libre-webui 0.26.0 → 0.28.0

package/backend/dist/persistence/sqliteMigrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqliteMigrations.d.ts","sourceRoot":"","sources":["../../src/persistence/sqliteMigrations.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAK3C,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AA2RvD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,4rEAwEtC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,svHAqG1C,CAAC;AAwiBF,eAAO,MAAM,gCAAgC,yKAK5C,CAAC;AAEF,eAAO,MAAM,oCAAoC,2NAKhD,CAAC;AAEF,eAAO,MAAM,4BAA4B,okBAkBxC,CAAC;AAEF,eAAO,MAAM,sCAAsC,ugBAgBlD,CAAC;AAEF,eAAO,MAAM,gCAAgC,4WAW5C,CAAC;AAEF,eAAO,MAAM,oCAAoC,sRAOhD,CAAC;AAEF,eAAO,MAAM,qCAAqC,8IAGjD,CAAC;AAEF,eAAO,MAAM,sCAAsC,m+BA0BlD,CAAC;AAEF,eAAO,MAAM,2BAA2B,+qHA8GvC,CAAC;AAEF,eAAO,MAAM,+BAA+B,y6DA4D3C,CAAC;AAEF,eAAO,MAAM,2BAA2B,s4HAyHvC,CAAC;AAEF,eAAO,MAAM,2BAA2B,07HAET,CAAC;AAEhC,eAAO,MAAM,sBAAsB,+ZAclC,CAAC;AAEF,eAAO,MAAM,mBAAmB,+tBAwB/B,CAAC;AAEF,eAAO,MAAM,mBAAmB,2xBA0B/B,CAAC;AAEF,eAAO,MAAM,6BAA6B,wvHA2HzC,CAAC;AAEF,eAAO,MAAM,6BAA6B,s8HAIT,CAAC;AAElC,eAAO,MAAM,+BAA+B,wlGAmG3C,CAAC;AAEF,eAAO,MAAM,+BAA+B,m3GAKT,CAAC;AAqEpC,MAAM,MAAM,yBAAyB,GACnC,eAAe,GAAG,WAAW,GAAG,YAAY,GAAG,cAAc,CAAC;AAEhE,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,yBAAyB,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAQD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iBAAiB,EAAE,KAAK,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA0gED;;;;;GAKG;AACH,eAAO,MAAM,+CAA+C,mBAC1C,MAAM,KACrB,OAKA,CAAC;AAEJ,iFAAiF;AACjF,eAAO,MAAM,yBAAyB;;;;IAQrC,CAAC;AA4GF;;;GAGG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,IAAI,CAkBN;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,IAAI,CAmBN;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,sBAAsB,CAuIxB;AAUD,eAAO,MAAM,2BAA2B,QAAO,wBAE7C,CAAC;AAkBH,eAAO,MAAM,yBAAyB,UAC7B,OAAO,KACb,wBAC2D,CAAC;AAE/D;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,wBAAwB,CAsD1B;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,wBAAwB,CA0B1B;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,wBAAwB,CAgN1B"}
+{"version":3,"file":"sqliteMigrations.d.ts","sourceRoot":"","sources":["../../src/persistence/sqliteMigrations.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAK3C,OAAO,EACL,4BAA4B,EAC5B,gCAAgC,GACjC,MAAM,+CAA+C,CAAC;AA2RvD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,4rEAwEtC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,svHAqG1C,CAAC;AAmmBF,eAAO,MAAM,gCAAgC,yKAK5C,CAAC;AAEF,eAAO,MAAM,oCAAoC,2NAKhD,CAAC;AAEF,eAAO,MAAM,4BAA4B,okBAkBxC,CAAC;AAEF,eAAO,MAAM,sCAAsC,ugBAgBlD,CAAC;AAEF,eAAO,MAAM,gCAAgC,4WAW5C,CAAC;AAEF,eAAO,MAAM,oCAAoC,sRAOhD,CAAC;AAEF,eAAO,MAAM,qCAAqC,8IAGjD,CAAC;AAEF,eAAO,MAAM,sCAAsC,m+BA0BlD,CAAC;AAEF,eAAO,MAAM,2BAA2B,+qHA8GvC,CAAC;AAEF,eAAO,MAAM,+BAA+B,y6DA4D3C,CAAC;AAEF,eAAO,MAAM,2BAA2B,s4HAyHvC,CAAC;AAEF,eAAO,MAAM,2BAA2B,07HAET,CAAC;AAEhC,eAAO,MAAM,sBAAsB,+ZAclC,CAAC;AAEF,eAAO,MAAM,mBAAmB,+tBAwB/B,CAAC;AAEF,eAAO,MAAM,mBAAmB,2xBA0B/B,CAAC;AAEF,eAAO,MAAM,6BAA6B,wvHA2HzC,CAAC;AAEF,eAAO,MAAM,6BAA6B,s8HAIT,CAAC;AAElC,eAAO,MAAM,+BAA+B,wlGAmG3C,CAAC;AAEF,eAAO,MAAM,+BAA+B,m3GAKT,CAAC;AAEpC,eAAO,MAAM,4BAA4B,8gEAkExC,CAAC;AAKF,eAAO,MAAM,iCAAiC,0MAI7C,CAAC;AAEF,eAAO,MAAM,wBAAwB,oEAEpC,CAAC;AAEF,eAAO,MAAM,wBAAwB,yEAEpC,CAAC;AAqEF,MAAM,MAAM,yBAAyB,GACnC,eAAe,GAAG,WAAW,GAAG,YAAY,GAAG,cAAc,CAAC;AAEhE,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,yBAAyB,CAAC;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAQD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,MAAM,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iBAAiB,EAAE,KAAK,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAmrED;;;;;GAKG;AACH,eAAO,MAAM,+CAA+C,mBAC1C,MAAM,KACrB,OAKA,CAAC;AAEJ,iFAAiF;AACjF,eAAO,MAAM,yBAAyB;;;;IAQrC,CAAC;AA4GF;;;GAGG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,IAAI,CAkBN;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,IAAI,CAmBN;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,sBAAsB,CAuIxB;AAUD,eAAO,MAAM,2BAA2B,QAAO,wBAE7C,CAAC;AAkBH,eAAO,MAAM,yBAAyB,UAC7B,OAAO,KACb,wBAC2D,CAAC;AAE/D;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,wBAAwB,CAsD1B;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,wBAAwB,CA0B1B;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAC1B,wBAAwB,CAgN1B"}

package/backend/dist/persistence/sqliteMigrations.js

@@ -1013,6 +1013,61 @@ const MEDIA_ENTERPRISE_OPS_REQUIRED_SCHEMA = {
         'completed_at',
     ],
 };
+const MFA_PUSH_RECOVERY_REQUIRED_SCHEMA = {
+    user_mfa: [
+        'user_id',
+        'totp_secret',
+        'activated_at',
+        'last_used_step',
+        'created_at',
+        'updated_at',
+    ],
+    mfa_recovery_codes: ['id', 'user_id', 'code_lookup', 'created_at', 'used_at'],
+    webauthn_credentials: [
+        'id',
+        'user_id',
+        'credential_lookup',
+        'credential_data',
+        'name',
+        'sign_count',
+        'created_at',
+        'last_used_at',
+    ],
+    push_subscriptions: [
+        'id',
+        'user_id',
+        'session_id',
+        'endpoint_lookup',
+        'subscription',
+        'user_agent',
+        'created_at',
+        'last_used_at',
+    ],
+    recovery_drills: [
+        'id',
+        'status',
+        'origin',
+        'started_at',
+        'finished_at',
+        'snapshot_bytes',
+        'rpo_seconds',
+        'restore_ms',
+        'error',
+        'report',
+        'created_by',
+        'created_at',
+    ],
+};
+const AUTOMATION_WORK_TARGET_REQUIRED_SCHEMA = {
+    automations: ['target', 'work_policy_id'],
+    automation_runs: ['work_task_id'],
+};
+const WORK_COMPUTER_REQUIRED_SCHEMA = {
+    work_policies: ['gui_enabled'],
+};
+const WORK_TAKEOVER_REQUIRED_SCHEMA = {
+    work_policies: ['takeover_enabled'],
+};
 export const IDENTITY_EMAIL_LOOKUP_SCHEMA_SQL = `
   ALTER TABLE users ADD COLUMN email_lookup TEXT;
   CREATE UNIQUE INDEX idx_users_email_lookup
@@ -1711,6 +1766,87 @@ export const MEDIA_ENTERPRISE_OPS_SCHEMA_SQL = `
   ALTER TABLE voice_profiles ADD COLUMN transfer_count INTEGER NOT NULL DEFAULT 0;
   ALTER TABLE voice_profiles ADD COLUMN last_transfer_at INTEGER;
 ${MEDIA_ENTERPRISE_OPS_TABLES_SQL}`;
+export const MFA_PUSH_RECOVERY_TABLES_SQL = `
+  CREATE TABLE IF NOT EXISTS user_mfa (
+    user_id TEXT PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+    totp_secret TEXT NOT NULL,
+    activated_at INTEGER,
+    last_used_step INTEGER,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS mfa_recovery_codes (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    code_lookup TEXT NOT NULL UNIQUE,
+    created_at INTEGER NOT NULL,
+    used_at INTEGER
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_mfa_recovery_codes_user
+    ON mfa_recovery_codes(user_id);
+
+  CREATE TABLE IF NOT EXISTS webauthn_credentials (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    credential_lookup TEXT NOT NULL UNIQUE,
+    credential_data TEXT NOT NULL,
+    name TEXT,
+    sign_count INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL,
+    last_used_at INTEGER
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_webauthn_credentials_user
+    ON webauthn_credentials(user_id);
+
+  CREATE TABLE IF NOT EXISTS push_subscriptions (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    session_id TEXT,
+    endpoint_lookup TEXT NOT NULL UNIQUE,
+    subscription TEXT NOT NULL,
+    user_agent TEXT,
+    created_at INTEGER NOT NULL,
+    last_used_at INTEGER
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_push_subscriptions_user
+    ON push_subscriptions(user_id);
+
+  CREATE TABLE IF NOT EXISTS recovery_drills (
+    id TEXT PRIMARY KEY,
+    status TEXT NOT NULL CHECK (status IN ('running', 'passed', 'failed')),
+    origin TEXT NOT NULL CHECK (origin IN ('scheduled', 'manual')),
+    started_at INTEGER NOT NULL,
+    finished_at INTEGER,
+    snapshot_bytes INTEGER,
+    rpo_seconds INTEGER,
+    restore_ms INTEGER,
+    error TEXT,
+    report TEXT,
+    created_by TEXT,
+    created_at INTEGER NOT NULL
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_recovery_drills_started
+    ON recovery_drills(started_at);
+`;
+// No CHECK on target: SQLite cannot DROP a column referenced by an inline
+// CHECK, which would make the documented rollback impossible. The service
+// layer normalizes the value; PostgreSQL keeps a real constraint.
+export const AUTOMATION_WORK_TARGET_SCHEMA_SQL = `
+  ALTER TABLE automations ADD COLUMN target TEXT NOT NULL DEFAULT 'chat';
+  ALTER TABLE automations ADD COLUMN work_policy_id TEXT;
+  ALTER TABLE automation_runs ADD COLUMN work_task_id TEXT;
+`;
+export const WORK_COMPUTER_SCHEMA_SQL = `
+  ALTER TABLE work_policies ADD COLUMN gui_enabled INTEGER;
+`;
+export const WORK_TAKEOVER_SCHEMA_SQL = `
+  ALTER TABLE work_policies ADD COLUMN takeover_enabled INTEGER;
+`;
 const REQUIRED_SCHEMA = {
     ...LEGACY_REQUIRED_SCHEMA,
     users: [
@@ -1907,6 +2043,11 @@ const REQUIRED_PRIMARY_KEYS = {
     arena_votes: ['id'],
     eval_sets: ['id'],
     eval_runs: ['id'],
+    user_mfa: ['user_id'],
+    mfa_recovery_codes: ['id'],
+    webauthn_credentials: ['id'],
+    push_subscriptions: ['id'],
+    recovery_drills: ['id'],
 };
 const REQUIRED_UNIQUE_KEYS = {
     [MIGRATION_TABLE]: [['name']],
@@ -1935,6 +2076,9 @@ const REQUIRED_UNIQUE_KEYS = {
     skill_files: [['skill_id', 'path']],
     message_feedback: [['user_id', 'message_id']],
     arena_votes: [['user_id', 'compare_group']],
+    mfa_recovery_codes: [['code_lookup']],
+    webauthn_credentials: [['credential_lookup']],
+    push_subscriptions: [['endpoint_lookup']],
 };
 const REQUIRED_FOREIGN_KEYS = [
     {
@@ -2280,6 +2424,34 @@ const REQUIRED_FOREIGN_KEYS = [
         referencedColumns: ['id'],
         onDelete: 'CASCADE',
     },
+    {
+        table: 'user_mfa',
+        columns: ['user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'mfa_recovery_codes',
+        columns: ['user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'webauthn_credentials',
+        columns: ['user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
+    {
+        table: 'push_subscriptions',
+        columns: ['user_id'],
+        referencedTable: 'users',
+        referencedColumns: ['id'],
+        onDelete: 'CASCADE',
+    },
 ];
 const REQUIRED_INDEXES = [
     {
@@ -2622,6 +2794,26 @@ const REQUIRED_INDEXES = [
         table: 'eval_runs',
         columns: ['set_id'],
     },
+    {
+        name: 'idx_mfa_recovery_codes_user',
+        table: 'mfa_recovery_codes',
+        columns: ['user_id'],
+    },
+    {
+        name: 'idx_webauthn_credentials_user',
+        table: 'webauthn_credentials',
+        columns: ['user_id'],
+    },
+    {
+        name: 'idx_push_subscriptions_user',
+        table: 'push_subscriptions',
+        columns: ['user_id'],
+    },
+    {
+        name: 'idx_recovery_drills_started',
+        table: 'recovery_drills',
+        columns: ['started_at'],
+    },
 ];
 const REQUIRED_TABLE_SQL_FRAGMENTS = {
     platform_vector_entries: ['CHECK(dimensions > 0)'],
@@ -2685,6 +2877,10 @@ const REQUIRED_TABLE_SQL_FRAGMENTS = {
     eval_runs: [
         "status IN ('queued', 'running', 'completed', 'failed', 'cancelled')",
     ],
+    recovery_drills: [
+        "status IN ('running', 'passed', 'failed')",
+        "origin IN ('scheduled', 'manual')",
+    ],
 };
 const quoteIdentifier = (identifier) => `"${identifier.replace(/"/g, '""')}"`;
 const normalizeSql = (sql) => sql
@@ -3009,6 +3205,17 @@ const collectMissingMediaEnterpriseOpsSchema = (database) => [
         item.includes('eval_sets') ||
         item.includes('eval_runs')),
 ];
+const collectMissingMfaPushRecoverySchema = (database) => [
+    ...collectMissingColumns(database, MFA_PUSH_RECOVERY_REQUIRED_SCHEMA),
+    ...collectMissingStructuralInvariants(database).filter(item => item.includes('user_mfa') ||
+        item.includes('mfa_recovery_codes') ||
+        item.includes('webauthn_credentials') ||
+        item.includes('push_subscriptions') ||
+        item.includes('recovery_drills')),
+];
+const collectMissingAutomationWorkTargetSchema = (database) => collectMissingColumns(database, AUTOMATION_WORK_TARGET_REQUIRED_SCHEMA);
+const collectMissingWorkComputerSchema = (database) => collectMissingColumns(database, WORK_COMPUTER_REQUIRED_SCHEMA);
+const collectMissingWorkTakeoverSchema = (database) => collectMissingColumns(database, WORK_TAKEOVER_REQUIRED_SCHEMA);
 const collectMissingIdentityAccountRetirementSchema = (database) => {
     const row = database
         .prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'users'")
@@ -3052,6 +3259,12 @@ function collectMissingSchemaAtVersion(database, version) {
         ...(version >= 18 ? collectMissingNotesV2Schema(database) : []),
         ...(version >= 19 ? collectMissingTeamCollaborationSchema(database) : []),
         ...(version >= 20 ? collectMissingMediaEnterpriseOpsSchema(database) : []),
+        ...(version >= 21 ? collectMissingMfaPushRecoverySchema(database) : []),
+        ...(version >= 22
+            ? collectMissingAutomationWorkTargetSchema(database)
+            : []),
+        ...(version >= 23 ? collectMissingWorkComputerSchema(database) : []),
+        ...(version >= 24 ? collectMissingWorkTakeoverSchema(database) : []),
     ];
 }
 const collectMissingLegacyBootstrapSchema = (database) => {
@@ -3107,6 +3320,10 @@ const SKILL_FILES_MIGRATION_CHECKSUM = '584e1f9bca79eb5974f997088636d74d7f2c1e5f
 const NOTES_V2_MIGRATION_CHECKSUM = '05a6758ab2b2a54f9097a5d5604a2bd57e085f1dd16816b5dc96d1eb7a41a399';
 const TEAM_COLLABORATION_MIGRATION_CHECKSUM = '1cf021c941cfd9207a82e794e58d7553ae24a35b3f8f8a84bb4a0e06d0d77443';
 const MEDIA_ENTERPRISE_OPS_MIGRATION_CHECKSUM = 'c6bc6d98518f7a279ad7109cfdfcd8a75fbf7e3e157c50bca98142b50ac0f38b';
+const MFA_PUSH_RECOVERY_MIGRATION_CHECKSUM = '9b2cdc08d2316877af091587113c749aed4b224d6ee12e72626b830da5447005';
+const WORK_COMPUTER_MIGRATION_CHECKSUM = 'b86fa1e6cb13bd76129db93043007cf7dd6888b85bd0139dfc34dbe394069867';
+const AUTOMATION_WORK_TARGET_MIGRATION_CHECKSUM = 'e5fb43e9bf42ab206dce74bfd867d5001754983c7a3cef30b811c4d4da54d1a9';
+const WORK_TAKEOVER_MIGRATION_CHECKSUM = '739dc7f86890961573baba8fdf8859bccf1e9e5ba9625288183582fc6be5c1b0';
 const MIGRATIONS = [
     {
         version: 1,
@@ -3398,6 +3615,56 @@ const MIGRATIONS = [
             }
         },
     },
+    {
+        version: 21,
+        name: 'mfa-push-recovery',
+        checksum: MFA_PUSH_RECOVERY_MIGRATION_CHECKSUM,
+        apply(database) {
+            database.exec(MFA_PUSH_RECOVERY_TABLES_SQL);
+            const missing = collectMissingMfaPushRecoverySchema(database);
+            if (missing.length > 0) {
+                throw new Error(`SQLite mfa/push/recovery schema is incomplete; missing ${missing.join(', ')}`);
+            }
+        },
+    },
+    {
+        version: 22,
+        name: 'automation-work-target',
+        checksum: AUTOMATION_WORK_TARGET_MIGRATION_CHECKSUM,
+        apply(database) {
+            addColumnIfMissing(database, 'automations', 'target', "TEXT NOT NULL DEFAULT 'chat'");
+            addColumnIfMissing(database, 'automations', 'work_policy_id', 'TEXT');
+            addColumnIfMissing(database, 'automation_runs', 'work_task_id', 'TEXT');
+            const missing = collectMissingAutomationWorkTargetSchema(database);
+            if (missing.length > 0) {
+                throw new Error(`SQLite automation work-target schema is incomplete; missing ${missing.join(', ')}`);
+            }
+        },
+    },
+    {
+        version: 23,
+        name: 'work-computer',
+        checksum: WORK_COMPUTER_MIGRATION_CHECKSUM,
+        apply(database) {
+            addColumnIfMissing(database, 'work_policies', 'gui_enabled', 'INTEGER');
+            const missing = collectMissingWorkComputerSchema(database);
+            if (missing.length > 0) {
+                throw new Error(`SQLite work computer schema is incomplete; missing ${missing.join(', ')}`);
+            }
+        },
+    },
+    {
+        version: 24,
+        name: 'work-takeover',
+        checksum: WORK_TAKEOVER_MIGRATION_CHECKSUM,
+        apply(database) {
+            addColumnIfMissing(database, 'work_policies', 'takeover_enabled', 'INTEGER');
+            const missing = collectMissingWorkTakeoverSchema(database);
+            if (missing.length > 0) {
+                throw new Error(`SQLite work takeover schema is incomplete; missing ${missing.join(', ')}`);
+            }
+        },
+    },
 ];
 /**
  * Whether a pending migration needs foreign-key enforcement suspended before