-- v7: per-user RBAC scoping for virtual Llms and Agents.
--
-- `Llm.ownerId` is new — we don't have a record of who created legacy
-- rows, so existing data is left NULL (treated as "no owner, public").
-- The list/get filter in the service layer handles NULL ownerId
-- correctly: a NULL-owner public row stays visible to everyone.
--
-- `Llm.visibility` and `Agent.visibility` default to 'public' so the
-- backfill is automatic — pre-v7 setups continue to behave identically.
-- New rows created post-deploy carry the value the service writes
-- (mcplocal virtuals → 'private'; CLI `mcpctl create llm` → 'public'
-- by default unless `--visibility private` is passed).

ALTER TABLE "Llm"
  ADD COLUMN "ownerId" TEXT,
  ADD COLUMN "visibility" TEXT NOT NULL DEFAULT 'public';

ALTER TABLE "Agent"
  ADD COLUMN "visibility" TEXT NOT NULL DEFAULT 'public';

-- Composite index supports the list-filter hot path:
--   `WHERE visibility='public' OR ownerId=$1`
-- on tables that may grow as more publishers / users come online.
CREATE INDEX "Llm_visibility_ownerId_idx" ON "Llm"("visibility", "ownerId");
CREATE INDEX "Agent_visibility_ownerId_idx" ON "Agent"("visibility", "ownerId");
