@askexenow/exe-os 0.9.153 → 0.9.155

package/deploy/compose/.env.example

@@ -1,6 +1,6 @@
 # exe-os VPS stack — example environment variables
-# Copy to .env before deployment and replace every CHANGEME_* value.
-# Values under # SET_MANUALLY must be provided by the operator.
+# Run `exe-os stack-init` or `node deploy/compose/generate-env.js` to auto-generate
+# all secrets. Or copy to .env and replace CHANGEME_* values manually.
 
 # --- Data Layer ---
 POSTGRES_USER=exe
@@ -13,67 +13,53 @@ CLICKHOUSE_PASSWORD=CHANGEME_CLICKHOUSE_PASSWORD
 
 REDIS_PASSWORD=CHANGEME_REDIS_PASSWORD
 
+# --- GoTrue (shared auth) ---
+GOTRUE_JWT_SECRET=CHANGEME_GOTRUE_JWT_SECRET
+GOTRUE_SITE_URL=https://crm.askexe.com
+GOTRUE_EXTERNAL_URL=https://auth.askexe.com
+GOTRUE_DISABLE_SIGNUP=false
+GOTRUE_MAILER_AUTOCONFIRM=true
+
 # --- CRM ---
-CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.2
-CRM_SERVER_URL=https://CHANGEME_DOMAIN
+CRM_IMAGE_TAG=ghcr.io/askexe/exe-crm:v0.9.3
+CRM_SERVER_URL=https://crm.askexe.com
 CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET
+EXE_CRM_ADMIN_TOKEN=CHANGEME_EXE_CRM_ADMIN_TOKEN
 CRM_HOST_PORT=3000
 
 # --- Wiki ---
-WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.2
+WIKI_IMAGE_TAG=ghcr.io/askexe/exe-wiki:v0.9.4
 WIKI_DB_SCHEMA=wiki
 WIKI_VECTOR_DB=postgres
 WIKI_AUTH_TOKEN=CHANGEME_WIKI_AUTH_TOKEN
+EXE_WIKI_ADMIN_TOKEN=CHANGEME_EXE_WIKI_ADMIN_TOKEN
 WIKI_JWT_SECRET=CHANGEME_WIKI_JWT_SECRET
 WIKI_SIG_KEY=CHANGEME_WIKI_SIG_KEY
 WIKI_SIG_SALT=CHANGEME_WIKI_SIG_SALT
 WIKI_HOST_PORT=3001
 
-# --- exe-os ---
-EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.2
+# --- exe-os (daemon) ---
+EXE_OS_IMAGE_TAG=ghcr.io/askexe/exe-os:v0.9.154
 EXED_MCP_TOKEN=CHANGEME_EXED_MCP_TOKEN
 EXED_DEVICE_ID=vps-default
-# VPS-only: enables cloud/local SQLite -> exe-db Postgres projection.
-# Keep false on laptops/dev boxes.
 EXE_CLOUD_SYNC_TO_POSTGRES=true
+EXE_LICENSE_KEY=CHANGEME_EXE_LICENSE_KEY
 
 # --- Gateway ---
-GATEWAY_IMAGE_TAG=ghcr.io/askexe/exe-gateway:v0.9.2
+GATEWAY_IMAGE_TAG=ghcr.io/askexe/exe-gateway:v0.9.3
 EXE_GATEWAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_AUTH_TOKEN
 EXE_GATEWAY_WS_RELAY_AUTH_TOKEN=CHANGEME_EXE_GATEWAY_WS_RELAY_AUTH_TOKEN
 EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN=CHANGEME_EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN
-# SET_MANUALLY
-WHATSAPP_ACCESS_TOKEN=CHANGEME_WHATSAPP_ACCESS_TOKEN
 API_ROUTER_URL=https://gateway.askexe.com
-API_ROUTER_KEY=CHANGEME_API_ROUTER_KEY
-# BYOK: to use your own API keys instead of the Exe API Router,
-# set BYOK_ENABLED=true and provide ANTHROPIC_API_KEY below.
-# BYOK_ENABLED=false
-# ANTHROPIC_API_KEY=CHANGEME_ANTHROPIC_API_KEY
 GATEWAY_HTTP_HOST_PORT=3100
 GATEWAY_WS_HOST_PORT=3101
 
-# --- Monitoring agent (standard for managed customer VPSs) ---
-MONITOR_AGENT_IMAGE_TAG=ghcr.io/askexe/exe-monitor-agent:v0.9.2
+# --- Monitoring ---
+MONITOR_HUB_IMAGE_TAG=ghcr.io/askexe/exe-monitor-hub:v0.9.4
+MONITOR_AGENT_IMAGE_TAG=ghcr.io/askexe/exe-monitor-agent:v0.9.4
+EXE_MONITOR_ADMIN_TOKEN=CHANGEME_EXE_MONITOR_ADMIN_TOKEN
 MONITOR_HUB_URL=https://monitor.askexe.com
-# Values copied from monitor.askexe.com when adding a new system.
-MONITOR_AGENT_TOKEN=CHANGEME_MONITOR_AGENT_TOKEN_FROM_MONITOR_HUB
-MONITOR_AGENT_KEY=CHANGEME_MONITOR_AGENT_PUBLIC_KEY_FROM_MONITOR_HUB
+MONITOR_AGENT_TOKEN=CHANGEME_MONITOR_AGENT_TOKEN
+MONITOR_AGENT_KEY=CHANGEME_MONITOR_AGENT_KEY
 MONITOR_AGENT_LISTEN=:45876
-
-# --- AskExe central monitoring hub auth (AskExe-owned infra only) ---
-# Customer VPSs normally run only MONITOR_AGENT_* above. These hub values are
-# for monitor.askexe.com on exe-db-jkt.
-MONITOR_HUB_PUBLIC_URL=https://monitor.askexe.com
-MONITOR_HUB_SOURCE_DIR=/opt/exe-monitor
-MONITOR_HUB_HOST_PORT=8090
-MONITOR_HUB_DATA_DIR=/opt/exe-monitor-data
-MONITOR_TRUSTED_AUTH_HEADER=X-AskExe-User-Email
-# Keep false during bootstrap; flip true after the GoTrue auth proxy is live.
-MONITOR_DISABLE_PASSWORD_AUTH=false
-MONITOR_USER_CREATION=true
-MONITOR_SHARE_ALL_SYSTEMS=false
-
-# --- License ---
-# injected by deploy_client
-EXE_LICENSE_KEY=CHANGEME_EXE_LICENSE_KEY
+MONITOR_HUB_PORT=8090

package/deploy/compose/cloudflared/config.yml.example

@@ -0,0 +1,29 @@
+# Cloudflare Tunnel config — routes *.askexe.com to local services.
+# Copy to config.yml and replace TUNNEL_ID with your tunnel UUID.
+# Create tunnel: cloudflared tunnel create <name>
+# Then copy credentials JSON to this directory.
+
+tunnel: CHANGEME_TUNNEL_ID
+credentials-file: /etc/cloudflared/CHANGEME_TUNNEL_ID.json
+
+ingress:
+  # CRM
+  - hostname: crm.CHANGEME_DOMAIN
+    service: http://exe-crm:3000
+  # Wiki
+  - hostname: wiki.CHANGEME_DOMAIN
+    service: http://exe-wiki:3001
+  # Gateway (WhatsApp, webhooks, pairing)
+  - hostname: gateway.CHANGEME_DOMAIN
+    service: http://exe-gateway:3100
+  # Monitor
+  - hostname: monitor.CHANGEME_DOMAIN
+    service: http://exe-monitor-hub:8090
+  # Auth (GoTrue)
+  - hostname: auth.CHANGEME_DOMAIN
+    service: http://gotrue:9999
+  # exe-os daemon (MCP)
+  - hostname: api.CHANGEME_DOMAIN
+    service: http://exe-os:8765
+  # Catch-all
+  - service: http_status:404

package/deploy/compose/docker-compose.yml

@@ -36,6 +36,7 @@ services:
       PGDATA: /var/lib/postgresql/data/pgdata
     volumes:
       - postgres_data:/var/lib/postgresql/data
+      - ./init-db.sql:/docker-entrypoint-initdb.d/01-init.sql:ro
     networks:
       backend:
         ipv4_address: 10.42.0.10
@@ -104,6 +105,66 @@ services:
       driver: json-file
       options: { max-size: "10m", max-file: "3" }
 
+  gotrue:
+    image: supabase/gotrue:v2.172.1@sha256:b0dd7aa28dd1f9a8bd31f136c8b912661f701d9b863171e5843cb08f18f49de4
+    container_name: gotrue
+    restart: unless-stopped
+    depends_on:
+      exe-db:
+        condition: service_healthy
+    env_file:
+      - path: .env
+        required: false
+    environment:
+      GOTRUE_DB_DRIVER: postgres
+      GOTRUE_DB_DATABASE_URL: postgres://${POSTGRES_USER:-exe}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@exe-db:5432/${POSTGRES_DB:-exedb}?sslmode=disable&search_path=auth
+      GOTRUE_SITE_URL: ${GOTRUE_SITE_URL:-https://crm.askexe.com}
+      GOTRUE_URI_ALLOW_LIST: ${GOTRUE_URI_ALLOW_LIST:-}
+      GOTRUE_JWT_SECRET: ${GOTRUE_JWT_SECRET:?GOTRUE_JWT_SECRET is required}
+      GOTRUE_JWT_EXP: ${GOTRUE_JWT_EXP:-3600}
+      GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
+      API_EXTERNAL_URL: ${GOTRUE_EXTERNAL_URL:-https://auth.askexe.com}
+      GOTRUE_DISABLE_SIGNUP: ${GOTRUE_DISABLE_SIGNUP:-false}
+      GOTRUE_MAILER_AUTOCONFIRM: ${GOTRUE_MAILER_AUTOCONFIRM:-true}
+    ports:
+      - "127.0.0.1:${GOTRUE_HOST_PORT:-9999}:9999"
+    networks:
+      backend:
+        ipv4_address: 10.42.0.13
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:9999/health"]
+      interval: 15s
+      timeout: 5s
+      start_period: 10s
+      retries: 5
+    logging:
+      driver: json-file
+      options: { max-size: "10m", max-file: "3" }
+
+  exe-monitor-hub:
+    image: ${MONITOR_HUB_IMAGE_TAG:-ghcr.io/askexe/exe-monitor-hub:v0.9.4}
+    container_name: exe-monitor-hub
+    restart: unless-stopped
+    environment:
+      EXE_MONITOR_ADMIN_TOKEN: ${EXE_MONITOR_ADMIN_TOKEN:-}
+      GOTRUE_URL: http://gotrue:9999
+    ports:
+      - "127.0.0.1:${MONITOR_HUB_PORT:-8090}:8090"
+    volumes:
+      - monitor_hub_data:/app/pb_data
+    networks:
+      backend:
+        ipv4_address: 10.42.0.14
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:8090/api/health"]
+      interval: 30s
+      timeout: 5s
+      start_period: 15s
+      retries: 5
+    logging:
+      driver: json-file
+      options: { max-size: "10m", max-file: "3" }
+
   # ------------------------------------------------------------------
   # Apps
   # ------------------------------------------------------------------
@@ -128,6 +189,8 @@ services:
       EXE_LICENSE_KEY: ${EXE_LICENSE_KEY:?EXE_LICENSE_KEY is required — purchase at https://askexe.com}
       SERVER_URL: ${CRM_SERVER_URL:-https://crm.askexe.com}
       APP_SECRET: ${CRM_APP_SECRET:?CRM_APP_SECRET is required}
+      EXE_CRM_ADMIN_TOKEN: ${EXE_CRM_ADMIN_TOKEN:-}
+      GOTRUE_URL: http://gotrue:9999
       PG_DATABASE_URL: postgres://${POSTGRES_USER:-exe}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@exe-db:5432/${POSTGRES_DB:-exedb}
       REDIS_URL: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD is required}@redis:6379
       CLICKHOUSE_URL: http://${CLICKHOUSE_USER:-exe}:${CLICKHOUSE_PASSWORD:?CLICKHOUSE_PASSWORD is required}@clickhouse:8123/${CLICKHOUSE_DB:-default}
@@ -211,6 +274,8 @@ services:
       STORAGE_DIR: /app/server/storage
       DATABASE_URL: postgres://${POSTGRES_USER:-exe}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@exe-db:5432/${POSTGRES_DB:-exedb}?schema=${WIKI_DB_SCHEMA:-wiki}
       AUTH_TOKEN: ${WIKI_AUTH_TOKEN:?WIKI_AUTH_TOKEN is required}
+      EXE_WIKI_ADMIN_TOKEN: ${EXE_WIKI_ADMIN_TOKEN:-}
+      GOTRUE_URL: http://gotrue:9999
       JWT_SECRET: ${WIKI_JWT_SECRET:?WIKI_JWT_SECRET is required}
       SIG_KEY: ${WIKI_SIG_KEY:?WIKI_SIG_KEY is required}
       SIG_SALT: ${WIKI_SIG_SALT:?WIKI_SIG_SALT is required}
@@ -290,6 +355,7 @@ services:
       EXE_GATEWAY_PORT: "3100"
       EXE_GATEWAY_HOST: "127.0.0.1"
       EXE_GATEWAY_AUTH_TOKEN: ${EXE_GATEWAY_AUTH_TOKEN:?EXE_GATEWAY_AUTH_TOKEN is required}
+      GOTRUE_URL: http://gotrue:9999
       EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN: ${EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN:?EXE_GATEWAY_WHATSAPP_VERIFY_TOKEN is required}
       EXE_GATEWAY_WS_RELAY_ENABLED: "true"
       EXE_GATEWAY_WS_RELAY_HOST: "127.0.0.1"
@@ -351,6 +417,32 @@ services:
       driver: json-file
       options: { max-size: "10m", max-file: "3" }
 
+  # ------------------------------------------------------------------
+  # Infrastructure — Cloudflare Tunnel (replaces nginx + SSL certs)
+  # ------------------------------------------------------------------
+
+  cloudflared:
+    image: cloudflare/cloudflared:latest
+    container_name: cloudflared
+    restart: unless-stopped
+    command: tunnel --config /etc/cloudflared/config.yml run
+    volumes:
+      - ${CLOUDFLARED_CONFIG_DIR:-./cloudflared}:/etc/cloudflared:ro
+    networks:
+      backend:
+        ipv4_address: 10.42.0.31
+      frontend:
+        ipv4_address: 10.43.0.31
+    healthcheck:
+      test: ["CMD", "cloudflared", "tunnel", "info", "--output", "json"]
+      interval: 30s
+      timeout: 5s
+      start_period: 15s
+      retries: 5
+    logging:
+      driver: json-file
+      options: { max-size: "10m", max-file: "3" }
+
 # ------------------------------------------------------------------
 # Volumes
 # ------------------------------------------------------------------
@@ -373,6 +465,8 @@ volumes:
     driver: local
   monitor_agent_data:
     driver: local
+  monitor_hub_data:
+    driver: local
 
 # ------------------------------------------------------------------
 # Networks

package/deploy/compose/gateway.json

@@ -1 +1,11 @@
-{}
+{
+  "port": 3100,
+  "host": "0.0.0.0",
+  "readOnly": false,
+  "adapters": {
+    "whatsapp": {
+      "enabled": false,
+      "accounts": []
+    }
+  }
+}

package/deploy/compose/generate-env.ts

@@ -5,11 +5,11 @@ const REGISTRY = "ghcr.io/askexe";
 // own package semver internally, but customer deployments use the tested stack
 // image alias so one stack manifest can pin the whole release. exe-os/exed is
 // the exception because the runtime package version is the orchestrator release.
-const STACK_IMAGE_TAG = "v0.9.2";
-const EXED_RELEASE_TAG = "v0.9.2";
+const STACK_IMAGE_TAG = "v0.9.4";
+const EXED_RELEASE_TAG = "v0.9.154";
 
 const POSTGRES_USER = "exe";
-const POSTGRES_DB = "default";
+const POSTGRES_DB = "exedb";
 const CLICKHOUSE_DB = "default";
 const CLICKHOUSE_USER = "exe";
 export const CRM_IMAGE_TAG = `${REGISTRY}/exe-crm:${STACK_IMAGE_TAG}`;
@@ -21,6 +21,7 @@ const WIKI_HOST_PORT = "3001";
 export const EXE_OS_IMAGE_TAG = `${REGISTRY}/exe-os:${EXED_RELEASE_TAG}`;
 export const GATEWAY_IMAGE_TAG = `${REGISTRY}/exe-gateway:${STACK_IMAGE_TAG}`;
 export const MONITOR_AGENT_IMAGE_TAG = `${REGISTRY}/exe-monitor-agent:${STACK_IMAGE_TAG}`;
+export const MONITOR_HUB_IMAGE_TAG = `${REGISTRY}/exe-monitor-hub:${STACK_IMAGE_TAG}`;
 const GATEWAY_HTTP_HOST_PORT = "3100";
 const GATEWAY_WS_HOST_PORT = "3101";
 const RANDOM_SECRET_16 = 16;
@@ -56,10 +57,18 @@ export function generateEnv(options: GenerateEnvOptions): string {
     "",
     `REDIS_PASSWORD=${randomSecret(RANDOM_SECRET_32)}`,
     "",
+    "# --- GoTrue (shared auth) ---",
+    `GOTRUE_JWT_SECRET=${randomSecret(RANDOM_SECRET_48)}`,
+    `GOTRUE_SITE_URL=https://crm.${normalizedDomain}`,
+    `GOTRUE_EXTERNAL_URL=https://auth.${normalizedDomain}`,
+    "GOTRUE_DISABLE_SIGNUP=false",
+    "GOTRUE_MAILER_AUTOCONFIRM=true",
+    "",
     "# --- CRM ---",
     `CRM_IMAGE_TAG=${CRM_IMAGE_TAG}`,
     `CRM_SERVER_URL=https://${normalizedDomain}`,
     `CRM_APP_SECRET=${randomSecret(RANDOM_SECRET_48)}`,
+    `EXE_CRM_ADMIN_TOKEN=${randomSecret(RANDOM_SECRET_48)}`,
     `CRM_HOST_PORT=${CRM_HOST_PORT}`,
     "",
     "# --- Wiki ---",
@@ -67,6 +76,7 @@ export function generateEnv(options: GenerateEnvOptions): string {
     `WIKI_DB_SCHEMA=${WIKI_DB_SCHEMA}`,
     `WIKI_VECTOR_DB=${WIKI_VECTOR_DB}`,
     `WIKI_AUTH_TOKEN=${randomSecret(RANDOM_SECRET_48)}`,
+    `EXE_WIKI_ADMIN_TOKEN=${randomSecret(RANDOM_SECRET_48)}`,
     `WIKI_JWT_SECRET=${randomSecret(RANDOM_SECRET_48)}`,
     `WIKI_SIG_KEY=${randomSecret(RANDOM_SECRET_48)}`,
     `WIKI_SIG_SALT=${randomSecret(RANDOM_SECRET_16)}`,
@@ -95,12 +105,15 @@ export function generateEnv(options: GenerateEnvOptions): string {
     `GATEWAY_HTTP_HOST_PORT=${GATEWAY_HTTP_HOST_PORT}`,
     `GATEWAY_WS_HOST_PORT=${GATEWAY_WS_HOST_PORT}`,
     "",
-    "# --- Monitoring agent (standard for managed customer VPSs) ---",
+    "# --- Monitoring ---",
+    `MONITOR_HUB_IMAGE_TAG=${MONITOR_HUB_IMAGE_TAG}`,
     `MONITOR_AGENT_IMAGE_TAG=${MONITOR_AGENT_IMAGE_TAG}`,
+    `EXE_MONITOR_ADMIN_TOKEN=${randomSecret(RANDOM_SECRET_48)}`,
     `MONITOR_HUB_URL=${DEFAULT_MONITOR_HUB_URL}`,
     "MONITOR_AGENT_TOKEN=CHANGEME_MONITOR_AGENT_TOKEN_FROM_MONITOR_HUB",
     "MONITOR_AGENT_KEY=CHANGEME_MONITOR_AGENT_PUBLIC_KEY_FROM_MONITOR_HUB",
     `MONITOR_AGENT_LISTEN=${DEFAULT_MONITOR_AGENT_LISTEN}`,
+    "MONITOR_HUB_PORT=8090",
     "",
     "# --- License ---",
     LICENSE_KEY_COMMENT,
@@ -129,6 +142,7 @@ export function generateExampleEnv(): string {
     `CRM_IMAGE_TAG=${CRM_IMAGE_TAG}`,
     "CRM_SERVER_URL=https://CHANGEME_DOMAIN",
     "CRM_APP_SECRET=CHANGEME_CRM_APP_SECRET",
+    "EXE_CRM_ADMIN_TOKEN=CHANGEME_EXE_CRM_ADMIN_TOKEN",
     `CRM_HOST_PORT=${CRM_HOST_PORT}`,
     "",
     "# --- Wiki ---",

package/deploy/compose/init-db.sql

@@ -0,0 +1,55 @@
+-- exe-os database initialization — runs on first boot.
+-- Creates the exe superuser, schemas, and extensions.
+-- Idempotent: safe to run multiple times.
+
+-- Ensure exe user exists with superuser
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'exe') THEN
+    CREATE ROLE exe WITH LOGIN SUPERUSER PASSWORD current_setting('app.postgres_password', true);
+  ELSE
+    ALTER ROLE exe SUPERUSER;
+  END IF;
+END $$;
+
+-- Create extensions
+CREATE EXTENSION IF NOT EXISTS vector;
+CREATE EXTENSION IF NOT EXISTS pgcrypto;
+
+-- Create all schemas
+CREATE SCHEMA IF NOT EXISTS raw;
+CREATE SCHEMA IF NOT EXISTS graph;
+CREATE SCHEMA IF NOT EXISTS gateway;
+CREATE SCHEMA IF NOT EXISTS wiki;
+CREATE SCHEMA IF NOT EXISTS crm;
+CREATE SCHEMA IF NOT EXISTS auth;
+
+-- Grant exe full access to all schemas
+DO $$ DECLARE s text; BEGIN
+  FOR s IN SELECT schema_name FROM information_schema.schemata
+           WHERE schema_name NOT IN ('pg_catalog', 'information_schema', 'pg_toast')
+  LOOP
+    EXECUTE 'GRANT ALL ON SCHEMA ' || quote_ident(s) || ' TO exe';
+    EXECUTE 'GRANT ALL ON ALL TABLES IN SCHEMA ' || quote_ident(s) || ' TO exe';
+    EXECUTE 'GRANT ALL ON ALL SEQUENCES IN SCHEMA ' || quote_ident(s) || ' TO exe';
+    EXECUTE 'ALTER DEFAULT PRIVILEGES IN SCHEMA ' || quote_ident(s) || ' GRANT ALL ON TABLES TO exe';
+    EXECUTE 'ALTER DEFAULT PRIVILEGES IN SCHEMA ' || quote_ident(s) || ' GRANT ALL ON SEQUENCES TO exe';
+  END LOOP;
+END $$;
+
+-- Create raw.raw_events landing pad
+CREATE TABLE IF NOT EXISTS raw.raw_events (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  source TEXT NOT NULL,
+  source_id TEXT,
+  event_type TEXT NOT NULL,
+  payload JSONB NOT NULL,
+  metadata JSONB,
+  timestamp TIMESTAMPTZ DEFAULT now(),
+  created_at TIMESTAMPTZ DEFAULT now(),
+  processed_at TIMESTAMPTZ,
+  error TEXT,
+  projections JSONB DEFAULT '{}'::jsonb
+);
+
+CREATE INDEX IF NOT EXISTS idx_raw_events_unprocessed ON raw.raw_events (created_at) WHERE processed_at IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS uq_raw_events_dedup ON raw.raw_events (source, source_id, event_type);

package/dist/{active-agent-HDUT3T3I.js → active-agent-GHJBTJRF.js}

@@ -5,13 +5,13 @@ import {
   getAllActiveAgents,
   resolveActiveAgentFromTmuxSession,
   writeActiveAgent
-} from "./chunk-UHL4QL5E.js";
+} from "./chunk-77QEF6FR.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-MBYJEE3B.js";
-import "./chunk-EOO32RJZ.js";
+import "./chunk-EVB53OQD.js";
+import "./chunk-RVSGXGWG.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-TOWAZ5IV.js";
+import "./chunk-4GXRETYL.js";
 import "./chunk-LYH5HE24.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{active-agent-XHERKXH6.js → active-agent-RY74REEW.js}

@@ -6,13 +6,13 @@ import {
   getAllActiveAgents,
   resolveActiveAgentFromTmuxSession,
   writeActiveAgent
-} from "./chunk-UHL4QL5E.js";
+} from "./chunk-77QEF6FR.js";
 import "./chunk-CVYC6DUW.js";
 import "./chunk-GJV3WDWM.js";
-import "./chunk-MBYJEE3B.js";
-import "./chunk-EOO32RJZ.js";
+import "./chunk-EVB53OQD.js";
+import "./chunk-RVSGXGWG.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-TOWAZ5IV.js";
+import "./chunk-4GXRETYL.js";
 import "./chunk-LYH5HE24.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{agentic-ontology-GMK3MB3U.js → agentic-ontology-FP67RCR6.js}

@@ -9,7 +9,7 @@ import {
   insertOntologyForMemory,
   ontologyPayload,
   stableId
-} from "./chunk-OU7SLHNA.js";
+} from "./chunk-LKKKOWTH.js";
 import "./chunk-MLKGABMK.js";
 export {
   clean,

package/dist/{backfill-metadata-PPI5QFYW.js → backfill-metadata-W7FUQRD7.js}

@@ -2,18 +2,18 @@
 import {
   disposeStore,
   initStore
-} from "./chunk-25NSQUZ3.js";
-import "./chunk-BRXDLJBU.js";
+} from "./chunk-RTNRPBQP.js";
+import "./chunk-LZLXG7TK.js";
 import "./chunk-MP2AFCGL.js";
 import {
   getClient,
   getEmployeeNamesByRole,
   loadEmployeesSync
-} from "./chunk-MBYJEE3B.js";
-import "./chunk-EOO32RJZ.js";
+} from "./chunk-EVB53OQD.js";
+import "./chunk-RVSGXGWG.js";
 import "./chunk-FXU7JOXK.js";
 import "./chunk-6D23UNXU.js";
-import "./chunk-TOWAZ5IV.js";
+import "./chunk-4GXRETYL.js";
 import "./chunk-LYH5HE24.js";
 import {
   isMainModule

package/dist/{background-jobs-IUB22CRF.js → background-jobs-XYVQT4HN.js}

@@ -8,8 +8,8 @@ import {
   releaseJobLock,
   reniceCurrentProcess,
   startManagedJob
-} from "./chunk-6YUACQQA.js";
-import "./chunk-TOWAZ5IV.js";
+} from "./chunk-CTOQYEKJ.js";
+import "./chunk-4GXRETYL.js";
 import "./chunk-LYH5HE24.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/{behaviors-JG75DNG3.js → behaviors-KA64SSPT.js}

@@ -5,11 +5,11 @@ import {
   listBehaviorsSince,
   listSharedSkills,
   storeBehavior
-} from "./chunk-EOU4ZLRZ.js";
-import "./chunk-MBYJEE3B.js";
-import "./chunk-EOO32RJZ.js";
+} from "./chunk-SNN634YS.js";
+import "./chunk-EVB53OQD.js";
+import "./chunk-RVSGXGWG.js";
 import "./chunk-FXU7JOXK.js";
-import "./chunk-TOWAZ5IV.js";
+import "./chunk-4GXRETYL.js";
 import "./chunk-LYH5HE24.js";
 import "./chunk-MLKGABMK.js";
 export {

package/dist/bin/age-ontology-load.js

@@ -5,8 +5,8 @@ import {
 import {
   politeBatchPause,
   startManagedJob
-} from "../chunk-6YUACQQA.js";
-import "../chunk-TOWAZ5IV.js";
+} from "../chunk-CTOQYEKJ.js";
+import "../chunk-4GXRETYL.js";
 import "../chunk-LYH5HE24.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/bin/agentic-ontology-backfill.js

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import {
   insertOntologyForBatch
-} from "../chunk-OU7SLHNA.js";
+} from "../chunk-LKKKOWTH.js";
 import {
   politeBatchPause,
   startManagedJob
-} from "../chunk-6YUACQQA.js";
+} from "../chunk-CTOQYEKJ.js";
 import {
   disposeStore,
   initStore
-} from "../chunk-25NSQUZ3.js";
-import "../chunk-BRXDLJBU.js";
+} from "../chunk-RTNRPBQP.js";
+import "../chunk-LZLXG7TK.js";
 import "../chunk-MP2AFCGL.js";
 import {
   getClient
-} from "../chunk-MBYJEE3B.js";
-import "../chunk-EOO32RJZ.js";
+} from "../chunk-EVB53OQD.js";
+import "../chunk-RVSGXGWG.js";
 import "../chunk-FXU7JOXK.js";
 import "../chunk-6D23UNXU.js";
-import "../chunk-TOWAZ5IV.js";
+import "../chunk-4GXRETYL.js";
 import "../chunk-LYH5HE24.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/bin/agentic-reflection-backfill.js

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
 import {
   generateReflectionCheckpoints
-} from "../chunk-MNIJA5BL.js";
-import "../chunk-OU7SLHNA.js";
+} from "../chunk-LVWXGZER.js";
+import "../chunk-LKKKOWTH.js";
 import {
   startManagedJob
-} from "../chunk-6YUACQQA.js";
+} from "../chunk-CTOQYEKJ.js";
 import {
   initStore
-} from "../chunk-25NSQUZ3.js";
-import "../chunk-BRXDLJBU.js";
+} from "../chunk-RTNRPBQP.js";
+import "../chunk-LZLXG7TK.js";
 import "../chunk-MP2AFCGL.js";
-import "../chunk-MBYJEE3B.js";
-import "../chunk-EOO32RJZ.js";
+import "../chunk-EVB53OQD.js";
+import "../chunk-RVSGXGWG.js";
 import "../chunk-FXU7JOXK.js";
 import "../chunk-6D23UNXU.js";
-import "../chunk-TOWAZ5IV.js";
+import "../chunk-4GXRETYL.js";
 import "../chunk-LYH5HE24.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/bin/agentic-semantic-label.js

@@ -3,23 +3,23 @@ import {
   clean,
   inferSemanticLabel,
   stableId
-} from "../chunk-OU7SLHNA.js";
+} from "../chunk-LKKKOWTH.js";
 import {
   politeBatchPause,
   startManagedJob
-} from "../chunk-6YUACQQA.js";
+} from "../chunk-CTOQYEKJ.js";
 import {
   initStore
-} from "../chunk-25NSQUZ3.js";
-import "../chunk-BRXDLJBU.js";
+} from "../chunk-RTNRPBQP.js";
+import "../chunk-LZLXG7TK.js";
 import "../chunk-MP2AFCGL.js";
 import {
   getClient
-} from "../chunk-MBYJEE3B.js";
-import "../chunk-EOO32RJZ.js";
+} from "../chunk-EVB53OQD.js";
+import "../chunk-RVSGXGWG.js";
 import "../chunk-FXU7JOXK.js";
 import "../chunk-6D23UNXU.js";
-import "../chunk-TOWAZ5IV.js";
+import "../chunk-4GXRETYL.js";
 import "../chunk-LYH5HE24.js";
 import "../chunk-MLKGABMK.js";
 

package/dist/bin/backfill-conversations.js

@@ -2,24 +2,24 @@
 import {
   connectEmbedDaemon,
   embedViaClient
-} from "../chunk-W6SKR3HZ.js";
+} from "../chunk-E2O7YYDS.js";
 import "../chunk-3H4VU65X.js";
-import "../chunk-K4KAPZC7.js";
+import "../chunk-CMFLJNP6.js";
 import {
   flushBatch,
   initStore,
   writeMemory
-} from "../chunk-25NSQUZ3.js";
-import "../chunk-BRXDLJBU.js";
+} from "../chunk-RTNRPBQP.js";
+import "../chunk-LZLXG7TK.js";
 import "../chunk-MP2AFCGL.js";
 import {
   getClient,
   isCoordinatorName
-} from "../chunk-MBYJEE3B.js";
-import "../chunk-EOO32RJZ.js";
+} from "../chunk-EVB53OQD.js";
+import "../chunk-RVSGXGWG.js";
 import "../chunk-FXU7JOXK.js";
 import "../chunk-6D23UNXU.js";
-import "../chunk-TOWAZ5IV.js";
+import "../chunk-4GXRETYL.js";
 import "../chunk-LYH5HE24.js";
 import {
   isMainModule