@meyicloud/meyi-insight-server 1.0.0

package/dist/migrations/run.js

@@ -0,0 +1,1262 @@
+import { sql } from "drizzle-orm";
+import yaml from "js-yaml";
+/**
+ * Run all DDL migrations for the Insight plugin.
+ * Safe to run on every start - all statements use IF NOT EXISTS / IF EXISTS guards.
+ */
+export async function runMigrations(db) {
+    const defaultTenantId = (process.env.INSIGHT_DEFAULT_TENANT_ID || "default").trim() || "default";
+    const defaultTenantSql = defaultTenantId.replace(/'/g, "''");
+    const defaultTokenTtlDaysRaw = Number.parseInt(process.env.INSIGHT_WEBHOOK_TOKEN_DEFAULT_DAYS || "30", 10);
+    const defaultTokenTtlDays = Number.isFinite(defaultTokenTtlDaysRaw) && defaultTokenTtlDaysRaw > 0
+        ? defaultTokenTtlDaysRaw
+        : 30;
+    // Rename tables and columns if they exist from the old 'connector' naming convention
+    await db.execute(sql.raw(`
+    DO $$
+    BEGIN
+      -- Rename main table
+      IF EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'meyiconnect' AND table_name = 'insight_connectors') THEN
+        IF NOT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'meyiconnect' AND table_name = 'insight_sources') THEN
+          EXECUTE 'ALTER TABLE "meyiconnect"."insight_connectors" RENAME TO "insight_sources"';
+        END IF;
+      END IF;
+
+      -- Rename CloudWatch setups
+      IF EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'meyiconnect' AND table_name = 'insight_cloudwatch_connector_setups') THEN
+        IF NOT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'meyiconnect' AND table_name = 'insight_cloudwatch_source_setups') THEN
+          EXECUTE 'ALTER TABLE "meyiconnect"."insight_cloudwatch_connector_setups" RENAME TO "insight_cloudwatch_source_setups"';
+          EXECUTE 'ALTER TABLE "meyiconnect"."insight_cloudwatch_source_setups" RENAME COLUMN "connector_id" TO "source_id"';
+        END IF;
+      END IF;
+
+      -- Rename CloudTrail setups
+      IF EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'meyiconnect' AND table_name = 'insight_cloudtrail_connector_setups') THEN
+        IF NOT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'meyiconnect' AND table_name = 'insight_cloudtrail_source_setups') THEN
+          EXECUTE 'ALTER TABLE "meyiconnect"."insight_cloudtrail_connector_setups" RENAME TO "insight_cloudtrail_source_setups"';
+          EXECUTE 'ALTER TABLE "meyiconnect"."insight_cloudtrail_source_setups" RENAME COLUMN "connector_id" TO "source_id"';
+        END IF;
+      END IF;
+
+      -- Rename Grafana setups
+      IF EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'meyiconnect' AND table_name = 'insight_grafana_connector_setups') THEN
+        IF NOT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'meyiconnect' AND table_name = 'insight_grafana_source_setups') THEN
+          EXECUTE 'ALTER TABLE "meyiconnect"."insight_grafana_connector_setups" RENAME TO "insight_grafana_source_setups"';
+          EXECUTE 'ALTER TABLE "meyiconnect"."insight_grafana_source_setups" RENAME COLUMN "connector_id" TO "source_id"';
+        END IF;
+      END IF;
+
+      -- Rename Prometheus setups
+      IF EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'meyiconnect' AND table_name = 'insight_prometheus_connector_setups') THEN
+        IF NOT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'meyiconnect' AND table_name = 'insight_prometheus_source_setups') THEN
+          EXECUTE 'ALTER TABLE "meyiconnect"."insight_prometheus_connector_setups" RENAME TO "insight_prometheus_source_setups"';
+          EXECUTE 'ALTER TABLE "meyiconnect"."insight_prometheus_source_setups" RENAME COLUMN "connector_id" TO "source_id"';
+        END IF;
+      END IF;
+
+      -- Rename Connector Health
+      IF EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'meyiconnect' AND table_name = 'insight_connector_health') THEN
+        IF NOT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_schema = 'meyiconnect' AND table_name = 'insight_source_health') THEN
+          EXECUTE 'ALTER TABLE "meyiconnect"."insight_connector_health" RENAME TO "insight_source_health"';
+          EXECUTE 'ALTER TABLE "meyiconnect"."insight_source_health" RENAME COLUMN "connector_id" TO "source_id"';
+        END IF;
+      END IF;
+
+      -- Rename Webhook Failure Logs
+      IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = 'meyiconnect' AND table_name = 'insight_webhook_failure_logs' AND column_name = 'connector_id') THEN
+        EXECUTE 'ALTER TABLE "meyiconnect"."insight_webhook_failure_logs" RENAME COLUMN "connector_id" TO "source_id"';
+      END IF;
+
+      -- Rename columns in alerts
+      IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = 'meyiconnect' AND table_name = 'insight_alerts' AND column_name = 'connector_id') THEN
+        EXECUTE 'ALTER TABLE "meyiconnect"."insight_alerts" RENAME COLUMN "connector_id" TO "source_id"';
+        EXECUTE 'ALTER TABLE "meyiconnect"."insight_alerts" RENAME COLUMN "connector_name" TO "source_name"';
+        EXECUTE 'ALTER TABLE "meyiconnect"."insight_alerts" RENAME COLUMN "connector_type" TO "source_type"';
+      END IF;
+
+      -- Rename columns in configs
+      IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = 'meyiconnect' AND table_name = 'insight_normalization_configs' AND column_name = 'connector_id') THEN
+        EXECUTE 'ALTER TABLE "meyiconnect"."insight_normalization_configs" RENAME COLUMN "connector_id" TO "source_id"';
+        EXECUTE 'ALTER TABLE "meyiconnect"."insight_normalization_configs" RENAME COLUMN "connector_type" TO "source_type"';
+      END IF;
+
+      IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = 'meyiconnect' AND table_name = 'insight_dedup_configs' AND column_name = 'connector_id') THEN
+        EXECUTE 'ALTER TABLE "meyiconnect"."insight_dedup_configs" RENAME COLUMN "connector_id" TO "source_id"';
+        EXECUTE 'ALTER TABLE "meyiconnect"."insight_dedup_configs" RENAME COLUMN "connector_type" TO "source_type"';
+      END IF;
+
+      IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = 'meyiconnect' AND table_name = 'insight_grouping_configs' AND column_name = 'connector_id') THEN
+        EXECUTE 'ALTER TABLE "meyiconnect"."insight_grouping_configs" RENAME COLUMN "connector_id" TO "source_id"';
+        EXECUTE 'ALTER TABLE "meyiconnect"."insight_grouping_configs" RENAME COLUMN "connector_type" TO "source_type"';
+      END IF;
+
+    END $$;
+  `));
+    await db.execute(sql.raw(`
+    DO $$
+    DECLARE
+      v_relkind "char";
+    BEGIN
+      SELECT c.relkind INTO v_relkind
+      FROM pg_class c
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE n.nspname = 'meyiconnect' AND c.relname = 'insight_tenants'
+      LIMIT 1;
+
+      IF v_relkind IS NULL THEN
+        CREATE TABLE "meyiconnect"."insight_tenants" (
+          "id" TEXT PRIMARY KEY,
+          "name" TEXT NOT NULL,
+          "is_default" BOOLEAN NOT NULL DEFAULT false,
+          "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+          "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+        );
+        INSERT INTO "meyiconnect"."insight_tenants" ("id", "name", "is_default")
+        VALUES ('${defaultTenantSql}', 'Default tenant', true)
+        ON CONFLICT ("id") DO UPDATE SET "is_default" = true, "updated_at" = NOW();
+      ELSIF v_relkind = 'r' THEN
+        INSERT INTO "meyiconnect"."insight_tenants" ("id", "name", "is_default")
+        VALUES ('${defaultTenantSql}', 'Default tenant', true)
+        ON CONFLICT ("id") DO UPDATE SET "is_default" = true, "updated_at" = NOW();
+      END IF;
+    END $$;
+  `));
+    // insight_sources
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_sources" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "name" TEXT NOT NULL,
+      "type" TEXT NOT NULL,
+      "webhook_token" TEXT NOT NULL,
+      "webhook_auth_token" TEXT,
+      "webhook_token_never_expires" BOOLEAN NOT NULL DEFAULT false,
+      "webhook_token_expires_at" TIMESTAMPTZ,
+      "is_active" BOOLEAN NOT NULL DEFAULT true,
+      "description" TEXT,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`
+    DO $$
+    BEGIN
+      IF EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_sources' AND column_name = 'tenant_id' AND data_type = 'uuid'
+      ) THEN
+        ALTER TABLE "meyiconnect"."insight_sources" ALTER COLUMN "tenant_id" TYPE TEXT USING "tenant_id"::TEXT;
+      ELSIF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_sources' AND column_name = 'tenant_id'
+      ) THEN
+        ALTER TABLE "meyiconnect"."insight_sources" ADD COLUMN "tenant_id" TEXT;
+      END IF;
+    END $$;
+  `));
+    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_sources" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id"::text = ''`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_sources_tenant_id_idx ON "meyiconnect"."insight_sources" ("tenant_id")`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sources" ADD COLUMN IF NOT EXISTS "webhook_token_never_expires" BOOLEAN NOT NULL DEFAULT false`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sources" ADD COLUMN IF NOT EXISTS "webhook_token_expires_at" TIMESTAMPTZ`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sources" ADD COLUMN IF NOT EXISTS "is_active" BOOLEAN NOT NULL DEFAULT true`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sources" ADD COLUMN IF NOT EXISTS "description" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sources" ALTER COLUMN "webhook_token_expires_at" SET DEFAULT (NOW() + INTERVAL '${defaultTokenTtlDays} days')`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sources" DROP COLUMN IF EXISTS "config"`));
+    await db.execute(sql.raw(`
+    UPDATE "meyiconnect"."insight_sources"
+    SET "webhook_token" = gen_random_uuid()::TEXT
+    WHERE "webhook_token" IS NULL
+  `));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sources" ALTER COLUMN "webhook_token" SET NOT NULL`)).catch(() => { });
+    await db.execute(sql.raw(`
+    UPDATE "meyiconnect"."insight_sources"
+    SET "webhook_token_expires_at" = NOW() + INTERVAL '${defaultTokenTtlDays} days'
+    WHERE COALESCE("webhook_token_never_expires", FALSE) = FALSE
+      AND "webhook_token_expires_at" IS NULL
+  `));
+    await db.execute(sql.raw(`
+    CREATE UNIQUE INDEX IF NOT EXISTS insight_sources_webhook_token_unique
+    ON "meyiconnect"."insight_sources" ("webhook_token")
+  `));
+    // CloudWatch source setup lives in a dedicated one-to-one table.
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_cloudwatch_source_setups" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "source_id" UUID NOT NULL REFERENCES "meyiconnect"."insight_sources"("id") ON DELETE CASCADE,
+      "aws_access_key_id" TEXT,
+      "aws_secret_access_key" TEXT,
+      "aws_session_token" TEXT,
+      "aws_region" TEXT,
+      "aws_stack_name" TEXT,
+      "aws_lambda_name" TEXT,
+      "aws_alarm_name_prefix" TEXT,
+      "aws_selected_alarm_names" JSONB DEFAULT '[]',
+      "aws_selected_metric_keys" JSONB DEFAULT '[]',
+      "aws_deployment_status" TEXT NOT NULL DEFAULT 'not_started',
+      "aws_deployment_status_reason" TEXT,
+      "aws_stack_id" TEXT,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`CREATE UNIQUE INDEX IF NOT EXISTS insight_cloudwatch_source_setups_source_unique ON "meyiconnect"."insight_cloudwatch_source_setups" ("source_id")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_cloudwatch_source_setups_status_idx ON "meyiconnect"."insight_cloudwatch_source_setups" ("aws_deployment_status")`));
+    // CloudTrail source setup — dedicated one-to-one side-table (same pattern as cloudwatch).
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_cloudtrail_source_setups" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "source_id" UUID NOT NULL REFERENCES "meyiconnect"."insight_sources"("id") ON DELETE CASCADE,
+      "aws_region" TEXT,
+      "aws_stack_name" TEXT,
+      "aws_create_new_trail" BOOLEAN NOT NULL DEFAULT true,
+      "aws_deployment_status" TEXT NOT NULL DEFAULT 'not_started',
+      "aws_deployment_status_reason" TEXT,
+      "aws_stack_id" TEXT,
+      "aws_deployment_mode" TEXT DEFAULT 'Organizations',
+      "aws_target_ous" TEXT,
+      "aws_target_accounts" TEXT,
+      "aws_target_regions" TEXT,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`CREATE UNIQUE INDEX IF NOT EXISTS insight_cloudtrail_source_setups_source_unique ON "meyiconnect"."insight_cloudtrail_source_setups" ("source_id")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_cloudtrail_source_setups_status_idx ON "meyiconnect"."insight_cloudtrail_source_setups" ("aws_deployment_status")`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_cloudtrail_source_setups" ADD COLUMN IF NOT EXISTS "aws_create_new_trail" BOOLEAN NOT NULL DEFAULT true`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_cloudtrail_source_setups" ADD COLUMN IF NOT EXISTS "aws_deployment_mode" TEXT DEFAULT 'Organizations'`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_cloudtrail_source_setups" ADD COLUMN IF NOT EXISTS "aws_target_ous" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_cloudtrail_source_setups" ADD COLUMN IF NOT EXISTS "aws_target_accounts" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_cloudtrail_source_setups" ADD COLUMN IF NOT EXISTS "aws_target_regions" TEXT`));
+    await db.execute(sql.raw(`
+    DO $$
+    BEGIN
+      IF EXISTS (
+        SELECT 1
+        FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect'
+          AND table_name = 'insight_sources'
+          AND column_name = 'aws_region'
+      ) THEN
+        INSERT INTO "meyiconnect"."insight_cloudwatch_source_setups" (
+          "source_id",
+          "aws_access_key_id",
+          "aws_secret_access_key",
+          "aws_session_token",
+          "aws_region",
+          "aws_stack_name",
+          "aws_lambda_name",
+          "aws_alarm_name_prefix",
+          "aws_selected_alarm_names",
+          "aws_selected_metric_keys",
+          "aws_deployment_status",
+          "aws_deployment_status_reason",
+          "aws_stack_id",
+          "created_at",
+          "updated_at"
+        )
+        SELECT
+          "id",
+          "aws_access_key_id",
+          "aws_secret_access_key",
+          "aws_session_token",
+          "aws_region",
+          "aws_stack_name",
+          "aws_lambda_name",
+          "aws_alarm_name_prefix",
+          COALESCE("aws_selected_alarm_names", '[]'::jsonb),
+          COALESCE("aws_selected_metric_keys", '[]'::jsonb),
+          COALESCE("aws_deployment_status", 'not_started'),
+          "aws_deployment_status_reason",
+          "aws_stack_id",
+          NOW(),
+          NOW()
+        FROM "meyiconnect"."insight_sources"
+        WHERE "type" = 'cloudwatch'
+          AND (
+            "aws_access_key_id" IS NOT NULL OR
+            "aws_secret_access_key" IS NOT NULL OR
+            "aws_session_token" IS NOT NULL OR
+            "aws_region" IS NOT NULL OR
+            "aws_stack_name" IS NOT NULL OR
+            "aws_lambda_name" IS NOT NULL OR
+            "aws_alarm_name_prefix" IS NOT NULL OR
+            "aws_deployment_status" IS NOT NULL OR
+            "aws_stack_id" IS NOT NULL
+          )
+        ON CONFLICT ("source_id") DO UPDATE SET
+          "aws_access_key_id" = EXCLUDED."aws_access_key_id",
+          "aws_secret_access_key" = EXCLUDED."aws_secret_access_key",
+          "aws_session_token" = EXCLUDED."aws_session_token",
+          "aws_region" = EXCLUDED."aws_region",
+          "aws_stack_name" = EXCLUDED."aws_stack_name",
+          "aws_lambda_name" = EXCLUDED."aws_lambda_name",
+          "aws_alarm_name_prefix" = EXCLUDED."aws_alarm_name_prefix",
+          "aws_selected_alarm_names" = EXCLUDED."aws_selected_alarm_names",
+          "aws_selected_metric_keys" = EXCLUDED."aws_selected_metric_keys",
+          "aws_deployment_status" = EXCLUDED."aws_deployment_status",
+          "aws_deployment_status_reason" = EXCLUDED."aws_deployment_status_reason",
+          "aws_stack_id" = EXCLUDED."aws_stack_id",
+          "updated_at" = NOW();
+      END IF;
+    END $$;
+  `));
+    await db.execute(sql.raw(`
+    ALTER TABLE "meyiconnect"."insight_sources"
+      DROP COLUMN IF EXISTS "aws_access_key_id",
+      DROP COLUMN IF EXISTS "aws_secret_access_key",
+      DROP COLUMN IF EXISTS "aws_session_token",
+      DROP COLUMN IF EXISTS "aws_region",
+      DROP COLUMN IF EXISTS "aws_stack_name",
+      DROP COLUMN IF EXISTS "aws_lambda_name",
+      DROP COLUMN IF EXISTS "aws_alarm_name_prefix",
+      DROP COLUMN IF EXISTS "aws_selected_alarm_names",
+      DROP COLUMN IF EXISTS "aws_selected_metric_keys",
+      DROP COLUMN IF EXISTS "aws_deployment_status",
+      DROP COLUMN IF EXISTS "aws_deployment_status_reason",
+      DROP COLUMN IF EXISTS "aws_stack_id"
+  `));
+    // Grafana source setup lives in a dedicated one-to-one table.
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_grafana_source_setups" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "source_id" UUID NOT NULL REFERENCES "meyiconnect"."insight_sources"("id") ON DELETE CASCADE,
+      "grafana_base_url" TEXT,
+      "grafana_contact_point_name" TEXT,
+      "grafana_account_token_encrypted" TEXT,
+      "grafana_auto_route" BOOLEAN NOT NULL DEFAULT false,
+      "grafana_matcher_label" TEXT,
+      "grafana_matcher_value" TEXT,
+      "grafana_policy_updated" BOOLEAN NOT NULL DEFAULT false,
+      "grafana_setup_status" TEXT NOT NULL DEFAULT 'not_started',
+      "grafana_setup_status_reason" TEXT,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_grafana_source_setups" ADD COLUMN IF NOT EXISTS "grafana_account_token_encrypted" TEXT`));
+    await db.execute(sql.raw(`CREATE UNIQUE INDEX IF NOT EXISTS insight_grafana_source_setups_source_unique ON "meyiconnect"."insight_grafana_source_setups" ("source_id")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_grafana_source_setups_status_idx ON "meyiconnect"."insight_grafana_source_setups" ("grafana_setup_status")`));
+    // Prometheus source setup lives in a dedicated one-to-one table.
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_prometheus_source_setups" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "source_id" UUID NOT NULL REFERENCES "meyiconnect"."insight_sources"("id") ON DELETE CASCADE,
+      "prometheus_environment" TEXT,
+      "prometheus_receiver_name" TEXT,
+      "prometheus_base_url" TEXT,
+      "alertmanager_base_url" TEXT,
+      "prometheus_setup_status" TEXT NOT NULL DEFAULT 'not_started',
+      "prometheus_setup_status_reason" TEXT,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_prometheus_source_setups" ADD COLUMN IF NOT EXISTS "prometheus_base_url" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_prometheus_source_setups" ADD COLUMN IF NOT EXISTS "alertmanager_base_url" TEXT`));
+    await db.execute(sql.raw(`CREATE UNIQUE INDEX IF NOT EXISTS insight_prometheus_source_setups_source_unique ON "meyiconnect"."insight_prometheus_source_setups" ("source_id")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_prometheus_source_setups_status_idx ON "meyiconnect"."insight_prometheus_source_setups" ("prometheus_setup_status")`));
+    // Source observability: one health row per source + failed webhook log.
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_source_health" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "source_id" UUID NOT NULL REFERENCES "meyiconnect"."insight_sources"("id") ON DELETE CASCADE,
+      "delivery_status" TEXT NOT NULL DEFAULT 'unknown',
+      "last_webhook_received_at" TIMESTAMPTZ,
+      "last_successful_webhook_at" TIMESTAMPTZ,
+      "last_failed_webhook_at" TIMESTAMPTZ,
+      "last_error_code" TEXT,
+      "last_error_message" TEXT,
+      "last_alert_id" UUID,
+      "success_count" INTEGER NOT NULL DEFAULT 0,
+      "failure_count" INTEGER NOT NULL DEFAULT 0,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`CREATE UNIQUE INDEX IF NOT EXISTS insight_source_health_source_unique ON "meyiconnect"."insight_source_health" ("source_id")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_source_health_status_idx ON "meyiconnect"."insight_source_health" ("delivery_status")`));
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_webhook_failure_logs" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "source_id" UUID REFERENCES "meyiconnect"."insight_sources"("id") ON DELETE SET NULL,
+      "token_hash" TEXT,
+      "token_preview" TEXT,
+      "error_code" TEXT NOT NULL,
+      "error_message" TEXT NOT NULL,
+      "request_ip" TEXT,
+      "user_agent" TEXT,
+      "method" TEXT,
+      "path" TEXT,
+      "payload" JSONB,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_webhook_failure_logs_source_idx ON "meyiconnect"."insight_webhook_failure_logs" ("source_id")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_webhook_failure_logs_error_idx ON "meyiconnect"."insight_webhook_failure_logs" ("error_code")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_webhook_failure_logs_created_idx ON "meyiconnect"."insight_webhook_failure_logs" ("created_at")`));
+    // insight_projects
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_projects" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "name" TEXT NOT NULL,
+      "tag" TEXT NOT NULL,
+      "description" TEXT,
+      "dependencies" JSONB DEFAULT '[]',
+      "aws_access_key_id" TEXT,
+      "aws_secret_access_key" TEXT,
+      "aws_region" TEXT,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`
+    DO $$
+    BEGIN
+      IF EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_projects' AND column_name = 'tenant_id' AND data_type = 'uuid'
+      ) THEN
+        ALTER TABLE "meyiconnect"."insight_projects" ALTER COLUMN "tenant_id" TYPE TEXT USING "tenant_id"::TEXT;
+      ELSIF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_projects' AND column_name = 'tenant_id'
+      ) THEN
+        ALTER TABLE "meyiconnect"."insight_projects" ADD COLUMN "tenant_id" TEXT;
+      END IF;
+    END $$;
+  `));
+    await db.execute(sql.raw(`
+    ALTER TABLE "meyiconnect"."insight_projects"
+    ADD COLUMN IF NOT EXISTS "aws_access_key_id" TEXT,
+    ADD COLUMN IF NOT EXISTS "aws_secret_access_key" TEXT,
+    ADD COLUMN IF NOT EXISTS "aws_region" TEXT
+  `));
+    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_projects" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id"::text = ''`));
+    await db.execute(sql.raw(`DROP INDEX IF EXISTS "meyiconnect"."insight_projects_tag_unique"`)).catch(() => { });
+    await db.execute(sql.raw(`DROP INDEX IF EXISTS insight_projects_tag_unique`)).catch(() => { });
+    await db.execute(sql.raw(`CREATE UNIQUE INDEX IF NOT EXISTS insight_projects_tenant_tag_unique ON "meyiconnect"."insight_projects" ("tenant_id", "tag")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_projects_tag_idx ON "meyiconnect"."insight_projects" ("tag")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_projects_tenant_id_idx ON "meyiconnect"."insight_projects" ("tenant_id")`));
+    // insight_incidents
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_incidents" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "alias_id" SERIAL,
+      "monitor_id" TEXT,
+      "monitor_name" TEXT,
+      "monitor_type" TEXT,
+      "monitor_url" TEXT,
+      "name" TEXT NOT NULL DEFAULT '',
+      "source" TEXT NOT NULL DEFAULT '',
+      "resource_name" TEXT NOT NULL DEFAULT '',
+      "resource_type" TEXT NOT NULL DEFAULT '',
+      "down_message" TEXT,
+      "project_tag" TEXT,
+      "down_time" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "incident_down_time" TEXT NOT NULL DEFAULT '',
+      "resolved_at" TIMESTAMPTZ,
+      "analysis_status" TEXT NOT NULL DEFAULT 'pending',
+      "analysis_percent" INTEGER NOT NULL DEFAULT 0,
+      "analysis_triggered_at" TIMESTAMPTZ,
+      "analysis_completed_at" TIMESTAMPTZ,
+      "analysis_result" JSONB,
+      "remediation_steps" JSONB DEFAULT '[]',
+      "confidence_score" REAL,
+      "ai_model_used" TEXT,
+      "source_alert_id" UUID,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_incidents_monitor_id_idx ON "meyiconnect"."insight_incidents" ("monitor_id")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_incidents_status_idx ON "meyiconnect"."insight_incidents" ("analysis_status")`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "alias_id" SERIAL`));
+    await db.execute(sql.raw(`
+    DO $$
+    BEGIN
+      IF EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_incidents' AND column_name = 'tenant_id' AND data_type = 'uuid'
+      ) THEN
+        ALTER TABLE "meyiconnect"."insight_incidents" ALTER COLUMN "tenant_id" TYPE TEXT USING "tenant_id"::TEXT;
+      ELSIF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_incidents' AND column_name = 'tenant_id'
+      ) THEN
+        ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN "tenant_id" TEXT;
+      END IF;
+    END $$;
+  `));
+    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_incidents" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id"::text = ''`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_incidents_tenant_id_idx ON "meyiconnect"."insight_incidents" ("tenant_id")`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "incident_down_time" TEXT NOT NULL DEFAULT ''`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "name" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "source" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "resource_name" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "resource_type" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "down_time" TIMESTAMPTZ`));
+    await db.execute(sql.raw(`
+    DO $$
+    BEGIN
+      UPDATE "meyiconnect"."insight_incidents" SET "name" = COALESCE("monitor_name", 'Unknown') WHERE "name" IS NULL;
+      UPDATE "meyiconnect"."insight_incidents" SET "source" = 'Unknown' WHERE "source" IS NULL;
+      UPDATE "meyiconnect"."insight_incidents" SET "resource_name" = COALESCE("monitor_name", 'Unknown') WHERE "resource_name" IS NULL;
+      UPDATE "meyiconnect"."insight_incidents" SET "resource_type" = COALESCE("monitor_type", 'Unknown') WHERE "resource_type" IS NULL;
+      UPDATE "meyiconnect"."insight_incidents" SET "down_time" = "created_at" WHERE "down_time" IS NULL;
+
+      ALTER TABLE "meyiconnect"."insight_incidents" ALTER COLUMN "name" SET NOT NULL;
+      ALTER TABLE "meyiconnect"."insight_incidents" ALTER COLUMN "source" SET NOT NULL;
+      ALTER TABLE "meyiconnect"."insight_incidents" ALTER COLUMN "resource_name" SET NOT NULL;
+      ALTER TABLE "meyiconnect"."insight_incidents" ALTER COLUMN "resource_type" SET NOT NULL;
+      ALTER TABLE "meyiconnect"."insight_incidents" ALTER COLUMN "down_time" SET NOT NULL;
+      
+      -- Remove NOT NULL from old columns if they exist
+      IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = 'meyiconnect' AND table_name = 'insight_incidents' AND column_name = 'monitor_id') THEN
+        ALTER TABLE "meyiconnect"."insight_incidents" ALTER COLUMN "monitor_id" DROP NOT NULL;
+        ALTER TABLE "meyiconnect"."insight_incidents" ALTER COLUMN "monitor_name" DROP NOT NULL;
+        ALTER TABLE "meyiconnect"."insight_incidents" ALTER COLUMN "monitor_type" DROP NOT NULL;
+      END IF;
+    END $$;
+  `));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "status" TEXT NOT NULL DEFAULT 'open'`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "analysis_percent" INTEGER NOT NULL DEFAULT 0`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "remediation_steps" JSONB DEFAULT '[]'`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "confidence_score" REAL`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "ai_model_used" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "source_alert_id" UUID`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "assignee_ids" JSONB DEFAULT '[]'::jsonb`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" DROP COLUMN IF EXISTS "processing_status"`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" DROP COLUMN IF EXISTS "progress_percent"`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "account_id" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "account_name" TEXT`));
+    await db.execute(sql.raw(`
+    UPDATE "meyiconnect"."insight_incidents" i
+    SET "account_name" = c."account_name"
+    FROM "meyiconnect"."connectors" c
+    WHERE i."account_name" IS NULL
+      AND i."account_id" IS NOT NULL
+      AND i."account_id" = c."account_id";
+  `));
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."incident_comments" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "incident_id" UUID NOT NULL REFERENCES "meyiconnect"."insight_incidents"("id") ON DELETE CASCADE,
+      "author_id" TEXT,
+      "author_name" TEXT,
+      "message" TEXT NOT NULL,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS incident_comments_incident_id_idx ON "meyiconnect"."incident_comments" ("incident_id")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS incident_comments_created_at_idx ON "meyiconnect"."incident_comments" ("created_at")`));
+    // insight_alerts
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_alerts" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "tenant_id" TEXT,
+      "source_id" UUID,
+      "source_name" TEXT,
+      "source_type" TEXT,
+      "resource_id" TEXT NOT NULL,
+      "resource_name" TEXT NOT NULL,
+      "resource_type" TEXT NOT NULL,
+      "project_tag" TEXT,
+      "severity" TEXT NOT NULL DEFAULT 'high',
+      "alert_name" TEXT NOT NULL,
+      "description" TEXT,
+      "additional_configuration" JSONB,
+      "status" TEXT NOT NULL DEFAULT 'open',
+      "converted_incident_id" UUID,
+      "incident_id" UUID,
+      "alias_id" TEXT,
+      "assignee_id" UUID,
+      "down_time" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "dup_count" INT NOT NULL DEFAULT 0,
+      "last_dup_at" TIMESTAMPTZ,
+      "fingerprint" TEXT,
+      "dedup_key" TEXT,
+      "pipeline_status" TEXT DEFAULT 'queued',
+      "group_id" UUID,
+      "raw_payload" JSONB
+    )
+  `));
+    await db.execute(sql.raw(`
+    DO $$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_alerts' AND column_name = 'alert_name'
+      ) THEN
+        ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN "alert_name" TEXT;
+      END IF;
+
+      IF EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_alerts' AND column_name = 'title'
+      ) THEN
+        ALTER TABLE "meyiconnect"."insight_alerts" ALTER COLUMN "title" DROP NOT NULL;
+        ALTER TABLE "meyiconnect"."insight_alerts" ALTER COLUMN "title" SET DEFAULT 'Alert';
+        UPDATE "meyiconnect"."insight_alerts"
+        SET "alert_name" = COALESCE("alert_name", "title", 'Alert')
+        WHERE "alert_name" IS NULL;
+      ELSE
+        UPDATE "meyiconnect"."insight_alerts"
+        SET "alert_name" = COALESCE("alert_name", 'Alert')
+        WHERE "alert_name" IS NULL;
+      END IF;
+
+      ALTER TABLE "meyiconnect"."insight_alerts" ALTER COLUMN "alert_name" SET NOT NULL;
+    END $$;
+  `));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "project_tag" TEXT`));
+    await db.execute(sql.raw(`
+    DO $$
+    BEGIN
+      IF EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_alerts' AND column_name = 'tenant_id' AND data_type = 'uuid'
+      ) THEN
+        ALTER TABLE "meyiconnect"."insight_alerts" ALTER COLUMN "tenant_id" TYPE TEXT USING "tenant_id"::TEXT;
+      ELSIF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_alerts' AND column_name = 'tenant_id'
+      ) THEN
+        ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN "tenant_id" TEXT;
+      END IF;
+    END $$;
+  `));
+    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_alerts" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id"::text = ''`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_alerts_tenant_id_idx ON "meyiconnect"."insight_alerts" ("tenant_id")`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "alias_id" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "additional_configuration" JSONB`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "incident_id" UUID`));
+    await db.execute(sql.raw(`
+    DO $$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_alerts' AND column_name = 'down_time'
+      ) THEN
+        ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN "down_time" TIMESTAMPTZ;
+      END IF;
+
+      IF EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_alerts' AND column_name = 'alert_time'
+      ) THEN
+        UPDATE "meyiconnect"."insight_alerts"
+        SET "down_time" = COALESCE("down_time", "alert_time", NOW())
+        WHERE "down_time" IS NULL;
+      ELSE
+        UPDATE "meyiconnect"."insight_alerts"
+        SET "down_time" = COALESCE("down_time", NOW())
+        WHERE "down_time" IS NULL;
+      END IF;
+
+      ALTER TABLE "meyiconnect"."insight_alerts" ALTER COLUMN "down_time" SET NOT NULL;
+      ALTER TABLE "meyiconnect"."insight_alerts" ALTER COLUMN "down_time" SET DEFAULT NOW();
+    END $$;
+  `));
+    await db.execute(sql.raw(`
+    DO $$
+    BEGIN
+      IF EXISTS (
+        SELECT 1 FROM information_schema.columns 
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_alerts' AND column_name = 'promoted_incident_id'
+      ) THEN
+        IF NOT EXISTS (
+          SELECT 1 FROM information_schema.columns 
+          WHERE table_schema = 'meyiconnect' AND table_name = 'insight_alerts' AND column_name = 'converted_incident_id'
+        ) THEN
+          ALTER TABLE "meyiconnect"."insight_alerts" RENAME COLUMN "promoted_incident_id" TO "converted_incident_id";
+        ELSE
+          ALTER TABLE "meyiconnect"."insight_alerts" DROP COLUMN "promoted_incident_id";
+        END IF;
+      END IF;
+    END $$;
+  `));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "converted_incident_id" UUID`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "assignee_id" UUID`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "dup_count" INT NOT NULL DEFAULT 0`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "last_dup_at" TIMESTAMPTZ`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "account_id" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "account_name" TEXT`));
+    await db.execute(sql.raw(`
+    UPDATE "meyiconnect"."insight_alerts" a
+    SET "account_name" = c."account_name"
+    FROM "meyiconnect"."connectors" c
+    WHERE a."account_name" IS NULL
+      AND a."account_id" IS NOT NULL
+      AND a."account_id" = c."account_id";
+  `));
+    await db.execute(sql.raw(`
+    UPDATE "meyiconnect"."insight_alerts"
+    SET "account_id" = COALESCE(
+      "additional_configuration"->>'accountId',
+      "raw_payload"->>'account',
+      "raw_payload"->>'accountId',
+      "raw_payload"->>'AWSAccountId',
+      "raw_payload"->'rawEvent'->>'account',
+      "raw_payload"->'detail'->>'account',
+      "raw_payload"->'detail'->>'recipientAccountId',
+      substring("resource_id" FROM 'arn:aws[a-z0-9-]*:cloudwatch:[^:]+:([0-9]{12}):alarm:')
+    )
+    WHERE "account_id" IS NULL
+      AND (
+        "additional_configuration"->>'accountId' IS NOT NULL
+        OR "raw_payload"->>'account' IS NOT NULL
+        OR "raw_payload"->>'accountId' IS NOT NULL
+        OR "raw_payload"->>'AWSAccountId' IS NOT NULL
+        OR "raw_payload"->'rawEvent'->>'account' IS NOT NULL
+        OR "raw_payload"->'detail'->>'account' IS NOT NULL
+        OR "raw_payload"->'detail'->>'recipientAccountId' IS NOT NULL
+        OR "resource_id" ~ '^arn:aws[a-z0-9-]*:cloudwatch:[^:]+:[0-9]{12}:alarm:'
+      )
+  `));
+    await db.execute(sql.raw(`
+    UPDATE "meyiconnect"."insight_alerts"
+    SET "additional_configuration" = jsonb_set(
+      COALESCE("additional_configuration", '{}'::jsonb),
+      '{tags}',
+      COALESCE("raw_payload"->'tags', "raw_payload"->'Tags', "raw_payload"->'detail'->'tags')
+    )
+    WHERE ("additional_configuration" IS NULL OR "additional_configuration"->'tags' IS NULL)
+      AND (
+        "raw_payload"->'tags' IS NOT NULL
+        OR "raw_payload"->'Tags' IS NOT NULL
+        OR "raw_payload"->'detail'->'tags' IS NOT NULL
+      )
+  `));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_alerts_status_idx ON "meyiconnect"."insight_alerts" ("status")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_alerts_source_idx ON "meyiconnect"."insight_alerts" ("source_id")`));
+    // insight_settings
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_settings" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_settings" ADD COLUMN IF NOT EXISTS "aws_bedrock_access_key_id" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_settings" ADD COLUMN IF NOT EXISTS "aws_bedrock_secret_access_key" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_settings" ADD COLUMN IF NOT EXISTS "aws_bedrock_region" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_settings" ADD COLUMN IF NOT EXISTS "tenant_id" TEXT`));
+    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_settings" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id" = ''`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_settings_tenant_id_idx ON "meyiconnect"."insight_settings" ("tenant_id")`));
+    // notification_providers
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."notification_providers" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "tenant_id" TEXT,
+      "provider_name" VARCHAR(50) NOT NULL,
+      "display_name" VARCHAR(100) NOT NULL,
+      "is_enabled" BOOLEAN NOT NULL DEFAULT false,
+      "config" JSONB,
+      "description" TEXT,
+      "icon" TEXT,
+      "created_at" TIMESTAMP DEFAULT NOW(),
+      "updated_at" TIMESTAMP DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."notification_providers" ADD COLUMN IF NOT EXISTS "tenant_id" TEXT`));
+    await db.execute(sql.raw(`UPDATE "meyiconnect"."notification_providers" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id" = ''`));
+    await db.execute(sql.raw(`DROP INDEX IF EXISTS "meyiconnect"."notification_providers_provider_name_unique"`)).catch(() => { });
+    await db.execute(sql.raw(`DROP INDEX IF EXISTS notification_providers_provider_name_unique`)).catch(() => { });
+    await db.execute(sql.raw(`CREATE UNIQUE INDEX IF NOT EXISTS notification_providers_tenant_name_unique ON "meyiconnect"."notification_providers" ("tenant_id", "provider_name")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS notification_providers_tenant_id_idx ON "meyiconnect"."notification_providers" ("tenant_id")`));
+    // incident_events — timestamped audit/timeline log (status changes, assigns, analysis, comments)
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."incident_events" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "incident_id" UUID NOT NULL REFERENCES "meyiconnect"."insight_incidents"("id") ON DELETE CASCADE,
+      "type" TEXT NOT NULL,
+      "actor" TEXT,
+      "message" TEXT,
+      "before_value" TEXT,
+      "after_value" TEXT,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS incident_events_incident_id_idx ON "meyiconnect"."incident_events" ("incident_id")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS incident_events_created_at_idx ON "meyiconnect"."incident_events" ("created_at")`));
+    // incident_logs
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."incident_logs" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "incident_id" UUID NOT NULL REFERENCES "meyiconnect"."insight_incidents"("id") ON DELETE CASCADE,
+      "ec2_details" JSONB,
+      "ec2_status_checks" JSONB,
+      "cloudwatch_metrics" JSONB,
+      "raw_logs" JSONB,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS incident_logs_incident_id_idx ON "meyiconnect"."incident_logs" ("incident_id")`));
+    //  insight_sops 
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_sops" (
+      "id"          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "sop_id"      TEXT NOT NULL,
+      "title"       TEXT NOT NULL,
+      "alert_type"  TEXT,
+      "service"     TEXT,
+      "severity"    TEXT,
+      "status"      TEXT NOT NULL DEFAULT 'draft',
+      "description" TEXT,
+      "steps"       TEXT,
+      "error_response" TEXT,
+      "created_by"  TEXT DEFAULT 'Manual',
+      "created_at"  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at"  TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`DROP INDEX IF EXISTS "meyiconnect"."insight_sops_sop_id_unique"`)).catch(() => { });
+    await db.execute(sql.raw(`DROP INDEX IF EXISTS insight_sops_sop_id_unique`)).catch(() => { });
+    await db.execute(sql.raw(`CREATE INDEX        IF NOT EXISTS insight_sops_status_idx   ON "meyiconnect"."insight_sops" ("status")`));
+    await db.execute(sql.raw(`CREATE INDEX        IF NOT EXISTS insight_sops_severity_idx ON "meyiconnect"."insight_sops" ("severity")`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sops" ADD COLUMN IF NOT EXISTS "prompt" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sops" ADD COLUMN IF NOT EXISTS "error_response" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sops" ADD COLUMN IF NOT EXISTS "source_id" UUID`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sops" ADD COLUMN IF NOT EXISTS "project_id" UUID`));
+    await db.execute(sql.raw(`
+    DO $$
+    BEGIN
+      IF EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_sops' AND column_name = 'incident_id'
+      ) THEN
+        IF NOT EXISTS (
+          SELECT 1 FROM information_schema.columns 
+          WHERE table_schema = 'meyiconnect' AND table_name = 'insight_sops' AND column_name = 'alert_id'
+        ) THEN
+          -- Drop old FK before renaming to ensure it points to the correct table
+          ALTER TABLE "meyiconnect"."insight_sops" DROP CONSTRAINT IF EXISTS insight_sops_incident_id_fkey;
+          ALTER TABLE "meyiconnect"."insight_sops" RENAME COLUMN "incident_id" TO "alert_id";
+        ELSE
+          ALTER TABLE "meyiconnect"."insight_sops" DROP COLUMN "incident_id";
+        END IF;
+      END IF;
+    END $$;
+  `));
+    // Drop constraint anyway in case we renamed it but left the constraint intact previously
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sops" DROP CONSTRAINT IF EXISTS insight_sops_incident_id_fkey;`));
+    // Add column if it doesn't exist
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sops" ADD COLUMN IF NOT EXISTS "alert_id" UUID`));
+    // Explicitly add the new foreign key constraint if it doesn't exist
+    await db.execute(sql.raw(`
+    DO $$
+    BEGIN
+      IF NOT EXISTS (
+        SELECT 1 FROM information_schema.table_constraints 
+        WHERE constraint_schema = 'meyiconnect' AND constraint_name = 'insight_sops_alert_id_fkey'
+      ) THEN
+        -- Clear invalid alert_ids (which are actually old incident_ids) before adding the constraint
+        UPDATE "meyiconnect"."insight_sops" 
+        SET alert_id = NULL 
+        WHERE alert_id IS NOT NULL AND alert_id NOT IN (SELECT id FROM "meyiconnect"."insight_alerts");
+
+        ALTER TABLE "meyiconnect"."insight_sops" ADD CONSTRAINT insight_sops_alert_id_fkey FOREIGN KEY ("alert_id") REFERENCES "meyiconnect"."insight_alerts"("id") ON DELETE SET NULL;
+      END IF;
+    END $$;
+  `));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sops" ADD COLUMN IF NOT EXISTS "alert_name" TEXT`));
+    await db.execute(sql.raw(`DROP INDEX IF EXISTS "meyiconnect"."insight_sops_alert_name_unique"`)).catch(() => { });
+    await db.execute(sql.raw(`DROP INDEX IF EXISTS insight_sops_alert_name_unique`)).catch(() => { });
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sops" ADD COLUMN IF NOT EXISTS "source" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sops" ADD COLUMN IF NOT EXISTS "project" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sops" ADD COLUMN IF NOT EXISTS "ai_model_used" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_sops" ADD COLUMN IF NOT EXISTS "tenant_id" TEXT`));
+    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_sops" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id" = ''`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_sops_tenant_id_idx ON "meyiconnect"."insight_sops" ("tenant_id")`));
+    await db.execute(sql.raw(`CREATE UNIQUE INDEX IF NOT EXISTS insight_sops_tenant_sop_id_unique ON "meyiconnect"."insight_sops" ("tenant_id", "sop_id")`));
+    //  incident_evidence 
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."incident_evidence" (
+      "incident_id" UUID PRIMARY KEY REFERENCES "meyiconnect"."insight_incidents"("id") ON DELETE CASCADE,
+      "evidence_text" JSONB NOT NULL DEFAULT '[]'::jsonb,
+      "investigation_findings" JSONB NOT NULL DEFAULT '[]'::jsonb,
+      "rca_signals" JSONB NOT NULL DEFAULT '{}'::jsonb,
+      "tool_calls_made" JSONB NOT NULL DEFAULT '[]'::jsonb,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    //  insight_workflows 
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_workflows" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "name" TEXT NOT NULL,
+      "description" TEXT,
+      "is_active" BOOLEAN NOT NULL DEFAULT true,
+      "priority" INTEGER NOT NULL DEFAULT 0,
+      "conditions" JSONB NOT NULL DEFAULT '[]'::jsonb,
+      "actions" JSONB NOT NULL DEFAULT '[]'::jsonb,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`
+    ALTER TABLE "meyiconnect"."insight_workflows"
+    ADD COLUMN IF NOT EXISTS "yaml_definition" TEXT NOT NULL DEFAULT ''
+  `));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_workflows" ADD COLUMN IF NOT EXISTS "tenant_id" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_workflows" ADD COLUMN IF NOT EXISTS "source_id" UUID REFERENCES "meyiconnect"."insight_sources"("id") ON DELETE CASCADE`));
+    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_workflows" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id" = ''`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_workflows_tenant_id_idx ON "meyiconnect"."insight_workflows" ("tenant_id")`));
+    await db.execute(sql.raw(`
+    ALTER TABLE "meyiconnect"."insight_workflows"
+    DROP COLUMN IF EXISTS "conditions"
+  `));
+    await db.execute(sql.raw(`
+    ALTER TABLE "meyiconnect"."insight_workflows"
+    DROP COLUMN IF EXISTS "actions"
+  `));
+    await db.execute(sql.raw(`
+    ALTER TABLE "meyiconnect"."insight_workflows"
+    DROP COLUMN IF EXISTS "description"
+  `));
+    //  insight_workflow_executions 
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_workflow_executions" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "workflow_id" UUID NOT NULL REFERENCES "meyiconnect"."insight_workflows"("id") ON DELETE CASCADE,
+      "alert_id" UUID REFERENCES "meyiconnect"."insight_alerts"("id") ON DELETE SET NULL,
+      "status" TEXT NOT NULL DEFAULT 'pending',
+      "actions_executed" JSONB NOT NULL DEFAULT '[]'::jsonb,
+      "error_message" TEXT,
+      "triggered_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "completed_at" TIMESTAMPTZ
+    )
+  `));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_workflow_executions_workflow_id_idx ON "meyiconnect"."insight_workflow_executions" ("workflow_id")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_workflow_executions_alert_id_idx ON "meyiconnect"."insight_workflow_executions" ("alert_id")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_workflow_executions_status_idx ON "meyiconnect"."insight_workflow_executions" ("status")`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_workflow_executions" ADD COLUMN IF NOT EXISTS "tenant_id" TEXT`));
+    await db.execute(sql.raw(`
+    UPDATE "meyiconnect"."insight_workflow_executions" e
+    SET "tenant_id" = COALESCE(w."tenant_id", '${defaultTenantSql}')
+    FROM "meyiconnect"."insight_workflows" w
+    WHERE e."workflow_id" = w."id"
+      AND (e."tenant_id" IS NULL OR e."tenant_id" = '')
+  `));
+    await db.execute(sql.raw(`UPDATE "meyiconnect"."insight_workflow_executions" SET "tenant_id" = '${defaultTenantSql}' WHERE "tenant_id" IS NULL OR "tenant_id" = ''`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_workflow_executions_tenant_id_idx ON "meyiconnect"."insight_workflow_executions" ("tenant_id")`));
+    // ─── insight_alerts pipeline columns (Phase 1) ───────────────────────────────
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "fingerprint" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "dedup_key" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "pipeline_status" TEXT DEFAULT 'queued'`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "group_id" UUID`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alerts" ADD COLUMN IF NOT EXISTS "raw_payload" JSONB`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_alerts_pipeline_status_idx ON "meyiconnect"."insight_alerts" ("pipeline_status")`));
+    // ─── insight_provider_configs ────────────────────────────────────────────────
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_provider_configs" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "tenant_id" TEXT,
+      "llm_provider_name" TEXT NOT NULL,
+      "llm_model_name" TEXT,
+      "llm_model_id" TEXT,
+      "llm_api_key" TEXT,
+      "is_active" BOOLEAN NOT NULL DEFAULT true,
+      "auth_type" TEXT,
+      "aws_region" TEXT,
+      "aws_access_key_id" TEXT,
+      "aws_secret_access_key" TEXT,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_provider_configs_tenant_id_idx ON "meyiconnect"."insight_provider_configs" ("tenant_id")`));
+    // ─── insight_normalization_configs ───────────────────────────────────────────
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_normalization_configs" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "tenant_id" TEXT,
+      "name" TEXT NOT NULL,
+      "priority" INTEGER NOT NULL DEFAULT 0,
+      "is_active" BOOLEAN NOT NULL DEFAULT true,
+      "source_id" UUID REFERENCES "meyiconnect"."insight_sources"("id") ON DELETE CASCADE,
+      "source_type" TEXT,
+      "field_mapping" TEXT NOT NULL DEFAULT '',
+      "yaml_definition" TEXT NOT NULL DEFAULT '',
+      "is_system" BOOLEAN NOT NULL DEFAULT false,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_normalization_configs" ADD COLUMN IF NOT EXISTS "is_system" BOOLEAN NOT NULL DEFAULT false`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_normalization_configs_priority_idx ON "meyiconnect"."insight_normalization_configs" ("priority")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_normalization_configs_source_type_idx ON "meyiconnect"."insight_normalization_configs" ("source_type")`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_normalization_configs" ADD COLUMN IF NOT EXISTS "yaml_definition" TEXT NOT NULL DEFAULT ''`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_normalization_configs" ADD COLUMN IF NOT EXISTS "tenant_id" TEXT`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_normalization_configs_tenant_id_idx ON "meyiconnect"."insight_normalization_configs" ("tenant_id")`));
+    // ─── insight_dedup_configs ───────────────────────────────────────────────────
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_dedup_configs" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "tenant_id" TEXT,
+      "name" TEXT NOT NULL,
+      "priority" INTEGER NOT NULL DEFAULT 0,
+      "is_active" BOOLEAN NOT NULL DEFAULT true,
+      "source_id" UUID REFERENCES "meyiconnect"."insight_sources"("id") ON DELETE CASCADE,
+      "source_type" TEXT,
+      "window_seconds" INTEGER NOT NULL DEFAULT 300,
+      "key_fields" JSONB NOT NULL DEFAULT '[]'::jsonb,
+      "flap_threshold" INTEGER NOT NULL DEFAULT 4,
+      "flap_window_seconds" INTEGER NOT NULL DEFAULT 600,
+      "on_flap" TEXT NOT NULL DEFAULT 'none',
+      "yaml_definition" TEXT NOT NULL DEFAULT '',
+      "is_system" BOOLEAN NOT NULL DEFAULT false,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_dedup_configs" ADD COLUMN IF NOT EXISTS "is_system" BOOLEAN NOT NULL DEFAULT false`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_dedup_configs_priority_idx ON "meyiconnect"."insight_dedup_configs" ("priority")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_dedup_configs_source_type_idx ON "meyiconnect"."insight_dedup_configs" ("source_type")`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_dedup_configs" ADD COLUMN IF NOT EXISTS "yaml_definition" TEXT NOT NULL DEFAULT ''`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_dedup_configs" ADD COLUMN IF NOT EXISTS "tenant_id" TEXT`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_dedup_configs_tenant_id_idx ON "meyiconnect"."insight_dedup_configs" ("tenant_id")`));
+    // ─── insight_grouping_configs ────────────────────────────────────────────────
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_grouping_configs" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "tenant_id" TEXT,
+      "name" TEXT NOT NULL,
+      "priority" INTEGER NOT NULL DEFAULT 0,
+      "is_active" BOOLEAN NOT NULL DEFAULT true,
+      "source_id" UUID REFERENCES "meyiconnect"."insight_sources"("id") ON DELETE CASCADE,
+      "source_type" TEXT,
+      "group_by" JSONB NOT NULL DEFAULT '[]'::jsonb,
+      "timeout_seconds" INTEGER NOT NULL DEFAULT 600,
+      "max_alarms" INTEGER NOT NULL DEFAULT 50,
+      "incident_title_template" TEXT DEFAULT '{{count}} alerts on {{resourceName}}',
+      "use_ai_generate" BOOLEAN NOT NULL DEFAULT false,
+      "yaml_definition" TEXT NOT NULL DEFAULT '',
+      "is_system" BOOLEAN NOT NULL DEFAULT false,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_grouping_configs" ADD COLUMN IF NOT EXISTS "is_system" BOOLEAN NOT NULL DEFAULT false`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_grouping_configs_priority_idx ON "meyiconnect"."insight_grouping_configs" ("priority")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_grouping_configs_source_type_idx ON "meyiconnect"."insight_grouping_configs" ("source_type")`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_grouping_configs" ADD COLUMN IF NOT EXISTS "yaml_definition" TEXT NOT NULL DEFAULT ''`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_grouping_configs" ADD COLUMN IF NOT EXISTS "tenant_id" TEXT`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_grouping_configs_tenant_id_idx ON "meyiconnect"."insight_grouping_configs" ("tenant_id")`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_grouping_configs" ADD COLUMN IF NOT EXISTS "use_ai_generate" BOOLEAN NOT NULL DEFAULT false`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_grouping_configs" ADD COLUMN IF NOT EXISTS "topology_tag_mapping" TEXT`));
+    // ─── insight_alarm_groups ────────────────────────────────────────────────────
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_alarm_groups" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "tenant_id" TEXT,
+      "group_key" TEXT NOT NULL,
+      "config_id" UUID REFERENCES "meyiconnect"."insight_grouping_configs"("id") ON DELETE SET NULL,
+      "status" TEXT NOT NULL DEFAULT 'buffering',
+      "first_alarm_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "last_alarm_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "incident_id" UUID,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_alarm_groups_flush_idx ON "meyiconnect"."insight_alarm_groups" ("status", "last_alarm_at")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_alarm_groups_group_key_idx ON "meyiconnect"."insight_alarm_groups" ("group_key")`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_alarm_groups" ADD COLUMN IF NOT EXISTS "tenant_id" TEXT`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_alarm_groups_tenant_id_idx ON "meyiconnect"."insight_alarm_groups" ("tenant_id")`));
+    // ─── insight_alarm_group_members (P1 junction table) ─────────────────────────
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_alarm_group_members" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "group_id" UUID NOT NULL REFERENCES "meyiconnect"."insight_alarm_groups"("id") ON DELETE CASCADE,
+      "alarm_id" UUID NOT NULL REFERENCES "meyiconnect"."insight_alerts"("id") ON DELETE CASCADE,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_alarm_group_members_group_id_idx ON "meyiconnect"."insight_alarm_group_members" ("group_id")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_alarm_group_members_alarm_id_idx ON "meyiconnect"."insight_alarm_group_members" ("alarm_id")`));
+    await db.execute(sql.raw(`CREATE UNIQUE INDEX IF NOT EXISTS insight_alarm_group_members_unique_idx ON "meyiconnect"."insight_alarm_group_members" ("group_id", "alarm_id")`));
+    // ─── insight_pipeline_events ─────────────────────────────────────────────────
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_pipeline_events" (
+      "id" UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      "tenant_id" TEXT,
+      "alarm_id" UUID REFERENCES "meyiconnect"."insight_alerts"("id") ON DELETE CASCADE,
+      "stage" TEXT NOT NULL,
+      "status" TEXT NOT NULL,
+      "matched_config_id" UUID,
+      "meta" JSONB,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_pipeline_events_alarm_id_idx ON "meyiconnect"."insight_pipeline_events" ("alarm_id")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_pipeline_events_stage_idx ON "meyiconnect"."insight_pipeline_events" ("stage")`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_pipeline_events_created_at_idx ON "meyiconnect"."insight_pipeline_events" ("created_at")`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_pipeline_events" ADD COLUMN IF NOT EXISTS "tenant_id" TEXT`));
+    await db.execute(sql.raw(`CREATE INDEX IF NOT EXISTS insight_pipeline_events_tenant_id_idx ON "meyiconnect"."insight_pipeline_events" ("tenant_id")`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_incidents" ADD COLUMN IF NOT EXISTS "description" TEXT`));
+    await db.execute(sql.raw(`ALTER TABLE "meyiconnect"."insight_grouping_configs" ADD COLUMN IF NOT EXISTS "user_prompt" TEXT`));
+    // ─── Seed Pipeline Defaults ──────────────────────────────────────────────────
+    try {
+        const { PipelineDefaults } = await import("../pipeline/defaults/pipelineDefaults.js");
+        for (const [sourceType, configs] of Object.entries(PipelineDefaults)) {
+            if (configs.normalization) {
+                const parsed = yaml.load(configs.normalization.yamlDefinition);
+                const name = parsed.name || `${sourceType} Default Normalization`;
+                await db.execute(sql.raw(`
+          UPDATE "meyiconnect"."insight_normalization_configs" 
+          SET "field_mapping" = $token$${configs.normalization.fieldMapping}$token$
+          WHERE "source_type" = '${sourceType}' AND "is_system" = true
+        `));
+                await db.execute(sql.raw(`
+          INSERT INTO "meyiconnect"."insight_normalization_configs" 
+          ("name", "priority", "is_active", "source_type", "field_mapping", "yaml_definition", "is_system")
+          SELECT '${name}', 10, true, '${sourceType}', $token$${configs.normalization.fieldMapping}$token$, $token$${configs.normalization.yamlDefinition}$token$, true
+          WHERE NOT EXISTS (
+            SELECT 1 FROM "meyiconnect"."insight_normalization_configs" 
+            WHERE "source_type" = '${sourceType}' AND "is_system" = true
+          )
+        `));
+            }
+            if (configs.dedup) {
+                const parsed = yaml.load(configs.dedup.yamlDefinition);
+                const name = parsed.name || `${sourceType} Default Deduplication`;
+                await db.execute(sql.raw(`
+          INSERT INTO "meyiconnect"."insight_dedup_configs" 
+          ("name", "priority", "is_active", "source_type", "yaml_definition", "is_system")
+          SELECT '${name}', 10, true, '${sourceType}', $token$${configs.dedup.yamlDefinition}$token$, true
+          WHERE NOT EXISTS (
+            SELECT 1 FROM "meyiconnect"."insight_dedup_configs" 
+            WHERE "source_type" = '${sourceType}' AND "is_system" = true
+          )
+        `));
+            }
+            if (configs.grouping) {
+                const parsed = yaml.load(configs.grouping.yamlDefinition);
+                const name = parsed.name || `${sourceType} Default Grouping`;
+                await db.execute(sql.raw(`
+          INSERT INTO "meyiconnect"."insight_grouping_configs" 
+          ("name", "priority", "is_active", "source_type", "yaml_definition", "is_system")
+          SELECT '${name}', 10, true, '${sourceType}', $token$${configs.grouping.yamlDefinition}$token$, true
+          WHERE NOT EXISTS (
+            SELECT 1 FROM "meyiconnect"."insight_grouping_configs" 
+            WHERE "source_type" = '${sourceType}' AND "is_system" = true
+          )
+        `));
+            }
+        }
+    }
+    catch (err) {
+        console.error("Failed to seed pipeline defaults:", err.message);
+    }
+    // ─── insight_connectors ────────────────────────────────────────────────────
+    // Denormalized connector table written by marketplace-service during
+    // onboarding. insight-server reads from this table for the Connectors page.
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_connectors" (
+      "id"                    UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
+      "tenant_id"             TEXT        NOT NULL,
+      "account_id"            TEXT        NOT NULL,
+      "account_name"          TEXT        NOT NULL,
+      "email"                 TEXT,
+      "access_status"         TEXT        NOT NULL DEFAULT 'Active',
+      "connection_status"     TEXT        NOT NULL DEFAULT 'PENDING',
+      "connection_id"         TEXT        NOT NULL,
+      "management_account_id" TEXT,
+      "external_id"           TEXT        NOT NULL,
+      "role_name"             TEXT        NOT NULL,
+      "role_arn"              TEXT        NOT NULL,
+      "selected"              BOOLEAN     NOT NULL DEFAULT false,
+      "joined_method"         TEXT,
+      "connected_at"          TIMESTAMPTZ,
+      "created_at"            TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at"            TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`
+    CREATE UNIQUE INDEX IF NOT EXISTS insight_connectors_tenant_account_unique
+      ON "meyiconnect"."insight_connectors" ("tenant_id", "account_id")
+  `));
+    await db.execute(sql.raw(`
+    CREATE INDEX IF NOT EXISTS insight_connectors_tenant_idx
+      ON "meyiconnect"."insight_connectors" ("tenant_id")
+  `));
+    await db.execute(sql.raw(`
+    CREATE INDEX IF NOT EXISTS insight_connectors_connection_idx
+      ON "meyiconnect"."insight_connectors" ("connection_id")
+  `));
+    await db.execute(sql.raw(`
+    CREATE INDEX IF NOT EXISTS insight_connectors_access_status_idx
+      ON "meyiconnect"."insight_connectors" ("access_status")
+  `));
+    // ─── insight_job_queue ────────────────────────────────────────────────────
+    await db.execute(sql.raw(`
+    CREATE TABLE IF NOT EXISTS "meyiconnect"."insight_job_queue" (
+      "id" SERIAL PRIMARY KEY,
+      "job_type" TEXT NOT NULL,
+      "payload" JSONB NOT NULL,
+      "status" TEXT NOT NULL DEFAULT 'pending',
+      "attempts" INTEGER NOT NULL DEFAULT 0,
+      "max_attempts" INTEGER NOT NULL DEFAULT 3,
+      "available_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "leased_by" TEXT,
+      "leased_at" TIMESTAMPTZ,
+      "last_error" TEXT,
+      "created_at" TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      "updated_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `));
+    await db.execute(sql.raw(`
+    CREATE INDEX IF NOT EXISTS insight_job_queue_fetch_idx
+      ON "meyiconnect"."insight_job_queue" ("job_type", "status", "available_at")
+  `));
+    // ─── generic tags migration & project_tag removal ─────────────────────────
+    await db.execute(sql.raw(`
+    ALTER TABLE "meyiconnect"."insight_alerts"
+      ADD COLUMN IF NOT EXISTS "tags" JSONB NOT NULL DEFAULT '{}'::jsonb;
+  `));
+    await db.execute(sql.raw(`
+    ALTER TABLE "meyiconnect"."insight_incidents"
+      ADD COLUMN IF NOT EXISTS "tags" JSONB NOT NULL DEFAULT '{}'::jsonb;
+  `));
+    await db.execute(sql.raw(`
+    DO $$
+    BEGIN
+      IF EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_alerts' AND column_name = 'project_tag'
+      ) THEN
+        UPDATE "meyiconnect"."insight_alerts"
+        SET "tags" = COALESCE("tags", '{}'::jsonb)
+          || CASE WHEN "additional_configuration"->'tags' IS NOT NULL THEN ("additional_configuration"->'tags') ELSE '{}'::jsonb END
+          || CASE WHEN "project_tag" IS NOT NULL AND "project_tag" != '' THEN jsonb_build_object('project', "project_tag") ELSE '{}'::jsonb END;
+
+        DROP INDEX IF EXISTS "meyiconnect"."insight_alerts_project_tag_idx";
+        ALTER TABLE "meyiconnect"."insight_alerts" DROP COLUMN "project_tag";
+      END IF;
+
+      IF EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'meyiconnect' AND table_name = 'insight_incidents' AND column_name = 'project_tag'
+      ) THEN
+        UPDATE "meyiconnect"."insight_incidents"
+        SET "tags" = COALESCE("tags", '{}'::jsonb)
+          || CASE WHEN "project_tag" IS NOT NULL AND "project_tag" != '' THEN jsonb_build_object('project', "project_tag") ELSE '{}'::jsonb END;
+
+        ALTER TABLE "meyiconnect"."insight_incidents" DROP COLUMN "project_tag";
+      END IF;
+    END $$;
+  `));
+    await db.execute(sql.raw(`
+    CREATE INDEX IF NOT EXISTS insight_alerts_tags_idx
+      ON "meyiconnect"."insight_alerts" USING GIN ("tags");
+  `));
+    await db.execute(sql.raw(`
+    CREATE INDEX IF NOT EXISTS insight_incidents_tags_idx
+      ON "meyiconnect"."insight_incidents" USING GIN ("tags");
+  `));
+}
+//# sourceMappingURL=run.js.map