTS idx_messaging_by_account ON messaging_bindings(channel, account_id);
-        CREATE INDEX IF NOT EXISTS idx_auth_sessions_expires ON auth_sessions(expires_at);
-        CREATE INDEX IF NOT EXISTS idx_auth_sessions_user ON auth_sessions(user_id);
-      `);
-    },
-    // LOSES every messaging binding: the channel credentials, the enabled flag and the
-    // last-chat memory all live in the table this drops. The auth_sessions indexes are
-    // derived and cost nothing to lose.
-    down(db) {
-      db.exec(`
-        DROP INDEX IF EXISTS idx_auth_sessions_user;
-        DROP INDEX IF EXISTS idx_auth_sessions_expires;
-        DROP INDEX IF EXISTS idx_messaging_by_account;
-        DROP TABLE IF EXISTS messaging_bindings;
-      `);
-    }
-  },
-  {
-    version: 2,
-    name: "messaging-delivery-flags",
-    // Two columns with defaults on an existing table: a rollback to a predecessor that
-    // does not know them leaves them at their defaults and reads nothing.
-    swapSafe: true,
-    up(db) {
-      ensureColumn(db, "messaging_bindings", "final_reply_only", "INTEGER NOT NULL DEFAULT 0");
-      ensureColumn(db, "messaging_bindings", "render_markdown", "INTEGER NOT NULL DEFAULT 1");
-    },
-    // LOSES both delivery preferences on every binding; the bindings themselves survive.
-    // Dropped in reverse order for symmetry with `up`. Neither column is indexed, which is
-    // what lets SQLite drop them at all.
-    down(db) {
-      db.exec("ALTER TABLE messaging_bindings DROP COLUMN render_markdown");
-      db.exec("ALTER TABLE messaging_bindings DROP COLUMN final_reply_only");
-    }
-  },
-  {
-    version: 3,
-    name: "drop-goal-state",
-    // Narrowing: drops a table. A pushed platform rolled back to 0.2.9 mid-process would
-    // prepare its goal statements against a table that is gone (its declarative track only
-    // runs at the runtime's own open, never at a platform boot), so this is the first
-    // restart-only migration: refused on the swap path, applied by the runtime's open.
-    swapSafe: false,
-    up(db) {
-      db.exec(`
-        DROP INDEX IF EXISTS idx_goal_session;
-        DROP TABLE IF EXISTS goal_state;
-      `);
-    },
-    // Recreates the table exactly as 0.2.9 declared it — EMPTY. LOSES every goal run ever
-    // recorded (objective, status, budget, used, rounds per run): the rows only ever fed the
-    // banner of a finished goal, and a build with this migration reads the goal file instead.
-    down(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS goal_state (
-          id          INTEGER PRIMARY KEY AUTOINCREMENT,
-          session_id  TEXT NOT NULL,
-          project_id  TEXT NOT NULL,
-          agent_id    TEXT NOT NULL,
-          objective   TEXT NOT NULL,
-          status      TEXT NOT NULL,
-          budget      INTEGER NOT NULL,
-          used        INTEGER NOT NULL DEFAULT 0,
-          rounds      INTEGER NOT NULL DEFAULT 0,
-          created_at  TEXT NOT NULL,
-          updated_at  TEXT NOT NULL
-        );
-        CREATE INDEX IF NOT EXISTS idx_goal_session ON goal_state(session_id);
-      `);
-    }
-  },
-  {
-    version: 4,
-    name: "machines",
-    // Three new tables, nothing existing touched: a platform rolled back to one without
-    // machines never queries them. Swap-safe on its own; a database still behind
-    // drop-goal-state is refused whole by that one first, which is the rule.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS machine (
-          singleton  INTEGER PRIMARY KEY CHECK (singleton = 1),
-          machine_id TEXT NOT NULL
-        );
-        CREATE TABLE IF NOT EXISTS machines (
-          address      TEXT PRIMARY KEY,
-          machine_id   TEXT,
-          version      TEXT,
-          installed_at TEXT,
-          session_pid  INTEGER,
-          remote_port  INTEGER,
-          platform     TEXT
-        );
-        CREATE TABLE IF NOT EXISTS machine_project (
-          project_id TEXT PRIMARY KEY REFERENCES projects(project_id) ON DELETE CASCADE,
-          addresses  TEXT NOT NULL
-        );
-      `);
-    },
-    // LOSES this server's own machine id (every stored reference to it on other machines
-    // then points at nothing), what was installed where, the sessions held, and which
-    // machines each Project used.
-    down(db) {
-      db.exec(`
-        DROP TABLE IF EXISTS machine_project;
-        DROP TABLE IF EXISTS machines;
-        DROP TABLE IF EXISTS machine;
-      `);
-    }
-  },
-  {
-    version: 5,
-    name: "user-profile",
-    // Two nullable columns on `users`, no default and nothing existing rewritten: a platform
-    // rolled back to a predecessor that does not know them never selects or writes them, and
-    // every existing account simply reads NULL — no profile yet.
-    swapSafe: true,
-    up(db) {
-      ensureColumn(db, "users", "display_name", "TEXT");
-      ensureColumn(db, "users", "avatar", "TEXT");
-    },
-    // LOSES every stored nickname and avatar: both live entirely in the two columns this
-    // drops, and nothing else on disk holds a copy. Dropped in reverse order for symmetry
-    // with `up`; neither column is indexed, which is what lets SQLite drop them at all.
-    down(db) {
-      const cols = db.prepare("PRAGMA table_info(users)").all();
-      const has = (name) => cols.some((c) => c.name === name);
-      if (has("avatar")) db.exec("ALTER TABLE users DROP COLUMN avatar");
-      if (has("display_name")) db.exec("ALTER TABLE users DROP COLUMN display_name");
-    }
-  },
-  {
-    version: 6,
-    name: "company-mode-org-caches",
-    // Additive: seven new tables for company mode (organizations of Agents), no change to any
-    // existing table. Every row is either rebuildable from the organization's files (desks.toml,
-    // the tickets' Sessions headers, the calendar files, usage records) or a user's own read
-    // cursor; a predecessor build never touches them.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS org_sessions (      -- DERIVED CACHE (company mode): desk sessions, rebuilt from each organization's desks.toml (current + previous); trigger_hop is chat-chain accounting and reads 0 after a rebuild
-          session_id  TEXT PRIMARY KEY,
-          project_id  TEXT NOT NULL,
-          org_id      TEXT NOT NULL,
-          agent_id    TEXT NOT NULL,
-          current     INTEGER NOT NULL DEFAULT 1,
-          trigger_hop INTEGER NOT NULL DEFAULT 0
-        );
-        CREATE INDEX IF NOT EXISTS idx_org_sessions_org ON org_sessions(project_id, org_id);
-        CREATE TABLE IF NOT EXISTS org_ticket_sessions ( -- DERIVED CACHE (company mode): ticket <-> contributing session, rebuilt from each ticket's Sessions header
-          project_id  TEXT NOT NULL,
-          org_id      TEXT NOT NULL,
-          ticket_id   TEXT NOT NULL,
-          session_id  TEXT NOT NULL,
-          agent_id    TEXT NOT NULL,
-          trigger_hop INTEGER NOT NULL DEFAULT 0,
-          PRIMARY KEY (project_id, org_id, ticket_id, session_id)
-        );
-        CREATE INDEX IF NOT EXISTS idx_org_ticket_sessions_session ON org_ticket_sessions(session_id);
-        CREATE TABLE IF NOT EXISTS org_calendar_state ( -- calendar run state (company mode; the files are declarative intent), same rules as schedule_state
-          project_id     TEXT NOT NULL,
-          org_id         TEXT NOT NULL,
-          agent_id       TEXT NOT NULL,
-          name           TEXT NOT NULL,
-          start_at_ms    INTEGER NOT NULL,
-          def_hash       TEXT NOT NULL,
-          last_slot_ms   INTEGER,
-          last_fired_at  TEXT,
-          fired_once     INTEGER NOT NULL DEFAULT 0,
-          missed         INTEGER NOT NULL DEFAULT 0,
-          invalid_reason TEXT,
-          last_outcome   TEXT,
-          PRIMARY KEY (project_id, org_id, agent_id, name)
-        );
-        CREATE TABLE IF NOT EXISTS org_ticket_state (   -- DERIVED CACHE (company mode): the last (status, owner, blocked) seen per ticket, so a change is notified once; rebuilt silently from the ticket files
-          project_id  TEXT NOT NULL,
-          org_id      TEXT NOT NULL,
-          ticket_id   TEXT NOT NULL,
-          status      TEXT NOT NULL,
-          owner       TEXT NOT NULL DEFAULT '',
-          blocked     TEXT NOT NULL DEFAULT '',
-          blocked_by  TEXT NOT NULL DEFAULT '',
-          PRIMARY KEY (project_id, org_id, ticket_id)
-        );
-        CREATE TABLE IF NOT EXISTS org_chat_state (     -- DERIVED CACHE (company mode): tail-scan byte cursor per chat day file
-          project_id   TEXT NOT NULL,
-          org_id       TEXT NOT NULL,
-          date         TEXT NOT NULL,
-          offset_bytes INTEGER NOT NULL DEFAULT 0,
-          PRIMARY KEY (project_id, org_id, date)
-        );
-        CREATE TABLE IF NOT EXISTS org_chat_reads (     -- user data (company mode): each user's read cursor in an organization's chat
-          project_id   TEXT NOT NULL,
-          org_id       TEXT NOT NULL,
-          user_id      TEXT NOT NULL,
-          last_read_id TEXT NOT NULL,
-          PRIMARY KEY (project_id, org_id, user_id)
-        );
-        CREATE TABLE IF NOT EXISTS org_budget_state (   -- DERIVED CACHE (company mode): warn / pause marks per employee and period, recomputed from usage and the chart's budgets
-          project_id TEXT NOT NULL,
-          org_id     TEXT NOT NULL,
-          agent_id   TEXT NOT NULL,
-          period     TEXT NOT NULL,
-          warned_at  TEXT,
-          paused_at  TEXT,
-          PRIMARY KEY (project_id, org_id, agent_id, period)
-        );
-      `);
-    },
-    // Drops the seven tables. LOSES: chat read cursors (each user's "read up to here" marks) and
-    // the run marks that stop a calendar slot, a ticket change or a budget alert from firing
-    // twice — a build with this migration re-registers everything from the files, without
-    // backfilling missed slots, and users see every chat message as unread once.
-    down(db) {
-      db.exec(`
-        DROP INDEX IF EXISTS idx_org_ticket_sessions_session;
-        DROP INDEX IF EXISTS idx_org_sessions_org;
-        DROP TABLE IF EXISTS org_budget_state;
-        DROP TABLE IF EXISTS org_chat_reads;
-        DROP TABLE IF EXISTS org_chat_state;
-        DROP TABLE IF EXISTS org_ticket_state;
-        DROP TABLE IF EXISTS org_calendar_state;
-        DROP TABLE IF EXISTS org_ticket_sessions;
-        DROP TABLE IF EXISTS org_sessions;
-      `);
-    }
-  },
-  {
-    version: 7,
-    name: "company-mode-channels",
-    // The organization's single group chat became channels: a message lives in
-    // `channels/<channel_id>/<date>.jsonl`, so the tail-scan cursor and each user's read
-    // cursor are per channel. `org_chat_state` / `org_chat_reads` are dropped for
-    // `org_channel_state` / `org_channel_reads`: the tables are renamed and the channel
-    // belongs in the primary key, neither of which SQLite does in place. Nothing is carried
-    // over: company mode is unreleased, and every row was either rebuildable from the files
-    // (the scan cursor) or one pass of "everything looks unread" (the read cursor). A
-    // predecessor build reads neither table's shape, only its own writes, so this is
-    // swap-safe.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        DROP TABLE IF EXISTS org_chat_state;
-        DROP TABLE IF EXISTS org_chat_reads;
-        CREATE TABLE IF NOT EXISTS org_channel_state ( -- DERIVED CACHE (company mode): tail-scan byte cursor per channel and day file
-          project_id   TEXT NOT NULL,
-          org_id       TEXT NOT NULL,
-          channel_id   TEXT NOT NULL,
-          date         TEXT NOT NULL,
-          offset_bytes INTEGER NOT NULL DEFAULT 0,
-          PRIMARY KEY (project_id, org_id, channel_id, date)
-        );
-        CREATE TABLE IF NOT EXISTS org_channel_reads ( -- user data (company mode): each user's read cursor in one channel
-          project_id   TEXT NOT NULL,
-          org_id       TEXT NOT NULL,
-          channel_id   TEXT NOT NULL,
-          user_id      TEXT NOT NULL,
-          last_read_id TEXT NOT NULL,
-          PRIMARY KEY (project_id, org_id, channel_id, user_id)
-        );
-      `);
-    },
-    // Recreates the two tables under their old names, exactly as migration 6 declared them —
-    // EMPTY. LOSES every scan cursor (re-derived by the next pass, which republishes the
-    // messages it re-reads) and every read cursor (users see the recent days as unread once).
-    down(db) {
-      db.exec(`
-        DROP TABLE IF EXISTS org_channel_state;
-        DROP TABLE IF EXISTS org_channel_reads;
-        CREATE TABLE IF NOT EXISTS org_chat_state (     -- DERIVED CACHE (company mode): tail-scan byte cursor per chat day file
-          project_id   TEXT NOT NULL,
-          org_id       TEXT NOT NULL,
-          date         TEXT NOT NULL,
-          offset_bytes INTEGER NOT NULL DEFAULT 0,
-          PRIMARY KEY (project_id, org_id, date)
-        );
-        CREATE TABLE IF NOT EXISTS org_chat_reads ( -- user data (company mode): each user's read cursor in an organization's chat
-          project_id   TEXT NOT NULL,
-          org_id       TEXT NOT NULL,
-          user_id      TEXT NOT NULL,
-          last_read_id TEXT NOT NULL,
-          PRIMARY KEY (project_id, org_id, user_id)
-        );
-      `);
-    }
-  },
-  {
-    version: 8,
-    name: "company-mode-desk-notices",
-    // Additive: one new table and its index. A ticket change no longer starts a work run at
-    // the owner's desk; it is queued here and delivered inside the body of that employee's
-    // next calendar sweep. A predecessor build never reads the table, so a rollback survives
-    // it — with whatever rows are in it left undelivered.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS org_desk_notices (   -- DERIVED CACHE (company mode): ticket changes waiting for an employee's next calendar sweep; dropping it loses only the digests not delivered yet
-          seq        INTEGER PRIMARY KEY AUTOINCREMENT,
-          project_id TEXT NOT NULL,
-          org_id     TEXT NOT NULL,
-          agent_id   TEXT NOT NULL,
-          ticket_id  TEXT NOT NULL,
-          change     TEXT NOT NULL,
-          at         TEXT NOT NULL
-        );
-        CREATE INDEX IF NOT EXISTS idx_org_desk_notices_agent ON org_desk_notices(project_id, org_id, agent_id);
-      `);
-    },
-    // LOSES every queued notice: the ticket changes an employee has not been told about yet.
-    // The change itself is in the ticket file and its history either way; what
-    // goes is the "Since your last sweep" line that would have named it.
-    down(db) {
-      db.exec(`
-        DROP INDEX IF EXISTS idx_org_desk_notices_agent;
-        DROP TABLE IF EXISTS org_desk_notices;
-      `);
-    }
-  },
-  {
-    version: 9,
-    name: "model-promotions",
-    // Additive: one new table, nothing existing touched. A predecessor build never reads it
-    // and prices every row at the number in its Project file, so a rollback survives it.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS model_promotions ( -- NOT a cache rebuildable from files: the only record of a Project row's running promotion (.project_config.toml keeps the list price), written by preset seeding at Project creation, "sync presets" and Penguin Go authorization / sync, and read by cost; lost rows price usage at list until the next sync writes them back
-          project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
-          provider   TEXT NOT NULL,
-          model_id   TEXT NOT NULL,
-          discount   REAL NOT NULL CHECK (discount > 0 AND discount < 1),
-          updated_at TEXT NOT NULL,
-          PRIMARY KEY (project_id, provider, model_id)
-        );
-      `);
-    },
-    // LOSES every stored promotion: no file holds a copy of the fractions, so usage is priced
-    // at the Project files' list prices until the next "sync presets" or Penguin Go sync
-    // writes them back.
-    down(db) {
-      db.exec("DROP TABLE IF EXISTS model_promotions");
-    }
-  },
-  {
-    version: 10,
-    name: "model-provider-auth-tokens",
-    // Additive: one new table, nothing existing touched. A predecessor build never reads it;
-    // the access token already written into .project_config.toml keeps working until it
-    // expires, so rollback only loses silent refresh state.
-    // KEEP until every supported upgrade starts from schema 10 or newer. The release that
-    // raises the minimum database baseline past 9 owns removing this migration block and its
-    // version-9 fixture; the table itself remains while provider token refresh uses it.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS model_provider_auth_tokens ( -- Server-side OAuth refresh metadata for provider groups. The current request token remains in .project_config.toml as api_key; this table holds only the refresh material that must never be returned to the frontend or written into Project files.
-          project_id              TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
-          provider                TEXT NOT NULL,
-          refresh_token           TEXT NOT NULL,
-          access_token_expires_at TEXT,
-          updated_at              TEXT NOT NULL,
-          PRIMARY KEY (project_id, provider)
-        );
-      `);
-    },
-    // LOSES every stored refresh token and access-token expiry. Existing access tokens in
-    // Project files remain until they expire; users re-authorize to restore silent refresh.
-    down(db) {
-      db.exec("DROP TABLE IF EXISTS model_provider_auth_tokens");
-    }
-  },
-  {
-    version: 11,
-    name: "sessions-sandbox",
-    // The Session's own sandbox policy (JSON), snapshotted from the server's settings when
-    // the Session is created, so a later settings change leaves running Sessions alone.
-    // NULL = a row from before this column: it takes the settings in force at its next
-    // command and keeps them from then on. Swap-safe: a pushed platform boots against the
-    // runtime's already-open database, so the column has to arrive by a migration.
-    swapSafe: true,
-    up(db) {
-      ensureColumn(db, "sessions", "sandbox", "TEXT");
-    },
-    // Not a DROP: schema.ts declares the column, and dropping it would put every Session
-    // back under whatever the settings say.
-    down() {
-    }
-  },
-  {
-    version: 12,
-    name: "machines-columns",
-    // A machines table can predate migration 4 — a data root that ran the machines line
-    // before it was released kept forwards, not sessions — and that migration's IF NOT
-    // EXISTS adopted it whatever its columns were, so the first connect failed on the row's
-    // insert. Adds what is missing, nullable; a platform rolled back to 4 declared these
-    // columns itself, so there is nothing for it to mind.
-    swapSafe: true,
-    up(db) {
-      ensureColumn(db, "machines", "session_pid", "INTEGER");
-      ensureColumn(db, "machines", "platform", "TEXT");
-    },
-    // Nothing to undo: what this added, 4 already declares, and a column it found in place
-    // was never this migration's to take away.
-    down() {
-    }
-  },
-  {
-    version: 13,
-    name: "browser-extensions",
-    // Additive: one new table and its index. The Chrome backend's pairings — one row per
-    // PenguinHarness Browser extension a user paired, its token stored hashed. A predecessor
-    // build never reads the table, so a rollback survives it; the paired extensions then simply
-    // fail to connect until a build that knows them is back.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS browser_extensions ( -- one row per Chrome paired to a user (builtin-browser/extension-pairing.ts): the PenguinHarness Browser extension's long-lived credential, stored only hashed; NOT rebuildable \u2014 a lost row means pairing that Chrome again
-          extension_id TEXT PRIMARY KEY,
-          user_id      TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
-          token_hash   TEXT NOT NULL UNIQUE,
-          name         TEXT NOT NULL,
-          version      TEXT NOT NULL,
-          created_at   TEXT NOT NULL,
-          last_seen_at TEXT,
-          revoked_at   TEXT
-        );
-        CREATE INDEX IF NOT EXISTS idx_browser_extensions_user ON browser_extensions(user_id);
-      `);
-    },
-    // LOSES every pairing: each user's Chrome has to be paired again (a new code from the
-    // Browser panel) before agents can drive it.
-    down(db) {
-      db.exec(`
-        DROP INDEX IF EXISTS idx_browser_extensions_user;
-        DROP TABLE IF EXISTS browser_extensions;
-      `);
-    }
-  },
-  {
-    version: 14,
-    name: "agent-api",
-    // Additive: two new tables and an index. The Agent API's per-Agent settings (the switch,
-    // keyless access, the approval mode API Sessions are created with) and its keys, stored
-    // hashed. A predecessor build never reads them and serves no /api/amsp route, so a
-    // rollback survives it: callers get 404 until a build that knows the tables is back.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS agent_api (          -- per-Agent public API settings (amsp/routes.ts); NOT rebuildable from files
-          project_id    TEXT NOT NULL,
-          agent_id      TEXT NOT NULL,
-          enabled       INTEGER NOT NULL DEFAULT 0,
-          open          INTEGER NOT NULL DEFAULT 0,
-          approval_mode TEXT NOT NULL DEFAULT 'allow-all',
-          updated_at    TEXT NOT NULL,
-          PRIMARY KEY (project_id, agent_id)
-        );
-        CREATE TABLE IF NOT EXISTS agent_api_keys (     -- one row per key the API tab or the CLI minted; the caller alone holds the key
-          key_id       TEXT PRIMARY KEY,
-          project_id   TEXT NOT NULL,
-          agent_id     TEXT NOT NULL,
-          token_hash   TEXT NOT NULL UNIQUE,
-          prefix       TEXT NOT NULL,
-          name         TEXT NOT NULL,
-          created_by   TEXT NOT NULL REFERENCES users(user_id),
-          created_at   TEXT NOT NULL,
-          last_used_at TEXT
-        );
-        CREATE INDEX IF NOT EXISTS idx_agent_api_keys_agent ON agent_api_keys(project_id, agent_id);
-      `);
-    },
-    // LOSES every Agent's API settings and every key: each exposed Agent reads as disabled
-    // again (404 to its callers), and every caller needs a newly created key once it is back
-    // on — no file holds a copy of either.
-    down(db) {
-      db.exec(`
-        DROP INDEX IF EXISTS idx_agent_api_keys_agent;
-        DROP TABLE IF EXISTS agent_api_keys;
-        DROP TABLE IF EXISTS agent_api;
-      `);
-    }
-  },
-  {
-    version: 15,
-    name: "messaging-conversations",
-    // Additive: one new table. The WeChat connector's per-(bot, user) delivery state — the
-    // context token every send must echo, how many sends it has funded, and replies held for
-    // the user's next message. A predecessor build never reads it and keeps its tokens in
-    // memory as it always did, so a rollback survives it.
-    swapSafe: true,
-    up(db) {
-      db.exec(`
-        CREATE TABLE IF NOT EXISTS messaging_conversations ( -- per-(bot, chat) delivery state a connector must keep across reconnects and restarts (WeChat: the context token, its send count, held replies); deleted once no messaging_bindings row references (channel, account_id) \u2014 see MessagingBindingsRepo
-          channel    TEXT NOT NULL,
-          account_id TEXT NOT NULL,
-          chat_id    TEXT NOT NULL,
-          state_json TEXT NOT NULL,
-          updated_at TEXT NOT NULL,
-          PRIMARY KEY (channel, account_id, chat_id)
-        );
-      `);
-    },
-    // LOSES every stored context token and every held reply: replies sent before each user's
-    // next message are refused again, and what was held never arrives.
-    down(db) {
-      db.exec("DROP TABLE IF EXISTS messaging_conversations");
-    }
-  },
-  {
-    version: 16,
-    name: "sessions-kept-at",
-    // The "keep in sidebar" mark: written when the user unarchives a Session, cleared when they
-    // archive it. The listing rule files a background Session (api / schedule / cli) away unless
-    // it carries the mark, so existing rows are listed by the rule as they stand and nothing is
-    // rewritten. Swap-safe: a pushed platform boots against the runtime's already-open database,
-    // so the column has to arrive by a migration.
-    swapSafe: true,
-    up(db) {
-      ensureColumn(db, "sessions", "kept_at", "TEXT");
-    },
-    // Not a DROP: schema.ts declares the column, and dropping it would file every kept
-    // background Session away again.
-    down() {
-    }
-  },
-  {
-    version: 17,
-    name: "agent-api-session-settings",
-    // Retain until the minimum supported database version exceeds 16; the maintainer raising
-    // that baseline removes this upgrade after all supported data roots have these columns.
-    // Nullable additions preserve existing keys, exposure, approvals and new-Session defaults.
-    swapSafe: true,
-    up(db) {
-      ensureColumn(db, "agent_api", "provider", "TEXT");
-      ensureColumn(db, "agent_api", "model_id", "TEXT");
-      ensureColumn(db, "agent_api", "thinking_level", "TEXT");
-      ensureColumn(db, "agent_api", "workspace", "TEXT");
-    },
-    // Keep the saved defaults on rollback; older builds ignore the additional columns.
-    down() {
-    }
-  },
-  {
-    version: 18,
-    name: "agent-api-concurrency",
-    // Retain until the minimum supported database version exceeds 17. The maintainer raising
-    // that baseline removes this upgrade once every supported data root has the column.
-    swapSafe: true,
-    up(db) {
-      ensureColumn(db, "agent_api", "max_concurrent_runs", "INTEGER NOT NULL DEFAULT 4");
-    },
-    // Keep the configured limit on rollback; older builds ignore this column.
-    down() {
-    }
-  }
-];
-var LATEST_VERSION = MIGRATIONS.reduce((n, m) => Math.max(n, m.version), 0);
-function schemaVersion(db) {
-  const row = db.prepare("PRAGMA user_version").get();
-  return row?.user_version ?? 0;
-}
-var RestartRequiredError = class extends Error {
-  constructor(migration) {
-    super(
-      `migration ${migration.version} (${migration.name}) is restart-only and cannot be applied while a pushed platform boots: it is not safe to leave behind if this boot is rolled back. Restart the runtime on a build that carries it, then push again.`
-    );
-    this.migration = migration;
-    this.name = "RestartRequiredError";
-  }
-  migration;
-};
-function migrate(db, { swapPath = false } = {}) {
-  const from = schemaVersion(db);
-  const pending = [...MIGRATIONS].sort((a, b) => a.version - b.version).filter((m) => m.version > from);
-  if (swapPath) {
-    const blocked = pending.find((m) => !m.swapSafe);
-    if (blocked) throw new RestartRequiredError(blocked);
-  }
-  const applied = [];
-  for (const m of pending) {
-    db.exec("BEGIN");
-    try {
-      m.up(db);
-      db.exec(`PRAGMA user_version = ${m.version}`);
-      db.exec("COMMIT");
-    } catch (err) {
-      db.exec("ROLLBACK");
-      throw new Error(`migration ${m.version} (${m.name}) failed: ${String(err)}`, { cause: err });
-    }
-    applied.push(m.name);
-  }
-  return { from, to: schemaVersion(db), applied };
-}
-
-// src/db/schema.ts
-var MODEL_PROMOTIONS_SQL = `
-CREATE TABLE IF NOT EXISTS model_promotions ( -- NOT a cache rebuildable from files: the only record of a Project row's running promotion (.project_config.toml keeps the list price), written by preset seeding at Project creation, "sync presets" and Penguin Go authorization / sync, and read by cost; lost rows price usage at list until the next sync writes them back
-  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
-  provider   TEXT NOT NULL,
-  model_id   TEXT NOT NULL,
-  discount   REAL NOT NULL CHECK (discount > 0 AND discount < 1),  -- fraction off the row's list price: billed = list \xD7 (1 \u2212 discount)
-  updated_at TEXT NOT NULL,
-  PRIMARY KEY (project_id, provider, model_id)
-);`;
-var MODEL_PROVIDER_AUTH_TOKENS_SQL = `
-CREATE TABLE IF NOT EXISTS model_provider_auth_tokens ( -- Server-side OAuth refresh metadata for provider groups. The current request token remains in .project_config.toml as api_key; this table holds only the refresh material that must never be returned to the frontend or written into Project files.
-  project_id              TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
-  provider                TEXT NOT NULL,
-  refresh_token           TEXT NOT NULL,
-  access_token_expires_at TEXT,
-  updated_at              TEXT NOT NULL,
-  PRIMARY KEY (project_id, provider)
-);`;
-var SCHEMA_SQL = `
-CREATE TABLE IF NOT EXISTS users (
-  user_id             TEXT PRIMARY KEY,            -- semantic id doubles as login name: ^[a-z][a-z0-9_-]{1,31}$
-  password_hash       TEXT NOT NULL,               -- scrypt$N$r$p$salt$hash(base64)
-  is_admin            INTEGER NOT NULL DEFAULT 0,  -- 1 for the built-in admin (seeded at startup)
-  password_is_initial INTEGER NOT NULL DEFAULT 0,  -- 1=initial password (seeded/admin-set); cleared once the user changes it
-  display_name        TEXT,                        -- nickname shown in place of user_id (1-32 characters); NULL = never set, surfaces show the id
-  avatar              TEXT,                        -- avatar as a data URL (image/png|jpeg|webp, <= 131072 characters); NULL = never set, surfaces draw the letter placeholder
-  created_at          TEXT NOT NULL
-);
--- Server-side sessions backing the HttpOnly cookie: the cookie carries a 32-byte random
--- token, the row stores only its sha256. A session outlives a restart (it is on disk), which
--- is why the model is a row and not a signed statement.
-CREATE TABLE IF NOT EXISTS auth_sessions (
-  token_hash TEXT PRIMARY KEY,               -- sha256(token) hex; the cookie stores only the raw token
-  user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
-  created_at TEXT NOT NULL,
-  expires_at TEXT NOT NULL,                  -- 30-day sliding renewal, topped up in place when <29 days remain
-  via        TEXT                            -- 'password'|'desktop'|'setup'|'cli'|'remote'; NULL = legacy (password)
-);
--- deleteExpired runs on every login and mint, deleteByUser on every admin reset; without
--- these both scan the whole table.
-CREATE INDEX IF NOT EXISTS idx_auth_sessions_expires ON auth_sessions(expires_at);
-CREATE INDEX IF NOT EXISTS idx_auth_sessions_user ON auth_sessions(user_id);
-
-CREATE TABLE IF NOT EXISTS projects (
-  project_id    TEXT PRIMARY KEY,            -- directory name doubles as id; display name lives in project_config.toml
-  owner_user_id TEXT NOT NULL REFERENCES users(user_id),
-  created_at    TEXT NOT NULL
-);
-CREATE TABLE IF NOT EXISTS project_members (  -- member grants only; owners are not stored here
-  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
-  user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
-  created_at TEXT NOT NULL,
-  PRIMARY KEY (project_id, user_id)
-);
-${MODEL_PROMOTIONS_SQL}
-${MODEL_PROVIDER_AUTH_TOKENS_SQL}
-CREATE TABLE IF NOT EXISTS agents (           -- index only; name/description live in system_config.yaml
-  project_id TEXT NOT NULL,
-  agent_id   TEXT NOT NULL,
-  created_at TEXT NOT NULL,
-  PRIMARY KEY (project_id, agent_id)
-);
-CREATE TABLE IF NOT EXISTS sessions (
-  session_id    TEXT PRIMARY KEY,
-  project_id    TEXT NOT NULL,
-  agent_id      TEXT NOT NULL,
-  provider      TEXT NOT NULL,                     -- provider group of the session's CURRENT model (paired with model_id as a model reference; moves with each in-session switch)
-  model_id      TEXT NOT NULL,                     -- upstream model id of the current model (sent to MMSP as-is; never concatenate <provider>/<id>)
-  workspace     TEXT NOT NULL,
-  approval_mode TEXT NOT NULL DEFAULT 'allow-all',   -- allow-all|deny-all|read-only|always-ask
-  thinking_level TEXT,                               -- level pinned for THIS session (none|low|medium|high|xhigh|max); NULL=not pinned, runs follow the Agent config
-  title         TEXT,                                -- auto-generated by the model after the first exchange; NULL=not yet (frontend shows "New chat")
-  archived_at   TEXT,                                -- the user archived it (ISO time); NULL = not archived by hand (the listing rule may still file it away)
-  kept_at       TEXT,                                -- "keep in sidebar": set when the user unarchives, cleared when they archive; NULL = the listing rule decides (a background source is archived, a user Session is active). Never written by a run.
-  client        TEXT,                                -- creating client: 'web' (created via the Web App) | 'cli' (adopted from a CLI Trace) | 'org' (company mode) | 'api' (an Agent API run); NULL = legacy row, treated as web
-  has_trace     INTEGER NOT NULL DEFAULT 0,          -- cache: a Trace record exists (set at task start / adoption / subagent registration; lazily backfilled by list hydration)
-  fork_count    INTEGER NOT NULL DEFAULT 0,          -- monotonically allocated child-fork number for this source Session; never decremented when a fork is deleted
-  sandbox       TEXT,                                -- the Session's sandbox policy snapshot (JSON SandboxSettings); NULL = legacy row, snapshotted at its next command
-  last_active_at TEXT,                               -- last activity this server drove for the session (ISO; stamped once when a run starts and once when it ends, initialized to created_at); monotonic, never moves backwards; NULL only before openDatabase's one-time backfill
-  created_at    TEXT NOT NULL
-);                                            -- the Session's SOURCE (user/api/schedule/subagent/cli/company) is NOT stored: session_meta in the Trace is the single source of truth (see runtime/session-sources.ts); "client" is a different, DB-only axis (who created the row), read for the source only where the Trace records none ('org' \u2192 company)
-CREATE INDEX IF NOT EXISTS idx_sessions_agent_created ON sessions(project_id, agent_id, created_at DESC);
-CREATE TABLE IF NOT EXISTS usage_records (
-  id                INTEGER PRIMARY KEY AUTOINCREMENT,
-  ts                TEXT NOT NULL,
-  date              TEXT NOT NULL,            -- local date yyyy-mm-dd (aggregation key; same convention as Trace date directories)
-  project_id        TEXT NOT NULL,
-  agent_id          TEXT NOT NULL,
-  session_id        TEXT NOT NULL,            -- top-level Session (child-session usage counts toward its main Session)
-  origin_session_id TEXT,                     -- immediate source child Session (last of the origin chain); NULL=main session
-  provider          TEXT NOT NULL,            -- provider group: paired with model_id as the attribution key; always GROUP BY provider, model_id
-  model_id          TEXT NOT NULL,            -- upstream model id (paired with provider; same model_id across providers aggregates separately)
-  cache_read        INTEGER NOT NULL,
-  cache_write       INTEGER NOT NULL,
-  output            INTEGER NOT NULL,
-  total             INTEGER NOT NULL,         -- from token_usage.request (one row per Request)
-  status            TEXT NOT NULL DEFAULT 'completed'  -- request outcome: completed=success (with tokens); others=failure (0 tokens, for success rate)
-);                                            -- cost is not stored: computed at query time from current pricing
-CREATE INDEX IF NOT EXISTS idx_usage_project_date ON usage_records(project_id, date);
-CREATE INDEX IF NOT EXISTS idx_usage_session_ts ON usage_records(session_id, ts);  -- (session_id) alone was idx_usage_session (dropped on open): ts makes the last_active_at backfill's MAX(ts) a covering index scan instead of a random row lookup per usage record
-CREATE TABLE IF NOT EXISTS error_records (     -- server-side error capture (the Costs page's "Errors" tab)
-  id         INTEGER PRIMARY KEY AUTOINCREMENT,
-  ts         TEXT NOT NULL,
-  date       TEXT NOT NULL,            -- local date yyyy-mm-dd (same convention as usage_records)
-  project_id TEXT,                     -- nullable: sign-in/registration and process-level errors have no Project context
-  agent_id   TEXT,
-  session_id TEXT,
-  source     TEXT NOT NULL,            -- http | session | usage | title | subagent | process | llm | environment | compaction | schedule | messaging | organization | id_suggest | plugin
-  kind       TEXT NOT NULL,            -- expected (HttpError, business 4xx) | unexpected (500/runtime)
-  code       TEXT NOT NULL,            -- HttpError.code / internal / session_run_failed / ...
-  status     INTEGER,                  -- HTTP status code; NULL for non-HTTP sources
-  message    TEXT NOT NULL             -- truncated to 500 chars (no stack stored: stacks go to logs only)
-);
-CREATE INDEX IF NOT EXISTS idx_error_project_date ON error_records(project_id, date);
-CREATE TABLE IF NOT EXISTS schedule_state (    -- schedule runtime state (files are declarative intent; the system never writes back)
-  project_id      TEXT NOT NULL,
-  agent_id        TEXT NOT NULL,
-  name            TEXT NOT NULL,               -- file name (without .toml) doubles as the identifier
-  creator_user_id TEXT,                        -- creator (recorded on API create; hand-edited file reconciliation falls back to the Project owner)
-  start_at_ms     INTEGER NOT NULL,            -- defines identity: a start_at change counts as a new task instance, resetting fire state
-  def_hash        TEXT NOT NULL,               -- file content fingerprint: any change clears the invalid flag (the file takes effect again after edits)
-  last_slot_ms    INTEGER,                     -- latest due slot already consumed (advances on fire or skip; no re-fire across restarts)
-  last_fired_at   TEXT,                        -- last actual fire time (for display)
-  fired_once      INTEGER NOT NULL DEFAULT 0,  -- one-shot task has fired
-  missed          INTEGER NOT NULL DEFAULT 0,  -- one-shot task was missed (flagged by startup/registration reconciliation; not backfilled)
-  invalid_reason  TEXT,                        -- invalidation reason (e.g. the bound Session was deleted); NULL=healthy
-  PRIMARY KEY (project_id, agent_id, name)
-);
-CREATE TABLE IF NOT EXISTS messaging_bindings ( -- Session \u2194 messaging-channel bot bindings (runtime/messaging/ holds the long connections)
-  session_id       TEXT NOT NULL,              -- a Session keeps at most one saved config PER channel (composite PK below); at most ONE of them is enabled at a time (route-enforced, 409 another_channel_enabled), and enabling is what binds the account to this Session
-  channel          TEXT NOT NULL,              -- messaging channel discriminator ('feishu' | 'telegram' | 'qq' | 'wechat')
-  account_id       TEXT NOT NULL,              -- channel-scoped bot/app identity (feishu: app_id; telegram: the bot token's numeric id; qq: the bot's App ID; wechat: the scanned bot id); NOT unique \u2014 any number of Sessions may keep the same account saved side by side, each with its own config and last-chat memory; only ENABLING is exclusive (route-enforced, 409 account_enabled_elsewhere: one account has one event stream, two live connections on it would race)
-  config_json      TEXT NOT NULL,              -- channel-specific credentials/config JSON (feishu: appId/appSecret/baseDomain; telegram: botToken; qq: appId/appSecret; wechat: botId/botToken/baseUrl/userId); secrets plaintext at rest (same trade-off as the proxy address in server_settings), masked at every API surface; a cleared secret is stored as "" (the row and its account identity stay)
-  enabled          INTEGER NOT NULL DEFAULT 0, -- INTENT state (the connection's runtime status stays in memory): new bindings start disabled \u2014 saving credentials never opens a connection, the explicit state toggle does
-  line_per_message INTEGER NOT NULL DEFAULT 0, -- delivery preference: 1 = every non-blank line of a relayed assistant reply is sent as its own message (a reply written as spoken lines arrives as spoken lines), 0 = one message per reply. Channel-agnostic, so it lives here rather than in config_json, which each connector owns
-  final_reply_only INTEGER NOT NULL DEFAULT 0, -- delivery preference: 1 = a run's intermediate assistant messages are held and only its LAST completed one is sent, at the run's end, 0 = every completed assistant message mirrors the moment it completes. Channel-agnostic like the column above and independent of it: with both set, that one final text is the one split per line
-  render_markdown  INTEGER NOT NULL DEFAULT 1, -- delivery preference: 1 = a relayed reply's Markdown is rendered in the channel's own markup (Telegram HTML, a Feishu card, QQ markdown, the subset WeChat itself reads), 0 = the reply's characters are sent as written. DEFAULT 1 because the model writes Markdown and showing it raw was the defect; the per-channel subsets and the plain-text fallback live in the connectors
-  last_chat_id     TEXT,                       -- most recent inbound chat (NULL until the bot is messaged once; replies and test messages target it); CONNECTOR-OPAQUE, not necessarily a bare chat id \u2014 telegram appends the forum topic (see telegram-connector.ts chatRefOf), so only that channel's connector may interpret it
-  last_chat_is_direct INTEGER NOT NULL DEFAULT 1, -- 1 = direct chat (reply by chat id), 0 = group chat (prefer reply-to-message)
-  last_inbound_message_id TEXT,                 -- channel id of the most recently PROCESSED inbound message (NULL until one arrives); the durable half of the bridge's redelivery guard, so a channel replaying an event this server already turned into a Task after a restart does not run it twice
-  created_at       TEXT NOT NULL,
-  updated_at       TEXT NOT NULL,
-  PRIMARY KEY (session_id, channel)
-);
-CREATE INDEX IF NOT EXISTS idx_messaging_by_account ON messaging_bindings(channel, account_id);  -- serves the enable guard's by-account lookup; deliberately NOT unique, unlike its predecessor idx_messaging_account (dropped on open) which made an account exclusive to one Session forever
-CREATE TABLE IF NOT EXISTS messaging_conversations ( -- per-(bot, chat) delivery state a connector must keep across reconnects and restarts (WeChat: the context token, its send count, held replies); deleted once no messaging_bindings row references (channel, account_id) \u2014 see MessagingBindingsRepo
-  channel    TEXT NOT NULL,                     -- messaging channel discriminator (only 'wechat' writes rows today)
-  account_id TEXT NOT NULL,                     -- the bot, as messaging_bindings.account_id names it
-  chat_id    TEXT NOT NULL,                     -- the connector's own chat id (wechat: the user's ilink_user_id)
-  state_json TEXT NOT NULL,                     -- connector-owned JSON (wechat: {contextToken, tokenAt, spent, held, heldSince}); the token is a conversation handle at rest, same trade-off as config_json's credentials
-  updated_at TEXT NOT NULL,
-  PRIMARY KEY (channel, account_id, chat_id)
-);
-CREATE TABLE IF NOT EXISTS ui_prefs (
-  user_id    TEXT PRIMARY KEY REFERENCES users(user_id) ON DELETE CASCADE,
-  prefs_json TEXT NOT NULL                    -- {theme?, lastProjectId?, ...} free-form JSON
-);
-CREATE TABLE IF NOT EXISTS browser_extensions ( -- one row per Chrome paired to a user (builtin-browser/extension-pairing.ts): the PenguinHarness Browser extension's long-lived credential, stored only hashed; NOT rebuildable \u2014 a lost row means pairing that Chrome again
-  extension_id TEXT PRIMARY KEY,              -- random id shown in the Web App's list
-  user_id      TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
-  token_hash   TEXT NOT NULL UNIQUE,          -- sha256(token) hex; the extension alone holds the token
-  name         TEXT NOT NULL,                 -- how the extension names this Chrome ("Chrome 130 on macOS")
-  version      TEXT NOT NULL,                 -- the extension's version, as of its last hello
-  created_at   TEXT NOT NULL,
-  last_seen_at TEXT,                          -- last connect or disconnect; NULL = never connected
-  revoked_at   TEXT                           -- set by Revoke; a revoked token's socket is closed 4003
-);
-CREATE INDEX IF NOT EXISTS idx_browser_extensions_user ON browser_extensions(user_id);
-CREATE TABLE IF NOT EXISTS agent_api (          -- per-Agent public API settings (amsp/routes.ts); NOT rebuildable from files
-  project_id    TEXT NOT NULL,
-  agent_id      TEXT NOT NULL,
-  enabled       INTEGER NOT NULL DEFAULT 0,     -- the API tab's switch; off = every /api/amsp request for it is 404 agent_not_found
-  open          INTEGER NOT NULL DEFAULT 0,     -- keyless access: a request without Authorization is accepted; off = 401 unauthorized
-  approval_mode TEXT NOT NULL DEFAULT 'allow-all', -- copied onto each new API Session
-  provider      TEXT,                         -- NULL pair follows the Project default model
-  model_id      TEXT,
-  thinking_level TEXT,                        -- NULL follows Agent/Project configuration
-  workspace     TEXT,                         -- NULL creates a temporary Workspace
-  max_concurrent_runs INTEGER NOT NULL DEFAULT 4,
-  updated_at    TEXT NOT NULL,
-  PRIMARY KEY (project_id, agent_id)
-);
-CREATE TABLE IF NOT EXISTS agent_api_keys (     -- one row per key the API tab or the CLI minted; the caller alone holds the key
-  key_id       TEXT PRIMARY KEY,                -- 16 base64url chars, shown in the list
-  project_id   TEXT NOT NULL,
-  agent_id     TEXT NOT NULL,
-  token_hash   TEXT NOT NULL UNIQUE,            -- sha256(key) hex
-  prefix       TEXT NOT NULL,                   -- the key's first 16 characters ("penguin_" + 8), shown in the list
-  name         TEXT NOT NULL,                   -- 1-64 characters
-  created_by   TEXT NOT NULL REFERENCES users(user_id),
-  created_at   TEXT NOT NULL,
-  last_used_at TEXT                             -- stamped once per run request that authenticated with it; NULL = never
-);
-CREATE INDEX IF NOT EXISTS idx_agent_api_keys_agent ON agent_api_keys(project_id, agent_id);
-CREATE TABLE IF NOT EXISTS server_settings (   -- admin-level server-global settings (GET/PUT /api/admin/settings)
-  key   TEXT PRIMARY KEY,                     -- setting name, e.g. 'proxy_for_app'
-  value TEXT NOT NULL                         -- JSON-encoded value; an absent row means the setting's built-in default
-);
-CREATE TABLE IF NOT EXISTS machine (           -- this server's OWN identity, minted here and never assigned from outside (what 'penguin server status' reports)
-  singleton  INTEGER PRIMARY KEY CHECK (singleton = 1),  -- exactly one row, enforced by the schema rather than by convention
-  machine_id TEXT NOT NULL                    -- 16 base64url characters; what every stored reference to this machine points at
-);
-CREATE TABLE IF NOT EXISTS machines (          -- one row per machine this server installed on or reached (machines/service.ts)
-  address      TEXT PRIMARY KEY,               -- 'ssh:<alias>'
-  machine_id   TEXT,                           -- that machine's own id, once heard
-  version      TEXT,                           -- what this server last installed there; NULL = never
-  installed_at TEXT,
-  session_pid  INTEGER,                        -- the ssh session this server holds to it; what a successor App closes after a hot swap
-  remote_port  INTEGER,                        -- its server's port over there, as of the last connect
-  platform     TEXT                            -- linux | darwin | win32, as the install found it: the shell dialect the status probe speaks to it in
-);
-CREATE TABLE IF NOT EXISTS machine_project (   -- which machines a Project uses; no row = none yet. Follows the Project out, like project_members
-  project_id TEXT PRIMARY KEY REFERENCES projects(project_id) ON DELETE CASCADE,
-  addresses  TEXT NOT NULL                     -- JSON array of 'ssh:<alias>'
-);
-CREATE TABLE IF NOT EXISTS trace_files (       -- DERIVED CACHE of the on-disk Trace tree (services/trace-index.ts): the directories stay the single source of truth, every row is rebuildable from disk, and a row is never authority for absence \u2014 consumers reconcile + retry on a miss, so a stale index costs one extra scan, never a false 404
-  project_id TEXT NOT NULL,
-  agent_id   TEXT NOT NULL,
-  session_id TEXT NOT NULL,
-  file_index INTEGER NOT NULL,               -- shard index NNN of <session_id>_NNN.jsonl (name/path are reconstructed from the row, never stored: the data root may move)
-  date       TEXT NOT NULL,                  -- date directory name (local yyyy-mm-dd)
-  size_bytes INTEGER NOT NULL,               -- last observed size (listings stat-refresh the returned page and write back; an actively-appended shard may lag in between)
-  page_stats TEXT,                           -- cached message-window scan state at this shard's END (services/message-window.ts ShardPrefixRecord JSON); immutable shards only, NULL = not yet computed, nulled whenever size_bytes changes
-  PRIMARY KEY (project_id, agent_id, session_id, file_index)
-);
-CREATE INDEX IF NOT EXISTS idx_trace_files_agent_date ON trace_files(project_id, agent_id, date);
-CREATE INDEX IF NOT EXISTS idx_trace_files_session ON trace_files(session_id);
-CREATE TABLE IF NOT EXISTS trace_sessions (    -- per-session facts read ONCE at registration from the earliest shard's head (same derived-cache rules as trace_files; listing needs zero head-reads)
-  session_id TEXT PRIMARY KEY,
-  project_id TEXT NOT NULL,
-  agent_id   TEXT NOT NULL,
-  source     TEXT,                           -- session_meta source as the head carried it: 'user' | 'api' | 'schedule' | 'subagent' | 'cli' | 'company'; NULL = the head records none (written before the source was required: read as 'company' for an 'org' row, else 'user' \u2014 readRecordedSource); 'benchmark' from older rows reads as 'cli' (normalizeSessionSource; meaningless while meta_read = 0)
-  workspace  TEXT NOT NULL DEFAULT '',
-  title      TEXT,                           -- first-prompt fallback title (sessions.title always wins when present)
-  provider   TEXT,                           -- model reference from session_meta: the model the Session was created on (CLI adoption reads it from here, and the runtime's own answer corrects the row at load; NULL = meta unreadable / legacy without provider)
-  model_id   TEXT,
-  first_ts   TEXT,                           -- first record's timestamp (adoption's createdAt fallback when the id embeds no time)
-  meta_read  INTEGER NOT NULL DEFAULT 0      -- 1 once the head parsed; 0 = facts unknown, retried by the next reconcile that touches the session
-);
-CREATE INDEX IF NOT EXISTS idx_trace_sessions_agent ON trace_sessions(project_id, agent_id);
-CREATE TABLE IF NOT EXISTS org_sessions (      -- DERIVED CACHE (company mode): desk sessions, rebuilt from each organization's desks.toml (current + previous); trigger_hop is mention-chain accounting and reads 0 after a rebuild
-  session_id  TEXT PRIMARY KEY,
-  project_id  TEXT NOT NULL,
-  org_id      TEXT NOT NULL,
-  agent_id    TEXT NOT NULL,
-  current     INTEGER NOT NULL DEFAULT 1,
-  trigger_hop INTEGER NOT NULL DEFAULT 0
-);
-CREATE INDEX IF NOT EXISTS idx_org_sessions_org ON org_sessions(project_id, org_id);
-CREATE TABLE IF NOT EXISTS org_ticket_sessions ( -- DERIVED CACHE (company mode): ticket <-> contributing session, rebuilt from each ticket's Sessions header
-  project_id  TEXT NOT NULL,
-  org_id      TEXT NOT NULL,
-  ticket_id   TEXT NOT NULL,
-  session_id  TEXT NOT NULL,
-  agent_id    TEXT NOT NULL,
-  trigger_hop INTEGER NOT NULL DEFAULT 0,
-  PRIMARY KEY (project_id, org_id, ticket_id, session_id)
-);
-CREATE INDEX IF NOT EXISTS idx_org_ticket_sessions_session ON org_ticket_sessions(session_id);
-CREATE TABLE IF NOT EXISTS org_calendar_state ( -- calendar run state (company mode; the files are declarative intent), same rules as schedule_state
-  project_id     TEXT NOT NULL,
-  org_id         TEXT NOT NULL,
-  agent_id       TEXT NOT NULL,
-  name           TEXT NOT NULL,
-  start_at_ms    INTEGER NOT NULL,
-  def_hash       TEXT NOT NULL,
-  last_slot_ms   INTEGER,
-  last_fired_at  TEXT,
-  fired_once     INTEGER NOT NULL DEFAULT 0,
-  missed         INTEGER NOT NULL DEFAULT 0,
-  invalid_reason TEXT,
-  last_outcome   TEXT,
-  PRIMARY KEY (project_id, org_id, agent_id, name)
-);
-CREATE TABLE IF NOT EXISTS org_ticket_state (   -- DERIVED CACHE (company mode): the last (status, owner, blocked) seen per ticket, so a change is notified once; rebuilt silently from the ticket files
-  project_id  TEXT NOT NULL,
-  org_id      TEXT NOT NULL,
-  ticket_id   TEXT NOT NULL,
-  status      TEXT NOT NULL,
-  owner       TEXT NOT NULL DEFAULT '',
-  blocked     TEXT NOT NULL DEFAULT '',
-  blocked_by  TEXT NOT NULL DEFAULT '',
-  PRIMARY KEY (project_id, org_id, ticket_id)
-);
-CREATE TABLE IF NOT EXISTS org_channel_state ( -- DERIVED CACHE (company mode): tail-scan byte cursor per channel and day file
-  project_id   TEXT NOT NULL,
-  org_id       TEXT NOT NULL,
-  channel_id   TEXT NOT NULL,
-  date         TEXT NOT NULL,
-  offset_bytes INTEGER NOT NULL DEFAULT 0,
-  PRIMARY KEY (project_id, org_id, channel_id, date)
-);
-CREATE TABLE IF NOT EXISTS org_channel_reads ( -- user data (company mode): each user's read cursor in one channel
-  project_id   TEXT NOT NULL,
-  org_id       TEXT NOT NULL,
-  channel_id   TEXT NOT NULL,
-  user_id      TEXT NOT NULL,
-  last_read_id TEXT NOT NULL,
-  PRIMARY KEY (project_id, org_id, channel_id, user_id)
-);
-CREATE TABLE IF NOT EXISTS org_budget_state (   -- DERIVED CACHE (company mode): warn / pause marks per employee and period, recomputed from usage and the chart's budgets
-  project_id TEXT NOT NULL,
-  org_id     TEXT NOT NULL,
-  agent_id   TEXT NOT NULL,
-  period     TEXT NOT NULL,
-  warned_at  TEXT,
-  paused_at  TEXT,
-  PRIMARY KEY (project_id, org_id, agent_id, period)
-);
-CREATE TABLE IF NOT EXISTS org_desk_notices (   -- DERIVED CACHE (company mode): ticket changes waiting for an employee's next calendar sweep; dropping it loses only the digests not delivered yet
-  seq        INTEGER PRIMARY KEY AUTOINCREMENT,
-  project_id TEXT NOT NULL,
-  org_id     TEXT NOT NULL,
-  agent_id   TEXT NOT NULL,
-  ticket_id  TEXT NOT NULL,
-  change     TEXT NOT NULL,
-  at         TEXT NOT NULL
-);
-CREATE INDEX IF NOT EXISTS idx_org_desk_notices_agent ON org_desk_notices(project_id, org_id, agent_id);
-`;
-
-// src/db/database.ts
-var sqlite = process.getBuiltinModule("node:sqlite");
-function openExistingDatabase(dbPath) {
-  const db = new sqlite.DatabaseSync(dbPath);
-  db.exec("PRAGMA foreign_keys = ON;");
-  db.exec("PRAGMA busy_timeout = 5000;");
-  return db;
-}
-function openDatabaseReadOnly(dbPath) {
-  const db = new sqlite.DatabaseSync(dbPath, { readOnly: true });
-  db.exec("PRAGMA busy_timeout = 5000;");
-  return db;
-}
-function openDatabase(dbPath) {
-  if (dbPath !== ":memory:") {
-    mkdirSync(path.dirname(dbPath), { recursive: true });
-  }
-  const db = new sqlite.DatabaseSync(dbPath);
-  db.exec("PRAGMA journal_mode = WAL;");
-  db.exec("PRAGMA busy_timeout = 5000;");
-  db.exec("PRAGMA foreign_keys = ON;");
-  db.exec(SCHEMA_SQL);
-  ensureColumn(db, "sessions", "client", "TEXT");
-  ensureColumn(db, "sessions", "has_trace", "INTEGER NOT NULL DEFAULT 0");
-  ensureColumn(db, "sessions", "fork_count", "INTEGER NOT NULL DEFAULT 0");
-  ensureColumn(db, "sessions", "thinking_level", "TEXT");
-  ensureColumn(db, "sessions", "sandbox", "TEXT");
-  ensureColumn(db, "auth_sessions", "via", "TEXT");
-  ensureColumn(db, "trace_files", "page_stats", "TEXT");
-  ensureColumn(db, "messaging_bindings", "line_per_message", "INTEGER NOT NULL DEFAULT 0");
-  ensureColumn(db, "messaging_bindings", "final_reply_only", "INTEGER NOT NULL DEFAULT 0");
-  ensureColumn(db, "messaging_bindings", "render_markdown", "INTEGER NOT NULL DEFAULT 1");
-  ensureColumn(db, "messaging_bindings", "last_inbound_message_id", "TEXT");
-  db.exec("DROP INDEX IF EXISTS idx_usage_session");
-  db.exec("DROP INDEX IF EXISTS idx_messaging_account");
-  upgradeLastActiveAt(db);
-  migrate(db);
-  return db;
-}
-function upgradeLastActiveAt(db) {
-  db.exec("BEGIN");
-  try {
-    if (ensureColumn(db, "sessions", "last_active_at", "TEXT")) {
-      db.exec(
-        `UPDATE sessions SET last_active_at = COALESCE(
-           (SELECT MAX(ts) FROM usage_records WHERE usage_records.session_id = sessions.session_id),
-           created_at
-         )`
-      );
-    }
-    db.exec("COMMIT");
-  } catch (err) {
-    db.exec("ROLLBACK");
-    throw err;
-  }
-}
-function ensureColumn(db, table, column, ddl) {
-  const cols = db.prepare(`PRAGMA table_info(${table})`).all();
-  if (cols.some((c) => c.name === column)) return false;
-  db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${ddl}`);
-  return true;
-}
-
-export {
-  migrate,
-  openExistingDatabase,
-  openDatabaseReadOnly,
-  openDatabase
-};
-//# sourceMappingURL=chunk-3SFJKLQU.js.map