agor-live 0.22.0 → 0.23.2

package/dist/core/tools/mcp/oauth-refresh.js

@@ -57,19 +57,49 @@ var init_ids = __esm({
   }
 });
 
+// src/db/tenant-context.ts
+import { AsyncLocalStorage } from "async_hooks";
+function getCurrentTenantId() {
+  const store = tenantDatabaseScope.getStore();
+  return store?.kind === "tenant" ? store.tenantId : void 0;
+}
+var tenantDatabaseScope;
+var init_tenant_context = __esm({
+  "src/db/tenant-context.ts"() {
+    "use strict";
+    init_esm_shims();
+    tenantDatabaseScope = new AsyncLocalStorage();
+  }
+});
+
 // src/db/database-wrapper.ts
 import { sql } from "drizzle-orm";
 function isSQLiteDatabase(db) {
   return "run" in db && typeof db.run === "function";
 }
-function wrapQuery(query, db) {
+function tableHasTenantColumn(table) {
+  return Boolean(table && "tenant_id" in table);
+}
+function withTenantInsertValues(values, table) {
+  const tenantId = getCurrentTenantId();
+  if (!tenantId || !tableHasTenantColumn(table)) return values;
+  const stamp = (row) => {
+    if (!row || typeof row !== "object" || Array.isArray(row)) return row;
+    if ("tenant_id" in row) return row;
+    return { tenant_id: tenantId, ...row };
+  };
+  return Array.isArray(values) ? values.map(stamp) : stamp(values);
+}
+function wrapQuery(query, db, table) {
   return {
     ...query,
     one: async () => {
       if (isSQLiteDatabase(db)) {
         return await query.get();
       } else {
-        const results = await query.limit(1);
+        const results = await query.limit(
+          1
+        );
         return results[0] || null;
       }
     },
@@ -91,30 +121,55 @@ function wrapQuery(query, db) {
         return { rowsAffected: result.length || 0 };
       }
     },
-    // biome-ignore lint/suspicious/noExplicitAny: Drizzle query builder types vary by dialect
     returning: () => wrapReturning(query.returning(), db),
     // Preserve chainable methods
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    where: (...args) => wrapQuery(query.where(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    limit: (...args) => wrapQuery(query.limit(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    offset: (...args) => wrapQuery(query.offset(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    orderBy: (...args) => wrapQuery(query.orderBy(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    groupBy: (...args) => wrapQuery(query.groupBy(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    set: (...args) => wrapQuery(query.set(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    values: (...args) => wrapQuery(query.values(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    innerJoin: (...args) => wrapQuery(query.innerJoin(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    leftJoin: (...args) => wrapQuery(query.leftJoin(...args), db),
-    onConflictDoNothing: (...args) => (
-      // biome-ignore lint/suspicious/noExplicitAny: Drizzle exposes onConflictDoNothing on both dialects after .values()
-      wrapQuery(query.onConflictDoNothing(...args), db)
+    where: (...args) => wrapQuery(
+      query.where(...args),
+      db,
+      table
+    ),
+    limit: (...args) => wrapQuery(
+      query.limit(...args),
+      db,
+      table
+    ),
+    offset: (...args) => wrapQuery(
+      query.offset(...args),
+      db,
+      table
+    ),
+    orderBy: (...args) => wrapQuery(
+      query.orderBy(...args),
+      db,
+      table
+    ),
+    groupBy: (...args) => wrapQuery(
+      query.groupBy(...args),
+      db,
+      table
+    ),
+    set: (...args) => wrapQuery(query.set(...args), db, table),
+    values: (...args) => wrapQuery(
+      query.values(
+        ...args.map((arg) => withTenantInsertValues(arg, table))
+      ),
+      db,
+      table
+    ),
+    innerJoin: (...args) => wrapQuery(
+      query.innerJoin(...args),
+      db,
+      table
+    ),
+    leftJoin: (...args) => wrapQuery(
+      query.leftJoin(...args),
+      db,
+      table
+    ),
+    onConflictDoNothing: (...args) => wrapQuery(
+      query.onConflictDoNothing(...args),
+      db,
+      table
     )
   };
 }
@@ -147,7 +202,7 @@ function select(db, columns) {
 }
 function insert(db, table) {
   const query = db.insert(table);
-  return wrapQuery(query, db);
+  return wrapQuery(query, db, table);
 }
 function update(db, table) {
   const query = db.update(table);
@@ -161,6 +216,7 @@ var init_database_wrapper = __esm({
   "src/db/database-wrapper.ts"() {
     "use strict";
     init_esm_shims();
+    init_tenant_context();
   }
 });
 
@@ -408,6 +464,14 @@ var init_template = __esm({
   }
 });
 
+// src/types/tenant.ts
+var init_tenant = __esm({
+  "src/types/tenant.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // src/types/ui.ts
 var init_ui = __esm({
   "src/types/ui.ts"() {
@@ -498,6 +562,7 @@ var init_types = __esm({
     init_session();
     init_task();
     init_template();
+    init_tenant();
     init_ui();
     init_user();
     init_utils();
@@ -523,6 +588,7 @@ __export(schema_postgres_exports, {
   cardTypes: () => cardTypes,
   cards: () => cards,
   gatewayChannels: () => gatewayChannels,
+  gatewayOutboundMessages: () => gatewayOutboundMessages,
   groupMemberships: () => groupMemberships,
   groups: () => groups,
   kbDocumentUnits: () => kbDocumentUnits,
@@ -566,7 +632,7 @@ import {
   uniqueIndex,
   varchar
 } from "drizzle-orm/pg-core";
-var bytea, t, sessions, sessionRelationships, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, sessionRelationshipsRelations, branchesRelations, schedulesRelations;
+var bytea, t, sessions, sessionRelationships, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, gatewayOutboundMessages, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, sessionRelationshipsRelations, branchesRelations, schedulesRelations;
 var init_schema_postgres = __esm({
   "src/db/schema.postgres.ts"() {
     "use strict";
@@ -585,6 +651,7 @@ var init_schema_postgres = __esm({
     sessions = pgTable(
       "sessions",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         session_id: varchar("session_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -644,7 +711,9 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: index("sessions_tenant_id_idx").on(table.tenant_id),
         statusIdx: index("sessions_status_idx").on(table.status),
+        statusReadyIdx: index("sessions_status_ready_idx").on(table.status, table.ready_for_prompt),
         agenticToolIdx: index("sessions_agentic_tool_idx").on(table.agentic_tool),
         boardIdx: index("sessions_board_idx").on(table.board_id),
         branchIdx: index("sessions_branch_idx").on(table.branch_id),
@@ -656,12 +725,13 @@ var init_schema_postgres = __esm({
         // Partial unique index — covering for the scheduler's dedup lookup
         // AND serves as the DB-level guard against check-then-create races
         // in spawnScheduledSession.
-        scheduleRunUnique: uniqueIndex("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(sql2`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
+        scheduleRunUnique: uniqueIndex("sessions_schedule_run_unique").on(table.tenant_id, table.schedule_id, table.scheduled_run_at).where(sql2`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
       })
     );
     sessionRelationships = pgTable(
       "session_relationships",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         relationship_id: varchar("relationship_id", { length: 36 }).primaryKey(),
         source_session_id: varchar("source_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         target_session_id: varchar("target_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
@@ -679,10 +749,23 @@ var init_schema_postgres = __esm({
         data: t.json("data")
       },
       (table) => ({
+        tenantIdx: index("session_relationships_tenant_id_idx").on(table.tenant_id),
         sourceIdx: index("session_relationships_source_idx").on(table.source_session_id),
         targetIdx: index("session_relationships_target_idx").on(table.target_session_id),
         callbackIdx: index("session_relationships_callback_idx").on(table.callback_session_id),
+        // Composite indexes so the OR predicate in dispatchCompletionCallbacks
+        // (WHERE source_session_id = $1 OR target_session_id = $2) uses BitmapOr
+        // over these instead of a full tenant table scan via tenant_id_idx.
+        tenantSourceIdx: index("session_relationships_tenant_source_idx").on(
+          table.tenant_id,
+          table.source_session_id
+        ),
+        tenantTargetIdx: index("session_relationships_tenant_target_idx").on(
+          table.tenant_id,
+          table.target_session_id
+        ),
         sourceTargetTypeUnique: uniqueIndex("session_relationships_source_target_type_unique").on(
+          table.tenant_id,
           table.source_session_id,
           table.target_session_id,
           table.relationship_type
@@ -692,6 +775,7 @@ var init_schema_postgres = __esm({
     tasks = pgTable(
       "tasks",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         task_id: varchar("task_id", { length: 36 }).primaryKey(),
         session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         created_at: t.timestamp("created_at").notNull(),
@@ -721,19 +805,23 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: index("tasks_tenant_id_idx").on(table.tenant_id),
         sessionIdx: index("tasks_session_idx").on(table.session_id),
         statusIdx: index("tasks_status_idx").on(table.status),
         createdIdx: index("tasks_created_idx").on(table.created_at),
+        // Composite for "latest task for session" queries (ORDER BY created_at DESC LIMIT 1).
+        sessionCreatedIdx: index("tasks_session_created_idx").on(table.session_id, table.created_at),
         queueIdx: index("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
         // Partial unique index — defense-in-depth for `tasks.createPending` race
         // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
         // rows have NULL queue_position and are unaffected.
-        queuedPositionUnique: uniqueIndex("tasks_queued_position_unique").on(table.session_id, table.queue_position).where(sql2`${table.status} = 'queued'`)
+        queuedPositionUnique: uniqueIndex("tasks_queued_position_unique").on(table.tenant_id, table.session_id, table.queue_position).where(sql2`${table.status} = 'queued'`)
       })
     );
     serializedSessions = pgTable(
       "serialized_sessions",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         id: varchar("id", { length: 36 }).primaryKey(),
         session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
@@ -749,6 +837,7 @@ var init_schema_postgres = __esm({
         // gzipped; NULL while status='processing'
       },
       (table) => ({
+        tenantIdx: index("serialized_sessions_tenant_id_idx").on(table.tenant_id),
         sessionTurnIdx: index("serialized_sessions_session_turn_idx").on(
           table.session_id,
           table.turn_index
@@ -759,6 +848,7 @@ var init_schema_postgres = __esm({
     messages = pgTable(
       "messages",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         message_id: varchar("message_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -798,15 +888,23 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: index("messages_tenant_id_idx").on(table.tenant_id),
+        tenantTimestampIdx: index("messages_tenant_timestamp_idx").on(table.tenant_id, table.timestamp),
         // Indexes for efficient lookups
         sessionIdx: index("messages_session_id_idx").on(table.session_id),
         taskIdx: index("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: index("messages_session_index_idx").on(table.session_id, table.index)
+        sessionIndexIdx: index("messages_session_index_idx").on(table.session_id, table.index),
+        timestampIdx: index("messages_timestamp_idx").on(table.timestamp),
+        sessionTimestampIdx: index("messages_session_timestamp_idx").on(
+          table.session_id,
+          table.timestamp
+        )
       })
     );
     boards = pgTable(
       "boards",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         board_id: varchar("board_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
         updated_at: t.timestamp("updated_at"),
@@ -814,7 +912,7 @@ var init_schema_postgres = __esm({
         created_by: varchar("created_by", { length: 36 }).notNull(),
         // Materialized for lookups
         name: text("name").notNull(),
-        slug: text("slug").unique(),
+        slug: text("slug"),
         primary_assistant_id: varchar("primary_assistant_id", { length: 36 }).references(
           () => branches.branch_id,
           {
@@ -829,18 +927,21 @@ var init_schema_postgres = __esm({
         archived_by: varchar("archived_by", { length: 36 })
       },
       (table) => ({
+        tenantIdx: index("boards_tenant_id_idx").on(table.tenant_id),
         nameIdx: index("boards_name_idx").on(table.name),
-        slugIdx: index("boards_slug_idx").on(table.slug)
+        slugIdx: index("boards_slug_idx").on(table.slug),
+        slugTenantUnique: uniqueIndex("boards_tenant_slug_unique").on(table.tenant_id, table.slug)
       })
     );
     repos = pgTable(
       "repos",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         repo_id: varchar("repo_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
         updated_at: t.timestamp("updated_at"),
         // Materialized for querying
-        slug: text("slug").notNull().unique(),
+        slug: text("slug").notNull(),
         repo_type: text("repo_type", { enum: ["remote", "local"] }).notNull().default("remote"),
         // Unix group for repo-level git access (agor_rp_<short-id>)
         // Users who have access to ANY branch in this repo get added to this group.
@@ -851,12 +952,15 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
-        slugIdx: index("repos_slug_idx").on(table.slug)
+        tenantIdx: index("repos_tenant_id_idx").on(table.tenant_id),
+        slugIdx: index("repos_slug_idx").on(table.slug),
+        slugTenantUnique: uniqueIndex("repos_tenant_slug_unique").on(table.tenant_id, table.slug)
       })
     );
     branches = pgTable(
       "branches",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         branch_id: varchar("branch_id", { length: 36 }).primaryKey(),
         repo_id: varchar("repo_id", { length: 36 }).notNull().references(() => repos.repo_id, { onDelete: "cascade" }),
@@ -931,6 +1035,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: index("branches_tenant_id_idx").on(table.tenant_id),
         repoIdx: index("branches_repo_idx").on(table.repo_id),
         nameIdx: index("branches_name_idx").on(table.name),
         refIdx: index("branches_ref_idx").on(table.ref),
@@ -944,22 +1049,26 @@ var init_schema_postgres = __esm({
     branchOwners = pgTable(
       "branch_owners",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         created_at: t.timestamp("created_at").defaultNow()
       },
       (table) => ({
+        tenantIdx: index("branch_owners_tenant_id_idx").on(table.tenant_id),
         pk: primaryKey({ columns: [table.branch_id, table.user_id] })
       })
     );
     boardOwners = pgTable(
       "board_owners",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         created_at: t.timestamp("created_at")
       },
       (table) => ({
+        tenantIdx: index("board_owners_tenant_id_idx").on(table.tenant_id),
         pk: primaryKey({ columns: [table.board_id, table.user_id] }),
         userIdx: index("board_owners_user_idx").on(table.user_id)
       })
@@ -967,6 +1076,7 @@ var init_schema_postgres = __esm({
     schedules = pgTable(
       "schedules",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         schedule_id: varchar("schedule_id", { length: 36 }).primaryKey(),
         branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         name: text("name").notNull(),
@@ -990,6 +1100,7 @@ var init_schema_postgres = __esm({
         created_by: varchar("created_by", { length: 36 }).notNull().references(() => users.user_id)
       },
       (table) => ({
+        tenantIdx: index("schedules_tenant_id_idx").on(table.tenant_id),
         enabledNextRunIdx: index("schedules_enabled_next_run_idx").on(table.enabled, table.next_run_at),
         branchIdx: index("schedules_branch_idx").on(table.branch_id),
         createdByIdx: index("schedules_created_by_idx").on(table.created_by)
@@ -998,12 +1109,13 @@ var init_schema_postgres = __esm({
     users = pgTable(
       "users",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         user_id: varchar("user_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
         updated_at: t.timestamp("updated_at"),
         // Materialized for auth lookups
-        email: text("email").unique().notNull(),
+        email: text("email").notNull(),
         password: text("password").notNull(),
         // bcrypt hashed
         // Basic profile (materialized for display)
@@ -1019,16 +1131,22 @@ var init_schema_postgres = __esm({
         onboarding_completed: t.bool("onboarding_completed").notNull().default(false),
         // Force password change flag (admin-settable, auto-cleared on password change)
         must_change_password: t.bool("must_change_password").notNull().default(false),
+        // Auth invalidation marker. Password changes set this timestamp so any
+        // previously issued browser access or refresh token is rejected.
+        tokens_valid_after: t.timestamp("tokens_valid_after"),
         // JSON blob for profile/preferences
         data: t.json("data").$type().notNull()
       },
       (table) => ({
-        emailIdx: index("users_email_idx").on(table.email)
+        tenantIdx: index("users_tenant_id_idx").on(table.tenant_id),
+        emailIdx: index("users_email_idx").on(table.email),
+        emailTenantUnique: uniqueIndex("users_tenant_email_unique").on(table.tenant_id, table.email)
       })
     );
     groups = pgTable(
       "groups",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         group_id: varchar("group_id", { length: 36 }).primaryKey(),
         name: text("name").notNull(),
         slug: text("slug").notNull(),
@@ -1041,13 +1159,15 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
-        slugIdx: uniqueIndex("groups_slug_idx").on(table.slug),
+        tenantIdx: index("groups_tenant_id_idx").on(table.tenant_id),
+        slugIdx: uniqueIndex("groups_tenant_slug_unique").on(table.tenant_id, table.slug),
         archivedIdx: index("groups_archived_idx").on(table.archived)
       })
     );
     groupMemberships = pgTable(
       "group_memberships",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         group_id: varchar("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
         user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         added_by: varchar("added_by", { length: 36 }).references(() => users.user_id, {
@@ -1056,6 +1176,7 @@ var init_schema_postgres = __esm({
         created_at: t.timestamp("created_at").notNull()
       },
       (table) => ({
+        tenantIdx: index("group_memberships_tenant_id_idx").on(table.tenant_id),
         pk: primaryKey({ columns: [table.group_id, table.user_id] }),
         userIdx: index("group_memberships_user_idx").on(table.user_id)
       })
@@ -1063,6 +1184,7 @@ var init_schema_postgres = __esm({
     branchGroupGrants = pgTable(
       "branch_group_grants",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         branch_id: varchar("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         group_id: varchar("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
         can: text("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
@@ -1074,6 +1196,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: index("branch_group_grants_tenant_id_idx").on(table.tenant_id),
         pk: primaryKey({ columns: [table.branch_id, table.group_id] }),
         groupIdx: index("branch_group_grants_group_idx").on(table.group_id)
       })
@@ -1081,6 +1204,7 @@ var init_schema_postgres = __esm({
     boardGroupGrants = pgTable(
       "board_group_grants",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         group_id: varchar("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
         can: text("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
@@ -1092,6 +1216,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: index("board_group_grants_tenant_id_idx").on(table.tenant_id),
         pk: primaryKey({ columns: [table.board_id, table.group_id] }),
         groupIdx: index("board_group_grants_group_idx").on(table.group_id)
       })
@@ -1099,6 +1224,7 @@ var init_schema_postgres = __esm({
     appVariables = pgTable(
       "app_variables",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         variable_id: varchar("variable_id", { length: 36 }).primaryKey(),
         namespace: text("namespace").notNull(),
         key: text("key").notNull(),
@@ -1114,13 +1240,19 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at").notNull()
       },
       (table) => ({
-        namespaceKeyIdx: uniqueIndex("app_variables_namespace_key_idx").on(table.namespace, table.key),
+        tenantIdx: index("app_variables_tenant_id_idx").on(table.tenant_id),
+        namespaceKeyIdx: uniqueIndex("app_variables_tenant_namespace_key_unique").on(
+          table.tenant_id,
+          table.namespace,
+          table.key
+        ),
         namespaceIdx: index("app_variables_namespace_idx").on(table.namespace)
       })
     );
     userApiKeys = pgTable(
       "user_api_keys",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         id: varchar("id", { length: 36 }).primaryKey(),
         user_id: varchar("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         name: text("name").notNull(),
@@ -1132,6 +1264,7 @@ var init_schema_postgres = __esm({
         last_used_at: t.timestamp("last_used_at")
       },
       (table) => ({
+        tenantIdx: index("user_api_keys_tenant_id_idx").on(table.tenant_id),
         userIdx: index("user_api_keys_user_idx").on(table.user_id),
         prefixIdx: index("user_api_keys_prefix_idx").on(table.prefix)
       })
@@ -1139,6 +1272,7 @@ var init_schema_postgres = __esm({
     mcpServers = pgTable(
       "mcp_servers",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         mcp_server_id: varchar("mcp_server_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -1165,6 +1299,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: index("mcp_servers_tenant_id_idx").on(table.tenant_id),
         nameIdx: index("mcp_servers_name_idx").on(table.name),
         scopeIdx: index("mcp_servers_scope_idx").on(table.scope),
         ownerIdx: index("mcp_servers_owner_idx").on(table.owner_user_id),
@@ -1174,6 +1309,7 @@ var init_schema_postgres = __esm({
     cardTypes = pgTable(
       "card_types",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         card_type_id: varchar("card_type_id", { length: 36 }).primaryKey(),
         name: text("name").notNull(),
         emoji: text("emoji"),
@@ -1185,12 +1321,14 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at").notNull()
       },
       (table) => ({
+        tenantIdx: index("card_types_tenant_id_idx").on(table.tenant_id),
         nameIdx: index("card_types_name_idx").on(table.name)
       })
     );
     cards = pgTable(
       "cards",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         card_id: varchar("card_id", { length: 36 }).primaryKey(),
         board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         card_type_id: varchar("card_type_id", { length: 36 }).references(() => cardTypes.card_type_id, {
@@ -1211,6 +1349,7 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
+        tenantIdx: index("cards_tenant_id_idx").on(table.tenant_id),
         boardIdx: index("cards_board_idx").on(table.board_id),
         cardTypeIdx: index("cards_card_type_idx").on(table.card_type_id),
         titleIdx: index("cards_title_idx").on(table.title),
@@ -1221,6 +1360,7 @@ var init_schema_postgres = __esm({
     artifacts = pgTable(
       "artifacts",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         artifact_id: varchar("artifact_id", { length: 36 }).primaryKey(),
         branch_id: varchar("branch_id", { length: 36 }).references(() => branches.branch_id, {
           onDelete: "set null"
@@ -1256,6 +1396,7 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
+        tenantIdx: index("artifacts_tenant_id_idx").on(table.tenant_id),
         branchIdx: index("artifacts_branch_idx").on(table.branch_id),
         sourceSessionIdx: index("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: index("artifacts_board_idx").on(table.board_id),
@@ -1266,6 +1407,7 @@ var init_schema_postgres = __esm({
     artifactTrustGrants = pgTable(
       "artifact_trust_grants",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         grant_id: varchar("grant_id", { length: 36 }).primaryKey(),
         user_id: varchar("user_id", { length: 36 }).notNull(),
         scope_type: text("scope_type").notNull(),
@@ -1276,6 +1418,7 @@ var init_schema_postgres = __esm({
         revoked_at: t.timestamp("revoked_at")
       },
       (table) => ({
+        tenantIdx: index("artifact_trust_grants_tenant_id_idx").on(table.tenant_id),
         userIdx: index("artifact_trust_grants_user_idx").on(table.user_id),
         scopeIdx: index("artifact_trust_grants_scope_idx").on(table.scope_type, table.scope_value)
       })
@@ -1283,6 +1426,7 @@ var init_schema_postgres = __esm({
     boardObjects = pgTable(
       "board_objects",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         object_id: varchar("object_id", { length: 36 }).primaryKey(),
         board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
@@ -1298,6 +1442,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: index("board_objects_tenant_id_idx").on(table.tenant_id),
         boardIdx: index("board_objects_board_idx").on(table.board_id),
         branchIdx: index("board_objects_branch_idx").on(table.branch_id),
         cardIdx: index("board_objects_card_idx").on(table.card_id)
@@ -1306,12 +1451,14 @@ var init_schema_postgres = __esm({
     sessionMcpServers = pgTable(
       "session_mcp_servers",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         mcp_server_id: varchar("mcp_server_id", { length: 36 }).notNull().references(() => mcpServers.mcp_server_id, { onDelete: "cascade" }),
         enabled: t.bool("enabled").notNull().default(true),
         added_at: t.timestamp("added_at").notNull()
       },
       (table) => ({
+        tenantIdx: index("session_mcp_servers_tenant_id_idx").on(table.tenant_id),
         // Composite primary key
         pk: index("session_mcp_servers_pk").on(table.session_id, table.mcp_server_id),
         // Indexes for queries
@@ -1323,6 +1470,7 @@ var init_schema_postgres = __esm({
     userMcpOauthTokens = pgTable(
       "user_mcp_oauth_tokens",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // NULL = shared-mode token (one per mcp_server_id)
         user_id: varchar("user_id", { length: 36 }).references(() => users.user_id, {
           onDelete: "cascade"
@@ -1340,6 +1488,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: index("user_mcp_oauth_tokens_tenant_id_idx").on(table.tenant_id),
         // Composite lookup indexes. Uniqueness enforced via partial unique indexes
         // created in the migration (one for per-user rows, one for the shared row).
         pk: index("user_mcp_oauth_tokens_pk").on(table.user_id, table.mcp_server_id),
@@ -1350,6 +1499,7 @@ var init_schema_postgres = __esm({
     boardComments = pgTable(
       "board_comments",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         comment_id: varchar("comment_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -1391,6 +1541,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: index("board_comments_tenant_id_idx").on(table.tenant_id),
         boardIdx: index("board_comments_board_idx").on(table.board_id),
         sessionIdx: index("board_comments_session_idx").on(table.session_id),
         taskIdx: index("board_comments_task_idx").on(table.task_id),
@@ -1405,6 +1556,7 @@ var init_schema_postgres = __esm({
     gatewayChannels = pgTable(
       "gateway_channels",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         id: varchar("id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -1418,7 +1570,7 @@ var init_schema_postgres = __esm({
         }).notNull(),
         target_branch_id: varchar("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         agor_user_id: varchar("agor_user_id", { length: 36 }).notNull(),
-        channel_key: text("channel_key").notNull().unique(),
+        channel_key: text("channel_key").notNull(),
         enabled: t.bool("enabled").notNull().default(true),
         last_message_at: t.timestamp("last_message_at"),
         // JSON blob for platform credentials (encrypted at rest)
@@ -1427,13 +1579,19 @@ var init_schema_postgres = __esm({
         agentic_config: t.json("agentic_config")
       },
       (table) => ({
+        tenantIdx: index("gateway_channels_tenant_id_idx").on(table.tenant_id),
         channelKeyIdx: index("idx_gateway_channel_key").on(table.channel_key),
+        channelKeyTenantUnique: uniqueIndex("gateway_channels_tenant_channel_key_unique").on(
+          table.tenant_id,
+          table.channel_key
+        ),
         enabledTypeIdx: index("idx_gateway_enabled_type").on(table.enabled, table.channel_type)
       })
     );
     threadSessionMap = pgTable(
       "thread_session_map",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         // Primary identity
         id: varchar("id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -1451,7 +1609,9 @@ var init_schema_postgres = __esm({
         metadata: t.json("metadata")
       },
       (table) => ({
-        uniqueChannelThread: uniqueIndex("uniq_thread_map_channel_thread").on(
+        tenantIdx: index("thread_session_map_tenant_id_idx").on(table.tenant_id),
+        uniqueChannelThread: uniqueIndex("uniq_thread_map_tenant_channel_thread").on(
+          table.tenant_id,
           table.channel_id,
           table.thread_id
         ),
@@ -1460,14 +1620,82 @@ var init_schema_postgres = __esm({
         channelStatusIdx: index("idx_thread_map_channel_status").on(table.channel_id, table.status)
       })
     );
+    gatewayOutboundMessages = pgTable(
+      "gateway_outbound_messages",
+      {
+        tenant_id: text("tenant_id").notNull().default("default"),
+        id: varchar("id", { length: 36 }).primaryKey(),
+        created_at: t.timestamp("created_at").notNull(),
+        updated_at: t.timestamp("updated_at").notNull(),
+        gateway_channel_id: varchar("gateway_channel_id", { length: 36 }).notNull().references(() => gatewayChannels.id, { onDelete: "cascade" }),
+        channel_type: text("channel_type", {
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+        }).notNull(),
+        platform_channel_id: text("platform_channel_id").notNull(),
+        platform_message_id: text("platform_message_id").notNull(),
+        platform_thread_id: text("platform_thread_id").notNull(),
+        platform_permalink: text("platform_permalink"),
+        target_branch_id: varchar("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id),
+        emitted_by_user_id: varchar("emitted_by_user_id", { length: 36 }).notNull().references(() => users.user_id),
+        emitted_by_session_id: varchar("emitted_by_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        emitted_by_task_id: varchar("emitted_by_task_id", { length: 36 }).references(
+          () => tasks.task_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        emitted_by_schedule_id: varchar("emitted_by_schedule_id", { length: 36 }).references(
+          () => schedules.schedule_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        message_text: text("message_text").notNull(),
+        message_preview: text("message_preview").notNull(),
+        metadata: t.json("metadata"),
+        consumed_by_session_id: varchar("consumed_by_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        consumed_at: t.timestamp("consumed_at")
+      },
+      (table) => ({
+        tenantIdx: index("gateway_outbound_messages_tenant_id_idx").on(table.tenant_id),
+        uniqueChannelThread: uniqueIndex("uniq_gateway_outbound_tenant_channel_thread").on(
+          table.tenant_id,
+          table.gateway_channel_id,
+          table.platform_thread_id
+        ),
+        emittedSessionIdx: index("idx_gateway_outbound_emitted_session").on(
+          table.emitted_by_session_id
+        ),
+        emittedScheduleIdx: index("idx_gateway_outbound_emitted_schedule").on(
+          table.emitted_by_schedule_id
+        ),
+        targetBranchCreatedIdx: index("idx_gateway_outbound_branch_created").on(
+          table.target_branch_id,
+          table.created_at
+        ),
+        consumedIdx: index("idx_gateway_outbound_consumed").on(table.consumed_at)
+      })
+    );
     sessionEnvSelections = pgTable(
       "session_env_selections",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         session_id: varchar("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         env_var_name: text("env_var_name").notNull(),
         created_at: t.timestamp("created_at").notNull()
       },
       (table) => ({
+        tenantIdx: index("session_env_selections_tenant_id_idx").on(table.tenant_id),
         pk: primaryKey({ columns: [table.session_id, table.env_var_name] }),
         sessionIdx: index("session_env_selections_session_idx").on(table.session_id)
       })
@@ -1475,6 +1703,7 @@ var init_schema_postgres = __esm({
     kbNamespaces = pgTable(
       "kb_namespaces",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         namespace_id: varchar("namespace_id", { length: 36 }).primaryKey(),
         slug: text("slug").notNull(),
         display_name: text("display_name").notNull(),
@@ -1501,7 +1730,8 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
-        slugIdx: uniqueIndex("kb_namespaces_slug_idx").on(table.slug).where(sql2`${table.archived} = false`),
+        tenantIdx: index("kb_namespaces_tenant_id_idx").on(table.tenant_id),
+        slugIdx: uniqueIndex("kb_namespaces_tenant_slug_unique").on(table.tenant_id, table.slug).where(sql2`${table.archived} = false`),
         kindIdx: index("kb_namespaces_kind_idx").on(table.kind),
         ownerIdx: index("kb_namespaces_owner_idx").on(table.owner_user_id),
         repoIdx: index("kb_namespaces_repo_idx").on(table.repo_id),
@@ -1512,6 +1742,7 @@ var init_schema_postgres = __esm({
     kbNamespaceAcl = pgTable(
       "kb_namespace_acl",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         namespace_acl_id: varchar("namespace_acl_id", { length: 36 }).primaryKey(),
         namespace_id: varchar("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces.namespace_id, { onDelete: "cascade" }),
         subject_type: text("subject_type", { enum: ["user", "group"] }).notNull(),
@@ -1524,9 +1755,11 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: index("kb_namespace_acl_tenant_id_idx").on(table.tenant_id),
         namespaceIdx: index("kb_namespace_acl_namespace_idx").on(table.namespace_id),
         subjectIdx: index("kb_namespace_acl_subject_idx").on(table.subject_type, table.subject_id),
-        namespaceSubjectIdx: uniqueIndex("kb_namespace_acl_namespace_subject_idx").on(
+        namespaceSubjectIdx: uniqueIndex("kb_namespace_acl_tenant_namespace_subject_unique").on(
+          table.tenant_id,
           table.namespace_id,
           table.subject_type,
           table.subject_id
@@ -1536,6 +1769,7 @@ var init_schema_postgres = __esm({
     kbDocuments = pgTable(
       "kb_documents",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         document_id: varchar("document_id", { length: 36 }).primaryKey(),
         namespace_id: varchar("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces.namespace_id, { onDelete: "cascade" }),
         path: text("path").notNull(),
@@ -1563,8 +1797,9 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
-        namespacePathIdx: uniqueIndex("kb_documents_namespace_path_idx").on(table.namespace_id, table.path).where(sql2`${table.archived} = false`),
-        uriIdx: uniqueIndex("kb_documents_uri_idx").on(table.uri).where(sql2`${table.archived} = false`),
+        tenantIdx: index("kb_documents_tenant_id_idx").on(table.tenant_id),
+        namespacePathIdx: uniqueIndex("kb_documents_tenant_namespace_path_unique").on(table.tenant_id, table.namespace_id, table.path).where(sql2`${table.archived} = false`),
+        uriIdx: uniqueIndex("kb_documents_tenant_uri_unique").on(table.tenant_id, table.uri).where(sql2`${table.archived} = false`),
         namespaceIdx: index("kb_documents_namespace_idx").on(table.namespace_id),
         kindIdx: index("kb_documents_kind_idx").on(table.kind),
         visibilityIdx: index("kb_documents_visibility_idx").on(table.visibility),
@@ -1577,6 +1812,7 @@ var init_schema_postgres = __esm({
     kbDocumentVersions = pgTable(
       "kb_document_versions",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         version_id: varchar("version_id", { length: 36 }).primaryKey(),
         document_id: varchar("document_id", { length: 36 }).notNull().references(() => kbDocuments.document_id, { onDelete: "cascade" }),
         version_number: integer("version_number").notNull(),
@@ -1596,7 +1832,9 @@ var init_schema_postgres = __esm({
         created_at: t.timestamp("created_at").notNull()
       },
       (table) => ({
-        documentVersionIdx: uniqueIndex("kb_document_versions_document_version_idx").on(
+        tenantIdx: index("kb_document_versions_tenant_id_idx").on(table.tenant_id),
+        documentVersionIdx: uniqueIndex("kb_document_versions_tenant_document_version_unique").on(
+          table.tenant_id,
           table.document_id,
           table.version_number
         ),
@@ -1608,6 +1846,7 @@ var init_schema_postgres = __esm({
     kbDocumentUnits = pgTable(
       "kb_document_units",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         unit_id: varchar("unit_id", { length: 36 }).primaryKey(),
         document_id: varchar("document_id", { length: 36 }).notNull().references(() => kbDocuments.document_id, { onDelete: "cascade" }),
         version_id: varchar("version_id", { length: 36 }).notNull().references(() => kbDocumentVersions.version_id, { onDelete: "cascade" }),
@@ -1632,6 +1871,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: index("kb_document_units_tenant_id_idx").on(table.tenant_id),
         documentIdx: index("kb_document_units_document_idx").on(table.document_id),
         versionIdx: index("kb_document_units_version_idx").on(table.version_id),
         versionOrdinalIdx: index("kb_document_units_version_ordinal_idx").on(
@@ -1645,6 +1885,7 @@ var init_schema_postgres = __esm({
     kbEmbeddingSpaces = pgTable(
       "kb_embedding_spaces",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         embedding_space_id: varchar("embedding_space_id", { length: 36 }).primaryKey(),
         provider: text("provider").notNull(),
         model: text("model").notNull(),
@@ -1657,7 +1898,9 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
-        providerModelIdx: uniqueIndex("kb_embedding_spaces_provider_model_idx").on(
+        tenantIdx: index("kb_embedding_spaces_tenant_id_idx").on(table.tenant_id),
+        providerModelIdx: uniqueIndex("kb_embedding_spaces_tenant_provider_model_unique").on(
+          table.tenant_id,
           table.provider,
           table.model,
           table.dimensions,
@@ -1670,6 +1913,7 @@ var init_schema_postgres = __esm({
     kbGraphNodes = pgTable(
       "kb_graph_nodes",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         node_id: varchar("node_id", { length: 36 }).primaryKey(),
         node_type: text("node_type", {
           enum: [
@@ -1735,7 +1979,8 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
-        uriIdx: uniqueIndex("kb_graph_nodes_uri_idx").on(table.uri).where(sql2`${table.archived} = false`),
+        tenantIdx: index("kb_graph_nodes_tenant_id_idx").on(table.tenant_id),
+        uriIdx: uniqueIndex("kb_graph_nodes_tenant_uri_unique").on(table.tenant_id, table.uri).where(sql2`${table.archived} = false`),
         typeIdx: index("kb_graph_nodes_type_idx").on(table.node_type),
         namespaceIdx: index("kb_graph_nodes_namespace_idx").on(table.namespace_id),
         documentIdx: index("kb_graph_nodes_document_idx").on(table.document_id),
@@ -1755,6 +2000,7 @@ var init_schema_postgres = __esm({
     kbGraphEdges = pgTable(
       "kb_graph_edges",
       {
+        tenant_id: text("tenant_id").notNull().default("default"),
         edge_id: varchar("edge_id", { length: 36 }).primaryKey(),
         source_node_id: varchar("source_node_id", { length: 36 }).notNull().references(() => kbGraphNodes.node_id, { onDelete: "cascade" }),
         target_node_id: varchar("target_node_id", { length: 36 }).notNull().references(() => kbGraphNodes.node_id, { onDelete: "cascade" }),
@@ -1783,6 +2029,7 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
+        tenantIdx: index("kb_graph_edges_tenant_id_idx").on(table.tenant_id),
         sourceIdx: index("kb_graph_edges_source_idx").on(table.source_node_id),
         targetIdx: index("kb_graph_edges_target_idx").on(table.target_node_id),
         typeIdx: index("kb_graph_edges_type_idx").on(table.edge_type),
@@ -1794,7 +2041,7 @@ var init_schema_postgres = __esm({
           table.target_node_id,
           table.edge_type
         ),
-        sourceTargetTypeIdx: uniqueIndex("kb_graph_edges_source_target_type_idx").on(table.source_node_id, table.target_node_id, table.edge_type).where(sql2`${table.archived} = false`),
+        sourceTargetTypeIdx: uniqueIndex("kb_graph_edges_tenant_source_target_type_unique").on(table.tenant_id, table.source_node_id, table.target_node_id, table.edge_type).where(sql2`${table.archived} = false`),
         archivedIdx: index("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
@@ -1858,6 +2105,7 @@ __export(schema_sqlite_exports, {
   cardTypes: () => cardTypes2,
   cards: () => cards2,
   gatewayChannels: () => gatewayChannels2,
+  gatewayOutboundMessages: () => gatewayOutboundMessages2,
   groupMemberships: () => groupMemberships2,
   groups: () => groups2,
   kbDocumentUnits: () => kbDocumentUnits2,
@@ -1896,7 +2144,7 @@ import {
   text as text2,
   uniqueIndex as uniqueIndex2
 } from "drizzle-orm/sqlite-core";
-var t2, sessions2, sessionRelationships2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, sessionRelationshipsRelations2, branchesRelations2, schedulesRelations2;
+var t2, sessions2, sessionRelationships2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, gatewayOutboundMessages2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, sessionRelationshipsRelations2, branchesRelations2, schedulesRelations2;
 var init_schema_sqlite = __esm({
   "src/db/schema.sqlite.ts"() {
     "use strict";
@@ -1970,6 +2218,7 @@ var init_schema_sqlite = __esm({
       },
       (table) => ({
         statusIdx: index2("sessions_status_idx").on(table.status),
+        statusReadyIdx: index2("sessions_status_ready_idx").on(table.status, table.ready_for_prompt),
         agenticToolIdx: index2("sessions_agentic_tool_idx").on(table.agentic_tool),
         boardIdx: index2("sessions_board_idx").on(table.board_id),
         branchIdx: index2("sessions_branch_idx").on(table.branch_id),
@@ -2009,6 +2258,9 @@ var init_schema_sqlite = __esm({
         sourceIdx: index2("session_relationships_source_idx").on(table.source_session_id),
         targetIdx: index2("session_relationships_target_idx").on(table.target_session_id),
         callbackIdx: index2("session_relationships_callback_idx").on(table.callback_session_id),
+        // Note: no tenant_source/tenant_target composite indexes here — SQLite schema
+        // has no tenant column on this table (RLS is Postgres-only). The standalone
+        // source/target indexes above are sufficient for SQLite.
         sourceTargetTypeUnique: uniqueIndex2("session_relationships_source_target_type_unique").on(
           table.source_session_id,
           table.target_session_id,
@@ -2128,7 +2380,12 @@ var init_schema_sqlite = __esm({
         // Indexes for efficient lookups
         sessionIdx: index2("messages_session_id_idx").on(table.session_id),
         taskIdx: index2("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: index2("messages_session_index_idx").on(table.session_id, table.index)
+        sessionIndexIdx: index2("messages_session_index_idx").on(table.session_id, table.index),
+        timestampIdx: index2("messages_timestamp_idx").on(table.timestamp),
+        sessionTimestampIdx: index2("messages_session_timestamp_idx").on(
+          table.session_id,
+          table.timestamp
+        )
       })
     );
     boards2 = sqliteTable(
@@ -2354,6 +2611,9 @@ var init_schema_sqlite = __esm({
         onboarding_completed: t2.bool("onboarding_completed").notNull().default(false),
         // Force password change flag (admin-settable, auto-cleared on password change)
         must_change_password: t2.bool("must_change_password").notNull().default(false),
+        // Auth invalidation marker. Password changes set this timestamp so any
+        // previously issued browser access or refresh token is rejected.
+        tokens_valid_after: t2.timestamp("tokens_valid_after"),
         // JSON blob for profile/preferences
         data: t2.json("data").$type().notNull()
       },
@@ -2797,6 +3057,66 @@ var init_schema_sqlite = __esm({
         channelStatusIdx: index2("idx_thread_map_channel_status").on(table.channel_id, table.status)
       })
     );
+    gatewayOutboundMessages2 = sqliteTable(
+      "gateway_outbound_messages",
+      {
+        id: text2("id", { length: 36 }).primaryKey(),
+        created_at: t2.timestamp("created_at").notNull(),
+        updated_at: t2.timestamp("updated_at").notNull(),
+        gateway_channel_id: text2("gateway_channel_id", { length: 36 }).notNull().references(() => gatewayChannels2.id, { onDelete: "cascade" }),
+        channel_type: text2("channel_type", {
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+        }).notNull(),
+        platform_channel_id: text2("platform_channel_id").notNull(),
+        platform_message_id: text2("platform_message_id").notNull(),
+        platform_thread_id: text2("platform_thread_id").notNull(),
+        platform_permalink: text2("platform_permalink"),
+        target_branch_id: text2("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id),
+        emitted_by_user_id: text2("emitted_by_user_id", { length: 36 }).notNull().references(() => users2.user_id),
+        emitted_by_session_id: text2("emitted_by_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        emitted_by_task_id: text2("emitted_by_task_id", { length: 36 }).references(() => tasks2.task_id, {
+          onDelete: "set null"
+        }),
+        emitted_by_schedule_id: text2("emitted_by_schedule_id", { length: 36 }).references(
+          () => schedules2.schedule_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        message_text: text2("message_text").notNull(),
+        message_preview: text2("message_preview").notNull(),
+        metadata: t2.json("metadata"),
+        consumed_by_session_id: text2("consumed_by_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        consumed_at: t2.timestamp("consumed_at")
+      },
+      (table) => ({
+        uniqueChannelThread: uniqueIndex2("uniq_gateway_outbound_channel_thread").on(
+          table.gateway_channel_id,
+          table.platform_thread_id
+        ),
+        emittedSessionIdx: index2("idx_gateway_outbound_emitted_session").on(
+          table.emitted_by_session_id
+        ),
+        emittedScheduleIdx: index2("idx_gateway_outbound_emitted_schedule").on(
+          table.emitted_by_schedule_id
+        ),
+        targetBranchCreatedIdx: index2("idx_gateway_outbound_branch_created").on(
+          table.target_branch_id,
+          table.created_at
+        ),
+        consumedIdx: index2("idx_gateway_outbound_consumed").on(table.consumed_at)
+      })
+    );
     sessionEnvSelections2 = sqliteTable(
       "session_env_selections",
       {
@@ -3295,6 +3615,71 @@ var init_executor_heartbeat = __esm({
   }
 });
 
+// src/config/multitenancy.ts
+function detectPostgresUrl(url) {
+  if (!url) return false;
+  const lower = url.toLowerCase();
+  return lower.startsWith("postgresql://") || lower.startsWith("postgres://") || lower.startsWith("pg://");
+}
+function resolveMultiTenancyDatabaseDialect(config = {}) {
+  if (process.env.AGOR_DB_DIALECT === "postgresql" || process.env.AGOR_DB_DIALECT === "sqlite") {
+    return process.env.AGOR_DB_DIALECT;
+  }
+  if (detectPostgresUrl(process.env.DATABASE_URL)) return "postgresql";
+  if (config.database?.dialect === "postgresql" || config.database?.dialect === "sqlite") {
+    return config.database.dialect;
+  }
+  if (detectPostgresUrl(config.database?.postgresql?.url) || config.database?.postgresql?.host) {
+    return "postgresql";
+  }
+  return "sqlite";
+}
+function resolveMultiTenancyConfig(config) {
+  const raw = config.multi_tenancy ?? {};
+  const mode = raw.mode ?? "static";
+  return {
+    mode,
+    static_tenant_id: raw.static_tenant_id?.trim() || DEFAULT_STATIC_TENANT_ID,
+    ...raw.auth_claim ? { auth_claim: raw.auth_claim } : {},
+    ...raw.trusted_header ? { trusted_header: raw.trusted_header } : {}
+  };
+}
+function assertValidMultiTenancyConfig(config) {
+  const resolved = resolveMultiTenancyConfig(config);
+  if (resolved.mode !== "static" && resolved.mode !== "required_from_auth") {
+    throw new Error("Config error: multi_tenancy.mode must be one of: static, required_from_auth");
+  }
+  if (!resolved.static_tenant_id) {
+    throw new Error("Config error: multi_tenancy.static_tenant_id must not be empty");
+  }
+  if (resolved.auth_claim && RESERVED_AUTH_CLAIMS.has(resolved.auth_claim)) {
+    throw new Error(
+      `Config error: multi_tenancy.auth_claim cannot be reserved JWT claim '${resolved.auth_claim}'`
+    );
+  }
+  if (resolved.mode === "required_from_auth") {
+    if (resolveMultiTenancyDatabaseDialect(config) !== "postgresql") {
+      throw new Error(
+        "Config error: multi_tenancy.required_from_auth requires database.dialect: postgresql"
+      );
+    }
+    if (!resolved.auth_claim && !resolved.trusted_header) {
+      throw new Error(
+        "Config error: multi_tenancy.required_from_auth requires multi_tenancy.auth_claim or multi_tenancy.trusted_header"
+      );
+    }
+  }
+}
+var DEFAULT_STATIC_TENANT_ID, RESERVED_AUTH_CLAIMS;
+var init_multitenancy = __esm({
+  "src/config/multitenancy.ts"() {
+    "use strict";
+    init_esm_shims();
+    DEFAULT_STATIC_TENANT_ID = "default";
+    RESERVED_AUTH_CLAIMS = /* @__PURE__ */ new Set(["aud", "exp", "iat", "iss", "jti", "nbf", "sub", "type"]);
+  }
+});
+
 // src/config/types.ts
 var init_types2 = __esm({
   "src/config/types.ts"() {
@@ -3308,7 +3693,7 @@ import { readFileSync, statSync } from "fs";
 import fs from "fs/promises";
 import os from "os";
 import path2 from "path";
-import yaml from "js-yaml";
+import * as yaml from "js-yaml";
 function cacheKeyMatches(a, b) {
   return a.mtimeMs === b.mtimeMs && a.size === b.size;
 }
@@ -3337,6 +3722,9 @@ function writeCachedConfig(configPath, config, key) {
   cachedEntry = { path: configPath, config: structuredClone(config), key };
 }
 function parseAndValidateConfig(content) {
+  if (content.trim() === "") {
+    return {};
+  }
   const parsed = yaml.load(content);
   const finalConfig = parsed || {};
   validateConfig(finalConfig);
@@ -3366,6 +3754,7 @@ To update: agor config set execution.unix_user_mode insulated`
       `Config error: execution.managed_envs_execution_mode must be one of: hybrid, webhook-only`
     );
   }
+  assertValidMultiTenancyConfig(config);
   validateOptionalHttpUrl(
     config.external_launch,
     "login_redirect_url",
@@ -3426,7 +3815,12 @@ function getDefaultConfig() {
       // Default: sync passwords to Unix
       executor_heartbeat: resolveExecutorHeartbeatConfig()
     },
-    analytics: getDefaultAnalyticsConfig()
+    analytics: getDefaultAnalyticsConfig(),
+    telemetry: {},
+    multi_tenancy: {
+      mode: "static",
+      static_tenant_id: "default"
+    }
   };
 }
 function loadConfigSync() {
@@ -3478,6 +3872,7 @@ var init_config_manager = __esm({
     init_analytics_defaults();
     init_constants();
     init_executor_heartbeat();
+    init_multitenancy();
     init_types2();
     NO_FILE = -1;
     NO_FILE_KEY = { mtimeMs: NO_FILE, size: 0 };
@@ -3531,7 +3926,7 @@ var init_schema_factory = __esm({
 });
 
 // src/db/schema.ts
-var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionRelationships3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
+var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionRelationships3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, gatewayOutboundMessages3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
 var init_schema = __esm({
   "src/db/schema.ts"() {
     "use strict";
@@ -3569,6 +3964,7 @@ var init_schema = __esm({
     boardComments3 = schema.boardComments;
     gatewayChannels3 = schema.gatewayChannels;
     threadSessionMap3 = schema.threadSessionMap;
+    gatewayOutboundMessages3 = schema.gatewayOutboundMessages;
     userApiKeys3 = schema.userApiKeys;
     serializedSessions3 = schema.serializedSessions;
     kbNamespaces3 = schema.kbNamespaces;
@@ -3605,6 +4001,7 @@ init_schema();
 init_esm_shims();
 init_ids();
 init_id();
+init_tenant_context();
 var RepositoryError = class extends Error {
   constructor(message, cause) {
     super(message);
@@ -3658,7 +4055,7 @@ import { and as and2, eq as eq2, isNull } from "drizzle-orm";
 init_esm_shims();
 init_config_manager();
 init_ids();
-import { and as and3, eq as eq3, like, or } from "drizzle-orm";
+import { and as and4, eq as eq4, inArray as inArray2, like, or as or2 } from "drizzle-orm";
 
 // src/utils/url.ts
 init_esm_shims();
@@ -3668,17 +4065,27 @@ init_id();
 init_database_wrapper();
 init_schema();
 
+// src/db/repositories/branch-access.ts
+init_esm_shims();
+init_types();
+init_database_wrapper();
+init_schema();
+import { and as and3, eq as eq3, exists, inArray, isNotNull, or, sql as sql4 } from "drizzle-orm";
+var VISIBLE_BRANCH_PERMISSION_LEVELS = BRANCH_PERMISSION_LEVELS.filter(
+  (level) => level !== "none"
+);
+
 // src/db/repositories/board-comments.ts
 init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and4, eq as eq4, isNull as isNull2, like as like2 } from "drizzle-orm";
+import { and as and5, eq as eq5, isNotNull as isNotNull2, isNull as isNull2, like as like2, or as or3, sql as sql5 } from "drizzle-orm";
 
 // src/db/repositories/board-objects.ts
 init_esm_shims();
 init_ids();
-import { and as and6, asc, eq as eq6, getTableColumns, isNotNull as isNotNull2, isNull as isNull3, or as or3, sql as sql5 } from "drizzle-orm";
+import { and as and6, asc, eq as eq6, getTableColumns, isNotNull as isNotNull3, isNull as isNull3, or as or4, sql as sql6 } from "drizzle-orm";
 
 // src/utils/board-placement.ts
 init_esm_shims();
@@ -3687,27 +4094,41 @@ init_esm_shims();
 init_database_wrapper();
 init_schema();
 
-// src/db/repositories/branch-access.ts
-init_esm_shims();
-init_types();
-init_database_wrapper();
-init_schema();
-import { and as and5, eq as eq5, exists, inArray, isNotNull, or as or2, sql as sql4 } from "drizzle-orm";
-var VISIBLE_BRANCH_PERMISSION_LEVELS = BRANCH_PERMISSION_LEVELS.filter(
-  (level) => level !== "none"
-);
-
 // src/db/repositories/boards.ts
 init_esm_shims();
 init_types();
 init_config_manager();
 init_ids();
-import { and as and9, eq as eq9, exists as exists2, isNull as isNull4, like as like4, ne, or as or4, sql as sql7 } from "drizzle-orm";
+import { and as and9, eq as eq9, inArray as inArray4, isNull as isNull4, like as like4, ne } from "drizzle-orm";
 import * as yaml2 from "js-yaml";
 
 // src/lib/slugs.ts
 init_esm_shims();
 
+// src/utils/emoji-shortcodes.ts
+init_esm_shims();
+import { createRequire } from "module";
+var requireJson = createRequire(import.meta.url);
+var emojiData = requireJson("emojibase-data/en/compact.json");
+var shortcodes = requireJson(
+  "emojibase-data/en/shortcodes/emojibase.json"
+);
+var emojiByHexcode = /* @__PURE__ */ new Map();
+for (const emoji of emojiData) {
+  if (emoji.unicode) {
+    emojiByHexcode.set(emoji.hexcode, emoji.unicode);
+  }
+}
+var emojiByShortcode = /* @__PURE__ */ new Map();
+for (const [hexcode, codes] of Object.entries(shortcodes)) {
+  const emoji = emojiByHexcode.get(hexcode);
+  if (!emoji) continue;
+  const codeList = Array.isArray(codes) ? codes : [codes];
+  for (const code of codeList) {
+    emojiByShortcode.set(code.toLowerCase(), emoji);
+  }
+}
+
 // src/db/repositories/boards.ts
 init_database_wrapper();
 init_schema();
@@ -3717,7 +4138,7 @@ init_esm_shims();
 init_types();
 init_config_manager();
 init_ids();
-import { and as and8, desc, eq as eq8, getTableColumns as getTableColumns2, inArray as inArray2, like as like3, sql as sql6 } from "drizzle-orm";
+import { and as and8, desc, eq as eq8, exists as exists2, getTableColumns as getTableColumns2, inArray as inArray3, like as like3, or as or5, sql as sql7 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
 
@@ -3758,24 +4179,69 @@ init_database_wrapper();
 import { eq as eq12, like as like7 } from "drizzle-orm";
 init_schema();
 
+// src/db/repositories/gateway-outbound-messages.ts
+init_esm_shims();
+init_types();
+init_ids();
+init_database_wrapper();
+init_schema();
+import { and as and11, eq as eq13, isNull as isNull5, like as like8 } from "drizzle-orm";
+
 // src/db/repositories/knowledge.ts
 init_esm_shims();
 init_types();
 init_config_manager();
 init_ids();
 import { createHash } from "crypto";
-import { and as and11, desc as desc2, eq as eq13, inArray as inArray3, like as like8, or as or5, sql as sql8 } from "drizzle-orm";
+import { and as and12, desc as desc2, eq as eq14, inArray as inArray5, like as like9, or as or6, sql as sql8 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/mcp-servers.ts
 init_esm_shims();
 init_ids();
-import { and as and12, eq as eq14, like as like9 } from "drizzle-orm";
+import { and as and14, eq as eq17, like as like10 } from "drizzle-orm";
 
 // src/tools/mcp/auth-secrets.ts
 init_esm_shims();
 
+// src/mcp/template-resolver.ts
+init_esm_shims();
+
+// src/config/env-resolver.ts
+init_esm_shims();
+init_database_wrapper();
+import { eq as eq16 } from "drizzle-orm";
+
+// src/db/repositories/session-env-selections.ts
+init_esm_shims();
+init_database_wrapper();
+init_schema();
+import { and as and13, eq as eq15 } from "drizzle-orm";
+
+// src/config/env-resolver.ts
+init_schema();
+
+// src/config/env-blocklist.ts
+init_esm_shims();
+var BLOCKED_ENV_PATTERNS = Object.freeze([
+  /^LD_/i,
+  /^DYLD_/i,
+  /^PYTHON(?!_AGOR_)/i
+]);
+
+// src/config/env-vars.ts
+init_esm_shims();
+var V05_SCOPES = ["global", "session"];
+var V05_SCOPE_SET = new Set(V05_SCOPES);
+
+// src/templates/handlebars-helpers.ts
+init_esm_shims();
+import Handlebars from "handlebars";
+
+// src/mcp/template-patterns.ts
+init_esm_shims();
+
 // src/tools/mcp/http-headers.ts
 init_esm_shims();
 var MCP_HEADER_REDACTED_SENTINEL = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
@@ -3926,7 +4392,7 @@ var MCPServerRepository = class {
    */
   async resolveId(id) {
     return resolveByShortIdPrefix(id, "MCPServer", async (pattern) => {
-      const rows = await select(this.db).from(mcpServers3).where(like9(mcpServers3.mcp_server_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      const rows = await select(this.db).from(mcpServers3).where(like10(mcpServers3.mcp_server_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
       return rows.map((r) => r.mcp_server_id);
     });
   }
@@ -3937,7 +4403,7 @@ var MCPServerRepository = class {
     try {
       const insertData = this.mcpServerToInsert(data);
       await insert(this.db, mcpServers3).values(insertData).run();
-      const row = await select(this.db).from(mcpServers3).where(eq14(mcpServers3.mcp_server_id, insertData.mcp_server_id)).one();
+      const row = await select(this.db).from(mcpServers3).where(eq17(mcpServers3.mcp_server_id, insertData.mcp_server_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created MCP server");
       }
@@ -3956,7 +4422,7 @@ var MCPServerRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(mcpServers3).where(eq14(mcpServers3.mcp_server_id, fullId)).one();
+      const row = await select(this.db).from(mcpServers3).where(eq17(mcpServers3.mcp_server_id, fullId)).one();
       return row ? this.rowToMCPServer(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -3975,24 +4441,24 @@ var MCPServerRepository = class {
       let query = select(this.db).from(mcpServers3);
       const conditions = [];
       if (filters?.scope) {
-        conditions.push(eq14(mcpServers3.scope, filters.scope));
+        conditions.push(eq17(mcpServers3.scope, filters.scope));
       }
       if (filters?.scopeId) {
         if (filters.scope === "global") {
-          conditions.push(eq14(mcpServers3.owner_user_id, filters.scopeId));
+          conditions.push(eq17(mcpServers3.owner_user_id, filters.scopeId));
         }
       }
       if (filters?.transport) {
-        conditions.push(eq14(mcpServers3.transport, filters.transport));
+        conditions.push(eq17(mcpServers3.transport, filters.transport));
       }
       if (filters?.enabled !== void 0) {
-        conditions.push(eq14(mcpServers3.enabled, filters.enabled));
+        conditions.push(eq17(mcpServers3.enabled, filters.enabled));
       }
       if (filters?.source) {
-        conditions.push(eq14(mcpServers3.source, filters.source));
+        conditions.push(eq17(mcpServers3.source, filters.source));
       }
       if (conditions.length > 0) {
-        query = query.where(and12(...conditions));
+        query = query.where(and14(...conditions));
       }
       const rows = await query.all();
       return rows.map((row) => this.rowToMCPServer(row));
@@ -4039,7 +4505,7 @@ var MCPServerRepository = class {
         transport: insertData.transport,
         updated_at: /* @__PURE__ */ new Date(),
         data: insertData.data
-      }).where(eq14(mcpServers3.mcp_server_id, fullId)).run();
+      }).where(eq17(mcpServers3.mcp_server_id, fullId)).run();
       const updated = await this.findById(fullId);
       if (!updated) {
         throw new RepositoryError("Failed to retrieve updated MCP server");
@@ -4060,7 +4526,7 @@ var MCPServerRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, mcpServers3).where(eq14(mcpServers3.mcp_server_id, fullId)).run();
+      const result = await deleteFrom(this.db, mcpServers3).where(eq17(mcpServers3.mcp_server_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("MCPServer", id);
       }
@@ -4092,21 +4558,18 @@ var MCPServerRepository = class {
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and13, eq as eq15 } from "drizzle-orm";
+import { and as and15, eq as eq18, inArray as inArray6 } from "drizzle-orm";
 
 // src/db/repositories/repos.ts
 init_esm_shims();
-import { eq as eq16, like as like10, sql as sql9 } from "drizzle-orm";
+import { eq as eq19, like as like11, sql as sql9 } from "drizzle-orm";
 
 // src/config/variant-resolver.ts
 init_esm_shims();
 
 // src/yaml/index.ts
 init_esm_shims();
-import yaml3 from "js-yaml";
-var load2 = yaml3.load;
-var dump2 = yaml3.dump;
-var YAMLException = yaml3.YAMLException;
+import * as yaml3 from "js-yaml";
 
 // src/db/repositories/repos.ts
 init_ids();
@@ -4118,33 +4581,27 @@ init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and14, asc as asc2, desc as desc3, eq as eq17, isNull as isNull5, like as like11, lte, or as or6, sql as sql10 } from "drizzle-orm";
+import { and as and16, asc as asc2, desc as desc3, eq as eq20, isNull as isNull6, like as like12, lte, or as or7, sql as sql10 } from "drizzle-orm";
 
 // src/db/repositories/serialized-sessions.ts
 init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and15, desc as desc4, eq as eq18, lt } from "drizzle-orm";
-
-// src/db/repositories/session-env-selections.ts
-init_esm_shims();
-init_database_wrapper();
-init_schema();
-import { and as and16, eq as eq19 } from "drizzle-orm";
+import { and as and17, desc as desc4, eq as eq21, lt } from "drizzle-orm";
 
 // src/db/repositories/session-mcp-servers.ts
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and18, eq as eq21 } from "drizzle-orm";
+import { and as and19, eq as eq23 } from "drizzle-orm";
 
 // src/db/repositories/sessions.ts
 init_esm_shims();
 init_types();
 init_config_manager();
 init_ids();
-import { and as and17, desc as desc5, eq as eq20, inArray as inArray4, like as like12, or as or7, sql as sql11 } from "drizzle-orm";
+import { and as and18, desc as desc5, eq as eq22, inArray as inArray7, like as like13, or as or8, sql as sql11 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
 
@@ -4153,7 +4610,7 @@ init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and19, eq as eq22, inArray as inArray5, or as or8 } from "drizzle-orm";
+import { and as and20, eq as eq24, inArray as inArray8, or as or9 } from "drizzle-orm";
 
 // src/db/repositories/tasks.ts
 init_esm_shims();
@@ -4161,7 +4618,7 @@ init_types();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { eq as eq23, inArray as inArray6, like as like13, sql as sql12 } from "drizzle-orm";
+import { and as and21, eq as eq25, inArray as inArray9, like as like14, sql as sql12 } from "drizzle-orm";
 
 // src/db/repositories/thread-session-map.ts
 init_esm_shims();
@@ -4169,22 +4626,23 @@ init_types();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and20, eq as eq24, like as like14, lt as lt2 } from "drizzle-orm";
+import { and as and22, eq as eq26, like as like15, lt as lt2 } from "drizzle-orm";
 
 // src/db/repositories/user-api-keys.ts
 init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
+init_tenant_context();
 import { randomBytes as randomBytes3 } from "crypto";
 import bcrypt from "bcryptjs";
-import { and as and21, eq as eq25 } from "drizzle-orm";
+import { and as and23, eq as eq27 } from "drizzle-orm";
 
 // src/db/repositories/user-mcp-oauth-tokens.ts
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and22, eq as eq26, isNull as isNull6 } from "drizzle-orm";
+import { and as and24, eq as eq28, isNull as isNull7 } from "drizzle-orm";
 function rowToToken(row) {
   return {
     user_id: row.user_id ?? null,
@@ -4199,9 +4657,9 @@ function rowToToken(row) {
   };
 }
 function matchKey(userId, serverId) {
-  return and22(
-    userId === null ? isNull6(userMcpOauthTokens3.user_id) : eq26(userMcpOauthTokens3.user_id, userId),
-    eq26(userMcpOauthTokens3.mcp_server_id, serverId)
+  return and24(
+    userId === null ? isNull7(userMcpOauthTokens3.user_id) : eq28(userMcpOauthTokens3.user_id, userId),
+    eq28(userMcpOauthTokens3.mcp_server_id, serverId)
   );
 }
 var UserMCPOAuthTokenRepository = class {
@@ -4318,7 +4776,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async deleteAllForUser(userId) {
     try {
-      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq26(userMcpOauthTokens3.user_id, userId)).run();
+      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq28(userMcpOauthTokens3.user_id, userId)).run();
       return result.rowsAffected;
     } catch (error) {
       throw new RepositoryError(
@@ -4329,7 +4787,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async deleteAllForServer(serverId) {
     try {
-      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq26(userMcpOauthTokens3.mcp_server_id, serverId)).run();
+      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq28(userMcpOauthTokens3.mcp_server_id, serverId)).run();
       return result.rowsAffected;
     } catch (error) {
       throw new RepositoryError(
@@ -4340,7 +4798,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async listForUser(userId) {
     try {
-      const rows = await select(this.db).from(userMcpOauthTokens3).where(eq26(userMcpOauthTokens3.user_id, userId)).all();
+      const rows = await select(this.db).from(userMcpOauthTokens3).where(eq28(userMcpOauthTokens3.user_id, userId)).all();
       return rows.map(rowToToken);
     } catch (error) {
       throw new RepositoryError(
@@ -4358,14 +4816,7 @@ var UserMCPOAuthTokenRepository = class {
 // src/db/repositories/users.ts
 init_esm_shims();
 init_types();
-import { eq as eq27, like as like15, sql as sql13 } from "drizzle-orm";
-
-// src/config/env-vars.ts
-init_esm_shims();
-var V05_SCOPES = ["global", "session"];
-var V05_SCOPE_SET = new Set(V05_SCOPES);
-
-// src/db/repositories/users.ts
+import { eq as eq29, like as like16, sql as sql13 } from "drizzle-orm";
 init_ids();
 init_database_wrapper();
 init_schema();