@prismshadow/penguin-server 0.2.16 → 0.2.18

package/dist/chunk-5YLLSHY3.js

@@ -0,0 +1,1195 @@
+// src/db/database.ts
+import { mkdirSync } from "fs";
+import path from "path";
+
+// src/db/migrations/runner.ts
+var LEDGER_DDL = `
+  CREATE TABLE IF NOT EXISTS schema_migrations (
+    name       TEXT PRIMARY KEY,
+    applied_at TEXT NOT NULL
+  );
+`;
+function hasLedger(db) {
+  return db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'schema_migrations'").get() !== void 0;
+}
+function appliedMigrations(db) {
+  if (!hasLedger(db)) return [];
+  const rows = db.prepare("SELECT name FROM schema_migrations ORDER BY rowid").all();
+  return rows.map((r) => r.name);
+}
+function migrate(db, migrations, { swapPath = false } = {}) {
+  const adopted = !hasLedger(db);
+  const done = new Set(appliedMigrations(db));
+  const pending = migrations.filter((m) => !done.has(m.name));
+  if (adopted) db.exec(LEDGER_DDL);
+  const record = db.prepare("INSERT INTO schema_migrations (name, applied_at) VALUES (?, ?)");
+  const applied = [];
+  const deferred = [];
+  for (const m of pending) {
+    if (swapPath && !m.swapSafe) {
+      deferred.push(m.name);
+      continue;
+    }
+    db.exec("BEGIN");
+    try {
+      m.up(db);
+      record.run(m.name, (/* @__PURE__ */ new Date()).toISOString());
+      db.exec("COMMIT");
+    } catch (err) {
+      db.exec("ROLLBACK");
+      throw new Error(`migration ${m.name} failed: ${String(err)}`, { cause: err });
+    }
+    applied.push(m.name);
+  }
+  return { adopted, applied, deferred };
+}
+
+// src/db/migrations/steps/2026-08-31-messaging-bindings.ts
+var messagingBindings = {
+  name: "2026-08-31-messaging-bindings",
+  // Purely additive: one new table plus three indexes, no column of any existing table
+  // touched. A platform that rolls back to a predecessor without messaging simply never
+  // queries them.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS messaging_bindings (
+        session_id       TEXT NOT NULL,
+        channel          TEXT NOT NULL,
+        account_id       TEXT NOT NULL,
+        config_json      TEXT NOT NULL,
+        enabled          INTEGER NOT NULL DEFAULT 0,
+        line_per_message INTEGER NOT NULL DEFAULT 0,
+        last_chat_id     TEXT,
+        last_chat_is_direct INTEGER NOT NULL DEFAULT 1,
+        last_inbound_message_id TEXT,
+        created_at       TEXT NOT NULL,
+        updated_at       TEXT NOT NULL,
+        PRIMARY KEY (session_id, channel)
+      );
+      CREATE INDEX IF NOT EXISTS idx_messaging_by_account ON messaging_bindings(channel, account_id);
+      CREATE INDEX IF NOT EXISTS idx_auth_sessions_expires ON auth_sessions(expires_at);
+      CREATE INDEX IF NOT EXISTS idx_auth_sessions_user ON auth_sessions(user_id);
+    `);
+  },
+  // LOSES every messaging binding: the channel credentials, the enabled flag and the
+  // last-chat memory all live in the table this drops. The auth_sessions indexes are
+  // derived and cost nothing to lose.
+  down(db) {
+    db.exec(`
+      DROP INDEX IF EXISTS idx_auth_sessions_user;
+      DROP INDEX IF EXISTS idx_auth_sessions_expires;
+      DROP INDEX IF EXISTS idx_messaging_by_account;
+      DROP TABLE IF EXISTS messaging_bindings;
+    `);
+  }
+};
+
+// src/db/migrations/steps/2026-08-31-messaging-delivery-flags.ts
+var messagingDeliveryFlags = {
+  name: "2026-08-31-messaging-delivery-flags",
+  // Two columns with defaults on an existing table: a rollback to a predecessor that
+  // does not know them leaves them at their defaults and reads nothing.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "messaging_bindings", "final_reply_only", "INTEGER NOT NULL DEFAULT 0");
+    ensureColumn(db, "messaging_bindings", "render_markdown", "INTEGER NOT NULL DEFAULT 1");
+  },
+  // LOSES both delivery preferences on every binding; the bindings themselves survive.
+  // Dropped in reverse order for symmetry with `up`. Neither column is indexed, which is
+  // what lets SQLite drop them at all.
+  down(db) {
+    db.exec("ALTER TABLE messaging_bindings DROP COLUMN render_markdown");
+    db.exec("ALTER TABLE messaging_bindings DROP COLUMN final_reply_only");
+  }
+};
+
+// src/db/migrations/steps/2026-09-02-drop-goal-state.ts
+var dropGoalState = {
+  name: "2026-09-02-drop-goal-state",
+  // CONTRACT: drops a table no build since 0.2.10 reads. A pushed platform rolled back to
+  // 0.2.9 mid-process would prepare its goal statements against a table that is gone, so it
+  // is left pending on the swap path and applied by the runtime's own open; until then the
+  // table just sits there unused.
+  swapSafe: false,
+  up(db) {
+    db.exec(`
+      DROP INDEX IF EXISTS idx_goal_session;
+      DROP TABLE IF EXISTS goal_state;
+    `);
+  },
+  // Recreates the table exactly as 0.2.9 declared it — EMPTY. LOSES every goal run ever
+  // recorded (objective, status, budget, used, rounds per run): the rows only ever fed the
+  // banner of a finished goal, and a build with this migration reads the goal file instead.
+  down(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS goal_state (
+        id          INTEGER PRIMARY KEY AUTOINCREMENT,
+        session_id  TEXT NOT NULL,
+        project_id  TEXT NOT NULL,
+        agent_id    TEXT NOT NULL,
+        objective   TEXT NOT NULL,
+        status      TEXT NOT NULL,
+        budget      INTEGER NOT NULL,
+        used        INTEGER NOT NULL DEFAULT 0,
+        rounds      INTEGER NOT NULL DEFAULT 0,
+        created_at  TEXT NOT NULL,
+        updated_at  TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_goal_session ON goal_state(session_id);
+    `);
+  }
+};
+
+// src/db/migrations/steps/2026-09-04-machines.ts
+var machines = {
+  name: "2026-09-04-machines",
+  // Three new tables, nothing existing touched: a platform rolled back to one without
+  // machines never queries them. Swap-safe on its own; a database still behind
+  // 2026-09-02-drop-goal-state is refused whole by that one first, which is the rule.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS machine (
+        singleton  INTEGER PRIMARY KEY CHECK (singleton = 1),
+        machine_id TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS machines (
+        address      TEXT PRIMARY KEY,
+        machine_id   TEXT,
+        version      TEXT,
+        installed_at TEXT,
+        session_pid  INTEGER,
+        remote_port  INTEGER,
+        platform     TEXT
+      );
+      CREATE TABLE IF NOT EXISTS machine_project (
+        project_id TEXT PRIMARY KEY REFERENCES projects(project_id) ON DELETE CASCADE,
+        addresses  TEXT NOT NULL
+      );
+    `);
+  },
+  // LOSES this server's own machine id (every stored reference to it on other machines
+  // then points at nothing), what was installed where, the sessions held, and which
+  // machines each Project used.
+  down(db) {
+    db.exec(`
+      DROP TABLE IF EXISTS machine_project;
+      DROP TABLE IF EXISTS machines;
+      DROP TABLE IF EXISTS machine;
+    `);
+  }
+};
+
+// src/db/migrations/steps/2026-09-14-user-profile.ts
+var userProfile = {
+  name: "2026-09-14-user-profile",
+  // Two nullable columns on `users`, no default and nothing existing rewritten: a platform
+  // rolled back to a predecessor that does not know them never selects or writes them, and
+  // every existing account simply reads NULL — no profile yet.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "users", "display_name", "TEXT");
+    ensureColumn(db, "users", "avatar", "TEXT");
+  },
+  // LOSES every stored nickname and avatar: both live entirely in the two columns this
+  // drops, and nothing else on disk holds a copy. Dropped in reverse order for symmetry
+  // with `up`; neither column is indexed, which is what lets SQLite drop them at all.
+  down(db) {
+    const cols = db.prepare("PRAGMA table_info(users)").all();
+    const has = (name) => cols.some((c) => c.name === name);
+    if (has("avatar")) db.exec("ALTER TABLE users DROP COLUMN avatar");
+    if (has("display_name")) db.exec("ALTER TABLE users DROP COLUMN display_name");
+  }
+};
+
+// src/db/migrations/steps/2026-09-16-company-mode-channels.ts
+var companyModeChannels = {
+  name: "2026-09-16-company-mode-channels",
+  // The organization's single group chat became channels: a message lives in
+  // `channels/<channel_id>/<date>.jsonl`, so the tail-scan cursor and each user's read
+  // cursor are per channel. `org_chat_state` / `org_chat_reads` are dropped for
+  // `org_channel_state` / `org_channel_reads`: the tables are renamed and the channel
+  // belongs in the primary key, neither of which SQLite does in place. Nothing is carried
+  // over: company mode is unreleased, and every row was either rebuildable from the files
+  // (the scan cursor) or one pass of "everything looks unread" (the read cursor). A
+  // predecessor build reads neither table's shape, only its own writes, so this is
+  // swap-safe.
+  //
+  // By the expand / contract rule (migration.ts) the two DROPs are a contract, and this is the
+  // one expand that removes anything on the swap path. It stays an expand because it is frozen
+  // and cannot be deferred: the same step creates the channel tables a pushed platform needs.
+  // A new change of this kind is split into an expand and a later contract instead.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      DROP TABLE IF EXISTS org_chat_state;
+      DROP TABLE IF EXISTS org_chat_reads;
+      CREATE TABLE IF NOT EXISTS org_channel_state ( -- DERIVED CACHE (company mode): tail-scan byte cursor per channel and day file
+        project_id   TEXT NOT NULL,
+        org_id       TEXT NOT NULL,
+        channel_id   TEXT NOT NULL,
+        date         TEXT NOT NULL,
+        offset_bytes INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY (project_id, org_id, channel_id, date)
+      );
+      CREATE TABLE IF NOT EXISTS org_channel_reads ( -- user data (company mode): each user's read cursor in one channel
+        project_id   TEXT NOT NULL,
+        org_id       TEXT NOT NULL,
+        channel_id   TEXT NOT NULL,
+        user_id      TEXT NOT NULL,
+        last_read_id TEXT NOT NULL,
+        PRIMARY KEY (project_id, org_id, channel_id, user_id)
+      );
+    `);
+  },
+  // Recreates the two tables under their old names, exactly as 2026-09-16-company-mode-org-caches declared them —
+  // EMPTY. LOSES every scan cursor (re-derived by the next pass, which republishes the
+  // messages it re-reads) and every read cursor (users see the recent days as unread once).
+  down(db) {
+    db.exec(`
+      DROP TABLE IF EXISTS org_channel_state;
+      DROP TABLE IF EXISTS org_channel_reads;
+      CREATE TABLE IF NOT EXISTS org_chat_state (     -- DERIVED CACHE (company mode): tail-scan byte cursor per chat day file
+        project_id   TEXT NOT NULL,
+        org_id       TEXT NOT NULL,
+        date         TEXT NOT NULL,
+        offset_bytes INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY (project_id, org_id, date)
+      );
+      CREATE TABLE IF NOT EXISTS org_chat_reads ( -- user data (company mode): each user's read cursor in an organization's chat
+        project_id   TEXT NOT NULL,
+        org_id       TEXT NOT NULL,
+        user_id      TEXT NOT NULL,
+        last_read_id TEXT NOT NULL,
+        PRIMARY KEY (project_id, org_id, user_id)
+      );
+    `);
+  }
+};
+
+// src/db/migrations/steps/2026-09-16-company-mode-desk-notices.ts
+var companyModeDeskNotices = {
+  name: "2026-09-16-company-mode-desk-notices",
+  // Additive: one new table and its index. A ticket change no longer starts a work run at
+  // the owner's desk; it is queued here and delivered inside the body of that employee's
+  // next calendar sweep. A predecessor build never reads the table, so a rollback survives
+  // it — with whatever rows are in it left undelivered.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS org_desk_notices (   -- DERIVED CACHE (company mode): ticket changes waiting for an employee's next calendar sweep; dropping it loses only the digests not delivered yet
+        seq        INTEGER PRIMARY KEY AUTOINCREMENT,
+        project_id TEXT NOT NULL,
+        org_id     TEXT NOT NULL,
+        agent_id   TEXT NOT NULL,
+        ticket_id  TEXT NOT NULL,
+        change     TEXT NOT NULL,
+        at         TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_org_desk_notices_agent ON org_desk_notices(project_id, org_id, agent_id);
+    `);
+  },
+  // LOSES every queued notice: the ticket changes an employee has not been told about yet.
+  // The change itself is in the ticket file and its history either way; what
+  // goes is the "Since your last sweep" line that would have named it.
+  down(db) {
+    db.exec(`
+      DROP INDEX IF EXISTS idx_org_desk_notices_agent;
+      DROP TABLE IF EXISTS org_desk_notices;
+    `);
+  }
+};
+
+// src/db/migrations/steps/2026-09-16-company-mode-org-caches.ts
+var companyModeOrgCaches = {
+  name: "2026-09-16-company-mode-org-caches",
+  // Additive: seven new tables for company mode (organizations of Agents), no change to any
+  // existing table. Every row is either rebuildable from the organization's files (desks.toml,
+  // the tickets' Sessions headers, the calendar files, usage records) or a user's own read
+  // cursor; a predecessor build never touches them.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS org_sessions (      -- DERIVED CACHE (company mode): desk sessions, rebuilt from each organization's desks.toml (current + previous); trigger_hop is chat-chain accounting and reads 0 after a rebuild
+        session_id  TEXT PRIMARY KEY,
+        project_id  TEXT NOT NULL,
+        org_id      TEXT NOT NULL,
+        agent_id    TEXT NOT NULL,
+        current     INTEGER NOT NULL DEFAULT 1,
+        trigger_hop INTEGER NOT NULL DEFAULT 0
+      );
+      CREATE INDEX IF NOT EXISTS idx_org_sessions_org ON org_sessions(project_id, org_id);
+      CREATE TABLE IF NOT EXISTS org_ticket_sessions ( -- DERIVED CACHE (company mode): ticket <-> contributing session, rebuilt from each ticket's Sessions header
+        project_id  TEXT NOT NULL,
+        org_id      TEXT NOT NULL,
+        ticket_id   TEXT NOT NULL,
+        session_id  TEXT NOT NULL,
+        agent_id    TEXT NOT NULL,
+        trigger_hop INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY (project_id, org_id, ticket_id, session_id)
+      );
+      CREATE INDEX IF NOT EXISTS idx_org_ticket_sessions_session ON org_ticket_sessions(session_id);
+      CREATE TABLE IF NOT EXISTS org_calendar_state ( -- calendar run state (company mode; the files are declarative intent), same rules as schedule_state
+        project_id     TEXT NOT NULL,
+        org_id         TEXT NOT NULL,
+        agent_id       TEXT NOT NULL,
+        name           TEXT NOT NULL,
+        start_at_ms    INTEGER NOT NULL,
+        def_hash       TEXT NOT NULL,
+        last_slot_ms   INTEGER,
+        last_fired_at  TEXT,
+        fired_once     INTEGER NOT NULL DEFAULT 0,
+        missed         INTEGER NOT NULL DEFAULT 0,
+        invalid_reason TEXT,
+        last_outcome   TEXT,
+        PRIMARY KEY (project_id, org_id, agent_id, name)
+      );
+      CREATE TABLE IF NOT EXISTS org_ticket_state (   -- DERIVED CACHE (company mode): the last (status, owner, blocked) seen per ticket, so a change is notified once; rebuilt silently from the ticket files
+        project_id  TEXT NOT NULL,
+        org_id      TEXT NOT NULL,
+        ticket_id   TEXT NOT NULL,
+        status      TEXT NOT NULL,
+        owner       TEXT NOT NULL DEFAULT '',
+        blocked     TEXT NOT NULL DEFAULT '',
+        blocked_by  TEXT NOT NULL DEFAULT '',
+        PRIMARY KEY (project_id, org_id, ticket_id)
+      );
+      CREATE TABLE IF NOT EXISTS org_budget_state (   -- DERIVED CACHE (company mode): warn / pause marks per employee and period, recomputed from usage and the chart's budgets
+        project_id TEXT NOT NULL,
+        org_id     TEXT NOT NULL,
+        agent_id   TEXT NOT NULL,
+        period     TEXT NOT NULL,
+        warned_at  TEXT,
+        paused_at  TEXT,
+        PRIMARY KEY (project_id, org_id, agent_id, period)
+      );
+    `);
+    const superseded = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'org_channel_state'").get() !== void 0;
+    if (!superseded) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS org_chat_state (     -- DERIVED CACHE (company mode): tail-scan byte cursor per chat day file
+          project_id   TEXT NOT NULL,
+          org_id       TEXT NOT NULL,
+          date         TEXT NOT NULL,
+          offset_bytes INTEGER NOT NULL DEFAULT 0,
+          PRIMARY KEY (project_id, org_id, date)
+        );
+        CREATE TABLE IF NOT EXISTS org_chat_reads (     -- user data (company mode): each user's read cursor in an organization's chat
+          project_id   TEXT NOT NULL,
+          org_id       TEXT NOT NULL,
+          user_id      TEXT NOT NULL,
+          last_read_id TEXT NOT NULL,
+          PRIMARY KEY (project_id, org_id, user_id)
+        );
+      `);
+    }
+  },
+  // Drops the seven tables. LOSES: chat read cursors (each user's "read up to here" marks) and
+  // the run marks that stop a calendar slot, a ticket change or a budget alert from firing
+  // twice — a build with this migration re-registers everything from the files, without
+  // backfilling missed slots, and users see every chat message as unread once.
+  down(db) {
+    db.exec(`
+      DROP INDEX IF EXISTS idx_org_ticket_sessions_session;
+      DROP INDEX IF EXISTS idx_org_sessions_org;
+      DROP TABLE IF EXISTS org_budget_state;
+      DROP TABLE IF EXISTS org_chat_reads;
+      DROP TABLE IF EXISTS org_chat_state;
+      DROP TABLE IF EXISTS org_ticket_state;
+      DROP TABLE IF EXISTS org_calendar_state;
+      DROP TABLE IF EXISTS org_ticket_sessions;
+      DROP TABLE IF EXISTS org_sessions;
+    `);
+  }
+};
+
+// src/db/migrations/steps/2026-09-17-model-promotions.ts
+var modelPromotions = {
+  name: "2026-09-17-model-promotions",
+  // Additive: one new table, nothing existing touched. A predecessor build never reads it
+  // and prices every row at the number in its Project file, so a rollback survives it.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS model_promotions ( -- NOT a cache rebuildable from files: the only record of a Project row's running promotion (.project_config.toml keeps the list price), written by preset seeding at Project creation, "sync presets" and Penguin Go authorization / sync, and read by cost; lost rows price usage at list until the next sync writes them back
+        project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+        provider   TEXT NOT NULL,
+        model_id   TEXT NOT NULL,
+        discount   REAL NOT NULL CHECK (discount > 0 AND discount < 1),
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (project_id, provider, model_id)
+      );
+    `);
+  },
+  // LOSES every stored promotion: no file holds a copy of the fractions, so usage is priced
+  // at the Project files' list prices until the next "sync presets" or Penguin Go sync
+  // writes them back.
+  down(db) {
+    db.exec("DROP TABLE IF EXISTS model_promotions");
+  }
+};
+
+// src/db/migrations/steps/2026-09-21-model-provider-auth-tokens.ts
+var modelProviderAuthTokens = {
+  name: "2026-09-21-model-provider-auth-tokens",
+  // Additive: one new table, nothing existing touched. A predecessor build never reads it;
+  // the access token already written into .project_config.toml keeps working until it
+  // expires, so rollback only loses silent refresh state.
+  // KEEP until every supported upgrade starts from a database that already has this table.
+  // The release that raises the minimum database baseline past it owns removing this
+  // migration and its fixture; the table itself remains while provider token refresh uses it.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS model_provider_auth_tokens ( -- Server-side OAuth refresh metadata for provider groups. The current request token remains in .project_config.toml as api_key; this table holds only the refresh material that must never be returned to the frontend or written into Project files.
+        project_id              TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+        provider                TEXT NOT NULL,
+        refresh_token           TEXT NOT NULL,
+        access_token_expires_at TEXT,
+        updated_at              TEXT NOT NULL,
+        PRIMARY KEY (project_id, provider)
+      );
+    `);
+  },
+  // LOSES every stored refresh token and access-token expiry. Existing access tokens in
+  // Project files remain until they expire; users re-authorize to restore silent refresh.
+  down(db) {
+    db.exec("DROP TABLE IF EXISTS model_provider_auth_tokens");
+  }
+};
+
+// src/db/migrations/steps/2026-09-22-sessions-sandbox.ts
+var sessionsSandbox = {
+  name: "2026-09-22-sessions-sandbox",
+  // The Session's own sandbox policy (JSON), snapshotted from the server's settings when
+  // the Session is created, so a later settings change leaves running Sessions alone.
+  // NULL = a row from before this column: it takes the settings in force at its next
+  // command and keeps them from then on. Swap-safe: a pushed platform boots against the
+  // runtime's already-open database, so the column has to arrive by a migration.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "sessions", "sandbox", "TEXT");
+  },
+  // Not a DROP: schema.ts declares the column, and dropping it would put every Session
+  // back under whatever the settings say.
+  down() {
+  }
+};
+
+// src/db/migrations/steps/2026-09-23-machines-columns.ts
+var machinesColumns = {
+  name: "2026-09-23-machines-columns",
+  // A machines table can predate `machines` — a data root that ran the machines line
+  // before it was released kept forwards, not sessions — and that migration's IF NOT
+  // EXISTS adopted it whatever its columns were, so the first connect failed on the row's
+  // insert. Adds what is missing, nullable; a platform rolled back to `machines` declared these
+  // columns itself, so there is nothing for it to mind.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "machines", "session_pid", "INTEGER");
+    ensureColumn(db, "machines", "platform", "TEXT");
+  },
+  // Nothing to undo: what this added, `machines` already declares, and a column it found in place
+  // was never this migration's to take away.
+  down() {
+  }
+};
+
+// src/db/migrations/steps/2026-09-23-model-tables-adoption.ts
+var modelTablesAdoption = {
+  name: "2026-09-23-model-tables-adoption",
+  // A data root that ran the chain before it was restacked onto main (2026-09-23) is
+  // stamped 16 under THAT line's numbering, where 9 and 10 were 2026-09-22-sessions-sandbox and
+  // 2026-09-23-machines-columns. This line numbers main's 2026-09-17-model-promotions and
+  // 2026-09-21-model-provider-auth-tokens 9 and 10 and everything after them two higher, so such a
+  // root reads both as already applied, reaches 18 without `model_promotions` or
+  // `model_provider_auth_tokens`, and answers 500 wherever cost or provider auth reads
+  // them (the models page, an organization's overview). Seen on the release instance at
+  // the first push of the restacked line.
+  //
+  // Re-runs 9's and 10's own `up` — the frozen DDL, both `IF NOT EXISTS`, so a root that
+  // took them in their proper place finds its work done. The ledger ended the numbering
+  // hazard: adopting a numbered root runs 2026-09-17-model-promotions and 2026-09-21-model-provider-auth-tokens
+  // themselves. Remove together with the ledger's adoption of numbered roots (index.ts).
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS model_promotions (
+        project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+        provider   TEXT NOT NULL,
+        model_id   TEXT NOT NULL,
+        discount   REAL NOT NULL CHECK (discount > 0 AND discount < 1),
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (project_id, provider, model_id)
+      );
+      CREATE TABLE IF NOT EXISTS model_provider_auth_tokens (
+        project_id              TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+        provider                TEXT NOT NULL,
+        refresh_token           TEXT NOT NULL,
+        access_token_expires_at TEXT,
+        updated_at              TEXT NOT NULL,
+        PRIMARY KEY (project_id, provider)
+      );
+    `);
+  },
+  // Nothing to undo: the tables are 2026-09-17-model-promotions' and 2026-09-21-model-provider-auth-tokens', and
+  // their own downs drop them.
+  down() {
+  }
+};
+
+// src/db/migrations/steps/2026-10-04-browser-extensions.ts
+var browserExtensions = {
+  name: "2026-10-04-browser-extensions",
+  // Additive: one new table and its index. The Chrome backend's pairings — one row per
+  // PenguinHarness Browser extension a user paired, its token stored hashed. A predecessor
+  // build never reads the table, so a rollback survives it; the paired extensions then simply
+  // fail to connect until a build that knows them is back.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS browser_extensions ( -- one row per Chrome paired to a user (builtin-browser/extension-pairing.ts): the PenguinHarness Browser extension's long-lived credential, stored only hashed; NOT rebuildable \u2014 a lost row means pairing that Chrome again
+        extension_id TEXT PRIMARY KEY,
+        user_id      TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+        token_hash   TEXT NOT NULL UNIQUE,
+        name         TEXT NOT NULL,
+        version      TEXT NOT NULL,
+        created_at   TEXT NOT NULL,
+        last_seen_at TEXT,
+        revoked_at   TEXT
+      );
+      CREATE INDEX IF NOT EXISTS idx_browser_extensions_user ON browser_extensions(user_id);
+    `);
+  },
+  // LOSES every pairing: each user's Chrome has to be paired again (a new code from the
+  // Browser panel) before agents can drive it.
+  down(db) {
+    db.exec(`
+      DROP INDEX IF EXISTS idx_browser_extensions_user;
+      DROP TABLE IF EXISTS browser_extensions;
+    `);
+  }
+};
+
+// src/db/migrations/steps/2026-10-10-agent-api.ts
+var agentApi = {
+  name: "2026-10-10-agent-api",
+  // Additive: two new tables and an index. The Agent API's per-Agent settings (the switch,
+  // keyless access, the approval mode API Sessions are created with) and its keys, stored
+  // hashed. A predecessor build never reads them and serves no /api/amsp route, so a
+  // rollback survives it: callers get 404 until a build that knows the tables is back.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS agent_api (          -- per-Agent public API settings (amsp/routes.ts); NOT rebuildable from files
+          project_id    TEXT NOT NULL,
+          agent_id      TEXT NOT NULL,
+          enabled       INTEGER NOT NULL DEFAULT 0,
+          open          INTEGER NOT NULL DEFAULT 0,
+          approval_mode TEXT NOT NULL DEFAULT 'allow-all',
+          updated_at    TEXT NOT NULL,
+          PRIMARY KEY (project_id, agent_id)
+        );
+        CREATE TABLE IF NOT EXISTS agent_api_keys (     -- one row per key the API tab or the CLI minted; the caller alone holds the key
+          key_id       TEXT PRIMARY KEY,
+          project_id   TEXT NOT NULL,
+          agent_id     TEXT NOT NULL,
+          token_hash   TEXT NOT NULL UNIQUE,
+          prefix       TEXT NOT NULL,
+          name         TEXT NOT NULL,
+          created_by   TEXT NOT NULL REFERENCES users(user_id),
+          created_at   TEXT NOT NULL,
+          last_used_at TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_agent_api_keys_agent ON agent_api_keys(project_id, agent_id);
+      `);
+  },
+  // LOSES every Agent's API settings and every key: each exposed Agent reads as disabled
+  // again (404 to its callers), and every caller needs a newly created key once it is back
+  // on — no file holds a copy of either.
+  down(db) {
+    db.exec(`
+        DROP INDEX IF EXISTS idx_agent_api_keys_agent;
+        DROP TABLE IF EXISTS agent_api_keys;
+        DROP TABLE IF EXISTS agent_api;
+      `);
+  }
+};
+
+// src/db/migrations/steps/2026-10-12-messaging-conversations.ts
+var messagingConversations = {
+  name: "2026-10-12-messaging-conversations",
+  // Additive: one new table. The WeChat connector's per-(bot, user) delivery state — the
+  // context token every send must echo, how many sends it has funded, and replies held for
+  // the user's next message. A predecessor build never reads it and keeps its tokens in
+  // memory as it always did, so a rollback survives it.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS messaging_conversations ( -- per-(bot, chat) delivery state a connector must keep across reconnects and restarts (WeChat: the context token, its send count, held replies); deleted once no messaging_bindings row references (channel, account_id) \u2014 see MessagingBindingsRepo
+        channel    TEXT NOT NULL,
+        account_id TEXT NOT NULL,
+        chat_id    TEXT NOT NULL,
+        state_json TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (channel, account_id, chat_id)
+      );
+    `);
+  },
+  // LOSES every stored context token and every held reply: replies sent before each user's
+  // next message are refused again, and what was held never arrives.
+  down(db) {
+    db.exec("DROP TABLE IF EXISTS messaging_conversations");
+  }
+};
+
+// src/db/migrations/steps/2026-10-12-sessions-kept-at.ts
+var sessionsKeptAt = {
+  name: "2026-10-12-sessions-kept-at",
+  // The "keep in sidebar" mark: written when the user unarchives a Session, cleared when they
+  // archive it. The listing rule files a background Session (api / schedule / cli) away unless
+  // it carries the mark, so existing rows are listed by the rule as they stand and nothing is
+  // rewritten. Swap-safe: a pushed platform boots against the runtime's already-open database,
+  // so the column has to arrive by a migration.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "sessions", "kept_at", "TEXT");
+  },
+  // Not a DROP: schema.ts declares the column, and dropping it would file every kept
+  // background Session away again.
+  down() {
+  }
+};
+
+// src/db/migrations/steps/2026-10-14-agent-api-concurrency.ts
+var agentApiConcurrency = {
+  name: "2026-10-14-agent-api-concurrency",
+  // How many of an Agent API Agent's runs may be live at once.
+  // Retain while a supported data root can predate this column; the maintainer raising
+  // that baseline removes this upgrade once every supported data root has it.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "agent_api", "max_concurrent_runs", "INTEGER NOT NULL DEFAULT 4");
+  },
+  // Keep the configured limit on rollback; older builds ignore this column.
+  down() {
+  }
+};
+
+// src/db/migrations/steps/2026-10-14-agent-api-session-settings.ts
+var agentApiSessionSettings = {
+  name: "2026-10-14-agent-api-session-settings",
+  // The per-Agent API defaults a new Session starts with: which provider, model, thinking
+  // level and workspace it opens in. Nullable additions preserve existing keys, exposure,
+  // approvals and new-Session defaults.
+  // Retain while a supported data root can predate these columns; the maintainer raising
+  // that baseline removes this upgrade after all supported data roots have them.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "agent_api", "provider", "TEXT");
+    ensureColumn(db, "agent_api", "model_id", "TEXT");
+    ensureColumn(db, "agent_api", "thinking_level", "TEXT");
+    ensureColumn(db, "agent_api", "workspace", "TEXT");
+  },
+  // Keep the saved defaults on rollback; older builds ignore the additional columns.
+  down() {
+  }
+};
+
+// src/db/migrations/steps/2026-10-16-machines-adopted-at.ts
+var machinesAdoptedAt = {
+  name: "2026-10-16-machines-adopted-at",
+  // When this server adopted a machine (first recorded it): the Sessions that machine held
+  // before then read as CLI tasks through this server (session-sources.ts sourceSeenBy). A
+  // machine recorded before this column has none and never gets one, so the rule does not apply
+  // to it (user decision, 2026-10-15) — nothing on either side is rewritten. Swap-safe: a pushed platform boots against the runtime's
+  // already-open database, so the column has to arrive by a migration.
+  swapSafe: true,
+  up(db) {
+    ensureColumn(db, "machines", "adopted_at", "TEXT");
+  },
+  // Keep the adoption times on rollback; older builds ignore the column.
+  down() {
+  }
+};
+
+// src/db/migrations/steps/2026-10-26-user-drafts.ts
+var userDrafts = {
+  name: "2026-10-26-user-drafts",
+  // Additive: two new tables and two indexes. A user's unsent drafts and the custom background
+  // image, which used to live only in the browser that made them. A predecessor build never
+  // reads either table, so a rollback survives it; its Web App then keeps drafts and the image
+  // in that browser alone, as it always did.
+  swapSafe: true,
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS user_drafts ( -- a user's unsent drafts (composer text, parked conversations, form answers), so they follow the account to another browser; bounded per user, dropped with the Session or Project they belong to
+        user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+        draft_key  TEXT NOT NULL,
+        session_id TEXT,
+        project_id TEXT,
+        value_json TEXT NOT NULL,
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (user_id, draft_key)
+      );
+      CREATE INDEX IF NOT EXISTS idx_user_drafts_session ON user_drafts(session_id);
+      CREATE INDEX IF NOT EXISTS idx_user_drafts_project ON user_drafts(project_id);
+      CREATE TABLE IF NOT EXISTS user_background_images ( -- the custom background image of a user's appearance settings, apart from ui_prefs so the megabyte it may hold is read only by the one route that serves it
+        user_id    TEXT PRIMARY KEY REFERENCES users(user_id) ON DELETE CASCADE,
+        image      TEXT NOT NULL,
+        image_id   TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+    `);
+  },
+  // LOSES every draft and background image the accounts hold on the server. A browser that still
+  // caches them keeps showing its own copy; another browser starts without them.
+  down(db) {
+    db.exec(`
+      DROP INDEX IF EXISTS idx_user_drafts_project;
+      DROP INDEX IF EXISTS idx_user_drafts_session;
+      DROP TABLE IF EXISTS user_drafts;
+      DROP TABLE IF EXISTS user_background_images;
+    `);
+  }
+};
+
+// src/db/migrations/index.ts
+var MIGRATIONS = [
+  messagingBindings,
+  messagingDeliveryFlags,
+  dropGoalState,
+  machines,
+  userProfile,
+  companyModeOrgCaches,
+  companyModeChannels,
+  companyModeDeskNotices,
+  modelPromotions,
+  modelProviderAuthTokens,
+  sessionsSandbox,
+  machinesColumns,
+  browserExtensions,
+  agentApi,
+  messagingConversations,
+  sessionsKeptAt,
+  agentApiSessionSettings,
+  agentApiConcurrency,
+  machinesAdoptedAt,
+  modelTablesAdoption,
+  userDrafts
+];
+function migrate2(db, options = {}) {
+  return migrate(db, MIGRATIONS, options);
+}
+
+// src/db/schema.ts
+var MODEL_PROMOTIONS_SQL = `
+CREATE TABLE IF NOT EXISTS model_promotions ( -- NOT a cache rebuildable from files: the only record of a Project row's running promotion (.project_config.toml keeps the list price), written by preset seeding at Project creation, "sync presets" and Penguin Go authorization / sync, and read by cost; lost rows price usage at list until the next sync writes them back
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  provider   TEXT NOT NULL,
+  model_id   TEXT NOT NULL,
+  discount   REAL NOT NULL CHECK (discount > 0 AND discount < 1),  -- fraction off the row's list price: billed = list \xD7 (1 \u2212 discount)
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, provider, model_id)
+);`;
+var MODEL_PROVIDER_AUTH_TOKENS_SQL = `
+CREATE TABLE IF NOT EXISTS model_provider_auth_tokens ( -- Server-side OAuth refresh metadata for provider groups. The current request token remains in .project_config.toml as api_key; this table holds only the refresh material that must never be returned to the frontend or written into Project files.
+  project_id              TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  provider                TEXT NOT NULL,
+  refresh_token           TEXT NOT NULL,
+  access_token_expires_at TEXT,
+  updated_at              TEXT NOT NULL,
+  PRIMARY KEY (project_id, provider)
+);`;
+var SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS users (
+  user_id             TEXT PRIMARY KEY,            -- semantic id doubles as login name: ^[a-z][a-z0-9_-]{1,31}$
+  password_hash       TEXT NOT NULL,               -- scrypt$N$r$p$salt$hash(base64)
+  is_admin            INTEGER NOT NULL DEFAULT 0,  -- 1 for the built-in admin (seeded at startup)
+  password_is_initial INTEGER NOT NULL DEFAULT 0,  -- 1=initial password (seeded/admin-set); cleared once the user changes it
+  display_name        TEXT,                        -- nickname shown in place of user_id (1-32 characters); NULL = never set, surfaces show the id
+  avatar              TEXT,                        -- avatar as a data URL (image/png|jpeg|webp, <= 131072 characters); NULL = never set, surfaces draw the letter placeholder
+  created_at          TEXT NOT NULL
+);
+-- Server-side sessions backing the HttpOnly cookie: the cookie carries a 32-byte random
+-- token, the row stores only its sha256. A session outlives a restart (it is on disk), which
+-- is why the model is a row and not a signed statement.
+CREATE TABLE IF NOT EXISTS auth_sessions (
+  token_hash TEXT PRIMARY KEY,               -- sha256(token) hex; the cookie stores only the raw token
+  user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,                  -- 30-day sliding renewal, topped up in place when <29 days remain
+  via        TEXT                            -- 'password'|'desktop'|'setup'|'cli'|'remote'; NULL = legacy (password)
+);
+-- deleteExpired runs on every login and mint, deleteByUser on every admin reset; without
+-- these both scan the whole table.
+CREATE INDEX IF NOT EXISTS idx_auth_sessions_expires ON auth_sessions(expires_at);
+CREATE INDEX IF NOT EXISTS idx_auth_sessions_user ON auth_sessions(user_id);
+
+CREATE TABLE IF NOT EXISTS projects (
+  project_id    TEXT PRIMARY KEY,            -- directory name doubles as id; display name lives in project_config.toml
+  owner_user_id TEXT NOT NULL REFERENCES users(user_id),
+  created_at    TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS project_members (  -- member grants only; owners are not stored here
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, user_id)
+);
+${MODEL_PROMOTIONS_SQL}
+${MODEL_PROVIDER_AUTH_TOKENS_SQL}
+CREATE TABLE IF NOT EXISTS agents (           -- index only; name/description live in system_config.yaml
+  project_id TEXT NOT NULL,
+  agent_id   TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, agent_id)
+);
+CREATE TABLE IF NOT EXISTS sessions (
+  session_id    TEXT PRIMARY KEY,
+  project_id    TEXT NOT NULL,
+  agent_id      TEXT NOT NULL,
+  provider      TEXT NOT NULL,                     -- provider group of the session's CURRENT model (paired with model_id as a model reference; moves with each in-session switch)
+  model_id      TEXT NOT NULL,                     -- upstream model id of the current model (sent to MMSP as-is; never concatenate <provider>/<id>)
+  workspace     TEXT NOT NULL,
+  approval_mode TEXT NOT NULL DEFAULT 'allow-all',   -- allow-all|deny-all|read-only|always-ask
+  thinking_level TEXT,                               -- level pinned for THIS session (none|low|medium|high|xhigh|max); NULL=not pinned, runs follow the Agent config
+  title         TEXT,                                -- auto-generated by the model after the first exchange; NULL=not yet (frontend shows "New chat")
+  archived_at   TEXT,                                -- the user archived it (ISO time); NULL = not archived by hand (the listing rule may still file it away)
+  kept_at       TEXT,                                -- "keep in sidebar": set when the user unarchives, cleared when they archive; NULL = the listing rule decides (a background source is archived, a user Session is active). Never written by a run.
+  client        TEXT,                                -- creating client: 'web' (created via the Web App) | 'cli' (adopted from a CLI Trace) | 'org' (company mode) | 'api' (an Agent API run); NULL = legacy row, treated as web
+  has_trace     INTEGER NOT NULL DEFAULT 0,          -- cache: a Trace record exists (set at task start / adoption / subagent registration; lazily backfilled by list hydration)
+  fork_count    INTEGER NOT NULL DEFAULT 0,          -- monotonically allocated child-fork number for this source Session; never decremented when a fork is deleted
+  sandbox       TEXT,                                -- the Session's sandbox policy snapshot (JSON SandboxSettings); NULL = legacy row, snapshotted at its next command
+  last_active_at TEXT,                               -- last activity this server drove for the session (ISO; stamped once when a run starts and once when it ends, initialized to created_at); monotonic, never moves backwards; NULL only before openDatabase's one-time backfill
+  created_at    TEXT NOT NULL
+);                                            -- the Session's SOURCE (user/api/schedule/subagent/cli/company) is NOT stored: session_meta in the Trace is the single source of truth (see runtime/session-sources.ts); "client" is a different, DB-only axis (who created the row), read for the source only where the Trace records none ('org' \u2192 company)
+CREATE INDEX IF NOT EXISTS idx_sessions_agent_created ON sessions(project_id, agent_id, created_at DESC);
+CREATE TABLE IF NOT EXISTS usage_records (
+  id                INTEGER PRIMARY KEY AUTOINCREMENT,
+  ts                TEXT NOT NULL,
+  date              TEXT NOT NULL,            -- local date yyyy-mm-dd (aggregation key; same convention as Trace date directories)
+  project_id        TEXT NOT NULL,
+  agent_id          TEXT NOT NULL,
+  session_id        TEXT NOT NULL,            -- top-level Session (child-session usage counts toward its main Session)
+  origin_session_id TEXT,                     -- immediate source child Session (last of the origin chain); NULL=main session
+  provider          TEXT NOT NULL,            -- provider group: paired with model_id as the attribution key; always GROUP BY provider, model_id
+  model_id          TEXT NOT NULL,            -- upstream model id (paired with provider; same model_id across providers aggregates separately)
+  cache_read        INTEGER NOT NULL,
+  cache_write       INTEGER NOT NULL,
+  output            INTEGER NOT NULL,
+  total             INTEGER NOT NULL,         -- from token_usage.request (one row per Request)
+  status            TEXT NOT NULL DEFAULT 'completed'  -- request outcome: completed=success (with tokens); others=failure (0 tokens, for success rate)
+);                                            -- cost is not stored: computed at query time from current pricing
+CREATE INDEX IF NOT EXISTS idx_usage_project_date ON usage_records(project_id, date);
+CREATE INDEX IF NOT EXISTS idx_usage_session_ts ON usage_records(session_id, ts);  -- (session_id) alone was idx_usage_session (dropped on open): ts makes the last_active_at backfill's MAX(ts) a covering index scan instead of a random row lookup per usage record
+CREATE TABLE IF NOT EXISTS error_records (     -- server-side error capture (the Costs page's "Errors" tab)
+  id         INTEGER PRIMARY KEY AUTOINCREMENT,
+  ts         TEXT NOT NULL,
+  date       TEXT NOT NULL,            -- local date yyyy-mm-dd (same convention as usage_records)
+  project_id TEXT,                     -- nullable: sign-in/registration and process-level errors have no Project context
+  agent_id   TEXT,
+  session_id TEXT,
+  source     TEXT NOT NULL,            -- http | session | usage | title | subagent | process | llm | environment | compaction | schedule | messaging | organization | id_suggest | plugin
+  kind       TEXT NOT NULL,            -- expected (HttpError, business 4xx) | unexpected (500/runtime)
+  code       TEXT NOT NULL,            -- HttpError.code / internal / session_run_failed / ...
+  status     INTEGER,                  -- HTTP status code; NULL for non-HTTP sources
+  message    TEXT NOT NULL             -- truncated to 500 chars (no stack stored: stacks go to logs only)
+);
+CREATE INDEX IF NOT EXISTS idx_error_project_date ON error_records(project_id, date);
+CREATE TABLE IF NOT EXISTS schedule_state (    -- schedule runtime state (files are declarative intent; the system never writes back)
+  project_id      TEXT NOT NULL,
+  agent_id        TEXT NOT NULL,
+  name            TEXT NOT NULL,               -- file name (without .toml) doubles as the identifier
+  creator_user_id TEXT,                        -- creator (recorded on API create; hand-edited file reconciliation falls back to the Project owner)
+  start_at_ms     INTEGER NOT NULL,            -- defines identity: a start_at change counts as a new task instance, resetting fire state
+  def_hash        TEXT NOT NULL,               -- file content fingerprint: any change clears the invalid flag (the file takes effect again after edits)
+  last_slot_ms    INTEGER,                     -- latest due slot already consumed (advances on fire or skip; no re-fire across restarts)
+  last_fired_at   TEXT,                        -- last actual fire time (for display)
+  fired_once      INTEGER NOT NULL DEFAULT 0,  -- one-shot task has fired
+  missed          INTEGER NOT NULL DEFAULT 0,  -- one-shot task was missed (flagged by startup/registration reconciliation; not backfilled)
+  invalid_reason  TEXT,                        -- invalidation reason (e.g. the bound Session was deleted); NULL=healthy
+  PRIMARY KEY (project_id, agent_id, name)
+);
+CREATE TABLE IF NOT EXISTS messaging_bindings ( -- Session \u2194 messaging-channel bot bindings (runtime/messaging/ holds the long connections)
+  session_id       TEXT NOT NULL,              -- a Session keeps at most one saved config PER channel (composite PK below); at most ONE of them is enabled at a time (route-enforced, 409 another_channel_enabled), and enabling is what binds the account to this Session
+  channel          TEXT NOT NULL,              -- messaging channel discriminator ('feishu' | 'telegram' | 'qq' | 'wechat')
+  account_id       TEXT NOT NULL,              -- channel-scoped bot/app identity (feishu: app_id; telegram: the bot token's numeric id; qq: the bot's App ID; wechat: the scanned bot id); NOT unique \u2014 any number of Sessions may keep the same account saved side by side, each with its own config and last-chat memory; only ENABLING is exclusive (route-enforced, 409 account_enabled_elsewhere: one account has one event stream, two live connections on it would race)
+  config_json      TEXT NOT NULL,              -- channel-specific credentials/config JSON (feishu: appId/appSecret/baseDomain; telegram: botToken; qq: appId/appSecret; wechat: botId/botToken/baseUrl/userId); secrets plaintext at rest (same trade-off as the proxy address in server_settings), masked at every API surface; a cleared secret is stored as "" (the row and its account identity stay)
+  enabled          INTEGER NOT NULL DEFAULT 0, -- INTENT state (the connection's runtime status stays in memory): new bindings start disabled \u2014 saving credentials never opens a connection, the explicit state toggle does
+  line_per_message INTEGER NOT NULL DEFAULT 0, -- delivery preference: 1 = every non-blank line of a relayed assistant reply is sent as its own message (a reply written as spoken lines arrives as spoken lines), 0 = one message per reply. Channel-agnostic, so it lives here rather than in config_json, which each connector owns
+  final_reply_only INTEGER NOT NULL DEFAULT 0, -- delivery preference: 1 = a run's intermediate assistant messages are held and only its LAST completed one is sent, at the run's end, 0 = every completed assistant message mirrors the moment it completes. Channel-agnostic like the column above and independent of it: with both set, that one final text is the one split per line
+  render_markdown  INTEGER NOT NULL DEFAULT 1, -- delivery preference: 1 = a relayed reply's Markdown is rendered in the channel's own markup (Telegram HTML, a Feishu card, QQ markdown, the subset WeChat itself reads), 0 = the reply's characters are sent as written. DEFAULT 1 because the model writes Markdown and showing it raw was the defect; the per-channel subsets and the plain-text fallback live in the connectors
+  last_chat_id     TEXT,                       -- most recent inbound chat (NULL until the bot is messaged once; replies and test messages target it); CONNECTOR-OPAQUE, not necessarily a bare chat id \u2014 telegram appends the forum topic (see telegram-connector.ts chatRefOf), so only that channel's connector may interpret it
+  last_chat_is_direct INTEGER NOT NULL DEFAULT 1, -- 1 = direct chat (reply by chat id), 0 = group chat (prefer reply-to-message)
+  last_inbound_message_id TEXT,                 -- channel id of the most recently PROCESSED inbound message (NULL until one arrives); the durable half of the bridge's redelivery guard, so a channel replaying an event this server already turned into a Task after a restart does not run it twice
+  created_at       TEXT NOT NULL,
+  updated_at       TEXT NOT NULL,
+  PRIMARY KEY (session_id, channel)
+);
+CREATE INDEX IF NOT EXISTS idx_messaging_by_account ON messaging_bindings(channel, account_id);  -- serves the enable guard's by-account lookup; deliberately NOT unique, unlike its predecessor idx_messaging_account (dropped on open) which made an account exclusive to one Session forever
+CREATE TABLE IF NOT EXISTS messaging_conversations ( -- per-(bot, chat) delivery state a connector must keep across reconnects and restarts (WeChat: the context token, its send count, held replies); deleted once no messaging_bindings row references (channel, account_id) \u2014 see MessagingBindingsRepo
+  channel    TEXT NOT NULL,                     -- messaging channel discriminator (only 'wechat' writes rows today)
+  account_id TEXT NOT NULL,                     -- the bot, as messaging_bindings.account_id names it
+  chat_id    TEXT NOT NULL,                     -- the connector's own chat id (wechat: the user's ilink_user_id)
+  state_json TEXT NOT NULL,                     -- connector-owned JSON (wechat: {contextToken, tokenAt, spent, held, heldSince}); the token is a conversation handle at rest, same trade-off as config_json's credentials
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (channel, account_id, chat_id)
+);
+CREATE TABLE IF NOT EXISTS ui_prefs (
+  user_id    TEXT PRIMARY KEY REFERENCES users(user_id) ON DELETE CASCADE,
+  prefs_json TEXT NOT NULL                    -- {theme?, lastProjectId?, ...} free-form JSON
+);
+CREATE TABLE IF NOT EXISTS user_drafts ( -- a user's unsent drafts (composer text, parked conversations, form answers), so they follow the account to another browser; bounded per user, dropped with the Session or Project they belong to
+  user_id    TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+  draft_key  TEXT NOT NULL,                   -- <kind>:<id> (api/types.ts DRAFT_KINDS)
+  session_id TEXT,                            -- the Session the key names (session / a2ui kinds); NULL otherwise
+  project_id TEXT,                            -- the Project the key names (chat / parked / org / channel kinds); NULL otherwise
+  value_json TEXT NOT NULL,                   -- the draft as the Web App wrote it
+  updated_at TEXT NOT NULL,                   -- last write (ISO); the oldest go first when the user's bound is exceeded
+  PRIMARY KEY (user_id, draft_key)
+);
+CREATE INDEX IF NOT EXISTS idx_user_drafts_session ON user_drafts(session_id);
+CREATE INDEX IF NOT EXISTS idx_user_drafts_project ON user_drafts(project_id);
+CREATE TABLE IF NOT EXISTS user_background_images ( -- the custom background image of a user's appearance settings, apart from ui_prefs so the megabyte it may hold is read only by the one route that serves it
+  user_id    TEXT PRIMARY KEY REFERENCES users(user_id) ON DELETE CASCADE,
+  image      TEXT NOT NULL,                   -- data URL (image/png|jpeg|webp, <= BACKGROUND_IMAGE_MAX_CHARS characters)
+  image_id   TEXT NOT NULL,                   -- content hash; mirrored into ui_prefs.backgroundImageId so a browser fetches the image only when it changed
+  updated_at TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS browser_extensions ( -- one row per Chrome paired to a user (builtin-browser/extension-pairing.ts): the PenguinHarness Browser extension's long-lived credential, stored only hashed; NOT rebuildable \u2014 a lost row means pairing that Chrome again
+  extension_id TEXT PRIMARY KEY,              -- random id shown in the Web App's list
+  user_id      TEXT NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
+  token_hash   TEXT NOT NULL UNIQUE,          -- sha256(token) hex; the extension alone holds the token
+  name         TEXT NOT NULL,                 -- how the extension names this Chrome ("Chrome 130 on macOS")
+  version      TEXT NOT NULL,                 -- the extension's version, as of its last hello
+  created_at   TEXT NOT NULL,
+  last_seen_at TEXT,                          -- last connect or disconnect; NULL = never connected
+  revoked_at   TEXT                           -- set by Revoke; a revoked token's socket is closed 4003
+);
+CREATE INDEX IF NOT EXISTS idx_browser_extensions_user ON browser_extensions(user_id);
+CREATE TABLE IF NOT EXISTS agent_api (          -- per-Agent public API settings (amsp/routes.ts); NOT rebuildable from files
+  project_id    TEXT NOT NULL,
+  agent_id      TEXT NOT NULL,
+  enabled       INTEGER NOT NULL DEFAULT 0,     -- the API tab's switch; off = every /api/amsp request for it is 404 agent_not_found
+  open          INTEGER NOT NULL DEFAULT 0,     -- keyless access: a request without Authorization is accepted; off = 401 unauthorized
+  approval_mode TEXT NOT NULL DEFAULT 'allow-all', -- copied onto each new API Session
+  provider      TEXT,                         -- NULL pair follows the Project default model
+  model_id      TEXT,
+  thinking_level TEXT,                        -- NULL follows Agent/Project configuration
+  workspace     TEXT,                         -- NULL creates a temporary Workspace
+  max_concurrent_runs INTEGER NOT NULL DEFAULT 4,
+  updated_at    TEXT NOT NULL,
+  PRIMARY KEY (project_id, agent_id)
+);
+CREATE TABLE IF NOT EXISTS agent_api_keys (     -- one row per key the API tab or the CLI minted; the caller alone holds the key
+  key_id       TEXT PRIMARY KEY,                -- 16 base64url chars, shown in the list
+  project_id   TEXT NOT NULL,
+  agent_id     TEXT NOT NULL,
+  token_hash   TEXT NOT NULL UNIQUE,            -- sha256(key) hex
+  prefix       TEXT NOT NULL,                   -- the key's first 16 characters ("penguin_" + 8), shown in the list
+  name         TEXT NOT NULL,                   -- 1-64 characters
+  created_by   TEXT NOT NULL REFERENCES users(user_id),
+  created_at   TEXT NOT NULL,
+  last_used_at TEXT                             -- stamped once per run request that authenticated with it; NULL = never
+);
+CREATE INDEX IF NOT EXISTS idx_agent_api_keys_agent ON agent_api_keys(project_id, agent_id);
+CREATE TABLE IF NOT EXISTS server_settings (   -- admin-level server-global settings (GET/PUT /api/admin/settings)
+  key   TEXT PRIMARY KEY,                     -- setting name, e.g. 'proxy_for_app'
+  value TEXT NOT NULL                         -- JSON-encoded value; an absent row means the setting's built-in default
+);
+CREATE TABLE IF NOT EXISTS machine (           -- this server's OWN identity, minted here and never assigned from outside (what 'penguin server status' reports)
+  singleton  INTEGER PRIMARY KEY CHECK (singleton = 1),  -- exactly one row, enforced by the schema rather than by convention
+  machine_id TEXT NOT NULL                    -- 16 base64url characters; what every stored reference to this machine points at
+);
+CREATE TABLE IF NOT EXISTS machines (          -- one row per machine this server installed on or reached (machines/service.ts)
+  address      TEXT PRIMARY KEY,               -- 'ssh:<alias>'
+  machine_id   TEXT,                           -- that machine's own id, once heard
+  version      TEXT,                           -- what this server last installed there; NULL = never
+  installed_at TEXT,
+  session_pid  INTEGER,                        -- the ssh session this server holds to it; what a successor App closes after a hot swap
+  remote_port  INTEGER,                        -- its server's port over there, as of the last connect
+  platform     TEXT,                           -- linux | darwin | win32, as the install found it: the shell dialect the status probe speaks to it in
+  adopted_at   TEXT                            -- when this server first recorded this machine (reset when the address answers with another machine's id): Sessions it held before then read as CLI tasks through this server. NULL = recorded before the column existed; never filled in later, and the rule does not apply
+);
+CREATE TABLE IF NOT EXISTS machine_project (   -- which machines a Project uses; no row = none yet. Follows the Project out, like project_members
+  project_id TEXT PRIMARY KEY REFERENCES projects(project_id) ON DELETE CASCADE,
+  addresses  TEXT NOT NULL                     -- JSON array of 'ssh:<alias>'
+);
+CREATE TABLE IF NOT EXISTS trace_files (       -- DERIVED CACHE of the on-disk Trace tree (services/trace-index.ts): the directories stay the single source of truth, every row is rebuildable from disk, and a row is never authority for absence \u2014 consumers reconcile + retry on a miss, so a stale index costs one extra scan, never a false 404
+  project_id TEXT NOT NULL,
+  agent_id   TEXT NOT NULL,
+  session_id TEXT NOT NULL,
+  file_index INTEGER NOT NULL,               -- shard index NNN of <session_id>_NNN.jsonl (name/path are reconstructed from the row, never stored: the data root may move)
+  date       TEXT NOT NULL,                  -- date directory name (local yyyy-mm-dd)
+  size_bytes INTEGER NOT NULL,               -- last observed size (listings stat-refresh the returned page and write back; an actively-appended shard may lag in between)
+  page_stats TEXT,                           -- cached message-window scan state at this shard's END (services/message-window.ts ShardPrefixRecord JSON); immutable shards only, NULL = not yet computed, nulled whenever size_bytes changes
+  PRIMARY KEY (project_id, agent_id, session_id, file_index)
+);
+CREATE INDEX IF NOT EXISTS idx_trace_files_agent_date ON trace_files(project_id, agent_id, date);
+CREATE INDEX IF NOT EXISTS idx_trace_files_session ON trace_files(session_id);
+CREATE TABLE IF NOT EXISTS trace_sessions (    -- per-session facts read ONCE at registration from the earliest shard's head (same derived-cache rules as trace_files; listing needs zero head-reads)
+  session_id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  agent_id   TEXT NOT NULL,
+  source     TEXT,                           -- session_meta source as the head carried it: 'user' | 'api' | 'schedule' | 'subagent' | 'cli' | 'company'; NULL = the head records none (written before the source was required: read as 'company' for an 'org' row, else 'user' \u2014 readRecordedSource); 'benchmark' from older rows reads as 'cli' (normalizeSessionSource; meaningless while meta_read = 0)
+  workspace  TEXT NOT NULL DEFAULT '',
+  title      TEXT,                           -- first-prompt fallback title (sessions.title always wins when present)
+  provider   TEXT,                           -- model reference from session_meta: the model the Session was created on (CLI adoption reads it from here, and the runtime's own answer corrects the row at load; NULL = meta unreadable / legacy without provider)
+  model_id   TEXT,
+  first_ts   TEXT,                           -- first record's timestamp (adoption's createdAt fallback when the id embeds no time)
+  meta_read  INTEGER NOT NULL DEFAULT 0      -- 1 once the head parsed; 0 = facts unknown, retried by the next reconcile that touches the session
+);
+CREATE INDEX IF NOT EXISTS idx_trace_sessions_agent ON trace_sessions(project_id, agent_id);
+CREATE TABLE IF NOT EXISTS org_sessions (      -- DERIVED CACHE (company mode): desk sessions, rebuilt from each organization's desks.toml (current + previous); trigger_hop is mention-chain accounting and reads 0 after a rebuild
+  session_id  TEXT PRIMARY KEY,
+  project_id  TEXT NOT NULL,
+  org_id      TEXT NOT NULL,
+  agent_id    TEXT NOT NULL,
+  current     INTEGER NOT NULL DEFAULT 1,
+  trigger_hop INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS idx_org_sessions_org ON org_sessions(project_id, org_id);
+CREATE TABLE IF NOT EXISTS org_ticket_sessions ( -- DERIVED CACHE (company mode): ticket <-> contributing session, rebuilt from each ticket's Sessions header
+  project_id  TEXT NOT NULL,
+  org_id      TEXT NOT NULL,
+  ticket_id   TEXT NOT NULL,
+  session_id  TEXT NOT NULL,
+  agent_id    TEXT NOT NULL,
+  trigger_hop INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (project_id, org_id, ticket_id, session_id)
+);
+CREATE INDEX IF NOT EXISTS idx_org_ticket_sessions_session ON org_ticket_sessions(session_id);
+CREATE TABLE IF NOT EXISTS org_calendar_state ( -- calendar run state (company mode; the files are declarative intent), same rules as schedule_state
+  project_id     TEXT NOT NULL,
+  org_id         TEXT NOT NULL,
+  agent_id       TEXT NOT NULL,
+  name           TEXT NOT NULL,
+  start_at_ms    INTEGER NOT NULL,
+  def_hash       TEXT NOT NULL,
+  last_slot_ms   INTEGER,
+  last_fired_at  TEXT,
+  fired_once     INTEGER NOT NULL DEFAULT 0,
+  missed         INTEGER NOT NULL DEFAULT 0,
+  invalid_reason TEXT,
+  last_outcome   TEXT,
+  PRIMARY KEY (project_id, org_id, agent_id, name)
+);
+CREATE TABLE IF NOT EXISTS org_ticket_state (   -- DERIVED CACHE (company mode): the last (status, owner, blocked) seen per ticket, so a change is notified once; rebuilt silently from the ticket files
+  project_id  TEXT NOT NULL,
+  org_id      TEXT NOT NULL,
+  ticket_id   TEXT NOT NULL,
+  status      TEXT NOT NULL,
+  owner       TEXT NOT NULL DEFAULT '',
+  blocked     TEXT NOT NULL DEFAULT '',
+  blocked_by  TEXT NOT NULL DEFAULT '',
+  PRIMARY KEY (project_id, org_id, ticket_id)
+);
+CREATE TABLE IF NOT EXISTS org_channel_state ( -- DERIVED CACHE (company mode): tail-scan byte cursor per channel and day file
+  project_id   TEXT NOT NULL,
+  org_id       TEXT NOT NULL,
+  channel_id   TEXT NOT NULL,
+  date         TEXT NOT NULL,
+  offset_bytes INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (project_id, org_id, channel_id, date)
+);
+CREATE TABLE IF NOT EXISTS org_channel_reads ( -- user data (company mode): each user's read cursor in one channel
+  project_id   TEXT NOT NULL,
+  org_id       TEXT NOT NULL,
+  channel_id   TEXT NOT NULL,
+  user_id      TEXT NOT NULL,
+  last_read_id TEXT NOT NULL,
+  PRIMARY KEY (project_id, org_id, channel_id, user_id)
+);
+CREATE TABLE IF NOT EXISTS org_budget_state (   -- DERIVED CACHE (company mode): warn / pause marks per employee and period, recomputed from usage and the chart's budgets
+  project_id TEXT NOT NULL,
+  org_id     TEXT NOT NULL,
+  agent_id   TEXT NOT NULL,
+  period     TEXT NOT NULL,
+  warned_at  TEXT,
+  paused_at  TEXT,
+  PRIMARY KEY (project_id, org_id, agent_id, period)
+);
+CREATE TABLE IF NOT EXISTS org_desk_notices (   -- DERIVED CACHE (company mode): ticket changes waiting for an employee's next calendar sweep; dropping it loses only the digests not delivered yet
+  seq        INTEGER PRIMARY KEY AUTOINCREMENT,
+  project_id TEXT NOT NULL,
+  org_id     TEXT NOT NULL,
+  agent_id   TEXT NOT NULL,
+  ticket_id  TEXT NOT NULL,
+  change     TEXT NOT NULL,
+  at         TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_org_desk_notices_agent ON org_desk_notices(project_id, org_id, agent_id);
+`;
+
+// src/db/database.ts
+var sqlite = process.getBuiltinModule("node:sqlite");
+function openExistingDatabase(dbPath) {
+  const db = new sqlite.DatabaseSync(dbPath);
+  db.exec("PRAGMA foreign_keys = ON;");
+  db.exec("PRAGMA busy_timeout = 5000;");
+  return db;
+}
+function openDatabaseReadOnly(dbPath) {
+  const db = new sqlite.DatabaseSync(dbPath, { readOnly: true });
+  db.exec("PRAGMA busy_timeout = 5000;");
+  return db;
+}
+function openDatabase(dbPath) {
+  if (dbPath !== ":memory:") {
+    mkdirSync(path.dirname(dbPath), { recursive: true });
+  }
+  const db = new sqlite.DatabaseSync(dbPath);
+  db.exec("PRAGMA journal_mode = WAL;");
+  db.exec("PRAGMA busy_timeout = 5000;");
+  db.exec("PRAGMA foreign_keys = ON;");
+  db.exec(SCHEMA_SQL);
+  ensureColumn(db, "sessions", "client", "TEXT");
+  ensureColumn(db, "sessions", "has_trace", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn(db, "sessions", "fork_count", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn(db, "sessions", "thinking_level", "TEXT");
+  ensureColumn(db, "sessions", "sandbox", "TEXT");
+  ensureColumn(db, "auth_sessions", "via", "TEXT");
+  ensureColumn(db, "trace_files", "page_stats", "TEXT");
+  ensureColumn(db, "messaging_bindings", "line_per_message", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn(db, "messaging_bindings", "final_reply_only", "INTEGER NOT NULL DEFAULT 0");
+  ensureColumn(db, "messaging_bindings", "render_markdown", "INTEGER NOT NULL DEFAULT 1");
+  ensureColumn(db, "messaging_bindings", "last_inbound_message_id", "TEXT");
+  db.exec("DROP INDEX IF EXISTS idx_usage_session");
+  db.exec("DROP INDEX IF EXISTS idx_messaging_account");
+  upgradeLastActiveAt(db);
+  migrate2(db);
+  return db;
+}
+function upgradeLastActiveAt(db) {
+  db.exec("BEGIN");
+  try {
+    if (ensureColumn(db, "sessions", "last_active_at", "TEXT")) {
+      db.exec(
+        `UPDATE sessions SET last_active_at = COALESCE(
+           (SELECT MAX(ts) FROM usage_records WHERE usage_records.session_id = sessions.session_id),
+           created_at
+         )`
+      );
+    }
+    db.exec("COMMIT");
+  } catch (err) {
+    db.exec("ROLLBACK");
+    throw err;
+  }
+}
+function ensureColumn(db, table, column, ddl) {
+  const cols = db.prepare(`PRAGMA table_info(${table})`).all();
+  if (cols.some((c) => c.name === column)) return false;
+  db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${ddl}`);
+  return true;
+}
+
+export {
+  migrate2 as migrate,
+  openExistingDatabase,
+  openDatabaseReadOnly,
+  openDatabase
+};
+//# sourceMappingURL=chunk-5YLLSHY3.js.map