@taskforcehq/taskforce 0.3.169 → 0.3.300

package/dist/migrations/taskSchemaMigrations.js

@@ -1,3 +1,22 @@
+function hasTable(db, tableName) {
+    if (db.provider === 'postgres') {
+        const row = db.prepare(`
+            SELECT tablename AS name
+            FROM pg_catalog.pg_tables
+            WHERE schemaname = current_schema()
+              AND tablename = ?
+            LIMIT 1
+        `).get(tableName);
+        return Boolean(String(row?.name || '').trim());
+    }
+    const row = db.prepare(`
+        SELECT name
+        FROM sqlite_master
+        WHERE type = 'table' AND name = ?
+        LIMIT 1
+    `).get(tableName);
+    return Boolean(String(row?.name || '').trim());
+}
 export function ensureTenantSchema(db) {
     const taskColumns = db.prepare(`PRAGMA table_info(tasks)`).all();
     const hasTaskTenantColumn = taskColumns.some((c) => c.name === 'tenant_id');
@@ -9,16 +28,10 @@ export function ensureTenantSchema(db) {
     if (!hasCommentTenantColumn) {
         db.exec(`ALTER TABLE comments ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default'`);
     }
-    const screenshotColumns = db.prepare(`PRAGMA table_info(screenshots)`).all();
-    const hasScreenshotTenantColumn = screenshotColumns.some((c) => c.name === 'tenant_id');
-    if (!hasScreenshotTenantColumn) {
-        db.exec(`ALTER TABLE screenshots ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'default'`);
-    }
     db.exec(`
         CREATE INDEX IF NOT EXISTS idx_tasks_tenant ON tasks(tenant_id);
         CREATE INDEX IF NOT EXISTS idx_tasks_tenant_archived ON tasks(tenant_id, is_archived);
         CREATE INDEX IF NOT EXISTS idx_comments_tenant_task ON comments(tenant_id, task_id);
-        CREATE INDEX IF NOT EXISTS idx_screenshots_tenant_task ON screenshots(tenant_id, task_id);
     `);
 }
 export function ensureParentTaskSchema(db) {
@@ -106,6 +119,74 @@ export function ensureAssigneeTaskSchema(db) {
     }
     db.exec(`CREATE INDEX IF NOT EXISTS idx_tasks_assignee ON tasks(assignee)`);
 }
+export function ensureTaskReferenceSchema(db) {
+    const columns = db.prepare(`PRAGMA table_info(tasks)`).all();
+    const hasReferenceNumberColumn = columns.some((c) => c.name === 'reference_number');
+    if (!hasReferenceNumberColumn) {
+        db.exec(`ALTER TABLE tasks ADD COLUMN reference_number INTEGER`);
+    }
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS workspace_task_reference_sequences (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            next_reference_number INTEGER NOT NULL DEFAULT 0,
+            PRIMARY KEY (tenant_id, workspace_id)
+        );
+    `);
+    const workspaceRows = db.prepare(`
+        SELECT DISTINCT
+            COALESCE(tenant_id, 'default') AS tenant_id,
+            COALESCE(workspace_id, 'default') AS workspace_id
+        FROM tasks
+        ORDER BY tenant_id ASC, workspace_id ASC
+    `).all();
+    const selectRows = db.prepare(`
+        SELECT id, reference_number, created_at
+        FROM tasks
+        WHERE tenant_id = ? AND workspace_id = ?
+        ORDER BY created_at ASC, id ASC
+    `);
+    const updateReference = db.prepare(`
+        UPDATE tasks
+        SET reference_number = ?
+        WHERE tenant_id = ? AND workspace_id = ? AND id = ?
+    `);
+    const upsertSequence = db.prepare(`
+        INSERT INTO workspace_task_reference_sequences (tenant_id, workspace_id, next_reference_number)
+        VALUES (?, ?, ?)
+        ON CONFLICT (tenant_id, workspace_id) DO UPDATE SET
+            next_reference_number = EXCLUDED.next_reference_number
+    `);
+    for (const workspaceRow of workspaceRows) {
+        const tenantId = String(workspaceRow.tenant_id || 'default').trim() || 'default';
+        const workspaceId = String(workspaceRow.workspace_id || 'default').trim() || 'default';
+        const taskRows = selectRows.all(tenantId, workspaceId);
+        const seen = new Set();
+        let nextReferenceNumber = 0;
+        for (const row of taskRows) {
+            const taskId = String(row.id || '').trim();
+            if (!taskId)
+                continue;
+            const rawReferenceNumber = Number(row.reference_number);
+            const currentReferenceNumber = Number.isFinite(rawReferenceNumber) && rawReferenceNumber > 0
+                ? Math.floor(rawReferenceNumber)
+                : null;
+            if (currentReferenceNumber && !seen.has(currentReferenceNumber)) {
+                seen.add(currentReferenceNumber);
+                nextReferenceNumber = Math.max(nextReferenceNumber, currentReferenceNumber);
+                continue;
+            }
+            nextReferenceNumber += 1;
+            seen.add(nextReferenceNumber);
+            updateReference.run(nextReferenceNumber, tenantId, workspaceId, taskId);
+        }
+        upsertSequence.run(tenantId, workspaceId, nextReferenceNumber);
+    }
+    db.exec(`
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_tasks_workspace_reference
+        ON tasks(tenant_id, workspace_id, reference_number);
+    `);
+}
 export function ensureWorkspaceSchema(db) {
     db.exec(`
         CREATE TABLE IF NOT EXISTS workspaces (
@@ -162,6 +243,29 @@ export function ensureWorkspaceSchema(db) {
             FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE,
             FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
         );
+
+        CREATE TABLE IF NOT EXISTS mcp_access_tokens (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL,
+            user_id TEXT NOT NULL,
+            name TEXT NOT NULL,
+            scopes_json TEXT NOT NULL,
+            token_prefix TEXT NOT NULL,
+            token_hash TEXT NOT NULL,
+            status TEXT NOT NULL DEFAULT 'active',
+            last_used_at TEXT,
+            last_used_ip TEXT,
+            last_used_user_agent TEXT,
+            created_by_ip TEXT,
+            expires_at TEXT,
+            revoked_at TEXT,
+            revoked_by_user_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE,
+            FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+        );
     `);
     const taskColumns = db.prepare(`PRAGMA table_info(tasks)`).all();
     const hasTaskWorkspaceColumn = taskColumns.some((c) => c.name === 'workspace_id');
@@ -173,36 +277,75 @@ export function ensureWorkspaceSchema(db) {
     if (!hasCommentWorkspaceColumn) {
         db.exec(`ALTER TABLE comments ADD COLUMN workspace_id TEXT NOT NULL DEFAULT 'default'`);
     }
-    const screenshotColumns = db.prepare(`PRAGMA table_info(screenshots)`).all();
-    const hasScreenshotWorkspaceColumn = screenshotColumns.some((c) => c.name === 'workspace_id');
-    if (!hasScreenshotWorkspaceColumn) {
-        db.exec(`ALTER TABLE screenshots ADD COLUMN workspace_id TEXT NOT NULL DEFAULT 'default'`);
-    }
-    const userColumns = db.prepare(`PRAGMA table_info(users)`).all();
-    const hasPasswordHashColumn = userColumns.some((c) => c.name === 'password_hash');
-    if (!hasPasswordHashColumn) {
-        db.exec(`ALTER TABLE users ADD COLUMN password_hash TEXT`);
-    }
-    const hasEmailVerifiedAtColumn = userColumns.some((c) => c.name === 'email_verified_at');
-    if (!hasEmailVerifiedAtColumn) {
-        db.exec(`ALTER TABLE users ADD COLUMN email_verified_at TEXT`);
-    }
-    const hasSystemRoleColumn = userColumns.some((c) => c.name === 'system_role');
-    if (!hasSystemRoleColumn) {
-        db.exec(`ALTER TABLE users ADD COLUMN system_role TEXT NOT NULL DEFAULT 'user'`);
+    if (db.provider === 'postgres') {
+        const postgresUserRepairs = [
+            `ALTER TABLE users ADD COLUMN IF NOT EXISTS display_name TEXT`,
+            `ALTER TABLE users ADD COLUMN IF NOT EXISTS avatar_url TEXT`,
+            `ALTER TABLE users ADD COLUMN IF NOT EXISTS auth_provider TEXT`,
+            `ALTER TABLE users ADD COLUMN IF NOT EXISTS external_auth_id TEXT`,
+            `ALTER TABLE users ADD COLUMN IF NOT EXISTS password_hash TEXT`,
+            `ALTER TABLE users ADD COLUMN IF NOT EXISTS email_verified_at TEXT`,
+            `ALTER TABLE users ADD COLUMN IF NOT EXISTS beta_access BOOLEAN NOT NULL DEFAULT TRUE`,
+            `ALTER TABLE users ADD COLUMN IF NOT EXISTS is_disabled BOOLEAN NOT NULL DEFAULT FALSE`,
+            `ALTER TABLE users ADD COLUMN IF NOT EXISTS updated_at TEXT`,
+            `ALTER TABLE users ADD COLUMN IF NOT EXISTS system_role TEXT NOT NULL DEFAULT 'user'`
+        ];
+        for (const ddl of postgresUserRepairs) {
+            try {
+                db.exec(ddl);
+            }
+            catch {
+                // Best-effort repair for older deployments.
+            }
+        }
+        const postgresMembershipRepairs = [
+            `ALTER TABLE workspace_memberships ADD COLUMN IF NOT EXISTS permission_mode TEXT NOT NULL DEFAULT 'read-write'`,
+            `ALTER TABLE workspace_memberships ADD COLUMN IF NOT EXISTS beta_access BOOLEAN NOT NULL DEFAULT TRUE`,
+            `ALTER TABLE workspace_memberships ADD COLUMN IF NOT EXISTS status TEXT NOT NULL DEFAULT 'active'`,
+            `ALTER TABLE workspace_memberships ADD COLUMN IF NOT EXISTS updated_at TEXT`
+        ];
+        for (const ddl of postgresMembershipRepairs) {
+            try {
+                db.exec(ddl);
+            }
+            catch {
+                // Best-effort repair for older deployments.
+            }
+        }
     }
-    const hasUserBetaAccessColumn = userColumns.some((c) => c.name === 'beta_access');
-    if (!hasUserBetaAccessColumn) {
-        db.exec(`ALTER TABLE users ADD COLUMN beta_access BOOLEAN NOT NULL DEFAULT TRUE`);
-    }
-    const membershipColumns = db.prepare(`PRAGMA table_info(workspace_memberships)`).all();
-    const hasBetaAccessColumn = membershipColumns.some((c) => c.name === 'beta_access');
-    const hasPermissionModeColumn = membershipColumns.some((c) => c.name === 'permission_mode');
-    if (!hasBetaAccessColumn) {
-        db.exec(`ALTER TABLE workspace_memberships ADD COLUMN beta_access BOOLEAN NOT NULL DEFAULT TRUE`);
-    }
-    if (!hasPermissionModeColumn) {
-        db.exec(`ALTER TABLE workspace_memberships ADD COLUMN permission_mode TEXT NOT NULL DEFAULT 'read-write'`);
+    else {
+        const userColumns = db.prepare(`PRAGMA table_info(users)`).all();
+        const existingUserColumns = new Set(userColumns.map((column) => String(column.name || '').trim()));
+        const sqliteUserRepairs = [
+            { name: 'display_name', sql: `ALTER TABLE users ADD COLUMN display_name TEXT` },
+            { name: 'avatar_url', sql: `ALTER TABLE users ADD COLUMN avatar_url TEXT` },
+            { name: 'auth_provider', sql: `ALTER TABLE users ADD COLUMN auth_provider TEXT` },
+            { name: 'external_auth_id', sql: `ALTER TABLE users ADD COLUMN external_auth_id TEXT` },
+            { name: 'password_hash', sql: `ALTER TABLE users ADD COLUMN password_hash TEXT` },
+            { name: 'email_verified_at', sql: `ALTER TABLE users ADD COLUMN email_verified_at TEXT` },
+            { name: 'beta_access', sql: `ALTER TABLE users ADD COLUMN beta_access BOOLEAN NOT NULL DEFAULT TRUE` },
+            { name: 'is_disabled', sql: `ALTER TABLE users ADD COLUMN is_disabled BOOLEAN NOT NULL DEFAULT FALSE` },
+            { name: 'updated_at', sql: `ALTER TABLE users ADD COLUMN updated_at TEXT` },
+            { name: 'system_role', sql: `ALTER TABLE users ADD COLUMN system_role TEXT NOT NULL DEFAULT 'user'` }
+        ];
+        for (const column of sqliteUserRepairs) {
+            if (!existingUserColumns.has(column.name)) {
+                db.exec(column.sql);
+            }
+        }
+        const membershipColumns = db.prepare(`PRAGMA table_info(workspace_memberships)`).all();
+        const existingMembershipColumns = new Set(membershipColumns.map((column) => String(column.name || '').trim()));
+        const sqliteMembershipRepairs = [
+            { name: 'permission_mode', sql: `ALTER TABLE workspace_memberships ADD COLUMN permission_mode TEXT NOT NULL DEFAULT 'read-write'` },
+            { name: 'beta_access', sql: `ALTER TABLE workspace_memberships ADD COLUMN beta_access BOOLEAN NOT NULL DEFAULT TRUE` },
+            { name: 'status', sql: `ALTER TABLE workspace_memberships ADD COLUMN status TEXT NOT NULL DEFAULT 'active'` },
+            { name: 'updated_at', sql: `ALTER TABLE workspace_memberships ADD COLUMN updated_at TEXT` }
+        ];
+        for (const column of sqliteMembershipRepairs) {
+            if (!existingMembershipColumns.has(column.name)) {
+                db.exec(column.sql);
+            }
+        }
     }
     const authTokenColumns = db.prepare(`PRAGMA table_info(auth_tokens)`).all();
     const hasRevokedAtColumn = authTokenColumns.some((c) => c.name === 'revoked_at');
@@ -213,6 +356,32 @@ export function ensureWorkspaceSchema(db) {
     if (!hasWorkspaceIdColumn) {
         db.exec(`ALTER TABLE auth_tokens ADD COLUMN workspace_id TEXT`);
     }
+    const mcpTokenColumns = db.prepare(`PRAGMA table_info(mcp_access_tokens)`).all();
+    if (mcpTokenColumns.length > 0) {
+        const requiredColumns = [
+            { name: 'workspace_id', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN workspace_id TEXT NOT NULL DEFAULT 'default'` },
+            { name: 'user_id', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN user_id TEXT NOT NULL DEFAULT ''` },
+            { name: 'name', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN name TEXT NOT NULL DEFAULT ''` },
+            { name: 'scopes_json', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN scopes_json TEXT NOT NULL DEFAULT '[]'` },
+            { name: 'token_prefix', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN token_prefix TEXT NOT NULL DEFAULT ''` },
+            { name: 'token_hash', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN token_hash TEXT NOT NULL DEFAULT ''` },
+            { name: 'status', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN status TEXT NOT NULL DEFAULT 'active'` },
+            { name: 'last_used_at', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN last_used_at TEXT` },
+            { name: 'last_used_ip', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN last_used_ip TEXT` },
+            { name: 'last_used_user_agent', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN last_used_user_agent TEXT` },
+            { name: 'created_by_ip', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN created_by_ip TEXT` },
+            { name: 'expires_at', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN expires_at TEXT` },
+            { name: 'revoked_at', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN revoked_at TEXT` },
+            { name: 'revoked_by_user_id', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN revoked_by_user_id TEXT` },
+            { name: 'created_at', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN created_at TEXT NOT NULL DEFAULT ''` },
+            { name: 'updated_at', sql: `ALTER TABLE mcp_access_tokens ADD COLUMN updated_at TEXT NOT NULL DEFAULT ''` },
+        ];
+        for (const column of requiredColumns) {
+            if (!mcpTokenColumns.some((c) => c.name === column.name)) {
+                db.exec(column.sql);
+            }
+        }
+    }
     db.exec(`
         CREATE UNIQUE INDEX IF NOT EXISTS idx_workspaces_tenant_slug ON workspaces(tenant_id, slug);
         CREATE UNIQUE INDEX IF NOT EXISTS idx_users_tenant_email ON users(tenant_id, email);
@@ -223,12 +392,15 @@ export function ensureWorkspaceSchema(db) {
         CREATE INDEX IF NOT EXISTS idx_tasks_workspace ON tasks(workspace_id);
         CREATE INDEX IF NOT EXISTS idx_tasks_tenant_workspace_archived ON tasks(tenant_id, workspace_id, is_archived);
         CREATE INDEX IF NOT EXISTS idx_comments_workspace_task ON comments(workspace_id, task_id);
-        CREATE INDEX IF NOT EXISTS idx_screenshots_workspace_task ON screenshots(workspace_id, task_id);
         CREATE INDEX IF NOT EXISTS idx_workspace_memberships_user ON workspace_memberships(user_id);
         CREATE INDEX IF NOT EXISTS idx_workspace_memberships_workspace ON workspace_memberships(workspace_id);
         CREATE INDEX IF NOT EXISTS idx_auth_tokens_user_purpose ON auth_tokens(user_id, purpose);
         CREATE INDEX IF NOT EXISTS idx_auth_tokens_workspace_purpose ON auth_tokens(workspace_id, purpose);
         CREATE INDEX IF NOT EXISTS idx_auth_tokens_expires ON auth_tokens(expires_at);
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_mcp_access_tokens_prefix ON mcp_access_tokens(token_prefix);
+        CREATE INDEX IF NOT EXISTS idx_mcp_access_tokens_workspace_user ON mcp_access_tokens(workspace_id, user_id);
+        CREATE INDEX IF NOT EXISTS idx_mcp_access_tokens_status ON mcp_access_tokens(status);
+        CREATE INDEX IF NOT EXISTS idx_mcp_access_tokens_expires ON mcp_access_tokens(expires_at);
     `);
 }
 export function ensureBillingSchema(db) {
@@ -240,9 +412,9 @@ export function ensureBillingSchema(db) {
             stripe_subscription_id TEXT,
             stripe_price_id TEXT,
             stripe_status TEXT,
-            tier TEXT NOT NULL DEFAULT 'free',
+            tier TEXT NOT NULL DEFAULT '',
             billing_interval TEXT,
-            entitlement_state TEXT NOT NULL DEFAULT 'free',
+            entitlement_state TEXT NOT NULL DEFAULT 'active',
             trial_end TEXT,
             current_period_end TEXT,
             effective_until TEXT,
@@ -281,10 +453,13 @@ export function ensureBillingSchema(db) {
             plan_version_id TEXT NOT NULL,
             billing_interval TEXT NOT NULL,
             stripe_price_id TEXT NOT NULL,
+            pricing_type TEXT NOT NULL DEFAULT 'stripe',
             active BOOLEAN NOT NULL DEFAULT TRUE,
+            unit_amount INTEGER,
+            currency TEXT,
             created_at TEXT NOT NULL,
             updated_at TEXT NOT NULL,
-            PRIMARY KEY (tenant_id, stripe_price_id)
+            PRIMARY KEY (tenant_id, plan_version_id, billing_interval, stripe_price_id)
         );
 
         CREATE INDEX IF NOT EXISTS idx_user_billing_tenant ON user_billing(tenant_id);
@@ -296,6 +471,159 @@ export function ensureBillingSchema(db) {
         CREATE INDEX IF NOT EXISTS idx_billing_price_mappings_plan ON billing_price_mappings(tenant_id, plan_version_id);
         CREATE INDEX IF NOT EXISTS idx_billing_price_mappings_active ON billing_price_mappings(tenant_id, active);
     `);
+    const columns = db.prepare(`PRAGMA table_info(billing_price_mappings)`).all();
+    const hasUnitAmountColumn = columns.some((c) => c.name === 'unit_amount');
+    const hasCurrencyColumn = columns.some((c) => c.name === 'currency');
+    const hasPricingTypeColumn = columns.some((c) => c.name === 'pricing_type');
+    if (!hasUnitAmountColumn) {
+        db.exec(`ALTER TABLE billing_price_mappings ADD COLUMN unit_amount INTEGER`);
+    }
+    if (!hasCurrencyColumn) {
+        db.exec(`ALTER TABLE billing_price_mappings ADD COLUMN currency TEXT`);
+    }
+    if (!hasPricingTypeColumn) {
+        db.exec(`ALTER TABLE billing_price_mappings ADD COLUMN pricing_type TEXT NOT NULL DEFAULT 'stripe'`);
+    }
+    ensureBillingPriceMappingsConstraints(db);
+    normalizeUserBillingDefaults(db);
+}
+function ensureBillingPriceMappingsConstraints(db) {
+    if (db.provider === 'postgres') {
+        db.exec(`
+            ALTER TABLE billing_price_mappings DROP CONSTRAINT IF EXISTS billing_price_mappings_pkey;
+            ALTER TABLE billing_price_mappings
+            ADD CONSTRAINT billing_price_mappings_pkey
+            PRIMARY KEY (tenant_id, plan_version_id, billing_interval, stripe_price_id);
+            CREATE UNIQUE INDEX IF NOT EXISTS idx_billing_price_mappings_active_interval
+            ON billing_price_mappings(tenant_id, plan_version_id, billing_interval)
+            WHERE active = TRUE;
+        `);
+        return;
+    }
+    const indexes = db.prepare(`PRAGMA index_list(billing_price_mappings)`).all();
+    const tableInfo = db.prepare(`PRAGMA table_info(billing_price_mappings)`).all();
+    const hasActiveIntervalIndex = indexes.some((index) => index.name === 'idx_billing_price_mappings_active_interval');
+    const primaryKeyColumns = tableInfo
+        .filter((column) => Number(column.pk || 0) > 0)
+        .sort((a, b) => Number(a.pk || 0) - Number(b.pk || 0))
+        .map((column) => String(column.name || ''));
+    const needsPrimaryKeyRepair = primaryKeyColumns.join('|') !== 'tenant_id|plan_version_id|billing_interval|stripe_price_id';
+    if (needsPrimaryKeyRepair) {
+        db.exec(`
+            ALTER TABLE billing_price_mappings RENAME TO billing_price_mappings_legacy;
+
+            CREATE TABLE billing_price_mappings (
+                tenant_id TEXT NOT NULL DEFAULT 'default',
+                plan_version_id TEXT NOT NULL,
+                billing_interval TEXT NOT NULL,
+                stripe_price_id TEXT NOT NULL,
+                pricing_type TEXT NOT NULL DEFAULT 'stripe',
+                active BOOLEAN NOT NULL DEFAULT TRUE,
+                unit_amount INTEGER,
+                currency TEXT,
+                created_at TEXT NOT NULL,
+                updated_at TEXT NOT NULL,
+                PRIMARY KEY (tenant_id, plan_version_id, billing_interval, stripe_price_id)
+            );
+
+            INSERT INTO billing_price_mappings (
+                tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at
+            )
+            SELECT
+                tenant_id, plan_version_id, billing_interval, stripe_price_id, COALESCE(pricing_type, 'stripe'), active, unit_amount, currency, created_at, updated_at
+            FROM billing_price_mappings_legacy;
+
+            DROP TABLE billing_price_mappings_legacy;
+        `);
+    }
+    if (!hasActiveIntervalIndex) {
+        db.exec(`
+            CREATE UNIQUE INDEX IF NOT EXISTS idx_billing_price_mappings_active_interval
+            ON billing_price_mappings(tenant_id, plan_version_id, billing_interval)
+            WHERE active = 1;
+        `);
+    }
+}
+function normalizeUserBillingDefaults(db) {
+    if (db.provider === 'postgres') {
+        db.exec(`
+            ALTER TABLE user_billing ALTER COLUMN tier SET DEFAULT '';
+            ALTER TABLE user_billing ALTER COLUMN entitlement_state SET DEFAULT 'active';
+        `);
+        return;
+    }
+    const columns = db.prepare(`PRAGMA table_info(user_billing)`).all();
+    const tierColumn = columns.find((column) => column.name === 'tier');
+    const stateColumn = columns.find((column) => column.name === 'entitlement_state');
+    const tierDefault = String(tierColumn?.dflt_value ?? '').trim();
+    const stateDefault = String(stateColumn?.dflt_value ?? '').trim().toLowerCase();
+    const tierNeedsRepair = tierDefault !== "''";
+    const stateNeedsRepair = stateDefault !== "'active'";
+    if (!tierNeedsRepair && !stateNeedsRepair) {
+        return;
+    }
+    const tx = db.transaction(() => {
+        db.exec(`
+            ALTER TABLE user_billing RENAME TO user_billing_legacy;
+
+            CREATE TABLE user_billing (
+                user_id TEXT PRIMARY KEY,
+                tenant_id TEXT NOT NULL DEFAULT 'default',
+                stripe_customer_id TEXT UNIQUE,
+                stripe_subscription_id TEXT,
+                stripe_price_id TEXT,
+                stripe_status TEXT,
+                tier TEXT NOT NULL DEFAULT '',
+                billing_interval TEXT,
+                entitlement_state TEXT NOT NULL DEFAULT 'active',
+                trial_end TEXT,
+                current_period_end TEXT,
+                effective_until TEXT,
+                created_at TEXT NOT NULL,
+                updated_at TEXT NOT NULL,
+                FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+            );
+
+            INSERT INTO user_billing (
+                user_id,
+                tenant_id,
+                stripe_customer_id,
+                stripe_subscription_id,
+                stripe_price_id,
+                stripe_status,
+                tier,
+                billing_interval,
+                entitlement_state,
+                trial_end,
+                current_period_end,
+                effective_until,
+                created_at,
+                updated_at
+            )
+            SELECT
+                user_id,
+                tenant_id,
+                stripe_customer_id,
+                stripe_subscription_id,
+                stripe_price_id,
+                stripe_status,
+                tier,
+                billing_interval,
+                entitlement_state,
+                trial_end,
+                current_period_end,
+                effective_until,
+                created_at,
+                updated_at
+            FROM user_billing_legacy;
+
+            DROP TABLE user_billing_legacy;
+
+            CREATE INDEX IF NOT EXISTS idx_user_billing_tenant ON user_billing(tenant_id);
+            CREATE INDEX IF NOT EXISTS idx_user_billing_customer ON user_billing(stripe_customer_id);
+        `);
+    });
+    tx();
 }
 export function ensureEntitlementsSchema(db) {
     db.exec(`
@@ -416,6 +744,152 @@ export function ensureTaskAssetsSchema(db) {
         db.exec(`ALTER TABLE task_assets ADD COLUMN quarantine_status TEXT NOT NULL DEFAULT 'none'`);
     }
 }
+export function ensureWorkspaceAssetsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS workspace_assets (
+            asset_id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL,
+            kind TEXT NOT NULL,
+            logical_name TEXT,
+            original_filename TEXT NOT NULL,
+            mime_type TEXT NOT NULL,
+            storage_provider TEXT NOT NULL,
+            storage_key TEXT NOT NULL,
+            content_sha256 TEXT NOT NULL,
+            size_bytes INTEGER NOT NULL,
+            document_id TEXT,
+            version INTEGER,
+            is_latest INTEGER NOT NULL DEFAULT 1,
+            scan_status TEXT NOT NULL DEFAULT 'clean',
+            scan_engine TEXT,
+            scan_details TEXT,
+            created_by_user_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            deleted_at TEXT,
+            purge_after TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_assets_workspace_deleted_updated
+        ON workspace_assets(tenant_id, workspace_id, deleted_at, updated_at);
+        CREATE INDEX IF NOT EXISTS idx_workspace_assets_workspace_kind_updated
+        ON workspace_assets(tenant_id, workspace_id, kind, updated_at);
+        CREATE INDEX IF NOT EXISTS idx_workspace_assets_document_version
+        ON workspace_assets(tenant_id, workspace_id, document_id, version);
+        CREATE INDEX IF NOT EXISTS idx_workspace_assets_sha
+        ON workspace_assets(tenant_id, workspace_id, content_sha256);
+        CREATE INDEX IF NOT EXISTS idx_workspace_assets_purge_after
+        ON workspace_assets(purge_after);
+
+        CREATE TABLE IF NOT EXISTS workspace_asset_links (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL,
+            asset_id TEXT NOT NULL,
+            task_id TEXT NOT NULL,
+            role TEXT NOT NULL,
+            display_name TEXT,
+            sort_order INTEGER,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            deleted_at TEXT,
+            PRIMARY KEY (tenant_id, workspace_id, asset_id, task_id, role)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_workspace_asset_links_task
+        ON workspace_asset_links(tenant_id, workspace_id, task_id, deleted_at, updated_at);
+        CREATE INDEX IF NOT EXISTS idx_workspace_asset_links_asset
+        ON workspace_asset_links(tenant_id, workspace_id, asset_id, deleted_at, updated_at);
+    `);
+    const linkColumns = db.prepare(`PRAGMA table_info(workspace_asset_links)`).all();
+    const hasDisplayNameColumn = linkColumns.some((c) => c.name === 'display_name');
+    if (!hasDisplayNameColumn) {
+        db.exec(`ALTER TABLE workspace_asset_links ADD COLUMN display_name TEXT`);
+    }
+}
+export function ensureDocumentReferenceSchema(db) {
+    const columns = db.prepare(`PRAGMA table_info(workspace_assets)`).all();
+    const hasReferenceNumberColumn = columns.some((c) => c.name === 'reference_number');
+    if (!hasReferenceNumberColumn) {
+        db.exec(`ALTER TABLE workspace_assets ADD COLUMN reference_number INTEGER`);
+    }
+    // Drop the original cross-kind unique index before backfilling per-kind
+    // references. Otherwise existing D-### rows can block image backfills such
+    // as I-1 / I-2 while the old uniqueness rule is still active.
+    db.exec(`DROP INDEX IF EXISTS idx_workspace_assets_workspace_reference`);
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS workspace_document_reference_sequences (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            next_reference_number INTEGER NOT NULL DEFAULT 0,
+            PRIMARY KEY (tenant_id, workspace_id)
+        );
+        CREATE TABLE IF NOT EXISTS workspace_image_reference_sequences (
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            next_reference_number INTEGER NOT NULL DEFAULT 0,
+            PRIMARY KEY (tenant_id, workspace_id)
+        );
+    `);
+    const backfillKindReferences = (kind, sequenceTable) => {
+        const workspaceRows = db.prepare(`
+            SELECT DISTINCT
+                COALESCE(tenant_id, 'default') AS tenant_id,
+                COALESCE(workspace_id, 'default') AS workspace_id
+            FROM workspace_assets
+            WHERE kind = ?
+            ORDER BY tenant_id ASC, workspace_id ASC
+        `).all(kind);
+        const selectRows = db.prepare(`
+            SELECT asset_id, reference_number, created_at
+            FROM workspace_assets
+            WHERE tenant_id = ? AND workspace_id = ? AND kind = ?
+            ORDER BY created_at ASC, asset_id ASC
+        `);
+        const updateReference = db.prepare(`
+            UPDATE workspace_assets
+            SET reference_number = ?
+            WHERE tenant_id = ? AND workspace_id = ? AND asset_id = ?
+        `);
+        const upsertSequence = db.prepare(`
+            INSERT INTO ${sequenceTable} (tenant_id, workspace_id, next_reference_number)
+            VALUES (?, ?, ?)
+            ON CONFLICT (tenant_id, workspace_id) DO UPDATE SET
+                next_reference_number = EXCLUDED.next_reference_number
+        `);
+        for (const workspaceRow of workspaceRows) {
+            const tenantId = String(workspaceRow.tenant_id || 'default').trim() || 'default';
+            const workspaceId = String(workspaceRow.workspace_id || 'default').trim() || 'default';
+            const assetRows = selectRows.all(tenantId, workspaceId, kind);
+            const seen = new Set();
+            let nextReferenceNumber = 0;
+            for (const row of assetRows) {
+                const assetId = String(row.asset_id || '').trim();
+                if (!assetId)
+                    continue;
+                const rawReferenceNumber = Number(row.reference_number);
+                const currentReferenceNumber = Number.isFinite(rawReferenceNumber) && rawReferenceNumber > 0
+                    ? Math.floor(rawReferenceNumber)
+                    : null;
+                if (currentReferenceNumber && !seen.has(currentReferenceNumber)) {
+                    seen.add(currentReferenceNumber);
+                    nextReferenceNumber = Math.max(nextReferenceNumber, currentReferenceNumber);
+                    continue;
+                }
+                nextReferenceNumber += 1;
+                seen.add(nextReferenceNumber);
+                updateReference.run(nextReferenceNumber, tenantId, workspaceId, assetId);
+            }
+            upsertSequence.run(tenantId, workspaceId, nextReferenceNumber);
+        }
+    };
+    backfillKindReferences('document', 'workspace_document_reference_sequences');
+    backfillKindReferences('image', 'workspace_image_reference_sequences');
+    db.exec(`
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_workspace_assets_workspace_kind_reference
+        ON workspace_assets(tenant_id, workspace_id, kind, reference_number);
+    `);
+}
 export function ensureSyncEventsSchema(db) {
     const syncEventsIdColumnSql = db.provider === 'postgres'
         ? 'id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY'
@@ -451,3 +925,171 @@ export function ensureWorkspaceDocumentsSchema(db) {
         ON workspace_documents(tenant_id, workspace_id, path);
     `);
 }
+export function ensureAnnotatedAttachmentSessionsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS annotated_attachment_sessions (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            task_id TEXT NOT NULL,
+            base_image_asset_id TEXT NOT NULL,
+            title TEXT,
+            global_instruction TEXT,
+            annotations_json TEXT NOT NULL DEFAULT '[]',
+            created_by_actor_id TEXT,
+            updated_by_actor_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            deleted_at TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_annotated_attachment_sessions_task
+        ON annotated_attachment_sessions(tenant_id, workspace_id, task_id, deleted_at, updated_at);
+        CREATE INDEX IF NOT EXISTS idx_annotated_attachment_sessions_image
+        ON annotated_attachment_sessions(tenant_id, workspace_id, base_image_asset_id, deleted_at, updated_at);
+    `);
+}
+export function ensureDocumentReviewSessionsSchema(db) {
+    db.exec(`
+        CREATE TABLE IF NOT EXISTS document_review_sessions (
+            id TEXT PRIMARY KEY,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            asset_id TEXT NOT NULL,
+            document_id TEXT,
+            document_version INTEGER,
+            title TEXT,
+            status TEXT NOT NULL DEFAULT 'open',
+            comments_json TEXT NOT NULL DEFAULT '[]',
+            created_by_actor_id TEXT,
+            updated_by_actor_id TEXT,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            deleted_at TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_document_review_sessions_asset
+        ON document_review_sessions(tenant_id, workspace_id, asset_id, deleted_at, updated_at);
+        CREATE INDEX IF NOT EXISTS idx_document_review_sessions_workspace
+        ON document_review_sessions(tenant_id, workspace_id, updated_at, id);
+
+        CREATE TABLE IF NOT EXISTS document_review_comments (
+            id TEXT PRIMARY KEY,
+            session_id TEXT NOT NULL,
+            tenant_id TEXT NOT NULL DEFAULT 'default',
+            workspace_id TEXT NOT NULL DEFAULT 'default',
+            body TEXT NOT NULL,
+            anchor_json TEXT,
+            author_actor_id TEXT,
+            order_index INTEGER NOT NULL DEFAULT 0,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            deleted_at TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_document_review_comments_session
+        ON document_review_comments(tenant_id, workspace_id, session_id, deleted_at, order_index, created_at, id);
+        CREATE INDEX IF NOT EXISTS idx_document_review_comments_workspace
+        ON document_review_comments(tenant_id, workspace_id, updated_at, id);
+    `);
+    const sessionRows = db.prepare(`
+        SELECT
+            id,
+            tenant_id,
+            workspace_id,
+            comments_json
+        FROM document_review_sessions
+        WHERE comments_json IS NOT NULL
+          AND TRIM(comments_json) <> ''
+          AND comments_json <> '[]'
+    `).all();
+    const hasExistingComment = db.prepare(`
+        SELECT id
+        FROM document_review_comments
+        WHERE tenant_id = ? AND workspace_id = ? AND session_id = ?
+        LIMIT 1
+    `);
+    const insertComment = db.prepare(`
+        INSERT INTO document_review_comments (
+            id,
+            session_id,
+            tenant_id,
+            workspace_id,
+            body,
+            anchor_json,
+            author_actor_id,
+            order_index,
+            created_at,
+            updated_at,
+            deleted_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `);
+    for (const row of sessionRows) {
+        const sessionId = String(row.id || '').trim();
+        const tenantId = String(row.tenant_id || 'default').trim() || 'default';
+        const workspaceId = String(row.workspace_id || 'default').trim() || 'default';
+        if (!sessionId)
+            continue;
+        const existing = hasExistingComment.get(tenantId, workspaceId, sessionId);
+        if (existing?.id)
+            continue;
+        try {
+            const parsed = JSON.parse(String(row.comments_json || '[]'));
+            if (!Array.isArray(parsed))
+                continue;
+            for (let index = 0; index < parsed.length; index += 1) {
+                const raw = parsed[index];
+                if (!raw || typeof raw !== 'object')
+                    continue;
+                const record = raw;
+                const commentId = String(record.id || '').trim() || `${sessionId}-comment-${index + 1}`;
+                const body = String(record.body || '').trim();
+                if (!body)
+                    continue;
+                const createdAt = String(record.createdAt || '').trim() || new Date().toISOString();
+                const updatedAt = String(record.updatedAt || '').trim() || createdAt;
+                const anchorJson = record.anchor && typeof record.anchor === 'object' ? JSON.stringify(record.anchor) : null;
+                const rawOrder = Number(record.order);
+                const orderIndex = Number.isFinite(rawOrder) ? Math.max(0, Math.floor(rawOrder)) : index;
+                insertComment.run(commentId, sessionId, tenantId, workspaceId, body, anchorJson, String(record.authorActorId || '').trim() || null, orderIndex, createdAt, updatedAt, String(record.deletedAt || '').trim() || null);
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    if (hasTable(db, 'workspace_memberships') && hasTable(db, 'users')) {
+        const anonymousComments = db.prepare(`
+            SELECT DISTINCT tenant_id, workspace_id
+            FROM document_review_comments
+            WHERE LOWER(COALESCE(author_actor_id, '')) = 'anonymous'
+        `).all();
+        const resolveFallbackActor = db.prepare(`
+            SELECT m.user_id
+            FROM workspace_memberships m
+            JOIN users u
+              ON u.tenant_id = m.tenant_id
+             AND u.id = m.user_id
+            WHERE m.tenant_id = ?
+              AND m.workspace_id = ?
+              AND LOWER(COALESCE(m.status, 'active')) = 'active'
+              AND COALESCE(u.is_disabled, 0) = 0
+            ORDER BY COALESCE(m.updated_at, m.created_at) DESC, u.created_at DESC, m.user_id ASC
+            LIMIT 1
+        `);
+        const updateAnonymousComments = db.prepare(`
+            UPDATE document_review_comments
+            SET author_actor_id = ?
+            WHERE tenant_id = ?
+              AND workspace_id = ?
+              AND LOWER(COALESCE(author_actor_id, '')) = 'anonymous'
+        `);
+        for (const row of anonymousComments) {
+            const tenantId = String(row.tenant_id || 'default').trim() || 'default';
+            const workspaceId = String(row.workspace_id || 'default').trim() || 'default';
+            const fallbackActor = resolveFallbackActor.get(tenantId, workspaceId);
+            const actorId = String(fallbackActor?.user_id || 'user').trim() || 'user';
+            updateAnonymousComments.run(actorId, tenantId, workspaceId);
+        }
+    }
+}