agor-live 0.21.2 → 0.23.1

package/dist/core/claude/index.cjs

@@ -31,9 +31,12 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // ../../node_modules/.pnpm/tsup@8.5.1_jiti@2.6.1_postcss@8.5.15_tsx@4.22.4_typescript@6.0.3_yaml@2.9.0/node_modules/tsup/assets/cjs_shims.js
+var getImportMetaUrl, importMetaUrl;
 var init_cjs_shims = __esm({
   "../../node_modules/.pnpm/tsup@8.5.1_jiti@2.6.1_postcss@8.5.15_tsx@4.22.4_typescript@6.0.3_yaml@2.9.0/node_modules/tsup/assets/cjs_shims.js"() {
     "use strict";
+    getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href;
+    importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
   }
 });
 
@@ -179,6 +182,71 @@ var init_executor_heartbeat = __esm({
   }
 });
 
+// src/config/multitenancy.ts
+function detectPostgresUrl(url) {
+  if (!url) return false;
+  const lower = url.toLowerCase();
+  return lower.startsWith("postgresql://") || lower.startsWith("postgres://") || lower.startsWith("pg://");
+}
+function resolveMultiTenancyDatabaseDialect(config = {}) {
+  if (process.env.AGOR_DB_DIALECT === "postgresql" || process.env.AGOR_DB_DIALECT === "sqlite") {
+    return process.env.AGOR_DB_DIALECT;
+  }
+  if (detectPostgresUrl(process.env.DATABASE_URL)) return "postgresql";
+  if (config.database?.dialect === "postgresql" || config.database?.dialect === "sqlite") {
+    return config.database.dialect;
+  }
+  if (detectPostgresUrl(config.database?.postgresql?.url) || config.database?.postgresql?.host) {
+    return "postgresql";
+  }
+  return "sqlite";
+}
+function resolveMultiTenancyConfig(config) {
+  const raw = config.multi_tenancy ?? {};
+  const mode = raw.mode ?? "static";
+  return {
+    mode,
+    static_tenant_id: raw.static_tenant_id?.trim() || DEFAULT_STATIC_TENANT_ID,
+    ...raw.auth_claim ? { auth_claim: raw.auth_claim } : {},
+    ...raw.trusted_header ? { trusted_header: raw.trusted_header } : {}
+  };
+}
+function assertValidMultiTenancyConfig(config) {
+  const resolved = resolveMultiTenancyConfig(config);
+  if (resolved.mode !== "static" && resolved.mode !== "required_from_auth") {
+    throw new Error("Config error: multi_tenancy.mode must be one of: static, required_from_auth");
+  }
+  if (!resolved.static_tenant_id) {
+    throw new Error("Config error: multi_tenancy.static_tenant_id must not be empty");
+  }
+  if (resolved.auth_claim && RESERVED_AUTH_CLAIMS.has(resolved.auth_claim)) {
+    throw new Error(
+      `Config error: multi_tenancy.auth_claim cannot be reserved JWT claim '${resolved.auth_claim}'`
+    );
+  }
+  if (resolved.mode === "required_from_auth") {
+    if (resolveMultiTenancyDatabaseDialect(config) !== "postgresql") {
+      throw new Error(
+        "Config error: multi_tenancy.required_from_auth requires database.dialect: postgresql"
+      );
+    }
+    if (!resolved.auth_claim && !resolved.trusted_header) {
+      throw new Error(
+        "Config error: multi_tenancy.required_from_auth requires multi_tenancy.auth_claim or multi_tenancy.trusted_header"
+      );
+    }
+  }
+}
+var DEFAULT_STATIC_TENANT_ID, RESERVED_AUTH_CLAIMS;
+var init_multitenancy = __esm({
+  "src/config/multitenancy.ts"() {
+    "use strict";
+    init_cjs_shims();
+    DEFAULT_STATIC_TENANT_ID = "default";
+    RESERVED_AUTH_CLAIMS = /* @__PURE__ */ new Set(["aud", "exp", "iat", "iss", "jti", "nbf", "sub", "type"]);
+  }
+});
+
 // src/config/types.ts
 var init_types = __esm({
   "src/config/types.ts"() {
@@ -216,7 +284,10 @@ function writeCachedConfig(configPath, config, key) {
   cachedEntry = { path: configPath, config: structuredClone(config), key };
 }
 function parseAndValidateConfig(content) {
-  const parsed = import_js_yaml.default.load(content);
+  if (content.trim() === "") {
+    return {};
+  }
+  const parsed = yaml.load(content);
   const finalConfig = parsed || {};
   validateConfig(finalConfig);
   return finalConfig;
@@ -245,6 +316,7 @@ To update: agor config set execution.unix_user_mode insulated`
       `Config error: execution.managed_envs_execution_mode must be one of: hybrid, webhook-only`
     );
   }
+  assertValidMultiTenancyConfig(config);
   validateOptionalHttpUrl(
     config.external_launch,
     "login_redirect_url",
@@ -305,7 +377,12 @@ function getDefaultConfig() {
       // Default: sync passwords to Unix
       executor_heartbeat: resolveExecutorHeartbeatConfig()
     },
-    analytics: getDefaultAnalyticsConfig()
+    analytics: getDefaultAnalyticsConfig(),
+    telemetry: {},
+    multi_tenancy: {
+      mode: "static",
+      static_tenant_id: "default"
+    }
   };
 }
 function loadConfigSync() {
@@ -349,7 +426,7 @@ function loadConfigSync() {
   }
   return finalConfig;
 }
-var import_node_fs2, import_promises, import_node_os, import_node_path2, import_js_yaml, NO_FILE, NO_FILE_KEY, cachedEntry;
+var import_node_fs2, import_promises, import_node_os, import_node_path2, yaml, NO_FILE, NO_FILE_KEY, cachedEntry;
 var init_config_manager = __esm({
   "src/config/config-manager.ts"() {
     "use strict";
@@ -358,10 +435,11 @@ var init_config_manager = __esm({
     import_promises = __toESM(require("fs/promises"), 1);
     import_node_os = __toESM(require("os"), 1);
     import_node_path2 = __toESM(require("path"), 1);
-    import_js_yaml = __toESM(require("js-yaml"), 1);
+    yaml = __toESM(require("js-yaml"), 1);
     init_analytics_defaults();
     init_constants();
     init_executor_heartbeat();
+    init_multitenancy();
     init_types();
     NO_FILE = -1;
     NO_FILE_KEY = { mtimeMs: NO_FILE, size: 0 };
@@ -540,15 +618,35 @@ var init_schedule = __esm({
 });
 
 // src/types/session.ts
+var SessionStatus, EXECUTING_SESSION_STATUSES;
 var init_session = __esm({
   "src/types/session.ts"() {
     "use strict";
     init_cjs_shims();
+    SessionStatus = {
+      IDLE: "idle",
+      RUNNING: "running",
+      STOPPING: "stopping",
+      // Stop requested, waiting for task to stop
+      AWAITING_PERMISSION: "awaiting_permission",
+      AWAITING_INPUT: "awaiting_input",
+      // Legacy / pre-#1177: AskUserQuestion was disallowed at the SDK; new sessions never enter this state, kept for historical rows
+      TIMED_OUT: "timed_out",
+      // Permission/input request timed out, executor exited — user must re-prompt
+      COMPLETED: "completed",
+      FAILED: "failed"
+    };
+    EXECUTING_SESSION_STATUSES = /* @__PURE__ */ new Set([
+      SessionStatus.RUNNING,
+      SessionStatus.STOPPING,
+      SessionStatus.AWAITING_PERMISSION,
+      SessionStatus.AWAITING_INPUT
+    ]);
   }
 });
 
 // src/types/task.ts
-var TaskStatus, TERMINAL_TASK_STATUSES;
+var TaskStatus, TERMINAL_TASK_STATUSES, EXECUTING_TASK_STATUSES;
 var init_task = __esm({
   "src/types/task.ts"() {
     "use strict";
@@ -576,6 +674,12 @@ var init_task = __esm({
       TaskStatus.STOPPED,
       TaskStatus.TIMED_OUT
     ]);
+    EXECUTING_TASK_STATUSES = /* @__PURE__ */ new Set([
+      TaskStatus.RUNNING,
+      TaskStatus.STOPPING,
+      TaskStatus.AWAITING_PERMISSION,
+      TaskStatus.AWAITING_INPUT
+    ]);
   }
 });
 
@@ -587,6 +691,14 @@ var init_template = __esm({
   }
 });
 
+// src/types/tenant.ts
+var init_tenant = __esm({
+  "src/types/tenant.ts"() {
+    "use strict";
+    init_cjs_shims();
+  }
+});
+
 // src/types/ui.ts
 var init_ui = __esm({
   "src/types/ui.ts"() {
@@ -677,6 +789,7 @@ var init_types2 = __esm({
     init_session();
     init_task();
     init_template();
+    init_tenant();
     init_ui();
     init_user();
     init_utils();
@@ -702,6 +815,7 @@ __export(schema_postgres_exports, {
   cardTypes: () => cardTypes,
   cards: () => cards,
   gatewayChannels: () => gatewayChannels,
+  gatewayOutboundMessages: () => gatewayOutboundMessages,
   groupMemberships: () => groupMemberships,
   groups: () => groups,
   kbDocumentUnits: () => kbDocumentUnits,
@@ -720,6 +834,8 @@ __export(schema_postgres_exports, {
   serializedSessions: () => serializedSessions,
   sessionEnvSelections: () => sessionEnvSelections,
   sessionMcpServers: () => sessionMcpServers,
+  sessionRelationships: () => sessionRelationships,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations,
   sessions: () => sessions,
   sessionsRelations: () => sessionsRelations,
   tasks: () => tasks,
@@ -728,7 +844,7 @@ __export(schema_postgres_exports, {
   userMcpOauthTokens: () => userMcpOauthTokens,
   users: () => users
 });
-var import_drizzle_orm, import_pg_core, bytea, t, sessions, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, branchesRelations, schedulesRelations;
+var import_drizzle_orm, import_pg_core, bytea, t, sessions, sessionRelationships, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, gatewayOutboundMessages, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, sessionRelationshipsRelations, branchesRelations, schedulesRelations;
 var init_schema_postgres = __esm({
   "src/db/schema.postgres.ts"() {
     "use strict";
@@ -749,6 +865,7 @@ var init_schema_postgres = __esm({
     sessions = (0, import_pg_core.pgTable)(
       "sessions",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -808,7 +925,9 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("sessions_tenant_id_idx").on(table.tenant_id),
         statusIdx: (0, import_pg_core.index)("sessions_status_idx").on(table.status),
+        statusReadyIdx: (0, import_pg_core.index)("sessions_status_ready_idx").on(table.status, table.ready_for_prompt),
         agenticToolIdx: (0, import_pg_core.index)("sessions_agentic_tool_idx").on(table.agentic_tool),
         boardIdx: (0, import_pg_core.index)("sessions_board_idx").on(table.board_id),
         branchIdx: (0, import_pg_core.index)("sessions_branch_idx").on(table.branch_id),
@@ -820,12 +939,57 @@ var init_schema_postgres = __esm({
         // Partial unique index — covering for the scheduler's dedup lookup
         // AND serves as the DB-level guard against check-then-create races
         // in spawnScheduledSession.
-        scheduleRunUnique: (0, import_pg_core.uniqueIndex)("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(import_drizzle_orm.sql`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
+        scheduleRunUnique: (0, import_pg_core.uniqueIndex)("sessions_schedule_run_unique").on(table.tenant_id, table.schedule_id, table.scheduled_run_at).where(import_drizzle_orm.sql`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
+      })
+    );
+    sessionRelationships = (0, import_pg_core.pgTable)(
+      "session_relationships",
+      {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+        relationship_id: (0, import_pg_core.varchar)("relationship_id", { length: 36 }).primaryKey(),
+        source_session_id: (0, import_pg_core.varchar)("source_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+        target_session_id: (0, import_pg_core.varchar)("target_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+        relationship_type: (0, import_pg_core.text)("relationship_type", { enum: ["remote_create"] }).notNull(),
+        created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull(),
+        created_at: t.timestamp("created_at").notNull(),
+        updated_at: t.timestamp("updated_at"),
+        callback_enabled: t.bool("callback_enabled").notNull().default(false),
+        callback_session_id: (0, import_pg_core.varchar)("callback_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        data: t.json("data")
+      },
+      (table) => ({
+        tenantIdx: (0, import_pg_core.index)("session_relationships_tenant_id_idx").on(table.tenant_id),
+        sourceIdx: (0, import_pg_core.index)("session_relationships_source_idx").on(table.source_session_id),
+        targetIdx: (0, import_pg_core.index)("session_relationships_target_idx").on(table.target_session_id),
+        callbackIdx: (0, import_pg_core.index)("session_relationships_callback_idx").on(table.callback_session_id),
+        // Composite indexes so the OR predicate in dispatchCompletionCallbacks
+        // (WHERE source_session_id = $1 OR target_session_id = $2) uses BitmapOr
+        // over these instead of a full tenant table scan via tenant_id_idx.
+        tenantSourceIdx: (0, import_pg_core.index)("session_relationships_tenant_source_idx").on(
+          table.tenant_id,
+          table.source_session_id
+        ),
+        tenantTargetIdx: (0, import_pg_core.index)("session_relationships_tenant_target_idx").on(
+          table.tenant_id,
+          table.target_session_id
+        ),
+        sourceTargetTypeUnique: (0, import_pg_core.uniqueIndex)("session_relationships_source_target_type_unique").on(
+          table.tenant_id,
+          table.source_session_id,
+          table.target_session_id,
+          table.relationship_type
+        )
       })
     );
     tasks = (0, import_pg_core.pgTable)(
       "tasks",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         task_id: (0, import_pg_core.varchar)("task_id", { length: 36 }).primaryKey(),
         session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         created_at: t.timestamp("created_at").notNull(),
@@ -855,19 +1019,23 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("tasks_tenant_id_idx").on(table.tenant_id),
         sessionIdx: (0, import_pg_core.index)("tasks_session_idx").on(table.session_id),
         statusIdx: (0, import_pg_core.index)("tasks_status_idx").on(table.status),
         createdIdx: (0, import_pg_core.index)("tasks_created_idx").on(table.created_at),
+        // Composite for "latest task for session" queries (ORDER BY created_at DESC LIMIT 1).
+        sessionCreatedIdx: (0, import_pg_core.index)("tasks_session_created_idx").on(table.session_id, table.created_at),
         queueIdx: (0, import_pg_core.index)("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
         // Partial unique index — defense-in-depth for `tasks.createPending` race
         // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
         // rows have NULL queue_position and are unaffected.
-        queuedPositionUnique: (0, import_pg_core.uniqueIndex)("tasks_queued_position_unique").on(table.session_id, table.queue_position).where(import_drizzle_orm.sql`${table.status} = 'queued'`)
+        queuedPositionUnique: (0, import_pg_core.uniqueIndex)("tasks_queued_position_unique").on(table.tenant_id, table.session_id, table.queue_position).where(import_drizzle_orm.sql`${table.status} = 'queued'`)
       })
     );
     serializedSessions = (0, import_pg_core.pgTable)(
       "serialized_sessions",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         id: (0, import_pg_core.varchar)("id", { length: 36 }).primaryKey(),
         session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
@@ -883,6 +1051,7 @@ var init_schema_postgres = __esm({
         // gzipped; NULL while status='processing'
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("serialized_sessions_tenant_id_idx").on(table.tenant_id),
         sessionTurnIdx: (0, import_pg_core.index)("serialized_sessions_session_turn_idx").on(
           table.session_id,
           table.turn_index
@@ -893,6 +1062,7 @@ var init_schema_postgres = __esm({
     messages = (0, import_pg_core.pgTable)(
       "messages",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         message_id: (0, import_pg_core.varchar)("message_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -932,15 +1102,23 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("messages_tenant_id_idx").on(table.tenant_id),
+        tenantTimestampIdx: (0, import_pg_core.index)("messages_tenant_timestamp_idx").on(table.tenant_id, table.timestamp),
         // Indexes for efficient lookups
         sessionIdx: (0, import_pg_core.index)("messages_session_id_idx").on(table.session_id),
         taskIdx: (0, import_pg_core.index)("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: (0, import_pg_core.index)("messages_session_index_idx").on(table.session_id, table.index)
+        sessionIndexIdx: (0, import_pg_core.index)("messages_session_index_idx").on(table.session_id, table.index),
+        timestampIdx: (0, import_pg_core.index)("messages_timestamp_idx").on(table.timestamp),
+        sessionTimestampIdx: (0, import_pg_core.index)("messages_session_timestamp_idx").on(
+          table.session_id,
+          table.timestamp
+        )
       })
     );
     boards = (0, import_pg_core.pgTable)(
       "boards",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
         updated_at: t.timestamp("updated_at"),
@@ -948,7 +1126,7 @@ var init_schema_postgres = __esm({
         created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull(),
         // Materialized for lookups
         name: (0, import_pg_core.text)("name").notNull(),
-        slug: (0, import_pg_core.text)("slug").unique(),
+        slug: (0, import_pg_core.text)("slug"),
         primary_assistant_id: (0, import_pg_core.varchar)("primary_assistant_id", { length: 36 }).references(
           () => branches.branch_id,
           {
@@ -963,18 +1141,21 @@ var init_schema_postgres = __esm({
         archived_by: (0, import_pg_core.varchar)("archived_by", { length: 36 })
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("boards_tenant_id_idx").on(table.tenant_id),
         nameIdx: (0, import_pg_core.index)("boards_name_idx").on(table.name),
-        slugIdx: (0, import_pg_core.index)("boards_slug_idx").on(table.slug)
+        slugIdx: (0, import_pg_core.index)("boards_slug_idx").on(table.slug),
+        slugTenantUnique: (0, import_pg_core.uniqueIndex)("boards_tenant_slug_unique").on(table.tenant_id, table.slug)
       })
     );
     repos = (0, import_pg_core.pgTable)(
       "repos",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         repo_id: (0, import_pg_core.varchar)("repo_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
         updated_at: t.timestamp("updated_at"),
         // Materialized for querying
-        slug: (0, import_pg_core.text)("slug").notNull().unique(),
+        slug: (0, import_pg_core.text)("slug").notNull(),
         repo_type: (0, import_pg_core.text)("repo_type", { enum: ["remote", "local"] }).notNull().default("remote"),
         // Unix group for repo-level git access (agor_rp_<short-id>)
         // Users who have access to ANY branch in this repo get added to this group.
@@ -985,12 +1166,15 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
-        slugIdx: (0, import_pg_core.index)("repos_slug_idx").on(table.slug)
+        tenantIdx: (0, import_pg_core.index)("repos_tenant_id_idx").on(table.tenant_id),
+        slugIdx: (0, import_pg_core.index)("repos_slug_idx").on(table.slug),
+        slugTenantUnique: (0, import_pg_core.uniqueIndex)("repos_tenant_slug_unique").on(table.tenant_id, table.slug)
       })
     );
     branches = (0, import_pg_core.pgTable)(
       "branches",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).primaryKey(),
         repo_id: (0, import_pg_core.varchar)("repo_id", { length: 36 }).notNull().references(() => repos.repo_id, { onDelete: "cascade" }),
@@ -1065,6 +1249,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("branches_tenant_id_idx").on(table.tenant_id),
         repoIdx: (0, import_pg_core.index)("branches_repo_idx").on(table.repo_id),
         nameIdx: (0, import_pg_core.index)("branches_name_idx").on(table.name),
         refIdx: (0, import_pg_core.index)("branches_ref_idx").on(table.ref),
@@ -1078,22 +1263,26 @@ var init_schema_postgres = __esm({
     branchOwners = (0, import_pg_core.pgTable)(
       "branch_owners",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         created_at: t.timestamp("created_at").defaultNow()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("branch_owners_tenant_id_idx").on(table.tenant_id),
         pk: (0, import_pg_core.primaryKey)({ columns: [table.branch_id, table.user_id] })
       })
     );
     boardOwners = (0, import_pg_core.pgTable)(
       "board_owners",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         created_at: t.timestamp("created_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("board_owners_tenant_id_idx").on(table.tenant_id),
         pk: (0, import_pg_core.primaryKey)({ columns: [table.board_id, table.user_id] }),
         userIdx: (0, import_pg_core.index)("board_owners_user_idx").on(table.user_id)
       })
@@ -1101,6 +1290,7 @@ var init_schema_postgres = __esm({
     schedules = (0, import_pg_core.pgTable)(
       "schedules",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         schedule_id: (0, import_pg_core.varchar)("schedule_id", { length: 36 }).primaryKey(),
         branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         name: (0, import_pg_core.text)("name").notNull(),
@@ -1124,6 +1314,7 @@ var init_schema_postgres = __esm({
         created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull().references(() => users.user_id)
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("schedules_tenant_id_idx").on(table.tenant_id),
         enabledNextRunIdx: (0, import_pg_core.index)("schedules_enabled_next_run_idx").on(table.enabled, table.next_run_at),
         branchIdx: (0, import_pg_core.index)("schedules_branch_idx").on(table.branch_id),
         createdByIdx: (0, import_pg_core.index)("schedules_created_by_idx").on(table.created_by)
@@ -1132,12 +1323,13 @@ var init_schema_postgres = __esm({
     users = (0, import_pg_core.pgTable)(
       "users",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
         updated_at: t.timestamp("updated_at"),
         // Materialized for auth lookups
-        email: (0, import_pg_core.text)("email").unique().notNull(),
+        email: (0, import_pg_core.text)("email").notNull(),
         password: (0, import_pg_core.text)("password").notNull(),
         // bcrypt hashed
         // Basic profile (materialized for display)
@@ -1153,16 +1345,22 @@ var init_schema_postgres = __esm({
         onboarding_completed: t.bool("onboarding_completed").notNull().default(false),
         // Force password change flag (admin-settable, auto-cleared on password change)
         must_change_password: t.bool("must_change_password").notNull().default(false),
+        // Auth invalidation marker. Password changes set this timestamp so any
+        // previously issued browser access or refresh token is rejected.
+        tokens_valid_after: t.timestamp("tokens_valid_after"),
         // JSON blob for profile/preferences
         data: t.json("data").$type().notNull()
       },
       (table) => ({
-        emailIdx: (0, import_pg_core.index)("users_email_idx").on(table.email)
+        tenantIdx: (0, import_pg_core.index)("users_tenant_id_idx").on(table.tenant_id),
+        emailIdx: (0, import_pg_core.index)("users_email_idx").on(table.email),
+        emailTenantUnique: (0, import_pg_core.uniqueIndex)("users_tenant_email_unique").on(table.tenant_id, table.email)
       })
     );
     groups = (0, import_pg_core.pgTable)(
       "groups",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         group_id: (0, import_pg_core.varchar)("group_id", { length: 36 }).primaryKey(),
         name: (0, import_pg_core.text)("name").notNull(),
         slug: (0, import_pg_core.text)("slug").notNull(),
@@ -1175,13 +1373,15 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
-        slugIdx: (0, import_pg_core.uniqueIndex)("groups_slug_idx").on(table.slug),
+        tenantIdx: (0, import_pg_core.index)("groups_tenant_id_idx").on(table.tenant_id),
+        slugIdx: (0, import_pg_core.uniqueIndex)("groups_tenant_slug_unique").on(table.tenant_id, table.slug),
         archivedIdx: (0, import_pg_core.index)("groups_archived_idx").on(table.archived)
       })
     );
     groupMemberships = (0, import_pg_core.pgTable)(
       "group_memberships",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         group_id: (0, import_pg_core.varchar)("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
         user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         added_by: (0, import_pg_core.varchar)("added_by", { length: 36 }).references(() => users.user_id, {
@@ -1190,6 +1390,7 @@ var init_schema_postgres = __esm({
         created_at: t.timestamp("created_at").notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("group_memberships_tenant_id_idx").on(table.tenant_id),
         pk: (0, import_pg_core.primaryKey)({ columns: [table.group_id, table.user_id] }),
         userIdx: (0, import_pg_core.index)("group_memberships_user_idx").on(table.user_id)
       })
@@ -1197,6 +1398,7 @@ var init_schema_postgres = __esm({
     branchGroupGrants = (0, import_pg_core.pgTable)(
       "branch_group_grants",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         group_id: (0, import_pg_core.varchar)("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
         can: (0, import_pg_core.text)("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
@@ -1208,6 +1410,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("branch_group_grants_tenant_id_idx").on(table.tenant_id),
         pk: (0, import_pg_core.primaryKey)({ columns: [table.branch_id, table.group_id] }),
         groupIdx: (0, import_pg_core.index)("branch_group_grants_group_idx").on(table.group_id)
       })
@@ -1215,6 +1418,7 @@ var init_schema_postgres = __esm({
     boardGroupGrants = (0, import_pg_core.pgTable)(
       "board_group_grants",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         group_id: (0, import_pg_core.varchar)("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
         can: (0, import_pg_core.text)("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
@@ -1226,6 +1430,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("board_group_grants_tenant_id_idx").on(table.tenant_id),
         pk: (0, import_pg_core.primaryKey)({ columns: [table.board_id, table.group_id] }),
         groupIdx: (0, import_pg_core.index)("board_group_grants_group_idx").on(table.group_id)
       })
@@ -1233,6 +1438,7 @@ var init_schema_postgres = __esm({
     appVariables = (0, import_pg_core.pgTable)(
       "app_variables",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         variable_id: (0, import_pg_core.varchar)("variable_id", { length: 36 }).primaryKey(),
         namespace: (0, import_pg_core.text)("namespace").notNull(),
         key: (0, import_pg_core.text)("key").notNull(),
@@ -1248,13 +1454,19 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at").notNull()
       },
       (table) => ({
-        namespaceKeyIdx: (0, import_pg_core.uniqueIndex)("app_variables_namespace_key_idx").on(table.namespace, table.key),
+        tenantIdx: (0, import_pg_core.index)("app_variables_tenant_id_idx").on(table.tenant_id),
+        namespaceKeyIdx: (0, import_pg_core.uniqueIndex)("app_variables_tenant_namespace_key_unique").on(
+          table.tenant_id,
+          table.namespace,
+          table.key
+        ),
         namespaceIdx: (0, import_pg_core.index)("app_variables_namespace_idx").on(table.namespace)
       })
     );
     userApiKeys = (0, import_pg_core.pgTable)(
       "user_api_keys",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         id: (0, import_pg_core.varchar)("id", { length: 36 }).primaryKey(),
         user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         name: (0, import_pg_core.text)("name").notNull(),
@@ -1266,6 +1478,7 @@ var init_schema_postgres = __esm({
         last_used_at: t.timestamp("last_used_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("user_api_keys_tenant_id_idx").on(table.tenant_id),
         userIdx: (0, import_pg_core.index)("user_api_keys_user_idx").on(table.user_id),
         prefixIdx: (0, import_pg_core.index)("user_api_keys_prefix_idx").on(table.prefix)
       })
@@ -1273,6 +1486,7 @@ var init_schema_postgres = __esm({
     mcpServers = (0, import_pg_core.pgTable)(
       "mcp_servers",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         mcp_server_id: (0, import_pg_core.varchar)("mcp_server_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -1299,6 +1513,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("mcp_servers_tenant_id_idx").on(table.tenant_id),
         nameIdx: (0, import_pg_core.index)("mcp_servers_name_idx").on(table.name),
         scopeIdx: (0, import_pg_core.index)("mcp_servers_scope_idx").on(table.scope),
         ownerIdx: (0, import_pg_core.index)("mcp_servers_owner_idx").on(table.owner_user_id),
@@ -1308,6 +1523,7 @@ var init_schema_postgres = __esm({
     cardTypes = (0, import_pg_core.pgTable)(
       "card_types",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         card_type_id: (0, import_pg_core.varchar)("card_type_id", { length: 36 }).primaryKey(),
         name: (0, import_pg_core.text)("name").notNull(),
         emoji: (0, import_pg_core.text)("emoji"),
@@ -1319,12 +1535,14 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at").notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("card_types_tenant_id_idx").on(table.tenant_id),
         nameIdx: (0, import_pg_core.index)("card_types_name_idx").on(table.name)
       })
     );
     cards = (0, import_pg_core.pgTable)(
       "cards",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         card_id: (0, import_pg_core.varchar)("card_id", { length: 36 }).primaryKey(),
         board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         card_type_id: (0, import_pg_core.varchar)("card_type_id", { length: 36 }).references(() => cardTypes.card_type_id, {
@@ -1345,6 +1563,7 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("cards_tenant_id_idx").on(table.tenant_id),
         boardIdx: (0, import_pg_core.index)("cards_board_idx").on(table.board_id),
         cardTypeIdx: (0, import_pg_core.index)("cards_card_type_idx").on(table.card_type_id),
         titleIdx: (0, import_pg_core.index)("cards_title_idx").on(table.title),
@@ -1355,10 +1574,17 @@ var init_schema_postgres = __esm({
     artifacts = (0, import_pg_core.pgTable)(
       "artifacts",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         artifact_id: (0, import_pg_core.varchar)("artifact_id", { length: 36 }).primaryKey(),
         branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).references(() => branches.branch_id, {
           onDelete: "set null"
         }),
+        source_session_id: (0, import_pg_core.varchar)("source_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
         board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         name: (0, import_pg_core.text)("name").notNull(),
         description: (0, import_pg_core.text)("description"),
@@ -1384,7 +1610,9 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("artifacts_tenant_id_idx").on(table.tenant_id),
         branchIdx: (0, import_pg_core.index)("artifacts_branch_idx").on(table.branch_id),
+        sourceSessionIdx: (0, import_pg_core.index)("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: (0, import_pg_core.index)("artifacts_board_idx").on(table.board_id),
         archivedIdx: (0, import_pg_core.index)("artifacts_archived_idx").on(table.archived),
         publicIdx: (0, import_pg_core.index)("artifacts_public_idx").on(table.public)
@@ -1393,6 +1621,7 @@ var init_schema_postgres = __esm({
     artifactTrustGrants = (0, import_pg_core.pgTable)(
       "artifact_trust_grants",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         grant_id: (0, import_pg_core.varchar)("grant_id", { length: 36 }).primaryKey(),
         user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).notNull(),
         scope_type: (0, import_pg_core.text)("scope_type").notNull(),
@@ -1403,6 +1632,7 @@ var init_schema_postgres = __esm({
         revoked_at: t.timestamp("revoked_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("artifact_trust_grants_tenant_id_idx").on(table.tenant_id),
         userIdx: (0, import_pg_core.index)("artifact_trust_grants_user_idx").on(table.user_id),
         scopeIdx: (0, import_pg_core.index)("artifact_trust_grants_scope_idx").on(table.scope_type, table.scope_value)
       })
@@ -1410,6 +1640,7 @@ var init_schema_postgres = __esm({
     boardObjects = (0, import_pg_core.pgTable)(
       "board_objects",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         object_id: (0, import_pg_core.varchar)("object_id", { length: 36 }).primaryKey(),
         board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
@@ -1425,6 +1656,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("board_objects_tenant_id_idx").on(table.tenant_id),
         boardIdx: (0, import_pg_core.index)("board_objects_board_idx").on(table.board_id),
         branchIdx: (0, import_pg_core.index)("board_objects_branch_idx").on(table.branch_id),
         cardIdx: (0, import_pg_core.index)("board_objects_card_idx").on(table.card_id)
@@ -1433,12 +1665,14 @@ var init_schema_postgres = __esm({
     sessionMcpServers = (0, import_pg_core.pgTable)(
       "session_mcp_servers",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         mcp_server_id: (0, import_pg_core.varchar)("mcp_server_id", { length: 36 }).notNull().references(() => mcpServers.mcp_server_id, { onDelete: "cascade" }),
         enabled: t.bool("enabled").notNull().default(true),
         added_at: t.timestamp("added_at").notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("session_mcp_servers_tenant_id_idx").on(table.tenant_id),
         // Composite primary key
         pk: (0, import_pg_core.index)("session_mcp_servers_pk").on(table.session_id, table.mcp_server_id),
         // Indexes for queries
@@ -1450,6 +1684,7 @@ var init_schema_postgres = __esm({
     userMcpOauthTokens = (0, import_pg_core.pgTable)(
       "user_mcp_oauth_tokens",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // NULL = shared-mode token (one per mcp_server_id)
         user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).references(() => users.user_id, {
           onDelete: "cascade"
@@ -1467,6 +1702,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("user_mcp_oauth_tokens_tenant_id_idx").on(table.tenant_id),
         // Composite lookup indexes. Uniqueness enforced via partial unique indexes
         // created in the migration (one for per-user rows, one for the shared row).
         pk: (0, import_pg_core.index)("user_mcp_oauth_tokens_pk").on(table.user_id, table.mcp_server_id),
@@ -1477,6 +1713,7 @@ var init_schema_postgres = __esm({
     boardComments = (0, import_pg_core.pgTable)(
       "board_comments",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         comment_id: (0, import_pg_core.varchar)("comment_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -1518,6 +1755,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("board_comments_tenant_id_idx").on(table.tenant_id),
         boardIdx: (0, import_pg_core.index)("board_comments_board_idx").on(table.board_id),
         sessionIdx: (0, import_pg_core.index)("board_comments_session_idx").on(table.session_id),
         taskIdx: (0, import_pg_core.index)("board_comments_task_idx").on(table.task_id),
@@ -1532,6 +1770,7 @@ var init_schema_postgres = __esm({
     gatewayChannels = (0, import_pg_core.pgTable)(
       "gateway_channels",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         id: (0, import_pg_core.varchar)("id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -1541,11 +1780,11 @@ var init_schema_postgres = __esm({
         // Materialized for queries
         name: (0, import_pg_core.text)("name").notNull(),
         channel_type: (0, import_pg_core.text)("channel_type", {
-          enum: ["slack", "discord", "whatsapp", "telegram", "github"]
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
         }).notNull(),
         target_branch_id: (0, import_pg_core.varchar)("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         agor_user_id: (0, import_pg_core.varchar)("agor_user_id", { length: 36 }).notNull(),
-        channel_key: (0, import_pg_core.text)("channel_key").notNull().unique(),
+        channel_key: (0, import_pg_core.text)("channel_key").notNull(),
         enabled: t.bool("enabled").notNull().default(true),
         last_message_at: t.timestamp("last_message_at"),
         // JSON blob for platform credentials (encrypted at rest)
@@ -1554,13 +1793,19 @@ var init_schema_postgres = __esm({
         agentic_config: t.json("agentic_config")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("gateway_channels_tenant_id_idx").on(table.tenant_id),
         channelKeyIdx: (0, import_pg_core.index)("idx_gateway_channel_key").on(table.channel_key),
+        channelKeyTenantUnique: (0, import_pg_core.uniqueIndex)("gateway_channels_tenant_channel_key_unique").on(
+          table.tenant_id,
+          table.channel_key
+        ),
         enabledTypeIdx: (0, import_pg_core.index)("idx_gateway_enabled_type").on(table.enabled, table.channel_type)
       })
     );
     threadSessionMap = (0, import_pg_core.pgTable)(
       "thread_session_map",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         id: (0, import_pg_core.varchar)("id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -1578,7 +1823,9 @@ var init_schema_postgres = __esm({
         metadata: t.json("metadata")
       },
       (table) => ({
-        uniqueChannelThread: (0, import_pg_core.uniqueIndex)("uniq_thread_map_channel_thread").on(
+        tenantIdx: (0, import_pg_core.index)("thread_session_map_tenant_id_idx").on(table.tenant_id),
+        uniqueChannelThread: (0, import_pg_core.uniqueIndex)("uniq_thread_map_tenant_channel_thread").on(
+          table.tenant_id,
           table.channel_id,
           table.thread_id
         ),
@@ -1587,14 +1834,82 @@ var init_schema_postgres = __esm({
         channelStatusIdx: (0, import_pg_core.index)("idx_thread_map_channel_status").on(table.channel_id, table.status)
       })
     );
+    gatewayOutboundMessages = (0, import_pg_core.pgTable)(
+      "gateway_outbound_messages",
+      {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+        id: (0, import_pg_core.varchar)("id", { length: 36 }).primaryKey(),
+        created_at: t.timestamp("created_at").notNull(),
+        updated_at: t.timestamp("updated_at").notNull(),
+        gateway_channel_id: (0, import_pg_core.varchar)("gateway_channel_id", { length: 36 }).notNull().references(() => gatewayChannels.id, { onDelete: "cascade" }),
+        channel_type: (0, import_pg_core.text)("channel_type", {
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+        }).notNull(),
+        platform_channel_id: (0, import_pg_core.text)("platform_channel_id").notNull(),
+        platform_message_id: (0, import_pg_core.text)("platform_message_id").notNull(),
+        platform_thread_id: (0, import_pg_core.text)("platform_thread_id").notNull(),
+        platform_permalink: (0, import_pg_core.text)("platform_permalink"),
+        target_branch_id: (0, import_pg_core.varchar)("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id),
+        emitted_by_user_id: (0, import_pg_core.varchar)("emitted_by_user_id", { length: 36 }).notNull().references(() => users.user_id),
+        emitted_by_session_id: (0, import_pg_core.varchar)("emitted_by_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        emitted_by_task_id: (0, import_pg_core.varchar)("emitted_by_task_id", { length: 36 }).references(
+          () => tasks.task_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        emitted_by_schedule_id: (0, import_pg_core.varchar)("emitted_by_schedule_id", { length: 36 }).references(
+          () => schedules.schedule_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        message_text: (0, import_pg_core.text)("message_text").notNull(),
+        message_preview: (0, import_pg_core.text)("message_preview").notNull(),
+        metadata: t.json("metadata"),
+        consumed_by_session_id: (0, import_pg_core.varchar)("consumed_by_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        consumed_at: t.timestamp("consumed_at")
+      },
+      (table) => ({
+        tenantIdx: (0, import_pg_core.index)("gateway_outbound_messages_tenant_id_idx").on(table.tenant_id),
+        uniqueChannelThread: (0, import_pg_core.uniqueIndex)("uniq_gateway_outbound_tenant_channel_thread").on(
+          table.tenant_id,
+          table.gateway_channel_id,
+          table.platform_thread_id
+        ),
+        emittedSessionIdx: (0, import_pg_core.index)("idx_gateway_outbound_emitted_session").on(
+          table.emitted_by_session_id
+        ),
+        emittedScheduleIdx: (0, import_pg_core.index)("idx_gateway_outbound_emitted_schedule").on(
+          table.emitted_by_schedule_id
+        ),
+        targetBranchCreatedIdx: (0, import_pg_core.index)("idx_gateway_outbound_branch_created").on(
+          table.target_branch_id,
+          table.created_at
+        ),
+        consumedIdx: (0, import_pg_core.index)("idx_gateway_outbound_consumed").on(table.consumed_at)
+      })
+    );
     sessionEnvSelections = (0, import_pg_core.pgTable)(
       "session_env_selections",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         env_var_name: (0, import_pg_core.text)("env_var_name").notNull(),
         created_at: t.timestamp("created_at").notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("session_env_selections_tenant_id_idx").on(table.tenant_id),
         pk: (0, import_pg_core.primaryKey)({ columns: [table.session_id, table.env_var_name] }),
         sessionIdx: (0, import_pg_core.index)("session_env_selections_session_idx").on(table.session_id)
       })
@@ -1602,6 +1917,7 @@ var init_schema_postgres = __esm({
     kbNamespaces = (0, import_pg_core.pgTable)(
       "kb_namespaces",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         namespace_id: (0, import_pg_core.varchar)("namespace_id", { length: 36 }).primaryKey(),
         slug: (0, import_pg_core.text)("slug").notNull(),
         display_name: (0, import_pg_core.text)("display_name").notNull(),
@@ -1628,7 +1944,8 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
-        slugIdx: (0, import_pg_core.uniqueIndex)("kb_namespaces_slug_idx").on(table.slug).where(import_drizzle_orm.sql`${table.archived} = false`),
+        tenantIdx: (0, import_pg_core.index)("kb_namespaces_tenant_id_idx").on(table.tenant_id),
+        slugIdx: (0, import_pg_core.uniqueIndex)("kb_namespaces_tenant_slug_unique").on(table.tenant_id, table.slug).where(import_drizzle_orm.sql`${table.archived} = false`),
         kindIdx: (0, import_pg_core.index)("kb_namespaces_kind_idx").on(table.kind),
         ownerIdx: (0, import_pg_core.index)("kb_namespaces_owner_idx").on(table.owner_user_id),
         repoIdx: (0, import_pg_core.index)("kb_namespaces_repo_idx").on(table.repo_id),
@@ -1639,6 +1956,7 @@ var init_schema_postgres = __esm({
     kbNamespaceAcl = (0, import_pg_core.pgTable)(
       "kb_namespace_acl",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         namespace_acl_id: (0, import_pg_core.varchar)("namespace_acl_id", { length: 36 }).primaryKey(),
         namespace_id: (0, import_pg_core.varchar)("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces.namespace_id, { onDelete: "cascade" }),
         subject_type: (0, import_pg_core.text)("subject_type", { enum: ["user", "group"] }).notNull(),
@@ -1651,9 +1969,11 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("kb_namespace_acl_tenant_id_idx").on(table.tenant_id),
         namespaceIdx: (0, import_pg_core.index)("kb_namespace_acl_namespace_idx").on(table.namespace_id),
         subjectIdx: (0, import_pg_core.index)("kb_namespace_acl_subject_idx").on(table.subject_type, table.subject_id),
-        namespaceSubjectIdx: (0, import_pg_core.uniqueIndex)("kb_namespace_acl_namespace_subject_idx").on(
+        namespaceSubjectIdx: (0, import_pg_core.uniqueIndex)("kb_namespace_acl_tenant_namespace_subject_unique").on(
+          table.tenant_id,
           table.namespace_id,
           table.subject_type,
           table.subject_id
@@ -1663,6 +1983,7 @@ var init_schema_postgres = __esm({
     kbDocuments = (0, import_pg_core.pgTable)(
       "kb_documents",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         document_id: (0, import_pg_core.varchar)("document_id", { length: 36 }).primaryKey(),
         namespace_id: (0, import_pg_core.varchar)("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces.namespace_id, { onDelete: "cascade" }),
         path: (0, import_pg_core.text)("path").notNull(),
@@ -1690,8 +2011,9 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
-        namespacePathIdx: (0, import_pg_core.uniqueIndex)("kb_documents_namespace_path_idx").on(table.namespace_id, table.path).where(import_drizzle_orm.sql`${table.archived} = false`),
-        uriIdx: (0, import_pg_core.uniqueIndex)("kb_documents_uri_idx").on(table.uri).where(import_drizzle_orm.sql`${table.archived} = false`),
+        tenantIdx: (0, import_pg_core.index)("kb_documents_tenant_id_idx").on(table.tenant_id),
+        namespacePathIdx: (0, import_pg_core.uniqueIndex)("kb_documents_tenant_namespace_path_unique").on(table.tenant_id, table.namespace_id, table.path).where(import_drizzle_orm.sql`${table.archived} = false`),
+        uriIdx: (0, import_pg_core.uniqueIndex)("kb_documents_tenant_uri_unique").on(table.tenant_id, table.uri).where(import_drizzle_orm.sql`${table.archived} = false`),
         namespaceIdx: (0, import_pg_core.index)("kb_documents_namespace_idx").on(table.namespace_id),
         kindIdx: (0, import_pg_core.index)("kb_documents_kind_idx").on(table.kind),
         visibilityIdx: (0, import_pg_core.index)("kb_documents_visibility_idx").on(table.visibility),
@@ -1704,6 +2026,7 @@ var init_schema_postgres = __esm({
     kbDocumentVersions = (0, import_pg_core.pgTable)(
       "kb_document_versions",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         version_id: (0, import_pg_core.varchar)("version_id", { length: 36 }).primaryKey(),
         document_id: (0, import_pg_core.varchar)("document_id", { length: 36 }).notNull().references(() => kbDocuments.document_id, { onDelete: "cascade" }),
         version_number: (0, import_pg_core.integer)("version_number").notNull(),
@@ -1723,7 +2046,9 @@ var init_schema_postgres = __esm({
         created_at: t.timestamp("created_at").notNull()
       },
       (table) => ({
-        documentVersionIdx: (0, import_pg_core.uniqueIndex)("kb_document_versions_document_version_idx").on(
+        tenantIdx: (0, import_pg_core.index)("kb_document_versions_tenant_id_idx").on(table.tenant_id),
+        documentVersionIdx: (0, import_pg_core.uniqueIndex)("kb_document_versions_tenant_document_version_unique").on(
+          table.tenant_id,
           table.document_id,
           table.version_number
         ),
@@ -1735,6 +2060,7 @@ var init_schema_postgres = __esm({
     kbDocumentUnits = (0, import_pg_core.pgTable)(
       "kb_document_units",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         unit_id: (0, import_pg_core.varchar)("unit_id", { length: 36 }).primaryKey(),
         document_id: (0, import_pg_core.varchar)("document_id", { length: 36 }).notNull().references(() => kbDocuments.document_id, { onDelete: "cascade" }),
         version_id: (0, import_pg_core.varchar)("version_id", { length: 36 }).notNull().references(() => kbDocumentVersions.version_id, { onDelete: "cascade" }),
@@ -1759,6 +2085,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("kb_document_units_tenant_id_idx").on(table.tenant_id),
         documentIdx: (0, import_pg_core.index)("kb_document_units_document_idx").on(table.document_id),
         versionIdx: (0, import_pg_core.index)("kb_document_units_version_idx").on(table.version_id),
         versionOrdinalIdx: (0, import_pg_core.index)("kb_document_units_version_ordinal_idx").on(
@@ -1772,6 +2099,7 @@ var init_schema_postgres = __esm({
     kbEmbeddingSpaces = (0, import_pg_core.pgTable)(
       "kb_embedding_spaces",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         embedding_space_id: (0, import_pg_core.varchar)("embedding_space_id", { length: 36 }).primaryKey(),
         provider: (0, import_pg_core.text)("provider").notNull(),
         model: (0, import_pg_core.text)("model").notNull(),
@@ -1784,7 +2112,9 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
-        providerModelIdx: (0, import_pg_core.uniqueIndex)("kb_embedding_spaces_provider_model_idx").on(
+        tenantIdx: (0, import_pg_core.index)("kb_embedding_spaces_tenant_id_idx").on(table.tenant_id),
+        providerModelIdx: (0, import_pg_core.uniqueIndex)("kb_embedding_spaces_tenant_provider_model_unique").on(
+          table.tenant_id,
           table.provider,
           table.model,
           table.dimensions,
@@ -1797,6 +2127,7 @@ var init_schema_postgres = __esm({
     kbGraphNodes = (0, import_pg_core.pgTable)(
       "kb_graph_nodes",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         node_id: (0, import_pg_core.varchar)("node_id", { length: 36 }).primaryKey(),
         node_type: (0, import_pg_core.text)("node_type", {
           enum: [
@@ -1862,7 +2193,8 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
-        uriIdx: (0, import_pg_core.uniqueIndex)("kb_graph_nodes_uri_idx").on(table.uri).where(import_drizzle_orm.sql`${table.archived} = false`),
+        tenantIdx: (0, import_pg_core.index)("kb_graph_nodes_tenant_id_idx").on(table.tenant_id),
+        uriIdx: (0, import_pg_core.uniqueIndex)("kb_graph_nodes_tenant_uri_unique").on(table.tenant_id, table.uri).where(import_drizzle_orm.sql`${table.archived} = false`),
         typeIdx: (0, import_pg_core.index)("kb_graph_nodes_type_idx").on(table.node_type),
         namespaceIdx: (0, import_pg_core.index)("kb_graph_nodes_namespace_idx").on(table.namespace_id),
         documentIdx: (0, import_pg_core.index)("kb_graph_nodes_document_idx").on(table.document_id),
@@ -1882,6 +2214,7 @@ var init_schema_postgres = __esm({
     kbGraphEdges = (0, import_pg_core.pgTable)(
       "kb_graph_edges",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         edge_id: (0, import_pg_core.varchar)("edge_id", { length: 36 }).primaryKey(),
         source_node_id: (0, import_pg_core.varchar)("source_node_id", { length: 36 }).notNull().references(() => kbGraphNodes.node_id, { onDelete: "cascade" }),
         target_node_id: (0, import_pg_core.varchar)("target_node_id", { length: 36 }).notNull().references(() => kbGraphNodes.node_id, { onDelete: "cascade" }),
@@ -1910,6 +2243,7 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("kb_graph_edges_tenant_id_idx").on(table.tenant_id),
         sourceIdx: (0, import_pg_core.index)("kb_graph_edges_source_idx").on(table.source_node_id),
         targetIdx: (0, import_pg_core.index)("kb_graph_edges_target_idx").on(table.target_node_id),
         typeIdx: (0, import_pg_core.index)("kb_graph_edges_type_idx").on(table.edge_type),
@@ -1921,11 +2255,11 @@ var init_schema_postgres = __esm({
           table.target_node_id,
           table.edge_type
         ),
-        sourceTargetTypeIdx: (0, import_pg_core.uniqueIndex)("kb_graph_edges_source_target_type_idx").on(table.source_node_id, table.target_node_id, table.edge_type).where(import_drizzle_orm.sql`${table.archived} = false`),
+        sourceTargetTypeIdx: (0, import_pg_core.uniqueIndex)("kb_graph_edges_tenant_source_target_type_unique").on(table.tenant_id, table.source_node_id, table.target_node_id, table.edge_type).where(import_drizzle_orm.sql`${table.archived} = false`),
         archivedIdx: (0, import_pg_core.index)("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
-    sessionsRelations = (0, import_drizzle_orm.relations)(sessions, ({ one }) => ({
+    sessionsRelations = (0, import_drizzle_orm.relations)(sessions, ({ one, many }) => ({
       branch: one(branches, {
         fields: [sessions.branch_id],
         references: [branches.branch_id]
@@ -1933,6 +2267,24 @@ var init_schema_postgres = __esm({
       schedule: one(schedules, {
         fields: [sessions.schedule_id],
         references: [schedules.schedule_id]
+      }),
+      outboundRelationships: many(sessionRelationships, { relationName: "relationshipSource" }),
+      inboundRelationships: many(sessionRelationships, { relationName: "relationshipTarget" })
+    }));
+    sessionRelationshipsRelations = (0, import_drizzle_orm.relations)(sessionRelationships, ({ one }) => ({
+      sourceSession: one(sessions, {
+        fields: [sessionRelationships.source_session_id],
+        references: [sessions.session_id],
+        relationName: "relationshipSource"
+      }),
+      targetSession: one(sessions, {
+        fields: [sessionRelationships.target_session_id],
+        references: [sessions.session_id],
+        relationName: "relationshipTarget"
+      }),
+      callbackSession: one(sessions, {
+        fields: [sessionRelationships.callback_session_id],
+        references: [sessions.session_id]
       })
     }));
     branchesRelations = (0, import_drizzle_orm.relations)(branches, ({ many }) => ({
@@ -1967,6 +2319,7 @@ __export(schema_sqlite_exports, {
   cardTypes: () => cardTypes2,
   cards: () => cards2,
   gatewayChannels: () => gatewayChannels2,
+  gatewayOutboundMessages: () => gatewayOutboundMessages2,
   groupMemberships: () => groupMemberships2,
   groups: () => groups2,
   kbDocumentUnits: () => kbDocumentUnits2,
@@ -1985,6 +2338,8 @@ __export(schema_sqlite_exports, {
   serializedSessions: () => serializedSessions2,
   sessionEnvSelections: () => sessionEnvSelections2,
   sessionMcpServers: () => sessionMcpServers2,
+  sessionRelationships: () => sessionRelationships2,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations2,
   sessions: () => sessions2,
   sessionsRelations: () => sessionsRelations2,
   tasks: () => tasks2,
@@ -1993,7 +2348,7 @@ __export(schema_sqlite_exports, {
   userMcpOauthTokens: () => userMcpOauthTokens2,
   users: () => users2
 });
-var import_drizzle_orm2, import_sqlite_core, t2, sessions2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, branchesRelations2, schedulesRelations2;
+var import_drizzle_orm2, import_sqlite_core, t2, sessions2, sessionRelationships2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, gatewayOutboundMessages2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, sessionRelationshipsRelations2, branchesRelations2, schedulesRelations2;
 var init_schema_sqlite = __esm({
   "src/db/schema.sqlite.ts"() {
     "use strict";
@@ -2069,6 +2424,7 @@ var init_schema_sqlite = __esm({
       },
       (table) => ({
         statusIdx: (0, import_sqlite_core.index)("sessions_status_idx").on(table.status),
+        statusReadyIdx: (0, import_sqlite_core.index)("sessions_status_ready_idx").on(table.status, table.ready_for_prompt),
         agenticToolIdx: (0, import_sqlite_core.index)("sessions_agentic_tool_idx").on(table.agentic_tool),
         boardIdx: (0, import_sqlite_core.index)("sessions_board_idx").on(table.board_id),
         branchIdx: (0, import_sqlite_core.index)("sessions_branch_idx").on(table.branch_id),
@@ -2085,6 +2441,39 @@ var init_schema_sqlite = __esm({
         scheduleRunUnique: (0, import_sqlite_core.uniqueIndex)("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(import_drizzle_orm2.sql`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
       })
     );
+    sessionRelationships2 = (0, import_sqlite_core.sqliteTable)(
+      "session_relationships",
+      {
+        relationship_id: (0, import_sqlite_core.text)("relationship_id", { length: 36 }).primaryKey(),
+        source_session_id: (0, import_sqlite_core.text)("source_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+        target_session_id: (0, import_sqlite_core.text)("target_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+        relationship_type: (0, import_sqlite_core.text)("relationship_type", { enum: ["remote_create"] }).notNull(),
+        created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).notNull(),
+        created_at: t2.timestamp("created_at").notNull(),
+        updated_at: t2.timestamp("updated_at"),
+        callback_enabled: t2.bool("callback_enabled").notNull().default(false),
+        callback_session_id: (0, import_sqlite_core.text)("callback_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        data: t2.json("data")
+      },
+      (table) => ({
+        sourceIdx: (0, import_sqlite_core.index)("session_relationships_source_idx").on(table.source_session_id),
+        targetIdx: (0, import_sqlite_core.index)("session_relationships_target_idx").on(table.target_session_id),
+        callbackIdx: (0, import_sqlite_core.index)("session_relationships_callback_idx").on(table.callback_session_id),
+        // Note: no tenant_source/tenant_target composite indexes here — SQLite schema
+        // has no tenant column on this table (RLS is Postgres-only). The standalone
+        // source/target indexes above are sufficient for SQLite.
+        sourceTargetTypeUnique: (0, import_sqlite_core.uniqueIndex)("session_relationships_source_target_type_unique").on(
+          table.source_session_id,
+          table.target_session_id,
+          table.relationship_type
+        )
+      })
+    );
     tasks2 = (0, import_sqlite_core.sqliteTable)(
       "tasks",
       {
@@ -2197,7 +2586,12 @@ var init_schema_sqlite = __esm({
         // Indexes for efficient lookups
         sessionIdx: (0, import_sqlite_core.index)("messages_session_id_idx").on(table.session_id),
         taskIdx: (0, import_sqlite_core.index)("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: (0, import_sqlite_core.index)("messages_session_index_idx").on(table.session_id, table.index)
+        sessionIndexIdx: (0, import_sqlite_core.index)("messages_session_index_idx").on(table.session_id, table.index),
+        timestampIdx: (0, import_sqlite_core.index)("messages_timestamp_idx").on(table.timestamp),
+        sessionTimestampIdx: (0, import_sqlite_core.index)("messages_session_timestamp_idx").on(
+          table.session_id,
+          table.timestamp
+        )
       })
     );
     boards2 = (0, import_sqlite_core.sqliteTable)(
@@ -2423,6 +2817,9 @@ var init_schema_sqlite = __esm({
         onboarding_completed: t2.bool("onboarding_completed").notNull().default(false),
         // Force password change flag (admin-settable, auto-cleared on password change)
         must_change_password: t2.bool("must_change_password").notNull().default(false),
+        // Auth invalidation marker. Password changes set this timestamp so any
+        // previously issued browser access or refresh token is rejected.
+        tokens_valid_after: t2.timestamp("tokens_valid_after"),
         // JSON blob for profile/preferences
         data: t2.json("data").$type().notNull()
       },
@@ -2629,6 +3026,12 @@ var init_schema_sqlite = __esm({
         branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).references(() => branches2.branch_id, {
           onDelete: "set null"
         }),
+        source_session_id: (0, import_sqlite_core.text)("source_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
         board_id: (0, import_sqlite_core.text)("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
         name: (0, import_sqlite_core.text)("name").notNull(),
         description: (0, import_sqlite_core.text)("description"),
@@ -2655,6 +3058,7 @@ var init_schema_sqlite = __esm({
       },
       (table) => ({
         branchIdx: (0, import_sqlite_core.index)("artifacts_branch_idx").on(table.branch_id),
+        sourceSessionIdx: (0, import_sqlite_core.index)("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: (0, import_sqlite_core.index)("artifacts_board_idx").on(table.board_id),
         archivedIdx: (0, import_sqlite_core.index)("artifacts_archived_idx").on(table.archived),
         publicIdx: (0, import_sqlite_core.index)("artifacts_public_idx").on(table.public)
@@ -2813,7 +3217,7 @@ var init_schema_sqlite = __esm({
         // Materialized for queries
         name: (0, import_sqlite_core.text)("name").notNull(),
         channel_type: (0, import_sqlite_core.text)("channel_type", {
-          enum: ["slack", "discord", "whatsapp", "telegram", "github"]
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
         }).notNull(),
         target_branch_id: (0, import_sqlite_core.text)("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
         agor_user_id: (0, import_sqlite_core.text)("agor_user_id", { length: 36 }).notNull(),
@@ -2859,6 +3263,66 @@ var init_schema_sqlite = __esm({
         channelStatusIdx: (0, import_sqlite_core.index)("idx_thread_map_channel_status").on(table.channel_id, table.status)
       })
     );
+    gatewayOutboundMessages2 = (0, import_sqlite_core.sqliteTable)(
+      "gateway_outbound_messages",
+      {
+        id: (0, import_sqlite_core.text)("id", { length: 36 }).primaryKey(),
+        created_at: t2.timestamp("created_at").notNull(),
+        updated_at: t2.timestamp("updated_at").notNull(),
+        gateway_channel_id: (0, import_sqlite_core.text)("gateway_channel_id", { length: 36 }).notNull().references(() => gatewayChannels2.id, { onDelete: "cascade" }),
+        channel_type: (0, import_sqlite_core.text)("channel_type", {
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+        }).notNull(),
+        platform_channel_id: (0, import_sqlite_core.text)("platform_channel_id").notNull(),
+        platform_message_id: (0, import_sqlite_core.text)("platform_message_id").notNull(),
+        platform_thread_id: (0, import_sqlite_core.text)("platform_thread_id").notNull(),
+        platform_permalink: (0, import_sqlite_core.text)("platform_permalink"),
+        target_branch_id: (0, import_sqlite_core.text)("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id),
+        emitted_by_user_id: (0, import_sqlite_core.text)("emitted_by_user_id", { length: 36 }).notNull().references(() => users2.user_id),
+        emitted_by_session_id: (0, import_sqlite_core.text)("emitted_by_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        emitted_by_task_id: (0, import_sqlite_core.text)("emitted_by_task_id", { length: 36 }).references(() => tasks2.task_id, {
+          onDelete: "set null"
+        }),
+        emitted_by_schedule_id: (0, import_sqlite_core.text)("emitted_by_schedule_id", { length: 36 }).references(
+          () => schedules2.schedule_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        message_text: (0, import_sqlite_core.text)("message_text").notNull(),
+        message_preview: (0, import_sqlite_core.text)("message_preview").notNull(),
+        metadata: t2.json("metadata"),
+        consumed_by_session_id: (0, import_sqlite_core.text)("consumed_by_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        consumed_at: t2.timestamp("consumed_at")
+      },
+      (table) => ({
+        uniqueChannelThread: (0, import_sqlite_core.uniqueIndex)("uniq_gateway_outbound_channel_thread").on(
+          table.gateway_channel_id,
+          table.platform_thread_id
+        ),
+        emittedSessionIdx: (0, import_sqlite_core.index)("idx_gateway_outbound_emitted_session").on(
+          table.emitted_by_session_id
+        ),
+        emittedScheduleIdx: (0, import_sqlite_core.index)("idx_gateway_outbound_emitted_schedule").on(
+          table.emitted_by_schedule_id
+        ),
+        targetBranchCreatedIdx: (0, import_sqlite_core.index)("idx_gateway_outbound_branch_created").on(
+          table.target_branch_id,
+          table.created_at
+        ),
+        consumedIdx: (0, import_sqlite_core.index)("idx_gateway_outbound_consumed").on(table.consumed_at)
+      })
+    );
     sessionEnvSelections2 = (0, import_sqlite_core.sqliteTable)(
       "session_env_selections",
       {
@@ -3196,7 +3660,7 @@ var init_schema_sqlite = __esm({
         archivedIdx: (0, import_sqlite_core.index)("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
-    sessionsRelations2 = (0, import_drizzle_orm2.relations)(sessions2, ({ one }) => ({
+    sessionsRelations2 = (0, import_drizzle_orm2.relations)(sessions2, ({ one, many }) => ({
       branch: one(branches2, {
         fields: [sessions2.branch_id],
         references: [branches2.branch_id]
@@ -3204,6 +3668,24 @@ var init_schema_sqlite = __esm({
       schedule: one(schedules2, {
         fields: [sessions2.schedule_id],
         references: [schedules2.schedule_id]
+      }),
+      outboundRelationships: many(sessionRelationships2, { relationName: "relationshipSource" }),
+      inboundRelationships: many(sessionRelationships2, { relationName: "relationshipTarget" })
+    }));
+    sessionRelationshipsRelations2 = (0, import_drizzle_orm2.relations)(sessionRelationships2, ({ one }) => ({
+      sourceSession: one(sessions2, {
+        fields: [sessionRelationships2.source_session_id],
+        references: [sessions2.session_id],
+        relationName: "relationshipSource"
+      }),
+      targetSession: one(sessions2, {
+        fields: [sessionRelationships2.target_session_id],
+        references: [sessions2.session_id],
+        relationName: "relationshipTarget"
+      }),
+      callbackSession: one(sessions2, {
+        fields: [sessionRelationships2.callback_session_id],
+        references: [sessions2.session_id]
       })
     }));
     branchesRelations2 = (0, import_drizzle_orm2.relations)(branches2, ({ many }) => ({
@@ -3265,6 +3747,17 @@ var init_schema_factory = __esm({
   }
 });
 
+// src/db/tenant-context.ts
+var import_node_async_hooks, tenantDatabaseScope;
+var init_tenant_context = __esm({
+  "src/db/tenant-context.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_async_hooks = require("async_hooks");
+    tenantDatabaseScope = new import_node_async_hooks.AsyncLocalStorage();
+  }
+});
+
 // src/db/database-wrapper.ts
 var import_drizzle_orm3;
 var init_database_wrapper = __esm({
@@ -3272,11 +3765,12 @@ var init_database_wrapper = __esm({
     "use strict";
     init_cjs_shims();
     import_drizzle_orm3 = require("drizzle-orm");
+    init_tenant_context();
   }
 });
 
 // src/db/schema.ts
-var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
+var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionRelationships3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, gatewayOutboundMessages3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
 var init_schema = __esm({
   "src/db/schema.ts"() {
     "use strict";
@@ -3308,11 +3802,13 @@ var init_schema = __esm({
     artifactTrustGrants3 = schema.artifactTrustGrants;
     boardObjects3 = schema.boardObjects;
     sessionMcpServers3 = schema.sessionMcpServers;
+    sessionRelationships3 = schema.sessionRelationships;
     sessionEnvSelections3 = schema.sessionEnvSelections;
     userMcpOauthTokens3 = schema.userMcpOauthTokens;
     boardComments3 = schema.boardComments;
     gatewayChannels3 = schema.gatewayChannels;
     threadSessionMap3 = schema.threadSessionMap;
+    gatewayOutboundMessages3 = schema.gatewayOutboundMessages;
     userApiKeys3 = schema.userApiKeys;
     serializedSessions3 = schema.serializedSessions;
     kbNamespaces3 = schema.kbNamespaces;
@@ -3326,31 +3822,46 @@ var init_schema = __esm({
   }
 });
 
+// src/db/tenant-scope.ts
+var import_drizzle_orm4;
+var init_tenant_scope = __esm({
+  "src/db/tenant-scope.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_drizzle_orm4 = require("drizzle-orm");
+    init_tenant_context();
+    init_tenant_context();
+    init_database_wrapper();
+  }
+});
+
 // src/db/user-utils.ts
-var import_bcryptjs, import_drizzle_orm4;
+var import_bcryptjs, import_drizzle_orm5;
 var init_user_utils = __esm({
   "src/db/user-utils.ts"() {
     "use strict";
     init_cjs_shims();
     import_bcryptjs = __toESM(require("bcryptjs"), 1);
-    import_drizzle_orm4 = require("drizzle-orm");
+    import_drizzle_orm5 = require("drizzle-orm");
     init_ids();
     init_user();
     init_database_wrapper();
     init_schema();
+    init_tenant_scope();
   }
 });
 
 // src/db/first-run-bootstrap.ts
-var import_node_crypto3, import_drizzle_orm5;
+var import_node_crypto3, import_drizzle_orm6;
 var init_first_run_bootstrap = __esm({
   "src/db/first-run-bootstrap.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_crypto3 = require("crypto");
-    import_drizzle_orm5 = require("drizzle-orm");
+    import_drizzle_orm6 = require("drizzle-orm");
     init_database_wrapper();
     init_schema();
+    init_tenant_scope();
     init_user_utils();
   }
 });
@@ -3485,7 +3996,7 @@ init_cjs_shims();
 
 // src/db/index.ts
 init_cjs_shims();
-var import_drizzle_orm33 = require("drizzle-orm");
+var import_drizzle_orm36 = require("drizzle-orm");
 var import_bcryptjs3 = __toESM(require("bcryptjs"), 1);
 init_ids();
 
@@ -3522,11 +4033,12 @@ init_first_run_bootstrap();
 init_cjs_shims();
 var import_node_path4 = require("path");
 var import_node_url = require("url");
-var import_drizzle_orm6 = require("drizzle-orm");
+var import_drizzle_orm7 = require("drizzle-orm");
 var import_migrator = require("drizzle-orm/libsql/migrator");
 var import_migrator2 = require("drizzle-orm/postgres-js/migrator");
 init_database_wrapper();
 init_schema();
+init_tenant_scope();
 
 // src/db/pending-migrations.ts
 init_cjs_shims();
@@ -3536,7 +4048,7 @@ init_cjs_shims();
 
 // src/db/repositories/app-variables.ts
 init_cjs_shims();
-var import_drizzle_orm7 = require("drizzle-orm");
+var import_drizzle_orm8 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -3545,17 +4057,18 @@ init_schema();
 init_cjs_shims();
 init_ids();
 init_id();
+init_tenant_context();
 
 // src/db/repositories/artifact-trust.ts
 init_cjs_shims();
-var import_drizzle_orm8 = require("drizzle-orm");
+var import_drizzle_orm9 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/artifacts.ts
 init_cjs_shims();
-var import_drizzle_orm9 = require("drizzle-orm");
+var import_drizzle_orm11 = require("drizzle-orm");
 init_config_manager();
 init_ids();
 
@@ -3567,16 +4080,26 @@ init_id();
 init_database_wrapper();
 init_schema();
 
-// src/db/repositories/board-comments.ts
+// src/db/repositories/branch-access.ts
 init_cjs_shims();
+init_types2();
 var import_drizzle_orm10 = require("drizzle-orm");
+init_database_wrapper();
+init_schema();
+var VISIBLE_BRANCH_PERMISSION_LEVELS = BRANCH_PERMISSION_LEVELS.filter(
+  (level) => level !== "none"
+);
+
+// src/db/repositories/board-comments.ts
+init_cjs_shims();
+var import_drizzle_orm12 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/board-objects.ts
 init_cjs_shims();
-var import_drizzle_orm12 = require("drizzle-orm");
+var import_drizzle_orm13 = require("drizzle-orm");
 init_ids();
 
 // src/utils/board-placement.ts
@@ -3586,30 +4109,46 @@ init_cjs_shims();
 init_database_wrapper();
 init_schema();
 
-// src/db/repositories/branch-access.ts
-init_cjs_shims();
-init_types2();
-var import_drizzle_orm11 = require("drizzle-orm");
-init_database_wrapper();
-init_schema();
-var VISIBLE_BRANCH_PERMISSION_LEVELS = BRANCH_PERMISSION_LEVELS.filter(
-  (level) => level !== "none"
-);
-
 // src/db/repositories/boards.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm15 = require("drizzle-orm");
+var import_drizzle_orm16 = require("drizzle-orm");
 var yaml2 = __toESM(require("js-yaml"), 1);
 init_config_manager();
 init_ids();
+
+// src/utils/emoji-shortcodes.ts
+init_cjs_shims();
+var import_node_module = require("module");
+var requireJson = (0, import_node_module.createRequire)(importMetaUrl);
+var emojiData = requireJson("emojibase-data/en/compact.json");
+var shortcodes = requireJson(
+  "emojibase-data/en/shortcodes/emojibase.json"
+);
+var emojiByHexcode = /* @__PURE__ */ new Map();
+for (const emoji of emojiData) {
+  if (emoji.unicode) {
+    emojiByHexcode.set(emoji.hexcode, emoji.unicode);
+  }
+}
+var emojiByShortcode = /* @__PURE__ */ new Map();
+for (const [hexcode, codes] of Object.entries(shortcodes)) {
+  const emoji = emojiByHexcode.get(hexcode);
+  if (!emoji) continue;
+  const codeList = Array.isArray(codes) ? codes : [codes];
+  for (const code of codeList) {
+    emojiByShortcode.set(code.toLowerCase(), emoji);
+  }
+}
+
+// src/db/repositories/boards.ts
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/branches.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm14 = require("drizzle-orm");
+var import_drizzle_orm15 = require("drizzle-orm");
 init_config_manager();
 init_ids();
 init_database_wrapper();
@@ -3617,7 +4156,7 @@ init_schema();
 
 // src/db/repositories/groups.ts
 init_cjs_shims();
-var import_drizzle_orm13 = require("drizzle-orm");
+var import_drizzle_orm14 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -3632,14 +4171,14 @@ var BRANCH_PERMISSION_RANK = Object.fromEntries(
 
 // src/db/repositories/card-types.ts
 init_cjs_shims();
-var import_drizzle_orm16 = require("drizzle-orm");
+var import_drizzle_orm17 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/cards.ts
 init_cjs_shims();
-var import_drizzle_orm17 = require("drizzle-orm");
+var import_drizzle_orm18 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -3647,7 +4186,15 @@ init_schema();
 // src/db/repositories/gateway-channels.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm18 = require("drizzle-orm");
+var import_drizzle_orm19 = require("drizzle-orm");
+init_ids();
+init_database_wrapper();
+init_schema();
+
+// src/db/repositories/gateway-outbound-messages.ts
+init_cjs_shims();
+init_types2();
+var import_drizzle_orm20 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -3656,7 +4203,7 @@ init_schema();
 init_cjs_shims();
 var import_node_crypto4 = require("crypto");
 init_types2();
-var import_drizzle_orm19 = require("drizzle-orm");
+var import_drizzle_orm21 = require("drizzle-orm");
 init_config_manager();
 init_ids();
 init_database_wrapper();
@@ -3664,7 +4211,7 @@ init_schema();
 
 // src/db/repositories/mcp-servers.ts
 init_cjs_shims();
-var import_drizzle_orm20 = require("drizzle-orm");
+var import_drizzle_orm22 = require("drizzle-orm");
 init_ids();
 
 // src/tools/mcp/auth-secrets.ts
@@ -3679,23 +4226,20 @@ init_schema();
 
 // src/db/repositories/messages.ts
 init_cjs_shims();
-var import_drizzle_orm21 = require("drizzle-orm");
+var import_drizzle_orm23 = require("drizzle-orm");
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/repos.ts
 init_cjs_shims();
-var import_drizzle_orm22 = require("drizzle-orm");
+var import_drizzle_orm24 = require("drizzle-orm");
 
 // src/config/variant-resolver.ts
 init_cjs_shims();
 
 // src/yaml/index.ts
 init_cjs_shims();
-var import_js_yaml2 = __toESM(require("js-yaml"), 1);
-var load2 = import_js_yaml2.default.load;
-var dump2 = import_js_yaml2.default.dump;
-var YAMLException = import_js_yaml2.default.YAMLException;
+var yaml3 = __toESM(require("js-yaml"), 1);
 
 // src/db/repositories/repos.ts
 init_ids();
@@ -3704,43 +4248,50 @@ init_schema();
 
 // src/db/repositories/schedules.ts
 init_cjs_shims();
-var import_drizzle_orm23 = require("drizzle-orm");
+var import_drizzle_orm25 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/serialized-sessions.ts
 init_cjs_shims();
-var import_drizzle_orm24 = require("drizzle-orm");
+var import_drizzle_orm26 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/session-env-selections.ts
 init_cjs_shims();
-var import_drizzle_orm25 = require("drizzle-orm");
+var import_drizzle_orm27 = require("drizzle-orm");
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/session-mcp-servers.ts
 init_cjs_shims();
-var import_drizzle_orm27 = require("drizzle-orm");
+var import_drizzle_orm29 = require("drizzle-orm");
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/sessions.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm26 = require("drizzle-orm");
+var import_drizzle_orm28 = require("drizzle-orm");
 init_config_manager();
 init_ids();
 init_database_wrapper();
 init_schema();
 
+// src/db/repositories/session-relationships.ts
+init_cjs_shims();
+var import_drizzle_orm30 = require("drizzle-orm");
+init_ids();
+init_database_wrapper();
+init_schema();
+
 // src/db/repositories/tasks.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm28 = require("drizzle-orm");
+var import_drizzle_orm31 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -3748,7 +4299,7 @@ init_schema();
 // src/db/repositories/thread-session-map.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm29 = require("drizzle-orm");
+var import_drizzle_orm32 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -3757,21 +4308,22 @@ init_schema();
 init_cjs_shims();
 var import_node_crypto5 = require("crypto");
 var import_bcryptjs2 = __toESM(require("bcryptjs"), 1);
-var import_drizzle_orm30 = require("drizzle-orm");
+var import_drizzle_orm33 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
+init_tenant_context();
 
 // src/db/repositories/user-mcp-oauth-tokens.ts
 init_cjs_shims();
-var import_drizzle_orm31 = require("drizzle-orm");
+var import_drizzle_orm34 = require("drizzle-orm");
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/users.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm32 = require("drizzle-orm");
+var import_drizzle_orm35 = require("drizzle-orm");
 
 // src/config/env-vars.ts
 init_cjs_shims();
@@ -3791,6 +4343,7 @@ init_cjs_shims();
 init_ids();
 
 // src/db/index.ts
+init_tenant_scope();
 init_user_utils();
 var compare = import_bcryptjs3.default.compare;
 var hash = import_bcryptjs3.default.hash;
@@ -3844,8 +4397,8 @@ function extractTasksFromMessages(messages4, sessionId) {
     const userMessage = messages4[startIndex];
     const endIndex = i < userMessageIndices.length - 1 ? userMessageIndices[i + 1] - 1 : messages4.length - 1;
     const messagesInRange = messages4.slice(startIndex, endIndex + 1);
-    const toolUseCount = messagesInRange.reduce((count, msg) => {
-      return count + (msg.tool_uses?.length ?? 0);
+    const toolUseCount = messagesInRange.reduce((count2, msg) => {
+      return count2 + (msg.tool_uses?.length ?? 0);
     }, 0);
     let fullPrompt = "";
     if (typeof userMessage.content === "string") {