thinkwork-cli 0.12.12 → 0.12.15

package/dist/drizzle/0155_tenant_model_catalog.sql

@@ -0,0 +1,152 @@
+-- Purpose: add tenant-scoped Bedrock model catalog state.
+-- Plan: docs/plans/2026-06-09-001-feat-tenant-model-catalog-plan.md U1
+-- Apply manually (no CI migration runner):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0155_tenant_model_catalog.sql
+-- Pre-flight:
+--   SELECT count(*) FROM public.model_catalog;
+--   SELECT count(*) FROM public.tenants;
+-- creates: public.tenant_model_catalog
+-- creates: public.idx_tenant_model_catalog_tenant_enabled
+-- creates: public.idx_tenant_model_catalog_model
+-- creates-constraint: public.tenant_model_catalog.tenant_model_catalog_pkey
+-- creates-constraint: public.tenant_model_catalog.tenant_model_catalog_tenant_id_tenants_id_fk
+-- creates-constraint: public.tenant_model_catalog.tenant_model_catalog_model_id_model_catalog_model_id_fk
+-- creates-constraint: public.tenant_model_catalog.tenant_model_catalog_imported_by_user_id_users_id_fk
+-- creates-constraint: public.tenant_model_catalog.tenant_model_catalog_pricing_status_allowed
+-- creates-constraint: public.tenant_model_catalog.tenant_model_catalog_enabled_requires_resolved_pricing
+
+\set ON_ERROR_STOP on
+
+SET lock_timeout = '5s';
+SET statement_timeout = '15min';
+
+SELECT pg_advisory_lock(hashtext('migration:0155_tenant_model_catalog'));
+
+CREATE TABLE IF NOT EXISTS public.tenant_model_catalog (
+  tenant_id uuid NOT NULL,
+  model_id text NOT NULL,
+  display_name text NOT NULL,
+  enabled boolean NOT NULL DEFAULT false,
+  pricing_status text NOT NULL DEFAULT 'missing',
+  pricing_source text,
+  pricing_diagnostics jsonb NOT NULL DEFAULT '{}'::jsonb,
+  last_priced_at timestamptz,
+  import_source text NOT NULL DEFAULT 'backfill',
+  import_payload jsonb NOT NULL DEFAULT '{}'::jsonb,
+  imported_by_user_id uuid,
+  imported_at timestamptz NOT NULL DEFAULT now(),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT tenant_model_catalog_pkey
+    PRIMARY KEY (tenant_id, model_id),
+  CONSTRAINT tenant_model_catalog_tenant_id_tenants_id_fk
+    FOREIGN KEY (tenant_id)
+    REFERENCES public.tenants(id)
+    ON DELETE CASCADE,
+  CONSTRAINT tenant_model_catalog_model_id_model_catalog_model_id_fk
+    FOREIGN KEY (model_id)
+    REFERENCES public.model_catalog(model_id)
+    ON DELETE CASCADE,
+  CONSTRAINT tenant_model_catalog_imported_by_user_id_users_id_fk
+    FOREIGN KEY (imported_by_user_id)
+    REFERENCES public.users(id)
+    ON DELETE SET NULL,
+  CONSTRAINT tenant_model_catalog_pricing_status_allowed
+    CHECK (pricing_status IN ('resolved', 'missing', 'ambiguous', 'error')),
+  CONSTRAINT tenant_model_catalog_enabled_requires_resolved_pricing
+    CHECK (enabled IS FALSE OR pricing_status = 'resolved')
+);
+
+CREATE INDEX IF NOT EXISTS idx_tenant_model_catalog_tenant_enabled
+  ON public.tenant_model_catalog (tenant_id, enabled);
+
+CREATE INDEX IF NOT EXISTS idx_tenant_model_catalog_model
+  ON public.tenant_model_catalog (model_id);
+
+WITH referenced_models AS (
+  SELECT tenant_id, default_model AS model_id
+  FROM public.tenant_settings
+  WHERE tenant_id IS NOT NULL
+    AND default_model IS NOT NULL
+
+  UNION
+
+  SELECT tenant_id, model AS model_id
+  FROM public.agents
+  WHERE model IS NOT NULL
+    AND status <> 'archived'
+
+  UNION
+
+  SELECT tenant_id, model AS model_id
+  FROM public.agent_templates
+  WHERE tenant_id IS NOT NULL
+    AND model IS NOT NULL
+
+  UNION
+
+  SELECT tenant_id, model_id
+  FROM public.agent_profiles
+  WHERE model_id IS NOT NULL
+
+  UNION
+
+  SELECT tenant_id, model_id
+  FROM public.user_model_approvals
+),
+eligible_models AS (
+  SELECT DISTINCT
+    rm.tenant_id,
+    mc.model_id,
+    mc.display_name,
+    mc.input_cost_per_million,
+    mc.output_cost_per_million
+  FROM referenced_models rm
+  JOIN public.model_catalog mc
+    ON mc.model_id = rm.model_id
+   AND mc.is_available IS TRUE
+  WHERE rm.tenant_id IS NOT NULL
+)
+INSERT INTO public.tenant_model_catalog (
+  tenant_id,
+  model_id,
+  display_name,
+  enabled,
+  pricing_status,
+  pricing_source,
+  pricing_diagnostics,
+  last_priced_at,
+  import_source,
+  import_payload
+)
+SELECT
+  tenant_id,
+  model_id,
+  display_name,
+  (input_cost_per_million IS NOT NULL AND output_cost_per_million IS NOT NULL) AS enabled,
+  CASE
+    WHEN input_cost_per_million IS NOT NULL AND output_cost_per_million IS NOT NULL
+      THEN 'resolved'
+    ELSE 'missing'
+  END AS pricing_status,
+  CASE
+    WHEN input_cost_per_million IS NOT NULL AND output_cost_per_million IS NOT NULL
+      THEN 'legacy-model-catalog'
+    ELSE NULL
+  END AS pricing_source,
+  CASE
+    WHEN input_cost_per_million IS NOT NULL AND output_cost_per_million IS NOT NULL
+      THEN jsonb_build_object('backfilledFrom', 'model_catalog')
+    ELSE jsonb_build_object('reason', 'model_catalog_missing_token_costs')
+  END AS pricing_diagnostics,
+  CASE
+    WHEN input_cost_per_million IS NOT NULL AND output_cost_per_million IS NOT NULL
+      THEN now()
+    ELSE NULL
+  END AS last_priced_at,
+  'backfill' AS import_source,
+  jsonb_build_object('referencedBy', 'existing tenant defaults, agents, profiles, templates, or approvals') AS import_payload
+FROM eligible_models
+ON CONFLICT (tenant_id, model_id) DO NOTHING;
+
+SELECT pg_advisory_unlock(hashtext('migration:0155_tenant_model_catalog'));

package/dist/drizzle/0156_bootstrap_credential_leases.sql

@@ -0,0 +1,52 @@
+-- Bootstrap credential lease metadata for browser-first customer deployments.
+--
+-- Credential material lives only in AWS Secrets Manager. This table stores
+-- lease metadata, redaction-safe fingerprints, and cleanup state.
+--
+-- creates: public.bootstrap_credential_leases
+-- creates: public.bootstrap_credential_leases_session_idx
+-- creates: public.bootstrap_credential_leases_status_expires_idx
+-- creates: public.bootstrap_credential_leases_secret_arn_uidx
+
+CREATE TABLE IF NOT EXISTS "bootstrap_credential_leases" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  "session_id" uuid NOT NULL REFERENCES "customer_deployment_sessions"("id") ON DELETE cascade,
+  "status" text NOT NULL DEFAULT 'pending',
+  "lease_type" text NOT NULL,
+  "secret_arn" text NOT NULL,
+  "secret_fingerprint" text NOT NULL,
+  "external_id_hash" text,
+  "role_arn" text,
+  "expires_at" timestamp with time zone NOT NULL,
+  "validated_at" timestamp with time zone,
+  "in_use_at" timestamp with time zone,
+  "transferred_at" timestamp with time zone,
+  "revoked_at" timestamp with time zone,
+  "failed_cleanup_reason" text,
+  "audit_metadata" jsonb NOT NULL DEFAULT '{}'::jsonb,
+  "created_at" timestamp with time zone NOT NULL DEFAULT now(),
+  "updated_at" timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT "bootstrap_credential_leases_status_allowed" CHECK (
+    "status" IN (
+      'pending',
+      'validated',
+      'in_use',
+      'transferred',
+      'revoked',
+      'expired',
+      'failed_cleanup'
+    )
+  ),
+  CONSTRAINT "bootstrap_credential_leases_type_allowed" CHECK (
+    "lease_type" IN ('temporary_credentials', 'assumable_role')
+  )
+);
+
+CREATE INDEX IF NOT EXISTS "bootstrap_credential_leases_session_idx"
+  ON "bootstrap_credential_leases" ("session_id");
+
+CREATE INDEX IF NOT EXISTS "bootstrap_credential_leases_status_expires_idx"
+  ON "bootstrap_credential_leases" ("status", "expires_at");
+
+CREATE UNIQUE INDEX IF NOT EXISTS "bootstrap_credential_leases_secret_arn_uidx"
+  ON "bootstrap_credential_leases" ("secret_arn");

package/dist/drizzle/0157_knowledge_graph_observations_source.sql

@@ -0,0 +1,79 @@
+-- Purpose: admit Hindsight observations as a Knowledge Graph ingest source and
+--          add per-(tenant, bank) incremental cursors for the tenant fan-in.
+-- Plan: docs/plans/2026-06-09-004-feat-cognee-centric-memory-pipeline-plan.md (U4)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0157_knowledge_graph_observations_source.sql
+-- creates: public.knowledge_graph_observation_cursors
+-- creates: public.uq_kg_observation_cursors_tenant_bank
+-- creates: public.idx_kg_observation_cursors_tenant
+-- creates-constraint: public.knowledge_graph_ingest_runs.knowledge_graph_ingest_runs_source_kind_allowed
+-- creates-constraint: public.knowledge_graph_ingest_runs.knowledge_graph_ingest_runs_trigger_allowed
+-- creates-constraint: public.knowledge_graph_entities.knowledge_graph_entities_source_kind_allowed
+-- creates-constraint: public.knowledge_graph_relationships.knowledge_graph_relationships_source_kind_allowed
+-- creates-constraint: public.knowledge_graph_evidence.knowledge_graph_evidence_source_kind_allowed
+-- creates-constraint: public.knowledge_graph_evidence.knowledge_graph_evidence_evidence_source_kind_allowed
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+
+-- Source-kind vocabulary gains 'observations'. Constraint re-adds validate
+-- against existing rows; all current rows use thread/wiki/brain, so widening
+-- is safe in either deploy order.
+ALTER TABLE public.knowledge_graph_ingest_runs
+  DROP CONSTRAINT IF EXISTS knowledge_graph_ingest_runs_source_kind_allowed;
+ALTER TABLE public.knowledge_graph_ingest_runs
+  ADD CONSTRAINT knowledge_graph_ingest_runs_source_kind_allowed
+  CHECK (source_kind IN ('thread','wiki','brain','observations'));
+
+-- U5's drainer schedules observation runs; 'manual' stays the default.
+ALTER TABLE public.knowledge_graph_ingest_runs
+  DROP CONSTRAINT IF EXISTS knowledge_graph_ingest_runs_trigger_allowed;
+ALTER TABLE public.knowledge_graph_ingest_runs
+  ADD CONSTRAINT knowledge_graph_ingest_runs_trigger_allowed
+  CHECK ("trigger" IN ('manual','scheduled'));
+
+ALTER TABLE public.knowledge_graph_entities
+  DROP CONSTRAINT IF EXISTS knowledge_graph_entities_source_kind_allowed;
+ALTER TABLE public.knowledge_graph_entities
+  ADD CONSTRAINT knowledge_graph_entities_source_kind_allowed
+  CHECK (source_kind IN ('thread','wiki','brain','observations'));
+
+ALTER TABLE public.knowledge_graph_relationships
+  DROP CONSTRAINT IF EXISTS knowledge_graph_relationships_source_kind_allowed;
+ALTER TABLE public.knowledge_graph_relationships
+  ADD CONSTRAINT knowledge_graph_relationships_source_kind_allowed
+  CHECK (source_kind IN ('thread','wiki','brain','observations'));
+
+ALTER TABLE public.knowledge_graph_evidence
+  DROP CONSTRAINT IF EXISTS knowledge_graph_evidence_source_kind_allowed;
+ALTER TABLE public.knowledge_graph_evidence
+  ADD CONSTRAINT knowledge_graph_evidence_source_kind_allowed
+  CHECK (source_kind IN ('thread','wiki','brain','observations'));
+
+ALTER TABLE public.knowledge_graph_evidence
+  DROP CONSTRAINT IF EXISTS knowledge_graph_evidence_evidence_source_kind_allowed;
+ALTER TABLE public.knowledge_graph_evidence
+  ADD CONSTRAINT knowledge_graph_evidence_evidence_source_kind_allowed
+  CHECK (evidence_source_kind IN ('thread_message','wiki_page','wiki_section','brain_page','brain_section','hindsight_observation','cognee_payload','normalizer'));
+
+-- Per-(tenant, bank) cursors for the observations fan-in. The
+-- (last_record_updated_at, last_record_id) pair mirrors the wiki compile
+-- cursor tiebreaker; cursors advance only in the same transaction as the
+-- mirror snapshot replace.
+CREATE TABLE IF NOT EXISTS public.knowledge_graph_observation_cursors (
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  bank_id text NOT NULL,
+  last_record_updated_at timestamptz,
+  last_record_id text,
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_kg_observation_cursors_tenant_bank
+  ON public.knowledge_graph_observation_cursors (tenant_id, bank_id);
+
+CREATE INDEX IF NOT EXISTS idx_kg_observation_cursors_tenant
+  ON public.knowledge_graph_observation_cursors (tenant_id);
+
+COMMIT;

package/dist/drizzle/0158_pending_user_questions.sql

@@ -0,0 +1,80 @@
+-- Purpose: add pending_user_questions for the ask_user_question HITL flow —
+--   one row per question batch the parent agent asks; answer state lives on
+--   this row (never mutated into the message's parts payload). The partial
+--   unique index enforces one `pending` batch per thread (R8) so the intake
+--   endpoint can return 409 on conflict.
+-- Plan: docs/plans/2026-06-09-005-feat-ask-user-question-plan.md U1
+-- Apply manually (no CI migration runner):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0158_pending_user_questions.sql
+-- creates: public.pending_user_questions
+-- creates: public.pending_user_questions_one_pending_per_thread
+-- creates: public.idx_pending_user_questions_tenant
+-- creates: public.idx_pending_user_questions_thread_status
+-- creates: public.idx_pending_user_questions_message
+-- creates-constraint: public.pending_user_questions.pending_user_questions_tenant_id_tenants_id_fk
+-- creates-constraint: public.pending_user_questions.pending_user_questions_thread_id_threads_id_fk
+-- creates-constraint: public.pending_user_questions.pending_user_questions_message_id_messages_id_fk
+-- creates-constraint: public.pending_user_questions.pending_user_questions_thread_turn_id_thread_turns_id_fk
+-- creates-constraint: public.pending_user_questions.pending_user_questions_status_allowed
+-- creates-constraint: public.pending_user_questions.pending_user_questions_answered_via_allowed
+
+\set ON_ERROR_STOP on
+
+SET lock_timeout = '5s';
+SET statement_timeout = '15min';
+
+SELECT pg_advisory_lock(hashtext('migration:0158_pending_user_questions'));
+
+CREATE TABLE IF NOT EXISTS public.pending_user_questions (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  thread_id uuid NOT NULL,
+  message_id uuid NOT NULL,
+  thread_turn_id uuid NOT NULL,
+  status text NOT NULL DEFAULT 'pending',
+  questions jsonb NOT NULL,
+  answers jsonb,
+  answered_via text,
+  answered_by text,
+  answered_at timestamptz,
+  delegation_context jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT pending_user_questions_tenant_id_tenants_id_fk
+    FOREIGN KEY (tenant_id)
+    REFERENCES public.tenants(id)
+    ON DELETE CASCADE,
+  CONSTRAINT pending_user_questions_thread_id_threads_id_fk
+    FOREIGN KEY (thread_id)
+    REFERENCES public.threads(id)
+    ON DELETE CASCADE,
+  CONSTRAINT pending_user_questions_message_id_messages_id_fk
+    FOREIGN KEY (message_id)
+    REFERENCES public.messages(id)
+    ON DELETE CASCADE,
+  CONSTRAINT pending_user_questions_thread_turn_id_thread_turns_id_fk
+    FOREIGN KEY (thread_turn_id)
+    REFERENCES public.thread_turns(id),
+  CONSTRAINT pending_user_questions_status_allowed
+    CHECK (status IN ('pending', 'answered', 'cancelled')),
+  CONSTRAINT pending_user_questions_answered_via_allowed
+    CHECK (answered_via IS NULL OR answered_via IN ('card', 'reply'))
+);
+
+-- R8: at most one pending question batch per thread; the intake endpoint
+-- surfaces violations as 409.
+CREATE UNIQUE INDEX IF NOT EXISTS pending_user_questions_one_pending_per_thread
+  ON public.pending_user_questions (thread_id)
+  WHERE status = 'pending';
+
+CREATE INDEX IF NOT EXISTS idx_pending_user_questions_tenant
+  ON public.pending_user_questions (tenant_id);
+
+CREATE INDEX IF NOT EXISTS idx_pending_user_questions_thread_status
+  ON public.pending_user_questions (thread_id, status);
+
+-- Message.userQuestion resolves by message id; the messages.id FK cascade
+-- also needs this to avoid a sequential scan on message deletes.
+CREATE INDEX IF NOT EXISTS idx_pending_user_questions_message
+  ON public.pending_user_questions (message_id);
+
+SELECT pg_advisory_unlock(hashtext('migration:0158_pending_user_questions'));

package/dist/drizzle/0158_wiki_tenant_scope.sql

@@ -0,0 +1,38 @@
+-- Purpose: relax the wiki owner-scope covenant for tenant-scoped pages —
+--          `owner_id` becomes nullable on wiki.pages AND wiki.compile_jobs
+--          (graph-mode compile jobs are tenant-keyed), and a partial unique
+--          index enforces (tenant_id, type, slug) uniqueness for null-owner
+--          pages (the existing four-column unique treats NULLs as distinct
+--          and would silently allow duplicate tenant pages).
+--          Purely additive: nothing drops, no data changes. User-scoped
+--          pages keep their owner_id; the U11 cutover archive pass is a
+--          separate, later migration.
+-- Plan: docs/plans/2026-06-09-004-feat-cognee-centric-memory-pipeline-plan.md (U9)
+-- Apply manually: psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0158_wiki_tenant_scope.sql
+-- creates: wiki.uq_pages_tenant_type_slug_tenant_scope
+-- Note: the two ALTER COLUMN ... DROP NOT NULL statements (wiki.pages.owner_id,
+-- wiki.compile_jobs.owner_id) have no drift-reporter marker convention —
+-- nullability changes aren't object creations. They are idempotent.
+
+\set ON_ERROR_STOP on
+
+BEGIN;
+
+SET LOCAL lock_timeout = '5s';
+
+-- Tenant-scoped pages carry owner_id NULL (graph→wiki materializer).
+ALTER TABLE wiki.pages
+  ALTER COLUMN owner_id DROP NOT NULL;
+
+-- Graph-mode compile jobs are tenant-keyed — same covenant change.
+ALTER TABLE wiki.compile_jobs
+  ALTER COLUMN owner_id DROP NOT NULL;
+
+-- Integrity-load-bearing: uq_pages_tenant_owner_type_slug treats NULL
+-- owner_id as distinct, so duplicate (tenant, type, slug) tenant pages
+-- would otherwise insert silently. All existing indexes stay untouched.
+CREATE UNIQUE INDEX IF NOT EXISTS uq_pages_tenant_type_slug_tenant_scope
+  ON wiki.pages (tenant_id, type, slug)
+  WHERE owner_id IS NULL;
+
+COMMIT;

package/dist/drizzle/0159_agent_profiles_space_local.sql

@@ -0,0 +1,49 @@
+-- Purpose: space-local Agent Profiles (dynamic workspace U7). Profiles defined
+--   under a Space source's agents/ folder project into agent_profiles scoped to
+--   that Space via source_space_id (NULL = central/agent-source profile). Slug
+--   uniqueness becomes per-origin: central keeps tenant+slug uniqueness, while
+--   space-local rows are unique per (tenant, slug, source_space_id) so a
+--   space-local slug may intentionally shadow a central one while its Space is
+--   active.
+-- Plan: docs/plans/2026-06-12-002-feat-dynamic-workspace-plan.md U7
+-- Apply manually (no CI migration runner):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0159_agent_profiles_space_local.sql
+-- creates-column: public.agent_profiles.source_space_id
+-- creates-constraint: public.agent_profiles.agent_profiles_source_space_id_spaces_id_fk
+-- creates: public.uq_agent_profiles_tenant_slug
+-- creates: public.uq_agent_profiles_tenant_slug_source_space
+
+\set ON_ERROR_STOP on
+
+SET lock_timeout = '5s';
+SET statement_timeout = '15min';
+
+SELECT pg_advisory_lock(hashtext('migration:0159_agent_profiles_space_local'));
+
+ALTER TABLE public.agent_profiles
+  ADD COLUMN IF NOT EXISTS source_space_id uuid;
+
+DO $$
+BEGIN
+  ALTER TABLE public.agent_profiles
+    ADD CONSTRAINT agent_profiles_source_space_id_spaces_id_fk
+    FOREIGN KEY (source_space_id)
+    REFERENCES public.spaces(id)
+    ON DELETE CASCADE;
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+END $$;
+
+-- Recreate the tenant+slug uniqueness as a partial index over central rows
+-- only; space-local rows get their own per-Space uniqueness.
+DROP INDEX IF EXISTS uq_agent_profiles_tenant_slug;
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_agent_profiles_tenant_slug
+  ON public.agent_profiles (tenant_id, slug)
+  WHERE source_space_id IS NULL;
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_agent_profiles_tenant_slug_source_space
+  ON public.agent_profiles (tenant_id, slug, source_space_id)
+  WHERE source_space_id IS NOT NULL;
+
+SELECT pg_advisory_unlock(hashtext('migration:0159_agent_profiles_space_local'));

package/dist/drizzle/0159_application_plugins.sql

@@ -0,0 +1,193 @@
+-- Purpose: add the application-plugin engine tables — canonical install,
+--   component, and user-activation state for the plugin system. Installs pin
+--   a catalog version + payload sha256; components carry handler linkage
+--   (handler_ref) for read-time reconciliation against deployment jobs;
+--   activations hold one app-level OAuth grant per (user, install) with one
+--   token record per RFC 8707 resource indicator. Also adds the
+--   tenant_mcp_servers.plugin_install_id ownership column for plugin-managed
+--   MCP rows.
+-- Plan: docs/plans/2026-06-12-001-feat-application-plugins-plan.md U4
+-- Apply manually (no CI migration runner):
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f packages/database-pg/drizzle/0159_application_plugins.sql
+-- Pre-flight:
+--   SELECT count(*) FROM public.tenants;
+--   SELECT count(*) FROM public.users;
+--   SELECT count(*) FROM public.tenant_mcp_servers;
+-- creates: public.plugin_installs
+-- creates: public.plugin_components
+-- creates: public.user_plugin_activations
+-- creates: public.user_plugin_activation_tokens
+-- creates: public.uq_plugin_installs_tenant_plugin
+-- creates: public.idx_plugin_installs_tenant_state
+-- creates: public.uq_plugin_components_install_key
+-- creates: public.idx_plugin_components_install
+-- creates: public.uq_user_plugin_activations
+-- creates: public.idx_user_plugin_activations_install
+-- creates: public.uq_user_plugin_activation_tokens_resource
+-- creates-column: public.tenant_mcp_servers.plugin_install_id
+-- creates-constraint: public.plugin_installs.plugin_installs_pkey
+-- creates-constraint: public.plugin_installs.plugin_installs_tenant_id_tenants_id_fk
+-- creates-constraint: public.plugin_installs.plugin_installs_state_allowed
+-- creates-constraint: public.plugin_components.plugin_components_pkey
+-- creates-constraint: public.plugin_components.plugin_components_plugin_install_id_plugin_installs_id_fk
+-- creates-constraint: public.plugin_components.plugin_components_state_allowed
+-- creates-constraint: public.plugin_components.plugin_components_type_allowed
+-- creates-constraint: public.user_plugin_activations.user_plugin_activations_pkey
+-- creates-constraint: public.user_plugin_activations.user_plugin_activations_user_id_users_id_fk
+-- creates-constraint: public.user_plugin_activations.user_plugin_activations_plugin_install_id_plugin_installs_id_fk
+-- creates-constraint: public.user_plugin_activations.user_plugin_activations_status_allowed
+-- creates-constraint: public.user_plugin_activation_tokens.user_plugin_activation_tokens_pkey
+-- creates-constraint: public.user_plugin_activation_tokens.user_plugin_activation_tokens_activation_id_fk
+-- creates-constraint: public.user_plugin_activation_tokens.user_plugin_activation_tokens_status_allowed
+-- creates-constraint: public.tenant_mcp_servers.tenant_mcp_servers_plugin_install_id_plugin_installs_id_fk
+
+\set ON_ERROR_STOP on
+
+SET lock_timeout = '5s';
+SET statement_timeout = '15min';
+
+SELECT pg_advisory_lock(hashtext('migration:0159_application_plugins'));
+
+-- ---------------------------------------------------------------------------
+-- plugin_installs — one row per (tenant, plugin); pins the catalog version
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS public.plugin_installs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL,
+  plugin_key text NOT NULL,
+  pinned_version text NOT NULL,
+  pinned_payload_sha256 text NOT NULL,
+  state text NOT NULL DEFAULT 'installing',
+  idempotency_key text NOT NULL,
+  last_transition_at timestamptz NOT NULL DEFAULT now(),
+  last_error text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT plugin_installs_tenant_id_tenants_id_fk
+    FOREIGN KEY (tenant_id)
+    REFERENCES public.tenants(id)
+    ON DELETE CASCADE,
+  CONSTRAINT plugin_installs_state_allowed
+    CHECK (state IN ('installing', 'awaiting_approval', 'installed', 'partially_installed', 'failed', 'uninstalling'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_plugin_installs_tenant_plugin
+  ON public.plugin_installs (tenant_id, plugin_key);
+
+CREATE INDEX IF NOT EXISTS idx_plugin_installs_tenant_state
+  ON public.plugin_installs (tenant_id, state);
+
+-- ---------------------------------------------------------------------------
+-- plugin_components — per-component provisioning state under an install
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS public.plugin_components (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  plugin_install_id uuid NOT NULL,
+  component_key text NOT NULL,
+  component_type text NOT NULL,
+  state text NOT NULL DEFAULT 'pending',
+  handler_ref jsonb NOT NULL DEFAULT '{}'::jsonb,
+  last_error text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT plugin_components_plugin_install_id_plugin_installs_id_fk
+    FOREIGN KEY (plugin_install_id)
+    REFERENCES public.plugin_installs(id)
+    ON DELETE CASCADE,
+  CONSTRAINT plugin_components_state_allowed
+    CHECK (state IN ('pending', 'provisioned', 'failed')),
+  CONSTRAINT plugin_components_type_allowed
+    CHECK (component_type IN ('mcp-server', 'skills', 'infrastructure', 'ui-surface'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_plugin_components_install_key
+  ON public.plugin_components (plugin_install_id, component_key);
+
+CREATE INDEX IF NOT EXISTS idx_plugin_components_install
+  ON public.plugin_components (plugin_install_id);
+
+-- ---------------------------------------------------------------------------
+-- user_plugin_activations — one app-level OAuth grant per (user, install)
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS public.user_plugin_activations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id uuid NOT NULL,
+  plugin_install_id uuid NOT NULL,
+  status text NOT NULL DEFAULT 'active',
+  granted_scopes jsonb NOT NULL DEFAULT '[]'::jsonb,
+  granted_at timestamptz NOT NULL DEFAULT now(),
+  revoked_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT user_plugin_activations_user_id_users_id_fk
+    FOREIGN KEY (user_id)
+    REFERENCES public.users(id)
+    ON DELETE CASCADE,
+  CONSTRAINT user_plugin_activations_plugin_install_id_plugin_installs_id_fk
+    FOREIGN KEY (plugin_install_id)
+    REFERENCES public.plugin_installs(id)
+    ON DELETE CASCADE,
+  CONSTRAINT user_plugin_activations_status_allowed
+    CHECK (status IN ('active', 'needs_reauth', 'revoked'))
+);
+
+-- Doubles as the dispatch-time activation lookup (user_id, plugin_install_id).
+CREATE UNIQUE INDEX IF NOT EXISTS uq_user_plugin_activations
+  ON public.user_plugin_activations (user_id, plugin_install_id);
+
+-- activatedUserCount: count of 'active' activations per install.
+CREATE INDEX IF NOT EXISTS idx_user_plugin_activations_install
+  ON public.user_plugin_activations (plugin_install_id);
+
+-- ---------------------------------------------------------------------------
+-- user_plugin_activation_tokens — one token record per resource indicator
+-- ---------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS public.user_plugin_activation_tokens (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  activation_id uuid NOT NULL,
+  resource_indicator text NOT NULL,
+  secret_ref text NOT NULL,
+  status text NOT NULL DEFAULT 'active',
+  expires_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  -- Explicit short name: the drizzle-derived name exceeds Postgres's 63-char
+  -- identifier limit (matches the foreignKey() name in src/schema/plugins.ts).
+  CONSTRAINT user_plugin_activation_tokens_activation_id_fk
+    FOREIGN KEY (activation_id)
+    REFERENCES public.user_plugin_activations(id)
+    ON DELETE CASCADE,
+  CONSTRAINT user_plugin_activation_tokens_status_allowed
+    CHECK (status IN ('active', 'expired', 'revoked'))
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_user_plugin_activation_tokens_resource
+  ON public.user_plugin_activation_tokens (activation_id, resource_indicator);
+
+-- ---------------------------------------------------------------------------
+-- tenant_mcp_servers.plugin_install_id — plugin ownership marker
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE public.tenant_mcp_servers
+  ADD COLUMN IF NOT EXISTS plugin_install_id uuid;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'tenant_mcp_servers_plugin_install_id_plugin_installs_id_fk'
+      AND conrelid = 'public.tenant_mcp_servers'::regclass
+  ) THEN
+    ALTER TABLE public.tenant_mcp_servers
+      ADD CONSTRAINT tenant_mcp_servers_plugin_install_id_plugin_installs_id_fk
+      FOREIGN KEY (plugin_install_id)
+      REFERENCES public.plugin_installs(id)
+      ON DELETE SET NULL;
+  END IF;
+END $$;
+
+SELECT pg_advisory_unlock(hashtext('migration:0159_application_plugins'));