libre-webui 0.25.0 → 0.27.0

package/backend/dist/persistence/sqliteMigrations.js

@@ -745,6 +745,319 @@ const PERSONAL_AUTOMATIONS_REQUIRED_SCHEMA = {
         'created_at',
     ],
 };
+const AGENT_FOUNDATION_REQUIRED_SCHEMA = {
+    personas: ['bindings'],
+    tool_servers: [
+        'id',
+        'user_id',
+        'name',
+        'description',
+        'kind',
+        'base_url',
+        'spec',
+        'spec_digest',
+        'spec_revision',
+        'auth_mode',
+        'auth_header',
+        'access_mode',
+        'enabled',
+        'timeout_ms',
+        'max_response_bytes',
+        'created_at',
+        'updated_at',
+    ],
+    tool_server_tools: [
+        'id',
+        'server_id',
+        'name',
+        'description',
+        'params_schema',
+        'detail',
+        'side_effect',
+        'enabled',
+        'created_at',
+        'updated_at',
+    ],
+    tool_server_credentials: [
+        'id',
+        'server_id',
+        'user_id',
+        'secret',
+        'created_at',
+        'updated_at',
+    ],
+    tool_approvals: [
+        'id',
+        'user_id',
+        'session_id',
+        'server_id',
+        'tool_name',
+        'call_id',
+        'arguments_digest',
+        'scope',
+        'status',
+        'created_at',
+        'resolved_at',
+        'expires_at',
+    ],
+    prompts: [
+        'id',
+        'user_id',
+        'slug',
+        'title',
+        'description',
+        'content',
+        'variables',
+        'tags',
+        'version',
+        'created_at',
+        'updated_at',
+    ],
+    prompt_versions: [
+        'id',
+        'prompt_id',
+        'version',
+        'content',
+        'variables',
+        'created_at',
+    ],
+    skills: [
+        'id',
+        'user_id',
+        'slug',
+        'name',
+        'description',
+        'instructions',
+        'enabled',
+        'version',
+        'created_at',
+        'updated_at',
+    ],
+    skill_versions: ['id', 'skill_id', 'version', 'instructions', 'created_at'],
+};
+const SKILL_FILES_REQUIRED_SCHEMA = {
+    skill_files: [
+        'id',
+        'skill_id',
+        'path',
+        'content',
+        'size',
+        'created_at',
+        'updated_at',
+    ],
+};
+const NOTES_V2_REQUIRED_SCHEMA = {
+    notes: ['pinned'],
+    note_revisions: ['id', 'note_id', 'title', 'content', 'created_at'],
+    note_attachments: [
+        'id',
+        'note_id',
+        'blob_id',
+        'filename',
+        'content_type',
+        'size',
+        'created_at',
+    ],
+};
+const TEAM_COLLABORATION_REQUIRED_SCHEMA = {
+    calendar_events: [
+        'calendar_id',
+        'reminder_minutes',
+        'last_reminded_occurrence',
+    ],
+    calendars: ['id', 'user_id', 'name', 'color', 'created_at', 'updated_at'],
+    channels: [
+        'id',
+        'type',
+        'name',
+        'description',
+        'dm_key',
+        'created_by',
+        'created_at',
+        'updated_at',
+        'archived_at',
+    ],
+    channel_members: [
+        'channel_id',
+        'user_id',
+        'role',
+        'joined_at',
+        'last_read_at',
+    ],
+    channel_messages: [
+        'id',
+        'channel_id',
+        'user_id',
+        'parent_id',
+        'author_kind',
+        'model',
+        'content',
+        'metadata',
+        'created_at',
+        'updated_at',
+        'edited_at',
+        'deleted_at',
+        'pinned_at',
+        'pinned_by',
+    ],
+    channel_reactions: ['id', 'message_id', 'user_id', 'emoji', 'created_at'],
+    channel_attachments: [
+        'id',
+        'message_id',
+        'channel_id',
+        'blob_id',
+        'filename',
+        'content_type',
+        'size',
+        'created_by',
+        'created_at',
+    ],
+    notifications: [
+        'id',
+        'user_id',
+        'type',
+        'title',
+        'body',
+        'href',
+        'source_key',
+        'created_at',
+        'read_at',
+    ],
+    webhook_targets: [
+        'id',
+        'name',
+        'url',
+        'secret',
+        'events',
+        'enabled',
+        'created_by',
+        'created_at',
+        'updated_at',
+    ],
+};
+const MEDIA_ENTERPRISE_OPS_REQUIRED_SCHEMA = {
+    voice_profiles: [
+        'consent_expires_at',
+        'revoked_at',
+        'transfer_count',
+        'last_transfer_at',
+    ],
+    model_tariffs: [
+        'id',
+        'plugin_id',
+        'model',
+        'input_per_million',
+        'output_per_million',
+        'unit_price',
+        'currency',
+        'effective_from',
+        'created_by',
+        'created_at',
+    ],
+    usage_budgets: [
+        'id',
+        'name',
+        'principal_type',
+        'principal_id',
+        'period',
+        'amount_usd',
+        'mode',
+        'created_by',
+        'created_at',
+        'updated_at',
+    ],
+    message_feedback: [
+        'id',
+        'user_id',
+        'session_id',
+        'message_id',
+        'rating',
+        'tags',
+        'comment',
+        'model',
+        'plugin_id',
+        'snapshot',
+        'created_at',
+        'updated_at',
+    ],
+    arena_votes: [
+        'id',
+        'user_id',
+        'compare_group',
+        'model_a',
+        'model_b',
+        'winner',
+        'created_at',
+    ],
+    eval_sets: [
+        'id',
+        'user_id',
+        'name',
+        'description',
+        'items',
+        'created_at',
+        'updated_at',
+    ],
+    eval_runs: [
+        'id',
+        'set_id',
+        'user_id',
+        'label',
+        'plugin_id',
+        'model',
+        'status',
+        'results',
+        'error',
+        'created_at',
+        'updated_at',
+        'completed_at',
+    ],
+};
+const MFA_PUSH_RECOVERY_REQUIRED_SCHEMA = {
+    user_mfa: [
+        'user_id',
+        'totp_secret',
+        'activated_at',
+        'last_used_step',
+        'created_at',
+        'updated_at',
+    ],
+    mfa_recovery_codes: ['id', 'user_id', 'code_lookup', 'created_at', 'used_at'],
+    webauthn_credentials: [
+        'id',
+        'user_id',
+        'credential_lookup',
+        'credential_data',
+        'name',
+        'sign_count',
+        'created_at',
+        'last_used_at',
+    ],
+    push_subscriptions: [
+        'id',
+        'user_id',
+        'session_id',
+        'endpoint_lookup',
+        'subscription',
+        'user_agent',
+        'created_at',
+        'last_used_at',
+    ],
+    recovery_drills: [
+        'id',
+        'status',
+        'origin',
+        'started_at',
+        'finished_at',
+        'snapshot_bytes',
+        'rpo_seconds',
+        'restore_ms',
+        'error',
+        'report',
+        'created_by',
+        'created_at',
+    ],
+};
 export const IDENTITY_EMAIL_LOOKUP_SCHEMA_SQL = `
   ALTER TABLE users ADD COLUMN email_lookup TEXT;
   CREATE UNIQUE INDEX idx_users_email_lookup
@@ -1016,83 +1329,577 @@ export const PERSONAL_AUTOMATIONS_SCHEMA_SQL = `
   CREATE INDEX IF NOT EXISTS idx_automation_runs_owner_time
     ON automation_runs(user_id, scheduled_for);
 `;
-const REQUIRED_SCHEMA = {
-    ...LEGACY_REQUIRED_SCHEMA,
-    users: [
-        ...LEGACY_REQUIRED_SCHEMA.users,
-        ...IDENTITY_EMAIL_LOOKUP_REQUIRED_SCHEMA.users,
-    ],
-    voice_profiles: [
-        ...LEGACY_REQUIRED_SCHEMA.voice_profiles,
-        ...VOICE_PROFILE_NAME_LOOKUP_REQUIRED_SCHEMA.voice_profiles,
-    ],
-    ...PLATFORM_VECTOR_REQUIRED_SCHEMA,
-    ...DURABLE_JOBS_EVENTS_REQUIRED_SCHEMA,
-    ...BLOB_REFERENCE_REQUIRED_SCHEMA,
-    ...PLUGIN_DEFINITION_REQUIRED_SCHEMA,
-};
-const LEGACY_ADDITIVE_COLUMNS = {
-    users: ['avatar', 'account_status', 'approved_at', 'approved_by'],
-    personas: ['embedding_model', 'memory_settings', 'mutation_settings'],
-    sessions: [
-        'persona_id',
-        'provider_type',
-        'provider_id',
-        'archived',
-        'settings',
-        'folder_id',
-        'pinned',
-    ],
-    session_messages: [
-        'thinking',
-        'model',
-        'provider_metadata',
-        'images',
-        'statistics',
-        'artifacts',
-        'parent_id',
-        'branch_index',
-        'is_active',
-        'rating',
-    ],
-    documents: ['file_type', 'size', 'session_id', 'collection_id'],
-    plugin_credentials: ['routing_auth_fingerprint'],
-    plugin_definition_approvals: ['source_path'],
-    generated_images: ['kind', 'plugin_id', 'mime_type', 'metadata'],
-    voice_profiles: ['routing_fingerprint'],
-    work_tasks: ['provider_type', 'provider_id', 'host_path', 'policy_id'],
-    work_runs: ['provider_type', 'provider_id'],
-    persona_memories: [
-        'memory_type',
-        'access_count',
-        'last_accessed',
-        'decay_factor',
-        'consolidated_from',
-    ],
-};
-const LEGACY_BOOTSTRAP_CORE_TABLES = [
-    'users',
-    'sessions',
-    'session_messages',
-    'documents',
-    'document_chunks',
-    'user_preferences',
-    'system_settings',
-    'personas',
-];
-const addColumnIfMissing = (database, table, column, definition) => {
-    const columns = database
-        .prepare(`PRAGMA table_info(${table})`)
-        .all();
-    if (!columns.some(item => item.name === column)) {
-        database.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
-    }
-};
-const ensurePersonaPersistence = (database) => {
-    database.exec(`
-    CREATE TABLE IF NOT EXISTS persona_memories (
-      id TEXT PRIMARY KEY,
-      user_id TEXT NOT NULL,
+export const AGENT_FOUNDATION_TABLES_SQL = `
+  CREATE TABLE IF NOT EXISTS tool_servers (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    description TEXT,
+    kind TEXT NOT NULL CHECK (kind IN ('openapi', 'mcp')),
+    base_url TEXT NOT NULL,
+    spec TEXT,
+    spec_digest TEXT,
+    spec_revision INTEGER NOT NULL DEFAULT 1,
+    auth_mode TEXT NOT NULL CHECK (auth_mode IN ('none', 'bearer', 'header')),
+    auth_header TEXT,
+    access_mode TEXT NOT NULL
+      CHECK (access_mode IN ('admins-only', 'all-users', 'granted')),
+    enabled INTEGER NOT NULL DEFAULT 1,
+    timeout_ms INTEGER NOT NULL,
+    max_response_bytes INTEGER NOT NULL,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_tool_servers_updated
+    ON tool_servers(updated_at);
+
+  CREATE TABLE IF NOT EXISTS tool_server_tools (
+    id TEXT PRIMARY KEY,
+    server_id TEXT NOT NULL REFERENCES tool_servers(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    description TEXT,
+    params_schema TEXT,
+    detail TEXT,
+    side_effect INTEGER NOT NULL DEFAULT 1,
+    enabled INTEGER NOT NULL DEFAULT 1,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    UNIQUE (server_id, name)
+  );
+
+  CREATE TABLE IF NOT EXISTS tool_server_credentials (
+    id TEXT PRIMARY KEY,
+    server_id TEXT NOT NULL REFERENCES tool_servers(id) ON DELETE CASCADE,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    secret TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    UNIQUE (server_id, user_id)
+  );
+
+  CREATE TABLE IF NOT EXISTS tool_approvals (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    session_id TEXT REFERENCES sessions(id) ON DELETE CASCADE,
+    server_id TEXT REFERENCES tool_servers(id) ON DELETE CASCADE,
+    tool_name TEXT NOT NULL,
+    call_id TEXT,
+    arguments_digest TEXT,
+    scope TEXT NOT NULL CHECK (scope IN ('once', 'session', 'always')),
+    status TEXT NOT NULL
+      CHECK (status IN ('pending', 'approved', 'denied', 'expired')),
+    created_at INTEGER NOT NULL,
+    resolved_at INTEGER,
+    expires_at INTEGER
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_tool_approvals_owner
+    ON tool_approvals(user_id, status, created_at);
+
+  CREATE TABLE IF NOT EXISTS prompts (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    slug TEXT NOT NULL,
+    title TEXT NOT NULL,
+    description TEXT,
+    content TEXT NOT NULL,
+    variables TEXT,
+    tags TEXT,
+    version INTEGER NOT NULL DEFAULT 1,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    UNIQUE (user_id, slug)
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_prompts_owner
+    ON prompts(user_id, updated_at);
+
+  CREATE TABLE IF NOT EXISTS prompt_versions (
+    id TEXT PRIMARY KEY,
+    prompt_id TEXT NOT NULL REFERENCES prompts(id) ON DELETE CASCADE,
+    version INTEGER NOT NULL,
+    content TEXT NOT NULL,
+    variables TEXT,
+    created_at INTEGER NOT NULL,
+    UNIQUE (prompt_id, version)
+  );
+
+  CREATE TABLE IF NOT EXISTS skills (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    slug TEXT NOT NULL,
+    name TEXT NOT NULL,
+    description TEXT NOT NULL,
+    instructions TEXT NOT NULL,
+    enabled INTEGER NOT NULL DEFAULT 1,
+    version INTEGER NOT NULL DEFAULT 1,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    UNIQUE (user_id, slug)
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_skills_owner
+    ON skills(user_id, updated_at);
+
+  CREATE TABLE IF NOT EXISTS skill_versions (
+    id TEXT PRIMARY KEY,
+    skill_id TEXT NOT NULL REFERENCES skills(id) ON DELETE CASCADE,
+    version INTEGER NOT NULL,
+    instructions TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    UNIQUE (skill_id, version)
+  );
+`;
+export const AGENT_FOUNDATION_SCHEMA_SQL = `
+  ALTER TABLE personas ADD COLUMN bindings TEXT;
+${AGENT_FOUNDATION_TABLES_SQL}`;
+export const SKILL_FILES_SCHEMA_SQL = `
+  CREATE TABLE IF NOT EXISTS skill_files (
+    id TEXT PRIMARY KEY,
+    skill_id TEXT NOT NULL REFERENCES skills(id) ON DELETE CASCADE,
+    path TEXT NOT NULL,
+    content TEXT NOT NULL,
+    size INTEGER NOT NULL,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    UNIQUE (skill_id, path)
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_skill_files_skill
+    ON skill_files(skill_id);
+`;
+export const NOTES_V2_TABLES_SQL = `
+  CREATE TABLE IF NOT EXISTS note_revisions (
+    id TEXT PRIMARY KEY,
+    note_id TEXT NOT NULL REFERENCES notes(id) ON DELETE CASCADE,
+    title TEXT NOT NULL,
+    content TEXT NOT NULL,
+    created_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_note_revisions_note
+    ON note_revisions(note_id, created_at);
+
+  CREATE TABLE IF NOT EXISTS note_attachments (
+    id TEXT PRIMARY KEY,
+    note_id TEXT NOT NULL REFERENCES notes(id) ON DELETE CASCADE,
+    blob_id TEXT NOT NULL,
+    filename TEXT NOT NULL,
+    content_type TEXT NOT NULL,
+    size INTEGER NOT NULL,
+    created_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_note_attachments_note
+    ON note_attachments(note_id);
+`;
+export const NOTES_V2_SCHEMA_SQL = `
+  ALTER TABLE notes ADD COLUMN pinned INTEGER DEFAULT 0;
+
+  CREATE TABLE IF NOT EXISTS note_revisions (
+    id TEXT PRIMARY KEY,
+    note_id TEXT NOT NULL REFERENCES notes(id) ON DELETE CASCADE,
+    title TEXT NOT NULL,
+    content TEXT NOT NULL,
+    created_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_note_revisions_note
+    ON note_revisions(note_id, created_at);
+
+  CREATE TABLE IF NOT EXISTS note_attachments (
+    id TEXT PRIMARY KEY,
+    note_id TEXT NOT NULL REFERENCES notes(id) ON DELETE CASCADE,
+    blob_id TEXT NOT NULL,
+    filename TEXT NOT NULL,
+    content_type TEXT NOT NULL,
+    size INTEGER NOT NULL,
+    created_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_note_attachments_note
+    ON note_attachments(note_id);
+`;
+export const TEAM_COLLABORATION_TABLES_SQL = `
+  CREATE INDEX IF NOT EXISTS idx_calendar_scoped_events
+    ON calendar_events(calendar_id)
+    WHERE calendar_id IS NOT NULL;
+
+  CREATE TABLE IF NOT EXISTS calendars (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    color TEXT,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_calendars_owner
+    ON calendars(user_id, updated_at);
+
+  CREATE TABLE IF NOT EXISTS channels (
+    id TEXT PRIMARY KEY,
+    type TEXT NOT NULL CHECK (type IN ('public', 'private', 'dm')),
+    name TEXT NOT NULL,
+    description TEXT,
+    dm_key TEXT,
+    created_by TEXT,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    archived_at INTEGER
+  );
+
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_channels_dm_key
+    ON channels(dm_key)
+    WHERE dm_key IS NOT NULL;
+
+  CREATE TABLE IF NOT EXISTS channel_members (
+    channel_id TEXT NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    role TEXT NOT NULL CHECK (role IN ('owner', 'member')),
+    joined_at INTEGER NOT NULL,
+    last_read_at INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (channel_id, user_id)
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_channel_members_user
+    ON channel_members(user_id);
+
+  CREATE TABLE IF NOT EXISTS channel_messages (
+    id TEXT PRIMARY KEY,
+    channel_id TEXT NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
+    user_id TEXT,
+    parent_id TEXT,
+    author_kind TEXT NOT NULL DEFAULT 'user' CHECK (author_kind IN ('user', 'model')),
+    model TEXT,
+    content TEXT NOT NULL,
+    metadata TEXT,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    edited_at INTEGER,
+    deleted_at INTEGER,
+    pinned_at INTEGER,
+    pinned_by TEXT
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_channel_messages_timeline
+    ON channel_messages(channel_id, created_at, id);
+
+  CREATE INDEX IF NOT EXISTS idx_channel_messages_thread
+    ON channel_messages(parent_id)
+    WHERE parent_id IS NOT NULL;
+
+  CREATE TABLE IF NOT EXISTS channel_reactions (
+    id TEXT PRIMARY KEY,
+    message_id TEXT NOT NULL REFERENCES channel_messages(id) ON DELETE CASCADE,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    emoji TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    UNIQUE (message_id, user_id, emoji)
+  );
+
+  CREATE TABLE IF NOT EXISTS channel_attachments (
+    id TEXT PRIMARY KEY,
+    message_id TEXT NOT NULL REFERENCES channel_messages(id) ON DELETE CASCADE,
+    channel_id TEXT NOT NULL,
+    blob_id TEXT NOT NULL,
+    filename TEXT NOT NULL,
+    content_type TEXT NOT NULL,
+    size INTEGER NOT NULL,
+    created_by TEXT,
+    created_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_channel_attachments_message
+    ON channel_attachments(message_id);
+
+  CREATE TABLE IF NOT EXISTS notifications (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    type TEXT NOT NULL,
+    title TEXT NOT NULL,
+    body TEXT,
+    href TEXT,
+    source_key TEXT,
+    created_at INTEGER NOT NULL,
+    read_at INTEGER
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_notifications_user
+    ON notifications(user_id, created_at);
+
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_notifications_dedupe
+    ON notifications(user_id, source_key)
+    WHERE source_key IS NOT NULL;
+
+  CREATE TABLE IF NOT EXISTS webhook_targets (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    url TEXT NOT NULL,
+    secret TEXT,
+    events TEXT NOT NULL,
+    enabled INTEGER NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+    created_by TEXT,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  );
+`;
+export const TEAM_COLLABORATION_SCHEMA_SQL = `
+  ALTER TABLE calendar_events ADD COLUMN calendar_id TEXT;
+  ALTER TABLE calendar_events ADD COLUMN reminder_minutes INTEGER;
+  ALTER TABLE calendar_events ADD COLUMN last_reminded_occurrence INTEGER;
+${TEAM_COLLABORATION_TABLES_SQL}`;
+export const MEDIA_ENTERPRISE_OPS_TABLES_SQL = `
+  CREATE TABLE IF NOT EXISTS model_tariffs (
+    id TEXT PRIMARY KEY,
+    plugin_id TEXT NOT NULL,
+    model TEXT,
+    input_per_million REAL,
+    output_per_million REAL,
+    unit_price REAL,
+    currency TEXT NOT NULL DEFAULT 'USD',
+    effective_from INTEGER NOT NULL,
+    created_by TEXT,
+    created_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_model_tariffs_lookup
+    ON model_tariffs(plugin_id, model, effective_from);
+
+  CREATE TABLE IF NOT EXISTS usage_budgets (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    principal_type TEXT NOT NULL CHECK (principal_type IN ('instance', 'user', 'group')),
+    principal_id TEXT,
+    period TEXT NOT NULL CHECK (period IN ('daily', 'weekly', 'monthly')),
+    amount_usd REAL NOT NULL,
+    mode TEXT NOT NULL CHECK (mode IN ('observe', 'soft', 'hard')),
+    created_by TEXT,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_usage_budgets_principal
+    ON usage_budgets(principal_type, principal_id);
+
+  CREATE TABLE IF NOT EXISTS message_feedback (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    session_id TEXT NOT NULL,
+    message_id TEXT NOT NULL,
+    rating INTEGER NOT NULL CHECK (rating IN (-1, 1)),
+    tags TEXT,
+    comment TEXT,
+    model TEXT,
+    plugin_id TEXT,
+    snapshot TEXT,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    UNIQUE (user_id, message_id)
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_message_feedback_owner
+    ON message_feedback(user_id, created_at);
+
+  CREATE TABLE IF NOT EXISTS arena_votes (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    compare_group TEXT NOT NULL,
+    model_a TEXT NOT NULL,
+    model_b TEXT NOT NULL,
+    winner TEXT NOT NULL CHECK (winner IN ('a', 'b', 'tie', 'both-bad')),
+    created_at INTEGER NOT NULL,
+    UNIQUE (user_id, compare_group)
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_arena_votes_order
+    ON arena_votes(created_at, id);
+
+  CREATE TABLE IF NOT EXISTS eval_sets (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    description TEXT,
+    items TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_eval_sets_owner
+    ON eval_sets(user_id, updated_at);
+
+  CREATE TABLE IF NOT EXISTS eval_runs (
+    id TEXT PRIMARY KEY,
+    set_id TEXT NOT NULL REFERENCES eval_sets(id) ON DELETE CASCADE,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    label TEXT,
+    plugin_id TEXT,
+    model TEXT NOT NULL,
+    status TEXT NOT NULL CHECK (status IN ('queued', 'running', 'completed', 'failed', 'cancelled')),
+    results TEXT,
+    error TEXT,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL,
+    completed_at INTEGER
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_eval_runs_owner
+    ON eval_runs(user_id, created_at);
+
+  CREATE INDEX IF NOT EXISTS idx_eval_runs_parent
+    ON eval_runs(set_id);
+`;
+export const MEDIA_ENTERPRISE_OPS_SCHEMA_SQL = `
+  ALTER TABLE voice_profiles ADD COLUMN consent_expires_at INTEGER;
+  ALTER TABLE voice_profiles ADD COLUMN revoked_at INTEGER;
+  ALTER TABLE voice_profiles ADD COLUMN transfer_count INTEGER NOT NULL DEFAULT 0;
+  ALTER TABLE voice_profiles ADD COLUMN last_transfer_at INTEGER;
+${MEDIA_ENTERPRISE_OPS_TABLES_SQL}`;
+export const MFA_PUSH_RECOVERY_TABLES_SQL = `
+  CREATE TABLE IF NOT EXISTS user_mfa (
+    user_id TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+    totp_secret TEXT NOT NULL,
+    activated_at INTEGER,
+    last_used_step INTEGER,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS mfa_recovery_codes (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    code_lookup TEXT NOT NULL UNIQUE,
+    created_at INTEGER NOT NULL,
+    used_at INTEGER
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_mfa_recovery_codes_user
+    ON mfa_recovery_codes(user_id);
+
+  CREATE TABLE IF NOT EXISTS webauthn_credentials (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    credential_lookup TEXT NOT NULL UNIQUE,
+    credential_data TEXT NOT NULL,
+    name TEXT,
+    sign_count INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL,
+    last_used_at INTEGER
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_webauthn_credentials_user
+    ON webauthn_credentials(user_id);
+
+  CREATE TABLE IF NOT EXISTS push_subscriptions (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    session_id TEXT,
+    endpoint_lookup TEXT NOT NULL UNIQUE,
+    subscription TEXT NOT NULL,
+    user_agent TEXT,
+    created_at INTEGER NOT NULL,
+    last_used_at INTEGER
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_push_subscriptions_user
+    ON push_subscriptions(user_id);
+
+  CREATE TABLE IF NOT EXISTS recovery_drills (
+    id TEXT PRIMARY KEY,
+    status TEXT NOT NULL CHECK (status IN ('running', 'passed', 'failed')),
+    origin TEXT NOT NULL CHECK (origin IN ('scheduled', 'manual')),
+    started_at INTEGER NOT NULL,
+    finished_at INTEGER,
+    snapshot_bytes INTEGER,
+    rpo_seconds INTEGER,
+    restore_ms INTEGER,
+    error TEXT,
+    report TEXT,
+    created_by TEXT,
+    created_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_recovery_drills_started
+    ON recovery_drills(started_at);
+`;
+const REQUIRED_SCHEMA = {
+    ...LEGACY_REQUIRED_SCHEMA,
+    users: [
+        ...LEGACY_REQUIRED_SCHEMA.users,
+        ...IDENTITY_EMAIL_LOOKUP_REQUIRED_SCHEMA.users,
+    ],
+    voice_profiles: [
+        ...LEGACY_REQUIRED_SCHEMA.voice_profiles,
+        ...VOICE_PROFILE_NAME_LOOKUP_REQUIRED_SCHEMA.voice_profiles,
+    ],
+    ...PLATFORM_VECTOR_REQUIRED_SCHEMA,
+    ...DURABLE_JOBS_EVENTS_REQUIRED_SCHEMA,
+    ...BLOB_REFERENCE_REQUIRED_SCHEMA,
+    ...PLUGIN_DEFINITION_REQUIRED_SCHEMA,
+};
+const LEGACY_ADDITIVE_COLUMNS = {
+    users: ['avatar', 'account_status', 'approved_at', 'approved_by'],
+    personas: ['embedding_model', 'memory_settings', 'mutation_settings'],
+    sessions: [
+        'persona_id',
+        'provider_type',
+        'provider_id',
+        'archived',
+        'settings',
+        'folder_id',
+        'pinned',
+    ],
+    session_messages: [
+        'thinking',
+        'model',
+        'provider_metadata',
+        'images',
+        'statistics',
+        'artifacts',
+        'parent_id',
+        'branch_index',
+        'is_active',
+        'rating',
+    ],
+    documents: ['file_type', 'size', 'session_id', 'collection_id'],
+    plugin_credentials: ['routing_auth_fingerprint'],
+    plugin_definition_approvals: ['source_path'],
+    generated_images: ['kind', 'plugin_id', 'mime_type', 'metadata'],
+    voice_profiles: ['routing_fingerprint'],
+    work_tasks: ['provider_type', 'provider_id', 'host_path', 'policy_id'],
+    work_runs: ['provider_type', 'provider_id'],
+    persona_memories: [
+        'memory_type',
+        'access_count',
+        'last_accessed',
+        'decay_factor',
+        'consolidated_from',
+    ],
+};
+const LEGACY_BOOTSTRAP_CORE_TABLES = [
+    'users',
+    'sessions',
+    'session_messages',
+    'documents',
+    'document_chunks',
+    'user_preferences',
+    'system_settings',
+    'personas',
+];
+const addColumnIfMissing = (database, table, column, definition) => {
+    const columns = database
+        .prepare(`PRAGMA table_info(${table})`)
+        .all();
+    if (!columns.some(item => item.name === column)) {
+        database.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
+    }
+};
+const ensurePersonaPersistence = (database) => {
+    database.exec(`
+    CREATE TABLE IF NOT EXISTS persona_memories (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
       persona_id TEXT NOT NULL,
       content TEXT NOT NULL,
       embedding BLOB,
@@ -1187,6 +1994,36 @@ const REQUIRED_PRIMARY_KEYS = {
     calendar_events: ['id'],
     automations: ['id'],
     automation_runs: ['id'],
+    tool_servers: ['id'],
+    tool_server_tools: ['id'],
+    tool_server_credentials: ['id'],
+    tool_approvals: ['id'],
+    prompts: ['id'],
+    prompt_versions: ['id'],
+    skills: ['id'],
+    skill_versions: ['id'],
+    skill_files: ['id'],
+    note_revisions: ['id'],
+    note_attachments: ['id'],
+    calendars: ['id'],
+    channels: ['id'],
+    channel_members: ['channel_id', 'user_id'],
+    channel_messages: ['id'],
+    channel_reactions: ['id'],
+    channel_attachments: ['id'],
+    notifications: ['id'],
+    webhook_targets: ['id'],
+    model_tariffs: ['id'],
+    usage_budgets: ['id'],
+    message_feedback: ['id'],
+    arena_votes: ['id'],
+    eval_sets: ['id'],
+    eval_runs: ['id'],
+    user_mfa: ['user_id'],
+    mfa_recovery_codes: ['id'],
+    webauthn_credentials: ['id'],
+    push_subscriptions: ['id'],
+    recovery_drills: ['id'],
 };
 const REQUIRED_UNIQUE_KEYS = {
     [MIGRATION_TABLE]: [['name']],
@@ -1206,171 +2043,386 @@ const REQUIRED_UNIQUE_KEYS = {
         ['resource_type', 'resource_id', 'principal_type', 'principal_id'],
     ],
     api_tokens: [['token_hash']],
+    tool_server_tools: [['server_id', 'name']],
+    tool_server_credentials: [['server_id', 'user_id']],
+    prompts: [['user_id', 'slug']],
+    prompt_versions: [['prompt_id', 'version']],
+    skills: [['user_id', 'slug']],
+    skill_versions: [['skill_id', 'version']],
+    skill_files: [['skill_id', 'path']],
+    message_feedback: [['user_id', 'message_id']],
+    arena_votes: [['user_id', 'compare_group']],
+    mfa_recovery_codes: [['code_lookup']],
+    webauthn_credentials: [['credential_lookup']],
+    push_subscriptions: [['endpoint_lookup']],
 };
 const REQUIRED_FOREIGN_KEYS = [
     {
-        table: 'sessions',
+        table: 'sessions',
+        columns: ['user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'session_messages',
+        columns: ['session_id'],
+        referencedTable: 'sessions',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'plugin_credentials',
+        columns: ['user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'work_tasks',
+        columns: ['user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'work_runs',
+        columns: ['task_id'],
+        referencedTable: 'work_tasks',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'work_messages',
+        columns: ['task_id'],
+        referencedTable: 'work_tasks',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'work_messages',
+        columns: ['run_id'],
+        referencedTable: 'work_runs',
+        referencedColumns: ['id'],
+        onDelete: 'SET NULL',
+    },
+    {
+        table: 'persona_memories',
+        columns: ['user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'persona_memories',
+        columns: ['persona_id'],
+        referencedTable: 'personas',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'persona_states',
+        columns: ['persona_id'],
+        referencedTable: 'personas',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'platform_vector_acl',
+        columns: ['namespace', 'owner_user_id', 'vector_id'],
+        referencedTable: 'platform_vector_entries',
+        referencedColumns: ['namespace', 'owner_user_id', 'id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'platform_vector_attributes',
+        columns: ['namespace', 'owner_user_id', 'vector_id'],
+        referencedTable: 'platform_vector_entries',
+        referencedColumns: ['namespace', 'owner_user_id', 'id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'platform_job_attempts',
+        columns: ['job_id'],
+        referencedTable: 'platform_jobs',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'platform_events',
+        columns: ['stream_id'],
+        referencedTable: 'platform_event_stream_heads',
+        referencedColumns: ['stream_id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'user_group_members',
+        columns: ['group_id'],
+        referencedTable: 'user_groups',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'user_group_members',
+        columns: ['user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'resource_grants',
+        columns: ['owner_user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'auth_sessions',
         columns: ['user_id'],
         referencedTable: 'users',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'session_messages',
-        columns: ['session_id'],
-        referencedTable: 'sessions',
+        table: 'api_tokens',
+        columns: ['user_id'],
+        referencedTable: 'users',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'plugin_credentials',
+        table: 'oauth_identities',
         columns: ['user_id'],
         referencedTable: 'users',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'work_tasks',
+        table: 'calendar_events',
         columns: ['user_id'],
         referencedTable: 'users',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'work_runs',
-        columns: ['task_id'],
-        referencedTable: 'work_tasks',
+        table: 'automations',
+        columns: ['user_id'],
+        referencedTable: 'users',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'work_messages',
-        columns: ['task_id'],
-        referencedTable: 'work_tasks',
+        table: 'automation_runs',
+        columns: ['automation_id'],
+        referencedTable: 'automations',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'work_messages',
-        columns: ['run_id'],
-        referencedTable: 'work_runs',
+        table: 'automation_runs',
+        columns: ['user_id'],
+        referencedTable: 'users',
         referencedColumns: ['id'],
-        onDelete: 'SET NULL',
+        onDelete: 'CASCADE',
     },
     {
-        table: 'persona_memories',
+        table: 'tool_servers',
         columns: ['user_id'],
         referencedTable: 'users',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'persona_memories',
-        columns: ['persona_id'],
-        referencedTable: 'personas',
+        table: 'tool_server_tools',
+        columns: ['server_id'],
+        referencedTable: 'tool_servers',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'persona_states',
-        columns: ['persona_id'],
-        referencedTable: 'personas',
+        table: 'tool_server_credentials',
+        columns: ['server_id'],
+        referencedTable: 'tool_servers',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'platform_vector_acl',
-        columns: ['namespace', 'owner_user_id', 'vector_id'],
-        referencedTable: 'platform_vector_entries',
-        referencedColumns: ['namespace', 'owner_user_id', 'id'],
+        table: 'tool_server_credentials',
+        columns: ['user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'platform_vector_attributes',
-        columns: ['namespace', 'owner_user_id', 'vector_id'],
-        referencedTable: 'platform_vector_entries',
-        referencedColumns: ['namespace', 'owner_user_id', 'id'],
+        table: 'tool_approvals',
+        columns: ['user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'platform_job_attempts',
-        columns: ['job_id'],
-        referencedTable: 'platform_jobs',
+        table: 'tool_approvals',
+        columns: ['session_id'],
+        referencedTable: 'sessions',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'platform_events',
-        columns: ['stream_id'],
-        referencedTable: 'platform_event_stream_heads',
-        referencedColumns: ['stream_id'],
+        table: 'prompts',
+        columns: ['user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'user_group_members',
-        columns: ['group_id'],
-        referencedTable: 'user_groups',
+        table: 'prompt_versions',
+        columns: ['prompt_id'],
+        referencedTable: 'prompts',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'user_group_members',
+        table: 'skills',
         columns: ['user_id'],
         referencedTable: 'users',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'resource_grants',
-        columns: ['owner_user_id'],
+        table: 'skill_versions',
+        columns: ['skill_id'],
+        referencedTable: 'skills',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'skill_files',
+        columns: ['skill_id'],
+        referencedTable: 'skills',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'note_revisions',
+        columns: ['note_id'],
+        referencedTable: 'notes',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'note_attachments',
+        columns: ['note_id'],
+        referencedTable: 'notes',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'calendars',
+        columns: ['user_id'],
         referencedTable: 'users',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'auth_sessions',
+        table: 'channel_members',
+        columns: ['channel_id'],
+        referencedTable: 'channels',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'channel_members',
         columns: ['user_id'],
         referencedTable: 'users',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'api_tokens',
+        table: 'channel_messages',
+        columns: ['channel_id'],
+        referencedTable: 'channels',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'channel_reactions',
+        columns: ['message_id'],
+        referencedTable: 'channel_messages',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'channel_attachments',
+        columns: ['message_id'],
+        referencedTable: 'channel_messages',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'notifications',
         columns: ['user_id'],
         referencedTable: 'users',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'oauth_identities',
+        table: 'message_feedback',
         columns: ['user_id'],
         referencedTable: 'users',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'calendar_events',
+        table: 'arena_votes',
         columns: ['user_id'],
         referencedTable: 'users',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'automations',
+        table: 'eval_sets',
         columns: ['user_id'],
         referencedTable: 'users',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'automation_runs',
-        columns: ['automation_id'],
-        referencedTable: 'automations',
+        table: 'eval_runs',
+        columns: ['user_id'],
+        referencedTable: 'users',
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
     {
-        table: 'automation_runs',
+        table: 'eval_runs',
+        columns: ['set_id'],
+        referencedTable: 'eval_sets',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'user_mfa',
+        columns: ['user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'mfa_recovery_codes',
+        columns: ['user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'webauthn_credentials',
+        columns: ['user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'push_subscriptions',
         columns: ['user_id'],
         referencedTable: 'users',
         referencedColumns: ['id'],
@@ -1598,6 +2650,146 @@ const REQUIRED_INDEXES = [
         table: 'automation_runs',
         columns: ['user_id', 'scheduled_for'],
     },
+    {
+        name: 'idx_tool_servers_updated',
+        table: 'tool_servers',
+        columns: ['updated_at'],
+    },
+    {
+        name: 'idx_tool_approvals_owner',
+        table: 'tool_approvals',
+        columns: ['user_id', 'status', 'created_at'],
+    },
+    {
+        name: 'idx_prompts_owner',
+        table: 'prompts',
+        columns: ['user_id', 'updated_at'],
+    },
+    {
+        name: 'idx_skills_owner',
+        table: 'skills',
+        columns: ['user_id', 'updated_at'],
+    },
+    {
+        name: 'idx_skill_files_skill',
+        table: 'skill_files',
+        columns: ['skill_id'],
+    },
+    {
+        name: 'idx_note_revisions_note',
+        table: 'note_revisions',
+        columns: ['note_id', 'created_at'],
+    },
+    {
+        name: 'idx_note_attachments_note',
+        table: 'note_attachments',
+        columns: ['note_id'],
+    },
+    {
+        name: 'idx_calendar_scoped_events',
+        table: 'calendar_events',
+        columns: ['calendar_id'],
+        sqlFragment: 'WHERE calendar_id IS NOT NULL',
+    },
+    {
+        name: 'idx_calendars_owner',
+        table: 'calendars',
+        columns: ['user_id', 'updated_at'],
+    },
+    {
+        name: 'idx_channels_dm_key',
+        table: 'channels',
+        columns: ['dm_key'],
+        unique: true,
+        sqlFragment: 'WHERE dm_key IS NOT NULL',
+    },
+    {
+        name: 'idx_channel_members_user',
+        table: 'channel_members',
+        columns: ['user_id'],
+    },
+    {
+        name: 'idx_channel_messages_timeline',
+        table: 'channel_messages',
+        columns: ['channel_id', 'created_at', 'id'],
+    },
+    {
+        name: 'idx_channel_messages_thread',
+        table: 'channel_messages',
+        columns: ['parent_id'],
+    },
+    {
+        name: 'idx_channel_attachments_message',
+        table: 'channel_attachments',
+        columns: ['message_id'],
+    },
+    {
+        name: 'idx_notifications_user',
+        table: 'notifications',
+        columns: ['user_id', 'created_at'],
+    },
+    {
+        name: 'idx_notifications_dedupe',
+        table: 'notifications',
+        columns: ['user_id', 'source_key'],
+        unique: true,
+        sqlFragment: 'WHERE source_key IS NOT NULL',
+    },
+    {
+        name: 'idx_model_tariffs_lookup',
+        table: 'model_tariffs',
+        columns: ['plugin_id', 'model', 'effective_from'],
+    },
+    {
+        name: 'idx_usage_budgets_principal',
+        table: 'usage_budgets',
+        columns: ['principal_type', 'principal_id'],
+    },
+    {
+        name: 'idx_message_feedback_owner',
+        table: 'message_feedback',
+        columns: ['user_id', 'created_at'],
+    },
+    {
+        name: 'idx_arena_votes_order',
+        table: 'arena_votes',
+        columns: ['created_at', 'id'],
+    },
+    {
+        name: 'idx_eval_sets_owner',
+        table: 'eval_sets',
+        columns: ['user_id', 'updated_at'],
+    },
+    {
+        name: 'idx_eval_runs_owner',
+        table: 'eval_runs',
+        columns: ['user_id', 'created_at'],
+    },
+    {
+        name: 'idx_eval_runs_parent',
+        table: 'eval_runs',
+        columns: ['set_id'],
+    },
+    {
+        name: 'idx_mfa_recovery_codes_user',
+        table: 'mfa_recovery_codes',
+        columns: ['user_id'],
+    },
+    {
+        name: 'idx_webauthn_credentials_user',
+        table: 'webauthn_credentials',
+        columns: ['user_id'],
+    },
+    {
+        name: 'idx_push_subscriptions_user',
+        table: 'push_subscriptions',
+        columns: ['user_id'],
+    },
+    {
+        name: 'idx_recovery_drills_started',
+        table: 'recovery_drills',
+        columns: ['started_at'],
+    },
 ];
 const REQUIRED_TABLE_SQL_FRAGMENTS = {
     platform_vector_entries: ['CHECK(dimensions > 0)'],
@@ -1634,6 +2826,37 @@ const REQUIRED_TABLE_SQL_FRAGMENTS = {
         "permission IN ('read', 'write', 'admin')",
     ],
     security_audit_events: ["result IN ('success', 'denied', 'failure')"],
+    tool_servers: [
+        "kind IN ('openapi', 'mcp')",
+        "auth_mode IN ('none', 'bearer', 'header')",
+        "access_mode IN ('admins-only', 'all-users', 'granted')",
+    ],
+    tool_approvals: [
+        "scope IN ('once', 'session', 'always')",
+        "status IN ('pending', 'approved', 'denied', 'expired')",
+    ],
+    channels: ["type IN ('public', 'private', 'dm')"],
+    channel_members: ["role IN ('owner', 'member')"],
+    channel_messages: ["author_kind IN ('user', 'model')"],
+    channel_reactions: ['UNIQUE (message_id, user_id, emoji)'],
+    webhook_targets: ['enabled IN (0, 1)'],
+    usage_budgets: [
+        "principal_type IN ('instance', 'user', 'group')",
+        "period IN ('daily', 'weekly', 'monthly')",
+        "mode IN ('observe', 'soft', 'hard')",
+    ],
+    message_feedback: ['rating IN (-1, 1)', 'UNIQUE (user_id, message_id)'],
+    arena_votes: [
+        "winner IN ('a', 'b', 'tie', 'both-bad')",
+        'UNIQUE (user_id, compare_group)',
+    ],
+    eval_runs: [
+        "status IN ('queued', 'running', 'completed', 'failed', 'cancelled')",
+    ],
+    recovery_drills: [
+        "status IN ('running', 'passed', 'failed')",
+        "origin IN ('scheduled', 'manual')",
+    ],
 };
 const quoteIdentifier = (identifier) => `"${identifier.replace(/"/g, '""')}"`;
 const normalizeSql = (sql) => sql
@@ -1855,6 +3078,10 @@ const collectMissingSchema = (database) => [
     ...collectMissingResourceDeletionLifecycleSchema(database),
     ...collectMissingTrustFoundationSchema(database),
     ...collectMissingPersonalAutomationsSchema(database),
+    ...collectMissingAgentFoundationSchema(database),
+    ...collectMissingSkillFilesSchema(database),
+    ...collectMissingNotesV2Schema(database),
+    ...collectMissingTeamCollaborationSchema(database),
 ];
 const collectMissingMigrationLedgerSchema = (database) => [
     ...collectMissingColumns(database, {
@@ -1866,7 +3093,8 @@ const collectMissingLegacySchema = (database) => [
     ...collectMissingColumns(database, LEGACY_REQUIRED_SCHEMA),
     ...collectMissingStructuralInvariants(database).filter(item => !item.includes('platform_') &&
         !item.includes('idx_users_email_lookup') &&
-        !item.includes('idx_voice_profiles_name_lookup')),
+        !item.includes('idx_voice_profiles_name_lookup') &&
+        !item.includes('idx_calendar_scoped_events')),
 ];
 const collectMissingIdentityEmailLookupSchema = (database) => [
     ...collectMissingColumns(database, IDENTITY_EMAIL_LOOKUP_REQUIRED_SCHEMA),
@@ -1921,6 +3149,46 @@ const collectMissingPersonalAutomationsSchema = (database) => [
         item.includes('automations') ||
         item.includes('automation_runs')),
 ];
+const collectMissingAgentFoundationSchema = (database) => [
+    ...collectMissingColumns(database, AGENT_FOUNDATION_REQUIRED_SCHEMA),
+    ...collectMissingStructuralInvariants(database).filter(item => item.includes('tool_server') ||
+        item.includes('tool_approvals') ||
+        item.includes('prompt') ||
+        item.includes('skill')),
+];
+const collectMissingSkillFilesSchema = (database) => [
+    ...collectMissingColumns(database, SKILL_FILES_REQUIRED_SCHEMA),
+    ...collectMissingStructuralInvariants(database).filter(item => item.includes('skill_files')),
+];
+const collectMissingNotesV2Schema = (database) => [
+    ...collectMissingColumns(database, NOTES_V2_REQUIRED_SCHEMA),
+    ...collectMissingStructuralInvariants(database).filter(item => item.includes('note_revisions') || item.includes('note_attachments')),
+];
+const collectMissingTeamCollaborationSchema = (database) => [
+    ...collectMissingColumns(database, TEAM_COLLABORATION_REQUIRED_SCHEMA),
+    ...collectMissingStructuralInvariants(database).filter(item => item.includes('channel') ||
+        item.includes('notifications') ||
+        item.includes('webhook_targets') ||
+        item.includes('calendars') ||
+        item.includes('idx_calendar_scoped_events')),
+];
+const collectMissingMediaEnterpriseOpsSchema = (database) => [
+    ...collectMissingColumns(database, MEDIA_ENTERPRISE_OPS_REQUIRED_SCHEMA),
+    ...collectMissingStructuralInvariants(database).filter(item => item.includes('model_tariffs') ||
+        item.includes('usage_budgets') ||
+        item.includes('message_feedback') ||
+        item.includes('arena_votes') ||
+        item.includes('eval_sets') ||
+        item.includes('eval_runs')),
+];
+const collectMissingMfaPushRecoverySchema = (database) => [
+    ...collectMissingColumns(database, MFA_PUSH_RECOVERY_REQUIRED_SCHEMA),
+    ...collectMissingStructuralInvariants(database).filter(item => item.includes('user_mfa') ||
+        item.includes('mfa_recovery_codes') ||
+        item.includes('webauthn_credentials') ||
+        item.includes('push_subscriptions') ||
+        item.includes('recovery_drills')),
+];
 const collectMissingIdentityAccountRetirementSchema = (database) => {
     const row = database
         .prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'users'")
@@ -1959,6 +3227,12 @@ function collectMissingSchemaAtVersion(database, version) {
             : []),
         ...(version >= 14 ? collectMissingTrustFoundationSchema(database) : []),
         ...(version >= 15 ? collectMissingPersonalAutomationsSchema(database) : []),
+        ...(version >= 16 ? collectMissingAgentFoundationSchema(database) : []),
+        ...(version >= 17 ? collectMissingSkillFilesSchema(database) : []),
+        ...(version >= 18 ? collectMissingNotesV2Schema(database) : []),
+        ...(version >= 19 ? collectMissingTeamCollaborationSchema(database) : []),
+        ...(version >= 20 ? collectMissingMediaEnterpriseOpsSchema(database) : []),
+        ...(version >= 21 ? collectMissingMfaPushRecoverySchema(database) : []),
     ];
 }
 const collectMissingLegacyBootstrapSchema = (database) => {
@@ -2009,6 +3283,12 @@ const DURABLE_EVENT_REPLAY_INDEX_MIGRATION_CHECKSUM = '7d6b769ceadd08791c77ac5c5
 const TRUST_FOUNDATION_MIGRATION_CHECKSUM = 'c5a73245de3cd3e37db8877c8457c975d789f98c1c71ae1e4fc891ba09e8de5a';
 const LEGACY_DURABLE_EVENT_REPLAY_INDEX_MIGRATION_CHECKSUM = 'DURABLE_EVENT_REPLAY_INDEX_CHECKSUM_TO_FREEZE';
 const PERSONAL_AUTOMATIONS_MIGRATION_CHECKSUM = '5bfb4a1789480a3cacc09c5a4359a4e77b82b0edafa80f6d78cde73e57ddc70b';
+const AGENT_FOUNDATION_MIGRATION_CHECKSUM = '7e3a346fae66c073aac800aa45847999a4300b2f17eb3eaf9ed6351e891e2941';
+const SKILL_FILES_MIGRATION_CHECKSUM = '584e1f9bca79eb5974f997088636d74d7f2c1e5fd816fcd0f6cf74ec30aea161';
+const NOTES_V2_MIGRATION_CHECKSUM = '05a6758ab2b2a54f9097a5d5604a2bd57e085f1dd16816b5dc96d1eb7a41a399';
+const TEAM_COLLABORATION_MIGRATION_CHECKSUM = '1cf021c941cfd9207a82e794e58d7553ae24a35b3f8f8a84bb4a0e06d0d77443';
+const MEDIA_ENTERPRISE_OPS_MIGRATION_CHECKSUM = 'c6bc6d98518f7a279ad7109cfdfcd8a75fbf7e3e157c50bca98142b50ac0f38b';
+const MFA_PUSH_RECOVERY_MIGRATION_CHECKSUM = '9b2cdc08d2316877af091587113c749aed4b224d6ee12e72626b830da5447005';
 const MIGRATIONS = [
     {
         version: 1,
@@ -2231,6 +3511,87 @@ const MIGRATIONS = [
             }
         },
     },
+    {
+        version: 16,
+        name: 'agent-foundation',
+        checksum: AGENT_FOUNDATION_MIGRATION_CHECKSUM,
+        apply(database) {
+            addColumnIfMissing(database, 'personas', 'bindings', 'TEXT');
+            database.exec(AGENT_FOUNDATION_TABLES_SQL);
+            const missing = collectMissingAgentFoundationSchema(database);
+            if (missing.length > 0) {
+                throw new Error(`SQLite agent foundation schema is incomplete; missing ${missing.join(', ')}`);
+            }
+        },
+    },
+    {
+        version: 17,
+        name: 'skill-files',
+        checksum: SKILL_FILES_MIGRATION_CHECKSUM,
+        apply(database) {
+            database.exec(SKILL_FILES_SCHEMA_SQL);
+            const missing = collectMissingSkillFilesSchema(database);
+            if (missing.length > 0) {
+                throw new Error(`SQLite skill files schema is incomplete; missing ${missing.join(', ')}`);
+            }
+        },
+    },
+    {
+        version: 18,
+        name: 'notes-v2',
+        checksum: NOTES_V2_MIGRATION_CHECKSUM,
+        apply(database) {
+            addColumnIfMissing(database, 'notes', 'pinned', 'INTEGER DEFAULT 0');
+            database.exec(NOTES_V2_TABLES_SQL);
+            const missing = collectMissingNotesV2Schema(database);
+            if (missing.length > 0) {
+                throw new Error(`SQLite notes v2 schema is incomplete; missing ${missing.join(', ')}`);
+            }
+        },
+    },
+    {
+        version: 19,
+        name: 'team-collaboration',
+        checksum: TEAM_COLLABORATION_MIGRATION_CHECKSUM,
+        apply(database) {
+            addColumnIfMissing(database, 'calendar_events', 'calendar_id', 'TEXT');
+            addColumnIfMissing(database, 'calendar_events', 'reminder_minutes', 'INTEGER');
+            addColumnIfMissing(database, 'calendar_events', 'last_reminded_occurrence', 'INTEGER');
+            database.exec(TEAM_COLLABORATION_TABLES_SQL);
+            const missing = collectMissingTeamCollaborationSchema(database);
+            if (missing.length > 0) {
+                throw new Error(`SQLite team collaboration schema is incomplete; missing ${missing.join(', ')}`);
+            }
+        },
+    },
+    {
+        version: 20,
+        name: 'media-enterprise-ops',
+        checksum: MEDIA_ENTERPRISE_OPS_MIGRATION_CHECKSUM,
+        apply(database) {
+            addColumnIfMissing(database, 'voice_profiles', 'consent_expires_at', 'INTEGER');
+            addColumnIfMissing(database, 'voice_profiles', 'revoked_at', 'INTEGER');
+            addColumnIfMissing(database, 'voice_profiles', 'transfer_count', 'INTEGER NOT NULL DEFAULT 0');
+            addColumnIfMissing(database, 'voice_profiles', 'last_transfer_at', 'INTEGER');
+            database.exec(MEDIA_ENTERPRISE_OPS_TABLES_SQL);
+            const missing = collectMissingMediaEnterpriseOpsSchema(database);
+            if (missing.length > 0) {
+                throw new Error(`SQLite media enterprise ops schema is incomplete; missing ${missing.join(', ')}`);
+            }
+        },
+    },
+    {
+        version: 21,
+        name: 'mfa-push-recovery',
+        checksum: MFA_PUSH_RECOVERY_MIGRATION_CHECKSUM,
+        apply(database) {
+            database.exec(MFA_PUSH_RECOVERY_TABLES_SQL);
+            const missing = collectMissingMfaPushRecoverySchema(database);
+            if (missing.length > 0) {
+                throw new Error(`SQLite mfa/push/recovery schema is incomplete; missing ${missing.join(', ')}`);
+            }
+        },
+    },
 ];
 /**
  * Whether a pending migration needs foreign-key enforcement suspended before