@mgsoftwarebv/mg-dashboard-mcp 7.0.6 → 7.0.8

package/dist/index.js

@@ -20,6 +20,7 @@ import { sql } from 'drizzle-orm';
 import { once } from 'events';
 import { lookup } from 'dns/promises';
 import { connect } from 'tls';
+import { pgTable, timestamp, jsonb, uuid, boolean, text, pgEnum, integer, uniqueIndex, index, bigint } from 'drizzle-orm/pg-core';
 import { tasks } from '@trigger.dev/sdk/v3';
 import { HeadObjectCommand, S3Client, ListObjectsV2Command, DeleteObjectsCommand, DeleteObjectCommand, CreateMultipartUploadCommand, UploadPartCommand, CompleteMultipartUploadCommand, AbortMultipartUploadCommand, PutObjectCommand, GetObjectCommand, CopyObjectCommand } from '@aws-sdk/client-s3';
 
@@ -618,6 +619,12 @@ var TERMINAL_STATUSES = /* @__PURE__ */ new Set([
   "INTERRUPTED",
   "EXPIRED"
 ]);
+var EXECUTE_PIPELINE_TASK = "execute-pipeline";
+function validateExecutePipelineTestPayload(payload) {
+  const stepIds = payload.stepIds;
+  if (Array.isArray(stepIds) && stepIds.length > 0) return null;
+  return 'execute-pipeline requires real stepIds from a release row. Use a lightweight task (e.g. "hello-world") for connectivity checks, or pass a payload with releaseId (UUID) and non-empty stepIds.';
+}
 var TRIGGER_SERVER_ID = "03659d55-e194-400d-b82a-bf6457371ded";
 var COMPOSE_PROJECT = "mg-dashboard-supabase-trigger";
 var PG_CONTAINER = `${COMPOSE_PROJECT}-postgres-1`;
@@ -677,10 +684,10 @@ var TRIGGER_TOOL_MODULE_MAP = {
   "trigger-run": "ci_cd"
 };
 async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
-  const sql28 = `SELECT re.\\"apiKey\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
+  const sql29 = `SELECT re.\\"apiKey\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
   const cmd = [
     `PORT=$(docker port "${WA_CONTAINER}" 3000/tcp 2>/dev/null | head -1 | sed 's/.*://')`,
-    `KEY=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql28}" 2>/dev/null | tr -d '[:space:]')`,
+    `KEY=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql29}" 2>/dev/null | tr -d '[:space:]')`,
     'echo "$PORT|$KEY"'
   ].join(" && ");
   const result = await sshExec2(conn, cmd, proxy);
@@ -701,8 +708,8 @@ async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
   return { port, apiKey: apiKey2 };
 }
 async function fetchRunLogs(runId, conn, proxy, sshExec2) {
-  const sql28 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
-  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql28}" 2>/dev/null`;
+  const sql29 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
+  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql29}" 2>/dev/null`;
   const result = await sshExec2(conn, cmd, proxy);
   const output = result.stdout.trim();
   if (!output) return "";
@@ -784,8 +791,8 @@ async function handleTriggerTool(name, args2, deps) {
   switch (name) {
     // -----------------------------------------------------------------
     case "trigger-list": {
-      const sql28 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
-      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql28}" 2>/dev/null`;
+      const sql29 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
+      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql29}" 2>/dev/null`;
       const result = await sshExec2(conn, cmd, proxy);
       const output = result.stdout.trim();
       if (!output) {
@@ -866,8 +873,15 @@ ${rawJson.substring(0, 500)}` }] };
             throw new Error(`Invalid JSON payload: ${String(args2.payload).substring(0, 200)}`);
           }
         }
+        const parsedPayload = JSON.parse(payload);
+        if (taskId === EXECUTE_PIPELINE_TASK) {
+          const validationError = validateExecutePipelineTestPayload(parsedPayload);
+          if (validationError) {
+            return { content: [{ type: "text", text: `Error: ${validationError}` }] };
+          }
+        }
         const triggerBody = JSON.stringify({
-          payload: JSON.parse(payload),
+          payload: parsedPayload,
           options: { tags: ["mcp-test"], test: true }
         });
         const triggerJson = await triggerApi(
@@ -943,9 +957,9 @@ async function fetchAndFormatRun(conn, proxy, sshExec2, instance, runId) {
     return { content: [{ type: "text", text: `Invalid API response:
 ${rawJson.substring(0, 500)}` }] };
   }
-  let text = formatRunDetail(run);
-  if (logs) text += "\n\n--- Logs ---\n" + logs;
-  return { content: [{ type: "text", text }] };
+  let text7 = formatRunDetail(run);
+  if (logs) text7 += "\n\n--- Logs ---\n" + logs;
+  return { content: [{ type: "text", text: text7 }] };
 }
 async function waitForCompletion(conn, proxy, sshExec2, instance, runId, waitSeconds) {
   const pollInterval = 3e3;
@@ -967,10 +981,10 @@ async function waitForCompletion(conn, proxy, sshExec2, instance, runId, waitSec
       continue;
     }
     if (TERMINAL_STATUSES.has(run.status)) {
-      let text = formatRunDetail(run);
+      let text7 = formatRunDetail(run);
       const logs = await fetchRunLogs(runId, conn, proxy, sshExec2);
-      if (logs) text += "\n\n--- Logs ---\n" + logs;
-      return { content: [{ type: "text", text }] };
+      if (logs) text7 += "\n\n--- Logs ---\n" + logs;
+      return { content: [{ type: "text", text: text7 }] };
     }
   }
   return {
@@ -3657,10 +3671,10 @@ var ZodObject = class _ZodObject extends ZodType {
   //   }) as any;
   //   return merged;
   // }
-  catchall(index) {
+  catchall(index5) {
     return new _ZodObject({
       ...this._def,
-      catchall: index
+      catchall: index5
     });
   }
   pick(mask) {
@@ -3978,9 +3992,9 @@ function mergeValues(a, b) {
       return { valid: false };
     }
     const newArray = [];
-    for (let index = 0; index < a.length; index++) {
-      const itemA = a[index];
-      const itemB = b[index];
+    for (let index5 = 0; index5 < a.length; index5++) {
+      const itemA = a[index5];
+      const itemB = b[index5];
       const sharedValue = mergeValues(itemA, itemB);
       if (!sharedValue.valid) {
         return { valid: false };
@@ -4186,10 +4200,10 @@ var ZodMap = class extends ZodType {
     }
     const keyType = this._def.keyType;
     const valueType = this._def.valueType;
-    const pairs = [...ctx.data.entries()].map(([key, value], index) => {
+    const pairs = [...ctx.data.entries()].map(([key, value], index5) => {
       return {
-        key: keyType._parse(new ParseInputLazyPath(ctx, key, ctx.path, [index, "key"])),
-        value: valueType._parse(new ParseInputLazyPath(ctx, value, ctx.path, [index, "value"]))
+        key: keyType._parse(new ParseInputLazyPath(ctx, key, ctx.path, [index5, "key"])),
+        value: valueType._parse(new ParseInputLazyPath(ctx, value, ctx.path, [index5, "value"]))
       };
     });
     if (ctx.common.async) {
@@ -5103,7 +5117,642 @@ external_exports.array(LitespeedVhostMappingSchema);
 function normalizeVhostDomain(value) {
   return value.trim().replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/\.+$/, "").toLowerCase();
 }
+var users = pgTable("user", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  email: text("email").notNull().unique(),
+  fullName: text("full_name"),
+  avatarUrl: text("avatar_url"),
+  emailVerified: boolean("email_verified").notNull().default(false),
+  roleId: uuid("role_id"),
+  permissions: jsonb("permissions"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable("session", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  token: text("token").notNull().unique(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  ipAddress: text("ip_address"),
+  userAgent: text("user_agent"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable("account", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  providerId: text("provider_id").notNull(),
+  accountId: text("account_id").notNull(),
+  password: text("password"),
+  accessToken: text("access_token"),
+  refreshToken: text("refresh_token"),
+  accessTokenExpiresAt: timestamp("access_token_expires_at", {
+    withTimezone: true
+  }),
+  refreshTokenExpiresAt: timestamp("refresh_token_expires_at", {
+    withTimezone: true
+  }),
+  scope: text("scope"),
+  idToken: text("id_token"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable("verification", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  identifier: text("identifier").notNull(),
+  value: text("value").notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable("two_factor", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  secret: text("secret").notNull(),
+  backupCodes: text("backup_codes")
+});
+var managedServerOs = pgEnum("managed_server_os", [
+  "linux",
+  "windows",
+  "unknown"
+]);
+var serverAgentStatus = pgEnum("server_agent_status", [
+  "not_installed",
+  "installing",
+  "online",
+  "degraded",
+  "offline",
+  "error"
+]);
+var resourceKind = pgEnum("resource_kind", [
+  "wordpress",
+  "prestashop",
+  "postgres_cluster",
+  "postgres_database",
+  "mysql_database",
+  "mariadb_database",
+  "boiler_project",
+  "boiler_web_project",
+  "static_site",
+  "docker_app",
+  "domain",
+  "backup_policy",
+  "server_service"
+]);
+var resourceStatus = pgEnum("resource_status", [
+  "unknown",
+  "healthy",
+  "degraded",
+  "failed",
+  "missing",
+  "provisioning",
+  "disabled"
+]);
+var resourceOwnership = pgEnum("resource_ownership", [
+  "managed",
+  "discovered",
+  "external"
+]);
+var operationStatus = pgEnum("operation_status", [
+  "queued",
+  "running",
+  "succeeded",
+  "failed",
+  "cancelled"
+]);
+var alertSeverity = pgEnum("alert_severity", [
+  "info",
+  "warning",
+  "critical"
+]);
+var managedServer = pgTable(
+  "managed_server",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    name: text("name").notNull(),
+    hostname: text("hostname").notNull(),
+    port: integer("port").notNull().default(22),
+    username: text("username").notNull(),
+    authMethod: text("auth_method").notNull().default("ssh_key"),
+    os: managedServerOs("os").notNull().default("unknown"),
+    provider: text("provider"),
+    region: text("region"),
+    tags: jsonb("tags").$type().notNull().default([]),
+    agentStatus: serverAgentStatus("agent_status").notNull().default("not_installed"),
+    agentVersion: text("agent_version"),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("managed_server_hostname_port_uidx").on(
+      table.hostname,
+      table.port
+    ),
+    index("managed_server_agent_status_idx").on(table.agentStatus)
+  ]
+);
+pgTable("server_credential", {
+  serverId: uuid("server_id").primaryKey().references(() => managedServer.id, { onDelete: "cascade" }),
+  passwordEncrypted: text("password_encrypted"),
+  sshKeyEncrypted: text("ssh_key_encrypted"),
+  sshKeyPassphraseEncrypted: text("ssh_key_passphrase_encrypted"),
+  dbRootPasswordEncrypted: text("db_root_password_encrypted"),
+  monitoringApiKeyEncrypted: text("monitoring_api_key_encrypted"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable(
+  "server_connection_log",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    userId: uuid("user_id").notNull(),
+    connectedAt: timestamp("connected_at", { withTimezone: true }).notNull().defaultNow(),
+    disconnectedAt: timestamp("disconnected_at", { withTimezone: true }),
+    durationSeconds: integer("duration_seconds"),
+    status: text("status").notNull(),
+    errorMessage: text("error_message"),
+    clientIp: text("client_ip"),
+    terminalCols: integer("terminal_cols"),
+    terminalRows: integer("terminal_rows"),
+    outputSizeBytes: bigint("output_size_bytes", { mode: "number" }).notNull().default(0),
+    inputSizeBytes: bigint("input_size_bytes", { mode: "number" }).notNull().default(0),
+    commandCount: integer("command_count").notNull().default(0),
+    connectionType: text("connection_type").notNull().default("terminal"),
+    action: text("action"),
+    rawOutput: text("raw_output"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("server_connection_log_server_idx").on(table.serverId),
+    index("server_connection_log_user_idx").on(table.userId),
+    index("server_connection_log_connected_idx").on(table.connectedAt),
+    index("server_connection_log_status_idx").on(table.status)
+  ]
+);
+pgTable(
+  "mcp_audit_log",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    apiKeyId: uuid("api_key_id"),
+    userId: uuid("user_id"),
+    toolName: text("tool_name"),
+    arguments: jsonb("arguments"),
+    ipAddress: text("ip_address"),
+    serverId: uuid("server_id"),
+    resultStatus: text("result_status").notNull().default("success"),
+    errorMessage: text("error_message"),
+    durationMs: integer("duration_ms"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("mcp_audit_log_created_at_idx").on(table.createdAt),
+    index("mcp_audit_log_user_idx").on(table.userId),
+    index("mcp_audit_log_tool_name_idx").on(table.toolName),
+    index("mcp_audit_log_server_idx").on(table.serverId),
+    index("mcp_audit_log_api_key_idx").on(table.apiKeyId),
+    index("mcp_audit_log_result_status_idx").on(table.resultStatus)
+  ]
+);
+var resource = pgTable(
+  "resource",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    parentResourceId: uuid("parent_resource_id"),
+    kind: resourceKind("kind").notNull(),
+    slug: text("slug").notNull(),
+    displayName: text("display_name").notNull(),
+    spec: jsonb("spec").$type().notNull().default({}),
+    state: jsonb("state").$type().notNull().default({}),
+    status: resourceStatus("status").notNull().default("unknown"),
+    ownership: resourceOwnership("ownership").notNull().default("managed"),
+    lastDetectedAt: timestamp("last_detected_at", { withTimezone: true }),
+    lastEventId: uuid("last_event_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("resource_server_kind_slug_uidx").on(
+      table.serverId,
+      table.kind,
+      table.slug
+    ),
+    index("resource_server_idx").on(table.serverId),
+    index("resource_parent_idx").on(table.parentResourceId),
+    index("resource_kind_status_idx").on(table.kind, table.status)
+  ]
+);
+pgTable(
+  "resource_event",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    resourceId: uuid("resource_id").notNull().references(() => resource.id, { onDelete: "cascade" }),
+    kind: text("kind").notNull(),
+    before: jsonb("before").$type(),
+    after: jsonb("after").$type(),
+    actorUserId: text("actor_user_id"),
+    operationId: uuid("operation_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("resource_event_resource_created_idx").on(
+      table.resourceId,
+      table.createdAt
+    ),
+    index("resource_event_operation_idx").on(table.operationId)
+  ]
+);
+var operation = pgTable(
+  "operation",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    kind: text("kind").notNull(),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "set null"
+    }),
+    serverId: uuid("server_id").references(() => managedServer.id, {
+      onDelete: "set null"
+    }),
+    status: operationStatus("status").notNull().default("queued"),
+    steps: jsonb("steps").$type().notNull().default([]),
+    idempotencyKey: text("idempotency_key").notNull(),
+    triggerRunId: text("trigger_run_id"),
+    logsR2Key: text("logs_r2_key"),
+    logs: text("logs"),
+    startedBy: text("started_by"),
+    startedAt: timestamp("started_at", { withTimezone: true }),
+    endedAt: timestamp("ended_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("operation_idempotency_uidx").on(table.idempotencyKey),
+    index("operation_resource_idx").on(table.resourceId),
+    index("operation_server_idx").on(table.serverId),
+    index("operation_status_created_idx").on(table.status, table.createdAt)
+  ]
+);
+pgTable(
+  "agent_installation",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    agentId: text("agent_id"),
+    version: text("version").notNull(),
+    installPath: text("install_path").notNull().default("/usr/local/bin/mg-agent"),
+    configHash: text("config_hash").notNull(),
+    status: serverAgentStatus("status").notNull().default("installing"),
+    lastHeartbeatAt: timestamp("last_heartbeat_at", { withTimezone: true }),
+    lastError: text("last_error"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("agent_installation_server_uidx").on(table.serverId),
+    index("agent_installation_status_idx").on(table.status)
+  ]
+);
+pgTable(
+  "monitoring_sample",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "cascade"
+    }),
+    metric: text("metric").notNull(),
+    value: integer("value").notNull(),
+    unit: text("unit").notNull(),
+    tags: jsonb("tags").$type().notNull().default({}),
+    sampledAt: timestamp("sampled_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("monitoring_sample_server_metric_time_idx").on(
+      table.serverId,
+      table.metric,
+      table.sampledAt
+    ),
+    // Descending on sampled_at so "latest metric per (server, metric)" lookups
+    // (DISTINCT ON ... ORDER BY sampled_at DESC) are served by an index-only
+    // scan instead of a full-table sort. The migration also adds
+    // INCLUDE (value, unit) to make it covering for the overview snapshot query
+    // (Drizzle 0.44 can't express INCLUDE here). See migration 20260529210000.
+    index("monitoring_sample_server_metric_time_desc_idx").on(
+      table.serverId,
+      table.metric,
+      table.sampledAt.desc()
+    ),
+    index("monitoring_sample_resource_metric_time_idx").on(
+      table.resourceId,
+      table.metric,
+      table.sampledAt
+    )
+  ]
+);
+var appLogSource = pgTable(
+  "app_log_source",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "set null"
+    }),
+    sourceType: text("source_type").notNull(),
+    sourceKey: text("source_key").notNull(),
+    displayName: text("display_name").notNull(),
+    path: text("path").notNull(),
+    enabled: boolean("enabled").notNull().default(true),
+    mutedUntil: timestamp("muted_until", { withTimezone: true }),
+    metadata: jsonb("metadata").$type().notNull().default({}),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("app_log_source_server_type_key_uidx").on(
+      table.serverId,
+      table.sourceType,
+      table.sourceKey
+    ),
+    index("app_log_source_server_idx").on(table.serverId),
+    index("app_log_source_resource_idx").on(table.resourceId),
+    index("app_log_source_type_seen_idx").on(
+      table.sourceType,
+      table.lastSeenAt
+    )
+  ]
+);
+pgTable(
+  "app_error_event",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "set null"
+    }),
+    logSourceId: uuid("log_source_id").references(() => appLogSource.id, {
+      onDelete: "set null"
+    }),
+    fingerprint: text("fingerprint").notNull(),
+    severity: text("severity").notNull().default("critical"),
+    category: text("category").notNull(),
+    sourceType: text("source_type").notNull(),
+    sourcePath: text("source_path").notNull(),
+    sampleMessage: text("sample_message").notNull(),
+    sampleLines: jsonb("sample_lines").$type().notNull().default([]),
+    signals: jsonb("signals").$type().notNull().default({}),
+    occurrences: integer("occurrences").notNull().default(1),
+    firstSeenAt: timestamp("first_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("app_error_event_fingerprint_created_idx").on(
+      table.fingerprint,
+      table.createdAt
+    ),
+    index("app_error_event_server_created_idx").on(
+      table.serverId,
+      table.createdAt
+    ),
+    index("app_error_event_resource_created_idx").on(
+      table.resourceId,
+      table.createdAt
+    ),
+    index("app_error_event_severity_created_idx").on(
+      table.severity,
+      table.createdAt
+    )
+  ]
+);
+pgTable(
+  "app_error_alert",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    fingerprint: text("fingerprint").notNull(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "set null"
+    }),
+    logSourceId: uuid("log_source_id").references(() => appLogSource.id, {
+      onDelete: "set null"
+    }),
+    severity: text("severity").notNull().default("critical"),
+    status: text("status").notNull().default("open"),
+    category: text("category").notNull(),
+    title: text("title").notNull(),
+    lastError: text("last_error").notNull(),
+    sampleLines: jsonb("sample_lines").$type().notNull().default([]),
+    signals: jsonb("signals").$type().notNull().default({}),
+    failureCount: integer("failure_count").notNull().default(1),
+    firstSeenAt: timestamp("first_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    lastAlertAt: timestamp("last_alert_at", { withTimezone: true }),
+    resolvedAt: timestamp("resolved_at", { withTimezone: true }),
+    mutedUntil: timestamp("muted_until", { withTimezone: true }),
+    cursorPrompt: text("cursor_prompt"),
+    telegramChatId: text("telegram_chat_id"),
+    telegramMessageId: bigint("telegram_message_id", { mode: "number" }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("app_error_alert_fingerprint_uidx").on(table.fingerprint),
+    index("app_error_alert_status_seen_idx").on(
+      table.status,
+      table.lastSeenAt
+    ),
+    index("app_error_alert_server_seen_idx").on(
+      table.serverId,
+      table.lastSeenAt
+    ),
+    index("app_error_alert_resource_seen_idx").on(
+      table.resourceId,
+      table.lastSeenAt
+    ),
+    index("app_error_alert_alerted_idx").on(table.lastAlertAt)
+  ]
+);
+pgTable(
+  "alert_rule",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").references(() => managedServer.id, {
+      onDelete: "cascade"
+    }),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "cascade"
+    }),
+    metric: text("metric").notNull(),
+    expression: text("expression").notNull(),
+    severity: alertSeverity("severity").notNull().default("warning"),
+    cooldownSeconds: integer("cooldown_seconds").notNull().default(900),
+    enabled: boolean("enabled").notNull().default(true),
+    routes: jsonb("routes").$type().notNull().default({}),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("alert_rule_server_idx").on(table.serverId),
+    index("alert_rule_resource_idx").on(table.resourceId),
+    index("alert_rule_enabled_severity_idx").on(table.enabled, table.severity)
+  ]
+);
+pgTable(
+  "deployment_project_server",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    releaseProfileStageId: uuid("release_profile_stage_id").notNull(),
+    sshServerId: uuid("ssh_server_id").notNull(),
+    deployPath: text("deploy_path").notNull(),
+    deployPathNormalized: text("deploy_path_normalized"),
+    pm2PortBase: integer("pm2_port_base").notNull(),
+    postgresHost: text("postgres_host"),
+    postgresPort: integer("postgres_port"),
+    buildFilters: text("build_filters"),
+    envSymlinkDirs: jsonb("env_symlink_dirs"),
+    litespeedVhosts: jsonb("litespeed_vhosts"),
+    litespeedVhostsCheckedAt: timestamp("litespeed_vhosts_checked_at", {
+      withTimezone: true
+    }),
+    litespeedVhostsCheckOk: boolean("litespeed_vhosts_check_ok"),
+    ecosystemConfig: text("ecosystem_config").notNull().default("ecosystem.config.cjs"),
+    usePipelineDeploy: boolean("use_pipeline_deploy").notNull().default(true),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("deployment_project_server_stage_server_uidx").on(
+      table.releaseProfileStageId,
+      table.sshServerId
+    ),
+    uniqueIndex("deployment_project_server_server_path_uidx").on(
+      table.sshServerId,
+      table.deployPathNormalized
+    ),
+    uniqueIndex("deployment_project_server_server_port_uidx").on(
+      table.sshServerId,
+      table.pm2PortBase
+    )
+  ]
+);
+var dnsMigrationStatus = pgEnum("dns_migration_status", [
+  "pending",
+  "scanned",
+  "imported",
+  "verified"
+]);
+var dnsMigration = pgTable(
+  "dns_migration",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    domain: text("domain").notNull(),
+    sourceProvider: text("source_provider").notNull().default("hostnet"),
+    status: dnsMigrationStatus("status").notNull().default("pending"),
+    scannedRecords: jsonb("scanned_records").$type().notNull().default([]),
+    sourceNameservers: jsonb("source_nameservers").$type().notNull().default([]),
+    currentNameservers: jsonb("current_nameservers").$type().notNull().default([]),
+    importResult: jsonb("import_result").$type(),
+    emailChecklist: jsonb("email_checklist").$type().notNull().default({}),
+    directadminHost: text("directadmin_host"),
+    directadminUsername: text("directadmin_username"),
+    directadminPasswordEncrypted: text("directadmin_password_encrypted"),
+    syncServerId: uuid("sync_server_id").references(() => managedServer.id, {
+      onDelete: "set null"
+    }),
+    syncOperationId: uuid("sync_operation_id").references(() => operation.id, {
+      onDelete: "set null"
+    }),
+    mailRecordsImportedAt: timestamp("mail_records_imported_at", {
+      withTimezone: true
+    }),
+    notes: text("notes"),
+    lastError: text("last_error"),
+    lastScannedAt: timestamp("last_scanned_at", { withTimezone: true }),
+    importedAt: timestamp("imported_at", { withTimezone: true }),
+    verifiedAt: timestamp("verified_at", { withTimezone: true }),
+    createdBy: text("created_by"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("dns_migration_domain_idx").on(table.domain),
+    index("dns_migration_status_created_idx").on(
+      table.status,
+      table.createdAt
+    )
+  ]
+);
+var dnsMigrationMailboxStatus = pgEnum(
+  "dns_migration_mailbox_status",
+  ["pending", "provisioned", "syncing", "synced", "delta_synced", "failed"]
+);
+pgTable(
+  "dns_migration_mailbox",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    migrationId: uuid("migration_id").notNull().references(() => dnsMigration.id, { onDelete: "cascade" }),
+    address: text("address").notNull(),
+    sourcePasswordEncrypted: text("source_password_encrypted"),
+    destPasswordEncrypted: text("dest_password_encrypted"),
+    status: dnsMigrationMailboxStatus("status").notNull().default("pending"),
+    syncStats: jsonb("sync_stats").$type(),
+    lastError: text("last_error"),
+    provisionedAt: timestamp("provisioned_at", { withTimezone: true }),
+    lastSyncedAt: timestamp("last_synced_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("dns_migration_mailbox_migration_address_uidx").on(
+      table.migrationId,
+      table.address
+    ),
+    index("dns_migration_mailbox_migration_idx").on(table.migrationId)
+  ]
+);
+pgTable(
+  "github_token",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    label: text("label").notNull(),
+    owner: text("owner"),
+    notes: text("notes"),
+    tokenEncrypted: text("token_encrypted").notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("github_token_label_idx").on(table.label),
+    index("github_token_owner_idx").on(table.owner)
+  ]
+);
+pgTable(
+  "github_webhook_secret",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    label: text("label").notNull(),
+    owner: text("owner"),
+    notes: text("notes"),
+    secretEncrypted: text("secret_encrypted").notNull(),
+    enabled: boolean("enabled").notNull().default(true),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("github_webhook_secret_label_idx").on(table.label),
+    index("github_webhook_secret_owner_idx").on(table.owner)
+  ]
+);
+function assertPipelinePayload(payload) {
+  if (!payload.stepIds?.length) {
+    throw new Error("Cannot trigger execute-pipeline: stepIds is empty");
+  }
+}
 async function triggerPipeline(payload) {
+  assertPipelinePayload(payload);
   return tasks.trigger(
     "execute-pipeline",
     payload
@@ -5555,6 +6204,24 @@ async function createReleaseForStage(userId, params) {
   if (!triggerAuthorName && userId) {
     triggerAuthorName = await resolveUserDisplayName(userId);
   }
+  const enabledSteps = buildStepList(
+    stage,
+    profile,
+    await resolveBuildStepListOptions({
+      profile,
+      triggerSha,
+      githubToken: token,
+      isManual: triggerType === "manual" || triggerType === "mcp",
+      stageId: params.stageId,
+      deployRetryScripts: stage.deploy_retry_scripts
+    })
+  );
+  if (enabledSteps.length === 0) {
+    throw new CreateReleaseError(
+      "No pipeline steps configured for this stage (enable a PM2/Docker stage_app or deployment_project_server)",
+      "PRECONDITION_FAILED"
+    );
+  }
   const initialStatus = "running";
   let release;
   try {
@@ -5588,18 +6255,6 @@ async function createReleaseForStage(userId, params) {
       "INTERNAL_SERVER_ERROR"
     );
   }
-  const enabledSteps = buildStepList(
-    stage,
-    profile,
-    await resolveBuildStepListOptions({
-      profile,
-      triggerSha,
-      githubToken: token,
-      isManual: triggerType === "manual" || triggerType === "mcp",
-      stageId: params.stageId,
-      deployRetryScripts: stage.deploy_retry_scripts
-    })
-  );
   const stepIds = [];
   try {
     stepIds.push(...await insertReleaseSteps(release.id, enabledSteps));
@@ -5667,10 +6322,10 @@ function inferDeployMethod(folderName, hasNextConfig, hasDockerfile, hasPm2Ecosy
 function toLabel(folderName) {
   return folderName.charAt(0).toUpperCase() + folderName.slice(1);
 }
-async function scanRepoForApps(repoFullName, githubToken, ref = "main") {
+async function scanRepoForApps(repoFullName, githubToken2, ref = "main") {
   const headers = {
     Accept: "application/vnd.github.v3+json",
-    Authorization: `Bearer ${githubToken}`,
+    Authorization: `Bearer ${githubToken2}`,
     "Content-Type": "application/json"
   };
   async function fetchContents(path) {
@@ -5816,10 +6471,10 @@ function toStageApps(apps) {
     enabled: a.enabled
   }));
 }
-async function ensureGitHubBranchExists(repoFullName, branchName, fromBranch, githubToken) {
+async function ensureGitHubBranchExists(repoFullName, branchName, fromBranch, githubToken2) {
   const headers = {
     Accept: "application/vnd.github.v3+json",
-    Authorization: `Bearer ${githubToken}`,
+    Authorization: `Bearer ${githubToken2}`,
     "Content-Type": "application/json"
   };
   const checkRes = await fetch(
@@ -6822,7 +7477,7 @@ function getEncryptionKey() {
     throw new Error("ENCRYPTION_KEY must be a 64-character hex string");
   return buf;
 }
-function encrypt(text) {
+function encrypt(text7) {
   const key = getEncryptionKey();
   const iv = randomBytes(ENC_IV_LENGTH);
   const cipher = createCipheriv(
@@ -6830,7 +7485,7 @@ function encrypt(text) {
     new Uint8Array(key),
     new Uint8Array(iv)
   );
-  let encrypted = cipher.update(text, "utf8", "hex");
+  let encrypted = cipher.update(text7, "utf8", "hex");
   encrypted += cipher.final("hex");
   const authTag = cipher.getAuthTag();
   return Buffer.concat([
@@ -7550,10 +8205,10 @@ async function r2GetObjectRange(bucket, key, range) {
     const body = result.Body;
     if (!body?.transformToString)
       throw new Error("R2 returned no readable body");
-    const text = await body.transformToString();
+    const text7 = await body.transformToString();
     const header = `# range: bytes ${range.offset}-${end} of ${size} (${effectiveLen} bytes)`;
     return `${header}
-${text}`;
+${text7}`;
   } catch (e) {
     throw r2WrapError(bucket, key, e);
   }
@@ -7916,15 +8571,15 @@ async function sftpRead(opts, filePath, proxy, options) {
             clearTimeout(timer);
             cleanup?.();
             cleanup = void 0;
-            const text = Buffer.concat(
+            const text7 = Buffer.concat(
               chunks.map((ch) => new Uint8Array(ch))
             ).toString("utf-8");
             if (!isWholeFileRequest) {
               const header = `# range: bytes ${offset}-${offset + effectiveLen - 1} of ${total} (${effectiveLen} bytes)`;
               resolve(`${header}
-${text}`);
+${text7}`);
             } else {
-              resolve(text);
+              resolve(text7);
             }
           });
           rs.on("error", (e) => {
@@ -8054,11 +8709,11 @@ function getKnownContainers(serverId, maxAgeMs = 5 * 6e4) {
   if (Date.now() - e.capturedAt > maxAgeMs) return void 0;
   return e.names;
 }
-function truncateForLLM(text, maxBytes) {
-  const totalBytes = Buffer.byteLength(text, "utf8");
+function truncateForLLM(text7, maxBytes) {
+  const totalBytes = Buffer.byteLength(text7, "utf8");
   if (totalBytes <= maxBytes)
-    return { text, truncated: false, totalBytes, shownBytes: totalBytes };
-  const buf = Buffer.from(text, "utf8");
+    return { text: text7, truncated: false, totalBytes, shownBytes: totalBytes };
+  const buf = Buffer.from(text7, "utf8");
   let cut = maxBytes;
   while (cut > 0 && (buf[cut] & 192) === 128) cut--;
   const head = buf.subarray(0, cut).toString("utf8");
@@ -8088,10 +8743,10 @@ function isTransientSshError(stderr, exitCode) {
 function postprocessResult(result, meta) {
   if (!result.content?.length) return result;
   const block = result.content[0];
-  let text = String(block.text ?? "");
-  const trunc = truncateForLLM(text, RESPONSE_MAX_BYTES);
+  let text7 = String(block.text ?? "");
+  const trunc = truncateForLLM(text7, RESPONSE_MAX_BYTES);
   if (trunc.truncated) {
-    text = trunc.text + "\n\n... " + buildTruncationHint(
+    text7 = trunc.text + "\n\n... " + buildTruncationHint(
       meta.toolName,
       meta.args,
       trunc.totalBytes,
@@ -8105,11 +8760,11 @@ function postprocessResult(result, meta) {
     const parts = [`took ${tookStr}`, sizeStr];
     if (meta.serverIdLabel) parts.push(`server: ${meta.serverIdLabel}`);
     if (meta.cached) parts.push("cached");
-    text = `${text}
+    text7 = `${text7}
 
 [${parts.join(", ")}]`;
   }
-  return { ...result, content: [{ ...block, text }] };
+  return { ...result, content: [{ ...block, text: text7 }] };
 }
 function buildPipelineScript(commands, shell, marker, stopOnError) {
   if (shell === "powershell") {
@@ -8895,11 +9550,11 @@ CREATE TABLE IF NOT EXISTS _mcp_migrations (
   applied_by  TEXT
 );
 `.trim();
-function normaliseMigrationSql(sql28) {
-  return sql28.replace(/\r\n/g, "\n").trim() + "\n";
+function normaliseMigrationSql(sql29) {
+  return sql29.replace(/\r\n/g, "\n").trim() + "\n";
 }
-function migrationSha256(sql28) {
-  return createHash("sha256").update(normaliseMigrationSql(sql28), "utf8").digest("hex");
+function migrationSha256(sql29) {
+  return createHash("sha256").update(normaliseMigrationSql(sql29), "utf8").digest("hex");
 }
 function dollarQuoteTag(value) {
   let tag = "_mcp";
@@ -11164,8 +11819,8 @@ ${sample.join("\n")}${files.length > 5 ? `
             };
           const filtered = sortRows(applyFilter(only.rows));
           if (format === "json") {
-            const text2 = filtered.map((c) => JSON.stringify(c)).join("\n") || "(no containers)";
-            return { content: [{ type: "text", text: text2 }] };
+            const text8 = filtered.map((c) => JSON.stringify(c)).join("\n") || "(no containers)";
+            return { content: [{ type: "text", text: text8 }] };
           }
           if (groupByProject) {
             const groups = /* @__PURE__ */ new Map();
@@ -11192,8 +11847,8 @@ ${sample.join("\n")}${files.length > 5 ? `
           }
           const header = `${"NAMES".padEnd(36)}  ${"IMAGE".padEnd(40)}  ${"STATUS".padEnd(24)}  ${"HEALTH".padEnd(10)}  ${"PORTS".padEnd(40)}  PROJECT`;
           const body = filtered.map((r) => `${fmtRow(r)}  ${r.Project || ""}`);
-          const text = filtered.length === 0 ? "(no containers match)" : [header, ...body].join("\n");
-          return { content: [{ type: "text", text }] };
+          const text7 = filtered.length === 0 ? "(no containers match)" : [header, ...body].join("\n");
+          return { content: [{ type: "text", text: text7 }] };
         }
         if (format === "json") {
           const lines = [];
@@ -12766,7 +13421,7 @@ ${lines.join("\n\n")}`
       // ----- Domains (mijn.host) -----
       case "domain-list": {
         const res = await mijnhostFetch(
-          "/domains"
+          "/domains/"
         );
         const domains = res.data.domains;
         if (!domains.length) {