taskover-mcp 1.0.1 → 1.2.0

package/db.js

@@ -0,0 +1,2292 @@
+const path = require("path");
+const fs = require("fs");
+
+const DATA_DIR = process.env.TASKOVER_DATA_DIR || path.join(__dirname, "..", "data");
+const DB_FILE = process.env.TASKOVER_DB_FILE || path.join(DATA_DIR, "taskover.db");
+const BACKUP_DIR = path.join(DATA_DIR, "backups");
+
+function ensureDir(dir) {
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+}
+
+// ===== ENGINE DETECTION =====
+// better-sqlite3 (native C, ~100x faster) for Docker/production
+// sql.js (WebAssembly) for Electron/local dev where native compilation isn't available
+
+let _engine = "sql.js"; // default
+let Database = null;
+let initSqlJs = null;
+
+try {
+  Database = require("better-sqlite3");
+  _engine = "better-sqlite3";
+} catch (_) {
+  initSqlJs = require("sql.js");
+}
+
+function getEngine() { return _engine; }
+
+let _db = null;
+let _SQL = null; // sql.js only
+let _saveTimer = null; // sql.js only
+let _inTransaction = false; // sql.js: defer saves until transaction commits
+
+// ===== COMPATIBILITY WRAPPER (sql.js only) =====
+// Wraps sql.js to provide a better-sqlite3-like API so data-store.js works unchanged
+
+class CompatDB {
+  constructor(sqlDb) {
+    this._db = sqlDb;
+  }
+
+  prepare(sql) {
+    return new CompatStatement(this._db, sql);
+  }
+
+  exec(sql) {
+    this._db.run(sql);
+    _scheduleSave();
+  }
+
+  transaction(fn) {
+    return (...args) => {
+      this._db.run("BEGIN TRANSACTION");
+      _inTransaction = true;
+      let result;
+      try {
+        result = fn(...args);
+      } catch (fnErr) {
+        _inTransaction = false;
+        try { this._db.run("ROLLBACK"); } catch (_) {}
+        throw fnErr;
+      }
+      _inTransaction = false;
+      this._db.run("COMMIT");
+      _scheduleSave();
+      return result;
+    };
+  }
+
+  pragma(str) {
+    try {
+      this._db.run("PRAGMA " + str);
+    } catch (_) {}
+  }
+
+  backup(destPath) {
+    const data = this._db.export();
+    fs.writeFileSync(destPath, Buffer.from(data));
+  }
+
+  close() {
+    _saveToDiskSqlJs();
+    this._db.close();
+  }
+}
+
+class CompatStatement {
+  constructor(db, sql) {
+    this._db = db;
+    this._sql = sql;
+  }
+
+  run(...params) {
+    const flatParams = params.length === 1 && Array.isArray(params[0]) ? params[0] : params;
+    this._db.run(this._sql, flatParams);
+    _scheduleSave();
+    return { changes: this._db.getRowsModified() };
+  }
+
+  get(...params) {
+    const flatParams = params.length === 1 && Array.isArray(params[0]) ? params[0] : params;
+    let stmt;
+    try {
+      stmt = this._db.prepare(this._sql);
+      if (flatParams.length > 0) stmt.bind(flatParams);
+      if (stmt.step()) {
+        const row = stmt.getAsObject();
+        stmt.free();
+        return row;
+      }
+      stmt.free();
+      return undefined;
+    } catch (e) {
+      if (stmt) try { stmt.free(); } catch (_) {}
+      throw e;
+    }
+  }
+
+  all(...params) {
+    const flatParams = params.length === 1 && Array.isArray(params[0]) ? params[0] : params;
+    const results = [];
+    let stmt;
+    try {
+      stmt = this._db.prepare(this._sql);
+      if (flatParams.length > 0) stmt.bind(flatParams);
+      while (stmt.step()) {
+        results.push(stmt.getAsObject());
+      }
+      stmt.free();
+      return results;
+    } catch (e) {
+      if (stmt) try { stmt.free(); } catch (_) {}
+      throw e;
+    }
+  }
+}
+
+// ===== SAVE MANAGEMENT (sql.js only — better-sqlite3 writes directly) =====
+
+let _lastSaveTime = 0;
+
+function getLastSaveTime() { return _lastSaveTime; }
+
+function _saveToDiskSqlJs() {
+  if (!_db || _engine !== "sql.js") return;
+  ensureDir(DATA_DIR);
+  _lastSaveTime = Date.now();
+  const data = _db._db.export();
+  fs.writeFileSync(DB_FILE, Buffer.from(data));
+}
+
+function _scheduleSave() {
+  if (_engine !== "sql.js") return;
+  if (_inTransaction) return; // defer save until COMMIT
+  _saveToDiskSqlJs();
+}
+
+function saveToDisk() {
+  if (_engine === "sql.js") {
+    _saveToDiskSqlJs();
+  } else {
+    _lastSaveTime = Date.now();
+  }
+}
+
+// ===== INIT =====
+
+async function initDb() {
+  if (_db) return _db;
+  ensureDir(DATA_DIR);
+
+  if (_engine === "better-sqlite3") {
+    _db = new Database(DB_FILE);
+    const jm = _db.pragma("journal_mode = WAL");
+    _db.pragma("synchronous = NORMAL");
+    _db.pragma("foreign_keys = ON");
+    console.log(`[DB] PRAGMAs: journal_mode=${jm[0]?.journal_mode ?? jm}, synchronous=NORMAL, foreign_keys=ON`);
+  } else {
+    _SQL = await initSqlJs();
+    if (fs.existsSync(DB_FILE)) {
+      const buffer = fs.readFileSync(DB_FILE);
+      _db = new CompatDB(new _SQL.Database(buffer));
+    } else {
+      _db = new CompatDB(new _SQL.Database());
+    }
+  }
+
+  runMigrations(_db);
+  if (_engine === "sql.js") _saveToDiskSqlJs();
+  console.log(`[DB] Initialized with ${_engine} engine`);
+  return _db;
+}
+
+function getDb() {
+  if (!_db) throw new Error("Database not initialized. Call initDb() first.");
+  return _db;
+}
+
+function reloadFromDisk() {
+  if (_engine === "better-sqlite3") {
+    if (_db) { try { _db.close(); } catch (_) {} }
+    _db = new Database(DB_FILE);
+    _db.pragma("journal_mode = WAL");
+    _db.pragma("synchronous = NORMAL");
+    _db.pragma("foreign_keys = ON");
+  } else {
+    if (!_SQL) throw new Error("Database not initialized. Call initDb() first.");
+    if (fs.existsSync(DB_FILE)) {
+      const buffer = fs.readFileSync(DB_FILE);
+      if (_db) _db._db.close();
+      _db = new CompatDB(new _SQL.Database(buffer));
+    }
+  }
+}
+
+function closeDb() {
+  if (_saveTimer) { clearTimeout(_saveTimer); _saveTimer = null; }
+  if (_db) {
+    if (_engine === "sql.js") _db.close();
+    else _db.close();
+    _db = null;
+  }
+}
+
+// ===== MIGRATION SYSTEM =====
+
+const MIGRATIONS = [
+  {
+    version: 1,
+    description: "Initial schema — all 25 collections",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS projects (
+          id TEXT PRIMARY KEY,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          last_updated TEXT NOT NULL
+        );
+        CREATE TABLE IF NOT EXISTS tasks (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'todo',
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          last_updated TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_tasks_project ON tasks(project_id);
+        CREATE INDEX IF NOT EXISTS idx_tasks_status ON tasks(project_id, status);
+        CREATE TABLE IF NOT EXISTS systems (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          last_updated TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_systems_project ON systems(project_id);
+        CREATE TABLE IF NOT EXISTS sessions (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          date TEXT NOT NULL,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_sessions_project ON sessions(project_id);
+        CREATE TABLE IF NOT EXISTS changelog (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          date TEXT NOT NULL,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_changelog_project ON changelog(project_id);
+        CREATE TABLE IF NOT EXISTS bugs (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'open',
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_bugs_project ON bugs(project_id);
+        CREATE TABLE IF NOT EXISTS decisions (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          date TEXT NOT NULL,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_decisions_project ON decisions(project_id);
+        CREATE TABLE IF NOT EXISTS blueprints (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          data TEXT NOT NULL,
+          last_updated TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_blueprints_project ON blueprints(project_id);
+        CREATE TABLE IF NOT EXISTS notes (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          parent_type TEXT,
+          parent_id TEXT,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_notes_project ON notes(project_id);
+        CREATE TABLE IF NOT EXISTS backups_log (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          date TEXT NOT NULL,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_backups_project ON backups_log(project_id);
+        CREATE TABLE IF NOT EXISTS levels (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          last_updated TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_levels_project ON levels(project_id);
+        CREATE TABLE IF NOT EXISTS plugins (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          last_updated TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_plugins_project ON plugins(project_id);
+        CREATE TABLE IF NOT EXISTS build_errors (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'open',
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_build_errors_project ON build_errors(project_id);
+        CREATE TABLE IF NOT EXISTS optimize_items (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'open',
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_optimize_project ON optimize_items(project_id);
+        CREATE TABLE IF NOT EXISTS perf_budget (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_perf_project ON perf_budget(project_id);
+        CREATE TABLE IF NOT EXISTS playtests (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          date TEXT NOT NULL,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_playtests_project ON playtests(project_id);
+        CREATE TABLE IF NOT EXISTS milestones (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'upcoming',
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_milestones_project ON milestones(project_id);
+        CREATE TABLE IF NOT EXISTS iterations (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_iterations_project ON iterations(project_id);
+        CREATE TABLE IF NOT EXISTS dialogues (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_dialogues_project ON dialogues(project_id);
+        CREATE TABLE IF NOT EXISTS sounds (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_sounds_project ON sounds(project_id);
+        CREATE TABLE IF NOT EXISTS controls (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_controls_project ON controls(project_id);
+        CREATE TABLE IF NOT EXISTS assets (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'concept',
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          last_updated TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_assets_project ON assets(project_id);
+        CREATE TABLE IF NOT EXISTS refs (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_refs_project ON refs(project_id);
+        CREATE TABLE IF NOT EXISTS marketing_items (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'todo',
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_marketing_project ON marketing_items(project_id);
+        CREATE TABLE IF NOT EXISTS wiki_pages (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          last_updated TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_wiki_project ON wiki_pages(project_id);
+        CREATE TABLE IF NOT EXISTS ship_checked (
+          project_id TEXT NOT NULL,
+          step_id TEXT NOT NULL,
+          PRIMARY KEY (project_id, step_id)
+        );
+        CREATE TABLE IF NOT EXISTS open_questions (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          resolved INTEGER NOT NULL DEFAULT 0,
+          data TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_questions_project ON open_questions(project_id);
+      `);
+    },
+  },
+  {
+    version: 2,
+    description: "Add user_settings key-value table",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS user_settings (
+          key TEXT PRIMARY KEY,
+          value TEXT NOT NULL
+        );
+      `);
+    },
+  },
+  {
+    version: 3,
+    description: "Add attachments table for file attachments on tasks",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS attachments (
+          id TEXT PRIMARY KEY,
+          card_id TEXT NOT NULL,
+          project_id TEXT NOT NULL,
+          name TEXT NOT NULL,
+          type TEXT DEFAULT '',
+          size INTEGER DEFAULT 0,
+          data TEXT,
+          time TEXT NOT NULL,
+          FOREIGN KEY (card_id) REFERENCES tasks(id) ON DELETE CASCADE
+        );
+        CREATE INDEX IF NOT EXISTS idx_attachments_card ON attachments(card_id);
+      `);
+    },
+  },
+  {
+    version: 4,
+    description: "Add sprints table and sprint_id column on tasks",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS sprints (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          name TEXT NOT NULL,
+          start_date TEXT NOT NULL,
+          end_date TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'planned',
+          milestone TEXT DEFAULT NULL,
+          template TEXT DEFAULT NULL,
+          color TEXT DEFAULT '#FDBA74',
+          completed_tasks INTEGER DEFAULT 0,
+          total_tasks INTEGER DEFAULT 0,
+          completed_bugs INTEGER DEFAULT 0,
+          created_at TEXT NOT NULL,
+          FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+        );
+        CREATE INDEX IF NOT EXISTS idx_sprints_project ON sprints(project_id);
+        CREATE INDEX IF NOT EXISTS idx_sprints_status ON sprints(status);
+      `);
+      // Add sprint_id column to tasks — safe to run even if column exists
+      try {
+        db.exec(`ALTER TABLE tasks ADD COLUMN sprint_id TEXT DEFAULT NULL REFERENCES sprints(id) ON DELETE SET NULL`);
+      } catch (_) { /* column already exists */ }
+      try {
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_tasks_sprint ON tasks(sprint_id)`);
+      } catch (_) {}
+    },
+  },
+  {
+    version: 5,
+    description: "Add time estimates and time_logs table",
+    up(db) {
+      try {
+        db.exec(`ALTER TABLE tasks ADD COLUMN estimate_hours REAL DEFAULT NULL`);
+      } catch (_) { /* column already exists */ }
+      try {
+        db.exec(`ALTER TABLE tasks ADD COLUMN actual_hours REAL DEFAULT 0`);
+      } catch (_) { /* column already exists */ }
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS time_logs (
+          id TEXT PRIMARY KEY,
+          card_id TEXT NOT NULL,
+          project_id TEXT NOT NULL,
+          hours REAL NOT NULL,
+          note TEXT DEFAULT '',
+          time TEXT NOT NULL,
+          FOREIGN KEY (card_id) REFERENCES tasks(id) ON DELETE CASCADE
+        );
+        CREATE INDEX IF NOT EXISTS idx_time_logs_card ON time_logs(card_id);
+        CREATE INDEX IF NOT EXISTS idx_time_logs_project ON time_logs(project_id);
+      `);
+    },
+  },
+  {
+    version: 6,
+    description: "Add sprint time totals and bug fixed_at timestamp",
+    up(db) {
+      try { db.exec("ALTER TABLE sprints ADD COLUMN estimate_total REAL DEFAULT 0"); } catch (_) {}
+      try { db.exec("ALTER TABLE sprints ADD COLUMN actual_total REAL DEFAULT 0"); } catch (_) {}
+      try { db.exec("ALTER TABLE bugs ADD COLUMN fixed_at TEXT DEFAULT NULL"); } catch (_) {}
+    },
+  },
+  {
+    version: 7,
+    description: "Add GDD tables — sections, linked tasks, revisions",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS gdd_sections (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          section_key TEXT NOT NULL,
+          status TEXT DEFAULT 'draft',
+          content TEXT DEFAULT '',
+          updated_at TEXT NOT NULL,
+          FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE,
+          UNIQUE(project_id, section_key)
+        );
+        CREATE INDEX IF NOT EXISTS idx_gdd_project ON gdd_sections(project_id);
+
+        CREATE TABLE IF NOT EXISTS gdd_linked_tasks (
+          id TEXT PRIMARY KEY,
+          gdd_section_id TEXT NOT NULL,
+          task_id TEXT NOT NULL,
+          task_title TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          FOREIGN KEY (gdd_section_id) REFERENCES gdd_sections(id) ON DELETE CASCADE,
+          UNIQUE(gdd_section_id, task_id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_gdd_links_section ON gdd_linked_tasks(gdd_section_id);
+        CREATE INDEX IF NOT EXISTS idx_gdd_links_task ON gdd_linked_tasks(task_id);
+
+        CREATE TABLE IF NOT EXISTS gdd_revisions (
+          id TEXT PRIMARY KEY,
+          gdd_section_id TEXT NOT NULL,
+          content TEXT NOT NULL,
+          author TEXT DEFAULT '',
+          created_at TEXT NOT NULL,
+          FOREIGN KEY (gdd_section_id) REFERENCES gdd_sections(id) ON DELETE CASCADE
+        );
+        CREATE INDEX IF NOT EXISTS idx_gdd_revisions_section ON gdd_revisions(gdd_section_id);
+      `);
+    },
+  },
+  {
+    version: 8,
+    description: "Add task assignment + team_members table",
+    up(db) {
+      db.exec(`ALTER TABLE tasks ADD COLUMN assignee TEXT DEFAULT NULL`);
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS team_members (
+          id TEXT PRIMARY KEY,
+          name TEXT NOT NULL,
+          avatar TEXT NOT NULL DEFAULT '',
+          color TEXT NOT NULL DEFAULT '',
+          status TEXT DEFAULT 'offline',
+          user_id TEXT,
+          created_at TEXT NOT NULL
+        );
+      `);
+      // Team members table created — no seed data for production
+    },
+  },
+  {
+    version: 9,
+    description: "Add notifications and notification_settings tables",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS notifications (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          type TEXT NOT NULL,
+          text TEXT NOT NULL,
+          from_member TEXT DEFAULT NULL,
+          action_tab TEXT DEFAULT 'dashboard',
+          action_id TEXT DEFAULT NULL,
+          read INTEGER DEFAULT 0,
+          created_at TEXT NOT NULL,
+          FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+        );
+        CREATE INDEX IF NOT EXISTS idx_notifications_project ON notifications(project_id);
+        CREATE INDEX IF NOT EXISTS idx_notifications_read ON notifications(project_id, read);
+
+        CREATE TABLE IF NOT EXISTS notification_settings (
+          id TEXT PRIMARY KEY,
+          user_id TEXT NOT NULL,
+          category TEXT NOT NULL,
+          enabled INTEGER DEFAULT 1,
+          UNIQUE(user_id, category)
+        );
+      `);
+      // Notification settings and notifications created dynamically per user — no seed data
+    },
+  },
+  {
+    version: 10,
+    description: "Add UE5 sync tables: sync_channels, sync_log, sync_settings, ue_discovered_bps",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS sync_channels (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          channel TEXT NOT NULL,
+          enabled INTEGER DEFAULT 1,
+          auto_sync INTEGER DEFAULT 1,
+          last_sync TEXT DEFAULT NULL,
+          synced_count INTEGER DEFAULT 0,
+          status TEXT DEFAULT 'idle',
+          UNIQUE(project_id, channel),
+          FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+        );
+
+        CREATE TABLE IF NOT EXISTS sync_log (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          channel TEXT NOT NULL,
+          action TEXT NOT NULL,
+          type TEXT NOT NULL DEFAULT 'info',
+          created_at TEXT NOT NULL,
+          FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+        );
+        CREATE INDEX IF NOT EXISTS idx_sync_log_project ON sync_log(project_id);
+
+        CREATE TABLE IF NOT EXISTS sync_settings (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          auto_sync_master INTEGER DEFAULT 1,
+          sync_interval INTEGER DEFAULT 30,
+          UNIQUE(project_id),
+          FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+        );
+
+        CREATE TABLE IF NOT EXISTS ue_discovered_bps (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          name TEXT NOT NULL,
+          path TEXT NOT NULL,
+          parent_class TEXT DEFAULT 'Actor',
+          synced INTEGER DEFAULT 0,
+          is_new INTEGER DEFAULT 1,
+          discovered_at TEXT NOT NULL,
+          FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+        );
+      `);
+      // Seed per-project defaults
+      try {
+        const row = db.prepare("SELECT id FROM projects LIMIT 1").get();
+        if (row) {
+          const pid = row.id;
+          db.exec(`
+            INSERT OR IGNORE INTO sync_channels (id, project_id, channel, enabled, auto_sync, last_sync, synced_count, status) VALUES
+              ('sc_bp',  '${pid}', 'blueprints',  1, 1, NULL, 0, 'idle'),
+              ('sc_lvl', '${pid}', 'levels',      1, 1, NULL, 0, 'idle'),
+              ('sc_err', '${pid}', 'buildErrors', 1, 1, NULL, 0, 'idle'),
+              ('sc_act', '${pid}', 'actors',      0, 0, NULL, 0, 'idle');
+
+            INSERT OR IGNORE INTO sync_settings (id, project_id, auto_sync_master, sync_interval) VALUES
+              ('ss_1', '${pid}', 1, 30);
+
+            INSERT OR IGNORE INTO sync_log (id, project_id, channel, action, type, created_at) VALUES
+              ('sl1', '${pid}', 'blueprints',  'Synced 5 blueprints from UE5',                          'success', datetime('now', '-10 minutes')),
+              ('sl2', '${pid}', 'levels',      'Synced 3 levels: CursedVillage_Main, Graveyard, ChurchRuins', 'success', datetime('now', '-10 minutes')),
+              ('sl3', '${pid}', 'buildErrors', 'Captured 2 compile errors from Output Log',              'warning', datetime('now', '-12 minutes')),
+              ('sl4', '${pid}', 'system',      'Connected to Unreal Engine 5.5.1 — CursedVillage project', 'info',  datetime('now', '-14 minutes')),
+              ('sl5', '${pid}', 'blueprints',  'Detected new BP: BP_HorrorMaiden — auto-registered',     'success', datetime('now', '-27 minutes')),
+              ('sl6', '${pid}', 'buildErrors', 'Build error resolved: BP_LoopGate unresolved external',  'info',    datetime('now', '-42 minutes'));
+
+            INSERT OR IGNORE INTO ue_discovered_bps (id, project_id, name, path, parent_class, synced, is_new, discovered_at) VALUES
+              ('ubp1', '${pid}', 'BP_LoopGate',          '/Game/CursedVillage/Blueprints/BP_LoopGate',                          'Actor',        1, 0, datetime('now', '-2 hours')),
+              ('ubp2', '${pid}', 'Trigger_TakePhoto',     '/Game/HorrorEngine/Blueprints/Assets/Triggers/Trigger_TakePhoto',     'Actor',        1, 0, datetime('now', '-2 hours')),
+              ('ubp3', '${pid}', 'BP_VillageGameManager', '/Game/CursedVillage/Blueprints/BP_VillageGameManager',                'GameModeBase', 1, 0, datetime('now', '-2 hours')),
+              ('ubp4', '${pid}', 'BP_AnomalyBase',        '/Game/AnomalyFramework/Blueprints/BP_AnomalyBase',                    'Actor',        1, 0, datetime('now', '-2 hours')),
+              ('ubp5', '${pid}', 'BP_HorrorMaiden',       '/Game/CursedVillage/Blueprints/BP_HorrorMaiden',                      'Actor',        1, 0, datetime('now', '-27 minutes')),
+              ('ubp6', '${pid}', 'BP_FogManager',         '/Game/CursedVillage/Blueprints/BP_FogManager',                        'Actor',        0, 1, datetime('now', '-5 minutes')),
+              ('ubp7', '${pid}', 'BP_AmbientSoundZone',   '/Game/CursedVillage/Blueprints/BP_AmbientSoundZone',                  'Actor',        0, 1, datetime('now', '-3 minutes'));
+          `);
+        }
+      } catch (_) {}
+    },
+  },
+  {
+    version: 11,
+    description: "Add Discord pipeline tables: discord_config, discord_submissions, discord_updates",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS discord_config (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          mode TEXT DEFAULT 'hosted',
+          bot_token TEXT DEFAULT NULL,
+          server_id TEXT DEFAULT NULL,
+          server_name TEXT DEFAULT NULL,
+          server_icon TEXT DEFAULT NULL,
+          member_count INTEGER DEFAULT 0,
+          channel_bugs TEXT DEFAULT '#bug-reports',
+          channel_suggestions TEXT DEFAULT '#feature-requests',
+          channel_updates TEXT DEFAULT '#dev-updates',
+          auto_post_updates INTEGER DEFAULT 1,
+          sync_upvotes INTEGER DEFAULT 1,
+          connected INTEGER DEFAULT 0,
+          connected_at TEXT DEFAULT NULL,
+          UNIQUE(project_id),
+          FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+        );
+
+        CREATE TABLE IF NOT EXISTS discord_submissions (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          type TEXT NOT NULL,
+          title TEXT NOT NULL,
+          author TEXT NOT NULL,
+          author_avatar TEXT DEFAULT '',
+          upvotes INTEGER DEFAULT 0,
+          status TEXT DEFAULT 'open',
+          imported INTEGER DEFAULT 0,
+          discord_message_id TEXT DEFAULT NULL,
+          created_at TEXT NOT NULL,
+          FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+        );
+        CREATE INDEX IF NOT EXISTS idx_discord_subs_project ON discord_submissions(project_id);
+
+        CREATE TABLE IF NOT EXISTS discord_updates (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          type TEXT NOT NULL,
+          title TEXT NOT NULL,
+          channel TEXT NOT NULL,
+          posted_at TEXT NOT NULL,
+          FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+        );
+      `);
+      // Seed sample data
+      try {
+        const row = db.prepare("SELECT id FROM projects LIMIT 1").get();
+        if (row) {
+          const pid = row.id;
+          db.exec(`
+            INSERT OR IGNORE INTO discord_submissions (id, project_id, type, title, author, author_avatar, upvotes, status, imported, created_at) VALUES
+              ('ds1', '${pid}', 'bug',        'Graveyard fog clips through walls near gate B',           'ghosthunter42',   'G', 14, 'open',      0, datetime('now', '-6 hours')),
+              ('ds2', '${pid}', 'suggestion',  'Add a flashlight mechanic for darker areas',              'HorrorFanatic',   'H', 31, 'open',      0, datetime('now', '-1 day')),
+              ('ds3', '${pid}', 'bug',         'Bell tower audio cuts out after round 5',                 'SoundDesignNerd', 'S',  8, 'imported',  1, datetime('now', '-1 day', '-6 hours')),
+              ('ds4', '${pid}', 'suggestion',  'Let players review photos they''ve taken in a gallery',   'PixelSnapper',    'P', 52, 'open',      0, datetime('now', '-2 days')),
+              ('ds5', '${pid}', 'bug',         'Anomaly doesn''t despawn when photographed from far away','SpeedrunnerMax',  'S', 22, 'imported',  1, datetime('now', '-2 days', '-6 hours')),
+              ('ds6', '${pid}', 'suggestion',  'Ambient music between rounds would be great',             'ghosthunter42',   'G',  7, 'dismissed', 0, datetime('now', '-3 days')),
+              ('ds7', '${pid}', 'bug',         'Player can clip through church ruins wall',               'GlitchFinder99',  'G', 19, 'open',      0, datetime('now', '-10 hours'));
+
+            INSERT OR IGNORE INTO discord_updates (id, project_id, type, title, channel, posted_at) VALUES
+              ('du1', '${pid}', 'bugfix',  'Fixed: Camera zoom stuck after taking photo',  '#dev-updates', datetime('now', '-8 hours')),
+              ('du2', '${pid}', 'feature', 'New: Round indicator bell chimes added',        '#dev-updates', datetime('now', '-1 day', '-8 hours')),
+              ('du3', '${pid}', 'bugfix',  'Fixed: Gate teleport infinite loop crash',      '#dev-updates', datetime('now', '-2 days'));
+          `);
+        }
+      } catch (_) {}
+    },
+  },
+  {
+    version: 12,
+    description: "Add builds table for build pipeline dashboard",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS builds (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          version TEXT NOT NULL,
+          platform TEXT DEFAULT 'Win64',
+          config TEXT DEFAULT 'Development',
+          status TEXT DEFAULT 'success',
+          size TEXT DEFAULT '—',
+          duration TEXT DEFAULT '—',
+          date TEXT NOT NULL,
+          playtest_id TEXT DEFAULT NULL,
+          errors INTEGER DEFAULT 0,
+          notes TEXT DEFAULT '',
+          FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+        );
+        CREATE INDEX IF NOT EXISTS idx_builds_project ON builds(project_id);
+      `);
+      // Seed 8 sample builds
+      try {
+        const row = db.prepare("SELECT id FROM projects LIMIT 1").get();
+        if (row) {
+          const pid = row.id;
+          db.exec(`
+            INSERT OR IGNORE INTO builds (id, project_id, version, platform, config, status, size, duration, date, playtest_id, errors, notes) VALUES
+              ('b1', '${pid}', '0.4.2', 'Win64', 'Development', 'success', '2.8 GB', '8m 42s',  datetime('now', '-4 hours'),  NULL,  0, 'Added photo mechanic + gate loop system'),
+              ('b2', '${pid}', '0.4.1', 'Win64', 'Development', 'success', '2.7 GB', '8m 15s',  datetime('now', '-2 days'),   'pt3', 0, 'Bell tower audio + anomaly framework integration'),
+              ('b3', '${pid}', '0.4.0', 'Win64', 'Shipping',    'success', '2.4 GB', '12m 03s', datetime('now', '-4 days'),   'pt2', 0, 'First shipping build — demo candidate'),
+              ('b4', '${pid}', '0.3.9', 'Win64', 'Development', 'failed',  '—',      '3m 11s',  datetime('now', '-5 days'),   NULL,  4, 'Compile error in BP_LoopGate — unresolved reference'),
+              ('b5', '${pid}', '0.3.8', 'Win64', 'Development', 'success', '2.3 GB', '7m 58s',  datetime('now', '-7 days'),   'pt1', 0, 'Initial gate system + fog volumes'),
+              ('b6', '${pid}', '0.3.7', 'Win64', 'Development', 'success', '2.2 GB', '7m 40s',  datetime('now', '-9 days'),   NULL,  0, 'World-space interact icons + M_InteractIcon material'),
+              ('b7', '${pid}', '0.3.6', 'Win64', 'Development', 'failed',  '—',      '1m 52s',  datetime('now', '-11 days'),  NULL,  2, 'Missing plugin dependency — Horror Engine SE'),
+              ('b8', '${pid}', '0.3.5', 'Win64', 'Development', 'success', '2.1 GB', '7m 22s',  datetime('now', '-13 days'),  NULL,  0, 'Base motel level + player controller');
+          `);
+        }
+      } catch (_) {}
+    },
+  },
+  {
+    version: 13,
+    description: "Add devlogs table for devlog generator",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS devlogs (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          title TEXT DEFAULT '',
+          template TEXT DEFAULT 'patch',
+          format TEXT DEFAULT 'markdown',
+          source_entry_ids TEXT DEFAULT '[]',
+          output TEXT DEFAULT '',
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+        );
+        CREATE INDEX IF NOT EXISTS idx_devlogs_project ON devlogs(project_id);
+      `);
+    },
+  },
+  {
+    version: 14,
+    description: "Add scope_snapshots and scope_alerts tables for scope creep detector",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS scope_snapshots (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          week_label TEXT NOT NULL,
+          week_start TEXT NOT NULL,
+          tasks_added INTEGER DEFAULT 0,
+          tasks_completed INTEGER DEFAULT 0,
+          backlog_total INTEGER DEFAULT 0,
+          scope_health INTEGER DEFAULT 100,
+          snapshot_at TEXT NOT NULL DEFAULT (datetime('now')),
+          FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+        );
+        CREATE INDEX IF NOT EXISTS idx_scope_snapshots_project ON scope_snapshots(project_id);
+
+        CREATE TABLE IF NOT EXISTS scope_alerts (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          severity TEXT DEFAULT 'info',
+          text TEXT NOT NULL,
+          metric TEXT DEFAULT '',
+          dismissed INTEGER DEFAULT 0,
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+        );
+        CREATE INDEX IF NOT EXISTS idx_scope_alerts_project ON scope_alerts(project_id);
+      `);
+      // Seed data
+      try {
+        const row = db.prepare("SELECT id FROM projects LIMIT 1").get();
+        if (row) {
+          const pid = row.id;
+          db.exec(`
+            INSERT OR IGNORE INTO scope_snapshots (id, project_id, week_label, week_start, tasks_added, tasks_completed, backlog_total, scope_health, snapshot_at) VALUES
+              ('ss1', '${pid}', 'Jan 20', '2026-01-20', 5, 4, 12, 88, '2026-01-26T23:59:00Z'),
+              ('ss2', '${pid}', 'Jan 27', '2026-01-27', 4, 5, 11, 92, '2026-02-02T23:59:00Z'),
+              ('ss3', '${pid}', 'Feb 3',  '2026-02-03', 6, 4, 13, 82, '2026-02-09T23:59:00Z'),
+              ('ss4', '${pid}', 'Feb 10', '2026-02-10', 7, 3, 17, 68, '2026-02-16T23:59:00Z'),
+              ('ss5', '${pid}', 'Feb 17', '2026-02-17', 8, 3, 22, 72, '2026-02-18T23:59:00Z');
+
+            INSERT OR IGNORE INTO scope_alerts (id, project_id, severity, text, metric, created_at) VALUES
+              ('sa1', '${pid}', 'warning', 'Backlog grew by 8 tasks this week but only 3 were completed',             '+5 net new',   datetime('now', '-4 hours')),
+              ('sa2', '${pid}', 'danger',  'Milestone ''Demo Build'' is 4 days away with 6 unfinished tasks',         '6 remaining',  datetime('now', '-8 hours')),
+              ('sa3', '${pid}', 'info',    'Feature velocity is steady at ~2.5 tasks/week over the last month',       'On track',     datetime('now', '-1 day')),
+              ('sa4', '${pid}', 'warning', '3 new high-priority tasks added after sprint was planned',                 'Scope shift',  datetime('now', '-2 days'));
+          `);
+        }
+      } catch (_) {}
+    },
+  },
+  // ── Migration 15: App Settings (single-row store) ──
+  {
+    version: 15,
+    description: "App settings table",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS app_settings (
+          id INTEGER PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+          minimize_to_tray INTEGER DEFAULT 1,
+          close_to_tray INTEGER DEFAULT 0,
+          launch_on_startup INTEGER DEFAULT 0,
+          start_minimized INTEGER DEFAULT 0,
+          global_hotkey TEXT DEFAULT 'Ctrl+Shift+T',
+          native_notifications INTEGER DEFAULT 1,
+          notif_sound INTEGER DEFAULT 1,
+          notif_bug_reports INTEGER DEFAULT 1,
+          notif_build_complete INTEGER DEFAULT 1,
+          notif_deadlines INTEGER DEFAULT 1,
+          notif_discord INTEGER DEFAULT 1,
+          deep_links INTEGER DEFAULT 1,
+          auto_update INTEGER DEFAULT 1,
+          update_channel TEXT DEFAULT 'stable',
+          compact_mode INTEGER DEFAULT 0,
+          animations_enabled INTEGER DEFAULT 1
+        );
+        INSERT OR IGNORE INTO app_settings (id) VALUES (1);
+      `);
+    },
+  },
+  // ── Migration 16: Activity log for analytics ──
+  {
+    version: 16,
+    description: "Activity log table for analytics",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS activity_log (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          project_id TEXT NOT NULL,
+          action_type TEXT NOT NULL,
+          created_at TEXT DEFAULT (datetime('now')),
+          metadata TEXT
+        );
+        CREATE INDEX IF NOT EXISTS idx_activity_date ON activity_log(created_at);
+        CREATE INDEX IF NOT EXISTS idx_activity_project ON activity_log(project_id);
+      `);
+
+      // Seed some sample activity data if a project exists
+      try {
+        const proj = db.prepare("SELECT id FROM projects LIMIT 1").get();
+        if (proj) {
+          const pid = proj.id;
+          const types = ['task_done','task_done','task_done','bug_fixed','task_added','task_added','session','changelog','build','task_done','bug_fixed','task_added','task_done','task_done','bug_added','task_done','session','task_added','task_done','bug_fixed','changelog','task_done','task_added','task_done','task_done','bug_fixed','session','build','task_done','task_added','task_done','bug_added','task_done','changelog','task_done','bug_fixed','task_done','session','task_added','task_done'];
+          const stmt = db.prepare("INSERT INTO activity_log (project_id, action_type, created_at) VALUES (?, ?, datetime('now', ? || ' days'))");
+          types.forEach((t, i) => {
+            const daysAgo = '-' + Math.floor(i * 2.1);
+            stmt.run(pid, t, daysAgo);
+          });
+        }
+      } catch (_) {}
+    },
+  },
+  // ── Migration 17: Add sync_sound column to app_settings ──
+  {
+    version: 17,
+    description: "Add sync connection sound setting",
+    up(db) {
+      db.exec(`ALTER TABLE app_settings ADD COLUMN sync_sound INTEGER DEFAULT 1`);
+    },
+  },
+  // ── Migration 18: Create stories table (narrative bible) ──
+  {
+    version: 18,
+    description: "Create stories table for narrative bible",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS stories (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          data TEXT,
+          created_at TEXT NOT NULL,
+          last_updated TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_stories_project ON stories(project_id);
+      `);
+    },
+  },
+  // ── Migration 19: Create scenes table ──
+  {
+    version: 19,
+    description: "Create scenes table for story scenes",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS scenes (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          data TEXT,
+          created_at TEXT NOT NULL,
+          last_updated TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_scenes_project ON scenes(project_id);
+      `);
+    },
+  },
+  // ── Migration 20: Create cloud_sync table for future cloud sync ──
+  {
+    version: 20,
+    description: "Create cloud_sync config table",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS cloud_sync (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          enabled INTEGER DEFAULT 0,
+          mode TEXT DEFAULT 'local',
+          sync_tabs TEXT DEFAULT '{}',
+          encryption_key_hash TEXT,
+          last_synced_at TEXT,
+          data TEXT,
+          created_at TEXT NOT NULL,
+          last_updated TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_cloud_sync_project ON cloud_sync(project_id);
+      `);
+    },
+  },
+  // ── Migration 21: Add accent_color to app_settings ──
+  {
+    version: 21,
+    description: "Add accent_color column to app_settings",
+    up(db) {
+      db.exec(`ALTER TABLE app_settings ADD COLUMN accent_color TEXT DEFAULT '#7F24DD'`);
+    },
+  },
+  // ── Migration 22: Add users table for authentication ──
+  {
+    version: 22,
+    description: "Add users table for authentication",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS users (
+          id TEXT PRIMARY KEY,
+          username TEXT NOT NULL UNIQUE COLLATE NOCASE,
+          password_hash TEXT NOT NULL,
+          salt TEXT NOT NULL,
+          onboarding_complete INTEGER DEFAULT 0,
+          onboarding_data TEXT DEFAULT '{}',
+          created_at TEXT NOT NULL
+        );
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_users_username ON users(username COLLATE NOCASE);
+      `);
+      // Migration 22 created the users table — no seed data needed for production
+    },
+  },
+  // ── Migration 23: Per-user data isolation ──
+  {
+    version: 23,
+    description: "Add user_id to projects, user_settings, and team_members for per-user data isolation",
+    up(db) {
+      // 1. Add user_id to projects table
+      db.exec(`
+        ALTER TABLE projects ADD COLUMN user_id TEXT DEFAULT 'klaw';
+        CREATE INDEX idx_projects_user ON projects(user_id);
+      `);
+
+      // 2. Recreate user_settings with composite key (user_id, key)
+      db.exec(`
+        CREATE TABLE user_settings_new (
+          user_id TEXT NOT NULL DEFAULT 'klaw',
+          key TEXT NOT NULL,
+          value TEXT NOT NULL,
+          PRIMARY KEY (user_id, key)
+        );
+        INSERT INTO user_settings_new (user_id, key, value)
+          SELECT 'klaw', key, value FROM user_settings;
+        DROP TABLE user_settings;
+        ALTER TABLE user_settings_new RENAME TO user_settings;
+      `);
+
+      // 3. Add owner_user_id to team_members
+      db.exec(`
+        ALTER TABLE team_members ADD COLUMN owner_user_id TEXT DEFAULT 'klaw';
+      `);
+    },
+  },
+  // ── Migration 24: Track username change cooldown ──
+  {
+    version: 24,
+    description: "Add username_changed_at to users table for 24h cooldown",
+    up(db) {
+      db.exec(`ALTER TABLE users ADD COLUMN username_changed_at TEXT DEFAULT NULL`);
+    },
+  },
+  // ── Migration 25: Move machine-level settings to __global__ scope ──
+  {
+    version: 25,
+    description: "Move authUserId and hasBooted from klaw to __global__ user scope",
+    up(db) {
+      const globalKeys = ['authUserId', 'hasBooted'];
+      for (const key of globalKeys) {
+        const row = db.prepare("SELECT value FROM user_settings WHERE key = ? AND user_id = 'klaw'").get(key);
+        if (row) {
+          db.prepare("INSERT OR REPLACE INTO user_settings (user_id, key, value) VALUES ('__global__', ?, ?)").run(key, row.value);
+          db.prepare("DELETE FROM user_settings WHERE user_id = 'klaw' AND key = ?").run(key);
+        }
+      }
+    },
+  },
+  // ── Migration 26: Messaging system — friends, conversations, messages ──
+  {
+    version: 26,
+    description: "Add friends, conversations, conversation_members, and messages tables",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS friends (
+          id TEXT PRIMARY KEY,
+          user_id TEXT NOT NULL,
+          friend_id TEXT NOT NULL,
+          status TEXT DEFAULT 'pending',
+          created_at TEXT NOT NULL,
+          accepted_at TEXT DEFAULT NULL,
+          UNIQUE(user_id, friend_id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_friends_user ON friends(user_id);
+        CREATE INDEX IF NOT EXISTS idx_friends_friend ON friends(friend_id);
+
+        CREATE TABLE IF NOT EXISTS conversations (
+          id TEXT PRIMARY KEY,
+          name TEXT DEFAULT NULL,
+          type TEXT DEFAULT 'dm',
+          avatar TEXT DEFAULT NULL,
+          avatar_color TEXT DEFAULT NULL,
+          owner_user_id TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          last_message_at TEXT DEFAULT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_conversations_owner ON conversations(owner_user_id);
+
+        CREATE TABLE IF NOT EXISTS conversation_members (
+          id TEXT PRIMARY KEY,
+          conversation_id TEXT NOT NULL,
+          user_id TEXT NOT NULL,
+          display_name TEXT NOT NULL,
+          avatar TEXT DEFAULT '',
+          color TEXT DEFAULT '',
+          role TEXT DEFAULT 'member',
+          joined_at TEXT NOT NULL,
+          UNIQUE(conversation_id, user_id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_conv_members_conv ON conversation_members(conversation_id);
+        CREATE INDEX IF NOT EXISTS idx_conv_members_user ON conversation_members(user_id);
+
+        CREATE TABLE IF NOT EXISTS messages (
+          id TEXT PRIMARY KEY,
+          conversation_id TEXT NOT NULL,
+          sender_id TEXT NOT NULL,
+          sender_name TEXT NOT NULL,
+          text TEXT NOT NULL,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_messages_conv ON messages(conversation_id);
+        CREATE INDEX IF NOT EXISTS idx_messages_time ON messages(conversation_id, created_at);
+      `);
+
+      // Friends, conversations, and messages created dynamically — no seed data
+    },
+  },
+  {
+    version: 27,
+    description: "API keys table for Bridge authentication",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS api_keys (
+          id TEXT PRIMARY KEY,
+          user_id TEXT NOT NULL,
+          key TEXT NOT NULL UNIQUE,
+          name TEXT NOT NULL DEFAULT 'Default',
+          created_at TEXT NOT NULL,
+          last_used_at TEXT DEFAULT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_api_keys_user ON api_keys(user_id);
+        CREATE INDEX IF NOT EXISTS idx_api_keys_key ON api_keys(key);
+      `);
+    },
+  },
+  {
+    version: 28,
+    description: "MFA support: TOTP secret, enabled flag, backup codes table",
+    up(db) {
+      db.exec(`ALTER TABLE users ADD COLUMN mfa_enabled INTEGER DEFAULT 0`);
+      db.exec(`ALTER TABLE users ADD COLUMN mfa_secret TEXT DEFAULT NULL`);
+      db.exec(`ALTER TABLE users ADD COLUMN mfa_verified_at TEXT DEFAULT NULL`);
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS mfa_backup_codes (
+          id TEXT PRIMARY KEY,
+          user_id TEXT NOT NULL,
+          code_hash TEXT NOT NULL,
+          used INTEGER DEFAULT 0,
+          used_at TEXT DEFAULT NULL,
+          created_at TEXT NOT NULL,
+          FOREIGN KEY (user_id) REFERENCES users(id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_mfa_backup_user ON mfa_backup_codes(user_id);
+      `);
+    },
+  },
+  {
+    version: 29,
+    description: "Security events table + auto-lock settings",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS security_events (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL,
+          event_type TEXT NOT NULL,
+          description TEXT NOT NULL,
+          metadata TEXT DEFAULT '{}',
+          created_at TEXT NOT NULL,
+          FOREIGN KEY (user_id) REFERENCES users(id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_security_events_user ON security_events(user_id);
+        CREATE INDEX IF NOT EXISTS idx_security_events_type ON security_events(event_type);
+        CREATE INDEX IF NOT EXISTS idx_security_events_created ON security_events(created_at);
+      `);
+      db.exec(`ALTER TABLE app_settings ADD COLUMN auto_lock_enabled INTEGER DEFAULT 0`);
+      db.exec(`ALTER TABLE app_settings ADD COLUMN auto_lock_minutes INTEGER DEFAULT 5`);
+    },
+  },
+  {
+    version: 30,
+    description: "Stripe billing tables — stripe_customers and stripe_subscriptions",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS stripe_customers (
+          id TEXT PRIMARY KEY,
+          user_id TEXT NOT NULL UNIQUE,
+          stripe_customer_id TEXT NOT NULL UNIQUE,
+          plan TEXT DEFAULT 'free',
+          created_at TEXT NOT NULL,
+          FOREIGN KEY (user_id) REFERENCES users(id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_stripe_customers_user ON stripe_customers(user_id);
+        CREATE INDEX IF NOT EXISTS idx_stripe_customers_stripe ON stripe_customers(stripe_customer_id);
+
+        CREATE TABLE IF NOT EXISTS stripe_subscriptions (
+          id TEXT PRIMARY KEY,
+          stripe_customer_id TEXT NOT NULL,
+          stripe_subscription_id TEXT NOT NULL UNIQUE,
+          status TEXT NOT NULL DEFAULT 'active',
+          plan TEXT NOT NULL,
+          current_period_end TEXT,
+          created_at TEXT NOT NULL,
+          updated_at TEXT NOT NULL,
+          FOREIGN KEY (stripe_customer_id) REFERENCES stripe_customers(stripe_customer_id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_stripe_subs_customer ON stripe_subscriptions(stripe_customer_id);
+      `);
+    },
+  },
+  {
+    version: 31,
+    description: "Add r2_key column to attachments for cloud file storage",
+    up(db) {
+      db.exec(`ALTER TABLE attachments ADD COLUMN r2_key TEXT DEFAULT NULL`);
+    },
+  },
+  {
+    version: 32,
+    description: "Project collaborators table for shared project access",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS project_collaborators (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          user_id TEXT NOT NULL,
+          role TEXT NOT NULL DEFAULT 'editor',
+          invited_by TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          UNIQUE(project_id, user_id),
+          FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+        );
+        CREATE INDEX IF NOT EXISTS idx_proj_collab_project ON project_collaborators(project_id);
+        CREATE INDEX IF NOT EXISTS idx_proj_collab_user ON project_collaborators(user_id);
+      `);
+    },
+  },
+  {
+    version: 33,
+    description: "Conversation read state for unread message tracking",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS conversation_read_state (
+          user_id TEXT NOT NULL,
+          conversation_id TEXT NOT NULL,
+          last_read_at TEXT NOT NULL,
+          PRIMARY KEY (user_id, conversation_id)
+        );
+      `);
+    },
+  },
+  {
+    version: 34,
+    description: "S6A: Encryption-at-rest schema — DEKs, hash_algorithm, API key HMAC, encryption metadata",
+    up(db) {
+      db.exec(`ALTER TABLE users ADD COLUMN encrypted_dek TEXT DEFAULT NULL`);
+      db.exec(`ALTER TABLE users ADD COLUMN hash_algorithm TEXT DEFAULT 'scrypt'`);
+      db.exec(`ALTER TABLE api_keys ADD COLUMN key_hmac TEXT DEFAULT NULL`);
+      db.exec(`CREATE INDEX IF NOT EXISTS idx_api_keys_hmac ON api_keys(key_hmac)`);
+      db.exec(`ALTER TABLE mfa_backup_codes ADD COLUMN salt TEXT DEFAULT NULL`);
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS _encryption_meta (
+          key TEXT PRIMARY KEY,
+          value TEXT NOT NULL
+        );
+      `);
+      // Default migration state
+      try {
+        db.exec(`INSERT INTO _encryption_meta (key, value) VALUES ('migration_status', 'pending')`);
+      } catch (_) {} // Ignore if already exists
+    },
+  },
+  // ── Migration 35: Token revocation support ──
+  {
+    version: 35,
+    description: "Add tokens_revoked_before column for session invalidation on password change",
+    up(db) {
+      db.exec(`ALTER TABLE users ADD COLUMN tokens_revoked_before TEXT DEFAULT NULL`);
+    },
+  },
+  // ── Migration 36: Stripe webhook idempotency ──
+  {
+    version: 36,
+    description: "Track processed Stripe webhook events to prevent duplicate processing",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS stripe_webhook_events (
+          event_id TEXT PRIMARY KEY,
+          event_type TEXT NOT NULL,
+          processed_at TEXT NOT NULL
+        );
+      `);
+    },
+  },
+  // ── Migration 37: Refresh token rotation ──
+  {
+    version: 37,
+    description: "Refresh token families for rotation and reuse detection",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS refresh_tokens (
+          id TEXT PRIMARY KEY,
+          user_id TEXT NOT NULL,
+          token_hash TEXT NOT NULL UNIQUE,
+          family TEXT NOT NULL,
+          used INTEGER DEFAULT 0,
+          expires_at TEXT NOT NULL,
+          created_at TEXT NOT NULL,
+          FOREIGN KEY (user_id) REFERENCES users(id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_refresh_tokens_user ON refresh_tokens(user_id);
+        CREATE INDEX IF NOT EXISTS idx_refresh_tokens_family ON refresh_tokens(family);
+        CREATE INDEX IF NOT EXISTS idx_refresh_tokens_hash ON refresh_tokens(token_hash);
+      `);
+    },
+  },
+  // ── Migration 38: Performance indexes for high-volume tables ──
+  {
+    version: 38,
+    description: "Add missing indexes for high-volume query patterns",
+    up(db) {
+      db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_tasks_assignee ON tasks(assignee);
+        CREATE INDEX IF NOT EXISTS idx_tasks_project_assignee ON tasks(project_id, assignee);
+        CREATE INDEX IF NOT EXISTS idx_tasks_sprint_status ON tasks(sprint_id, status);
+        CREATE INDEX IF NOT EXISTS idx_messages_sender ON messages(sender_id);
+        CREATE INDEX IF NOT EXISTS idx_time_logs_project_card ON time_logs(project_id, card_id);
+        CREATE INDEX IF NOT EXISTS idx_attachments_project ON attachments(project_id);
+        CREATE INDEX IF NOT EXISTS idx_activity_action_type ON activity_log(action_type);
+        CREATE INDEX IF NOT EXISTS idx_refresh_tokens_user_used ON refresh_tokens(user_id, used);
+        CREATE INDEX IF NOT EXISTS idx_security_events_user_type ON security_events(user_id, event_type);
+      `);
+    },
+  },
+  // ── Migration 39: Compound indexes for ORDER BY / WHERE filter combos ──
+  {
+    version: 39,
+    description: "Add compound indexes for sorted and filtered queries",
+    up(db) {
+      db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_bugs_project_status ON bugs(project_id, status);
+        CREATE INDEX IF NOT EXISTS idx_notes_project_parent ON notes(project_id, parent_type, parent_id);
+        CREATE INDEX IF NOT EXISTS idx_sessions_project_date ON sessions(project_id, date DESC);
+        CREATE INDEX IF NOT EXISTS idx_changelog_project_date ON changelog(project_id, date DESC);
+        CREATE INDEX IF NOT EXISTS idx_decisions_project_date ON decisions(project_id, date DESC);
+        CREATE INDEX IF NOT EXISTS idx_activity_project_created ON activity_log(project_id, created_at);
+        CREATE INDEX IF NOT EXISTS idx_notifications_project_created ON notifications(project_id, created_at DESC);
+      `);
+    },
+  },
+  {
+    version: 40,
+    description: "Add deleted_usernames table to prevent re-registration of deleted accounts",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS deleted_usernames (
+          username TEXT NOT NULL COLLATE NOCASE,
+          deleted_at TEXT NOT NULL,
+          reason TEXT DEFAULT 'account_deleted'
+        );
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_deleted_usernames ON deleted_usernames(username COLLATE NOCASE);
+      `);
+    },
+  },
+  // ── Migration 41: Add email column + deleted_emails table ──
+  {
+    version: 41,
+    description: "Add email column to users and deleted_emails table for email-based auth",
+    up(db) {
+      // Add nullable email column
+      db.exec(`ALTER TABLE users ADD COLUMN email TEXT DEFAULT NULL`);
+      // Unique index on email (case-insensitive)
+      db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_users_email ON users(email COLLATE NOCASE)`);
+      // Table to reserve deleted account emails
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS deleted_emails (
+          email TEXT NOT NULL COLLATE NOCASE,
+          deleted_at TEXT NOT NULL,
+          reason TEXT DEFAULT 'account_deleted'
+        );
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_deleted_emails ON deleted_emails(email COLLATE NOCASE);
+      `);
+      // Migration 32 added email column — no seed data needed
+    },
+  },
+  // ── Migration 42: Make username nullable for email-first registration ──
+  {
+    version: 42,
+    description: "Rebuild users table to make username nullable (email-first auth)",
+    up(db) {
+      db.exec(`
+        CREATE TABLE users_new (
+          id TEXT PRIMARY KEY,
+          username TEXT DEFAULT NULL COLLATE NOCASE,
+          email TEXT DEFAULT NULL COLLATE NOCASE,
+          password_hash TEXT NOT NULL,
+          salt TEXT NOT NULL,
+          onboarding_complete INTEGER DEFAULT 0,
+          onboarding_data TEXT DEFAULT '{}',
+          created_at TEXT NOT NULL,
+          username_changed_at TEXT DEFAULT NULL,
+          mfa_enabled INTEGER DEFAULT 0,
+          mfa_secret TEXT DEFAULT NULL,
+          mfa_verified_at TEXT DEFAULT NULL,
+          encrypted_dek TEXT DEFAULT NULL,
+          hash_algorithm TEXT DEFAULT 'scrypt',
+          tokens_revoked_before TEXT DEFAULT NULL
+        );
+        INSERT INTO users_new SELECT
+          id, username, email, password_hash, salt,
+          onboarding_complete, onboarding_data, created_at,
+          username_changed_at, mfa_enabled, mfa_secret, mfa_verified_at,
+          encrypted_dek, hash_algorithm, tokens_revoked_before
+        FROM users;
+        DROP TABLE users;
+        ALTER TABLE users_new RENAME TO users;
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_users_username ON users(username COLLATE NOCASE);
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_users_email ON users(email COLLATE NOCASE);
+      `);
+    },
+  },
+  // ── Migration 43: CHECK constraint — at least one identity must be non-NULL ──
+  {
+    version: 43,
+    description: "Add CHECK constraint ensuring username or email is non-NULL",
+    up(db) {
+      db.exec(`
+        CREATE TABLE users_new (
+          id TEXT PRIMARY KEY,
+          username TEXT DEFAULT NULL COLLATE NOCASE,
+          email TEXT DEFAULT NULL COLLATE NOCASE,
+          password_hash TEXT NOT NULL,
+          salt TEXT NOT NULL,
+          onboarding_complete INTEGER DEFAULT 0,
+          onboarding_data TEXT DEFAULT '{}',
+          created_at TEXT NOT NULL,
+          username_changed_at TEXT DEFAULT NULL,
+          mfa_enabled INTEGER DEFAULT 0,
+          mfa_secret TEXT DEFAULT NULL,
+          mfa_verified_at TEXT DEFAULT NULL,
+          encrypted_dek TEXT DEFAULT NULL,
+          hash_algorithm TEXT DEFAULT 'scrypt',
+          tokens_revoked_before TEXT DEFAULT NULL,
+          CHECK (username IS NOT NULL OR email IS NOT NULL)
+        );
+        INSERT INTO users_new SELECT
+          id, username, email, password_hash, salt,
+          onboarding_complete, onboarding_data, created_at,
+          username_changed_at, mfa_enabled, mfa_secret, mfa_verified_at,
+          encrypted_dek, hash_algorithm, tokens_revoked_before
+        FROM users;
+        DROP TABLE users;
+        ALTER TABLE users_new RENAME TO users;
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_users_username ON users(username COLLATE NOCASE);
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_users_email ON users(email COLLATE NOCASE);
+      `);
+    },
+  },
+  // ── Migration 44: Email verification + email_tokens table ──
+  {
+    version: 44,
+    description: "Add email_verified columns and email_tokens table",
+    up(db) {
+      db.exec(`ALTER TABLE users ADD COLUMN email_verified INTEGER DEFAULT 0`);
+      db.exec(`ALTER TABLE users ADD COLUMN email_verified_at TEXT DEFAULT NULL`);
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS email_tokens (
+          id TEXT PRIMARY KEY,
+          user_id TEXT NOT NULL,
+          token_hash TEXT NOT NULL UNIQUE,
+          type TEXT NOT NULL,
+          expires_at TEXT NOT NULL,
+          used INTEGER DEFAULT 0,
+          created_at TEXT NOT NULL,
+          FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+        );
+        CREATE INDEX IF NOT EXISTS idx_email_tokens_user ON email_tokens(user_id);
+        CREATE INDEX IF NOT EXISTS idx_email_tokens_hash ON email_tokens(token_hash);
+        CREATE INDEX IF NOT EXISTS idx_email_tokens_type ON email_tokens(user_id, type);
+      `);
+    },
+  },
+
+  // ── Migration 45: Phase 2 — FTS4 search index + activity_log event store columns ──
+  {
+    version: 45,
+    description: "FTS4 search index + activity_log user/target columns for Phase 2",
+    up(db) {
+      // 1. Create FTS4 virtual table for full-text search
+      // FTS4 used instead of FTS5 for sql.js (WASM) compatibility — same MATCH semantics
+      db.exec(`
+        CREATE VIRTUAL TABLE IF NOT EXISTS search_index USING fts4(
+          title, body,
+          project_id, record_type, record_id,
+          notindexed=project_id, notindexed=record_type, notindexed=record_id,
+          tokenize=unicode61 "remove_diacritics=2"
+        );
+      `);
+
+      // 2. Add event store columns to activity_log (guard against already-existing)
+      const cols = db.prepare("SELECT name FROM pragma_table_info('activity_log')").all().map(r => r.name);
+      if (!cols.includes('user_id'))     db.exec("ALTER TABLE activity_log ADD COLUMN user_id TEXT;");
+      if (!cols.includes('target_type')) db.exec("ALTER TABLE activity_log ADD COLUMN target_type TEXT;");
+      if (!cols.includes('target_id'))   db.exec("ALTER TABLE activity_log ADD COLUMN target_id TEXT;");
+      if (!cols.includes('detail'))      db.exec("ALTER TABLE activity_log ADD COLUMN detail TEXT;");
+
+      db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_activity_user ON activity_log(user_id);
+        CREATE INDEX IF NOT EXISTS idx_activity_target ON activity_log(target_type, target_id);
+      `);
+
+      // 3. Backfill FTS index from existing data (6 collections)
+      const insert = db.prepare(
+        "INSERT INTO search_index(title, body, project_id, record_type, record_id) VALUES (?, ?, ?, ?, ?)"
+      );
+      const tx = db.transaction(() => {
+        for (const r of db.prepare("SELECT id, project_id, data FROM tasks").all()) {
+          try { const d = JSON.parse(r.data || '{}'); insert.run(d.title || '', d.description || '', r.project_id, 'task', r.id); } catch(_){}
+        }
+        for (const r of db.prepare("SELECT id, project_id, data FROM bugs").all()) {
+          try { const d = JSON.parse(r.data || '{}'); insert.run(d.title || '', d.description || '', r.project_id, 'bug', r.id); } catch(_){}
+        }
+        for (const r of db.prepare("SELECT id, project_id, data FROM notes").all()) {
+          try { const d = JSON.parse(r.data || '{}'); insert.run(d.title || '', d.content || '', r.project_id, 'note', r.id); } catch(_){}
+        }
+        for (const r of db.prepare("SELECT id, project_id, data FROM systems").all()) {
+          try { const d = JSON.parse(r.data || '{}'); insert.run(d.name || '', [d.description, d.notes].filter(Boolean).join(' '), r.project_id, 'system', r.id); } catch(_){}
+        }
+        for (const r of db.prepare("SELECT id, project_id, data FROM wiki_pages").all()) {
+          try { const d = JSON.parse(r.data || '{}'); insert.run(d.title || '', d.content || '', r.project_id, 'wiki_page', r.id); } catch(_){}
+        }
+        for (const r of db.prepare("SELECT id, project_id, data FROM sessions").all()) {
+          try { const d = JSON.parse(r.data || '{}'); insert.run(d.title || '', [d.summary, d.whereWeLeftOff].filter(Boolean).join(' '), r.project_id, 'session', r.id); } catch(_){}
+        }
+      });
+      tx();
+    },
+  },
+
+  // ── Migration 46: Phase 3 — server-side notifications + rules ──
+  {
+    version: 46,
+    description: "Server-side notifications_v2 table for Phase 3 notification engine",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS notifications_v2 (
+          id TEXT PRIMARY KEY,
+          project_id TEXT NOT NULL,
+          user_id TEXT NOT NULL,
+          type TEXT NOT NULL,
+          target_type TEXT,
+          target_id TEXT,
+          detail TEXT,
+          read INTEGER DEFAULT 0,
+          created_at TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS idx_notif2_user_project ON notifications_v2(user_id, project_id, created_at);
+        CREATE INDEX IF NOT EXISTS idx_notif2_project ON notifications_v2(project_id);
+        CREATE INDEX IF NOT EXISTS idx_notif2_dedup ON notifications_v2(user_id, type, target_id);
+      `);
+    },
+  },
+
+  // ── Migration 47: Phase 4 — AI usage tracking ──
+  {
+    version: 47,
+    description: "AI usage log for Phase 4 quota tracking",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS ai_usage_log (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL,
+          project_id TEXT NOT NULL,
+          endpoint TEXT NOT NULL,
+          had_enrichment INTEGER DEFAULT 0,
+          created_at TEXT NOT NULL DEFAULT (datetime('now'))
+        );
+        CREATE INDEX IF NOT EXISTS idx_ai_usage_user ON ai_usage_log(user_id, created_at);
+        CREATE INDEX IF NOT EXISTS idx_ai_usage_user_endpoint ON ai_usage_log(user_id, endpoint, created_at);
+      `);
+    },
+  },
+
+  // ── Migration 48: Admin flag on users ──
+  {
+    version: 48,
+    description: "Add is_admin flag to users table",
+    up(db) {
+      db.exec(`ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0`);
+      // Backfill: first registered user becomes admin (deterministic tiebreak by id)
+      db.exec(`UPDATE users SET is_admin = 1 WHERE id = (SELECT id FROM users ORDER BY created_at ASC, id ASC LIMIT 1)`);
+    },
+  },
+
+  // ── Migration 49: Access codes for invite-only registration ──
+  {
+    version: 49,
+    description: "Access codes table for invite-only registration",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS access_codes (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          code_hash TEXT NOT NULL UNIQUE,
+          created_at INTEGER NOT NULL,
+          created_by TEXT NOT NULL REFERENCES users(id),
+          redeemed_at INTEGER DEFAULT NULL,
+          redeemed_by TEXT DEFAULT NULL REFERENCES users(id),
+          expires_at INTEGER DEFAULT NULL,
+          max_uses INTEGER NOT NULL DEFAULT 1 CHECK(max_uses >= 1),
+          uses INTEGER NOT NULL DEFAULT 0 CHECK(uses >= 0),
+          note TEXT DEFAULT NULL,
+          disabled INTEGER NOT NULL DEFAULT 0
+        );
+        CREATE INDEX IF NOT EXISTS idx_access_codes_created_by ON access_codes(created_by);
+      `);
+    },
+  },
+
+  // ── Migration 50: Email verification codes (pre-registration) ──
+  {
+    version: 50,
+    description: "Email verification codes for pre-registration flow",
+    up(db) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS email_verifications (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          email_hash TEXT NOT NULL,
+          access_code_hash TEXT NOT NULL,
+          code_hash TEXT NOT NULL,
+          expires_at TEXT NOT NULL,
+          attempts INTEGER NOT NULL DEFAULT 0,
+          consumed INTEGER NOT NULL DEFAULT 0,
+          last_sent_at TEXT NOT NULL,
+          created_at TEXT NOT NULL DEFAULT (datetime('now'))
+        );
+        CREATE INDEX IF NOT EXISTS idx_email_verifications_email ON email_verifications(email_hash, consumed);
+        CREATE INDEX IF NOT EXISTS idx_email_verifications_lookup ON email_verifications(email_hash, access_code_hash, consumed);
+      `);
+    },
+  },
+    {
+      version: 51,
+      description: "Add disabled column to users for admin revoke",
+      up(db) {
+        db.exec(`ALTER TABLE users ADD COLUMN disabled INTEGER NOT NULL DEFAULT 0`);
+      },
+    },
+    {
+      version: 52,
+      description: "Create pre_verify_tokens table without FK to users",
+      up(db) {
+        db.exec(`CREATE TABLE IF NOT EXISTS pre_verify_tokens (
+          id TEXT PRIMARY KEY,
+          email_hash TEXT NOT NULL,
+          token_hash TEXT NOT NULL UNIQUE,
+          expires_at TEXT NOT NULL,
+          used INTEGER DEFAULT 0,
+          created_at TEXT NOT NULL
+        )`);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_pvt_token ON pre_verify_tokens(token_hash)`);
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_pvt_email ON pre_verify_tokens(email_hash)`);
+      },
+    },
+    {
+      version: 53,
+      description: "Add Bridge heartbeat columns to users",
+      up(db) {
+        db.exec(`ALTER TABLE users ADD COLUMN last_bridge_heartbeat INTEGER`);
+        db.exec(`ALTER TABLE users ADD COLUMN bridge_mcp_configured INTEGER NOT NULL DEFAULT 0`);
+        db.exec(`ALTER TABLE users ADD COLUMN last_bridge_device_id TEXT`);
+        db.exec(`ALTER TABLE users ADD COLUMN last_bridge_version TEXT`);
+      },
+    },
+    {
+      version: 54,
+      description: "Add engine detection column to users",
+      up(db) {
+        db.exec(`ALTER TABLE users ADD COLUMN bridge_engine_running TEXT`);
+      },
+    },
+    {
+      version: 55,
+      description: "Write audit log table for abuse detection",
+      up: (db) => {
+        db.exec(`
+          CREATE TABLE IF NOT EXISTS write_audit_log (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            user_id TEXT NOT NULL,
+            project_id TEXT,
+            method TEXT NOT NULL,
+            payload_bytes INTEGER DEFAULT 0,
+            rejected INTEGER DEFAULT 0,
+            reject_reason TEXT,
+            created_at TEXT NOT NULL DEFAULT (datetime('now'))
+          );
+          CREATE INDEX IF NOT EXISTS idx_wal_user ON write_audit_log(user_id, created_at);
+          CREATE INDEX IF NOT EXISTS idx_wal_project ON write_audit_log(project_id, created_at);
+          CREATE INDEX IF NOT EXISTS idx_wal_method ON write_audit_log(method, created_at);
+          CREATE INDEX IF NOT EXISTS idx_wal_rejected ON write_audit_log(rejected, created_at);
+        `);
+      },
+    },
+    {
+      version: 56,
+      description: "Recovery Center — soft-delete snapshot table",
+      up: (db) => {
+        db.exec(`
+          CREATE TABLE IF NOT EXISTS recovery_items (
+            id TEXT PRIMARY KEY,
+            project_id TEXT NOT NULL,
+            user_id TEXT NOT NULL,
+            item_type TEXT NOT NULL,
+            item_id TEXT NOT NULL,
+            item_title TEXT NOT NULL DEFAULT '',
+            snapshot TEXT NOT NULL,
+            source_page TEXT DEFAULT NULL,
+            deleted_at TEXT NOT NULL,
+            expires_at TEXT NOT NULL,
+            FOREIGN KEY (project_id) REFERENCES projects(id)
+          );
+          CREATE INDEX IF NOT EXISTS idx_recovery_project ON recovery_items(project_id, deleted_at);
+          CREATE INDEX IF NOT EXISTS idx_recovery_user ON recovery_items(user_id, deleted_at);
+          CREATE INDEX IF NOT EXISTS idx_recovery_expires ON recovery_items(expires_at);
+          CREATE INDEX IF NOT EXISTS idx_recovery_type ON recovery_items(project_id, item_type);
+        `);
+      },
+    },
+    {
+      version: 57,
+      description: "Data Control — per-project AI/MCP permission policies",
+      up: (db) => {
+        db.exec(`
+          CREATE TABLE IF NOT EXISTS data_control_policies (
+            project_id TEXT PRIMARY KEY,
+            policy_version INTEGER NOT NULL DEFAULT 1,
+            policies TEXT NOT NULL DEFAULT '{}',
+            updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+            updated_by TEXT NOT NULL DEFAULT ''
+          );
+        `);
+      },
+    },
+    {
+      version: 58,
+      description: "Data Control — blocked action audit log",
+      up: (db) => {
+        db.exec(`
+          CREATE TABLE IF NOT EXISTS dc_audit_log (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            user_id TEXT NOT NULL,
+            project_id TEXT,
+            method TEXT NOT NULL,
+            domain TEXT,
+            action TEXT,
+            permission TEXT,
+            denial_code TEXT NOT NULL,
+            created_at TEXT NOT NULL DEFAULT (datetime('now'))
+          );
+          CREATE INDEX IF NOT EXISTS idx_dc_audit_user ON dc_audit_log(user_id, created_at);
+          CREATE INDEX IF NOT EXISTS idx_dc_audit_project ON dc_audit_log(project_id, created_at);
+        `);
+      },
+    },
+    {
+      version: 59,
+      description: "Data Control — policy change audit trail + version increment",
+      up: (db) => {
+        db.exec(`
+          CREATE TABLE IF NOT EXISTS dc_policy_changes (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            project_id TEXT NOT NULL,
+            user_id TEXT NOT NULL,
+            auth_type TEXT NOT NULL DEFAULT 'jwt',
+            changed_domains TEXT NOT NULL DEFAULT '[]',
+            old_values TEXT NOT NULL DEFAULT '{}',
+            new_values TEXT NOT NULL DEFAULT '{}',
+            version_before INTEGER,
+            version_after INTEGER,
+            request_id TEXT,
+            created_at TEXT NOT NULL DEFAULT (datetime('now'))
+          );
+          CREATE INDEX IF NOT EXISTS idx_dc_policy_changes_project ON dc_policy_changes(project_id, created_at);
+        `);
+      },
+    },
+    // ── Migration 60: Admin audit log ──
+    {
+      version: 60,
+      description: "Admin audit log for granular admin action tracking",
+      up(db) {
+        db.exec(`
+          CREATE TABLE IF NOT EXISTS admin_audit_log (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            admin_user_id TEXT NOT NULL,
+            action TEXT NOT NULL,
+            target_type TEXT,
+            target_id TEXT,
+            detail TEXT DEFAULT '{}',
+            ip TEXT,
+            request_id TEXT,
+            created_at TEXT NOT NULL DEFAULT (datetime('now'))
+          );
+          CREATE INDEX IF NOT EXISTS idx_admin_audit_user ON admin_audit_log(admin_user_id, created_at);
+          CREATE INDEX IF NOT EXISTS idx_admin_audit_action ON admin_audit_log(action, created_at);
+          CREATE INDEX IF NOT EXISTS idx_admin_audit_created ON admin_audit_log(created_at);
+        `);
+      },
+    },
+    // ── Migration 62: Add bridge_glow to app_settings ──
+    {
+      version: 62,
+      description: "Add bridge_glow column to app_settings for glow bar toggle",
+      up(db) {
+        db.exec(`ALTER TABLE app_settings ADD COLUMN bridge_glow INTEGER DEFAULT 1`);
+      },
+    },
+    {
+      version: 63,
+      description: "User feedback table",
+      up(db) {
+        db.exec(`
+          CREATE TABLE IF NOT EXISTS feedback (
+            id TEXT PRIMARY KEY,
+            user_id TEXT NOT NULL,
+            type TEXT NOT NULL,
+            mood TEXT,
+            text TEXT NOT NULL,
+            email TEXT,
+            status TEXT NOT NULL DEFAULT 'new',
+            admin_note TEXT,
+            created_at TEXT NOT NULL
+          );
+          CREATE INDEX IF NOT EXISTS idx_feedback_user ON feedback(user_id);
+          CREATE INDEX IF NOT EXISTS idx_feedback_status ON feedback(status);
+          CREATE INDEX IF NOT EXISTS idx_feedback_created ON feedback(created_at);
+        `);
+      },
+    },
+    {
+      version: 64,
+      description: "MCP browser auth: auth codes and refresh tokens",
+      up(db) {
+        db.exec(`CREATE TABLE IF NOT EXISTS mcp_auth_codes (
+      code TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      code_challenge TEXT NOT NULL,
+      code_challenge_method TEXT NOT NULL DEFAULT 'S256',
+      redirect_uri TEXT NOT NULL,
+      state_hash TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      expires_at INTEGER NOT NULL,
+      used INTEGER NOT NULL DEFAULT 0,
+      used_at INTEGER
+    )`);
+        db.exec(`CREATE TABLE IF NOT EXISTS mcp_refresh_tokens (
+      token_hash TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      family_id TEXT NOT NULL,
+      device_label TEXT,
+      created_at INTEGER NOT NULL,
+      expires_at INTEGER NOT NULL,
+      revoked INTEGER NOT NULL DEFAULT 0,
+      revoked_at INTEGER,
+      rotated_at INTEGER,
+      last_used_at INTEGER,
+      FOREIGN KEY (user_id) REFERENCES users(id)
+    )`);
+        db.exec("CREATE INDEX IF NOT EXISTS idx_mcp_rt_user ON mcp_refresh_tokens(user_id)");
+        db.exec("CREATE INDEX IF NOT EXISTS idx_mcp_rt_family ON mcp_refresh_tokens(family_id)");
+      }
+    },
+    {
+      version: 65,
+      description: "Drop orphaned bridge_* columns from users and app_settings",
+      up(db) {
+        // Clean up any stale temp tables from a previous failed attempt
+        db.exec("DROP TABLE IF EXISTS users_new");
+        db.exec("DROP TABLE IF EXISTS app_settings_new");
+
+        // SQLite 3.35+ supports ALTER TABLE DROP COLUMN (better-sqlite3 bundles 3.45+)
+        const dropCols = ["last_bridge_heartbeat", "bridge_mcp_configured", "last_bridge_device_id", "last_bridge_version", "bridge_engine_running"];
+        const userCols = db.pragma("table_info(users)").map(c => c.name);
+        for (const col of dropCols) {
+          if (userCols.includes(col)) db.exec(`ALTER TABLE users DROP COLUMN ${col}`);
+        }
+
+        const asCols = db.pragma("table_info(app_settings)").map(c => c.name);
+        if (asCols.includes("bridge_glow")) db.exec("ALTER TABLE app_settings DROP COLUMN bridge_glow");
+      },
+    },
+    // ── Migration 66: Fleet heartbeat tables ──
+    {
+      version: 66,
+      description: "Fleet heartbeat tables for VPS monitoring",
+      up(db) {
+        db.exec(`
+          DROP TABLE IF EXISTS fleet_heartbeats;
+          DROP TABLE IF EXISTS fleet_events;
+          DROP TABLE IF EXISTS fleet_nodes;
+          CREATE TABLE fleet_nodes (
+            id TEXT PRIMARY KEY,
+            name TEXT NOT NULL,
+            roles TEXT NOT NULL DEFAULT '[]',
+            color TEXT,
+            last_heartbeat_at TEXT,
+            status TEXT NOT NULL DEFAULT 'offline',
+            latest_payload TEXT NOT NULL DEFAULT '{}',
+            created_at TEXT NOT NULL DEFAULT (datetime('now'))
+          );
+          CREATE TABLE fleet_heartbeats (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            node_id TEXT NOT NULL,
+            payload TEXT NOT NULL,
+            received_at TEXT NOT NULL DEFAULT (datetime('now')),
+            FOREIGN KEY (node_id) REFERENCES fleet_nodes(id)
+          );
+          CREATE INDEX IF NOT EXISTS idx_fleet_hb_node ON fleet_heartbeats(node_id, received_at);
+          CREATE TABLE IF NOT EXISTS fleet_events (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            node_id TEXT,
+            type TEXT NOT NULL,
+            severity TEXT NOT NULL DEFAULT 'info',
+            message TEXT NOT NULL,
+            detail TEXT DEFAULT '{}',
+            created_at TEXT NOT NULL DEFAULT (datetime('now'))
+          );
+          CREATE INDEX IF NOT EXISTS idx_fleet_events_created ON fleet_events(created_at);
+        `);
+        // Seed the 3 VPS nodes
+        const stmt = db.prepare("INSERT OR IGNORE INTO fleet_nodes (id, name, roles, color) VALUES (?, ?, ?, ?)");
+        stmt.run("vps1", "VPS-1", JSON.stringify(["API Server", "Proxy"]), "#4ade80");
+        stmt.run("vps2", "VPS-2", JSON.stringify(["Backup", "Logs"]), "#1B76FF");
+        stmt.run("vps3", "VPS-3", JSON.stringify(["Web", "CDN Origin"]), "#a78bfa");
+      },
+    },
+    {
+      version: 67,
+      description: "Create public_project_pages table for community project pages",
+      up: (db) => {
+        db.exec(`
+          CREATE TABLE IF NOT EXISTS public_project_pages (
+            id TEXT PRIMARY KEY,
+            project_id TEXT NOT NULL,
+            user_id TEXT NOT NULL,
+            slug TEXT NOT NULL UNIQUE COLLATE NOCASE,
+            is_published INTEGER NOT NULL DEFAULT 0,
+            custom_slug INTEGER NOT NULL DEFAULT 0,
+            public_title TEXT NOT NULL DEFAULT '',
+            public_tagline TEXT NOT NULL DEFAULT '',
+            public_image TEXT NOT NULL DEFAULT '',
+            public_engine TEXT NOT NULL DEFAULT '',
+            public_genre TEXT NOT NULL DEFAULT '',
+            public_status TEXT NOT NULL DEFAULT '',
+            public_team_size TEXT NOT NULL DEFAULT '',
+            public_stage TEXT NOT NULL DEFAULT '',
+            creator_display_name TEXT NOT NULL DEFAULT '',
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL,
+            FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE,
+            FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+          );
+          CREATE UNIQUE INDEX IF NOT EXISTS idx_public_pages_slug ON public_project_pages(slug);
+          CREATE INDEX IF NOT EXISTS idx_public_pages_project ON public_project_pages(project_id);
+          CREATE INDEX IF NOT EXISTS idx_public_pages_user ON public_project_pages(user_id);
+          CREATE INDEX IF NOT EXISTS idx_public_pages_published ON public_project_pages(is_published);
+        `);
+      },
+    },
+    {
+      version: 68,
+      description: "Create burned_slugs table for permanent slug reservation + add public_code to projects",
+      up: (db) => {
+        // Burned slugs: permanently reserved codes from deleted/archived projects
+        // These can NEVER be reused, even after project deletion
+        db.exec(`
+          CREATE TABLE IF NOT EXISTS burned_slugs (
+            slug TEXT PRIMARY KEY COLLATE NOCASE,
+            original_project_id TEXT,
+            original_user_id TEXT,
+            burned_at TEXT NOT NULL,
+            reason TEXT NOT NULL DEFAULT 'deleted'
+          );
+          CREATE INDEX IF NOT EXISTS idx_burned_slugs_date ON burned_slugs(burned_at);
+        `);
+        // Add public_code column to projects table for automatic permanent code assignment
+        try { db.exec("ALTER TABLE projects ADD COLUMN public_code TEXT"); } catch(_) {}
+        try { db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_projects_public_code ON projects(public_code) WHERE public_code IS NOT NULL"); } catch(_) {}
+      },
+    },
+    // ── Migration 69: Image moderation system ──
+    {
+      version: 69,
+      description: "Image uploads, moderation actions, and moderation reports tables",
+      up(db) {
+        db.exec(`
+          CREATE TABLE IF NOT EXISTS image_uploads (
+            id TEXT PRIMARY KEY,
+            user_id TEXT NOT NULL,
+            project_id TEXT,
+            image_type TEXT NOT NULL,
+            original_mime TEXT,
+            original_size INTEGER,
+            detected_mime TEXT,
+            processed_mime TEXT DEFAULT 'image/webp',
+            processed_size INTEGER,
+            width INTEGER,
+            height INTEGER,
+            r2_key TEXT,
+            moderation_state TEXT NOT NULL DEFAULT 'pending',
+            moderation_reason TEXT,
+            moderation_labels TEXT,
+            moderation_provider TEXT,
+            moderation_score REAL,
+            moderation_decided_at TEXT,
+            is_orphaned INTEGER DEFAULT 0,
+            created_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL
+          );
+          CREATE INDEX IF NOT EXISTS idx_image_uploads_user ON image_uploads(user_id);
+          CREATE INDEX IF NOT EXISTS idx_image_uploads_state ON image_uploads(moderation_state);
+          CREATE INDEX IF NOT EXISTS idx_image_uploads_type ON image_uploads(image_type);
+
+          CREATE TABLE IF NOT EXISTS image_moderation_actions (
+            id TEXT PRIMARY KEY,
+            image_upload_id TEXT NOT NULL,
+            actor_user_id TEXT NOT NULL,
+            action TEXT NOT NULL,
+            previous_state TEXT,
+            new_state TEXT,
+            note TEXT,
+            created_at TEXT NOT NULL,
+            FOREIGN KEY (image_upload_id) REFERENCES image_uploads(id)
+          );
+          CREATE INDEX IF NOT EXISTS idx_mod_actions_image ON image_moderation_actions(image_upload_id);
+          CREATE INDEX IF NOT EXISTS idx_mod_actions_actor ON image_moderation_actions(actor_user_id);
+
+          CREATE TABLE IF NOT EXISTS image_moderation_reports (
+            id TEXT PRIMARY KEY,
+            image_upload_id TEXT NOT NULL,
+            reporter_user_id TEXT NOT NULL,
+            reason TEXT NOT NULL,
+            detail TEXT,
+            status TEXT NOT NULL DEFAULT 'open',
+            reviewed_by TEXT,
+            reviewed_at TEXT,
+            created_at TEXT NOT NULL,
+            FOREIGN KEY (image_upload_id) REFERENCES image_uploads(id)
+          );
+          CREATE INDEX IF NOT EXISTS idx_image_reports_status ON image_moderation_reports(status);
+          CREATE INDEX IF NOT EXISTS idx_image_reports_image ON image_moderation_reports(image_upload_id);
+        `);
+      },
+    },
+    // ── Migration 70: Add content_hash to image_uploads for abuse fingerprinting ──
+    {
+      version: 70,
+      description: "Add content_hash column to image_uploads for abuse fingerprinting",
+      up(db) {
+        try { db.exec("ALTER TABLE image_uploads ADD COLUMN content_hash TEXT"); } catch(_) {}
+        db.exec("CREATE INDEX IF NOT EXISTS idx_image_uploads_hash ON image_uploads(content_hash)");
+      },
+    },
+    // ── Migration 71: Expand ue_discovered_bps for Blueprint Intelligence sync ──
+    {
+      version: 71,
+      description: "Expand ue_discovered_bps with data blob, content_hash, sync_status for Blueprint Intelligence",
+      up(db) {
+        try { db.exec("ALTER TABLE ue_discovered_bps ADD COLUMN data TEXT DEFAULT '{}'"); } catch(_) {}
+        try { db.exec("ALTER TABLE ue_discovered_bps ADD COLUMN content_hash TEXT"); } catch(_) {}
+        try { db.exec("ALTER TABLE ue_discovered_bps ADD COLUMN updated_at TEXT"); } catch(_) {}
+        try { db.exec("ALTER TABLE ue_discovered_bps ADD COLUMN sync_status TEXT DEFAULT 'complete'"); } catch(_) {}
+        try { db.exec("ALTER TABLE ue_discovered_bps ADD COLUMN sync_warnings TEXT DEFAULT '[]'"); } catch(_) {}
+      },
+    },
+    // ── Migration 72: Blueprint snapshots + change tracking for timeline ──
+    {
+      version: 72,
+      description: "Create blueprint_snapshots and blueprint_changes tables for change timeline",
+      up(db) {
+        db.exec(`
+          CREATE TABLE IF NOT EXISTS blueprint_snapshots (
+            id TEXT PRIMARY KEY,
+            project_id TEXT NOT NULL,
+            blueprint_id TEXT NOT NULL,
+            snapshot_hash TEXT NOT NULL,
+            data TEXT NOT NULL,
+            metrics TEXT DEFAULT '{}',
+            created_at TEXT NOT NULL,
+            FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+          );
+          CREATE INDEX IF NOT EXISTS idx_bp_snapshots_bp ON blueprint_snapshots(blueprint_id);
+          CREATE INDEX IF NOT EXISTS idx_bp_snapshots_created ON blueprint_snapshots(created_at);
+
+          CREATE TABLE IF NOT EXISTS blueprint_changes (
+            id TEXT PRIMARY KEY,
+            project_id TEXT NOT NULL,
+            blueprint_id TEXT NOT NULL,
+            snapshot_id TEXT NOT NULL,
+            prev_snapshot_id TEXT,
+            diff TEXT NOT NULL,
+            summary TEXT NOT NULL,
+            complexity_delta INTEGER DEFAULT 0,
+            is_layout_only INTEGER DEFAULT 0,
+            created_at TEXT NOT NULL,
+            FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+          );
+          CREATE INDEX IF NOT EXISTS idx_bp_changes_bp ON blueprint_changes(blueprint_id);
+        `);
+      },
+    },
+    // ── Migration 73: Blueprint standards + violations for review system ──
+    {
+      version: 73,
+      description: "Create blueprint_standards and blueprint_violations tables for AI review",
+      up(db) {
+        db.exec(`
+          CREATE TABLE IF NOT EXISTS blueprint_standards (
+            id TEXT PRIMARY KEY,
+            project_id TEXT NOT NULL,
+            rule_id TEXT NOT NULL,
+            enabled INTEGER DEFAULT 1,
+            severity TEXT DEFAULT 'warning',
+            created_at TEXT NOT NULL,
+            UNIQUE(project_id, rule_id),
+            FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+          );
+
+          CREATE TABLE IF NOT EXISTS blueprint_violations (
+            id TEXT PRIMARY KEY,
+            project_id TEXT NOT NULL,
+            blueprint_id TEXT NOT NULL,
+            standard_id TEXT NOT NULL,
+            rule_id TEXT NOT NULL,
+            detail TEXT DEFAULT '{}',
+            resolved INTEGER DEFAULT 0,
+            found_at TEXT NOT NULL,
+            resolved_at TEXT,
+            FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+          );
+          CREATE INDEX IF NOT EXISTS idx_bp_violations_project ON blueprint_violations(project_id);
+          CREATE INDEX IF NOT EXISTS idx_bp_violations_bp ON blueprint_violations(blueprint_id);
+        `);
+      },
+    },
+    // ── Migration 74: Blueprint dependencies for impact analysis ──
+    {
+      version: 74,
+      description: "Create blueprint_dependencies table for impact analysis",
+      up(db) {
+        db.exec(`
+          CREATE TABLE IF NOT EXISTS blueprint_dependencies (
+            id TEXT PRIMARY KEY,
+            project_id TEXT NOT NULL,
+            source_bp_id TEXT NOT NULL,
+            target_bp_id TEXT NOT NULL,
+            dependency_type TEXT NOT NULL,
+            weight INTEGER DEFAULT 1,
+            confidence TEXT DEFAULT 'full',
+            detail TEXT DEFAULT '{}',
+            computed_at TEXT NOT NULL,
+            UNIQUE(source_bp_id, target_bp_id, dependency_type),
+            FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
+          );
+          CREATE INDEX IF NOT EXISTS idx_bp_deps_source ON blueprint_dependencies(source_bp_id);
+          CREATE INDEX IF NOT EXISTS idx_bp_deps_target ON blueprint_dependencies(target_bp_id);
+        `);
+      },
+    },
+];
+
+function runMigrations(db) {
+  db.exec(`CREATE TABLE IF NOT EXISTS _migrations (
+    version INTEGER PRIMARY KEY,
+    description TEXT,
+    applied_at TEXT NOT NULL
+  )`);
+
+  const applied = db.prepare("SELECT version FROM _migrations").all().map(r => r.version);
+
+  for (const m of MIGRATIONS) {
+    if (!applied.includes(m.version)) {
+      m.up(db);
+      db.prepare("INSERT INTO _migrations (version, description, applied_at) VALUES (?, ?, ?)")
+        .run(m.version, m.description, new Date().toISOString());
+      console.log(`Migration ${m.version}: ${m.description}`);
+    }
+  }
+}
+
+// ===== AUTO BACKUP =====
+
+function createBackup() {
+  ensureDir(BACKUP_DIR);
+  if (!_db) return null;
+  const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
+  const backupPath = path.join(BACKUP_DIR, `taskover-${timestamp}.db`);
+  if (_engine === "sql.js") {
+    _db.backup(backupPath);
+  } else {
+    // better-sqlite3: use VACUUM INTO for a synchronous consistent copy
+    try {
+      _db.exec(`VACUUM INTO '${backupPath.replace(/'/g, "''")}'`);
+    } catch (_) {
+      fs.copyFileSync(DB_FILE, backupPath);
+    }
+  }
+
+  // S6A-14: Encrypt backup if crypto is initialized
+  let finalPath = backupPath;
+  try {
+    const cryptoModule = require("./crypto");
+    if (cryptoModule.isCryptoInitialized()) {
+      const encPath = backupPath + ".enc";
+      cryptoModule.encryptBackup(backupPath, encPath);
+      fs.unlinkSync(backupPath); // Remove plaintext copy
+      finalPath = encPath;
+    }
+  } catch (_) {
+    // Crypto not available — keep plaintext backup
+  }
+
+  // Keep only last 10 backups (match both .db and .db.enc)
+  const backups = fs.readdirSync(BACKUP_DIR)
+    .filter(f => f.startsWith("taskover-") && (f.endsWith(".db") || f.endsWith(".db.enc")))
+    .sort();
+  while (backups.length > 10) {
+    const oldest = backups.shift();
+    try { fs.unlinkSync(path.join(BACKUP_DIR, oldest)); } catch (_) {}
+  }
+
+  return finalPath;
+}
+
+module.exports = { initDb, getDb, closeDb, reloadFromDisk, createBackup, saveToDisk, getLastSaveTime, getEngine, DB_FILE, DATA_DIR, BACKUP_DIR };