@mgsoftwarebv/mg-dashboard-mcp 7.0.5 → 7.0.7

package/dist/index.js

@@ -20,6 +20,7 @@ import { sql } from 'drizzle-orm';
 import { once } from 'events';
 import { lookup } from 'dns/promises';
 import { connect } from 'tls';
+import { pgTable, timestamp, jsonb, uuid, boolean, text, pgEnum, integer, uniqueIndex, index, bigint } from 'drizzle-orm/pg-core';
 import { tasks } from '@trigger.dev/sdk/v3';
 import { HeadObjectCommand, S3Client, ListObjectsV2Command, DeleteObjectsCommand, DeleteObjectCommand, CreateMultipartUploadCommand, UploadPartCommand, CompleteMultipartUploadCommand, AbortMultipartUploadCommand, PutObjectCommand, GetObjectCommand, CopyObjectCommand } from '@aws-sdk/client-s3';
 
@@ -677,10 +678,10 @@ var TRIGGER_TOOL_MODULE_MAP = {
   "trigger-run": "ci_cd"
 };
 async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
-  const sql27 = `SELECT re.\\"apiKey\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
+  const sql28 = `SELECT re.\\"apiKey\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
   const cmd = [
     `PORT=$(docker port "${WA_CONTAINER}" 3000/tcp 2>/dev/null | head -1 | sed 's/.*://')`,
-    `KEY=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql27}" 2>/dev/null | tr -d '[:space:]')`,
+    `KEY=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql28}" 2>/dev/null | tr -d '[:space:]')`,
     'echo "$PORT|$KEY"'
   ].join(" && ");
   const result = await sshExec2(conn, cmd, proxy);
@@ -701,8 +702,8 @@ async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
   return { port, apiKey: apiKey2 };
 }
 async function fetchRunLogs(runId, conn, proxy, sshExec2) {
-  const sql27 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
-  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql27}" 2>/dev/null`;
+  const sql28 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
+  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql28}" 2>/dev/null`;
   const result = await sshExec2(conn, cmd, proxy);
   const output = result.stdout.trim();
   if (!output) return "";
@@ -784,8 +785,8 @@ async function handleTriggerTool(name, args2, deps) {
   switch (name) {
     // -----------------------------------------------------------------
     case "trigger-list": {
-      const sql27 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
-      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql27}" 2>/dev/null`;
+      const sql28 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
+      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql28}" 2>/dev/null`;
       const result = await sshExec2(conn, cmd, proxy);
       const output = result.stdout.trim();
       if (!output) {
@@ -943,9 +944,9 @@ async function fetchAndFormatRun(conn, proxy, sshExec2, instance, runId) {
     return { content: [{ type: "text", text: `Invalid API response:
 ${rawJson.substring(0, 500)}` }] };
   }
-  let text = formatRunDetail(run);
-  if (logs) text += "\n\n--- Logs ---\n" + logs;
-  return { content: [{ type: "text", text }] };
+  let text6 = formatRunDetail(run);
+  if (logs) text6 += "\n\n--- Logs ---\n" + logs;
+  return { content: [{ type: "text", text: text6 }] };
 }
 async function waitForCompletion(conn, proxy, sshExec2, instance, runId, waitSeconds) {
   const pollInterval = 3e3;
@@ -967,10 +968,10 @@ async function waitForCompletion(conn, proxy, sshExec2, instance, runId, waitSec
       continue;
     }
     if (TERMINAL_STATUSES.has(run.status)) {
-      let text = formatRunDetail(run);
+      let text6 = formatRunDetail(run);
       const logs = await fetchRunLogs(runId, conn, proxy, sshExec2);
-      if (logs) text += "\n\n--- Logs ---\n" + logs;
-      return { content: [{ type: "text", text }] };
+      if (logs) text6 += "\n\n--- Logs ---\n" + logs;
+      return { content: [{ type: "text", text: text6 }] };
     }
   }
   return {
@@ -1024,6 +1025,39 @@ async function getMgBoilerGitHubToken() {
     return { token: null, error: "Failed to decrypt GitHub token" };
   }
 }
+async function getGitHubTokenById(id) {
+  try {
+    const rows = await getDb().execute(sql`
+      SELECT id, label, owner, notes, token_encrypted, created_at, updated_at
+      FROM github_token
+      WHERE id = ${id}
+      LIMIT 1
+    `);
+    const row = rows[0];
+    if (!row)
+      return { token: null, owner: null, error: null };
+    return {
+      token: decrypt(row.token_encrypted),
+      owner: row.owner ?? null,
+      error: null
+    };
+  } catch (error) {
+    console.error("[getGitHubTokenById] error:", error);
+    return { token: null, owner: null, error: "Failed to decrypt GitHub token" };
+  }
+}
+async function resolveReleaseGitHubToken(githubTokenId) {
+  if (githubTokenId) {
+    const { token, error } = await getGitHubTokenById(githubTokenId);
+    if (token)
+      return { token, error: null };
+    return {
+      token: null,
+      error: error || "Configured GitHub token not found"
+    };
+  }
+  return getMgBoilerGitHubToken();
+}
 
 // ../../node_modules/zod/dist/esm/v3/external.js
 var external_exports = {};
@@ -3624,10 +3658,10 @@ var ZodObject = class _ZodObject extends ZodType {
   //   }) as any;
   //   return merged;
   // }
-  catchall(index) {
+  catchall(index4) {
     return new _ZodObject({
       ...this._def,
-      catchall: index
+      catchall: index4
     });
   }
   pick(mask) {
@@ -3945,9 +3979,9 @@ function mergeValues(a, b) {
       return { valid: false };
     }
     const newArray = [];
-    for (let index = 0; index < a.length; index++) {
-      const itemA = a[index];
-      const itemB = b[index];
+    for (let index4 = 0; index4 < a.length; index4++) {
+      const itemA = a[index4];
+      const itemB = b[index4];
       const sharedValue = mergeValues(itemA, itemB);
       if (!sharedValue.valid) {
         return { valid: false };
@@ -4153,10 +4187,10 @@ var ZodMap = class extends ZodType {
     }
     const keyType = this._def.keyType;
     const valueType = this._def.valueType;
-    const pairs = [...ctx.data.entries()].map(([key, value], index) => {
+    const pairs = [...ctx.data.entries()].map(([key, value], index4) => {
       return {
-        key: keyType._parse(new ParseInputLazyPath(ctx, key, ctx.path, [index, "key"])),
-        value: valueType._parse(new ParseInputLazyPath(ctx, value, ctx.path, [index, "value"]))
+        key: keyType._parse(new ParseInputLazyPath(ctx, key, ctx.path, [index4, "key"])),
+        value: valueType._parse(new ParseInputLazyPath(ctx, value, ctx.path, [index4, "value"]))
       };
     });
     if (ctx.common.async) {
@@ -5061,7 +5095,7 @@ var coerce = {
 var NEVER = INVALID;
 
 // ../platform/dist/utils/litespeed-vhost.js
-var LITESPEED_STANDARD_APP_PATH = /^apps\/(backoffice|portal|web|api)(\/[\w-]+)?$/;
+var LITESPEED_STANDARD_APP_PATH = /^(\.|apps\/(backoffice|portal|web|api)(\/[\w-]+)?)$/;
 var LitespeedVhostMappingSchema = external_exports.object({
   domain: external_exports.string().min(1).transform((value) => normalizeVhostDomain(value)),
   appPath: external_exports.string().min(1).regex(LITESPEED_STANDARD_APP_PATH, "Unsupported appPath")
@@ -5070,6 +5104,618 @@ external_exports.array(LitespeedVhostMappingSchema);
 function normalizeVhostDomain(value) {
   return value.trim().replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/\.+$/, "").toLowerCase();
 }
+var users = pgTable("user", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  email: text("email").notNull().unique(),
+  fullName: text("full_name"),
+  avatarUrl: text("avatar_url"),
+  emailVerified: boolean("email_verified").notNull().default(false),
+  roleId: uuid("role_id"),
+  permissions: jsonb("permissions"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable("session", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  token: text("token").notNull().unique(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  ipAddress: text("ip_address"),
+  userAgent: text("user_agent"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable("account", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  providerId: text("provider_id").notNull(),
+  accountId: text("account_id").notNull(),
+  password: text("password"),
+  accessToken: text("access_token"),
+  refreshToken: text("refresh_token"),
+  accessTokenExpiresAt: timestamp("access_token_expires_at", {
+    withTimezone: true
+  }),
+  refreshTokenExpiresAt: timestamp("refresh_token_expires_at", {
+    withTimezone: true
+  }),
+  scope: text("scope"),
+  idToken: text("id_token"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable("verification", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  identifier: text("identifier").notNull(),
+  value: text("value").notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable("two_factor", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  secret: text("secret").notNull(),
+  backupCodes: text("backup_codes")
+});
+var managedServerOs = pgEnum("managed_server_os", [
+  "linux",
+  "windows",
+  "unknown"
+]);
+var serverAgentStatus = pgEnum("server_agent_status", [
+  "not_installed",
+  "installing",
+  "online",
+  "degraded",
+  "offline",
+  "error"
+]);
+var resourceKind = pgEnum("resource_kind", [
+  "wordpress",
+  "prestashop",
+  "postgres_cluster",
+  "postgres_database",
+  "mysql_database",
+  "mariadb_database",
+  "boiler_project",
+  "boiler_web_project",
+  "static_site",
+  "docker_app",
+  "domain",
+  "backup_policy",
+  "server_service"
+]);
+var resourceStatus = pgEnum("resource_status", [
+  "unknown",
+  "healthy",
+  "degraded",
+  "failed",
+  "missing",
+  "provisioning",
+  "disabled"
+]);
+var resourceOwnership = pgEnum("resource_ownership", [
+  "managed",
+  "discovered",
+  "external"
+]);
+var operationStatus = pgEnum("operation_status", [
+  "queued",
+  "running",
+  "succeeded",
+  "failed",
+  "cancelled"
+]);
+var alertSeverity = pgEnum("alert_severity", [
+  "info",
+  "warning",
+  "critical"
+]);
+var managedServer = pgTable(
+  "managed_server",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    name: text("name").notNull(),
+    hostname: text("hostname").notNull(),
+    port: integer("port").notNull().default(22),
+    username: text("username").notNull(),
+    authMethod: text("auth_method").notNull().default("ssh_key"),
+    os: managedServerOs("os").notNull().default("unknown"),
+    provider: text("provider"),
+    region: text("region"),
+    tags: jsonb("tags").$type().notNull().default([]),
+    agentStatus: serverAgentStatus("agent_status").notNull().default("not_installed"),
+    agentVersion: text("agent_version"),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("managed_server_hostname_port_uidx").on(
+      table.hostname,
+      table.port
+    ),
+    index("managed_server_agent_status_idx").on(table.agentStatus)
+  ]
+);
+pgTable("server_credential", {
+  serverId: uuid("server_id").primaryKey().references(() => managedServer.id, { onDelete: "cascade" }),
+  passwordEncrypted: text("password_encrypted"),
+  sshKeyEncrypted: text("ssh_key_encrypted"),
+  sshKeyPassphraseEncrypted: text("ssh_key_passphrase_encrypted"),
+  dbRootPasswordEncrypted: text("db_root_password_encrypted"),
+  monitoringApiKeyEncrypted: text("monitoring_api_key_encrypted"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable(
+  "server_connection_log",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    userId: uuid("user_id").notNull(),
+    connectedAt: timestamp("connected_at", { withTimezone: true }).notNull().defaultNow(),
+    disconnectedAt: timestamp("disconnected_at", { withTimezone: true }),
+    durationSeconds: integer("duration_seconds"),
+    status: text("status").notNull(),
+    errorMessage: text("error_message"),
+    clientIp: text("client_ip"),
+    terminalCols: integer("terminal_cols"),
+    terminalRows: integer("terminal_rows"),
+    outputSizeBytes: bigint("output_size_bytes", { mode: "number" }).notNull().default(0),
+    inputSizeBytes: bigint("input_size_bytes", { mode: "number" }).notNull().default(0),
+    commandCount: integer("command_count").notNull().default(0),
+    connectionType: text("connection_type").notNull().default("terminal"),
+    action: text("action"),
+    rawOutput: text("raw_output"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("server_connection_log_server_idx").on(table.serverId),
+    index("server_connection_log_user_idx").on(table.userId),
+    index("server_connection_log_connected_idx").on(table.connectedAt),
+    index("server_connection_log_status_idx").on(table.status)
+  ]
+);
+pgTable(
+  "mcp_audit_log",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    apiKeyId: uuid("api_key_id"),
+    userId: uuid("user_id"),
+    toolName: text("tool_name"),
+    arguments: jsonb("arguments"),
+    ipAddress: text("ip_address"),
+    serverId: uuid("server_id"),
+    resultStatus: text("result_status").notNull().default("success"),
+    errorMessage: text("error_message"),
+    durationMs: integer("duration_ms"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("mcp_audit_log_created_at_idx").on(table.createdAt),
+    index("mcp_audit_log_user_idx").on(table.userId),
+    index("mcp_audit_log_tool_name_idx").on(table.toolName),
+    index("mcp_audit_log_server_idx").on(table.serverId),
+    index("mcp_audit_log_api_key_idx").on(table.apiKeyId),
+    index("mcp_audit_log_result_status_idx").on(table.resultStatus)
+  ]
+);
+var resource = pgTable(
+  "resource",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    parentResourceId: uuid("parent_resource_id"),
+    kind: resourceKind("kind").notNull(),
+    slug: text("slug").notNull(),
+    displayName: text("display_name").notNull(),
+    spec: jsonb("spec").$type().notNull().default({}),
+    state: jsonb("state").$type().notNull().default({}),
+    status: resourceStatus("status").notNull().default("unknown"),
+    ownership: resourceOwnership("ownership").notNull().default("managed"),
+    lastDetectedAt: timestamp("last_detected_at", { withTimezone: true }),
+    lastEventId: uuid("last_event_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("resource_server_kind_slug_uidx").on(
+      table.serverId,
+      table.kind,
+      table.slug
+    ),
+    index("resource_server_idx").on(table.serverId),
+    index("resource_parent_idx").on(table.parentResourceId),
+    index("resource_kind_status_idx").on(table.kind, table.status)
+  ]
+);
+pgTable(
+  "resource_event",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    resourceId: uuid("resource_id").notNull().references(() => resource.id, { onDelete: "cascade" }),
+    kind: text("kind").notNull(),
+    before: jsonb("before").$type(),
+    after: jsonb("after").$type(),
+    actorUserId: text("actor_user_id"),
+    operationId: uuid("operation_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("resource_event_resource_created_idx").on(
+      table.resourceId,
+      table.createdAt
+    ),
+    index("resource_event_operation_idx").on(table.operationId)
+  ]
+);
+var operation = pgTable(
+  "operation",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    kind: text("kind").notNull(),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "set null"
+    }),
+    serverId: uuid("server_id").references(() => managedServer.id, {
+      onDelete: "set null"
+    }),
+    status: operationStatus("status").notNull().default("queued"),
+    steps: jsonb("steps").$type().notNull().default([]),
+    idempotencyKey: text("idempotency_key").notNull(),
+    triggerRunId: text("trigger_run_id"),
+    logsR2Key: text("logs_r2_key"),
+    logs: text("logs"),
+    startedBy: text("started_by"),
+    startedAt: timestamp("started_at", { withTimezone: true }),
+    endedAt: timestamp("ended_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("operation_idempotency_uidx").on(table.idempotencyKey),
+    index("operation_resource_idx").on(table.resourceId),
+    index("operation_server_idx").on(table.serverId),
+    index("operation_status_created_idx").on(table.status, table.createdAt)
+  ]
+);
+pgTable(
+  "agent_installation",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    agentId: text("agent_id"),
+    version: text("version").notNull(),
+    installPath: text("install_path").notNull().default("/usr/local/bin/mg-agent"),
+    configHash: text("config_hash").notNull(),
+    status: serverAgentStatus("status").notNull().default("installing"),
+    lastHeartbeatAt: timestamp("last_heartbeat_at", { withTimezone: true }),
+    lastError: text("last_error"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("agent_installation_server_uidx").on(table.serverId),
+    index("agent_installation_status_idx").on(table.status)
+  ]
+);
+pgTable(
+  "monitoring_sample",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "cascade"
+    }),
+    metric: text("metric").notNull(),
+    value: integer("value").notNull(),
+    unit: text("unit").notNull(),
+    tags: jsonb("tags").$type().notNull().default({}),
+    sampledAt: timestamp("sampled_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("monitoring_sample_server_metric_time_idx").on(
+      table.serverId,
+      table.metric,
+      table.sampledAt
+    ),
+    // Descending on sampled_at so "latest metric per (server, metric)" lookups
+    // (DISTINCT ON ... ORDER BY sampled_at DESC) are served by an index-only
+    // scan instead of a full-table sort. The migration also adds
+    // INCLUDE (value, unit) to make it covering for the overview snapshot query
+    // (Drizzle 0.44 can't express INCLUDE here). See migration 20260529210000.
+    index("monitoring_sample_server_metric_time_desc_idx").on(
+      table.serverId,
+      table.metric,
+      table.sampledAt.desc()
+    ),
+    index("monitoring_sample_resource_metric_time_idx").on(
+      table.resourceId,
+      table.metric,
+      table.sampledAt
+    )
+  ]
+);
+var appLogSource = pgTable(
+  "app_log_source",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "set null"
+    }),
+    sourceType: text("source_type").notNull(),
+    sourceKey: text("source_key").notNull(),
+    displayName: text("display_name").notNull(),
+    path: text("path").notNull(),
+    enabled: boolean("enabled").notNull().default(true),
+    mutedUntil: timestamp("muted_until", { withTimezone: true }),
+    metadata: jsonb("metadata").$type().notNull().default({}),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("app_log_source_server_type_key_uidx").on(
+      table.serverId,
+      table.sourceType,
+      table.sourceKey
+    ),
+    index("app_log_source_server_idx").on(table.serverId),
+    index("app_log_source_resource_idx").on(table.resourceId),
+    index("app_log_source_type_seen_idx").on(
+      table.sourceType,
+      table.lastSeenAt
+    )
+  ]
+);
+pgTable(
+  "app_error_event",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "set null"
+    }),
+    logSourceId: uuid("log_source_id").references(() => appLogSource.id, {
+      onDelete: "set null"
+    }),
+    fingerprint: text("fingerprint").notNull(),
+    severity: text("severity").notNull().default("critical"),
+    category: text("category").notNull(),
+    sourceType: text("source_type").notNull(),
+    sourcePath: text("source_path").notNull(),
+    sampleMessage: text("sample_message").notNull(),
+    sampleLines: jsonb("sample_lines").$type().notNull().default([]),
+    signals: jsonb("signals").$type().notNull().default({}),
+    occurrences: integer("occurrences").notNull().default(1),
+    firstSeenAt: timestamp("first_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("app_error_event_fingerprint_created_idx").on(
+      table.fingerprint,
+      table.createdAt
+    ),
+    index("app_error_event_server_created_idx").on(
+      table.serverId,
+      table.createdAt
+    ),
+    index("app_error_event_resource_created_idx").on(
+      table.resourceId,
+      table.createdAt
+    ),
+    index("app_error_event_severity_created_idx").on(
+      table.severity,
+      table.createdAt
+    )
+  ]
+);
+pgTable(
+  "app_error_alert",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    fingerprint: text("fingerprint").notNull(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "set null"
+    }),
+    logSourceId: uuid("log_source_id").references(() => appLogSource.id, {
+      onDelete: "set null"
+    }),
+    severity: text("severity").notNull().default("critical"),
+    status: text("status").notNull().default("open"),
+    category: text("category").notNull(),
+    title: text("title").notNull(),
+    lastError: text("last_error").notNull(),
+    sampleLines: jsonb("sample_lines").$type().notNull().default([]),
+    signals: jsonb("signals").$type().notNull().default({}),
+    failureCount: integer("failure_count").notNull().default(1),
+    firstSeenAt: timestamp("first_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    lastAlertAt: timestamp("last_alert_at", { withTimezone: true }),
+    resolvedAt: timestamp("resolved_at", { withTimezone: true }),
+    mutedUntil: timestamp("muted_until", { withTimezone: true }),
+    cursorPrompt: text("cursor_prompt"),
+    telegramChatId: text("telegram_chat_id"),
+    telegramMessageId: bigint("telegram_message_id", { mode: "number" }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("app_error_alert_fingerprint_uidx").on(table.fingerprint),
+    index("app_error_alert_status_seen_idx").on(
+      table.status,
+      table.lastSeenAt
+    ),
+    index("app_error_alert_server_seen_idx").on(
+      table.serverId,
+      table.lastSeenAt
+    ),
+    index("app_error_alert_resource_seen_idx").on(
+      table.resourceId,
+      table.lastSeenAt
+    ),
+    index("app_error_alert_alerted_idx").on(table.lastAlertAt)
+  ]
+);
+pgTable(
+  "alert_rule",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").references(() => managedServer.id, {
+      onDelete: "cascade"
+    }),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "cascade"
+    }),
+    metric: text("metric").notNull(),
+    expression: text("expression").notNull(),
+    severity: alertSeverity("severity").notNull().default("warning"),
+    cooldownSeconds: integer("cooldown_seconds").notNull().default(900),
+    enabled: boolean("enabled").notNull().default(true),
+    routes: jsonb("routes").$type().notNull().default({}),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("alert_rule_server_idx").on(table.serverId),
+    index("alert_rule_resource_idx").on(table.resourceId),
+    index("alert_rule_enabled_severity_idx").on(table.enabled, table.severity)
+  ]
+);
+pgTable(
+  "deployment_project_server",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    releaseProfileStageId: uuid("release_profile_stage_id").notNull(),
+    sshServerId: uuid("ssh_server_id").notNull(),
+    deployPath: text("deploy_path").notNull(),
+    deployPathNormalized: text("deploy_path_normalized"),
+    pm2PortBase: integer("pm2_port_base").notNull(),
+    postgresHost: text("postgres_host"),
+    postgresPort: integer("postgres_port"),
+    buildFilters: text("build_filters"),
+    envSymlinkDirs: jsonb("env_symlink_dirs"),
+    litespeedVhosts: jsonb("litespeed_vhosts"),
+    litespeedVhostsCheckedAt: timestamp("litespeed_vhosts_checked_at", {
+      withTimezone: true
+    }),
+    litespeedVhostsCheckOk: boolean("litespeed_vhosts_check_ok"),
+    ecosystemConfig: text("ecosystem_config").notNull().default("ecosystem.config.cjs"),
+    usePipelineDeploy: boolean("use_pipeline_deploy").notNull().default(true),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("deployment_project_server_stage_server_uidx").on(
+      table.releaseProfileStageId,
+      table.sshServerId
+    ),
+    uniqueIndex("deployment_project_server_server_path_uidx").on(
+      table.sshServerId,
+      table.deployPathNormalized
+    ),
+    uniqueIndex("deployment_project_server_server_port_uidx").on(
+      table.sshServerId,
+      table.pm2PortBase
+    )
+  ]
+);
+var dnsMigrationStatus = pgEnum("dns_migration_status", [
+  "pending",
+  "scanned",
+  "imported",
+  "verified"
+]);
+var dnsMigration = pgTable(
+  "dns_migration",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    domain: text("domain").notNull(),
+    sourceProvider: text("source_provider").notNull().default("hostnet"),
+    status: dnsMigrationStatus("status").notNull().default("pending"),
+    scannedRecords: jsonb("scanned_records").$type().notNull().default([]),
+    sourceNameservers: jsonb("source_nameservers").$type().notNull().default([]),
+    currentNameservers: jsonb("current_nameservers").$type().notNull().default([]),
+    importResult: jsonb("import_result").$type(),
+    emailChecklist: jsonb("email_checklist").$type().notNull().default({}),
+    directadminHost: text("directadmin_host"),
+    directadminUsername: text("directadmin_username"),
+    directadminPasswordEncrypted: text("directadmin_password_encrypted"),
+    syncServerId: uuid("sync_server_id").references(() => managedServer.id, {
+      onDelete: "set null"
+    }),
+    syncOperationId: uuid("sync_operation_id").references(() => operation.id, {
+      onDelete: "set null"
+    }),
+    mailRecordsImportedAt: timestamp("mail_records_imported_at", {
+      withTimezone: true
+    }),
+    notes: text("notes"),
+    lastError: text("last_error"),
+    lastScannedAt: timestamp("last_scanned_at", { withTimezone: true }),
+    importedAt: timestamp("imported_at", { withTimezone: true }),
+    verifiedAt: timestamp("verified_at", { withTimezone: true }),
+    createdBy: text("created_by"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("dns_migration_domain_idx").on(table.domain),
+    index("dns_migration_status_created_idx").on(
+      table.status,
+      table.createdAt
+    )
+  ]
+);
+var dnsMigrationMailboxStatus = pgEnum(
+  "dns_migration_mailbox_status",
+  ["pending", "provisioned", "syncing", "synced", "delta_synced", "failed"]
+);
+pgTable(
+  "dns_migration_mailbox",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    migrationId: uuid("migration_id").notNull().references(() => dnsMigration.id, { onDelete: "cascade" }),
+    address: text("address").notNull(),
+    sourcePasswordEncrypted: text("source_password_encrypted"),
+    destPasswordEncrypted: text("dest_password_encrypted"),
+    status: dnsMigrationMailboxStatus("status").notNull().default("pending"),
+    syncStats: jsonb("sync_stats").$type(),
+    lastError: text("last_error"),
+    provisionedAt: timestamp("provisioned_at", { withTimezone: true }),
+    lastSyncedAt: timestamp("last_synced_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("dns_migration_mailbox_migration_address_uidx").on(
+      table.migrationId,
+      table.address
+    ),
+    index("dns_migration_mailbox_migration_idx").on(table.migrationId)
+  ]
+);
+pgTable(
+  "github_token",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    label: text("label").notNull(),
+    owner: text("owner"),
+    notes: text("notes"),
+    tokenEncrypted: text("token_encrypted").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("github_token_label_idx").on(table.label),
+    index("github_token_owner_idx").on(table.owner)
+  ]
+);
 async function triggerPipeline(payload) {
   return tasks.trigger(
     "execute-pipeline",
@@ -5473,7 +6119,9 @@ async function createReleaseForStage(userId, params) {
       "BAD_REQUEST"
     );
   }
-  const { token } = await getMgBoilerGitHubToken();
+  const { token } = await resolveReleaseGitHubToken(
+    profile.github_token_id ?? null
+  );
   if (!token) {
     throw new CreateReleaseError(
       "GitHub token is not configured",
@@ -5612,6 +6260,449 @@ async function createReleaseForStage(userId, params) {
     authorName: triggerAuthorName
   };
 }
+var GITHUB_API3 = "https://api.github.com";
+var ReleaseProfileQuickCreateError = class extends Error {
+  constructor(message, code = "INTERNAL_SERVER_ERROR") {
+    super(message);
+    this.code = code;
+    this.name = "ReleaseProfileQuickCreateError";
+  }
+};
+function inferDeployMethod(folderName, hasNextConfig, hasDockerfile, hasPm2Ecosystem) {
+  if (hasPm2Ecosystem && hasNextConfig) return "pm2";
+  if (hasPm2Ecosystem && !hasDockerfile && !folderName.toLowerCase().includes("api"))
+    return "pm2";
+  if (hasNextConfig) return "pm2";
+  if (hasDockerfile || folderName.toLowerCase().includes("api"))
+    return "docker";
+  return "none";
+}
+function toLabel(folderName) {
+  return folderName.charAt(0).toUpperCase() + folderName.slice(1);
+}
+async function scanRepoForApps(repoFullName, githubToken2, ref = "main") {
+  const headers = {
+    Accept: "application/vnd.github.v3+json",
+    Authorization: `Bearer ${githubToken2}`,
+    "Content-Type": "application/json"
+  };
+  async function fetchContents(path) {
+    const res = await fetch(
+      `${GITHUB_API3}/repos/${repoFullName}/contents/${path}?ref=${ref}`,
+      { headers }
+    );
+    if (!res.ok) return null;
+    const data = await res.json();
+    return Array.isArray(data) ? data : null;
+  }
+  async function fileExists(path) {
+    const res = await fetch(
+      `${GITHUB_API3}/repos/${repoFullName}/contents/${path}?ref=${ref}`,
+      { headers, method: "HEAD" }
+    );
+    return res.ok;
+  }
+  const apps = [];
+  const appsDir = await fetchContents("apps");
+  const isMonorepo = appsDir !== null && appsDir.length > 0;
+  const hasPm2Ecosystem = await Promise.any([
+    fileExists("ecosystem.config.cjs"),
+    fileExists("ecosystem.config.js"),
+    fileExists("ecosystem.config.mjs")
+  ]).catch(() => false);
+  if (isMonorepo) {
+    const subfolders = appsDir.filter((item) => item.type === "dir");
+    const detections = await Promise.all(
+      subfolders.map(async (folder) => {
+        const folderPath = `apps/${folder.name}`;
+        const [hasNextMjs, hasNextJs, hasNextTs, hasDockerfile, hasPkgJson] = await Promise.all([
+          fileExists(`${folderPath}/next.config.mjs`),
+          fileExists(`${folderPath}/next.config.js`),
+          fileExists(`${folderPath}/next.config.ts`),
+          fileExists(`${folderPath}/Dockerfile`),
+          fileExists(`${folderPath}/package.json`)
+        ]);
+        const hasNextConfig = hasNextMjs || hasNextJs || hasNextTs;
+        const deployMethod = inferDeployMethod(
+          folder.name,
+          hasNextConfig,
+          hasDockerfile,
+          !!hasPm2Ecosystem
+        );
+        return {
+          path: folderPath,
+          label: toLabel(folder.name),
+          deployMethod,
+          hasNextConfig,
+          hasDockerfile,
+          hasPackageJson: hasPkgJson,
+          enabled: true
+        };
+      })
+    );
+    apps.push(...detections);
+  } else {
+    const [hasNextMjs, hasNextJs, hasNextTs, hasDockerfile, hasPkgJson] = await Promise.all([
+      fileExists("next.config.mjs"),
+      fileExists("next.config.js"),
+      fileExists("next.config.ts"),
+      fileExists("Dockerfile"),
+      fileExists("package.json")
+    ]);
+    const hasNextConfig = hasNextMjs || hasNextJs || hasNextTs;
+    const repoName = repoFullName.split("/").pop() ?? "app";
+    const deployMethod = inferDeployMethod(
+      repoName,
+      hasNextConfig,
+      hasDockerfile,
+      !!hasPm2Ecosystem
+    );
+    apps.push({
+      path: ".",
+      label: toLabel(repoName),
+      deployMethod,
+      hasNextConfig,
+      hasDockerfile,
+      hasPackageJson: hasPkgJson,
+      enabled: true
+    });
+  }
+  const workDirectory = isMonorepo ? apps.find((a) => a.deployMethod !== "none")?.path ?? "." : ".";
+  const hasTriggerDev = await Promise.any([
+    fileExists("packages/jobs/trigger.config.ts"),
+    fileExists("trigger.config.ts")
+  ]).catch(() => false);
+  return {
+    isMonorepo,
+    apps,
+    workDirectory,
+    hasTriggerDev: !!hasTriggerDev
+  };
+}
+var QUICK_STAGE_DEFAULTS = {
+  dev: {
+    name: "Development",
+    releaseBranch: "release-dev",
+    triggerMode: "pr_webhook",
+    autoApprove: true,
+    requireReview: false,
+    backupDb: false,
+    migrateDb: true
+  },
+  staging: {
+    name: "Staging",
+    releaseBranch: "release-staging",
+    triggerMode: "manual",
+    autoApprove: false,
+    requireReview: false,
+    backupDb: true,
+    migrateDb: true
+  },
+  prod: {
+    name: "Production",
+    releaseBranch: "release-prod",
+    triggerMode: "manual",
+    autoApprove: false,
+    requireReview: false,
+    backupDb: true,
+    migrateDb: true
+  }
+};
+var QUICK_STAGES_FOR_TYPE = {
+  dev_only: ["dev"],
+  prod_only: ["prod"],
+  both: ["dev", "prod"]
+};
+function deriveProfileName(repoFullName) {
+  const repoName = repoFullName.split("/").pop() ?? repoFullName;
+  return repoName.split(/[-_]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+}
+function toStageApps(apps) {
+  return apps.filter((a) => a.enabled).map((a) => ({
+    path: a.path,
+    label: a.label,
+    deployMethod: a.deployMethod,
+    deploymentAppId: null,
+    deploymentServerId: null,
+    deployPath: null,
+    deployScript: null,
+    enabled: a.enabled
+  }));
+}
+async function ensureGitHubBranchExists(repoFullName, branchName, fromBranch, githubToken2) {
+  const headers = {
+    Accept: "application/vnd.github.v3+json",
+    Authorization: `Bearer ${githubToken2}`,
+    "Content-Type": "application/json"
+  };
+  const checkRes = await fetch(
+    `${GITHUB_API3}/repos/${repoFullName}/git/ref/heads/${branchName}`,
+    { headers }
+  );
+  if (checkRes.ok) return;
+  let sha;
+  const sourceRes = await fetch(
+    `${GITHUB_API3}/repos/${repoFullName}/git/ref/heads/${fromBranch}`,
+    { headers }
+  );
+  if (sourceRes.ok) {
+    const data = await sourceRes.json();
+    sha = data.object?.sha;
+  } else {
+    const repoRes = await fetch(`${GITHUB_API3}/repos/${repoFullName}`, {
+      headers
+    });
+    if (!repoRes.ok) {
+      throw new Error(`Could not access repository ${repoFullName}`);
+    }
+    const repo = await repoRes.json();
+    const defaultBranch = repo.default_branch ?? "main";
+    const defaultRes = await fetch(
+      `${GITHUB_API3}/repos/${repoFullName}/git/ref/heads/${defaultBranch}`,
+      { headers }
+    );
+    if (!defaultRes.ok) {
+      throw new Error(`Could not resolve a source branch for ${repoFullName}`);
+    }
+    const data = await defaultRes.json();
+    sha = data.object?.sha;
+  }
+  if (!sha) {
+    throw new Error(`Could not determine SHA to create branch ${branchName}`);
+  }
+  const createRes = await fetch(
+    `${GITHUB_API3}/repos/${repoFullName}/git/refs`,
+    {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ ref: `refs/heads/${branchName}`, sha })
+    }
+  );
+  if (!createRes.ok && createRes.status !== 422) {
+    const body = await createRes.text().catch(() => "");
+    throw new Error(
+      `Failed to create branch ${branchName}: ${createRes.status} ${body}`
+    );
+  }
+}
+async function insertQuickStages(profileId, releaseType, stageApps) {
+  const db2 = getDb();
+  const stages = [];
+  const wanted = QUICK_STAGES_FOR_TYPE[releaseType];
+  for (let i = 0; i < wanted.length; i++) {
+    const stageType = wanted[i];
+    const defaults = QUICK_STAGE_DEFAULTS[stageType];
+    const rows = await db2.execute(sql`
+      INSERT INTO release_profile_stage (
+        release_profile_id, name, stage, stage_order, release_branch,
+        trigger_mode, auto_approve, require_review,
+        backup_db, migrate_db, stage_apps, enabled,
+        trigger_branch, trigger_event
+      ) VALUES (
+        ${profileId}, ${defaults.name}, ${stageType}, ${i + 1},
+        ${defaults.releaseBranch},
+        ${defaults.triggerMode}, ${defaults.autoApprove}, ${defaults.requireReview},
+        ${defaults.backupDb}, ${defaults.migrateDb},
+        ${JSON.stringify(stageApps)}::jsonb, true,
+        ${defaults.releaseBranch}, 'push'
+      )
+      RETURNING id, name, stage, release_branch, trigger_mode
+    `);
+    if (rows[0]) stages.push(rows[0]);
+  }
+  return stages;
+}
+async function quickCreateReleaseProfile(userId, options) {
+  const db2 = getDb();
+  const repoFullName = options.repoFullName.trim();
+  if (!repoFullName.includes("/")) {
+    throw new ReleaseProfileQuickCreateError(
+      `Repository must be in "owner/name" format, got "${repoFullName}"`,
+      "BAD_REQUEST"
+    );
+  }
+  const existing = await db2.execute(sql`
+    SELECT id, name FROM release_profile
+    WHERE lower(repo_full_name) = ${repoFullName.toLowerCase()}
+    LIMIT 1
+  `);
+  if (existing[0]) {
+    throw new ReleaseProfileQuickCreateError(
+      `Repository ${repoFullName} already has a release profile ("${existing[0].name}")`,
+      "CONFLICT"
+    );
+  }
+  const githubTokenId = options.githubTokenId ?? null;
+  const { token, error: tokenError } = await resolveReleaseGitHubToken(githubTokenId);
+  if (!token) {
+    throw new ReleaseProfileQuickCreateError(
+      tokenError || "GitHub token is not configured",
+      "PRECONDITION_FAILED"
+    );
+  }
+  let scan;
+  try {
+    scan = await scanRepoForApps(repoFullName, token);
+  } catch (err) {
+    throw new ReleaseProfileQuickCreateError(
+      `Failed to scan repository ${repoFullName}: ${err instanceof Error ? err.message : String(err)}`,
+      "BAD_REQUEST"
+    );
+  }
+  const name = options.name?.trim() || deriveProfileName(repoFullName);
+  const releaseType = options.releaseType ?? "both";
+  const detectedApps = toStageApps(scan.apps);
+  let profile;
+  try {
+    const rows = await db2.execute(sql`
+      INSERT INTO release_profile (
+        name, repo_full_name, work_directory, enabled, release_type,
+        current_version, active_version, created_by, use_changes_branch,
+        detected_apps, has_trigger_dev, github_token_id
+      ) VALUES (
+        ${name}, ${repoFullName}, ${scan.workDirectory}, true, ${releaseType},
+        NULL, NULL, ${userId}, false,
+        ${JSON.stringify(detectedApps)}::jsonb, ${scan.hasTriggerDev},
+        ${githubTokenId}
+      )
+      RETURNING *
+    `);
+    profile = rows[0];
+  } catch (err) {
+    throw new ReleaseProfileQuickCreateError(
+      `Failed to create release profile: ${err instanceof Error ? err.message : String(err)}`,
+      "INTERNAL_SERVER_ERROR"
+    );
+  }
+  if (!profile) {
+    throw new ReleaseProfileQuickCreateError(
+      "Release profile insert returned no rows",
+      "INTERNAL_SERVER_ERROR"
+    );
+  }
+  const stages = await insertQuickStages(profile.id, releaseType, detectedApps);
+  const branchWarnings = [];
+  for (const stage of stages) {
+    if (!stage.release_branch) continue;
+    try {
+      await ensureGitHubBranchExists(
+        repoFullName,
+        stage.release_branch,
+        "main",
+        token
+      );
+    } catch (err) {
+      branchWarnings.push(
+        `Could not create branch ${stage.release_branch}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  return { profile, stages, scan, branchWarnings };
+}
+async function updateReleaseProfileSettings(profileId, fields) {
+  const db2 = getDb();
+  const profileRows = await db2.execute(sql`
+    SELECT id, release_type, detected_apps
+    FROM release_profile WHERE id = ${profileId} LIMIT 1
+  `);
+  const current = profileRows[0];
+  if (!current) {
+    throw new ReleaseProfileQuickCreateError(
+      "Release profile not found",
+      "NOT_FOUND"
+    );
+  }
+  const setExprs = [];
+  if (fields.name !== void 0) setExprs.push(sql`name = ${fields.name}`);
+  if (fields.enabled !== void 0)
+    setExprs.push(sql`enabled = ${fields.enabled}`);
+  if (fields.releaseType !== void 0)
+    setExprs.push(sql`release_type = ${fields.releaseType}`);
+  if (fields.githubTokenId !== void 0)
+    setExprs.push(sql`github_token_id = ${fields.githubTokenId}`);
+  if (fields.useChangesBranch !== void 0)
+    setExprs.push(sql`use_changes_branch = ${fields.useChangesBranch}`);
+  if (fields.hasTriggerDev !== void 0)
+    setExprs.push(sql`has_trigger_dev = ${fields.hasTriggerDev}`);
+  if (fields.workDirectory !== void 0)
+    setExprs.push(sql`work_directory = ${fields.workDirectory}`);
+  if (setExprs.length === 0) {
+    throw new ReleaseProfileQuickCreateError(
+      "No fields to update",
+      "BAD_REQUEST"
+    );
+  }
+  const rows = await db2.execute(sql`
+    UPDATE release_profile
+    SET ${sql.join(setExprs, sql`, `)}
+    WHERE id = ${profileId}
+    RETURNING *
+  `);
+  const profile = rows[0];
+  if (!profile) {
+    throw new ReleaseProfileQuickCreateError(
+      "Release profile update returned no rows",
+      "INTERNAL_SERVER_ERROR"
+    );
+  }
+  let stagesReconfigured = false;
+  if (fields.releaseType !== void 0 && fields.releaseType !== current.release_type) {
+    await reconfigureQuickStages(
+      profileId,
+      fields.releaseType,
+      current.detected_apps ?? []
+    );
+    stagesReconfigured = true;
+  }
+  return { profile, stagesReconfigured };
+}
+async function reconfigureQuickStages(profileId, releaseType, detectedApps) {
+  const db2 = getDb();
+  const wanted = QUICK_STAGES_FOR_TYPE[releaseType];
+  const existingStages = await db2.execute(sql`
+    SELECT id, stage, release_branch
+    FROM release_profile_stage
+    WHERE release_profile_id = ${profileId}
+  `);
+  const existingByStage = new Map(existingStages.map((s) => [s.stage, s]));
+  for (let i = 0; i < wanted.length; i++) {
+    const stageType = wanted[i];
+    const defaults = QUICK_STAGE_DEFAULTS[stageType];
+    const existing = existingByStage.get(stageType);
+    if (existing) {
+      await db2.execute(sql`
+        UPDATE release_profile_stage
+        SET stage_order = ${i + 1},
+            release_branch = ${existing.release_branch ?? defaults.releaseBranch},
+            enabled = true
+        WHERE id = ${existing.id}
+      `);
+    } else {
+      await db2.execute(sql`
+        INSERT INTO release_profile_stage (
+          release_profile_id, name, stage, stage_order, release_branch,
+          trigger_mode, auto_approve, require_review,
+          backup_db, migrate_db, stage_apps, enabled,
+          trigger_branch, trigger_event
+        ) VALUES (
+          ${profileId}, ${defaults.name}, ${stageType}, ${i + 1},
+          ${defaults.releaseBranch},
+          ${defaults.triggerMode}, ${defaults.autoApprove}, ${defaults.requireReview},
+          ${defaults.backupDb}, ${defaults.migrateDb},
+          ${JSON.stringify(detectedApps)}::jsonb, true,
+          ${defaults.releaseBranch}, 'push'
+        )
+      `);
+    }
+  }
+  const wantedSet = new Set(wanted);
+  for (const existing of existingStages) {
+    if (wantedSet.has(existing.stage)) continue;
+    await db2.execute(sql`
+      UPDATE release_profile_stage SET enabled = false WHERE id = ${existing.id}
+    `);
+  }
+}
 var args = process.argv.slice(2);
 function getArg2(name) {
   return args.find((a) => a.startsWith(`--${name}=`))?.split("=").slice(1).join("=");
@@ -5853,6 +6944,9 @@ var TOOL_MODULE_MAP = {
   "env-get": "ci_cd",
   "env-store": "ci_cd",
   "release-trigger": "ci_cd",
+  "release-profile-list": "ci_cd",
+  "release-profile-create": "ci_cd",
+  "release-profile-update": "ci_cd",
   "domain-list": "domains",
   "dns-list": "domains",
   "dns-record": "domains",
@@ -6233,6 +7327,23 @@ async function resolveReleaseProfileStageIds(profileName) {
   }
   return { stageIds: stages.map((s) => s.id), profileId: profile.id };
 }
+async function resolveGitHubTokenIdByKey(key) {
+  const trimmed = key.trim();
+  const rows = await db.execute(sql`
+    SELECT id FROM github_token
+    WHERE label ILIKE ${trimmed} OR owner ILIKE ${trimmed} OR id::text = ${trimmed}
+    ORDER BY label
+    LIMIT 1
+  `);
+  if (rows[0]) return rows[0].id;
+  const all = await db.execute(
+    sql`SELECT label, owner FROM github_token ORDER BY label`
+  );
+  const available = all.map((t) => t.owner ? `${t.label} (${t.owner})` : t.label).join(", ");
+  throw new Error(
+    `GitHub key "${key}" not found. Available keys: ${available || "(none)"}. Omit githubKey to use the default MG Software token.`
+  );
+}
 async function resolveReleaseTriggerStage(profileName, stageFilter) {
   const profileRows = await db.execute(sql`
     SELECT id, name FROM release_profile
@@ -6324,7 +7435,7 @@ function getEncryptionKey() {
     throw new Error("ENCRYPTION_KEY must be a 64-character hex string");
   return buf;
 }
-function encrypt(text) {
+function encrypt(text6) {
   const key = getEncryptionKey();
   const iv = randomBytes(ENC_IV_LENGTH);
   const cipher = createCipheriv(
@@ -6332,7 +7443,7 @@ function encrypt(text) {
     new Uint8Array(key),
     new Uint8Array(iv)
   );
-  let encrypted = cipher.update(text, "utf8", "hex");
+  let encrypted = cipher.update(text6, "utf8", "hex");
   encrypted += cipher.final("hex");
   const authTag = cipher.getAuthTag();
   return Buffer.concat([
@@ -7052,10 +8163,10 @@ async function r2GetObjectRange(bucket, key, range) {
     const body = result.Body;
     if (!body?.transformToString)
       throw new Error("R2 returned no readable body");
-    const text = await body.transformToString();
+    const text6 = await body.transformToString();
     const header = `# range: bytes ${range.offset}-${end} of ${size} (${effectiveLen} bytes)`;
     return `${header}
-${text}`;
+${text6}`;
   } catch (e) {
     throw r2WrapError(bucket, key, e);
   }
@@ -7418,15 +8529,15 @@ async function sftpRead(opts, filePath, proxy, options) {
             clearTimeout(timer);
             cleanup?.();
             cleanup = void 0;
-            const text = Buffer.concat(
+            const text6 = Buffer.concat(
               chunks.map((ch) => new Uint8Array(ch))
             ).toString("utf-8");
             if (!isWholeFileRequest) {
               const header = `# range: bytes ${offset}-${offset + effectiveLen - 1} of ${total} (${effectiveLen} bytes)`;
               resolve(`${header}
-${text}`);
+${text6}`);
             } else {
-              resolve(text);
+              resolve(text6);
             }
           });
           rs.on("error", (e) => {
@@ -7556,11 +8667,11 @@ function getKnownContainers(serverId, maxAgeMs = 5 * 6e4) {
   if (Date.now() - e.capturedAt > maxAgeMs) return void 0;
   return e.names;
 }
-function truncateForLLM(text, maxBytes) {
-  const totalBytes = Buffer.byteLength(text, "utf8");
+function truncateForLLM(text6, maxBytes) {
+  const totalBytes = Buffer.byteLength(text6, "utf8");
   if (totalBytes <= maxBytes)
-    return { text, truncated: false, totalBytes, shownBytes: totalBytes };
-  const buf = Buffer.from(text, "utf8");
+    return { text: text6, truncated: false, totalBytes, shownBytes: totalBytes };
+  const buf = Buffer.from(text6, "utf8");
   let cut = maxBytes;
   while (cut > 0 && (buf[cut] & 192) === 128) cut--;
   const head = buf.subarray(0, cut).toString("utf8");
@@ -7590,10 +8701,10 @@ function isTransientSshError(stderr, exitCode) {
 function postprocessResult(result, meta) {
   if (!result.content?.length) return result;
   const block = result.content[0];
-  let text = String(block.text ?? "");
-  const trunc = truncateForLLM(text, RESPONSE_MAX_BYTES);
+  let text6 = String(block.text ?? "");
+  const trunc = truncateForLLM(text6, RESPONSE_MAX_BYTES);
   if (trunc.truncated) {
-    text = trunc.text + "\n\n... " + buildTruncationHint(
+    text6 = trunc.text + "\n\n... " + buildTruncationHint(
       meta.toolName,
       meta.args,
       trunc.totalBytes,
@@ -7607,11 +8718,11 @@ function postprocessResult(result, meta) {
     const parts = [`took ${tookStr}`, sizeStr];
     if (meta.serverIdLabel) parts.push(`server: ${meta.serverIdLabel}`);
     if (meta.cached) parts.push("cached");
-    text = `${text}
+    text6 = `${text6}
 
 [${parts.join(", ")}]`;
   }
-  return { ...result, content: [{ ...block, text }] };
+  return { ...result, content: [{ ...block, text: text6 }] };
 }
 function buildPipelineScript(commands, shell, marker, stopOnError) {
   if (shell === "powershell") {
@@ -8397,11 +9508,11 @@ CREATE TABLE IF NOT EXISTS _mcp_migrations (
   applied_by  TEXT
 );
 `.trim();
-function normaliseMigrationSql(sql27) {
-  return sql27.replace(/\r\n/g, "\n").trim() + "\n";
+function normaliseMigrationSql(sql28) {
+  return sql28.replace(/\r\n/g, "\n").trim() + "\n";
 }
-function migrationSha256(sql27) {
-  return createHash("sha256").update(normaliseMigrationSql(sql27), "utf8").digest("hex");
+function migrationSha256(sql28) {
+  return createHash("sha256").update(normaliseMigrationSql(sql28), "utf8").digest("hex");
 }
 function dollarQuoteTag(value) {
   let tag = "_mcp";
@@ -9468,6 +10579,79 @@ var TOOLS = [
       required: ["releaseProfile"]
     }
   },
+  {
+    name: "release-profile-list",
+    description: "List all release profiles with repo, enabled state, release type, GitHub key and a summary of their stages. Requires ci_cd permission.",
+    inputSchema: {
+      type: "object",
+      properties: {},
+      required: []
+    }
+  },
+  {
+    name: "release-profile-create",
+    description: "One-step release profile creation: scans the GitHub repo, detects apps (Next.js/Docker/PM2), creates the profile plus dev/prod stages with smart defaults (dev: release-dev + PR webhook + auto-approve, prod: release-prod + manual + DB backup) and seeds the stage apps. Release branches are created on GitHub automatically. Deployment servers must be assigned afterwards in the dashboard (Releases \u2192 Profiles). Requires ci_cd permission.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        repoFullName: {
+          type: "string",
+          description: 'Repository in "owner/name" format (e.g. MGSoftwareBV/mg-dashboard).'
+        },
+        githubKey: {
+          type: "string",
+          description: 'Named GitHub key (github_token label or owner, e.g. "AVARC Solutions") used for all GitHub API calls for this profile. Omit for the default MG Software token.'
+        },
+        name: {
+          type: "string",
+          description: 'Profile name override. Default: title-cased repo name (mg-dashboard \u2192 "Mg Dashboard").'
+        },
+        releaseType: {
+          type: "string",
+          enum: ["dev_only", "prod_only", "both"],
+          description: "Which stages to create (default: both = dev + prod)."
+        }
+      },
+      required: ["repoFullName"]
+    }
+  },
+  {
+    name: "release-profile-update",
+    description: "Update release profile settings. Locate the profile by name or repo. Changing releaseType reconfigures the stages (missing stages are created with smart defaults, out-of-scope stages are disabled). Requires ci_cd permission.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        releaseProfile: {
+          type: "string",
+          description: "Profile name or repo full name to locate the profile."
+        },
+        name: { type: "string", description: "New profile name." },
+        enabled: { type: "boolean", description: "Enable/disable the profile." },
+        releaseType: {
+          type: "string",
+          enum: ["dev_only", "prod_only", "both"],
+          description: "New release type \u2014 reconfigures stages accordingly."
+        },
+        githubKey: {
+          type: "string",
+          description: 'Named GitHub key (github_token label or owner). Pass "default" to reset to the default MG Software token.'
+        },
+        useChangesBranch: {
+          type: "boolean",
+          description: "Use a long-lived -changes accumulation branch."
+        },
+        hasTriggerDev: {
+          type: "boolean",
+          description: "Deploy Trigger.dev jobs during production releases."
+        },
+        workDirectory: {
+          type: "string",
+          description: 'Working directory within the repo (e.g. ".").'
+        }
+      },
+      required: ["releaseProfile"]
+    }
+  },
   {
     name: "cache-purge",
     description: 'Purge caches on a server. Default mode is **safe** (recommended): LiteSpeed file cache, WordPress/LiteSpeed plugin caches via wp-cli, PrestaShop file caches, graceful LiteSpeed reload \u2014 does NOT kill lsphp, FLUSHALL Redis, or hard-restart the web server.\n\nUse `mode: "full"` only when safe purge is insufficient: kills all lsphp (OPcache reset), clears Redis/Memcached entirely, and may hard-restart LiteSpeed \u2014 can briefly take sites offline or serve stale error pages until caches warm up (VCA multi-site risk).',
@@ -9567,7 +10751,7 @@ var TOOLS = [
   // ----- Trigger.dev -----
   ...TRIGGER_TOOLS
 ];
-var MCP_VERSION = "7.0.0";
+var MCP_VERSION = "7.0.5";
 async function handleListTools() {
   if (!authContext) return { tools: TOOLS };
   const accessible = TOOLS.filter((tool) => {
@@ -10593,8 +11777,8 @@ ${sample.join("\n")}${files.length > 5 ? `
             };
           const filtered = sortRows(applyFilter(only.rows));
           if (format === "json") {
-            const text2 = filtered.map((c) => JSON.stringify(c)).join("\n") || "(no containers)";
-            return { content: [{ type: "text", text: text2 }] };
+            const text7 = filtered.map((c) => JSON.stringify(c)).join("\n") || "(no containers)";
+            return { content: [{ type: "text", text: text7 }] };
           }
           if (groupByProject) {
             const groups = /* @__PURE__ */ new Map();
@@ -10621,8 +11805,8 @@ ${sample.join("\n")}${files.length > 5 ? `
           }
           const header = `${"NAMES".padEnd(36)}  ${"IMAGE".padEnd(40)}  ${"STATUS".padEnd(24)}  ${"HEALTH".padEnd(10)}  ${"PORTS".padEnd(40)}  PROJECT`;
           const body = filtered.map((r) => `${fmtRow(r)}  ${r.Project || ""}`);
-          const text = filtered.length === 0 ? "(no containers match)" : [header, ...body].join("\n");
-          return { content: [{ type: "text", text }] };
+          const text6 = filtered.length === 0 ? "(no containers match)" : [header, ...body].join("\n");
+          return { content: [{ type: "text", text: text6 }] };
         }
         if (format === "json") {
           const lines = [];
@@ -12009,6 +13193,170 @@ LIMIT ${limit};
           throw err;
         }
       }
+      case "release-profile-list": {
+        const profiles = await db.execute(sql`
+          SELECT
+            p.id, p.name, p.repo_full_name, p.enabled, p.release_type,
+            p.work_directory, p.use_changes_branch, p.has_trigger_dev,
+            gt.label AS github_key,
+            (
+              SELECT string_agg(
+                s.stage || ' (' || COALESCE(s.release_branch, '-') ||
+                  ', ' || COALESCE(s.trigger_mode, 'manual') ||
+                  CASE WHEN s.enabled THEN '' ELSE ', disabled' END || ')',
+                '; ' ORDER BY s.stage_order
+              )
+              FROM release_profile_stage s
+              WHERE s.release_profile_id = p.id
+            ) AS stages
+          FROM release_profile p
+          LEFT JOIN github_token gt ON gt.id = p.github_token_id
+          ORDER BY p.name
+        `);
+        if (profiles.length === 0) {
+          return {
+            content: [{ type: "text", text: "No release profiles found" }]
+          };
+        }
+        const lines = profiles.map((p) => {
+          const flags = [
+            p.enabled ? "enabled" : "disabled",
+            `type=${p.release_type ?? "both"}`,
+            `key=${p.github_key ?? "MG Software (default)"}`,
+            p.use_changes_branch ? "changes-branch" : null,
+            p.has_trigger_dev ? "trigger.dev" : null
+          ].filter(Boolean).join(", ");
+          return `${p.name} \u2014 ${p.repo_full_name} [${flags}]
+  stages: ${p.stages ?? "(none)"}`;
+        });
+        return {
+          content: [
+            {
+              type: "text",
+              text: `${profiles.length} release profile(s):
+
+${lines.join("\n\n")}`
+            }
+          ]
+        };
+      }
+      case "release-profile-create": {
+        const repoFullName = String(a.repoFullName ?? "").trim();
+        const githubTokenId = a.githubKey ? await resolveGitHubTokenIdByKey(String(a.githubKey)) : null;
+        const releaseType = a.releaseType ? String(a.releaseType) : null;
+        if (releaseType !== null && releaseType !== "dev_only" && releaseType !== "prod_only" && releaseType !== "both") {
+          throw new Error(
+            `Invalid releaseType "${releaseType}". Expected dev_only, prod_only, or both.`
+          );
+        }
+        try {
+          const result = await quickCreateReleaseProfile(
+            authContext.userId,
+            {
+              repoFullName,
+              githubTokenId,
+              name: a.name ? String(a.name) : null,
+              releaseType
+            }
+          );
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(
+                  {
+                    profileId: result.profile.id,
+                    name: result.profile.name,
+                    repo: repoFullName,
+                    releaseType: releaseType ?? "both",
+                    appsDetected: result.scan.apps.map((app) => ({
+                      path: app.path,
+                      label: app.label,
+                      deployMethod: app.deployMethod
+                    })),
+                    stages: result.stages.map((s) => ({
+                      stage: s.stage,
+                      name: s.name,
+                      releaseBranch: s.release_branch,
+                      triggerMode: s.trigger_mode
+                    })),
+                    branchWarnings: result.branchWarnings,
+                    hint: "Assign deployment servers per stage app in the dashboard (Releases \u2192 Profiles) before triggering a release."
+                  },
+                  null,
+                  2
+                )
+              }
+            ]
+          };
+        } catch (err) {
+          if (err instanceof ReleaseProfileQuickCreateError) {
+            throw new Error(err.message);
+          }
+          throw err;
+        }
+      }
+      case "release-profile-update": {
+        const identifier = String(a.releaseProfile ?? "").trim();
+        const profileRows = await db.execute(sql`
+          SELECT id, name FROM release_profile
+          WHERE name ILIKE ${identifier} OR repo_full_name ILIKE ${identifier}
+          LIMIT 1
+        `);
+        const profile = profileRows[0];
+        if (!profile) {
+          const all = await db.execute(
+            sql`SELECT name FROM release_profile ORDER BY name`
+          );
+          throw new Error(
+            `Release profile "${identifier}" not found. Available profiles: ${all.map((p) => p.name).join(", ") || "(none)"}`
+          );
+        }
+        const releaseType = a.releaseType ? String(a.releaseType) : void 0;
+        if (releaseType !== void 0 && releaseType !== "dev_only" && releaseType !== "prod_only" && releaseType !== "both") {
+          throw new Error(
+            `Invalid releaseType "${releaseType}". Expected dev_only, prod_only, or both.`
+          );
+        }
+        let githubTokenId;
+        if (a.githubKey !== void 0) {
+          const key = String(a.githubKey).trim();
+          githubTokenId = !key || key.toLowerCase() === "default" ? null : await resolveGitHubTokenIdByKey(key);
+        }
+        try {
+          const result = await updateReleaseProfileSettings(profile.id, {
+            name: a.name !== void 0 ? String(a.name) : void 0,
+            enabled: a.enabled !== void 0 ? a.enabled === true : void 0,
+            releaseType,
+            githubTokenId,
+            useChangesBranch: a.useChangesBranch !== void 0 ? a.useChangesBranch === true : void 0,
+            hasTriggerDev: a.hasTriggerDev !== void 0 ? a.hasTriggerDev === true : void 0,
+            workDirectory: a.workDirectory !== void 0 ? String(a.workDirectory) : void 0
+          });
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(
+                  {
+                    profileId: profile.id,
+                    name: result.profile.name,
+                    updated: true,
+                    stagesReconfigured: result.stagesReconfigured
+                  },
+                  null,
+                  2
+                )
+              }
+            ]
+          };
+        } catch (err) {
+          if (err instanceof ReleaseProfileQuickCreateError) {
+            throw new Error(err.message);
+          }
+          throw err;
+        }
+      }
       // ----- Cache Purge -----
       case "cache-purge": {
         const { conn, proxy } = await getServerConnection(String(a.serverId));
@@ -12031,7 +13379,7 @@ LIMIT ${limit};
       // ----- Domains (mijn.host) -----
       case "domain-list": {
         const res = await mijnhostFetch(
-          "/domains"
+          "/domains/"
         );
         const domains = res.data.domains;
         if (!domains.length) {