agor-live 0.22.0 → 0.23.2

package/dist/core/claude/index.js

@@ -158,6 +158,71 @@ var init_executor_heartbeat = __esm({
   }
 });
 
+// src/config/multitenancy.ts
+function detectPostgresUrl(url) {
+  if (!url) return false;
+  const lower = url.toLowerCase();
+  return lower.startsWith("postgresql://") || lower.startsWith("postgres://") || lower.startsWith("pg://");
+}
+function resolveMultiTenancyDatabaseDialect(config = {}) {
+  if (process.env.AGOR_DB_DIALECT === "postgresql" || process.env.AGOR_DB_DIALECT === "sqlite") {
+    return process.env.AGOR_DB_DIALECT;
+  }
+  if (detectPostgresUrl(process.env.DATABASE_URL)) return "postgresql";
+  if (config.database?.dialect === "postgresql" || config.database?.dialect === "sqlite") {
+    return config.database.dialect;
+  }
+  if (detectPostgresUrl(config.database?.postgresql?.url) || config.database?.postgresql?.host) {
+    return "postgresql";
+  }
+  return "sqlite";
+}
+function resolveMultiTenancyConfig(config) {
+  const raw = config.multi_tenancy ?? {};
+  const mode = raw.mode ?? "static";
+  return {
+    mode,
+    static_tenant_id: raw.static_tenant_id?.trim() || DEFAULT_STATIC_TENANT_ID,
+    ...raw.auth_claim ? { auth_claim: raw.auth_claim } : {},
+    ...raw.trusted_header ? { trusted_header: raw.trusted_header } : {}
+  };
+}
+function assertValidMultiTenancyConfig(config) {
+  const resolved = resolveMultiTenancyConfig(config);
+  if (resolved.mode !== "static" && resolved.mode !== "required_from_auth") {
+    throw new Error("Config error: multi_tenancy.mode must be one of: static, required_from_auth");
+  }
+  if (!resolved.static_tenant_id) {
+    throw new Error("Config error: multi_tenancy.static_tenant_id must not be empty");
+  }
+  if (resolved.auth_claim && RESERVED_AUTH_CLAIMS.has(resolved.auth_claim)) {
+    throw new Error(
+      `Config error: multi_tenancy.auth_claim cannot be reserved JWT claim '${resolved.auth_claim}'`
+    );
+  }
+  if (resolved.mode === "required_from_auth") {
+    if (resolveMultiTenancyDatabaseDialect(config) !== "postgresql") {
+      throw new Error(
+        "Config error: multi_tenancy.required_from_auth requires database.dialect: postgresql"
+      );
+    }
+    if (!resolved.auth_claim && !resolved.trusted_header) {
+      throw new Error(
+        "Config error: multi_tenancy.required_from_auth requires multi_tenancy.auth_claim or multi_tenancy.trusted_header"
+      );
+    }
+  }
+}
+var DEFAULT_STATIC_TENANT_ID, RESERVED_AUTH_CLAIMS;
+var init_multitenancy = __esm({
+  "src/config/multitenancy.ts"() {
+    "use strict";
+    init_esm_shims();
+    DEFAULT_STATIC_TENANT_ID = "default";
+    RESERVED_AUTH_CLAIMS = /* @__PURE__ */ new Set(["aud", "exp", "iat", "iss", "jti", "nbf", "sub", "type"]);
+  }
+});
+
 // src/config/types.ts
 var init_types = __esm({
   "src/config/types.ts"() {
@@ -171,7 +236,7 @@ import { readFileSync, statSync } from "fs";
 import fs2 from "fs/promises";
 import os from "os";
 import path3 from "path";
-import yaml from "js-yaml";
+import * as yaml from "js-yaml";
 function cacheKeyMatches(a, b) {
   return a.mtimeMs === b.mtimeMs && a.size === b.size;
 }
@@ -200,6 +265,9 @@ function writeCachedConfig(configPath, config, key) {
   cachedEntry = { path: configPath, config: structuredClone(config), key };
 }
 function parseAndValidateConfig(content) {
+  if (content.trim() === "") {
+    return {};
+  }
   const parsed = yaml.load(content);
   const finalConfig = parsed || {};
   validateConfig(finalConfig);
@@ -229,6 +297,7 @@ To update: agor config set execution.unix_user_mode insulated`
       `Config error: execution.managed_envs_execution_mode must be one of: hybrid, webhook-only`
     );
   }
+  assertValidMultiTenancyConfig(config);
   validateOptionalHttpUrl(
     config.external_launch,
     "login_redirect_url",
@@ -289,7 +358,12 @@ function getDefaultConfig() {
       // Default: sync passwords to Unix
       executor_heartbeat: resolveExecutorHeartbeatConfig()
     },
-    analytics: getDefaultAnalyticsConfig()
+    analytics: getDefaultAnalyticsConfig(),
+    telemetry: {},
+    multi_tenancy: {
+      mode: "static",
+      static_tenant_id: "default"
+    }
   };
 }
 function loadConfigSync() {
@@ -341,6 +415,7 @@ var init_config_manager = __esm({
     init_analytics_defaults();
     init_constants();
     init_executor_heartbeat();
+    init_multitenancy();
     init_types();
     NO_FILE = -1;
     NO_FILE_KEY = { mtimeMs: NO_FILE, size: 0 };
@@ -592,6 +667,14 @@ var init_template = __esm({
   }
 });
 
+// src/types/tenant.ts
+var init_tenant = __esm({
+  "src/types/tenant.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // src/types/ui.ts
 var init_ui = __esm({
   "src/types/ui.ts"() {
@@ -682,6 +765,7 @@ var init_types2 = __esm({
     init_session();
     init_task();
     init_template();
+    init_tenant();
     init_ui();
     init_user();
     init_utils();
@@ -707,6 +791,7 @@ __export(schema_postgres_exports, {
   cardTypes: () => cardTypes,
   cards: () => cards,
   gatewayChannels: () => gatewayChannels,
+  gatewayOutboundMessages: () => gatewayOutboundMessages,
   groupMemberships: () => groupMemberships,
   groups: () => groups,
   kbDocumentUnits: () => kbDocumentUnits,
@@ -750,7 +835,7 @@ import {
   uniqueIndex,
   varchar
 } from "drizzle-orm/pg-core";
-var bytea, t, sessions, sessionRelationships, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, sessionRelationshipsRelations, branchesRelations, schedulesRelations;
+var bytea, t, sessions, sessionRelationships, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, gatewayOutboundMessages, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, sessionRelationshipsRelations, branchesRelations, schedulesRelations;
 var init_schema_postgres = __esm({
   "src/db/schema.postgres.ts"() {
     "use strict";
@@ -769,6 +854,7 @@ var init_schema_postgres = __esm({
     sessions = pgTable(
       "sessions",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         session_id: varchar("session_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -828,7 +914,9 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: index("sessions_tenant_id_idx").on(table.tenant_id),
         statusIdx: index("sessions_status_idx").on(table.status),
+        statusReadyIdx: index("sessions_status_ready_idx").on(table.status, table.ready_for_prompt),
         agenticToolIdx: index("sessions_agentic_tool_idx").on(table.agentic_tool),
         boardIdx: index("sessions_board_idx").on(table.board_id),
         branchIdx: index("sessions_branch_idx").on(table.branch_id),
@@ -840,12 +928,13 @@ var init_schema_postgres = __esm({
         // Partial unique index — covering for the scheduler's dedup lookup
         // AND serves as the DB-level guard against check-then-create races
         // in spawnScheduledSession.
-        scheduleRunUnique: uniqueIndex("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(sql`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
+        scheduleRunUnique: uniqueIndex("sessions_schedule_run_unique").on(table.tenant_id, table.schedule_id, table.scheduled_run_at).where(sql`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
       })
     );
     sessionRelationships = pgTable(
       "session_relationships",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         relationship_id: varchar("relationship_id", { length: 36 }).primaryKey(),
         source_session_id: varchar("source_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         target_session_id: varchar("target_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
@@ -863,10 +952,23 @@ var init_schema_postgres = __esm({
         data: t.json("data")
       },
       (table) => ({
+        tenantIdx: index("session_relationships_tenant_id_idx").on(table.tenant_id),
         sourceIdx: index("session_relationships_source_idx").on(table.source_session_id),
         targetIdx: index("session_relationships_target_idx").on(table.target_session_id),
         callbackIdx: index("session_relationships_callback_idx").on(table.callback_session_id),
+        // Composite indexes so the OR predicate in dispatchCompletionCallbacks
+        // (WHERE source_session_id = $1 OR target_session_id = $2) uses BitmapOr
+        // over these instead of a full tenant table scan via tenant_id_idx.
+        tenantSourceIdx: index("session_relationships_tenant_source_idx").on(
+          table.tenant_id,
+          table.source_session_id
+        ),
+        tenantTargetIdx: index("session_relationships_tenant_target_idx").on(
+          table.tenant_id,
+          table.target_session_id
+        ),
         sourceTargetTypeUnique: uniqueIndex("session_relationships_source_target_type_unique").on(
+          table.tenant_id,
           table.source_session_id,
           table.target_session_id,
           table.relationship_type
@@ -876,6 +978,7 @@ var init_schema_postgres = __esm({
     tasks = pgTable(
       "tasks",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         task_id: varchar("task_id", { length: 36 }).primaryKey(),
         session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         created_at: t.timestamp("created_at").notNull(),
@@ -905,19 +1008,23 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: index("tasks_tenant_id_idx").on(table.tenant_id),
         sessionIdx: index("tasks_session_idx").on(table.session_id),
         statusIdx: index("tasks_status_idx").on(table.status),
         createdIdx: index("tasks_created_idx").on(table.created_at),
+        // Composite for "latest task for session" queries (ORDER BY created_at DESC LIMIT 1).
+        sessionCreatedIdx: index("tasks_session_created_idx").on(table.session_id, table.created_at),
         queueIdx: index("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
         // Partial unique index — defense-in-depth for `tasks.createPending` race
         // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
         // rows have NULL queue_position and are unaffected.
-        queuedPositionUnique: uniqueIndex("tasks_queued_position_unique").on(table.session_id, table.queue_position).where(sql`${table.status} = 'queued'`)
+        queuedPositionUnique: uniqueIndex("tasks_queued_position_unique").on(table.tenant_id, table.session_id, table.queue_position).where(sql`${table.status} = 'queued'`)
       })
     );
     serializedSessions = pgTable(
       "serialized_sessions",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         id: varchar("id", { length: 36 }).primaryKey(),
         session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
@@ -933,6 +1040,7 @@ var init_schema_postgres = __esm({
         // gzipped; NULL while status='processing'
       },
       (table) => ({
+        tenantIdx: index("serialized_sessions_tenant_id_idx").on(table.tenant_id),
         sessionTurnIdx: index("serialized_sessions_session_turn_idx").on(
           table.session_id,
           table.turn_index
@@ -943,6 +1051,7 @@ var init_schema_postgres = __esm({
     messages = pgTable(
       "messages",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         message_id: varchar("message_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -982,15 +1091,23 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: index("messages_tenant_id_idx").on(table.tenant_id),
+        tenantTimestampIdx: index("messages_tenant_timestamp_idx").on(table.tenant_id, table.timestamp),
         // Indexes for efficient lookups
         sessionIdx: index("messages_session_id_idx").on(table.session_id),
         taskIdx: index("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: index("messages_session_index_idx").on(table.session_id, table.index)
+        sessionIndexIdx: index("messages_session_index_idx").on(table.session_id, table.index),
+        timestampIdx: index("messages_timestamp_idx").on(table.timestamp),
+        sessionTimestampIdx: index("messages_session_timestamp_idx").on(
+          table.session_id,
+          table.timestamp
+        )
       })
     );
     boards = pgTable(
       "boards",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         board_id: varchar("board_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
         updated_at: t.timestamp("updated_at"),
@@ -998,7 +1115,7 @@ var init_schema_postgres = __esm({
         created_by: varchar("created_by", { length: 36 }).notNull(),
         // Materialized for lookups
         name: text("name").notNull(),
-        slug: text("slug").unique(),
+        slug: text("slug"),
         primary_assistant_id: varchar("primary_assistant_id", { length: 36 }).references(
           () => branches.branch_id,
           {
@@ -1013,18 +1130,21 @@ var init_schema_postgres = __esm({
         archived_by: varchar("archived_by", { length: 36 })
       },
       (table) => ({
+        tenantIdx: index("boards_tenant_id_idx").on(table.tenant_id),
         nameIdx: index("boards_name_idx").on(table.name),
-        slugIdx: index("boards_slug_idx").on(table.slug)
+        slugIdx: index("boards_slug_idx").on(table.slug),
+        slugTenantUnique: uniqueIndex("boards_tenant_slug_unique").on(table.tenant_id, table.slug)
       })
     );
     repos = pgTable(
       "repos",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         repo_id: varchar("repo_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
         updated_at: t.timestamp("updated_at"),
         // Materialized for querying
-        slug: text("slug").notNull().unique(),
+        slug: text("slug").notNull(),
         repo_type: text("repo_type", { enum: ["remote", "local"] }).notNull().default("remote"),
         // Unix group for repo-level git access (agor_rp_<short-id>)
         // Users who have access to ANY branch in this repo get added to this group.
@@ -1035,12 +1155,15 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
-        slugIdx: index("repos_slug_idx").on(table.slug)
+        tenantIdx: index("repos_tenant_id_idx").on(table.tenant_id),
+        slugIdx: index("repos_slug_idx").on(table.slug),
+        slugTenantUnique: uniqueIndex("repos_tenant_slug_unique").on(table.tenant_id, table.slug)
       })
     );
     branches = pgTable(
       "branches",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         branch_id: varchar("branch_id", { length: 36 }).primaryKey(),
         repo_id: varchar("repo_id", { length: 36 }).notNull().references(() => repos.repo_id, { onDelete: "cascade" }),
@@ -1115,6 +1238,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: index("branches_tenant_id_idx").on(table.tenant_id),
         repoIdx: index("branches_repo_idx").on(table.repo_id),
         nameIdx: index("branches_name_idx").on(table.name),
         refIdx: index("branches_ref_idx").on(table.ref),
@@ -1128,22 +1252,26 @@ var init_schema_postgres = __esm({
     branchOwners = pgTable(
       "branch_owners",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         created_at: t.timestamp("created_at").defaultNow()
       },
       (table) => ({
+        tenantIdx: index("branch_owners_tenant_id_idx").on(table.tenant_id),
         pk: primaryKey({ columns: [table.branch_id, table.user_id] })
       })
     );
     boardOwners = pgTable(
       "board_owners",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         created_at: t.timestamp("created_at")
       },
       (table) => ({
+        tenantIdx: index("board_owners_tenant_id_idx").on(table.tenant_id),
         pk: primaryKey({ columns: [table.board_id, table.user_id] }),
         userIdx: index("board_owners_user_idx").on(table.user_id)
       })
@@ -1151,6 +1279,7 @@ var init_schema_postgres = __esm({
     schedules = pgTable(
       "schedules",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         schedule_id: varchar("schedule_id", { length: 36 }).primaryKey(),
         branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         name: text("name").notNull(),
@@ -1174,6 +1303,7 @@ var init_schema_postgres = __esm({
         created_by: varchar("created_by", { length: 36 }).notNull().references(() => users.user_id)
       },
       (table) => ({
+        tenantIdx: index("schedules_tenant_id_idx").on(table.tenant_id),
         enabledNextRunIdx: index("schedules_enabled_next_run_idx").on(table.enabled, table.next_run_at),
         branchIdx: index("schedules_branch_idx").on(table.branch_id),
         createdByIdx: index("schedules_created_by_idx").on(table.created_by)
@@ -1182,12 +1312,13 @@ var init_schema_postgres = __esm({
     users = pgTable(
       "users",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         user_id: varchar("user_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
         updated_at: t.timestamp("updated_at"),
         // Materialized for auth lookups
-        email: text("email").unique().notNull(),
+        email: text("email").notNull(),
         password: text("password").notNull(),
         // bcrypt hashed
         // Basic profile (materialized for display)
@@ -1203,16 +1334,22 @@ var init_schema_postgres = __esm({
         onboarding_completed: t.bool("onboarding_completed").notNull().default(false),
         // Force password change flag (admin-settable, auto-cleared on password change)
         must_change_password: t.bool("must_change_password").notNull().default(false),
+        // Auth invalidation marker. Password changes set this timestamp so any
+        // previously issued browser access or refresh token is rejected.
+        tokens_valid_after: t.timestamp("tokens_valid_after"),
         // JSON blob for profile/preferences
         data: t.json("data").$type().notNull()
       },
       (table) => ({
-        emailIdx: index("users_email_idx").on(table.email)
+        tenantIdx: index("users_tenant_id_idx").on(table.tenant_id),
+        emailIdx: index("users_email_idx").on(table.email),
+        emailTenantUnique: uniqueIndex("users_tenant_email_unique").on(table.tenant_id, table.email)
       })
     );
     groups = pgTable(
       "groups",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         group_id: varchar("group_id", { length: 36 }).primaryKey(),
         name: text("name").notNull(),
         slug: text("slug").notNull(),
@@ -1225,13 +1362,15 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
-        slugIdx: uniqueIndex("groups_slug_idx").on(table.slug),
+        tenantIdx: index("groups_tenant_id_idx").on(table.tenant_id),
+        slugIdx: uniqueIndex("groups_tenant_slug_unique").on(table.tenant_id, table.slug),
         archivedIdx: index("groups_archived_idx").on(table.archived)
       })
     );
     groupMemberships = pgTable(
       "group_memberships",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         group_id: varchar("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
         user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         added_by: varchar("added_by", { length: 36 }).references(() => users.user_id, {
@@ -1240,6 +1379,7 @@ var init_schema_postgres = __esm({
         created_at: t.timestamp("created_at").notNull()
       },
       (table) => ({
+        tenantIdx: index("group_memberships_tenant_id_idx").on(table.tenant_id),
         pk: primaryKey({ columns: [table.group_id, table.user_id] }),
         userIdx: index("group_memberships_user_idx").on(table.user_id)
       })
@@ -1247,6 +1387,7 @@ var init_schema_postgres = __esm({
     branchGroupGrants = pgTable(
       "branch_group_grants",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         group_id: varchar("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
         can: text("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
@@ -1258,6 +1399,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: index("branch_group_grants_tenant_id_idx").on(table.tenant_id),
         pk: primaryKey({ columns: [table.branch_id, table.group_id] }),
         groupIdx: index("branch_group_grants_group_idx").on(table.group_id)
       })
@@ -1265,6 +1407,7 @@ var init_schema_postgres = __esm({
     boardGroupGrants = pgTable(
       "board_group_grants",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         group_id: varchar("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
         can: text("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
@@ -1276,6 +1419,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: index("board_group_grants_tenant_id_idx").on(table.tenant_id),
         pk: primaryKey({ columns: [table.board_id, table.group_id] }),
         groupIdx: index("board_group_grants_group_idx").on(table.group_id)
       })
@@ -1283,6 +1427,7 @@ var init_schema_postgres = __esm({
     appVariables = pgTable(
       "app_variables",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         variable_id: varchar("variable_id", { length: 36 }).primaryKey(),
         namespace: text("namespace").notNull(),
         key: text("key").notNull(),
@@ -1298,13 +1443,19 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at").notNull()
       },
       (table) => ({
-        namespaceKeyIdx: uniqueIndex("app_variables_namespace_key_idx").on(table.namespace, table.key),
+        tenantIdx: index("app_variables_tenant_id_idx").on(table.tenant_id),
+        namespaceKeyIdx: uniqueIndex("app_variables_tenant_namespace_key_unique").on(
+          table.tenant_id,
+          table.namespace,
+          table.key
+        ),
         namespaceIdx: index("app_variables_namespace_idx").on(table.namespace)
       })
     );
     userApiKeys = pgTable(
       "user_api_keys",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         id: varchar("id", { length: 36 }).primaryKey(),
         user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         name: text("name").notNull(),
@@ -1316,6 +1467,7 @@ var init_schema_postgres = __esm({
         last_used_at: t.timestamp("last_used_at")
       },
       (table) => ({
+        tenantIdx: index("user_api_keys_tenant_id_idx").on(table.tenant_id),
         userIdx: index("user_api_keys_user_idx").on(table.user_id),
         prefixIdx: index("user_api_keys_prefix_idx").on(table.prefix)
       })
@@ -1323,6 +1475,7 @@ var init_schema_postgres = __esm({
     mcpServers = pgTable(
       "mcp_servers",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         mcp_server_id: varchar("mcp_server_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -1349,6 +1502,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: index("mcp_servers_tenant_id_idx").on(table.tenant_id),
         nameIdx: index("mcp_servers_name_idx").on(table.name),
         scopeIdx: index("mcp_servers_scope_idx").on(table.scope),
         ownerIdx: index("mcp_servers_owner_idx").on(table.owner_user_id),
@@ -1358,6 +1512,7 @@ var init_schema_postgres = __esm({
     cardTypes = pgTable(
       "card_types",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         card_type_id: varchar("card_type_id", { length: 36 }).primaryKey(),
         name: text("name").notNull(),
         emoji: text("emoji"),
@@ -1369,12 +1524,14 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at").notNull()
       },
       (table) => ({
+        tenantIdx: index("card_types_tenant_id_idx").on(table.tenant_id),
         nameIdx: index("card_types_name_idx").on(table.name)
       })
     );
     cards = pgTable(
       "cards",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         card_id: varchar("card_id", { length: 36 }).primaryKey(),
         board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         card_type_id: varchar("card_type_id", { length: 36 }).references(() => cardTypes.card_type_id, {
@@ -1395,6 +1552,7 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
+        tenantIdx: index("cards_tenant_id_idx").on(table.tenant_id),
         boardIdx: index("cards_board_idx").on(table.board_id),
         cardTypeIdx: index("cards_card_type_idx").on(table.card_type_id),
         titleIdx: index("cards_title_idx").on(table.title),
@@ -1405,6 +1563,7 @@ var init_schema_postgres = __esm({
     artifacts = pgTable(
       "artifacts",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         artifact_id: varchar("artifact_id", { length: 36 }).primaryKey(),
         branch_id: varchar("branch_id", { length: 36 }).references(() => branches.branch_id, {
           onDelete: "set null"
@@ -1440,6 +1599,7 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
+        tenantIdx: index("artifacts_tenant_id_idx").on(table.tenant_id),
         branchIdx: index("artifacts_branch_idx").on(table.branch_id),
         sourceSessionIdx: index("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: index("artifacts_board_idx").on(table.board_id),
@@ -1450,6 +1610,7 @@ var init_schema_postgres = __esm({
     artifactTrustGrants = pgTable(
       "artifact_trust_grants",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         grant_id: varchar("grant_id", { length: 36 }).primaryKey(),
         user_id: varchar("user_id", { length: 36 }).notNull(),
         scope_type: text("scope_type").notNull(),
@@ -1460,6 +1621,7 @@ var init_schema_postgres = __esm({
         revoked_at: t.timestamp("revoked_at")
       },
       (table) => ({
+        tenantIdx: index("artifact_trust_grants_tenant_id_idx").on(table.tenant_id),
         userIdx: index("artifact_trust_grants_user_idx").on(table.user_id),
         scopeIdx: index("artifact_trust_grants_scope_idx").on(table.scope_type, table.scope_value)
       })
@@ -1467,6 +1629,7 @@ var init_schema_postgres = __esm({
     boardObjects = pgTable(
       "board_objects",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         object_id: varchar("object_id", { length: 36 }).primaryKey(),
         board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
@@ -1482,6 +1645,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: index("board_objects_tenant_id_idx").on(table.tenant_id),
         boardIdx: index("board_objects_board_idx").on(table.board_id),
         branchIdx: index("board_objects_branch_idx").on(table.branch_id),
         cardIdx: index("board_objects_card_idx").on(table.card_id)
@@ -1490,12 +1654,14 @@ var init_schema_postgres = __esm({
     sessionMcpServers = pgTable(
       "session_mcp_servers",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         mcp_server_id: varchar("mcp_server_id", { length: 36 }).notNull().references(() => mcpServers.mcp_server_id, { onDelete: "cascade" }),
         enabled: t.bool("enabled").notNull().default(true),
         added_at: t.timestamp("added_at").notNull()
       },
       (table) => ({
+        tenantIdx: index("session_mcp_servers_tenant_id_idx").on(table.tenant_id),
         // Composite primary key
         pk: index("session_mcp_servers_pk").on(table.session_id, table.mcp_server_id),
         // Indexes for queries
@@ -1507,6 +1673,7 @@ var init_schema_postgres = __esm({
     userMcpOauthTokens = pgTable(
       "user_mcp_oauth_tokens",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // NULL = shared-mode token (one per mcp_server_id)
         user_id: varchar("user_id", { length: 36 }).references(() => users.user_id, {
           onDelete: "cascade"
@@ -1524,6 +1691,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: index("user_mcp_oauth_tokens_tenant_id_idx").on(table.tenant_id),
         // Composite lookup indexes. Uniqueness enforced via partial unique indexes
         // created in the migration (one for per-user rows, one for the shared row).
         pk: index("user_mcp_oauth_tokens_pk").on(table.user_id, table.mcp_server_id),
@@ -1534,6 +1702,7 @@ var init_schema_postgres = __esm({
     boardComments = pgTable(
       "board_comments",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         comment_id: varchar("comment_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -1575,6 +1744,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: index("board_comments_tenant_id_idx").on(table.tenant_id),
         boardIdx: index("board_comments_board_idx").on(table.board_id),
         sessionIdx: index("board_comments_session_idx").on(table.session_id),
         taskIdx: index("board_comments_task_idx").on(table.task_id),
@@ -1589,6 +1759,7 @@ var init_schema_postgres = __esm({
     gatewayChannels = pgTable(
       "gateway_channels",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         id: varchar("id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -1602,7 +1773,7 @@ var init_schema_postgres = __esm({
         }).notNull(),
         target_branch_id: varchar("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         agor_user_id: varchar("agor_user_id", { length: 36 }).notNull(),
-        channel_key: text("channel_key").notNull().unique(),
+        channel_key: text("channel_key").notNull(),
         enabled: t.bool("enabled").notNull().default(true),
         last_message_at: t.timestamp("last_message_at"),
         // JSON blob for platform credentials (encrypted at rest)
@@ -1611,13 +1782,19 @@ var init_schema_postgres = __esm({
         agentic_config: t.json("agentic_config")
       },
       (table) => ({
+        tenantIdx: index("gateway_channels_tenant_id_idx").on(table.tenant_id),
         channelKeyIdx: index("idx_gateway_channel_key").on(table.channel_key),
+        channelKeyTenantUnique: uniqueIndex("gateway_channels_tenant_channel_key_unique").on(
+          table.tenant_id,
+          table.channel_key
+        ),
         enabledTypeIdx: index("idx_gateway_enabled_type").on(table.enabled, table.channel_type)
       })
     );
     threadSessionMap = pgTable(
       "thread_session_map",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         id: varchar("id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -1635,7 +1812,9 @@ var init_schema_postgres = __esm({
         metadata: t.json("metadata")
       },
       (table) => ({
-        uniqueChannelThread: uniqueIndex("uniq_thread_map_channel_thread").on(
+        tenantIdx: index("thread_session_map_tenant_id_idx").on(table.tenant_id),
+        uniqueChannelThread: uniqueIndex("uniq_thread_map_tenant_channel_thread").on(
+          table.tenant_id,
           table.channel_id,
           table.thread_id
         ),
@@ -1644,14 +1823,82 @@ var init_schema_postgres = __esm({
         channelStatusIdx: index("idx_thread_map_channel_status").on(table.channel_id, table.status)
       })
     );
+    gatewayOutboundMessages = pgTable(
+      "gateway_outbound_messages",
+      {
+        tenant_id: text("tenant_id").notNull().default("default"),
+        id: varchar("id", { length: 36 }).primaryKey(),
+        created_at: t.timestamp("created_at").notNull(),
+        updated_at: t.timestamp("updated_at").notNull(),
+        gateway_channel_id: varchar("gateway_channel_id", { length: 36 }).notNull().references(() => gatewayChannels.id, { onDelete: "cascade" }),
+        channel_type: text("channel_type", {
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+        }).notNull(),
+        platform_channel_id: text("platform_channel_id").notNull(),
+        platform_message_id: text("platform_message_id").notNull(),
+        platform_thread_id: text("platform_thread_id").notNull(),
+        platform_permalink: text("platform_permalink"),
+        target_branch_id: varchar("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id),
+        emitted_by_user_id: varchar("emitted_by_user_id", { length: 36 }).notNull().references(() => users.user_id),
+        emitted_by_session_id: varchar("emitted_by_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        emitted_by_task_id: varchar("emitted_by_task_id", { length: 36 }).references(
+          () => tasks.task_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        emitted_by_schedule_id: varchar("emitted_by_schedule_id", { length: 36 }).references(
+          () => schedules.schedule_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        message_text: text("message_text").notNull(),
+        message_preview: text("message_preview").notNull(),
+        metadata: t.json("metadata"),
+        consumed_by_session_id: varchar("consumed_by_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        consumed_at: t.timestamp("consumed_at")
+      },
+      (table) => ({
+        tenantIdx: index("gateway_outbound_messages_tenant_id_idx").on(table.tenant_id),
+        uniqueChannelThread: uniqueIndex("uniq_gateway_outbound_tenant_channel_thread").on(
+          table.tenant_id,
+          table.gateway_channel_id,
+          table.platform_thread_id
+        ),
+        emittedSessionIdx: index("idx_gateway_outbound_emitted_session").on(
+          table.emitted_by_session_id
+        ),
+        emittedScheduleIdx: index("idx_gateway_outbound_emitted_schedule").on(
+          table.emitted_by_schedule_id
+        ),
+        targetBranchCreatedIdx: index("idx_gateway_outbound_branch_created").on(
+          table.target_branch_id,
+          table.created_at
+        ),
+        consumedIdx: index("idx_gateway_outbound_consumed").on(table.consumed_at)
+      })
+    );
     sessionEnvSelections = pgTable(
       "session_env_selections",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         env_var_name: text("env_var_name").notNull(),
         created_at: t.timestamp("created_at").notNull()
       },
       (table) => ({
+        tenantIdx: index("session_env_selections_tenant_id_idx").on(table.tenant_id),
         pk: primaryKey({ columns: [table.session_id, table.env_var_name] }),
         sessionIdx: index("session_env_selections_session_idx").on(table.session_id)
       })
@@ -1659,6 +1906,7 @@ var init_schema_postgres = __esm({
     kbNamespaces = pgTable(
       "kb_namespaces",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         namespace_id: varchar("namespace_id", { length: 36 }).primaryKey(),
         slug: text("slug").notNull(),
         display_name: text("display_name").notNull(),
@@ -1685,7 +1933,8 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
-        slugIdx: uniqueIndex("kb_namespaces_slug_idx").on(table.slug).where(sql`${table.archived} = false`),
+        tenantIdx: index("kb_namespaces_tenant_id_idx").on(table.tenant_id),
+        slugIdx: uniqueIndex("kb_namespaces_tenant_slug_unique").on(table.tenant_id, table.slug).where(sql`${table.archived} = false`),
         kindIdx: index("kb_namespaces_kind_idx").on(table.kind),
         ownerIdx: index("kb_namespaces_owner_idx").on(table.owner_user_id),
         repoIdx: index("kb_namespaces_repo_idx").on(table.repo_id),
@@ -1696,6 +1945,7 @@ var init_schema_postgres = __esm({
     kbNamespaceAcl = pgTable(
       "kb_namespace_acl",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         namespace_acl_id: varchar("namespace_acl_id", { length: 36 }).primaryKey(),
         namespace_id: varchar("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces.namespace_id, { onDelete: "cascade" }),
         subject_type: text("subject_type", { enum: ["user", "group"] }).notNull(),
@@ -1708,9 +1958,11 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: index("kb_namespace_acl_tenant_id_idx").on(table.tenant_id),
         namespaceIdx: index("kb_namespace_acl_namespace_idx").on(table.namespace_id),
         subjectIdx: index("kb_namespace_acl_subject_idx").on(table.subject_type, table.subject_id),
-        namespaceSubjectIdx: uniqueIndex("kb_namespace_acl_namespace_subject_idx").on(
+        namespaceSubjectIdx: uniqueIndex("kb_namespace_acl_tenant_namespace_subject_unique").on(
+          table.tenant_id,
           table.namespace_id,
           table.subject_type,
           table.subject_id
@@ -1720,6 +1972,7 @@ var init_schema_postgres = __esm({
     kbDocuments = pgTable(
       "kb_documents",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         document_id: varchar("document_id", { length: 36 }).primaryKey(),
         namespace_id: varchar("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces.namespace_id, { onDelete: "cascade" }),
         path: text("path").notNull(),
@@ -1747,8 +2000,9 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
-        namespacePathIdx: uniqueIndex("kb_documents_namespace_path_idx").on(table.namespace_id, table.path).where(sql`${table.archived} = false`),
-        uriIdx: uniqueIndex("kb_documents_uri_idx").on(table.uri).where(sql`${table.archived} = false`),
+        tenantIdx: index("kb_documents_tenant_id_idx").on(table.tenant_id),
+        namespacePathIdx: uniqueIndex("kb_documents_tenant_namespace_path_unique").on(table.tenant_id, table.namespace_id, table.path).where(sql`${table.archived} = false`),
+        uriIdx: uniqueIndex("kb_documents_tenant_uri_unique").on(table.tenant_id, table.uri).where(sql`${table.archived} = false`),
         namespaceIdx: index("kb_documents_namespace_idx").on(table.namespace_id),
         kindIdx: index("kb_documents_kind_idx").on(table.kind),
         visibilityIdx: index("kb_documents_visibility_idx").on(table.visibility),
@@ -1761,6 +2015,7 @@ var init_schema_postgres = __esm({
     kbDocumentVersions = pgTable(
       "kb_document_versions",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         version_id: varchar("version_id", { length: 36 }).primaryKey(),
         document_id: varchar("document_id", { length: 36 }).notNull().references(() => kbDocuments.document_id, { onDelete: "cascade" }),
         version_number: integer("version_number").notNull(),
@@ -1780,7 +2035,9 @@ var init_schema_postgres = __esm({
         created_at: t.timestamp("created_at").notNull()
       },
       (table) => ({
-        documentVersionIdx: uniqueIndex("kb_document_versions_document_version_idx").on(
+        tenantIdx: index("kb_document_versions_tenant_id_idx").on(table.tenant_id),
+        documentVersionIdx: uniqueIndex("kb_document_versions_tenant_document_version_unique").on(
+          table.tenant_id,
           table.document_id,
           table.version_number
         ),
@@ -1792,6 +2049,7 @@ var init_schema_postgres = __esm({
     kbDocumentUnits = pgTable(
       "kb_document_units",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         unit_id: varchar("unit_id", { length: 36 }).primaryKey(),
         document_id: varchar("document_id", { length: 36 }).notNull().references(() => kbDocuments.document_id, { onDelete: "cascade" }),
         version_id: varchar("version_id", { length: 36 }).notNull().references(() => kbDocumentVersions.version_id, { onDelete: "cascade" }),
@@ -1816,6 +2074,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: index("kb_document_units_tenant_id_idx").on(table.tenant_id),
         documentIdx: index("kb_document_units_document_idx").on(table.document_id),
         versionIdx: index("kb_document_units_version_idx").on(table.version_id),
         versionOrdinalIdx: index("kb_document_units_version_ordinal_idx").on(
@@ -1829,6 +2088,7 @@ var init_schema_postgres = __esm({
     kbEmbeddingSpaces = pgTable(
       "kb_embedding_spaces",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         embedding_space_id: varchar("embedding_space_id", { length: 36 }).primaryKey(),
         provider: text("provider").notNull(),
         model: text("model").notNull(),
@@ -1841,7 +2101,9 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
-        providerModelIdx: uniqueIndex("kb_embedding_spaces_provider_model_idx").on(
+        tenantIdx: index("kb_embedding_spaces_tenant_id_idx").on(table.tenant_id),
+        providerModelIdx: uniqueIndex("kb_embedding_spaces_tenant_provider_model_unique").on(
+          table.tenant_id,
           table.provider,
           table.model,
           table.dimensions,
@@ -1854,6 +2116,7 @@ var init_schema_postgres = __esm({
     kbGraphNodes = pgTable(
       "kb_graph_nodes",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         node_id: varchar("node_id", { length: 36 }).primaryKey(),
         node_type: text("node_type", {
           enum: [
@@ -1919,7 +2182,8 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
-        uriIdx: uniqueIndex("kb_graph_nodes_uri_idx").on(table.uri).where(sql`${table.archived} = false`),
+        tenantIdx: index("kb_graph_nodes_tenant_id_idx").on(table.tenant_id),
+        uriIdx: uniqueIndex("kb_graph_nodes_tenant_uri_unique").on(table.tenant_id, table.uri).where(sql`${table.archived} = false`),
         typeIdx: index("kb_graph_nodes_type_idx").on(table.node_type),
         namespaceIdx: index("kb_graph_nodes_namespace_idx").on(table.namespace_id),
         documentIdx: index("kb_graph_nodes_document_idx").on(table.document_id),
@@ -1939,6 +2203,7 @@ var init_schema_postgres = __esm({
     kbGraphEdges = pgTable(
       "kb_graph_edges",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         edge_id: varchar("edge_id", { length: 36 }).primaryKey(),
         source_node_id: varchar("source_node_id", { length: 36 }).notNull().references(() => kbGraphNodes.node_id, { onDelete: "cascade" }),
         target_node_id: varchar("target_node_id", { length: 36 }).notNull().references(() => kbGraphNodes.node_id, { onDelete: "cascade" }),
@@ -1967,6 +2232,7 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
+        tenantIdx: index("kb_graph_edges_tenant_id_idx").on(table.tenant_id),
         sourceIdx: index("kb_graph_edges_source_idx").on(table.source_node_id),
         targetIdx: index("kb_graph_edges_target_idx").on(table.target_node_id),
         typeIdx: index("kb_graph_edges_type_idx").on(table.edge_type),
@@ -1978,7 +2244,7 @@ var init_schema_postgres = __esm({
           table.target_node_id,
           table.edge_type
         ),
-        sourceTargetTypeIdx: uniqueIndex("kb_graph_edges_source_target_type_idx").on(table.source_node_id, table.target_node_id, table.edge_type).where(sql`${table.archived} = false`),
+        sourceTargetTypeIdx: uniqueIndex("kb_graph_edges_tenant_source_target_type_unique").on(table.tenant_id, table.source_node_id, table.target_node_id, table.edge_type).where(sql`${table.archived} = false`),
         archivedIdx: index("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
@@ -2042,6 +2308,7 @@ __export(schema_sqlite_exports, {
   cardTypes: () => cardTypes2,
   cards: () => cards2,
   gatewayChannels: () => gatewayChannels2,
+  gatewayOutboundMessages: () => gatewayOutboundMessages2,
   groupMemberships: () => groupMemberships2,
   groups: () => groups2,
   kbDocumentUnits: () => kbDocumentUnits2,
@@ -2080,7 +2347,7 @@ import {
   text as text2,
   uniqueIndex as uniqueIndex2
 } from "drizzle-orm/sqlite-core";
-var t2, sessions2, sessionRelationships2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, sessionRelationshipsRelations2, branchesRelations2, schedulesRelations2;
+var t2, sessions2, sessionRelationships2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, gatewayOutboundMessages2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, sessionRelationshipsRelations2, branchesRelations2, schedulesRelations2;
 var init_schema_sqlite = __esm({
   "src/db/schema.sqlite.ts"() {
     "use strict";
@@ -2154,6 +2421,7 @@ var init_schema_sqlite = __esm({
       },
       (table) => ({
         statusIdx: index2("sessions_status_idx").on(table.status),
+        statusReadyIdx: index2("sessions_status_ready_idx").on(table.status, table.ready_for_prompt),
         agenticToolIdx: index2("sessions_agentic_tool_idx").on(table.agentic_tool),
         boardIdx: index2("sessions_board_idx").on(table.board_id),
         branchIdx: index2("sessions_branch_idx").on(table.branch_id),
@@ -2193,6 +2461,9 @@ var init_schema_sqlite = __esm({
         sourceIdx: index2("session_relationships_source_idx").on(table.source_session_id),
         targetIdx: index2("session_relationships_target_idx").on(table.target_session_id),
         callbackIdx: index2("session_relationships_callback_idx").on(table.callback_session_id),
+        // Note: no tenant_source/tenant_target composite indexes here — SQLite schema
+        // has no tenant column on this table (RLS is Postgres-only). The standalone
+        // source/target indexes above are sufficient for SQLite.
         sourceTargetTypeUnique: uniqueIndex2("session_relationships_source_target_type_unique").on(
           table.source_session_id,
           table.target_session_id,
@@ -2312,7 +2583,12 @@ var init_schema_sqlite = __esm({
         // Indexes for efficient lookups
         sessionIdx: index2("messages_session_id_idx").on(table.session_id),
         taskIdx: index2("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: index2("messages_session_index_idx").on(table.session_id, table.index)
+        sessionIndexIdx: index2("messages_session_index_idx").on(table.session_id, table.index),
+        timestampIdx: index2("messages_timestamp_idx").on(table.timestamp),
+        sessionTimestampIdx: index2("messages_session_timestamp_idx").on(
+          table.session_id,
+          table.timestamp
+        )
       })
     );
     boards2 = sqliteTable(
@@ -2538,6 +2814,9 @@ var init_schema_sqlite = __esm({
         onboarding_completed: t2.bool("onboarding_completed").notNull().default(false),
         // Force password change flag (admin-settable, auto-cleared on password change)
         must_change_password: t2.bool("must_change_password").notNull().default(false),
+        // Auth invalidation marker. Password changes set this timestamp so any
+        // previously issued browser access or refresh token is rejected.
+        tokens_valid_after: t2.timestamp("tokens_valid_after"),
         // JSON blob for profile/preferences
         data: t2.json("data").$type().notNull()
       },
@@ -2981,6 +3260,66 @@ var init_schema_sqlite = __esm({
         channelStatusIdx: index2("idx_thread_map_channel_status").on(table.channel_id, table.status)
       })
     );
+    gatewayOutboundMessages2 = sqliteTable(
+      "gateway_outbound_messages",
+      {
+        id: text2("id", { length: 36 }).primaryKey(),
+        created_at: t2.timestamp("created_at").notNull(),
+        updated_at: t2.timestamp("updated_at").notNull(),
+        gateway_channel_id: text2("gateway_channel_id", { length: 36 }).notNull().references(() => gatewayChannels2.id, { onDelete: "cascade" }),
+        channel_type: text2("channel_type", {
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+        }).notNull(),
+        platform_channel_id: text2("platform_channel_id").notNull(),
+        platform_message_id: text2("platform_message_id").notNull(),
+        platform_thread_id: text2("platform_thread_id").notNull(),
+        platform_permalink: text2("platform_permalink"),
+        target_branch_id: text2("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id),
+        emitted_by_user_id: text2("emitted_by_user_id", { length: 36 }).notNull().references(() => users2.user_id),
+        emitted_by_session_id: text2("emitted_by_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        emitted_by_task_id: text2("emitted_by_task_id", { length: 36 }).references(() => tasks2.task_id, {
+          onDelete: "set null"
+        }),
+        emitted_by_schedule_id: text2("emitted_by_schedule_id", { length: 36 }).references(
+          () => schedules2.schedule_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        message_text: text2("message_text").notNull(),
+        message_preview: text2("message_preview").notNull(),
+        metadata: t2.json("metadata"),
+        consumed_by_session_id: text2("consumed_by_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        consumed_at: t2.timestamp("consumed_at")
+      },
+      (table) => ({
+        uniqueChannelThread: uniqueIndex2("uniq_gateway_outbound_channel_thread").on(
+          table.gateway_channel_id,
+          table.platform_thread_id
+        ),
+        emittedSessionIdx: index2("idx_gateway_outbound_emitted_session").on(
+          table.emitted_by_session_id
+        ),
+        emittedScheduleIdx: index2("idx_gateway_outbound_emitted_schedule").on(
+          table.emitted_by_schedule_id
+        ),
+        targetBranchCreatedIdx: index2("idx_gateway_outbound_branch_created").on(
+          table.target_branch_id,
+          table.created_at
+        ),
+        consumedIdx: index2("idx_gateway_outbound_consumed").on(table.consumed_at)
+      })
+    );
     sessionEnvSelections2 = sqliteTable(
       "session_env_selections",
       {
@@ -3405,17 +3744,29 @@ var init_schema_factory = __esm({
   }
 });
 
+// src/db/tenant-context.ts
+import { AsyncLocalStorage } from "async_hooks";
+var tenantDatabaseScope;
+var init_tenant_context = __esm({
+  "src/db/tenant-context.ts"() {
+    "use strict";
+    init_esm_shims();
+    tenantDatabaseScope = new AsyncLocalStorage();
+  }
+});
+
 // src/db/database-wrapper.ts
 import { sql as sql3 } from "drizzle-orm";
 var init_database_wrapper = __esm({
   "src/db/database-wrapper.ts"() {
     "use strict";
     init_esm_shims();
+    init_tenant_context();
   }
 });
 
 // src/db/schema.ts
-var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionRelationships3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
+var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionRelationships3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, gatewayOutboundMessages3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
 var init_schema = __esm({
   "src/db/schema.ts"() {
     "use strict";
@@ -3453,6 +3804,7 @@ var init_schema = __esm({
     boardComments3 = schema.boardComments;
     gatewayChannels3 = schema.gatewayChannels;
     threadSessionMap3 = schema.threadSessionMap;
+    gatewayOutboundMessages3 = schema.gatewayOutboundMessages;
     userApiKeys3 = schema.userApiKeys;
     serializedSessions3 = schema.serializedSessions;
     kbNamespaces3 = schema.kbNamespaces;
@@ -3466,9 +3818,21 @@ var init_schema = __esm({
   }
 });
 
+// src/db/tenant-scope.ts
+import { sql as sql4 } from "drizzle-orm";
+var init_tenant_scope = __esm({
+  "src/db/tenant-scope.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_tenant_context();
+    init_tenant_context();
+    init_database_wrapper();
+  }
+});
+
 // src/db/user-utils.ts
 import bcrypt from "bcryptjs";
-import { eq } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 var init_user_utils = __esm({
   "src/db/user-utils.ts"() {
     "use strict";
@@ -3477,18 +3841,20 @@ var init_user_utils = __esm({
     init_user();
     init_database_wrapper();
     init_schema();
+    init_tenant_scope();
   }
 });
 
 // src/db/first-run-bootstrap.ts
 import { randomInt } from "crypto";
-import { eq as eq2, inArray } from "drizzle-orm";
+import { and as and2, eq as eq2, inArray } from "drizzle-orm";
 var init_first_run_bootstrap = __esm({
   "src/db/first-run-bootstrap.ts"() {
     "use strict";
     init_esm_shims();
     init_database_wrapper();
     init_schema();
+    init_tenant_scope();
     init_user_utils();
   }
 });
@@ -3612,17 +3978,19 @@ init_esm_shims();
 init_esm_shims();
 init_ids();
 import {
-  and as and23,
+  and as and28,
   asc as asc3,
+  count,
   desc as desc6,
-  eq as eq31,
+  eq as eq33,
   gt,
   gte,
-  inArray as inArray8,
-  like as like16,
+  inArray as inArray11,
+  like as like17,
+  lt as lt3,
   lte as lte2,
-  or as or9,
-  sql as sql15
+  or as or10,
+  sql as sql16
 } from "drizzle-orm";
 import bcryptjs from "bcryptjs";
 
@@ -3659,9 +4027,10 @@ init_first_run_bootstrap();
 init_esm_shims();
 init_database_wrapper();
 init_schema();
+init_tenant_scope();
 import { dirname, join as join2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { eq as eq3, sql as sql4 } from "drizzle-orm";
+import { and as and3, eq as eq3, sql as sql5 } from "drizzle-orm";
 import { migrate as migrateSQLite } from "drizzle-orm/libsql/migrator";
 import { migrate as migratePostgres } from "drizzle-orm/postgres-js/migrator";
 
@@ -3675,26 +4044,27 @@ init_esm_shims();
 init_esm_shims();
 init_ids();
 init_database_wrapper();
-import { and, eq as eq4 } from "drizzle-orm";
+import { and as and4, eq as eq4 } from "drizzle-orm";
 init_schema();
 
 // src/db/repositories/base.ts
 init_esm_shims();
 init_ids();
 init_id();
+init_tenant_context();
 
 // src/db/repositories/artifact-trust.ts
 init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and2, eq as eq5, isNull } from "drizzle-orm";
+import { and as and5, eq as eq5, isNull } from "drizzle-orm";
 
 // src/db/repositories/artifacts.ts
 init_esm_shims();
 init_config_manager();
 init_ids();
-import { and as and3, eq as eq6, like, or } from "drizzle-orm";
+import { and as and7, eq as eq7, inArray as inArray3, like, or as or2 } from "drizzle-orm";
 
 // src/utils/url.ts
 init_esm_shims();
@@ -3704,17 +4074,27 @@ init_id();
 init_database_wrapper();
 init_schema();
 
+// src/db/repositories/branch-access.ts
+init_esm_shims();
+init_types2();
+init_database_wrapper();
+init_schema();
+import { and as and6, eq as eq6, exists, inArray as inArray2, isNotNull, or, sql as sql6 } from "drizzle-orm";
+var VISIBLE_BRANCH_PERMISSION_LEVELS = BRANCH_PERMISSION_LEVELS.filter(
+  (level) => level !== "none"
+);
+
 // src/db/repositories/board-comments.ts
 init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and4, eq as eq7, isNull as isNull2, like as like2 } from "drizzle-orm";
+import { and as and8, eq as eq8, isNotNull as isNotNull2, isNull as isNull2, like as like2, or as or3, sql as sql7 } from "drizzle-orm";
 
 // src/db/repositories/board-objects.ts
 init_esm_shims();
 init_ids();
-import { and as and6, asc, eq as eq9, getTableColumns, isNotNull as isNotNull2, isNull as isNull3, or as or3, sql as sql6 } from "drizzle-orm";
+import { and as and9, asc, eq as eq9, getTableColumns, isNotNull as isNotNull3, isNull as isNull3, or as or4, sql as sql8 } from "drizzle-orm";
 
 // src/utils/board-placement.ts
 init_esm_shims();
@@ -3723,23 +4103,39 @@ init_esm_shims();
 init_database_wrapper();
 init_schema();
 
-// src/db/repositories/branch-access.ts
-init_esm_shims();
-init_types2();
-init_database_wrapper();
-init_schema();
-import { and as and5, eq as eq8, exists, inArray as inArray2, isNotNull, or as or2, sql as sql5 } from "drizzle-orm";
-var VISIBLE_BRANCH_PERMISSION_LEVELS = BRANCH_PERMISSION_LEVELS.filter(
-  (level) => level !== "none"
-);
-
 // src/db/repositories/boards.ts
 init_esm_shims();
 init_types2();
 init_config_manager();
 init_ids();
-import { and as and9, eq as eq12, exists as exists2, isNull as isNull4, like as like4, ne, or as or4, sql as sql8 } from "drizzle-orm";
+import { and as and12, eq as eq12, inArray as inArray5, isNull as isNull4, like as like4, ne } from "drizzle-orm";
 import * as yaml2 from "js-yaml";
+
+// src/utils/emoji-shortcodes.ts
+init_esm_shims();
+import { createRequire } from "module";
+var requireJson = createRequire(import.meta.url);
+var emojiData = requireJson("emojibase-data/en/compact.json");
+var shortcodes = requireJson(
+  "emojibase-data/en/shortcodes/emojibase.json"
+);
+var emojiByHexcode = /* @__PURE__ */ new Map();
+for (const emoji of emojiData) {
+  if (emoji.unicode) {
+    emojiByHexcode.set(emoji.hexcode, emoji.unicode);
+  }
+}
+var emojiByShortcode = /* @__PURE__ */ new Map();
+for (const [hexcode, codes] of Object.entries(shortcodes)) {
+  const emoji = emojiByHexcode.get(hexcode);
+  if (!emoji) continue;
+  const codeList = Array.isArray(codes) ? codes : [codes];
+  for (const code of codeList) {
+    emojiByShortcode.set(code.toLowerCase(), emoji);
+  }
+}
+
+// src/db/repositories/boards.ts
 init_database_wrapper();
 init_schema();
 
@@ -3748,7 +4144,7 @@ init_esm_shims();
 init_types2();
 init_config_manager();
 init_ids();
-import { and as and8, desc, eq as eq11, getTableColumns as getTableColumns2, inArray as inArray3, like as like3, sql as sql7 } from "drizzle-orm";
+import { and as and11, desc, eq as eq11, exists as exists2, getTableColumns as getTableColumns2, inArray as inArray4, like as like3, or as or5, sql as sql9 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
 
@@ -3757,7 +4153,7 @@ init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and7, eq as eq10 } from "drizzle-orm";
+import { and as and10, eq as eq10 } from "drizzle-orm";
 
 // src/db/repositories/merge-utils.ts
 init_esm_shims();
@@ -3779,7 +4175,7 @@ init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and10, eq as eq14, like as like6 } from "drizzle-orm";
+import { and as and13, eq as eq14, like as like6 } from "drizzle-orm";
 
 // src/db/repositories/gateway-channels.ts
 init_esm_shims();
@@ -3789,24 +4185,69 @@ init_database_wrapper();
 import { eq as eq15, like as like7 } from "drizzle-orm";
 init_schema();
 
+// src/db/repositories/gateway-outbound-messages.ts
+init_esm_shims();
+init_types2();
+init_ids();
+init_database_wrapper();
+init_schema();
+import { and as and14, eq as eq16, isNull as isNull5, like as like8 } from "drizzle-orm";
+
 // src/db/repositories/knowledge.ts
 init_esm_shims();
 init_types2();
 init_config_manager();
 init_ids();
 import { createHash } from "crypto";
-import { and as and11, desc as desc2, eq as eq16, inArray as inArray4, like as like8, or as or5, sql as sql9 } from "drizzle-orm";
+import { and as and15, desc as desc2, eq as eq17, inArray as inArray6, like as like9, or as or6, sql as sql10 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/mcp-servers.ts
 init_esm_shims();
 init_ids();
-import { and as and12, eq as eq17, like as like9 } from "drizzle-orm";
+import { and as and17, eq as eq20, like as like10 } from "drizzle-orm";
 
 // src/tools/mcp/auth-secrets.ts
 init_esm_shims();
 
+// src/mcp/template-resolver.ts
+init_esm_shims();
+
+// src/config/env-resolver.ts
+init_esm_shims();
+init_database_wrapper();
+import { eq as eq19 } from "drizzle-orm";
+
+// src/db/repositories/session-env-selections.ts
+init_esm_shims();
+init_database_wrapper();
+init_schema();
+import { and as and16, eq as eq18 } from "drizzle-orm";
+
+// src/config/env-resolver.ts
+init_schema();
+
+// src/config/env-blocklist.ts
+init_esm_shims();
+var BLOCKED_ENV_PATTERNS = Object.freeze([
+  /^LD_/i,
+  /^DYLD_/i,
+  /^PYTHON(?!_AGOR_)/i
+]);
+
+// src/config/env-vars.ts
+init_esm_shims();
+var V05_SCOPES = ["global", "session"];
+var V05_SCOPE_SET = new Set(V05_SCOPES);
+
+// src/templates/handlebars-helpers.ts
+init_esm_shims();
+import Handlebars from "handlebars";
+
+// src/mcp/template-patterns.ts
+init_esm_shims();
+
 // src/tools/mcp/http-headers.ts
 init_esm_shims();
 
@@ -3818,21 +4259,18 @@ init_schema();
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and13, eq as eq18 } from "drizzle-orm";
+import { and as and18, eq as eq21, inArray as inArray7 } from "drizzle-orm";
 
 // src/db/repositories/repos.ts
 init_esm_shims();
-import { eq as eq19, like as like10, sql as sql10 } from "drizzle-orm";
+import { eq as eq22, like as like11, sql as sql11 } from "drizzle-orm";
 
 // src/config/variant-resolver.ts
 init_esm_shims();
 
 // src/yaml/index.ts
 init_esm_shims();
-import yaml3 from "js-yaml";
-var load2 = yaml3.load;
-var dump2 = yaml3.dump;
-var YAMLException = yaml3.YAMLException;
+import * as yaml3 from "js-yaml";
 
 // src/db/repositories/repos.ts
 init_ids();
@@ -3844,33 +4282,27 @@ init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and14, asc as asc2, desc as desc3, eq as eq20, isNull as isNull5, like as like11, lte, or as or6, sql as sql11 } from "drizzle-orm";
+import { and as and19, asc as asc2, desc as desc3, eq as eq23, isNull as isNull6, like as like12, lte, or as or7, sql as sql12 } from "drizzle-orm";
 
 // src/db/repositories/serialized-sessions.ts
 init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and15, desc as desc4, eq as eq21, lt } from "drizzle-orm";
-
-// src/db/repositories/session-env-selections.ts
-init_esm_shims();
-init_database_wrapper();
-init_schema();
-import { and as and16, eq as eq22 } from "drizzle-orm";
+import { and as and20, desc as desc4, eq as eq24, lt } from "drizzle-orm";
 
 // src/db/repositories/session-mcp-servers.ts
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and18, eq as eq24 } from "drizzle-orm";
+import { and as and22, eq as eq26 } from "drizzle-orm";
 
 // src/db/repositories/sessions.ts
 init_esm_shims();
 init_types2();
 init_config_manager();
 init_ids();
-import { and as and17, desc as desc5, eq as eq23, inArray as inArray5, like as like12, or as or7, sql as sql12 } from "drizzle-orm";
+import { and as and21, desc as desc5, eq as eq25, inArray as inArray8, like as like13, or as or8, sql as sql13 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
 
@@ -3879,7 +4311,7 @@ init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and19, eq as eq25, inArray as inArray6, or as or8 } from "drizzle-orm";
+import { and as and23, eq as eq27, inArray as inArray9, or as or9 } from "drizzle-orm";
 
 // src/db/repositories/tasks.ts
 init_esm_shims();
@@ -3887,7 +4319,7 @@ init_types2();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { eq as eq26, inArray as inArray7, like as like13, sql as sql13 } from "drizzle-orm";
+import { and as and24, eq as eq28, inArray as inArray10, like as like14, sql as sql14 } from "drizzle-orm";
 
 // src/db/repositories/thread-session-map.ts
 init_esm_shims();
@@ -3895,34 +4327,28 @@ init_types2();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and20, eq as eq27, like as like14, lt as lt2 } from "drizzle-orm";
+import { and as and25, eq as eq29, like as like15, lt as lt2 } from "drizzle-orm";
 
 // src/db/repositories/user-api-keys.ts
 init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
+init_tenant_context();
 import { randomBytes as randomBytes3 } from "crypto";
 import bcrypt2 from "bcryptjs";
-import { and as and21, eq as eq28 } from "drizzle-orm";
+import { and as and26, eq as eq30 } from "drizzle-orm";
 
 // src/db/repositories/user-mcp-oauth-tokens.ts
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and22, eq as eq29, isNull as isNull6 } from "drizzle-orm";
+import { and as and27, eq as eq31, isNull as isNull7 } from "drizzle-orm";
 
 // src/db/repositories/users.ts
 init_esm_shims();
 init_types2();
-import { eq as eq30, like as like15, sql as sql14 } from "drizzle-orm";
-
-// src/config/env-vars.ts
-init_esm_shims();
-var V05_SCOPES = ["global", "session"];
-var V05_SCOPE_SET = new Set(V05_SCOPES);
-
-// src/db/repositories/users.ts
+import { eq as eq32, like as like16, sql as sql15 } from "drizzle-orm";
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -3935,6 +4361,7 @@ init_esm_shims();
 init_ids();
 
 // src/db/index.ts
+init_tenant_scope();
 init_user_utils();
 var compare = bcryptjs.compare;
 var hash = bcryptjs.hash;
@@ -3988,8 +4415,8 @@ function extractTasksFromMessages(messages4, sessionId) {
     const userMessage = messages4[startIndex];
     const endIndex = i < userMessageIndices.length - 1 ? userMessageIndices[i + 1] - 1 : messages4.length - 1;
     const messagesInRange = messages4.slice(startIndex, endIndex + 1);
-    const toolUseCount = messagesInRange.reduce((count, msg) => {
-      return count + (msg.tool_uses?.length ?? 0);
+    const toolUseCount = messagesInRange.reduce((count2, msg) => {
+      return count2 + (msg.tool_uses?.length ?? 0);
     }, 0);
     let fullPrompt = "";
     if (typeof userMessage.content === "string") {