@mgsoftwarebv/mg-dashboard-mcp 7.4.21 → 7.4.22

package/dist/index.js

@@ -18,11 +18,11 @@ import { AsyncLocalStorage } from 'async_hooks';
 import { drizzle } from 'drizzle-orm/postgres-js';
 import postgres from 'postgres';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { sql } from 'drizzle-orm';
+import { sql, or, eq, and, inArray, like, desc } from 'drizzle-orm';
 import { once } from 'events';
 import { lookup } from 'dns/promises';
 import { connect } from 'tls';
-import { pgTable, timestamp, uuid, jsonb, boolean, text, customType, integer, date, real, index, uniqueIndex, pgEnum, check, bigint, doublePrecision, primaryKey, foreignKey } from 'drizzle-orm/pg-core';
+import { pgEnum, pgTable, timestamp, text, jsonb, integer, uuid, uniqueIndex, index, bigint, boolean, customType, date, real, check, doublePrecision, primaryKey, foreignKey } from 'drizzle-orm/pg-core';
 import { HeadObjectCommand, ListObjectsV2Command, DeleteObjectsCommand, S3Client, DeleteObjectCommand, CreateMultipartUploadCommand, UploadPartCommand, CompleteMultipartUploadCommand, AbortMultipartUploadCommand, PutObjectCommand, GetObjectCommand, CopyObjectCommand } from '@aws-sdk/client-s3';
 
 var __defProp = Object.defineProperty;
@@ -553,7 +553,7 @@ async function fetchViaSshProxy(options) {
     headers["Content-Length"] = String(Buffer.byteLength(body));
   }
   headers.Host = parsedUrl.host;
-  const ssh = await connectSsh(options.proxy);
+  const ssh2 = await connectSsh(options.proxy);
   const timeoutMs = options.timeoutMs ?? 6e4;
   let timer;
   try {
@@ -563,7 +563,7 @@ async function fetchViaSshProxy(options) {
       connectHost = resolved.address;
     } catch {
     }
-    const stream = await forwardOut(ssh, connectHost, targetPort);
+    const stream = await forwardOut(ssh2, connectHost, targetPort);
     const tlsSocket = connect({
       socket: stream,
       servername: targetHost,
@@ -625,7 +625,7 @@ async function fetchViaSshProxy(options) {
     });
   } finally {
     if (timer) clearTimeout(timer);
-    ssh.end();
+    ssh2.end();
   }
 }
 
@@ -724,10 +724,10 @@ var TRIGGER_TOOL_MODULE_MAP = {
   "trigger-env": "settings"
 };
 async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
-  const sql31 = `SELECT re.\\"apiKey\\" || '~~' || p.\\"externalRef\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
+  const sql33 = `SELECT re.\\"apiKey\\" || '~~' || p.\\"externalRef\\" FROM \\"RuntimeEnvironment\\" re JOIN \\"Project\\" p ON re.\\"projectId\\" = p.id WHERE p.slug='${projectSlug}' AND re.slug='prod' LIMIT 1`;
   const cmd = [
     `PORT=$(docker port "${WA_CONTAINER}" 3000/tcp 2>/dev/null | head -1 | sed 's/.*://')`,
-    `ROW=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql31}" 2>/dev/null | tr -d '[:space:]')`,
+    `ROW=$(docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql33}" 2>/dev/null | tr -d '[:space:]')`,
     'echo "$PORT|$ROW"'
   ].join(" && ");
   const result = await sshExec2(conn, cmd, proxy);
@@ -749,8 +749,8 @@ async function discoverInstance(projectSlug, conn, proxy, sshExec2) {
   return { port, apiKey: apiKey2, projectRef: projectRef || "" };
 }
 async function fetchRunLogs(runId, conn, proxy, sshExec2) {
-  const sql31 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
-  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql31}" 2>/dev/null`;
+  const sql33 = `SELECT level, message, \\"isError\\", \\"createdAt\\" FROM \\"TaskEvent\\" WHERE \\"runId\\" = '${runId}' AND level IN ('INFO','WARN','ERROR','DEBUG','LOG','TRACE') ORDER BY \\"startTime\\" ASC LIMIT 200`;
+  const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql33}" 2>/dev/null`;
   const result = await sshExec2(conn, cmd, proxy);
   const output = result.stdout.trim();
   if (!output) return "";
@@ -832,8 +832,8 @@ async function handleTriggerTool(name, args2, deps) {
   switch (name) {
     // -----------------------------------------------------------------
     case "trigger-list": {
-      const sql31 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
-      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql31}" 2>/dev/null`;
+      const sql33 = 'SELECT slug, name FROM \\"Project\\" ORDER BY name';
+      const cmd = `docker exec "${PG_CONTAINER}" psql -U postgres -d main -t -A -c "${sql33}" 2>/dev/null`;
       const result = await sshExec2(conn, cmd, proxy);
       const output = result.stdout.trim();
       if (!output) {
@@ -1011,9 +1011,9 @@ ${raw2.substring(0, 500)}` }] };
           return { content: [{ type: "text", text: `No environment variables for ${project}/${env}.` }] };
         }
         const lines = vars.map((v) => `${v.isSecret ? "[secret]" : "        "}  ${v.name}`).sort();
-        const text21 = `Env vars for ${project}/${env} (${vars.length}) \u2014 values hidden, use action="get" with a key:
+        const text22 = `Env vars for ${project}/${env} (${vars.length}) \u2014 values hidden, use action="get" with a key:
 ` + "-".repeat(50) + "\n" + lines.join("\n");
-        return { content: [{ type: "text", text: text21 }] };
+        return { content: [{ type: "text", text: text22 }] };
       }
       if (action === "get") {
         const key2 = String(args2.key ?? "");
@@ -1100,9 +1100,9 @@ async function fetchAndFormatRun(conn, proxy, sshExec2, instance, runId) {
     return { content: [{ type: "text", text: `Invalid API response:
 ${rawJson.substring(0, 500)}` }] };
   }
-  let text21 = formatRunDetail(run);
-  if (logs) text21 += "\n\n--- Logs ---\n" + logs;
-  return { content: [{ type: "text", text: text21 }] };
+  let text22 = formatRunDetail(run);
+  if (logs) text22 += "\n\n--- Logs ---\n" + logs;
+  return { content: [{ type: "text", text: text22 }] };
 }
 async function waitForCompletion(conn, proxy, sshExec2, instance, runId, waitSeconds) {
   const pollInterval = 3e3;
@@ -1124,10 +1124,10 @@ async function waitForCompletion(conn, proxy, sshExec2, instance, runId, waitSec
       continue;
     }
     if (TERMINAL_STATUSES.has(run.status)) {
-      let text21 = formatRunDetail(run);
+      let text22 = formatRunDetail(run);
       const logs = await fetchRunLogs(runId, conn, proxy, sshExec2);
-      if (logs) text21 += "\n\n--- Logs ---\n" + logs;
-      return { content: [{ type: "text", text: text21 }] };
+      if (logs) text22 += "\n\n--- Logs ---\n" + logs;
+      return { content: [{ type: "text", text: text22 }] };
     }
   }
   return {
@@ -1391,11 +1391,11 @@ function tokenFromDotenv(content) {
   for (const line of content.split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
-    const eq4 = trimmed.indexOf("=");
-    if (eq4 < 1) continue;
-    const key = trimmed.slice(0, eq4).trim();
+    const eq5 = trimmed.indexOf("=");
+    if (eq5 < 1) continue;
+    const key = trimmed.slice(0, eq5).trim();
     if (key !== "MAILSERVER_MCP_TOKEN") continue;
-    let value = trimmed.slice(eq4 + 1).trim();
+    let value = trimmed.slice(eq5 + 1).trim();
     if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
       value = value.slice(1, -1);
     }
@@ -1500,12 +1500,12 @@ async function mailserverFetch(deps, plan) {
     },
     body: plan.body ? JSON.stringify(plan.body) : void 0
   });
-  const text21 = await res.text();
-  let json = text21;
+  const text22 = await res.text();
+  let json = text22;
   try {
-    json = text21 ? JSON.parse(text21) : null;
+    json = text22 ? JSON.parse(text22) : null;
   } catch {
-    json = { error: text21.slice(0, 500) };
+    json = { error: text22.slice(0, 500) };
   }
   return { status: res.status, json };
 }
@@ -1567,6 +1567,470 @@ async function handleMailserverTool(args2, deps) {
     ]
   };
 }
+var managedServerOs = pgEnum("managed_server_os", [
+  "linux",
+  "windows",
+  "unknown"
+]);
+var serverAgentStatus = pgEnum("server_agent_status", [
+  "not_installed",
+  "installing",
+  "online",
+  "degraded",
+  "offline",
+  "error"
+]);
+var resourceKind = pgEnum("resource_kind", [
+  "wordpress",
+  "prestashop",
+  "postgres_cluster",
+  "postgres_database",
+  "mysql_database",
+  "mariadb_database",
+  "boiler_project",
+  "boiler_web_project",
+  "static_site",
+  "docker_app",
+  "domain",
+  "backup_policy",
+  "server_service"
+]);
+var resourceStatus = pgEnum("resource_status", [
+  "unknown",
+  "healthy",
+  "degraded",
+  "failed",
+  "missing",
+  "provisioning",
+  "disabled"
+]);
+var resourceOwnership = pgEnum("resource_ownership", [
+  "managed",
+  "discovered",
+  "external"
+]);
+var operationStatus = pgEnum("operation_status", [
+  "queued",
+  "running",
+  "succeeded",
+  "failed",
+  "cancelled"
+]);
+var alertSeverity = pgEnum("alert_severity", [
+  "info",
+  "warning",
+  "critical"
+]);
+var managedServer = pgTable(
+  "managed_server",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    name: text("name").notNull(),
+    hostname: text("hostname").notNull(),
+    port: integer("port").notNull().default(22),
+    username: text("username").notNull(),
+    authMethod: text("auth_method").notNull().default("ssh_key"),
+    os: managedServerOs("os").notNull().default("unknown"),
+    provider: text("provider"),
+    region: text("region"),
+    tags: jsonb("tags").$type().notNull().default([]),
+    agentStatus: serverAgentStatus("agent_status").notNull().default("not_installed"),
+    agentVersion: text("agent_version"),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("managed_server_hostname_port_uidx").on(
+      table.hostname,
+      table.port
+    ),
+    index("managed_server_agent_status_idx").on(table.agentStatus)
+  ]
+);
+pgTable("server_credential", {
+  serverId: uuid("server_id").primaryKey().references(() => managedServer.id, { onDelete: "cascade" }),
+  passwordEncrypted: text("password_encrypted"),
+  sshKeyEncrypted: text("ssh_key_encrypted"),
+  sshKeyPassphraseEncrypted: text("ssh_key_passphrase_encrypted"),
+  dbRootPasswordEncrypted: text("db_root_password_encrypted"),
+  monitoringApiKeyEncrypted: text("monitoring_api_key_encrypted"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable(
+  "server_connection_log",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    userId: uuid("user_id").notNull(),
+    connectedAt: timestamp("connected_at", { withTimezone: true }).notNull().defaultNow(),
+    disconnectedAt: timestamp("disconnected_at", { withTimezone: true }),
+    durationSeconds: integer("duration_seconds"),
+    status: text("status").notNull(),
+    errorMessage: text("error_message"),
+    clientIp: text("client_ip"),
+    terminalCols: integer("terminal_cols"),
+    terminalRows: integer("terminal_rows"),
+    outputSizeBytes: bigint("output_size_bytes", { mode: "number" }).notNull().default(0),
+    inputSizeBytes: bigint("input_size_bytes", { mode: "number" }).notNull().default(0),
+    commandCount: integer("command_count").notNull().default(0),
+    connectionType: text("connection_type").notNull().default("terminal"),
+    action: text("action"),
+    rawOutput: text("raw_output"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("server_connection_log_server_idx").on(table.serverId),
+    index("server_connection_log_user_idx").on(table.userId),
+    index("server_connection_log_connected_idx").on(table.connectedAt),
+    index("server_connection_log_status_idx").on(table.status)
+  ]
+);
+pgTable(
+  "mcp_audit_log",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    apiKeyId: uuid("api_key_id"),
+    userId: uuid("user_id"),
+    toolName: text("tool_name"),
+    arguments: jsonb("arguments"),
+    ipAddress: text("ip_address"),
+    serverId: uuid("server_id"),
+    resultStatus: text("result_status").notNull().default("success"),
+    errorMessage: text("error_message"),
+    durationMs: integer("duration_ms"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("mcp_audit_log_created_at_idx").on(table.createdAt),
+    index("mcp_audit_log_user_idx").on(table.userId),
+    index("mcp_audit_log_tool_name_idx").on(table.toolName),
+    index("mcp_audit_log_server_idx").on(table.serverId),
+    index("mcp_audit_log_api_key_idx").on(table.apiKeyId),
+    index("mcp_audit_log_result_status_idx").on(table.resultStatus)
+  ]
+);
+var resource = pgTable(
+  "resource",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    parentResourceId: uuid("parent_resource_id"),
+    kind: resourceKind("kind").notNull(),
+    slug: text("slug").notNull(),
+    displayName: text("display_name").notNull(),
+    spec: jsonb("spec").$type().notNull().default({}),
+    state: jsonb("state").$type().notNull().default({}),
+    status: resourceStatus("status").notNull().default("unknown"),
+    ownership: resourceOwnership("ownership").notNull().default("managed"),
+    lastDetectedAt: timestamp("last_detected_at", { withTimezone: true }),
+    lastEventId: uuid("last_event_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("resource_server_kind_slug_uidx").on(
+      table.serverId,
+      table.kind,
+      table.slug
+    ),
+    index("resource_server_idx").on(table.serverId),
+    index("resource_parent_idx").on(table.parentResourceId),
+    index("resource_kind_status_idx").on(table.kind, table.status)
+  ]
+);
+pgTable(
+  "resource_event",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    resourceId: uuid("resource_id").notNull().references(() => resource.id, { onDelete: "cascade" }),
+    kind: text("kind").notNull(),
+    before: jsonb("before").$type(),
+    after: jsonb("after").$type(),
+    actorUserId: text("actor_user_id"),
+    operationId: uuid("operation_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("resource_event_resource_created_idx").on(
+      table.resourceId,
+      table.createdAt
+    ),
+    index("resource_event_operation_idx").on(table.operationId)
+  ]
+);
+var operation = pgTable(
+  "operation",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    kind: text("kind").notNull(),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "set null"
+    }),
+    serverId: uuid("server_id").references(() => managedServer.id, {
+      onDelete: "set null"
+    }),
+    status: operationStatus("status").notNull().default("queued"),
+    steps: jsonb("steps").$type().notNull().default([]),
+    idempotencyKey: text("idempotency_key").notNull(),
+    triggerRunId: text("trigger_run_id"),
+    logsR2Key: text("logs_r2_key"),
+    logs: text("logs"),
+    startedBy: text("started_by"),
+    startedAt: timestamp("started_at", { withTimezone: true }),
+    endedAt: timestamp("ended_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("operation_idempotency_uidx").on(table.idempotencyKey),
+    index("operation_resource_idx").on(table.resourceId),
+    index("operation_server_idx").on(table.serverId),
+    index("operation_status_created_idx").on(table.status, table.createdAt)
+  ]
+);
+pgTable(
+  "agent_installation",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    agentId: text("agent_id"),
+    version: text("version").notNull(),
+    installPath: text("install_path").notNull().default("/usr/local/bin/mg-agent"),
+    configHash: text("config_hash").notNull(),
+    status: serverAgentStatus("status").notNull().default("installing"),
+    lastHeartbeatAt: timestamp("last_heartbeat_at", { withTimezone: true }),
+    lastError: text("last_error"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("agent_installation_server_uidx").on(table.serverId),
+    index("agent_installation_status_idx").on(table.status)
+  ]
+);
+pgTable(
+  "monitoring_sample",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "cascade"
+    }),
+    metric: text("metric").notNull(),
+    value: integer("value").notNull(),
+    unit: text("unit").notNull(),
+    tags: jsonb("tags").$type().notNull().default({}),
+    sampledAt: timestamp("sampled_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("monitoring_sample_server_metric_time_idx").on(
+      table.serverId,
+      table.metric,
+      table.sampledAt
+    ),
+    // Descending on sampled_at so "latest metric per (server, metric)" lookups
+    // (DISTINCT ON ... ORDER BY sampled_at DESC) are served by an index-only
+    // scan instead of a full-table sort. The migration also adds
+    // INCLUDE (value, unit) to make it covering for the overview snapshot query
+    // (Drizzle 0.44 can't express INCLUDE here). See migration 20260529210000.
+    index("monitoring_sample_server_metric_time_desc_idx").on(
+      table.serverId,
+      table.metric,
+      table.sampledAt.desc()
+    ),
+    index("monitoring_sample_resource_metric_time_idx").on(
+      table.resourceId,
+      table.metric,
+      table.sampledAt
+    ),
+    // Retention cleanup (monitoring-sample-retention-cleanup) filters only on
+    // sampled_at. Without this index Postgres seq-scans the full firehose.
+    // Live DB name uses idx_ prefix (see migration 20260731070000).
+    index("idx_monitoring_sample_sampled_at").on(table.sampledAt)
+  ]
+);
+var appLogSource = pgTable(
+  "app_log_source",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "set null"
+    }),
+    sourceType: text("source_type").notNull(),
+    sourceKey: text("source_key").notNull(),
+    displayName: text("display_name").notNull(),
+    path: text("path").notNull(),
+    enabled: boolean("enabled").notNull().default(true),
+    mutedUntil: timestamp("muted_until", { withTimezone: true }),
+    metadata: jsonb("metadata").$type().notNull().default({}),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("app_log_source_server_type_key_uidx").on(
+      table.serverId,
+      table.sourceType,
+      table.sourceKey
+    ),
+    index("app_log_source_server_idx").on(table.serverId),
+    index("app_log_source_resource_idx").on(table.resourceId),
+    index("app_log_source_type_seen_idx").on(
+      table.sourceType,
+      table.lastSeenAt
+    )
+  ]
+);
+pgTable(
+  "app_error_event",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "set null"
+    }),
+    logSourceId: uuid("log_source_id").references(() => appLogSource.id, {
+      onDelete: "set null"
+    }),
+    fingerprint: text("fingerprint").notNull(),
+    severity: text("severity").notNull().default("critical"),
+    category: text("category").notNull(),
+    sourceType: text("source_type").notNull(),
+    sourcePath: text("source_path").notNull(),
+    sampleMessage: text("sample_message").notNull(),
+    sampleLines: jsonb("sample_lines").$type().notNull().default([]),
+    signals: jsonb("signals").$type().notNull().default({}),
+    occurrences: integer("occurrences").notNull().default(1),
+    firstSeenAt: timestamp("first_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("app_error_event_fingerprint_created_idx").on(
+      table.fingerprint,
+      table.createdAt
+    ),
+    index("app_error_event_server_created_idx").on(
+      table.serverId,
+      table.createdAt
+    ),
+    index("app_error_event_resource_created_idx").on(
+      table.resourceId,
+      table.createdAt
+    ),
+    index("app_error_event_severity_created_idx").on(
+      table.severity,
+      table.createdAt
+    )
+  ]
+);
+pgTable(
+  "app_error_alert",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    fingerprint: text("fingerprint").notNull(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "set null"
+    }),
+    logSourceId: uuid("log_source_id").references(() => appLogSource.id, {
+      onDelete: "set null"
+    }),
+    severity: text("severity").notNull().default("critical"),
+    status: text("status").notNull().default("open"),
+    category: text("category").notNull(),
+    title: text("title").notNull(),
+    lastError: text("last_error").notNull(),
+    sampleLines: jsonb("sample_lines").$type().notNull().default([]),
+    signals: jsonb("signals").$type().notNull().default({}),
+    failureCount: integer("failure_count").notNull().default(1),
+    firstSeenAt: timestamp("first_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    lastAlertAt: timestamp("last_alert_at", { withTimezone: true }),
+    resolvedAt: timestamp("resolved_at", { withTimezone: true }),
+    mutedUntil: timestamp("muted_until", { withTimezone: true }),
+    cursorPrompt: text("cursor_prompt"),
+    telegramChatId: text("telegram_chat_id"),
+    telegramMessageId: bigint("telegram_message_id", { mode: "number" }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("app_error_alert_fingerprint_uidx").on(table.fingerprint),
+    index("app_error_alert_status_seen_idx").on(
+      table.status,
+      table.lastSeenAt
+    ),
+    index("app_error_alert_server_seen_idx").on(
+      table.serverId,
+      table.lastSeenAt
+    ),
+    index("app_error_alert_resource_seen_idx").on(
+      table.resourceId,
+      table.lastSeenAt
+    ),
+    index("app_error_alert_alerted_idx").on(table.lastAlertAt)
+  ]
+);
+pgTable(
+  "alert_rule",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    serverId: uuid("server_id").references(() => managedServer.id, {
+      onDelete: "cascade"
+    }),
+    resourceId: uuid("resource_id").references(() => resource.id, {
+      onDelete: "cascade"
+    }),
+    metric: text("metric").notNull(),
+    expression: text("expression").notNull(),
+    severity: alertSeverity("severity").notNull().default("warning"),
+    cooldownSeconds: integer("cooldown_seconds").notNull().default(900),
+    enabled: boolean("enabled").notNull().default(true),
+    routes: jsonb("routes").$type().notNull().default({}),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    index("alert_rule_server_idx").on(table.serverId),
+    index("alert_rule_resource_idx").on(table.resourceId),
+    index("alert_rule_enabled_severity_idx").on(table.enabled, table.severity)
+  ]
+);
+var defaultHermesCompanyModules = {
+  seo: false,
+  ads: false,
+  catalogus: false,
+  customerFacing: false,
+  exact: false
+};
+var hermesCompany = pgTable(
+  "hermes_company",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    brandId: text("brand_id").notNull(),
+    displayName: text("display_name").notNull(),
+    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "restrict" }),
+    refrontCustomerId: uuid("refront_customer_id"),
+    refrontCustomerName: text("refront_customer_name"),
+    refrontTeamLabel: text("refront_team_label"),
+    kitPath: text("kit_path").notNull().default("/opt/hermes-company-kit"),
+    modules: jsonb("modules").$type().notNull().default(defaultHermesCompanyModules),
+    lastDeployAt: timestamp("last_deploy_at", { withTimezone: true }),
+    lastDeployStatus: text("last_deploy_status"),
+    lastDeployLog: text("last_deploy_log"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("hermes_company_brand_id_uidx").on(table.brandId),
+    index("hermes_company_server_id_idx").on(table.serverId),
+    index("hermes_company_customer_id_idx").on(table.refrontCustomerId)
+  ]
+);
 var ALGORITHM = "aes-256-gcm";
 var IV_LENGTH = 16;
 var AUTH_TAG_LENGTH = 16;
@@ -1644,6 +2108,87 @@ async function resolveReleaseGitHubToken(githubTokenId) {
   }
   return getMgBoilerGitHubToken();
 }
+function decryptNullable(value) {
+  return value ? decrypt(value) : null;
+}
+function normalizeManagedServerConnectionRow(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    hostname: row.hostname,
+    port: row.port,
+    username: row.username,
+    password_encrypted: decryptNullable(row.password_encrypted),
+    ssh_key_encrypted: decryptNullable(row.ssh_key_encrypted),
+    ssh_key_passphrase_encrypted: decryptNullable(row.ssh_key_passphrase_encrypted),
+    description: null,
+    tags: row.tags ?? [],
+    last_connected_at: null,
+    last_software_scan_at: null,
+    monitoring_api_key: null,
+    monitoring_enabled: false,
+    hosted_by: row.hosted_by,
+    php_version: null,
+    php_version_number: null,
+    php_distro: null,
+    php_ini_path: null,
+    php_binary_path: null,
+    lsphp_install_path: null,
+    installed_lsphp_versions: null,
+    last_php_scan_at: null,
+    docker_prune_enabled: row.tags?.includes("docker-prune") ?? false,
+    disk_hygiene_enabled: row.tags?.includes("disk-hygiene") ?? false,
+    disk_hygiene_auto_clean: row.tags?.includes("disk-hygiene-auto-clean") ?? false,
+    os_type: row.os_type === "windows" ? "windows" : "linux",
+    created_at: row.created_at,
+    updated_at: row.updated_at,
+    created_by: row.created_by
+  };
+}
+async function getManagedServerConnectionByIdForUse(id) {
+  try {
+    const rows = await getDb().execute(sql`
+      SELECT
+        ms.id,
+        ms.name,
+        ms.hostname,
+        ms.port,
+        ms.username,
+        ms.auth_method,
+        ms.os AS os_type,
+        ms.provider AS hosted_by,
+        ms.tags,
+        sc.password_encrypted,
+        sc.ssh_key_encrypted,
+        sc.ssh_key_passphrase_encrypted,
+        ms.created_at,
+        ms.updated_at,
+        NULL::text AS created_by
+      FROM managed_server ms
+      LEFT JOIN server_credential sc ON sc.server_id = ms.id
+      WHERE ms.id = ${id}
+      LIMIT 1
+    `);
+    const row = rows[0];
+    if (row) {
+      return {
+        server: normalizeManagedServerConnectionRow(row),
+        error: null
+      };
+    }
+    return { server: null, error: `Server with id ${id} not found` };
+  } catch (error) {
+    return {
+      server: null,
+      error: error instanceof Error ? error.message : "Failed to resolve server connection"
+    };
+  }
+}
+
+// ../platform/dist/queries/ssh-server.js
+async function getSshServerByIdForUse(id) {
+  return getManagedServerConnectionByIdForUse(id);
+}
 
 // ../../node_modules/zod/dist/esm/v3/external.js
 var external_exports = {};
@@ -4244,10 +4789,10 @@ var ZodObject = class _ZodObject extends ZodType {
   //   }) as any;
   //   return merged;
   // }
-  catchall(index18) {
+  catchall(index19) {
     return new _ZodObject({
       ...this._def,
-      catchall: index18
+      catchall: index19
     });
   }
   pick(mask) {
@@ -4565,9 +5110,9 @@ function mergeValues(a, b) {
       return { valid: false };
     }
     const newArray = [];
-    for (let index18 = 0; index18 < a.length; index18++) {
-      const itemA = a[index18];
-      const itemB = b[index18];
+    for (let index19 = 0; index19 < a.length; index19++) {
+      const itemA = a[index19];
+      const itemB = b[index19];
       const sharedValue = mergeValues(itemA, itemB);
       if (!sharedValue.valid) {
         return { valid: false };
@@ -4773,10 +5318,10 @@ var ZodMap = class extends ZodType {
     }
     const keyType = this._def.keyType;
     const valueType = this._def.valueType;
-    const pairs = [...ctx.data.entries()].map(([key, value], index18) => {
+    const pairs = [...ctx.data.entries()].map(([key, value], index19) => {
       return {
-        key: keyType._parse(new ParseInputLazyPath(ctx, key, ctx.path, [index18, "key"])),
-        value: valueType._parse(new ParseInputLazyPath(ctx, value, ctx.path, [index18, "value"]))
+        key: keyType._parse(new ParseInputLazyPath(ctx, key, ctx.path, [index19, "key"])),
+        value: valueType._parse(new ParseInputLazyPath(ctx, value, ctx.path, [index19, "value"]))
       };
     });
     if (ctx.common.async) {
@@ -5417,1405 +5962,972 @@ var ZodCatch = class extends ZodType {
           value: result2.status === "valid" ? result2.value : this._def.catchValue({
             get error() {
               return new ZodError(newCtx.common.issues);
-            },
-            input: newCtx.data
-          })
-        };
-      });
-    } else {
-      return {
-        status: "valid",
-        value: result.status === "valid" ? result.value : this._def.catchValue({
-          get error() {
-            return new ZodError(newCtx.common.issues);
-          },
-          input: newCtx.data
-        })
-      };
-    }
-  }
-  removeCatch() {
-    return this._def.innerType;
-  }
-};
-ZodCatch.create = (type, params) => {
-  return new ZodCatch({
-    innerType: type,
-    typeName: ZodFirstPartyTypeKind.ZodCatch,
-    catchValue: typeof params.catch === "function" ? params.catch : () => params.catch,
-    ...processCreateParams(params)
-  });
-};
-var ZodNaN = class extends ZodType {
-  _parse(input) {
-    const parsedType = this._getType(input);
-    if (parsedType !== ZodParsedType.nan) {
-      const ctx = this._getOrReturnCtx(input);
-      addIssueToContext(ctx, {
-        code: ZodIssueCode.invalid_type,
-        expected: ZodParsedType.nan,
-        received: ctx.parsedType
-      });
-      return INVALID;
-    }
-    return { status: "valid", value: input.data };
-  }
-};
-ZodNaN.create = (params) => {
-  return new ZodNaN({
-    typeName: ZodFirstPartyTypeKind.ZodNaN,
-    ...processCreateParams(params)
-  });
-};
-var BRAND = /* @__PURE__ */ Symbol("zod_brand");
-var ZodBranded = class extends ZodType {
-  _parse(input) {
-    const { ctx } = this._processInputParams(input);
-    const data = ctx.data;
-    return this._def.type._parse({
-      data,
-      path: ctx.path,
-      parent: ctx
-    });
-  }
-  unwrap() {
-    return this._def.type;
-  }
-};
-var ZodPipeline = class _ZodPipeline extends ZodType {
-  _parse(input) {
-    const { status, ctx } = this._processInputParams(input);
-    if (ctx.common.async) {
-      const handleAsync = async () => {
-        const inResult = await this._def.in._parseAsync({
-          data: ctx.data,
-          path: ctx.path,
-          parent: ctx
-        });
-        if (inResult.status === "aborted")
-          return INVALID;
-        if (inResult.status === "dirty") {
-          status.dirty();
-          return DIRTY(inResult.value);
-        } else {
-          return this._def.out._parseAsync({
-            data: inResult.value,
-            path: ctx.path,
-            parent: ctx
-          });
-        }
-      };
-      return handleAsync();
-    } else {
-      const inResult = this._def.in._parseSync({
-        data: ctx.data,
-        path: ctx.path,
-        parent: ctx
-      });
-      if (inResult.status === "aborted")
-        return INVALID;
-      if (inResult.status === "dirty") {
-        status.dirty();
-        return {
-          status: "dirty",
-          value: inResult.value
-        };
-      } else {
-        return this._def.out._parseSync({
-          data: inResult.value,
-          path: ctx.path,
-          parent: ctx
-        });
-      }
-    }
-  }
-  static create(a, b) {
-    return new _ZodPipeline({
-      in: a,
-      out: b,
-      typeName: ZodFirstPartyTypeKind.ZodPipeline
-    });
-  }
-};
-var ZodReadonly = class extends ZodType {
-  _parse(input) {
-    const result = this._def.innerType._parse(input);
-    const freeze = (data) => {
-      if (isValid(data)) {
-        data.value = Object.freeze(data.value);
-      }
-      return data;
-    };
-    return isAsync(result) ? result.then((data) => freeze(data)) : freeze(result);
+            },
+            input: newCtx.data
+          })
+        };
+      });
+    } else {
+      return {
+        status: "valid",
+        value: result.status === "valid" ? result.value : this._def.catchValue({
+          get error() {
+            return new ZodError(newCtx.common.issues);
+          },
+          input: newCtx.data
+        })
+      };
+    }
   }
-  unwrap() {
+  removeCatch() {
     return this._def.innerType;
   }
 };
-ZodReadonly.create = (type, params) => {
-  return new ZodReadonly({
+ZodCatch.create = (type, params) => {
+  return new ZodCatch({
     innerType: type,
-    typeName: ZodFirstPartyTypeKind.ZodReadonly,
+    typeName: ZodFirstPartyTypeKind.ZodCatch,
+    catchValue: typeof params.catch === "function" ? params.catch : () => params.catch,
     ...processCreateParams(params)
   });
 };
-function cleanParams(params, data) {
-  const p = typeof params === "function" ? params(data) : typeof params === "string" ? { message: params } : params;
-  const p2 = typeof p === "string" ? { message: p } : p;
-  return p2;
-}
-function custom(check3, _params = {}, fatal) {
-  if (check3)
-    return ZodAny.create().superRefine((data, ctx) => {
-      const r = check3(data);
-      if (r instanceof Promise) {
-        return r.then((r2) => {
-          if (!r2) {
-            const params = cleanParams(_params, data);
-            const _fatal = params.fatal ?? fatal ?? true;
-            ctx.addIssue({ code: "custom", ...params, fatal: _fatal });
-          }
-        });
-      }
-      if (!r) {
-        const params = cleanParams(_params, data);
-        const _fatal = params.fatal ?? fatal ?? true;
-        ctx.addIssue({ code: "custom", ...params, fatal: _fatal });
-      }
-      return;
-    });
-  return ZodAny.create();
-}
-var late = {
-  object: ZodObject.lazycreate
+var ZodNaN = class extends ZodType {
+  _parse(input) {
+    const parsedType = this._getType(input);
+    if (parsedType !== ZodParsedType.nan) {
+      const ctx = this._getOrReturnCtx(input);
+      addIssueToContext(ctx, {
+        code: ZodIssueCode.invalid_type,
+        expected: ZodParsedType.nan,
+        received: ctx.parsedType
+      });
+      return INVALID;
+    }
+    return { status: "valid", value: input.data };
+  }
 };
-var ZodFirstPartyTypeKind;
-(function(ZodFirstPartyTypeKind2) {
-  ZodFirstPartyTypeKind2["ZodString"] = "ZodString";
-  ZodFirstPartyTypeKind2["ZodNumber"] = "ZodNumber";
-  ZodFirstPartyTypeKind2["ZodNaN"] = "ZodNaN";
-  ZodFirstPartyTypeKind2["ZodBigInt"] = "ZodBigInt";
-  ZodFirstPartyTypeKind2["ZodBoolean"] = "ZodBoolean";
-  ZodFirstPartyTypeKind2["ZodDate"] = "ZodDate";
-  ZodFirstPartyTypeKind2["ZodSymbol"] = "ZodSymbol";
-  ZodFirstPartyTypeKind2["ZodUndefined"] = "ZodUndefined";
-  ZodFirstPartyTypeKind2["ZodNull"] = "ZodNull";
-  ZodFirstPartyTypeKind2["ZodAny"] = "ZodAny";
-  ZodFirstPartyTypeKind2["ZodUnknown"] = "ZodUnknown";
-  ZodFirstPartyTypeKind2["ZodNever"] = "ZodNever";
-  ZodFirstPartyTypeKind2["ZodVoid"] = "ZodVoid";
-  ZodFirstPartyTypeKind2["ZodArray"] = "ZodArray";
-  ZodFirstPartyTypeKind2["ZodObject"] = "ZodObject";
-  ZodFirstPartyTypeKind2["ZodUnion"] = "ZodUnion";
-  ZodFirstPartyTypeKind2["ZodDiscriminatedUnion"] = "ZodDiscriminatedUnion";
-  ZodFirstPartyTypeKind2["ZodIntersection"] = "ZodIntersection";
-  ZodFirstPartyTypeKind2["ZodTuple"] = "ZodTuple";
-  ZodFirstPartyTypeKind2["ZodRecord"] = "ZodRecord";
-  ZodFirstPartyTypeKind2["ZodMap"] = "ZodMap";
-  ZodFirstPartyTypeKind2["ZodSet"] = "ZodSet";
-  ZodFirstPartyTypeKind2["ZodFunction"] = "ZodFunction";
-  ZodFirstPartyTypeKind2["ZodLazy"] = "ZodLazy";
-  ZodFirstPartyTypeKind2["ZodLiteral"] = "ZodLiteral";
-  ZodFirstPartyTypeKind2["ZodEnum"] = "ZodEnum";
-  ZodFirstPartyTypeKind2["ZodEffects"] = "ZodEffects";
-  ZodFirstPartyTypeKind2["ZodNativeEnum"] = "ZodNativeEnum";
-  ZodFirstPartyTypeKind2["ZodOptional"] = "ZodOptional";
-  ZodFirstPartyTypeKind2["ZodNullable"] = "ZodNullable";
-  ZodFirstPartyTypeKind2["ZodDefault"] = "ZodDefault";
-  ZodFirstPartyTypeKind2["ZodCatch"] = "ZodCatch";
-  ZodFirstPartyTypeKind2["ZodPromise"] = "ZodPromise";
-  ZodFirstPartyTypeKind2["ZodBranded"] = "ZodBranded";
-  ZodFirstPartyTypeKind2["ZodPipeline"] = "ZodPipeline";
-  ZodFirstPartyTypeKind2["ZodReadonly"] = "ZodReadonly";
-})(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
-var instanceOfType = (cls, params = {
-  message: `Input not instance of ${cls.name}`
-}) => custom((data) => data instanceof cls, params);
-var stringType = ZodString.create;
-var numberType = ZodNumber.create;
-var nanType = ZodNaN.create;
-var bigIntType = ZodBigInt.create;
-var booleanType = ZodBoolean.create;
-var dateType = ZodDate.create;
-var symbolType = ZodSymbol.create;
-var undefinedType = ZodUndefined.create;
-var nullType = ZodNull.create;
-var anyType = ZodAny.create;
-var unknownType = ZodUnknown.create;
-var neverType = ZodNever.create;
-var voidType = ZodVoid.create;
-var arrayType = ZodArray.create;
-var objectType = ZodObject.create;
-var strictObjectType = ZodObject.strictCreate;
-var unionType = ZodUnion.create;
-var discriminatedUnionType = ZodDiscriminatedUnion.create;
-var intersectionType = ZodIntersection.create;
-var tupleType = ZodTuple.create;
-var recordType = ZodRecord.create;
-var mapType = ZodMap.create;
-var setType = ZodSet.create;
-var functionType = ZodFunction.create;
-var lazyType = ZodLazy.create;
-var literalType = ZodLiteral.create;
-var enumType = ZodEnum.create;
-var nativeEnumType = ZodNativeEnum.create;
-var promiseType = ZodPromise.create;
-var effectsType = ZodEffects.create;
-var optionalType = ZodOptional.create;
-var nullableType = ZodNullable.create;
-var preprocessType = ZodEffects.createWithPreprocess;
-var pipelineType = ZodPipeline.create;
-var ostring = () => stringType().optional();
-var onumber = () => numberType().optional();
-var oboolean = () => booleanType().optional();
-var coerce = {
-  string: ((arg) => ZodString.create({ ...arg, coerce: true })),
-  number: ((arg) => ZodNumber.create({ ...arg, coerce: true })),
-  boolean: ((arg) => ZodBoolean.create({
-    ...arg,
-    coerce: true
-  })),
-  bigint: ((arg) => ZodBigInt.create({ ...arg, coerce: true })),
-  date: ((arg) => ZodDate.create({ ...arg, coerce: true }))
+ZodNaN.create = (params) => {
+  return new ZodNaN({
+    typeName: ZodFirstPartyTypeKind.ZodNaN,
+    ...processCreateParams(params)
+  });
 };
-var NEVER = INVALID;
-
-// ../platform/dist/utils/litespeed-vhost.js
-var LITESPEED_STANDARD_APP_PATH = /^(\.|apps\/(backoffice|portal|web|api)(\/[\w-]+)?)$/;
-var LitespeedVhostMappingSchema = external_exports.object({
-  domain: external_exports.string().min(1).transform((value) => normalizeVhostDomain(value)),
-  appPath: external_exports.string().min(1).regex(LITESPEED_STANDARD_APP_PATH, "Unsupported appPath")
-});
-external_exports.array(LitespeedVhostMappingSchema);
-function normalizeVhostDomain(value) {
-  return value.trim().replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/\.+$/, "").toLowerCase();
-}
-var users = pgTable("user", {
-  id: uuid("id").primaryKey().defaultRandom(),
-  email: text("email").notNull().unique(),
-  fullName: text("full_name"),
-  avatarUrl: text("avatar_url"),
-  emailVerified: boolean("email_verified").notNull().default(false),
-  roleId: uuid("role_id"),
-  permissions: jsonb("permissions"),
-  /** Linked Refront user id (matched by email during refront-crm-sync). */
-  refrontUserId: uuid("refront_user_id"),
-  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-});
-pgTable("session", {
-  id: uuid("id").primaryKey().defaultRandom(),
-  userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
-  token: text("token").notNull().unique(),
-  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
-  ipAddress: text("ip_address"),
-  userAgent: text("user_agent"),
-  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-});
-pgTable("account", {
-  id: uuid("id").primaryKey().defaultRandom(),
-  userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
-  providerId: text("provider_id").notNull(),
-  accountId: text("account_id").notNull(),
-  password: text("password"),
-  accessToken: text("access_token"),
-  refreshToken: text("refresh_token"),
-  accessTokenExpiresAt: timestamp("access_token_expires_at", {
-    withTimezone: true
-  }),
-  refreshTokenExpiresAt: timestamp("refresh_token_expires_at", {
-    withTimezone: true
-  }),
-  scope: text("scope"),
-  idToken: text("id_token"),
-  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-});
-pgTable("verification", {
-  id: uuid("id").primaryKey().defaultRandom(),
-  identifier: text("identifier").notNull(),
-  value: text("value").notNull(),
-  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
-  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-});
-pgTable("two_factor", {
-  id: uuid("id").primaryKey().defaultRandom(),
-  userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
-  secret: text("secret").notNull(),
-  backupCodes: text("backup_codes")
-});
-var WIKI_EMBEDDING_DIMENSIONS = 1536;
-var vector = customType({
-  dataType(config) {
-    return `vector(${config?.dimensions ?? WIKI_EMBEDDING_DIMENSIONS})`;
-  },
-  toDriver(value) {
-    return `[${value.join(",")}]`;
-  },
-  fromDriver(value) {
-    if (Array.isArray(value)) return value.map(Number);
-    if (typeof value !== "string") return [];
-    const trimmed = value.replace(/^\[/, "").replace(/\]$/, "");
-    if (!trimmed) return [];
-    return trimmed.split(",").map((part) => Number(part.trim()));
+var BRAND = /* @__PURE__ */ Symbol("zod_brand");
+var ZodBranded = class extends ZodType {
+  _parse(input) {
+    const { ctx } = this._processInputParams(input);
+    const data = ctx.data;
+    return this._def.type._parse({
+      data,
+      path: ctx.path,
+      parent: ctx
+    });
+  }
+  unwrap() {
+    return this._def.type;
   }
-});
-pgTable(
-  "wiki_page",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    slug: text("slug").notNull().unique(),
-    title: text("title").notNull().default(""),
-    summary: text("summary"),
-    content: text("content").notNull().default(""),
-    frontmatter: jsonb("frontmatter").$type(),
-    sources: jsonb("sources").$type(),
-    sourcesArchive: jsonb("sources_archive").$type(),
-    tags: text("tags").array().notNull().default([]),
-    status: text("status").notNull().default("draft"),
-    pageUpdatedOn: date("page_updated_on"),
-    contentHash: text("content_hash"),
-    /** Legacy app-layer cosine storage; dual-written with embeddingVec. */
-    embedding: real("embedding").array(),
-    embeddingVec: vector("embedding_vec", {
-      dimensions: WIKI_EMBEDDING_DIMENSIONS
-    }),
-    embeddingModel: text("embedding_model"),
-    embeddedAt: timestamp("embedded_at", { withTimezone: true }),
-    reviewedBy: text("reviewed_by"),
-    reviewedOn: date("reviewed_on"),
-    lastVerifiedOn: date("last_verified_on"),
-    verifyCount: integer("verify_count").notNull().default(0),
-    verifyNote: text("verify_note"),
-    dirty: boolean("dirty").notNull().default(false),
-    vaultSyncedAt: timestamp("vault_synced_at", { withTimezone: true }),
-    /** Reviewer / itemized-phase lease holder. */
-    claimedBy: text("claimed_by"),
-    claimedAt: timestamp("claimed_at", { withTimezone: true }),
-    /** Expired leases are reclaimable by any runner. */
-    leaseExpiresAt: timestamp("lease_expires_at", { withTimezone: true }),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  },
-  (table) => [
-    index("idx_wiki_page_status").on(table.status),
-    index("idx_wiki_page_last_verified").on(table.lastVerifiedOn),
-    index("idx_wiki_page_dirty").on(table.dirty),
-    index("idx_wiki_page_lease_expires").on(table.leaseExpiresAt).where(sql`${table.leaseExpiresAt} IS NOT NULL`)
-  ]
-);
-pgTable(
-  "wiki_change_log",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    authorJob: text("author_job").notNull(),
-    summary: text("summary").notNull().default(""),
-    slugs: text("slugs").array().notNull().default([]),
-    syncedAt: timestamp("synced_at", { withTimezone: true }),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-  },
-  (table) => [index("idx_wiki_change_log_created").on(table.createdAt)]
-);
-pgTable(
-  "wiki_page_flag",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    pageSlug: text("page_slug").notNull(),
-    kind: text("kind").notNull(),
-    detail: text("detail").notNull().default(""),
-    sourceRef: text("source_ref"),
-    createdBy: text("created_by"),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    resolvedAt: timestamp("resolved_at", { withTimezone: true }),
-    resolvedBy: text("resolved_by")
-  },
-  (table) => [index("idx_wiki_page_flag_created").on(table.createdAt)]
-);
-pgTable(
-  "wiki_page_evidence",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    pageSlug: text("page_slug").notNull(),
-    evidenceType: text("evidence_type").notNull(),
-    evidenceRef: text("evidence_ref").notNull(),
-    matchScore: real("match_score"),
-    matchReason: text("match_reason"),
-    snippet: text("snippet"),
-    status: text("status").notNull().default("pending"),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    resolvedAt: timestamp("resolved_at", { withTimezone: true })
-  },
-  (table) => [
-    uniqueIndex(
-      "wiki_page_evidence_page_slug_evidence_type_evidence_ref_key"
-    ).on(table.pageSlug, table.evidenceType, table.evidenceRef),
-    index("idx_wiki_page_evidence_created").on(table.createdAt)
-  ]
-);
-pgTable(
-  "wiki_page_link",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    sourceSlug: text("source_slug").notNull(),
-    targetSlug: text("target_slug").notNull(),
-    kind: text("kind").notNull().default("wikilink"),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-  },
-  (table) => [
-    uniqueIndex("wiki_page_link_source_target_kind_key").on(
-      table.sourceSlug,
-      table.targetSlug,
-      table.kind
-    ),
-    index("idx_wiki_page_link_source").on(table.sourceSlug),
-    index("idx_wiki_page_link_target").on(table.targetSlug)
-  ]
-);
-pgTable(
-  "wiki_page_read",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    slug: text("slug").notNull(),
-    caller: text("caller"),
-    includedArchive: boolean("included_archive").notNull().default(false),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-  },
-  (table) => [
-    index("idx_wiki_page_read_slug").on(table.slug, table.createdAt),
-    index("idx_wiki_page_read_created").on(table.createdAt)
-  ]
-);
-pgTable(
-  "wiki_verify_event",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    pageSlug: text("page_slug").notNull(),
-    outcome: text("outcome").notNull(),
-    runMode: text("run_mode"),
-    note: text("note"),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-  },
-  (table) => [
-    index("idx_wiki_verify_event_created").on(table.createdAt),
-    index("idx_wiki_verify_event_outcome_created").on(
-      table.outcome,
-      table.createdAt
-    )
-  ]
-);
-pgTable(
-  "wiki_invariant_violation",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    slug: text("slug").notNull(),
-    code: text("code").notNull(),
-    severity: text("severity").notNull().default("warning"),
-    detail: text("detail").notNull().default(""),
-    suggestedFix: text("suggested_fix"),
-    suggestedSlug: text("suggested_slug"),
-    occurrenceCount: integer("occurrence_count").notNull().default(1),
-    reopenCount: integer("reopen_count").notNull().default(0),
-    firstSeenAt: timestamp("first_seen_at", { withTimezone: true }).notNull().defaultNow(),
-    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
-    resolvedAt: timestamp("resolved_at", { withTimezone: true }),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  },
-  (table) => [
-    uniqueIndex("wiki_invariant_violation_slug_code_key").on(
-      table.slug,
-      table.code
-    ),
-    index("idx_wiki_invariant_violation_severity").on(
-      table.severity,
-      table.resolvedAt
-    )
-  ]
-);
-pgTable(
-  "wiki_pipeline_rule",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    scope: text("scope").notNull(),
-    ruleKey: text("rule_key").notNull(),
-    text: text("text").notNull(),
-    /** A = deterministic auto-applied, B = judgement, gated by insight accept. */
-    tier: text("tier").notNull().default("B"),
-    status: text("status").notNull().default("proposed"),
-    sourceCode: text("source_code"),
-    evidenceRefs: text("evidence_refs").array().notNull().default([]),
-    violationCount: integer("violation_count").notNull().default(0),
-    lastViolationAt: timestamp("last_violation_at", { withTimezone: true }),
-    activatedAt: timestamp("activated_at", { withTimezone: true }),
-    retiredAt: timestamp("retired_at", { withTimezone: true }),
-    retiredReason: text("retired_reason"),
-    rejectedAt: timestamp("rejected_at", { withTimezone: true }),
-    rejectedReason: text("rejected_reason"),
-    approvedBy: text("approved_by"),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-  },
-  (table) => [
-    uniqueIndex("wiki_pipeline_rule_scope_key_key").on(
-      table.scope,
-      table.ruleKey
-    )
-  ]
-);
-pgTable(
-  "wiki_search_log",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    query: text("query").notNull(),
-    hitCount: integer("hit_count").notNull().default(0),
-    topScore: real("top_score"),
-    topSlug: text("top_slug"),
-    caller: text("caller"),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-  },
-  (table) => [index("idx_wiki_search_log_created").on(table.createdAt)]
-);
-pgTable(
-  "team_memory_search_log",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    query: text("query").notNull(),
-    hitCount: integer("hit_count").notNull().default(0),
-    topScore: real("top_score"),
-    topId: text("top_id"),
-    caller: text("caller"),
-    repo: text("repo"),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-  },
-  (table) => [index("idx_team_memory_search_log_created").on(table.createdAt)]
-);
-pgTable(
-  "wiki_agent_run",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    phase: text("phase").notNull(),
-    model: text("model"),
-    claimed: jsonb("claimed").$type(),
-    proven: jsonb("proven").$type(),
-    violationCount: integer("violation_count").notNull().default(0),
-    violations: jsonb("violations").$type(),
-    outcome: text("outcome").notNull().default("ok"),
-    agentId: text("agent_id"),
-    runId: text("run_id"),
-    passId: text("pass_id"),
-    changedPaths: jsonb("changed_paths").$type(),
-    summary: text("summary"),
-    userVerdict: text("user_verdict"),
-    userVerdictNote: text("user_verdict_note"),
-    verdictAt: timestamp("verdict_at", { withTimezone: true }),
-    reviewed: boolean("reviewed").notNull().default(false),
-    reviewNotes: text("review_notes"),
-    reviewedAt: timestamp("reviewed_at", { withTimezone: true }),
-    startedAt: timestamp("started_at", { withTimezone: true }),
-    finishedAt: timestamp("finished_at", { withTimezone: true }).notNull().defaultNow(),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+};
+var ZodPipeline = class _ZodPipeline extends ZodType {
+  _parse(input) {
+    const { status, ctx } = this._processInputParams(input);
+    if (ctx.common.async) {
+      const handleAsync = async () => {
+        const inResult = await this._def.in._parseAsync({
+          data: ctx.data,
+          path: ctx.path,
+          parent: ctx
+        });
+        if (inResult.status === "aborted")
+          return INVALID;
+        if (inResult.status === "dirty") {
+          status.dirty();
+          return DIRTY(inResult.value);
+        } else {
+          return this._def.out._parseAsync({
+            data: inResult.value,
+            path: ctx.path,
+            parent: ctx
+          });
+        }
+      };
+      return handleAsync();
+    } else {
+      const inResult = this._def.in._parseSync({
+        data: ctx.data,
+        path: ctx.path,
+        parent: ctx
+      });
+      if (inResult.status === "aborted")
+        return INVALID;
+      if (inResult.status === "dirty") {
+        status.dirty();
+        return {
+          status: "dirty",
+          value: inResult.value
+        };
+      } else {
+        return this._def.out._parseSync({
+          data: inResult.value,
+          path: ctx.path,
+          parent: ctx
+        });
+      }
+    }
+  }
+  static create(a, b) {
+    return new _ZodPipeline({
+      in: a,
+      out: b,
+      typeName: ZodFirstPartyTypeKind.ZodPipeline
+    });
+  }
+};
+var ZodReadonly = class extends ZodType {
+  _parse(input) {
+    const result = this._def.innerType._parse(input);
+    const freeze = (data) => {
+      if (isValid(data)) {
+        data.value = Object.freeze(data.value);
+      }
+      return data;
+    };
+    return isAsync(result) ? result.then((data) => freeze(data)) : freeze(result);
+  }
+  unwrap() {
+    return this._def.innerType;
+  }
+};
+ZodReadonly.create = (type, params) => {
+  return new ZodReadonly({
+    innerType: type,
+    typeName: ZodFirstPartyTypeKind.ZodReadonly,
+    ...processCreateParams(params)
+  });
+};
+function cleanParams(params, data) {
+  const p = typeof params === "function" ? params(data) : typeof params === "string" ? { message: params } : params;
+  const p2 = typeof p === "string" ? { message: p } : p;
+  return p2;
+}
+function custom(check3, _params = {}, fatal) {
+  if (check3)
+    return ZodAny.create().superRefine((data, ctx) => {
+      const r = check3(data);
+      if (r instanceof Promise) {
+        return r.then((r2) => {
+          if (!r2) {
+            const params = cleanParams(_params, data);
+            const _fatal = params.fatal ?? fatal ?? true;
+            ctx.addIssue({ code: "custom", ...params, fatal: _fatal });
+          }
+        });
+      }
+      if (!r) {
+        const params = cleanParams(_params, data);
+        const _fatal = params.fatal ?? fatal ?? true;
+        ctx.addIssue({ code: "custom", ...params, fatal: _fatal });
+      }
+      return;
+    });
+  return ZodAny.create();
+}
+var late = {
+  object: ZodObject.lazycreate
+};
+var ZodFirstPartyTypeKind;
+(function(ZodFirstPartyTypeKind2) {
+  ZodFirstPartyTypeKind2["ZodString"] = "ZodString";
+  ZodFirstPartyTypeKind2["ZodNumber"] = "ZodNumber";
+  ZodFirstPartyTypeKind2["ZodNaN"] = "ZodNaN";
+  ZodFirstPartyTypeKind2["ZodBigInt"] = "ZodBigInt";
+  ZodFirstPartyTypeKind2["ZodBoolean"] = "ZodBoolean";
+  ZodFirstPartyTypeKind2["ZodDate"] = "ZodDate";
+  ZodFirstPartyTypeKind2["ZodSymbol"] = "ZodSymbol";
+  ZodFirstPartyTypeKind2["ZodUndefined"] = "ZodUndefined";
+  ZodFirstPartyTypeKind2["ZodNull"] = "ZodNull";
+  ZodFirstPartyTypeKind2["ZodAny"] = "ZodAny";
+  ZodFirstPartyTypeKind2["ZodUnknown"] = "ZodUnknown";
+  ZodFirstPartyTypeKind2["ZodNever"] = "ZodNever";
+  ZodFirstPartyTypeKind2["ZodVoid"] = "ZodVoid";
+  ZodFirstPartyTypeKind2["ZodArray"] = "ZodArray";
+  ZodFirstPartyTypeKind2["ZodObject"] = "ZodObject";
+  ZodFirstPartyTypeKind2["ZodUnion"] = "ZodUnion";
+  ZodFirstPartyTypeKind2["ZodDiscriminatedUnion"] = "ZodDiscriminatedUnion";
+  ZodFirstPartyTypeKind2["ZodIntersection"] = "ZodIntersection";
+  ZodFirstPartyTypeKind2["ZodTuple"] = "ZodTuple";
+  ZodFirstPartyTypeKind2["ZodRecord"] = "ZodRecord";
+  ZodFirstPartyTypeKind2["ZodMap"] = "ZodMap";
+  ZodFirstPartyTypeKind2["ZodSet"] = "ZodSet";
+  ZodFirstPartyTypeKind2["ZodFunction"] = "ZodFunction";
+  ZodFirstPartyTypeKind2["ZodLazy"] = "ZodLazy";
+  ZodFirstPartyTypeKind2["ZodLiteral"] = "ZodLiteral";
+  ZodFirstPartyTypeKind2["ZodEnum"] = "ZodEnum";
+  ZodFirstPartyTypeKind2["ZodEffects"] = "ZodEffects";
+  ZodFirstPartyTypeKind2["ZodNativeEnum"] = "ZodNativeEnum";
+  ZodFirstPartyTypeKind2["ZodOptional"] = "ZodOptional";
+  ZodFirstPartyTypeKind2["ZodNullable"] = "ZodNullable";
+  ZodFirstPartyTypeKind2["ZodDefault"] = "ZodDefault";
+  ZodFirstPartyTypeKind2["ZodCatch"] = "ZodCatch";
+  ZodFirstPartyTypeKind2["ZodPromise"] = "ZodPromise";
+  ZodFirstPartyTypeKind2["ZodBranded"] = "ZodBranded";
+  ZodFirstPartyTypeKind2["ZodPipeline"] = "ZodPipeline";
+  ZodFirstPartyTypeKind2["ZodReadonly"] = "ZodReadonly";
+})(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
+var instanceOfType = (cls, params = {
+  message: `Input not instance of ${cls.name}`
+}) => custom((data) => data instanceof cls, params);
+var stringType = ZodString.create;
+var numberType = ZodNumber.create;
+var nanType = ZodNaN.create;
+var bigIntType = ZodBigInt.create;
+var booleanType = ZodBoolean.create;
+var dateType = ZodDate.create;
+var symbolType = ZodSymbol.create;
+var undefinedType = ZodUndefined.create;
+var nullType = ZodNull.create;
+var anyType = ZodAny.create;
+var unknownType = ZodUnknown.create;
+var neverType = ZodNever.create;
+var voidType = ZodVoid.create;
+var arrayType = ZodArray.create;
+var objectType = ZodObject.create;
+var strictObjectType = ZodObject.strictCreate;
+var unionType = ZodUnion.create;
+var discriminatedUnionType = ZodDiscriminatedUnion.create;
+var intersectionType = ZodIntersection.create;
+var tupleType = ZodTuple.create;
+var recordType = ZodRecord.create;
+var mapType = ZodMap.create;
+var setType = ZodSet.create;
+var functionType = ZodFunction.create;
+var lazyType = ZodLazy.create;
+var literalType = ZodLiteral.create;
+var enumType = ZodEnum.create;
+var nativeEnumType = ZodNativeEnum.create;
+var promiseType = ZodPromise.create;
+var effectsType = ZodEffects.create;
+var optionalType = ZodOptional.create;
+var nullableType = ZodNullable.create;
+var preprocessType = ZodEffects.createWithPreprocess;
+var pipelineType = ZodPipeline.create;
+var ostring = () => stringType().optional();
+var onumber = () => numberType().optional();
+var oboolean = () => booleanType().optional();
+var coerce = {
+  string: ((arg) => ZodString.create({ ...arg, coerce: true })),
+  number: ((arg) => ZodNumber.create({ ...arg, coerce: true })),
+  boolean: ((arg) => ZodBoolean.create({
+    ...arg,
+    coerce: true
+  })),
+  bigint: ((arg) => ZodBigInt.create({ ...arg, coerce: true })),
+  date: ((arg) => ZodDate.create({ ...arg, coerce: true }))
+};
+var NEVER = INVALID;
+
+// ../platform/dist/utils/litespeed-vhost.js
+var LITESPEED_STANDARD_APP_PATH = /^(\.|apps\/(backoffice|portal|web|api)(\/[\w-]+)?)$/;
+var LitespeedVhostMappingSchema = external_exports.object({
+  domain: external_exports.string().min(1).transform((value) => normalizeVhostDomain(value)),
+  appPath: external_exports.string().min(1).regex(LITESPEED_STANDARD_APP_PATH, "Unsupported appPath")
+});
+external_exports.array(LitespeedVhostMappingSchema);
+function normalizeVhostDomain(value) {
+  return value.trim().replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/\.+$/, "").toLowerCase();
+}
+var users = pgTable("user", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  email: text("email").notNull().unique(),
+  fullName: text("full_name"),
+  avatarUrl: text("avatar_url"),
+  emailVerified: boolean("email_verified").notNull().default(false),
+  roleId: uuid("role_id"),
+  permissions: jsonb("permissions"),
+  /** Linked Refront user id (matched by email during refront-crm-sync). */
+  refrontUserId: uuid("refront_user_id"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable("session", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  token: text("token").notNull().unique(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  ipAddress: text("ip_address"),
+  userAgent: text("user_agent"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable("account", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  providerId: text("provider_id").notNull(),
+  accountId: text("account_id").notNull(),
+  password: text("password"),
+  accessToken: text("access_token"),
+  refreshToken: text("refresh_token"),
+  accessTokenExpiresAt: timestamp("access_token_expires_at", {
+    withTimezone: true
+  }),
+  refreshTokenExpiresAt: timestamp("refresh_token_expires_at", {
+    withTimezone: true
+  }),
+  scope: text("scope"),
+  idToken: text("id_token"),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable("verification", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  identifier: text("identifier").notNull(),
+  value: text("value").notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+pgTable("two_factor", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  secret: text("secret").notNull(),
+  backupCodes: text("backup_codes")
+});
+var WIKI_EMBEDDING_DIMENSIONS = 1536;
+var vector = customType({
+  dataType(config) {
+    return `vector(${config?.dimensions ?? WIKI_EMBEDDING_DIMENSIONS})`;
   },
-  (table) => [
-    index("idx_wiki_agent_run_phase_created").on(table.phase, table.createdAt),
-    index("idx_wiki_agent_run_created").on(table.createdAt),
-    index("idx_wiki_agent_run_reviewed").on(table.reviewed),
-    index("idx_wiki_agent_run_user_verdict").on(table.userVerdict),
-    index("idx_wiki_agent_run_pass_id").on(table.passId)
-  ]
-);
-pgTable(
-  "wiki_agent_review_suggestion",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    status: text("status").notNull().default("proposed"),
-    implementationClass: text("implementation_class").notNull(),
-    phase: text("phase"),
-    scope: text("scope"),
-    title: text("title").notNull(),
-    summary: text("summary").notNull(),
-    targetFile: text("target_file"),
-    targetKey: text("target_key"),
-    beforeText: text("before_text"),
-    afterText: text("after_text"),
-    evidenceRunIds: uuid("evidence_run_ids").array().notNull().default([]),
-    evidenceRefs: text("evidence_refs").array().notNull().default([]),
-    dedupeKey: text("dedupe_key").notNull(),
-    source: text("source").notNull().default("auto"),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  toDriver(value) {
+    return `[${value.join(",")}]`;
   },
-  (table) => [
-    uniqueIndex("wiki_agent_review_suggestion_dedupe_key").on(table.dedupeKey),
-    index("idx_wiki_agent_review_suggestion_status_created").on(
-      table.status,
-      table.createdAt
-    )
-  ]
-);
-
-// ../db/src/schema/agent-memory.ts
+  fromDriver(value) {
+    if (Array.isArray(value)) return value.map(Number);
+    if (typeof value !== "string") return [];
+    const trimmed = value.replace(/^\[/, "").replace(/\]$/, "");
+    if (!trimmed) return [];
+    return trimmed.split(",").map((part) => Number(part.trim()));
+  }
+});
 pgTable(
-  "agent_memory",
+  "wiki_page",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    conversationId: uuid("conversation_id"),
-    localConversationId: text("local_conversation_id"),
-    source: text("source").notNull().default("mirror"),
-    userId: text("user_id"),
-    hostId: uuid("host_id"),
-    workspaceId: uuid("workspace_id"),
-    gitRepository: text("git_repository"),
+    slug: text("slug").notNull().unique(),
     title: text("title").notNull().default(""),
     summary: text("summary"),
     content: text("content").notNull().default(""),
+    frontmatter: jsonb("frontmatter").$type(),
+    sources: jsonb("sources").$type(),
+    sourcesArchive: jsonb("sources_archive").$type(),
+    tags: text("tags").array().notNull().default([]),
+    status: text("status").notNull().default("draft"),
+    pageUpdatedOn: date("page_updated_on"),
     contentHash: text("content_hash"),
+    /** Legacy app-layer cosine storage; dual-written with embeddingVec. */
     embedding: real("embedding").array(),
     embeddingVec: vector("embedding_vec", {
       dimensions: WIKI_EMBEDDING_DIMENSIONS
     }),
     embeddingModel: text("embedding_model"),
-    messageCount: integer("message_count").notNull().default(0),
-    startedAt: timestamp("started_at", { withTimezone: true }),
-    lastMessageAt: timestamp("last_message_at", { withTimezone: true }),
     embeddedAt: timestamp("embedded_at", { withTimezone: true }),
-    resolved: boolean("resolved"),
-    category: text("category"),
-    tech: text("tech").array(),
-    kind: text("kind").notNull().default("human"),
-    symbols: text("symbols").array(),
+    reviewedBy: text("reviewed_by"),
+    reviewedOn: date("reviewed_on"),
+    lastVerifiedOn: date("last_verified_on"),
+    verifyCount: integer("verify_count").notNull().default(0),
+    verifyNote: text("verify_note"),
+    dirty: boolean("dirty").notNull().default(false),
+    vaultSyncedAt: timestamp("vault_synced_at", { withTimezone: true }),
+    /** Reviewer / itemized-phase lease holder. */
+    claimedBy: text("claimed_by"),
+    claimedAt: timestamp("claimed_at", { withTimezone: true }),
+    /** Expired leases are reclaimable by any runner. */
+    leaseExpiresAt: timestamp("lease_expires_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    uniqueIndex("uq_agent_memory_local_conversation").on(
-      table.localConversationId
-    ),
-    index("idx_agent_memory_repo").on(table.gitRepository),
-    index("idx_agent_memory_user").on(table.userId),
-    index("idx_agent_memory_kind").on(table.kind)
+    index("idx_wiki_page_status").on(table.status),
+    index("idx_wiki_page_last_verified").on(table.lastVerifiedOn),
+    index("idx_wiki_page_dirty").on(table.dirty),
+    index("idx_wiki_page_lease_expires").on(table.leaseExpiresAt).where(sql`${table.leaseExpiresAt} IS NOT NULL`)
   ]
 );
-var contentSourceType = pgEnum("content_source_type", [
-  "own_site",
-  "client_site",
-  "external_source",
-  "competitor",
-  "news",
-  "government",
-  "supplier",
-  "unknown"
-]);
-var contentSnapshotKind = pgEnum("content_snapshot_kind", [
-  "corpus",
-  "source"
-]);
-var contentCandidateStatus = pgEnum("content_candidate_status", [
-  "candidate",
-  "used",
-  "rejected"
-]);
-var contentSources = pgTable(
-  "content_sources",
+pgTable(
+  "wiki_change_log",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    url: text("url").notNull(),
-    canonicalUrl: text("canonical_url"),
-    domain: text("domain").notNull(),
-    sourceType: contentSourceType("source_type").notNull().default("unknown"),
-    title: text("title"),
-    author: text("author"),
-    publishedAt: timestamp("published_at", { withTimezone: true }),
-    extractionMethod: text("extraction_method"),
-    summary: text("summary"),
-    facts: jsonb("facts").$type().notNull().default([]),
-    limitations: jsonb("limitations").$type().notNull().default([]),
-    fullText: text("full_text"),
-    textHash: text("text_hash"),
-    wordCount: integer("word_count"),
-    language: text("language"),
-    projectKey: text("project_key"),
-    siteKey: text("site_key"),
-    ticketNumber: text("ticket_number"),
-    metadata: jsonb("metadata").$type().notNull().default({}),
-    fetchedAt: timestamp("fetched_at", { withTimezone: true }).notNull().defaultNow(),
-    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+    authorJob: text("author_job").notNull(),
+    summary: text("summary").notNull().default(""),
+    slugs: text("slugs").array().notNull().default([]),
+    syncedAt: timestamp("synced_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
   },
-  (table) => [
-    uniqueIndex("content_sources_canonical_url_uidx").on(table.canonicalUrl),
-    index("content_sources_domain_idx").on(table.domain),
-    index("content_sources_type_idx").on(table.sourceType),
-    index("content_sources_text_hash_idx").on(table.textHash),
-    index("content_sources_project_idx").on(table.projectKey),
-    index("content_sources_ticket_idx").on(table.ticketNumber),
-    index("content_sources_last_seen_idx").on(table.lastSeenAt.desc())
-  ]
+  (table) => [index("idx_wiki_change_log_created").on(table.createdAt)]
 );
-var contentEvidencePacks = pgTable(
-  "content_evidence_packs",
+pgTable(
+  "wiki_page_flag",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    topic: text("topic"),
-    locale: text("locale"),
-    projectKey: text("project_key"),
-    siteKey: text("site_key"),
-    ticketNumber: text("ticket_number"),
-    generatedAt: timestamp("generated_at", { withTimezone: true }).notNull().defaultNow(),
-    sources: jsonb("sources").$type().notNull().default([]),
-    verifiedFacts: jsonb("verified_facts").$type().notNull().default([]),
-    conflicts: jsonb("conflicts").$type().notNull().default([]),
-    uniqueClaims: jsonb("unique_claims").$type().notNull().default([]),
-    openQuestions: jsonb("open_questions").$type().notNull().default([]),
-    verbatimWarnings: jsonb("verbatim_warnings").$type().notNull().default([]),
-    limitations: jsonb("limitations").$type().notNull().default([]),
-    /**
-     * Order-independent signature of topic + canonical URL set (packSignature).
-     * Lets the reuse-first save path return a fresh stored pack without
-     * re-researching when the same urls/topic are shared again.
-     */
-    sourceSignature: text("source_signature"),
-    metadata: jsonb("metadata").$type().notNull().default({}),
+    pageSlug: text("page_slug").notNull(),
+    kind: text("kind").notNull(),
+    detail: text("detail").notNull().default(""),
+    sourceRef: text("source_ref"),
+    createdBy: text("created_by"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+    resolvedAt: timestamp("resolved_at", { withTimezone: true }),
+    resolvedBy: text("resolved_by")
   },
-  (table) => [
-    index("content_evidence_packs_project_idx").on(table.projectKey),
-    index("content_evidence_packs_ticket_idx").on(table.ticketNumber),
-    index("content_evidence_packs_generated_idx").on(table.generatedAt.desc()),
-    index("content_evidence_packs_signature_idx").on(table.sourceSignature)
-  ]
+  (table) => [index("idx_wiki_page_flag_created").on(table.createdAt)]
 );
 pgTable(
-  "content_evidence_pack_source",
+  "wiki_page_evidence",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    packId: uuid("pack_id").notNull().references(() => contentEvidencePacks.id, { onDelete: "cascade" }),
-    contentSourceId: uuid("content_source_id").notNull().references(() => contentSources.id, { onDelete: "cascade" }),
-    packSourceRef: text("pack_source_ref"),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+    pageSlug: text("page_slug").notNull(),
+    evidenceType: text("evidence_type").notNull(),
+    evidenceRef: text("evidence_ref").notNull(),
+    matchScore: real("match_score"),
+    matchReason: text("match_reason"),
+    snippet: text("snippet"),
+    status: text("status").notNull().default("pending"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    resolvedAt: timestamp("resolved_at", { withTimezone: true })
   },
   (table) => [
-    uniqueIndex("content_evidence_pack_source_uidx").on(
-      table.packId,
-      table.contentSourceId
-    ),
-    index("content_evidence_pack_source_source_idx").on(table.contentSourceId)
-  ]
-);
-var contentCorpusItems = pgTable(
-  "content_corpus_items",
-  {
-    id: uuid("id").primaryKey().defaultRandom(),
-    projectKey: text("project_key").notNull(),
-    siteKey: text("site_key"),
-    url: text("url").notNull(),
-    canonicalUrl: text("canonical_url"),
-    domain: text("domain").notNull(),
-    pagePath: text("page_path"),
-    sourceType: contentSourceType("source_type").notNull().default("own_site"),
-    title: text("title"),
-    h1: text("h1"),
-    headings: jsonb("headings").$type().notNull().default([]),
-    wordCount: integer("word_count"),
-    fullText: text("full_text"),
-    textHash: text("text_hash"),
-    internalLinks: jsonb("internal_links").$type().notNull().default([]),
-    externalLinks: jsonb("external_links").$type().notNull().default([]),
-    language: text("language"),
-    ticketNumber: text("ticket_number"),
-    metadata: jsonb("metadata").$type().notNull().default({}),
-    extractedAt: timestamp("extracted_at", { withTimezone: true }).notNull().defaultNow(),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+    uniqueIndex(
+      "wiki_page_evidence_page_slug_evidence_type_evidence_ref_key"
+    ).on(table.pageSlug, table.evidenceType, table.evidenceRef),
+    index("idx_wiki_page_evidence_created").on(table.createdAt)
+  ]
+);
+pgTable(
+  "wiki_page_link",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    sourceSlug: text("source_slug").notNull(),
+    targetSlug: text("target_slug").notNull(),
+    kind: text("kind").notNull().default("wikilink"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    uniqueIndex("content_corpus_items_project_canonical_uidx").on(
-      table.projectKey,
-      table.canonicalUrl
+    uniqueIndex("wiki_page_link_source_target_kind_key").on(
+      table.sourceSlug,
+      table.targetSlug,
+      table.kind
     ),
-    index("content_corpus_items_domain_idx").on(table.domain),
-    index("content_corpus_items_project_idx").on(table.projectKey),
-    index("content_corpus_items_type_idx").on(table.sourceType),
-    index("content_corpus_items_text_hash_idx").on(table.textHash),
-    index("content_corpus_items_extracted_idx").on(table.extractedAt.desc())
+    index("idx_wiki_page_link_source").on(table.sourceSlug),
+    index("idx_wiki_page_link_target").on(table.targetSlug)
   ]
 );
 pgTable(
-  "content_quality_runs",
+  "wiki_page_read",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    corpusItemId: uuid("corpus_item_id").references(
-      () => contentCorpusItems.id,
-      { onDelete: "set null" }
-    ),
-    contentSourceId: uuid("content_source_id").references(
-      () => contentSources.id,
-      { onDelete: "set null" }
-    ),
-    projectKey: text("project_key"),
-    siteKey: text("site_key"),
-    url: text("url"),
-    canonicalUrl: text("canonical_url"),
-    tool: text("tool").notNull(),
-    toolVersion: text("tool_version"),
-    score: integer("score"),
-    flags: jsonb("flags").$type().notNull().default([]),
-    report: jsonb("report").$type().notNull().default({}),
-    reportUrl: text("report_url"),
-    ticketNumber: text("ticket_number"),
-    runAt: timestamp("run_at", { withTimezone: true }).notNull().defaultNow(),
+    slug: text("slug").notNull(),
+    caller: text("caller"),
+    includedArchive: boolean("included_archive").notNull().default(false),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    index("content_quality_runs_corpus_idx").on(table.corpusItemId),
-    index("content_quality_runs_source_idx").on(table.contentSourceId),
-    index("content_quality_runs_project_run_idx").on(
-      table.projectKey,
-      table.runAt.desc()
-    ),
-    index("content_quality_runs_url_idx").on(table.url)
+    index("idx_wiki_page_read_slug").on(table.slug, table.createdAt),
+    index("idx_wiki_page_read_created").on(table.createdAt)
   ]
 );
 pgTable(
-  "content_snapshots",
+  "wiki_verify_event",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    corpusItemId: uuid("corpus_item_id").references(
-      () => contentCorpusItems.id,
-      { onDelete: "cascade" }
-    ),
-    contentSourceId: uuid("content_source_id").references(
-      () => contentSources.id,
-      { onDelete: "cascade" }
-    ),
-    kind: contentSnapshotKind("kind").notNull(),
-    url: text("url"),
-    canonicalUrl: text("canonical_url"),
-    domain: text("domain"),
-    title: text("title"),
-    fullText: text("full_text"),
-    textHash: text("text_hash"),
-    wordCount: integer("word_count"),
-    headings: jsonb("headings").$type().notNull().default([]),
-    internalLinks: jsonb("internal_links").$type().notNull().default([]),
-    metadata: jsonb("metadata").$type().notNull().default({}),
-    /**
-     * Run that captured this snapshot (managed site content sync, 2026-DASMG-042).
-     * Soft pointer (no Drizzle .references() to avoid a schema import cycle); the
-     * DB foreign key is declared in the migration.
-     */
-    ingestionRunId: uuid("ingestion_run_id"),
-    /** Source git commit / deploy id this snapshot was captured for, when known. */
-    sourceCommit: text("source_commit"),
-    capturedAt: timestamp("captured_at", { withTimezone: true }).notNull().defaultNow(),
+    pageSlug: text("page_slug").notNull(),
+    outcome: text("outcome").notNull(),
+    runMode: text("run_mode"),
+    note: text("note"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    index("content_snapshots_corpus_idx").on(
-      table.corpusItemId,
-      table.capturedAt.desc()
-    ),
-    index("content_snapshots_source_idx").on(
-      table.contentSourceId,
-      table.capturedAt.desc()
-    ),
-    index("content_snapshots_text_hash_idx").on(table.textHash),
-    index("content_snapshots_ingestion_run_idx").on(table.ingestionRunId),
-    uniqueIndex("content_snapshots_corpus_hash_uidx").on(
-      table.corpusItemId,
-      table.textHash
-    ),
-    uniqueIndex("content_snapshots_source_hash_uidx").on(
-      table.contentSourceId,
-      table.textHash
+    index("idx_wiki_verify_event_created").on(table.createdAt),
+    index("idx_wiki_verify_event_outcome_created").on(
+      table.outcome,
+      table.createdAt
     )
   ]
 );
 pgTable(
-  "content_site_candidates",
+  "wiki_invariant_violation",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    contentSourceId: uuid("content_source_id").references(
-      () => contentSources.id,
-      { onDelete: "cascade" }
-    ),
-    packId: uuid("pack_id").references(() => contentEvidencePacks.id, {
-      onDelete: "cascade"
-    }),
-    /** Managed site (2026-DASMG-042) when known; soft pointer, no FK to avoid a schema cycle. */
-    managedSiteId: uuid("managed_site_id"),
-    projectKey: text("project_key"),
-    siteKey: text("site_key"),
-    domain: text("domain"),
-    status: contentCandidateStatus("status").notNull().default("candidate"),
-    reason: text("reason"),
-    score: integer("score"),
-    /** The corpus page produced from this content, set when status becomes used. */
-    usedCorpusItemId: uuid("used_corpus_item_id").references(
-      () => contentCorpusItems.id,
-      { onDelete: "set null" }
-    ),
-    usedUrl: text("used_url"),
-    usedAt: timestamp("used_at", { withTimezone: true }),
-    ticketNumber: text("ticket_number"),
-    metadata: jsonb("metadata").$type().notNull().default({}),
+    slug: text("slug").notNull(),
+    code: text("code").notNull(),
+    severity: text("severity").notNull().default("warning"),
+    detail: text("detail").notNull().default(""),
+    suggestedFix: text("suggested_fix"),
+    suggestedSlug: text("suggested_slug"),
+    occurrenceCount: integer("occurrence_count").notNull().default(1),
+    reopenCount: integer("reopen_count").notNull().default(0),
+    firstSeenAt: timestamp("first_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    resolvedAt: timestamp("resolved_at", { withTimezone: true }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    index("content_site_candidates_source_idx").on(table.contentSourceId),
-    index("content_site_candidates_pack_idx").on(table.packId),
-    index("content_site_candidates_managed_site_idx").on(table.managedSiteId),
-    index("content_site_candidates_project_idx").on(table.projectKey),
-    index("content_site_candidates_status_idx").on(table.status),
-    uniqueIndex("content_site_candidates_source_site_uidx").on(table.contentSourceId, table.managedSiteId).where(
-      sql`content_source_id IS NOT NULL AND managed_site_id IS NOT NULL`
-    ),
-    uniqueIndex("content_site_candidates_pack_site_uidx").on(table.packId, table.managedSiteId).where(sql`pack_id IS NOT NULL AND managed_site_id IS NOT NULL`),
-    check(
-      "content_site_candidates_subject_chk",
-      sql`content_source_id IS NOT NULL OR pack_id IS NOT NULL`
+    uniqueIndex("wiki_invariant_violation_slug_code_key").on(
+      table.slug,
+      table.code
     ),
-    check(
-      "content_site_candidates_target_chk",
-      sql`managed_site_id IS NOT NULL OR project_key IS NOT NULL OR domain IS NOT NULL`
+    index("idx_wiki_invariant_violation_severity").on(
+      table.severity,
+      table.resolvedAt
     )
   ]
 );
-var managedServerOs = pgEnum("managed_server_os", [
-  "linux",
-  "windows",
-  "unknown"
-]);
-var serverAgentStatus = pgEnum("server_agent_status", [
-  "not_installed",
-  "installing",
-  "online",
-  "degraded",
-  "offline",
-  "error"
-]);
-var resourceKind = pgEnum("resource_kind", [
-  "wordpress",
-  "prestashop",
-  "postgres_cluster",
-  "postgres_database",
-  "mysql_database",
-  "mariadb_database",
-  "boiler_project",
-  "boiler_web_project",
-  "static_site",
-  "docker_app",
-  "domain",
-  "backup_policy",
-  "server_service"
-]);
-var resourceStatus = pgEnum("resource_status", [
-  "unknown",
-  "healthy",
-  "degraded",
-  "failed",
-  "missing",
-  "provisioning",
-  "disabled"
-]);
-var resourceOwnership = pgEnum("resource_ownership", [
-  "managed",
-  "discovered",
-  "external"
-]);
-var operationStatus = pgEnum("operation_status", [
-  "queued",
-  "running",
-  "succeeded",
-  "failed",
-  "cancelled"
-]);
-var alertSeverity = pgEnum("alert_severity", [
-  "info",
-  "warning",
-  "critical"
-]);
-var managedServer = pgTable(
-  "managed_server",
+pgTable(
+  "wiki_pipeline_rule",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    name: text("name").notNull(),
-    hostname: text("hostname").notNull(),
-    port: integer("port").notNull().default(22),
-    username: text("username").notNull(),
-    authMethod: text("auth_method").notNull().default("ssh_key"),
-    os: managedServerOs("os").notNull().default("unknown"),
-    provider: text("provider"),
-    region: text("region"),
-    tags: jsonb("tags").$type().notNull().default([]),
-    agentStatus: serverAgentStatus("agent_status").notNull().default("not_installed"),
-    agentVersion: text("agent_version"),
-    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }),
+    scope: text("scope").notNull(),
+    ruleKey: text("rule_key").notNull(),
+    text: text("text").notNull(),
+    /** A = deterministic auto-applied, B = judgement, gated by insight accept. */
+    tier: text("tier").notNull().default("B"),
+    status: text("status").notNull().default("proposed"),
+    sourceCode: text("source_code"),
+    evidenceRefs: text("evidence_refs").array().notNull().default([]),
+    violationCount: integer("violation_count").notNull().default(0),
+    lastViolationAt: timestamp("last_violation_at", { withTimezone: true }),
+    activatedAt: timestamp("activated_at", { withTimezone: true }),
+    retiredAt: timestamp("retired_at", { withTimezone: true }),
+    retiredReason: text("retired_reason"),
+    rejectedAt: timestamp("rejected_at", { withTimezone: true }),
+    rejectedReason: text("rejected_reason"),
+    approvedBy: text("approved_by"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    uniqueIndex("managed_server_hostname_port_uidx").on(
-      table.hostname,
-      table.port
-    ),
-    index("managed_server_agent_status_idx").on(table.agentStatus)
+    uniqueIndex("wiki_pipeline_rule_scope_key_key").on(
+      table.scope,
+      table.ruleKey
+    )
   ]
 );
-pgTable("server_credential", {
-  serverId: uuid("server_id").primaryKey().references(() => managedServer.id, { onDelete: "cascade" }),
-  passwordEncrypted: text("password_encrypted"),
-  sshKeyEncrypted: text("ssh_key_encrypted"),
-  sshKeyPassphraseEncrypted: text("ssh_key_passphrase_encrypted"),
-  dbRootPasswordEncrypted: text("db_root_password_encrypted"),
-  monitoringApiKeyEncrypted: text("monitoring_api_key_encrypted"),
-  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-  updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
-});
 pgTable(
-  "server_connection_log",
+  "wiki_search_log",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
-    userId: uuid("user_id").notNull(),
-    connectedAt: timestamp("connected_at", { withTimezone: true }).notNull().defaultNow(),
-    disconnectedAt: timestamp("disconnected_at", { withTimezone: true }),
-    durationSeconds: integer("duration_seconds"),
-    status: text("status").notNull(),
-    errorMessage: text("error_message"),
-    clientIp: text("client_ip"),
-    terminalCols: integer("terminal_cols"),
-    terminalRows: integer("terminal_rows"),
-    outputSizeBytes: bigint("output_size_bytes", { mode: "number" }).notNull().default(0),
-    inputSizeBytes: bigint("input_size_bytes", { mode: "number" }).notNull().default(0),
-    commandCount: integer("command_count").notNull().default(0),
-    connectionType: text("connection_type").notNull().default("terminal"),
-    action: text("action"),
-    rawOutput: text("raw_output"),
+    query: text("query").notNull(),
+    hitCount: integer("hit_count").notNull().default(0),
+    topScore: real("top_score"),
+    topSlug: text("top_slug"),
+    caller: text("caller"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
   },
-  (table) => [
-    index("server_connection_log_server_idx").on(table.serverId),
-    index("server_connection_log_user_idx").on(table.userId),
-    index("server_connection_log_connected_idx").on(table.connectedAt),
-    index("server_connection_log_status_idx").on(table.status)
-  ]
+  (table) => [index("idx_wiki_search_log_created").on(table.createdAt)]
 );
 pgTable(
-  "mcp_audit_log",
+  "team_memory_search_log",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    apiKeyId: uuid("api_key_id"),
-    userId: uuid("user_id"),
-    toolName: text("tool_name"),
-    arguments: jsonb("arguments"),
-    ipAddress: text("ip_address"),
-    serverId: uuid("server_id"),
-    resultStatus: text("result_status").notNull().default("success"),
-    errorMessage: text("error_message"),
-    durationMs: integer("duration_ms"),
+    query: text("query").notNull(),
+    hitCount: integer("hit_count").notNull().default(0),
+    topScore: real("top_score"),
+    topId: text("top_id"),
+    caller: text("caller"),
+    repo: text("repo"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [index("idx_team_memory_search_log_created").on(table.createdAt)]
+);
+pgTable(
+  "wiki_agent_run",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    phase: text("phase").notNull(),
+    model: text("model"),
+    claimed: jsonb("claimed").$type(),
+    proven: jsonb("proven").$type(),
+    violationCount: integer("violation_count").notNull().default(0),
+    violations: jsonb("violations").$type(),
+    outcome: text("outcome").notNull().default("ok"),
+    agentId: text("agent_id"),
+    runId: text("run_id"),
+    passId: text("pass_id"),
+    changedPaths: jsonb("changed_paths").$type(),
+    summary: text("summary"),
+    userVerdict: text("user_verdict"),
+    userVerdictNote: text("user_verdict_note"),
+    verdictAt: timestamp("verdict_at", { withTimezone: true }),
+    reviewed: boolean("reviewed").notNull().default(false),
+    reviewNotes: text("review_notes"),
+    reviewedAt: timestamp("reviewed_at", { withTimezone: true }),
+    startedAt: timestamp("started_at", { withTimezone: true }),
+    finishedAt: timestamp("finished_at", { withTimezone: true }).notNull().defaultNow(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    index("mcp_audit_log_created_at_idx").on(table.createdAt),
-    index("mcp_audit_log_user_idx").on(table.userId),
-    index("mcp_audit_log_tool_name_idx").on(table.toolName),
-    index("mcp_audit_log_server_idx").on(table.serverId),
-    index("mcp_audit_log_api_key_idx").on(table.apiKeyId),
-    index("mcp_audit_log_result_status_idx").on(table.resultStatus)
+    index("idx_wiki_agent_run_phase_created").on(table.phase, table.createdAt),
+    index("idx_wiki_agent_run_created").on(table.createdAt),
+    index("idx_wiki_agent_run_reviewed").on(table.reviewed),
+    index("idx_wiki_agent_run_user_verdict").on(table.userVerdict),
+    index("idx_wiki_agent_run_pass_id").on(table.passId)
   ]
 );
-var resource = pgTable(
-  "resource",
+pgTable(
+  "wiki_agent_review_suggestion",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
-    parentResourceId: uuid("parent_resource_id"),
-    kind: resourceKind("kind").notNull(),
-    slug: text("slug").notNull(),
-    displayName: text("display_name").notNull(),
-    spec: jsonb("spec").$type().notNull().default({}),
-    state: jsonb("state").$type().notNull().default({}),
-    status: resourceStatus("status").notNull().default("unknown"),
-    ownership: resourceOwnership("ownership").notNull().default("managed"),
-    lastDetectedAt: timestamp("last_detected_at", { withTimezone: true }),
-    lastEventId: uuid("last_event_id"),
+    status: text("status").notNull().default("proposed"),
+    implementationClass: text("implementation_class").notNull(),
+    phase: text("phase"),
+    scope: text("scope"),
+    title: text("title").notNull(),
+    summary: text("summary").notNull(),
+    targetFile: text("target_file"),
+    targetKey: text("target_key"),
+    beforeText: text("before_text"),
+    afterText: text("after_text"),
+    evidenceRunIds: uuid("evidence_run_ids").array().notNull().default([]),
+    evidenceRefs: text("evidence_refs").array().notNull().default([]),
+    dedupeKey: text("dedupe_key").notNull(),
+    source: text("source").notNull().default("auto"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    uniqueIndex("resource_server_kind_slug_uidx").on(
-      table.serverId,
-      table.kind,
-      table.slug
-    ),
-    index("resource_server_idx").on(table.serverId),
-    index("resource_parent_idx").on(table.parentResourceId),
-    index("resource_kind_status_idx").on(table.kind, table.status)
+    uniqueIndex("wiki_agent_review_suggestion_dedupe_key").on(table.dedupeKey),
+    index("idx_wiki_agent_review_suggestion_status_created").on(
+      table.status,
+      table.createdAt
+    )
   ]
 );
+
+// ../db/src/schema/agent-memory.ts
 pgTable(
-  "resource_event",
+  "agent_memory",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    resourceId: uuid("resource_id").notNull().references(() => resource.id, { onDelete: "cascade" }),
-    kind: text("kind").notNull(),
-    before: jsonb("before").$type(),
-    after: jsonb("after").$type(),
-    actorUserId: text("actor_user_id"),
-    operationId: uuid("operation_id"),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+    conversationId: uuid("conversation_id"),
+    localConversationId: text("local_conversation_id"),
+    source: text("source").notNull().default("mirror"),
+    userId: text("user_id"),
+    hostId: uuid("host_id"),
+    workspaceId: uuid("workspace_id"),
+    gitRepository: text("git_repository"),
+    title: text("title").notNull().default(""),
+    summary: text("summary"),
+    content: text("content").notNull().default(""),
+    contentHash: text("content_hash"),
+    embedding: real("embedding").array(),
+    embeddingVec: vector("embedding_vec", {
+      dimensions: WIKI_EMBEDDING_DIMENSIONS
+    }),
+    embeddingModel: text("embedding_model"),
+    messageCount: integer("message_count").notNull().default(0),
+    startedAt: timestamp("started_at", { withTimezone: true }),
+    lastMessageAt: timestamp("last_message_at", { withTimezone: true }),
+    embeddedAt: timestamp("embedded_at", { withTimezone: true }),
+    resolved: boolean("resolved"),
+    category: text("category"),
+    tech: text("tech").array(),
+    kind: text("kind").notNull().default("human"),
+    symbols: text("symbols").array(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    index("resource_event_resource_created_idx").on(
-      table.resourceId,
-      table.createdAt
+    uniqueIndex("uq_agent_memory_local_conversation").on(
+      table.localConversationId
     ),
-    index("resource_event_operation_idx").on(table.operationId)
+    index("idx_agent_memory_repo").on(table.gitRepository),
+    index("idx_agent_memory_user").on(table.userId),
+    index("idx_agent_memory_kind").on(table.kind)
   ]
 );
-var operation = pgTable(
-  "operation",
+var contentSourceType = pgEnum("content_source_type", [
+  "own_site",
+  "client_site",
+  "external_source",
+  "competitor",
+  "news",
+  "government",
+  "supplier",
+  "unknown"
+]);
+var contentSnapshotKind = pgEnum("content_snapshot_kind", [
+  "corpus",
+  "source"
+]);
+var contentCandidateStatus = pgEnum("content_candidate_status", [
+  "candidate",
+  "used",
+  "rejected"
+]);
+var contentSources = pgTable(
+  "content_sources",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    kind: text("kind").notNull(),
-    resourceId: uuid("resource_id").references(() => resource.id, {
-      onDelete: "set null"
-    }),
-    serverId: uuid("server_id").references(() => managedServer.id, {
-      onDelete: "set null"
-    }),
-    status: operationStatus("status").notNull().default("queued"),
-    steps: jsonb("steps").$type().notNull().default([]),
-    idempotencyKey: text("idempotency_key").notNull(),
-    triggerRunId: text("trigger_run_id"),
-    logsR2Key: text("logs_r2_key"),
-    logs: text("logs"),
-    startedBy: text("started_by"),
-    startedAt: timestamp("started_at", { withTimezone: true }),
-    endedAt: timestamp("ended_at", { withTimezone: true }),
+    url: text("url").notNull(),
+    canonicalUrl: text("canonical_url"),
+    domain: text("domain").notNull(),
+    sourceType: contentSourceType("source_type").notNull().default("unknown"),
+    title: text("title"),
+    author: text("author"),
+    publishedAt: timestamp("published_at", { withTimezone: true }),
+    extractionMethod: text("extraction_method"),
+    summary: text("summary"),
+    facts: jsonb("facts").$type().notNull().default([]),
+    limitations: jsonb("limitations").$type().notNull().default([]),
+    fullText: text("full_text"),
+    textHash: text("text_hash"),
+    wordCount: integer("word_count"),
+    language: text("language"),
+    projectKey: text("project_key"),
+    siteKey: text("site_key"),
+    ticketNumber: text("ticket_number"),
+    metadata: jsonb("metadata").$type().notNull().default({}),
+    fetchedAt: timestamp("fetched_at", { withTimezone: true }).notNull().defaultNow(),
+    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    uniqueIndex("operation_idempotency_uidx").on(table.idempotencyKey),
-    index("operation_resource_idx").on(table.resourceId),
-    index("operation_server_idx").on(table.serverId),
-    index("operation_status_created_idx").on(table.status, table.createdAt)
+    uniqueIndex("content_sources_canonical_url_uidx").on(table.canonicalUrl),
+    index("content_sources_domain_idx").on(table.domain),
+    index("content_sources_type_idx").on(table.sourceType),
+    index("content_sources_text_hash_idx").on(table.textHash),
+    index("content_sources_project_idx").on(table.projectKey),
+    index("content_sources_ticket_idx").on(table.ticketNumber),
+    index("content_sources_last_seen_idx").on(table.lastSeenAt.desc())
   ]
 );
-pgTable(
-  "agent_installation",
+var contentEvidencePacks = pgTable(
+  "content_evidence_packs",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
-    agentId: text("agent_id"),
-    version: text("version").notNull(),
-    installPath: text("install_path").notNull().default("/usr/local/bin/mg-agent"),
-    configHash: text("config_hash").notNull(),
-    status: serverAgentStatus("status").notNull().default("installing"),
-    lastHeartbeatAt: timestamp("last_heartbeat_at", { withTimezone: true }),
-    lastError: text("last_error"),
+    topic: text("topic"),
+    locale: text("locale"),
+    projectKey: text("project_key"),
+    siteKey: text("site_key"),
+    ticketNumber: text("ticket_number"),
+    generatedAt: timestamp("generated_at", { withTimezone: true }).notNull().defaultNow(),
+    sources: jsonb("sources").$type().notNull().default([]),
+    verifiedFacts: jsonb("verified_facts").$type().notNull().default([]),
+    conflicts: jsonb("conflicts").$type().notNull().default([]),
+    uniqueClaims: jsonb("unique_claims").$type().notNull().default([]),
+    openQuestions: jsonb("open_questions").$type().notNull().default([]),
+    verbatimWarnings: jsonb("verbatim_warnings").$type().notNull().default([]),
+    limitations: jsonb("limitations").$type().notNull().default([]),
+    /**
+     * Order-independent signature of topic + canonical URL set (packSignature).
+     * Lets the reuse-first save path return a fresh stored pack without
+     * re-researching when the same urls/topic are shared again.
+     */
+    sourceSignature: text("source_signature"),
+    metadata: jsonb("metadata").$type().notNull().default({}),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    uniqueIndex("agent_installation_server_uidx").on(table.serverId),
-    index("agent_installation_status_idx").on(table.status)
+    index("content_evidence_packs_project_idx").on(table.projectKey),
+    index("content_evidence_packs_ticket_idx").on(table.ticketNumber),
+    index("content_evidence_packs_generated_idx").on(table.generatedAt.desc()),
+    index("content_evidence_packs_signature_idx").on(table.sourceSignature)
   ]
 );
 pgTable(
-  "monitoring_sample",
+  "content_evidence_pack_source",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
-    resourceId: uuid("resource_id").references(() => resource.id, {
-      onDelete: "cascade"
-    }),
-    metric: text("metric").notNull(),
-    value: integer("value").notNull(),
-    unit: text("unit").notNull(),
-    tags: jsonb("tags").$type().notNull().default({}),
-    sampledAt: timestamp("sampled_at", { withTimezone: true }).notNull().defaultNow()
+    packId: uuid("pack_id").notNull().references(() => contentEvidencePacks.id, { onDelete: "cascade" }),
+    contentSourceId: uuid("content_source_id").notNull().references(() => contentSources.id, { onDelete: "cascade" }),
+    packSourceRef: text("pack_source_ref"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    index("monitoring_sample_server_metric_time_idx").on(
-      table.serverId,
-      table.metric,
-      table.sampledAt
-    ),
-    // Descending on sampled_at so "latest metric per (server, metric)" lookups
-    // (DISTINCT ON ... ORDER BY sampled_at DESC) are served by an index-only
-    // scan instead of a full-table sort. The migration also adds
-    // INCLUDE (value, unit) to make it covering for the overview snapshot query
-    // (Drizzle 0.44 can't express INCLUDE here). See migration 20260529210000.
-    index("monitoring_sample_server_metric_time_desc_idx").on(
-      table.serverId,
-      table.metric,
-      table.sampledAt.desc()
-    ),
-    index("monitoring_sample_resource_metric_time_idx").on(
-      table.resourceId,
-      table.metric,
-      table.sampledAt
+    uniqueIndex("content_evidence_pack_source_uidx").on(
+      table.packId,
+      table.contentSourceId
     ),
-    // Retention cleanup (monitoring-sample-retention-cleanup) filters only on
-    // sampled_at. Without this index Postgres seq-scans the full firehose.
-    // Live DB name uses idx_ prefix (see migration 20260731070000).
-    index("idx_monitoring_sample_sampled_at").on(table.sampledAt)
+    index("content_evidence_pack_source_source_idx").on(table.contentSourceId)
   ]
 );
-var appLogSource = pgTable(
-  "app_log_source",
+var contentCorpusItems = pgTable(
+  "content_corpus_items",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
-    resourceId: uuid("resource_id").references(() => resource.id, {
-      onDelete: "set null"
-    }),
-    sourceType: text("source_type").notNull(),
-    sourceKey: text("source_key").notNull(),
-    displayName: text("display_name").notNull(),
-    path: text("path").notNull(),
-    enabled: boolean("enabled").notNull().default(true),
-    mutedUntil: timestamp("muted_until", { withTimezone: true }),
+    projectKey: text("project_key").notNull(),
+    siteKey: text("site_key"),
+    url: text("url").notNull(),
+    canonicalUrl: text("canonical_url"),
+    domain: text("domain").notNull(),
+    pagePath: text("page_path"),
+    sourceType: contentSourceType("source_type").notNull().default("own_site"),
+    title: text("title"),
+    h1: text("h1"),
+    headings: jsonb("headings").$type().notNull().default([]),
+    wordCount: integer("word_count"),
+    fullText: text("full_text"),
+    textHash: text("text_hash"),
+    internalLinks: jsonb("internal_links").$type().notNull().default([]),
+    externalLinks: jsonb("external_links").$type().notNull().default([]),
+    language: text("language"),
+    ticketNumber: text("ticket_number"),
     metadata: jsonb("metadata").$type().notNull().default({}),
-    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    extractedAt: timestamp("extracted_at", { withTimezone: true }).notNull().defaultNow(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    uniqueIndex("app_log_source_server_type_key_uidx").on(
-      table.serverId,
-      table.sourceType,
-      table.sourceKey
+    uniqueIndex("content_corpus_items_project_canonical_uidx").on(
+      table.projectKey,
+      table.canonicalUrl
     ),
-    index("app_log_source_server_idx").on(table.serverId),
-    index("app_log_source_resource_idx").on(table.resourceId),
-    index("app_log_source_type_seen_idx").on(
-      table.sourceType,
-      table.lastSeenAt
-    )
+    index("content_corpus_items_domain_idx").on(table.domain),
+    index("content_corpus_items_project_idx").on(table.projectKey),
+    index("content_corpus_items_type_idx").on(table.sourceType),
+    index("content_corpus_items_text_hash_idx").on(table.textHash),
+    index("content_corpus_items_extracted_idx").on(table.extractedAt.desc())
   ]
 );
 pgTable(
-  "app_error_event",
+  "content_quality_runs",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
-    resourceId: uuid("resource_id").references(() => resource.id, {
-      onDelete: "set null"
-    }),
-    logSourceId: uuid("log_source_id").references(() => appLogSource.id, {
-      onDelete: "set null"
-    }),
-    fingerprint: text("fingerprint").notNull(),
-    severity: text("severity").notNull().default("critical"),
-    category: text("category").notNull(),
-    sourceType: text("source_type").notNull(),
-    sourcePath: text("source_path").notNull(),
-    sampleMessage: text("sample_message").notNull(),
-    sampleLines: jsonb("sample_lines").$type().notNull().default([]),
-    signals: jsonb("signals").$type().notNull().default({}),
-    occurrences: integer("occurrences").notNull().default(1),
-    firstSeenAt: timestamp("first_seen_at", { withTimezone: true }).notNull().defaultNow(),
-    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
+    corpusItemId: uuid("corpus_item_id").references(
+      () => contentCorpusItems.id,
+      { onDelete: "set null" }
+    ),
+    contentSourceId: uuid("content_source_id").references(
+      () => contentSources.id,
+      { onDelete: "set null" }
+    ),
+    projectKey: text("project_key"),
+    siteKey: text("site_key"),
+    url: text("url"),
+    canonicalUrl: text("canonical_url"),
+    tool: text("tool").notNull(),
+    toolVersion: text("tool_version"),
+    score: integer("score"),
+    flags: jsonb("flags").$type().notNull().default([]),
+    report: jsonb("report").$type().notNull().default({}),
+    reportUrl: text("report_url"),
+    ticketNumber: text("ticket_number"),
+    runAt: timestamp("run_at", { withTimezone: true }).notNull().defaultNow(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    index("app_error_event_fingerprint_created_idx").on(
-      table.fingerprint,
-      table.createdAt
-    ),
-    index("app_error_event_server_created_idx").on(
-      table.serverId,
-      table.createdAt
-    ),
-    index("app_error_event_resource_created_idx").on(
-      table.resourceId,
-      table.createdAt
+    index("content_quality_runs_corpus_idx").on(table.corpusItemId),
+    index("content_quality_runs_source_idx").on(table.contentSourceId),
+    index("content_quality_runs_project_run_idx").on(
+      table.projectKey,
+      table.runAt.desc()
     ),
-    index("app_error_event_severity_created_idx").on(
-      table.severity,
-      table.createdAt
-    )
+    index("content_quality_runs_url_idx").on(table.url)
   ]
 );
 pgTable(
-  "app_error_alert",
+  "content_snapshots",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    fingerprint: text("fingerprint").notNull(),
-    serverId: uuid("server_id").notNull().references(() => managedServer.id, { onDelete: "cascade" }),
-    resourceId: uuid("resource_id").references(() => resource.id, {
-      onDelete: "set null"
-    }),
-    logSourceId: uuid("log_source_id").references(() => appLogSource.id, {
-      onDelete: "set null"
-    }),
-    severity: text("severity").notNull().default("critical"),
-    status: text("status").notNull().default("open"),
-    category: text("category").notNull(),
-    title: text("title").notNull(),
-    lastError: text("last_error").notNull(),
-    sampleLines: jsonb("sample_lines").$type().notNull().default([]),
-    signals: jsonb("signals").$type().notNull().default({}),
-    failureCount: integer("failure_count").notNull().default(1),
-    firstSeenAt: timestamp("first_seen_at", { withTimezone: true }).notNull().defaultNow(),
-    lastSeenAt: timestamp("last_seen_at", { withTimezone: true }).notNull().defaultNow(),
-    lastAlertAt: timestamp("last_alert_at", { withTimezone: true }),
-    resolvedAt: timestamp("resolved_at", { withTimezone: true }),
-    mutedUntil: timestamp("muted_until", { withTimezone: true }),
-    cursorPrompt: text("cursor_prompt"),
-    telegramChatId: text("telegram_chat_id"),
-    telegramMessageId: bigint("telegram_message_id", { mode: "number" }),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+    corpusItemId: uuid("corpus_item_id").references(
+      () => contentCorpusItems.id,
+      { onDelete: "cascade" }
+    ),
+    contentSourceId: uuid("content_source_id").references(
+      () => contentSources.id,
+      { onDelete: "cascade" }
+    ),
+    kind: contentSnapshotKind("kind").notNull(),
+    url: text("url"),
+    canonicalUrl: text("canonical_url"),
+    domain: text("domain"),
+    title: text("title"),
+    fullText: text("full_text"),
+    textHash: text("text_hash"),
+    wordCount: integer("word_count"),
+    headings: jsonb("headings").$type().notNull().default([]),
+    internalLinks: jsonb("internal_links").$type().notNull().default([]),
+    metadata: jsonb("metadata").$type().notNull().default({}),
+    /**
+     * Run that captured this snapshot (managed site content sync, 2026-DASMG-042).
+     * Soft pointer (no Drizzle .references() to avoid a schema import cycle); the
+     * DB foreign key is declared in the migration.
+     */
+    ingestionRunId: uuid("ingestion_run_id"),
+    /** Source git commit / deploy id this snapshot was captured for, when known. */
+    sourceCommit: text("source_commit"),
+    capturedAt: timestamp("captured_at", { withTimezone: true }).notNull().defaultNow(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    uniqueIndex("app_error_alert_fingerprint_uidx").on(table.fingerprint),
-    index("app_error_alert_status_seen_idx").on(
-      table.status,
-      table.lastSeenAt
+    index("content_snapshots_corpus_idx").on(
+      table.corpusItemId,
+      table.capturedAt.desc()
     ),
-    index("app_error_alert_server_seen_idx").on(
-      table.serverId,
-      table.lastSeenAt
+    index("content_snapshots_source_idx").on(
+      table.contentSourceId,
+      table.capturedAt.desc()
     ),
-    index("app_error_alert_resource_seen_idx").on(
-      table.resourceId,
-      table.lastSeenAt
+    index("content_snapshots_text_hash_idx").on(table.textHash),
+    index("content_snapshots_ingestion_run_idx").on(table.ingestionRunId),
+    uniqueIndex("content_snapshots_corpus_hash_uidx").on(
+      table.corpusItemId,
+      table.textHash
     ),
-    index("app_error_alert_alerted_idx").on(table.lastAlertAt)
+    uniqueIndex("content_snapshots_source_hash_uidx").on(
+      table.contentSourceId,
+      table.textHash
+    )
   ]
 );
 pgTable(
-  "alert_rule",
+  "content_site_candidates",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    serverId: uuid("server_id").references(() => managedServer.id, {
-      onDelete: "cascade"
-    }),
-    resourceId: uuid("resource_id").references(() => resource.id, {
+    contentSourceId: uuid("content_source_id").references(
+      () => contentSources.id,
+      { onDelete: "cascade" }
+    ),
+    packId: uuid("pack_id").references(() => contentEvidencePacks.id, {
       onDelete: "cascade"
     }),
-    metric: text("metric").notNull(),
-    expression: text("expression").notNull(),
-    severity: alertSeverity("severity").notNull().default("warning"),
-    cooldownSeconds: integer("cooldown_seconds").notNull().default(900),
-    enabled: boolean("enabled").notNull().default(true),
-    routes: jsonb("routes").$type().notNull().default({}),
+    /** Managed site (2026-DASMG-042) when known; soft pointer, no FK to avoid a schema cycle. */
+    managedSiteId: uuid("managed_site_id"),
+    projectKey: text("project_key"),
+    siteKey: text("site_key"),
+    domain: text("domain"),
+    status: contentCandidateStatus("status").notNull().default("candidate"),
+    reason: text("reason"),
+    score: integer("score"),
+    /** The corpus page produced from this content, set when status becomes used. */
+    usedCorpusItemId: uuid("used_corpus_item_id").references(
+      () => contentCorpusItems.id,
+      { onDelete: "set null" }
+    ),
+    usedUrl: text("used_url"),
+    usedAt: timestamp("used_at", { withTimezone: true }),
+    ticketNumber: text("ticket_number"),
+    metadata: jsonb("metadata").$type().notNull().default({}),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => [
-    index("alert_rule_server_idx").on(table.serverId),
-    index("alert_rule_resource_idx").on(table.resourceId),
-    index("alert_rule_enabled_severity_idx").on(table.enabled, table.severity)
+    index("content_site_candidates_source_idx").on(table.contentSourceId),
+    index("content_site_candidates_pack_idx").on(table.packId),
+    index("content_site_candidates_managed_site_idx").on(table.managedSiteId),
+    index("content_site_candidates_project_idx").on(table.projectKey),
+    index("content_site_candidates_status_idx").on(table.status),
+    uniqueIndex("content_site_candidates_source_site_uidx").on(table.contentSourceId, table.managedSiteId).where(
+      sql`content_source_id IS NOT NULL AND managed_site_id IS NOT NULL`
+    ),
+    uniqueIndex("content_site_candidates_pack_site_uidx").on(table.packId, table.managedSiteId).where(sql`pack_id IS NOT NULL AND managed_site_id IS NOT NULL`),
+    check(
+      "content_site_candidates_subject_chk",
+      sql`content_source_id IS NOT NULL OR pack_id IS NOT NULL`
+    ),
+    check(
+      "content_site_candidates_target_chk",
+      sql`managed_site_id IS NOT NULL OR project_key IS NOT NULL OR domain IS NOT NULL`
+    )
   ]
 );
 var cursorSkill = pgTable(
@@ -7749,33 +7861,1188 @@ pgTable(
     index("idx_wiki_actor_affiliation_customer_folder").on(
       table.customerFolder
     )
-  ]
-);
-pgTable(
-  "intake_identity_unresolved",
+  ]
+);
+pgTable(
+  "intake_identity_unresolved",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    identityHash: text("identity_hash").notNull(),
+    kind: text("kind").notNull(),
+    seenCount: integer("seen_count").notNull().default(1),
+    sampleSignalIds: uuid("sample_signal_ids").array().notNull().default([]),
+    sampleContext: text("sample_context").array().notNull().default([]),
+    sampleSources: text("sample_sources").array().notNull().default([]),
+    lastSeen: timestamp("last_seen", { withTimezone: true }).notNull().defaultNow(),
+    insightFiledAt: timestamp("insight_filed_at", { withTimezone: true }),
+    resolvedAt: timestamp("resolved_at", { withTimezone: true }),
+    resolvedActorId: uuid("resolved_actor_id").references(() => wikiActor.id, {
+      onDelete: "set null"
+    }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => [
+    uniqueIndex("intake_identity_unresolved_kind_hash").on(
+      table.kind,
+      table.identityHash
+    )
+  ]
+);
+var SSH_POOL_IDLE_MS = 6e4;
+var sshPool = /* @__PURE__ */ new Map();
+function poolKey(options) {
+  return `${options.hostname}:${options.port}:${options.username}`;
+}
+function dropPooled(key, entry) {
+  if (sshPool.get(key) === entry)
+    sshPool.delete(key);
+  entry.closed = true;
+  if (entry.idleTimer)
+    clearTimeout(entry.idleTimer);
+  try {
+    entry.client.end();
+  } catch {
+  }
+}
+function getPooledConnection(options) {
+  const key = poolKey(options);
+  const existing = sshPool.get(key);
+  if (existing && !existing.closed) {
+    return { key, entry: existing, reused: true };
+  }
+  const client = new Client();
+  const entry = {
+    client,
+    ready: new Promise((resolve, reject) => {
+      client.on("ready", () => resolve());
+      client.on("error", (err) => reject(err));
+    }),
+    inFlight: 0,
+    idleTimer: null,
+    closed: false
+  };
+  entry.ready.catch(() => {
+  });
+  client.on("close", () => dropPooled(key, entry));
+  client.on("error", () => dropPooled(key, entry));
+  client.connect({
+    host: options.hostname,
+    port: options.port,
+    username: options.username,
+    password: options.password,
+    privateKey: options.privateKey,
+    passphrase: options.passphrase,
+    readyTimeout: options.timeout || 6e4,
+    // Detect dead pooled connections between commands.
+    keepaliveInterval: 15e3,
+    keepaliveCountMax: 2
+  });
+  sshPool.set(key, entry);
+  return { key, entry, reused: false };
+}
+function releasePooled(key, entry) {
+  entry.inFlight = Math.max(0, entry.inFlight - 1);
+  if (entry.inFlight === 0 && !entry.closed) {
+    if (entry.idleTimer)
+      clearTimeout(entry.idleTimer);
+    entry.idleTimer = setTimeout(() => {
+      if (entry.inFlight === 0)
+        dropPooled(key, entry);
+    }, SSH_POOL_IDLE_MS);
+    entry.idleTimer.unref?.();
+  }
+}
+async function executePooled(options, command, onData) {
+  const attempt = (allowRetry) => {
+    const { key, entry, reused } = getPooledConnection(options);
+    entry.inFlight += 1;
+    if (entry.idleTimer) {
+      clearTimeout(entry.idleTimer);
+      entry.idleTimer = null;
+    }
+    return new Promise((resolve) => {
+      let stdout = "";
+      let stderr = "";
+      let resolved = false;
+      let timedOut = false;
+      const timeout = options.timeout || 6e4;
+      const finish = (result, broken) => {
+        if (resolved)
+          return;
+        resolved = true;
+        clearTimeout(timeoutId);
+        if (broken) {
+          dropPooled(key, entry);
+        } else {
+          releasePooled(key, entry);
+        }
+        if (result.error && broken && reused && allowRetry && !timedOut) {
+          resolve(attempt(false));
+          return;
+        }
+        resolve(result);
+      };
+      const timeoutId = setTimeout(() => {
+        timedOut = true;
+        finish({
+          stdout,
+          stderr,
+          exitCode: -1,
+          error: new Error("SSH command timeout")
+        }, true);
+      }, timeout);
+      entry.ready.then(() => {
+        if (resolved)
+          return;
+        entry.client.exec(command, (err, stream) => {
+          if (err) {
+            finish({ stdout, stderr, exitCode: -1, error: err }, true);
+            return;
+          }
+          stream.on("close", (code) => {
+            finish({ stdout, stderr, exitCode: code || 0 }, false);
+          });
+          stream.on("data", (data) => {
+            const chunk = data.toString();
+            stdout += chunk;
+          });
+          stream.stderr.on("data", (data) => {
+            stderr += data.toString();
+          });
+        });
+      }).catch((err) => {
+        finish({ stdout, stderr, exitCode: -1, error: err }, true);
+      });
+    });
+  };
+  return attempt(true);
+}
+async function executeSshCommand(options, command, proxy) {
+  if (proxy) {
+    return executeSshCommandViaProxy(proxy, options, command);
+  }
+  if (options.pool) {
+    return executePooled(options, command);
+  }
+  return new Promise((resolve) => {
+    const ssh2 = new Client();
+    let stdout = "";
+    let stderr = "";
+    let exitCode = 0;
+    let resolved = false;
+    const timeout = options.timeout || 6e4;
+    const timeoutId = setTimeout(() => {
+      if (!resolved) {
+        resolved = true;
+        ssh2.end();
+        resolve({
+          stdout,
+          stderr,
+          exitCode: -1,
+          error: new Error("SSH command timeout")
+        });
+      }
+    }, timeout);
+    ssh2.on("ready", () => {
+      ssh2.exec(command, (err, stream) => {
+        if (err) {
+          if (!resolved) {
+            resolved = true;
+            clearTimeout(timeoutId);
+            ssh2.end();
+            resolve({
+              stdout,
+              stderr,
+              exitCode: -1,
+              error: err
+            });
+          }
+          return;
+        }
+        stream.on("close", (code) => {
+          if (!resolved) {
+            resolved = true;
+            clearTimeout(timeoutId);
+            ssh2.end();
+            exitCode = code || 0;
+            resolve({
+              stdout,
+              stderr,
+              exitCode
+            });
+          }
+        });
+        stream.on("data", (data) => {
+          stdout += data.toString();
+        });
+        stream.stderr.on("data", (data) => {
+          stderr += data.toString();
+        });
+      });
+    });
+    ssh2.on("error", (err) => {
+      if (!resolved) {
+        resolved = true;
+        clearTimeout(timeoutId);
+        resolve({
+          stdout,
+          stderr,
+          exitCode: -1,
+          error: err
+        });
+      }
+    });
+    ssh2.connect({
+      host: options.hostname,
+      port: options.port,
+      username: options.username,
+      password: options.password,
+      privateKey: options.privateKey,
+      passphrase: options.passphrase,
+      readyTimeout: timeout
+    });
+  });
+}
+function executeSshCommandViaProxy(proxyOptions, targetOptions, command) {
+  return new Promise((resolve) => {
+    const proxyClient = new Client();
+    let resolved = false;
+    const timeout = targetOptions.timeout || 6e4;
+    const timeoutId = setTimeout(() => {
+      if (!resolved) {
+        resolved = true;
+        proxyClient.end();
+        resolve({
+          stdout: "",
+          stderr: "",
+          exitCode: -1,
+          error: new Error("SSH proxy command timeout")
+        });
+      }
+    }, timeout);
+    const cleanup = () => {
+      clearTimeout(timeoutId);
+      proxyClient.end();
+    };
+    proxyClient.on("ready", () => {
+      proxyClient.forwardOut("127.0.0.1", 0, targetOptions.hostname, targetOptions.port, (err, tunnel) => {
+        if (err) {
+          if (!resolved) {
+            resolved = true;
+            cleanup();
+            resolve({ stdout: "", stderr: "", exitCode: -1, error: err });
+          }
+          return;
+        }
+        const targetClient = new Client();
+        let stdout = "";
+        let stderr = "";
+        targetClient.on("ready", () => {
+          targetClient.exec(command, (execErr, stream) => {
+            if (execErr) {
+              if (!resolved) {
+                resolved = true;
+                targetClient.end();
+                cleanup();
+                resolve({ stdout, stderr, exitCode: -1, error: execErr });
+              }
+              return;
+            }
+            stream.on("close", (code) => {
+              if (!resolved) {
+                resolved = true;
+                targetClient.end();
+                cleanup();
+                resolve({ stdout, stderr, exitCode: code || 0 });
+              }
+            });
+            stream.on("data", (data) => {
+              stdout += data.toString();
+            });
+            stream.stderr.on("data", (data) => {
+              stderr += data.toString();
+            });
+          });
+        });
+        targetClient.on("error", (targetErr) => {
+          if (!resolved) {
+            resolved = true;
+            targetClient.end();
+            cleanup();
+            resolve({ stdout, stderr, exitCode: -1, error: targetErr });
+          }
+        });
+        targetClient.connect({
+          sock: tunnel,
+          username: targetOptions.username,
+          password: targetOptions.password,
+          privateKey: targetOptions.privateKey,
+          passphrase: targetOptions.passphrase,
+          readyTimeout: timeout
+        });
+      });
+    });
+    proxyClient.on("error", (err) => {
+      if (!resolved) {
+        resolved = true;
+        cleanup();
+        resolve({ stdout: "", stderr: "", exitCode: -1, error: err });
+      }
+    });
+    proxyClient.connect({
+      host: proxyOptions.hostname,
+      port: proxyOptions.port,
+      username: proxyOptions.username,
+      password: proxyOptions.password,
+      privateKey: proxyOptions.privateKey,
+      passphrase: proxyOptions.passphrase,
+      readyTimeout: proxyOptions.timeout || 3e4
+    });
+  });
+}
+function serverToConnectionOptions(server2) {
+  return {
+    hostname: server2.hostname,
+    port: server2.port,
+    username: server2.username,
+    password: server2.password_encrypted || void 0,
+    privateKey: server2.ssh_key_encrypted || void 0,
+    passphrase: server2.ssh_key_passphrase_encrypted || void 0
+  };
+}
+async function appendOperationLog(operationId, message) {
+  const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] ${message}`;
+  try {
+    await getDb().execute(sql`
+      UPDATE operation
+      SET logs = CASE
+            WHEN logs IS NULL OR logs = '' THEN ${line}
+            ELSE logs || E'\n' || ${line}
+          END,
+          updated_at = now()
+      WHERE id = ${operationId}
+    `);
+  } catch {
+  }
+}
+
+// ../jobs/src/refront-api-client.ts
+function stripEnvValue(raw) {
+  if (!raw) return "";
+  return raw.split("#")[0]?.trim() ?? "";
+}
+function getRefrontApiKeyEntries() {
+  const fromList = (process.env.REFRONT_API_KEYS ?? "").split(",").map((part) => stripEnvValue(part)).filter(Boolean).map((part) => {
+    const pipe = part.indexOf("|");
+    if (pipe > 0) {
+      return {
+        label: part.slice(0, pipe).trim() || null,
+        apiKey: part.slice(pipe + 1).trim()
+      };
+    }
+    return { label: null, apiKey: part };
+  }).filter((entry) => entry.apiKey.length > 0);
+  const primary = stripEnvValue(
+    process.env.REFRONT_API_KEY || process.env.REFRONT_ACCESS_TOKEN
+  );
+  const entries = [...fromList];
+  if (primary && !entries.some((entry) => entry.apiKey === primary)) {
+    entries.unshift({ apiKey: primary, label: null });
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return entries.filter((entry) => {
+    if (seen.has(entry.apiKey)) return false;
+    seen.add(entry.apiKey);
+    return true;
+  });
+}
+function getBaseUrl() {
+  return (process.env.REFRONT_API_URL || "https://api.refront.nl").replace(
+    /\/+$/,
+    ""
+  );
+}
+async function apiFetchWithKey(apiKey2, path, options = {}) {
+  const url = `${getBaseUrl()}${path}`;
+  const response = await fetch(url, {
+    ...options,
+    headers: {
+      Authorization: `Bearer ${apiKey2}`,
+      "Content-Type": "application/json",
+      ...options.headers
+    }
+  });
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    const retryAfter = response.headers.get("retry-after");
+    const retrySuffix = response.status === 429 && retryAfter ? ` [retry-after=${retryAfter}]` : "";
+    throw new Error(
+      `Refront API ${options.method ?? "GET"} ${path} failed (${response.status}): ${body.slice(0, 300)}${retrySuffix}`
+    );
+  }
+  if (response.status === 204) return void 0;
+  return response.json();
+}
+function customerArchivedFlag(raw) {
+  if (raw.isArchived === true) return true;
+  if (raw.is_archived === true) return true;
+  if (raw.archived === true) return true;
+  if (typeof raw.archivedAt === "string" && raw.archivedAt.trim()) return true;
+  if (typeof raw.archived_at === "string" && raw.archived_at.trim())
+    return true;
+  return false;
+}
+function resolveCustomerStatus(raw) {
+  const explicit = typeof raw.status === "string" ? raw.status.trim() : raw.status;
+  if (explicit) return explicit;
+  if (customerArchivedFlag(raw)) return "archived";
+  return raw.status ?? null;
+}
+function normalizeCustomer(raw, team) {
+  const hasAliasesField = Object.prototype.hasOwnProperty.call(raw, "aliases");
+  const aliases = hasAliasesField ? Array.isArray(raw.aliases) ? raw.aliases.map((a) => String(a).trim()).filter(Boolean) : [] : void 0;
+  return {
+    id: raw.id,
+    name: raw.name,
+    status: resolveCustomerStatus(raw),
+    teamId: team?.id ?? null,
+    teamName: team?.name ?? null,
+    aliases
+  };
+}
+async function resolveProviderTeam(apiKey2, preferredLabel) {
+  try {
+    const res = await apiFetchWithKey(apiKey2, "/teams");
+    const teams = res.data ?? [];
+    const providers = teams.filter(
+      (team2) => team2.teamType === "provider" && !/e2e|eval/i.test(team2.name)
+    );
+    if (providers.length === 0) {
+      if (preferredLabel) return { id: "", name: preferredLabel };
+      return null;
+    }
+    if (preferredLabel) {
+      const byLabel = providers.find(
+        (team2) => team2.name.toLowerCase() === preferredLabel.toLowerCase() || team2.name.toLowerCase().includes(preferredLabel.toLowerCase())
+      );
+      if (byLabel) return { id: byLabel.id, name: byLabel.name };
+      return { id: providers[0].id, name: preferredLabel };
+    }
+    const team = providers[0];
+    if (!team) return null;
+    return { id: team.id, name: team.name };
+  } catch {
+    if (preferredLabel) return { id: "", name: preferredLabel };
+    return null;
+  }
+}
+function customerMatchesSearch(customer, q) {
+  const needle = q.trim().toLowerCase();
+  if (!needle) return true;
+  if (customer.name.toLowerCase().includes(needle)) return true;
+  return (customer.teamName ?? "").toLowerCase().includes(needle);
+}
+function filterCustomersBySearch(customers, q) {
+  const needle = q.trim();
+  if (!needle) return customers;
+  return customers.filter(
+    (customer) => customerMatchesSearch(customer, needle)
+  );
+}
+async function listCustomersForKey(apiKey2, options = {}, team) {
+  const qs = new URLSearchParams({
+    pageSize: String(options.pageSize ?? 20)
+  });
+  if (options.status && options.status !== "all") {
+    qs.set("status", options.status);
+  }
+  const query = options.q?.trim();
+  if (query) qs.set("q", query);
+  const teamId = options.teamId?.trim() || "";
+  if (teamId) qs.set("teamId", teamId);
+  const res = await apiFetchWithKey(
+    apiKey2,
+    `/customers?${qs.toString()}`
+  );
+  return (res.data ?? []).map((customer) => normalizeCustomer(customer, team));
+}
+async function listCustomers(options = {}) {
+  const entries = getRefrontApiKeyEntries();
+  if (entries.length === 0) {
+    throw new Error(
+      "Missing REFRONT_API_KEYS, REFRONT_API_KEY, or REFRONT_ACCESS_TOKEN env var"
+    );
+  }
+  if (options.teamId?.trim() && entries.length === 1) {
+    return listCustomersForKey(entries[0].apiKey, options);
+  }
+  const settled = await Promise.allSettled(
+    entries.map(async (entry) => {
+      const team = await resolveProviderTeam(entry.apiKey, entry.label);
+      return listCustomersForKey(entry.apiKey, options, team);
+    })
+  );
+  const byId = /* @__PURE__ */ new Map();
+  const errors = [];
+  for (const result of settled) {
+    if (result.status === "fulfilled") {
+      for (const customer of result.value) {
+        const existing = byId.get(customer.id);
+        if (!existing) {
+          byId.set(customer.id, customer);
+          continue;
+        }
+        if (!existing.teamName && customer.teamName) {
+          byId.set(customer.id, customer);
+          continue;
+        }
+        if (customer.teamName && existing.teamName && customer.teamName !== existing.teamName) {
+          byId.set(customer.id, customer);
+        }
+      }
+    } else {
+      const message = result.reason instanceof Error ? result.reason.message : String(result.reason);
+      errors.push(message);
+    }
+  }
+  if (byId.size === 0 && errors.length > 0) {
+    throw new Error(errors[0]);
+  }
+  if (errors.length > 0) {
+    console.warn(
+      `[refront] listCustomers partial failures (${errors.length}): ${errors.slice(0, 3).join(" | ")}`
+    );
+  }
+  return [...byId.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+async function searchCustomersWithFallback(options = {}) {
+  const pageSize = options.pageSize ?? 20;
+  const status = options.status ?? "active";
+  const raw = options.q?.trim() ?? "";
+  if (!raw) {
+    return listCustomers({ pageSize, status, teamId: options.teamId });
+  }
+  const exact = await listCustomers({
+    q: raw,
+    pageSize,
+    status,
+    teamId: options.teamId
+  });
+  const matchedExact = filterCustomersBySearch(exact, raw);
+  if (matchedExact.length > 0) return matchedExact.slice(0, pageSize);
+  const unfiltered = await listCustomers({
+    pageSize: Math.max(pageSize, 100),
+    status,
+    teamId: options.teamId
+  });
+  return filterCustomersBySearch(unfiltered, raw).slice(0, pageSize);
+}
+async function getCustomer(id) {
+  const entries = getRefrontApiKeyEntries();
+  if (entries.length === 0) {
+    throw new Error(
+      "Missing REFRONT_API_KEYS, REFRONT_API_KEY, or REFRONT_ACCESS_TOKEN env var"
+    );
+  }
+  let lastError = null;
+  for (const entry of entries) {
+    try {
+      const team = await resolveProviderTeam(entry.apiKey, entry.label);
+      const res = await apiFetchWithKey(
+        entry.apiKey,
+        `/customers/${id}`
+      );
+      return normalizeCustomer(res, team);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message.includes("(404)")) continue;
+      lastError = error instanceof Error ? error : new Error(message);
+    }
+  }
+  if (lastError) throw lastError;
+  return null;
+}
+
+// ../jobs/src/hermes-company.ts
+var MG_PROXY_SERVER_ID = process.env.MG_PROXY_SERVER_ID;
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var HermesCompanyError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "HermesCompanyError";
+  }
+};
+function containerNameFor(brandId) {
+  return `hermes-${brandId}`;
+}
+function modulesFlags(modules) {
+  const flags = [];
+  if (modules.seo) flags.push("--seo");
+  if (modules.ads) flags.push("--ads");
+  if (modules.catalogus) flags.push("--catalogus");
+  if (modules.customerFacing) flags.push("--customer-facing");
+  if (modules.exact) flags.push("--exact");
+  return flags.join(" ");
+}
+function parseBrandId(raw) {
+  const brandId = raw.trim().toLowerCase();
+  if (!/^[a-z0-9-]+$/.test(brandId)) {
+    throw new HermesCompanyError(
+      "BAD_REQUEST",
+      "brand must be a lowercase slug (a-z, 0-9, hyphen)"
+    );
+  }
+  return brandId;
+}
+function parseKitPath(raw) {
+  const kitPath = (raw ?? "/opt/hermes-company-kit").trim();
+  if (!/^\/[A-Za-z0-9._/-]+$/.test(kitPath)) {
+    throw new HermesCompanyError(
+      "BAD_REQUEST",
+      "kit path must be an absolute unix path"
+    );
+  }
+  return kitPath;
+}
+async function resolveServerId(serverIdOrName) {
+  const trimmed = serverIdOrName.trim();
+  if (!trimmed) {
+    throw new HermesCompanyError("BAD_REQUEST", "serverId is required");
+  }
+  if (UUID_RE.test(trimmed)) return trimmed;
+  const db2 = getDb();
+  const exact = await db2.select({ id: managedServer.id, name: managedServer.name }).from(managedServer).where(eq(managedServer.name, trimmed)).limit(2);
+  if (exact.length === 1) return exact[0].id;
+  if (exact.length > 1) {
+    throw new HermesCompanyError(
+      "BAD_REQUEST",
+      `Multiple servers named "${trimmed}". Pass the UUID.`
+    );
+  }
+  const fuzzy = await db2.select({ id: managedServer.id, name: managedServer.name }).from(managedServer).where(sql`${managedServer.name} ILIKE ${`%${trimmed}%`}`).orderBy(managedServer.name).limit(5);
+  if (fuzzy.length === 1) return fuzzy[0].id;
+  if (fuzzy.length === 0) {
+    throw new HermesCompanyError(
+      "NOT_FOUND",
+      `Server "${trimmed}" not found. Use list-servers.`
+    );
+  }
+  throw new HermesCompanyError(
+    "BAD_REQUEST",
+    `Multiple servers match "${trimmed}": ${fuzzy.map((row) => row.name).join(", ")}.`
+  );
+}
+async function resolveSsh(serverId) {
+  const { server: server2, error } = await getSshServerByIdForUse(serverId);
+  if (error || !server2) {
+    throw new HermesCompanyError(
+      "NOT_FOUND",
+      error || "Server credentials not found"
+    );
+  }
+  if (server2.os_type === "windows") {
+    throw new HermesCompanyError(
+      "BAD_REQUEST",
+      "Hermes companies need a Linux Docker host"
+    );
+  }
+  let proxy;
+  if (MG_PROXY_SERVER_ID && server2.id !== MG_PROXY_SERVER_ID) {
+    const { server: proxyServer } = await getSshServerByIdForUse(MG_PROXY_SERVER_ID);
+    if (proxyServer) {
+      proxy = serverToConnectionOptions(proxyServer);
+    }
+  }
+  return {
+    name: server2.name,
+    target: serverToConnectionOptions(server2),
+    proxy
+  };
+}
+async function ssh(serverId, command, timeoutMs) {
+  const conn = await resolveSsh(serverId);
+  const result = await executeSshCommand(
+    { ...conn.target, timeout: timeoutMs },
+    command,
+    conn.proxy
+  );
+  return {
+    stdout: result.stdout,
+    stderr: result.stderr,
+    exitCode: result.exitCode
+  };
+}
+async function dockerStatusByServer(serverIds) {
+  const byServer = /* @__PURE__ */ new Map();
+  const unique = [...new Set(serverIds)];
+  await Promise.all(
+    unique.map(async (serverId) => {
+      const names = /* @__PURE__ */ new Map();
+      try {
+        const result = await ssh(
+          serverId,
+          "docker ps -a --filter name=hermes- --format '{{.Names}}\\t{{.Status}}'",
+          2e4
+        );
+        if (result.exitCode === 0) {
+          for (const line of result.stdout.split("\n")) {
+            const trimmed = line.trim();
+            if (!trimmed) continue;
+            const [name, ...rest] = trimmed.split("	");
+            if (name) names.set(name, rest.join("	") || "unknown");
+          }
+        }
+      } catch {
+      }
+      byServer.set(serverId, names);
+    })
+  );
+  return byServer;
+}
+async function resolveCustomerCache(customerId) {
+  if (!customerId) {
+    return {
+      refrontCustomerId: null,
+      refrontCustomerName: null,
+      refrontTeamLabel: null
+    };
+  }
+  const customer = await getCustomer(customerId);
+  if (!customer) {
+    throw new HermesCompanyError("NOT_FOUND", "Refront customer not found");
+  }
+  return {
+    refrontCustomerId: customer.id,
+    refrontCustomerName: customer.name,
+    refrontTeamLabel: customer.teamName ?? null
+  };
+}
+function wrapMissingTable(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (/hermes_company/i.test(message) && /does not exist/i.test(message)) {
+    throw new HermesCompanyError(
+      "PRECONDITION_FAILED",
+      "Table hermes_company is missing. Run Dashboard migrations, then retry."
+    );
+  }
+  throw error;
+}
+async function listHermesCompanies() {
+  try {
+    const rows = await getDb().select({
+      company: hermesCompany,
+      serverName: managedServer.name,
+      serverHostname: managedServer.hostname
+    }).from(hermesCompany).innerJoin(managedServer, eq(hermesCompany.serverId, managedServer.id)).orderBy(desc(hermesCompany.updatedAt));
+    const docker = await dockerStatusByServer(
+      rows.map((row) => row.company.serverId)
+    );
+    return rows.map((row) => {
+      const name = containerNameFor(row.company.brandId);
+      return {
+        ...row.company,
+        serverName: row.serverName,
+        serverHostname: row.serverHostname,
+        containerName: name,
+        containerStatus: docker.get(row.company.serverId)?.get(name) ?? null
+      };
+    });
+  } catch (error) {
+    wrapMissingTable(error);
+  }
+}
+async function upsertHermesCompany(input) {
+  const brandId = parseBrandId(input.brandId);
+  const displayName = input.displayName.trim();
+  if (!displayName) {
+    throw new HermesCompanyError("BAD_REQUEST", "displayName is required");
+  }
+  const serverId = await resolveServerId(input.serverId);
+  const customer = await resolveCustomerCache(input.refrontCustomerId);
+  const modules = input.modules ?? defaultHermesCompanyModules;
+  const kitPath = parseKitPath(input.kitPath);
+  const now = /* @__PURE__ */ new Date();
+  const db2 = getDb();
+  try {
+    if (input.id) {
+      const [updated] = await db2.update(hermesCompany).set({
+        brandId,
+        displayName,
+        serverId,
+        kitPath,
+        modules,
+        ...customer,
+        updatedAt: now
+      }).where(eq(hermesCompany.id, input.id)).returning();
+      if (!updated) {
+        throw new HermesCompanyError("NOT_FOUND", "Company not found");
+      }
+      return updated;
+    }
+    const [existing] = await db2.select({ id: hermesCompany.id }).from(hermesCompany).where(eq(hermesCompany.brandId, brandId)).limit(1);
+    if (existing) {
+      const [updated] = await db2.update(hermesCompany).set({
+        displayName,
+        serverId,
+        kitPath,
+        modules,
+        ...customer,
+        updatedAt: now
+      }).where(eq(hermesCompany.id, existing.id)).returning();
+      return updated;
+    }
+    const [created] = await db2.insert(hermesCompany).values({
+      brandId,
+      displayName,
+      serverId,
+      kitPath,
+      modules,
+      ...customer
+    }).returning();
+    return created;
+  } catch (error) {
+    if (error instanceof HermesCompanyError) throw error;
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes("hermes_company_brand_id_uidx")) {
+      throw new HermesCompanyError(
+        "CONFLICT",
+        `Brand ${brandId} already exists`
+      );
+    }
+    wrapMissingTable(error);
+  }
+}
+async function removeHermesCompany(id) {
+  const [deleted] = await getDb().delete(hermesCompany).where(
+    or(eq(hermesCompany.id, id), eq(hermesCompany.brandId, id.toLowerCase()))
+  ).returning({ id: hermesCompany.id, brandId: hermesCompany.brandId });
+  if (!deleted) {
+    throw new HermesCompanyError("NOT_FOUND", "Company not found");
+  }
+  return { ok: true, ...deleted };
+}
+async function deployHermesCompany(input) {
+  const key = input.idOrBrand.trim();
+  const [row] = await getDb().select().from(hermesCompany).where(
+    UUID_RE.test(key) ? eq(hermesCompany.id, key) : eq(hermesCompany.brandId, parseBrandId(key))
+  ).limit(1);
+  if (!row) {
+    throw new HermesCompanyError("NOT_FOUND", "Company not found");
+  }
+  const kind = "hermes.company.deploy";
+  const idempotencyPrefix = `${kind}:${row.id}:`;
+  const [inFlight] = await getDb().select({ id: operation.id }).from(operation).where(
+    and(
+      eq(operation.serverId, row.serverId),
+      eq(operation.kind, kind),
+      inArray(operation.status, ["queued", "running"]),
+      like(operation.idempotencyKey, `${idempotencyPrefix}%`)
+    )
+  ).limit(1);
+  if (inFlight) {
+    throw new HermesCompanyError(
+      "CONFLICT",
+      "A deploy is already running for this company"
+    );
+  }
+  const [created] = await getDb().insert(operation).values({
+    kind,
+    serverId: row.serverId,
+    status: "running",
+    startedAt: /* @__PURE__ */ new Date(),
+    idempotencyKey: `${idempotencyPrefix}${Date.now()}`,
+    startedBy: input.actorUserId,
+    steps: [
+      { id: "probe", label: "Check kit checkout", status: "running" },
+      {
+        id: "install",
+        label: "install-company.sh --up",
+        status: "queued"
+      }
+    ]
+  }).returning();
+  if (!created) {
+    throw new HermesCompanyError(
+      "INTERNAL_SERVER_ERROR",
+      "Failed to create deploy operation"
+    );
+  }
+  await appendOperationLog(
+    created.id,
+    `Deploy ${row.brandId} queued by ${input.actorLabel ?? input.actorUserId} on kit ${row.kitPath}`
+  );
+  const markCompany = async (status, log) => {
+    await getDb().update(hermesCompany).set({
+      lastDeployAt: /* @__PURE__ */ new Date(),
+      lastDeployStatus: status,
+      lastDeployLog: log.slice(0, 4e3),
+      updatedAt: /* @__PURE__ */ new Date()
+    }).where(eq(hermesCompany.id, row.id));
+  };
+  const finishOperation = async (status, steps) => {
+    await getDb().update(operation).set({
+      status,
+      steps,
+      endedAt: /* @__PURE__ */ new Date(),
+      updatedAt: /* @__PURE__ */ new Date()
+    }).where(eq(operation.id, created.id));
+  };
+  try {
+    const probe = await ssh(
+      row.serverId,
+      `if [ -x '${row.kitPath}/scripts/install-company.sh' ]; then echo OK; else echo MISSING; fi`,
+      2e4
+    );
+    if (probe.exitCode !== 0 || !probe.stdout.includes("OK")) {
+      const message = `Hermes company kit not found at ${row.kitPath}. Clone MGSoftwareBV/hermes-company-kit there first.`;
+      const log2 = (probe.stderr || probe.stdout || message).slice(0, 4e3);
+      await appendOperationLog(created.id, message);
+      await markCompany("missing_kit", log2);
+      await finishOperation("failed", [
+        {
+          id: "probe",
+          label: "Check kit checkout",
+          status: "failed",
+          error: message
+        },
+        { id: "install", label: "install-company.sh --up", status: "queued" }
+      ]);
+      throw new HermesCompanyError("PRECONDITION_FAILED", message);
+    }
+    await appendOperationLog(created.id, "Kit checkout found");
+    const flags = modulesFlags(row.modules);
+    const command = `cd '${row.kitPath}' && ./scripts/install-company.sh --brand ${row.brandId} --display-name ${JSON.stringify(row.displayName)} ${flags} --up`;
+    await appendOperationLog(created.id, `Running ${command}`);
+    const result = await ssh(row.serverId, command, 6e5);
+    const log = `${result.stdout}
+${result.stderr}`.trim().slice(0, 4e3);
+    const ok = result.exitCode === 0;
+    if (log) await appendOperationLog(created.id, log);
+    await markCompany(ok ? "success" : "failed", log);
+    await finishOperation(ok ? "succeeded" : "failed", [
+      { id: "probe", label: "Check kit checkout", status: "succeeded" },
+      {
+        id: "install",
+        label: "install-company.sh --up",
+        status: ok ? "succeeded" : "failed",
+        error: ok ? void 0 : log.slice(-800) || "install-company.sh failed"
+      }
+    ]);
+    if (!ok) {
+      throw new HermesCompanyError(
+        "INTERNAL_SERVER_ERROR",
+        log.slice(-800) || "install-company.sh failed"
+      );
+    }
+    return {
+      ok: true,
+      operationId: created.id,
+      brandId: row.brandId,
+      containerName: containerNameFor(row.brandId),
+      log
+    };
+  } catch (error) {
+    if (error instanceof HermesCompanyError) throw error;
+    const message = error instanceof Error ? error.message : "Deploy SSH failed";
+    await appendOperationLog(created.id, message);
+    await markCompany("failed", message);
+    await finishOperation("failed", [
+      {
+        id: "probe",
+        label: "Check kit checkout",
+        status: "failed",
+        error: message
+      },
+      { id: "install", label: "install-company.sh --up", status: "queued" }
+    ]);
+    throw new HermesCompanyError("INTERNAL_SERVER_ERROR", message);
+  }
+}
+async function setupHermesCompany(input) {
+  const company = await upsertHermesCompany(input);
+  if (input.deploy === false) {
+    return {
+      company,
+      deploy: null,
+      next: "MCP keys + OAuth stay manual after --up. Call action=deploy when the kit is on the host."
+    };
+  }
+  const deploy = await deployHermesCompany({
+    idOrBrand: company.id,
+    actorUserId: input.actorUserId,
+    actorLabel: input.actorLabel
+  });
+  return {
+    company,
+    deploy,
+    next: "Paste MCP_WIKI_KEY and MCP_REFRONT_KEY into secrets.env, then docker exec hermes-<brand> hermes setup for OAuth."
+  };
+}
+async function searchHermesCustomers(q, pageSize = 20) {
+  return searchCustomersWithFallback({
+    q,
+    pageSize,
+    status: "active"
+  });
+}
+
+// src/hermes-company-tools.ts
+var HERMES_COMPANY_TOOL_NAME = "ai-company";
+var HERMES_COMPANY_ACTIONS = [
+  "list",
+  "search-customers",
+  "upsert",
+  "setup",
+  "deploy",
+  "remove"
+];
+var HERMES_COMPANY_TOOLS = [
   {
-    id: uuid("id").primaryKey().defaultRandom(),
-    identityHash: text("identity_hash").notNull(),
-    kind: text("kind").notNull(),
-    seenCount: integer("seen_count").notNull().default(1),
-    sampleSignalIds: uuid("sample_signal_ids").array().notNull().default([]),
-    sampleContext: text("sample_context").array().notNull().default([]),
-    sampleSources: text("sample_sources").array().notNull().default([]),
-    lastSeen: timestamp("last_seen", { withTimezone: true }).notNull().defaultNow(),
-    insightFiledAt: timestamp("insight_filed_at", { withTimezone: true }),
-    resolvedAt: timestamp("resolved_at", { withTimezone: true }),
-    resolvedActorId: uuid("resolved_actor_id").references(() => wikiActor.id, {
-      onDelete: "set null"
-    }),
-    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-  },
-  (table) => [
-    uniqueIndex("intake_identity_unresolved_kind_hash").on(
-      table.kind,
-      table.identityHash
-    )
-  ]
-);
+    name: HERMES_COMPANY_TOOL_NAME,
+    description: "Staff control plane for Hermes AI companies (one Docker container per brand). NOT for brand containers \u2014 those must not get SSH/Docker MCP. Dashboard UI is /ai-companies. yaml has no customerId; link the Refront customer here. Actions: list, search-customers (MG+AVARC), upsert (registry only), setup (registry + SSH install-company.sh --up), deploy, remove (registry only). MCP_WIKI_KEY / MCP_REFRONT_KEY paste and ChatGPT/Codex OAuth stay manual after --up. serverId accepts a managed-server UUID or name (e.g. MG Giga Server).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        action: {
+          type: "string",
+          enum: [...HERMES_COMPANY_ACTIONS],
+          description: "list | search-customers | upsert | setup | deploy | remove"
+        },
+        q: {
+          type: "string",
+          description: "search-customers: name or provider (wattago, avarc)."
+        },
+        brandId: {
+          type: "string",
+          description: "Lowercase slug. Container becomes hermes-<brandId>."
+        },
+        displayName: {
+          type: "string",
+          description: "Human name (Wattago, SolarFast)."
+        },
+        serverId: {
+          type: "string",
+          description: "Managed server UUID or name (list-servers)."
+        },
+        refrontCustomerId: {
+          type: "string",
+          description: "Optional Refront customer UUID. search-customers first. Empty is allowed."
+        },
+        kitPath: {
+          type: "string",
+          description: "Absolute unix path. Default /opt/hermes-company-kit."
+        },
+        seo: { type: "boolean", description: "Opt-in SEO specialist." },
+        ads: { type: "boolean", description: "Opt-in ads specialist." },
+        catalogus: { type: "boolean", description: "Opt-in catalogus (BM)." },
+        customerFacing: {
+          type: "boolean",
+          description: "Opt-in customer-facing (Wattago)."
+        },
+        exact: {
+          type: "boolean",
+          description: "Opt-in Exact (BM, read-gated)."
+        },
+        deploy: {
+          type: "boolean",
+          description: "setup: SSH --up after save (default true)."
+        },
+        id: {
+          type: "string",
+          description: "Company UUID, or brand slug for deploy/remove."
+        }
+      },
+      required: ["action"]
+    }
+  }
+];
+function textResult(payload) {
+  return {
+    content: [
+      {
+        type: "text",
+        text: typeof payload === "string" ? payload : JSON.stringify(payload, null, 2)
+      }
+    ]
+  };
+}
+function errorResult(error) {
+  const message = error instanceof HermesCompanyError ? error.message : error instanceof Error ? error.message : String(error);
+  return textResult(`Error: ${message}`);
+}
+function modulesFromArgs(a) {
+  return {
+    seo: a.seo === true,
+    ads: a.ads === true,
+    catalogus: a.catalogus === true,
+    customerFacing: a.customerFacing === true,
+    exact: a.exact === true
+  };
+}
+function str(a, key) {
+  const value = a[key];
+  return typeof value === "string" ? value.trim() : "";
+}
+async function handleHermesCompanyTool(a, ctx) {
+  const action = str(a, "action");
+  try {
+    switch (action) {
+      case "list":
+        return textResult(await listHermesCompanies());
+      case "search-customers":
+        return textResult(await searchHermesCustomers(str(a, "q"), 30));
+      case "upsert": {
+        const company = await upsertHermesCompany({
+          id: str(a, "id") || void 0,
+          brandId: str(a, "brandId"),
+          displayName: str(a, "displayName"),
+          serverId: str(a, "serverId"),
+          refrontCustomerId: str(a, "refrontCustomerId") || null,
+          kitPath: str(a, "kitPath") || void 0,
+          modules: modulesFromArgs(a)
+        });
+        return textResult({
+          company,
+          modulesFlags: modulesFlags(company.modules),
+          next: "Call action=setup or action=deploy to run install-company.sh --up."
+        });
+      }
+      case "setup": {
+        const result = await setupHermesCompany({
+          brandId: str(a, "brandId"),
+          displayName: str(a, "displayName") || str(a, "brandId"),
+          serverId: str(a, "serverId"),
+          refrontCustomerId: str(a, "refrontCustomerId") || null,
+          kitPath: str(a, "kitPath") || void 0,
+          modules: modulesFromArgs(a),
+          deploy: a.deploy !== false,
+          actorUserId: ctx.userId,
+          actorLabel: ctx.actorLabel
+        });
+        return textResult(result);
+      }
+      case "deploy":
+        return textResult(
+          await deployHermesCompany({
+            idOrBrand: str(a, "id") || str(a, "brandId"),
+            actorUserId: ctx.userId,
+            actorLabel: ctx.actorLabel
+          })
+        );
+      case "remove":
+        return textResult(
+          await removeHermesCompany(str(a, "id") || str(a, "brandId"))
+        );
+      default:
+        return textResult(
+          `Unknown action "${action}". Use: ${HERMES_COMPANY_ACTIONS.join(", ")}.`
+        );
+    }
+  } catch (error) {
+    return errorResult(error);
+  }
+}
 var GITHUB_API = "https://api.github.com";
 var TRANSIENT_GITHUB_STATUSES = /* @__PURE__ */ new Set([
   429,
@@ -9203,6 +10470,7 @@ var TOOL_MODULE_MAP = {
   "dns-record": "domains",
   "cursor-remote-list": "cursor_remote",
   "cursor-remote-run": "cursor_remote",
+  "ai-company": "ssh_servers",
   // cursor-skill intentionally unmapped — any valid API key may pull shared skills
   ...TRIGGER_TOOL_MODULE_MAP
 };
@@ -9772,7 +11040,7 @@ function getEncryptionKey() {
     throw new Error("ENCRYPTION_KEY must be a 64-character hex string");
   return buf;
 }
-function encrypt(text21) {
+function encrypt(text22) {
   const key = getEncryptionKey();
   const iv = randomBytes(ENC_IV_LENGTH);
   const cipher = createCipheriv(
@@ -9780,7 +11048,7 @@ function encrypt(text21) {
     new Uint8Array(key),
     new Uint8Array(iv)
   );
-  let encrypted = cipher.update(text21, "utf8", "hex");
+  let encrypted = cipher.update(text22, "utf8", "hex");
   encrypted += cipher.final("hex");
   const authTag = cipher.getAuthTag();
   return Buffer.concat([
@@ -9879,11 +11147,11 @@ async function getProxyConnection() {
   };
   return _proxyConnCache;
 }
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-async function resolveServerId(input) {
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function resolveServerId2(input) {
   const trimmed = (input ?? "").trim();
   if (!trimmed) throw new Error("serverId is required");
-  if (UUID_RE.test(trimmed)) return trimmed;
+  if (UUID_RE2.test(trimmed)) return trimmed;
   const exact = await db.execute(sql`
     SELECT id, name FROM managed_server WHERE name = ${trimmed} LIMIT 2
   `);
@@ -9923,7 +11191,7 @@ async function resolveServerId(input) {
   );
 }
 async function getServerConnection(serverIdOrName) {
-  const serverId = await resolveServerId(serverIdOrName);
+  const serverId = await resolveServerId2(serverIdOrName);
   assertServerAccess(serverId);
   const rows = await db.execute(sql`
     SELECT
@@ -10085,7 +11353,7 @@ async function sshExec(opts, command, proxy, options) {
 async function sshExecOnce(opts, command, proxy, options) {
   if (proxy) return sshExecViaProxy(proxy, opts, command, options);
   return new Promise((resolve) => {
-    const ssh = new Client();
+    const ssh2 = new Client();
     let stdout = "";
     let stderr = "";
     let done = false;
@@ -10095,7 +11363,7 @@ async function sshExecOnce(opts, command, proxy, options) {
       if (!done) {
         done = true;
         clearTimeout(idleTimer);
-        ssh.end();
+        ssh2.end();
         resolve({
           stdout,
           stderr: stderr || `idle/wall timeout after ${wallTimeout}ms`,
@@ -10111,7 +11379,7 @@ async function sshExecOnce(opts, command, proxy, options) {
         if (!done) {
           done = true;
           clearTimeout(wallTimer);
-          ssh.end();
+          ssh2.end();
           resolve({
             stdout,
             stderr: stderr || `idle timeout after ${idleTimeout}ms with no output`,
@@ -10121,15 +11389,15 @@ async function sshExecOnce(opts, command, proxy, options) {
       }, idleTimeout);
     };
     armIdle();
-    ssh.on("ready", () => {
+    ssh2.on("ready", () => {
       const execOpts = options?.pty ? { pty: true } : {};
-      ssh.exec(command, execOpts, (err, stream) => {
+      ssh2.exec(command, execOpts, (err, stream) => {
         if (err) {
           if (!done) {
             done = true;
             clearTimeout(wallTimer);
             if (idleTimer) clearTimeout(idleTimer);
-            ssh.end();
+            ssh2.end();
             resolve({ stdout, stderr: err.message || stderr, exitCode: -1 });
           }
           return;
@@ -10147,7 +11415,7 @@ async function sshExecOnce(opts, command, proxy, options) {
             done = true;
             clearTimeout(wallTimer);
             if (idleTimer) clearTimeout(idleTimer);
-            ssh.end();
+            ssh2.end();
             resolve({ stdout, stderr, exitCode: code ?? 0 });
           }
         });
@@ -10156,7 +11424,7 @@ async function sshExecOnce(opts, command, proxy, options) {
         }
       });
     });
-    ssh.on("error", (err) => {
+    ssh2.on("error", (err) => {
       if (!done) {
         done = true;
         clearTimeout(wallTimer);
@@ -10164,7 +11432,7 @@ async function sshExecOnce(opts, command, proxy, options) {
         resolve({ stdout, stderr: err.message, exitCode: -1 });
       }
     });
-    ssh.connect({
+    ssh2.connect({
       host: opts.hostname,
       port: opts.port,
       username: opts.username,
@@ -10320,10 +11588,10 @@ function connectSshClient(opts, proxy, readyTimeout = 6e4, extraConnect) {
   const compress = extraConnect?.compress;
   if (!proxy) {
     return new Promise((resolve, reject) => {
-      const ssh = new Client();
-      ssh.on("ready", () => resolve({ client: ssh, cleanup: () => ssh.end() }));
-      ssh.on("error", (e) => reject(e));
-      ssh.connect({
+      const ssh2 = new Client();
+      ssh2.on("ready", () => resolve({ client: ssh2, cleanup: () => ssh2.end() }));
+      ssh2.on("error", (e) => reject(e));
+      ssh2.connect({
         host: opts.hostname,
         port: opts.port,
         username: opts.username,
@@ -10517,10 +11785,10 @@ async function r2GetObjectRange(bucket, key, range) {
     const body = result.Body;
     if (!body?.transformToString)
       throw new Error("R2 returned no readable body");
-    const text21 = await body.transformToString();
+    const text22 = await body.transformToString();
     const header = `# range: bytes ${range.offset}-${end} of ${size} (${effectiveLen} bytes)`;
     return `${header}
-${text21}`;
+${text22}`;
   } catch (e) {
     throw r2WrapError(bucket, key, e);
   }
@@ -10883,15 +12151,15 @@ async function sftpRead(opts, filePath, proxy, options) {
             clearTimeout(timer);
             cleanup?.();
             cleanup = void 0;
-            const text21 = Buffer.concat(
+            const text22 = Buffer.concat(
               chunks.map((ch) => new Uint8Array(ch))
             ).toString("utf-8");
             if (!isWholeFileRequest) {
               const header = `# range: bytes ${offset}-${offset + effectiveLen - 1} of ${total} (${effectiveLen} bytes)`;
               resolve(`${header}
-${text21}`);
+${text22}`);
             } else {
-              resolve(text21);
+              resolve(text22);
             }
           });
           rs.on("error", (e) => {
@@ -10945,7 +12213,8 @@ var RAW_JSON_TOOLS = /* @__PURE__ */ new Set([
   // Skill registry metadata only (no file bodies) — must stay valid JSON.
   "cursor-skill",
   // GSC opportunity store (pass + items)
-  "gsc-opportunity"
+  "gsc-opportunity",
+  "ai-company"
 ]);
 var TOOL_CACHE_TTL_MS = {
   "list-servers": 6e4,
@@ -11046,11 +12315,11 @@ function getKnownContainers(serverId, maxAgeMs = 5 * 6e4) {
   if (Date.now() - e.capturedAt > maxAgeMs) return void 0;
   return e.names;
 }
-function truncateForLLM(text21, maxBytes) {
-  const totalBytes = Buffer.byteLength(text21, "utf8");
+function truncateForLLM(text22, maxBytes) {
+  const totalBytes = Buffer.byteLength(text22, "utf8");
   if (totalBytes <= maxBytes)
-    return { text: text21, truncated: false, totalBytes, shownBytes: totalBytes };
-  const buf = Buffer.from(text21, "utf8");
+    return { text: text22, truncated: false, totalBytes, shownBytes: totalBytes };
+  const buf = Buffer.from(text22, "utf8");
   let cut = maxBytes;
   while (cut > 0 && (buf[cut] & 192) === 128) cut--;
   const head = buf.subarray(0, cut).toString("utf8");
@@ -11081,10 +12350,10 @@ function postprocessResult(result, meta) {
   if (!result.content?.length) return result;
   if (RAW_JSON_TOOLS.has(meta.toolName)) return result;
   const block = result.content[0];
-  let text21 = String(block.text ?? "");
-  const trunc = truncateForLLM(text21, RESPONSE_MAX_BYTES);
+  let text22 = String(block.text ?? "");
+  const trunc = truncateForLLM(text22, RESPONSE_MAX_BYTES);
   if (trunc.truncated) {
-    text21 = trunc.text + "\n\n... " + buildTruncationHint(
+    text22 = trunc.text + "\n\n... " + buildTruncationHint(
       meta.toolName,
       meta.args,
       trunc.totalBytes,
@@ -11098,11 +12367,11 @@ function postprocessResult(result, meta) {
     const parts = [`took ${tookStr}`, sizeStr];
     if (meta.serverIdLabel) parts.push(`server: ${meta.serverIdLabel}`);
     if (meta.cached) parts.push("cached");
-    text21 = `${text21}
+    text22 = `${text22}
 
 [${parts.join(", ")}]`;
   }
-  return { ...result, content: [{ ...block, text: text21 }] };
+  return { ...result, content: [{ ...block, text: text22 }] };
 }
 function buildPipelineScript(commands, shell, marker, stopOnError) {
   if (shell === "powershell") {
@@ -11888,11 +13157,11 @@ CREATE TABLE IF NOT EXISTS _mcp_migrations (
   applied_by  TEXT
 );
 `.trim();
-function normaliseMigrationSql(sql31) {
-  return sql31.replace(/\r\n/g, "\n").trim() + "\n";
+function normaliseMigrationSql(sql33) {
+  return sql33.replace(/\r\n/g, "\n").trim() + "\n";
 }
-function migrationSha256(sql31) {
-  return createHash("sha256").update(sql31.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+function migrationSha256(sql33) {
+  return createHash("sha256").update(sql33.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function dollarQuoteTag(value) {
   let tag = "_mcp";
@@ -13904,6 +15173,7 @@ var TOOLS = [
     }
   },
   ...MAILSERVER_TOOLS,
+  ...HERMES_COMPANY_TOOLS,
   // ----- Trigger.dev -----
   ...TRIGGER_TOOLS
 ];
@@ -14224,7 +15494,7 @@ async function executeToolCall(name, a, _serverId) {
             ]
           };
         }
-        const lines = data.hits.map((hit, index18) => {
+        const lines = data.hits.map((hit, index19) => {
           const when = hit.lastMessageAt ? new Date(hit.lastMessageAt).toISOString().slice(0, 10) : "unknown date";
           const repo = hit.repo ?? "unknown repo";
           const sim = hit.similarity !== null ? ` \xB7 ${(hit.similarity * 100).toFixed(0)}% match` : "";
@@ -14234,7 +15504,7 @@ async function executeToolCall(name, a, _serverId) {
             ...Array.isArray(hit.tech) ? hit.tech.slice(0, 4) : []
           ].filter(Boolean);
           const tags = facets.length > 0 ? ` \xB7 ${facets.join(", ")}` : "";
-          return `${index18 + 1}. [${repo} \xB7 ${when}${sim}${tags}] ${hit.title}
+          return `${index19 + 1}. [${repo} \xB7 ${when}${sim}${tags}] ${hit.title}
    id: ${hit.id}
    ${(hit.summary ?? hit.snippet).replace(/\s+/g, " ").slice(0, 500)}`;
         });
@@ -14441,12 +15711,12 @@ Searchable via search-team-memory once indexing completes (usually immediate).`
             ]
           };
         }
-        const lines = data.hits.map((hit, index18) => {
+        const lines = data.hits.map((hit, index19) => {
           const sim = hit.similarity !== null ? ` \xB7 ${Math.round(hit.similarity * 100)}% match` : "";
           const tags = hit.tags.length ? ` \xB7 ${hit.tags.slice(0, 5).join(", ")}` : "";
           const sources = hit.sources.length ? `
    sources: ${hit.sources.slice(0, 6).map((s) => `${s.type}:${s.ref}`).join(", ")}` : "";
-          return `${index18 + 1}. [${hit.status} \xB7 updated ${hit.pageUpdatedOn ?? "unknown"}${sim}${tags}] ${hit.title}
+          return `${index19 + 1}. [${hit.status} \xB7 updated ${hit.pageUpdatedOn ?? "unknown"}${sim}${tags}] ${hit.title}
    slug: ${hit.slug}${sources}
    ${(hit.summary ?? hit.snippet).replace(/\s+/g, " ").slice(0, 400)}`;
         });
@@ -14624,7 +15894,7 @@ Archived sources (${archiveOnly.length}):
         let formatItems2 = function(items) {
           if (items.length === 0) return "(none)";
           return items.map(
-            (item, index18) => `${index18 + 1}. [${item.status} \xB7 ${item.folder} \xB7 updated ${item.updated ?? "unknown"}] ${item.title}
+            (item, index19) => `${index19 + 1}. [${item.status} \xB7 ${item.folder} \xB7 updated ${item.updated ?? "unknown"}] ${item.title}
    slug: ${item.slug}`
           ).join("\n");
         };
@@ -14651,9 +15921,9 @@ Archived sources (${archiveOnly.length}):
         }
         const data = await res.json();
         const countLine = Object.entries(data.counts).sort(([left], [right]) => left.localeCompare(right)).map(([status, count]) => `${status} ${count}`).join(" \xB7 ");
-        const flagLines = data.flags.length === 0 ? "(none)" : data.flags.map((flag, index18) => {
+        const flagLines = data.flags.length === 0 ? "(none)" : data.flags.map((flag, index19) => {
           const detail = flag.detail.replace(/\s+/g, " ").slice(0, 240);
-          return `${index18 + 1}. [${flag.kind} \xB7 ${flag.folder}${flag.status ? ` \xB7 page ${flag.status}` : ""}] ${flag.title}
+          return `${index19 + 1}. [${flag.kind} \xB7 ${flag.folder}${flag.status ? ` \xB7 page ${flag.status}` : ""}] ${flag.title}
    slug: ${flag.slug}
    ${detail}`;
         }).join("\n");
@@ -15819,8 +17089,8 @@ ${sample.join("\n")}${files.length > 5 ? `
             };
           const filtered = sortRows(applyFilter(only.rows));
           if (format === "json") {
-            const text22 = filtered.map((c) => JSON.stringify(c)).join("\n") || "(no containers)";
-            return { content: [{ type: "text", text: text22 }] };
+            const text23 = filtered.map((c) => JSON.stringify(c)).join("\n") || "(no containers)";
+            return { content: [{ type: "text", text: text23 }] };
           }
           if (groupByProject) {
             const groups = /* @__PURE__ */ new Map();
@@ -15847,8 +17117,8 @@ ${sample.join("\n")}${files.length > 5 ? `
           }
           const header = `${"NAMES".padEnd(36)}  ${"IMAGE".padEnd(40)}  ${"STATUS".padEnd(24)}  ${"HEALTH".padEnd(10)}  ${"PORTS".padEnd(40)}  PROJECT`;
           const body = filtered.map((r) => `${fmtRow(r)}  ${r.Project || ""}`);
-          const text21 = filtered.length === 0 ? "(no containers match)" : [header, ...body].join("\n");
-          return { content: [{ type: "text", text: text21 }] };
+          const text22 = filtered.length === 0 ? "(no containers match)" : [header, ...body].join("\n");
+          return { content: [{ type: "text", text: text22 }] };
         }
         if (format === "json") {
           const lines = [];
@@ -17671,6 +18941,12 @@ Install: GET https://dashboard.mgsoftware.nl/api/downloads/versions.txt then \u2
           token
         });
       }
+      case HERMES_COMPANY_TOOL_NAME: {
+        return handleHermesCompanyTool(a, {
+          userId: ctx.userId,
+          actorLabel: ctx.apiKeyName
+        });
+      }
       default:
         if (TRIGGER_TOOL_NAMES.has(name)) {
           return handleTriggerTool(name, a, { sshExec, getServerConnection });