agor-live 0.23.1 → 0.23.2

package/dist/core/tools/mcp/auth-secrets.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/tools/mcp/auth-secrets.ts
@@ -26,6 +36,3449 @@ __export(auth_secrets_exports, {
 });
 module.exports = __toCommonJS(auth_secrets_exports);
 
+// src/config/env-resolver.ts
+var import_drizzle_orm5 = require("drizzle-orm");
+
+// src/db/database-wrapper.ts
+var import_drizzle_orm = require("drizzle-orm");
+
+// src/db/tenant-context.ts
+var import_node_async_hooks = require("async_hooks");
+var tenantDatabaseScope = new import_node_async_hooks.AsyncLocalStorage();
+
+// src/db/encryption.ts
+var import_node_crypto = require("crypto");
+
+// src/db/repositories/session-env-selections.ts
+var import_drizzle_orm4 = require("drizzle-orm");
+
+// src/db/schema.postgres.ts
+var schema_postgres_exports = {};
+__export(schema_postgres_exports, {
+  appVariables: () => appVariables,
+  artifactTrustGrants: () => artifactTrustGrants,
+  artifacts: () => artifacts,
+  boardComments: () => boardComments,
+  boardGroupGrants: () => boardGroupGrants,
+  boardObjects: () => boardObjects,
+  boardOwners: () => boardOwners,
+  boards: () => boards,
+  branchGroupGrants: () => branchGroupGrants,
+  branchOwners: () => branchOwners,
+  branches: () => branches,
+  branchesRelations: () => branchesRelations,
+  cardTypes: () => cardTypes,
+  cards: () => cards,
+  gatewayChannels: () => gatewayChannels,
+  gatewayOutboundMessages: () => gatewayOutboundMessages,
+  groupMemberships: () => groupMemberships,
+  groups: () => groups,
+  kbDocumentUnits: () => kbDocumentUnits,
+  kbDocumentVersions: () => kbDocumentVersions,
+  kbDocuments: () => kbDocuments,
+  kbEmbeddingSpaces: () => kbEmbeddingSpaces,
+  kbGraphEdges: () => kbGraphEdges,
+  kbGraphNodes: () => kbGraphNodes,
+  kbNamespaceAcl: () => kbNamespaceAcl,
+  kbNamespaces: () => kbNamespaces,
+  mcpServers: () => mcpServers,
+  messages: () => messages,
+  repos: () => repos,
+  schedules: () => schedules,
+  schedulesRelations: () => schedulesRelations,
+  serializedSessions: () => serializedSessions,
+  sessionEnvSelections: () => sessionEnvSelections,
+  sessionMcpServers: () => sessionMcpServers,
+  sessionRelationships: () => sessionRelationships,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations,
+  sessions: () => sessions,
+  sessionsRelations: () => sessionsRelations,
+  tasks: () => tasks,
+  threadSessionMap: () => threadSessionMap,
+  userApiKeys: () => userApiKeys,
+  userMcpOauthTokens: () => userMcpOauthTokens,
+  users: () => users
+});
+
+// src/types/branch.ts
+var BRANCH_PERMISSION_LEVELS = ["none", "view", "session", "prompt", "all"];
+
+// src/types/session.ts
+var SessionStatus = {
+  IDLE: "idle",
+  RUNNING: "running",
+  STOPPING: "stopping",
+  // Stop requested, waiting for task to stop
+  AWAITING_PERMISSION: "awaiting_permission",
+  AWAITING_INPUT: "awaiting_input",
+  // Legacy / pre-#1177: AskUserQuestion was disallowed at the SDK; new sessions never enter this state, kept for historical rows
+  TIMED_OUT: "timed_out",
+  // Permission/input request timed out, executor exited — user must re-prompt
+  COMPLETED: "completed",
+  FAILED: "failed"
+};
+var EXECUTING_SESSION_STATUSES = /* @__PURE__ */ new Set([
+  SessionStatus.RUNNING,
+  SessionStatus.STOPPING,
+  SessionStatus.AWAITING_PERMISSION,
+  SessionStatus.AWAITING_INPUT
+]);
+
+// src/types/task.ts
+var TaskStatus = {
+  QUEUED: "queued",
+  // Task created but not yet running (waiting for executor to drain queue)
+  CREATED: "created",
+  RUNNING: "running",
+  STOPPING: "stopping",
+  // Stop requested, waiting for SDK to halt
+  AWAITING_PERMISSION: "awaiting_permission",
+  AWAITING_INPUT: "awaiting_input",
+  // Legacy / pre-#1177: AskUserQuestion was disallowed at the SDK; new tasks never enter this state, kept for historical rows
+  TIMED_OUT: "timed_out",
+  // Permission/input request timed out, executor exited — user must re-prompt
+  COMPLETED: "completed",
+  FAILED: "failed",
+  STOPPED: "stopped"
+  // User-requested stop (distinct from failed)
+};
+var TERMINAL_TASK_STATUSES = /* @__PURE__ */ new Set([
+  TaskStatus.COMPLETED,
+  TaskStatus.FAILED,
+  TaskStatus.STOPPED,
+  TaskStatus.TIMED_OUT
+]);
+var EXECUTING_TASK_STATUSES = /* @__PURE__ */ new Set([
+  TaskStatus.RUNNING,
+  TaskStatus.STOPPING,
+  TaskStatus.AWAITING_PERMISSION,
+  TaskStatus.AWAITING_INPUT
+]);
+
+// src/types/user.ts
+var ROLES = {
+  SUPERADMIN: "superadmin",
+  ADMIN: "admin",
+  MEMBER: "member",
+  VIEWER: "viewer"
+};
+var ROLE_OPTIONS = [
+  {
+    value: ROLES.SUPERADMIN,
+    label: "Superadmin",
+    description: "Full system access + branch RBAC bypass"
+  },
+  {
+    value: ROLES.ADMIN,
+    label: "Admin",
+    description: "Manage resources (users, MCP servers, config)"
+  },
+  { value: ROLES.MEMBER, label: "Member", description: "Standard user" },
+  { value: ROLES.VIEWER, label: "Viewer", description: "Read-only access" }
+];
+var ROLE_RANK = {
+  [ROLES.VIEWER]: 0,
+  [ROLES.MEMBER]: 1,
+  [ROLES.ADMIN]: 2,
+  [ROLES.SUPERADMIN]: 3,
+  owner: 3
+};
+
+// src/db/schema.postgres.ts
+var import_drizzle_orm2 = require("drizzle-orm");
+var import_pg_core = require("drizzle-orm/pg-core");
+var bytea = (0, import_pg_core.customType)({
+  dataType() {
+    return "bytea";
+  }
+});
+var t = {
+  timestamp: (name) => (0, import_pg_core.timestamp)(name, { mode: "date", withTimezone: true }),
+  bool: (name) => (0, import_pg_core.boolean)(name),
+  json: (name) => (0, import_pg_core.jsonb)(name).$type()
+};
+var sessions = (0, import_pg_core.pgTable)(
+  "sessions",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    // Primary identity
+    session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    // User attribution
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull(),
+    // Unix username for SDK impersonation (immutable once set)
+    // Set from creator's unix_username at session creation time
+    // NEVER changes, even if user's unix_username changes later
+    // This ensures SDK session data remains accessible in the original home directory
+    unix_username: (0, import_pg_core.text)("unix_username"),
+    // Materialized for filtering/joins (cross-DB compatible)
+    status: (0, import_pg_core.text)("status", {
+      enum: [
+        "idle",
+        "running",
+        "stopping",
+        "awaiting_permission",
+        "awaiting_input",
+        "timed_out",
+        "completed",
+        "failed"
+      ]
+    }).notNull(),
+    agentic_tool: (0, import_pg_core.text)("agentic_tool", {
+      enum: ["claude-code", "claude-code-cli", "codex", "gemini", "opencode", "copilot", "cursor"]
+    }).notNull(),
+    board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }),
+    // NULL = no board
+    // Genealogy (materialized for tree queries)
+    parent_session_id: (0, import_pg_core.varchar)("parent_session_id", { length: 36 }),
+    forked_from_session_id: (0, import_pg_core.varchar)("forked_from_session_id", { length: 36 }),
+    // Branch reference (REQUIRED: all sessions must have a branch)
+    branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, {
+      onDelete: "cascade"
+      // Cascade delete sessions when branch is deleted
+    }),
+    // Scheduler tracking (materialized for deduplication and retention cleanup)
+    scheduled_run_at: (0, import_pg_core.bigint)("scheduled_run_at", { mode: "number" }),
+    // Unix timestamp (ms) - authoritative run ID - bigint to support dates beyond 2038
+    scheduled_from_branch: t.bool("scheduled_from_branch").notNull().default(false),
+    // FK to schedules.schedule_id, ON DELETE SET NULL. Defined here (not
+    // just in the migration) so drizzle-kit / db introspection sees the
+    // constraint and so future schema diffs don't lose it.
+    schedule_id: (0, import_pg_core.varchar)("schedule_id", { length: 36 }).references(
+      () => schedules.schedule_id,
+      { onDelete: "set null" }
+    ),
+    // UI state (materialized for efficient highlighting queries)
+    ready_for_prompt: t.bool("ready_for_prompt").notNull().default(false),
+    // Archive state (cascaded from branch archive)
+    archived: t.bool("archived").notNull().default(false),
+    archived_reason: (0, import_pg_core.text)("archived_reason", {
+      enum: ["branch_archived", "manual", "btw_completed"]
+    }),
+    // JSON blob for everything else (cross-DB via json() type)
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("sessions_tenant_id_idx").on(table.tenant_id),
+    statusIdx: (0, import_pg_core.index)("sessions_status_idx").on(table.status),
+    statusReadyIdx: (0, import_pg_core.index)("sessions_status_ready_idx").on(table.status, table.ready_for_prompt),
+    agenticToolIdx: (0, import_pg_core.index)("sessions_agentic_tool_idx").on(table.agentic_tool),
+    boardIdx: (0, import_pg_core.index)("sessions_board_idx").on(table.board_id),
+    branchIdx: (0, import_pg_core.index)("sessions_branch_idx").on(table.branch_id),
+    createdIdx: (0, import_pg_core.index)("sessions_created_idx").on(table.created_at),
+    parentIdx: (0, import_pg_core.index)("sessions_parent_idx").on(table.parent_session_id),
+    forkedIdx: (0, import_pg_core.index)("sessions_forked_idx").on(table.forked_from_session_id),
+    // Scheduler indexes — including the partial unique index below.
+    scheduledFromBranchIdx: (0, import_pg_core.index)("sessions_scheduled_flag_idx").on(table.scheduled_from_branch),
+    // Partial unique index — covering for the scheduler's dedup lookup
+    // AND serves as the DB-level guard against check-then-create races
+    // in spawnScheduledSession.
+    scheduleRunUnique: (0, import_pg_core.uniqueIndex)("sessions_schedule_run_unique").on(table.tenant_id, table.schedule_id, table.scheduled_run_at).where(import_drizzle_orm2.sql`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
+  })
+);
+var sessionRelationships = (0, import_pg_core.pgTable)(
+  "session_relationships",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    relationship_id: (0, import_pg_core.varchar)("relationship_id", { length: 36 }).primaryKey(),
+    source_session_id: (0, import_pg_core.varchar)("source_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    target_session_id: (0, import_pg_core.varchar)("target_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    relationship_type: (0, import_pg_core.text)("relationship_type", { enum: ["remote_create"] }).notNull(),
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    callback_enabled: t.bool("callback_enabled").notNull().default(false),
+    callback_session_id: (0, import_pg_core.varchar)("callback_session_id", { length: 36 }).references(
+      () => sessions.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    data: t.json("data")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("session_relationships_tenant_id_idx").on(table.tenant_id),
+    sourceIdx: (0, import_pg_core.index)("session_relationships_source_idx").on(table.source_session_id),
+    targetIdx: (0, import_pg_core.index)("session_relationships_target_idx").on(table.target_session_id),
+    callbackIdx: (0, import_pg_core.index)("session_relationships_callback_idx").on(table.callback_session_id),
+    // Composite indexes so the OR predicate in dispatchCompletionCallbacks
+    // (WHERE source_session_id = $1 OR target_session_id = $2) uses BitmapOr
+    // over these instead of a full tenant table scan via tenant_id_idx.
+    tenantSourceIdx: (0, import_pg_core.index)("session_relationships_tenant_source_idx").on(
+      table.tenant_id,
+      table.source_session_id
+    ),
+    tenantTargetIdx: (0, import_pg_core.index)("session_relationships_tenant_target_idx").on(
+      table.tenant_id,
+      table.target_session_id
+    ),
+    sourceTargetTypeUnique: (0, import_pg_core.uniqueIndex)("session_relationships_source_target_type_unique").on(
+      table.tenant_id,
+      table.source_session_id,
+      table.target_session_id,
+      table.relationship_type
+    )
+  })
+);
+var tasks = (0, import_pg_core.pgTable)(
+  "tasks",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    task_id: (0, import_pg_core.varchar)("task_id", { length: 36 }).primaryKey(),
+    session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    created_at: t.timestamp("created_at").notNull(),
+    started_at: t.timestamp("started_at"),
+    completed_at: t.timestamp("completed_at"),
+    last_executor_heartbeat_at: t.timestamp("last_executor_heartbeat_at"),
+    status: (0, import_pg_core.text)("status", {
+      enum: [
+        "queued",
+        "created",
+        "running",
+        "stopping",
+        "awaiting_permission",
+        "awaiting_input",
+        "timed_out",
+        "completed",
+        "failed",
+        "stopped"
+      ]
+    }).notNull(),
+    // Queue position (lower drains first); only populated for status='queued'
+    queue_position: (0, import_pg_core.integer)("queue_position"),
+    // User attribution
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull(),
+    // MD5 of SDK session file at task completion (only populated when stateless_fs_mode is enabled)
+    session_md5: (0, import_pg_core.text)("session_md5"),
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("tasks_tenant_id_idx").on(table.tenant_id),
+    sessionIdx: (0, import_pg_core.index)("tasks_session_idx").on(table.session_id),
+    statusIdx: (0, import_pg_core.index)("tasks_status_idx").on(table.status),
+    createdIdx: (0, import_pg_core.index)("tasks_created_idx").on(table.created_at),
+    // Composite for "latest task for session" queries (ORDER BY created_at DESC LIMIT 1).
+    sessionCreatedIdx: (0, import_pg_core.index)("tasks_session_created_idx").on(table.session_id, table.created_at),
+    queueIdx: (0, import_pg_core.index)("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
+    // Partial unique index — defense-in-depth for `tasks.createPending` race
+    // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
+    // rows have NULL queue_position and are unaffected.
+    queuedPositionUnique: (0, import_pg_core.uniqueIndex)("tasks_queued_position_unique").on(table.tenant_id, table.session_id, table.queue_position).where(import_drizzle_orm2.sql`${table.status} = 'queued'`)
+  })
+);
+var serializedSessions = (0, import_pg_core.pgTable)(
+  "serialized_sessions",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    id: (0, import_pg_core.varchar)("id", { length: 36 }).primaryKey(),
+    session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
+    task_id: (0, import_pg_core.varchar)("task_id", { length: 36 }).references(() => tasks.task_id, {
+      onDelete: "set null"
+    }),
+    turn_index: (0, import_pg_core.integer)("turn_index").notNull().default(0),
+    created_at: t.timestamp("created_at").notNull(),
+    md5: (0, import_pg_core.text)("md5").notNull(),
+    status: (0, import_pg_core.text)("status").notNull(),
+    // 'processing' | 'done' — validated at app layer
+    payload: bytea("payload")
+    // gzipped; NULL while status='processing'
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("serialized_sessions_tenant_id_idx").on(table.tenant_id),
+    sessionTurnIdx: (0, import_pg_core.index)("serialized_sessions_session_turn_idx").on(
+      table.session_id,
+      table.turn_index
+    ),
+    branchIdx: (0, import_pg_core.index)("serialized_sessions_branch_idx").on(table.branch_id)
+  })
+);
+var messages = (0, import_pg_core.pgTable)(
+  "messages",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    // Primary identity
+    message_id: (0, import_pg_core.varchar)("message_id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    // Foreign keys (materialized for indexes)
+    session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    task_id: (0, import_pg_core.varchar)("task_id", { length: 36 }).references(() => tasks.task_id, {
+      onDelete: "set null"
+    }),
+    // Materialized for queries
+    type: (0, import_pg_core.text)("type", {
+      enum: [
+        "user",
+        "assistant",
+        "system",
+        "file-history-snapshot",
+        "permission_request",
+        "input_request",
+        "daemon_restart",
+        "daemon_crash",
+        "widget_request"
+      ]
+    }).notNull(),
+    role: (0, import_pg_core.text)("role", {
+      enum: ["user", "assistant", "system"]
+    }).notNull(),
+    index: (0, import_pg_core.integer)("index").notNull(),
+    // Position in conversation (0-based)
+    timestamp: t.timestamp("timestamp").notNull(),
+    content_preview: (0, import_pg_core.text)("content_preview"),
+    // First 200 chars for list views
+    // Parent tool use ID (for nested tool calls - e.g., Task tool spawning Read/Grep)
+    parent_tool_use_id: (0, import_pg_core.text)("parent_tool_use_id"),
+    // NOTE: queueing moved off `messages` and onto `tasks.status='queued'` as
+    // of migration sqlite/0040 (postgres/0030). The legacy `status` and
+    // `queue_position` columns are gone — see `tasks.queue_position` instead.
+    // Full data (JSON blob)
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("messages_tenant_id_idx").on(table.tenant_id),
+    tenantTimestampIdx: (0, import_pg_core.index)("messages_tenant_timestamp_idx").on(table.tenant_id, table.timestamp),
+    // Indexes for efficient lookups
+    sessionIdx: (0, import_pg_core.index)("messages_session_id_idx").on(table.session_id),
+    taskIdx: (0, import_pg_core.index)("messages_task_id_idx").on(table.task_id),
+    sessionIndexIdx: (0, import_pg_core.index)("messages_session_index_idx").on(table.session_id, table.index),
+    timestampIdx: (0, import_pg_core.index)("messages_timestamp_idx").on(table.timestamp),
+    sessionTimestampIdx: (0, import_pg_core.index)("messages_session_timestamp_idx").on(
+      table.session_id,
+      table.timestamp
+    )
+  })
+);
+var boards = (0, import_pg_core.pgTable)(
+  "boards",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    // User attribution
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull(),
+    // Materialized for lookups
+    name: (0, import_pg_core.text)("name").notNull(),
+    slug: (0, import_pg_core.text)("slug"),
+    primary_assistant_id: (0, import_pg_core.varchar)("primary_assistant_id", { length: 36 }).references(
+      () => branches.branch_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    // JSON blob for the rest
+    data: t.json("data").$type().notNull(),
+    // Archive state (for soft deletes)
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at"),
+    archived_by: (0, import_pg_core.varchar)("archived_by", { length: 36 })
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("boards_tenant_id_idx").on(table.tenant_id),
+    nameIdx: (0, import_pg_core.index)("boards_name_idx").on(table.name),
+    slugIdx: (0, import_pg_core.index)("boards_slug_idx").on(table.slug),
+    slugTenantUnique: (0, import_pg_core.uniqueIndex)("boards_tenant_slug_unique").on(table.tenant_id, table.slug)
+  })
+);
+var repos = (0, import_pg_core.pgTable)(
+  "repos",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    repo_id: (0, import_pg_core.varchar)("repo_id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    // Materialized for querying
+    slug: (0, import_pg_core.text)("slug").notNull(),
+    repo_type: (0, import_pg_core.text)("repo_type", { enum: ["remote", "local"] }).notNull().default("remote"),
+    // Unix group for repo-level git access (agor_rp_<short-id>)
+    // Users who have access to ANY branch in this repo get added to this group.
+    // Applied to repo Unix-group-managed paths:
+    // - repo root (non-recursive) for traversal into .git/worktrees/<name>
+    // - .git (recursive) for shared git objects/refs and git operations
+    unix_group: (0, import_pg_core.text)("unix_group"),
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("repos_tenant_id_idx").on(table.tenant_id),
+    slugIdx: (0, import_pg_core.index)("repos_slug_idx").on(table.slug),
+    slugTenantUnique: (0, import_pg_core.uniqueIndex)("repos_tenant_slug_unique").on(table.tenant_id, table.slug)
+  })
+);
+var branches = (0, import_pg_core.pgTable)(
+  "branches",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    // Primary identity
+    branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).primaryKey(),
+    repo_id: (0, import_pg_core.varchar)("repo_id", { length: 36 }).notNull().references(() => repos.repo_id, { onDelete: "cascade" }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    // User attribution
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull(),
+    // Materialized for queries
+    name: (0, import_pg_core.text)("name").notNull(),
+    // "feat-auth", "main"
+    ref: (0, import_pg_core.text)("ref").notNull(),
+    // Current branch/tag/commit
+    ref_type: (0, import_pg_core.text)("ref_type", { enum: ["branch", "tag"] }),
+    // Type of ref (branch or tag)
+    branch_unique_id: (0, import_pg_core.integer)("branch_unique_id").notNull(),
+    // Auto-assigned sequential ID for templates
+    // Environment configuration (static, initialized from templates, then user-editable)
+    start_command: (0, import_pg_core.text)("start_command"),
+    // Start command (initialized from repo's up_command template)
+    stop_command: (0, import_pg_core.text)("stop_command"),
+    // Stop command (initialized from repo's down_command template)
+    nuke_command: (0, import_pg_core.text)("nuke_command"),
+    // Nuke command (initialized from repo's nuke_command template)
+    health_check_url: (0, import_pg_core.text)("health_check_url"),
+    // Health check URL (initialized from repo's health_check.url_template)
+    app_url: (0, import_pg_core.text)("app_url"),
+    // Application URL (initialized from repo's app_url_template)
+    logs_command: (0, import_pg_core.text)("logs_command"),
+    // Logs command (initialized from repo's logs_command template)
+    // Name of the environment variant currently rendered into the command fields above.
+    // References a key under repo.environment.variants. Null for pre-v2 branches.
+    environment_variant: (0, import_pg_core.text)("environment_variant"),
+    // Board relationship (nullable - branches can exist without boards)
+    board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).references(() => boards.board_id, {
+      onDelete: "set null"
+      // If board is deleted, branch remains but loses board association
+    }),
+    // UI state (materialized for efficient highlighting queries)
+    needs_attention: t.bool("needs_attention").notNull().default(true),
+    // Default true for new branches
+    // Archive state (for soft deletes)
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at"),
+    archived_by: (0, import_pg_core.varchar)("archived_by", { length: 36 }),
+    filesystem_status: (0, import_pg_core.text)("filesystem_status", {
+      enum: ["creating", "ready", "failed", "preserved", "cleaned", "deleted"]
+    }),
+    // RBAC: App-layer permissions (rbac.md)
+    permission_source: (0, import_pg_core.text)("permission_source", { enum: ["board", "override"] }).$type().notNull().default("override"),
+    others_can: (0, import_pg_core.text)("others_can", {
+      enum: [...BRANCH_PERMISSION_LEVELS]
+    }).default("view"),
+    // RBAC: OS-layer permissions (unix-user-modes.md)
+    unix_group: (0, import_pg_core.text)("unix_group"),
+    // e.g., 'agor_wt_abc123'
+    others_fs_access: (0, import_pg_core.text)("others_fs_access", {
+      enum: ["none", "read", "write"]
+    }).$type().default("read"),
+    // Branch storage model — see context/explorations/clone-redesign.md.
+    // 'worktree' = native `git worktree add` (shared base .git/config — legacy default).
+    // 'clone'    = self-standing `git clone` (own .git/ — closes cross-branch leak vectors).
+    //
+    // No DB-side CHECK: enum is validated at the Drizzle/TS/Zod/service
+    // layer to stay symmetric with the SQLite mirror (which can't easily
+    // alter CHECK constraints in place).
+    storage_mode: (0, import_pg_core.text)("storage_mode", { enum: ["worktree", "clone"] }).notNull().default("worktree"),
+    // Only meaningful when storage_mode='clone'. NULL = full clone, positive
+    // integer = `git clone --depth N` (shallow). The service layer rejects
+    // a non-null clone_depth on worktree-mode rows.
+    clone_depth: (0, import_pg_core.integer)("clone_depth"),
+    // JSON blob for everything else
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("branches_tenant_id_idx").on(table.tenant_id),
+    repoIdx: (0, import_pg_core.index)("branches_repo_idx").on(table.repo_id),
+    nameIdx: (0, import_pg_core.index)("branches_name_idx").on(table.name),
+    refIdx: (0, import_pg_core.index)("branches_ref_idx").on(table.ref),
+    boardIdx: (0, import_pg_core.index)("branches_board_idx").on(table.board_id),
+    createdIdx: (0, import_pg_core.index)("branches_created_idx").on(table.created_at),
+    updatedIdx: (0, import_pg_core.index)("branches_updated_idx").on(table.updated_at),
+    // Composite unique constraint (repo + name)
+    uniqueRepoName: (0, import_pg_core.index)("branches_repo_name_unique").on(table.repo_id, table.name)
+  })
+);
+var branchOwners = (0, import_pg_core.pgTable)(
+  "branch_owners",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
+    user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
+    created_at: t.timestamp("created_at").defaultNow()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("branch_owners_tenant_id_idx").on(table.tenant_id),
+    pk: (0, import_pg_core.primaryKey)({ columns: [table.branch_id, table.user_id] })
+  })
+);
+var boardOwners = (0, import_pg_core.pgTable)(
+  "board_owners",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
+    user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
+    created_at: t.timestamp("created_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("board_owners_tenant_id_idx").on(table.tenant_id),
+    pk: (0, import_pg_core.primaryKey)({ columns: [table.board_id, table.user_id] }),
+    userIdx: (0, import_pg_core.index)("board_owners_user_idx").on(table.user_id)
+  })
+);
+var schedules = (0, import_pg_core.pgTable)(
+  "schedules",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    schedule_id: (0, import_pg_core.varchar)("schedule_id", { length: 36 }).primaryKey(),
+    branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
+    name: (0, import_pg_core.text)("name").notNull(),
+    description: (0, import_pg_core.text)("description"),
+    cron_expression: (0, import_pg_core.text)("cron_expression").notNull(),
+    timezone_mode: (0, import_pg_core.text)("timezone_mode", { enum: ["local", "utc"] }).notNull().default("local"),
+    timezone: (0, import_pg_core.text)("timezone"),
+    prompt: (0, import_pg_core.text)("prompt").notNull(),
+    agentic_tool_config: t.json("agentic_tool_config").notNull(),
+    enabled: t.bool("enabled").notNull().default(true),
+    allow_concurrent_runs: t.bool("allow_concurrent_runs").notNull().default(false),
+    retention: (0, import_pg_core.integer)("retention").notNull().default(5),
+    last_run_at: (0, import_pg_core.bigint)("last_run_at", { mode: "number" }),
+    last_run_session_id: (0, import_pg_core.varchar)("last_run_session_id", { length: 36 }).references(
+      () => sessions.session_id,
+      { onDelete: "set null" }
+    ),
+    next_run_at: (0, import_pg_core.bigint)("next_run_at", { mode: "number" }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at").notNull(),
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull().references(() => users.user_id)
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("schedules_tenant_id_idx").on(table.tenant_id),
+    enabledNextRunIdx: (0, import_pg_core.index)("schedules_enabled_next_run_idx").on(table.enabled, table.next_run_at),
+    branchIdx: (0, import_pg_core.index)("schedules_branch_idx").on(table.branch_id),
+    createdByIdx: (0, import_pg_core.index)("schedules_created_by_idx").on(table.created_by)
+  })
+);
+var users = (0, import_pg_core.pgTable)(
+  "users",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    // Primary identity
+    user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    // Materialized for auth lookups
+    email: (0, import_pg_core.text)("email").notNull(),
+    password: (0, import_pg_core.text)("password").notNull(),
+    // bcrypt hashed
+    // Basic profile (materialized for display)
+    name: (0, import_pg_core.text)("name"),
+    emoji: (0, import_pg_core.text)("emoji"),
+    role: (0, import_pg_core.text)("role", {
+      enum: ["superadmin", "admin", "member", "viewer"]
+      // 'owner' is deprecated alias for 'superadmin'
+    }).notNull().default("member"),
+    // Unix username for process impersonation (optional, app-enforced uniqueness)
+    unix_username: (0, import_pg_core.text)("unix_username"),
+    // Onboarding state
+    onboarding_completed: t.bool("onboarding_completed").notNull().default(false),
+    // Force password change flag (admin-settable, auto-cleared on password change)
+    must_change_password: t.bool("must_change_password").notNull().default(false),
+    // Auth invalidation marker. Password changes set this timestamp so any
+    // previously issued browser access or refresh token is rejected.
+    tokens_valid_after: t.timestamp("tokens_valid_after"),
+    // JSON blob for profile/preferences
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("users_tenant_id_idx").on(table.tenant_id),
+    emailIdx: (0, import_pg_core.index)("users_email_idx").on(table.email),
+    emailTenantUnique: (0, import_pg_core.uniqueIndex)("users_tenant_email_unique").on(table.tenant_id, table.email)
+  })
+);
+var groups = (0, import_pg_core.pgTable)(
+  "groups",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    group_id: (0, import_pg_core.varchar)("group_id", { length: 36 }).primaryKey(),
+    name: (0, import_pg_core.text)("name").notNull(),
+    slug: (0, import_pg_core.text)("slug").notNull(),
+    description: (0, import_pg_core.text)("description"),
+    archived: t.bool("archived").notNull().default(false),
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("groups_tenant_id_idx").on(table.tenant_id),
+    slugIdx: (0, import_pg_core.uniqueIndex)("groups_tenant_slug_unique").on(table.tenant_id, table.slug),
+    archivedIdx: (0, import_pg_core.index)("groups_archived_idx").on(table.archived)
+  })
+);
+var groupMemberships = (0, import_pg_core.pgTable)(
+  "group_memberships",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    group_id: (0, import_pg_core.varchar)("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
+    user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
+    added_by: (0, import_pg_core.varchar)("added_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("group_memberships_tenant_id_idx").on(table.tenant_id),
+    pk: (0, import_pg_core.primaryKey)({ columns: [table.group_id, table.user_id] }),
+    userIdx: (0, import_pg_core.index)("group_memberships_user_idx").on(table.user_id)
+  })
+);
+var branchGroupGrants = (0, import_pg_core.pgTable)(
+  "branch_group_grants",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
+    group_id: (0, import_pg_core.varchar)("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
+    can: (0, import_pg_core.text)("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
+    fs_access: (0, import_pg_core.text)("fs_access", { enum: ["none", "read", "write"] }).$type(),
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("branch_group_grants_tenant_id_idx").on(table.tenant_id),
+    pk: (0, import_pg_core.primaryKey)({ columns: [table.branch_id, table.group_id] }),
+    groupIdx: (0, import_pg_core.index)("branch_group_grants_group_idx").on(table.group_id)
+  })
+);
+var boardGroupGrants = (0, import_pg_core.pgTable)(
+  "board_group_grants",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
+    group_id: (0, import_pg_core.varchar)("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
+    can: (0, import_pg_core.text)("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
+    fs_access: (0, import_pg_core.text)("fs_access", { enum: ["none", "read", "write"] }).$type(),
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("board_group_grants_tenant_id_idx").on(table.tenant_id),
+    pk: (0, import_pg_core.primaryKey)({ columns: [table.board_id, table.group_id] }),
+    groupIdx: (0, import_pg_core.index)("board_group_grants_group_idx").on(table.group_id)
+  })
+);
+var appVariables = (0, import_pg_core.pgTable)(
+  "app_variables",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    variable_id: (0, import_pg_core.varchar)("variable_id", { length: 36 }).primaryKey(),
+    namespace: (0, import_pg_core.text)("namespace").notNull(),
+    key: (0, import_pg_core.text)("key").notNull(),
+    value_text: (0, import_pg_core.text)("value_text"),
+    value_encrypted: (0, import_pg_core.text)("value_encrypted"),
+    is_encrypted: t.bool("is_encrypted").notNull().default(false),
+    content_type: (0, import_pg_core.text)("content_type").notNull().default("text/plain"),
+    metadata: t.json("metadata"),
+    updated_by: (0, import_pg_core.varchar)("updated_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at").notNull()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("app_variables_tenant_id_idx").on(table.tenant_id),
+    namespaceKeyIdx: (0, import_pg_core.uniqueIndex)("app_variables_tenant_namespace_key_unique").on(
+      table.tenant_id,
+      table.namespace,
+      table.key
+    ),
+    namespaceIdx: (0, import_pg_core.index)("app_variables_namespace_idx").on(table.namespace)
+  })
+);
+var userApiKeys = (0, import_pg_core.pgTable)(
+  "user_api_keys",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    id: (0, import_pg_core.varchar)("id", { length: 36 }).primaryKey(),
+    user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
+    name: (0, import_pg_core.text)("name").notNull(),
+    prefix: (0, import_pg_core.text)("prefix").notNull(),
+    // first 12 chars: 'agor_sk_XXXX' for identification
+    key_hash: (0, import_pg_core.text)("key_hash").notNull(),
+    // bcrypt hash of full key
+    created_at: t.timestamp("created_at").notNull(),
+    last_used_at: t.timestamp("last_used_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("user_api_keys_tenant_id_idx").on(table.tenant_id),
+    userIdx: (0, import_pg_core.index)("user_api_keys_user_idx").on(table.user_id),
+    prefixIdx: (0, import_pg_core.index)("user_api_keys_prefix_idx").on(table.prefix)
+  })
+);
+var mcpServers = (0, import_pg_core.pgTable)(
+  "mcp_servers",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    // Primary identity
+    mcp_server_id: (0, import_pg_core.varchar)("mcp_server_id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    // Materialized for filtering
+    name: (0, import_pg_core.text)("name").notNull(),
+    // e.g., "filesystem", "sentry"
+    transport: (0, import_pg_core.text)("transport", {
+      enum: ["stdio", "http", "sse"]
+    }).notNull(),
+    scope: (0, import_pg_core.text)("scope", {
+      enum: ["global", "session"]
+    }).notNull(),
+    enabled: t.bool("enabled").notNull().default(true),
+    // Scope foreign key
+    // For 'global' scope: which user owns this server
+    // For 'session' scope: use session_mcp_servers junction table (many-to-many)
+    owner_user_id: (0, import_pg_core.varchar)("owner_user_id", { length: 36 }),
+    // Source tracking (materialized for queries)
+    source: (0, import_pg_core.text)("source", {
+      enum: ["user", "imported", "agor"]
+    }).notNull(),
+    // JSON blob for configuration and capabilities
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("mcp_servers_tenant_id_idx").on(table.tenant_id),
+    nameIdx: (0, import_pg_core.index)("mcp_servers_name_idx").on(table.name),
+    scopeIdx: (0, import_pg_core.index)("mcp_servers_scope_idx").on(table.scope),
+    ownerIdx: (0, import_pg_core.index)("mcp_servers_owner_idx").on(table.owner_user_id),
+    enabledIdx: (0, import_pg_core.index)("mcp_servers_enabled_idx").on(table.enabled)
+  })
+);
+var cardTypes = (0, import_pg_core.pgTable)(
+  "card_types",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    card_type_id: (0, import_pg_core.varchar)("card_type_id", { length: 36 }).primaryKey(),
+    name: (0, import_pg_core.text)("name").notNull(),
+    emoji: (0, import_pg_core.text)("emoji"),
+    color: (0, import_pg_core.text)("color"),
+    json_schema: (0, import_pg_core.text)("json_schema"),
+    // JSON string of JSON Schema
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at").notNull()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("card_types_tenant_id_idx").on(table.tenant_id),
+    nameIdx: (0, import_pg_core.index)("card_types_name_idx").on(table.name)
+  })
+);
+var cards = (0, import_pg_core.pgTable)(
+  "cards",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    card_id: (0, import_pg_core.varchar)("card_id", { length: 36 }).primaryKey(),
+    board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
+    card_type_id: (0, import_pg_core.varchar)("card_type_id", { length: 36 }).references(() => cardTypes.card_type_id, {
+      onDelete: "set null"
+    }),
+    title: (0, import_pg_core.text)("title").notNull(),
+    url: (0, import_pg_core.text)("url"),
+    description: (0, import_pg_core.text)("description"),
+    note: (0, import_pg_core.text)("note"),
+    data: (0, import_pg_core.text)("data"),
+    // JSON blob validated against CardType.json_schema if present
+    color_override: (0, import_pg_core.text)("color_override"),
+    emoji_override: (0, import_pg_core.text)("emoji_override"),
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at").notNull(),
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("cards_tenant_id_idx").on(table.tenant_id),
+    boardIdx: (0, import_pg_core.index)("cards_board_idx").on(table.board_id),
+    cardTypeIdx: (0, import_pg_core.index)("cards_card_type_idx").on(table.card_type_id),
+    titleIdx: (0, import_pg_core.index)("cards_title_idx").on(table.title),
+    archivedIdx: (0, import_pg_core.index)("cards_archived_idx").on(table.archived),
+    createdIdx: (0, import_pg_core.index)("cards_created_idx").on(table.created_at)
+  })
+);
+var artifacts = (0, import_pg_core.pgTable)(
+  "artifacts",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    artifact_id: (0, import_pg_core.varchar)("artifact_id", { length: 36 }).primaryKey(),
+    branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).references(() => branches.branch_id, {
+      onDelete: "set null"
+    }),
+    source_session_id: (0, import_pg_core.varchar)("source_session_id", { length: 36 }).references(
+      () => sessions.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
+    name: (0, import_pg_core.text)("name").notNull(),
+    description: (0, import_pg_core.text)("description"),
+    path: (0, import_pg_core.text)("path"),
+    // provenance only — where files were read from
+    template: (0, import_pg_core.text)("template").notNull().default("react"),
+    build_status: (0, import_pg_core.text)("build_status").notNull().default("unknown"),
+    build_errors: t.json("build_errors"),
+    content_hash: (0, import_pg_core.text)("content_hash"),
+    files: t.json("files"),
+    dependencies: t.json("dependencies"),
+    entry: (0, import_pg_core.text)("entry"),
+    // denormalized cache of the Sandpack entry file
+    sandpack_config: t.json("sandpack_config"),
+    required_env_vars: t.json("required_env_vars"),
+    agor_grants: t.json("agor_grants"),
+    agor_runtime: t.json("agor_runtime"),
+    public: t.bool("public").notNull().default(true),
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at").notNull(),
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("artifacts_tenant_id_idx").on(table.tenant_id),
+    branchIdx: (0, import_pg_core.index)("artifacts_branch_idx").on(table.branch_id),
+    sourceSessionIdx: (0, import_pg_core.index)("artifacts_source_session_idx").on(table.source_session_id),
+    boardIdx: (0, import_pg_core.index)("artifacts_board_idx").on(table.board_id),
+    archivedIdx: (0, import_pg_core.index)("artifacts_archived_idx").on(table.archived),
+    publicIdx: (0, import_pg_core.index)("artifacts_public_idx").on(table.public)
+  })
+);
+var artifactTrustGrants = (0, import_pg_core.pgTable)(
+  "artifact_trust_grants",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    grant_id: (0, import_pg_core.varchar)("grant_id", { length: 36 }).primaryKey(),
+    user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).notNull(),
+    scope_type: (0, import_pg_core.text)("scope_type").notNull(),
+    scope_value: (0, import_pg_core.text)("scope_value"),
+    env_vars_set: t.json("env_vars_set").notNull(),
+    agor_grants_set: t.json("agor_grants_set").notNull(),
+    granted_at: t.timestamp("granted_at").notNull(),
+    revoked_at: t.timestamp("revoked_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("artifact_trust_grants_tenant_id_idx").on(table.tenant_id),
+    userIdx: (0, import_pg_core.index)("artifact_trust_grants_user_idx").on(table.user_id),
+    scopeIdx: (0, import_pg_core.index)("artifact_trust_grants_scope_idx").on(table.scope_type, table.scope_value)
+  })
+);
+var boardObjects = (0, import_pg_core.pgTable)(
+  "board_objects",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    // Primary identity
+    object_id: (0, import_pg_core.varchar)("object_id", { length: 36 }).primaryKey(),
+    board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
+    created_at: t.timestamp("created_at").notNull(),
+    // Polymorphic entity reference (exactly one must be set)
+    branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).references(() => branches.branch_id, {
+      onDelete: "cascade"
+    }),
+    card_id: (0, import_pg_core.varchar)("card_id", { length: 36 }).references(() => cards.card_id, {
+      onDelete: "cascade"
+    }),
+    // Position data (JSON)
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("board_objects_tenant_id_idx").on(table.tenant_id),
+    boardIdx: (0, import_pg_core.index)("board_objects_board_idx").on(table.board_id),
+    branchIdx: (0, import_pg_core.index)("board_objects_branch_idx").on(table.branch_id),
+    cardIdx: (0, import_pg_core.index)("board_objects_card_idx").on(table.card_id)
+  })
+);
+var sessionMcpServers = (0, import_pg_core.pgTable)(
+  "session_mcp_servers",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    mcp_server_id: (0, import_pg_core.varchar)("mcp_server_id", { length: 36 }).notNull().references(() => mcpServers.mcp_server_id, { onDelete: "cascade" }),
+    enabled: t.bool("enabled").notNull().default(true),
+    added_at: t.timestamp("added_at").notNull()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("session_mcp_servers_tenant_id_idx").on(table.tenant_id),
+    // Composite primary key
+    pk: (0, import_pg_core.index)("session_mcp_servers_pk").on(table.session_id, table.mcp_server_id),
+    // Indexes for queries
+    sessionIdx: (0, import_pg_core.index)("session_mcp_servers_session_idx").on(table.session_id),
+    serverIdx: (0, import_pg_core.index)("session_mcp_servers_server_idx").on(table.mcp_server_id),
+    enabledIdx: (0, import_pg_core.index)("session_mcp_servers_enabled_idx").on(table.session_id, table.enabled)
+  })
+);
+var userMcpOauthTokens = (0, import_pg_core.pgTable)(
+  "user_mcp_oauth_tokens",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    // NULL = shared-mode token (one per mcp_server_id)
+    user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).references(() => users.user_id, {
+      onDelete: "cascade"
+    }),
+    mcp_server_id: (0, import_pg_core.varchar)("mcp_server_id", { length: 36 }).notNull().references(() => mcpServers.mcp_server_id, { onDelete: "cascade" }),
+    oauth_access_token: (0, import_pg_core.text)("oauth_access_token").notNull(),
+    oauth_token_expires_at: t.timestamp("oauth_token_expires_at"),
+    // Unix timestamp in milliseconds
+    oauth_refresh_token: (0, import_pg_core.text)("oauth_refresh_token"),
+    // DCR / registered client credentials this grant was issued under.
+    // Must be preserved across refreshes.
+    oauth_client_id: (0, import_pg_core.text)("oauth_client_id"),
+    oauth_client_secret: (0, import_pg_core.text)("oauth_client_secret"),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("user_mcp_oauth_tokens_tenant_id_idx").on(table.tenant_id),
+    // Composite lookup indexes. Uniqueness enforced via partial unique indexes
+    // created in the migration (one for per-user rows, one for the shared row).
+    pk: (0, import_pg_core.index)("user_mcp_oauth_tokens_pk").on(table.user_id, table.mcp_server_id),
+    userIdx: (0, import_pg_core.index)("user_mcp_oauth_tokens_user_idx").on(table.user_id),
+    serverIdx: (0, import_pg_core.index)("user_mcp_oauth_tokens_server_idx").on(table.mcp_server_id)
+  })
+);
+var boardComments = (0, import_pg_core.pgTable)(
+  "board_comments",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    // Primary identity
+    comment_id: (0, import_pg_core.varchar)("comment_id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    // Scoping & authorship
+    board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull(),
+    // FLEXIBLE ATTACHMENTS (all optional)
+    // Phase 1: board-level only (all NULL)
+    // Phase 2: object attachments (session, task, message, branch)
+    // Phase 3: spatial positioning
+    session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).references(() => sessions.session_id, {
+      onDelete: "set null"
+    }),
+    task_id: (0, import_pg_core.varchar)("task_id", { length: 36 }).references(() => tasks.task_id, {
+      onDelete: "set null"
+    }),
+    message_id: (0, import_pg_core.varchar)("message_id", { length: 36 }).references(() => messages.message_id, {
+      onDelete: "set null"
+    }),
+    branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).references(() => branches.branch_id, {
+      onDelete: "cascade"
+    }),
+    // Content (materialized for display)
+    content: (0, import_pg_core.text)("content").notNull(),
+    // Markdown-supported text
+    content_preview: (0, import_pg_core.text)("content_preview").notNull(),
+    // First 200 chars
+    // Thread support (optional)
+    parent_comment_id: (0, import_pg_core.varchar)("parent_comment_id", { length: 36 }),
+    // Metadata (materialized for filtering)
+    resolved: t.bool("resolved").notNull().default(false),
+    edited: t.bool("edited").notNull().default(false),
+    // Reactions (for BOTH thread roots and replies)
+    // Stored as JSON array: [{ user_id: "abc", emoji: "👍" }, ...]
+    // Display grouped by emoji: { "👍": ["alice", "bob"], "🎉": ["charlie"] }
+    reactions: t.json("reactions").$type().notNull().default(import_drizzle_orm2.sql`'[]'`),
+    // JSON blob for advanced features
+    data: t.json("data").$type().notNull()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("board_comments_tenant_id_idx").on(table.tenant_id),
+    boardIdx: (0, import_pg_core.index)("board_comments_board_idx").on(table.board_id),
+    sessionIdx: (0, import_pg_core.index)("board_comments_session_idx").on(table.session_id),
+    taskIdx: (0, import_pg_core.index)("board_comments_task_idx").on(table.task_id),
+    messageIdx: (0, import_pg_core.index)("board_comments_message_idx").on(table.message_id),
+    branchIdx: (0, import_pg_core.index)("board_comments_branch_idx").on(table.branch_id),
+    createdByIdx: (0, import_pg_core.index)("board_comments_created_by_idx").on(table.created_by),
+    parentIdx: (0, import_pg_core.index)("board_comments_parent_idx").on(table.parent_comment_id),
+    createdIdx: (0, import_pg_core.index)("board_comments_created_idx").on(table.created_at),
+    resolvedIdx: (0, import_pg_core.index)("board_comments_resolved_idx").on(table.resolved)
+  })
+);
+var gatewayChannels = (0, import_pg_core.pgTable)(
+  "gateway_channels",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    // Primary identity
+    id: (0, import_pg_core.varchar)("id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at").notNull(),
+    // User attribution
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull(),
+    // Materialized for queries
+    name: (0, import_pg_core.text)("name").notNull(),
+    channel_type: (0, import_pg_core.text)("channel_type", {
+      enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+    }).notNull(),
+    target_branch_id: (0, import_pg_core.varchar)("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
+    agor_user_id: (0, import_pg_core.varchar)("agor_user_id", { length: 36 }).notNull(),
+    channel_key: (0, import_pg_core.text)("channel_key").notNull(),
+    enabled: t.bool("enabled").notNull().default(true),
+    last_message_at: t.timestamp("last_message_at"),
+    // JSON blob for platform credentials (encrypted at rest)
+    config: t.json("config").notNull(),
+    // JSON blob for agentic tool configuration (agent, model, permission mode, etc.)
+    agentic_config: t.json("agentic_config")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("gateway_channels_tenant_id_idx").on(table.tenant_id),
+    channelKeyIdx: (0, import_pg_core.index)("idx_gateway_channel_key").on(table.channel_key),
+    channelKeyTenantUnique: (0, import_pg_core.uniqueIndex)("gateway_channels_tenant_channel_key_unique").on(
+      table.tenant_id,
+      table.channel_key
+    ),
+    enabledTypeIdx: (0, import_pg_core.index)("idx_gateway_enabled_type").on(table.enabled, table.channel_type)
+  })
+);
+var threadSessionMap = (0, import_pg_core.pgTable)(
+  "thread_session_map",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    // Primary identity
+    id: (0, import_pg_core.varchar)("id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    last_message_at: t.timestamp("last_message_at").notNull(),
+    // Foreign keys
+    channel_id: (0, import_pg_core.varchar)("channel_id", { length: 36 }).notNull().references(() => gatewayChannels.id, { onDelete: "cascade" }),
+    thread_id: (0, import_pg_core.text)("thread_id").notNull(),
+    session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).notNull().references(() => branches.branch_id),
+    // Materialized for queries
+    status: (0, import_pg_core.text)("status", {
+      enum: ["active", "archived", "paused"]
+    }).notNull().default("active"),
+    // JSON blob for extra metadata
+    metadata: t.json("metadata")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("thread_session_map_tenant_id_idx").on(table.tenant_id),
+    uniqueChannelThread: (0, import_pg_core.uniqueIndex)("uniq_thread_map_tenant_channel_thread").on(
+      table.tenant_id,
+      table.channel_id,
+      table.thread_id
+    ),
+    sessionIdx: (0, import_pg_core.index)("idx_thread_map_session_id").on(table.session_id),
+    threadIdx: (0, import_pg_core.index)("idx_thread_map_thread_id").on(table.thread_id),
+    channelStatusIdx: (0, import_pg_core.index)("idx_thread_map_channel_status").on(table.channel_id, table.status)
+  })
+);
+var gatewayOutboundMessages = (0, import_pg_core.pgTable)(
+  "gateway_outbound_messages",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    id: (0, import_pg_core.varchar)("id", { length: 36 }).primaryKey(),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at").notNull(),
+    gateway_channel_id: (0, import_pg_core.varchar)("gateway_channel_id", { length: 36 }).notNull().references(() => gatewayChannels.id, { onDelete: "cascade" }),
+    channel_type: (0, import_pg_core.text)("channel_type", {
+      enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+    }).notNull(),
+    platform_channel_id: (0, import_pg_core.text)("platform_channel_id").notNull(),
+    platform_message_id: (0, import_pg_core.text)("platform_message_id").notNull(),
+    platform_thread_id: (0, import_pg_core.text)("platform_thread_id").notNull(),
+    platform_permalink: (0, import_pg_core.text)("platform_permalink"),
+    target_branch_id: (0, import_pg_core.varchar)("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id),
+    emitted_by_user_id: (0, import_pg_core.varchar)("emitted_by_user_id", { length: 36 }).notNull().references(() => users.user_id),
+    emitted_by_session_id: (0, import_pg_core.varchar)("emitted_by_session_id", { length: 36 }).references(
+      () => sessions.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    emitted_by_task_id: (0, import_pg_core.varchar)("emitted_by_task_id", { length: 36 }).references(
+      () => tasks.task_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    emitted_by_schedule_id: (0, import_pg_core.varchar)("emitted_by_schedule_id", { length: 36 }).references(
+      () => schedules.schedule_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    message_text: (0, import_pg_core.text)("message_text").notNull(),
+    message_preview: (0, import_pg_core.text)("message_preview").notNull(),
+    metadata: t.json("metadata"),
+    consumed_by_session_id: (0, import_pg_core.varchar)("consumed_by_session_id", { length: 36 }).references(
+      () => sessions.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    consumed_at: t.timestamp("consumed_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("gateway_outbound_messages_tenant_id_idx").on(table.tenant_id),
+    uniqueChannelThread: (0, import_pg_core.uniqueIndex)("uniq_gateway_outbound_tenant_channel_thread").on(
+      table.tenant_id,
+      table.gateway_channel_id,
+      table.platform_thread_id
+    ),
+    emittedSessionIdx: (0, import_pg_core.index)("idx_gateway_outbound_emitted_session").on(
+      table.emitted_by_session_id
+    ),
+    emittedScheduleIdx: (0, import_pg_core.index)("idx_gateway_outbound_emitted_schedule").on(
+      table.emitted_by_schedule_id
+    ),
+    targetBranchCreatedIdx: (0, import_pg_core.index)("idx_gateway_outbound_branch_created").on(
+      table.target_branch_id,
+      table.created_at
+    ),
+    consumedIdx: (0, import_pg_core.index)("idx_gateway_outbound_consumed").on(table.consumed_at)
+  })
+);
+var sessionEnvSelections = (0, import_pg_core.pgTable)(
+  "session_env_selections",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+    env_var_name: (0, import_pg_core.text)("env_var_name").notNull(),
+    created_at: t.timestamp("created_at").notNull()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("session_env_selections_tenant_id_idx").on(table.tenant_id),
+    pk: (0, import_pg_core.primaryKey)({ columns: [table.session_id, table.env_var_name] }),
+    sessionIdx: (0, import_pg_core.index)("session_env_selections_session_idx").on(table.session_id)
+  })
+);
+var kbNamespaces = (0, import_pg_core.pgTable)(
+  "kb_namespaces",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    namespace_id: (0, import_pg_core.varchar)("namespace_id", { length: 36 }).primaryKey(),
+    slug: (0, import_pg_core.text)("slug").notNull(),
+    display_name: (0, import_pg_core.text)("display_name").notNull(),
+    description: (0, import_pg_core.text)("description"),
+    kind: (0, import_pg_core.text)("kind", { enum: ["system", "global", "user", "repo", "branch", "team"] }).notNull().default("global"),
+    owner_user_id: (0, import_pg_core.varchar)("owner_user_id", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    repo_id: (0, import_pg_core.varchar)("repo_id", { length: 36 }).references(() => repos.repo_id, {
+      onDelete: "set null"
+    }),
+    branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).references(() => branches.branch_id, {
+      onDelete: "set null"
+    }),
+    visibility_default: (0, import_pg_core.text)("visibility_default", { enum: ["public", "private"] }).notNull().default("public"),
+    others_can: (0, import_pg_core.text)("others_can", { enum: ["none", "read", "write"] }).notNull().default("write"),
+    metadata: t.json("metadata"),
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("kb_namespaces_tenant_id_idx").on(table.tenant_id),
+    slugIdx: (0, import_pg_core.uniqueIndex)("kb_namespaces_tenant_slug_unique").on(table.tenant_id, table.slug).where(import_drizzle_orm2.sql`${table.archived} = false`),
+    kindIdx: (0, import_pg_core.index)("kb_namespaces_kind_idx").on(table.kind),
+    ownerIdx: (0, import_pg_core.index)("kb_namespaces_owner_idx").on(table.owner_user_id),
+    repoIdx: (0, import_pg_core.index)("kb_namespaces_repo_idx").on(table.repo_id),
+    branchIdx: (0, import_pg_core.index)("kb_namespaces_branch_idx").on(table.branch_id),
+    archivedIdx: (0, import_pg_core.index)("kb_namespaces_archived_idx").on(table.archived)
+  })
+);
+var kbNamespaceAcl = (0, import_pg_core.pgTable)(
+  "kb_namespace_acl",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    namespace_acl_id: (0, import_pg_core.varchar)("namespace_acl_id", { length: 36 }).primaryKey(),
+    namespace_id: (0, import_pg_core.varchar)("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces.namespace_id, { onDelete: "cascade" }),
+    subject_type: (0, import_pg_core.text)("subject_type", { enum: ["user", "group"] }).notNull(),
+    subject_id: (0, import_pg_core.varchar)("subject_id", { length: 36 }).notNull(),
+    permission: (0, import_pg_core.text)("permission", { enum: ["read", "write", "own"] }).notNull(),
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("kb_namespace_acl_tenant_id_idx").on(table.tenant_id),
+    namespaceIdx: (0, import_pg_core.index)("kb_namespace_acl_namespace_idx").on(table.namespace_id),
+    subjectIdx: (0, import_pg_core.index)("kb_namespace_acl_subject_idx").on(table.subject_type, table.subject_id),
+    namespaceSubjectIdx: (0, import_pg_core.uniqueIndex)("kb_namespace_acl_tenant_namespace_subject_unique").on(
+      table.tenant_id,
+      table.namespace_id,
+      table.subject_type,
+      table.subject_id
+    )
+  })
+);
+var kbDocuments = (0, import_pg_core.pgTable)(
+  "kb_documents",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    document_id: (0, import_pg_core.varchar)("document_id", { length: 36 }).primaryKey(),
+    namespace_id: (0, import_pg_core.varchar)("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces.namespace_id, { onDelete: "cascade" }),
+    path: (0, import_pg_core.text)("path").notNull(),
+    uri: (0, import_pg_core.text)("uri").notNull(),
+    title: (0, import_pg_core.text)("title").notNull(),
+    icon_emoji: (0, import_pg_core.text)("icon_emoji"),
+    kind: (0, import_pg_core.text)("kind", {
+      enum: ["doc", "memory", "skill", "prompt", "guide", "decision", "bundle", "external"]
+    }).notNull().default("doc"),
+    visibility: (0, import_pg_core.text)("visibility", { enum: ["public", "private"] }).notNull().default("public"),
+    status: (0, import_pg_core.text)("status", { enum: ["draft", "published"] }).notNull().default("published"),
+    edit_policy: (0, import_pg_core.text)("edit_policy", { enum: ["owner", "public", "admins"] }).notNull().default("owner"),
+    // Application-maintained pointer. Avoids a circular FK with versions.
+    current_version_id: (0, import_pg_core.varchar)("current_version_id", { length: 36 }),
+    metadata: t.json("metadata"),
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_by: (0, import_pg_core.varchar)("updated_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    updated_at: t.timestamp("updated_at"),
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("kb_documents_tenant_id_idx").on(table.tenant_id),
+    namespacePathIdx: (0, import_pg_core.uniqueIndex)("kb_documents_tenant_namespace_path_unique").on(table.tenant_id, table.namespace_id, table.path).where(import_drizzle_orm2.sql`${table.archived} = false`),
+    uriIdx: (0, import_pg_core.uniqueIndex)("kb_documents_tenant_uri_unique").on(table.tenant_id, table.uri).where(import_drizzle_orm2.sql`${table.archived} = false`),
+    namespaceIdx: (0, import_pg_core.index)("kb_documents_namespace_idx").on(table.namespace_id),
+    kindIdx: (0, import_pg_core.index)("kb_documents_kind_idx").on(table.kind),
+    visibilityIdx: (0, import_pg_core.index)("kb_documents_visibility_idx").on(table.visibility),
+    statusIdx: (0, import_pg_core.index)("kb_documents_status_idx").on(table.status),
+    createdByIdx: (0, import_pg_core.index)("kb_documents_created_by_idx").on(table.created_by),
+    updatedAtIdx: (0, import_pg_core.index)("kb_documents_updated_at_idx").on(table.updated_at),
+    archivedIdx: (0, import_pg_core.index)("kb_documents_archived_idx").on(table.archived)
+  })
+);
+var kbDocumentVersions = (0, import_pg_core.pgTable)(
+  "kb_document_versions",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    version_id: (0, import_pg_core.varchar)("version_id", { length: 36 }).primaryKey(),
+    document_id: (0, import_pg_core.varchar)("document_id", { length: 36 }).notNull().references(() => kbDocuments.document_id, { onDelete: "cascade" }),
+    version_number: (0, import_pg_core.integer)("version_number").notNull(),
+    content_text: (0, import_pg_core.text)("content_text"),
+    content_blob: bytea("content_blob"),
+    mime_type: (0, import_pg_core.text)("mime_type").notNull().default("text/markdown"),
+    content_md5: (0, import_pg_core.text)("content_md5"),
+    content_sha256: (0, import_pg_core.text)("content_sha256"),
+    byte_length: (0, import_pg_core.integer)("byte_length"),
+    char_length: (0, import_pg_core.integer)("char_length"),
+    frontmatter: t.json("frontmatter"),
+    metadata: t.json("metadata"),
+    change_summary: (0, import_pg_core.text)("change_summary"),
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull()
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("kb_document_versions_tenant_id_idx").on(table.tenant_id),
+    documentVersionIdx: (0, import_pg_core.uniqueIndex)("kb_document_versions_tenant_document_version_unique").on(
+      table.tenant_id,
+      table.document_id,
+      table.version_number
+    ),
+    documentIdx: (0, import_pg_core.index)("kb_document_versions_document_idx").on(table.document_id),
+    createdIdx: (0, import_pg_core.index)("kb_document_versions_created_idx").on(table.created_at),
+    md5Idx: (0, import_pg_core.index)("kb_document_versions_md5_idx").on(table.content_md5)
+  })
+);
+var kbDocumentUnits = (0, import_pg_core.pgTable)(
+  "kb_document_units",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    unit_id: (0, import_pg_core.varchar)("unit_id", { length: 36 }).primaryKey(),
+    document_id: (0, import_pg_core.varchar)("document_id", { length: 36 }).notNull().references(() => kbDocuments.document_id, { onDelete: "cascade" }),
+    version_id: (0, import_pg_core.varchar)("version_id", { length: 36 }).notNull().references(() => kbDocumentVersions.version_id, { onDelete: "cascade" }),
+    kind: (0, import_pg_core.text)("kind", { enum: ["document", "section", "file", "auto_split"] }).notNull().default("document"),
+    ordinal: (0, import_pg_core.integer)("ordinal").notNull().default(0),
+    path_anchor: (0, import_pg_core.text)("path_anchor"),
+    heading_path: (0, import_pg_core.text)("heading_path"),
+    source_path: (0, import_pg_core.text)("source_path"),
+    content_text: (0, import_pg_core.text)("content_text"),
+    content_md5: (0, import_pg_core.text)("content_md5"),
+    start_offset: (0, import_pg_core.integer)("start_offset"),
+    end_offset: (0, import_pg_core.integer)("end_offset"),
+    embedding_status: (0, import_pg_core.text)("embedding_status", {
+      enum: ["not_configured", "pending", "ready", "stale", "error"]
+    }).notNull().default("not_configured"),
+    embedding_model: (0, import_pg_core.text)("embedding_model"),
+    embedding_dimensions: (0, import_pg_core.integer)("embedding_dimensions"),
+    embedding_hash: (0, import_pg_core.text)("embedding_hash"),
+    embedding_error: (0, import_pg_core.text)("embedding_error"),
+    metadata: t.json("metadata"),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("kb_document_units_tenant_id_idx").on(table.tenant_id),
+    documentIdx: (0, import_pg_core.index)("kb_document_units_document_idx").on(table.document_id),
+    versionIdx: (0, import_pg_core.index)("kb_document_units_version_idx").on(table.version_id),
+    versionOrdinalIdx: (0, import_pg_core.index)("kb_document_units_version_ordinal_idx").on(
+      table.version_id,
+      table.ordinal
+    ),
+    contentHashIdx: (0, import_pg_core.index)("kb_document_units_content_hash_idx").on(table.content_md5),
+    embeddingStatusIdx: (0, import_pg_core.index)("kb_document_units_embedding_status_idx").on(table.embedding_status)
+  })
+);
+var kbEmbeddingSpaces = (0, import_pg_core.pgTable)(
+  "kb_embedding_spaces",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    embedding_space_id: (0, import_pg_core.varchar)("embedding_space_id", { length: 36 }).primaryKey(),
+    provider: (0, import_pg_core.text)("provider").notNull(),
+    model: (0, import_pg_core.text)("model").notNull(),
+    dimensions: (0, import_pg_core.integer)("dimensions").notNull(),
+    storage_type: (0, import_pg_core.text)("storage_type").notNull().default("vector"),
+    distance: (0, import_pg_core.text)("distance").notNull().default("cosine"),
+    active: t.bool("active").notNull().default(true),
+    metadata: t.json("metadata"),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("kb_embedding_spaces_tenant_id_idx").on(table.tenant_id),
+    providerModelIdx: (0, import_pg_core.uniqueIndex)("kb_embedding_spaces_tenant_provider_model_unique").on(
+      table.tenant_id,
+      table.provider,
+      table.model,
+      table.dimensions,
+      table.storage_type,
+      table.distance
+    ),
+    activeIdx: (0, import_pg_core.index)("kb_embedding_spaces_active_idx").on(table.active)
+  })
+);
+var kbGraphNodes = (0, import_pg_core.pgTable)(
+  "kb_graph_nodes",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    node_id: (0, import_pg_core.varchar)("node_id", { length: 36 }).primaryKey(),
+    node_type: (0, import_pg_core.text)("node_type", {
+      enum: [
+        "namespace",
+        "document",
+        "document_unit",
+        "branch",
+        "session",
+        "task",
+        "message",
+        "artifact",
+        "repo",
+        "board",
+        "user",
+        "tag",
+        "external"
+      ]
+    }).notNull(),
+    uri: (0, import_pg_core.text)("uri").notNull(),
+    label: (0, import_pg_core.text)("label"),
+    namespace_id: (0, import_pg_core.varchar)("namespace_id", { length: 36 }).references(
+      () => kbNamespaces.namespace_id,
+      { onDelete: "cascade" }
+    ),
+    document_id: (0, import_pg_core.varchar)("document_id", { length: 36 }).references(() => kbDocuments.document_id, {
+      onDelete: "cascade"
+    }),
+    unit_id: (0, import_pg_core.varchar)("unit_id", { length: 36 }).references(() => kbDocumentUnits.unit_id, {
+      onDelete: "cascade"
+    }),
+    branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).references(() => branches.branch_id, {
+      onDelete: "cascade"
+    }),
+    session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).references(() => sessions.session_id, {
+      onDelete: "cascade"
+    }),
+    task_id: (0, import_pg_core.varchar)("task_id", { length: 36 }).references(() => tasks.task_id, {
+      onDelete: "cascade"
+    }),
+    message_id: (0, import_pg_core.varchar)("message_id", { length: 36 }).references(() => messages.message_id, {
+      onDelete: "cascade"
+    }),
+    artifact_id: (0, import_pg_core.varchar)("artifact_id", { length: 36 }).references(() => artifacts.artifact_id, {
+      onDelete: "cascade"
+    }),
+    repo_id: (0, import_pg_core.varchar)("repo_id", { length: 36 }).references(() => repos.repo_id, {
+      onDelete: "cascade"
+    }),
+    board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).references(() => boards.board_id, {
+      onDelete: "cascade"
+    }),
+    user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).references(() => users.user_id, {
+      onDelete: "cascade"
+    }),
+    external_uri: (0, import_pg_core.text)("external_uri"),
+    metadata: t.json("metadata"),
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    updated_at: t.timestamp("updated_at"),
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("kb_graph_nodes_tenant_id_idx").on(table.tenant_id),
+    uriIdx: (0, import_pg_core.uniqueIndex)("kb_graph_nodes_tenant_uri_unique").on(table.tenant_id, table.uri).where(import_drizzle_orm2.sql`${table.archived} = false`),
+    typeIdx: (0, import_pg_core.index)("kb_graph_nodes_type_idx").on(table.node_type),
+    namespaceIdx: (0, import_pg_core.index)("kb_graph_nodes_namespace_idx").on(table.namespace_id),
+    documentIdx: (0, import_pg_core.index)("kb_graph_nodes_document_idx").on(table.document_id),
+    unitIdx: (0, import_pg_core.index)("kb_graph_nodes_unit_idx").on(table.unit_id),
+    branchIdx: (0, import_pg_core.index)("kb_graph_nodes_branch_idx").on(table.branch_id),
+    sessionIdx: (0, import_pg_core.index)("kb_graph_nodes_session_idx").on(table.session_id),
+    taskIdx: (0, import_pg_core.index)("kb_graph_nodes_task_idx").on(table.task_id),
+    messageIdx: (0, import_pg_core.index)("kb_graph_nodes_message_idx").on(table.message_id),
+    artifactIdx: (0, import_pg_core.index)("kb_graph_nodes_artifact_idx").on(table.artifact_id),
+    repoIdx: (0, import_pg_core.index)("kb_graph_nodes_repo_idx").on(table.repo_id),
+    boardIdx: (0, import_pg_core.index)("kb_graph_nodes_board_idx").on(table.board_id),
+    userIdx: (0, import_pg_core.index)("kb_graph_nodes_user_idx").on(table.user_id),
+    externalUriIdx: (0, import_pg_core.index)("kb_graph_nodes_external_uri_idx").on(table.external_uri),
+    archivedIdx: (0, import_pg_core.index)("kb_graph_nodes_archived_idx").on(table.archived)
+  })
+);
+var kbGraphEdges = (0, import_pg_core.pgTable)(
+  "kb_graph_edges",
+  {
+    tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+    edge_id: (0, import_pg_core.varchar)("edge_id", { length: 36 }).primaryKey(),
+    source_node_id: (0, import_pg_core.varchar)("source_node_id", { length: 36 }).notNull().references(() => kbGraphNodes.node_id, { onDelete: "cascade" }),
+    target_node_id: (0, import_pg_core.varchar)("target_node_id", { length: 36 }).notNull().references(() => kbGraphNodes.node_id, { onDelete: "cascade" }),
+    edge_type: (0, import_pg_core.text)("edge_type", {
+      enum: [
+        "contains",
+        "references",
+        "mentions",
+        "implements",
+        "depends_on",
+        "supersedes",
+        "derived_from",
+        "tagged_with",
+        "about",
+        "parent_of",
+        "related_to"
+      ]
+    }).notNull(),
+    confidence: (0, import_pg_core.integer)("confidence"),
+    properties: t.json("properties"),
+    created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).references(() => users.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t.timestamp("created_at").notNull(),
+    archived: t.bool("archived").notNull().default(false),
+    archived_at: t.timestamp("archived_at")
+  },
+  (table) => ({
+    tenantIdx: (0, import_pg_core.index)("kb_graph_edges_tenant_id_idx").on(table.tenant_id),
+    sourceIdx: (0, import_pg_core.index)("kb_graph_edges_source_idx").on(table.source_node_id),
+    targetIdx: (0, import_pg_core.index)("kb_graph_edges_target_idx").on(table.target_node_id),
+    typeIdx: (0, import_pg_core.index)("kb_graph_edges_type_idx").on(table.edge_type),
+    sourceTypeIdx: (0, import_pg_core.index)("kb_graph_edges_source_type_idx").on(
+      table.source_node_id,
+      table.edge_type
+    ),
+    targetTypeIdx: (0, import_pg_core.index)("kb_graph_edges_target_type_idx").on(
+      table.target_node_id,
+      table.edge_type
+    ),
+    sourceTargetTypeIdx: (0, import_pg_core.uniqueIndex)("kb_graph_edges_tenant_source_target_type_unique").on(table.tenant_id, table.source_node_id, table.target_node_id, table.edge_type).where(import_drizzle_orm2.sql`${table.archived} = false`),
+    archivedIdx: (0, import_pg_core.index)("kb_graph_edges_archived_idx").on(table.archived)
+  })
+);
+var sessionsRelations = (0, import_drizzle_orm2.relations)(sessions, ({ one, many }) => ({
+  branch: one(branches, {
+    fields: [sessions.branch_id],
+    references: [branches.branch_id]
+  }),
+  schedule: one(schedules, {
+    fields: [sessions.schedule_id],
+    references: [schedules.schedule_id]
+  }),
+  outboundRelationships: many(sessionRelationships, { relationName: "relationshipSource" }),
+  inboundRelationships: many(sessionRelationships, { relationName: "relationshipTarget" })
+}));
+var sessionRelationshipsRelations = (0, import_drizzle_orm2.relations)(sessionRelationships, ({ one }) => ({
+  sourceSession: one(sessions, {
+    fields: [sessionRelationships.source_session_id],
+    references: [sessions.session_id],
+    relationName: "relationshipSource"
+  }),
+  targetSession: one(sessions, {
+    fields: [sessionRelationships.target_session_id],
+    references: [sessions.session_id],
+    relationName: "relationshipTarget"
+  }),
+  callbackSession: one(sessions, {
+    fields: [sessionRelationships.callback_session_id],
+    references: [sessions.session_id]
+  })
+}));
+var branchesRelations = (0, import_drizzle_orm2.relations)(branches, ({ many }) => ({
+  sessions: many(sessions),
+  schedules: many(schedules)
+}));
+var schedulesRelations = (0, import_drizzle_orm2.relations)(schedules, ({ one, many }) => ({
+  branch: one(branches, {
+    fields: [schedules.branch_id],
+    references: [branches.branch_id]
+  }),
+  sessions: many(sessions)
+}));
+
+// src/db/schema.sqlite.ts
+var schema_sqlite_exports = {};
+__export(schema_sqlite_exports, {
+  appVariables: () => appVariables2,
+  artifactTrustGrants: () => artifactTrustGrants2,
+  artifacts: () => artifacts2,
+  boardComments: () => boardComments2,
+  boardGroupGrants: () => boardGroupGrants2,
+  boardObjects: () => boardObjects2,
+  boardOwners: () => boardOwners2,
+  boards: () => boards2,
+  branchGroupGrants: () => branchGroupGrants2,
+  branchOwners: () => branchOwners2,
+  branches: () => branches2,
+  branchesRelations: () => branchesRelations2,
+  cardTypes: () => cardTypes2,
+  cards: () => cards2,
+  gatewayChannels: () => gatewayChannels2,
+  gatewayOutboundMessages: () => gatewayOutboundMessages2,
+  groupMemberships: () => groupMemberships2,
+  groups: () => groups2,
+  kbDocumentUnits: () => kbDocumentUnits2,
+  kbDocumentVersions: () => kbDocumentVersions2,
+  kbDocuments: () => kbDocuments2,
+  kbEmbeddingSpaces: () => kbEmbeddingSpaces2,
+  kbGraphEdges: () => kbGraphEdges2,
+  kbGraphNodes: () => kbGraphNodes2,
+  kbNamespaceAcl: () => kbNamespaceAcl2,
+  kbNamespaces: () => kbNamespaces2,
+  mcpServers: () => mcpServers2,
+  messages: () => messages2,
+  repos: () => repos2,
+  schedules: () => schedules2,
+  schedulesRelations: () => schedulesRelations2,
+  serializedSessions: () => serializedSessions2,
+  sessionEnvSelections: () => sessionEnvSelections2,
+  sessionMcpServers: () => sessionMcpServers2,
+  sessionRelationships: () => sessionRelationships2,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations2,
+  sessions: () => sessions2,
+  sessionsRelations: () => sessionsRelations2,
+  tasks: () => tasks2,
+  threadSessionMap: () => threadSessionMap2,
+  userApiKeys: () => userApiKeys2,
+  userMcpOauthTokens: () => userMcpOauthTokens2,
+  users: () => users2
+});
+var import_drizzle_orm3 = require("drizzle-orm");
+var import_sqlite_core = require("drizzle-orm/sqlite-core");
+var t2 = {
+  timestamp: (name) => (0, import_sqlite_core.integer)(name, { mode: "timestamp_ms" }),
+  bool: (name) => (0, import_sqlite_core.integer)(name, { mode: "boolean" }),
+  json: (name) => (0, import_sqlite_core.text)(name, { mode: "json" }).$type()
+};
+var sessions2 = (0, import_sqlite_core.sqliteTable)(
+  "sessions",
+  {
+    // Primary identity
+    session_id: (0, import_sqlite_core.text)("session_id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    // User attribution
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).notNull(),
+    // Unix username for SDK impersonation (immutable once set)
+    // Set from creator's unix_username at session creation time
+    // NEVER changes, even if user's unix_username changes later
+    // This ensures SDK session data remains accessible in the original home directory
+    unix_username: (0, import_sqlite_core.text)("unix_username"),
+    // Materialized for filtering/joins (cross-DB compatible)
+    status: (0, import_sqlite_core.text)("status", {
+      enum: [
+        "idle",
+        "running",
+        "stopping",
+        "awaiting_permission",
+        "awaiting_input",
+        "timed_out",
+        "completed",
+        "failed"
+      ]
+    }).notNull(),
+    agentic_tool: (0, import_sqlite_core.text)("agentic_tool", {
+      enum: ["claude-code", "claude-code-cli", "codex", "gemini", "opencode", "copilot", "cursor"]
+    }).notNull(),
+    board_id: (0, import_sqlite_core.text)("board_id", { length: 36 }),
+    // NULL = no board
+    // Genealogy (materialized for tree queries)
+    parent_session_id: (0, import_sqlite_core.text)("parent_session_id", { length: 36 }),
+    forked_from_session_id: (0, import_sqlite_core.text)("forked_from_session_id", { length: 36 }),
+    // Branch reference (REQUIRED: all sessions must have a branch)
+    branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, {
+      onDelete: "cascade"
+      // Cascade delete sessions when branch is deleted
+    }),
+    // Scheduler tracking (materialized for deduplication and retention cleanup)
+    scheduled_run_at: (0, import_sqlite_core.integer)("scheduled_run_at"),
+    // Unix timestamp (ms) - authoritative run ID
+    scheduled_from_branch: t2.bool("scheduled_from_branch").notNull().default(false),
+    // FK to schedules.schedule_id, ON DELETE SET NULL. Defined here (not
+    // just in the migration) so drizzle-kit / db introspection sees the
+    // constraint and so future schema diffs don't lose it.
+    schedule_id: (0, import_sqlite_core.text)("schedule_id", { length: 36 }).references(
+      () => schedules2.schedule_id,
+      { onDelete: "set null" }
+    ),
+    // UI state (materialized for efficient highlighting queries)
+    ready_for_prompt: t2.bool("ready_for_prompt").notNull().default(false),
+    // Archive state (cascaded from branch archive)
+    archived: t2.bool("archived").notNull().default(false),
+    archived_reason: (0, import_sqlite_core.text)("archived_reason", {
+      enum: ["branch_archived", "manual", "btw_completed"]
+    }),
+    // JSON blob for everything else (cross-DB via json() type)
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    statusIdx: (0, import_sqlite_core.index)("sessions_status_idx").on(table.status),
+    statusReadyIdx: (0, import_sqlite_core.index)("sessions_status_ready_idx").on(table.status, table.ready_for_prompt),
+    agenticToolIdx: (0, import_sqlite_core.index)("sessions_agentic_tool_idx").on(table.agentic_tool),
+    boardIdx: (0, import_sqlite_core.index)("sessions_board_idx").on(table.board_id),
+    branchIdx: (0, import_sqlite_core.index)("sessions_branch_idx").on(table.branch_id),
+    createdIdx: (0, import_sqlite_core.index)("sessions_created_idx").on(table.created_at),
+    parentIdx: (0, import_sqlite_core.index)("sessions_parent_idx").on(table.parent_session_id),
+    forkedIdx: (0, import_sqlite_core.index)("sessions_forked_idx").on(table.forked_from_session_id),
+    // Scheduler indexes — including the partial unique index below.
+    scheduledFromBranchIdx: (0, import_sqlite_core.index)("sessions_scheduled_flag_idx").on(table.scheduled_from_branch),
+    // Partial unique index — covering for the scheduler's dedup lookup
+    // AND serves as the DB-level guard against check-then-create races
+    // in spawnScheduledSession (cron tick vs manual run-now, or two
+    // tick async paths). Partial because schedule_id is nullable: ad-hoc
+    // sessions all have schedule_id NULL and must coexist.
+    scheduleRunUnique: (0, import_sqlite_core.uniqueIndex)("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(import_drizzle_orm3.sql`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
+  })
+);
+var sessionRelationships2 = (0, import_sqlite_core.sqliteTable)(
+  "session_relationships",
+  {
+    relationship_id: (0, import_sqlite_core.text)("relationship_id", { length: 36 }).primaryKey(),
+    source_session_id: (0, import_sqlite_core.text)("source_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    target_session_id: (0, import_sqlite_core.text)("target_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    relationship_type: (0, import_sqlite_core.text)("relationship_type", { enum: ["remote_create"] }).notNull(),
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).notNull(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    callback_enabled: t2.bool("callback_enabled").notNull().default(false),
+    callback_session_id: (0, import_sqlite_core.text)("callback_session_id", { length: 36 }).references(
+      () => sessions2.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    data: t2.json("data")
+  },
+  (table) => ({
+    sourceIdx: (0, import_sqlite_core.index)("session_relationships_source_idx").on(table.source_session_id),
+    targetIdx: (0, import_sqlite_core.index)("session_relationships_target_idx").on(table.target_session_id),
+    callbackIdx: (0, import_sqlite_core.index)("session_relationships_callback_idx").on(table.callback_session_id),
+    // Note: no tenant_source/tenant_target composite indexes here — SQLite schema
+    // has no tenant column on this table (RLS is Postgres-only). The standalone
+    // source/target indexes above are sufficient for SQLite.
+    sourceTargetTypeUnique: (0, import_sqlite_core.uniqueIndex)("session_relationships_source_target_type_unique").on(
+      table.source_session_id,
+      table.target_session_id,
+      table.relationship_type
+    )
+  })
+);
+var tasks2 = (0, import_sqlite_core.sqliteTable)(
+  "tasks",
+  {
+    task_id: (0, import_sqlite_core.text)("task_id", { length: 36 }).primaryKey(),
+    session_id: (0, import_sqlite_core.text)("session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    created_at: t2.timestamp("created_at").notNull(),
+    started_at: t2.timestamp("started_at"),
+    completed_at: t2.timestamp("completed_at"),
+    last_executor_heartbeat_at: t2.timestamp("last_executor_heartbeat_at"),
+    status: (0, import_sqlite_core.text)("status", {
+      enum: [
+        "queued",
+        "created",
+        "running",
+        "stopping",
+        "awaiting_permission",
+        "awaiting_input",
+        "timed_out",
+        "completed",
+        "failed",
+        "stopped"
+      ]
+    }).notNull(),
+    // Queue position (lower drains first); only populated for status='queued'
+    queue_position: (0, import_sqlite_core.integer)("queue_position"),
+    // User attribution
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).notNull(),
+    // MD5 of SDK session file at task completion (only populated when stateless_fs_mode is enabled)
+    session_md5: (0, import_sqlite_core.text)("session_md5"),
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    sessionIdx: (0, import_sqlite_core.index)("tasks_session_idx").on(table.session_id),
+    statusIdx: (0, import_sqlite_core.index)("tasks_status_idx").on(table.status),
+    createdIdx: (0, import_sqlite_core.index)("tasks_created_idx").on(table.created_at),
+    queueIdx: (0, import_sqlite_core.index)("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
+    // Partial unique index — defense-in-depth for `tasks.createPending` race
+    // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
+    // rows have NULL queue_position and are unaffected.
+    queuedPositionUnique: (0, import_sqlite_core.uniqueIndex)("tasks_queued_position_unique").on(table.session_id, table.queue_position).where(import_drizzle_orm3.sql`${table.status} = 'queued'`)
+  })
+);
+var serializedSessions2 = (0, import_sqlite_core.sqliteTable)(
+  "serialized_sessions",
+  {
+    id: (0, import_sqlite_core.text)("id", { length: 36 }).primaryKey(),
+    session_id: (0, import_sqlite_core.text)("session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
+    task_id: (0, import_sqlite_core.text)("task_id", { length: 36 }).references(() => tasks2.task_id, {
+      onDelete: "set null"
+    }),
+    turn_index: (0, import_sqlite_core.integer)("turn_index").notNull().default(0),
+    created_at: t2.timestamp("created_at").notNull(),
+    md5: (0, import_sqlite_core.text)("md5").notNull(),
+    status: (0, import_sqlite_core.text)("status").notNull(),
+    // 'processing' | 'done' — validated at app layer
+    payload: (0, import_sqlite_core.blob)("payload", { mode: "buffer" })
+    // gzipped; NULL while status='processing'
+  },
+  (table) => ({
+    sessionTurnIdx: (0, import_sqlite_core.index)("serialized_sessions_session_turn_idx").on(
+      table.session_id,
+      table.turn_index
+    ),
+    branchIdx: (0, import_sqlite_core.index)("serialized_sessions_branch_idx").on(table.branch_id)
+  })
+);
+var messages2 = (0, import_sqlite_core.sqliteTable)(
+  "messages",
+  {
+    // Primary identity
+    message_id: (0, import_sqlite_core.text)("message_id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    // Foreign keys (materialized for indexes)
+    session_id: (0, import_sqlite_core.text)("session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    task_id: (0, import_sqlite_core.text)("task_id", { length: 36 }).references(() => tasks2.task_id, {
+      onDelete: "set null"
+    }),
+    // Materialized for queries
+    type: (0, import_sqlite_core.text)("type", {
+      enum: [
+        "user",
+        "assistant",
+        "system",
+        "file-history-snapshot",
+        "permission_request",
+        "input_request",
+        "daemon_restart",
+        "daemon_crash",
+        "widget_request"
+      ]
+    }).notNull(),
+    role: (0, import_sqlite_core.text)("role", {
+      enum: ["user", "assistant", "system"]
+    }).notNull(),
+    index: (0, import_sqlite_core.integer)("index").notNull(),
+    // Position in conversation (0-based)
+    timestamp: t2.timestamp("timestamp").notNull(),
+    content_preview: (0, import_sqlite_core.text)("content_preview"),
+    // First 200 chars for list views
+    // Parent tool use ID (for nested tool calls - e.g., Task tool spawning Read/Grep)
+    parent_tool_use_id: (0, import_sqlite_core.text)("parent_tool_use_id"),
+    // NOTE: queueing moved off `messages` and onto `tasks.status='queued'` as
+    // of migration sqlite/0040 (postgres/0030). The legacy `status` and
+    // `queue_position` columns are gone — see `tasks.queue_position` instead.
+    // Full data (JSON blob)
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    // Indexes for efficient lookups
+    sessionIdx: (0, import_sqlite_core.index)("messages_session_id_idx").on(table.session_id),
+    taskIdx: (0, import_sqlite_core.index)("messages_task_id_idx").on(table.task_id),
+    sessionIndexIdx: (0, import_sqlite_core.index)("messages_session_index_idx").on(table.session_id, table.index),
+    timestampIdx: (0, import_sqlite_core.index)("messages_timestamp_idx").on(table.timestamp),
+    sessionTimestampIdx: (0, import_sqlite_core.index)("messages_session_timestamp_idx").on(
+      table.session_id,
+      table.timestamp
+    )
+  })
+);
+var boards2 = (0, import_sqlite_core.sqliteTable)(
+  "boards",
+  {
+    board_id: (0, import_sqlite_core.text)("board_id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    // User attribution
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).notNull(),
+    // Materialized for lookups
+    name: (0, import_sqlite_core.text)("name").notNull(),
+    slug: (0, import_sqlite_core.text)("slug").unique(),
+    primary_assistant_id: (0, import_sqlite_core.text)("primary_assistant_id", { length: 36 }).references(
+      () => branches2.branch_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    // JSON blob for the rest
+    data: t2.json("data").$type().notNull(),
+    // Archive state (for soft deletes)
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at"),
+    archived_by: (0, import_sqlite_core.text)("archived_by", { length: 36 })
+  },
+  (table) => ({
+    nameIdx: (0, import_sqlite_core.index)("boards_name_idx").on(table.name),
+    slugIdx: (0, import_sqlite_core.index)("boards_slug_idx").on(table.slug)
+  })
+);
+var repos2 = (0, import_sqlite_core.sqliteTable)(
+  "repos",
+  {
+    repo_id: (0, import_sqlite_core.text)("repo_id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    // Materialized for querying
+    slug: (0, import_sqlite_core.text)("slug").notNull().unique(),
+    repo_type: (0, import_sqlite_core.text)("repo_type", { enum: ["remote", "local"] }).notNull().default("remote"),
+    // Unix group for repo-level git access (agor_rp_<short-id>)
+    // Users who have access to ANY branch in this repo get added to this group.
+    // Applied to repo Unix-group-managed paths:
+    // - repo root (non-recursive) for traversal into .git/worktrees/<name>
+    // - .git (recursive) for shared git objects/refs and git operations
+    unix_group: (0, import_sqlite_core.text)("unix_group"),
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    slugIdx: (0, import_sqlite_core.index)("repos_slug_idx").on(table.slug)
+  })
+);
+var branches2 = (0, import_sqlite_core.sqliteTable)(
+  "branches",
+  {
+    // Primary identity
+    branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).primaryKey(),
+    repo_id: (0, import_sqlite_core.text)("repo_id", { length: 36 }).notNull().references(() => repos2.repo_id, { onDelete: "cascade" }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    // User attribution
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).notNull(),
+    // Materialized for queries
+    name: (0, import_sqlite_core.text)("name").notNull(),
+    // "feat-auth", "main"
+    ref: (0, import_sqlite_core.text)("ref").notNull(),
+    // Current branch/tag/commit
+    ref_type: (0, import_sqlite_core.text)("ref_type", { enum: ["branch", "tag"] }),
+    // Type of ref (branch or tag)
+    branch_unique_id: (0, import_sqlite_core.integer)("branch_unique_id").notNull(),
+    // Auto-assigned sequential ID for templates
+    // Environment configuration (static, initialized from templates, then user-editable)
+    start_command: (0, import_sqlite_core.text)("start_command"),
+    // Start command (initialized from repo's up_command template)
+    stop_command: (0, import_sqlite_core.text)("stop_command"),
+    // Stop command (initialized from repo's down_command template)
+    nuke_command: (0, import_sqlite_core.text)("nuke_command"),
+    // Nuke command (initialized from repo's nuke_command template)
+    health_check_url: (0, import_sqlite_core.text)("health_check_url"),
+    // Health check URL (initialized from repo's health_check.url_template)
+    app_url: (0, import_sqlite_core.text)("app_url"),
+    // Application URL (initialized from repo's app_url_template)
+    logs_command: (0, import_sqlite_core.text)("logs_command"),
+    // Logs command (initialized from repo's logs_command template)
+    // Name of the environment variant currently rendered into the command fields above.
+    // References a key under repo.environment.variants. Null for pre-v2 branches.
+    environment_variant: (0, import_sqlite_core.text)("environment_variant"),
+    // Board relationship (nullable - branches can exist without boards)
+    board_id: (0, import_sqlite_core.text)("board_id", { length: 36 }).references(() => boards2.board_id, {
+      onDelete: "set null"
+      // If board is deleted, branch remains but loses board association
+    }),
+    // UI state (materialized for efficient highlighting queries)
+    needs_attention: t2.bool("needs_attention").notNull().default(true),
+    // Default true for new branches
+    // Archive state (for soft deletes)
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at"),
+    archived_by: (0, import_sqlite_core.text)("archived_by", { length: 36 }),
+    filesystem_status: (0, import_sqlite_core.text)("filesystem_status", {
+      enum: ["creating", "ready", "failed", "preserved", "cleaned", "deleted"]
+    }),
+    // RBAC: App-layer permissions (rbac.md)
+    permission_source: (0, import_sqlite_core.text)("permission_source", { enum: ["board", "override"] }).$type().notNull().default("override"),
+    others_can: (0, import_sqlite_core.text)("others_can", {
+      enum: [...BRANCH_PERMISSION_LEVELS]
+    }).default("view"),
+    // RBAC: OS-layer permissions (unix-user-modes.md)
+    unix_group: (0, import_sqlite_core.text)("unix_group"),
+    // e.g., 'agor_wt_abc123'
+    others_fs_access: (0, import_sqlite_core.text)("others_fs_access", {
+      enum: ["none", "read", "write"]
+    }).$type().default("read"),
+    // Branch storage model — see context/explorations/clone-redesign.md.
+    // 'worktree' = native `git worktree add` (shared base .git/config — legacy default).
+    // 'clone'    = self-standing `git clone` (own .git/ — closes cross-branch leak vectors).
+    //
+    // Enum is validated at the Drizzle/TS/Zod/service layer (no DB-side
+    // CHECK) per context/guides/creating-database-migrations.md so adding a
+    // value later doesn't force a table-recreation migration on SQLite.
+    storage_mode: (0, import_sqlite_core.text)("storage_mode", { enum: ["worktree", "clone"] }).notNull().default("worktree"),
+    // Only meaningful when storage_mode='clone'. NULL = full clone, positive
+    // integer = `git clone --depth N` (shallow). The service layer rejects
+    // a non-null clone_depth on worktree-mode rows.
+    clone_depth: (0, import_sqlite_core.integer)("clone_depth"),
+    // JSON blob for everything else
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    repoIdx: (0, import_sqlite_core.index)("branches_repo_idx").on(table.repo_id),
+    nameIdx: (0, import_sqlite_core.index)("branches_name_idx").on(table.name),
+    refIdx: (0, import_sqlite_core.index)("branches_ref_idx").on(table.ref),
+    boardIdx: (0, import_sqlite_core.index)("branches_board_idx").on(table.board_id),
+    createdIdx: (0, import_sqlite_core.index)("branches_created_idx").on(table.created_at),
+    updatedIdx: (0, import_sqlite_core.index)("branches_updated_idx").on(table.updated_at),
+    // Composite unique constraint (repo + name)
+    uniqueRepoName: (0, import_sqlite_core.index)("branches_repo_name_unique").on(table.repo_id, table.name)
+  })
+);
+var branchOwners2 = (0, import_sqlite_core.sqliteTable)(
+  "branch_owners",
+  {
+    branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
+    user_id: (0, import_sqlite_core.text)("user_id", { length: 36 }).notNull().references(() => users2.user_id, { onDelete: "cascade" }),
+    created_at: t2.timestamp("created_at")
+  },
+  (table) => ({
+    // Composite primary key matching migration 0016
+    pk: (0, import_sqlite_core.primaryKey)({ columns: [table.branch_id, table.user_id] })
+  })
+);
+var boardOwners2 = (0, import_sqlite_core.sqliteTable)(
+  "board_owners",
+  {
+    board_id: (0, import_sqlite_core.text)("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
+    user_id: (0, import_sqlite_core.text)("user_id", { length: 36 }).notNull().references(() => users2.user_id, { onDelete: "cascade" }),
+    created_at: t2.timestamp("created_at")
+  },
+  (table) => ({
+    pk: (0, import_sqlite_core.primaryKey)({ columns: [table.board_id, table.user_id] }),
+    userIdx: (0, import_sqlite_core.index)("board_owners_user_idx").on(table.user_id)
+  })
+);
+var schedules2 = (0, import_sqlite_core.sqliteTable)(
+  "schedules",
+  {
+    schedule_id: (0, import_sqlite_core.text)("schedule_id", { length: 36 }).primaryKey(),
+    branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
+    name: (0, import_sqlite_core.text)("name").notNull(),
+    description: (0, import_sqlite_core.text)("description"),
+    cron_expression: (0, import_sqlite_core.text)("cron_expression").notNull(),
+    timezone_mode: (0, import_sqlite_core.text)("timezone_mode", { enum: ["local", "utc"] }).notNull().default("local"),
+    timezone: (0, import_sqlite_core.text)("timezone"),
+    // IANA, required when timezone_mode='local'
+    prompt: (0, import_sqlite_core.text)("prompt").notNull(),
+    // Handlebars template
+    // jsonb on PG; mirrors BranchScheduleConfig minus promoted fields.
+    agentic_tool_config: t2.json("agentic_tool_config").notNull(),
+    enabled: t2.bool("enabled").notNull().default(true),
+    allow_concurrent_runs: t2.bool("allow_concurrent_runs").notNull().default(false),
+    retention: (0, import_sqlite_core.integer)("retention").notNull().default(5),
+    // 0 = keep all
+    last_run_at: (0, import_sqlite_core.integer)("last_run_at"),
+    // Unix timestamp (ms)
+    last_run_session_id: (0, import_sqlite_core.text)("last_run_session_id", { length: 36 }).references(
+      () => sessions2.session_id,
+      { onDelete: "set null" }
+    ),
+    next_run_at: (0, import_sqlite_core.integer)("next_run_at"),
+    // Unix timestamp (ms), denormalized for scheduler
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at").notNull(),
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).notNull().references(() => users2.user_id)
+  },
+  (table) => ({
+    // Scheduler hot path: WHERE enabled = true AND next_run_at <= ?
+    enabledNextRunIdx: (0, import_sqlite_core.index)("schedules_enabled_next_run_idx").on(table.enabled, table.next_run_at),
+    branchIdx: (0, import_sqlite_core.index)("schedules_branch_idx").on(table.branch_id),
+    createdByIdx: (0, import_sqlite_core.index)("schedules_created_by_idx").on(table.created_by)
+  })
+);
+var users2 = (0, import_sqlite_core.sqliteTable)(
+  "users",
+  {
+    // Primary identity
+    user_id: (0, import_sqlite_core.text)("user_id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    // Materialized for auth lookups
+    email: (0, import_sqlite_core.text)("email").unique().notNull(),
+    password: (0, import_sqlite_core.text)("password").notNull(),
+    // bcrypt hashed
+    // Basic profile (materialized for display)
+    name: (0, import_sqlite_core.text)("name"),
+    emoji: (0, import_sqlite_core.text)("emoji"),
+    role: (0, import_sqlite_core.text)("role", {
+      enum: ["superadmin", "admin", "member", "viewer"]
+      // 'owner' is deprecated alias for 'superadmin'
+    }).notNull().default("member"),
+    // Unix username for process impersonation (optional, app-enforced uniqueness)
+    unix_username: (0, import_sqlite_core.text)("unix_username"),
+    // Onboarding state
+    onboarding_completed: t2.bool("onboarding_completed").notNull().default(false),
+    // Force password change flag (admin-settable, auto-cleared on password change)
+    must_change_password: t2.bool("must_change_password").notNull().default(false),
+    // Auth invalidation marker. Password changes set this timestamp so any
+    // previously issued browser access or refresh token is rejected.
+    tokens_valid_after: t2.timestamp("tokens_valid_after"),
+    // JSON blob for profile/preferences
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    emailIdx: (0, import_sqlite_core.index)("users_email_idx").on(table.email)
+  })
+);
+var groups2 = (0, import_sqlite_core.sqliteTable)(
+  "groups",
+  {
+    group_id: (0, import_sqlite_core.text)("group_id", { length: 36 }).primaryKey(),
+    name: (0, import_sqlite_core.text)("name").notNull(),
+    slug: (0, import_sqlite_core.text)("slug").notNull(),
+    description: (0, import_sqlite_core.text)("description"),
+    archived: t2.bool("archived").notNull().default(false),
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at")
+  },
+  (table) => ({
+    slugIdx: (0, import_sqlite_core.uniqueIndex)("groups_slug_idx").on(table.slug),
+    archivedIdx: (0, import_sqlite_core.index)("groups_archived_idx").on(table.archived)
+  })
+);
+var groupMemberships2 = (0, import_sqlite_core.sqliteTable)(
+  "group_memberships",
+  {
+    group_id: (0, import_sqlite_core.text)("group_id", { length: 36 }).notNull().references(() => groups2.group_id, { onDelete: "cascade" }),
+    user_id: (0, import_sqlite_core.text)("user_id", { length: 36 }).notNull().references(() => users2.user_id, { onDelete: "cascade" }),
+    added_by: (0, import_sqlite_core.text)("added_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull()
+  },
+  (table) => ({
+    pk: (0, import_sqlite_core.primaryKey)({ columns: [table.group_id, table.user_id] }),
+    userIdx: (0, import_sqlite_core.index)("group_memberships_user_idx").on(table.user_id)
+  })
+);
+var branchGroupGrants2 = (0, import_sqlite_core.sqliteTable)(
+  "branch_group_grants",
+  {
+    branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
+    group_id: (0, import_sqlite_core.text)("group_id", { length: 36 }).notNull().references(() => groups2.group_id, { onDelete: "cascade" }),
+    can: (0, import_sqlite_core.text)("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
+    fs_access: (0, import_sqlite_core.text)("fs_access", { enum: ["none", "read", "write"] }).$type(),
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at")
+  },
+  (table) => ({
+    pk: (0, import_sqlite_core.primaryKey)({ columns: [table.branch_id, table.group_id] }),
+    groupIdx: (0, import_sqlite_core.index)("branch_group_grants_group_idx").on(table.group_id)
+  })
+);
+var boardGroupGrants2 = (0, import_sqlite_core.sqliteTable)(
+  "board_group_grants",
+  {
+    board_id: (0, import_sqlite_core.text)("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
+    group_id: (0, import_sqlite_core.text)("group_id", { length: 36 }).notNull().references(() => groups2.group_id, { onDelete: "cascade" }),
+    can: (0, import_sqlite_core.text)("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
+    fs_access: (0, import_sqlite_core.text)("fs_access", { enum: ["none", "read", "write"] }).$type(),
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at")
+  },
+  (table) => ({
+    pk: (0, import_sqlite_core.primaryKey)({ columns: [table.board_id, table.group_id] }),
+    groupIdx: (0, import_sqlite_core.index)("board_group_grants_group_idx").on(table.group_id)
+  })
+);
+var appVariables2 = (0, import_sqlite_core.sqliteTable)(
+  "app_variables",
+  {
+    variable_id: (0, import_sqlite_core.text)("variable_id", { length: 36 }).primaryKey(),
+    namespace: (0, import_sqlite_core.text)("namespace").notNull(),
+    key: (0, import_sqlite_core.text)("key").notNull(),
+    value_text: (0, import_sqlite_core.text)("value_text"),
+    value_encrypted: (0, import_sqlite_core.text)("value_encrypted"),
+    is_encrypted: t2.bool("is_encrypted").notNull().default(false),
+    content_type: (0, import_sqlite_core.text)("content_type").notNull().default("text/plain"),
+    metadata: t2.json("metadata"),
+    updated_by: (0, import_sqlite_core.text)("updated_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at").notNull()
+  },
+  (table) => ({
+    namespaceKeyIdx: (0, import_sqlite_core.uniqueIndex)("app_variables_namespace_key_idx").on(table.namespace, table.key),
+    namespaceIdx: (0, import_sqlite_core.index)("app_variables_namespace_idx").on(table.namespace)
+  })
+);
+var userApiKeys2 = (0, import_sqlite_core.sqliteTable)(
+  "user_api_keys",
+  {
+    id: (0, import_sqlite_core.text)("id", { length: 36 }).primaryKey(),
+    user_id: (0, import_sqlite_core.text)("user_id", { length: 36 }).notNull().references(() => users2.user_id, { onDelete: "cascade" }),
+    name: (0, import_sqlite_core.text)("name").notNull(),
+    prefix: (0, import_sqlite_core.text)("prefix").notNull(),
+    // first 12 chars: 'agor_sk_XXXX' for identification
+    key_hash: (0, import_sqlite_core.text)("key_hash").notNull(),
+    // bcrypt hash of full key
+    created_at: t2.timestamp("created_at").notNull(),
+    last_used_at: t2.timestamp("last_used_at")
+  },
+  (table) => ({
+    userIdx: (0, import_sqlite_core.index)("user_api_keys_user_idx").on(table.user_id),
+    prefixIdx: (0, import_sqlite_core.index)("user_api_keys_prefix_idx").on(table.prefix)
+  })
+);
+var mcpServers2 = (0, import_sqlite_core.sqliteTable)(
+  "mcp_servers",
+  {
+    // Primary identity
+    mcp_server_id: (0, import_sqlite_core.text)("mcp_server_id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    // Materialized for filtering
+    name: (0, import_sqlite_core.text)("name").notNull(),
+    // e.g., "filesystem", "sentry"
+    transport: (0, import_sqlite_core.text)("transport", {
+      enum: ["stdio", "http", "sse"]
+    }).notNull(),
+    scope: (0, import_sqlite_core.text)("scope", {
+      enum: ["global", "session"]
+    }).notNull(),
+    enabled: t2.bool("enabled").notNull().default(true),
+    // Scope foreign key
+    // For 'global' scope: which user owns this server
+    // For 'session' scope: use session_mcp_servers junction table (many-to-many)
+    owner_user_id: (0, import_sqlite_core.text)("owner_user_id", { length: 36 }),
+    // Source tracking (materialized for queries)
+    source: (0, import_sqlite_core.text)("source", {
+      enum: ["user", "imported", "agor"]
+    }).notNull(),
+    // JSON blob for configuration and capabilities
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    nameIdx: (0, import_sqlite_core.index)("mcp_servers_name_idx").on(table.name),
+    scopeIdx: (0, import_sqlite_core.index)("mcp_servers_scope_idx").on(table.scope),
+    ownerIdx: (0, import_sqlite_core.index)("mcp_servers_owner_idx").on(table.owner_user_id),
+    enabledIdx: (0, import_sqlite_core.index)("mcp_servers_enabled_idx").on(table.enabled)
+  })
+);
+var cardTypes2 = (0, import_sqlite_core.sqliteTable)(
+  "card_types",
+  {
+    card_type_id: (0, import_sqlite_core.text)("card_type_id", { length: 36 }).primaryKey(),
+    name: (0, import_sqlite_core.text)("name").notNull(),
+    emoji: (0, import_sqlite_core.text)("emoji"),
+    color: (0, import_sqlite_core.text)("color"),
+    json_schema: (0, import_sqlite_core.text)("json_schema"),
+    // JSON string of JSON Schema
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at").notNull()
+  },
+  (table) => ({
+    nameIdx: (0, import_sqlite_core.index)("card_types_name_idx").on(table.name)
+  })
+);
+var cards2 = (0, import_sqlite_core.sqliteTable)(
+  "cards",
+  {
+    card_id: (0, import_sqlite_core.text)("card_id", { length: 36 }).primaryKey(),
+    board_id: (0, import_sqlite_core.text)("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
+    card_type_id: (0, import_sqlite_core.text)("card_type_id", { length: 36 }).references(() => cardTypes2.card_type_id, {
+      onDelete: "set null"
+    }),
+    title: (0, import_sqlite_core.text)("title").notNull(),
+    url: (0, import_sqlite_core.text)("url"),
+    description: (0, import_sqlite_core.text)("description"),
+    note: (0, import_sqlite_core.text)("note"),
+    data: (0, import_sqlite_core.text)("data"),
+    // JSON blob validated against CardType.json_schema if present
+    color_override: (0, import_sqlite_core.text)("color_override"),
+    emoji_override: (0, import_sqlite_core.text)("emoji_override"),
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at").notNull(),
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at")
+  },
+  (table) => ({
+    boardIdx: (0, import_sqlite_core.index)("cards_board_idx").on(table.board_id),
+    cardTypeIdx: (0, import_sqlite_core.index)("cards_card_type_idx").on(table.card_type_id),
+    titleIdx: (0, import_sqlite_core.index)("cards_title_idx").on(table.title),
+    archivedIdx: (0, import_sqlite_core.index)("cards_archived_idx").on(table.archived),
+    createdIdx: (0, import_sqlite_core.index)("cards_created_idx").on(table.created_at)
+  })
+);
+var artifacts2 = (0, import_sqlite_core.sqliteTable)(
+  "artifacts",
+  {
+    artifact_id: (0, import_sqlite_core.text)("artifact_id", { length: 36 }).primaryKey(),
+    branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).references(() => branches2.branch_id, {
+      onDelete: "set null"
+    }),
+    source_session_id: (0, import_sqlite_core.text)("source_session_id", { length: 36 }).references(
+      () => sessions2.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    board_id: (0, import_sqlite_core.text)("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
+    name: (0, import_sqlite_core.text)("name").notNull(),
+    description: (0, import_sqlite_core.text)("description"),
+    path: (0, import_sqlite_core.text)("path"),
+    // provenance only — where files were read from
+    template: (0, import_sqlite_core.text)("template").notNull().default("react"),
+    build_status: (0, import_sqlite_core.text)("build_status").notNull().default("unknown"),
+    build_errors: t2.json("build_errors"),
+    content_hash: (0, import_sqlite_core.text)("content_hash"),
+    files: t2.json("files"),
+    dependencies: t2.json("dependencies"),
+    entry: (0, import_sqlite_core.text)("entry"),
+    // denormalized cache of the Sandpack entry file
+    sandpack_config: t2.json("sandpack_config"),
+    required_env_vars: t2.json("required_env_vars"),
+    agor_grants: t2.json("agor_grants"),
+    agor_runtime: t2.json("agor_runtime"),
+    public: t2.bool("public").notNull().default(true),
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at").notNull(),
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at")
+  },
+  (table) => ({
+    branchIdx: (0, import_sqlite_core.index)("artifacts_branch_idx").on(table.branch_id),
+    sourceSessionIdx: (0, import_sqlite_core.index)("artifacts_source_session_idx").on(table.source_session_id),
+    boardIdx: (0, import_sqlite_core.index)("artifacts_board_idx").on(table.board_id),
+    archivedIdx: (0, import_sqlite_core.index)("artifacts_archived_idx").on(table.archived),
+    publicIdx: (0, import_sqlite_core.index)("artifacts_public_idx").on(table.public)
+  })
+);
+var artifactTrustGrants2 = (0, import_sqlite_core.sqliteTable)(
+  "artifact_trust_grants",
+  {
+    grant_id: (0, import_sqlite_core.text)("grant_id", { length: 36 }).primaryKey(),
+    user_id: (0, import_sqlite_core.text)("user_id", { length: 36 }).notNull(),
+    // CHECK constraint omitted — service-layer enforcement only, so adding new
+    // scope_types in the future doesn't require a SQLite table-recreate.
+    scope_type: (0, import_sqlite_core.text)("scope_type").notNull(),
+    scope_value: (0, import_sqlite_core.text)("scope_value"),
+    env_vars_set: t2.json("env_vars_set").notNull(),
+    agor_grants_set: t2.json("agor_grants_set").notNull(),
+    granted_at: t2.timestamp("granted_at").notNull(),
+    revoked_at: t2.timestamp("revoked_at")
+  },
+  (table) => ({
+    userIdx: (0, import_sqlite_core.index)("artifact_trust_grants_user_idx").on(table.user_id),
+    scopeIdx: (0, import_sqlite_core.index)("artifact_trust_grants_scope_idx").on(table.scope_type, table.scope_value)
+  })
+);
+var boardObjects2 = (0, import_sqlite_core.sqliteTable)(
+  "board_objects",
+  {
+    // Primary identity
+    object_id: (0, import_sqlite_core.text)("object_id", { length: 36 }).primaryKey(),
+    board_id: (0, import_sqlite_core.text)("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
+    created_at: t2.timestamp("created_at").notNull(),
+    // Polymorphic entity reference (exactly one must be set)
+    branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).references(() => branches2.branch_id, {
+      onDelete: "cascade"
+    }),
+    card_id: (0, import_sqlite_core.text)("card_id", { length: 36 }).references(() => cards2.card_id, {
+      onDelete: "cascade"
+    }),
+    // Position data (JSON)
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    boardIdx: (0, import_sqlite_core.index)("board_objects_board_idx").on(table.board_id),
+    branchIdx: (0, import_sqlite_core.index)("board_objects_branch_idx").on(table.branch_id),
+    cardIdx: (0, import_sqlite_core.index)("board_objects_card_idx").on(table.card_id)
+  })
+);
+var sessionMcpServers2 = (0, import_sqlite_core.sqliteTable)(
+  "session_mcp_servers",
+  {
+    session_id: (0, import_sqlite_core.text)("session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    mcp_server_id: (0, import_sqlite_core.text)("mcp_server_id", { length: 36 }).notNull().references(() => mcpServers2.mcp_server_id, { onDelete: "cascade" }),
+    enabled: t2.bool("enabled").notNull().default(true),
+    added_at: t2.timestamp("added_at").notNull()
+  },
+  (table) => ({
+    // Composite primary key
+    pk: (0, import_sqlite_core.index)("session_mcp_servers_pk").on(table.session_id, table.mcp_server_id),
+    // Indexes for queries
+    sessionIdx: (0, import_sqlite_core.index)("session_mcp_servers_session_idx").on(table.session_id),
+    serverIdx: (0, import_sqlite_core.index)("session_mcp_servers_server_idx").on(table.mcp_server_id),
+    enabledIdx: (0, import_sqlite_core.index)("session_mcp_servers_enabled_idx").on(table.session_id, table.enabled)
+  })
+);
+var userMcpOauthTokens2 = (0, import_sqlite_core.sqliteTable)(
+  "user_mcp_oauth_tokens",
+  {
+    // NULL = shared-mode token (one per mcp_server_id)
+    user_id: (0, import_sqlite_core.text)("user_id", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "cascade"
+    }),
+    mcp_server_id: (0, import_sqlite_core.text)("mcp_server_id", { length: 36 }).notNull().references(() => mcpServers2.mcp_server_id, { onDelete: "cascade" }),
+    oauth_access_token: (0, import_sqlite_core.text)("oauth_access_token").notNull(),
+    oauth_token_expires_at: t2.timestamp("oauth_token_expires_at"),
+    // Unix timestamp in milliseconds
+    oauth_refresh_token: (0, import_sqlite_core.text)("oauth_refresh_token"),
+    // DCR / registered client credentials this grant was issued under.
+    // Must be preserved across refreshes.
+    oauth_client_id: (0, import_sqlite_core.text)("oauth_client_id"),
+    oauth_client_secret: (0, import_sqlite_core.text)("oauth_client_secret"),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at")
+  },
+  (table) => ({
+    // Composite lookup indexes. Uniqueness enforced via partial unique indexes
+    // created in the migration (one for per-user rows, one for the shared row).
+    pk: (0, import_sqlite_core.index)("user_mcp_oauth_tokens_pk").on(table.user_id, table.mcp_server_id),
+    userIdx: (0, import_sqlite_core.index)("user_mcp_oauth_tokens_user_idx").on(table.user_id),
+    serverIdx: (0, import_sqlite_core.index)("user_mcp_oauth_tokens_server_idx").on(table.mcp_server_id)
+  })
+);
+var boardComments2 = (0, import_sqlite_core.sqliteTable)(
+  "board_comments",
+  {
+    // Primary identity
+    comment_id: (0, import_sqlite_core.text)("comment_id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    // Scoping & authorship
+    board_id: (0, import_sqlite_core.text)("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).notNull(),
+    // FLEXIBLE ATTACHMENTS (all optional)
+    // Phase 1: board-level only (all NULL)
+    // Phase 2: object attachments (session, task, message, branch)
+    // Phase 3: spatial positioning
+    session_id: (0, import_sqlite_core.text)("session_id", { length: 36 }).references(() => sessions2.session_id, {
+      onDelete: "set null"
+    }),
+    task_id: (0, import_sqlite_core.text)("task_id", { length: 36 }).references(() => tasks2.task_id, {
+      onDelete: "set null"
+    }),
+    message_id: (0, import_sqlite_core.text)("message_id", { length: 36 }).references(() => messages2.message_id, {
+      onDelete: "set null"
+    }),
+    branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).references(() => branches2.branch_id, {
+      onDelete: "cascade"
+    }),
+    // Content (materialized for display)
+    content: (0, import_sqlite_core.text)("content").notNull(),
+    // Markdown-supported text
+    content_preview: (0, import_sqlite_core.text)("content_preview").notNull(),
+    // First 200 chars
+    // Thread support (optional)
+    parent_comment_id: (0, import_sqlite_core.text)("parent_comment_id", { length: 36 }),
+    // Metadata (materialized for filtering)
+    resolved: t2.bool("resolved").notNull().default(false),
+    edited: t2.bool("edited").notNull().default(false),
+    // Reactions (for BOTH thread roots and replies)
+    // Stored as JSON array: [{ user_id: "abc", emoji: "👍" }, ...]
+    // Display grouped by emoji: { "👍": ["alice", "bob"], "🎉": ["charlie"] }
+    reactions: t2.json("reactions").$type().notNull().default(import_drizzle_orm3.sql`'[]'`),
+    // JSON blob for advanced features
+    data: t2.json("data").$type().notNull()
+  },
+  (table) => ({
+    boardIdx: (0, import_sqlite_core.index)("board_comments_board_idx").on(table.board_id),
+    sessionIdx: (0, import_sqlite_core.index)("board_comments_session_idx").on(table.session_id),
+    taskIdx: (0, import_sqlite_core.index)("board_comments_task_idx").on(table.task_id),
+    messageIdx: (0, import_sqlite_core.index)("board_comments_message_idx").on(table.message_id),
+    branchIdx: (0, import_sqlite_core.index)("board_comments_branch_idx").on(table.branch_id),
+    createdByIdx: (0, import_sqlite_core.index)("board_comments_created_by_idx").on(table.created_by),
+    parentIdx: (0, import_sqlite_core.index)("board_comments_parent_idx").on(table.parent_comment_id),
+    createdIdx: (0, import_sqlite_core.index)("board_comments_created_idx").on(table.created_at),
+    resolvedIdx: (0, import_sqlite_core.index)("board_comments_resolved_idx").on(table.resolved)
+  })
+);
+var gatewayChannels2 = (0, import_sqlite_core.sqliteTable)(
+  "gateway_channels",
+  {
+    // Primary identity
+    id: (0, import_sqlite_core.text)("id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at").notNull(),
+    // User attribution
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).notNull(),
+    // Materialized for queries
+    name: (0, import_sqlite_core.text)("name").notNull(),
+    channel_type: (0, import_sqlite_core.text)("channel_type", {
+      enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+    }).notNull(),
+    target_branch_id: (0, import_sqlite_core.text)("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
+    agor_user_id: (0, import_sqlite_core.text)("agor_user_id", { length: 36 }).notNull(),
+    channel_key: (0, import_sqlite_core.text)("channel_key").notNull().unique(),
+    enabled: t2.bool("enabled").notNull().default(true),
+    last_message_at: t2.timestamp("last_message_at"),
+    // JSON blob for platform credentials (encrypted at rest)
+    config: t2.json("config").notNull(),
+    // JSON blob for agentic tool configuration (agent, model, permission mode, etc.)
+    agentic_config: t2.json("agentic_config")
+  },
+  (table) => ({
+    channelKeyIdx: (0, import_sqlite_core.index)("idx_gateway_channel_key").on(table.channel_key),
+    enabledTypeIdx: (0, import_sqlite_core.index)("idx_gateway_enabled_type").on(table.enabled, table.channel_type)
+  })
+);
+var threadSessionMap2 = (0, import_sqlite_core.sqliteTable)(
+  "thread_session_map",
+  {
+    // Primary identity
+    id: (0, import_sqlite_core.text)("id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    last_message_at: t2.timestamp("last_message_at").notNull(),
+    // Foreign keys
+    channel_id: (0, import_sqlite_core.text)("channel_id", { length: 36 }).notNull().references(() => gatewayChannels2.id, { onDelete: "cascade" }),
+    thread_id: (0, import_sqlite_core.text)("thread_id").notNull(),
+    session_id: (0, import_sqlite_core.text)("session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).notNull().references(() => branches2.branch_id),
+    // Materialized for queries
+    status: (0, import_sqlite_core.text)("status", {
+      enum: ["active", "archived", "paused"]
+    }).notNull().default("active"),
+    // JSON blob for extra metadata
+    metadata: t2.json("metadata")
+  },
+  (table) => ({
+    uniqueChannelThread: (0, import_sqlite_core.uniqueIndex)("uniq_thread_map_channel_thread").on(
+      table.channel_id,
+      table.thread_id
+    ),
+    sessionIdx: (0, import_sqlite_core.index)("idx_thread_map_session_id").on(table.session_id),
+    threadIdx: (0, import_sqlite_core.index)("idx_thread_map_thread_id").on(table.thread_id),
+    channelStatusIdx: (0, import_sqlite_core.index)("idx_thread_map_channel_status").on(table.channel_id, table.status)
+  })
+);
+var gatewayOutboundMessages2 = (0, import_sqlite_core.sqliteTable)(
+  "gateway_outbound_messages",
+  {
+    id: (0, import_sqlite_core.text)("id", { length: 36 }).primaryKey(),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at").notNull(),
+    gateway_channel_id: (0, import_sqlite_core.text)("gateway_channel_id", { length: 36 }).notNull().references(() => gatewayChannels2.id, { onDelete: "cascade" }),
+    channel_type: (0, import_sqlite_core.text)("channel_type", {
+      enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+    }).notNull(),
+    platform_channel_id: (0, import_sqlite_core.text)("platform_channel_id").notNull(),
+    platform_message_id: (0, import_sqlite_core.text)("platform_message_id").notNull(),
+    platform_thread_id: (0, import_sqlite_core.text)("platform_thread_id").notNull(),
+    platform_permalink: (0, import_sqlite_core.text)("platform_permalink"),
+    target_branch_id: (0, import_sqlite_core.text)("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id),
+    emitted_by_user_id: (0, import_sqlite_core.text)("emitted_by_user_id", { length: 36 }).notNull().references(() => users2.user_id),
+    emitted_by_session_id: (0, import_sqlite_core.text)("emitted_by_session_id", { length: 36 }).references(
+      () => sessions2.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    emitted_by_task_id: (0, import_sqlite_core.text)("emitted_by_task_id", { length: 36 }).references(() => tasks2.task_id, {
+      onDelete: "set null"
+    }),
+    emitted_by_schedule_id: (0, import_sqlite_core.text)("emitted_by_schedule_id", { length: 36 }).references(
+      () => schedules2.schedule_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    message_text: (0, import_sqlite_core.text)("message_text").notNull(),
+    message_preview: (0, import_sqlite_core.text)("message_preview").notNull(),
+    metadata: t2.json("metadata"),
+    consumed_by_session_id: (0, import_sqlite_core.text)("consumed_by_session_id", { length: 36 }).references(
+      () => sessions2.session_id,
+      {
+        onDelete: "set null"
+      }
+    ),
+    consumed_at: t2.timestamp("consumed_at")
+  },
+  (table) => ({
+    uniqueChannelThread: (0, import_sqlite_core.uniqueIndex)("uniq_gateway_outbound_channel_thread").on(
+      table.gateway_channel_id,
+      table.platform_thread_id
+    ),
+    emittedSessionIdx: (0, import_sqlite_core.index)("idx_gateway_outbound_emitted_session").on(
+      table.emitted_by_session_id
+    ),
+    emittedScheduleIdx: (0, import_sqlite_core.index)("idx_gateway_outbound_emitted_schedule").on(
+      table.emitted_by_schedule_id
+    ),
+    targetBranchCreatedIdx: (0, import_sqlite_core.index)("idx_gateway_outbound_branch_created").on(
+      table.target_branch_id,
+      table.created_at
+    ),
+    consumedIdx: (0, import_sqlite_core.index)("idx_gateway_outbound_consumed").on(table.consumed_at)
+  })
+);
+var sessionEnvSelections2 = (0, import_sqlite_core.sqliteTable)(
+  "session_env_selections",
+  {
+    session_id: (0, import_sqlite_core.text)("session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+    env_var_name: (0, import_sqlite_core.text)("env_var_name").notNull(),
+    created_at: t2.timestamp("created_at").notNull()
+  },
+  (table) => ({
+    pk: (0, import_sqlite_core.primaryKey)({ columns: [table.session_id, table.env_var_name] }),
+    sessionIdx: (0, import_sqlite_core.index)("session_env_selections_session_idx").on(table.session_id)
+  })
+);
+var kbNamespaces2 = (0, import_sqlite_core.sqliteTable)(
+  "kb_namespaces",
+  {
+    namespace_id: (0, import_sqlite_core.text)("namespace_id", { length: 36 }).primaryKey(),
+    slug: (0, import_sqlite_core.text)("slug").notNull(),
+    display_name: (0, import_sqlite_core.text)("display_name").notNull(),
+    description: (0, import_sqlite_core.text)("description"),
+    kind: (0, import_sqlite_core.text)("kind", { enum: ["system", "global", "user", "repo", "branch", "team"] }).notNull().default("global"),
+    owner_user_id: (0, import_sqlite_core.text)("owner_user_id", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    repo_id: (0, import_sqlite_core.text)("repo_id", { length: 36 }).references(() => repos2.repo_id, {
+      onDelete: "set null"
+    }),
+    branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).references(() => branches2.branch_id, {
+      onDelete: "set null"
+    }),
+    visibility_default: (0, import_sqlite_core.text)("visibility_default", { enum: ["public", "private"] }).notNull().default("public"),
+    others_can: (0, import_sqlite_core.text)("others_can", { enum: ["none", "read", "write"] }).notNull().default("write"),
+    metadata: t2.json("metadata"),
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at")
+  },
+  (table) => ({
+    slugIdx: (0, import_sqlite_core.uniqueIndex)("kb_namespaces_slug_idx").on(table.slug).where(import_drizzle_orm3.sql`${table.archived} = false`),
+    kindIdx: (0, import_sqlite_core.index)("kb_namespaces_kind_idx").on(table.kind),
+    ownerIdx: (0, import_sqlite_core.index)("kb_namespaces_owner_idx").on(table.owner_user_id),
+    repoIdx: (0, import_sqlite_core.index)("kb_namespaces_repo_idx").on(table.repo_id),
+    branchIdx: (0, import_sqlite_core.index)("kb_namespaces_branch_idx").on(table.branch_id),
+    archivedIdx: (0, import_sqlite_core.index)("kb_namespaces_archived_idx").on(table.archived)
+  })
+);
+var kbNamespaceAcl2 = (0, import_sqlite_core.sqliteTable)(
+  "kb_namespace_acl",
+  {
+    namespace_acl_id: (0, import_sqlite_core.text)("namespace_acl_id", { length: 36 }).primaryKey(),
+    namespace_id: (0, import_sqlite_core.text)("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces2.namespace_id, { onDelete: "cascade" }),
+    subject_type: (0, import_sqlite_core.text)("subject_type", { enum: ["user", "group"] }).notNull(),
+    subject_id: (0, import_sqlite_core.text)("subject_id", { length: 36 }).notNull(),
+    permission: (0, import_sqlite_core.text)("permission", { enum: ["read", "write", "own"] }).notNull(),
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at")
+  },
+  (table) => ({
+    namespaceIdx: (0, import_sqlite_core.index)("kb_namespace_acl_namespace_idx").on(table.namespace_id),
+    subjectIdx: (0, import_sqlite_core.index)("kb_namespace_acl_subject_idx").on(table.subject_type, table.subject_id),
+    namespaceSubjectIdx: (0, import_sqlite_core.uniqueIndex)("kb_namespace_acl_namespace_subject_idx").on(
+      table.namespace_id,
+      table.subject_type,
+      table.subject_id
+    )
+  })
+);
+var kbDocuments2 = (0, import_sqlite_core.sqliteTable)(
+  "kb_documents",
+  {
+    document_id: (0, import_sqlite_core.text)("document_id", { length: 36 }).primaryKey(),
+    namespace_id: (0, import_sqlite_core.text)("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces2.namespace_id, { onDelete: "cascade" }),
+    path: (0, import_sqlite_core.text)("path").notNull(),
+    uri: (0, import_sqlite_core.text)("uri").notNull(),
+    title: (0, import_sqlite_core.text)("title").notNull(),
+    icon_emoji: (0, import_sqlite_core.text)("icon_emoji"),
+    kind: (0, import_sqlite_core.text)("kind", {
+      enum: ["doc", "memory", "skill", "prompt", "guide", "decision", "bundle", "external"]
+    }).notNull().default("doc"),
+    visibility: (0, import_sqlite_core.text)("visibility", { enum: ["public", "private"] }).notNull().default("public"),
+    status: (0, import_sqlite_core.text)("status", { enum: ["draft", "published"] }).notNull().default("published"),
+    edit_policy: (0, import_sqlite_core.text)("edit_policy", { enum: ["owner", "public", "admins"] }).notNull().default("owner"),
+    // Application-maintained pointer. Avoids a circular FK with versions.
+    current_version_id: (0, import_sqlite_core.text)("current_version_id", { length: 36 }),
+    metadata: t2.json("metadata"),
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_by: (0, import_sqlite_core.text)("updated_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    updated_at: t2.timestamp("updated_at"),
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at")
+  },
+  (table) => ({
+    namespacePathIdx: (0, import_sqlite_core.uniqueIndex)("kb_documents_namespace_path_idx").on(table.namespace_id, table.path).where(import_drizzle_orm3.sql`${table.archived} = false`),
+    uriIdx: (0, import_sqlite_core.uniqueIndex)("kb_documents_uri_idx").on(table.uri).where(import_drizzle_orm3.sql`${table.archived} = false`),
+    namespaceIdx: (0, import_sqlite_core.index)("kb_documents_namespace_idx").on(table.namespace_id),
+    kindIdx: (0, import_sqlite_core.index)("kb_documents_kind_idx").on(table.kind),
+    visibilityIdx: (0, import_sqlite_core.index)("kb_documents_visibility_idx").on(table.visibility),
+    statusIdx: (0, import_sqlite_core.index)("kb_documents_status_idx").on(table.status),
+    createdByIdx: (0, import_sqlite_core.index)("kb_documents_created_by_idx").on(table.created_by),
+    updatedAtIdx: (0, import_sqlite_core.index)("kb_documents_updated_at_idx").on(table.updated_at),
+    archivedIdx: (0, import_sqlite_core.index)("kb_documents_archived_idx").on(table.archived)
+  })
+);
+var kbDocumentVersions2 = (0, import_sqlite_core.sqliteTable)(
+  "kb_document_versions",
+  {
+    version_id: (0, import_sqlite_core.text)("version_id", { length: 36 }).primaryKey(),
+    document_id: (0, import_sqlite_core.text)("document_id", { length: 36 }).notNull().references(() => kbDocuments2.document_id, { onDelete: "cascade" }),
+    version_number: (0, import_sqlite_core.integer)("version_number").notNull(),
+    content_text: (0, import_sqlite_core.text)("content_text"),
+    content_blob: (0, import_sqlite_core.blob)("content_blob"),
+    mime_type: (0, import_sqlite_core.text)("mime_type").notNull().default("text/markdown"),
+    content_md5: (0, import_sqlite_core.text)("content_md5"),
+    content_sha256: (0, import_sqlite_core.text)("content_sha256"),
+    byte_length: (0, import_sqlite_core.integer)("byte_length"),
+    char_length: (0, import_sqlite_core.integer)("char_length"),
+    frontmatter: t2.json("frontmatter"),
+    metadata: t2.json("metadata"),
+    change_summary: (0, import_sqlite_core.text)("change_summary"),
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull()
+  },
+  (table) => ({
+    documentVersionIdx: (0, import_sqlite_core.uniqueIndex)("kb_document_versions_document_version_idx").on(
+      table.document_id,
+      table.version_number
+    ),
+    documentIdx: (0, import_sqlite_core.index)("kb_document_versions_document_idx").on(table.document_id),
+    createdIdx: (0, import_sqlite_core.index)("kb_document_versions_created_idx").on(table.created_at),
+    md5Idx: (0, import_sqlite_core.index)("kb_document_versions_md5_idx").on(table.content_md5)
+  })
+);
+var kbDocumentUnits2 = (0, import_sqlite_core.sqliteTable)(
+  "kb_document_units",
+  {
+    unit_id: (0, import_sqlite_core.text)("unit_id", { length: 36 }).primaryKey(),
+    document_id: (0, import_sqlite_core.text)("document_id", { length: 36 }).notNull().references(() => kbDocuments2.document_id, { onDelete: "cascade" }),
+    version_id: (0, import_sqlite_core.text)("version_id", { length: 36 }).notNull().references(() => kbDocumentVersions2.version_id, { onDelete: "cascade" }),
+    kind: (0, import_sqlite_core.text)("kind", { enum: ["document", "section", "file", "auto_split"] }).notNull().default("document"),
+    ordinal: (0, import_sqlite_core.integer)("ordinal").notNull().default(0),
+    path_anchor: (0, import_sqlite_core.text)("path_anchor"),
+    heading_path: (0, import_sqlite_core.text)("heading_path"),
+    source_path: (0, import_sqlite_core.text)("source_path"),
+    content_text: (0, import_sqlite_core.text)("content_text"),
+    content_md5: (0, import_sqlite_core.text)("content_md5"),
+    start_offset: (0, import_sqlite_core.integer)("start_offset"),
+    end_offset: (0, import_sqlite_core.integer)("end_offset"),
+    embedding_status: (0, import_sqlite_core.text)("embedding_status", {
+      enum: ["not_configured", "pending", "ready", "stale", "error"]
+    }).notNull().default("not_configured"),
+    embedding_model: (0, import_sqlite_core.text)("embedding_model"),
+    embedding_dimensions: (0, import_sqlite_core.integer)("embedding_dimensions"),
+    embedding_hash: (0, import_sqlite_core.text)("embedding_hash"),
+    embedding_error: (0, import_sqlite_core.text)("embedding_error"),
+    metadata: t2.json("metadata"),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at")
+  },
+  (table) => ({
+    documentIdx: (0, import_sqlite_core.index)("kb_document_units_document_idx").on(table.document_id),
+    versionIdx: (0, import_sqlite_core.index)("kb_document_units_version_idx").on(table.version_id),
+    versionOrdinalIdx: (0, import_sqlite_core.index)("kb_document_units_version_ordinal_idx").on(
+      table.version_id,
+      table.ordinal
+    ),
+    contentHashIdx: (0, import_sqlite_core.index)("kb_document_units_content_hash_idx").on(table.content_md5),
+    embeddingStatusIdx: (0, import_sqlite_core.index)("kb_document_units_embedding_status_idx").on(table.embedding_status)
+  })
+);
+var kbEmbeddingSpaces2 = (0, import_sqlite_core.sqliteTable)(
+  "kb_embedding_spaces",
+  {
+    embedding_space_id: (0, import_sqlite_core.text)("embedding_space_id", { length: 36 }).primaryKey(),
+    provider: (0, import_sqlite_core.text)("provider").notNull(),
+    model: (0, import_sqlite_core.text)("model").notNull(),
+    dimensions: (0, import_sqlite_core.integer)("dimensions").notNull(),
+    storage_type: (0, import_sqlite_core.text)("storage_type").notNull().default("vector"),
+    distance: (0, import_sqlite_core.text)("distance").notNull().default("cosine"),
+    active: t2.bool("active").notNull().default(true),
+    metadata: t2.json("metadata"),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at")
+  },
+  (table) => ({
+    providerModelIdx: (0, import_sqlite_core.uniqueIndex)("kb_embedding_spaces_provider_model_idx").on(
+      table.provider,
+      table.model,
+      table.dimensions,
+      table.storage_type,
+      table.distance
+    ),
+    activeIdx: (0, import_sqlite_core.index)("kb_embedding_spaces_active_idx").on(table.active)
+  })
+);
+var kbGraphNodes2 = (0, import_sqlite_core.sqliteTable)(
+  "kb_graph_nodes",
+  {
+    node_id: (0, import_sqlite_core.text)("node_id", { length: 36 }).primaryKey(),
+    node_type: (0, import_sqlite_core.text)("node_type", {
+      enum: [
+        "namespace",
+        "document",
+        "document_unit",
+        "branch",
+        "session",
+        "task",
+        "message",
+        "artifact",
+        "repo",
+        "board",
+        "user",
+        "tag",
+        "external"
+      ]
+    }).notNull(),
+    uri: (0, import_sqlite_core.text)("uri").notNull(),
+    label: (0, import_sqlite_core.text)("label"),
+    namespace_id: (0, import_sqlite_core.text)("namespace_id", { length: 36 }).references(() => kbNamespaces2.namespace_id, {
+      onDelete: "cascade"
+    }),
+    document_id: (0, import_sqlite_core.text)("document_id", { length: 36 }).references(() => kbDocuments2.document_id, {
+      onDelete: "cascade"
+    }),
+    unit_id: (0, import_sqlite_core.text)("unit_id", { length: 36 }).references(() => kbDocumentUnits2.unit_id, {
+      onDelete: "cascade"
+    }),
+    branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).references(() => branches2.branch_id, {
+      onDelete: "cascade"
+    }),
+    session_id: (0, import_sqlite_core.text)("session_id", { length: 36 }).references(() => sessions2.session_id, {
+      onDelete: "cascade"
+    }),
+    task_id: (0, import_sqlite_core.text)("task_id", { length: 36 }).references(() => tasks2.task_id, {
+      onDelete: "cascade"
+    }),
+    message_id: (0, import_sqlite_core.text)("message_id", { length: 36 }).references(() => messages2.message_id, {
+      onDelete: "cascade"
+    }),
+    artifact_id: (0, import_sqlite_core.text)("artifact_id", { length: 36 }).references(() => artifacts2.artifact_id, {
+      onDelete: "cascade"
+    }),
+    repo_id: (0, import_sqlite_core.text)("repo_id", { length: 36 }).references(() => repos2.repo_id, {
+      onDelete: "cascade"
+    }),
+    board_id: (0, import_sqlite_core.text)("board_id", { length: 36 }).references(() => boards2.board_id, {
+      onDelete: "cascade"
+    }),
+    user_id: (0, import_sqlite_core.text)("user_id", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "cascade"
+    }),
+    external_uri: (0, import_sqlite_core.text)("external_uri"),
+    metadata: t2.json("metadata"),
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    updated_at: t2.timestamp("updated_at"),
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at")
+  },
+  (table) => ({
+    uriIdx: (0, import_sqlite_core.uniqueIndex)("kb_graph_nodes_uri_idx").on(table.uri).where(import_drizzle_orm3.sql`${table.archived} = false`),
+    typeIdx: (0, import_sqlite_core.index)("kb_graph_nodes_type_idx").on(table.node_type),
+    namespaceIdx: (0, import_sqlite_core.index)("kb_graph_nodes_namespace_idx").on(table.namespace_id),
+    documentIdx: (0, import_sqlite_core.index)("kb_graph_nodes_document_idx").on(table.document_id),
+    unitIdx: (0, import_sqlite_core.index)("kb_graph_nodes_unit_idx").on(table.unit_id),
+    branchIdx: (0, import_sqlite_core.index)("kb_graph_nodes_branch_idx").on(table.branch_id),
+    sessionIdx: (0, import_sqlite_core.index)("kb_graph_nodes_session_idx").on(table.session_id),
+    taskIdx: (0, import_sqlite_core.index)("kb_graph_nodes_task_idx").on(table.task_id),
+    messageIdx: (0, import_sqlite_core.index)("kb_graph_nodes_message_idx").on(table.message_id),
+    artifactIdx: (0, import_sqlite_core.index)("kb_graph_nodes_artifact_idx").on(table.artifact_id),
+    repoIdx: (0, import_sqlite_core.index)("kb_graph_nodes_repo_idx").on(table.repo_id),
+    boardIdx: (0, import_sqlite_core.index)("kb_graph_nodes_board_idx").on(table.board_id),
+    userIdx: (0, import_sqlite_core.index)("kb_graph_nodes_user_idx").on(table.user_id),
+    externalUriIdx: (0, import_sqlite_core.index)("kb_graph_nodes_external_uri_idx").on(table.external_uri),
+    archivedIdx: (0, import_sqlite_core.index)("kb_graph_nodes_archived_idx").on(table.archived)
+  })
+);
+var kbGraphEdges2 = (0, import_sqlite_core.sqliteTable)(
+  "kb_graph_edges",
+  {
+    edge_id: (0, import_sqlite_core.text)("edge_id", { length: 36 }).primaryKey(),
+    source_node_id: (0, import_sqlite_core.text)("source_node_id", { length: 36 }).notNull().references(() => kbGraphNodes2.node_id, { onDelete: "cascade" }),
+    target_node_id: (0, import_sqlite_core.text)("target_node_id", { length: 36 }).notNull().references(() => kbGraphNodes2.node_id, { onDelete: "cascade" }),
+    edge_type: (0, import_sqlite_core.text)("edge_type", {
+      enum: [
+        "contains",
+        "references",
+        "mentions",
+        "implements",
+        "depends_on",
+        "supersedes",
+        "derived_from",
+        "tagged_with",
+        "about",
+        "parent_of",
+        "related_to"
+      ]
+    }).notNull(),
+    confidence: (0, import_sqlite_core.integer)("confidence"),
+    properties: t2.json("properties"),
+    created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).references(() => users2.user_id, {
+      onDelete: "set null"
+    }),
+    created_at: t2.timestamp("created_at").notNull(),
+    archived: t2.bool("archived").notNull().default(false),
+    archived_at: t2.timestamp("archived_at")
+  },
+  (table) => ({
+    sourceIdx: (0, import_sqlite_core.index)("kb_graph_edges_source_idx").on(table.source_node_id),
+    targetIdx: (0, import_sqlite_core.index)("kb_graph_edges_target_idx").on(table.target_node_id),
+    typeIdx: (0, import_sqlite_core.index)("kb_graph_edges_type_idx").on(table.edge_type),
+    sourceTypeIdx: (0, import_sqlite_core.index)("kb_graph_edges_source_type_idx").on(
+      table.source_node_id,
+      table.edge_type
+    ),
+    targetTypeIdx: (0, import_sqlite_core.index)("kb_graph_edges_target_type_idx").on(
+      table.target_node_id,
+      table.edge_type
+    ),
+    sourceTargetTypeIdx: (0, import_sqlite_core.uniqueIndex)("kb_graph_edges_source_target_type_idx").on(table.source_node_id, table.target_node_id, table.edge_type).where(import_drizzle_orm3.sql`${table.archived} = false`),
+    archivedIdx: (0, import_sqlite_core.index)("kb_graph_edges_archived_idx").on(table.archived)
+  })
+);
+var sessionsRelations2 = (0, import_drizzle_orm3.relations)(sessions2, ({ one, many }) => ({
+  branch: one(branches2, {
+    fields: [sessions2.branch_id],
+    references: [branches2.branch_id]
+  }),
+  schedule: one(schedules2, {
+    fields: [sessions2.schedule_id],
+    references: [schedules2.schedule_id]
+  }),
+  outboundRelationships: many(sessionRelationships2, { relationName: "relationshipSource" }),
+  inboundRelationships: many(sessionRelationships2, { relationName: "relationshipTarget" })
+}));
+var sessionRelationshipsRelations2 = (0, import_drizzle_orm3.relations)(sessionRelationships2, ({ one }) => ({
+  sourceSession: one(sessions2, {
+    fields: [sessionRelationships2.source_session_id],
+    references: [sessions2.session_id],
+    relationName: "relationshipSource"
+  }),
+  targetSession: one(sessions2, {
+    fields: [sessionRelationships2.target_session_id],
+    references: [sessions2.session_id],
+    relationName: "relationshipTarget"
+  }),
+  callbackSession: one(sessions2, {
+    fields: [sessionRelationships2.callback_session_id],
+    references: [sessions2.session_id]
+  })
+}));
+var branchesRelations2 = (0, import_drizzle_orm3.relations)(branches2, ({ many }) => ({
+  sessions: many(sessions2),
+  schedules: many(schedules2)
+}));
+var schedulesRelations2 = (0, import_drizzle_orm3.relations)(schedules2, ({ one, many }) => ({
+  branch: one(branches2, {
+    fields: [schedules2.branch_id],
+    references: [branches2.branch_id]
+  }),
+  sessions: many(sessions2)
+}));
+
+// src/config/config-manager.ts
+var import_node_fs = require("fs");
+var import_promises = __toESM(require("fs/promises"), 1);
+var import_node_os = __toESM(require("os"), 1);
+var import_node_path = __toESM(require("path"), 1);
+var yaml = __toESM(require("js-yaml"), 1);
+
+// src/config/analytics-defaults.ts
+function getDefaultAnalyticsConfig() {
+  return {
+    enabled: false,
+    client: {
+      app: "agor-daemon",
+      version: "dev",
+      debug: false
+    },
+    filters: {
+      exclude_events: []
+    },
+    plugins: [
+      {
+        type: "stdout",
+        enabled: false,
+        options: {
+          pretty: false
+        }
+      },
+      {
+        type: "http_batch",
+        enabled: false,
+        options: {
+          url: null,
+          flush_interval_ms: 1e3,
+          max_batch_size: 50,
+          timeout_ms: 3e3,
+          headers: {}
+        }
+      },
+      {
+        type: "module",
+        enabled: false,
+        options: {
+          module_path: null,
+          export_name: "createAnalyticsPlugin",
+          plugin_options: {}
+        }
+      }
+    ]
+  };
+}
+
+// src/config/constants.ts
+var DAEMON = {
+  /**
+   * Default daemon port
+   */
+  DEFAULT_PORT: 3030,
+  /**
+   * Default daemon host
+   */
+  DEFAULT_HOST: "localhost"
+};
+var MCP_TOKEN = {
+  /**
+   * Default lifetime for internal MCP session tokens in milliseconds.
+   * Keep short to bound the blast radius of a leaked token — there is no
+   * revocation mechanism; `exp` is the only backstop.
+   */
+  DEFAULT_EXPIRATION_MS: 24 * 60 * 60 * 1e3
+  // 24 hours
+};
+
+// src/config/executor-heartbeat.ts
+var EXECUTOR_HEARTBEAT_DEFAULT_INTERVAL_MS = 1e4;
+var EXECUTOR_HEARTBEAT_MIN_STALE_AFTER_MS = 3e4;
+var EXECUTOR_HEARTBEAT_DEFAULT_CALLBACK_TIMEOUT_MS = 3e3;
+function positiveIntegerOrDefault(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
+}
+function resolveExecutorHeartbeatConfig(execution) {
+  const raw = execution?.executor_heartbeat;
+  const intervalMs = positiveIntegerOrDefault(
+    raw?.interval_ms,
+    EXECUTOR_HEARTBEAT_DEFAULT_INTERVAL_MS
+  );
+  const staleAfterMs = positiveIntegerOrDefault(
+    raw?.stale_after_ms,
+    Math.max(3 * intervalMs, EXECUTOR_HEARTBEAT_MIN_STALE_AFTER_MS)
+  );
+  const timeoutMs = positiveIntegerOrDefault(
+    raw?.callback?.timeout_ms,
+    EXECUTOR_HEARTBEAT_DEFAULT_CALLBACK_TIMEOUT_MS
+  );
+  return {
+    // Default enabled: the heartbeat is a lightweight task-row timestamp patch,
+    // and callback execution remains opt-in via command_template.
+    enabled: raw?.enabled ?? true,
+    interval_ms: intervalMs,
+    stale_after_ms: staleAfterMs,
+    callback: {
+      command_template: raw?.callback?.command_template ?? null,
+      timeout_ms: timeoutMs
+    }
+  };
+}
+
+// src/config/multitenancy.ts
+var DEFAULT_STATIC_TENANT_ID = "default";
+var RESERVED_AUTH_CLAIMS = /* @__PURE__ */ new Set(["aud", "exp", "iat", "iss", "jti", "nbf", "sub", "type"]);
+function detectPostgresUrl(url) {
+  if (!url) return false;
+  const lower = url.toLowerCase();
+  return lower.startsWith("postgresql://") || lower.startsWith("postgres://") || lower.startsWith("pg://");
+}
+function resolveMultiTenancyDatabaseDialect(config = {}) {
+  if (process.env.AGOR_DB_DIALECT === "postgresql" || process.env.AGOR_DB_DIALECT === "sqlite") {
+    return process.env.AGOR_DB_DIALECT;
+  }
+  if (detectPostgresUrl(process.env.DATABASE_URL)) return "postgresql";
+  if (config.database?.dialect === "postgresql" || config.database?.dialect === "sqlite") {
+    return config.database.dialect;
+  }
+  if (detectPostgresUrl(config.database?.postgresql?.url) || config.database?.postgresql?.host) {
+    return "postgresql";
+  }
+  return "sqlite";
+}
+function resolveMultiTenancyConfig(config) {
+  const raw = config.multi_tenancy ?? {};
+  const mode = raw.mode ?? "static";
+  return {
+    mode,
+    static_tenant_id: raw.static_tenant_id?.trim() || DEFAULT_STATIC_TENANT_ID,
+    ...raw.auth_claim ? { auth_claim: raw.auth_claim } : {},
+    ...raw.trusted_header ? { trusted_header: raw.trusted_header } : {}
+  };
+}
+function assertValidMultiTenancyConfig(config) {
+  const resolved = resolveMultiTenancyConfig(config);
+  if (resolved.mode !== "static" && resolved.mode !== "required_from_auth") {
+    throw new Error("Config error: multi_tenancy.mode must be one of: static, required_from_auth");
+  }
+  if (!resolved.static_tenant_id) {
+    throw new Error("Config error: multi_tenancy.static_tenant_id must not be empty");
+  }
+  if (resolved.auth_claim && RESERVED_AUTH_CLAIMS.has(resolved.auth_claim)) {
+    throw new Error(
+      `Config error: multi_tenancy.auth_claim cannot be reserved JWT claim '${resolved.auth_claim}'`
+    );
+  }
+  if (resolved.mode === "required_from_auth") {
+    if (resolveMultiTenancyDatabaseDialect(config) !== "postgresql") {
+      throw new Error(
+        "Config error: multi_tenancy.required_from_auth requires database.dialect: postgresql"
+      );
+    }
+    if (!resolved.auth_claim && !resolved.trusted_header) {
+      throw new Error(
+        "Config error: multi_tenancy.required_from_auth requires multi_tenancy.auth_claim or multi_tenancy.trusted_header"
+      );
+    }
+  }
+}
+
+// src/config/config-manager.ts
+var NO_FILE = -1;
+var NO_FILE_KEY = { mtimeMs: NO_FILE, size: 0 };
+var cachedEntry = null;
+function cacheKeyMatches(a, b) {
+  return a.mtimeMs === b.mtimeMs && a.size === b.size;
+}
+function statCacheKey(configPath) {
+  try {
+    const stat = (0, import_node_fs.statSync)(configPath);
+    return { mtimeMs: stat.mtimeMs, size: stat.size };
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return NO_FILE_KEY;
+    }
+    return null;
+  }
+}
+function readCachedConfig(configPath) {
+  if (cachedEntry === null || cachedEntry.path !== configPath) {
+    return null;
+  }
+  const currentKey = statCacheKey(configPath);
+  if (currentKey === null || !cacheKeyMatches(currentKey, cachedEntry.key)) {
+    return null;
+  }
+  return structuredClone(cachedEntry.config);
+}
+function writeCachedConfig(configPath, config, key) {
+  cachedEntry = { path: configPath, config: structuredClone(config), key };
+}
+function parseAndValidateConfig(content) {
+  if (content.trim() === "") {
+    return {};
+  }
+  const parsed = yaml.load(content);
+  const finalConfig = parsed || {};
+  validateConfig(finalConfig);
+  return finalConfig;
+}
+function getAgorHome() {
+  return import_node_path.default.join(import_node_os.default.homedir(), ".agor");
+}
+function getConfigPath() {
+  return import_node_path.default.join(getAgorHome(), "config.yaml");
+}
+function validateConfig(config) {
+  const mode = config.execution?.unix_user_mode;
+  if (mode === "opportunistic") {
+    throw new Error(
+      `Config error: 'opportunistic' unix_user_mode has been deprecated.
+Please update your config to use one of:
+  - 'insulated': Filesystem isolation via Unix groups (recommended)
+  - 'strict': Full process impersonation required
+
+To update: agor config set execution.unix_user_mode insulated`
+    );
+  }
+  const managedEnvExecutionMode = config.execution?.managed_envs_execution_mode;
+  if (managedEnvExecutionMode !== void 0 && managedEnvExecutionMode !== "hybrid" && managedEnvExecutionMode !== "webhook-only") {
+    throw new Error(
+      `Config error: execution.managed_envs_execution_mode must be one of: hybrid, webhook-only`
+    );
+  }
+  assertValidMultiTenancyConfig(config);
+  validateOptionalHttpUrl(
+    config.external_launch,
+    "login_redirect_url",
+    "external_launch.login_redirect_url"
+  );
+}
+function validateOptionalHttpUrl(container, key, configPath) {
+  if (!container || container[key] === void 0) return;
+  const raw = container[key];
+  if (typeof raw !== "string") {
+    throw new Error(`Config error: ${configPath} must be an HTTP(S) URL string`);
+  }
+  container[key] = validateHttpUrlString(raw, configPath);
+}
+function validateHttpUrlString(url, label, options = {}) {
+  const trimmed = options.stripTrailingSlash ? url.trim().replace(/\/$/, "") : url.trim();
+  if (!trimmed.startsWith("http://") && !trimmed.startsWith("https://")) {
+    throw new Error(`Invalid ${label}: "${url}". Must start with http:// or https://`);
+  }
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new Error(`Invalid ${label} format: "${url}". Must be a valid HTTP(S) URL.`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`Invalid ${label}: "${url}". Must use http:// or https://`);
+  }
+  return trimmed;
+}
+function getDefaultConfig() {
+  return {
+    defaults: {
+      board: "main",
+      agent: "claude-code"
+    },
+    display: {
+      tableStyle: "unicode",
+      colorOutput: true
+    },
+    daemon: {
+      port: DAEMON.DEFAULT_PORT,
+      host: DAEMON.DEFAULT_HOST,
+      mcpEnabled: true
+      // Default: Enable built-in MCP server
+    },
+    ui: {
+      port: 5173,
+      host: "localhost"
+    },
+    execution: {
+      session_token_expiration_ms: 864e5,
+      // 24 hours
+      session_token_max_uses: 1,
+      // Single-use tokens
+      mcp_token_expiration_ms: MCP_TOKEN.DEFAULT_EXPIRATION_MS,
+      sync_unix_passwords: true,
+      // Default: sync passwords to Unix
+      executor_heartbeat: resolveExecutorHeartbeatConfig()
+    },
+    analytics: getDefaultAnalyticsConfig(),
+    telemetry: {},
+    multi_tenancy: {
+      mode: "static",
+      static_tenant_id: "default"
+    }
+  };
+}
+function loadConfigSync() {
+  const configPath = getConfigPath();
+  const cached = readCachedConfig(configPath);
+  if (cached !== null) {
+    return cached;
+  }
+  let beforeKey;
+  let content;
+  let afterKey;
+  try {
+    beforeKey = statCacheKey(configPath);
+    if (beforeKey?.mtimeMs === NO_FILE) {
+      const defaults = getDefaultConfig();
+      writeCachedConfig(configPath, defaults, NO_FILE_KEY);
+      return defaults;
+    }
+    content = (0, import_node_fs.readFileSync)(configPath, "utf-8");
+    afterKey = statCacheKey(configPath);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      const defaults = getDefaultConfig();
+      writeCachedConfig(configPath, defaults, NO_FILE_KEY);
+      return defaults;
+    }
+    throw new Error(
+      `Failed to load config: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  let finalConfig;
+  try {
+    finalConfig = parseAndValidateConfig(content);
+  } catch (error) {
+    throw new Error(
+      `Failed to load config: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (beforeKey !== null && afterKey !== null && cacheKeyMatches(beforeKey, afterKey)) {
+    writeCachedConfig(configPath, finalConfig, beforeKey);
+  }
+  return finalConfig;
+}
+
+// src/db/schema-factory.ts
+function detectDialectFromUrl(url) {
+  if (!url) return null;
+  const lowerUrl = url.toLowerCase();
+  if (lowerUrl.startsWith("postgresql://") || lowerUrl.startsWith("postgres://") || lowerUrl.startsWith("pg://")) {
+    return "postgresql";
+  }
+  if (lowerUrl.startsWith("file:") || lowerUrl.startsWith("libsql://") || lowerUrl.startsWith("http://") || lowerUrl.startsWith("https://")) {
+    return "sqlite";
+  }
+  return null;
+}
+function getDatabaseDialect() {
+  const envDialect = process.env.AGOR_DB_DIALECT;
+  if (envDialect === "postgresql" || envDialect === "sqlite") {
+    return envDialect;
+  }
+  const databaseUrl = process.env.DATABASE_URL;
+  if (databaseUrl) {
+    const detected = detectDialectFromUrl(databaseUrl);
+    if (detected) {
+      return detected;
+    }
+  }
+  try {
+    const config = loadConfigSync();
+    if (config.database?.dialect === "postgresql" || config.database?.dialect === "sqlite") {
+      return config.database.dialect;
+    }
+    if (config.database?.postgresql?.url) {
+      const detected = detectDialectFromUrl(config.database.postgresql.url);
+      if (detected) return detected;
+    }
+  } catch {
+  }
+  return "sqlite";
+}
+
+// src/db/schema.ts
+var dialect = getDatabaseDialect();
+var schema = dialect === "postgresql" ? schema_postgres_exports : schema_sqlite_exports;
+var sessions3 = schema.sessions;
+var tasks3 = schema.tasks;
+var messages3 = schema.messages;
+var boards3 = schema.boards;
+var repos3 = schema.repos;
+var branches3 = schema.branches;
+var branchOwners3 = schema.branchOwners;
+var boardOwners3 = schema.boardOwners;
+var groups3 = schema.groups;
+var groupMemberships3 = schema.groupMemberships;
+var branchGroupGrants3 = schema.branchGroupGrants;
+var boardGroupGrants3 = schema.boardGroupGrants;
+var schedules3 = schema.schedules;
+var users3 = schema.users;
+var appVariables3 = schema.appVariables;
+var mcpServers3 = schema.mcpServers;
+var cardTypes3 = schema.cardTypes;
+var cards3 = schema.cards;
+var artifacts3 = schema.artifacts;
+var artifactTrustGrants3 = schema.artifactTrustGrants;
+var boardObjects3 = schema.boardObjects;
+var sessionMcpServers3 = schema.sessionMcpServers;
+var sessionRelationships3 = schema.sessionRelationships;
+var sessionEnvSelections3 = schema.sessionEnvSelections;
+var userMcpOauthTokens3 = schema.userMcpOauthTokens;
+var boardComments3 = schema.boardComments;
+var gatewayChannels3 = schema.gatewayChannels;
+var threadSessionMap3 = schema.threadSessionMap;
+var gatewayOutboundMessages3 = schema.gatewayOutboundMessages;
+var userApiKeys3 = schema.userApiKeys;
+var serializedSessions3 = schema.serializedSessions;
+var kbNamespaces3 = schema.kbNamespaces;
+var kbNamespaceAcl3 = schema.kbNamespaceAcl;
+var kbDocuments3 = schema.kbDocuments;
+var kbDocumentVersions3 = schema.kbDocumentVersions;
+var kbDocumentUnits3 = schema.kbDocumentUnits;
+var kbEmbeddingSpaces3 = schema.kbEmbeddingSpaces;
+var kbGraphNodes3 = schema.kbGraphNodes;
+var kbGraphEdges3 = schema.kbGraphEdges;
+
+// src/lib/ids.ts
+var import_node_crypto2 = require("crypto");
+var import_uuid = require("uuid");
+
+// src/config/env-blocklist.ts
+var BLOCKED_ENV_PATTERNS = Object.freeze([
+  /^LD_/i,
+  /^DYLD_/i,
+  /^PYTHON(?!_AGOR_)/i
+]);
+
+// src/config/env-vars.ts
+var V05_SCOPES = ["global", "session"];
+var V05_SCOPE_SET = new Set(V05_SCOPES);
+
+// src/templates/handlebars-helpers.ts
+var import_handlebars = __toESM(require("handlebars"), 1);
+
+// src/mcp/template-patterns.ts
+var USER_ENV_PLACEHOLDER_RE = /^\{\{\s*user\.env\.[A-Za-z_][A-Za-z0-9_]*\s*\}\}$/;
+function isUserEnvPlaceholder(value) {
+  return USER_ENV_PLACEHOLDER_RE.test(value.trim());
+}
+
+// src/mcp/template-resolver.ts
+var TEMPLATE_RESOLVABLE_MCP_AUTH_SECRET_FIELDS = [
+  "token",
+  "api_token",
+  "api_secret",
+  "oauth_client_secret"
+];
+
 // src/tools/mcp/http-headers.ts
 var MCP_HEADER_REDACTED_SENTINEL = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 
@@ -43,11 +3496,15 @@ function redactMCPAuthSecrets(auth) {
   let changed = false;
   const redacted = { ...auth };
   const record = redacted;
+  const templateResolvable = new Set(TEMPLATE_RESOLVABLE_MCP_AUTH_SECRET_FIELDS);
   for (const field of MCP_AUTH_SECRET_FIELDS) {
-    if (redacted[field] !== void 0) {
-      record[field] = MCP_HEADER_REDACTED_SENTINEL;
-      changed = true;
+    const value = redacted[field];
+    if (value === void 0) continue;
+    if (templateResolvable.has(field) && typeof value === "string" && isUserEnvPlaceholder(value)) {
+      continue;
     }
+    record[field] = MCP_HEADER_REDACTED_SENTINEL;
+    changed = true;
   }
   return changed ? redacted : auth;
 }