agor-live 0.22.0 → 0.23.2

package/dist/core/tools/mcp/auth-secrets.js

@@ -1,3 +1,3473 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/config/env-resolver.ts
+import { eq as eq2 } from "drizzle-orm";
+
+// src/db/database-wrapper.ts
+import { sql } from "drizzle-orm";
+
+// src/db/tenant-context.ts
+import { AsyncLocalStorage } from "async_hooks";
+var tenantDatabaseScope = new AsyncLocalStorage();
+
+// src/db/encryption.ts
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "crypto";
+
+// src/db/repositories/session-env-selections.ts
+import { and, eq } from "drizzle-orm";
+
+// src/db/schema.postgres.ts
+var schema_postgres_exports = {};
+__export(schema_postgres_exports, {
+  appVariables: () => appVariables,
+  artifactTrustGrants: () => artifactTrustGrants,
+  artifacts: () => artifacts,
+  boardComments: () => boardComments,
+  boardGroupGrants: () => boardGroupGrants,
+  boardObjects: () => boardObjects,
+  boardOwners: () => boardOwners,
+  boards: () => boards,
+  branchGroupGrants: () => branchGroupGrants,
+  branchOwners: () => branchOwners,
+  branches: () => branches,
+  branchesRelations: () => branchesRelations,
+  cardTypes: () => cardTypes,
+  cards: () => cards,
+  gatewayChannels: () => gatewayChannels,
+  gatewayOutboundMessages: () => gatewayOutboundMessages,
+  groupMemberships: () => groupMemberships,
+  groups: () => groups,
+  kbDocumentUnits: () => kbDocumentUnits,
+  kbDocumentVersions: () => kbDocumentVersions,
+  kbDocuments: () => kbDocuments,
+  kbEmbeddingSpaces: () => kbEmbeddingSpaces,
+  kbGraphEdges: () => kbGraphEdges,
+  kbGraphNodes: () => kbGraphNodes,
+  kbNamespaceAcl: () => kbNamespaceAcl,
+  kbNamespaces: () => kbNamespaces,
+  mcpServers: () => mcpServers,
+  messages: () => messages,
+  repos: () => repos,
+  schedules: () => schedules,
+  schedulesRelations: () => schedulesRelations,
+  serializedSessions: () => serializedSessions,
+  sessionEnvSelections: () => sessionEnvSelections,
+  sessionMcpServers: () => sessionMcpServers,
+  sessionRelationships: () => sessionRelationships,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations,
+  sessions: () => sessions,
+  sessionsRelations: () => sessionsRelations,
+  tasks: () => tasks,
+  threadSessionMap: () => threadSessionMap,
+  userApiKeys: () => userApiKeys,
+  userMcpOauthTokens: () => userMcpOauthTokens,
+  users: () => users
+});
+
+// src/types/branch.ts
+var BRANCH_PERMISSION_LEVELS = ["none", "view", "session", "prompt", "all"];
+
+// src/types/session.ts
+var SessionStatus = {
+  IDLE: "idle",
+  RUNNING: "running",
+  STOPPING: "stopping",
+  // Stop requested, waiting for task to stop
+  AWAITING_PERMISSION: "awaiting_permission",
+  AWAITING_INPUT: "awaiting_input",
+  // Legacy / pre-#1177: AskUserQuestion was disallowed at the SDK; new sessions never enter this state, kept for historical rows
+  TIMED_OUT: "timed_out",
+  // Permission/input request timed out, executor exited — user must re-prompt
+  COMPLETED: "completed",
+  FAILED: "failed"
+};
+var EXECUTING_SESSION_STATUSES = /* @__PURE__ */ new Set([
+  SessionStatus.RUNNING,
+  SessionStatus.STOPPING,
+  SessionStatus.AWAITING_PERMISSION,
+  SessionStatus.AWAITING_INPUT
+]);
+
+// src/types/task.ts
+var TaskStatus = {
+  QUEUED: "queued",
+  // Task created but not yet running (waiting for executor to drain queue)
+  CREATED: "created",
+  RUNNING: "running",
+  STOPPING: "stopping",
+  // Stop requested, waiting for SDK to halt
+  AWAITING_PERMISSION: "awaiting_permission",
+  AWAITING_INPUT: "awaiting_input",
+  // Legacy / pre-#1177: AskUserQuestion was disallowed at the SDK; new tasks never enter this state, kept for historical rows
+  TIMED_OUT: "timed_out",
+  // Permission/input request timed out, executor exited — user must re-prompt
+  COMPLETED: "completed",
+  FAILED: "failed",
+  STOPPED: "stopped"
+  // User-requested stop (distinct from failed)
+};
+var TERMINAL_TASK_STATUSES = /* @__PURE__ */ new Set([
+  TaskStatus.COMPLETED,
+  TaskStatus.FAILED,
+  TaskStatus.STOPPED,
+  TaskStatus.TIMED_OUT
+]);
+var EXECUTING_TASK_STATUSES = /* @__PURE__ */ new Set([
+  TaskStatus.RUNNING,
+  TaskStatus.STOPPING,
+  TaskStatus.AWAITING_PERMISSION,
+  TaskStatus.AWAITING_INPUT
+]);
+
+// src/types/user.ts
+var ROLES = {
+  SUPERADMIN: "superadmin",
+  ADMIN: "admin",
+  MEMBER: "member",
+  VIEWER: "viewer"
+};
+var ROLE_OPTIONS = [
+  {
+    value: ROLES.SUPERADMIN,
+    label: "Superadmin",
+    description: "Full system access + branch RBAC bypass"
+  },
+  {
+    value: ROLES.ADMIN,
+    label: "Admin",
+    description: "Manage resources (users, MCP servers, config)"
+  },
+  { value: ROLES.MEMBER, label: "Member", description: "Standard user" },
+  { value: ROLES.VIEWER, label: "Viewer", description: "Read-only access" }
+];
+var ROLE_RANK = {
+  [ROLES.VIEWER]: 0,
+  [ROLES.MEMBER]: 1,
+  [ROLES.ADMIN]: 2,
+  [ROLES.SUPERADMIN]: 3,
+  owner: 3
+};
+
+// src/db/schema.postgres.ts
+import { relations, sql as sql2 } from "drizzle-orm";
+import {
+  bigint,
+  boolean,
+  customType,
+  index,
+  integer,
+  jsonb,
+  pgTable,
+  primaryKey,
+  text,
+  timestamp,
+  uniqueIndex,
+  varchar
+} from "drizzle-orm/pg-core";
+var bytea = customType({
+  dataType() {
+    return "bytea";
+  }
+});
+var t = {
+  timestamp: (name) => timestamp(name, { mode: "date", withTimezone: true }),
+  bool: (name) => boolean(name),
+  json: (name) => jsonb(name).$type()
+};
+var sessions = pgTable(
+  "sessions",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    // Primary identity
+    session_id: varchar("session_id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    // User attribution
+    created_by: varchar("created_by", { length: 36 }).notNull(),
+    // Unix username for SDK impersonation (immutable once set)
+    // Set from creator's unix_username at session creation time
+    // NEVER changes, even if user's unix_username changes later
+    // This ensures SDK session data remains accessible in the original home directory
+    unix_username: text("unix_username"),
+    // Materialized for filtering/joins (cross-DB compatible)
+    status: text("status", {
+      enum: [
+        "idle",
+        "running",
+        "stopping",
+        "awaiting_permission",
+        "awaiting_input",
+        "timed_out",
+        "completed",
+        "failed"
+      ]
+    }).notNull(),
+    agentic_tool: text("agentic_tool", {
+      enum: ["claude-code", "claude-code-cli", "codex", "gemini", "opencode", "copilot", "cursor"]
+    }).notNull(),
+    board_id: varchar("board_id", { length: 36 }),
+    // NULL = no board
+    // Genealogy (materialized for tree queries)
+    parent_session_id: varchar("parent_session_id", { length: 36 }),
+    forked_from_session_id: varchar("forked_from_session_id", { length: 36 }),
+    // Branch reference (REQUIRED: all sessions must have a branch)
+    branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, {
+      onDelete: "cascade"
+      // Cascade delete sessions when branch is deleted
+    }),
+    // Scheduler tracking (materialized for deduplication and retention cleanup)
+    scheduled_run_at: bigint("scheduled_run_at", { mode: "number" }),
+    // Unix timestamp (ms) - authoritative run ID - bigint to support dates beyond 2038
+    scheduled_from_branch: t.bool("scheduled_from_branch").notNull().default(false),
+    // FK to schedules.schedule_id, ON DELETE SET NULL. Defined here (not
+    // just in the migration) so drizzle-kit / db introspection sees the
+    // constraint and so future schema diffs don't lose it.
+    schedule_id: varchar("schedule_id", { length: 36 }).references(
+      () => schedules.schedule_id,
+      { onDelete: "set null" }
+    ),
+    // UI state (materialized for efficient highlighting queries)
+    ready_for_prompt: t.bool("ready_for_prompt").notNull().default(false),
+    // Archive state (cascaded from branch archive)
+    archived: t.bool("archived").notNull().default(false),
+    archived_reason: text("archived_reason", {
+      enum: ["branch_archived", "manual", "btw_completed"]
+    }),
+    // JSON blob for everything else (cross-DB via json() type)
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: index("sessions_tenant_id_idx").on(table.tenant_id),
+    statusIdx: index("sessions_status_idx").on(table.status),
+    statusReadyIdx: index("sessions_status_ready_idx").on(table.status, table.ready_for_prompt),
+    agenticToolIdx: index("sessions_agentic_tool_idx").on(table.agentic_tool),
+    boardIdx: index("sessions_board_idx").on(table.board_id),
+    branchIdx: index("sessions_branch_idx").on(table.branch_id),
+    createdIdx: index("sessions_created_idx").on(table.created_at),
+    parentIdx: index("sessions_parent_idx").on(table.parent_session_id),
+    forkedIdx: index("sessions_forked_idx").on(table.forked_from_session_id),
+    // Scheduler indexes — including the partial unique index below.
+    scheduledFromBranchIdx: index("sessions_scheduled_flag_idx").on(table.scheduled_from_branch),
+    // Partial unique index — covering for the scheduler's dedup lookup
+    // AND serves as the DB-level guard against check-then-create races
+    // in spawnScheduledSession.
+    scheduleRunUnique: uniqueIndex("sessions_schedule_run_unique").on(table.tenant_id, table.schedule_id, table.scheduled_run_at).where(sql2`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
+  })
+);
+var sessionRelationships = pgTable(
+  "session_relationships",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    relationship_id: varchar("relationship_id", { length: 36 }).primaryKey(),
+    source_session_id: varchar("source_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    target_session_id: varchar("target_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    relationship_type: text("relationship_type", { enum: ["remote_create"] }).notNull(),
+    created_by: varchar("created_by", { length: 36 }).notNull(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    callback_enabled: t.bool("callback_enabled").notNull().default(false),
+    callback_session_id: varchar("callback_session_id", { length: 36 }).references(
+      () => sessions.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    data: t.json("data")
+  },
+  (table) => ({
+    tenantIdx: index("session_relationships_tenant_id_idx").on(table.tenant_id),
+    sourceIdx: index("session_relationships_source_idx").on(table.source_session_id),
+    targetIdx: index("session_relationships_target_idx").on(table.target_session_id),
+    callbackIdx: index("session_relationships_callback_idx").on(table.callback_session_id),
+    // Composite indexes so the OR predicate in dispatchCompletionCallbacks
+    // (WHERE source_session_id = $1 OR target_session_id = $2) uses BitmapOr
+    // over these instead of a full tenant table scan via tenant_id_idx.
+    tenantSourceIdx: index("session_relationships_tenant_source_idx").on(
+      table.tenant_id,
+      table.source_session_id
+    ),
+    tenantTargetIdx: index("session_relationships_tenant_target_idx").on(
+      table.tenant_id,
+      table.target_session_id
+    ),
+    sourceTargetTypeUnique: uniqueIndex("session_relationships_source_target_type_unique").on(
+      table.tenant_id,
+      table.source_session_id,
+      table.target_session_id,
+      table.relationship_type
+    )
+  })
+);
+var tasks = pgTable(
+  "tasks",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    task_id: varchar("task_id", { length: 36 }).primaryKey(),
+    session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    created_at: t.timestamp("created_at").notNull(),
+    started_at: t.timestamp("started_at"),
+    completed_at: t.timestamp("completed_at"),
+    last_executor_heartbeat_at: t.timestamp("last_executor_heartbeat_at"),
+    status: text("status", {
+      enum: [
+        "queued",
+        "created",
+        "running",
+        "stopping",
+        "awaiting_permission",
+        "awaiting_input",
+        "timed_out",
+        "completed",
+        "failed",
+        "stopped"
+      ]
+    }).notNull(),
+    // Queue position (lower drains first); only populated for status='queued'
+    queue_position: integer("queue_position"),
+    // User attribution
+    created_by: varchar("created_by", { length: 36 }).notNull(),
+    // MD5 of SDK session file at task completion (only populated when stateless_fs_mode is enabled)
+    session_md5: text("session_md5"),
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: index("tasks_tenant_id_idx").on(table.tenant_id),
+    sessionIdx: index("tasks_session_idx").on(table.session_id),
+    statusIdx: index("tasks_status_idx").on(table.status),
+    createdIdx: index("tasks_created_idx").on(table.created_at),
+    // Composite for "latest task for session" queries (ORDER BY created_at DESC LIMIT 1).
+    sessionCreatedIdx: index("tasks_session_created_idx").on(table.session_id, table.created_at),
+    queueIdx: index("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
+    // Partial unique index — defense-in-depth for `tasks.createPending` race
+    // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
+    // rows have NULL queue_position and are unaffected.
+    queuedPositionUnique: uniqueIndex("tasks_queued_position_unique").on(table.tenant_id, table.session_id, table.queue_position).where(sql2`${table.status} = 'queued'`)
+  })
+);
+var serializedSessions = pgTable(
+  "serialized_sessions",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    id: varchar("id", { length: 36 }).primaryKey(),
+    session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
+    task_id: varchar("task_id", { length: 36 }).references(() => tasks.task_id, {
+      onDelete: "set null"
+    }),
+    turn_index: integer("turn_index").notNull().default(0),
+    created_at: t.timestamp("created_at").notNull(),
+    md5: text("md5").notNull(),
+    status: text("status").notNull(),
+    // 'processing' | 'done' — validated at app layer
+    payload: bytea("payload")
+    // gzipped; NULL while status='processing'
+  },
+  (table) => ({
+    tenantIdx: index("serialized_sessions_tenant_id_idx").on(table.tenant_id),
+    sessionTurnIdx: index("serialized_sessions_session_turn_idx").on(
+      table.session_id,
+      table.turn_index
+    ),
+    branchIdx: index("serialized_sessions_branch_idx").on(table.branch_id)
+  })
+);
+var messages = pgTable(
+  "messages",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    // Primary identity
+    message_id: varchar("message_id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    // Foreign keys (materialized for indexes)
+    session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    task_id: varchar("task_id", { length: 36 }).references(() => tasks.task_id, {
+      onDelete: "set null"
+    }),
+    // Materialized for queries
+    type: text("type", {
+      enum: [
+        "user",
+        "assistant",
+        "system",
+        "file-history-snapshot",
+        "permission_request",
+        "input_request",
+        "daemon_restart",
+        "daemon_crash",
+        "widget_request"
+      ]
+    }).notNull(),
+    role: text("role", {
+      enum: ["user", "assistant", "system"]
+    }).notNull(),
+    index: integer("index").notNull(),
+    // Position in conversation (0-based)
+    timestamp: t.timestamp("timestamp").notNull(),
+    content_preview: text("content_preview"),
+    // First 200 chars for list views
+    // Parent tool use ID (for nested tool calls - e.g., Task tool spawning Read/Grep)
+    parent_tool_use_id: text("parent_tool_use_id"),
+    // NOTE: queueing moved off `messages` and onto `tasks.status='queued'` as
+    // of migration sqlite/0040 (postgres/0030). The legacy `status` and
+    // `queue_position` columns are gone — see `tasks.queue_position` instead.
+    // Full data (JSON blob)
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: index("messages_tenant_id_idx").on(table.tenant_id),
+    tenantTimestampIdx: index("messages_tenant_timestamp_idx").on(table.tenant_id, table.timestamp),
+    // Indexes for efficient lookups
+    sessionIdx: index("messages_session_id_idx").on(table.session_id),
+    taskIdx: index("messages_task_id_idx").on(table.task_id),
+    sessionIndexIdx: index("messages_session_index_idx").on(table.session_id, table.index),
+    timestampIdx: index("messages_timestamp_idx").on(table.timestamp),
+    sessionTimestampIdx: index("messages_session_timestamp_idx").on(
+      table.session_id,
+      table.timestamp
+    )
+  })
+);
+var boards = pgTable(
+  "boards",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    board_id: varchar("board_id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    // User attribution
+    created_by: varchar("created_by", { length: 36 }).notNull(),
+    // Materialized for lookups
+    name: text("name").notNull(),
+    slug: text("slug"),
+    primary_assistant_id: varchar("primary_assistant_id", { length: 36 }).references(
+      () => branches.branch_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    // JSON blob for the rest
+    data: t.json("data").$type().notNull(),
+    // Archive state (for soft deletes)
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at"),
+    archived_by: varchar("archived_by", { length: 36 })
+  },
+  (table) => ({
+    tenantIdx: index("boards_tenant_id_idx").on(table.tenant_id),
+    nameIdx: index("boards_name_idx").on(table.name),
+    slugIdx: index("boards_slug_idx").on(table.slug),
+    slugTenantUnique: uniqueIndex("boards_tenant_slug_unique").on(table.tenant_id, table.slug)
+  })
+);
+var repos = pgTable(
+  "repos",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    repo_id: varchar("repo_id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    // Materialized for querying
+    slug: text("slug").notNull(),
+    repo_type: text("repo_type", { enum: ["remote", "local"] }).notNull().default("remote"),
+    // Unix group for repo-level git access (agor_rp_<short-id>)
+    // Users who have access to ANY branch in this repo get added to this group.
+    // Applied to repo Unix-group-managed paths:
+    // - repo root (non-recursive) for traversal into .git/worktrees/<name>
+    // - .git (recursive) for shared git objects/refs and git operations
+    unix_group: text("unix_group"),
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: index("repos_tenant_id_idx").on(table.tenant_id),
+    slugIdx: index("repos_slug_idx").on(table.slug),
+    slugTenantUnique: uniqueIndex("repos_tenant_slug_unique").on(table.tenant_id, table.slug)
+  })
+);
+var branches = pgTable(
+  "branches",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    // Primary identity
+    branch_id: varchar("branch_id", { length: 36 }).primaryKey(),
+    repo_id: varchar("repo_id", { length: 36 }).notNull().references(() => repos.repo_id, { onDelete: "cascade" }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    // User attribution
+    created_by: varchar("created_by", { length: 36 }).notNull(),
+    // Materialized for queries
+    name: text("name").notNull(),
+    // "feat-auth", "main"
+    ref: text("ref").notNull(),
+    // Current branch/tag/commit
+    ref_type: text("ref_type", { enum: ["branch", "tag"] }),
+    // Type of ref (branch or tag)
+    branch_unique_id: integer("branch_unique_id").notNull(),
+    // Auto-assigned sequential ID for templates
+    // Environment configuration (static, initialized from templates, then user-editable)
+    start_command: text("start_command"),
+    // Start command (initialized from repo's up_command template)
+    stop_command: text("stop_command"),
+    // Stop command (initialized from repo's down_command template)
+    nuke_command: text("nuke_command"),
+    // Nuke command (initialized from repo's nuke_command template)
+    health_check_url: text("health_check_url"),
+    // Health check URL (initialized from repo's health_check.url_template)
+    app_url: text("app_url"),
+    // Application URL (initialized from repo's app_url_template)
+    logs_command: text("logs_command"),
+    // Logs command (initialized from repo's logs_command template)
+    // Name of the environment variant currently rendered into the command fields above.
+    // References a key under repo.environment.variants. Null for pre-v2 branches.
+    environment_variant: text("environment_variant"),
+    // Board relationship (nullable - branches can exist without boards)
+    board_id: varchar("board_id", { length: 36 }).references(() => boards.board_id, {
+      onDelete: "set null"
+      // If board is deleted, branch remains but loses board association
+    }),
+    // UI state (materialized for efficient highlighting queries)
+    needs_attention: t.bool("needs_attention").notNull().default(true),
+    // Default true for new branches
+    // Archive state (for soft deletes)
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at"),
+    archived_by: varchar("archived_by", { length: 36 }),
+    filesystem_status: text("filesystem_status", {
+      enum: ["creating", "ready", "failed", "preserved", "cleaned", "deleted"]
+    }),
+    // RBAC: App-layer permissions (rbac.md)
+    permission_source: text("permission_source", { enum: ["board", "override"] }).$type().notNull().default("override"),
+    others_can: text("others_can", {
+      enum: [...BRANCH_PERMISSION_LEVELS]
+    }).default("view"),
+    // RBAC: OS-layer permissions (unix-user-modes.md)
+    unix_group: text("unix_group"),
+    // e.g., 'agor_wt_abc123'
+    others_fs_access: text("others_fs_access", {
+      enum: ["none", "read", "write"]
+    }).$type().default("read"),
+    // Branch storage model — see context/explorations/clone-redesign.md.
+    // 'worktree' = native `git worktree add` (shared base .git/config — legacy default).
+    // 'clone'    = self-standing `git clone` (own .git/ — closes cross-branch leak vectors).
+    //
+    // No DB-side CHECK: enum is validated at the Drizzle/TS/Zod/service
+    // layer to stay symmetric with the SQLite mirror (which can't easily
+    // alter CHECK constraints in place).
+    storage_mode: text("storage_mode", { enum: ["worktree", "clone"] }).notNull().default("worktree"),
+    // Only meaningful when storage_mode='clone'. NULL = full clone, positive
+    // integer = `git clone --depth N` (shallow). The service layer rejects
+    // a non-null clone_depth on worktree-mode rows.
+    clone_depth: integer("clone_depth"),
+    // JSON blob for everything else
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: index("branches_tenant_id_idx").on(table.tenant_id),
+    repoIdx: index("branches_repo_idx").on(table.repo_id),
+    nameIdx: index("branches_name_idx").on(table.name),
+    refIdx: index("branches_ref_idx").on(table.ref),
+    boardIdx: index("branches_board_idx").on(table.board_id),
+    createdIdx: index("branches_created_idx").on(table.created_at),
+    updatedIdx: index("branches_updated_idx").on(table.updated_at),
+    // Composite unique constraint (repo + name)
+    uniqueRepoName: index("branches_repo_name_unique").on(table.repo_id, table.name)
+  })
+);
+var branchOwners = pgTable(
+  "branch_owners",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
+    user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
+    created_at: t.timestamp("created_at").defaultNow()
+  },
+  (table) => ({
+    tenantIdx: index("branch_owners_tenant_id_idx").on(table.tenant_id),
+    pk: primaryKey({ columns: [table.branch_id, table.user_id] })
+  })
+);
+var boardOwners = pgTable(
+  "board_owners",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
+    user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
+    created_at: t.timestamp("created_at")
+  },
+  (table) => ({
+    tenantIdx: index("board_owners_tenant_id_idx").on(table.tenant_id),
+    pk: primaryKey({ columns: [table.board_id, table.user_id] }),
+    userIdx: index("board_owners_user_idx").on(table.user_id)
+  })
+);
+var schedules = pgTable(
+  "schedules",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    schedule_id: varchar("schedule_id", { length: 36 }).primaryKey(),
+    branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    description: text("description"),
+    cron_expression: text("cron_expression").notNull(),
+    timezone_mode: text("timezone_mode", { enum: ["local", "utc"] }).notNull().default("local"),
+    timezone: text("timezone"),
+    prompt: text("prompt").notNull(),
+    agentic_tool_config: t.json("agentic_tool_config").notNull(),
+    enabled: t.bool("enabled").notNull().default(true),
+    allow_concurrent_runs: t.bool("allow_concurrent_runs").notNull().default(false),
+    retention: integer("retention").notNull().default(5),
+    last_run_at: bigint("last_run_at", { mode: "number" }),
+    last_run_session_id: varchar("last_run_session_id", { length: 36 }).references(
+      () => sessions.session_id,
+      { onDelete: "set null" }
+    ),
+    next_run_at: bigint("next_run_at", { mode: "number" }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at").notNull(),
+    created_by: varchar("created_by", { length: 36 }).notNull().references(() => users.user_id)
+  },
+  (table) => ({
+    tenantIdx: index("schedules_tenant_id_idx").on(table.tenant_id),
+    enabledNextRunIdx: index("schedules_enabled_next_run_idx").on(table.enabled, table.next_run_at),
+    branchIdx: index("schedules_branch_idx").on(table.branch_id),
+    createdByIdx: index("schedules_created_by_idx").on(table.created_by)
+  })
+);
+var users = pgTable(
+  "users",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    // Primary identity
+    user_id: varchar("user_id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    // Materialized for auth lookups
+    email: text("email").notNull(),
+    password: text("password").notNull(),
+    // bcrypt hashed
+    // Basic profile (materialized for display)
+    name: text("name"),
+    emoji: text("emoji"),
+    role: text("role", {
+      enum: ["superadmin", "admin", "member", "viewer"]
+      // 'owner' is deprecated alias for 'superadmin'
+    }).notNull().default("member"),
+    // Unix username for process impersonation (optional, app-enforced uniqueness)
+    unix_username: text("unix_username"),
+    // Onboarding state
+    onboarding_completed: t.bool("onboarding_completed").notNull().default(false),
+    // Force password change flag (admin-settable, auto-cleared on password change)
+    must_change_password: t.bool("must_change_password").notNull().default(false),
+    // Auth invalidation marker. Password changes set this timestamp so any
+    // previously issued browser access or refresh token is rejected.
+    tokens_valid_after: t.timestamp("tokens_valid_after"),
+    // JSON blob for profile/preferences
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: index("users_tenant_id_idx").on(table.tenant_id),
+    emailIdx: index("users_email_idx").on(table.email),
+    emailTenantUnique: uniqueIndex("users_tenant_email_unique").on(table.tenant_id, table.email)
+  })
+);
+var groups = pgTable(
+  "groups",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    group_id: varchar("group_id", { length: 36 }).primaryKey(),
+    name: text("name").notNull(),
+    slug: text("slug").notNull(),
+    description: text("description"),
+    archived: t.bool("archived").notNull().default(false),
+    created_by: varchar("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at")
+  },
+  (table) => ({
+    tenantIdx: index("groups_tenant_id_idx").on(table.tenant_id),
+    slugIdx: uniqueIndex("groups_tenant_slug_unique").on(table.tenant_id, table.slug),
+    archivedIdx: index("groups_archived_idx").on(table.archived)
+  })
+);
+var groupMemberships = pgTable(
+  "group_memberships",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    group_id: varchar("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
+    user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
+    added_by: varchar("added_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull()
+  },
+  (table) => ({
+    tenantIdx: index("group_memberships_tenant_id_idx").on(table.tenant_id),
+    pk: primaryKey({ columns: [table.group_id, table.user_id] }),
+    userIdx: index("group_memberships_user_idx").on(table.user_id)
+  })
+);
+var branchGroupGrants = pgTable(
+  "branch_group_grants",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
+    group_id: varchar("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
+    can: text("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
+    fs_access: text("fs_access", { enum: ["none", "read", "write"] }).$type(),
+    created_by: varchar("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at")
+  },
+  (table) => ({
+    tenantIdx: index("branch_group_grants_tenant_id_idx").on(table.tenant_id),
+    pk: primaryKey({ columns: [table.branch_id, table.group_id] }),
+    groupIdx: index("branch_group_grants_group_idx").on(table.group_id)
+  })
+);
+var boardGroupGrants = pgTable(
+  "board_group_grants",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
+    group_id: varchar("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
+    can: text("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
+    fs_access: text("fs_access", { enum: ["none", "read", "write"] }).$type(),
+    created_by: varchar("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at")
+  },
+  (table) => ({
+    tenantIdx: index("board_group_grants_tenant_id_idx").on(table.tenant_id),
+    pk: primaryKey({ columns: [table.board_id, table.group_id] }),
+    groupIdx: index("board_group_grants_group_idx").on(table.group_id)
+  })
+);
+var appVariables = pgTable(
+  "app_variables",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    variable_id: varchar("variable_id", { length: 36 }).primaryKey(),
+    namespace: text("namespace").notNull(),
+    key: text("key").notNull(),
+    value_text: text("value_text"),
+    value_encrypted: text("value_encrypted"),
+    is_encrypted: t.bool("is_encrypted").notNull().default(false),
+    content_type: text("content_type").notNull().default("text/plain"),
+    metadata: t.json("metadata"),
+    updated_by: varchar("updated_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at").notNull()
+  },
+  (table) => ({
+    tenantIdx: index("app_variables_tenant_id_idx").on(table.tenant_id),
+    namespaceKeyIdx: uniqueIndex("app_variables_tenant_namespace_key_unique").on(
+      table.tenant_id,
+      table.namespace,
+      table.key
+    ),
+    namespaceIdx: index("app_variables_namespace_idx").on(table.namespace)
+  })
+);
+var userApiKeys = pgTable(
+  "user_api_keys",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    id: varchar("id", { length: 36 }).primaryKey(),
+    user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    prefix: text("prefix").notNull(),
+    // first 12 chars: 'agor_sk_XXXX' for identification
+    key_hash: text("key_hash").notNull(),
+    // bcrypt hash of full key
+    created_at: t.timestamp("created_at").notNull(),
+    last_used_at: t.timestamp("last_used_at")
+  },
+  (table) => ({
+    tenantIdx: index("user_api_keys_tenant_id_idx").on(table.tenant_id),
+    userIdx: index("user_api_keys_user_idx").on(table.user_id),
+    prefixIdx: index("user_api_keys_prefix_idx").on(table.prefix)
+  })
+);
+var mcpServers = pgTable(
+  "mcp_servers",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    // Primary identity
+    mcp_server_id: varchar("mcp_server_id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    // Materialized for filtering
+    name: text("name").notNull(),
+    // e.g., "filesystem", "sentry"
+    transport: text("transport", {
+      enum: ["stdio", "http", "sse"]
+    }).notNull(),
+    scope: text("scope", {
+      enum: ["global", "session"]
+    }).notNull(),
+    enabled: t.bool("enabled").notNull().default(true),
+    // Scope foreign key
+    // For 'global' scope: which user owns this server
+    // For 'session' scope: use session_mcp_servers junction table (many-to-many)
+    owner_user_id: varchar("owner_user_id", { length: 36 }),
+    // Source tracking (materialized for queries)
+    source: text("source", {
+      enum: ["user", "imported", "agor"]
+    }).notNull(),
+    // JSON blob for configuration and capabilities
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: index("mcp_servers_tenant_id_idx").on(table.tenant_id),
+    nameIdx: index("mcp_servers_name_idx").on(table.name),
+    scopeIdx: index("mcp_servers_scope_idx").on(table.scope),
+    ownerIdx: index("mcp_servers_owner_idx").on(table.owner_user_id),
+    enabledIdx: index("mcp_servers_enabled_idx").on(table.enabled)
+  })
+);
+var cardTypes = pgTable(
+  "card_types",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    card_type_id: varchar("card_type_id", { length: 36 }).primaryKey(),
+    name: text("name").notNull(),
+    emoji: text("emoji"),
+    color: text("color"),
+    json_schema: text("json_schema"),
+    // JSON string of JSON Schema
+    created_by: varchar("created_by", { length: 36 }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at").notNull()
+  },
+  (table) => ({
+    tenantIdx: index("card_types_tenant_id_idx").on(table.tenant_id),
+    nameIdx: index("card_types_name_idx").on(table.name)
+  })
+);
+var cards = pgTable(
+  "cards",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    card_id: varchar("card_id", { length: 36 }).primaryKey(),
+    board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
+    card_type_id: varchar("card_type_id", { length: 36 }).references(() => cardTypes.card_type_id, {
+      onDelete: "set null"
+    }),
+    title: text("title").notNull(),
+    url: text("url"),
+    description: text("description"),
+    note: text("note"),
+    data: text("data"),
+    // JSON blob validated against CardType.json_schema if present
+    color_override: text("color_override"),
+    emoji_override: text("emoji_override"),
+    created_by: varchar("created_by", { length: 36 }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at").notNull(),
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at")
+  },
+  (table) => ({
+    tenantIdx: index("cards_tenant_id_idx").on(table.tenant_id),
+    boardIdx: index("cards_board_idx").on(table.board_id),
+    cardTypeIdx: index("cards_card_type_idx").on(table.card_type_id),
+    titleIdx: index("cards_title_idx").on(table.title),
+    archivedIdx: index("cards_archived_idx").on(table.archived),
+    createdIdx: index("cards_created_idx").on(table.created_at)
+  })
+);
+var artifacts = pgTable(
+  "artifacts",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    artifact_id: varchar("artifact_id", { length: 36 }).primaryKey(),
+    branch_id: varchar("branch_id", { length: 36 }).references(() => branches.branch_id, {
+      onDelete: "set null"
+    }),
+    source_session_id: varchar("source_session_id", { length: 36 }).references(
+      () => sessions.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
+    name: text("name").notNull(),
+    description: text("description"),
+    path: text("path"),
+    // provenance only — where files were read from
+    template: text("template").notNull().default("react"),
+    build_status: text("build_status").notNull().default("unknown"),
+    build_errors: t.json("build_errors"),
+    content_hash: text("content_hash"),
+    files: t.json("files"),
+    dependencies: t.json("dependencies"),
+    entry: text("entry"),
+    // denormalized cache of the Sandpack entry file
+    sandpack_config: t.json("sandpack_config"),
+    required_env_vars: t.json("required_env_vars"),
+    agor_grants: t.json("agor_grants"),
+    agor_runtime: t.json("agor_runtime"),
+    public: t.bool("public").notNull().default(true),
+    created_by: varchar("created_by", { length: 36 }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at").notNull(),
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at")
+  },
+  (table) => ({
+    tenantIdx: index("artifacts_tenant_id_idx").on(table.tenant_id),
+    branchIdx: index("artifacts_branch_idx").on(table.branch_id),
+    sourceSessionIdx: index("artifacts_source_session_idx").on(table.source_session_id),
+    boardIdx: index("artifacts_board_idx").on(table.board_id),
+    archivedIdx: index("artifacts_archived_idx").on(table.archived),
+    publicIdx: index("artifacts_public_idx").on(table.public)
+  })
+);
+var artifactTrustGrants = pgTable(
+  "artifact_trust_grants",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    grant_id: varchar("grant_id", { length: 36 }).primaryKey(),
+    user_id: varchar("user_id", { length: 36 }).notNull(),
+    scope_type: text("scope_type").notNull(),
+    scope_value: text("scope_value"),
+    env_vars_set: t.json("env_vars_set").notNull(),
+    agor_grants_set: t.json("agor_grants_set").notNull(),
+    granted_at: t.timestamp("granted_at").notNull(),
+    revoked_at: t.timestamp("revoked_at")
+  },
+  (table) => ({
+    tenantIdx: index("artifact_trust_grants_tenant_id_idx").on(table.tenant_id),
+    userIdx: index("artifact_trust_grants_user_idx").on(table.user_id),
+    scopeIdx: index("artifact_trust_grants_scope_idx").on(table.scope_type, table.scope_value)
+  })
+);
+var boardObjects = pgTable(
+  "board_objects",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    // Primary identity
+    object_id: varchar("object_id", { length: 36 }).primaryKey(),
+    board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
+    created_at: t.timestamp("created_at").notNull(),
+    // Polymorphic entity reference (exactly one must be set)
+    branch_id: varchar("branch_id", { length: 36 }).references(() => branches.branch_id, {
+      onDelete: "cascade"
+    }),
+    card_id: varchar("card_id", { length: 36 }).references(() => cards.card_id, {
+      onDelete: "cascade"
+    }),
+    // Position data (JSON)
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: index("board_objects_tenant_id_idx").on(table.tenant_id),
+    boardIdx: index("board_objects_board_idx").on(table.board_id),
+    branchIdx: index("board_objects_branch_idx").on(table.branch_id),
+    cardIdx: index("board_objects_card_idx").on(table.card_id)
+  })
+);
+var sessionMcpServers = pgTable(
+  "session_mcp_servers",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    mcp_server_id: varchar("mcp_server_id", { length: 36 }).notNull().references(() => mcpServers.mcp_server_id, { onDelete: "cascade" }),
+    enabled: t.bool("enabled").notNull().default(true),
+    added_at: t.timestamp("added_at").notNull()
+  },
+  (table) => ({
+    tenantIdx: index("session_mcp_servers_tenant_id_idx").on(table.tenant_id),
+    // Composite primary key
+    pk: index("session_mcp_servers_pk").on(table.session_id, table.mcp_server_id),
+    // Indexes for queries
+    sessionIdx: index("session_mcp_servers_session_idx").on(table.session_id),
+    serverIdx: index("session_mcp_servers_server_idx").on(table.mcp_server_id),
+    enabledIdx: index("session_mcp_servers_enabled_idx").on(table.session_id, table.enabled)
+  })
+);
+var userMcpOauthTokens = pgTable(
+  "user_mcp_oauth_tokens",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    // NULL = shared-mode token (one per mcp_server_id)
+    user_id: varchar("user_id", { length: 36 }).references(() => users.user_id, {
+      onDelete: "cascade"
+    }),
+    mcp_server_id: varchar("mcp_server_id", { length: 36 }).notNull().references(() => mcpServers.mcp_server_id, { onDelete: "cascade" }),
+    oauth_access_token: text("oauth_access_token").notNull(),
+    oauth_token_expires_at: t.timestamp("oauth_token_expires_at"),
+    // Unix timestamp in milliseconds
+    oauth_refresh_token: text("oauth_refresh_token"),
+    // DCR / registered client credentials this grant was issued under.
+    // Must be preserved across refreshes.
+    oauth_client_id: text("oauth_client_id"),
+    oauth_client_secret: text("oauth_client_secret"),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at")
+  },
+  (table) => ({
+    tenantIdx: index("user_mcp_oauth_tokens_tenant_id_idx").on(table.tenant_id),
+    // Composite lookup indexes. Uniqueness enforced via partial unique indexes
+    // created in the migration (one for per-user rows, one for the shared row).
+    pk: index("user_mcp_oauth_tokens_pk").on(table.user_id, table.mcp_server_id),
+    userIdx: index("user_mcp_oauth_tokens_user_idx").on(table.user_id),
+    serverIdx: index("user_mcp_oauth_tokens_server_idx").on(table.mcp_server_id)
+  })
+);
+var boardComments = pgTable(
+  "board_comments",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    // Primary identity
+    comment_id: varchar("comment_id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    // Scoping & authorship
+    board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
+    created_by: varchar("created_by", { length: 36 }).notNull(),
+    // FLEXIBLE ATTACHMENTS (all optional)
+    // Phase 1: board-level only (all NULL)
+    // Phase 2: object attachments (session, task, message, branch)
+    // Phase 3: spatial positioning
+    session_id: varchar("session_id", { length: 36 }).references(() => sessions.session_id, {
+      onDelete: "set null"
+    }),
+    task_id: varchar("task_id", { length: 36 }).references(() => tasks.task_id, {
+      onDelete: "set null"
+    }),
+    message_id: varchar("message_id", { length: 36 }).references(() => messages.message_id, {
+      onDelete: "set null"
+    }),
+    branch_id: varchar("branch_id", { length: 36 }).references(() => branches.branch_id, {
+      onDelete: "cascade"
+    }),
+    // Content (materialized for display)
+    content: text("content").notNull(),
+    // Markdown-supported text
+    content_preview: text("content_preview").notNull(),
+    // First 200 chars
+    // Thread support (optional)
+    parent_comment_id: varchar("parent_comment_id", { length: 36 }),
+    // Metadata (materialized for filtering)
+    resolved: t.bool("resolved").notNull().default(false),
+    edited: t.bool("edited").notNull().default(false),
+    // Reactions (for BOTH thread roots and replies)
+    // Stored as JSON array: [{ user_id: "abc", emoji: "👍" }, ...]
+    // Display grouped by emoji: { "👍": ["alice", "bob"], "🎉": ["charlie"] }
+    reactions: t.json("reactions").$type().notNull().default(sql2`'[]'`),
+    // JSON blob for advanced features
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: index("board_comments_tenant_id_idx").on(table.tenant_id),
+    boardIdx: index("board_comments_board_idx").on(table.board_id),
+    sessionIdx: index("board_comments_session_idx").on(table.session_id),
+    taskIdx: index("board_comments_task_idx").on(table.task_id),
+    messageIdx: index("board_comments_message_idx").on(table.message_id),
+    branchIdx: index("board_comments_branch_idx").on(table.branch_id),
+    createdByIdx: index("board_comments_created_by_idx").on(table.created_by),
+    parentIdx: index("board_comments_parent_idx").on(table.parent_comment_id),
+    createdIdx: index("board_comments_created_idx").on(table.created_at),
+    resolvedIdx: index("board_comments_resolved_idx").on(table.resolved)
+  })
+);
+var gatewayChannels = pgTable(
+  "gateway_channels",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    // Primary identity
+    id: varchar("id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at").notNull(),
+    // User attribution
+    created_by: varchar("created_by", { length: 36 }).notNull(),
+    // Materialized for queries
+    name: text("name").notNull(),
+    channel_type: text("channel_type", {
+      enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+    }).notNull(),
+    target_branch_id: varchar("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
+    agor_user_id: varchar("agor_user_id", { length: 36 }).notNull(),
+    channel_key: text("channel_key").notNull(),
+    enabled: t.bool("enabled").notNull().default(true),
+    last_message_at: t.timestamp("last_message_at"),
+    // JSON blob for platform credentials (encrypted at rest)
+    config: t.json("config").notNull(),
+    // JSON blob for agentic tool configuration (agent, model, permission mode, etc.)
+    agentic_config: t.json("agentic_config")
+  },
+  (table) => ({
+    tenantIdx: index("gateway_channels_tenant_id_idx").on(table.tenant_id),
+    channelKeyIdx: index("idx_gateway_channel_key").on(table.channel_key),
+    channelKeyTenantUnique: uniqueIndex("gateway_channels_tenant_channel_key_unique").on(
+      table.tenant_id,
+      table.channel_key
+    ),
+    enabledTypeIdx: index("idx_gateway_enabled_type").on(table.enabled, table.channel_type)
+  })
+);
+var threadSessionMap = pgTable(
+  "thread_session_map",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    // Primary identity
+    id: varchar("id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    last_message_at: t.timestamp("last_message_at").notNull(),
+    // Foreign keys
+    channel_id: varchar("channel_id", { length: 36 }).notNull().references(() => gatewayChannels.id, { onDelete: "cascade" }),
+    thread_id: text("thread_id").notNull(),
+    session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id),
+    // Materialized for queries
+    status: text("status", {
+      enum: ["active", "archived", "paused"]
+    }).notNull().default("active"),
+    // JSON blob for extra metadata
+    metadata: t.json("metadata")
+  },
+  (table) => ({
+    tenantIdx: index("thread_session_map_tenant_id_idx").on(table.tenant_id),
+    uniqueChannelThread: uniqueIndex("uniq_thread_map_tenant_channel_thread").on(
+      table.tenant_id,
+      table.channel_id,
+      table.thread_id
+    ),
+    sessionIdx: index("idx_thread_map_session_id").on(table.session_id),
+    threadIdx: index("idx_thread_map_thread_id").on(table.thread_id),
+    channelStatusIdx: index("idx_thread_map_channel_status").on(table.channel_id, table.status)
+  })
+);
+var gatewayOutboundMessages = pgTable(
+  "gateway_outbound_messages",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    id: varchar("id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at").notNull(),
+    gateway_channel_id: varchar("gateway_channel_id", { length: 36 }).notNull().references(() => gatewayChannels.id, { onDelete: "cascade" }),
+    channel_type: text("channel_type", {
+      enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+    }).notNull(),
+    platform_channel_id: text("platform_channel_id").notNull(),
+    platform_message_id: text("platform_message_id").notNull(),
+    platform_thread_id: text("platform_thread_id").notNull(),
+    platform_permalink: text("platform_permalink"),
+    target_branch_id: varchar("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id),
+    emitted_by_user_id: varchar("emitted_by_user_id", { length: 36 }).notNull().references(() => users.user_id),
+    emitted_by_session_id: varchar("emitted_by_session_id", { length: 36 }).references(
+      () => sessions.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    emitted_by_task_id: varchar("emitted_by_task_id", { length: 36 }).references(
+      () => tasks.task_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    emitted_by_schedule_id: varchar("emitted_by_schedule_id", { length: 36 }).references(
+      () => schedules.schedule_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    message_text: text("message_text").notNull(),
+    message_preview: text("message_preview").notNull(),
+    metadata: t.json("metadata"),
+    consumed_by_session_id: varchar("consumed_by_session_id", { length: 36 }).references(
+      () => sessions.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    consumed_at: t.timestamp("consumed_at")
+  },
+  (table) => ({
+    tenantIdx: index("gateway_outbound_messages_tenant_id_idx").on(table.tenant_id),
+    uniqueChannelThread: uniqueIndex("uniq_gateway_outbound_tenant_channel_thread").on(
+      table.tenant_id,
+      table.gateway_channel_id,
+      table.platform_thread_id
+    ),
+    emittedSessionIdx: index("idx_gateway_outbound_emitted_session").on(
+      table.emitted_by_session_id
+    ),
+    emittedScheduleIdx: index("idx_gateway_outbound_emitted_schedule").on(
+      table.emitted_by_schedule_id
+    ),
+    targetBranchCreatedIdx: index("idx_gateway_outbound_branch_created").on(
+      table.target_branch_id,
+      table.created_at
+    ),
+    consumedIdx: index("idx_gateway_outbound_consumed").on(table.consumed_at)
+  })
+);
+var sessionEnvSelections = pgTable(
+  "session_env_selections",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    env_var_name: text("env_var_name").notNull(),
+    created_at: t.timestamp("created_at").notNull()
+  },
+  (table) => ({
+    tenantIdx: index("session_env_selections_tenant_id_idx").on(table.tenant_id),
+    pk: primaryKey({ columns: [table.session_id, table.env_var_name] }),
+    sessionIdx: index("session_env_selections_session_idx").on(table.session_id)
+  })
+);
+var kbNamespaces = pgTable(
+  "kb_namespaces",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    namespace_id: varchar("namespace_id", { length: 36 }).primaryKey(),
+    slug: text("slug").notNull(),
+    display_name: text("display_name").notNull(),
+    description: text("description"),
+    kind: text("kind", { enum: ["system", "global", "user", "repo", "branch", "team"] }).notNull().default("global"),
+    owner_user_id: varchar("owner_user_id", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    repo_id: varchar("repo_id", { length: 36 }).references(() => repos.repo_id, {
+      onDelete: "set null"
+    }),
+    branch_id: varchar("branch_id", { length: 36 }).references(() => branches.branch_id, {
+      onDelete: "set null"
+    }),
+    visibility_default: text("visibility_default", { enum: ["public", "private"] }).notNull().default("public"),
+    others_can: text("others_can", { enum: ["none", "read", "write"] }).notNull().default("write"),
+    metadata: t.json("metadata"),
+    created_by: varchar("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at")
+  },
+  (table) => ({
+    tenantIdx: index("kb_namespaces_tenant_id_idx").on(table.tenant_id),
+    slugIdx: uniqueIndex("kb_namespaces_tenant_slug_unique").on(table.tenant_id, table.slug).where(sql2`${table.archived} = false`),
+    kindIdx: index("kb_namespaces_kind_idx").on(table.kind),
+    ownerIdx: index("kb_namespaces_owner_idx").on(table.owner_user_id),
+    repoIdx: index("kb_namespaces_repo_idx").on(table.repo_id),
+    branchIdx: index("kb_namespaces_branch_idx").on(table.branch_id),
+    archivedIdx: index("kb_namespaces_archived_idx").on(table.archived)
+  })
+);
+var kbNamespaceAcl = pgTable(
+  "kb_namespace_acl",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    namespace_acl_id: varchar("namespace_acl_id", { length: 36 }).primaryKey(),
+    namespace_id: varchar("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces.namespace_id, { onDelete: "cascade" }),
+    subject_type: text("subject_type", { enum: ["user", "group"] }).notNull(),
+    subject_id: varchar("subject_id", { length: 36 }).notNull(),
+    permission: text("permission", { enum: ["read", "write", "own"] }).notNull(),
+    created_by: varchar("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at")
+  },
+  (table) => ({
+    tenantIdx: index("kb_namespace_acl_tenant_id_idx").on(table.tenant_id),
+    namespaceIdx: index("kb_namespace_acl_namespace_idx").on(table.namespace_id),
+    subjectIdx: index("kb_namespace_acl_subject_idx").on(table.subject_type, table.subject_id),
+    namespaceSubjectIdx: uniqueIndex("kb_namespace_acl_tenant_namespace_subject_unique").on(
+      table.tenant_id,
+      table.namespace_id,
+      table.subject_type,
+      table.subject_id
+    )
+  })
+);
+var kbDocuments = pgTable(
+  "kb_documents",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    document_id: varchar("document_id", { length: 36 }).primaryKey(),
+    namespace_id: varchar("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces.namespace_id, { onDelete: "cascade" }),
+    path: text("path").notNull(),
+    uri: text("uri").notNull(),
+    title: text("title").notNull(),
+    icon_emoji: text("icon_emoji"),
+    kind: text("kind", {
+      enum: ["doc", "memory", "skill", "prompt", "guide", "decision", "bundle", "external"]
+    }).notNull().default("doc"),
+    visibility: text("visibility", { enum: ["public", "private"] }).notNull().default("public"),
+    status: text("status", { enum: ["draft", "published"] }).notNull().default("published"),
+    edit_policy: text("edit_policy", { enum: ["owner", "public", "admins"] }).notNull().default("owner"),
+    // Application-maintained pointer. Avoids a circular FK with versions.
+    current_version_id: varchar("current_version_id", { length: 36 }),
+    metadata: t.json("metadata"),
+    created_by: varchar("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_by: varchar("updated_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    updated_at: t.timestamp("updated_at"),
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at")
+  },
+  (table) => ({
+    tenantIdx: index("kb_documents_tenant_id_idx").on(table.tenant_id),
+    namespacePathIdx: uniqueIndex("kb_documents_tenant_namespace_path_unique").on(table.tenant_id, table.namespace_id, table.path).where(sql2`${table.archived} = false`),
+    uriIdx: uniqueIndex("kb_documents_tenant_uri_unique").on(table.tenant_id, table.uri).where(sql2`${table.archived} = false`),
+    namespaceIdx: index("kb_documents_namespace_idx").on(table.namespace_id),
+    kindIdx: index("kb_documents_kind_idx").on(table.kind),
+    visibilityIdx: index("kb_documents_visibility_idx").on(table.visibility),
+    statusIdx: index("kb_documents_status_idx").on(table.status),
+    createdByIdx: index("kb_documents_created_by_idx").on(table.created_by),
+    updatedAtIdx: index("kb_documents_updated_at_idx").on(table.updated_at),
+    archivedIdx: index("kb_documents_archived_idx").on(table.archived)
+  })
+);
+var kbDocumentVersions = pgTable(
+  "kb_document_versions",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    version_id: varchar("version_id", { length: 36 }).primaryKey(),
+    document_id: varchar("document_id", { length: 36 }).notNull().references(() => kbDocuments.document_id, { onDelete: "cascade" }),
+    version_number: integer("version_number").notNull(),
+    content_text: text("content_text"),
+    content_blob: bytea("content_blob"),
+    mime_type: text("mime_type").notNull().default("text/markdown"),
+    content_md5: text("content_md5"),
+    content_sha256: text("content_sha256"),
+    byte_length: integer("byte_length"),
+    char_length: integer("char_length"),
+    frontmatter: t.json("frontmatter"),
+    metadata: t.json("metadata"),
+    change_summary: text("change_summary"),
+    created_by: varchar("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull()
+  },
+  (table) => ({
+    tenantIdx: index("kb_document_versions_tenant_id_idx").on(table.tenant_id),
+    documentVersionIdx: uniqueIndex("kb_document_versions_tenant_document_version_unique").on(
+      table.tenant_id,
+      table.document_id,
+      table.version_number
+    ),
+    documentIdx: index("kb_document_versions_document_idx").on(table.document_id),
+    createdIdx: index("kb_document_versions_created_idx").on(table.created_at),
+    md5Idx: index("kb_document_versions_md5_idx").on(table.content_md5)
+  })
+);
+var kbDocumentUnits = pgTable(
+  "kb_document_units",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    unit_id: varchar("unit_id", { length: 36 }).primaryKey(),
+    document_id: varchar("document_id", { length: 36 }).notNull().references(() => kbDocuments.document_id, { onDelete: "cascade" }),
+    version_id: varchar("version_id", { length: 36 }).notNull().references(() => kbDocumentVersions.version_id, { onDelete: "cascade" }),
+    kind: text("kind", { enum: ["document", "section", "file", "auto_split"] }).notNull().default("document"),
+    ordinal: integer("ordinal").notNull().default(0),
+    path_anchor: text("path_anchor"),
+    heading_path: text("heading_path"),
+    source_path: text("source_path"),
+    content_text: text("content_text"),
+    content_md5: text("content_md5"),
+    start_offset: integer("start_offset"),
+    end_offset: integer("end_offset"),
+    embedding_status: text("embedding_status", {
+      enum: ["not_configured", "pending", "ready", "stale", "error"]
+    }).notNull().default("not_configured"),
+    embedding_model: text("embedding_model"),
+    embedding_dimensions: integer("embedding_dimensions"),
+    embedding_hash: text("embedding_hash"),
+    embedding_error: text("embedding_error"),
+    metadata: t.json("metadata"),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at")
+  },
+  (table) => ({
+    tenantIdx: index("kb_document_units_tenant_id_idx").on(table.tenant_id),
+    documentIdx: index("kb_document_units_document_idx").on(table.document_id),
+    versionIdx: index("kb_document_units_version_idx").on(table.version_id),
+    versionOrdinalIdx: index("kb_document_units_version_ordinal_idx").on(
+      table.version_id,
+      table.ordinal
+    ),
+    contentHashIdx: index("kb_document_units_content_hash_idx").on(table.content_md5),
+    embeddingStatusIdx: index("kb_document_units_embedding_status_idx").on(table.embedding_status)
+  })
+);
+var kbEmbeddingSpaces = pgTable(
+  "kb_embedding_spaces",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    embedding_space_id: varchar("embedding_space_id", { length: 36 }).primaryKey(),
+    provider: text("provider").notNull(),
+    model: text("model").notNull(),
+    dimensions: integer("dimensions").notNull(),
+    storage_type: text("storage_type").notNull().default("vector"),
+    distance: text("distance").notNull().default("cosine"),
+    active: t.bool("active").notNull().default(true),
+    metadata: t.json("metadata"),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at")
+  },
+  (table) => ({
+    tenantIdx: index("kb_embedding_spaces_tenant_id_idx").on(table.tenant_id),
+    providerModelIdx: uniqueIndex("kb_embedding_spaces_tenant_provider_model_unique").on(
+      table.tenant_id,
+      table.provider,
+      table.model,
+      table.dimensions,
+      table.storage_type,
+      table.distance
+    ),
+    activeIdx: index("kb_embedding_spaces_active_idx").on(table.active)
+  })
+);
+var kbGraphNodes = pgTable(
+  "kb_graph_nodes",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    node_id: varchar("node_id", { length: 36 }).primaryKey(),
+    node_type: text("node_type", {
+      enum: [
+        "namespace",
+        "document",
+        "document_unit",
+        "branch",
+        "session",
+        "task",
+        "message",
+        "artifact",
+        "repo",
+        "board",
+        "user",
+        "tag",
+        "external"
+      ]
+    }).notNull(),
+    uri: text("uri").notNull(),
+    label: text("label"),
+    namespace_id: varchar("namespace_id", { length: 36 }).references(
+      () => kbNamespaces.namespace_id,
+      { onDelete: "cascade" }
+    ),
+    document_id: varchar("document_id", { length: 36 }).references(() => kbDocuments.document_id, {
+      onDelete: "cascade"
+    }),
+    unit_id: varchar("unit_id", { length: 36 }).references(() => kbDocumentUnits.unit_id, {
+      onDelete: "cascade"
+    }),
+    branch_id: varchar("branch_id", { length: 36 }).references(() => branches.branch_id, {
+      onDelete: "cascade"
+    }),
+    session_id: varchar("session_id", { length: 36 }).references(() => sessions.session_id, {
+      onDelete: "cascade"
+    }),
+    task_id: varchar("task_id", { length: 36 }).references(() => tasks.task_id, {
+      onDelete: "cascade"
+    }),
+    message_id: varchar("message_id", { length: 36 }).references(() => messages.message_id, {
+      onDelete: "cascade"
+    }),
+    artifact_id: varchar("artifact_id", { length: 36 }).references(() => artifacts.artifact_id, {
+      onDelete: "cascade"
+    }),
+    repo_id: varchar("repo_id", { length: 36 }).references(() => repos.repo_id, {
+      onDelete: "cascade"
+    }),
+    board_id: varchar("board_id", { length: 36 }).references(() => boards.board_id, {
+      onDelete: "cascade"
+    }),
+    user_id: varchar("user_id", { length: 36 }).references(() => users.user_id, {
+      onDelete: "cascade"
+    }),
+    external_uri: text("external_uri"),
+    metadata: t.json("metadata"),
+    created_by: varchar("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at")
+  },
+  (table) => ({
+    tenantIdx: index("kb_graph_nodes_tenant_id_idx").on(table.tenant_id),
+    uriIdx: uniqueIndex("kb_graph_nodes_tenant_uri_unique").on(table.tenant_id, table.uri).where(sql2`${table.archived} = false`),
+    typeIdx: index("kb_graph_nodes_type_idx").on(table.node_type),
+    namespaceIdx: index("kb_graph_nodes_namespace_idx").on(table.namespace_id),
+    documentIdx: index("kb_graph_nodes_document_idx").on(table.document_id),
+    unitIdx: index("kb_graph_nodes_unit_idx").on(table.unit_id),
+    branchIdx: index("kb_graph_nodes_branch_idx").on(table.branch_id),
+    sessionIdx: index("kb_graph_nodes_session_idx").on(table.session_id),
+    taskIdx: index("kb_graph_nodes_task_idx").on(table.task_id),
+    messageIdx: index("kb_graph_nodes_message_idx").on(table.message_id),
+    artifactIdx: index("kb_graph_nodes_artifact_idx").on(table.artifact_id),
+    repoIdx: index("kb_graph_nodes_repo_idx").on(table.repo_id),
+    boardIdx: index("kb_graph_nodes_board_idx").on(table.board_id),
+    userIdx: index("kb_graph_nodes_user_idx").on(table.user_id),
+    externalUriIdx: index("kb_graph_nodes_external_uri_idx").on(table.external_uri),
+    archivedIdx: index("kb_graph_nodes_archived_idx").on(table.archived)
+  })
+);
+var kbGraphEdges = pgTable(
+  "kb_graph_edges",
+  {
+    tenant_id: text("tenant_id").notNull().default("default"),
+    edge_id: varchar("edge_id", { length: 36 }).primaryKey(),
+    source_node_id: varchar("source_node_id", { length: 36 }).notNull().references(() => kbGraphNodes.node_id, { onDelete: "cascade" }),
+    target_node_id: varchar("target_node_id", { length: 36 }).notNull().references(() => kbGraphNodes.node_id, { onDelete: "cascade" }),
+    edge_type: text("edge_type", {
+      enum: [
+        "contains",
+        "references",
+        "mentions",
+        "implements",
+        "depends_on",
+        "supersedes",
+        "derived_from",
+        "tagged_with",
+        "about",
+        "parent_of",
+        "related_to"
+      ]
+    }).notNull(),
+    confidence: integer("confidence"),
+    properties: t.json("properties"),
+    created_by: varchar("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at")
+  },
+  (table) => ({
+    tenantIdx: index("kb_graph_edges_tenant_id_idx").on(table.tenant_id),
+    sourceIdx: index("kb_graph_edges_source_idx").on(table.source_node_id),
+    targetIdx: index("kb_graph_edges_target_idx").on(table.target_node_id),
+    typeIdx: index("kb_graph_edges_type_idx").on(table.edge_type),
+    sourceTypeIdx: index("kb_graph_edges_source_type_idx").on(
+      table.source_node_id,
+      table.edge_type
+    ),
+    targetTypeIdx: index("kb_graph_edges_target_type_idx").on(
+      table.target_node_id,
+      table.edge_type
+    ),
+    sourceTargetTypeIdx: uniqueIndex("kb_graph_edges_tenant_source_target_type_unique").on(table.tenant_id, table.source_node_id, table.target_node_id, table.edge_type).where(sql2`${table.archived} = false`),
+    archivedIdx: index("kb_graph_edges_archived_idx").on(table.archived)
+  })
+);
+var sessionsRelations = relations(sessions, ({ one, many }) => ({
+  branch: one(branches, {
+    fields: [sessions.branch_id],
+    references: [branches.branch_id]
+  }),
+  schedule: one(schedules, {
+    fields: [sessions.schedule_id],
+    references: [schedules.schedule_id]
+  }),
+  outboundRelationships: many(sessionRelationships, { relationName: "relationshipSource" }),
+  inboundRelationships: many(sessionRelationships, { relationName: "relationshipTarget" })
+}));
+var sessionRelationshipsRelations = relations(sessionRelationships, ({ one }) => ({
+  sourceSession: one(sessions, {
+    fields: [sessionRelationships.source_session_id],
+    references: [sessions.session_id],
+    relationName: "relationshipSource"
+  }),
+  targetSession: one(sessions, {
+    fields: [sessionRelationships.target_session_id],
+    references: [sessions.session_id],
+    relationName: "relationshipTarget"
+  }),
+  callbackSession: one(sessions, {
+    fields: [sessionRelationships.callback_session_id],
+    references: [sessions.session_id]
+  })
+}));
+var branchesRelations = relations(branches, ({ many }) => ({
+  sessions: many(sessions),
+  schedules: many(schedules)
+}));
+var schedulesRelations = relations(schedules, ({ one, many }) => ({
+  branch: one(branches, {
+    fields: [schedules.branch_id],
+    references: [branches.branch_id]
+  }),
+  sessions: many(sessions)
+}));
+
+// src/db/schema.sqlite.ts
+var schema_sqlite_exports = {};
+__export(schema_sqlite_exports, {
+  appVariables: () => appVariables2,
+  artifactTrustGrants: () => artifactTrustGrants2,
+  artifacts: () => artifacts2,
+  boardComments: () => boardComments2,
+  boardGroupGrants: () => boardGroupGrants2,
+  boardObjects: () => boardObjects2,
+  boardOwners: () => boardOwners2,
+  boards: () => boards2,
+  branchGroupGrants: () => branchGroupGrants2,
+  branchOwners: () => branchOwners2,
+  branches: () => branches2,
+  branchesRelations: () => branchesRelations2,
+  cardTypes: () => cardTypes2,
+  cards: () => cards2,
+  gatewayChannels: () => gatewayChannels2,
+  gatewayOutboundMessages: () => gatewayOutboundMessages2,
+  groupMemberships: () => groupMemberships2,
+  groups: () => groups2,
+  kbDocumentUnits: () => kbDocumentUnits2,
+  kbDocumentVersions: () => kbDocumentVersions2,
+  kbDocuments: () => kbDocuments2,
+  kbEmbeddingSpaces: () => kbEmbeddingSpaces2,
+  kbGraphEdges: () => kbGraphEdges2,
+  kbGraphNodes: () => kbGraphNodes2,
+  kbNamespaceAcl: () => kbNamespaceAcl2,
+  kbNamespaces: () => kbNamespaces2,
+  mcpServers: () => mcpServers2,
+  messages: () => messages2,
+  repos: () => repos2,
+  schedules: () => schedules2,
+  schedulesRelations: () => schedulesRelations2,
+  serializedSessions: () => serializedSessions2,
+  sessionEnvSelections: () => sessionEnvSelections2,
+  sessionMcpServers: () => sessionMcpServers2,
+  sessionRelationships: () => sessionRelationships2,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations2,
+  sessions: () => sessions2,
+  sessionsRelations: () => sessionsRelations2,
+  tasks: () => tasks2,
+  threadSessionMap: () => threadSessionMap2,
+  userApiKeys: () => userApiKeys2,
+  userMcpOauthTokens: () => userMcpOauthTokens2,
+  users: () => users2
+});
+import { relations as relations2, sql as sql3 } from "drizzle-orm";
+import {
+  blob,
+  index as index2,
+  integer as integer2,
+  primaryKey as primaryKey2,
+  sqliteTable,
+  text as text2,
+  uniqueIndex as uniqueIndex2
+} from "drizzle-orm/sqlite-core";
+var t2 = {
+  timestamp: (name) => integer2(name, { mode: "timestamp_ms" }),
+  bool: (name) => integer2(name, { mode: "boolean" }),
+  json: (name) => text2(name, { mode: "json" }).$type()
+};
+var sessions2 = sqliteTable(
+  "sessions",
+  {
+    // Primary identity
+    session_id: text2("session_id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    // User attribution
+    created_by: text2("created_by", { length: 36 }).notNull(),
+    // Unix username for SDK impersonation (immutable once set)
+    // Set from creator's unix_username at session creation time
+    // NEVER changes, even if user's unix_username changes later
+    // This ensures SDK session data remains accessible in the original home directory
+    unix_username: text2("unix_username"),
+    // Materialized for filtering/joins (cross-DB compatible)
+    status: text2("status", {
+      enum: [
+        "idle",
+        "running",
+        "stopping",
+        "awaiting_permission",
+        "awaiting_input",
+        "timed_out",
+        "completed",
+        "failed"
+      ]
+    }).notNull(),
+    agentic_tool: text2("agentic_tool", {
+      enum: ["claude-code", "claude-code-cli", "codex", "gemini", "opencode", "copilot", "cursor"]
+    }).notNull(),
+    board_id: text2("board_id", { length: 36 }),
+    // NULL = no board
+    // Genealogy (materialized for tree queries)
+    parent_session_id: text2("parent_session_id", { length: 36 }),
+    forked_from_session_id: text2("forked_from_session_id", { length: 36 }),
+    // Branch reference (REQUIRED: all sessions must have a branch)
+    branch_id: text2("branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, {
+      onDelete: "cascade"
+      // Cascade delete sessions when branch is deleted
+    }),
+    // Scheduler tracking (materialized for deduplication and retention cleanup)
+    scheduled_run_at: integer2("scheduled_run_at"),
+    // Unix timestamp (ms) - authoritative run ID
+    scheduled_from_branch: t2.bool("scheduled_from_branch").notNull().default(false),
+    // FK to schedules.schedule_id, ON DELETE SET NULL. Defined here (not
+    // just in the migration) so drizzle-kit / db introspection sees the
+    // constraint and so future schema diffs don't lose it.
+    schedule_id: text2("schedule_id", { length: 36 }).references(
+      () => schedules2.schedule_id,
+      { onDelete: "set null" }
+    ),
+    // UI state (materialized for efficient highlighting queries)
+    ready_for_prompt: t2.bool("ready_for_prompt").notNull().default(false),
+    // Archive state (cascaded from branch archive)
+    archived: t2.bool("archived").notNull().default(false),
+    archived_reason: text2("archived_reason", {
+      enum: ["branch_archived", "manual", "btw_completed"]
+    }),
+    // JSON blob for everything else (cross-DB via json() type)
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    statusIdx: index2("sessions_status_idx").on(table.status),
+    statusReadyIdx: index2("sessions_status_ready_idx").on(table.status, table.ready_for_prompt),
+    agenticToolIdx: index2("sessions_agentic_tool_idx").on(table.agentic_tool),
+    boardIdx: index2("sessions_board_idx").on(table.board_id),
+    branchIdx: index2("sessions_branch_idx").on(table.branch_id),
+    createdIdx: index2("sessions_created_idx").on(table.created_at),
+    parentIdx: index2("sessions_parent_idx").on(table.parent_session_id),
+    forkedIdx: index2("sessions_forked_idx").on(table.forked_from_session_id),
+    // Scheduler indexes — including the partial unique index below.
+    scheduledFromBranchIdx: index2("sessions_scheduled_flag_idx").on(table.scheduled_from_branch),
+    // Partial unique index — covering for the scheduler's dedup lookup
+    // AND serves as the DB-level guard against check-then-create races
+    // in spawnScheduledSession (cron tick vs manual run-now, or two
+    // tick async paths). Partial because schedule_id is nullable: ad-hoc
+    // sessions all have schedule_id NULL and must coexist.
+    scheduleRunUnique: uniqueIndex2("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(sql3`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
+  })
+);
+var sessionRelationships2 = sqliteTable(
+  "session_relationships",
+  {
+    relationship_id: text2("relationship_id", { length: 36 }).primaryKey(),
+    source_session_id: text2("source_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    target_session_id: text2("target_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    relationship_type: text2("relationship_type", { enum: ["remote_create"] }).notNull(),
+    created_by: text2("created_by", { length: 36 }).notNull(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    callback_enabled: t2.bool("callback_enabled").notNull().default(false),
+    callback_session_id: text2("callback_session_id", { length: 36 }).references(
+      () => sessions2.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    data: t2.json("data")
+  },
+  (table) => ({
+    sourceIdx: index2("session_relationships_source_idx").on(table.source_session_id),
+    targetIdx: index2("session_relationships_target_idx").on(table.target_session_id),
+    callbackIdx: index2("session_relationships_callback_idx").on(table.callback_session_id),
+    // Note: no tenant_source/tenant_target composite indexes here — SQLite schema
+    // has no tenant column on this table (RLS is Postgres-only). The standalone
+    // source/target indexes above are sufficient for SQLite.
+    sourceTargetTypeUnique: uniqueIndex2("session_relationships_source_target_type_unique").on(
+      table.source_session_id,
+      table.target_session_id,
+      table.relationship_type
+    )
+  })
+);
+var tasks2 = sqliteTable(
+  "tasks",
+  {
+    task_id: text2("task_id", { length: 36 }).primaryKey(),
+    session_id: text2("session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    created_at: t2.timestamp("created_at").notNull(),
+    started_at: t2.timestamp("started_at"),
+    completed_at: t2.timestamp("completed_at"),
+    last_executor_heartbeat_at: t2.timestamp("last_executor_heartbeat_at"),
+    status: text2("status", {
+      enum: [
+        "queued",
+        "created",
+        "running",
+        "stopping",
+        "awaiting_permission",
+        "awaiting_input",
+        "timed_out",
+        "completed",
+        "failed",
+        "stopped"
+      ]
+    }).notNull(),
+    // Queue position (lower drains first); only populated for status='queued'
+    queue_position: integer2("queue_position"),
+    // User attribution
+    created_by: text2("created_by", { length: 36 }).notNull(),
+    // MD5 of SDK session file at task completion (only populated when stateless_fs_mode is enabled)
+    session_md5: text2("session_md5"),
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    sessionIdx: index2("tasks_session_idx").on(table.session_id),
+    statusIdx: index2("tasks_status_idx").on(table.status),
+    createdIdx: index2("tasks_created_idx").on(table.created_at),
+    queueIdx: index2("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
+    // Partial unique index — defense-in-depth for `tasks.createPending` race
+    // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
+    // rows have NULL queue_position and are unaffected.
+    queuedPositionUnique: uniqueIndex2("tasks_queued_position_unique").on(table.session_id, table.queue_position).where(sql3`${table.status} = 'queued'`)
+  })
+);
+var serializedSessions2 = sqliteTable(
+  "serialized_sessions",
+  {
+    id: text2("id", { length: 36 }).primaryKey(),
+    session_id: text2("session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    branch_id: text2("branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
+    task_id: text2("task_id", { length: 36 }).references(() => tasks2.task_id, {
+      onDelete: "set null"
+    }),
+    turn_index: integer2("turn_index").notNull().default(0),
+    created_at: t2.timestamp("created_at").notNull(),
+    md5: text2("md5").notNull(),
+    status: text2("status").notNull(),
+    // 'processing' | 'done' — validated at app layer
+    payload: blob("payload", { mode: "buffer" })
+    // gzipped; NULL while status='processing'
+  },
+  (table) => ({
+    sessionTurnIdx: index2("serialized_sessions_session_turn_idx").on(
+      table.session_id,
+      table.turn_index
+    ),
+    branchIdx: index2("serialized_sessions_branch_idx").on(table.branch_id)
+  })
+);
+var messages2 = sqliteTable(
+  "messages",
+  {
+    // Primary identity
+    message_id: text2("message_id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    // Foreign keys (materialized for indexes)
+    session_id: text2("session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    task_id: text2("task_id", { length: 36 }).references(() => tasks2.task_id, {
+      onDelete: "set null"
+    }),
+    // Materialized for queries
+    type: text2("type", {
+      enum: [
+        "user",
+        "assistant",
+        "system",
+        "file-history-snapshot",
+        "permission_request",
+        "input_request",
+        "daemon_restart",
+        "daemon_crash",
+        "widget_request"
+      ]
+    }).notNull(),
+    role: text2("role", {
+      enum: ["user", "assistant", "system"]
+    }).notNull(),
+    index: integer2("index").notNull(),
+    // Position in conversation (0-based)
+    timestamp: t2.timestamp("timestamp").notNull(),
+    content_preview: text2("content_preview"),
+    // First 200 chars for list views
+    // Parent tool use ID (for nested tool calls - e.g., Task tool spawning Read/Grep)
+    parent_tool_use_id: text2("parent_tool_use_id"),
+    // NOTE: queueing moved off `messages` and onto `tasks.status='queued'` as
+    // of migration sqlite/0040 (postgres/0030). The legacy `status` and
+    // `queue_position` columns are gone — see `tasks.queue_position` instead.
+    // Full data (JSON blob)
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    // Indexes for efficient lookups
+    sessionIdx: index2("messages_session_id_idx").on(table.session_id),
+    taskIdx: index2("messages_task_id_idx").on(table.task_id),
+    sessionIndexIdx: index2("messages_session_index_idx").on(table.session_id, table.index),
+    timestampIdx: index2("messages_timestamp_idx").on(table.timestamp),
+    sessionTimestampIdx: index2("messages_session_timestamp_idx").on(
+      table.session_id,
+      table.timestamp
+    )
+  })
+);
+var boards2 = sqliteTable(
+  "boards",
+  {
+    board_id: text2("board_id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    // User attribution
+    created_by: text2("created_by", { length: 36 }).notNull(),
+    // Materialized for lookups
+    name: text2("name").notNull(),
+    slug: text2("slug").unique(),
+    primary_assistant_id: text2("primary_assistant_id", { length: 36 }).references(
+      () => branches2.branch_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    // JSON blob for the rest
+    data: t2.json("data").$type().notNull(),
+    // Archive state (for soft deletes)
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at"),
+    archived_by: text2("archived_by", { length: 36 })
+  },
+  (table) => ({
+    nameIdx: index2("boards_name_idx").on(table.name),
+    slugIdx: index2("boards_slug_idx").on(table.slug)
+  })
+);
+var repos2 = sqliteTable(
+  "repos",
+  {
+    repo_id: text2("repo_id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    // Materialized for querying
+    slug: text2("slug").notNull().unique(),
+    repo_type: text2("repo_type", { enum: ["remote", "local"] }).notNull().default("remote"),
+    // Unix group for repo-level git access (agor_rp_<short-id>)
+    // Users who have access to ANY branch in this repo get added to this group.
+    // Applied to repo Unix-group-managed paths:
+    // - repo root (non-recursive) for traversal into .git/worktrees/<name>
+    // - .git (recursive) for shared git objects/refs and git operations
+    unix_group: text2("unix_group"),
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    slugIdx: index2("repos_slug_idx").on(table.slug)
+  })
+);
+var branches2 = sqliteTable(
+  "branches",
+  {
+    // Primary identity
+    branch_id: text2("branch_id", { length: 36 }).primaryKey(),
+    repo_id: text2("repo_id", { length: 36 }).notNull().references(() => repos2.repo_id, { onDelete: "cascade" }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    // User attribution
+    created_by: text2("created_by", { length: 36 }).notNull(),
+    // Materialized for queries
+    name: text2("name").notNull(),
+    // "feat-auth", "main"
+    ref: text2("ref").notNull(),
+    // Current branch/tag/commit
+    ref_type: text2("ref_type", { enum: ["branch", "tag"] }),
+    // Type of ref (branch or tag)
+    branch_unique_id: integer2("branch_unique_id").notNull(),
+    // Auto-assigned sequential ID for templates
+    // Environment configuration (static, initialized from templates, then user-editable)
+    start_command: text2("start_command"),
+    // Start command (initialized from repo's up_command template)
+    stop_command: text2("stop_command"),
+    // Stop command (initialized from repo's down_command template)
+    nuke_command: text2("nuke_command"),
+    // Nuke command (initialized from repo's nuke_command template)
+    health_check_url: text2("health_check_url"),
+    // Health check URL (initialized from repo's health_check.url_template)
+    app_url: text2("app_url"),
+    // Application URL (initialized from repo's app_url_template)
+    logs_command: text2("logs_command"),
+    // Logs command (initialized from repo's logs_command template)
+    // Name of the environment variant currently rendered into the command fields above.
+    // References a key under repo.environment.variants. Null for pre-v2 branches.
+    environment_variant: text2("environment_variant"),
+    // Board relationship (nullable - branches can exist without boards)
+    board_id: text2("board_id", { length: 36 }).references(() => boards2.board_id, {
+      onDelete: "set null"
+      // If board is deleted, branch remains but loses board association
+    }),
+    // UI state (materialized for efficient highlighting queries)
+    needs_attention: t2.bool("needs_attention").notNull().default(true),
+    // Default true for new branches
+    // Archive state (for soft deletes)
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at"),
+    archived_by: text2("archived_by", { length: 36 }),
+    filesystem_status: text2("filesystem_status", {
+      enum: ["creating", "ready", "failed", "preserved", "cleaned", "deleted"]
+    }),
+    // RBAC: App-layer permissions (rbac.md)
+    permission_source: text2("permission_source", { enum: ["board", "override"] }).$type().notNull().default("override"),
+    others_can: text2("others_can", {
+      enum: [...BRANCH_PERMISSION_LEVELS]
+    }).default("view"),
+    // RBAC: OS-layer permissions (unix-user-modes.md)
+    unix_group: text2("unix_group"),
+    // e.g., 'agor_wt_abc123'
+    others_fs_access: text2("others_fs_access", {
+      enum: ["none", "read", "write"]
+    }).$type().default("read"),
+    // Branch storage model — see context/explorations/clone-redesign.md.
+    // 'worktree' = native `git worktree add` (shared base .git/config — legacy default).
+    // 'clone'    = self-standing `git clone` (own .git/ — closes cross-branch leak vectors).
+    //
+    // Enum is validated at the Drizzle/TS/Zod/service layer (no DB-side
+    // CHECK) per context/guides/creating-database-migrations.md so adding a
+    // value later doesn't force a table-recreation migration on SQLite.
+    storage_mode: text2("storage_mode", { enum: ["worktree", "clone"] }).notNull().default("worktree"),
+    // Only meaningful when storage_mode='clone'. NULL = full clone, positive
+    // integer = `git clone --depth N` (shallow). The service layer rejects
+    // a non-null clone_depth on worktree-mode rows.
+    clone_depth: integer2("clone_depth"),
+    // JSON blob for everything else
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    repoIdx: index2("branches_repo_idx").on(table.repo_id),
+    nameIdx: index2("branches_name_idx").on(table.name),
+    refIdx: index2("branches_ref_idx").on(table.ref),
+    boardIdx: index2("branches_board_idx").on(table.board_id),
+    createdIdx: index2("branches_created_idx").on(table.created_at),
+    updatedIdx: index2("branches_updated_idx").on(table.updated_at),
+    // Composite unique constraint (repo + name)
+    uniqueRepoName: index2("branches_repo_name_unique").on(table.repo_id, table.name)
+  })
+);
+var branchOwners2 = sqliteTable(
+  "branch_owners",
+  {
+    branch_id: text2("branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
+    user_id: text2("user_id", { length: 36 }).notNull().references(() => users2.user_id, { onDelete: "cascade" }),
+    created_at: t2.timestamp("created_at")
+  },
+  (table) => ({
+    // Composite primary key matching migration 0016
+    pk: primaryKey2({ columns: [table.branch_id, table.user_id] })
+  })
+);
+var boardOwners2 = sqliteTable(
+  "board_owners",
+  {
+    board_id: text2("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
+    user_id: text2("user_id", { length: 36 }).notNull().references(() => users2.user_id, { onDelete: "cascade" }),
+    created_at: t2.timestamp("created_at")
+  },
+  (table) => ({
+    pk: primaryKey2({ columns: [table.board_id, table.user_id] }),
+    userIdx: index2("board_owners_user_idx").on(table.user_id)
+  })
+);
+var schedules2 = sqliteTable(
+  "schedules",
+  {
+    schedule_id: text2("schedule_id", { length: 36 }).primaryKey(),
+    branch_id: text2("branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
+    name: text2("name").notNull(),
+    description: text2("description"),
+    cron_expression: text2("cron_expression").notNull(),
+    timezone_mode: text2("timezone_mode", { enum: ["local", "utc"] }).notNull().default("local"),
+    timezone: text2("timezone"),
+    // IANA, required when timezone_mode='local'
+    prompt: text2("prompt").notNull(),
+    // Handlebars template
+    // jsonb on PG; mirrors BranchScheduleConfig minus promoted fields.
+    agentic_tool_config: t2.json("agentic_tool_config").notNull(),
+    enabled: t2.bool("enabled").notNull().default(true),
+    allow_concurrent_runs: t2.bool("allow_concurrent_runs").notNull().default(false),
+    retention: integer2("retention").notNull().default(5),
+    // 0 = keep all
+    last_run_at: integer2("last_run_at"),
+    // Unix timestamp (ms)
+    last_run_session_id: text2("last_run_session_id", { length: 36 }).references(
+      () => sessions2.session_id,
+      { onDelete: "set null" }
+    ),
+    next_run_at: integer2("next_run_at"),
+    // Unix timestamp (ms), denormalized for scheduler
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at").notNull(),
+    created_by: text2("created_by", { length: 36 }).notNull().references(() => users2.user_id)
+  },
+  (table) => ({
+    // Scheduler hot path: WHERE enabled = true AND next_run_at <= ?
+    enabledNextRunIdx: index2("schedules_enabled_next_run_idx").on(table.enabled, table.next_run_at),
+    branchIdx: index2("schedules_branch_idx").on(table.branch_id),
+    createdByIdx: index2("schedules_created_by_idx").on(table.created_by)
+  })
+);
+var users2 = sqliteTable(
+  "users",
+  {
+    // Primary identity
+    user_id: text2("user_id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    // Materialized for auth lookups
+    email: text2("email").unique().notNull(),
+    password: text2("password").notNull(),
+    // bcrypt hashed
+    // Basic profile (materialized for display)
+    name: text2("name"),
+    emoji: text2("emoji"),
+    role: text2("role", {
+      enum: ["superadmin", "admin", "member", "viewer"]
+      // 'owner' is deprecated alias for 'superadmin'
+    }).notNull().default("member"),
+    // Unix username for process impersonation (optional, app-enforced uniqueness)
+    unix_username: text2("unix_username"),
+    // Onboarding state
+    onboarding_completed: t2.bool("onboarding_completed").notNull().default(false),
+    // Force password change flag (admin-settable, auto-cleared on password change)
+    must_change_password: t2.bool("must_change_password").notNull().default(false),
+    // Auth invalidation marker. Password changes set this timestamp so any
+    // previously issued browser access or refresh token is rejected.
+    tokens_valid_after: t2.timestamp("tokens_valid_after"),
+    // JSON blob for profile/preferences
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    emailIdx: index2("users_email_idx").on(table.email)
+  })
+);
+var groups2 = sqliteTable(
+  "groups",
+  {
+    group_id: text2("group_id", { length: 36 }).primaryKey(),
+    name: text2("name").notNull(),
+    slug: text2("slug").notNull(),
+    description: text2("description"),
+    archived: t2.bool("archived").notNull().default(false),
+    created_by: text2("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at")
+  },
+  (table) => ({
+    slugIdx: uniqueIndex2("groups_slug_idx").on(table.slug),
+    archivedIdx: index2("groups_archived_idx").on(table.archived)
+  })
+);
+var groupMemberships2 = sqliteTable(
+  "group_memberships",
+  {
+    group_id: text2("group_id", { length: 36 }).notNull().references(() => groups2.group_id, { onDelete: "cascade" }),
+    user_id: text2("user_id", { length: 36 }).notNull().references(() => users2.user_id, { onDelete: "cascade" }),
+    added_by: text2("added_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull()
+  },
+  (table) => ({
+    pk: primaryKey2({ columns: [table.group_id, table.user_id] }),
+    userIdx: index2("group_memberships_user_idx").on(table.user_id)
+  })
+);
+var branchGroupGrants2 = sqliteTable(
+  "branch_group_grants",
+  {
+    branch_id: text2("branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
+    group_id: text2("group_id", { length: 36 }).notNull().references(() => groups2.group_id, { onDelete: "cascade" }),
+    can: text2("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
+    fs_access: text2("fs_access", { enum: ["none", "read", "write"] }).$type(),
+    created_by: text2("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at")
+  },
+  (table) => ({
+    pk: primaryKey2({ columns: [table.branch_id, table.group_id] }),
+    groupIdx: index2("branch_group_grants_group_idx").on(table.group_id)
+  })
+);
+var boardGroupGrants2 = sqliteTable(
+  "board_group_grants",
+  {
+    board_id: text2("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
+    group_id: text2("group_id", { length: 36 }).notNull().references(() => groups2.group_id, { onDelete: "cascade" }),
+    can: text2("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
+    fs_access: text2("fs_access", { enum: ["none", "read", "write"] }).$type(),
+    created_by: text2("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at")
+  },
+  (table) => ({
+    pk: primaryKey2({ columns: [table.board_id, table.group_id] }),
+    groupIdx: index2("board_group_grants_group_idx").on(table.group_id)
+  })
+);
+var appVariables2 = sqliteTable(
+  "app_variables",
+  {
+    variable_id: text2("variable_id", { length: 36 }).primaryKey(),
+    namespace: text2("namespace").notNull(),
+    key: text2("key").notNull(),
+    value_text: text2("value_text"),
+    value_encrypted: text2("value_encrypted"),
+    is_encrypted: t2.bool("is_encrypted").notNull().default(false),
+    content_type: text2("content_type").notNull().default("text/plain"),
+    metadata: t2.json("metadata"),
+    updated_by: text2("updated_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at").notNull()
+  },
+  (table) => ({
+    namespaceKeyIdx: uniqueIndex2("app_variables_namespace_key_idx").on(table.namespace, table.key),
+    namespaceIdx: index2("app_variables_namespace_idx").on(table.namespace)
+  })
+);
+var userApiKeys2 = sqliteTable(
+  "user_api_keys",
+  {
+    id: text2("id", { length: 36 }).primaryKey(),
+    user_id: text2("user_id", { length: 36 }).notNull().references(() => users2.user_id, { onDelete: "cascade" }),
+    name: text2("name").notNull(),
+    prefix: text2("prefix").notNull(),
+    // first 12 chars: 'agor_sk_XXXX' for identification
+    key_hash: text2("key_hash").notNull(),
+    // bcrypt hash of full key
+    created_at: t2.timestamp("created_at").notNull(),
+    last_used_at: t2.timestamp("last_used_at")
+  },
+  (table) => ({
+    userIdx: index2("user_api_keys_user_idx").on(table.user_id),
+    prefixIdx: index2("user_api_keys_prefix_idx").on(table.prefix)
+  })
+);
+var mcpServers2 = sqliteTable(
+  "mcp_servers",
+  {
+    // Primary identity
+    mcp_server_id: text2("mcp_server_id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    // Materialized for filtering
+    name: text2("name").notNull(),
+    // e.g., "filesystem", "sentry"
+    transport: text2("transport", {
+      enum: ["stdio", "http", "sse"]
+    }).notNull(),
+    scope: text2("scope", {
+      enum: ["global", "session"]
+    }).notNull(),
+    enabled: t2.bool("enabled").notNull().default(true),
+    // Scope foreign key
+    // For 'global' scope: which user owns this server
+    // For 'session' scope: use session_mcp_servers junction table (many-to-many)
+    owner_user_id: text2("owner_user_id", { length: 36 }),
+    // Source tracking (materialized for queries)
+    source: text2("source", {
+      enum: ["user", "imported", "agor"]
+    }).notNull(),
+    // JSON blob for configuration and capabilities
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    nameIdx: index2("mcp_servers_name_idx").on(table.name),
+    scopeIdx: index2("mcp_servers_scope_idx").on(table.scope),
+    ownerIdx: index2("mcp_servers_owner_idx").on(table.owner_user_id),
+    enabledIdx: index2("mcp_servers_enabled_idx").on(table.enabled)
+  })
+);
+var cardTypes2 = sqliteTable(
+  "card_types",
+  {
+    card_type_id: text2("card_type_id", { length: 36 }).primaryKey(),
+    name: text2("name").notNull(),
+    emoji: text2("emoji"),
+    color: text2("color"),
+    json_schema: text2("json_schema"),
+    // JSON string of JSON Schema
+    created_by: text2("created_by", { length: 36 }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at").notNull()
+  },
+  (table) => ({
+    nameIdx: index2("card_types_name_idx").on(table.name)
+  })
+);
+var cards2 = sqliteTable(
+  "cards",
+  {
+    card_id: text2("card_id", { length: 36 }).primaryKey(),
+    board_id: text2("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
+    card_type_id: text2("card_type_id", { length: 36 }).references(() => cardTypes2.card_type_id, {
+      onDelete: "set null"
+    }),
+    title: text2("title").notNull(),
+    url: text2("url"),
+    description: text2("description"),
+    note: text2("note"),
+    data: text2("data"),
+    // JSON blob validated against CardType.json_schema if present
+    color_override: text2("color_override"),
+    emoji_override: text2("emoji_override"),
+    created_by: text2("created_by", { length: 36 }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at").notNull(),
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at")
+  },
+  (table) => ({
+    boardIdx: index2("cards_board_idx").on(table.board_id),
+    cardTypeIdx: index2("cards_card_type_idx").on(table.card_type_id),
+    titleIdx: index2("cards_title_idx").on(table.title),
+    archivedIdx: index2("cards_archived_idx").on(table.archived),
+    createdIdx: index2("cards_created_idx").on(table.created_at)
+  })
+);
+var artifacts2 = sqliteTable(
+  "artifacts",
+  {
+    artifact_id: text2("artifact_id", { length: 36 }).primaryKey(),
+    branch_id: text2("branch_id", { length: 36 }).references(() => branches2.branch_id, {
+      onDelete: "set null"
+    }),
+    source_session_id: text2("source_session_id", { length: 36 }).references(
+      () => sessions2.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    board_id: text2("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
+    name: text2("name").notNull(),
+    description: text2("description"),
+    path: text2("path"),
+    // provenance only — where files were read from
+    template: text2("template").notNull().default("react"),
+    build_status: text2("build_status").notNull().default("unknown"),
+    build_errors: t2.json("build_errors"),
+    content_hash: text2("content_hash"),
+    files: t2.json("files"),
+    dependencies: t2.json("dependencies"),
+    entry: text2("entry"),
+    // denormalized cache of the Sandpack entry file
+    sandpack_config: t2.json("sandpack_config"),
+    required_env_vars: t2.json("required_env_vars"),
+    agor_grants: t2.json("agor_grants"),
+    agor_runtime: t2.json("agor_runtime"),
+    public: t2.bool("public").notNull().default(true),
+    created_by: text2("created_by", { length: 36 }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at").notNull(),
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at")
+  },
+  (table) => ({
+    branchIdx: index2("artifacts_branch_idx").on(table.branch_id),
+    sourceSessionIdx: index2("artifacts_source_session_idx").on(table.source_session_id),
+    boardIdx: index2("artifacts_board_idx").on(table.board_id),
+    archivedIdx: index2("artifacts_archived_idx").on(table.archived),
+    publicIdx: index2("artifacts_public_idx").on(table.public)
+  })
+);
+var artifactTrustGrants2 = sqliteTable(
+  "artifact_trust_grants",
+  {
+    grant_id: text2("grant_id", { length: 36 }).primaryKey(),
+    user_id: text2("user_id", { length: 36 }).notNull(),
+    // CHECK constraint omitted — service-layer enforcement only, so adding new
+    // scope_types in the future doesn't require a SQLite table-recreate.
+    scope_type: text2("scope_type").notNull(),
+    scope_value: text2("scope_value"),
+    env_vars_set: t2.json("env_vars_set").notNull(),
+    agor_grants_set: t2.json("agor_grants_set").notNull(),
+    granted_at: t2.timestamp("granted_at").notNull(),
+    revoked_at: t2.timestamp("revoked_at")
+  },
+  (table) => ({
+    userIdx: index2("artifact_trust_grants_user_idx").on(table.user_id),
+    scopeIdx: index2("artifact_trust_grants_scope_idx").on(table.scope_type, table.scope_value)
+  })
+);
+var boardObjects2 = sqliteTable(
+  "board_objects",
+  {
+    // Primary identity
+    object_id: text2("object_id", { length: 36 }).primaryKey(),
+    board_id: text2("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
+    created_at: t2.timestamp("created_at").notNull(),
+    // Polymorphic entity reference (exactly one must be set)
+    branch_id: text2("branch_id", { length: 36 }).references(() => branches2.branch_id, {
+      onDelete: "cascade"
+    }),
+    card_id: text2("card_id", { length: 36 }).references(() => cards2.card_id, {
+      onDelete: "cascade"
+    }),
+    // Position data (JSON)
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    boardIdx: index2("board_objects_board_idx").on(table.board_id),
+    branchIdx: index2("board_objects_branch_idx").on(table.branch_id),
+    cardIdx: index2("board_objects_card_idx").on(table.card_id)
+  })
+);
+var sessionMcpServers2 = sqliteTable(
+  "session_mcp_servers",
+  {
+    session_id: text2("session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    mcp_server_id: text2("mcp_server_id", { length: 36 }).notNull().references(() => mcpServers2.mcp_server_id, { onDelete: "cascade" }),
+    enabled: t2.bool("enabled").notNull().default(true),
+    added_at: t2.timestamp("added_at").notNull()
+  },
+  (table) => ({
+    // Composite primary key
+    pk: index2("session_mcp_servers_pk").on(table.session_id, table.mcp_server_id),
+    // Indexes for queries
+    sessionIdx: index2("session_mcp_servers_session_idx").on(table.session_id),
+    serverIdx: index2("session_mcp_servers_server_idx").on(table.mcp_server_id),
+    enabledIdx: index2("session_mcp_servers_enabled_idx").on(table.session_id, table.enabled)
+  })
+);
+var userMcpOauthTokens2 = sqliteTable(
+  "user_mcp_oauth_tokens",
+  {
+    // NULL = shared-mode token (one per mcp_server_id)
+    user_id: text2("user_id", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "cascade"
+    }),
+    mcp_server_id: text2("mcp_server_id", { length: 36 }).notNull().references(() => mcpServers2.mcp_server_id, { onDelete: "cascade" }),
+    oauth_access_token: text2("oauth_access_token").notNull(),
+    oauth_token_expires_at: t2.timestamp("oauth_token_expires_at"),
+    // Unix timestamp in milliseconds
+    oauth_refresh_token: text2("oauth_refresh_token"),
+    // DCR / registered client credentials this grant was issued under.
+    // Must be preserved across refreshes.
+    oauth_client_id: text2("oauth_client_id"),
+    oauth_client_secret: text2("oauth_client_secret"),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at")
+  },
+  (table) => ({
+    // Composite lookup indexes. Uniqueness enforced via partial unique indexes
+    // created in the migration (one for per-user rows, one for the shared row).
+    pk: index2("user_mcp_oauth_tokens_pk").on(table.user_id, table.mcp_server_id),
+    userIdx: index2("user_mcp_oauth_tokens_user_idx").on(table.user_id),
+    serverIdx: index2("user_mcp_oauth_tokens_server_idx").on(table.mcp_server_id)
+  })
+);
+var boardComments2 = sqliteTable(
+  "board_comments",
+  {
+    // Primary identity
+    comment_id: text2("comment_id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    // Scoping & authorship
+    board_id: text2("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
+    created_by: text2("created_by", { length: 36 }).notNull(),
+    // FLEXIBLE ATTACHMENTS (all optional)
+    // Phase 1: board-level only (all NULL)
+    // Phase 2: object attachments (session, task, message, branch)
+    // Phase 3: spatial positioning
+    session_id: text2("session_id", { length: 36 }).references(() => sessions2.session_id, {
+      onDelete: "set null"
+    }),
+    task_id: text2("task_id", { length: 36 }).references(() => tasks2.task_id, {
+      onDelete: "set null"
+    }),
+    message_id: text2("message_id", { length: 36 }).references(() => messages2.message_id, {
+      onDelete: "set null"
+    }),
+    branch_id: text2("branch_id", { length: 36 }).references(() => branches2.branch_id, {
+      onDelete: "cascade"
+    }),
+    // Content (materialized for display)
+    content: text2("content").notNull(),
+    // Markdown-supported text
+    content_preview: text2("content_preview").notNull(),
+    // First 200 chars
+    // Thread support (optional)
+    parent_comment_id: text2("parent_comment_id", { length: 36 }),
+    // Metadata (materialized for filtering)
+    resolved: t2.bool("resolved").notNull().default(false),
+    edited: t2.bool("edited").notNull().default(false),
+    // Reactions (for BOTH thread roots and replies)
+    // Stored as JSON array: [{ user_id: "abc", emoji: "👍" }, ...]
+    // Display grouped by emoji: { "👍": ["alice", "bob"], "🎉": ["charlie"] }
+    reactions: t2.json("reactions").$type().notNull().default(sql3`'[]'`),
+    // JSON blob for advanced features
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    boardIdx: index2("board_comments_board_idx").on(table.board_id),
+    sessionIdx: index2("board_comments_session_idx").on(table.session_id),
+    taskIdx: index2("board_comments_task_idx").on(table.task_id),
+    messageIdx: index2("board_comments_message_idx").on(table.message_id),
+    branchIdx: index2("board_comments_branch_idx").on(table.branch_id),
+    createdByIdx: index2("board_comments_created_by_idx").on(table.created_by),
+    parentIdx: index2("board_comments_parent_idx").on(table.parent_comment_id),
+    createdIdx: index2("board_comments_created_idx").on(table.created_at),
+    resolvedIdx: index2("board_comments_resolved_idx").on(table.resolved)
+  })
+);
+var gatewayChannels2 = sqliteTable(
+  "gateway_channels",
+  {
+    // Primary identity
+    id: text2("id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at").notNull(),
+    // User attribution
+    created_by: text2("created_by", { length: 36 }).notNull(),
+    // Materialized for queries
+    name: text2("name").notNull(),
+    channel_type: text2("channel_type", {
+      enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+    }).notNull(),
+    target_branch_id: text2("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
+    agor_user_id: text2("agor_user_id", { length: 36 }).notNull(),
+    channel_key: text2("channel_key").notNull().unique(),
+    enabled: t2.bool("enabled").notNull().default(true),
+    last_message_at: t2.timestamp("last_message_at"),
+    // JSON blob for platform credentials (encrypted at rest)
+    config: t2.json("config").notNull(),
+    // JSON blob for agentic tool configuration (agent, model, permission mode, etc.)
+    agentic_config: t2.json("agentic_config")
+  },
+  (table) => ({
+    channelKeyIdx: index2("idx_gateway_channel_key").on(table.channel_key),
+    enabledTypeIdx: index2("idx_gateway_enabled_type").on(table.enabled, table.channel_type)
+  })
+);
+var threadSessionMap2 = sqliteTable(
+  "thread_session_map",
+  {
+    // Primary identity
+    id: text2("id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    last_message_at: t2.timestamp("last_message_at").notNull(),
+    // Foreign keys
+    channel_id: text2("channel_id", { length: 36 }).notNull().references(() => gatewayChannels2.id, { onDelete: "cascade" }),
+    thread_id: text2("thread_id").notNull(),
+    session_id: text2("session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    branch_id: text2("branch_id", { length: 36 }).notNull().references(() => branches2.branch_id),
+    // Materialized for queries
+    status: text2("status", {
+      enum: ["active", "archived", "paused"]
+    }).notNull().default("active"),
+    // JSON blob for extra metadata
+    metadata: t2.json("metadata")
+  },
+  (table) => ({
+    uniqueChannelThread: uniqueIndex2("uniq_thread_map_channel_thread").on(
+      table.channel_id,
+      table.thread_id
+    ),
+    sessionIdx: index2("idx_thread_map_session_id").on(table.session_id),
+    threadIdx: index2("idx_thread_map_thread_id").on(table.thread_id),
+    channelStatusIdx: index2("idx_thread_map_channel_status").on(table.channel_id, table.status)
+  })
+);
+var gatewayOutboundMessages2 = sqliteTable(
+  "gateway_outbound_messages",
+  {
+    id: text2("id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at").notNull(),
+    gateway_channel_id: text2("gateway_channel_id", { length: 36 }).notNull().references(() => gatewayChannels2.id, { onDelete: "cascade" }),
+    channel_type: text2("channel_type", {
+      enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+    }).notNull(),
+    platform_channel_id: text2("platform_channel_id").notNull(),
+    platform_message_id: text2("platform_message_id").notNull(),
+    platform_thread_id: text2("platform_thread_id").notNull(),
+    platform_permalink: text2("platform_permalink"),
+    target_branch_id: text2("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id),
+    emitted_by_user_id: text2("emitted_by_user_id", { length: 36 }).notNull().references(() => users2.user_id),
+    emitted_by_session_id: text2("emitted_by_session_id", { length: 36 }).references(
+      () => sessions2.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    emitted_by_task_id: text2("emitted_by_task_id", { length: 36 }).references(() => tasks2.task_id, {
+      onDelete: "set null"
+    }),
+    emitted_by_schedule_id: text2("emitted_by_schedule_id", { length: 36 }).references(
+      () => schedules2.schedule_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    message_text: text2("message_text").notNull(),
+    message_preview: text2("message_preview").notNull(),
+    metadata: t2.json("metadata"),
+    consumed_by_session_id: text2("consumed_by_session_id", { length: 36 }).references(
+      () => sessions2.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    consumed_at: t2.timestamp("consumed_at")
+  },
+  (table) => ({
+    uniqueChannelThread: uniqueIndex2("uniq_gateway_outbound_channel_thread").on(
+      table.gateway_channel_id,
+      table.platform_thread_id
+    ),
+    emittedSessionIdx: index2("idx_gateway_outbound_emitted_session").on(
+      table.emitted_by_session_id
+    ),
+    emittedScheduleIdx: index2("idx_gateway_outbound_emitted_schedule").on(
+      table.emitted_by_schedule_id
+    ),
+    targetBranchCreatedIdx: index2("idx_gateway_outbound_branch_created").on(
+      table.target_branch_id,
+      table.created_at
+    ),
+    consumedIdx: index2("idx_gateway_outbound_consumed").on(table.consumed_at)
+  })
+);
+var sessionEnvSelections2 = sqliteTable(
+  "session_env_selections",
+  {
+    session_id: text2("session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    env_var_name: text2("env_var_name").notNull(),
+    created_at: t2.timestamp("created_at").notNull()
+  },
+  (table) => ({
+    pk: primaryKey2({ columns: [table.session_id, table.env_var_name] }),
+    sessionIdx: index2("session_env_selections_session_idx").on(table.session_id)
+  })
+);
+var kbNamespaces2 = sqliteTable(
+  "kb_namespaces",
+  {
+    namespace_id: text2("namespace_id", { length: 36 }).primaryKey(),
+    slug: text2("slug").notNull(),
+    display_name: text2("display_name").notNull(),
+    description: text2("description"),
+    kind: text2("kind", { enum: ["system", "global", "user", "repo", "branch", "team"] }).notNull().default("global"),
+    owner_user_id: text2("owner_user_id", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    repo_id: text2("repo_id", { length: 36 }).references(() => repos2.repo_id, {
+      onDelete: "set null"
+    }),
+    branch_id: text2("branch_id", { length: 36 }).references(() => branches2.branch_id, {
+      onDelete: "set null"
+    }),
+    visibility_default: text2("visibility_default", { enum: ["public", "private"] }).notNull().default("public"),
+    others_can: text2("others_can", { enum: ["none", "read", "write"] }).notNull().default("write"),
+    metadata: t2.json("metadata"),
+    created_by: text2("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at")
+  },
+  (table) => ({
+    slugIdx: uniqueIndex2("kb_namespaces_slug_idx").on(table.slug).where(sql3`${table.archived} = false`),
+    kindIdx: index2("kb_namespaces_kind_idx").on(table.kind),
+    ownerIdx: index2("kb_namespaces_owner_idx").on(table.owner_user_id),
+    repoIdx: index2("kb_namespaces_repo_idx").on(table.repo_id),
+    branchIdx: index2("kb_namespaces_branch_idx").on(table.branch_id),
+    archivedIdx: index2("kb_namespaces_archived_idx").on(table.archived)
+  })
+);
+var kbNamespaceAcl2 = sqliteTable(
+  "kb_namespace_acl",
+  {
+    namespace_acl_id: text2("namespace_acl_id", { length: 36 }).primaryKey(),
+    namespace_id: text2("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces2.namespace_id, { onDelete: "cascade" }),
+    subject_type: text2("subject_type", { enum: ["user", "group"] }).notNull(),
+    subject_id: text2("subject_id", { length: 36 }).notNull(),
+    permission: text2("permission", { enum: ["read", "write", "own"] }).notNull(),
+    created_by: text2("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at")
+  },
+  (table) => ({
+    namespaceIdx: index2("kb_namespace_acl_namespace_idx").on(table.namespace_id),
+    subjectIdx: index2("kb_namespace_acl_subject_idx").on(table.subject_type, table.subject_id),
+    namespaceSubjectIdx: uniqueIndex2("kb_namespace_acl_namespace_subject_idx").on(
+      table.namespace_id,
+      table.subject_type,
+      table.subject_id
+    )
+  })
+);
+var kbDocuments2 = sqliteTable(
+  "kb_documents",
+  {
+    document_id: text2("document_id", { length: 36 }).primaryKey(),
+    namespace_id: text2("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces2.namespace_id, { onDelete: "cascade" }),
+    path: text2("path").notNull(),
+    uri: text2("uri").notNull(),
+    title: text2("title").notNull(),
+    icon_emoji: text2("icon_emoji"),
+    kind: text2("kind", {
+      enum: ["doc", "memory", "skill", "prompt", "guide", "decision", "bundle", "external"]
+    }).notNull().default("doc"),
+    visibility: text2("visibility", { enum: ["public", "private"] }).notNull().default("public"),
+    status: text2("status", { enum: ["draft", "published"] }).notNull().default("published"),
+    edit_policy: text2("edit_policy", { enum: ["owner", "public", "admins"] }).notNull().default("owner"),
+    // Application-maintained pointer. Avoids a circular FK with versions.
+    current_version_id: text2("current_version_id", { length: 36 }),
+    metadata: t2.json("metadata"),
+    created_by: text2("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_by: text2("updated_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    updated_at: t2.timestamp("updated_at"),
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at")
+  },
+  (table) => ({
+    namespacePathIdx: uniqueIndex2("kb_documents_namespace_path_idx").on(table.namespace_id, table.path).where(sql3`${table.archived} = false`),
+    uriIdx: uniqueIndex2("kb_documents_uri_idx").on(table.uri).where(sql3`${table.archived} = false`),
+    namespaceIdx: index2("kb_documents_namespace_idx").on(table.namespace_id),
+    kindIdx: index2("kb_documents_kind_idx").on(table.kind),
+    visibilityIdx: index2("kb_documents_visibility_idx").on(table.visibility),
+    statusIdx: index2("kb_documents_status_idx").on(table.status),
+    createdByIdx: index2("kb_documents_created_by_idx").on(table.created_by),
+    updatedAtIdx: index2("kb_documents_updated_at_idx").on(table.updated_at),
+    archivedIdx: index2("kb_documents_archived_idx").on(table.archived)
+  })
+);
+var kbDocumentVersions2 = sqliteTable(
+  "kb_document_versions",
+  {
+    version_id: text2("version_id", { length: 36 }).primaryKey(),
+    document_id: text2("document_id", { length: 36 }).notNull().references(() => kbDocuments2.document_id, { onDelete: "cascade" }),
+    version_number: integer2("version_number").notNull(),
+    content_text: text2("content_text"),
+    content_blob: blob("content_blob"),
+    mime_type: text2("mime_type").notNull().default("text/markdown"),
+    content_md5: text2("content_md5"),
+    content_sha256: text2("content_sha256"),
+    byte_length: integer2("byte_length"),
+    char_length: integer2("char_length"),
+    frontmatter: t2.json("frontmatter"),
+    metadata: t2.json("metadata"),
+    change_summary: text2("change_summary"),
+    created_by: text2("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull()
+  },
+  (table) => ({
+    documentVersionIdx: uniqueIndex2("kb_document_versions_document_version_idx").on(
+      table.document_id,
+      table.version_number
+    ),
+    documentIdx: index2("kb_document_versions_document_idx").on(table.document_id),
+    createdIdx: index2("kb_document_versions_created_idx").on(table.created_at),
+    md5Idx: index2("kb_document_versions_md5_idx").on(table.content_md5)
+  })
+);
+var kbDocumentUnits2 = sqliteTable(
+  "kb_document_units",
+  {
+    unit_id: text2("unit_id", { length: 36 }).primaryKey(),
+    document_id: text2("document_id", { length: 36 }).notNull().references(() => kbDocuments2.document_id, { onDelete: "cascade" }),
+    version_id: text2("version_id", { length: 36 }).notNull().references(() => kbDocumentVersions2.version_id, { onDelete: "cascade" }),
+    kind: text2("kind", { enum: ["document", "section", "file", "auto_split"] }).notNull().default("document"),
+    ordinal: integer2("ordinal").notNull().default(0),
+    path_anchor: text2("path_anchor"),
+    heading_path: text2("heading_path"),
+    source_path: text2("source_path"),
+    content_text: text2("content_text"),
+    content_md5: text2("content_md5"),
+    start_offset: integer2("start_offset"),
+    end_offset: integer2("end_offset"),
+    embedding_status: text2("embedding_status", {
+      enum: ["not_configured", "pending", "ready", "stale", "error"]
+    }).notNull().default("not_configured"),
+    embedding_model: text2("embedding_model"),
+    embedding_dimensions: integer2("embedding_dimensions"),
+    embedding_hash: text2("embedding_hash"),
+    embedding_error: text2("embedding_error"),
+    metadata: t2.json("metadata"),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at")
+  },
+  (table) => ({
+    documentIdx: index2("kb_document_units_document_idx").on(table.document_id),
+    versionIdx: index2("kb_document_units_version_idx").on(table.version_id),
+    versionOrdinalIdx: index2("kb_document_units_version_ordinal_idx").on(
+      table.version_id,
+      table.ordinal
+    ),
+    contentHashIdx: index2("kb_document_units_content_hash_idx").on(table.content_md5),
+    embeddingStatusIdx: index2("kb_document_units_embedding_status_idx").on(table.embedding_status)
+  })
+);
+var kbEmbeddingSpaces2 = sqliteTable(
+  "kb_embedding_spaces",
+  {
+    embedding_space_id: text2("embedding_space_id", { length: 36 }).primaryKey(),
+    provider: text2("provider").notNull(),
+    model: text2("model").notNull(),
+    dimensions: integer2("dimensions").notNull(),
+    storage_type: text2("storage_type").notNull().default("vector"),
+    distance: text2("distance").notNull().default("cosine"),
+    active: t2.bool("active").notNull().default(true),
+    metadata: t2.json("metadata"),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at")
+  },
+  (table) => ({
+    providerModelIdx: uniqueIndex2("kb_embedding_spaces_provider_model_idx").on(
+      table.provider,
+      table.model,
+      table.dimensions,
+      table.storage_type,
+      table.distance
+    ),
+    activeIdx: index2("kb_embedding_spaces_active_idx").on(table.active)
+  })
+);
+var kbGraphNodes2 = sqliteTable(
+  "kb_graph_nodes",
+  {
+    node_id: text2("node_id", { length: 36 }).primaryKey(),
+    node_type: text2("node_type", {
+      enum: [
+        "namespace",
+        "document",
+        "document_unit",
+        "branch",
+        "session",
+        "task",
+        "message",
+        "artifact",
+        "repo",
+        "board",
+        "user",
+        "tag",
+        "external"
+      ]
+    }).notNull(),
+    uri: text2("uri").notNull(),
+    label: text2("label"),
+    namespace_id: text2("namespace_id", { length: 36 }).references(() => kbNamespaces2.namespace_id, {
+      onDelete: "cascade"
+    }),
+    document_id: text2("document_id", { length: 36 }).references(() => kbDocuments2.document_id, {
+      onDelete: "cascade"
+    }),
+    unit_id: text2("unit_id", { length: 36 }).references(() => kbDocumentUnits2.unit_id, {
+      onDelete: "cascade"
+    }),
+    branch_id: text2("branch_id", { length: 36 }).references(() => branches2.branch_id, {
+      onDelete: "cascade"
+    }),
+    session_id: text2("session_id", { length: 36 }).references(() => sessions2.session_id, {
+      onDelete: "cascade"
+    }),
+    task_id: text2("task_id", { length: 36 }).references(() => tasks2.task_id, {
+      onDelete: "cascade"
+    }),
+    message_id: text2("message_id", { length: 36 }).references(() => messages2.message_id, {
+      onDelete: "cascade"
+    }),
+    artifact_id: text2("artifact_id", { length: 36 }).references(() => artifacts2.artifact_id, {
+      onDelete: "cascade"
+    }),
+    repo_id: text2("repo_id", { length: 36 }).references(() => repos2.repo_id, {
+      onDelete: "cascade"
+    }),
+    board_id: text2("board_id", { length: 36 }).references(() => boards2.board_id, {
+      onDelete: "cascade"
+    }),
+    user_id: text2("user_id", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "cascade"
+    }),
+    external_uri: text2("external_uri"),
+    metadata: t2.json("metadata"),
+    created_by: text2("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at")
+  },
+  (table) => ({
+    uriIdx: uniqueIndex2("kb_graph_nodes_uri_idx").on(table.uri).where(sql3`${table.archived} = false`),
+    typeIdx: index2("kb_graph_nodes_type_idx").on(table.node_type),
+    namespaceIdx: index2("kb_graph_nodes_namespace_idx").on(table.namespace_id),
+    documentIdx: index2("kb_graph_nodes_document_idx").on(table.document_id),
+    unitIdx: index2("kb_graph_nodes_unit_idx").on(table.unit_id),
+    branchIdx: index2("kb_graph_nodes_branch_idx").on(table.branch_id),
+    sessionIdx: index2("kb_graph_nodes_session_idx").on(table.session_id),
+    taskIdx: index2("kb_graph_nodes_task_idx").on(table.task_id),
+    messageIdx: index2("kb_graph_nodes_message_idx").on(table.message_id),
+    artifactIdx: index2("kb_graph_nodes_artifact_idx").on(table.artifact_id),
+    repoIdx: index2("kb_graph_nodes_repo_idx").on(table.repo_id),
+    boardIdx: index2("kb_graph_nodes_board_idx").on(table.board_id),
+    userIdx: index2("kb_graph_nodes_user_idx").on(table.user_id),
+    externalUriIdx: index2("kb_graph_nodes_external_uri_idx").on(table.external_uri),
+    archivedIdx: index2("kb_graph_nodes_archived_idx").on(table.archived)
+  })
+);
+var kbGraphEdges2 = sqliteTable(
+  "kb_graph_edges",
+  {
+    edge_id: text2("edge_id", { length: 36 }).primaryKey(),
+    source_node_id: text2("source_node_id", { length: 36 }).notNull().references(() => kbGraphNodes2.node_id, { onDelete: "cascade" }),
+    target_node_id: text2("target_node_id", { length: 36 }).notNull().references(() => kbGraphNodes2.node_id, { onDelete: "cascade" }),
+    edge_type: text2("edge_type", {
+      enum: [
+        "contains",
+        "references",
+        "mentions",
+        "implements",
+        "depends_on",
+        "supersedes",
+        "derived_from",
+        "tagged_with",
+        "about",
+        "parent_of",
+        "related_to"
+      ]
+    }).notNull(),
+    confidence: integer2("confidence"),
+    properties: t2.json("properties"),
+    created_by: text2("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at")
+  },
+  (table) => ({
+    sourceIdx: index2("kb_graph_edges_source_idx").on(table.source_node_id),
+    targetIdx: index2("kb_graph_edges_target_idx").on(table.target_node_id),
+    typeIdx: index2("kb_graph_edges_type_idx").on(table.edge_type),
+    sourceTypeIdx: index2("kb_graph_edges_source_type_idx").on(
+      table.source_node_id,
+      table.edge_type
+    ),
+    targetTypeIdx: index2("kb_graph_edges_target_type_idx").on(
+      table.target_node_id,
+      table.edge_type
+    ),
+    sourceTargetTypeIdx: uniqueIndex2("kb_graph_edges_source_target_type_idx").on(table.source_node_id, table.target_node_id, table.edge_type).where(sql3`${table.archived} = false`),
+    archivedIdx: index2("kb_graph_edges_archived_idx").on(table.archived)
+  })
+);
+var sessionsRelations2 = relations2(sessions2, ({ one, many }) => ({
+  branch: one(branches2, {
+    fields: [sessions2.branch_id],
+    references: [branches2.branch_id]
+  }),
+  schedule: one(schedules2, {
+    fields: [sessions2.schedule_id],
+    references: [schedules2.schedule_id]
+  }),
+  outboundRelationships: many(sessionRelationships2, { relationName: "relationshipSource" }),
+  inboundRelationships: many(sessionRelationships2, { relationName: "relationshipTarget" })
+}));
+var sessionRelationshipsRelations2 = relations2(sessionRelationships2, ({ one }) => ({
+  sourceSession: one(sessions2, {
+    fields: [sessionRelationships2.source_session_id],
+    references: [sessions2.session_id],
+    relationName: "relationshipSource"
+  }),
+  targetSession: one(sessions2, {
+    fields: [sessionRelationships2.target_session_id],
+    references: [sessions2.session_id],
+    relationName: "relationshipTarget"
+  }),
+  callbackSession: one(sessions2, {
+    fields: [sessionRelationships2.callback_session_id],
+    references: [sessions2.session_id]
+  })
+}));
+var branchesRelations2 = relations2(branches2, ({ many }) => ({
+  sessions: many(sessions2),
+  schedules: many(schedules2)
+}));
+var schedulesRelations2 = relations2(schedules2, ({ one, many }) => ({
+  branch: one(branches2, {
+    fields: [schedules2.branch_id],
+    references: [branches2.branch_id]
+  }),
+  sessions: many(sessions2)
+}));
+
+// src/config/config-manager.ts
+import { readFileSync, statSync } from "fs";
+import fs from "fs/promises";
+import os from "os";
+import path from "path";
+import * as yaml from "js-yaml";
+
+// src/config/analytics-defaults.ts
+function getDefaultAnalyticsConfig() {
+  return {
+    enabled: false,
+    client: {
+      app: "agor-daemon",
+      version: "dev",
+      debug: false
+    },
+    filters: {
+      exclude_events: []
+    },
+    plugins: [
+      {
+        type: "stdout",
+        enabled: false,
+        options: {
+          pretty: false
+        }
+      },
+      {
+        type: "http_batch",
+        enabled: false,
+        options: {
+          url: null,
+          flush_interval_ms: 1e3,
+          max_batch_size: 50,
+          timeout_ms: 3e3,
+          headers: {}
+        }
+      },
+      {
+        type: "module",
+        enabled: false,
+        options: {
+          module_path: null,
+          export_name: "createAnalyticsPlugin",
+          plugin_options: {}
+        }
+      }
+    ]
+  };
+}
+
+// src/config/constants.ts
+var DAEMON = {
+  /**
+   * Default daemon port
+   */
+  DEFAULT_PORT: 3030,
+  /**
+   * Default daemon host
+   */
+  DEFAULT_HOST: "localhost"
+};
+var MCP_TOKEN = {
+  /**
+   * Default lifetime for internal MCP session tokens in milliseconds.
+   * Keep short to bound the blast radius of a leaked token — there is no
+   * revocation mechanism; `exp` is the only backstop.
+   */
+  DEFAULT_EXPIRATION_MS: 24 * 60 * 60 * 1e3
+  // 24 hours
+};
+
+// src/config/executor-heartbeat.ts
+var EXECUTOR_HEARTBEAT_DEFAULT_INTERVAL_MS = 1e4;
+var EXECUTOR_HEARTBEAT_MIN_STALE_AFTER_MS = 3e4;
+var EXECUTOR_HEARTBEAT_DEFAULT_CALLBACK_TIMEOUT_MS = 3e3;
+function positiveIntegerOrDefault(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
+}
+function resolveExecutorHeartbeatConfig(execution) {
+  const raw = execution?.executor_heartbeat;
+  const intervalMs = positiveIntegerOrDefault(
+    raw?.interval_ms,
+    EXECUTOR_HEARTBEAT_DEFAULT_INTERVAL_MS
+  );
+  const staleAfterMs = positiveIntegerOrDefault(
+    raw?.stale_after_ms,
+    Math.max(3 * intervalMs, EXECUTOR_HEARTBEAT_MIN_STALE_AFTER_MS)
+  );
+  const timeoutMs = positiveIntegerOrDefault(
+    raw?.callback?.timeout_ms,
+    EXECUTOR_HEARTBEAT_DEFAULT_CALLBACK_TIMEOUT_MS
+  );
+  return {
+    // Default enabled: the heartbeat is a lightweight task-row timestamp patch,
+    // and callback execution remains opt-in via command_template.
+    enabled: raw?.enabled ?? true,
+    interval_ms: intervalMs,
+    stale_after_ms: staleAfterMs,
+    callback: {
+      command_template: raw?.callback?.command_template ?? null,
+      timeout_ms: timeoutMs
+    }
+  };
+}
+
+// src/config/multitenancy.ts
+var DEFAULT_STATIC_TENANT_ID = "default";
+var RESERVED_AUTH_CLAIMS = /* @__PURE__ */ new Set(["aud", "exp", "iat", "iss", "jti", "nbf", "sub", "type"]);
+function detectPostgresUrl(url) {
+  if (!url) return false;
+  const lower = url.toLowerCase();
+  return lower.startsWith("postgresql://") || lower.startsWith("postgres://") || lower.startsWith("pg://");
+}
+function resolveMultiTenancyDatabaseDialect(config = {}) {
+  if (process.env.AGOR_DB_DIALECT === "postgresql" || process.env.AGOR_DB_DIALECT === "sqlite") {
+    return process.env.AGOR_DB_DIALECT;
+  }
+  if (detectPostgresUrl(process.env.DATABASE_URL)) return "postgresql";
+  if (config.database?.dialect === "postgresql" || config.database?.dialect === "sqlite") {
+    return config.database.dialect;
+  }
+  if (detectPostgresUrl(config.database?.postgresql?.url) || config.database?.postgresql?.host) {
+    return "postgresql";
+  }
+  return "sqlite";
+}
+function resolveMultiTenancyConfig(config) {
+  const raw = config.multi_tenancy ?? {};
+  const mode = raw.mode ?? "static";
+  return {
+    mode,
+    static_tenant_id: raw.static_tenant_id?.trim() || DEFAULT_STATIC_TENANT_ID,
+    ...raw.auth_claim ? { auth_claim: raw.auth_claim } : {},
+    ...raw.trusted_header ? { trusted_header: raw.trusted_header } : {}
+  };
+}
+function assertValidMultiTenancyConfig(config) {
+  const resolved = resolveMultiTenancyConfig(config);
+  if (resolved.mode !== "static" && resolved.mode !== "required_from_auth") {
+    throw new Error("Config error: multi_tenancy.mode must be one of: static, required_from_auth");
+  }
+  if (!resolved.static_tenant_id) {
+    throw new Error("Config error: multi_tenancy.static_tenant_id must not be empty");
+  }
+  if (resolved.auth_claim && RESERVED_AUTH_CLAIMS.has(resolved.auth_claim)) {
+    throw new Error(
+      `Config error: multi_tenancy.auth_claim cannot be reserved JWT claim '${resolved.auth_claim}'`
+    );
+  }
+  if (resolved.mode === "required_from_auth") {
+    if (resolveMultiTenancyDatabaseDialect(config) !== "postgresql") {
+      throw new Error(
+        "Config error: multi_tenancy.required_from_auth requires database.dialect: postgresql"
+      );
+    }
+    if (!resolved.auth_claim && !resolved.trusted_header) {
+      throw new Error(
+        "Config error: multi_tenancy.required_from_auth requires multi_tenancy.auth_claim or multi_tenancy.trusted_header"
+      );
+    }
+  }
+}
+
+// src/config/config-manager.ts
+var NO_FILE = -1;
+var NO_FILE_KEY = { mtimeMs: NO_FILE, size: 0 };
+var cachedEntry = null;
+function cacheKeyMatches(a, b) {
+  return a.mtimeMs === b.mtimeMs && a.size === b.size;
+}
+function statCacheKey(configPath) {
+  try {
+    const stat = statSync(configPath);
+    return { mtimeMs: stat.mtimeMs, size: stat.size };
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return NO_FILE_KEY;
+    }
+    return null;
+  }
+}
+function readCachedConfig(configPath) {
+  if (cachedEntry === null || cachedEntry.path !== configPath) {
+    return null;
+  }
+  const currentKey = statCacheKey(configPath);
+  if (currentKey === null || !cacheKeyMatches(currentKey, cachedEntry.key)) {
+    return null;
+  }
+  return structuredClone(cachedEntry.config);
+}
+function writeCachedConfig(configPath, config, key) {
+  cachedEntry = { path: configPath, config: structuredClone(config), key };
+}
+function parseAndValidateConfig(content) {
+  if (content.trim() === "") {
+    return {};
+  }
+  const parsed = yaml.load(content);
+  const finalConfig = parsed || {};
+  validateConfig(finalConfig);
+  return finalConfig;
+}
+function getAgorHome() {
+  return path.join(os.homedir(), ".agor");
+}
+function getConfigPath() {
+  return path.join(getAgorHome(), "config.yaml");
+}
+function validateConfig(config) {
+  const mode = config.execution?.unix_user_mode;
+  if (mode === "opportunistic") {
+    throw new Error(
+      `Config error: 'opportunistic' unix_user_mode has been deprecated.
+Please update your config to use one of:
+  - 'insulated': Filesystem isolation via Unix groups (recommended)
+  - 'strict': Full process impersonation required
+
+To update: agor config set execution.unix_user_mode insulated`
+    );
+  }
+  const managedEnvExecutionMode = config.execution?.managed_envs_execution_mode;
+  if (managedEnvExecutionMode !== void 0 && managedEnvExecutionMode !== "hybrid" && managedEnvExecutionMode !== "webhook-only") {
+    throw new Error(
+      `Config error: execution.managed_envs_execution_mode must be one of: hybrid, webhook-only`
+    );
+  }
+  assertValidMultiTenancyConfig(config);
+  validateOptionalHttpUrl(
+    config.external_launch,
+    "login_redirect_url",
+    "external_launch.login_redirect_url"
+  );
+}
+function validateOptionalHttpUrl(container, key, configPath) {
+  if (!container || container[key] === void 0) return;
+  const raw = container[key];
+  if (typeof raw !== "string") {
+    throw new Error(`Config error: ${configPath} must be an HTTP(S) URL string`);
+  }
+  container[key] = validateHttpUrlString(raw, configPath);
+}
+function validateHttpUrlString(url, label, options = {}) {
+  const trimmed = options.stripTrailingSlash ? url.trim().replace(/\/$/, "") : url.trim();
+  if (!trimmed.startsWith("http://") && !trimmed.startsWith("https://")) {
+    throw new Error(`Invalid ${label}: "${url}". Must start with http:// or https://`);
+  }
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new Error(`Invalid ${label} format: "${url}". Must be a valid HTTP(S) URL.`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`Invalid ${label}: "${url}". Must use http:// or https://`);
+  }
+  return trimmed;
+}
+function getDefaultConfig() {
+  return {
+    defaults: {
+      board: "main",
+      agent: "claude-code"
+    },
+    display: {
+      tableStyle: "unicode",
+      colorOutput: true
+    },
+    daemon: {
+      port: DAEMON.DEFAULT_PORT,
+      host: DAEMON.DEFAULT_HOST,
+      mcpEnabled: true
+      // Default: Enable built-in MCP server
+    },
+    ui: {
+      port: 5173,
+      host: "localhost"
+    },
+    execution: {
+      session_token_expiration_ms: 864e5,
+      // 24 hours
+      session_token_max_uses: 1,
+      // Single-use tokens
+      mcp_token_expiration_ms: MCP_TOKEN.DEFAULT_EXPIRATION_MS,
+      sync_unix_passwords: true,
+      // Default: sync passwords to Unix
+      executor_heartbeat: resolveExecutorHeartbeatConfig()
+    },
+    analytics: getDefaultAnalyticsConfig(),
+    telemetry: {},
+    multi_tenancy: {
+      mode: "static",
+      static_tenant_id: "default"
+    }
+  };
+}
+function loadConfigSync() {
+  const configPath = getConfigPath();
+  const cached = readCachedConfig(configPath);
+  if (cached !== null) {
+    return cached;
+  }
+  let beforeKey;
+  let content;
+  let afterKey;
+  try {
+    beforeKey = statCacheKey(configPath);
+    if (beforeKey?.mtimeMs === NO_FILE) {
+      const defaults = getDefaultConfig();
+      writeCachedConfig(configPath, defaults, NO_FILE_KEY);
+      return defaults;
+    }
+    content = readFileSync(configPath, "utf-8");
+    afterKey = statCacheKey(configPath);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      const defaults = getDefaultConfig();
+      writeCachedConfig(configPath, defaults, NO_FILE_KEY);
+      return defaults;
+    }
+    throw new Error(
+      `Failed to load config: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  let finalConfig;
+  try {
+    finalConfig = parseAndValidateConfig(content);
+  } catch (error) {
+    throw new Error(
+      `Failed to load config: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (beforeKey !== null && afterKey !== null && cacheKeyMatches(beforeKey, afterKey)) {
+    writeCachedConfig(configPath, finalConfig, beforeKey);
+  }
+  return finalConfig;
+}
+
+// src/db/schema-factory.ts
+function detectDialectFromUrl(url) {
+  if (!url) return null;
+  const lowerUrl = url.toLowerCase();
+  if (lowerUrl.startsWith("postgresql://") || lowerUrl.startsWith("postgres://") || lowerUrl.startsWith("pg://")) {
+    return "postgresql";
+  }
+  if (lowerUrl.startsWith("file:") || lowerUrl.startsWith("libsql://") || lowerUrl.startsWith("http://") || lowerUrl.startsWith("https://")) {
+    return "sqlite";
+  }
+  return null;
+}
+function getDatabaseDialect() {
+  const envDialect = process.env.AGOR_DB_DIALECT;
+  if (envDialect === "postgresql" || envDialect === "sqlite") {
+    return envDialect;
+  }
+  const databaseUrl = process.env.DATABASE_URL;
+  if (databaseUrl) {
+    const detected = detectDialectFromUrl(databaseUrl);
+    if (detected) {
+      return detected;
+    }
+  }
+  try {
+    const config = loadConfigSync();
+    if (config.database?.dialect === "postgresql" || config.database?.dialect === "sqlite") {
+      return config.database.dialect;
+    }
+    if (config.database?.postgresql?.url) {
+      const detected = detectDialectFromUrl(config.database.postgresql.url);
+      if (detected) return detected;
+    }
+  } catch {
+  }
+  return "sqlite";
+}
+
+// src/db/schema.ts
+var dialect = getDatabaseDialect();
+var schema = dialect === "postgresql" ? schema_postgres_exports : schema_sqlite_exports;
+var sessions3 = schema.sessions;
+var tasks3 = schema.tasks;
+var messages3 = schema.messages;
+var boards3 = schema.boards;
+var repos3 = schema.repos;
+var branches3 = schema.branches;
+var branchOwners3 = schema.branchOwners;
+var boardOwners3 = schema.boardOwners;
+var groups3 = schema.groups;
+var groupMemberships3 = schema.groupMemberships;
+var branchGroupGrants3 = schema.branchGroupGrants;
+var boardGroupGrants3 = schema.boardGroupGrants;
+var schedules3 = schema.schedules;
+var users3 = schema.users;
+var appVariables3 = schema.appVariables;
+var mcpServers3 = schema.mcpServers;
+var cardTypes3 = schema.cardTypes;
+var cards3 = schema.cards;
+var artifacts3 = schema.artifacts;
+var artifactTrustGrants3 = schema.artifactTrustGrants;
+var boardObjects3 = schema.boardObjects;
+var sessionMcpServers3 = schema.sessionMcpServers;
+var sessionRelationships3 = schema.sessionRelationships;
+var sessionEnvSelections3 = schema.sessionEnvSelections;
+var userMcpOauthTokens3 = schema.userMcpOauthTokens;
+var boardComments3 = schema.boardComments;
+var gatewayChannels3 = schema.gatewayChannels;
+var threadSessionMap3 = schema.threadSessionMap;
+var gatewayOutboundMessages3 = schema.gatewayOutboundMessages;
+var userApiKeys3 = schema.userApiKeys;
+var serializedSessions3 = schema.serializedSessions;
+var kbNamespaces3 = schema.kbNamespaces;
+var kbNamespaceAcl3 = schema.kbNamespaceAcl;
+var kbDocuments3 = schema.kbDocuments;
+var kbDocumentVersions3 = schema.kbDocumentVersions;
+var kbDocumentUnits3 = schema.kbDocumentUnits;
+var kbEmbeddingSpaces3 = schema.kbEmbeddingSpaces;
+var kbGraphNodes3 = schema.kbGraphNodes;
+var kbGraphEdges3 = schema.kbGraphEdges;
+
+// src/lib/ids.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { v7 as uuidv7 } from "uuid";
+
+// src/config/env-blocklist.ts
+var BLOCKED_ENV_PATTERNS = Object.freeze([
+  /^LD_/i,
+  /^DYLD_/i,
+  /^PYTHON(?!_AGOR_)/i
+]);
+
+// src/config/env-vars.ts
+var V05_SCOPES = ["global", "session"];
+var V05_SCOPE_SET = new Set(V05_SCOPES);
+
+// src/templates/handlebars-helpers.ts
+import Handlebars from "handlebars";
+
+// src/mcp/template-patterns.ts
+var USER_ENV_PLACEHOLDER_RE = /^\{\{\s*user\.env\.[A-Za-z_][A-Za-z0-9_]*\s*\}\}$/;
+function isUserEnvPlaceholder(value) {
+  return USER_ENV_PLACEHOLDER_RE.test(value.trim());
+}
+
+// src/mcp/template-resolver.ts
+var TEMPLATE_RESOLVABLE_MCP_AUTH_SECRET_FIELDS = [
+  "token",
+  "api_token",
+  "api_secret",
+  "oauth_client_secret"
+];
+
 // src/tools/mcp/http-headers.ts
 var MCP_HEADER_REDACTED_SENTINEL = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 
@@ -15,11 +3485,15 @@ function redactMCPAuthSecrets(auth) {
   let changed = false;
   const redacted = { ...auth };
   const record = redacted;
+  const templateResolvable = new Set(TEMPLATE_RESOLVABLE_MCP_AUTH_SECRET_FIELDS);
   for (const field of MCP_AUTH_SECRET_FIELDS) {
-    if (redacted[field] !== void 0) {
-      record[field] = MCP_HEADER_REDACTED_SENTINEL;
-      changed = true;
+    const value = redacted[field];
+    if (value === void 0) continue;
+    if (templateResolvable.has(field) && typeof value === "string" && isUserEnvPlaceholder(value)) {
+      continue;
     }
+    record[field] = MCP_HEADER_REDACTED_SENTINEL;
+    changed = true;
   }
   return changed ? redacted : auth;
 }