Add installer/script delivery metadata to the core software model

AppVersion gains sha256 and silentargs so the endpoint update_app push can pin exact installer bytes and carry per-version silent switches; Application gains installersha256 for the app-level install source. New ShopDB-hosted script library (Script model plus scripts API) backs run_script delivery, with the body fetched by digest on push rather than pre-staged or sent over the command wire. Two idempotent migrations with real downgrades. Script added to the shopdb.api contract surface for plugin use.

migrations/versions/7d35_appversion_delivery_metadata.py

@@ -0,0 +1,46 @@
+"""Add appversions.sha256 and appversions.silentargs (installer delivery metadata)
+
+The endpoint installer push resolves a specific AppVersion: sha256 pins the
+exact bytes the agent must fetch, and silentargs carries this version's
+unattended-install switches (homegrown EXEs vary by developer; MSI is uniform
+via msiexec). Both nullable. Idempotent guards and real downgrade.
+
+Revision ID: 7d35_appversion_delivery_metadata
+Revises: 7d34_singular_relationship_types
+Create Date: 2026-07-24
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = '7d35_appversion_delivery_metadata'
+down_revision = '7d34_singular_relationship_types'
+branch_labels = None
+depends_on = None
+
+
+def _has_col(insp, name):
+    return any(c['name'] == name for c in insp.get_columns('appversions'))
+
+
+def upgrade():
+    bind = op.get_bind()
+    insp = sa.inspect(bind)
+    if 'appversions' not in insp.get_table_names():
+        return
+    if not _has_col(insp, 'sha256'):
+        op.add_column('appversions', sa.Column('sha256', sa.String(length=64), nullable=True))
+    if not _has_col(insp, 'silentargs'):
+        op.add_column('appversions', sa.Column('silentargs', sa.String(length=255), nullable=True))
+
+
+def downgrade():
+    bind = op.get_bind()
+    insp = sa.inspect(bind)
+    if 'appversions' not in insp.get_table_names():
+        return
+    if _has_col(insp, 'silentargs'):
+        op.drop_column('appversions', 'silentargs')
+    if _has_col(insp, 'sha256'):
+        op.drop_column('appversions', 'sha256')

migrations/versions/7d36_scriptlibrary_and_app_installer_digest.py

@@ -0,0 +1,71 @@
+"""Add applications.installersha256 and the scripts table (script-library delivery)
+
+Two additive, idempotent changes for the endpoint app/script delivery path:
+
+1. applications.installersha256 - digest of the app-level uploaded installer so
+   an update_app push can resolve an install source by app alone (no AppVersion
+   row required). Nullable; null when installpath is a site share path.
+
+2. scripts - the ShopDB-hosted script library. The endpoint agent fetches a
+   script body by digest on push and runs it in the configured runcontext
+   (system or user). Mirrors the application installer delivery model.
+
+Idempotent guards and a real downgrade throughout; strict MySQL 8 clean.
+
+Revision ID: 7d36_scriptlibrary_and_app_installer_digest
+Revises: 7d35_appversion_delivery_metadata
+Create Date: 2026-08-29
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = '7d36_scriptlibrary_and_app_installer_digest'
+down_revision = '7d35_appversion_delivery_metadata'
+branch_labels = None
+depends_on = None
+
+
+def _has_col(insp, table, name):
+    return any(c['name'] == name for c in insp.get_columns(table))
+
+
+def upgrade():
+    bind = op.get_bind()
+    insp = sa.inspect(bind)
+
+    if 'applications' in insp.get_table_names() \
+            and not _has_col(insp, 'applications', 'installersha256'):
+        op.add_column(
+            'applications',
+            sa.Column('installersha256', sa.String(length=64), nullable=True))
+
+    if 'scripts' not in insp.get_table_names():
+        op.create_table(
+            'scripts',
+            sa.Column('scriptid', sa.Integer(), primary_key=True),
+            sa.Column('scriptname', sa.String(length=100), nullable=False),
+            sa.Column('scriptdescription', sa.String(length=255), nullable=True),
+            sa.Column('filename', sa.String(length=255), nullable=True),
+            sa.Column('sha256', sa.String(length=64), nullable=True),
+            sa.Column('runcontext', sa.String(length=16),
+                      nullable=False, server_default='system'),
+            sa.Column('createddate', sa.DateTime(), nullable=False),
+            sa.Column('modifieddate', sa.DateTime(), nullable=False),
+            sa.Column('isactive', sa.Boolean(), nullable=False,
+                      server_default=sa.text('1')),
+            sa.UniqueConstraint('scriptname', name='uq_scripts_scriptname'),
+        )
+
+
+def downgrade():
+    bind = op.get_bind()
+    insp = sa.inspect(bind)
+
+    if 'scripts' in insp.get_table_names():
+        op.drop_table('scripts')
+
+    if 'applications' in insp.get_table_names() \
+            and _has_col(insp, 'applications', 'installersha256'):
+        op.drop_column('applications', 'installersha256')