circuschief 0.8.0 → 1.0.0

package/packages/server/src/api/projects.js

@@ -1,26 +1,18 @@
 import { Router } from 'express';
-import { projects, sessions, sessionTemplates, projectDefaults, commandRuns } from '../database.js';
+import { projects, sessions, commandRuns } from '../database.js';
 import { commandRunner } from '../services/commandRunner.js';
-import { CreateProjectRequest, UpdateProjectRequest, ProjectSessionDefaultsRequest } from '../../../shared/src/contracts/projects.js';
-import { ProjectDefaultsRepository } from '../db/ProjectDefaultsRepository.js';
-import { CreateSessionTemplateRequest } from '../../../shared/src/contracts/templates.js';
-import { broadcastToProject } from '../websocket.js';
+import { CreateProjectRequest, UpdateProjectRequest } from '../../../shared/src/contracts/projects.js';
 import projectCommandButtonsRouter from './projects-commandButtons.js';
-import { WS_MESSAGE_TYPES } from '../../../shared/src/index.js';
+import projectSessionDefaultsRouter from './projects-session-defaults.js';
+import projectTemplatesRouter from './projects-templates.js';
 import { handleUploadError, uploadMiddleware } from '../middleware/upload.js';
-import {
-  generateInitialName,
-  prepareSessionConfig,
-  applyTemplateOverrides,
-  resolveNextTemplateId,
-  determineInitialStatus,
-  buildSchedulingUpdate,
-  setupAndStartSession,
-} from './projects-session-helpers.js';
-import { validateGitSettings, buildRunsBySession } from './projects-helpers.js';
+import { determineInitialStatus } from './projects-session-helpers.js';
+import { buildRunsBySession } from './projects-helpers.js';
 import { resolveAgentTypeFromModel } from '../services/sessionProvider.js';
 import { access, constants } from 'fs/promises';
 import { dirname, isAbsolute } from 'path';
+import { getRepositoryUrl } from '../services/gitService.js';
+import { validateAndPrepareSessionConfig, createSessionRow, startSessionOrFail } from './projects-session-create.js';
 
 // Error message constants
 const ERR_PROJECT_NOT_FOUND = 'Project not found';
@@ -65,17 +57,31 @@ router.post('/', async (req, res) => {
     return res.status(400).json({ error: result.error.issues[0].message });
   }
 
-  const { name, workingDirectory, systemPrompt, onSessionCreated, onSessionDeleted, worktreePath, kanbanEnabled } = result.data;
+  const { name, workingDirectory, systemPrompt, onSessionCreated, onSessionDeleted, worktreePath, kanbanEnabled, repoUrl } = result.data;
 
   const pathError = await validateWorktreePath(worktreePath);
   if (pathError) {
     return res.status(400).json({ error: pathError });
   }
 
+  // Resolve repoUrl:
+  // - string: use as-is (explicitly provided)
+  // - null: suppress detection (explicitly sent as null)
+  // - undefined: auto-detect from git remote
+  let resolvedRepoUrl = repoUrl;
+  if (resolvedRepoUrl === undefined) {
+    try {
+      resolvedRepoUrl = await getRepositoryUrl(workingDirectory);
+    } catch {
+      resolvedRepoUrl = null;
+    }
+  }
+
   const createOptions = {
     onSessionCreated: onSessionCreated || null,
     onSessionDeleted: onSessionDeleted || null,
     worktreePath: worktreePath || null,
+    repoUrl: resolvedRepoUrl,
   };
   if (kanbanEnabled !== undefined) {
     createOptions.kanbanEnabled = kanbanEnabled;
@@ -198,98 +204,6 @@ router.get('/:id/sessions', (req, res) => {
   }
 });
 
-/**
- * Validate and prepare the session configuration from the request body.
- * Returns { config, nextTemplateId } on success, or { error, status } on failure.
- */
-async function validateAndPrepareSessionConfig(reqBody, reqFiles, projectId, project) {
-  const projectDefs = projectDefaults.getByProjectId(projectId);
-  const systemDefaults = ProjectDefaultsRepository.getSystemDefaults();
-  const config = prepareSessionConfig(reqBody, projectDefs, systemDefaults);
-  config.files = reqFiles || [];
-
-  if (!config.prompt) {
-    return { error: 'Prompt is required', status: 400 };
-  }
-
-  if (config.parentSessionId) {
-    const parentSession = sessions.getById(config.parentSessionId);
-    if (!parentSession) {
-      return { error: 'Parent session not found', status: 404 };
-    }
-    if (parentSession.projectId !== projectId) {
-      return { error: 'Parent session does not belong to this project', status: 400 };
-    }
-  }
-
-  // Apply template overrides and resolve nextTemplateId
-  applyTemplateOverrides(config);
-  const { nextTemplateId, error: nextTemplateError } = resolveNextTemplateId(reqBody, config.nextTemplateId || null);
-  if (nextTemplateError) {
-    return { error: nextTemplateError, status: 400 };
-  }
-  config.nextTemplateId = nextTemplateId;
-
-  // Validate git settings for git repos
-  const { config: updatedConfig, error: gitError } = await validateGitSettings(config, project);
-  if (gitError) {
-    return { error: gitError, status: 400 };
-  }
-  Object.assign(config, updatedConfig);
-
-  return { config, nextTemplateId };
-}
-
-/**
- * Create the session row and apply any post-create updates.
- * Returns the created session (already persisted in DB).
- */
-function createSessionRow(projectId, config, nextTemplateId, initialStatus) {
-  const sessionName = config.name || generateInitialName(config.prompt);
-  const session = sessions.create(projectId, sessionName, config.prompt, {
-    mode: config.mode,
-    thinkingEnabled: config.thinkingEnabled,
-    gitBranch: config.gitBranch,
-    parentSessionId: config.parentSessionId,
-    status: initialStatus,
-    model: config.model,
-    providerId: config.providerId,
-    effortLevel: config.effortLevel,
-    agentType: config.agentType,
-  });
-
-  const postCreateUpdate = {
-    ...(nextTemplateId ? { nextTemplateId } : {}),
-    ...buildSchedulingUpdate(config, initialStatus),
-  };
-  if (Object.keys(postCreateUpdate).length > 0) {
-    sessions.update(session.id, postCreateUpdate);
-  }
-  return session;
-}
-
-/**
- * Run setupAndStartSession and translate any failure into an error response,
- * marking the session as errored and broadcasting the update.
- */
-async function startSessionOrFail(req, res, { session, config, project }) {
-  try {
-    const { updatedSession } = await setupAndStartSession({
-      session, config, project, projectId: req.params.id, files: config.files,
-    });
-    return res.status(201).json(updatedSession);
-  } catch (error) {
-    console.error('Git setup error:', error);
-    const updatedSession = sessions.update(session.id, { status: 'error', error: error.message });
-    broadcastToProject(req.params.id, WS_MESSAGE_TYPES.SESSION_UPDATED, {
-      projectId: req.params.id,
-      sessionId: session.id,
-      session: updatedSession,
-    });
-    return res.status(500).json({ error: `Git setup failed: ${error.message}` });
-  }
-}
-
 // POST /api/projects/:id/sessions - Create session
 // Supports both JSON and multipart/form-data (for file attachments)
 router.post('/:id/sessions', uploadMiddleware('files', 10), handleUploadError, async (req, res) => {
@@ -335,79 +249,13 @@ router.post('/:id/sessions', uploadMiddleware('files', 10), handleUploadError, a
   }
 });
 
-// GET /api/projects/:id/templates - List available templates for project (project + global)
-router.get('/:id/templates', (req, res) => {
-  const project = projects.getById(req.params.id);
-  if (!project) {
-    return res.status(404).json({ error: ERR_PROJECT_NOT_FOUND });
-  }
-
-  const available = sessionTemplates.getAvailableForProject(req.params.id);
-  res.json(available);
-});
-
-// POST /api/projects/:id/templates - Create project template
-router.post('/:id/templates', (req, res) => {
-  const project = projects.getById(req.params.id);
-  if (!project) {
-    return res.status(404).json({ error: ERR_PROJECT_NOT_FOUND });
-  }
-
-  const result = CreateSessionTemplateRequest.safeParse(req.body);
-  if (!result.success) {
-    return res.status(400).json({ error: result.error.issues[0].message });
-  }
-
-  const template = sessionTemplates.create({
-    projectId: req.params.id,
-    ...result.data,
-  });
-  res.status(201).json(template);
-});
+// Template routes are mounted as a sub-router
+router.use('/:id/templates', projectTemplatesRouter);
 
 // Command button routes are mounted as a sub-router
-router.use('/:id/command-buttons', projectCommandButtonsRouter);
-
-// GET /api/projects/:id/session-defaults - Get session defaults for project
-router.get('/:id/session-defaults', (req, res) => {
-  const project = projects.getById(req.params.id);
-  if (!project) {
-    return res.status(404).json({ error: ERR_PROJECT_NOT_FOUND });
-  }
-
-  const defaults = projectDefaults.getByProjectId(req.params.id);
-  if (!defaults) {
-    return res.json(null);
-  }
+router.use('/:id/circus-commands', projectCommandButtonsRouter);
 
-  res.json(defaults);
-});
-
-// POST /api/projects/:id/session-defaults - Update/create session defaults for project
-router.post('/:id/session-defaults', (req, res) => {
-  const project = projects.getById(req.params.id);
-  if (!project) {
-    return res.status(404).json({ error: ERR_PROJECT_NOT_FOUND });
-  }
-
-  const result = ProjectSessionDefaultsRequest.safeParse(req.body);
-  if (!result.success) {
-    return res.status(400).json({ error: result.error.issues[0].message });
-  }
-
-  const updated = projectDefaults.upsert(req.params.id, result.data);
-  res.status(200).json(updated);
-});
-
-// DELETE /api/projects/:id/session-defaults - Reset session defaults for project
-router.delete('/:id/session-defaults', (req, res) => {
-  const project = projects.getById(req.params.id);
-  if (!project) {
-    return res.status(404).json({ error: ERR_PROJECT_NOT_FOUND });
-  }
-
-  projectDefaults.resetToDefaults(req.params.id);
-  res.json({ message: 'Session defaults reset to system defaults' });
-});
+// Session defaults routes are mounted as a sub-router
+router.use('/:id/session-defaults', projectSessionDefaultsRouter);
 
 export default router;

package/packages/server/src/api/sessions-commands.js

@@ -6,6 +6,9 @@ import { requireRootSessionAndProject } from '../middleware/sessionLookup.js';
 import { commandRunner } from '../services/commandRunner.js';
 import { databaseManager } from '../db/DatabaseManager.js';
 
+// Error message constants
+const ERR_BUTTON_NOT_FOUND = 'Circus Command not found';
+
 const router = Router();
 
 /**
@@ -46,13 +49,13 @@ function broadcastCommandError(ctx, errorMessage) {
   broadcastToProject(projectId, WS_MESSAGE_TYPES.COMMAND_RUN_ERROR, { projectId, sessionId, runId, buttonId, error: errorMessage });
 }
 
-// GET /api/sessions/:id/command-buttons - List command buttons for the workflow project
-router.get('/:id/command-buttons', requireRootSessionAndProject, (req, res) => {
+// GET /api/sessions/:id/circus-commands - List command buttons for the workflow project
+router.get('/:id/circus-commands', requireRootSessionAndProject, (req, res) => {
   res.json(commandButtons.getByProjectId(req.rootSession_.projectId));
 });
 
-// POST /api/sessions/:id/command-buttons/:buttonId/run - Execute button command
-router.post('/:id/command-buttons/:buttonId/run', requireRootSessionAndProject, (req, res) => {
+// POST /api/sessions/:id/circus-commands/:buttonId/run - Execute button command
+router.post('/:id/circus-commands/:buttonId/run', requireRootSessionAndProject, (req, res) => {
   const sessionId = req.rootSessionId;
   const buttonId = req.params.buttonId;
 
@@ -60,10 +63,10 @@ router.post('/:id/command-buttons/:buttonId/run', requireRootSessionAndProject,
 
   const button = commandButtons.getById(buttonId);
   if (!button) {
-    return res.status(404).json({ error: 'Command button not found' });
+    return res.status(404).json({ error: ERR_BUTTON_NOT_FOUND });
   }
   if (button.projectId !== req.rootSession_.projectId) {
-    return res.status(404).json({ error: 'Command button not found' });
+    return res.status(404).json({ error: ERR_BUTTON_NOT_FOUND });
   }
 
   // Generate run ID
@@ -105,16 +108,16 @@ router.post('/:id/command-buttons/:buttonId/run', requireRootSessionAndProject,
   })();
 });
 
-// GET /api/sessions/:id/command-buttons/runs - Get active runs for session
-router.get('/:id/command-buttons/runs', requireRootSessionAndProject, (req, res) => {
+// GET /api/sessions/:id/circus-commands/runs - Get active runs for session
+router.get('/:id/circus-commands/runs', requireRootSessionAndProject, (req, res) => {
   const sessionId = req.rootSessionId;
 
   const activeRuns = commandRunner.getRunsBySession(sessionId);
   res.json(activeRuns);
 });
 
-// GET /api/sessions/:id/command-buttons/runs/:runId - Get single run by ID
-router.get('/:id/command-buttons/runs/:runId', requireRootSessionAndProject, (req, res) => {
+// GET /api/sessions/:id/circus-commands/runs/:runId - Get single run by ID
+router.get('/:id/circus-commands/runs/:runId', requireRootSessionAndProject, (req, res) => {
   const { runId } = req.params;
   const sessionId = req.rootSessionId;
 
@@ -144,8 +147,8 @@ router.get('/:id/command-buttons/runs/:runId', requireRootSessionAndProject, (re
   });
 });
 
-// DELETE /api/sessions/:id/command-buttons/runs/:runId - Delete a command run record
-router.delete('/:id/command-buttons/runs/:runId', requireRootSessionAndProject, (req, res) => {
+// DELETE /api/sessions/:id/circus-commands/runs/:runId - Delete a command run record
+router.delete('/:id/circus-commands/runs/:runId', requireRootSessionAndProject, (req, res) => {
   const sessionId = req.rootSessionId;
   const { runId } = req.params;
 
@@ -178,17 +181,17 @@ router.delete('/:id/command-buttons/runs/:runId', requireRootSessionAndProject,
   res.status(204).send();
 });
 
-// DELETE /api/sessions/:id/command-buttons/:buttonId/runs/all - Delete all runs for a button in a session
-router.delete('/:id/command-buttons/:buttonId/runs/all', requireRootSessionAndProject, (req, res) => {
+// DELETE /api/sessions/:id/circus-commands/:buttonId/runs/all - Delete all runs for a button in a session
+router.delete('/:id/circus-commands/:buttonId/runs/all', requireRootSessionAndProject, (req, res) => {
   const sessionId = req.rootSessionId;
   const { buttonId } = req.params;
 
   const button = commandButtons.getById(buttonId);
   if (!button) {
-    return res.status(404).json({ error: 'Command button not found' });
+    return res.status(404).json({ error: ERR_BUTTON_NOT_FOUND });
   }
   if (button.projectId !== req.rootSession_.projectId) {
-    return res.status(404).json({ error: 'Command button not found' });
+    return res.status(404).json({ error: ERR_BUTTON_NOT_FOUND });
   }
 
   const { deletedRuns } = commandRuns.deleteByButtonAndSession(buttonId, sessionId);
@@ -213,8 +216,8 @@ router.delete('/:id/command-buttons/:buttonId/runs/all', requireRootSessionAndPr
   res.status(204).send();
 });
 
-// POST /api/sessions/:id/command-buttons/runs/:runId/kill - Kill running command
-router.post('/:id/command-buttons/runs/:runId/kill', requireRootSessionAndProject, (req, res) => {
+// POST /api/sessions/:id/circus-commands/runs/:runId/kill - Kill running command
+router.post('/:id/circus-commands/runs/:runId/kill', requireRootSessionAndProject, (req, res) => {
   const sessionId = req.rootSessionId;
   const runId = req.params.runId;
 

package/packages/server/src/api/sessions-patch.js

@@ -1,9 +1,11 @@
 import { Router } from 'express';
-import { sessions, sessionTemplates, modelProviders } from '../database.js';
+import { sessions, sessionTemplates, modelProviders, sessionSummaries } from '../database.js';
 import { broadcastToSession, broadcastToProject } from '../websocket.js';
 import { WS_MESSAGE_TYPES } from '../../../shared/src/index.js';
 import * as summaryService from '../services/summaryService.js';
 import { setSessionNameFromPr } from '../services/prUrlService.js';
+import { checkSessionCiStatusNow } from '../services/prStatusService.js';
+import { broadcastSummaryUpdate } from '../services/summaryBroadcast.js';
 import { requireSession } from '../middleware/sessionLookup.js';
 
 const router = Router();
@@ -195,6 +197,30 @@ function broadcastSessionUpdate(sessionId, projectId, updated, updateData) {
   });
 }
 
+/**
+ * Reset all PR state fields in the session summary when the PR URL changes or is cleared.
+ * This ensures stale PR state (e.g., "merged") doesn't persist for a different PR
+ * and doesn't block summary regeneration.
+ * @param {string} sessionId
+ * @param {string|null} projectId - For broadcasting to project subscribers
+ */
+function resetPrStateForSession(sessionId, projectId) {
+  const existingSummary = sessionSummaries.getBySessionId(sessionId);
+  if (!existingSummary) return;
+
+  sessionSummaries.upsert(sessionId, {
+    prState: null,
+    prMerged: false,
+    hasMergeConflicts: false,
+    ciStatus: null,
+    ciFailures: [],
+  });
+
+  // Broadcast the reset to both session and project subscribers
+  const updatedSummary = sessionSummaries.getBySessionId(sessionId);
+  broadcastSummaryUpdate(sessionId, projectId, updatedSummary);
+}
+
 // PATCH /api/sessions/:id - Update session settings
 router.patch('/:id', requireSession, (req, res) => {
   const { updateData, error } = buildUpdateData(req.body);
@@ -209,6 +235,15 @@ router.patch('/:id', requireSession, (req, res) => {
 
   const updated = sessions.update(req.params.id, updateData);
 
+  // Reset PR state when URL changes to a different PR or is cleared
+  const previousPrUrl = req.session_.prUrl;
+  const prUrlProvided = Object.prototype.hasOwnProperty.call(updateData, 'prUrl');
+  const prUrlChanged = prUrlProvided && previousPrUrl && previousPrUrl !== updateData.prUrl;
+
+  if (prUrlChanged) {
+    resetPrStateForSession(req.params.id, req.session_.projectId);
+  }
+
   // Propagate PR URL to parent session if set (not when clearing)
   if (updateData.prUrl) {
     summaryService.propagatePrUrlToParent(req.params.id, updateData.prUrl);
@@ -218,6 +253,11 @@ router.patch('/:id', requireSession, (req, res) => {
     setSessionNameFromPr(req.params.id, updateData.prUrl).catch(err => {
       console.error(`[Sessions API] Failed to set session name from PR:`, err);
     });
+
+    // Trigger immediate PR status check for the new/changed URL
+    checkSessionCiStatusNow(req.params.id).catch(err => {
+      console.error(`[Sessions API] Failed to check PR status after URL change:`, err);
+    });
   }
 
   broadcastSessionUpdate(req.params.id, req.session_.projectId, updated, updateData);

package/packages/server/src/db/SessionRepository.js

@@ -74,6 +74,7 @@ export class SessionRepository extends BaseRepository {
       createdAt: row.created_at,
       updatedAt: row.updated_at,
       lastActivityAt: row.last_activity_at ?? null,
+      lastMessageAt: row.last_message_at ?? null,
       activeTimeMs: row.active_time_ms || 0,
     };
   }
@@ -147,7 +148,6 @@ export class SessionRepository extends BaseRepository {
     }
 
     sql += ` ORDER BY
-      starred DESC,
       COALESCE(last_activity_at, updated_at, created_at) DESC,
       updated_at DESC,
       created_at DESC,

package/packages/server/src/db/SessionTemplateRepository.js

@@ -23,6 +23,10 @@ export class SessionTemplateRepository extends BaseRepository {
       mode: row.mode || null,
       effortLevel: row.effort_level ?? null,
       targetLaneId: row.target_lane_id || null,
+      showInQuickResponses: Boolean(row.show_in_quick_responses),
+      quickResponseAutoSubmit: Boolean(row.quick_response_auto_submit),
+      quickResponseSortOrder: row.quick_response_sort_order ?? 0,
+      legacyQuickResponseId: row.legacy_quick_response_id || null,
       createdAt: row.created_at,
       updatedAt: row.updated_at,
     };
@@ -51,13 +55,22 @@ export class SessionTemplateRepository extends BaseRepository {
     return value ? 1 : 0;
   }
 
+  static #normalizeBoolean(value) {
+    return value ? 1 : 0;
+  }
+
   create(data) {
     const id = databaseManager.generateId();
     const now = Date.now();
     this.db
       .prepare(
-        `INSERT INTO session_templates (id, project_id, name, prompt, next_template_id, thinking_enabled, git_branch, git_mode, model, mode, effort_level, target_lane_id, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+        `INSERT INTO session_templates (
+          id, project_id, name, prompt, next_template_id, thinking_enabled,
+          git_branch, git_mode, model, mode, effort_level, target_lane_id,
+          show_in_quick_responses, quick_response_auto_submit,
+          quick_response_sort_order, legacy_quick_response_id,
+          created_at, updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
       )
       .run(
         id,
@@ -72,6 +85,10 @@ export class SessionTemplateRepository extends BaseRepository {
         data.mode !== undefined && data.mode !== null ? data.mode : null,
         data.effortLevel ?? null,
         data.targetLaneId || null,
+        SessionTemplateRepository.#normalizeBoolean(data.showInQuickResponses),
+        SessionTemplateRepository.#normalizeBoolean(data.quickResponseAutoSubmit),
+        data.quickResponseSortOrder ?? 0,
+        data.legacyQuickResponseId || null,
         now,
         now
       );
@@ -93,6 +110,10 @@ export class SessionTemplateRepository extends BaseRepository {
     mode: { column: 'mode', transform: (v) => v },
     effortLevel: { column: 'effort_level', transform: (v) => v },
     targetLaneId: { column: 'target_lane_id', transform: (v) => v },
+    showInQuickResponses: { column: 'show_in_quick_responses', transform: (v) => v ? 1 : 0 },
+    quickResponseAutoSubmit: { column: 'quick_response_auto_submit', transform: (v) => v ? 1 : 0 },
+    quickResponseSortOrder: { column: 'quick_response_sort_order', transform: (v) => v },
+    legacyQuickResponseId: { column: 'legacy_quick_response_id', transform: (v) => v || null },
   };
 
   /**

package/packages/server/src/db/migrations/canvasItemsMigrations.js

@@ -0,0 +1,109 @@
+/**
+ * Migrations for the canvas_items table.
+ * Each export is an array of { name, up(db) } migration objects.
+ */
+import { addColumnIfMissing, getColumns, getTableSql } from './migrationUtils.js';
+
+/**
+ * Migrate canvas_items table to include 'code' in type CHECK constraint.
+ * SQLite doesn't support ALTER TABLE to modify constraints, so we recreate the table.
+ */
+function migrateCanvasItemsTypeConstraint(db) {
+  const tableSql = getTableSql(db, 'canvas_items');
+
+  // If schema already includes 'code', no migration needed
+  if (tableSql?.includes("'code'")) {
+    return;
+  }
+
+  db.exec(`
+    CREATE TABLE canvas_items_new (
+      id TEXT PRIMARY KEY,
+      session_id TEXT REFERENCES sessions(id) ON DELETE CASCADE,
+      type TEXT NOT NULL CHECK (type IN ('image', 'markdown', 'text', 'json', 'pdf', 'code')),
+      content TEXT,
+      data TEXT,
+      mime_type TEXT,
+      filename TEXT,
+      label TEXT,
+      width INTEGER,
+      height INTEGER,
+      created_at INTEGER NOT NULL DEFAULT (unixepoch() * 1000)
+    );
+
+    INSERT INTO canvas_items_new SELECT * FROM canvas_items;
+
+    DROP TABLE canvas_items;
+
+    ALTER TABLE canvas_items_new RENAME TO canvas_items;
+
+    CREATE INDEX IF NOT EXISTS idx_canvas_session ON canvas_items(session_id);
+  `);
+}
+
+/**
+ * Migrate canvas_items table to drop label column.
+ */
+function migrateCanvasItemsDropLabel(db) {
+  const columns = getColumns(db, 'canvas_items');
+
+  // If label column doesn't exist, migration already done
+  if (!columns.includes('label')) {
+    return;
+  }
+
+  db.exec(`
+    CREATE TABLE canvas_items_new (
+      id TEXT PRIMARY KEY,
+      session_id TEXT REFERENCES sessions(id) ON DELETE CASCADE,
+      type TEXT NOT NULL CHECK (type IN ('image', 'markdown', 'text', 'json', 'pdf', 'code')),
+      content TEXT,
+      data TEXT,
+      mime_type TEXT,
+      filename TEXT,
+      width INTEGER,
+      height INTEGER,
+      deleted_at INTEGER,
+      created_at INTEGER NOT NULL DEFAULT (unixepoch() * 1000)
+    );
+
+    INSERT INTO canvas_items_new (id, session_id, type, content, data, mime_type, filename, width, height, deleted_at, created_at)
+    SELECT id, session_id, type, content, data, mime_type, filename, width, height, deleted_at, created_at FROM canvas_items;
+
+    DROP TABLE canvas_items;
+
+    ALTER TABLE canvas_items_new RENAME TO canvas_items;
+
+    CREATE INDEX IF NOT EXISTS idx_canvas_session ON canvas_items(session_id);
+    CREATE INDEX IF NOT EXISTS idx_canvas_deleted ON canvas_items(deleted_at);
+  `);
+}
+
+/** @type {Array<{name: string, up: (db: import('better-sqlite3').Database) => void}>} */
+export const canvasItemsMigrations = [
+  {
+    name: 'canvas_items-migrate-type-constraint',
+    up(db) { migrateCanvasItemsTypeConstraint(db); },
+  },
+  {
+    name: 'canvas_items-add-deleted_at',
+    up(db) {
+      addColumnIfMissing(db, 'canvas_items', 'deleted_at', 'INTEGER');
+      db.exec('CREATE INDEX IF NOT EXISTS idx_canvas_deleted ON canvas_items(deleted_at)');
+    },
+  },
+  {
+    name: 'canvas_items-drop-label',
+    up(db) { migrateCanvasItemsDropLabel(db); },
+  },
+  {
+    name: 'canvas_items-add-updated_at',
+    up(db) {
+      const columns = getColumns(db, 'canvas_items');
+      if (!columns.includes('updated_at')) {
+        db.exec('ALTER TABLE canvas_items ADD COLUMN updated_at INTEGER');
+        db.exec('UPDATE canvas_items SET updated_at = created_at WHERE updated_at IS NULL');
+      }
+    },
+  },
+];