@xopcai/xopc 0.0.414 → 0.0.415

package/dist/src/storage/sqlite/offline-access.js

@@ -1,13 +1,9 @@
-import { windowsDatabaseOwners } from "./windows-database-owners.js";
+import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
+import { init_windows_database_owners, windowsDatabaseOwners } from "./windows-database-owners.js";
 import { resolve } from "node:path";
 import { closeSync, fsyncSync, openSync, readdirSync, readlinkSync, statSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 //#region src/storage/sqlite/offline-access.ts
-const backupFileSyncOperations = {
-	open: openSync,
-	fsync: fsyncSync,
-	close: closeSync
-};
 /** Windows requires write access on a file handle before FlushFileBuffers/fsync. */
 function flushBackupFile(backupPath, operations = backupFileSyncOperations) {
 	const fd = operations.open(backupPath, "r+");
@@ -73,5 +69,15 @@ function assertDatabaseOffline(databasePath) {
 	const otherOwners = databaseOwners(databasePath);
 	if (otherOwners.length) throw new Error(`Stop other xopc database processes before backing up: ${otherOwners.join(", ")}`);
 }
+var backupFileSyncOperations;
+var init_offline_access = __esmMin((() => {
+	init_windows_database_owners();
+	backupFileSyncOperations = {
+		open: openSync,
+		fsync: fsyncSync,
+		close: closeSync
+	};
+}));
 //#endregion
-export { assertDatabaseOffline, flushBackupFile };
+init_offline_access();
+export { assertDatabaseOffline, flushBackupFile, init_offline_access };

package/dist/src/storage/sqlite/schema-errors.d.ts

@@ -8,3 +8,15 @@ export declare class DatabaseSchemaTooOldError extends Error {
     readonly minimumVersion: number;
     constructor(dbVersion: number, minimumVersion: number);
 }
+export declare class DatabaseSchemaMigrationGapError extends Error {
+    readonly dbVersion: number;
+    readonly appVersion: number;
+    readonly missingVersion: number;
+    constructor(dbVersion: number, appVersion: number, missingVersion: number);
+}
+export declare class DatabaseSchemaMigrationFailedError extends Error {
+    readonly dbVersion: number;
+    readonly appVersion: number;
+    readonly backupPath: string | undefined;
+    constructor(dbVersion: number, appVersion: number, backupPath: string | undefined, cause: unknown);
+}

package/dist/src/storage/sqlite/schema-errors.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
 //#region src/storage/sqlite/schema-errors.ts
-var DatabaseSchemaTooNewError, DatabaseSchemaTooOldError;
+var DatabaseSchemaTooNewError, DatabaseSchemaTooOldError, DatabaseSchemaMigrationGapError, DatabaseSchemaMigrationFailedError;
 var init_schema_errors = __esmMin((() => {
 	DatabaseSchemaTooNewError = class extends Error {
 		dbVersion;
@@ -16,13 +16,31 @@ var init_schema_errors = __esmMin((() => {
 		dbVersion;
 		minimumVersion;
 		constructor(dbVersion, minimumVersion) {
-			super(`xopc database schema version ${dbVersion} is older than the minimum supported version (${minimumVersion}). Start with a new xopc.db.`);
+			super(`xopc database schema version ${dbVersion} is older than the minimum supported version (${minimumVersion}). Keep xopc.db and its WAL/SHM files; use a release with an upgrade path for this database or contact support.`);
 			this.name = "DatabaseSchemaTooOldError";
 			this.dbVersion = dbVersion;
 			this.minimumVersion = minimumVersion;
 		}
 	};
+	DatabaseSchemaMigrationGapError = class extends Error {
+		constructor(dbVersion, appVersion, missingVersion) {
+			super(`xopc database schema version ${dbVersion} requires migration to v${missingVersion}, but that migration is not bundled.`);
+			this.dbVersion = dbVersion;
+			this.appVersion = appVersion;
+			this.missingVersion = missingVersion;
+			this.name = "DatabaseSchemaMigrationGapError";
+		}
+	};
+	DatabaseSchemaMigrationFailedError = class extends Error {
+		constructor(dbVersion, appVersion, backupPath, cause) {
+			super(`SQLite database upgrade from v${dbVersion} to v${appVersion} failed; the upgrade was rolled back. ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+			this.dbVersion = dbVersion;
+			this.appVersion = appVersion;
+			this.backupPath = backupPath;
+			this.name = "DatabaseSchemaMigrationFailedError";
+		}
+	};
 }));
 //#endregion
 init_schema_errors();
-export { DatabaseSchemaTooNewError, DatabaseSchemaTooOldError, init_schema_errors };
+export { DatabaseSchemaMigrationFailedError, DatabaseSchemaMigrationGapError, DatabaseSchemaTooNewError, DatabaseSchemaTooOldError, init_schema_errors };

package/dist/src/storage/sqlite/schema-upgrade.d.ts

@@ -0,0 +1,4 @@
+import type { DatabaseSync } from 'node:sqlite';
+export declare const XOPC_DB_MINIMUM_SCHEMA_VERSION = 202;
+/** Keep the complete historical schema and data; retired features are never reactivated. */
+export declare function upgradeXopcDatabase(db: DatabaseSync, fromVersion: number, targetVersion: number): void;

package/dist/src/storage/sqlite/schema-upgrade.js

@@ -0,0 +1,78 @@
+import { __esmMin } from "../../../_virtual/_rolldown/runtime.js";
+import { init_sql_assets, readSqliteAsset, resolveSqliteAssetPath } from "./sql-assets.js";
+import { init_schema_version, readSchemaVersion, setSchemaVersion } from "./schema-version.js";
+import { DatabaseSchemaMigrationFailedError, DatabaseSchemaMigrationGapError, init_schema_errors } from "./schema-errors.js";
+import { createLogger } from "../../utils/logger/index.js";
+import { init_logger } from "../../utils/logger.js";
+import { assertDatabaseOffline, flushBackupFile, init_offline_access } from "./offline-access.js";
+import { chmodSync, readdirSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+//#region src/storage/sqlite/schema-upgrade.ts
+/** Keep the complete historical schema and data; retired features are never reactivated. */
+function upgradeXopcDatabase(db, fromVersion, targetVersion) {
+	let files;
+	try {
+		files = readdirSync(resolveSqliteAssetPath("upgrades"));
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		throw new DatabaseSchemaMigrationGapError(fromVersion, targetVersion, fromVersion + 1);
+	}
+	const migrations = [];
+	for (let version = fromVersion + 1; version <= targetVersion; version++) {
+		const matches = files.filter((file) => file.startsWith(`${version}_`) && file.endsWith(".sql"));
+		if (matches.length !== 1) throw new DatabaseSchemaMigrationGapError(fromVersion, targetVersion, version);
+		migrations.push(readSqliteAsset(`upgrades/${matches[0]}`));
+	}
+	const databasePath = db.prepare("PRAGMA database_list").all().find((row) => row.name === "main")?.file;
+	let backupPath;
+	if (databasePath) {
+		assertDatabaseOffline(databasePath);
+		backupPath = `${databasePath}.pre-upgrade-v${fromVersion}-${randomUUID()}.bak`;
+		db.prepare("VACUUM main INTO ?").run(backupPath);
+		chmodSync(backupPath, 384);
+		flushBackupFile(backupPath);
+		log.info({
+			path: databasePath,
+			backupPath,
+			fromVersion,
+			targetVersion
+		}, "Created pre-upgrade SQLite backup");
+	}
+	const foreignKeysEnabled = Number(db.prepare("PRAGMA foreign_keys").get()?.foreign_keys) === 1;
+	db.exec("PRAGMA foreign_keys = OFF");
+	let transactionStarted = false;
+	try {
+		db.exec("BEGIN IMMEDIATE");
+		transactionStarted = true;
+		if (readSchemaVersion(db) !== fromVersion) throw new Error("Database version changed during upgrade; retry startup");
+		for (const sql of migrations) db.exec(sql);
+		if (db.prepare("PRAGMA foreign_key_check").all().length) throw new Error("Database upgrade would violate foreign key integrity");
+		if (db.prepare("PRAGMA integrity_check").get()?.integrity_check !== "ok") throw new Error("Database upgrade failed integrity validation");
+		setSchemaVersion(db, targetVersion);
+		db.exec("COMMIT");
+		transactionStarted = false;
+		log.info({
+			fromVersion,
+			targetVersion,
+			backupPath
+		}, "Upgraded xopc SQLite database");
+	} catch (error) {
+		if (transactionStarted) db.exec("ROLLBACK");
+		throw new DatabaseSchemaMigrationFailedError(fromVersion, targetVersion, backupPath, error);
+	} finally {
+		if (foreignKeysEnabled) db.exec("PRAGMA foreign_keys = ON");
+	}
+}
+var XOPC_DB_MINIMUM_SCHEMA_VERSION, log;
+var init_schema_upgrade = __esmMin((() => {
+	init_logger();
+	init_offline_access();
+	init_schema_errors();
+	init_schema_version();
+	init_sql_assets();
+	XOPC_DB_MINIMUM_SCHEMA_VERSION = 202;
+	log = createLogger("Sqlite:Upgrade");
+}));
+//#endregion
+init_schema_upgrade();
+export { XOPC_DB_MINIMUM_SCHEMA_VERSION, init_schema_upgrade, upgradeXopcDatabase };

package/dist/src/storage/sqlite/schema.d.ts

@@ -2,5 +2,6 @@ import type { DatabaseSync } from 'node:sqlite';
 export { SCHEMA_META_SCHEMA_VERSION_KEY, readSchemaVersionForTest, readSchemaVersion, setSchemaVersion, ensureSchemaMetaTable } from './schema-version.js';
 export declare const XOPC_DB_SCHEMA_VERSION = 259;
 export declare const XOPC_DB_BASELINE_SCHEMA_VERSION = 259;
-/** Open only the current schema; older databases are never upgraded or interpreted. */
+export { XOPC_DB_MINIMUM_SCHEMA_VERSION } from './schema-upgrade.js';
+/** Initialize fresh databases directly; upgrade supported installed databases transactionally. */
 export declare function ensureXopcDatabaseSchema(db: DatabaseSync): void;

package/dist/src/storage/sqlite/schema.js

@@ -4,8 +4,9 @@ import { currentOperationId, init_operation_context } from "../../infra/operatio
 import { init_sql_assets, readSqliteAsset } from "./sql-assets.js";
 import { SCHEMA_META_SCHEMA_VERSION_KEY, ensureSchemaMetaTable, init_schema_version, readSchemaVersion, readSchemaVersionForTest, setSchemaVersion } from "./schema-version.js";
 import { DatabaseSchemaTooNewError, DatabaseSchemaTooOldError, init_schema_errors } from "./schema-errors.js";
+import { XOPC_DB_MINIMUM_SCHEMA_VERSION, init_schema_upgrade, upgradeXopcDatabase } from "./schema-upgrade.js";
 //#region src/storage/sqlite/schema.ts
-/** Open only the current schema; older databases are never upgraded or interpreted. */
+/** Initialize fresh databases directly; upgrade supported installed databases transactionally. */
 function ensureXopcDatabaseSchema(db) {
 	db.function("xopc_memory_search_text", { deterministic: true }, (value) => memorySearchText(String(value ?? "")));
 	db.function("xopc_operation_id", () => currentOperationId() ?? null);
@@ -14,7 +15,11 @@ function ensureXopcDatabaseSchema(db) {
 	if (!hasMetadata && tables.length) throw new Error("An unversioned database cannot be initialized");
 	const version = hasMetadata ? readSchemaVersion(db) : 0;
 	if (version > 259) throw new DatabaseSchemaTooNewError(version, 259);
-	if (version > 0 && version < 259) throw new DatabaseSchemaTooOldError(version, 259);
+	if (version > 0 && version < 202) throw new DatabaseSchemaTooOldError(version, 202);
+	if (version >= 202 && version < 259) {
+		upgradeXopcDatabase(db, version, 259);
+		return;
+	}
 	if (version === 259) return;
 	if (db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name != 'schema_meta' AND name NOT LIKE 'sqlite_%' LIMIT 1").get()) throw new Error("An unversioned database cannot be initialized");
 	db.exec("BEGIN IMMEDIATE");
@@ -34,9 +39,10 @@ var init_schema = __esmMin((() => {
 	init_sql_assets();
 	init_schema_version();
 	init_schema_errors();
+	init_schema_upgrade();
 	XOPC_DB_SCHEMA_VERSION = 259;
 	XOPC_DB_BASELINE_SCHEMA_VERSION = 259;
 }));
 //#endregion
 init_schema();
-export { SCHEMA_META_SCHEMA_VERSION_KEY, XOPC_DB_BASELINE_SCHEMA_VERSION, XOPC_DB_SCHEMA_VERSION, ensureSchemaMetaTable, ensureXopcDatabaseSchema, init_schema, readSchemaVersion, readSchemaVersionForTest, setSchemaVersion };
+export { SCHEMA_META_SCHEMA_VERSION_KEY, XOPC_DB_BASELINE_SCHEMA_VERSION, XOPC_DB_MINIMUM_SCHEMA_VERSION, XOPC_DB_SCHEMA_VERSION, ensureSchemaMetaTable, ensureXopcDatabaseSchema, init_schema, readSchemaVersion, readSchemaVersionForTest, setSchemaVersion };

package/dist/src/storage/sqlite/upgrades/203_remove_retired_proactive_contracts.sql

@@ -0,0 +1,70 @@
+DROP TABLE IF EXISTS relationship_settings;
+
+CREATE TABLE context_snapshots_v203 (
+  snapshot_id TEXT PRIMARY KEY,
+  trace_id TEXT NOT NULL UNIQUE,
+  owner_kind TEXT NOT NULL CHECK (owner_kind IN ('task_run', 'task', 'session')),
+  owner_id TEXT NOT NULL,
+  conversation_id TEXT,
+  query TEXT NOT NULL,
+  selected_items_json TEXT NOT NULL DEFAULT '[]',
+  rejected_items_json TEXT NOT NULL DEFAULT '[]',
+  consent_requests_json TEXT NOT NULL DEFAULT '[]',
+  relationship_policy_json TEXT NOT NULL DEFAULT '{}',
+  estimated_tokens INTEGER NOT NULL DEFAULT 0,
+  allocation_json TEXT,
+  authorization_snapshot_json TEXT NOT NULL DEFAULT '{}',
+  content_hash TEXT,
+  created_at INTEGER NOT NULL,
+  FOREIGN KEY (conversation_id) REFERENCES sessions(conversation_id) ON DELETE SET NULL
+);
+
+INSERT INTO context_snapshots_v203
+SELECT * FROM context_snapshots WHERE owner_kind <> 'proactive_run';
+
+DROP TABLE context_snapshots;
+ALTER TABLE context_snapshots_v203 RENAME TO context_snapshots;
+
+CREATE INDEX idx_context_snapshots_owner
+  ON context_snapshots(owner_kind, owner_id, created_at DESC);
+CREATE INDEX idx_context_snapshots_session
+  ON context_snapshots(conversation_id, created_at DESC);
+
+CREATE TABLE collaboration_rules_v203 (
+  rule_id TEXT PRIMARY KEY,
+  principal_id TEXT NOT NULL,
+  category TEXT NOT NULL CHECK (category IN ('communication', 'execution', 'boundary', 'routine', 'initiative')),
+  status TEXT NOT NULL CHECK (status IN ('active', 'disabled', 'archived')),
+  priority INTEGER NOT NULL DEFAULT 100,
+  scope_type TEXT NOT NULL CHECK (scope_type IN ('global', 'workspace', 'project', 'session')),
+  scope_id TEXT,
+  conditions_json TEXT NOT NULL DEFAULT '{}',
+  current_revision_id TEXT NOT NULL REFERENCES collaboration_rule_revisions(revision_id)
+    DEFERRABLE INITIALLY DEFERRED,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+INSERT INTO collaboration_rules_v203 (
+  rule_id, principal_id, category, status, priority, scope_type, scope_id,
+  conditions_json, current_revision_id, created_at, updated_at
+)
+SELECT
+  rule_id,
+  principal_id,
+  CASE category WHEN 'proactive' THEN 'initiative' ELSE category END,
+  status,
+  priority,
+  scope_type,
+  scope_id,
+  conditions_json,
+  current_revision_id,
+  created_at,
+  updated_at
+FROM collaboration_rules;
+
+DROP TABLE collaboration_rules;
+ALTER TABLE collaboration_rules_v203 RENAME TO collaboration_rules;
+
+CREATE INDEX idx_collaboration_rules_principal_status
+  ON collaboration_rules(principal_id, status, priority, updated_at DESC);

package/dist/src/storage/sqlite/upgrades/204_home_intelligence.sql

@@ -0,0 +1,78 @@
+CREATE TABLE home_advice_generations (
+  generation_id TEXT PRIMARY KEY,
+  owner_id TEXT NOT NULL,
+  workspace_id TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL,
+  status TEXT NOT NULL CHECK(status IN ('queued', 'running', 'succeeded', 'skipped', 'retry_wait', 'failed', 'cancelled')),
+  reasons_json TEXT NOT NULL DEFAULT '[]' CHECK(json_valid(reasons_json)),
+  requested_at INTEGER NOT NULL,
+  started_at INTEGER,
+  completed_at INTEGER,
+  retry_at INTEGER,
+  lease_owner TEXT,
+  lease_until INTEGER,
+  lease_epoch INTEGER NOT NULL DEFAULT 0,
+  attempt INTEGER NOT NULL DEFAULT 0,
+  dirty_after_start INTEGER NOT NULL DEFAULT 0 CHECK(dirty_after_start IN (0, 1)),
+  snapshot_hash TEXT,
+  evidence_ids_json TEXT NOT NULL DEFAULT '[]' CHECK(json_valid(evidence_ids_json)),
+  result_json TEXT CHECK(result_json IS NULL OR json_valid(result_json)),
+  model_ref TEXT,
+  input_tokens INTEGER,
+  output_tokens INTEGER,
+  estimated_cost_usd REAL,
+  outcome_reason TEXT,
+  error_code TEXT
+);
+
+CREATE UNIQUE INDEX idx_home_advice_generation_idempotency
+  ON home_advice_generations(owner_id, workspace_id, idempotency_key);
+CREATE UNIQUE INDEX idx_home_advice_generation_active
+  ON home_advice_generations(owner_id, workspace_id)
+  WHERE status IN ('queued', 'running', 'retry_wait');
+CREATE INDEX idx_home_advice_generation_claim
+  ON home_advice_generations(status, retry_at, requested_at);
+CREATE INDEX idx_home_advice_generation_latest
+  ON home_advice_generations(owner_id, workspace_id, completed_at DESC);
+
+CREATE TABLE home_opportunity_projections (
+  opportunity_id TEXT PRIMARY KEY,
+  generation_id TEXT NOT NULL REFERENCES home_advice_generations(generation_id) ON DELETE CASCADE,
+  owner_id TEXT NOT NULL,
+  workspace_id TEXT NOT NULL,
+  rank INTEGER NOT NULL CHECK(rank BETWEEN 0 AND 2),
+  kind TEXT NOT NULL CHECK(kind IN ('project_next_step', 'delivery_risk', 'meeting_prep', 'commitment_follow_up', 'automation_candidate')),
+  project_id TEXT,
+  dedupe_key TEXT NOT NULL,
+  content_json TEXT NOT NULL CHECK(json_valid(content_json)),
+  evidence_refs_json TEXT NOT NULL DEFAULT '[]' CHECK(json_valid(evidence_refs_json)),
+  snapshot_hash TEXT NOT NULL,
+  state TEXT NOT NULL CHECK(state IN ('active', 'snoozed', 'accepted', 'discussing', 'dismissed', 'expired', 'superseded')),
+  revision INTEGER NOT NULL DEFAULT 1 CHECK(revision > 0),
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  snoozed_until INTEGER,
+  resolution_kind TEXT CHECK(resolution_kind IS NULL OR resolution_kind IN ('session', 'task', 'scene')),
+  resolution_ref TEXT
+);
+
+CREATE UNIQUE INDEX idx_home_opportunity_active_dedupe
+  ON home_opportunity_projections(owner_id, workspace_id, dedupe_key)
+  WHERE state IN ('active', 'snoozed');
+CREATE INDEX idx_home_opportunity_visible
+  ON home_opportunity_projections(owner_id, workspace_id, state, rank, expires_at);
+
+CREATE TABLE home_opportunity_feedback (
+  feedback_id TEXT PRIMARY KEY,
+  opportunity_id TEXT NOT NULL REFERENCES home_opportunity_projections(opportunity_id) ON DELETE CASCADE,
+  idempotency_key TEXT NOT NULL UNIQUE,
+  kind TEXT NOT NULL CHECK(kind IN ('started', 'discussed', 'already_done', 'irrelevant', 'too_early', 'source_incorrect', 'less_like_this', 'snoozed')),
+  reason_code TEXT,
+  note TEXT,
+  scope_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(scope_json)),
+  created_at INTEGER NOT NULL
+);
+
+CREATE INDEX idx_home_opportunity_feedback_item
+  ON home_opportunity_feedback(opportunity_id, created_at DESC);

package/dist/src/storage/sqlite/upgrades/205_agent_catalog.sql

@@ -0,0 +1,66 @@
+CREATE TABLE agent_catalog_settings (
+  singleton_id INTEGER PRIMARY KEY CHECK(singleton_id = 1),
+  default_agent_id TEXT NOT NULL REFERENCES agents(id),
+  defaults_json TEXT NOT NULL CHECK(json_valid(defaults_json)),
+  revision INTEGER NOT NULL CHECK(revision > 0),
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE agents (
+  id TEXT PRIMARY KEY,
+  enabled INTEGER NOT NULL CHECK(enabled IN (0, 1)),
+  workspace_override TEXT,
+  profile_json TEXT CHECK(profile_json IS NULL OR json_valid(profile_json)),
+  overrides_json TEXT NOT NULL CHECK(json_valid(overrides_json)),
+  provisioning_state TEXT NOT NULL CHECK(provisioning_state IN ('pending', 'ready', 'error')),
+  provisioning_error TEXT,
+  revision INTEGER NOT NULL CHECK(revision > 0),
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  deleted_at INTEGER
+);
+
+CREATE INDEX idx_agents_available ON agents(enabled, provisioning_state, deleted_at, id);
+
+CREATE TABLE agent_bindings (
+  id TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL REFERENCES agents(id),
+  position INTEGER NOT NULL CHECK(position >= 0),
+  rule_json TEXT NOT NULL CHECK(json_valid(rule_json)),
+  revision INTEGER NOT NULL CHECK(revision > 0),
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  UNIQUE(position)
+);
+
+CREATE INDEX idx_agent_bindings_agent ON agent_bindings(agent_id, position);
+
+CREATE TABLE agent_surface_defaults (
+  surface TEXT PRIMARY KEY,
+  agent_id TEXT NOT NULL REFERENCES agents(id),
+  revision INTEGER NOT NULL CHECK(revision > 0),
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE agent_provisioning_jobs (
+  agent_id TEXT PRIMARY KEY REFERENCES agents(id) ON DELETE CASCADE,
+  operation TEXT NOT NULL CHECK(operation IN ('provision', 'purge')),
+  state TEXT NOT NULL CHECK(state IN ('pending', 'running', 'failed')),
+  attempts INTEGER NOT NULL DEFAULT 0 CHECK(attempts >= 0),
+  last_error TEXT,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE application_migrations (
+  id TEXT PRIMARY KEY,
+  state TEXT NOT NULL,
+  source_digest TEXT,
+  source_backup_path TEXT,
+  database_backup_path TEXT,
+  error_json TEXT CHECK(error_json IS NULL OR json_valid(error_json)),
+  started_at INTEGER NOT NULL,
+  completed_at INTEGER,
+  updated_at INTEGER NOT NULL
+);

package/dist/src/storage/sqlite/upgrades/206_home_advice_strategy_version.sql

@@ -0,0 +1,2 @@
+ALTER TABLE home_advice_generations
+  ADD COLUMN strategy_version TEXT NOT NULL DEFAULT 'home-v1';

package/dist/src/storage/sqlite/upgrades/207_user_model_policy_contract.sql

@@ -0,0 +1,121 @@
+ALTER TABLE user_assertions ADD COLUMN domain TEXT NOT NULL DEFAULT 'identity'
+  CHECK(domain IN (
+    'identity', 'life_history', 'health', 'emotion', 'personality', 'cognition',
+    'values', 'motivation', 'goals', 'capabilities', 'behavior', 'preferences',
+    'relationships', 'resources_constraints', 'environment', 'digital_life'
+  ));
+ALTER TABLE user_assertions ADD COLUMN model_layer TEXT NOT NULL DEFAULT 'fact'
+  CHECK(model_layer IN ('fact', 'pattern', 'interpretation'));
+ALTER TABLE user_assertions ADD COLUMN sensitivity_categories_json TEXT NOT NULL DEFAULT '[]'
+  CHECK(json_valid(sensitivity_categories_json));
+ALTER TABLE user_assertions ADD COLUMN purpose_ids_json TEXT NOT NULL DEFAULT '["personalization"]'
+  CHECK(json_valid(purpose_ids_json));
+ALTER TABLE user_assertions ADD COLUMN allowed_uses_json TEXT NOT NULL DEFAULT '["answer","rank","recommend"]'
+  CHECK(json_valid(allowed_uses_json));
+ALTER TABLE user_assertions ADD COLUMN allowed_agent_ids_json TEXT CHECK(allowed_agent_ids_json IS NULL OR json_valid(allowed_agent_ids_json));
+ALTER TABLE user_assertions ADD COLUMN consent_receipt_id TEXT;
+ALTER TABLE user_assertions ADD COLUMN support_count INTEGER NOT NULL DEFAULT 0 CHECK(support_count >= 0);
+ALTER TABLE user_assertions ADD COLUMN independent_source_count INTEGER NOT NULL DEFAULT 0 CHECK(independent_source_count >= 0);
+ALTER TABLE user_assertions ADD COLUMN last_supported_at INTEGER;
+ALTER TABLE user_assertions ADD COLUMN delete_after INTEGER;
+
+UPDATE user_assertions SET
+  domain = CASE kind
+    WHEN 'identity' THEN 'identity'
+    WHEN 'preference' THEN 'preferences'
+    WHEN 'value' THEN 'values'
+    WHEN 'routine' THEN 'behavior'
+    WHEN 'capability' THEN 'capabilities'
+    WHEN 'relationship' THEN 'relationships'
+    WHEN 'current_state' THEN 'environment'
+    ELSE 'cognition'
+  END,
+  model_layer = CASE
+    WHEN authority = 'user_explicit' OR kind = 'current_state' THEN 'fact'
+    WHEN kind = 'derived_insight' THEN 'interpretation'
+    ELSE 'pattern'
+  END,
+  support_count = (
+    SELECT COUNT(*) FROM user_assertion_evidence evidence
+    WHERE evidence.assertion_id = user_assertions.assertion_id AND evidence.relation = 'supports'
+  ),
+  independent_source_count = (
+    SELECT COUNT(DISTINCT COALESCE(context.source_instance_id, context.source_type || ':' || context.source_ref))
+    FROM user_assertion_evidence evidence
+    JOIN context_evidence context ON context.evidence_id = evidence.evidence_id
+    WHERE evidence.assertion_id = user_assertions.assertion_id AND evidence.relation = 'supports'
+  ),
+  last_supported_at = (
+    SELECT MAX(context.observed_at)
+    FROM user_assertion_evidence evidence
+    JOIN context_evidence context ON context.evidence_id = evidence.evidence_id
+    WHERE evidence.assertion_id = user_assertions.assertion_id AND evidence.relation = 'supports'
+  );
+
+CREATE TABLE understanding_consent_receipts (
+  receipt_id TEXT PRIMARY KEY,
+  grant_id TEXT NOT NULL REFERENCES understanding_source_grants(grant_id) ON DELETE CASCADE,
+  purposes_json TEXT NOT NULL CHECK(json_valid(purposes_json)),
+  allowed_domains_json TEXT NOT NULL CHECK(json_valid(allowed_domains_json)),
+  denied_domains_json TEXT NOT NULL DEFAULT '[]' CHECK(json_valid(denied_domains_json)),
+  allowed_fields_json TEXT NOT NULL CHECK(json_valid(allowed_fields_json)),
+  access_mode TEXT NOT NULL CHECK(access_mode IN ('once', 'continuous')),
+  lookback_days INTEGER NOT NULL CHECK(lookback_days >= 0),
+  raw_retention_days INTEGER NOT NULL CHECK(raw_retention_days >= 0),
+  processing_policy TEXT NOT NULL CHECK(processing_policy IN ('local_only', 'remote_allowed')),
+  allowed_agent_ids_json TEXT CHECK(allowed_agent_ids_json IS NULL OR json_valid(allowed_agent_ids_json)),
+  disclosure_version TEXT NOT NULL,
+  granted_at INTEGER NOT NULL,
+  revoked_at INTEGER
+);
+
+CREATE INDEX idx_understanding_consent_receipts_grant
+  ON understanding_consent_receipts(grant_id, granted_at DESC);
+CREATE UNIQUE INDEX idx_understanding_consent_receipts_active
+  ON understanding_consent_receipts(grant_id) WHERE revoked_at IS NULL;
+
+CREATE TABLE user_model_observations (
+  observation_id TEXT PRIMARY KEY,
+  principal_id TEXT NOT NULL,
+  domain TEXT NOT NULL CHECK(domain IN (
+    'identity', 'life_history', 'health', 'emotion', 'personality', 'cognition',
+    'values', 'motivation', 'goals', 'capabilities', 'behavior', 'preferences',
+    'relationships', 'resources_constraints', 'environment', 'digital_life'
+  )),
+  observation_type TEXT NOT NULL,
+  subject_type TEXT NOT NULL CHECK(subject_type IN ('user', 'person', 'goal', 'project', 'topic')),
+  subject_id TEXT NOT NULL,
+  value_json TEXT NOT NULL CHECK(json_valid(value_json)),
+  context_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(context_json)),
+  sensitivity_categories_json TEXT NOT NULL DEFAULT '[]' CHECK(json_valid(sensitivity_categories_json)),
+  owner_attribution TEXT NOT NULL CHECK(owner_attribution IN ('user', 'other', 'shared', 'unknown')),
+  observed_at INTEGER NOT NULL,
+  valid_to INTEGER,
+  delete_after INTEGER,
+  source_grant_id TEXT REFERENCES understanding_source_grants(grant_id) ON DELETE CASCADE,
+  source_item_id TEXT,
+  evidence_id TEXT REFERENCES context_evidence(evidence_id) ON DELETE CASCADE,
+  content_hash TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  UNIQUE(principal_id, content_hash)
+);
+
+CREATE INDEX idx_user_model_observations_domain_time
+  ON user_model_observations(principal_id, domain, observed_at DESC);
+CREATE INDEX idx_user_model_observations_expiry
+  ON user_model_observations(delete_after) WHERE delete_after IS NOT NULL;
+CREATE INDEX idx_user_model_observations_source
+  ON user_model_observations(source_grant_id, source_item_id);
+
+CREATE TABLE user_assertion_edges (
+  from_assertion_id TEXT NOT NULL REFERENCES user_assertions(assertion_id) ON DELETE CASCADE,
+  to_assertion_id TEXT NOT NULL REFERENCES user_assertions(assertion_id) ON DELETE CASCADE,
+  relation TEXT NOT NULL CHECK(relation IN ('supports', 'contradicts', 'derived_from', 'specializes')),
+  confidence REAL NOT NULL CHECK(confidence >= 0 AND confidence <= 1),
+  created_at INTEGER NOT NULL,
+  PRIMARY KEY(from_assertion_id, to_assertion_id, relation),
+  CHECK(from_assertion_id <> to_assertion_id)
+);
+
+CREATE INDEX idx_user_assertion_edges_to
+  ON user_assertion_edges(to_assertion_id, relation);

package/dist/src/storage/sqlite/upgrades/208_automation_management.sql

@@ -0,0 +1,2 @@
+ALTER TABLE automations ADD COLUMN management_json TEXT
+  CHECK(management_json IS NULL OR json_valid(management_json));

package/dist/src/storage/sqlite/upgrades/209_automation_event_hub.sql

@@ -0,0 +1,48 @@
+CREATE TABLE automation_events (
+  event_id TEXT PRIMARY KEY,
+  event_type TEXT NOT NULL,
+  schema_version INTEGER NOT NULL DEFAULT 1,
+  source TEXT NOT NULL,
+  subject_kind TEXT,
+  subject_id TEXT,
+  occurred_at_ms INTEGER NOT NULL,
+  ingested_at_ms INTEGER NOT NULL,
+  correlation_id TEXT NOT NULL,
+  causation_id TEXT,
+  root_event_id TEXT NOT NULL,
+  chain_depth INTEGER NOT NULL DEFAULT 0 CHECK(chain_depth BETWEEN 0 AND 32),
+  dedupe_key TEXT,
+  trust TEXT NOT NULL CHECK(trust IN ('system', 'user', 'connector', 'untrusted_webhook')),
+  payload_json TEXT NOT NULL,
+  projected_at_ms INTEGER,
+  projection_attempts INTEGER NOT NULL DEFAULT 0,
+  projection_error TEXT
+);
+
+CREATE UNIQUE INDEX idx_automation_events_source_dedupe
+  ON automation_events(source, dedupe_key)
+  WHERE dedupe_key IS NOT NULL;
+
+CREATE INDEX idx_automation_events_projection
+  ON automation_events(projected_at_ms, ingested_at_ms);
+
+CREATE TABLE automation_event_deliveries (
+  event_id TEXT NOT NULL,
+  automation_id TEXT NOT NULL,
+  status TEXT NOT NULL CHECK(status IN ('pending', 'queued', 'completed', 'failed', 'cancelled', 'skipped')),
+  run_id TEXT,
+  attempts INTEGER NOT NULL DEFAULT 0,
+  next_attempt_at_ms INTEGER NOT NULL,
+  last_error TEXT,
+  created_at_ms INTEGER NOT NULL,
+  updated_at_ms INTEGER NOT NULL,
+  PRIMARY KEY(event_id, automation_id),
+  FOREIGN KEY(event_id) REFERENCES automation_events(event_id) ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX idx_automation_event_deliveries_run
+  ON automation_event_deliveries(run_id)
+  WHERE run_id IS NOT NULL;
+
+CREATE INDEX idx_automation_event_deliveries_pending
+  ON automation_event_deliveries(status, next_attempt_at_ms, created_at_ms);

package/dist/src/storage/sqlite/upgrades/210_remove_legacy_automation_timeout.sql

@@ -0,0 +1,14 @@
+UPDATE automations
+SET reliability_json = json_remove(
+  json_set(
+    reliability_json,
+    '$.executionTimeoutSeconds',
+    COALESCE(
+      json_extract(reliability_json, '$.executionTimeoutSeconds'),
+      json_extract(reliability_json, '$.timeoutSeconds')
+    )
+  ),
+  '$.timeoutSeconds'
+)
+WHERE reliability_json IS NOT NULL
+  AND json_type(reliability_json, '$.timeoutSeconds') IS NOT NULL;

package/dist/src/storage/sqlite/upgrades/211_automation_result_deliveries.sql

@@ -0,0 +1,16 @@
+CREATE TABLE automation_result_deliveries (
+  run_id TEXT NOT NULL,
+  destination_key TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  status TEXT NOT NULL CHECK(status IN ('pending', 'delivering', 'delivered', 'failed')),
+  config_json TEXT NOT NULL,
+  attempts INTEGER NOT NULL DEFAULT 0,
+  next_attempt_at_ms INTEGER NOT NULL,
+  last_error TEXT,
+  created_at_ms INTEGER NOT NULL,
+  updated_at_ms INTEGER NOT NULL,
+  PRIMARY KEY(run_id, destination_key)
+);
+
+CREATE INDEX idx_automation_result_deliveries_pending
+  ON automation_result_deliveries(status, next_attempt_at_ms, created_at_ms);