botnote 0.1.1

package/dist/cli.js

@@ -0,0 +1,61 @@
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { createDb } from "./db/client.js";
+import { migrate } from "./db/migrate.js";
+import { BotnoteHttpClient } from "./mcp/http-client.js";
+import { buildMcpServer } from "./mcp/server.js";
+import { EmbeddingService } from "./service/embedding.js";
+import { buildServer } from "./rest/server.js";
+import { VERSION } from "./version.js";
+// Public botnote.net is the default so fresh remote installs (the common
+// plugin-install case) work without extra config. The daemon host overrides
+// via BOTNOTE_URL in its Codex / Claude Code config to skip the tunnel.
+const DEFAULT_MCP_BASE_URL = "https://botnote.net";
+async function runRest() {
+    const port = Number(process.env.BOTNOTE_PORT ?? 4280);
+    const host = process.env.BOTNOTE_HOST ?? "127.0.0.1";
+    const logLevel = process.env.BOTNOTE_LOG_LEVEL ?? "info";
+    await migrate();
+    const { db } = createDb();
+    const embedding = new EmbeddingService(db, { apiKey: process.env.OPENAI_API_KEY });
+    const app = await buildServer({ db, embedding, logLevel });
+    await app.listen({ port, host });
+    app.log.info(`botnote v${VERSION} listening on http://${host}:${port} (docs: /docs, embeddings ${embedding.isEnabled() ? "ON" : "OFF"})`);
+    const shutdown = async (sig) => {
+        app.log.info(`shutting down on ${sig}`);
+        await app.close();
+        process.exit(0);
+    };
+    process.on("SIGINT", () => shutdown("SIGINT"));
+    process.on("SIGTERM", () => shutdown("SIGTERM"));
+}
+async function runMcp() {
+    // MCP stdio mode. The server is now an HTTP client of the botnote daemon
+    // (no DB connection here), so this entry point is package-portable: it can
+    // be installed via a Claude Code plugin on any machine and pointed at any
+    // daemon (tailnet IP, https://botnote.net, ...).
+    // Every log line must go to stderr so we don't corrupt the MCP framed JSON
+    // on stdout.
+    const baseUrl = process.env.BOTNOTE_URL ?? DEFAULT_MCP_BASE_URL;
+    const client = new BotnoteHttpClient({
+        baseUrl,
+        token: process.env.BOTNOTE_TOKEN || undefined,
+        version: VERSION
+    });
+    const server = buildMcpServer({ client, version: VERSION });
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    process.stderr.write(`botnote MCP v${VERSION} ready (stdio) → ${baseUrl}\n`);
+}
+async function main() {
+    const mode = process.argv[2] ?? "rest";
+    if (mode === "mcp") {
+        await runMcp();
+        return;
+    }
+    await runRest();
+}
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,yEAAyE;AACzE,4EAA4E;AAC5E,wEAAwE;AACxE,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAEnD,KAAK,UAAU,OAAO;IACpB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,WAAW,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC;IAEzD,MAAM,OAAO,EAAE,CAAC;IAEhB,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAG,IAAI,gBAAgB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IAEnF,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjC,GAAG,CAAC,GAAG,CAAC,IAAI,CACV,YAAY,OAAO,wBAAwB,IAAI,IAAI,IAAI,6BAA6B,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAC5H,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAE,EAAE;QACrC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,iDAAiD;IACjD,2EAA2E;IAC3E,aAAa;IACb,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC;QACnC,OAAO;QACP,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,SAAS;QAC7C,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,oBAAoB,OAAO,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACvC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,MAAM,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,MAAM,OAAO,EAAE,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/db/client.d.ts

@@ -0,0 +1,10 @@
+import pkg from "pg";
+import * as schema from "./schema.js";
+export type Database = ReturnType<typeof createDb>;
+export declare function createPool(connectionString?: string): pkg.Pool;
+export declare function createDb(pool?: pkg.Pool): {
+    db: import("drizzle-orm/node-postgres").NodePgDatabase<typeof schema> & {
+        $client: import("pg").Pool;
+    };
+    pool: import("pg").Pool;
+};

package/dist/db/client.js

@@ -0,0 +1,16 @@
+import { drizzle } from "drizzle-orm/node-postgres";
+import pkg from "pg";
+import * as schema from "./schema.js";
+const { Pool } = pkg;
+export function createPool(connectionString) {
+    const url = connectionString ?? process.env.DATABASE_URL;
+    if (!url) {
+        throw new Error("DATABASE_URL is required");
+    }
+    return new Pool({ connectionString: url, max: 10 });
+}
+export function createDb(pool) {
+    const p = pool ?? createPool();
+    return { db: drizzle(p, { schema }), pool: p };
+}
+//# sourceMappingURL=client.js.map

package/dist/db/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/db/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AACpD,OAAO,GAAG,MAAM,IAAI,CAAC;AACrB,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;AAIrB,MAAM,UAAU,UAAU,CAAC,gBAAyB;IAClD,MAAM,GAAG,GAAG,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAe;IACtC,MAAM,CAAC,GAAG,IAAI,IAAI,UAAU,EAAE,CAAC;IAC/B,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC"}

package/dist/db/migrate.d.ts

@@ -0,0 +1 @@
+export declare function migrate(): Promise<void>;

package/dist/db/migrate.js

@@ -0,0 +1,57 @@
+import { readFileSync, readdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createPool } from "./client.js";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const MIGRATIONS_DIR = join(__dirname, "migrations");
+export async function migrate() {
+    const pool = createPool();
+    try {
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS _migrations (
+        name text PRIMARY KEY,
+        applied_at timestamptz NOT NULL DEFAULT now()
+      )
+    `);
+        const applied = new Set((await pool.query("SELECT name FROM _migrations")).rows.map((r) => r.name));
+        const files = readdirSync(MIGRATIONS_DIR)
+            .filter((f) => f.endsWith(".sql"))
+            .sort();
+        for (const file of files) {
+            if (applied.has(file)) {
+                console.log(`skip  ${file} (already applied)`);
+                continue;
+            }
+            const sql = readFileSync(join(MIGRATIONS_DIR, file), "utf8");
+            console.log(`apply ${file}`);
+            const client = await pool.connect();
+            try {
+                await client.query("BEGIN");
+                await client.query(sql);
+                await client.query("INSERT INTO _migrations (name) VALUES ($1)", [file]);
+                await client.query("COMMIT");
+            }
+            catch (err) {
+                await client.query("ROLLBACK");
+                throw err;
+            }
+            finally {
+                client.release();
+            }
+        }
+        console.log("migrations done");
+    }
+    finally {
+        await pool.end();
+    }
+}
+const isDirectInvocation = import.meta.url === `file://${process.argv[1]}` ||
+    process.argv[1]?.endsWith("/migrate.ts") ||
+    process.argv[1]?.endsWith("/migrate.js");
+if (isDirectInvocation) {
+    migrate().catch((err) => {
+        console.error(err);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=migrate.js.map

package/dist/db/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AAErD,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC;;;;;KAKhB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,MAAM,IAAI,CAAC,KAAK,CAAmB,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC7F,CAAC;QAEF,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,CAAC;aACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACjC,IAAI,EAAE,CAAC;QAEV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,oBAAoB,CAAC,CAAC;gBAC/C,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5B,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxB,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzE,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC/B,MAAM,GAAG,CAAC;YACZ,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GACtB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC;IACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;AAE3C,IAAI,kBAAkB,EAAE,CAAC;IACvB,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/db/migrations/0001_init.sql

@@ -0,0 +1,89 @@
+-- botnote 0001 init schema
+-- Idempotent: safe to re-run.
+
+CREATE EXTENSION IF NOT EXISTS vector;
+
+CREATE TABLE IF NOT EXISTS projects (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  key text NOT NULL,
+  name text NOT NULL,
+  agents_md text NOT NULL DEFAULT '',
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX IF NOT EXISTS projects_key_idx ON projects(key);
+
+CREATE TABLE IF NOT EXISTS actors (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  name text NOT NULL,
+  kind text NOT NULL,
+  key text,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX IF NOT EXISTS actors_name_idx ON actors(name);
+CREATE UNIQUE INDEX IF NOT EXISTS actors_key_idx ON actors(key);
+
+CREATE TABLE IF NOT EXISTS entities (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  project_id uuid REFERENCES projects(id) ON DELETE SET NULL,
+  kind text NOT NULL,
+  title text NOT NULL,
+  body text NOT NULL DEFAULT '',
+  tags text[] NOT NULL DEFAULT '{}'::text[],
+  status text NOT NULL DEFAULT 'open',
+  actor_id uuid REFERENCES actors(id),
+  actor_kind text NOT NULL DEFAULT 'human',
+  idempotency_key text,
+  parent_id uuid REFERENCES entities(id) ON DELETE SET NULL,
+  body_tsv tsvector GENERATED ALWAYS AS (
+    setweight(to_tsvector('simple', coalesce(title, '')), 'A') ||
+    setweight(to_tsvector('simple', coalesce(body, '')), 'B')
+  ) STORED,
+  body_vec vector(384),
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS entities_project_created_idx
+  ON entities(project_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS entities_project_kind_created_idx
+  ON entities(project_id, kind, created_at DESC);
+CREATE INDEX IF NOT EXISTS entities_actor_created_idx
+  ON entities(actor_id, created_at DESC);
+CREATE UNIQUE INDEX IF NOT EXISTS entities_idempotency_idx
+  ON entities(idempotency_key) WHERE idempotency_key IS NOT NULL;
+CREATE INDEX IF NOT EXISTS entities_body_tsv_idx
+  ON entities USING GIN(body_tsv);
+CREATE INDEX IF NOT EXISTS entities_body_vec_idx
+  ON entities USING hnsw (body_vec vector_cosine_ops);
+CREATE INDEX IF NOT EXISTS entities_tags_idx
+  ON entities USING GIN(tags);
+
+CREATE TABLE IF NOT EXISTS edges (
+  from_id uuid NOT NULL REFERENCES entities(id) ON DELETE CASCADE,
+  to_id uuid NOT NULL REFERENCES entities(id) ON DELETE CASCADE,
+  kind text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (from_id, to_id, kind)
+);
+CREATE INDEX IF NOT EXISTS edges_to_idx ON edges(to_id, kind);
+CREATE INDEX IF NOT EXISTS edges_from_idx ON edges(from_id, kind);
+
+-- updated_at trigger
+CREATE OR REPLACE FUNCTION botnote_touch_updated_at() RETURNS trigger AS $$
+BEGIN
+  NEW.updated_at = now();
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS entities_touch_updated_at ON entities;
+CREATE TRIGGER entities_touch_updated_at
+  BEFORE UPDATE ON entities
+  FOR EACH ROW EXECUTE FUNCTION botnote_touch_updated_at();
+
+DROP TRIGGER IF EXISTS projects_touch_updated_at ON projects;
+CREATE TRIGGER projects_touch_updated_at
+  BEFORE UPDATE ON projects
+  FOR EACH ROW EXECUTE FUNCTION botnote_touch_updated_at();

package/dist/db/migrations/0002_tasks_due_at.sql

@@ -0,0 +1,16 @@
+-- botnote 0002 — tasks need due dates for the Calendar view.
+-- Idempotent: safe to re-run.
+
+ALTER TABLE entities ADD COLUMN IF NOT EXISTS due_at timestamptz;
+
+CREATE INDEX IF NOT EXISTS entities_due_at_idx
+  ON entities(due_at) WHERE due_at IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS entities_kind_due_at_idx
+  ON entities(kind, due_at) WHERE due_at IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS entities_task_due_idx
+  ON entities(due_at) WHERE kind = 'task' AND due_at IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS entities_task_no_due_idx
+  ON entities(created_at DESC) WHERE kind = 'task' AND due_at IS NULL AND status NOT IN ('done', 'archived');

package/dist/db/migrations/0003_task_priority_and_sequence.sql

@@ -0,0 +1,45 @@
+-- botnote 0003 — priority + per-project sequence id (BOT-12 style).
+-- Idempotent.
+
+ALTER TABLE entities ADD COLUMN IF NOT EXISTS priority text NOT NULL DEFAULT 'none';
+ALTER TABLE entities ADD COLUMN IF NOT EXISTS sequence_id integer;
+
+CREATE INDEX IF NOT EXISTS entities_project_seq_idx
+  ON entities(project_id, sequence_id) WHERE sequence_id IS NOT NULL;
+
+-- per-project sequence trigger. Assign sequence_id on INSERT when project_id
+-- is set (workspace-wide entities stay null).
+CREATE OR REPLACE FUNCTION botnote_set_sequence_id() RETURNS trigger AS $$
+BEGIN
+  IF NEW.sequence_id IS NULL AND NEW.project_id IS NOT NULL THEN
+    SELECT COALESCE(MAX(sequence_id), 0) + 1
+      INTO NEW.sequence_id
+      FROM entities
+      WHERE project_id = NEW.project_id;
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS entities_set_sequence_id ON entities;
+CREATE TRIGGER entities_set_sequence_id
+  BEFORE INSERT ON entities
+  FOR EACH ROW EXECUTE FUNCTION botnote_set_sequence_id();
+
+-- Backfill existing rows that have project_id but no sequence_id, ordered by created_at.
+DO $$
+DECLARE
+  rec record;
+  counters jsonb := '{}'::jsonb;
+  next_n integer;
+BEGIN
+  FOR rec IN
+    SELECT id, project_id FROM entities
+    WHERE project_id IS NOT NULL AND sequence_id IS NULL
+    ORDER BY project_id, created_at
+  LOOP
+    next_n := COALESCE((counters->>rec.project_id::text)::int, 0) + 1;
+    counters := jsonb_set(counters, ARRAY[rec.project_id::text], to_jsonb(next_n));
+    UPDATE entities SET sequence_id = next_n WHERE id = rec.id;
+  END LOOP;
+END $$;

package/dist/db/migrations/0004_pinned.sql

@@ -0,0 +1,8 @@
+-- botnote 0004 — pinned flag for project-level context surfacing.
+-- Idempotent.
+
+ALTER TABLE entities ADD COLUMN IF NOT EXISTS pinned boolean NOT NULL DEFAULT false;
+
+CREATE INDEX IF NOT EXISTS entities_pinned_idx
+  ON entities(project_id, pinned)
+  WHERE pinned = true;

package/dist/db/migrations/0005_nullable_title_and_parent.sql

@@ -0,0 +1,5 @@
+-- Allow title to be null (notes without a title use body-derived placeholder in UI).
+ALTER TABLE entities ALTER COLUMN title DROP NOT NULL;
+
+-- Index parent_id for fast lookups of related entities (e.g. notes linked to a task).
+CREATE INDEX IF NOT EXISTS entities_parent_idx ON entities(parent_id) WHERE parent_id IS NOT NULL;

package/dist/db/migrations/0006_project_color_icon.sql

@@ -0,0 +1,3 @@
+-- Per-project color + icon. Defaults match the Linear-ish indigo accent and a simple circle dot.
+ALTER TABLE projects ADD COLUMN IF NOT EXISTS color text NOT NULL DEFAULT '#5e6ad2';
+ALTER TABLE projects ADD COLUMN IF NOT EXISTS icon text NOT NULL DEFAULT 'circle';

package/dist/db/migrations/0007_tokens.sql

@@ -0,0 +1,14 @@
+-- API tokens. token_hash stores sha256 of the plaintext token; prefix is the first
+-- 8 chars of the plaintext (for display). Auth middleware enforcement is off by
+-- default (botnote currently expects tailnet-only access); these endpoints exist
+-- so the UI can grant/revoke tokens and Boss can enable enforcement later.
+CREATE TABLE IF NOT EXISTS tokens (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  name text NOT NULL,
+  token_hash text NOT NULL UNIQUE,
+  prefix text NOT NULL,
+  last_used_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS tokens_created_idx ON tokens(created_at DESC);

package/dist/db/migrations/0008_simplify_kinds_drop_actors.sql

@@ -0,0 +1,21 @@
+-- 0008: simplify entity kinds and drop the actors table.
+--
+-- Why: the original schema had 7 entity kinds (task, note, decision, doc,
+-- comment, log, memory) and a separate `actors` table for writer identity.
+-- In practice only task and note carry real semantic weight in the UI/agent
+-- flows; the others are folded into note with the legacy kind preserved as a
+-- tag so nothing is lost. Identity is now expressed by the existing
+-- entities.actor_kind text column (human / agent / system) — the actors
+-- lookup table never accumulated rows, so we drop it.
+
+-- Fold legacy kinds into 'note'. The previous kind name is appended to tags
+-- so we can still query e.g. tag='decision' or tag='memory' if needed.
+UPDATE entities
+SET tags = array_append(tags, kind), kind = 'note'
+WHERE kind IN ('decision', 'doc', 'comment', 'log', 'memory');
+
+-- Drop the FK first to avoid a dependency error, then the column, then the
+-- table. None of these had any live rows referencing them.
+ALTER TABLE entities DROP CONSTRAINT IF EXISTS entities_actor_id_fkey;
+ALTER TABLE entities DROP COLUMN IF EXISTS actor_id;
+DROP TABLE IF EXISTS actors;

package/dist/db/migrations/0009_sessions.sql

@@ -0,0 +1,14 @@
+-- Browser session cookies. Each row corresponds to one logged-in browser;
+-- plaintext is the cookie value (random 32 bytes hex), DB stores sha256.
+
+CREATE TABLE IF NOT EXISTS sessions (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  token_hash text NOT NULL,
+  expires_at timestamptz NOT NULL,
+  user_agent text,
+  last_used_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS sessions_token_hash_idx ON sessions(token_hash);
+CREATE INDEX IF NOT EXISTS sessions_expires_at_idx ON sessions(expires_at);

package/dist/db/migrations/0010_completed_at.sql

@@ -0,0 +1,17 @@
+-- Add completed_at column to entities. Set automatically on a status
+-- transition into 'done' (and cleared when leaving). Backfill existing done
+-- rows from updated_at as the best available approximation — Plane-migrated
+-- tasks lost their original timestamp, so this clusters them on the migration
+-- day rather than guessing. New transitions are exact.
+ALTER TABLE entities ADD COLUMN IF NOT EXISTS completed_at timestamptz;
+
+UPDATE entities
+SET completed_at = updated_at
+WHERE kind = 'task' AND status = 'done' AND completed_at IS NULL;
+
+-- Partial index — only done rows have a non-null completed_at, so this stays
+-- small and keeps range scans cheap when the calendar queries by completed
+-- date.
+CREATE INDEX IF NOT EXISTS entities_completed_at_idx
+  ON entities (completed_at)
+  WHERE completed_at IS NOT NULL;

package/dist/db/migrations/0011_completed_at_backfill_fix.sql

@@ -0,0 +1,14 @@
+-- Fix the 0010 backfill. The first pass used updated_at, which for tasks
+-- migrated from Plane is the migration day — so every legacy done task piled
+-- onto the same calendar cell. Re-backfill with COALESCE(due_at, updated_at)
+-- so legacy done items render on their original due date (the pre-change
+-- behavior), while freshly-completed tasks still get an exact stamp from the
+-- service layer at status-transition time.
+UPDATE entities
+SET completed_at = COALESCE(due_at, updated_at)
+WHERE kind = 'task'
+  AND status = 'done'
+  -- Only rows whose completed_at matches the 0010 backfill exactly (i.e.
+  -- never updated since). Real recent completions have completed_at != updated_at
+  -- once anything else touches the row, so this avoids stomping on real data.
+  AND completed_at = updated_at;

package/dist/db/migrations/0012_completed_at_backfill_due.sql

@@ -0,0 +1,16 @@
+-- 0011's WHERE clause assumed completed_at = updated_at after 0010, but the
+-- BEFORE-UPDATE trigger bumps updated_at on every UPDATE, so 0010 set
+-- completed_at to OLD.updated_at and the trigger then advanced updated_at past
+-- it. As a result 0011 matched nothing.
+--
+-- This pass forces COALESCE(due_at, updated_at) onto every done task whose
+-- completed_at still falls before the 0010 backfill window — i.e. data the
+-- service layer has not freshly written. Anything completed by the running
+-- daemon after 0010 ran will have a strictly later completed_at and is left
+-- alone.
+UPDATE entities
+SET completed_at = COALESCE(due_at, updated_at)
+WHERE kind = 'task'
+  AND status = 'done'
+  AND completed_at IS NOT NULL
+  AND completed_at < '2026-06-03 23:56:00+00';

package/dist/db/migrations/0013_due_at_noon_utc.sql

@@ -0,0 +1,13 @@
+-- Date-only due dates were imported from Plane as `YYYY-MM-DD T00:00:00Z`,
+-- which lands the previous calendar day in any UTC-negative timezone
+-- (e.g. UTC midnight = 5pm Pacific the day before). Bump every midnight-UTC
+-- due_at to noon-UTC so it stays on the intended calendar day in every
+-- timezone Boss actually uses (UTC-12 .. UTC+11). The service layer applies
+-- the same normalization to new writes so this stays clean going forward.
+UPDATE entities
+SET due_at = date_trunc('day', due_at AT TIME ZONE 'UTC') + INTERVAL '12 hours'
+WHERE kind = 'task'
+  AND due_at IS NOT NULL
+  AND EXTRACT(HOUR FROM due_at AT TIME ZONE 'UTC') = 0
+  AND EXTRACT(MINUTE FROM due_at AT TIME ZONE 'UTC') = 0
+  AND EXTRACT(SECOND FROM due_at AT TIME ZONE 'UTC') = 0;