agor-live 0.22.0 → 0.23.1

package/dist/core/mcp/index.js

@@ -10,6 +10,10 @@ import { eq as eq2 } from "drizzle-orm";
 // src/db/database-wrapper.ts
 import { sql } from "drizzle-orm";
 
+// src/db/tenant-context.ts
+import { AsyncLocalStorage } from "async_hooks";
+var tenantDatabaseScope = new AsyncLocalStorage();
+
 // src/db/encryption.ts
 import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "crypto";
 
@@ -34,6 +38,7 @@ __export(schema_postgres_exports, {
   cardTypes: () => cardTypes,
   cards: () => cards,
   gatewayChannels: () => gatewayChannels,
+  gatewayOutboundMessages: () => gatewayOutboundMessages,
   groupMemberships: () => groupMemberships,
   groups: () => groups,
   kbDocumentUnits: () => kbDocumentUnits,
@@ -176,6 +181,7 @@ var t = {
 var sessions = pgTable(
   "sessions",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     // Primary identity
     session_id: varchar("session_id", { length: 36 }).primaryKey(),
     created_at: t.timestamp("created_at").notNull(),
@@ -235,7 +241,9 @@ var sessions = pgTable(
     data: t.json("data").$type().notNull()
   },
   (table) => ({
+    tenantIdx: index("sessions_tenant_id_idx").on(table.tenant_id),
     statusIdx: index("sessions_status_idx").on(table.status),
+    statusReadyIdx: index("sessions_status_ready_idx").on(table.status, table.ready_for_prompt),
     agenticToolIdx: index("sessions_agentic_tool_idx").on(table.agentic_tool),
     boardIdx: index("sessions_board_idx").on(table.board_id),
     branchIdx: index("sessions_branch_idx").on(table.branch_id),
@@ -247,12 +255,13 @@ var sessions = pgTable(
     // Partial unique index — covering for the scheduler's dedup lookup
     // AND serves as the DB-level guard against check-then-create races
     // in spawnScheduledSession.
-    scheduleRunUnique: uniqueIndex("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(sql2`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
+    scheduleRunUnique: uniqueIndex("sessions_schedule_run_unique").on(table.tenant_id, table.schedule_id, table.scheduled_run_at).where(sql2`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
   })
 );
 var sessionRelationships = pgTable(
   "session_relationships",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     relationship_id: varchar("relationship_id", { length: 36 }).primaryKey(),
     source_session_id: varchar("source_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
     target_session_id: varchar("target_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
@@ -270,10 +279,23 @@ var sessionRelationships = pgTable(
     data: t.json("data")
   },
   (table) => ({
+    tenantIdx: index("session_relationships_tenant_id_idx").on(table.tenant_id),
     sourceIdx: index("session_relationships_source_idx").on(table.source_session_id),
     targetIdx: index("session_relationships_target_idx").on(table.target_session_id),
     callbackIdx: index("session_relationships_callback_idx").on(table.callback_session_id),
+    // Composite indexes so the OR predicate in dispatchCompletionCallbacks
+    // (WHERE source_session_id = $1 OR target_session_id = $2) uses BitmapOr
+    // over these instead of a full tenant table scan via tenant_id_idx.
+    tenantSourceIdx: index("session_relationships_tenant_source_idx").on(
+      table.tenant_id,
+      table.source_session_id
+    ),
+    tenantTargetIdx: index("session_relationships_tenant_target_idx").on(
+      table.tenant_id,
+      table.target_session_id
+    ),
     sourceTargetTypeUnique: uniqueIndex("session_relationships_source_target_type_unique").on(
+      table.tenant_id,
       table.source_session_id,
       table.target_session_id,
       table.relationship_type
@@ -283,6 +305,7 @@ var sessionRelationships = pgTable(
 var tasks = pgTable(
   "tasks",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     task_id: varchar("task_id", { length: 36 }).primaryKey(),
     session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
     created_at: t.timestamp("created_at").notNull(),
@@ -312,19 +335,23 @@ var tasks = pgTable(
     data: t.json("data").$type().notNull()
   },
   (table) => ({
+    tenantIdx: index("tasks_tenant_id_idx").on(table.tenant_id),
     sessionIdx: index("tasks_session_idx").on(table.session_id),
     statusIdx: index("tasks_status_idx").on(table.status),
     createdIdx: index("tasks_created_idx").on(table.created_at),
+    // Composite for "latest task for session" queries (ORDER BY created_at DESC LIMIT 1).
+    sessionCreatedIdx: index("tasks_session_created_idx").on(table.session_id, table.created_at),
     queueIdx: index("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
     // Partial unique index — defense-in-depth for `tasks.createPending` race
     // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
     // rows have NULL queue_position and are unaffected.
-    queuedPositionUnique: uniqueIndex("tasks_queued_position_unique").on(table.session_id, table.queue_position).where(sql2`${table.status} = 'queued'`)
+    queuedPositionUnique: uniqueIndex("tasks_queued_position_unique").on(table.tenant_id, table.session_id, table.queue_position).where(sql2`${table.status} = 'queued'`)
   })
 );
 var serializedSessions = pgTable(
   "serialized_sessions",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     id: varchar("id", { length: 36 }).primaryKey(),
     session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
     branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
@@ -340,6 +367,7 @@ var serializedSessions = pgTable(
     // gzipped; NULL while status='processing'
   },
   (table) => ({
+    tenantIdx: index("serialized_sessions_tenant_id_idx").on(table.tenant_id),
     sessionTurnIdx: index("serialized_sessions_session_turn_idx").on(
       table.session_id,
       table.turn_index
@@ -350,6 +378,7 @@ var serializedSessions = pgTable(
 var messages = pgTable(
   "messages",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     // Primary identity
     message_id: varchar("message_id", { length: 36 }).primaryKey(),
     created_at: t.timestamp("created_at").notNull(),
@@ -389,15 +418,23 @@ var messages = pgTable(
     data: t.json("data").$type().notNull()
   },
   (table) => ({
+    tenantIdx: index("messages_tenant_id_idx").on(table.tenant_id),
+    tenantTimestampIdx: index("messages_tenant_timestamp_idx").on(table.tenant_id, table.timestamp),
     // Indexes for efficient lookups
     sessionIdx: index("messages_session_id_idx").on(table.session_id),
     taskIdx: index("messages_task_id_idx").on(table.task_id),
-    sessionIndexIdx: index("messages_session_index_idx").on(table.session_id, table.index)
+    sessionIndexIdx: index("messages_session_index_idx").on(table.session_id, table.index),
+    timestampIdx: index("messages_timestamp_idx").on(table.timestamp),
+    sessionTimestampIdx: index("messages_session_timestamp_idx").on(
+      table.session_id,
+      table.timestamp
+    )
   })
 );
 var boards = pgTable(
   "boards",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     board_id: varchar("board_id", { length: 36 }).primaryKey(),
     created_at: t.timestamp("created_at").notNull(),
     updated_at: t.timestamp("updated_at"),
@@ -405,7 +442,7 @@ var boards = pgTable(
     created_by: varchar("created_by", { length: 36 }).notNull(),
     // Materialized for lookups
     name: text("name").notNull(),
-    slug: text("slug").unique(),
+    slug: text("slug"),
     primary_assistant_id: varchar("primary_assistant_id", { length: 36 }).references(
       () => branches.branch_id,
       {
@@ -420,18 +457,21 @@ var boards = pgTable(
     archived_by: varchar("archived_by", { length: 36 })
   },
   (table) => ({
+    tenantIdx: index("boards_tenant_id_idx").on(table.tenant_id),
     nameIdx: index("boards_name_idx").on(table.name),
-    slugIdx: index("boards_slug_idx").on(table.slug)
+    slugIdx: index("boards_slug_idx").on(table.slug),
+    slugTenantUnique: uniqueIndex("boards_tenant_slug_unique").on(table.tenant_id, table.slug)
   })
 );
 var repos = pgTable(
   "repos",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     repo_id: varchar("repo_id", { length: 36 }).primaryKey(),
     created_at: t.timestamp("created_at").notNull(),
     updated_at: t.timestamp("updated_at"),
     // Materialized for querying
-    slug: text("slug").notNull().unique(),
+    slug: text("slug").notNull(),
     repo_type: text("repo_type", { enum: ["remote", "local"] }).notNull().default("remote"),
     // Unix group for repo-level git access (agor_rp_<short-id>)
     // Users who have access to ANY branch in this repo get added to this group.
@@ -442,12 +482,15 @@ var repos = pgTable(
     data: t.json("data").$type().notNull()
   },
   (table) => ({
-    slugIdx: index("repos_slug_idx").on(table.slug)
+    tenantIdx: index("repos_tenant_id_idx").on(table.tenant_id),
+    slugIdx: index("repos_slug_idx").on(table.slug),
+    slugTenantUnique: uniqueIndex("repos_tenant_slug_unique").on(table.tenant_id, table.slug)
   })
 );
 var branches = pgTable(
   "branches",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     // Primary identity
     branch_id: varchar("branch_id", { length: 36 }).primaryKey(),
     repo_id: varchar("repo_id", { length: 36 }).notNull().references(() => repos.repo_id, { onDelete: "cascade" }),
@@ -522,6 +565,7 @@ var branches = pgTable(
     data: t.json("data").$type().notNull()
   },
   (table) => ({
+    tenantIdx: index("branches_tenant_id_idx").on(table.tenant_id),
     repoIdx: index("branches_repo_idx").on(table.repo_id),
     nameIdx: index("branches_name_idx").on(table.name),
     refIdx: index("branches_ref_idx").on(table.ref),
@@ -535,22 +579,26 @@ var branches = pgTable(
 var branchOwners = pgTable(
   "branch_owners",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
     user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
     created_at: t.timestamp("created_at").defaultNow()
   },
   (table) => ({
+    tenantIdx: index("branch_owners_tenant_id_idx").on(table.tenant_id),
     pk: primaryKey({ columns: [table.branch_id, table.user_id] })
   })
 );
 var boardOwners = pgTable(
   "board_owners",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
     user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
     created_at: t.timestamp("created_at")
   },
   (table) => ({
+    tenantIdx: index("board_owners_tenant_id_idx").on(table.tenant_id),
     pk: primaryKey({ columns: [table.board_id, table.user_id] }),
     userIdx: index("board_owners_user_idx").on(table.user_id)
   })
@@ -558,6 +606,7 @@ var boardOwners = pgTable(
 var schedules = pgTable(
   "schedules",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     schedule_id: varchar("schedule_id", { length: 36 }).primaryKey(),
     branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
     name: text("name").notNull(),
@@ -581,6 +630,7 @@ var schedules = pgTable(
     created_by: varchar("created_by", { length: 36 }).notNull().references(() => users.user_id)
   },
   (table) => ({
+    tenantIdx: index("schedules_tenant_id_idx").on(table.tenant_id),
     enabledNextRunIdx: index("schedules_enabled_next_run_idx").on(table.enabled, table.next_run_at),
     branchIdx: index("schedules_branch_idx").on(table.branch_id),
     createdByIdx: index("schedules_created_by_idx").on(table.created_by)
@@ -589,12 +639,13 @@ var schedules = pgTable(
 var users = pgTable(
   "users",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     // Primary identity
     user_id: varchar("user_id", { length: 36 }).primaryKey(),
     created_at: t.timestamp("created_at").notNull(),
     updated_at: t.timestamp("updated_at"),
     // Materialized for auth lookups
-    email: text("email").unique().notNull(),
+    email: text("email").notNull(),
     password: text("password").notNull(),
     // bcrypt hashed
     // Basic profile (materialized for display)
@@ -610,16 +661,22 @@ var users = pgTable(
     onboarding_completed: t.bool("onboarding_completed").notNull().default(false),
     // Force password change flag (admin-settable, auto-cleared on password change)
     must_change_password: t.bool("must_change_password").notNull().default(false),
+    // Auth invalidation marker. Password changes set this timestamp so any
+    // previously issued browser access or refresh token is rejected.
+    tokens_valid_after: t.timestamp("tokens_valid_after"),
     // JSON blob for profile/preferences
     data: t.json("data").$type().notNull()
   },
   (table) => ({
-    emailIdx: index("users_email_idx").on(table.email)
+    tenantIdx: index("users_tenant_id_idx").on(table.tenant_id),
+    emailIdx: index("users_email_idx").on(table.email),
+    emailTenantUnique: uniqueIndex("users_tenant_email_unique").on(table.tenant_id, table.email)
   })
 );
 var groups = pgTable(
   "groups",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     group_id: varchar("group_id", { length: 36 }).primaryKey(),
     name: text("name").notNull(),
     slug: text("slug").notNull(),
@@ -632,13 +689,15 @@ var groups = pgTable(
     updated_at: t.timestamp("updated_at")
   },
   (table) => ({
-    slugIdx: uniqueIndex("groups_slug_idx").on(table.slug),
+    tenantIdx: index("groups_tenant_id_idx").on(table.tenant_id),
+    slugIdx: uniqueIndex("groups_tenant_slug_unique").on(table.tenant_id, table.slug),
     archivedIdx: index("groups_archived_idx").on(table.archived)
   })
 );
 var groupMemberships = pgTable(
   "group_memberships",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     group_id: varchar("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
     user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
     added_by: varchar("added_by", { length: 36 }).references(() => users.user_id, {
@@ -647,6 +706,7 @@ var groupMemberships = pgTable(
     created_at: t.timestamp("created_at").notNull()
   },
   (table) => ({
+    tenantIdx: index("group_memberships_tenant_id_idx").on(table.tenant_id),
     pk: primaryKey({ columns: [table.group_id, table.user_id] }),
     userIdx: index("group_memberships_user_idx").on(table.user_id)
   })
@@ -654,6 +714,7 @@ var groupMemberships = pgTable(
 var branchGroupGrants = pgTable(
   "branch_group_grants",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
     group_id: varchar("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
     can: text("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
@@ -665,6 +726,7 @@ var branchGroupGrants = pgTable(
     updated_at: t.timestamp("updated_at")
   },
   (table) => ({
+    tenantIdx: index("branch_group_grants_tenant_id_idx").on(table.tenant_id),
     pk: primaryKey({ columns: [table.branch_id, table.group_id] }),
     groupIdx: index("branch_group_grants_group_idx").on(table.group_id)
   })
@@ -672,6 +734,7 @@ var branchGroupGrants = pgTable(
 var boardGroupGrants = pgTable(
   "board_group_grants",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
     group_id: varchar("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
     can: text("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
@@ -683,6 +746,7 @@ var boardGroupGrants = pgTable(
     updated_at: t.timestamp("updated_at")
   },
   (table) => ({
+    tenantIdx: index("board_group_grants_tenant_id_idx").on(table.tenant_id),
     pk: primaryKey({ columns: [table.board_id, table.group_id] }),
     groupIdx: index("board_group_grants_group_idx").on(table.group_id)
   })
@@ -690,6 +754,7 @@ var boardGroupGrants = pgTable(
 var appVariables = pgTable(
   "app_variables",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     variable_id: varchar("variable_id", { length: 36 }).primaryKey(),
     namespace: text("namespace").notNull(),
     key: text("key").notNull(),
@@ -705,13 +770,19 @@ var appVariables = pgTable(
     updated_at: t.timestamp("updated_at").notNull()
   },
   (table) => ({
-    namespaceKeyIdx: uniqueIndex("app_variables_namespace_key_idx").on(table.namespace, table.key),
+    tenantIdx: index("app_variables_tenant_id_idx").on(table.tenant_id),
+    namespaceKeyIdx: uniqueIndex("app_variables_tenant_namespace_key_unique").on(
+      table.tenant_id,
+      table.namespace,
+      table.key
+    ),
     namespaceIdx: index("app_variables_namespace_idx").on(table.namespace)
   })
 );
 var userApiKeys = pgTable(
   "user_api_keys",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     id: varchar("id", { length: 36 }).primaryKey(),
     user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
     name: text("name").notNull(),
@@ -723,6 +794,7 @@ var userApiKeys = pgTable(
     last_used_at: t.timestamp("last_used_at")
   },
   (table) => ({
+    tenantIdx: index("user_api_keys_tenant_id_idx").on(table.tenant_id),
     userIdx: index("user_api_keys_user_idx").on(table.user_id),
     prefixIdx: index("user_api_keys_prefix_idx").on(table.prefix)
   })
@@ -730,6 +802,7 @@ var userApiKeys = pgTable(
 var mcpServers = pgTable(
   "mcp_servers",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     // Primary identity
     mcp_server_id: varchar("mcp_server_id", { length: 36 }).primaryKey(),
     created_at: t.timestamp("created_at").notNull(),
@@ -756,6 +829,7 @@ var mcpServers = pgTable(
     data: t.json("data").$type().notNull()
   },
   (table) => ({
+    tenantIdx: index("mcp_servers_tenant_id_idx").on(table.tenant_id),
     nameIdx: index("mcp_servers_name_idx").on(table.name),
     scopeIdx: index("mcp_servers_scope_idx").on(table.scope),
     ownerIdx: index("mcp_servers_owner_idx").on(table.owner_user_id),
@@ -765,6 +839,7 @@ var mcpServers = pgTable(
 var cardTypes = pgTable(
   "card_types",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     card_type_id: varchar("card_type_id", { length: 36 }).primaryKey(),
     name: text("name").notNull(),
     emoji: text("emoji"),
@@ -776,12 +851,14 @@ var cardTypes = pgTable(
     updated_at: t.timestamp("updated_at").notNull()
   },
   (table) => ({
+    tenantIdx: index("card_types_tenant_id_idx").on(table.tenant_id),
     nameIdx: index("card_types_name_idx").on(table.name)
   })
 );
 var cards = pgTable(
   "cards",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     card_id: varchar("card_id", { length: 36 }).primaryKey(),
     board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
     card_type_id: varchar("card_type_id", { length: 36 }).references(() => cardTypes.card_type_id, {
@@ -802,6 +879,7 @@ var cards = pgTable(
     archived_at: t.timestamp("archived_at")
   },
   (table) => ({
+    tenantIdx: index("cards_tenant_id_idx").on(table.tenant_id),
     boardIdx: index("cards_board_idx").on(table.board_id),
     cardTypeIdx: index("cards_card_type_idx").on(table.card_type_id),
     titleIdx: index("cards_title_idx").on(table.title),
@@ -812,6 +890,7 @@ var cards = pgTable(
 var artifacts = pgTable(
   "artifacts",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     artifact_id: varchar("artifact_id", { length: 36 }).primaryKey(),
     branch_id: varchar("branch_id", { length: 36 }).references(() => branches.branch_id, {
       onDelete: "set null"
@@ -847,6 +926,7 @@ var artifacts = pgTable(
     archived_at: t.timestamp("archived_at")
   },
   (table) => ({
+    tenantIdx: index("artifacts_tenant_id_idx").on(table.tenant_id),
     branchIdx: index("artifacts_branch_idx").on(table.branch_id),
     sourceSessionIdx: index("artifacts_source_session_idx").on(table.source_session_id),
     boardIdx: index("artifacts_board_idx").on(table.board_id),
@@ -857,6 +937,7 @@ var artifacts = pgTable(
 var artifactTrustGrants = pgTable(
   "artifact_trust_grants",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     grant_id: varchar("grant_id", { length: 36 }).primaryKey(),
     user_id: varchar("user_id", { length: 36 }).notNull(),
     scope_type: text("scope_type").notNull(),
@@ -867,6 +948,7 @@ var artifactTrustGrants = pgTable(
     revoked_at: t.timestamp("revoked_at")
   },
   (table) => ({
+    tenantIdx: index("artifact_trust_grants_tenant_id_idx").on(table.tenant_id),
     userIdx: index("artifact_trust_grants_user_idx").on(table.user_id),
     scopeIdx: index("artifact_trust_grants_scope_idx").on(table.scope_type, table.scope_value)
   })
@@ -874,6 +956,7 @@ var artifactTrustGrants = pgTable(
 var boardObjects = pgTable(
   "board_objects",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     // Primary identity
     object_id: varchar("object_id", { length: 36 }).primaryKey(),
     board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
@@ -889,6 +972,7 @@ var boardObjects = pgTable(
     data: t.json("data").$type().notNull()
   },
   (table) => ({
+    tenantIdx: index("board_objects_tenant_id_idx").on(table.tenant_id),
     boardIdx: index("board_objects_board_idx").on(table.board_id),
     branchIdx: index("board_objects_branch_idx").on(table.branch_id),
     cardIdx: index("board_objects_card_idx").on(table.card_id)
@@ -897,12 +981,14 @@ var boardObjects = pgTable(
 var sessionMcpServers = pgTable(
   "session_mcp_servers",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
     mcp_server_id: varchar("mcp_server_id", { length: 36 }).notNull().references(() => mcpServers.mcp_server_id, { onDelete: "cascade" }),
     enabled: t.bool("enabled").notNull().default(true),
     added_at: t.timestamp("added_at").notNull()
   },
   (table) => ({
+    tenantIdx: index("session_mcp_servers_tenant_id_idx").on(table.tenant_id),
     // Composite primary key
     pk: index("session_mcp_servers_pk").on(table.session_id, table.mcp_server_id),
     // Indexes for queries
@@ -914,6 +1000,7 @@ var sessionMcpServers = pgTable(
 var userMcpOauthTokens = pgTable(
   "user_mcp_oauth_tokens",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     // NULL = shared-mode token (one per mcp_server_id)
     user_id: varchar("user_id", { length: 36 }).references(() => users.user_id, {
       onDelete: "cascade"
@@ -931,6 +1018,7 @@ var userMcpOauthTokens = pgTable(
     updated_at: t.timestamp("updated_at")
   },
   (table) => ({
+    tenantIdx: index("user_mcp_oauth_tokens_tenant_id_idx").on(table.tenant_id),
     // Composite lookup indexes. Uniqueness enforced via partial unique indexes
     // created in the migration (one for per-user rows, one for the shared row).
     pk: index("user_mcp_oauth_tokens_pk").on(table.user_id, table.mcp_server_id),
@@ -941,6 +1029,7 @@ var userMcpOauthTokens = pgTable(
 var boardComments = pgTable(
   "board_comments",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     // Primary identity
     comment_id: varchar("comment_id", { length: 36 }).primaryKey(),
     created_at: t.timestamp("created_at").notNull(),
@@ -982,6 +1071,7 @@ var boardComments = pgTable(
     data: t.json("data").$type().notNull()
   },
   (table) => ({
+    tenantIdx: index("board_comments_tenant_id_idx").on(table.tenant_id),
     boardIdx: index("board_comments_board_idx").on(table.board_id),
     sessionIdx: index("board_comments_session_idx").on(table.session_id),
     taskIdx: index("board_comments_task_idx").on(table.task_id),
@@ -996,6 +1086,7 @@ var boardComments = pgTable(
 var gatewayChannels = pgTable(
   "gateway_channels",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     // Primary identity
     id: varchar("id", { length: 36 }).primaryKey(),
     created_at: t.timestamp("created_at").notNull(),
@@ -1009,7 +1100,7 @@ var gatewayChannels = pgTable(
     }).notNull(),
     target_branch_id: varchar("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
     agor_user_id: varchar("agor_user_id", { length: 36 }).notNull(),
-    channel_key: text("channel_key").notNull().unique(),
+    channel_key: text("channel_key").notNull(),
     enabled: t.bool("enabled").notNull().default(true),
     last_message_at: t.timestamp("last_message_at"),
     // JSON blob for platform credentials (encrypted at rest)
@@ -1018,13 +1109,19 @@ var gatewayChannels = pgTable(
     agentic_config: t.json("agentic_config")
   },
   (table) => ({
+    tenantIdx: index("gateway_channels_tenant_id_idx").on(table.tenant_id),
     channelKeyIdx: index("idx_gateway_channel_key").on(table.channel_key),
+    channelKeyTenantUnique: uniqueIndex("gateway_channels_tenant_channel_key_unique").on(
+      table.tenant_id,
+      table.channel_key
+    ),
     enabledTypeIdx: index("idx_gateway_enabled_type").on(table.enabled, table.channel_type)
   })
 );
 var threadSessionMap = pgTable(
   "thread_session_map",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     // Primary identity
     id: varchar("id", { length: 36 }).primaryKey(),
     created_at: t.timestamp("created_at").notNull(),
@@ -1042,7 +1139,9 @@ var threadSessionMap = pgTable(
     metadata: t.json("metadata")
   },
   (table) => ({
-    uniqueChannelThread: uniqueIndex("uniq_thread_map_channel_thread").on(
+    tenantIdx: index("thread_session_map_tenant_id_idx").on(table.tenant_id),
+    uniqueChannelThread: uniqueIndex("uniq_thread_map_tenant_channel_thread").on(
+      table.tenant_id,
       table.channel_id,
       table.thread_id
     ),
@@ -1051,14 +1150,82 @@ var threadSessionMap = pgTable(
     channelStatusIdx: index("idx_thread_map_channel_status").on(table.channel_id, table.status)
   })
 );
+var gatewayOutboundMessages = pgTable(
+  "gateway_outbound_messages",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    id: varchar("id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at").notNull(),
+    gateway_channel_id: varchar("gateway_channel_id", { length: 36 }).notNull().references(() => gatewayChannels.id, { onDelete: "cascade" }),
+    channel_type: text("channel_type", {
+      enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+    }).notNull(),
+    platform_channel_id: text("platform_channel_id").notNull(),
+    platform_message_id: text("platform_message_id").notNull(),
+    platform_thread_id: text("platform_thread_id").notNull(),
+    platform_permalink: text("platform_permalink"),
+    target_branch_id: varchar("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id),
+    emitted_by_user_id: varchar("emitted_by_user_id", { length: 36 }).notNull().references(() => users.user_id),
+    emitted_by_session_id: varchar("emitted_by_session_id", { length: 36 }).references(
+      () => sessions.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    emitted_by_task_id: varchar("emitted_by_task_id", { length: 36 }).references(
+      () => tasks.task_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    emitted_by_schedule_id: varchar("emitted_by_schedule_id", { length: 36 }).references(
+      () => schedules.schedule_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    message_text: text("message_text").notNull(),
+    message_preview: text("message_preview").notNull(),
+    metadata: t.json("metadata"),
+    consumed_by_session_id: varchar("consumed_by_session_id", { length: 36 }).references(
+      () => sessions.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    consumed_at: t.timestamp("consumed_at")
+  },
+  (table) => ({
+    tenantIdx: index("gateway_outbound_messages_tenant_id_idx").on(table.tenant_id),
+    uniqueChannelThread: uniqueIndex("uniq_gateway_outbound_tenant_channel_thread").on(
+      table.tenant_id,
+      table.gateway_channel_id,
+      table.platform_thread_id
+    ),
+    emittedSessionIdx: index("idx_gateway_outbound_emitted_session").on(
+      table.emitted_by_session_id
+    ),
+    emittedScheduleIdx: index("idx_gateway_outbound_emitted_schedule").on(
+      table.emitted_by_schedule_id
+    ),
+    targetBranchCreatedIdx: index("idx_gateway_outbound_branch_created").on(
+      table.target_branch_id,
+      table.created_at
+    ),
+    consumedIdx: index("idx_gateway_outbound_consumed").on(table.consumed_at)
+  })
+);
 var sessionEnvSelections = pgTable(
   "session_env_selections",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
     env_var_name: text("env_var_name").notNull(),
     created_at: t.timestamp("created_at").notNull()
   },
   (table) => ({
+    tenantIdx: index("session_env_selections_tenant_id_idx").on(table.tenant_id),
     pk: primaryKey({ columns: [table.session_id, table.env_var_name] }),
     sessionIdx: index("session_env_selections_session_idx").on(table.session_id)
   })
@@ -1066,6 +1233,7 @@ var sessionEnvSelections = pgTable(
 var kbNamespaces = pgTable(
   "kb_namespaces",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     namespace_id: varchar("namespace_id", { length: 36 }).primaryKey(),
     slug: text("slug").notNull(),
     display_name: text("display_name").notNull(),
@@ -1092,7 +1260,8 @@ var kbNamespaces = pgTable(
     archived_at: t.timestamp("archived_at")
   },
   (table) => ({
-    slugIdx: uniqueIndex("kb_namespaces_slug_idx").on(table.slug).where(sql2`${table.archived} = false`),
+    tenantIdx: index("kb_namespaces_tenant_id_idx").on(table.tenant_id),
+    slugIdx: uniqueIndex("kb_namespaces_tenant_slug_unique").on(table.tenant_id, table.slug).where(sql2`${table.archived} = false`),
     kindIdx: index("kb_namespaces_kind_idx").on(table.kind),
     ownerIdx: index("kb_namespaces_owner_idx").on(table.owner_user_id),
     repoIdx: index("kb_namespaces_repo_idx").on(table.repo_id),
@@ -1103,6 +1272,7 @@ var kbNamespaces = pgTable(
 var kbNamespaceAcl = pgTable(
   "kb_namespace_acl",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     namespace_acl_id: varchar("namespace_acl_id", { length: 36 }).primaryKey(),
     namespace_id: varchar("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces.namespace_id, { onDelete: "cascade" }),
     subject_type: text("subject_type", { enum: ["user", "group"] }).notNull(),
@@ -1115,9 +1285,11 @@ var kbNamespaceAcl = pgTable(
     updated_at: t.timestamp("updated_at")
   },
   (table) => ({
+    tenantIdx: index("kb_namespace_acl_tenant_id_idx").on(table.tenant_id),
     namespaceIdx: index("kb_namespace_acl_namespace_idx").on(table.namespace_id),
     subjectIdx: index("kb_namespace_acl_subject_idx").on(table.subject_type, table.subject_id),
-    namespaceSubjectIdx: uniqueIndex("kb_namespace_acl_namespace_subject_idx").on(
+    namespaceSubjectIdx: uniqueIndex("kb_namespace_acl_tenant_namespace_subject_unique").on(
+      table.tenant_id,
       table.namespace_id,
       table.subject_type,
       table.subject_id
@@ -1127,6 +1299,7 @@ var kbNamespaceAcl = pgTable(
 var kbDocuments = pgTable(
   "kb_documents",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     document_id: varchar("document_id", { length: 36 }).primaryKey(),
     namespace_id: varchar("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces.namespace_id, { onDelete: "cascade" }),
     path: text("path").notNull(),
@@ -1154,8 +1327,9 @@ var kbDocuments = pgTable(
     archived_at: t.timestamp("archived_at")
   },
   (table) => ({
-    namespacePathIdx: uniqueIndex("kb_documents_namespace_path_idx").on(table.namespace_id, table.path).where(sql2`${table.archived} = false`),
-    uriIdx: uniqueIndex("kb_documents_uri_idx").on(table.uri).where(sql2`${table.archived} = false`),
+    tenantIdx: index("kb_documents_tenant_id_idx").on(table.tenant_id),
+    namespacePathIdx: uniqueIndex("kb_documents_tenant_namespace_path_unique").on(table.tenant_id, table.namespace_id, table.path).where(sql2`${table.archived} = false`),
+    uriIdx: uniqueIndex("kb_documents_tenant_uri_unique").on(table.tenant_id, table.uri).where(sql2`${table.archived} = false`),
     namespaceIdx: index("kb_documents_namespace_idx").on(table.namespace_id),
     kindIdx: index("kb_documents_kind_idx").on(table.kind),
     visibilityIdx: index("kb_documents_visibility_idx").on(table.visibility),
@@ -1168,6 +1342,7 @@ var kbDocuments = pgTable(
 var kbDocumentVersions = pgTable(
   "kb_document_versions",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     version_id: varchar("version_id", { length: 36 }).primaryKey(),
     document_id: varchar("document_id", { length: 36 }).notNull().references(() => kbDocuments.document_id, { onDelete: "cascade" }),
     version_number: integer("version_number").notNull(),
@@ -1187,7 +1362,9 @@ var kbDocumentVersions = pgTable(
     created_at: t.timestamp("created_at").notNull()
   },
   (table) => ({
-    documentVersionIdx: uniqueIndex("kb_document_versions_document_version_idx").on(
+    tenantIdx: index("kb_document_versions_tenant_id_idx").on(table.tenant_id),
+    documentVersionIdx: uniqueIndex("kb_document_versions_tenant_document_version_unique").on(
+      table.tenant_id,
       table.document_id,
       table.version_number
     ),
@@ -1199,6 +1376,7 @@ var kbDocumentVersions = pgTable(
 var kbDocumentUnits = pgTable(
   "kb_document_units",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     unit_id: varchar("unit_id", { length: 36 }).primaryKey(),
     document_id: varchar("document_id", { length: 36 }).notNull().references(() => kbDocuments.document_id, { onDelete: "cascade" }),
     version_id: varchar("version_id", { length: 36 }).notNull().references(() => kbDocumentVersions.version_id, { onDelete: "cascade" }),
@@ -1223,6 +1401,7 @@ var kbDocumentUnits = pgTable(
     updated_at: t.timestamp("updated_at")
   },
   (table) => ({
+    tenantIdx: index("kb_document_units_tenant_id_idx").on(table.tenant_id),
     documentIdx: index("kb_document_units_document_idx").on(table.document_id),
     versionIdx: index("kb_document_units_version_idx").on(table.version_id),
     versionOrdinalIdx: index("kb_document_units_version_ordinal_idx").on(
@@ -1236,6 +1415,7 @@ var kbDocumentUnits = pgTable(
 var kbEmbeddingSpaces = pgTable(
   "kb_embedding_spaces",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     embedding_space_id: varchar("embedding_space_id", { length: 36 }).primaryKey(),
     provider: text("provider").notNull(),
     model: text("model").notNull(),
@@ -1248,7 +1428,9 @@ var kbEmbeddingSpaces = pgTable(
     updated_at: t.timestamp("updated_at")
   },
   (table) => ({
-    providerModelIdx: uniqueIndex("kb_embedding_spaces_provider_model_idx").on(
+    tenantIdx: index("kb_embedding_spaces_tenant_id_idx").on(table.tenant_id),
+    providerModelIdx: uniqueIndex("kb_embedding_spaces_tenant_provider_model_unique").on(
+      table.tenant_id,
       table.provider,
       table.model,
       table.dimensions,
@@ -1261,6 +1443,7 @@ var kbEmbeddingSpaces = pgTable(
 var kbGraphNodes = pgTable(
   "kb_graph_nodes",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     node_id: varchar("node_id", { length: 36 }).primaryKey(),
     node_type: text("node_type", {
       enum: [
@@ -1326,7 +1509,8 @@ var kbGraphNodes = pgTable(
     archived_at: t.timestamp("archived_at")
   },
   (table) => ({
-    uriIdx: uniqueIndex("kb_graph_nodes_uri_idx").on(table.uri).where(sql2`${table.archived} = false`),
+    tenantIdx: index("kb_graph_nodes_tenant_id_idx").on(table.tenant_id),
+    uriIdx: uniqueIndex("kb_graph_nodes_tenant_uri_unique").on(table.tenant_id, table.uri).where(sql2`${table.archived} = false`),
     typeIdx: index("kb_graph_nodes_type_idx").on(table.node_type),
     namespaceIdx: index("kb_graph_nodes_namespace_idx").on(table.namespace_id),
     documentIdx: index("kb_graph_nodes_document_idx").on(table.document_id),
@@ -1346,6 +1530,7 @@ var kbGraphNodes = pgTable(
 var kbGraphEdges = pgTable(
   "kb_graph_edges",
   {
+    tenant_id: text("tenant_id").notNull().default("default"),
     edge_id: varchar("edge_id", { length: 36 }).primaryKey(),
     source_node_id: varchar("source_node_id", { length: 36 }).notNull().references(() => kbGraphNodes.node_id, { onDelete: "cascade" }),
     target_node_id: varchar("target_node_id", { length: 36 }).notNull().references(() => kbGraphNodes.node_id, { onDelete: "cascade" }),
@@ -1374,6 +1559,7 @@ var kbGraphEdges = pgTable(
     archived_at: t.timestamp("archived_at")
   },
   (table) => ({
+    tenantIdx: index("kb_graph_edges_tenant_id_idx").on(table.tenant_id),
     sourceIdx: index("kb_graph_edges_source_idx").on(table.source_node_id),
     targetIdx: index("kb_graph_edges_target_idx").on(table.target_node_id),
     typeIdx: index("kb_graph_edges_type_idx").on(table.edge_type),
@@ -1385,7 +1571,7 @@ var kbGraphEdges = pgTable(
       table.target_node_id,
       table.edge_type
     ),
-    sourceTargetTypeIdx: uniqueIndex("kb_graph_edges_source_target_type_idx").on(table.source_node_id, table.target_node_id, table.edge_type).where(sql2`${table.archived} = false`),
+    sourceTargetTypeIdx: uniqueIndex("kb_graph_edges_tenant_source_target_type_unique").on(table.tenant_id, table.source_node_id, table.target_node_id, table.edge_type).where(sql2`${table.archived} = false`),
     archivedIdx: index("kb_graph_edges_archived_idx").on(table.archived)
   })
 );
@@ -1447,6 +1633,7 @@ __export(schema_sqlite_exports, {
   cardTypes: () => cardTypes2,
   cards: () => cards2,
   gatewayChannels: () => gatewayChannels2,
+  gatewayOutboundMessages: () => gatewayOutboundMessages2,
   groupMemberships: () => groupMemberships2,
   groups: () => groups2,
   kbDocumentUnits: () => kbDocumentUnits2,
@@ -1553,6 +1740,7 @@ var sessions2 = sqliteTable(
   },
   (table) => ({
     statusIdx: index2("sessions_status_idx").on(table.status),
+    statusReadyIdx: index2("sessions_status_ready_idx").on(table.status, table.ready_for_prompt),
     agenticToolIdx: index2("sessions_agentic_tool_idx").on(table.agentic_tool),
     boardIdx: index2("sessions_board_idx").on(table.board_id),
     branchIdx: index2("sessions_branch_idx").on(table.branch_id),
@@ -1592,6 +1780,9 @@ var sessionRelationships2 = sqliteTable(
     sourceIdx: index2("session_relationships_source_idx").on(table.source_session_id),
     targetIdx: index2("session_relationships_target_idx").on(table.target_session_id),
     callbackIdx: index2("session_relationships_callback_idx").on(table.callback_session_id),
+    // Note: no tenant_source/tenant_target composite indexes here — SQLite schema
+    // has no tenant column on this table (RLS is Postgres-only). The standalone
+    // source/target indexes above are sufficient for SQLite.
     sourceTargetTypeUnique: uniqueIndex2("session_relationships_source_target_type_unique").on(
       table.source_session_id,
       table.target_session_id,
@@ -1711,7 +1902,12 @@ var messages2 = sqliteTable(
     // Indexes for efficient lookups
     sessionIdx: index2("messages_session_id_idx").on(table.session_id),
     taskIdx: index2("messages_task_id_idx").on(table.task_id),
-    sessionIndexIdx: index2("messages_session_index_idx").on(table.session_id, table.index)
+    sessionIndexIdx: index2("messages_session_index_idx").on(table.session_id, table.index),
+    timestampIdx: index2("messages_timestamp_idx").on(table.timestamp),
+    sessionTimestampIdx: index2("messages_session_timestamp_idx").on(
+      table.session_id,
+      table.timestamp
+    )
   })
 );
 var boards2 = sqliteTable(
@@ -1937,6 +2133,9 @@ var users2 = sqliteTable(
     onboarding_completed: t2.bool("onboarding_completed").notNull().default(false),
     // Force password change flag (admin-settable, auto-cleared on password change)
     must_change_password: t2.bool("must_change_password").notNull().default(false),
+    // Auth invalidation marker. Password changes set this timestamp so any
+    // previously issued browser access or refresh token is rejected.
+    tokens_valid_after: t2.timestamp("tokens_valid_after"),
     // JSON blob for profile/preferences
     data: t2.json("data").$type().notNull()
   },
@@ -2380,6 +2579,66 @@ var threadSessionMap2 = sqliteTable(
     channelStatusIdx: index2("idx_thread_map_channel_status").on(table.channel_id, table.status)
   })
 );
+var gatewayOutboundMessages2 = sqliteTable(
+  "gateway_outbound_messages",
+  {
+    id: text2("id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at").notNull(),
+    gateway_channel_id: text2("gateway_channel_id", { length: 36 }).notNull().references(() => gatewayChannels2.id, { onDelete: "cascade" }),
+    channel_type: text2("channel_type", {
+      enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+    }).notNull(),
+    platform_channel_id: text2("platform_channel_id").notNull(),
+    platform_message_id: text2("platform_message_id").notNull(),
+    platform_thread_id: text2("platform_thread_id").notNull(),
+    platform_permalink: text2("platform_permalink"),
+    target_branch_id: text2("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id),
+    emitted_by_user_id: text2("emitted_by_user_id", { length: 36 }).notNull().references(() => users2.user_id),
+    emitted_by_session_id: text2("emitted_by_session_id", { length: 36 }).references(
+      () => sessions2.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    emitted_by_task_id: text2("emitted_by_task_id", { length: 36 }).references(() => tasks2.task_id, {
+      onDelete: "set null"
+    }),
+    emitted_by_schedule_id: text2("emitted_by_schedule_id", { length: 36 }).references(
+      () => schedules2.schedule_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    message_text: text2("message_text").notNull(),
+    message_preview: text2("message_preview").notNull(),
+    metadata: t2.json("metadata"),
+    consumed_by_session_id: text2("consumed_by_session_id", { length: 36 }).references(
+      () => sessions2.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    consumed_at: t2.timestamp("consumed_at")
+  },
+  (table) => ({
+    uniqueChannelThread: uniqueIndex2("uniq_gateway_outbound_channel_thread").on(
+      table.gateway_channel_id,
+      table.platform_thread_id
+    ),
+    emittedSessionIdx: index2("idx_gateway_outbound_emitted_session").on(
+      table.emitted_by_session_id
+    ),
+    emittedScheduleIdx: index2("idx_gateway_outbound_emitted_schedule").on(
+      table.emitted_by_schedule_id
+    ),
+    targetBranchCreatedIdx: index2("idx_gateway_outbound_branch_created").on(
+      table.target_branch_id,
+      table.created_at
+    ),
+    consumedIdx: index2("idx_gateway_outbound_consumed").on(table.consumed_at)
+  })
+);
 var sessionEnvSelections2 = sqliteTable(
   "session_env_selections",
   {
@@ -2762,7 +3021,7 @@ import { readFileSync, statSync } from "fs";
 import fs from "fs/promises";
 import os from "os";
 import path from "path";
-import yaml from "js-yaml";
+import * as yaml from "js-yaml";
 
 // src/config/analytics-defaults.ts
 function getDefaultAnalyticsConfig() {
@@ -2863,6 +3122,64 @@ function resolveExecutorHeartbeatConfig(execution) {
   };
 }
 
+// src/config/multitenancy.ts
+var DEFAULT_STATIC_TENANT_ID = "default";
+var RESERVED_AUTH_CLAIMS = /* @__PURE__ */ new Set(["aud", "exp", "iat", "iss", "jti", "nbf", "sub", "type"]);
+function detectPostgresUrl(url) {
+  if (!url) return false;
+  const lower = url.toLowerCase();
+  return lower.startsWith("postgresql://") || lower.startsWith("postgres://") || lower.startsWith("pg://");
+}
+function resolveMultiTenancyDatabaseDialect(config = {}) {
+  if (process.env.AGOR_DB_DIALECT === "postgresql" || process.env.AGOR_DB_DIALECT === "sqlite") {
+    return process.env.AGOR_DB_DIALECT;
+  }
+  if (detectPostgresUrl(process.env.DATABASE_URL)) return "postgresql";
+  if (config.database?.dialect === "postgresql" || config.database?.dialect === "sqlite") {
+    return config.database.dialect;
+  }
+  if (detectPostgresUrl(config.database?.postgresql?.url) || config.database?.postgresql?.host) {
+    return "postgresql";
+  }
+  return "sqlite";
+}
+function resolveMultiTenancyConfig(config) {
+  const raw = config.multi_tenancy ?? {};
+  const mode = raw.mode ?? "static";
+  return {
+    mode,
+    static_tenant_id: raw.static_tenant_id?.trim() || DEFAULT_STATIC_TENANT_ID,
+    ...raw.auth_claim ? { auth_claim: raw.auth_claim } : {},
+    ...raw.trusted_header ? { trusted_header: raw.trusted_header } : {}
+  };
+}
+function assertValidMultiTenancyConfig(config) {
+  const resolved = resolveMultiTenancyConfig(config);
+  if (resolved.mode !== "static" && resolved.mode !== "required_from_auth") {
+    throw new Error("Config error: multi_tenancy.mode must be one of: static, required_from_auth");
+  }
+  if (!resolved.static_tenant_id) {
+    throw new Error("Config error: multi_tenancy.static_tenant_id must not be empty");
+  }
+  if (resolved.auth_claim && RESERVED_AUTH_CLAIMS.has(resolved.auth_claim)) {
+    throw new Error(
+      `Config error: multi_tenancy.auth_claim cannot be reserved JWT claim '${resolved.auth_claim}'`
+    );
+  }
+  if (resolved.mode === "required_from_auth") {
+    if (resolveMultiTenancyDatabaseDialect(config) !== "postgresql") {
+      throw new Error(
+        "Config error: multi_tenancy.required_from_auth requires database.dialect: postgresql"
+      );
+    }
+    if (!resolved.auth_claim && !resolved.trusted_header) {
+      throw new Error(
+        "Config error: multi_tenancy.required_from_auth requires multi_tenancy.auth_claim or multi_tenancy.trusted_header"
+      );
+    }
+  }
+}
+
 // src/config/config-manager.ts
 var NO_FILE = -1;
 var NO_FILE_KEY = { mtimeMs: NO_FILE, size: 0 };
@@ -2895,6 +3212,9 @@ function writeCachedConfig(configPath, config, key) {
   cachedEntry = { path: configPath, config: structuredClone(config), key };
 }
 function parseAndValidateConfig(content) {
+  if (content.trim() === "") {
+    return {};
+  }
   const parsed = yaml.load(content);
   const finalConfig = parsed || {};
   validateConfig(finalConfig);
@@ -2924,6 +3244,7 @@ To update: agor config set execution.unix_user_mode insulated`
       `Config error: execution.managed_envs_execution_mode must be one of: hybrid, webhook-only`
     );
   }
+  assertValidMultiTenancyConfig(config);
   validateOptionalHttpUrl(
     config.external_launch,
     "login_redirect_url",
@@ -2984,7 +3305,12 @@ function getDefaultConfig() {
       // Default: sync passwords to Unix
       executor_heartbeat: resolveExecutorHeartbeatConfig()
     },
-    analytics: getDefaultAnalyticsConfig()
+    analytics: getDefaultAnalyticsConfig(),
+    telemetry: {},
+    multi_tenancy: {
+      mode: "static",
+      static_tenant_id: "default"
+    }
   };
 }
 function loadConfigSync() {
@@ -3098,6 +3424,7 @@ var userMcpOauthTokens3 = schema.userMcpOauthTokens;
 var boardComments3 = schema.boardComments;
 var gatewayChannels3 = schema.gatewayChannels;
 var threadSessionMap3 = schema.threadSessionMap;
+var gatewayOutboundMessages3 = schema.gatewayOutboundMessages;
 var userApiKeys3 = schema.userApiKeys;
 var serializedSessions3 = schema.serializedSessions;
 var kbNamespaces3 = schema.kbNamespaces;