diff --git a/.agents/skills/minimal-sufficient-work/SKILL.md b/.agents/skills/minimal-sufficient-work/SKILL.md
new file mode 100644
index 000000000..f52b76f95
--- /dev/null
+++ b/.agents/skills/minimal-sufficient-work/SKILL.md
@@ -0,0 +1,120 @@
+---
+name: minimal-sufficient-work
+description: "Use when MSW is invoked or work risks expanding beyond the requested scope."
+---
+
+# Minimal Sufficient Work (MSW)
+
+Use the MSW kernel to complete the requested outcome without speculative work, extra process, or proof beyond what the outcome requires.
+
+## Program
+
+```
+contract ← the requested outcome + the smallest criteria that prove it
+
+while ∃ claim c : deleting c leaves contract unmet ∨ unproven
+      do c ; prove c
+
+halt ; report
+```
+
+## Definitions
+
+### Contract
+
+Establish the requested outcome and the smallest set of acceptance criteria that would prove it before doing work. Treat the contract as both the floor and the ceiling.
+
+When the request is ambiguous:
+
+- In attended work, ask only when the answer would materially change the contract.
+- In unattended work, bind the smallest reading consistent with the stated intent and record the assumption.
+
+Do not silently expand the contract with inferred improvements, generic best practices, or unrelated cleanup.
+
+### Claim
+
+Treat anything petitioning to become work as a claim, including:
+
+- a plan step or implementation change
+- a test, check, investigation, or proof step
+- a new file, abstraction, dependency, artifact, or process
+- a review finding or discovered edge case
+- a migration, rollout control, monitoring change, or cleanup task
+- an instinct that another pass would be useful
+
+A claim is a proposal, not a verdict. Its source or stated severity does not make it necessary.
+
+### Deletion Rule
+
+For every claim `c`, ask:
+
+> If `c` is deleted, does the contract remain met and proven for the task's actual inputs, environment, and applicable constraints?
+
+- If yes, reject the claim. Do not implement, investigate, defer, or create follow-up work for it.
+- If no, accept the claim and perform the smallest reliable act that closes the specific gap.
+
+A claim passes only when deleting it leaves the contract unmet or unproven. Useful, thorough, conventional, and possible are not synonyms for necessary. Derive severity from impact on the contract, not from the person or tool that raised the claim.
+
+### Do and Prove
+
+For each accepted claim:
+
+1. Perform the smallest reliable act that closes the gap.
+2. Produce evidence sized to that claim.
+3. Close the claim when the evidence proves it.
+
+An unproven act leaves its claim open. Re-proving a closed claim is a new claim and must pass the deletion rule.
+
+Use evidence appropriate to the gap, such as a focused test, command output, direct inspection, reproduced behavior, type check, build result, or authoritative documentation. Do not add a broader test or review pass unless deleting it would leave the contract unproven.
+
+### Halt
+
+Stop when the contract is proven and no remaining claim passes the deletion rule. Reviewer silence and exhausted imagination are not stopping conditions. Continuing after the fixed point is as incorrect as stopping before it.
+
+## Fuses
+
+Use these fuses when claim evaluation fails to converge:
+
+```text
+rounds = 3 -> halt and report open items; do not chase them
+claim born in round n+1 that was visible in round n -> reject
+```
+
+A round is one complete evaluation, action, and proof pass over the claims then visible. The three-round limit is defined by this skill, not inferred from task size.
+
+## No Unauthoritative Limits
+
+Never invent a cap, threshold, quota, budget, timeout, retry count, round count, file count, line count, acceptance-criterion count, agent count, or similar limit.
+
+A limit is admissible only when its exact value is:
+
+- explicitly required by the requester
+- imposed by an applicable technical or platform contract
+- defined by authoritative project policy
+- derived from measured evidence necessary to meet or prove the contract
+
+State the authority or derivation whenever proposing or applying a limit. If no authority exists, omit the limit and apply the deletion rule. Metrics may be evidence, but must not become gates, defaults, targets, or recommendations through agent intuition. Examples and representative proportions do not become defaults.
+
+If a necessary limit requires an unresolved owner choice, ask rather than manufacture a value. The fuse above is already authorized by this skill.
+
+## Report
+
+Report only:
+
+1. the outcome against the contract
+2. the evidence that proves it
+3. necessary open items remaining because a fuse fired or the work is blocked
+4. rejected claims worth the user's attention, at most one line each
+
+Do not turn rejected claims into recommendations, investigations, or deferred tasks.
+
+## Quality Gate
+
+Before reporting, confirm:
+
+- the requested outcome and proof criteria formed the contract
+- every performed action passed the deletion rule
+- every accepted claim has evidence or remains explicitly open
+- no invented limit shaped the work
+- no closed claim was re-proven without necessity
+- work stopped at the fixed point or an authorized fuse
diff --git a/.env.example b/.env.example
index 12fac543c..9286b14d6 100644
--- a/.env.example
+++ b/.env.example
@@ -1,5 +1,5 @@
 # Postgres
-DATABASE_URL="postgresql://postgres:postgres@localhost:5432/crm?schema=public"
+DATABASE_URL="postgresql://crm:crm@localhost:5432/crm?schema=public"
 
 # A direct, unpooled connection to that same database, used by
 # `prisma migrate deploy` when the API is built on Vercel. Set it only if
@@ -11,7 +11,12 @@ DATABASE_URL="postgresql://postgres:postgres@localhost:5432/crm?schema=public"
 # and refuses to run without this — these are real integration tests, they write
 # and delete rows, and the pre-push hook runs them. The name has to end in
 # `_test`. `bun run db:test` creates it and applies the migrations.
-TEST_DATABASE_URL="postgresql://postgres:postgres@localhost:5432/crm_test?schema=public"
+TEST_DATABASE_URL="postgresql://crm:crm@localhost:5432/crm_test?schema=public"
+
+# Postgres connection for a BYPASSRLS role. Only the database migration
+# rehearsal uses this role to audit every tenant. Normal app processes must
+# never use this value.
+AUDIT_DATABASE_URL=""
 
 # Generate your own:  openssl rand -base64 32
 BETTER_AUTH_SECRET=""
@@ -53,7 +58,7 @@ GOOGLE_CLIENT_SECRET=""
 # MICROSOFT_CLIENT_SECRET=""
 
 # Optional. Enables Slack account linking on Settings > Connections.
-# Add APP_URL + /api/auth/oauth2/callback/slack as the Slack OAuth redirect URL.
+# Add API_URL + /api/auth/callback/slack as the Slack OAuth redirect URL.
 # SLACK_CLIENT_ID=""
 # SLACK_CLIENT_SECRET=""
 
@@ -112,6 +117,41 @@ GOOGLE_CLIENT_SECRET=""
 # schedule.
 # AGENT_BRIDGE_SECRET=""
 
+# Optional XMPP agent gateway. Set XMPP_COMPONENT_ENABLED to 1 and provide the
+# component identity, component secret, and owning organization together. The
+# gateway exposes only operations from apps/agent/src/exports. Task state is
+# retained in PostgreSQL for 24 hours after admission.
+# XMPP_COMPONENT_ENABLED="1"
+# XMPP_COMPONENT_JID="gateway.agents.example.com"
+# XMPP_COMPONENT_SECRET=""
+# XMPP_ORGANIZATION_ID=""
+# XMPP_COMPONENT_SERVICE="xmpp://127.0.0.1:5275"
+# XMPP_DEFAULT_AGENT_JID="assistant@agents.example.com"
+# XMPP_AGENT_DOMAIN="agents.example.com"
+# XMPP_SERVER_DOMAIN="example.com"
+# XMPP_GATEWAY_ID="gw-1"
+# XMPP_AGENT_VERSION="1.0.0"
+
+# Comma-separated domains that can discover and invoke the endpoint. The
+# server and agent domains are used when this value is absent.
+# XMPP_ALLOWED_CALLER_DOMAINS="example.com,agents.example.com"
+
+# Comma-separated bare JIDs that can invoke destructive exports. Destructive
+# exports remain visible but return forbidden when this value is absent.
+# XMPP_ALLOW_DESTRUCTIVE_CALLERS="trusted-agent@agents.example.com"
+
+# Optional transport tuning. The copied gateway supplies safe defaults.
+# XMPP_XML_LANG="en"
+# XMPP_RECEIPT_TIMEOUT_MS="30000"
+# XMPP_RECEIPT_MAX_RESENDS="0"
+# XMPP_RECEIPT_SWEEP_MS="10000"
+# XMPP_RECONNECT_INITIAL_MS="1000"
+# XMPP_RECONNECT_MAX_MS="60000"
+# XMPP_PING_INTERVAL_MS="60000"
+# XMPP_PING_TIMEOUT_MS="10000"
+# XMPP_PING_FAILURE_THRESHOLD="2"
+# XMPP_MAX_PENDING_IQ_REQUESTS="256"
+
 # PORT="3001"
 
 
@@ -152,6 +192,14 @@ GOOGLE_CLIENT_SECRET=""
 # https://vercel.com/docs/ai-gateway
 # AI_GATEWAY_API_KEY=""
 
+# Cloudflare R2 storage. Leave all four values empty to disable asset uploads.
+# Create an R2 API token with object read and write access for the private bucket.
+# The API signs direct browser and mobile transfers. It does not expose these keys.
+# R2_ACCOUNT_ID=""
+# R2_ACCESS_KEY_ID=""
+# R2_SECRET_ACCESS_KEY=""
+# R2_BUCKET=""
+
 
 # ── Optional: operations ─────────────────────────────────────────────────────
 
diff --git a/.github/workflows/auto-pr.yml b/.github/workflows/auto-pr.yml
deleted file mode 100644
index bbfcd8ec6..000000000
--- a/.github/workflows/auto-pr.yml
+++ /dev/null
@@ -1,62 +0,0 @@
-name: Auto PR
-
-on:
-  push:
-    branches-ignore:
-      - main
-      - release
-      - "release-please--**"
-      - "gh-readonly-queue/**"
-      - "dependabot/**"
-
-concurrency:
-  group: auto-pr-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  open:
-    name: Open a pull request into main
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Open the pull request
-        env:
-          GH_TOKEN: ${{ secrets.AUTOMATION_TOKEN || secrets.GITHUB_TOKEN }}
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          BRANCH: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-
-          existing=$(gh pr list --head "$BRANCH" --state all --limit 1 --json number,state --jq '.[0] | select(.) | "#\(.number) (\(.state))"')
-          if [ -n "$existing" ]; then
-            echo "\`$BRANCH\` already has pull request $existing — leaving it alone." >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          if [ "$(git rev-list --count "origin/main..origin/$BRANCH")" = "0" ]; then
-            echo "\`$BRANCH\` has nothing \`main\` does not already have." >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          title=$(.github/scripts/pr-title.sh generate "origin/main" "origin/$BRANCH" "$BRANCH")
-
-          body=$(cat <<EOF
-          Opened automatically when \`$BRANCH\` was pushed.
-
-          The title is written from the diff and rewritten as you push, because this is squashed onto \`main\` and the title becomes the commit subject and the changelog line. Retitle it yourself and it is yours — the automation stops touching it.
-
-          <!-- pr-title: $title -->
-          EOF
-          )
-
-          gh pr create --base main --head "$BRANCH" --title "$title" --body "$body"
-
-          echo "Opened a pull request for \`$BRANCH\` titled \`$title\`." >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bf7714763..09695ece5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,7 +4,7 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
   push:
-    branches: [main, release]
+    branches: [master]
 
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -20,12 +20,12 @@ env:
 jobs:
   check:
     name: check-types, lint, test
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 20
 
     services:
       postgres:
-        image: postgres:17-alpine
+        image: postgres:18-alpine
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres
@@ -39,8 +39,8 @@ jobs:
           --health-retries 20
 
     env:
-      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/crm_test?schema=public
-      TEST_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/crm_test?schema=public
+      DATABASE_URL: postgresql://crm:crm@localhost:5432/crm_test?schema=public
+      TEST_DATABASE_URL: postgresql://crm:crm@localhost:5432/crm_test?schema=public
       ALLOWED_SIGN_IN: example.com
       BETTER_AUTH_SECRET: ci-only-secret-regenerate-for-any-real-deployment
       API_URL: http://localhost:3001
@@ -50,13 +50,30 @@ jobs:
 
     steps:
       - uses: actions/checkout@v5
+        with:
+          submodules: recursive
 
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version-file: package.json
 
+      - name: Create runtime database role
+        env:
+          PGPASSWORD: postgres
+        run: |
+          psql -h localhost -U postgres -d postgres -v ON_ERROR_STOP=1 -c "CREATE ROLE crm WITH LOGIN PASSWORD 'crm' NOSUPERUSER CREATEDB NOCREATEROLE NOINHERIT NOBYPASSRLS"
+          psql -h localhost -U postgres -d postgres -v ON_ERROR_STOP=1 -c "ALTER DATABASE crm_test OWNER TO crm"
+
       - run: bun install --frozen-lockfile
 
+      - name: Install kaneo dependencies
+        run: cd vendor/kaneo && bun install
+
+      - name: Build kaneo packages
+        run: |
+          cd vendor/kaneo/packages/email && bun run build
+          cd ../permissions && bun run build
+
       - name: Apply migrations
         run: bun run db:deploy
 
diff --git a/.github/workflows/pr-base.yml b/.github/workflows/pr-base.yml
deleted file mode 100644
index 6f62f04b5..000000000
--- a/.github/workflows/pr-base.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-name: PR base
-
-on:
-  pull_request_target:
-    types: [opened, reopened]
-    branches: [release]
-
-concurrency:
-  group: pr-base-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  retarget:
-    name: Retarget onto main
-    if: >-
-      github.event.pull_request.head.ref != 'main' &&
-      !startsWith(github.event.pull_request.head.ref, 'release-please--')
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    steps:
-      - name: Move the pull request to main
-        env:
-          GH_TOKEN: ${{ secrets.AUTOMATION_TOKEN || secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          set -euo pipefail
-
-          gh pr edit "$NUMBER" --base main
-
-          echo "Retargeted #$NUMBER from \`release\` onto \`main\`." >> "$GITHUB_STEP_SUMMARY"
-
-      - uses: marocchino/sticky-pull-request-comment@v2
-        continue-on-error: true
-        with:
-          header: pr-base
-          message: |
-            **Retargeted this onto `main`.**
-
-            `release` is the default branch so that a plain clone runs the last tagged release, but nothing merges into it — it is fast-forwarded onto the tag by the Release workflow and that is all. Changes go to `main`, and reach `release` when a release is cut.
-
-            Nothing is wrong with your branch. If the diff now shows commits that are already on `main`, rebase and force-push:
-
-            ```sh
-            git fetch origin main
-            git rebase origin/main
-            git push --force-with-lease
-            ```
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
deleted file mode 100644
index c289adbe8..000000000
--- a/.github/workflows/pr-title.yml
+++ /dev/null
@@ -1,132 +0,0 @@
-name: PR title
-
-on:
-  pull_request:
-    types: [opened, edited, reopened, ready_for_review, synchronize]
-    branches: [main]
-
-concurrency:
-  group: pr-title-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  conventional:
-    name: conventional commit
-    if: >-
-      github.event.pull_request.draft == false &&
-      !startsWith(github.event.pull_request.head.ref, 'release-please--')
-    runs-on: ubuntu-24.04
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Write the title from the diff
-        id: autotitle
-        env:
-          GH_TOKEN: ${{ secrets.AUTOMATION_TOKEN || secrets.GITHUB_TOKEN }}
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          TITLE: ${{ github.event.pull_request.title }}
-          BODY: ${{ github.event.pull_request.body }}
-          NUMBER: ${{ github.event.pull_request.number }}
-          BRANCH: ${{ github.event.pull_request.head.ref }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          set -euo pipefail
-
-          body=$(printf '%s' "$BODY" | tr -d '\r')
-
-          if ! .github/scripts/pr-title.sh check "$TITLE"; then
-            reason="it is not a release note"
-          elif ! .github/scripts/pr-title.sh sufficient "$BASE_SHA" "$HEAD_SHA" "$TITLE"; then
-            reason="it releases less than the commits on the branch do"
-          else
-            echo "\`$TITLE\` still covers the diff — leaving it alone." >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          title=$(.github/scripts/pr-title.sh generate "$BASE_SHA" "$HEAD_SHA" "$BRANCH")
-
-          if [ "$title" = "$TITLE" ]; then
-            echo "\`$TITLE\` still describes the diff." >> "$GITHUB_STEP_SUMMARY"
-            echo "written=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          body=$(printf '%s\n\n<!-- pr-title: %s -->\n' \
-            "$(printf '%s\n' "$body" | grep -v '^<!-- pr-title: ' || true)" "$title")
-
-          if gh pr edit "$NUMBER" --title "$title" --body "$body"; then
-            echo "written=true" >> "$GITHUB_OUTPUT"
-            echo "Retitled #$NUMBER to \`$title\`, because $reason." >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          {
-            echo "The title needs changing, because $reason, but this workflow"
-            echo "could not write it. Set it by hand:"
-            echo
-            echo '```'
-            echo "$title"
-            echo '```'
-            echo
-            echo "A fork pull request grants a read-only token, which is the usual"
-            echo "cause. Check the step log for what the API returned."
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - uses: amannn/action-semantic-pull-request@v6
-        id: lint
-        if: steps.autotitle.outputs.written != 'true'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          types: |
-            feat
-            fix
-            perf
-            refactor
-            docs
-            revert
-            deps
-            chore
-            test
-            ci
-            build
-            style
-          requireScope: false
-          subjectPattern: ^(?![A-Z][a-z]).+[^.]$
-          subjectPatternError: >-
-            The subject "{subject}" of "{title}" reads like a sentence, not a
-            changelog line. Start it lowercase and in the imperative, and drop
-            the trailing full stop — "add bulk archive to the deals table",
-            not "Added bulk archive."
-
-      - uses: marocchino/sticky-pull-request-comment@v2
-        if: always()
-        continue-on-error: true
-        with:
-          header: pr-title
-          delete: ${{ steps.lint.outputs.error_message == null }}
-          message: |
-            **This pull request's title is not a Conventional Commit.**
-
-            It is squashed onto `main` as-is, so the title is the commit subject and the line that shows up in the changelog and the release notes.
-
-            ```
-            ${{ steps.lint.outputs.error_message }}
-            ```
-
-            | Title | Bump | Changelog heading |
-            | --- | --- | --- |
-            | `feat(app): add bulk archive to the deals table` | minor | Features |
-            | `fix(api): stop double-counting installs` | patch | Fixes |
-            | `feat(db)!: drop the legacy contacts table` | major | Features, flagged breaking |
-            | `chore(deps): bump turbo to 2.11` | none | hidden |
-
-            Edit the title and this check re-runs on its own.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index 0350ec948..000000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,126 +0,0 @@
-name: Release
-
-on:
-  push:
-    branches: [main]
-  workflow_dispatch:
-
-concurrency:
-  group: release
-  cancel-in-progress: false
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  release-please:
-    name: Release pull request, tag and notes
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - uses: googleapis/release-please-action@v5
-        id: release
-        with:
-          config-file: .github/release-please-config.json
-          manifest-file: .github/.release-please-manifest.json
-          target-branch: main
-          token: ${{ secrets.AUTOMATION_TOKEN || secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
-
-      # `release` carries a ruleset that requires a pull request, and the only
-      # bypass is the admin role. So this cannot push a merge commit itself:
-      # the REST `merges` API writes straight to the branch, the ruleset refused
-      # it, and every tag from v1.6.1 on was cut on `main` and never shipped —
-      # production sat on whatever pull request last reached `release` by hand.
-      # A pull request from `main` is the one door that is open, which is also
-      # what `pr-base.yml` assumes when it leaves a `main` head alone.
-      - name: Put the tag on release
-        if: steps.release.outputs.tag_name || github.event_name == 'workflow_dispatch'
-        env:
-          GH_TOKEN: ${{ secrets.AUTOMATION_TOKEN || secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-          TAG: ${{ steps.release.outputs.tag_name }}
-          URL: ${{ steps.release.outputs.html_url }}
-        run: |
-          set -euo pipefail
-
-          tag="${TAG:-$(gh release view --json tagName --jq .tagName)}"
-          url="${URL:-$(gh release view "$tag" --json url --jq .url)}"
-
-          if [ "$(gh api "repos/$GH_REPO/compare/release...main" --jq .ahead_by)" = "0" ]; then
-            echo "Released [$tag]($url); \`release\` already had it." >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          number=$(gh pr list --base release --head main --state open --limit 1 --json number --jq '.[0].number // empty')
-
-          if [ -z "$number" ]; then
-            gh pr create --base release --head main \
-              --title "release: $tag" \
-              --body "Puts [$tag]($url) on \`release\`, which is the branch production deploys from. Opened by the Release workflow."
-            number=$(gh pr list --base release --head main --state open --limit 1 --json number --jq '.[0].number')
-          fi
-
-          for _ in 1 2 3 4 5; do
-            if out=$(gh pr merge "$number" --merge 2>&1); then
-              echo "Released [$tag]($url) and put it on \`release\` in #$number. It is live." >> "$GITHUB_STEP_SUMMARY"
-              exit 0
-            fi
-            sleep 5
-          done
-
-          {
-            echo "**[$tag]($url) is tagged but did not reach \`release\`.**"
-            echo
-            echo "#$number is open and merging it ships this release."
-            echo
-            echo "\`\`\`"
-            echo "$out"
-            echo "\`\`\`"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          exit 1
-
-      - name: Say what happened
-        if: ${{ !steps.release.outputs.tag_name }}
-        run: |
-          set -euo pipefail
-          echo "No tag this run — either the release pull request is still open, or nothing releasable landed." >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Fail on a merged release pull request that was never tagged
-        env:
-          GH_TOKEN: ${{ secrets.AUTOMATION_TOKEN || secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-
-          candidates=$(gh pr list --repo "$GITHUB_REPOSITORY" --base main --state merged --label "autorelease: pending" --limit 20 --json number --jq '.[].number')
-
-          stuck=""
-
-          for pr in $candidates; do
-            state=$(gh api "repos/$GITHUB_REPOSITORY/issues/$pr/labels" --jq 'map(.name) | if index("autorelease: tagged") then "tagged" elif index("autorelease: pending") then "pending" else "cleared" end')
-
-            if [ "$state" != "pending" ]; then
-              continue
-            fi
-
-            title=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$pr" --jq '.title')
-            stuck="${stuck}#${pr} ${title}"$'\n'
-          done
-
-          if [ -z "$stuck" ]; then
-            exit 0
-          fi
-
-          {
-            echo "**A merged release pull request was never tagged.** release-please aborts on it, so nothing"
-            echo "releases and no release pull request opens until it is cleared: create the tag and GitHub"
-            echo "Release at that pull request's merge commit, then swap its \`autorelease: pending\` label for"
-            echo "\`autorelease: tagged\`."
-            echo
-            echo '```'
-            echo "$stuck"
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          exit 1
diff --git a/.gitignore b/.gitignore
index 853852992..404b72c60 100644
--- a/.gitignore
+++ b/.gitignore
@@ -50,3 +50,5 @@ yarn-error.log*
 
 # Agent scratch files
 .scratch/
+.serena/
+.codegraph/
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 000000000..e97e9c134
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,4 @@
+[submodule "vendor/kaneo"]
+	path = vendor/kaneo
+	url = git@github.com:romanbsd/kaneo.git
+	branch = crm-integration
diff --git a/.oxlintrc.json b/.oxlintrc.json
index 8a779c4eb..3f7d5c6cd 100644
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -14,9 +14,11 @@
 		".agents/**",
 		".claude/**",
 		"apps/api/src/generated/**",
+		"packages/agent-xmpp/**",
 		"packages/db/src/generated/**",
 		"packages/ui/src/components/**",
-		"tools/oxlint/anti-slop/**"
+		"tools/oxlint/anti-slop/**",
+		"vendor/**"
 	],
 	"rules": {
 		"anti-slop/no-chained-type-assertions": "error",
@@ -31,6 +33,16 @@
 		"anti-slop/no-widen-then-assert": "error"
 	},
 	"overrides": [
+		{
+			"files": ["packages/kaneo-domain/src/**"],
+			"rules": {
+				"anti-slop/no-chained-type-assertions": "off",
+				"anti-slop/no-runtime-typeof": "off",
+				"anti-slop/no-unknown-parameters": "off",
+				"anti-slop/no-unsafe-dictionary-type": "off",
+				"anti-slop/no-widen-then-assert": "off"
+			}
+		},
 		{
 			"files": [
 				"**/test/**",
@@ -57,6 +69,7 @@
 				"packages/db/src/fields.ts",
 				"packages/db/src/fields-shape.ts",
 				"apps/api/src/fields/**",
+				"apps/api/src/push-tokens/**",
 				"apps/app/components/crm/inline-field.tsx"
 			],
 			"rules": {
diff --git a/AGENTS.md b/AGENTS.md
index 2be0b3881..8f561f342 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -24,6 +24,7 @@ rules and skills you read.
 
 ## Always true
 
+- Keep each code file at 200 lines or fewer. Split larger files by responsibility.
 - **Never add code comments.** Not to new code, not to code you edit.
 - **No coauthoring commits.** No `Co-Authored-By` trailer, ever.
 - **Intelligence lives in `apps/agent`, never in the API.** No vendor client, no
@@ -251,53 +252,19 @@ it:
 
 @docs/design.md
 
-## Median Tasks
+## Task tracking
 
-Median can use a project-local workspace binding. If this repository has
-`.median/config.json`, run `mdn` commands from inside this repository so the
-correct Median workspace profile is selected. The local config stores only a
-profile name; API keys stay in your user config.
-
-To bind this repository to a workspace:
-
-```
-mdn setup --local
-```
-
-Before starting work, check your assigned tasks:
-
-```
-mdn tasks --agent <your-agent-name>
-```
-
-When picking up a task:
-
-```
-mdn status <TASK-CODE> in_progress --agent <your-agent-name>
-```
-
-When completing a task:
-
-```
-mdn status <TASK-CODE> ready --agent <your-agent-name>
-```
-
-To create a new task:
-
-```
-mdn create --title "Description" --status todo --priority medium --agent <your-agent-name>
-```
+Never use Median in this fork. Do not run `mdn` commands. Do not add Median task
+IDs to commits or pull requests.
 
 ## Commit Messages & Pull Requests
 
-Always include the Median task ID in commit messages and PR titles so tasks get marked automatically.
-
-```
-git commit -m "MDN-42 fix: resolve auth token expiry"
-```
+Use conventional commit messages and pull request titles.
 
-For pull requests, include the task ID in the title:
+Open pull requests against `master` in `jobsteward/compcrm` unless the user states
+another repository or base branch. This rule overrides repository and base branch
+defaults in other project documents and skills.
 
-```
-MDN-42 fix: resolve auth token expiry
+```shell
+git commit -m "fix: resolve auth token expiry"
 ```
diff --git a/adrs/kaneo.md b/adrs/kaneo.md
new file mode 100644
index 000000000..51f4112e4
--- /dev/null
+++ b/adrs/kaneo.md
@@ -0,0 +1,49 @@
+# Bundle Kaneo through an ORM-agnostic domain model
+
+## What we want to change
+
+Bring project management into the CRM as one domain, not two. Kaneo and the CRM are
+both Postgres and both better-auth. We want one physical schema, one migration stream,
+and the eve agent reading and writing project data through the same `@crm/db` client it
+already uses for contacts, companies and deals.
+
+## Why the current situation is a problem
+
+- Running Kaneo with its own database means two copies of `project` and `task`, and a
+  sync bus between them that will be debugged forever.
+- Pointing Kaneo's Drizzle schema at our Prisma-owned tables by hand-patching a vendored
+  `schema.ts` works once and drifts forever. Every upstream release conflicts with the
+  patch.
+- Two better-auth plugins over one `user` table creates two membership models that
+  silently diverge.
+
+## What we will do instead
+
+- **Fork and bundle Kaneo** (see `vendor/FORK-DELTA.md`). The fork is the trunk; all
+  work lands there first. Generic improvements are donated upstream as pull requests.
+- **Extract Kaneo's domain model into an ORM-agnostic definition** — a typed TypeScript
+  builder DSL that models tables, columns, constraints and relations at the Postgres
+  level, in a `packages/domain`-style package. This is the generic piece and is
+  upstream pull request number one.
+- **Bind the abstract model on each side.** Kaneo's Drizzle schema is generated from it
+  (behavior-identical, held by a golden DDL parity test). The CRM generates a Prisma
+  schema fragment from it, committed, merged via `prismaSchemaFolder`. The parity test
+  is two scratch databases, one `prisma db push` and one `drizzle-kit` push, `pg_dump`
+  both, diff must be empty.
+- **Prisma owns all migrations.** Kaneo's own migration runner is disabled in the fork.
+- **Identity unifies on the existing better-auth organization plugin.** Kaneo's workspace
+  plugin is disabled; the one workspace maps to `WORKSPACE_ID`. One membership model.
+- **One writer per aggregate.** `task.number` derives from `project.lastTaskNumber` in a
+  single transaction; whichever runtime owns a table owns that counter.
+
+## What it breaks
+
+- Kaneo's upstream code must keep producing identical DDL, or the parity test fails.
+- The abstract model adds a codegen step and a boundary rule (no `@crm/*` imports in the
+  generic packages).
+- Upstream may reject the extraction. That is not a failure: the fork carries it, the
+  parity test keeps it honest, and nothing blocks on acceptance.
+
+## Status
+
+Accepted. Vendoring is in place; the extraction is next.
\ No newline at end of file
diff --git a/apps/agent/agent/agent.ts b/apps/agent/agent/agent.ts
index 56756af59..f7adb3f11 100644
--- a/apps/agent/agent/agent.ts
+++ b/apps/agent/agent/agent.ts
@@ -1,8 +1,8 @@
 import "@crm/env/load";
 
-import { DEFAULT_AGENT_MODEL } from "@crm/db/settings";
+import { defaultAgentModelResult } from "@crm/db/settings";
 import { onTelemetryProblem, syncVersion } from "@crm/telemetry";
-import { defineAgent, defineDynamic } from "eve";
+import { type DefinedAgent, defineAgent, defineDynamic } from "eve";
 import { logCapabilities } from "./lib/capabilities";
 import { selectedModel } from "./lib/model";
 
@@ -12,10 +12,19 @@ onTelemetryProblem((message) => console.debug(`[telemetry] ${message}`));
 
 void syncVersion();
 
-export default defineAgent({
+const agent: DefinedAgent = defineAgent({
 	model: defineDynamic({
-		fallback: DEFAULT_AGENT_MODEL.id,
-		events: { "session.started": () => selectedModel() },
+		events: {
+			"session.started": async () => {
+				const selected = await selectedModel();
+				return selected
+					? {
+							model: selected.model,
+							modelContextWindowTokens: selected.modelContextWindowTokens,
+						}
+					: defaultAgentModelResult();
+			},
+		},
 	}),
 	limits: {
 		maxInputTokensPerSession: 500_000,
@@ -23,3 +32,5 @@ export default defineAgent({
 		sessionTimeoutMs: 30 * 24 * 60 * 60 * 1000,
 	},
 });
+
+export default agent;
diff --git a/apps/agent/agent/channels/crm.ts b/apps/agent/agent/channels/crm.ts
index aff3af458..3a3f58e81 100644
--- a/apps/agent/agent/channels/crm.ts
+++ b/apps/agent/agent/channels/crm.ts
@@ -29,10 +29,10 @@ import {
 import { DISPATCH } from "../lib/dispatch-config";
 import { settle } from "../lib/enrichment";
 import { finishRun, runResultOf } from "../lib/run-runtime";
-import { attribute } from "../lib/session-purpose";
+import { attribute, requireOrganizationId } from "../lib/session-purpose";
 import { createSlackChannel } from "../lib/slack-membership";
 import { reconcileStaleTasks } from "../lib/stale-tasks";
-import { completeTask, taskSubject } from "../lib/tasks";
+import { completeTask, taskSubject, withTaskTenant } from "../lib/tasks";
 
 const TASK_MARKER = "task:";
 const STALE_QUEUE_MS = DISPATCH.sweep.staleQueueMs;
@@ -93,11 +93,14 @@ export async function closeTask(
 	const taskId = taskFromToken(token);
 	if (!taskId) return false;
 
-	const subject =
-		(await completeTask(taskId, outcome)) ?? (await taskSubject(taskId));
-	if (subject) await settle(subject, status);
-
-	return true;
+	return (
+		(await withTaskTenant(taskId, async () => {
+			const subject =
+				(await completeTask(taskId, outcome)) ?? (await taskSubject(taskId));
+			if (subject) await settle(subject, status);
+			return true;
+		})) ?? false
+	);
 }
 
 export default defineChannel({
@@ -131,7 +134,7 @@ export default defineChannel({
 			);
 		}),
 
-		POST("/internal/crm/dispatch", async (request, { send, waitUntil }) => {
+		POST("/internal/crm/dispatch", async (request, { from, waitUntil }) => {
 			if (!authorised(request)) {
 				return new Response("Unauthorized", { status: 401 });
 			}
@@ -140,12 +143,11 @@ export default defineChannel({
 				(async () => {
 					await reconcileStaleTasks();
 					await drainAll((task) =>
-						send(brief(task), {
+						from(taskToken(task.id)).send(brief(task), {
 							auth: taskAuth(task),
-							continuationToken: taskToken(task.id),
 						}),
 					);
-					await drainAgentRuns(send);
+					await drainAgentRuns(from);
 				})(),
 			);
 
@@ -154,29 +156,29 @@ export default defineChannel({
 
 		POST(
 			"/internal/crm/builder-dispatch",
-			async (request, { send, waitUntil }) => {
+			async (request, { from, waitUntil }) => {
 				if (!authorised(request)) {
 					return new Response("Unauthorized", { status: 401 });
 				}
 
-				waitUntil(drainBuilder(send));
+				waitUntil(drainBuilder(from));
 				return new Response(null, { status: 202 });
 			},
 		),
 
 		POST(
 			"/internal/crm/agent-dispatch",
-			async (request, { send, waitUntil }) => {
+			async (request, { from, waitUntil }) => {
 				if (!authorised(request)) {
 					return new Response("Unauthorized", { status: 401 });
 				}
 
-				waitUntil(drainAgentRuns(send));
+				waitUntil(drainAgentRuns(from));
 				return new Response(null, { status: 202 });
 			},
 		),
 
-		POST("/internal/crm/cancel-run", async (request, { cancel }) => {
+		POST("/internal/crm/cancel-run", async (request, { from }) => {
 			if (!authorised(request)) {
 				return new Response("Unauthorized", { status: 401 });
 			}
@@ -188,9 +190,7 @@ export default defineChannel({
 				return Response.json({ error: "No run id was sent." }, { status: 400 });
 			}
 
-			return Response.json(
-				await cancel({ continuationToken: runToken(runId) }),
-			);
+			return Response.json(await from(runToken(runId)).cancel());
 		}),
 
 		POST("/internal/crm/slack/create-channel", async (request) => {
@@ -210,6 +210,7 @@ export default defineChannel({
 			}
 
 			const outcome = await createSlackChannel(
+				parsed.data.organizationId,
 				parsed.data.channelName,
 				parsed.data.isPrivate,
 			);
@@ -243,13 +244,14 @@ export default defineChannel({
 		async "input.requested"(data, channel, ctx) {
 			await persistBuilderInputRequest(
 				data,
-				channel.continuationToken,
+				channel.continuation?.token,
+				requireOrganizationId(ctx),
 				attribute(ctx, "conversationId"),
 			);
 		},
 
 		async "message.completed"(data, channel) {
-			const conversationId = builderIdFromToken(channel.continuationToken);
+			const conversationId = builderIdFromToken(channel.continuation?.token);
 			if (!conversationId || !data.message?.trim()) return;
 
 			await import("@crm/db").then(({ db }) =>
@@ -265,9 +267,9 @@ export default defineChannel({
 		},
 
 		async "session.waiting"(_data, channel) {
-			if (await closeTask(channel.continuationToken, "ran")) return;
+			if (await closeTask(channel.continuation?.token, "ran")) return;
 
-			const conversationId = builderIdFromToken(channel.continuationToken);
+			const conversationId = builderIdFromToken(channel.continuation?.token);
 			if (!conversationId) return;
 
 			await import("@crm/db").then(({ db }) =>
@@ -279,17 +281,19 @@ export default defineChannel({
 		},
 
 		async "turn.failed"(data, channel) {
-			const taskId = taskFromToken(channel.continuationToken);
+			const taskId = taskFromToken(channel.continuation?.token);
 			const reason =
 				eveTurnFailure.parse(data).message ?? "The agent turn failed.";
 
 			if (taskId) {
-				const subject = await taskSubject(taskId);
-				if (subject) await settle(subject, EnrichmentStatus.FAILED, reason);
+				await withTaskTenant(taskId, async () => {
+					const subject = await taskSubject(taskId);
+					if (subject) await settle(subject, EnrichmentStatus.FAILED, reason);
+				});
 				return;
 			}
 
-			const conversationId = builderIdFromToken(channel.continuationToken);
+			const conversationId = builderIdFromToken(channel.continuation?.token);
 			if (conversationId) {
 				const { db } = await import("@crm/db");
 				await db.agentConversation.updateMany({
@@ -302,14 +306,14 @@ export default defineChannel({
 				return;
 			}
 
-			const runId = runIdFromToken(channel.continuationToken);
+			const runId = runIdFromToken(channel.continuation?.token);
 			if (runId) await failRun(runId, "TURN_FAILED", reason);
 		},
 
 		async "session.completed"(_data, channel) {
-			if (await closeTask(channel.continuationToken, "ran")) return;
+			if (await closeTask(channel.continuation?.token, "ran")) return;
 
-			const conversationId = builderIdFromToken(channel.continuationToken);
+			const conversationId = builderIdFromToken(channel.continuation?.token);
 			if (conversationId) {
 				const { db } = await import("@crm/db");
 				await db.agentConversation.updateMany({
@@ -319,7 +323,7 @@ export default defineChannel({
 				return;
 			}
 
-			const runId = runIdFromToken(channel.continuationToken);
+			const runId = runIdFromToken(channel.continuation?.token);
 			if (!runId) return;
 
 			const { db } = await import("@crm/db");
@@ -346,7 +350,7 @@ export default defineChannel({
 		async "turn.cancelled"(_data, channel) {
 			if (
 				await closeTask(
-					channel.continuationToken,
+					channel.continuation?.token,
 					"stopped",
 					EnrichmentStatus.SKIPPED,
 				)
@@ -354,7 +358,7 @@ export default defineChannel({
 				return;
 			}
 
-			const conversationId = builderIdFromToken(channel.continuationToken);
+			const conversationId = builderIdFromToken(channel.continuation?.token);
 			if (conversationId) {
 				const { db } = await import("@crm/db");
 				await db.agentConversation.updateMany({
@@ -367,7 +371,7 @@ export default defineChannel({
 				return;
 			}
 
-			const runId = runIdFromToken(channel.continuationToken);
+			const runId = runIdFromToken(channel.continuation?.token);
 			if (runId) {
 				await cancelRun(
 					runId,
@@ -378,7 +382,7 @@ export default defineChannel({
 		},
 
 		async "session.failed"(data, channel) {
-			const conversationId = builderIdFromToken(channel.continuationToken);
+			const conversationId = builderIdFromToken(channel.continuation?.token);
 			if (conversationId) {
 				const { db } = await import("@crm/db");
 				await db.agentConversation.updateMany({
@@ -393,29 +397,28 @@ export default defineChannel({
 				return;
 			}
 
-			const runId = runIdFromToken(channel.continuationToken);
+			const runId = runIdFromToken(channel.continuation?.token);
 			if (runId) await failRun(runId, data.code, data.message);
 		},
 	},
 
-	async receive(input, { send }) {
+	async receive(input, { from }) {
 		const target = receiveTarget.parse(input.target);
 		if (target.builderSubmissionId) {
 			assertInternalDispatchAuth(input.auth);
-			return dispatchBuilderSubmission(target.builderSubmissionId, send);
+			return dispatchBuilderSubmission(target.builderSubmissionId, from);
 		}
 
 		if (target.runId) {
 			assertInternalDispatchAuth(input.auth);
-			return dispatchAgentRun(target.runId, send);
+			return dispatchAgentRun(target.runId, from);
 		}
 
-		return send(input.message, {
-			auth: input.auth,
-			continuationToken: target.taskId
+		return from(
+			target.taskId
 				? taskToken(target.taskId)
 				: `crm:adhoc:${crypto.randomUUID()}`,
-		});
+		).send(input.message, { auth: input.auth });
 	},
 });
 
diff --git a/apps/agent/agent/channels/xmpp.ts b/apps/agent/agent/channels/xmpp.ts
new file mode 100644
index 000000000..fdf038092
--- /dev/null
+++ b/apps/agent/agent/channels/xmpp.ts
@@ -0,0 +1,101 @@
+import { defineChannel, GET, POST } from "eve/channels";
+import {
+	ExportToolValidationError,
+	normalizeExportToolError,
+} from "../../src/export-tools/errors";
+import { createEveExportSend } from "../../src/export-tools/eve-adapter";
+import { executeExportTool } from "../../src/export-tools/executor";
+import { exportToolManifest } from "../../src/export-tools/manifest";
+import { schemaIssues } from "../../src/export-tools/schema";
+import {
+	type ExportStreamEvent,
+	exportInvocationRequestSchema,
+	exportStreamEventSchema,
+} from "../../src/export-tools/wire";
+
+function authorized(request: Request): boolean {
+	const secret = process.env.AGENT_BRIDGE_SECRET;
+	return (
+		Boolean(secret) &&
+		request.headers.get("authorization") === `Bearer ${secret}`
+	);
+}
+
+function denied(): Response {
+	return Response.json({ error: "Unauthorized" }, { status: 401 });
+}
+
+export default defineChannel({
+	routes: [
+		GET("/internal/xmpp/export-tools/manifest", async (request) => {
+			if (!authorized(request)) return denied();
+			return Response.json({ tools: exportToolManifest() });
+		}),
+		POST("/internal/xmpp/export-tools/invoke", async (request, { from }) => {
+			if (!authorized(request)) return denied();
+			const parsed = exportInvocationRequestSchema.safeParse(
+				await request.json(),
+			);
+			if (!parsed.success) {
+				return Response.json(
+					{ error: "Invalid invocation", issues: parsed.error.issues },
+					{ status: 400 },
+				);
+			}
+			const invocation = {
+				requestId: parsed.data.requestId,
+				operation: parsed.data.operation,
+				caller: parsed.data.caller,
+			};
+			const encoder = new TextEncoder();
+			const stream = new ReadableStream<Uint8Array>({
+				start(controller) {
+					let sessionId: string | undefined;
+					const write = (value: ExportStreamEvent) => {
+						controller.enqueue(
+							encoder.encode(
+								`${JSON.stringify(exportStreamEventSchema.parse(value))}\n`,
+							),
+						);
+					};
+					const eveSend = createEveExportSend(from, invocation, request.signal);
+					void executeExportTool(parsed.data.operation, parsed.data.arguments, {
+						abortSignal: request.signal,
+						invocation,
+						progress: async (update) => write({ type: "progress", update }),
+						send: async (agentRequest) => {
+							const result = await eveSend(agentRequest);
+							sessionId = result.sessionId;
+							return result;
+						},
+					})
+						.then((value) => write({ type: "result", value, sessionId }))
+						.catch((cause) => {
+							const error = normalizeExportToolError(
+								cause instanceof Error
+									? cause
+									: new Error("Export tool threw a non-error value", {
+											cause,
+										}),
+							);
+							write({
+								type: "error",
+								error: {
+									code: error.code,
+									message: error.message,
+									issues:
+										error instanceof ExportToolValidationError
+											? [...schemaIssues(error.issues)]
+											: undefined,
+								},
+							});
+						})
+						.finally(() => controller.close());
+				},
+			});
+			return new Response(stream, {
+				headers: { "content-type": "application/x-ndjson; charset=utf-8" },
+			});
+		}),
+	],
+});
diff --git a/apps/agent/agent/hooks/activity.ts b/apps/agent/agent/hooks/activity.ts
index 2e661bd15..d87aa1619 100644
--- a/apps/agent/agent/hooks/activity.ts
+++ b/apps/agent/agent/hooks/activity.ts
@@ -42,6 +42,8 @@ function requestName(action: ActionRequest): string {
 			return `subagent ${action.subagentName}`;
 		case "remote-agent-call":
 			return `remote ${action.remoteAgentName}`;
+		case "workflow-tool-call":
+			return `workflow ${action.toolName}`;
 		case "load-skill":
 			return "load_skill";
 	}
diff --git a/apps/agent/agent/hooks/audit.ts b/apps/agent/agent/hooks/audit.ts
index e2b59e9bc..226dcacfd 100644
--- a/apps/agent/agent/hooks/audit.ts
+++ b/apps/agent/agent/hooks/audit.ts
@@ -1,10 +1,15 @@
-import { db, Prisma } from "@crm/db";
+import { Prisma } from "@crm/db";
+import { scopedTransaction } from "@crm/db/tenant-scope";
 import { defineHook } from "eve/hooks";
 import { z } from "zod";
 import { isTransportOnlyEvent } from "../lib/event-persistence";
 import { currentFocus } from "../lib/focus";
 import { lockAgentRun } from "../lib/run-state";
-import { attribute, purposeOf } from "../lib/session-purpose";
+import {
+	attribute,
+	purposeOf,
+	runInSessionTenant,
+} from "../lib/session-purpose";
 
 const finiteNumber = z.number().refine(Number.isFinite).nullable().catch(null);
 
@@ -39,29 +44,31 @@ export default defineHook({
 				const purpose = purposeOf(ctx);
 				const conversationId =
 					purpose === "builder" ? attribute(ctx, "conversationId") : null;
-				await db.$transaction(async (tx) => {
-					await tx.agentEvent.createMany({
-						data: [
-							{
-								id,
-								sessionId: ctx.session.id,
-								contactId: currentFocus().contactId,
-								conversationId,
-								type: event.type,
-								data,
-								emittedAt,
-							},
-						],
-						skipDuplicates: true,
-					});
-
-					if (purpose === "builder") {
-						await persistBuilderLifecycle(tx, event, ctx.session.id, ctx);
-					}
-					if (purpose === "team-agent") {
-						await persistRunEvent(tx, id, event.type, data, emittedAt, ctx);
-					}
-				});
+				await runInSessionTenant(ctx, () =>
+					scopedTransaction(async (tx) => {
+						await tx.agentEvent.createMany({
+							data: [
+								{
+									id,
+									sessionId: ctx.session.id,
+									contactId: currentFocus().contactId,
+									conversationId,
+									type: event.type,
+									data,
+									emittedAt,
+								},
+							],
+							skipDuplicates: true,
+						});
+
+						if (purpose === "builder") {
+							await persistBuilderLifecycle(tx, event, ctx.session.id, ctx);
+						}
+						if (purpose === "team-agent") {
+							await persistRunEvent(tx, id, event.type, data, emittedAt, ctx);
+						}
+					}),
+				);
 			} catch (error) {
 				console.warn("[audit] could not record event", {
 					type: event.type,
diff --git a/apps/agent/agent/hooks/telemetry.ts b/apps/agent/agent/hooks/telemetry.ts
index da537aebc..34a23dbc3 100644
--- a/apps/agent/agent/hooks/telemetry.ts
+++ b/apps/agent/agent/hooks/telemetry.ts
@@ -1,8 +1,9 @@
-import { db } from "@crm/db";
 import { readAgentModel } from "@crm/db/settings";
+import { scopedTransaction } from "@crm/db/tenant-scope";
 import { agentError, modelError } from "@crm/telemetry";
 import { defineHook } from "eve/hooks";
 import { z } from "zod";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 type SessionPrincipal = {
 	readonly attributes?: Readonly<Record<string, string | readonly string[]>>;
@@ -10,18 +11,16 @@ type SessionPrincipal = {
 
 const attributeText = z.string().trim().min(1).nullable().catch(null);
 
-let modelId: string | null = null;
-
-async function configuredModel(): Promise<string | null> {
-	if (modelId) return modelId;
-
+async function configuredModel(
+	ctx: Parameters<typeof runInSessionTenant>[0],
+): Promise<string | null> {
 	try {
-		modelId = (await readAgentModel(db)).id;
+		return await runInSessionTenant(ctx, () =>
+			scopedTransaction(async (tx) => (await readAgentModel(tx)).id),
+		);
 	} catch {
-		modelId = null;
+		return null;
 	}
-
-	return modelId;
 }
 
 const MODEL_CODES = [
@@ -73,12 +72,12 @@ export default defineHook({
 			});
 		},
 
-		async "step.failed"(event) {
+		async "step.failed"(event, ctx) {
 			if (!looksLikeModel(event.data.code)) return;
 
 			modelError({
 				error: event.data.code,
-				modelId: await configuredModel(),
+				modelId: await configuredModel(ctx),
 			});
 		},
 	},
diff --git a/apps/agent/agent/instructions/task.ts b/apps/agent/agent/instructions/task.ts
index 045eba565..e35c3a622 100644
--- a/apps/agent/agent/instructions/task.ts
+++ b/apps/agent/agent/instructions/task.ts
@@ -3,7 +3,11 @@ import { z } from "zod";
 import { focusOn, setBudget } from "../lib/focus";
 import { sessionPreamble } from "../lib/preamble";
 import { RESEARCH_INSTRUCTIONS } from "../lib/research-instructions";
-import { attribute, purposeOf } from "../lib/session-purpose";
+import {
+	attribute,
+	purposeOf,
+	runInSessionTenant,
+} from "../lib/session-purpose";
 
 const attributeText = z.string().trim().min(1).nullable().catch(null);
 
@@ -36,19 +40,21 @@ export default defineDynamic({
 
 			const fieldKeys = attributeText.parse(attributes.fieldKeys);
 
-			const { markdown, focus } = await sessionPreamble(
-				{
-					contactId: attributeText.parse(attributes.contactId),
-					companyId: attributeText.parse(attributes.companyId),
-					dealId: attributeText.parse(attributes.dealId),
-				},
-				{
-					dispatched: Boolean(kind),
-					kind,
-					reason: attributeText.parse(attributes.reason),
-					budget,
-					fieldKeys: fieldKeys ? fieldKeys.split(",") : null,
-				},
+			const { markdown, focus } = await runInSessionTenant(ctx, () =>
+				sessionPreamble(
+					{
+						contactId: attributeText.parse(attributes.contactId),
+						companyId: attributeText.parse(attributes.companyId),
+						dealId: attributeText.parse(attributes.dealId),
+					},
+					{
+						dispatched: Boolean(kind),
+						kind,
+						reason: attributeText.parse(attributes.reason),
+						budget,
+						fieldKeys: fieldKeys ? fieldKeys.split(",") : null,
+					},
+				),
 			);
 
 			focusOn({ ...focus, sessionId: ctx.session.id, taskKind: kind });
diff --git a/apps/agent/agent/lib/accounts.ts b/apps/agent/agent/lib/accounts.ts
index 742d37732..70de96b44 100644
--- a/apps/agent/agent/lib/accounts.ts
+++ b/apps/agent/agent/lib/accounts.ts
@@ -1,4 +1,5 @@
-import { ActivityType, db, EmailDirection } from "@crm/db";
+import { ActivityType, EmailDirection } from "@crm/db";
+import { scopedDb as db } from "@crm/db/tenant-scope";
 import { z } from "zod";
 import { isDerivedName } from "./names";
 
diff --git a/apps/agent/agent/lib/approval.ts b/apps/agent/agent/lib/approval.ts
index 04f9707c1..8935f1f04 100644
--- a/apps/agent/agent/lib/approval.ts
+++ b/apps/agent/agent/lib/approval.ts
@@ -1,4 +1,4 @@
-import type { Approval } from "eve/tools";
+import type { Approval } from "eve/tools/approval";
 import { APP_AUTH } from "./app-auth";
 
 export function isAutomated(session: {
diff --git a/apps/agent/agent/lib/blank-facts.ts b/apps/agent/agent/lib/blank-facts.ts
index 1923c0a93..fcbaed8f7 100644
--- a/apps/agent/agent/lib/blank-facts.ts
+++ b/apps/agent/agent/lib/blank-facts.ts
@@ -1,4 +1,5 @@
-import { db, FactStatus } from "@crm/db";
+import { FactStatus, type Prisma } from "@crm/db";
+import { forEachTenant } from "@crm/db/tenants";
 import {
 	canonicalValue,
 	type FactField,
@@ -45,10 +46,31 @@ export type BlankFactSweep = {
 
 export async function sweepBlankFacts(
 	options: { dry?: boolean } = {},
+): Promise<BlankFactSweep> {
+	const combined = emptySweep();
+
+	await forEachTenant(async (_organizationId, tx) => {
+		const sweep = await sweepTenantBlankFacts(tx, options);
+		combined.scanned += sweep.scanned;
+		combined.filled += sweep.filled;
+		combined.settled += sweep.settled;
+		combined.waiting += sweep.waiting;
+		combined.unscanned += sweep.unscanned;
+		combined.fills.push(...sweep.fills);
+	});
+
+	return combined;
+}
+
+async function sweepTenantBlankFacts(
+	tx: Prisma.TransactionClient,
+	options: { dry?: boolean },
 ): Promise<BlankFactSweep> {
 	const [pending, proposals] = await Promise.all([
-		db.contactFact.count({ where: { status: FactStatus.PROPOSED } }),
-		db.contactFact.findMany({
+		tx.contactFact.count({
+			where: { status: FactStatus.PROPOSED },
+		}),
+		tx.contactFact.findMany({
 			where: { status: FactStatus.PROPOSED },
 			select: {
 				id: true,
@@ -63,18 +85,13 @@ export async function sweepBlankFacts(
 		}),
 	]);
 
-	const sweep: BlankFactSweep = {
-		scanned: proposals.length,
-		filled: 0,
-		settled: 0,
-		waiting: 0,
-		unscanned: Math.max(0, pending - proposals.length),
-		fills: [],
-	};
+	const sweep = emptySweep();
+	sweep.scanned = proposals.length;
+	sweep.unscanned = Math.max(0, pending - proposals.length);
 
 	if (proposals.length === 0) return sweep;
 
-	const applied = await appliedValues([
+	const applied = await appliedValues(tx, [
 		...new Set(proposals.map((row) => row.contactId)),
 	]);
 
@@ -93,7 +110,7 @@ export async function sweepBlankFacts(
 			if (stale.length === 0) continue;
 
 			if (!options.dry) {
-				await db.contactFact.updateMany({
+				await tx.contactFact.updateMany({
 					where: { id: { in: stale.map((row) => row.id) } },
 					data: { status: FactStatus.SUPERSEDED, supersededAt: new Date() },
 				});
@@ -109,7 +126,7 @@ export async function sweepBlankFacts(
 		}
 
 		if (!options.dry) {
-			await fill(best.id, best.contactId, field, best.value, column);
+			await fill(tx, best.id, best.contactId, field, best.value, column);
 		}
 
 		sweep.filled += 1;
@@ -127,6 +144,17 @@ export async function sweepBlankFacts(
 	return sweep;
 }
 
+function emptySweep(): BlankFactSweep {
+	return {
+		scanned: 0,
+		filled: 0,
+		settled: 0,
+		waiting: 0,
+		unscanned: 0,
+		fills: [],
+	};
+}
+
 type Proposal = {
 	id: string;
 	contactId: string;
@@ -148,12 +176,13 @@ type Proposal = {
 };
 
 async function appliedValues(
+	tx: Prisma.TransactionClient,
 	contactIds: string[],
 ): Promise<Map<string, string>> {
 	const values = new Map<string, string>();
 
 	for (let start = 0; start < contactIds.length; start += 1000) {
-		const rows = await db.contactFact.findMany({
+		const rows = await tx.contactFact.findMany({
 			where: {
 				status: FactStatus.APPLIED,
 				contactId: { in: contactIds.slice(start, start + 1000) },
@@ -196,45 +225,44 @@ function redundant(group: Proposal[], value: string | null): Proposal[] {
 }
 
 async function fill(
+	tx: Prisma.TransactionClient,
 	factId: string,
 	contactId: string,
 	field: FactField,
 	value: string,
 	column: string | null,
 ): Promise<void> {
-	await db.$transaction(async (tx) => {
-		await tx.contactFact.updateMany({
-			where: {
-				contactId,
-				field,
-				id: { not: factId },
-				status: { in: [FactStatus.APPLIED, FactStatus.PROPOSED] },
-			},
-			data: { status: FactStatus.SUPERSEDED, supersededAt: new Date() },
-		});
+	await tx.contactFact.updateMany({
+		where: {
+			contactId,
+			field,
+			id: { not: factId },
+			status: { in: [FactStatus.APPLIED, FactStatus.PROPOSED] },
+		},
+		data: { status: FactStatus.SUPERSEDED, supersededAt: new Date() },
+	});
+
+	await tx.contactFact.update({
+		where: { id: factId },
+		data: { status: FactStatus.APPLIED },
+	});
 
-		await tx.contactFact.update({
-			where: { id: factId },
-			data: { status: FactStatus.APPLIED },
+	if (column) {
+		await tx.contact.update({
+			where: { id: contactId },
+			data: { [column]: value },
 		});
+	}
 
-		if (column) {
+	if (field === "name") {
+		const split = splitName(value);
+		if (split) {
 			await tx.contact.update({
 				where: { id: contactId },
-				data: { [column]: value },
+				data: { firstName: split.firstName, lastName: split.lastName },
 			});
 		}
-
-		if (field === "name") {
-			const split = splitName(value);
-			if (split) {
-				await tx.contact.update({
-					where: { id: contactId },
-					data: { firstName: split.firstName, lastName: split.lastName },
-				});
-			}
-		}
-	});
+	}
 }
 
 function key(contactId: string, field: string): string {
diff --git a/apps/agent/agent/lib/brand.ts b/apps/agent/agent/lib/brand.ts
index fdd7740bd..31f3cf99c 100644
--- a/apps/agent/agent/lib/brand.ts
+++ b/apps/agent/agent/lib/brand.ts
@@ -1,4 +1,5 @@
-import { db, EnrichmentStatus } from "@crm/db";
+import { EnrichmentStatus } from "@crm/db";
+import { scopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import { mirrorBrandImages } from "./brand-images";
 import { brandToUpdate, filledFields, stillFillable } from "./brand-mapping";
 import { brandByDomain, contextDevEnabled } from "./context-dev";
@@ -51,7 +52,7 @@ export async function runBrand({
 	fresh?: boolean;
 	spend?: Spend;
 }): Promise<BrandResult> {
-	const company = await db.company.findUnique({
+	const company = await scopedDb.company.findUnique({
 		where: { id: companyId },
 		select: COMPANY_FIELDS,
 	});
@@ -78,7 +79,7 @@ export async function runBrand({
 	const charge = spend(2);
 	if (!charge.ok) return { enriched: false, reason: charge.reason };
 
-	await db.company.updateMany({
+	await scopedDb.company.updateMany({
 		where: { id: companyId, ...UNLESS_COMPLETE },
 		data: {
 			enrichmentStatus: EnrichmentStatus.RUNNING,
@@ -106,7 +107,7 @@ export async function runBrand({
 
 	const { mirrored } = await mirrorBrandImages(companyId, update);
 
-	const filled = await db.$transaction(async (tx) => {
+	const filled = await scopedTransaction(async (tx) => {
 		const current = await tx.company.findUnique({
 			where: { id: companyId },
 			select: COMPANY_FIELDS,
@@ -128,7 +129,10 @@ export async function runBrand({
 
 		await tx.companyEnrichment.upsert({
 			where: { companyId },
-			create: { companyId, raw: result.raw as object },
+			create: {
+				companyId,
+				raw: result.raw as object,
+			},
 			update: { raw: result.raw as object, fetchedAt: new Date() },
 		});
 
@@ -173,7 +177,7 @@ async function settle(
 	error: string,
 	guard: SettleGuard = { enrichmentStatus: EnrichmentStatus.RUNNING },
 ): Promise<void> {
-	await db.company.updateMany({
+	await scopedDb.company.updateMany({
 		where: { id: companyId, ...guard },
 		data: { enrichmentStatus: status, enrichmentError: error },
 	});
diff --git a/apps/agent/agent/lib/builder-input.ts b/apps/agent/agent/lib/builder-input.ts
index a3dbbed7c..ed7bbc22f 100644
--- a/apps/agent/agent/lib/builder-input.ts
+++ b/apps/agent/agent/lib/builder-input.ts
@@ -1,5 +1,6 @@
-import { db, type Prisma } from "@crm/db";
+import type { Prisma } from "@crm/db";
 import { lockIdempotencyKey } from "@crm/db/idempotency";
+import { tenantTransaction } from "@crm/db/tenant-scope";
 import { type InputRequested, parse, schemas } from "@crm/validation";
 import type { ChannelEvents } from "eve/channels";
 import {
@@ -20,6 +21,7 @@ type InputRequestedEvent = Parameters<
 export async function persistBuilderInputRequest(
 	data: InputRequestedEvent,
 	continuationToken: string | undefined,
+	organizationId: string,
 	authenticatedConversationId?: string | null,
 ): Promise<boolean> {
 	const conversationId =
@@ -39,7 +41,7 @@ export async function persistBuilderInputRequest(
 
 	const eventId = `${eventPrefix(conversationId)}${question.requestId}`;
 
-	return db.$transaction(async (tx) => {
+	return tenantTransaction(organizationId, async (tx) => {
 		await lockIdempotencyKey(tx, eventId);
 
 		const replay = await tx.agentEvent.findUnique({
@@ -49,7 +51,11 @@ export async function persistBuilderInputRequest(
 		if (replay) return false;
 
 		const conversation = await lockBuilderConversation(tx, conversationId);
-		if (conversation?.kind !== "BUILDER" || !conversation.sessionId) {
+		if (
+			conversation?.organizationId !== organizationId ||
+			conversation.kind !== "BUILDER" ||
+			!conversation.sessionId
+		) {
 			return false;
 		}
 
diff --git a/apps/agent/agent/lib/builder-runtime.ts b/apps/agent/agent/lib/builder-runtime.ts
index 4a2a2f9a8..f61100099 100644
--- a/apps/agent/agent/lib/builder-runtime.ts
+++ b/apps/agent/agent/lib/builder-runtime.ts
@@ -1,12 +1,13 @@
 import { isDeepStrictEqual } from "node:util";
-import { db, type Prisma } from "@crm/db";
+import type { Prisma } from "@crm/db";
 import {
 	CRM_EVENT_CATALOG,
 	CRM_EVENT_TYPES,
 	type CrmEventType,
 } from "@crm/db/crm-events";
 import { readAgentModel } from "@crm/db/settings";
-import { WORKSPACE_ID } from "@crm/db/workspace";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedTransaction, tenantTransaction } from "@crm/db/tenant-scope";
 import { AGENT_ACTION_TYPES } from "@crm/validation/agent-manifest";
 import { z } from "zod";
 import { actionDependency } from "./agent-actions";
@@ -93,6 +94,7 @@ const ARTIFACT_LANGUAGES = {
 } satisfies Record<BuilderArtifactPath, string>;
 
 export async function writeBuilderArtifact(
+	organizationId: string,
 	conversationId: string,
 	userId: string,
 	path: BuilderArtifactPath,
@@ -100,7 +102,7 @@ export async function writeBuilderArtifact(
 ) {
 	assertSafeArtifact(content);
 
-	return db.$transaction(async (tx) => {
+	return tenantTransaction(organizationId, async (tx) => {
 		const [conversation] = await tx.$queryRaw<Array<{ id: string }>>`
 			SELECT id
 			FROM "agentConversation"
@@ -120,7 +122,11 @@ export async function writeBuilderArtifact(
 		});
 
 		if (latest?.content === content) {
-			return { saved: true as const, id: latest.id, revision: latest.revision };
+			return {
+				saved: true as const,
+				id: latest.id,
+				revision: latest.revision,
+			};
 		}
 
 		const artifact = await tx.agentBuilderArtifact.create({
@@ -140,37 +146,43 @@ export async function writeBuilderArtifact(
 	});
 }
 
-export async function builderContext(conversationId: string, userId: string) {
-	const conversation = await db.agentConversation.findFirst({
-		where: { id: conversationId, userId, kind: "BUILDER" },
-		select: {
-			id: true,
-			title: true,
-			agent: {
-				select: {
-					id: true,
-					name: true,
-					description: true,
-					status: true,
-					versions: {
-						orderBy: { number: "desc" },
-						take: 1,
-						select: {
-							id: true,
-							number: true,
-							status: true,
-							manifest: true,
-							instructions: true,
+export async function builderContext(
+	organizationId: string,
+	conversationId: string,
+	userId: string,
+) {
+	const conversation = await tenantTransaction(organizationId, (tx) =>
+		tx.agentConversation.findFirst({
+			where: { id: conversationId, userId, kind: "BUILDER" },
+			select: {
+				id: true,
+				title: true,
+				agent: {
+					select: {
+						id: true,
+						name: true,
+						description: true,
+						status: true,
+						versions: {
+							orderBy: { number: "desc" },
+							take: 1,
+							select: {
+								id: true,
+								number: true,
+								status: true,
+								manifest: true,
+								instructions: true,
+							},
 						},
 					},
 				},
+				submissions: {
+					orderBy: { createdAt: "asc" },
+					select: { id: true, message: true, createdAt: true },
+				},
 			},
-			submissions: {
-				orderBy: { createdAt: "asc" },
-				select: { id: true, message: true, createdAt: true },
-			},
-		},
-	});
+		}),
+	);
 
 	if (!conversation)
 		throw new Error("This builder conversation is unavailable.");
@@ -181,34 +193,46 @@ export async function builderContext(conversationId: string, userId: string) {
 		),
 	);
 
+	const [availableConnections, describedResources] = await runInTenant(
+		organizationId,
+		() =>
+			Promise.all([
+				connectionStatus(userId, organizationId),
+				describeResources(resources),
+			]),
+	);
+
 	return {
 		conversation: {
 			id: conversation.id,
 			title: conversation.title,
 		},
-		availableConnections: await connectionStatus(userId),
+		availableConnections,
 		crmEvents: CRM_EVENT_TYPES.map((type) => ({
 			type,
 			...CRM_EVENT_CATALOG[type],
 		})),
-		resources: await describeResources(resources),
+		resources: describedResources,
 		existingDraft: conversation.agent,
 		now: new Date().toISOString(),
 	};
 }
 
 export async function saveBuilderDraft(
+	organizationId: string,
 	conversationId: string,
 	userId: string,
 	input: DraftAgentInput,
 ) {
-	const conversation = await db.agentConversation.findFirst({
-		where: { id: conversationId, userId, kind: "BUILDER" },
-		select: {
-			id: true,
-			submissions: { select: { message: true } },
-		},
-	});
+	const conversation = await tenantTransaction(organizationId, (tx) =>
+		tx.agentConversation.findFirst({
+			where: { id: conversationId, userId, kind: "BUILDER" },
+			select: {
+				id: true,
+				submissions: { select: { message: true } },
+			},
+		}),
+	);
 
 	if (!conversation)
 		throw new Error("This builder conversation is unavailable.");
@@ -218,7 +242,9 @@ export async function saveBuilderDraft(
 			resourcesOf(submission.message),
 		),
 	);
-	const validation = await validateDraft(userId, input, taggedResources);
+	const validation = await runInTenant(organizationId, () =>
+		validateDraft(userId, input, taggedResources, organizationId),
+	);
 	if (!validation.valid) {
 		return {
 			saved: false as const,
@@ -227,7 +253,9 @@ export async function saveBuilderDraft(
 		};
 	}
 
-	const model = await readAgentModel(db);
+	const model = await tenantTransaction(organizationId, (tx) =>
+		readAgentModel(tx),
+	);
 	const now = new Date();
 	const manifestTriggers = input.triggers.map((trigger) => ({
 		type: trigger.type,
@@ -265,7 +293,7 @@ export async function saveBuilderDraft(
 	const files = artifactFiles(input, JSON.stringify(manifest, null, 2));
 	for (const file of files) assertSafeArtifact(file.content);
 
-	return db.$transaction(async (tx) => {
+	return tenantTransaction(organizationId, async (tx) => {
 		const [lockedConversation] = await tx.$queryRaw<
 			Array<{ id: string; agentId: string | null }>
 		>`
@@ -481,8 +509,9 @@ async function validateDraft(
 	userId: string,
 	input: DraftAgentInput,
 	taggedResources: BuilderResource[],
+	organizationId: string,
 ) {
-	const connections = await connectionStatus(userId);
+	const connections = await connectionStatus(userId, organizationId);
 	const issues: string[] = [];
 	const capabilities = new Set(["crm.read"]);
 	const resourceKeys = new Set<string>();
@@ -622,45 +651,47 @@ async function validateDraft(
 	};
 }
 
-async function connectionStatus(userId: string) {
-	const [googleAccounts, slackAccount, workspaceMembers] = await Promise.all([
-		db.account.findMany({
-			where: { userId, providerId: "google" },
-			select: { providerId: true, scope: true },
-		}),
-		db.account.findFirst({
-			where: { providerId: "slack", accessToken: { not: null } },
-			orderBy: { updatedAt: "desc" },
-			select: { id: true },
-		}),
-		db.member.findMany({
-			where: { organizationId: WORKSPACE_ID },
-			orderBy: { user: { name: "asc" } },
-			select: {
-				user: {
+async function connectionStatus(userId: string, organizationId: string) {
+	const [googleAccounts, slackAccount, workspaceMembers, slackChannels] =
+		await scopedTransaction((tx) =>
+			Promise.all([
+				tx.account.findMany({
+					where: { userId, providerId: "google" },
+					select: { providerId: true, scope: true },
+				}),
+				tx.slackWorkspaceGrant.findFirst({
+					where: { botToken: { not: null } },
+					orderBy: { updatedAt: "desc" },
+					select: { id: true },
+				}),
+				tx.member.findMany({
+					where: { organizationId },
+					orderBy: { user: { name: "asc" } },
 					select: {
-						name: true,
-						email: true,
-						slackMemberMatch: {
+						user: {
 							select: {
-								slackUserId: true,
-								slackHandle: true,
-								slackEmail: true,
+								name: true,
+								email: true,
+								slackMemberMatch: {
+									select: {
+										slackUserId: true,
+										slackHandle: true,
+										slackEmail: true,
+									},
+								},
 							},
 						},
 					},
-				},
-			},
-		}),
-	]);
-	if (slackAccount) void requestStaleSlackInventorySync();
-
-	const slackChannels = await db.slackChannel.findMany({
-		where: { available: true },
-		orderBy: { name: "asc" },
-		take: 100,
-		select: { id: true, name: true, memberCount: true },
-	});
+				}),
+				tx.slackChannel.findMany({
+					where: { available: true },
+					orderBy: { name: "asc" },
+					take: 100,
+					select: { id: true, name: true, memberCount: true },
+				}),
+			]),
+		);
+	if (slackAccount) void requestStaleSlackInventorySync(organizationId);
 	const scopes = new Set(
 		googleAccounts.flatMap((account) => (account.scope ?? "").split(/[,\s]+/)),
 	);
@@ -735,53 +766,55 @@ export function slackDestinationIssues(
 }
 
 async function describeResources(resources: BuilderResource[]) {
-	return Promise.all(
-		resources.map(async (resource) => {
-			if (resource.kind === "company") {
-				const row = await db.company.findUnique({
-					where: { id: resource.id },
-					select: { id: true, name: true, domain: true, industry: true },
-				});
-				return { ...resource, record: row };
-			}
-			if (resource.kind === "contact") {
-				const row = await db.contact.findUnique({
-					where: { id: resource.id },
-					select: {
-						id: true,
-						firstName: true,
-						lastName: true,
-						email: true,
-						title: true,
-						company: { select: { id: true, name: true } },
-					},
-				});
-				return { ...resource, record: row };
-			}
-			if (resource.kind === "deal") {
-				const row = await db.deal.findUnique({
-					where: { id: resource.id },
-					select: {
-						id: true,
-						name: true,
-						stage: true,
-						amount: true,
-						currency: true,
-						company: { select: { id: true, name: true } },
-					},
-				});
-				return {
-					...resource,
-					record: row
-						? {
-								...row,
-								amount: row.amount === null ? null : Number(row.amount),
-							}
-						: null,
-				};
-			}
-			return { ...resource, record: null };
-		}),
+	return scopedTransaction((tx) =>
+		Promise.all(
+			resources.map(async (resource) => {
+				if (resource.kind === "company") {
+					const row = await tx.company.findFirst({
+						where: { id: resource.id },
+						select: { id: true, name: true, domain: true, industry: true },
+					});
+					return { ...resource, record: row };
+				}
+				if (resource.kind === "contact") {
+					const row = await tx.contact.findFirst({
+						where: { id: resource.id },
+						select: {
+							id: true,
+							firstName: true,
+							lastName: true,
+							email: true,
+							title: true,
+							company: { select: { id: true, name: true } },
+						},
+					});
+					return { ...resource, record: row };
+				}
+				if (resource.kind === "deal") {
+					const row = await tx.deal.findFirst({
+						where: { id: resource.id },
+						select: {
+							id: true,
+							name: true,
+							stage: true,
+							amount: true,
+							currency: true,
+							company: { select: { id: true, name: true } },
+						},
+					});
+					return {
+						...resource,
+						record: row
+							? {
+									...row,
+									amount: row.amount === null ? null : Number(row.amount),
+								}
+							: null,
+					};
+				}
+				return { ...resource, record: null };
+			}),
+		),
 	);
 }
 
diff --git a/apps/agent/agent/lib/capabilities.ts b/apps/agent/agent/lib/capabilities.ts
index 2e587e955..642ddcae5 100644
--- a/apps/agent/agent/lib/capabilities.ts
+++ b/apps/agent/agent/lib/capabilities.ts
@@ -1,7 +1,7 @@
 import "@crm/env/load";
 
-import { db } from "@crm/db";
 import { readContextDevKey } from "@crm/db/settings";
+import { scopedTransaction } from "@crm/db/tenant-scope";
 
 export const CONTEXT_DEV = "CONTEXT_DEV";
 
@@ -19,7 +19,7 @@ export type Capability = {
 
 export async function contextDevKey(): Promise<string | null> {
 	try {
-		return await readContextDevKey(db);
+		return await scopedTransaction((tx) => readContextDevKey(tx));
 	} catch (error) {
 		console.error(
 			`[agent] could not read the Context.dev key from the database: ${
diff --git a/apps/agent/agent/lib/conversation-title.ts b/apps/agent/agent/lib/conversation-title.ts
index 5eb2efbba..0edd73d20 100644
--- a/apps/agent/agent/lib/conversation-title.ts
+++ b/apps/agent/agent/lib/conversation-title.ts
@@ -1,4 +1,4 @@
-import { db } from "@crm/db";
+import { scopedDb as db } from "@crm/db/tenant-scope";
 
 export const BUILDER_CONVERSATION_TITLE_MAX_LENGTH = 60;
 
diff --git a/apps/agent/agent/lib/crm.ts b/apps/agent/agent/lib/crm.ts
index 0c0e5e82e..b2426e1ca 100644
--- a/apps/agent/agent/lib/crm.ts
+++ b/apps/agent/agent/lib/crm.ts
@@ -1,4 +1,5 @@
-import { db, EnrichmentStatus, type Prisma } from "@crm/db";
+import { EnrichmentStatus, type Prisma } from "@crm/db";
+import { scopedDb as db } from "@crm/db/tenant-scope";
 import { domainOf, isDerivedName } from "./names";
 import type { Person } from "./socials";
 
diff --git a/apps/agent/agent/lib/custom-agent-dispatch.ts b/apps/agent/agent/lib/custom-agent-dispatch.ts
index aff74d24e..9b945a14a 100644
--- a/apps/agent/agent/lib/custom-agent-dispatch.ts
+++ b/apps/agent/agent/lib/custom-agent-dispatch.ts
@@ -1,9 +1,13 @@
-import { db, Prisma } from "@crm/db";
+import { Prisma } from "@crm/db";
 import { CRM_EVENT_CATALOG } from "@crm/db/crm-events";
 import { lockIdempotencyKey } from "@crm/db/idempotency";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb, tenantTransaction } from "@crm/db/tenant-scope";
+import { collectAcrossTenants, locateTenantRow } from "@crm/db/tenants";
 import { crmEventTask } from "@crm/validation/agent-events";
 import { readAgentTriggerConfig } from "@crm/validation/agent-manifest";
-import type { SendFn } from "eve/channels";
+import type { UserContent } from "ai";
+import type { ChannelFrom } from "eve/channels";
 import { z } from "zod";
 import { DISPATCH } from "./dispatch-config";
 import { DEPENDENCY_UNAVAILABLE, runDependencyFailure } from "./run-preflight";
@@ -20,7 +24,17 @@ const MAX_BUILDER_ATTEMPTS = DISPATCH.builder.maxAttempts;
 const BUILDER_LEASE_MS = DISPATCH.builder.leaseMs;
 const RUN_DELIVERY_LEASE_MS = DISPATCH.run.deliveryLeaseMs;
 
-type BuilderMessageParts = Extract<Parameters<SendFn>[0], readonly unknown[]>;
+function compareByDateThenId<T extends { id: string }>(
+	date: (row: T) => Date | null,
+) {
+	return (left: T, right: T) => {
+		const time = (date(left)?.getTime() ?? 0) - (date(right)?.getTime() ?? 0);
+		if (time !== 0) return time;
+		return left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
+	};
+}
+
+type BuilderMessageParts = Extract<UserContent, readonly unknown[]>;
 
 const trimmedText = z.string().trim().catch("");
 
@@ -46,23 +60,35 @@ const builderSubmissionMessage = z
 		inputResponse: { requestId: "", optionId: "", text: "" },
 	});
 
+type BuilderInputResponse = z.infer<typeof builderInputResponse>;
+type BuilderSubmissionMessage = z.infer<typeof builderSubmissionMessage>;
+
+function isCreateAgentInput(inputResponse: BuilderInputResponse): boolean {
+	return Boolean(
+		inputResponse.requestId && (inputResponse.optionId || inputResponse.text),
+	);
+}
+
 export async function pendingBuilderSubmissionIds(): Promise<string[]> {
 	await recoverBuilderSubmissions();
-	const rows = await db.agentConversationSubmission.findMany({
-		where: {
-			status: "PENDING",
-			conversation: {
-				kind: "BUILDER",
-				OR: [{ sessionId: null }, { continuationToken: { not: null } }],
+	const rows = await collectAcrossTenants(() =>
+		scopedDb.agentConversationSubmission.findMany({
+			where: {
+				status: "PENDING",
+				conversation: {
+					kind: "BUILDER",
+					OR: [{ sessionId: null }, { continuationToken: { not: null } }],
+				},
 			},
-		},
-		orderBy: [{ createdAt: "asc" }, { id: "asc" }],
-		take: BUILDER_BATCH * 3,
-		select: { id: true, conversationId: true },
-	});
+			orderBy: [{ createdAt: "asc" }, { id: "asc" }],
+			take: BUILDER_BATCH * 3,
+			select: { id: true, conversationId: true, createdAt: true },
+		}),
+	);
 
 	const seen = new Set<string>();
 	return rows
+		.sort(compareByDateThenId((row) => row.createdAt))
 		.flatMap((row) => {
 			if (seen.has(row.conversationId)) return [];
 			seen.add(row.conversationId);
@@ -71,23 +97,30 @@ export async function pendingBuilderSubmissionIds(): Promise<string[]> {
 		.slice(0, BUILDER_BATCH);
 }
 
-export async function drainBuilder(send: SendFn): Promise<number> {
+export async function drainBuilder(from: ChannelFrom): Promise<number> {
 	const ids = await pendingBuilderSubmissionIds();
-	await Promise.all(ids.map((id) => dispatchBuilderSubmission(id, send)));
+	await Promise.all(ids.map((id) => dispatchBuilderSubmission(id, from)));
 	return ids.length;
 }
 
 export async function dispatchBuilderSubmission(
 	submissionId: string,
-	send: SendFn,
+	from: ChannelFrom,
 ) {
-	const submission = await db.$transaction(async (tx) => {
-		const seed = await tx.agentConversationSubmission.findUnique({
+	const located = await locateTenantRow(() =>
+		scopedDb.agentConversationSubmission.findUnique({
 			where: { id: submissionId },
-			select: { conversationId: true },
-		});
-		if (!seed) throw new Error("Builder submission is unavailable.");
+			select: {
+				conversationId: true,
+				conversation: { select: { organizationId: true } },
+			},
+		}),
+	);
+	const seed = located?.row;
+	if (!seed) throw new Error("Builder submission is unavailable.");
 
+	const organizationId = seed.conversation.organizationId;
+	const submission = await tenantTransaction(organizationId, async (tx) => {
 		const conversation = await lockBuilderConversation(tx, seed.conversationId);
 		if (conversation?.kind !== "BUILDER") {
 			throw new Error("Builder submission is unavailable.");
@@ -146,6 +179,7 @@ export async function dispatchBuilderSubmission(
 				conversation: {
 					select: {
 						id: true,
+						organizationId: true,
 						title: true,
 						userId: true,
 						kind: true,
@@ -157,35 +191,40 @@ export async function dispatchBuilderSubmission(
 	const conversationId = submission.conversation.id;
 
 	try {
-		const session = await send(
-			builderDeliveryMessage(
-				submission.id,
-				submission.message,
-				submission.attachments,
-			),
-			{
-				auth: {
-					authenticator: "crm-builder",
-					principalType: "user",
-					principalId: submission.conversation.userId,
-					attributes: {
-						purpose: "builder",
-						commandType: builderCommandType(
-							submission.commandType,
-							submission.message,
-						),
-						needsTitle: submission.conversation.title ? "false" : "true",
-						conversationId,
-						userId: submission.conversation.userId,
-						submissionId: submission.id,
-					},
-				},
-				continuationToken: builderToken(conversationId),
-				title: submission.conversation.title ?? "Agent builder",
+		const message = builderSubmissionMessage.parse(submission.message);
+		const { inputResponse } = message;
+		const { requestId, optionId, text: responseText } = inputResponse;
+		const isCreateAgent = isCreateAgentInput(inputResponse);
+		const auth = {
+			authenticator: "crm-builder",
+			principalType: "user",
+			principalId: submission.conversation.userId,
+			attributes: {
+				purpose: "builder",
+				organizationId: submission.conversation.organizationId,
+				commandType: isCreateAgent ? "CREATE_AGENT" : submission.commandType,
+				needsTitle: submission.conversation.title ? "false" : "true",
+				conversationId,
+				userId: submission.conversation.userId,
+				submissionId: submission.id,
 			},
-		);
-
-		await db.$transaction(async (tx) => {
+		};
+		const session = isCreateAgent
+			? await from(builderToken(conversationId)).respond(
+					[
+						{
+							requestId,
+							...(optionId ? { optionId } : { text: responseText }),
+						},
+					],
+					{ auth },
+				)
+			: await from(builderToken(conversationId)).send(
+					builderDeliveryParts(message, submission.id, submission.attachments),
+					{ auth, title: submission.conversation.title ?? "Agent builder" },
+				);
+
+		await tenantTransaction(organizationId, async (tx) => {
 			const conversation = await lockBuilderConversation(tx, conversationId);
 			if (!conversation) return;
 			await tx.agentConversationSubmission.update({
@@ -205,7 +244,7 @@ export async function dispatchBuilderSubmission(
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
 		const retry = submission.attemptCount < MAX_BUILDER_ATTEMPTS;
-		await db.$transaction(async (tx) => {
+		await tenantTransaction(organizationId, async (tx) => {
 			const conversation = await lockBuilderConversation(tx, conversationId);
 			if (!conversation) return;
 			await tx.agentConversationSubmission.update({
@@ -226,26 +265,30 @@ export async function dispatchBuilderSubmission(
 }
 
 export async function queueDueAgentRuns(now = new Date()): Promise<number> {
-	const triggers = await db.agentTrigger.findMany({
-		where: {
-			enabled: true,
-			type: "SCHEDULE",
-			nextRunAt: { lte: now },
-			agent: { status: "LIVE" },
-		},
-		orderBy: [{ nextRunAt: "asc" }, { id: "asc" }],
-		take: RUN_BATCH,
-		select: {
-			id: true,
-			agentId: true,
-			versionId: true,
-			nextRunAt: true,
-			config: true,
-		},
-	});
+	const triggers = await collectAcrossTenants(() =>
+		scopedDb.agentTrigger.findMany({
+			where: {
+				enabled: true,
+				type: "SCHEDULE",
+				nextRunAt: { lte: now },
+				agent: { status: "LIVE" },
+			},
+			orderBy: [{ nextRunAt: "asc" }, { id: "asc" }],
+			take: RUN_BATCH,
+			select: {
+				id: true,
+				organizationId: true,
+				agentId: true,
+				versionId: true,
+				nextRunAt: true,
+				config: true,
+			},
+		}),
+	);
+	triggers.sort(compareByDateThenId((trigger) => trigger.nextRunAt));
 
 	let queued = 0;
-	for (const trigger of triggers) {
+	for (const trigger of triggers.slice(0, RUN_BATCH)) {
 		if (!trigger.nextRunAt) continue;
 		const scheduledAt = trigger.nextRunAt;
 		const intervalMinutes = readAgentTriggerConfig(
@@ -253,43 +296,52 @@ export async function queueDueAgentRuns(now = new Date()): Promise<number> {
 		).intervalMinutes;
 		const nextRunAt = advance(scheduledAt, intervalMinutes, now);
 		const idempotencyKey = `${trigger.id}:${scheduledAt.toISOString()}`;
-		const claimed = await db.$transaction(async (tx) => {
-			const [agent] = await tx.$queryRaw<Array<{ id: string; status: string }>>`
-				SELECT id, status
-				FROM "agentDefinition"
-				WHERE id = ${trigger.agentId}
-				FOR UPDATE
-			`;
-			if (agent?.status !== "LIVE") return false;
-
-			const updated = await tx.agentTrigger.updateMany({
-				where: {
-					id: trigger.id,
-					nextRunAt: scheduledAt,
-					enabled: true,
-				},
-				data: { nextRunAt, lastRunAt: scheduledAt },
-			});
-			if (updated.count === 0) return false;
+		const claimed = await tenantTransaction(
+			trigger.organizationId,
+			async (tx) => {
+				const [agent] = await tx.$queryRaw<
+					Array<{ id: string; status: string }>
+				>`
+			SELECT id, status
+			FROM "agentDefinition"
+			WHERE id = ${trigger.agentId}
+			FOR UPDATE
+		`;
+				if (agent?.status !== "LIVE") return false;
 
-			await tx.agentRun.upsert({
-				where: { idempotencyKey },
-				create: {
-					agentId: trigger.agentId,
-					versionId: trigger.versionId,
-					triggerId: trigger.id,
-					triggerType: "SCHEDULE",
-					idempotencyKey,
-					correlationId: crypto.randomUUID(),
-					input: { scheduledFor: scheduledAt.toISOString() },
-					events: {
-						create: { sequence: 0, type: "run.queued", data: {} },
+				const updated = await tx.agentTrigger.updateMany({
+					where: {
+						id: trigger.id,
+						nextRunAt: scheduledAt,
+						enabled: true,
 					},
-				},
-				update: {},
-			});
-			return true;
-		});
+					data: { nextRunAt, lastRunAt: scheduledAt },
+				});
+				if (updated.count === 0) return false;
+
+				await tx.agentRun.upsert({
+					where: { idempotencyKey },
+					create: {
+						agentId: trigger.agentId,
+						versionId: trigger.versionId,
+						triggerId: trigger.id,
+						triggerType: "SCHEDULE",
+						idempotencyKey,
+						correlationId: crypto.randomUUID(),
+						input: { scheduledFor: scheduledAt.toISOString() },
+						events: {
+							create: {
+								sequence: 0,
+								type: "run.queued",
+								data: {},
+							},
+						},
+					},
+					update: {},
+				});
+				return true;
+			},
+		);
 		if (claimed) queued += 1;
 	}
 
@@ -299,7 +351,7 @@ export async function queueDueAgentRuns(now = new Date()): Promise<number> {
 export async function queueEventAgentRuns(
 	task: Pick<
 		LeasedTask,
-		"id" | "contactId" | "companyId" | "dealId" | "payload"
+		"id" | "organizationId" | "contactId" | "companyId" | "dealId" | "payload"
 	>,
 ): Promise<number> {
 	const parsed = crmEventTask.safeParse(task.payload);
@@ -321,27 +373,29 @@ export async function queueEventAgentRuns(
 		throw new Error("The queued agent event is invalid.");
 	}
 
-	const triggers = await db.agentTrigger.findMany({
-		where: {
-			enabled: true,
-			type: "EVENT",
-			agent: { status: "LIVE" },
-		},
-		orderBy: { id: "asc" },
-		select: {
-			id: true,
-			agentId: true,
-			versionId: true,
-			config: true,
-		},
-	});
+	const triggers = await tenantTransaction(task.organizationId, (tx) =>
+		tx.agentTrigger.findMany({
+			where: {
+				enabled: true,
+				type: "EVENT",
+				agent: { status: "LIVE" },
+			},
+			orderBy: { id: "asc" },
+			select: {
+				id: true,
+				agentId: true,
+				versionId: true,
+				config: true,
+			},
+		}),
+	);
 
 	let matched = 0;
 	for (const trigger of triggers) {
 		if (readAgentTriggerConfig(trigger.config).event !== eventType) continue;
 		const idempotencyKey = `event:${task.id}:trigger:${trigger.id}`;
 
-		const queued = await db.$transaction(async (tx) => {
+		const queued = await tenantTransaction(task.organizationId, async (tx) => {
 			await lockIdempotencyKey(tx, idempotencyKey);
 			const eligible = await tx.agentTrigger.findFirst({
 				where: {
@@ -361,6 +415,7 @@ export async function queueEventAgentRuns(
 					versionId: trigger.versionId,
 					triggerId: trigger.id,
 					triggerType: "EVENT",
+					dealId: recordKind === "deal" ? recordId : null,
 					idempotencyKey,
 					correlationId: `trigger:${trigger.id}:event:${task.id}`,
 					input: {
@@ -391,26 +446,37 @@ export async function queueEventAgentRuns(
 
 export async function pendingAgentRunIds(): Promise<string[]> {
 	await recoverAgentRuns();
-	const rows = await db.agentRun.findMany({
-		where: {
-			status: "QUEUED",
-			agent: {
-				status: "LIVE",
-				runs: {
-					none: { status: { in: ["RUNNING", "WAITING_FOR_APPROVAL"] } },
+	const rows = await collectAcrossTenants(() =>
+		scopedDb.agentRun.findMany({
+			where: {
+				status: "QUEUED",
+				agent: {
+					status: "LIVE",
+					runs: {
+						none: { status: { in: ["RUNNING", "WAITING_FOR_APPROVAL"] } },
+					},
 				},
 			},
-		},
-		orderBy: [{ createdAt: "asc" }, { id: "asc" }],
-		take: RUN_BATCH * 4,
-		select: { id: true, agentId: true, versionId: true },
-	});
+			orderBy: [{ createdAt: "asc" }, { id: "asc" }],
+			take: RUN_BATCH * 4,
+			select: {
+				id: true,
+				organizationId: true,
+				agentId: true,
+				versionId: true,
+				createdAt: true,
+			},
+		}),
+	);
+	rows.sort(compareByDateThenId((row) => row.createdAt));
 
 	const runnable: string[] = [];
 	const selectedAgents = new Set<string>();
-	for (const row of rows) {
+	for (const row of rows.slice(0, RUN_BATCH * 4)) {
 		if (selectedAgents.has(row.agentId)) continue;
-		const blocked = await runDependencyFailure(row.versionId);
+		const blocked = await runInTenant(row.organizationId, () =>
+			runDependencyFailure(row.versionId),
+		);
 		if (blocked) {
 			await failRun(row.id, DEPENDENCY_UNAVAILABLE, blocked).catch(() => {});
 			continue;
@@ -423,7 +489,7 @@ export async function pendingAgentRunIds(): Promise<string[]> {
 	return runnable;
 }
 
-export async function drainAgentRuns(send: SendFn): Promise<number> {
+export async function drainAgentRuns(from: ChannelFrom): Promise<number> {
 	await queueDueAgentRuns();
 
 	let dispatched = 0;
@@ -433,7 +499,7 @@ export async function drainAgentRuns(send: SendFn): Promise<number> {
 
 		const outcomes = await Promise.all(
 			ids.map((id) =>
-				dispatchAgentRun(id, send).then(
+				dispatchAgentRun(id, from).then(
 					() => true,
 					(error) => {
 						console.error(
@@ -452,32 +518,36 @@ export async function drainAgentRuns(send: SendFn): Promise<number> {
 	return dispatched;
 }
 
-export async function dispatchAgentRun(runId: string, send: SendFn) {
-	const run = await db.agentRun.findUnique({
-		where: { id: runId },
-		select: {
-			id: true,
-			status: true,
-			agentId: true,
-			versionId: true,
-			initiatedById: true,
-			agent: {
-				select: { name: true, createdById: true, status: true },
+export async function dispatchAgentRun(runId: string, from: ChannelFrom) {
+	const located = await locateTenantRow(() =>
+		scopedDb.agentRun.findUnique({
+			where: { id: runId },
+			select: {
+				id: true,
+				organizationId: true,
+				status: true,
+				agentId: true,
+				versionId: true,
+				initiatedById: true,
+				agent: {
+					select: { name: true, createdById: true, status: true },
+				},
+				version: { select: { modelId: true } },
 			},
-			version: { select: { modelId: true } },
-		},
-	});
+		}),
+	);
+	const run = located?.row;
 	if (run?.status !== "QUEUED" || run.agent.status !== "LIVE") {
 		throw new Error("Agent run was already claimed or is not live.");
 	}
 
-	const claim = await db.$transaction(async (tx) => {
+	const claim = await tenantTransaction(run.organizationId, async (tx) => {
 		const [agent] = await tx.$queryRaw<Array<{ id: string; status: string }>>`
-			SELECT id, status
-			FROM "agentDefinition"
-			WHERE id = ${run.agentId}
-			FOR UPDATE
-		`;
+		SELECT id, status
+		FROM "agentDefinition"
+		WHERE id = ${run.agentId}
+		FOR UPDATE
+	`;
 		if (agent?.status !== "LIVE") return "unavailable" as const;
 
 		const active = await tx.agentRun.findFirst({
@@ -512,28 +582,33 @@ export async function dispatchAgentRun(runId: string, send: SendFn) {
 
 	const principalId = run.initiatedById ?? run.agent.createdById;
 	try {
-		const session = await send(`Execute deployed agent run ${run.id}.`, {
-			auth: {
-				authenticator: run.initiatedById ? "crm-user" : "crm-schedule",
-				principalType: run.initiatedById ? "user" : "runtime",
-				principalId,
-				attributes: {
-					purpose: "team-agent",
-					runId: run.id,
-					agentId: run.agentId,
-					versionId: run.versionId,
-					userId: principalId,
+		const session = await from(runToken(run.id)).send(
+			`Execute deployed agent run ${run.id}.`,
+			{
+				auth: {
+					authenticator: run.initiatedById ? "crm-user" : "crm-schedule",
+					principalType: run.initiatedById ? "user" : "runtime",
+					principalId,
+					attributes: {
+						purpose: "team-agent",
+						organizationId: run.organizationId,
+						runId: run.id,
+						agentId: run.agentId,
+						versionId: run.versionId,
+						userId: principalId,
+					},
 				},
+				title: `${run.agent.name} run`,
+				mode: "task",
 			},
-			continuationToken: runToken(run.id),
-			title: `${run.agent.name} run`,
-			mode: "task",
-		});
+		);
 
-		await db.agentRun.updateMany({
-			where: { id: run.id, status: "RUNNING" },
-			data: { sessionId: session.id },
-		});
+		await tenantTransaction(run.organizationId, (tx) =>
+			tx.agentRun.updateMany({
+				where: { id: run.id, status: "RUNNING" },
+				data: { sessionId: session.id },
+			}),
+		);
 		return session;
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
@@ -543,7 +618,15 @@ export async function dispatchAgentRun(runId: string, send: SendFn) {
 }
 
 export async function failRun(runId: string, code: string, message: string) {
-	return db.$transaction(async (tx) => {
+	const locator = await locateTenantRow(() =>
+		scopedDb.agentRun.findUnique({
+			where: { id: runId },
+			select: { organizationId: true },
+		}),
+	);
+	if (!locator) throw new Error(`Agent run ${runId} does not exist.`);
+
+	return tenantTransaction(locator.organizationId, async (tx) => {
 		const run = await lockAgentRun(tx, runId);
 		if (run.status === "FAILED") {
 			return { id: run.id, status: "FAILED" as const };
@@ -599,7 +682,15 @@ export async function failRun(runId: string, code: string, message: string) {
 }
 
 export async function cancelRun(runId: string, code: string, message: string) {
-	return db.$transaction(async (tx) => {
+	const locator = await locateTenantRow(() =>
+		scopedDb.agentRun.findUnique({
+			where: { id: runId },
+			select: { organizationId: true },
+		}),
+	);
+	if (!locator) throw new Error(`Agent run ${runId} does not exist.`);
+
+	return tenantTransaction(locator.organizationId, async (tx) => {
 		const run = await lockAgentRun(tx, runId);
 		if (isTerminalRunStatus(run.status)) {
 			return { id: run.id, status: run.status, settled: false };
@@ -678,18 +769,27 @@ export function runIdFromToken(token: string | undefined): string | null {
 
 async function recoverBuilderSubmissions() {
 	const stale = new Date(Date.now() - BUILDER_LEASE_MS);
-	const rows = await db.agentConversationSubmission.findMany({
-		where: {
-			status: "SENDING",
-			sentAt: { lt: stale },
-		},
-		orderBy: [{ sentAt: "asc" }, { id: "asc" }],
-		take: BUILDER_BATCH * 3,
-		select: { id: true, conversationId: true, attemptCount: true },
-	});
+	const rows = await collectAcrossTenants(() =>
+		scopedDb.agentConversationSubmission.findMany({
+			where: {
+				status: "SENDING",
+				sentAt: { lt: stale },
+			},
+			orderBy: [{ sentAt: "asc" }, { id: "asc" }],
+			take: BUILDER_BATCH * 3,
+			select: {
+				id: true,
+				conversationId: true,
+				attemptCount: true,
+				sentAt: true,
+				conversation: { select: { organizationId: true } },
+			},
+		}),
+	);
+	rows.sort(compareByDateThenId((row) => row.sentAt));
 
-	for (const row of rows) {
-		await db.$transaction(async (tx) => {
+	for (const row of rows.slice(0, BUILDER_BATCH * 3)) {
+		await tenantTransaction(row.conversation.organizationId, async (tx) => {
 			const conversation = await lockBuilderConversation(
 				tx,
 				row.conversationId,
@@ -719,6 +819,7 @@ async function recoverBuilderSubmissions() {
 
 export type LockedBuilderConversation = {
 	id: string;
+	organizationId: string;
 	kind: string;
 	sessionId: string | null;
 	continuationToken: string | null;
@@ -729,7 +830,7 @@ export async function lockBuilderConversation(
 	conversationId: string,
 ): Promise<LockedBuilderConversation | null> {
 	const [conversation] = await tx.$queryRaw<LockedBuilderConversation[]>`
-		SELECT id, kind, "sessionId", "continuationToken"
+		SELECT id, "organizationId", kind, "sessionId", "continuationToken"
 		FROM "agentConversation"
 		WHERE id = ${conversationId}
 		FOR UPDATE
@@ -741,19 +842,22 @@ export const RUN_TIMED_OUT = "RUN_TIMED_OUT";
 
 async function timeOutOverrunningRuns() {
 	const overrun = new Date(Date.now() - DISPATCH.run.executionTimeoutMs);
-	const rows = await db.agentRun.findMany({
-		where: {
-			status: "RUNNING",
-			sessionId: { not: null },
-			startedAt: { lt: overrun },
-		},
-		orderBy: [{ startedAt: "asc" }, { id: "asc" }],
-		take: RUN_BATCH * 3,
-		select: { id: true },
-	});
+	const rows = await collectAcrossTenants(() =>
+		scopedDb.agentRun.findMany({
+			where: {
+				status: "RUNNING",
+				sessionId: { not: null },
+				startedAt: { lt: overrun },
+			},
+			orderBy: [{ startedAt: "asc" }, { id: "asc" }],
+			take: RUN_BATCH * 3,
+			select: { id: true, startedAt: true },
+		}),
+	);
+	rows.sort(compareByDateThenId((row) => row.startedAt));
 
 	const minutes = Math.round(DISPATCH.run.executionTimeoutMs / 60_000);
-	for (const row of rows) {
+	for (const row of rows.slice(0, RUN_BATCH * 3)) {
 		await failRun(
 			row.id,
 			RUN_TIMED_OUT,
@@ -766,25 +870,33 @@ async function recoverAgentRuns() {
 	await timeOutOverrunningRuns();
 
 	const stale = new Date(Date.now() - RUN_DELIVERY_LEASE_MS);
-	const rows = await db.agentRun.findMany({
-		where: {
-			status: "RUNNING",
-			sessionId: null,
-			startedAt: { lt: stale },
-		},
-		orderBy: [{ startedAt: "asc" }, { id: "asc" }],
-		take: RUN_BATCH * 3,
-		select: { id: true, agentId: true },
-	});
+	const rows = await collectAcrossTenants(() =>
+		scopedDb.agentRun.findMany({
+			where: {
+				status: "RUNNING",
+				sessionId: null,
+				startedAt: { lt: stale },
+			},
+			orderBy: [{ startedAt: "asc" }, { id: "asc" }],
+			take: RUN_BATCH * 3,
+			select: {
+				id: true,
+				organizationId: true,
+				agentId: true,
+				startedAt: true,
+			},
+		}),
+	);
+	rows.sort(compareByDateThenId((row) => row.startedAt));
 
-	for (const row of rows) {
-		await db.$transaction(async (tx) => {
+	for (const row of rows.slice(0, RUN_BATCH * 3)) {
+		await tenantTransaction(row.organizationId, async (tx) => {
 			const [agent] = await tx.$queryRaw<Array<{ status: string }>>`
-				SELECT status
-				FROM "agentDefinition"
-				WHERE id = ${row.agentId}
-				FOR UPDATE
-			`;
+			SELECT status
+			FROM "agentDefinition"
+			WHERE id = ${row.agentId}
+			FOR UPDATE
+		`;
 			const run = await lockAgentRun(tx, row.id);
 			if (
 				run.status !== "RUNNING" ||
@@ -830,24 +942,11 @@ async function recoverAgentRuns() {
 	}
 }
 
-export function builderDeliveryMessage(
+function builderDeliveryParts(
+	message: BuilderSubmissionMessage,
 	submissionId: string,
-	value: Prisma.JsonValue,
 	attachments: readonly BuilderDeliveryAttachment[] = [],
-): Parameters<SendFn>[0] {
-	const message = builderSubmissionMessage.parse(value);
-	const { requestId, optionId, text: responseText } = message.inputResponse;
-	if (requestId && (optionId || responseText)) {
-		return {
-			inputResponses: [
-				{
-					requestId,
-					...(optionId ? { optionId } : { text: responseText }),
-				},
-			],
-		};
-	}
-
+): string | UserContent {
 	const labels = message.resources
 		.map((resource) => resource.label)
 		.filter(Boolean);
@@ -875,13 +974,24 @@ export function builderDeliveryMessage(
 	return parts;
 }
 
+export function builderDeliveryMessage(
+	submissionId: string,
+	value: Prisma.JsonValue,
+	attachments: readonly BuilderDeliveryAttachment[] = [],
+): string | UserContent {
+	return builderDeliveryParts(
+		builderSubmissionMessage.parse(value),
+		submissionId,
+		attachments,
+	);
+}
+
 export function builderCommandType(
 	commandType: string,
 	value: Prisma.JsonValue,
 ): string {
-	const { requestId, optionId, text } =
-		builderSubmissionMessage.parse(value).inputResponse;
-	return requestId && (optionId || text) ? "CREATE_AGENT" : commandType;
+	const { inputResponse } = builderSubmissionMessage.parse(value);
+	return isCreateAgentInput(inputResponse) ? "CREATE_AGENT" : commandType;
 }
 
 type BuilderDeliveryAttachment = {
diff --git a/apps/agent/agent/lib/dispatch-config.ts b/apps/agent/agent/lib/dispatch-config.ts
index 4382b4a80..02628780a 100644
--- a/apps/agent/agent/lib/dispatch-config.ts
+++ b/apps/agent/agent/lib/dispatch-config.ts
@@ -30,6 +30,7 @@ export const DISPATCH = {
 
 	task: {
 		leaseMs: 10 * MINUTE_MS,
+		tenantConcurrency: 6,
 	},
 
 	reconcile: {
diff --git a/apps/agent/agent/lib/dispatch.ts b/apps/agent/agent/lib/dispatch.ts
index c2157b008..8fa3f4e4d 100644
--- a/apps/agent/agent/lib/dispatch.ts
+++ b/apps/agent/agent/lib/dispatch.ts
@@ -1,4 +1,6 @@
 import { EnrichmentStatus } from "@crm/db";
+import { DIRECT_KINDS } from "@crm/db/agent-tasks";
+import { collapsing, runLimited } from "@crm/db/pool";
 import { fieldBackfillPayload } from "@crm/validation/field-backfill";
 import { APP_AUTH, type AppAuth } from "./app-auth";
 import { brandOutcome, runBrand } from "./brand";
@@ -6,7 +8,6 @@ import { queueEventAgentRuns } from "./custom-agent-dispatch";
 import { settledWithin } from "./deadline";
 import { DISPATCH } from "./dispatch-config";
 import { markRunning, settle } from "./enrichment";
-import { collapsing, runLimited } from "./pool";
 import { runPortrait } from "./portrait";
 import { runSlackChannelJoin } from "./slack-join-task";
 import { runSlackPeopleMatch } from "./slack-people";
@@ -14,9 +15,9 @@ import { staleTaskSweep } from "./stale-tasks";
 import {
 	claimDue,
 	completeTask,
-	DIRECT_KINDS,
 	type LeasedTask,
 	noteSession,
+	runTaskInTenant,
 } from "./tasks";
 
 export const VISIBLE_BATCH = DISPATCH.visible.batch;
@@ -54,9 +55,11 @@ export async function runDirect(
 	handle: (task: LeasedTask) => Promise<void> = handleDirect,
 	timeoutMs: number = DISPATCH.sweep.itemTimeoutMs,
 ): Promise<void> {
-	const work: Promise<DirectOutcome> = handle(task).then(
-		() => ({ finished: true }) as const,
-		(error) => ({ finished: false, reason: reasonOf(error) }) as const,
+	const work: Promise<DirectOutcome> = runTaskInTenant(task, () =>
+		handle(task).then(
+			() => ({ finished: true }) as const,
+			(error) => ({ finished: false, reason: reasonOf(error) }) as const,
+		),
 	);
 
 	const outcome = await settledWithin(work, timeoutMs);
@@ -80,7 +83,9 @@ async function reconcileDirect(
 ): Promise<void> {
 	if (outcome.finished) return;
 
-	await settle(task, EnrichmentStatus.FAILED, outcome.reason).catch(() => {});
+	await runTaskInTenant(task, () =>
+		settle(task, EnrichmentStatus.FAILED, outcome.reason).catch(() => {}),
+	);
 }
 
 async function handleDirect(task: LeasedTask): Promise<void> {
@@ -108,12 +113,15 @@ async function handleDirect(task: LeasedTask): Promise<void> {
 	}
 
 	if (task.kind === "slack-people-match") {
-		await completeTask(task.id, await runSlackPeopleMatch());
+		await completeTask(task.id, await runSlackPeopleMatch(task.organizationId));
 		return;
 	}
 
 	if (task.kind === "slack-channel-join") {
-		await completeTask(task.id, await runSlackChannelJoin(task.payload));
+		await completeTask(
+			task.id,
+			await runSlackChannelJoin(task.payload, task.organizationId),
+		);
 		return;
 	}
 
@@ -166,15 +174,17 @@ async function beginResearch(
 	start: (task: LeasedTask) => Promise<{ id: string }>,
 ): Promise<void> {
 	try {
-		await markRunning(task);
+		await runTaskInTenant(task, () => markRunning(task));
 	} catch (error) {
-		await settle(task, EnrichmentStatus.FAILED, reasonOf(error)).catch(
-			() => {},
+		await runTaskInTenant(task, () =>
+			settle(task, EnrichmentStatus.FAILED, reasonOf(error)).catch(() => {}),
 		);
 		return;
 	}
 
-	const send: Promise<StartOutcome> = start(task).then(
+	const send: Promise<StartOutcome> = runTaskInTenant(task, () =>
+		start(task),
+	).then(
 		(session) => ({ accepted: true, sessionId: session.id }) as const,
 		(error) => ({ accepted: false, reason: reasonOf(error) }) as const,
 	);
@@ -203,7 +213,9 @@ async function reconcileStart(
 		return;
 	}
 
-	await settle(task, EnrichmentStatus.FAILED, outcome.reason).catch(() => {});
+	await runTaskInTenant(task, () =>
+		settle(task, EnrichmentStatus.FAILED, outcome.reason).catch(() => {}),
+	);
 }
 
 export async function linkSession(
@@ -214,7 +226,7 @@ export async function linkSession(
 ): Promise<boolean> {
 	for (let attempt = 1; attempt <= link.attempts; attempt += 1) {
 		try {
-			await note(task.id, sessionId);
+			await runTaskInTenant(task, () => note(task.id, sessionId));
 			return true;
 		} catch (error) {
 			if (attempt < link.attempts) {
@@ -238,8 +250,18 @@ function reasonOf(cause: unknown): string {
 	return cause instanceof Error ? cause.message : String(cause);
 }
 
+type TaskAuthRecords = {
+	organizationId: string;
+	contactId?: string;
+	companyId?: string;
+	dealId?: string;
+	fieldKeys?: string;
+};
+
 export function taskAuth(task: LeasedTask, base: AppAuth = APP_AUTH): AppAuth {
-	const records: Record<string, string> = {};
+	const records: TaskAuthRecords = {
+		organizationId: task.organizationId,
+	};
 	if (task.contactId) records.contactId = task.contactId;
 	if (task.companyId) records.companyId = task.companyId;
 	if (task.dealId) records.dealId = task.dealId;
diff --git a/apps/agent/agent/lib/enrichment.ts b/apps/agent/agent/lib/enrichment.ts
index 5155f75e8..8298249fa 100644
--- a/apps/agent/agent/lib/enrichment.ts
+++ b/apps/agent/agent/lib/enrichment.ts
@@ -1,5 +1,6 @@
-import { db, EnrichmentStatus, type Prisma } from "@crm/db";
+import { EnrichmentStatus, type Prisma } from "@crm/db";
 import { ownsCompanyStatus, ownsContactStatus } from "@crm/db/agent-tasks";
+import { scopedDb } from "@crm/db/tenant-scope";
 import type { TaskSubject } from "./tasks";
 
 type StatusGuard =
@@ -69,14 +70,14 @@ async function write(
 	};
 
 	if (owned.contactId) {
-		await db.contact.updateMany({
+		await scopedDb.contact.updateMany({
 			where: { id: owned.contactId, ...guard },
 			data,
 		});
 	}
 
 	if (owned.companyId) {
-		await db.company.updateMany({
+		await scopedDb.company.updateMany({
 			where: { id: owned.companyId, ...guard },
 			data,
 		});
@@ -130,7 +131,7 @@ async function settleable(
 }
 
 async function taskEndedAt(taskId: string): Promise<Date | null> {
-	const task = await db.agentTask.findUnique({
+	const task = await scopedDb.agentTask.findUnique({
 		where: { id: taskId },
 		select: { finishedAt: true },
 	});
@@ -144,7 +145,7 @@ async function hasOpenRequest(subject: TaskSubject): Promise<boolean> {
 	if (subject.companyId) owners.push({ companyId: subject.companyId });
 	if (owners.length === 0) return false;
 
-	const open = await db.agentTask.findFirst({
+	const open = await scopedDb.agentTask.findFirst({
 		where: { id: { not: subject.id }, finishedAt: null, OR: owners },
 		select: { id: true },
 	});
diff --git a/apps/agent/agent/lib/facts.ts b/apps/agent/agent/lib/facts.ts
index ff92b1a30..dc9123a36 100644
--- a/apps/agent/agent/lib/facts.ts
+++ b/apps/agent/agent/lib/facts.ts
@@ -1,4 +1,5 @@
-import { db, FactBand, FactStatus, type Prisma } from "@crm/db";
+import { FactBand, FactStatus, type Prisma } from "@crm/db";
+import { scopedTransaction } from "@crm/db/tenant-scope";
 import { type Evidence, scoreEvidence } from "./evidence";
 import { currentFocus } from "./focus";
 import { isDerivedName, splitName } from "./names";
@@ -88,99 +89,101 @@ export async function recordFact(
 		};
 	}
 
-	const contact = await db.contact.findUnique({
-		where: { id: contactId },
-		select: {
-			id: true,
-			email: true,
-			firstName: true,
-			lastName: true,
-			title: true,
-			seniority: true,
-			function: true,
-			linkedinUrl: true,
-			twitterUrl: true,
-			githubUrl: true,
-		},
-	});
-
-	if (!contact) {
-		return {
-			...base,
-			stored: false,
-			applied: false,
-			reason: "No such contact.",
-		};
-	}
+	return scopedTransaction(async (tx) => {
+		const contact = await tx.contact.findUnique({
+			where: { id: contactId },
+			select: {
+				id: true,
+				email: true,
+				firstName: true,
+				lastName: true,
+				title: true,
+				seniority: true,
+				function: true,
+				linkedinUrl: true,
+				twitterUrl: true,
+				githubUrl: true,
+			},
+		});
 
-	const existing = await db.contactFact.findMany({
-		where: { contactId, field },
-		select: { id: true, value: true, status: true },
-	});
+		if (!contact) {
+			return {
+				...base,
+				stored: false,
+				applied: false,
+				reason: "No such contact.",
+			};
+		}
 
-	if (
-		existing.some(
-			(fact) =>
-				fact.status === FactStatus.DISMISSED && sameValue(fact.value, trimmed),
-		)
-	) {
-		return {
-			...base,
-			stored: false,
-			applied: false,
-			reason:
-				"A person has already dismissed this exact value. Do not offer it again.",
-		};
-	}
+		const existing = await tx.contactFact.findMany({
+			where: { contactId, field },
+			select: { id: true, value: true, status: true },
+		});
 
-	const currentApplied = existing.find(
-		(fact) => fact.status === FactStatus.APPLIED,
-	);
+		if (
+			existing.some(
+				(fact) =>
+					fact.status === FactStatus.DISMISSED &&
+					sameValue(fact.value, trimmed),
+			)
+		) {
+			return {
+				...base,
+				stored: false,
+				applied: false,
+				reason:
+					"A person has already dismissed this exact value. Do not offer it again.",
+			};
+		}
 
-	if (currentApplied && sameValue(currentApplied.value, trimmed)) {
-		return {
-			...base,
-			stored: false,
-			applied: false,
-			reason: "Already on the record, from this same source. Nothing changed.",
-		};
-	}
+		const currentApplied = existing.find(
+			(fact) => fact.status === FactStatus.APPLIED,
+		);
+
+		if (currentApplied && sameValue(currentApplied.value, trimmed)) {
+			return {
+				...base,
+				stored: false,
+				applied: false,
+				reason:
+					"Already on the record, from this same source. Nothing changed.",
+			};
+		}
 
-	const column = FIELDS[field].column;
-	const hasAgentFact = Boolean(currentApplied);
+		const column = FIELDS[field].column;
+		const hasAgentFact = Boolean(currentApplied);
 
-	if (humanOwns({ field, column, contact, hasAgentFact })) {
-		return {
-			...base,
-			stored: false,
-			applied: false,
-			reason: `A person already filled in ${field}. That outranks anything found on the web.`,
-		};
-	}
+		if (humanOwns({ field, column, contact, hasAgentFact })) {
+			return {
+				...base,
+				stored: false,
+				applied: false,
+				reason: `A person already filled in ${field}. That outranks anything found on the web.`,
+			};
+		}
 
-	const applies =
-		scored.band === FactBand.VERIFIED ||
-		fillsBlank({ field, contact, hasAgentFact });
-
-	if (
-		!applies &&
-		existing.some(
-			(fact) =>
-				fact.status === FactStatus.PROPOSED && sameValue(fact.value, trimmed),
-		)
-	) {
-		return {
-			...base,
-			stored: false,
-			applied: false,
-			reason:
-				"This exact value is already in front of a rep, waiting on them. Offering it twice only makes them read it twice.",
-		};
-	}
+		const applies =
+			scored.band === FactBand.VERIFIED ||
+			fillsBlank({ field, contact, hasAgentFact });
+
+		if (
+			!applies &&
+			existing.some(
+				(fact) =>
+					fact.status === FactStatus.PROPOSED && sameValue(fact.value, trimmed),
+			)
+		) {
+			return {
+				...base,
+				stored: false,
+				applied: false,
+				reason:
+					"This exact value is already in front of a rep, waiting on them. Offering it twice only makes them read it twice.",
+			};
+		}
 
-	const sessionId = currentFocus().sessionId;
+		const sessionId = currentFocus().sessionId;
 
-	await db.$transaction(async (tx) => {
 		if (applies) {
 			await tx.contactFact.updateMany({
 				where: {
@@ -207,60 +210,61 @@ export async function recordFact(
 			},
 		});
 
-		if (!applies) return;
-
-		if (column) {
-			await tx.contact.update({
-				where: { id: contactId },
-				data: { [column]: trimmed },
-			});
-		}
-
-		if (field === "name") {
-			const split = splitName(trimmed);
-			if (split) {
+		if (applies) {
+			if (column) {
 				await tx.contact.update({
 					where: { id: contactId },
-					data: { firstName: split.firstName, lastName: split.lastName },
+					data: { [column]: trimmed },
 				});
 			}
+
+			if (field === "name") {
+				const split = splitName(trimmed);
+				if (split) {
+					await tx.contact.update({
+						where: { id: contactId },
+						data: { firstName: split.firstName, lastName: split.lastName },
+					});
+				}
+			}
 		}
+		return {
+			...base,
+			stored: true,
+			applied: applies,
+			reason: applies
+				? undefined
+				: "The record already carries a value here, and only VERIFIED evidence may replace one, so this is kept as a proposal for a rep to accept or dismiss. This is a normal outcome, not a failure — do not try to raise the score.",
+		};
 	});
-
-	return {
-		...base,
-		stored: true,
-		applied: applies,
-		reason: applies
-			? undefined
-			: "The record already carries a value here, and only VERIFIED evidence may replace one, so this is kept as a proposal for a rep to accept or dismiss. This is a normal outcome, not a failure — do not try to raise the score.",
-	};
 }
 
 export async function lastEmployerChange(contactId: string) {
-	const [previous, current] = await Promise.all([
-		db.contactFact.findFirst({
-			where: { contactId, field: "employer", status: FactStatus.SUPERSEDED },
-			orderBy: { supersededAt: "desc" },
-			select: { value: true, supersededAt: true },
-		}),
-		db.contactFact.findFirst({
-			where: { contactId, field: "employer", status: FactStatus.APPLIED },
-			orderBy: { observedAt: "desc" },
-			select: { value: true, observedAt: true, sourceUrl: true },
-		}),
-	]);
-
-	if (!previous || !current || sameValue(previous.value, current.value)) {
-		return null;
-	}
+	return scopedTransaction(async (tx) => {
+		const [previous, current] = await Promise.all([
+			tx.contactFact.findFirst({
+				where: { contactId, field: "employer", status: FactStatus.SUPERSEDED },
+				orderBy: { supersededAt: "desc" },
+				select: { value: true, supersededAt: true },
+			}),
+			tx.contactFact.findFirst({
+				where: { contactId, field: "employer", status: FactStatus.APPLIED },
+				orderBy: { observedAt: "desc" },
+				select: { value: true, observedAt: true, sourceUrl: true },
+			}),
+		]);
+
+		if (!previous || !current || sameValue(previous.value, current.value)) {
+			return null;
+		}
 
-	return {
-		from: previous.value,
-		to: current.value,
-		observedAt: current.observedAt,
-		sourceUrl: current.sourceUrl,
-	};
+		return {
+			from: previous.value,
+			to: current.value,
+			observedAt: current.observedAt,
+			sourceUrl: current.sourceUrl,
+		};
+	});
 }
 
 export type BriefSections = {
@@ -281,30 +285,43 @@ export async function writeBrief(input: {
 }): Promise<{ written: boolean; score: number; reason?: string }> {
 	const scored = scoreEvidence(input.evidence);
 
-	if (scored.band === null) {
-		return {
-			written: false,
+	return scopedTransaction(async (tx) => {
+		const contact = await tx.contact.findUnique({
+			where: { id: input.contactId },
+			select: { id: true },
+		});
+		if (!contact) {
+			return { written: false, score: 0, reason: "No such contact." };
+		}
+
+		if (scored.band === null) {
+			return {
+				written: false,
+				score: scored.score,
+				reason: "Nothing here is sourced well enough to put on the record.",
+			};
+		}
+
+		const data = {
+			narrative: input.narrative.trim(),
+			sections: input.sections as Prisma.InputJsonValue,
 			score: scored.score,
-			reason: "Nothing here is sourced well enough to put on the record.",
+			sourceUrl: input.sourceUrl ?? null,
+			sessionId: currentFocus().sessionId,
+			refreshedAt: new Date(),
 		};
-	}
 
-	const data = {
-		narrative: input.narrative.trim(),
-		sections: input.sections as Prisma.InputJsonValue,
-		score: scored.score,
-		sourceUrl: input.sourceUrl ?? null,
-		sessionId: currentFocus().sessionId,
-		refreshedAt: new Date(),
-	};
+		await tx.contactBrief.upsert({
+			where: { contactId: input.contactId },
+			create: {
+				contactId: input.contactId,
+				...data,
+			},
+			update: data,
+		});
 
-	await db.contactBrief.upsert({
-		where: { contactId: input.contactId },
-		create: { contactId: input.contactId, ...data },
-		update: data,
+		return { written: true, score: scored.score };
 	});
-
-	return { written: true, score: scored.score };
 }
 
 function humanOwns({
diff --git a/apps/agent/agent/lib/fields.ts b/apps/agent/agent/lib/fields.ts
index 8f0b45f7d..266bdd7a1 100644
--- a/apps/agent/agent/lib/fields.ts
+++ b/apps/agent/agent/lib/fields.ts
@@ -1,4 +1,4 @@
-import { db } from "@crm/db";
+import type { Prisma } from "@crm/db";
 import type { FieldEntity, FieldType } from "@crm/db/enums";
 import {
 	attachValues,
@@ -14,6 +14,7 @@ import {
 	writeValues,
 } from "@crm/db/fields";
 import { lockIdempotencyKey } from "@crm/db/idempotency";
+import { scopedTransaction } from "@crm/db/tenant-scope";
 import { currentFocus } from "./focus";
 
 const WITH_OPTIONS = { options: { orderBy: { position: "asc" } } } as const;
@@ -21,9 +22,10 @@ const WITH_OPTIONS = { options: { orderBy: { position: "asc" } } } as const;
 export type { FieldEntity, FieldType, RecordField, SerializedField };
 
 async function definitionsFor(
+	tx: Prisma.TransactionClient,
 	entity: FieldEntity,
 ): Promise<FieldDefinitionWithOptions[]> {
-	return db.fieldDefinition.findMany({
+	return tx.fieldDefinition.findMany({
 		where: { entity, archivedAt: null },
 		include: WITH_OPTIONS,
 		orderBy: { position: "asc" },
@@ -33,22 +35,27 @@ async function definitionsFor(
 export async function listFields(
 	entity: FieldEntity,
 ): Promise<SerializedField[]> {
-	const definitions = await definitionsFor(entity);
-	return definitions.map(serializeField);
+	return scopedTransaction(async (tx) => {
+		const definitions = await definitionsFor(tx, entity);
+		return definitions.map(serializeField);
+	});
 }
 
 export async function readFields(
 	entity: FieldEntity,
 	recordId: string,
 ): Promise<RecordField[]> {
-	const column = recordColumn(entity);
-
-	const [definitions, rows] = await Promise.all([
-		definitionsFor(entity),
-		db.fieldValue.findMany({ where: { [column]: recordId } }),
-	]);
-
-	return attachValues(definitions, rows);
+	return scopedTransaction(async (tx) => {
+		const column = recordColumn(entity);
+		const [definitions, rows] = await Promise.all([
+			definitionsFor(tx, entity),
+			tx.fieldValue.findMany({
+				where: { [column]: recordId },
+			}),
+		]);
+
+		return attachValues(definitions, rows);
+	});
 }
 
 export type WriteResult =
@@ -61,27 +68,34 @@ export async function writeField(input: {
 	key: string;
 	value: unknown;
 }): Promise<WriteResult> {
-	const definitions = await definitionsFor(input.entity);
-	const definition = definitions.find((entry) => entry.key === input.key);
-
-	if (!definition) {
-		return {
-			written: false,
-			reason: `There is no field called "${input.key}" on ${input.entity.toLowerCase()}s. Call list_fields to see what exists.`,
-		};
-	}
+	try {
+		return await scopedTransaction(async (tx) => {
+			const definitions = await definitionsFor(tx, input.entity);
+			const definition = definitions.find((entry) => entry.key === input.key);
+
+			if (!definition) {
+				return {
+					written: false,
+					reason: `There is no field called "${input.key}" on ${input.entity.toLowerCase()}s. Call list_fields to see what exists.`,
+				};
+			}
 
-	if (!definition.agentFilled) {
-		return {
-			written: false,
-			reason: `"${input.key}" is marked manual only, so a rep keeps it by hand.`,
-		};
-	}
+			if (!definition.agentFilled) {
+				return {
+					written: false,
+					reason: `"${input.key}" is marked manual only, so a rep keeps it by hand.`,
+				};
+			}
 
-	const isBackfill = currentFocus().taskKind === "field-backfill";
+			if (!(await recordExists(tx, input.entity, input.recordId))) {
+				return {
+					written: false,
+					reason: `There is no ${input.entity.toLowerCase()} with id "${input.recordId}".`,
+				};
+			}
+
+			const isBackfill = currentFocus().taskKind === "field-backfill";
 
-	try {
-		return await db.$transaction(async (tx) => {
 			if (isBackfill) {
 				const column = recordColumn(input.entity);
 				await lockIdempotencyKey(
@@ -129,49 +143,51 @@ export async function createField(input: {
 		return { created: false, reason: "That label does not make a usable key." };
 	}
 
-	const taken = await db.fieldDefinition.findUnique({
-		where: { entity_key: { entity: input.entity, key } },
-		select: { id: true },
-	});
-
-	if (taken) {
-		return {
-			created: false,
-			reason: `There is already a field called "${key}" on ${input.entity.toLowerCase()}s.`,
-		};
-	}
-
 	if (usesOptions(input.type) && (input.options ?? []).length === 0) {
 		return { created: false, reason: "A select needs at least one option." };
 	}
 
-	const last = await db.fieldDefinition.findFirst({
-		where: { entity: input.entity },
-		orderBy: { position: "desc" },
-		select: { position: true },
-	});
+	return scopedTransaction(async (tx) => {
+		const taken = await tx.fieldDefinition.findFirst({
+			where: { entity: input.entity, key },
+			select: { id: true },
+		});
 
-	const definition = await db.fieldDefinition.create({
-		data: {
-			entity: input.entity,
-			key,
-			label: input.label,
-			type: input.type,
-			agentBrief: input.agentBrief ?? null,
-			position: (last?.position ?? -1) + 1,
-			options: usesOptions(input.type)
-				? {
-						create: (input.options ?? []).map((label, index) => ({
-							label,
-							position: index,
-						})),
-					}
-				: undefined,
-		},
-		include: WITH_OPTIONS,
-	});
+		if (taken) {
+			return {
+				created: false,
+				reason: `There is already a field called "${key}" on ${input.entity.toLowerCase()}s.`,
+			};
+		}
+
+		const last = await tx.fieldDefinition.findFirst({
+			where: { entity: input.entity },
+			orderBy: { position: "desc" },
+			select: { position: true },
+		});
+
+		const definition = await tx.fieldDefinition.create({
+			data: {
+				entity: input.entity,
+				key,
+				label: input.label,
+				type: input.type,
+				agentBrief: input.agentBrief ?? null,
+				position: (last?.position ?? -1) + 1,
+				options: usesOptions(input.type)
+					? {
+							create: (input.options ?? []).map((label, index) => ({
+								label,
+								position: index,
+							})),
+						}
+					: undefined,
+			},
+			include: WITH_OPTIONS,
+		});
 
-	return serializeField(definition);
+		return serializeField(definition);
+	});
 }
 
 export async function updateFieldBrief(input: {
@@ -180,47 +196,81 @@ export async function updateFieldBrief(input: {
 	agentBrief: string | null;
 	agentFilled?: boolean;
 }): Promise<SerializedField | { updated: false; reason: string }> {
-	const existing = await db.fieldDefinition.findUnique({
-		where: { entity_key: { entity: input.entity, key: input.key } },
-		select: { id: true },
-	});
+	return scopedTransaction(async (tx) => {
+		const existing = await tx.fieldDefinition.findFirst({
+			where: { entity: input.entity, key: input.key },
+			select: { id: true },
+		});
 
-	if (!existing) {
-		return {
-			updated: false,
-			reason: `There is no field called "${input.key}".`,
-		};
-	}
+		if (!existing) {
+			return {
+				updated: false,
+				reason: `There is no field called "${input.key}".`,
+			};
+		}
 
-	const definition = await db.fieldDefinition.update({
-		where: { id: existing.id },
-		data: { agentBrief: input.agentBrief, agentFilled: input.agentFilled },
-		include: WITH_OPTIONS,
-	});
+		const definition = await tx.fieldDefinition.update({
+			where: { id: existing.id },
+			data: { agentBrief: input.agentBrief, agentFilled: input.agentFilled },
+			include: WITH_OPTIONS,
+		});
 
-	return serializeField(definition);
+		return serializeField(definition);
+	});
 }
 
 export async function archiveField(input: {
 	entity: FieldEntity;
 	key: string;
 }): Promise<{ archived: boolean; reason?: string }> {
-	const existing = await db.fieldDefinition.findUnique({
-		where: { entity_key: { entity: input.entity, key: input.key } },
-		select: { id: true },
-	});
+	return scopedTransaction(async (tx) => {
+		const existing = await tx.fieldDefinition.findFirst({
+			where: { entity: input.entity, key: input.key },
+			select: { id: true },
+		});
 
-	if (!existing) {
-		return {
-			archived: false,
-			reason: `There is no field called "${input.key}".`,
-		};
-	}
+		if (!existing) {
+			return {
+				archived: false,
+				reason: `There is no field called "${input.key}".`,
+			};
+		}
 
-	await db.fieldDefinition.update({
-		where: { id: existing.id },
-		data: { archivedAt: new Date() },
+		await tx.fieldDefinition.update({
+			where: { id: existing.id },
+			data: { archivedAt: new Date() },
+		});
+
+		return { archived: true };
 	});
+}
 
-	return { archived: true };
+async function recordExists(
+	tx: Prisma.TransactionClient,
+	entity: FieldEntity,
+	recordId: string,
+): Promise<boolean> {
+	switch (entity) {
+		case "COMPANY":
+			return Boolean(
+				await tx.company.findFirst({
+					where: { id: recordId },
+					select: { id: true },
+				}),
+			);
+		case "CONTACT":
+			return Boolean(
+				await tx.contact.findFirst({
+					where: { id: recordId },
+					select: { id: true },
+				}),
+			);
+		case "DEAL":
+			return Boolean(
+				await tx.deal.findFirst({
+					where: { id: recordId },
+					select: { id: true },
+				}),
+			);
+	}
 }
diff --git a/apps/agent/agent/lib/kaneo-writes.ts b/apps/agent/agent/lib/kaneo-writes.ts
new file mode 100644
index 000000000..9de5ffbb0
--- /dev/null
+++ b/apps/agent/agent/lib/kaneo-writes.ts
@@ -0,0 +1,106 @@
+import { db } from "@crm/db";
+import { WORKSPACE_ID } from "@crm/db/workspace";
+import createKaneoComment from "../../../../vendor/kaneo/apps/api/src/activity/controllers/create-comment";
+import createKaneoTask from "../../../../vendor/kaneo/apps/api/src/task/controllers/create-task";
+import updateKaneoTask from "../../../../vendor/kaneo/apps/api/src/task/controllers/update-task";
+
+export type CreateTaskInput = {
+	projectId: string;
+	title: string;
+	description?: string;
+	status?: string;
+	priority?: string;
+	assigneeId?: string;
+	dueDate?: string;
+};
+
+export type UpdateTaskInput = {
+	title?: string;
+	description?: string;
+	status?: string;
+	priority?: string;
+	assigneeId?: string | null;
+	dueDate?: string | null;
+};
+
+async function agentPrincipal(): Promise<string> {
+	const owner = await db.member.findFirst({
+		where: { organizationId: WORKSPACE_ID, role: "owner" },
+		orderBy: { createdAt: "asc" },
+		select: { userId: true },
+	});
+	if (!owner) {
+		throw new Error("no workspace owner to act as the agent");
+	}
+	return owner.userId;
+}
+
+export async function createTask(input: CreateTaskInput) {
+	const currentUserId = await agentPrincipal();
+	const task = await createKaneoTask({
+		projectId: input.projectId,
+		currentUserId,
+		userId: input.assigneeId,
+		title: input.title,
+		status: input.status ?? "to-do",
+		priority: input.priority,
+		description: input.description,
+		dueDate: input.dueDate ? new Date(input.dueDate) : undefined,
+	});
+	return { id: task.id, number: task.number, title: task.title };
+}
+
+export async function updateTask(taskId: string, input: UpdateTaskInput) {
+	const currentUserId = await agentPrincipal();
+	const current = await db.projectTask.findUnique({
+		where: { id: taskId },
+		select: {
+			title: true,
+			status: true,
+			startDate: true,
+			dueDate: true,
+			projectId: true,
+			description: true,
+			priority: true,
+			position: true,
+			userId: true,
+		},
+	});
+	if (!current) {
+		throw new Error(`task ${taskId} does not exist`);
+	}
+	const task = await updateKaneoTask(
+		taskId,
+		input.title ?? current.title,
+		input.status ?? current.status,
+		current.startDate ?? undefined,
+		input.dueDate !== undefined
+			? input.dueDate
+				? new Date(input.dueDate)
+				: undefined
+			: (current.dueDate ?? undefined),
+		current.projectId,
+		input.description !== undefined
+			? input.description
+			: (current.description ?? ""),
+		input.priority ?? current.priority,
+		current.position ?? 0,
+		input.assigneeId !== undefined
+			? (input.assigneeId ?? undefined)
+			: (current.userId ?? undefined),
+		currentUserId,
+	);
+	return {
+		id: task.id,
+		title: task.title,
+		status: task.status,
+		priority: task.priority,
+		dueDate: task.dueDate,
+	};
+}
+
+export async function addTaskComment(taskId: string, content: string) {
+	const userId = await agentPrincipal();
+	const activity = await createKaneoComment(taskId, userId, content);
+	return { id: activity.id, createdAt: activity.createdAt };
+}
diff --git a/apps/agent/agent/lib/kaneo.ts b/apps/agent/agent/lib/kaneo.ts
new file mode 100644
index 000000000..9a6cf3ac5
--- /dev/null
+++ b/apps/agent/agent/lib/kaneo.ts
@@ -0,0 +1,147 @@
+import { db } from "@crm/db";
+
+export type TaskListFilter = {
+	projectId?: string;
+	assigneeId?: string;
+	status?: string;
+	limit?: number;
+};
+
+type UserName = { id: string; name: string; email: string | null };
+
+async function userNames(
+	userIds: Array<string | null>,
+): Promise<Map<string, UserName>> {
+	const ids = [...new Set(userIds.filter((id): id is string => Boolean(id)))];
+	if (ids.length === 0) {
+		return new Map();
+	}
+	const users = await db.user.findMany({
+		where: { id: { in: ids } },
+		select: { id: true, name: true, email: true },
+	});
+	return new Map(users.map((user) => [user.id, user]));
+}
+
+export async function listProjects() {
+	const projects = await db.project.findMany({
+		where: { archivedAt: null },
+		orderBy: { position: "asc" },
+		select: {
+			id: true,
+			name: true,
+			slug: true,
+			description: true,
+			position: true,
+			_count: { select: { projectTasks: true } },
+		},
+	});
+	return projects.map((project) => ({
+		id: project.id,
+		name: project.name,
+		slug: project.slug,
+		description: project.description,
+		taskCount: project._count.projectTasks,
+	}));
+}
+
+export async function listTasks(filter: TaskListFilter) {
+	const tasks = await db.projectTask.findMany({
+		where: {
+			projectId: filter.projectId,
+			userId: filter.assigneeId,
+			status: filter.status,
+		},
+		orderBy: [{ position: "asc" }, { createdAt: "asc" }],
+		take: filter.limit ?? 50,
+		select: {
+			id: true,
+			number: true,
+			title: true,
+			status: true,
+			priority: true,
+			dueDate: true,
+			projectId: true,
+			userId: true,
+			project: { select: { name: true } },
+		},
+	});
+	const names = await userNames(tasks.map((task) => task.userId));
+	return tasks.map((task) => ({
+		id: task.id,
+		number: task.number,
+		title: task.title,
+		status: task.status,
+		priority: task.priority,
+		dueDate: task.dueDate,
+		projectId: task.projectId,
+		projectName: task.project.name,
+		assignee: task.userId
+			? {
+					id: task.userId,
+					name: names.get(task.userId)?.name ?? null,
+					email: names.get(task.userId)?.email ?? null,
+				}
+			: null,
+	}));
+}
+
+export async function readTask(taskId: string) {
+	const task = await db.projectTask.findUnique({
+		where: { id: taskId },
+		select: {
+			id: true,
+			number: true,
+			title: true,
+			description: true,
+			status: true,
+			priority: true,
+			startDate: true,
+			dueDate: true,
+			projectId: true,
+			userId: true,
+			project: { select: { name: true } },
+			column: { select: { name: true } },
+			labels: { select: { name: true, color: true } },
+			taskActivities: {
+				where: { type: "comment" },
+				orderBy: { createdAt: "asc" },
+				select: { content: true, createdAt: true },
+			},
+		},
+	});
+	if (!task) {
+		return null;
+	}
+	const names = await userNames([task.userId]);
+	const assignee = task.userId
+		? {
+				id: task.userId,
+				name: names.get(task.userId)?.name ?? null,
+				email: names.get(task.userId)?.email ?? null,
+			}
+		: null;
+	return {
+		id: task.id,
+		number: task.number,
+		title: task.title,
+		description: task.description,
+		status: task.status,
+		priority: task.priority,
+		startDate: task.startDate,
+		dueDate: task.dueDate,
+		projectId: task.projectId,
+		projectName: task.project.name,
+		columnName: task.column?.name ?? null,
+		assignee,
+		labels: task.labels.map((label) => label.name),
+		comments: task.taskActivities
+			.filter((activity): activity is { content: string; createdAt: Date } =>
+				Boolean(activity.content),
+			)
+			.map((activity) => ({
+				content: activity.content,
+				createdAt: activity.createdAt,
+			})),
+	};
+}
diff --git a/apps/agent/agent/lib/lookup.ts b/apps/agent/agent/lib/lookup.ts
index 8f8385e73..3c897f579 100644
--- a/apps/agent/agent/lib/lookup.ts
+++ b/apps/agent/agent/lib/lookup.ts
@@ -1,5 +1,6 @@
-import { DealStage, db } from "@crm/db";
+import { DealStage } from "@crm/db";
 import { LOSING_DEAL_STAGES, OPEN_DEAL_STAGES } from "@crm/db/deal-stage";
+import { scopedDb as db } from "@crm/db/tenant-scope";
 import { domainOf, normalise } from "./names";
 
 export type RecordKind = "contact" | "company" | "deal";
diff --git a/apps/agent/agent/lib/model.ts b/apps/agent/agent/lib/model.ts
index 76aca94fc..918e081a3 100644
--- a/apps/agent/agent/lib/model.ts
+++ b/apps/agent/agent/lib/model.ts
@@ -1,5 +1,5 @@
-import { db } from "@crm/db";
 import { readAgentModel } from "@crm/db/settings";
+import { scopedTransaction } from "@crm/db/tenant-scope";
 
 export interface ModelSelection {
 	model: string;
@@ -8,7 +8,7 @@ export interface ModelSelection {
 
 export async function selectedModel(): Promise<ModelSelection | null> {
 	try {
-		const setting = await readAgentModel(db);
+		const setting = await scopedTransaction((tx) => readAgentModel(tx));
 
 		if (setting.isDefault) return null;
 
diff --git a/apps/agent/agent/lib/portrait.ts b/apps/agent/agent/lib/portrait.ts
index fc5f4009a..35ec6f90d 100644
--- a/apps/agent/agent/lib/portrait.ts
+++ b/apps/agent/agent/lib/portrait.ts
@@ -1,5 +1,5 @@
-import { db } from "@crm/db";
 import { blobEnabled, isMirrored, mirror } from "@crm/db/blob";
+import { scopedDb } from "@crm/db/tenant-scope";
 import { CONTEXT_DEV_PEOPLE, enabled } from "./capabilities";
 import { findPortrait, type PortraitSource } from "./portrait-sources";
 
@@ -48,7 +48,7 @@ export async function storePortrait({
 		};
 	}
 
-	const contact = await db.contact.findUnique({
+	const contact = await scopedDb.contact.findUnique({
 		where: { id: contactId },
 		select: { imageUrl: true },
 	});
@@ -79,7 +79,7 @@ export async function storePortrait({
 		return { stored: false, imageUrl: stored, reason: "Unchanged." };
 	}
 
-	await db.contact.update({
+	await scopedDb.contact.update({
 		where: { id: contactId },
 		data: { imageUrl: stored },
 	});
@@ -105,7 +105,7 @@ export async function runPortrait({
 		};
 	}
 
-	const contact = await db.contact.findUnique({
+	const contact = await scopedDb.contact.findUnique({
 		where: { id: contactId },
 		select: {
 			id: true,
diff --git a/apps/agent/agent/lib/preamble.ts b/apps/agent/agent/lib/preamble.ts
index 1b93f383d..9dbed893d 100644
--- a/apps/agent/agent/lib/preamble.ts
+++ b/apps/agent/agent/lib/preamble.ts
@@ -1,4 +1,4 @@
-import { db } from "@crm/db";
+import { scopedDb as db } from "@crm/db/tenant-scope";
 import { websiteUrl } from "@crm/db/workspace";
 import { capabilitiesMarkdown } from "./capabilities";
 import { identity, usMarkdown, type WorkspaceIdentity } from "./workspace";
diff --git a/apps/agent/agent/lib/run-preflight.ts b/apps/agent/agent/lib/run-preflight.ts
index 8a89e34b3..85ffeda1d 100644
--- a/apps/agent/agent/lib/run-preflight.ts
+++ b/apps/agent/agent/lib/run-preflight.ts
@@ -1,4 +1,4 @@
-import { db } from "@crm/db";
+import { scopedDb as db } from "@crm/db/tenant-scope";
 import {
 	type AgentManifest,
 	InvalidAgentManifest,
diff --git a/apps/agent/agent/lib/run-runtime.ts b/apps/agent/agent/lib/run-runtime.ts
index bc9d9c2f8..a7087698e 100644
--- a/apps/agent/agent/lib/run-runtime.ts
+++ b/apps/agent/agent/lib/run-runtime.ts
@@ -1,7 +1,8 @@
 import { createHash, randomUUID } from "node:crypto";
-import { ActivityType, db, type Prisma } from "@crm/db";
+import { ActivityType, type Prisma } from "@crm/db";
 import type { AgentActionStatus, AgentTriggerType } from "@crm/db/enums";
 import { lockIdempotencyKey } from "@crm/db/idempotency";
+import { scopedTransaction } from "@crm/db/tenant-scope";
 import {
 	AGENT_ACTION_TYPES,
 	type AgentManifestResource,
@@ -110,13 +111,15 @@ const RUN_ACTION_FIELDS = {
 } as const;
 
 export async function approvedRunInstructions(runId: string): Promise<string> {
-	const run = await db.agentRun.findUnique({
-		where: { id: runId },
-		select: {
-			status: true,
-			version: { select: { instructions: true } },
-		},
-	});
+	const run = await scopedTransaction((tx) =>
+		tx.agentRun.findUnique({
+			where: { id: runId },
+			select: {
+				status: true,
+				version: { select: { instructions: true } },
+			},
+		}),
+	);
 
 	if (!run) throw new Error("This agent run is unavailable.");
 	if (run.status !== "RUNNING") {
@@ -126,26 +129,31 @@ export async function approvedRunInstructions(runId: string): Promise<string> {
 }
 
 export async function runContext(runId: string) {
-	const run = await db.agentRun.findUnique({
-		where: { id: runId },
-		select: {
-			id: true,
-			status: true,
-			triggerType: true,
-			input: true,
-			agent: { select: { id: true, name: true, description: true } },
-			version: {
-				select: {
-					id: true,
-					number: true,
-					manifest: true,
-					modelId: true,
-					sandboxPolicy: true,
+	const run = await scopedTransaction((tx) =>
+		tx.agentRun.findUnique({
+			where: { id: runId },
+			select: {
+				id: true,
+				organizationId: true,
+				status: true,
+				triggerType: true,
+				input: true,
+				agent: { select: { id: true, name: true, description: true } },
+				version: {
+					select: {
+						id: true,
+						number: true,
+						manifest: true,
+						modelId: true,
+						sandboxPolicy: true,
+					},
+				},
+				trigger: {
+					select: { id: true, name: true, type: true, config: true },
 				},
 			},
-			trigger: { select: { id: true, name: true, type: true, config: true } },
-		},
-	});
+		}),
+	);
 
 	if (!run) throw new Error("This agent run is unavailable.");
 	if (run.status !== "RUNNING") {
@@ -240,17 +248,19 @@ export async function createRunActivity(
 		dueAt?: string | null;
 	},
 ) {
-	const run = await db.agentRun.findUnique({
-		where: { id: runId },
-		select: {
-			id: true,
-			status: true,
-			agentId: true,
-			initiatedById: true,
-			agent: { select: { createdById: true } },
-			version: { select: { manifest: true } },
-		},
-	});
+	const run = await scopedTransaction((tx) =>
+		tx.agentRun.findUnique({
+			where: { id: runId },
+			select: {
+				id: true,
+				status: true,
+				agentId: true,
+				initiatedById: true,
+				agent: { select: { createdById: true } },
+				version: { select: { manifest: true } },
+			},
+		}),
+	);
 	if (!run) throw new Error("This agent run is unavailable.");
 
 	assertActivityAllowed(run.version.manifest, input.type);
@@ -310,7 +320,7 @@ export async function createRunActivity(
 		const activityId = `agent-action-${claim.actionId}`;
 		const now = new Date();
 
-		await db.$transaction(async (tx) => {
+		await scopedTransaction(async (tx) => {
 			const activeRun = await lockAgentRun(tx, runId);
 			if (activeRun.status !== "RUNNING") {
 				throw new Error("This agent run is not active.");
@@ -381,15 +391,17 @@ export async function postRunSlackMessage(
 	input: { text: string },
 	abortSignal?: AbortSignal,
 ) {
-	const run = await db.agentRun.findUnique({
-		where: { id: runId },
-		select: {
-			id: true,
-			status: true,
-			agentId: true,
-			version: { select: { manifest: true } },
-		},
-	});
+	const run = await scopedTransaction((tx) =>
+		tx.agentRun.findUnique({
+			where: { id: runId },
+			select: {
+				id: true,
+				status: true,
+				agentId: true,
+				version: { select: { manifest: true } },
+			},
+		}),
+	);
 	if (!run) throw new Error("This agent run is unavailable.");
 
 	const destination = approvedSlackDestination(run.version.manifest);
@@ -451,14 +463,16 @@ export async function postRunSlackMessage(
 			},
 		);
 		const messageId = `${posted.channel}:${posted.ts}`;
-		const completed = await db.agentAction.updateMany({
-			where: { id: actionId, status: "RUNNING", startedAt: claimedAt },
-			data: {
-				status: "SUCCEEDED",
-				externalId: messageId,
-				completedAt: new Date(),
-			},
-		});
+		const completed = await scopedTransaction((tx) =>
+			tx.agentAction.updateMany({
+				where: { id: actionId, status: "RUNNING", startedAt: claimedAt },
+				data: {
+					status: "SUCCEEDED",
+					externalId: messageId,
+					completedAt: new Date(),
+				},
+			}),
+		);
 		if (completed.count === 0) {
 			await recordDeliveryOutsideClaim(actionId, messageId);
 			throw new Error(
@@ -483,10 +497,12 @@ async function findRunAction(
 	idempotencyKey: string,
 	requestHash: string,
 ): Promise<RunActionRow | null> {
-	const existing = await db.agentAction.findUnique({
-		where: { idempotencyKey },
-		select: RUN_ACTION_FIELDS,
-	});
+	const existing = await scopedTransaction((tx) =>
+		tx.agentAction.findUnique({
+			where: { idempotencyKey },
+			select: RUN_ACTION_FIELDS,
+		}),
+	);
 	if (existing) assertActionRequestMatches(existing.requestHash, requestHash);
 	return existing;
 }
@@ -497,12 +513,12 @@ async function claimRunAction(
 	requestHash: string,
 	data: Omit<
 		Prisma.AgentActionUncheckedCreateInput,
-		"idempotencyKey" | "requestHash"
+		"idempotencyKey" | "organizationId" | "requestHash"
 	>,
 ): Promise<RunActionClaim> {
 	const action =
 		existing ??
-		(await db.$transaction(async (tx) => {
+		(await scopedTransaction(async (tx) => {
 			await lockIdempotencyKey(tx, idempotencyKey);
 			const winner = await tx.agentAction.findUnique({
 				where: { idempotencyKey },
@@ -527,31 +543,37 @@ async function claimRunAction(
 	}
 
 	const claimedAt = new Date();
-	const claimed = await db.agentAction.updateMany({
-		where: {
-			id: action.id,
-			OR: [
-				{ status: { in: ["PLANNED", "FAILED"] } },
-				{
-					status: "RUNNING",
-					startedAt: { lt: new Date(claimedAt.getTime() - ACTION_LEASE_MS) },
-				},
-			],
-		},
-		data: {
-			status: "RUNNING",
-			startedAt: claimedAt,
-			completedAt: null,
-			attemptCount: { increment: 1 },
-			errorCode: null,
-			errorMessage: null,
-		},
-	});
+	const claimed = await scopedTransaction((tx) =>
+		tx.agentAction.updateMany({
+			where: {
+				id: action.id,
+				OR: [
+					{ status: { in: ["PLANNED", "FAILED"] } },
+					{
+						status: "RUNNING",
+						startedAt: {
+							lt: new Date(claimedAt.getTime() - ACTION_LEASE_MS),
+						},
+					},
+				],
+			},
+			data: {
+				status: "RUNNING",
+				startedAt: claimedAt,
+				completedAt: null,
+				attemptCount: { increment: 1 },
+				errorCode: null,
+				errorMessage: null,
+			},
+		}),
+	);
 	if (claimed.count === 0) {
-		const current = await db.agentAction.findUnique({
-			where: { id: action.id },
-			select: { status: true, externalId: true },
-		});
+		const current = await scopedTransaction((tx) =>
+			tx.agentAction.findUnique({
+				where: { id: action.id },
+				select: { status: true, externalId: true },
+			}),
+		);
 		if (current?.status === "SUCCEEDED") {
 			return {
 				claimed: false,
@@ -575,19 +597,21 @@ async function failRunAction(
 	code: string,
 	message: string,
 ): Promise<void> {
-	await db.agentAction.updateMany({
-		where: {
-			id: claim.actionId,
-			status: "RUNNING",
-			startedAt: claim.claimedAt,
-		},
-		data: {
-			status: "FAILED",
-			errorCode: code,
-			errorMessage: message,
-			completedAt: new Date(),
-		},
-	});
+	await scopedTransaction((tx) =>
+		tx.agentAction.updateMany({
+			where: {
+				id: claim.actionId,
+				status: "RUNNING",
+				startedAt: claim.claimedAt,
+			},
+			data: {
+				status: "FAILED",
+				errorCode: code,
+				errorMessage: message,
+				completedAt: new Date(),
+			},
+		}),
+	);
 }
 
 export async function sendSlackMessage(
@@ -641,10 +665,12 @@ export async function sendSlackMessage(
 }
 
 async function assertRunActive(runId: string): Promise<void> {
-	const run = await db.agentRun.findUnique({
-		where: { id: runId },
-		select: { status: true },
-	});
+	const run = await scopedTransaction((tx) =>
+		tx.agentRun.findUnique({
+			where: { id: runId },
+			select: { status: true },
+		}),
+	);
 	if (run?.status !== "RUNNING") {
 		throw new Error("This agent run is not active.");
 	}
@@ -655,7 +681,7 @@ async function holdRunActionClaim(
 	actionId: string,
 	claimedAt: Date,
 ): Promise<void> {
-	await db.$transaction(async (tx) => {
+	await scopedTransaction(async (tx) => {
 		const run = await lockAgentRun(tx, runId);
 		if (run.status !== "RUNNING") {
 			throw new Error("This agent run is not active.");
@@ -675,21 +701,25 @@ async function recordDeliveryOutsideClaim(
 ): Promise<void> {
 	const delivered =
 		"Slack accepted this message before the run stopped, and it cannot be withdrawn.";
-	const current = await db.agentAction.findUnique({
-		where: { id: actionId },
-		select: { status: true, externalId: true, errorMessage: true },
-	});
+	const current = await scopedTransaction((tx) =>
+		tx.agentAction.findUnique({
+			where: { id: actionId },
+			select: { status: true, externalId: true, errorMessage: true },
+		}),
+	);
 	if (!current || current.status === "SUCCEEDED" || current.externalId) return;
 
-	await db.agentAction.updateMany({
-		where: { id: actionId, status: { not: "SUCCEEDED" }, externalId: null },
-		data: {
-			externalId: messageId,
-			errorMessage: current.errorMessage
-				? `${current.errorMessage} ${delivered}`
-				: delivered,
-		},
-	});
+	await scopedTransaction((tx) =>
+		tx.agentAction.updateMany({
+			where: { id: actionId, status: { not: "SUCCEEDED" }, externalId: null },
+			data: {
+				externalId: messageId,
+				errorMessage: current.errorMessage
+					? `${current.errorMessage} ${delivered}`
+					: delivered,
+			},
+		}),
+	);
 }
 
 async function slackApiRequest(
@@ -744,7 +774,7 @@ export async function stageRunResult(
 		noActionNeeded?: { reason: string } | null;
 	},
 ) {
-	return db.$transaction(async (tx) => {
+	return scopedTransaction(async (tx) => {
 		const run = await lockAgentRun(tx, runId);
 		if (run.status !== "RUNNING") {
 			throw new Error(`This agent run already ended with ${run.status}.`);
@@ -785,7 +815,7 @@ export async function finishRun(
 	runId: string,
 	input: { summary: string; result?: RunResult | null },
 ) {
-	return db.$transaction(async (tx) => {
+	return scopedTransaction(async (tx) => {
 		const run = await lockAgentRun(tx, runId);
 		if (run.status === "SUCCEEDED") {
 			return { id: run.id, status: "SUCCEEDED" as const };
@@ -1092,10 +1122,12 @@ export function allowedHistorySources(
 
 async function targetRecord(kind: "company" | "contact" | "deal", id: string) {
 	if (kind === "company") {
-		const company = await db.company.findUnique({
-			where: { id },
-			select: { id: true, name: true },
-		});
+		const company = await scopedTransaction((tx) =>
+			tx.company.findUnique({
+				where: { id },
+				select: { id: true, name: true },
+			}),
+		);
 		return company
 			? {
 					label: company.name,
@@ -1106,10 +1138,12 @@ async function targetRecord(kind: "company" | "contact" | "deal", id: string) {
 			: null;
 	}
 	if (kind === "contact") {
-		const contact = await db.contact.findUnique({
-			where: { id },
-			select: { id: true, firstName: true, lastName: true, companyId: true },
-		});
+		const contact = await scopedTransaction((tx) =>
+			tx.contact.findUnique({
+				where: { id },
+				select: { id: true, firstName: true, lastName: true, companyId: true },
+			}),
+		);
 		return contact
 			? {
 					label: [contact.firstName, contact.lastName]
@@ -1122,10 +1156,12 @@ async function targetRecord(kind: "company" | "contact" | "deal", id: string) {
 			: null;
 	}
 
-	const deal = await db.deal.findUnique({
-		where: { id },
-		select: { id: true, name: true, companyId: true },
-	});
+	const deal = await scopedTransaction((tx) =>
+		tx.deal.findUnique({
+			where: { id },
+			select: { id: true, name: true, companyId: true },
+		}),
+	);
 	return deal
 		? {
 				label: deal.name,
diff --git a/apps/agent/agent/lib/run-state.ts b/apps/agent/agent/lib/run-state.ts
index c98fcb359..d5b38f7b7 100644
--- a/apps/agent/agent/lib/run-state.ts
+++ b/apps/agent/agent/lib/run-state.ts
@@ -3,6 +3,7 @@ import type { AgentRunStatus } from "@crm/db/enums";
 
 export type LockedAgentRun = {
 	id: string;
+	organizationId: string;
 	agentId: string;
 	versionId: string;
 	status: AgentRunStatus;
@@ -16,7 +17,7 @@ export async function lockAgentRun(
 	runId: string,
 ): Promise<LockedAgentRun> {
 	const [run] = await tx.$queryRaw<LockedAgentRun[]>`
-		SELECT id, "agentId", "versionId", status, "sessionId", "startedAt", "nextEventSequence"
+		SELECT id, "organizationId", "agentId", "versionId", status, "sessionId", "startedAt", "nextEventSequence"
 		FROM "agentRun"
 		WHERE id = ${runId}
 		FOR UPDATE
diff --git a/apps/agent/agent/lib/session-purpose.ts b/apps/agent/agent/lib/session-purpose.ts
index f3b292881..b4faffcec 100644
--- a/apps/agent/agent/lib/session-purpose.ts
+++ b/apps/agent/agent/lib/session-purpose.ts
@@ -1,3 +1,4 @@
+import { runInTenant } from "@crm/db/tenant-context";
 import { z } from "zod";
 
 export type SessionPurpose = "builder" | "team-agent" | "research";
@@ -38,6 +39,14 @@ export function requireAttribute(ctx: PurposeContext, key: string): string {
 	return value;
 }
 
+export function requireOrganizationId(ctx: PurposeContext): string {
+	return requireAttribute(ctx, "organizationId");
+}
+
+export function runInSessionTenant<T>(ctx: PurposeContext, action: () => T): T {
+	return runInTenant(requireOrganizationId(ctx), action);
+}
+
 export function requireBuilderAttribute(
 	ctx: PurposeContext,
 	key: string,
diff --git a/apps/agent/agent/lib/slack-connection.ts b/apps/agent/agent/lib/slack-connection.ts
index 41b267c90..6c5a13261 100644
--- a/apps/agent/agent/lib/slack-connection.ts
+++ b/apps/agent/agent/lib/slack-connection.ts
@@ -1,13 +1,13 @@
-import { db } from "@crm/db";
+import { scopedDb } from "@crm/db/tenant-scope";
 
 export async function slackAccessToken(): Promise<string | null> {
-	const account = await db.account.findFirst({
-		where: { providerId: "slack", accessToken: { not: null } },
+	const grant = await scopedDb.slackWorkspaceGrant.findFirst({
+		where: { botToken: { not: null } },
 		orderBy: { updatedAt: "desc" },
-		select: { accessToken: true },
+		select: { botToken: true },
 	});
 
-	return account?.accessToken ?? null;
+	return grant?.botToken ?? null;
 }
 
 export async function slackConnected(): Promise<boolean> {
@@ -15,7 +15,7 @@ export async function slackConnected(): Promise<boolean> {
 }
 
 export async function slackUserToken(): Promise<string | null> {
-	const grant = await db.slackWorkspaceGrant.findFirst({
+	const grant = await scopedDb.slackWorkspaceGrant.findFirst({
 		orderBy: { updatedAt: "desc" },
 		select: { userToken: true },
 	});
diff --git a/apps/agent/agent/lib/slack-join-task.ts b/apps/agent/agent/lib/slack-join-task.ts
index 27d29c653..2c8d9b884 100644
--- a/apps/agent/agent/lib/slack-join-task.ts
+++ b/apps/agent/agent/lib/slack-join-task.ts
@@ -4,13 +4,14 @@ import { joinSlackChannel } from "./slack-membership";
 
 export async function runSlackChannelJoin(
 	value: Prisma.JsonValue,
+	organizationId: string,
 ): Promise<string> {
 	const { channelId, channelName } = parse(
 		schemas.slack.joinPayload,
 		value,
 		"A slack-channel-join task carries an unreadable payload",
 	);
-	const outcome = await joinSlackChannel(channelId);
+	const outcome = await joinSlackChannel(organizationId, channelId);
 
 	if (outcome.joined) {
 		return outcome.already
diff --git a/apps/agent/agent/lib/slack-membership.ts b/apps/agent/agent/lib/slack-membership.ts
index c776d5c3d..2ad515f78 100644
--- a/apps/agent/agent/lib/slack-membership.ts
+++ b/apps/agent/agent/lib/slack-membership.ts
@@ -1,4 +1,4 @@
-import { db } from "@crm/db";
+import { scopedDb } from "@crm/db/tenant-scope";
 import { schemas } from "@crm/validation";
 import { z } from "zod";
 import { SLACK } from "./slack-config";
@@ -103,6 +103,7 @@ async function classifyChannel(
 	channelId: string,
 	cached: ChannelState,
 	token: string,
+	organizationId: string,
 ): Promise<ChannelState> {
 	const live = await liveChannelState(token, channelId);
 	if (!live) return cached;
@@ -113,21 +114,22 @@ async function classifyChannel(
 		return live;
 	}
 
-	await db.slackChannel
+	await scopedDb.slackChannel
 		.update({
 			where: { id: channelId },
 			data: { ...live, classifiedAt: new Date() },
 		})
 		.catch(() => null);
-	await requestSlackInventorySync();
+	await requestSlackInventorySync(organizationId);
 
 	return live;
 }
 
 export async function joinSlackChannel(
+	organizationId: string,
 	channelId: string,
 ): Promise<JoinOutcome> {
-	const channel = await db.slackChannel.findUnique({
+	const channel = await scopedDb.slackChannel.findUnique({
 		where: { id: channelId },
 		select: { id: true, isPrivate: true, isMember: true },
 	});
@@ -149,6 +151,7 @@ export async function joinSlackChannel(
 		channelId,
 		{ isPrivate: channel.isPrivate, isMember: channel.isMember },
 		bot,
+		organizationId,
 	);
 	if (state.isMember) return { joined: true, already: true };
 
@@ -164,7 +167,7 @@ export async function joinSlackChannel(
 		};
 	}
 
-	await db.slackChannel.update({
+	await scopedDb.slackChannel.update({
 		where: { id: channelId },
 		data: {
 			isMember: true,
@@ -223,6 +226,7 @@ function explain(error: string): string {
 }
 
 export async function createSlackChannel(
+	organizationId: string,
 	name: string,
 	isPrivate: boolean,
 ): Promise<{ id: string; name: string } | { error: string }> {
@@ -258,10 +262,11 @@ export async function createSlackChannel(
 
 	const channel = parsed.data.channel;
 
-	await db.slackChannel.upsert({
+	await scopedDb.slackChannel.upsert({
 		where: { id: channel.id },
 		create: {
 			id: channel.id,
+			organizationId,
 			name: channel.name,
 			isPrivate,
 			isMember: !isPrivate && token === bot,
@@ -276,7 +281,7 @@ export async function createSlackChannel(
 		},
 	});
 
-	if (token === user) await joinSlackChannel(channel.id);
+	if (token === user) await joinSlackChannel(organizationId, channel.id);
 
 	return channel;
 }
diff --git a/apps/agent/agent/lib/slack-people.ts b/apps/agent/agent/lib/slack-people.ts
index b73d14e12..7aea67cbf 100644
--- a/apps/agent/agent/lib/slack-people.ts
+++ b/apps/agent/agent/lib/slack-people.ts
@@ -1,6 +1,5 @@
-import { db } from "@crm/db";
 import { queueSlackInventorySync } from "@crm/db/slack-inventory";
-import { WORKSPACE_ID } from "@crm/db/workspace";
+import { scopedTransaction } from "@crm/db/tenant-scope";
 import { parse, schemas } from "@crm/validation";
 import { z } from "zod";
 import { SLACK } from "./slack-config";
@@ -48,16 +47,22 @@ const RECONNECT_ERRORS = ["invalid_auth", "account_inactive", "token_revoked"];
 const INVENTORY_REASON =
 	"Read Slack people and channels again: the cached inventory is stale";
 
-export async function requestSlackInventorySync(): Promise<void> {
-	await queueSlackInventorySync(INVENTORY_REASON);
+export async function requestSlackInventorySync(
+	organizationId: string,
+): Promise<void> {
+	await queueSlackInventorySync(INVENTORY_REASON, organizationId);
 }
 
-export async function requestStaleSlackInventorySync(): Promise<void> {
+export async function requestStaleSlackInventorySync(
+	organizationId: string,
+): Promise<void> {
 	try {
-		const newest = await db.slackChannel.findFirst({
-			orderBy: { updatedAt: "desc" },
-			select: { updatedAt: true },
-		});
+		const newest = await scopedTransaction((tx) =>
+			tx.slackChannel.findFirst({
+				orderBy: { updatedAt: "desc" },
+				select: { updatedAt: true },
+			}),
+		);
 		const fresh =
 			newest !== null &&
 			Date.now() - newest.updatedAt.getTime() < SLACK.inventory.staleMs;
@@ -66,10 +71,12 @@ export async function requestStaleSlackInventorySync(): Promise<void> {
 		return;
 	}
 
-	await requestSlackInventorySync();
+	await requestSlackInventorySync(organizationId);
 }
 
-export async function runSlackPeopleMatch(): Promise<string> {
+export async function runSlackPeopleMatch(
+	organizationId: string,
+): Promise<string> {
 	const accessToken = await slackAccessToken();
 	if (!accessToken) return "Slack is not connected.";
 
@@ -87,47 +94,53 @@ export async function runSlackPeopleMatch(): Promise<string> {
 			return email ? [[email, member] as const] : [];
 		}),
 	);
-	const crmMembers = await db.member.findMany({
-		where: { organizationId: WORKSPACE_ID },
-		select: {
-			user: {
-				select: {
-					id: true,
-					email: true,
+	const matched = await scopedTransaction(async (tx) => {
+		const crmMembers = await tx.member.findMany({
+			where: { organizationId },
+			select: {
+				user: {
+					select: {
+						id: true,
+						email: true,
+					},
 				},
 			},
-		},
-	});
-
-	let matched = 0;
-	for (const { user } of crmMembers) {
-		const slack = byEmail.get(user.email.trim().toLowerCase());
-		const slackHandle = slack ? `@${slack.name ?? slack.id}` : null;
-		await db.slackMemberMatch.upsert({
-			where: { crmUserId: user.id },
-			create: {
-				crmUserId: user.id,
-				slackUserId: slack?.id,
-				slackHandle,
-				slackEmail: slack?.profile?.email,
-			},
-			update: {
-				slackUserId: slack?.id ?? null,
-				slackHandle,
-				slackEmail: slack?.profile?.email ?? null,
-			},
 		});
-		if (slack) matched += 1;
-	}
+
+		let count = 0;
+		for (const { user } of crmMembers) {
+			const slack = byEmail.get(user.email.trim().toLowerCase());
+			const slackHandle = slack ? `@${slack.name ?? slack.id}` : null;
+			await tx.slackMemberMatch.upsert({
+				where: { crmUserId: user.id },
+				create: {
+					crmUserId: user.id,
+					slackUserId: slack?.id,
+					slackHandle,
+					slackEmail: slack?.profile?.email,
+				},
+				update: {
+					slackUserId: slack?.id ?? null,
+					slackHandle,
+					slackEmail: slack?.profile?.email ?? null,
+				},
+			});
+			if (slack) count += 1;
+		}
+		return count;
+	});
 
 	const availableChannels = await persistSlackChannels(
 		slackChannels,
 		Boolean(userToken),
+		organizationId,
 	);
 	return `Matched ${matched} workspace ${matched === 1 ? "member" : "members"} by email and found ${availableChannels} available ${availableChannels === 1 ? "channel" : "channels"}.`;
 }
 
-export async function refreshSlackChannels(): Promise<number> {
+export async function refreshSlackChannels(
+	organizationId: string,
+): Promise<number> {
 	const accessToken = await slackAccessToken();
 	if (!accessToken) return 0;
 
@@ -135,6 +148,7 @@ export async function refreshSlackChannels(): Promise<number> {
 	return persistSlackChannels(
 		await visibleChannels(accessToken, userToken),
 		Boolean(userToken),
+		organizationId,
 	);
 }
 
@@ -160,6 +174,7 @@ async function visibleChannels(
 export async function persistSlackChannels(
 	channels: SlackChannel[],
 	canInviteItself: boolean,
+	_organizationId: string,
 ): Promise<number> {
 	const available = [
 		...new Map(
@@ -173,16 +188,16 @@ export async function persistSlackChannels(
 		).values(),
 	];
 
-	return db.$transaction(async (tx) => {
-		const [account] = await tx.$queryRaw<Array<{ id: string }>>`
+	return scopedTransaction(async (tx) => {
+		const [grant] = await tx.$queryRaw<Array<{ id: string }>>`
 			SELECT id
-			FROM "account"
-			WHERE "providerId" = 'slack' AND "accessToken" IS NOT NULL
+			FROM "slackWorkspaceGrant"
+			WHERE "botToken" IS NOT NULL
 			ORDER BY "updatedAt" DESC
 			LIMIT 1
 			FOR UPDATE
 		`;
-		if (!account) return 0;
+		if (!grant) return 0;
 
 		const ids = available.map((channel) => channel.id);
 		await tx.slackChannel.updateMany({
diff --git a/apps/agent/agent/lib/stale-tasks.ts b/apps/agent/agent/lib/stale-tasks.ts
index c85d51fcc..59ce96ef9 100644
--- a/apps/agent/agent/lib/stale-tasks.ts
+++ b/apps/agent/agent/lib/stale-tasks.ts
@@ -1,12 +1,14 @@
-import { db, EnrichmentStatus, type Prisma } from "@crm/db";
+import { EnrichmentStatus, type Prisma } from "@crm/db";
 import {
 	MAX_ATTEMPTS,
 	ownsCompanyStatus,
 	ownsContactStatus,
 } from "@crm/db/agent-tasks";
+import { tenantTransaction } from "@crm/db/tenant-scope";
+import { forEachTenant } from "@crm/db/tenants";
 import { DISPATCH } from "./dispatch-config";
 import { settle } from "./enrichment";
-import { retireExhausted, type TaskSubject } from "./tasks";
+import { retireExhausted, runTaskInTenant, type TaskSubject } from "./tasks";
 
 const SCAN = DISPATCH.reconcile.scan;
 
@@ -31,6 +33,7 @@ export type StaleTaskSweep = {
 
 type OpenTask = {
 	id: string;
+	organizationId: string;
 	kind: string;
 	contactId: string | null;
 	companyId: string | null;
@@ -38,6 +41,12 @@ type OpenTask = {
 	attempts: number;
 	leasedUntil: Date | null;
 	startedAt: Date | null;
+	dueAt: Date;
+};
+
+type TenantScan = {
+	open: number;
+	tasks: OpenTask[];
 };
 
 let lastSweep: StaleTaskSweep | null = null;
@@ -56,7 +65,9 @@ export async function retireAbandoned(): Promise<TaskSubject[]> {
 	}
 
 	for (const task of abandoned) {
-		await settle(task, EnrichmentStatus.FAILED, RETIRED_ERROR).catch(() => {});
+		await runTaskInTenant(task, () =>
+			settle(task, EnrichmentStatus.FAILED, RETIRED_ERROR),
+		).catch(() => {});
 	}
 
 	return abandoned;
@@ -86,97 +97,120 @@ export async function reconcileStaleTasks(): Promise<StaleTaskSweep> {
 
 async function runSweep(sweep: StaleTaskSweep): Promise<void> {
 	const now = new Date();
-
 	const where: Prisma.AgentTaskWhereInput = {
 		finishedAt: null,
 		dueAt: { lte: now },
 		OR: [{ leasedUntil: null }, { leasedUntil: { lt: now } }],
 	};
+	const scans: TenantScan[] = [];
+
+	await forEachTenant(
+		async (_organizationId, tx) => {
+			const tenantWhere: Prisma.AgentTaskWhereInput = {
+				...where,
+			};
+			const [open, tasks] = await Promise.all([
+				tx.agentTask.count({ where: tenantWhere }),
+				tx.agentTask.findMany({
+					where: tenantWhere,
+					orderBy: [{ dueAt: "asc" }],
+					take: SCAN,
+					select: {
+						id: true,
+						organizationId: true,
+						kind: true,
+						contactId: true,
+						companyId: true,
+						dealId: true,
+						attempts: true,
+						leasedUntil: true,
+						startedAt: true,
+						dueAt: true,
+					},
+				}),
+			]);
+			scans.push({ open, tasks });
+		},
+		{ concurrency: DISPATCH.task.tenantConcurrency },
+	);
 
-	const [open, tasks] = await Promise.all([
-		db.agentTask.count({ where }),
-		db.agentTask.findMany({
-			where,
-			orderBy: [{ dueAt: "asc" }],
-			take: SCAN,
-			select: {
-				id: true,
-				kind: true,
-				contactId: true,
-				companyId: true,
-				dealId: true,
-				attempts: true,
-				leasedUntil: true,
-				startedAt: true,
-			},
-		}),
-	]);
+	const open = scans.reduce((total, scan) => total + scan.open, 0);
+	const tasks = scans
+		.flatMap((scan) => scan.tasks)
+		.sort(compareDueAt)
+		.slice(0, SCAN);
 
 	sweep.scanned = tasks.length;
 	sweep.unscanned = Math.max(0, open - tasks.length);
+	const groups = groupTasksByTenant(tasks);
+
+	for (const [organizationId, tenantTasks] of groups) {
+		await tenantTransaction(organizationId, async (tx) => {
+			const completed = await completedSubjects(tx, tenantTasks);
+			const landed: string[] = [];
+			const untargeted: string[] = [];
+			const dead: string[] = [];
+
+			for (const task of tenantTasks) {
+				if (isUntargetedFieldBackfill(task)) {
+					untargeted.push(task.id);
+					continue;
+				}
+
+				if (finishedElsewhere(task, completed)) {
+					landed.push(task.id);
+					continue;
+				}
+
+				if (task.attempts >= MAX_ATTEMPTS) continue;
+
+				if (task.leasedUntil !== null) dead.push(task.id);
+				else sweep.waiting += 1;
+			}
+
+			if (landed.length > 0) {
+				const { count } = await tx.agentTask.updateMany({
+					where: {
+						id: { in: landed },
+						finishedAt: null,
+						OR: [{ leasedUntil: null }, { leasedUntil: { lt: now } }],
+					},
+					data: { finishedAt: now, outcome: LANDED_OUTCOME },
+				});
+				sweep.closed += count;
+			}
 
-	const completed = await completedSubjects(tasks);
-
-	const landed: string[] = [];
-	const untargeted: string[] = [];
-	const dead: string[] = [];
-
-	for (const task of tasks) {
-		if (isUntargetedFieldBackfill(task)) {
-			untargeted.push(task.id);
-			continue;
-		}
-
-		if (finishedElsewhere(task, completed)) {
-			landed.push(task.id);
-			continue;
-		}
-
-		if (task.attempts >= MAX_ATTEMPTS) continue;
-
-		if (task.leasedUntil !== null) dead.push(task.id);
-		else sweep.waiting += 1;
-	}
-
-	if (landed.length > 0) {
-		const { count } = await db.agentTask.updateMany({
-			where: {
-				id: { in: landed },
-				finishedAt: null,
-				OR: [{ leasedUntil: null }, { leasedUntil: { lt: now } }],
-			},
-			data: { finishedAt: now, outcome: LANDED_OUTCOME },
-		});
-
-		sweep.closed = count;
-	}
+			if (untargeted.length > 0) {
+				const { count } = await tx.agentTask.updateMany({
+					where: {
+						id: { in: untargeted },
+						finishedAt: null,
+						OR: [{ leasedUntil: null }, { leasedUntil: { lt: now } }],
+					},
+					data: { finishedAt: now, outcome: UNTARGETED_OUTCOME },
+				});
+				sweep.closed += count;
+			}
 
-	if (untargeted.length > 0) {
-		const { count } = await db.agentTask.updateMany({
-			where: {
-				id: { in: untargeted },
-				finishedAt: null,
-				OR: [{ leasedUntil: null }, { leasedUntil: { lt: now } }],
-			},
-			data: { finishedAt: now, outcome: UNTARGETED_OUTCOME },
+			if (dead.length > 0) {
+				const { count } = await tx.agentTask.updateMany({
+					where: {
+						id: { in: dead },
+						finishedAt: null,
+						leasedUntil: { lt: now },
+					},
+					data: { leasedUntil: null },
+				});
+				sweep.released += count;
+			}
 		});
-
-		sweep.closed += count;
 	}
 
 	sweep.retired = (await retireAbandoned()).length;
-
-	if (dead.length > 0) {
-		const { count } = await db.agentTask.updateMany({
-			where: { id: { in: dead }, finishedAt: null, leasedUntil: { lt: now } },
-			data: { leasedUntil: null },
-		});
-
-		sweep.released = count;
-	}
 }
 
 async function completedSubjects(
+	tx: Prisma.TransactionClient,
 	tasks: readonly OpenTask[],
 ): Promise<Map<string, Date>> {
 	const contactIds = unique(tasks.map((task) => task.contactId));
@@ -185,7 +219,7 @@ async function completedSubjects(
 	const [contacts, companies] = await Promise.all([
 		contactIds.length === 0
 			? []
-			: db.contact.findMany({
+			: tx.contact.findMany({
 					where: {
 						id: { in: contactIds },
 						enrichmentStatus: EnrichmentStatus.COMPLETE,
@@ -195,7 +229,7 @@ async function completedSubjects(
 				}),
 		companyIds.length === 0
 			? []
-			: db.company.findMany({
+			: tx.company.findMany({
 					where: {
 						id: { in: companyIds },
 						enrichmentStatus: EnrichmentStatus.COMPLETE,
@@ -214,6 +248,22 @@ async function completedSubjects(
 	return completed;
 }
 
+function groupTasksByTenant(
+	tasks: readonly OpenTask[],
+): Map<string, OpenTask[]> {
+	const groups = new Map<string, OpenTask[]>();
+	for (const task of tasks) {
+		const tenantTasks = groups.get(task.organizationId) ?? [];
+		tenantTasks.push(task);
+		groups.set(task.organizationId, tenantTasks);
+	}
+	return groups;
+}
+
+function compareDueAt(a: OpenTask, b: OpenTask): number {
+	return a.dueAt.getTime() - b.dueAt.getTime() || a.id.localeCompare(b.id);
+}
+
 function finishedElsewhere(
 	task: OpenTask,
 	completed: Map<string, Date>,
diff --git a/apps/agent/agent/lib/tasks.ts b/apps/agent/agent/lib/tasks.ts
index 9d8a912c7..26312ebb7 100644
--- a/apps/agent/agent/lib/tasks.ts
+++ b/apps/agent/agent/lib/tasks.ts
@@ -1,9 +1,17 @@
-import { db, type Prisma } from "@crm/db";
+import { Prisma } from "@crm/db";
 import { MAX_ATTEMPTS, RETIRED_OUTCOME } from "@crm/db/agent-tasks";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import {
+	forEachTenant,
+	locateTenantRow,
+	organizationIds,
+} from "@crm/db/tenants";
 import { DISPATCH } from "./dispatch-config";
 
 export type LeasedTask = {
 	id: string;
+	organizationId: string;
 	contactId: string | null;
 	companyId: string | null;
 	dealId: string | null;
@@ -18,21 +26,29 @@ export type LeasedTask = {
 
 export type TaskSubject = {
 	id: string;
+	organizationId: string;
 	contactId: string | null;
 	companyId: string | null;
 	dealId: string | null;
 	kind: string;
 };
 
-const LEASE_MS = DISPATCH.task.leaseMs;
+type TaskCandidate = {
+	id: string;
+	organizationId: string;
+	priority: number;
+	dueAt: Date;
+};
 
-export { DIRECT_KINDS, MAX_ATTEMPTS } from "@crm/db/agent-tasks";
+const LEASE_MS = DISPATCH.task.leaseMs;
 
 export async function claimDue(
 	limit: number,
 	kinds: { only: readonly string[] } | { except: readonly string[] },
 	leaseMs = LEASE_MS,
 ): Promise<LeasedTask[]> {
+	if (limit <= 0) return [];
+
 	const now = new Date();
 	const until = new Date(now.getTime() + leaseMs);
 
@@ -40,57 +56,178 @@ export async function claimDue(
 	if ("only" in kinds && list.length === 0) return [];
 
 	const onlyMode = "only" in kinds;
+	const organizations = await organizationIds();
+	const claimed: LeasedTask[] = [];
 
-	const claimed = await db.$queryRaw<LeasedTask[]>`
-		UPDATE "agentTask" AS t
-		SET "leasedUntil" = ${until},
-			"startedAt" = COALESCE(t."startedAt", ${now}),
-			"attempts" = t."attempts" + 1
-		FROM (
-			SELECT t2.id FROM "agentTask" AS t2
-			WHERE t2."finishedAt" IS NULL
-				AND t2."dueAt" <= ${now}
-				AND (t2."leasedUntil" IS NULL OR t2."leasedUntil" < ${now})
-				AND t2."attempts" < ${MAX_ATTEMPTS}
-				AND CASE
-					WHEN ${onlyMode}::boolean THEN t2.kind = ANY(${list}::text[])
-					ELSE t2.kind <> ALL(${list}::text[])
-				END
-			ORDER BY t2."priority" DESC, t2."dueAt" ASC
-			LIMIT ${limit}
-			FOR UPDATE SKIP LOCKED
-		) AS due
-		WHERE t.id = due.id
-		RETURNING t.id, t."contactId", t."companyId", t."dealId", t.kind, t.reason, t.payload,
-			t.budget, t.attempts, t.priority, t."dueAt";
-	`;
-
-	return claimed.sort(
-		(a, b) => b.priority - a.priority || a.dueAt.getTime() - b.dueAt.getTime(),
-	);
+	while (claimed.length < limit) {
+		const remaining = limit - claimed.length;
+		const candidates = await collectTenantRows(
+			organizations,
+			(_organizationId, tx) =>
+				tx.$queryRaw<TaskCandidate[]>(Prisma.sql`
+					SELECT t.id, t."organizationId", t.priority, t."dueAt"
+					FROM "agentTask" AS t
+					WHERE t."finishedAt" IS NULL
+						AND t."dueAt" <= ${now}
+						AND (t."leasedUntil" IS NULL OR t."leasedUntil" < ${now})
+						AND t."attempts" < ${MAX_ATTEMPTS}
+						AND CASE
+							WHEN ${onlyMode}::boolean THEN t.kind = ANY(${list}::text[])
+							ELSE t.kind <> ALL(${list}::text[])
+						END
+					ORDER BY t.priority DESC, t."dueAt" ASC
+					LIMIT ${remaining}
+					FOR UPDATE SKIP LOCKED
+				`),
+		);
+		const selected = candidates.sort(compareTaskPriority).slice(0, remaining);
+		if (selected.length === 0) break;
+
+		const batch = await claimSelectedTasks(
+			selected,
+			now,
+			until,
+			list,
+			onlyMode,
+		);
+		claimed.push(...batch);
+	}
+
+	return claimed.sort(compareTaskPriority);
 }
 
 export async function retireExhausted(
 	limit: number = DISPATCH.reconcile.retire,
 ): Promise<TaskSubject[]> {
+	if (limit <= 0) return [];
+
 	const now = new Date();
+	const organizations = await organizationIds();
+	const retired: TaskSubject[] = [];
+
+	while (retired.length < limit) {
+		const remaining = limit - retired.length;
+		const candidates = await collectTenantRows(
+			organizations,
+			(_organizationId, tx) =>
+				tx.$queryRaw<TaskCandidate[]>(Prisma.sql`
+					SELECT t.id, t."organizationId", t.priority, t."dueAt"
+					FROM "agentTask" AS t
+					WHERE t."finishedAt" IS NULL
+						AND t."attempts" >= ${MAX_ATTEMPTS}
+						AND (t."leasedUntil" IS NULL OR t."leasedUntil" < ${now})
+					ORDER BY t."dueAt" ASC
+					LIMIT ${remaining}
+					FOR UPDATE SKIP LOCKED
+				`),
+		);
+		const selected = candidates
+			.sort((a, b) => a.dueAt.getTime() - b.dueAt.getTime())
+			.slice(0, remaining);
+		if (selected.length === 0) break;
+
+		const batch = await retireSelectedTasks(selected, now);
+		retired.push(...batch);
+	}
+
+	return retired;
+}
 
-	return db.$queryRaw<TaskSubject[]>`
-		UPDATE "agentTask" AS t
-		SET "finishedAt" = ${now},
-			"outcome" = ${RETIRED_OUTCOME}
-		WHERE t.id IN (
-			SELECT c.id
-			FROM "agentTask" AS c
-			WHERE c."finishedAt" IS NULL
-				AND c."attempts" >= ${MAX_ATTEMPTS}
-				AND (c."leasedUntil" IS NULL OR c."leasedUntil" < ${now})
-			ORDER BY c."dueAt" ASC
-			LIMIT ${limit}
-			FOR UPDATE SKIP LOCKED
-		)
-		RETURNING t.id, t."contactId", t."companyId", t."dealId", t.kind;
-	`;
+async function collectTenantRows<T>(
+	organizations: readonly string[],
+	query: (organizationId: string, tx: Prisma.TransactionClient) => Promise<T[]>,
+): Promise<T[]> {
+	const rows: T[] = [];
+	await forEachTenant(
+		async (organizationId, tx) => {
+			rows.push(...(await query(organizationId, tx)));
+		},
+		{ concurrency: DISPATCH.task.tenantConcurrency, organizations },
+	);
+	return rows;
+}
+
+async function claimSelectedTasks(
+	selected: readonly TaskCandidate[],
+	now: Date,
+	until: Date,
+	list: readonly string[],
+	onlyMode: boolean,
+): Promise<LeasedTask[]> {
+	return updateSelectedByTenant(selected, (_organizationId, ids, tx) =>
+		tx.$queryRaw<LeasedTask[]>(Prisma.sql`
+			WITH due AS (
+				SELECT t.id
+				FROM "agentTask" AS t
+				WHERE t.id IN (${Prisma.join(ids)})
+					AND t."finishedAt" IS NULL
+					AND t."dueAt" <= ${now}
+					AND (t."leasedUntil" IS NULL OR t."leasedUntil" < ${now})
+					AND t."attempts" < ${MAX_ATTEMPTS}
+					AND CASE
+						WHEN ${onlyMode}::boolean THEN t.kind = ANY(${list}::text[])
+						ELSE t.kind <> ALL(${list}::text[])
+					END
+				FOR UPDATE SKIP LOCKED
+			)
+			UPDATE "agentTask" AS t
+			SET "leasedUntil" = ${until},
+				"startedAt" = COALESCE(t."startedAt", ${now}),
+				"attempts" = t."attempts" + 1
+			FROM due
+			WHERE t.id = due.id
+			RETURNING t.id, t."contactId", t."companyId", t."dealId", t.kind, t.reason, t.payload,
+				t.budget, t.attempts, t.priority, t."dueAt", t."organizationId"
+		`),
+	);
+}
+
+async function retireSelectedTasks(
+	selected: readonly TaskCandidate[],
+	now: Date,
+): Promise<TaskSubject[]> {
+	return updateSelectedByTenant(selected, (_organizationId, ids, tx) =>
+		tx.$queryRaw<TaskSubject[]>(Prisma.sql`
+			WITH exhausted AS (
+				SELECT t.id
+				FROM "agentTask" AS t
+				WHERE t.id IN (${Prisma.join(ids)})
+					AND t."finishedAt" IS NULL
+					AND t."attempts" >= ${MAX_ATTEMPTS}
+					AND (t."leasedUntil" IS NULL OR t."leasedUntil" < ${now})
+				FOR UPDATE SKIP LOCKED
+			)
+			UPDATE "agentTask" AS t
+			SET "finishedAt" = ${now},
+				"outcome" = ${RETIRED_OUTCOME}
+			FROM exhausted
+			WHERE t.id = exhausted.id
+			RETURNING t.id, t."organizationId", t."contactId", t."companyId", t."dealId", t.kind
+		`),
+	);
+}
+
+async function updateSelectedByTenant<T>(
+	selected: readonly TaskCandidate[],
+	update: (
+		organizationId: string,
+		ids: readonly string[],
+		tx: Prisma.TransactionClient,
+	) => Promise<T[]>,
+): Promise<T[]> {
+	const groups = new Map<string, string[]>();
+	for (const task of selected) {
+		const ids = groups.get(task.organizationId) ?? [];
+		ids.push(task.id);
+		groups.set(task.organizationId, ids);
+	}
+	return collectTenantRows([...groups.keys()], (organizationId, tx) =>
+		update(organizationId, groups.get(organizationId) ?? [], tx),
+	);
+}
+
+function compareTaskPriority(a: TaskCandidate, b: TaskCandidate): number {
+	return b.priority - a.priority || a.dueAt.getTime() - b.dueAt.getTime();
 }
 
 export async function completeTask(
@@ -98,7 +235,7 @@ export async function completeTask(
 	outcome: string,
 	sessionId?: string,
 ): Promise<TaskSubject | null> {
-	const { count } = await db.agentTask.updateMany({
+	const { count } = await scopedDb.agentTask.updateMany({
 		where: { id: taskId, finishedAt: null },
 		data: {
 			finishedAt: new Date(),
@@ -109,10 +246,11 @@ export async function completeTask(
 
 	if (count === 0) return null;
 
-	return db.agentTask.findUnique({
+	return await scopedDb.agentTask.findUnique({
 		where: { id: taskId },
 		select: {
 			id: true,
+			organizationId: true,
 			contactId: true,
 			companyId: true,
 			dealId: true,
@@ -122,10 +260,11 @@ export async function completeTask(
 }
 
 export async function taskSubject(taskId: string): Promise<TaskSubject | null> {
-	return db.agentTask.findUnique({
+	return await scopedDb.agentTask.findUnique({
 		where: { id: taskId },
 		select: {
 			id: true,
+			organizationId: true,
 			contactId: true,
 			companyId: true,
 			dealId: true,
@@ -134,17 +273,41 @@ export async function taskSubject(taskId: string): Promise<TaskSubject | null> {
 	});
 }
 
+export function runTaskInTenant<T>(
+	task: { organizationId: string },
+	action: () => T,
+): T {
+	return runInTenant(task.organizationId, action);
+}
+
+export async function withTaskTenant<T>(
+	taskId: string,
+	action: () => Promise<T>,
+): Promise<T | null> {
+	const located = await locateTenantRow(() =>
+		scopedDb.agentTask.findUnique({
+			where: { id: taskId },
+			select: { id: true },
+		}),
+	);
+
+	if (!located) return null;
+
+	return runInTenant(located.organizationId, action);
+}
+
 export async function noteSession(
 	taskId: string,
 	sessionId: string,
 ): Promise<void> {
-	await db.agentTask.updateMany({
+	await scopedDb.agentTask.updateMany({
 		where: { id: taskId, finishedAt: null },
 		data: { sessionId },
 	});
 }
 
 export async function scheduleTask(input: {
+	organizationId: string;
 	contactId?: string | null;
 	companyId?: string | null;
 	dealId?: string | null;
@@ -155,7 +318,7 @@ export async function scheduleTask(input: {
 	priority?: number;
 	budget?: number;
 }): Promise<{ id: string }> {
-	const existing = await db.agentTask.findFirst({
+	const existing = await scopedDb.agentTask.findFirst({
 		where: {
 			kind: input.kind,
 			finishedAt: null,
@@ -167,14 +330,14 @@ export async function scheduleTask(input: {
 	});
 
 	if (existing) {
-		await db.agentTask.update({
+		await scopedDb.agentTask.update({
 			where: { id: existing.id },
 			data: { dueAt: input.dueAt, reason: input.reason },
 		});
 		return existing;
 	}
 
-	return db.agentTask.create({
+	return await scopedDb.agentTask.create({
 		data: {
 			contactId: input.contactId ?? null,
 			companyId: input.companyId ?? null,
@@ -191,7 +354,7 @@ export async function scheduleTask(input: {
 }
 
 export async function lastDecision(contactId: string) {
-	return db.agentTask.findFirst({
+	return await scopedDb.agentTask.findFirst({
 		where: { contactId },
 		orderBy: { createdAt: "desc" },
 		select: {
diff --git a/apps/agent/agent/lib/workspace.ts b/apps/agent/agent/lib/workspace.ts
index 98d5185dd..e20dcc734 100644
--- a/apps/agent/agent/lib/workspace.ts
+++ b/apps/agent/agent/lib/workspace.ts
@@ -1,4 +1,4 @@
-import { db } from "@crm/db";
+import { scopedTransaction } from "@crm/db/tenant-scope";
 import {
 	readWorkspaceIdentity,
 	type WorkspaceIdentity,
@@ -8,7 +8,7 @@ export type { WorkspaceIdentity };
 
 export async function identity(): Promise<WorkspaceIdentity | null> {
 	try {
-		return await readWorkspaceIdentity(db);
+		return await scopedTransaction((tx) => readWorkspaceIdentity(tx));
 	} catch (error) {
 		console.error("[agent] could not read who we are", error);
 		return null;
diff --git a/apps/agent/agent/schedules/dispatch.ts b/apps/agent/agent/schedules/dispatch.ts
index 1aa080fe6..9f954bbea 100644
--- a/apps/agent/agent/schedules/dispatch.ts
+++ b/apps/agent/agent/schedules/dispatch.ts
@@ -11,7 +11,7 @@ import { reconcileStaleTasks } from "../lib/stale-tasks";
 
 export default defineSchedule({
 	cron: "* * * * *",
-	async run({ receive, waitUntil, appAuth }) {
+	async run({ to, waitUntil, appAuth }) {
 		waitUntil(
 			Promise.all([
 				sweepBlankFacts(),
@@ -19,9 +19,7 @@ export default defineSchedule({
 				(async () => {
 					await reconcileStaleTasks();
 					await drainAll((task) =>
-						receive(crm, {
-							message: brief(task),
-							target: { taskId: task.id },
+						to(crm, { taskId: task.id }).send(brief(task), {
 							auth: taskAuth(task, appAuth),
 						}),
 					);
@@ -33,16 +31,13 @@ export default defineSchedule({
 
 					await Promise.all([
 						...builderIds.map((builderSubmissionId) =>
-							receive(crm, {
-								message: "Continue a queued private agent-builder chat.",
-								target: { builderSubmissionId },
-								auth: appAuth,
-							}),
+							to(crm, { builderSubmissionId }).send(
+								"Continue a queued private agent-builder chat.",
+								{ auth: appAuth },
+							),
 						),
 						...runIds.map((runId) =>
-							receive(crm, {
-								message: "Execute a queued deployed agent run.",
-								target: { runId },
+							to(crm, { runId }).send("Execute a queued deployed agent run.", {
 								auth: appAuth,
 							}),
 						),
diff --git a/apps/agent/agent/subagents/agent_builder/agent.ts b/apps/agent/agent/subagents/agent_builder/agent.ts
index 4318264f9..aa5ae8ef5 100644
--- a/apps/agent/agent/subagents/agent_builder/agent.ts
+++ b/apps/agent/agent/subagents/agent_builder/agent.ts
@@ -1,14 +1,23 @@
-import { DEFAULT_AGENT_MODEL } from "@crm/db/settings";
-import { defineAgent, defineDynamic } from "eve";
+import { defaultAgentModelResult } from "@crm/db/settings";
+import { type DefinedAgent, defineAgent, defineDynamic } from "eve";
 import { z } from "zod";
 import { selectedModel } from "../../lib/model";
 
-export default defineAgent({
+const agent: DefinedAgent = defineAgent({
 	description:
 		"Turn one private CRM builder-chat request into a validated, reviewable team-agent version without deploying it.",
 	model: defineDynamic({
-		fallback: DEFAULT_AGENT_MODEL.id,
-		events: { "session.started": () => selectedModel() },
+		events: {
+			"session.started": async () => {
+				const selected = await selectedModel();
+				return selected
+					? {
+							model: selected.model,
+							modelContextWindowTokens: selected.modelContextWindowTokens,
+						}
+					: defaultAgentModelResult();
+			},
+		},
 	}),
 	outputSchema: z.object({
 		status: z.literal("draft_ready"),
@@ -22,3 +31,5 @@ export default defineAgent({
 		sessionTimeoutMs: 24 * 60 * 60 * 1000,
 	},
 });
+
+export default agent;
diff --git a/apps/agent/agent/subagents/agent_builder/tools/glob.ts b/apps/agent/agent/subagents/agent_builder/tools/glob.ts
deleted file mode 100644
index 04bd05447..000000000
--- a/apps/agent/agent/subagents/agent_builder/tools/glob.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import { disableTool } from "eve/tools";
-
-export default disableTool();
diff --git a/apps/agent/agent/subagents/agent_builder/tools/grep.ts b/apps/agent/agent/subagents/agent_builder/tools/grep.ts
deleted file mode 100644
index 04bd05447..000000000
--- a/apps/agent/agent/subagents/agent_builder/tools/grep.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import { disableTool } from "eve/tools";
-
-export default disableTool();
diff --git a/apps/agent/agent/subagents/agent_builder/tools/inspect_context.ts b/apps/agent/agent/subagents/agent_builder/tools/inspect_context.ts
index 8979cbb8d..edf790b75 100644
--- a/apps/agent/agent/subagents/agent_builder/tools/inspect_context.ts
+++ b/apps/agent/agent/subagents/agent_builder/tools/inspect_context.ts
@@ -1,7 +1,10 @@
 import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { builderContext } from "../../../lib/builder-runtime";
-import { requireBuilderAttribute } from "../../../lib/session-purpose";
+import {
+	requireBuilderAttribute,
+	requireOrganizationId,
+} from "../../../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -9,6 +12,7 @@ export default defineTool({
 	inputSchema: z.object({}),
 	async execute(_input, ctx) {
 		return builderContext(
+			requireOrganizationId(ctx),
 			requireBuilderAttribute(ctx, "conversationId"),
 			requireBuilderAttribute(ctx, "userId"),
 		);
diff --git a/apps/agent/agent/subagents/agent_builder/tools/save_agent_draft.ts b/apps/agent/agent/subagents/agent_builder/tools/save_agent_draft.ts
index 8ed3c0aa5..a59e00897 100644
--- a/apps/agent/agent/subagents/agent_builder/tools/save_agent_draft.ts
+++ b/apps/agent/agent/subagents/agent_builder/tools/save_agent_draft.ts
@@ -1,6 +1,9 @@
 import { defineTool } from "eve/tools";
 import { saveBuilderDraft } from "../../../lib/builder-runtime";
-import { requireBuilderAttribute } from "../../../lib/session-purpose";
+import {
+	requireBuilderAttribute,
+	requireOrganizationId,
+} from "../../../lib/session-purpose";
 import { builderDraftToolInput, draftInputFromTool } from "../lib/draft-input";
 import {
 	assertBuilderDraftOpen,
@@ -14,6 +17,7 @@ export default defineTool({
 	async execute(input, ctx) {
 		assertBuilderDraftOpen();
 		const result = await saveBuilderDraft(
+			requireOrganizationId(ctx),
 			requireBuilderAttribute(ctx, "conversationId"),
 			requireBuilderAttribute(ctx, "userId"),
 			draftInputFromTool(input),
diff --git a/apps/agent/agent/subagents/agent_builder/tools/write_agent_file.ts b/apps/agent/agent/subagents/agent_builder/tools/write_agent_file.ts
index 9d9380122..9ddbed982 100644
--- a/apps/agent/agent/subagents/agent_builder/tools/write_agent_file.ts
+++ b/apps/agent/agent/subagents/agent_builder/tools/write_agent_file.ts
@@ -4,7 +4,10 @@ import {
 	BUILDER_ARTIFACT_PATHS,
 	writeBuilderArtifact,
 } from "../../../lib/builder-runtime";
-import { requireBuilderAttribute } from "../../../lib/session-purpose";
+import {
+	requireBuilderAttribute,
+	requireOrganizationId,
+} from "../../../lib/session-purpose";
 import { assertBuilderDraftOpen } from "../lib/execution-state";
 
 export default defineTool({
@@ -17,6 +20,7 @@ export default defineTool({
 	async execute(input, ctx) {
 		assertBuilderDraftOpen();
 		return writeBuilderArtifact(
+			requireOrganizationId(ctx),
 			requireBuilderAttribute(ctx, "conversationId"),
 			requireBuilderAttribute(ctx, "userId"),
 			input.path,
diff --git a/apps/agent/agent/subagents/agent_runner/agent.ts b/apps/agent/agent/subagents/agent_runner/agent.ts
index 1d8be7751..6c5ba754f 100644
--- a/apps/agent/agent/subagents/agent_runner/agent.ts
+++ b/apps/agent/agent/subagents/agent_runner/agent.ts
@@ -1,34 +1,42 @@
-import { db } from "@crm/db";
-import { DEFAULT_AGENT_MODEL } from "@crm/db/settings";
-import { defineAgent, defineDynamic } from "eve";
+import { defaultAgentModelResult } from "@crm/db/settings";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import { type DefinedAgent, defineAgent, defineDynamic } from "eve";
 import { z } from "zod";
-import { attribute, purposeOf } from "../../lib/session-purpose";
+import {
+	attribute,
+	purposeOf,
+	runInSessionTenant,
+} from "../../lib/session-purpose";
 
-export default defineAgent({
+const agent: DefinedAgent = defineAgent({
 	description:
 		"Execute one immutable deployed CRM agent version and persist its result and every side effect.",
 	model: defineDynamic({
-		fallback: DEFAULT_AGENT_MODEL.id,
 		events: {
 			"session.started": async (_event, ctx) => {
-				if (purposeOf(ctx) !== "team-agent") return null;
+				if (purposeOf(ctx) !== "team-agent") {
+					return defaultAgentModelResult();
+				}
 				const runId = attribute(ctx, "runId");
-				if (!runId) return null;
-
-				const run = await db.agentRun.findUnique({
-					where: { id: runId },
-					select: {
-						version: {
-							select: { modelId: true, modelContextWindowTokens: true },
+				if (!runId) {
+					return defaultAgentModelResult();
+				}
+				const run = await runInSessionTenant(ctx, () =>
+					db.agentRun.findUnique({
+						where: { id: runId },
+						select: {
+							version: {
+								select: { modelId: true, modelContextWindowTokens: true },
+							},
 						},
-					},
-				});
+					}),
+				);
 				return run
 					? {
 							model: run.version.modelId,
 							modelContextWindowTokens: run.version.modelContextWindowTokens,
 						}
-					: null;
+					: defaultAgentModelResult();
 			},
 		},
 	}),
@@ -42,3 +50,5 @@ export default defineAgent({
 		sessionTimeoutMs: 24 * 60 * 60 * 1000,
 	},
 });
+
+export default agent;
diff --git a/apps/agent/agent/subagents/agent_runner/tools/glob.ts b/apps/agent/agent/subagents/agent_runner/tools/glob.ts
deleted file mode 100644
index 04bd05447..000000000
--- a/apps/agent/agent/subagents/agent_runner/tools/glob.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import { disableTool } from "eve/tools";
-
-export default disableTool();
diff --git a/apps/agent/agent/subagents/agent_runner/tools/grep.ts b/apps/agent/agent/subagents/agent_runner/tools/grep.ts
deleted file mode 100644
index 04bd05447..000000000
--- a/apps/agent/agent/subagents/agent_runner/tools/grep.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import { disableTool } from "eve/tools";
-
-export default disableTool();
diff --git a/apps/agent/agent/tools/archive_field.ts b/apps/agent/agent/tools/archive_field.ts
index a43265272..a60cbe739 100644
--- a/apps/agent/agent/tools/archive_field.ts
+++ b/apps/agent/agent/tools/archive_field.ts
@@ -2,6 +2,7 @@ import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { sensitiveWrite } from "../lib/approval";
 import { archiveField } from "../lib/fields";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -13,7 +14,7 @@ export default defineTool({
 	approval: sensitiveWrite(
 		"Say which field you would archive and let a rep do it from the Fields sheet.",
 	),
-	async execute(input) {
-		return archiveField(input);
+	async execute(input, ctx) {
+		return runInSessionTenant(ctx, () => archiveField(input));
 	},
 });
diff --git a/apps/agent/agent/tools/enrich_company.ts b/apps/agent/agent/tools/enrich_company.ts
index 02502f5d0..4a3f11d6b 100644
--- a/apps/agent/agent/tools/enrich_company.ts
+++ b/apps/agent/agent/tools/enrich_company.ts
@@ -2,7 +2,10 @@ import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { runBrand } from "../lib/brand";
 import { spend } from "../lib/focus";
-import { assertResearchPurpose } from "../lib/session-purpose";
+import {
+	assertResearchPurpose,
+	runInSessionTenant,
+} from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -18,26 +21,28 @@ export default defineTool({
 	}),
 	async execute({ companyId, fresh }, ctx) {
 		assertResearchPurpose(ctx);
-		const result = await runBrand({ companyId, fresh, spend });
+		return runInSessionTenant(ctx, async () => {
+			const result = await runBrand({ companyId, fresh, spend });
 
-		if (!result.enriched) {
-			return {
-				enriched: false as const,
-				reason: result.reason,
-				retryable: result.retryable,
-			};
-		}
+			if (!result.enriched) {
+				return {
+					enriched: false as const,
+					reason: result.reason,
+					retryable: result.retryable,
+				};
+			}
 
-		const filled = result.filled ?? [];
+			const filled = result.filled ?? [];
 
-		return {
-			enriched: true as const,
-			filled,
-			mirrored: result.mirrored ?? [],
-			note:
-				filled.length === 0
-					? "Everything it returned was already on the record."
-					: undefined,
-		};
+			return {
+				enriched: true as const,
+				filled,
+				mirrored: result.mirrored ?? [],
+				note:
+					filled.length === 0
+						? "Everything it returned was already on the record."
+						: undefined,
+			};
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/fetch_contact_photo.ts b/apps/agent/agent/tools/fetch_contact_photo.ts
index 46999e86d..eed2ea71c 100644
--- a/apps/agent/agent/tools/fetch_contact_photo.ts
+++ b/apps/agent/agent/tools/fetch_contact_photo.ts
@@ -3,7 +3,10 @@ import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { spend } from "../lib/focus";
 import { runPortrait } from "../lib/portrait";
-import { assertResearchPurpose } from "../lib/session-purpose";
+import {
+	assertResearchPurpose,
+	runInSessionTenant,
+} from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -17,16 +20,18 @@ export default defineTool({
 	}),
 	async execute({ contactId, force }, ctx) {
 		assertResearchPurpose(ctx);
-		if (!blobEnabled()) {
-			return {
-				stored: false as const,
-				configured: false as const,
-				reason:
-					"This install has no BLOB_READ_WRITE_TOKEN, so there is nowhere to keep a copy, and " +
-					"the source URLs expire. Retrying will not help.",
-			};
-		}
+		return runInSessionTenant(ctx, async () => {
+			if (!blobEnabled()) {
+				return {
+					stored: false as const,
+					configured: false as const,
+					reason:
+						"This install has no BLOB_READ_WRITE_TOKEN, so there is nowhere to keep a copy, and " +
+						"the source URLs expire. Retrying will not help.",
+				};
+			}
 
-		return runPortrait({ contactId, spend, force });
+			return runPortrait({ contactId, spend, force });
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/find_contact_socials.ts b/apps/agent/agent/tools/find_contact_socials.ts
index 307aa91e2..16cfc98e4 100644
--- a/apps/agent/agent/tools/find_contact_socials.ts
+++ b/apps/agent/agent/tools/find_contact_socials.ts
@@ -2,6 +2,7 @@ import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { personForVerification, stampSocialsChecked } from "../lib/crm";
 import { focusOn, spend } from "../lib/focus";
+import { runInSessionTenant } from "../lib/session-purpose";
 import { findSocialCandidates } from "../lib/socials";
 
 export default defineTool({
@@ -10,33 +11,36 @@ export default defineTool({
 	inputSchema: z.object({
 		contactId: z.string(),
 	}),
-	async execute({ contactId }) {
-		focusOn({ contactId });
+	async execute({ contactId }, ctx) {
+		return runInSessionTenant(ctx, async () => {
+			focusOn({ contactId });
 
-		const person = await personForVerification(contactId);
-		if (!person) {
-			return { searched: false as const, reason: "No such contact." };
-		}
+			const person = await personForVerification(contactId);
+			if (!person) {
+				return { searched: false as const, reason: "No such contact." };
+			}
 
-		const charge = spend(2);
-		if (!charge.ok) return { searched: false as const, reason: charge.reason };
+			const charge = spend(2);
+			if (!charge.ok)
+				return { searched: false as const, reason: charge.reason };
 
-		const [x, github] = await Promise.all([
-			findSocialCandidates(person, "x"),
-			findSocialCandidates(person, "github"),
-		]);
+			const [x, github] = await Promise.all([
+				findSocialCandidates(person, "x"),
+				findSocialCandidates(person, "github"),
+			]);
 
-		await stampSocialsChecked(contactId);
+			await stampSocialsChecked(contactId);
 
-		return {
-			searched: true as const,
-			searchedFor: person.fullName,
-			candidates: {
-				x: x.candidates.map((c) => c.url),
-				github: github.candidates.map((c) => c.url),
-			},
-			citations: [...x.citations, ...github.citations],
-			note: "Unverified. set_contact_socials will reject any of these it cannot corroborate, and that is a normal outcome.",
-		};
+			return {
+				searched: true as const,
+				searchedFor: person.fullName,
+				candidates: {
+					x: x.candidates.map((c) => c.url),
+					github: github.candidates.map((c) => c.url),
+				},
+				citations: [...x.citations, ...github.citations],
+				note: "Unverified. set_contact_socials will reject any of these it cannot corroborate, and that is a normal outcome.",
+			};
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/get_contact_work_history.ts b/apps/agent/agent/tools/get_contact_work_history.ts
index 937990218..c32a122f7 100644
--- a/apps/agent/agent/tools/get_contact_work_history.ts
+++ b/apps/agent/agent/tools/get_contact_work_history.ts
@@ -9,6 +9,7 @@ import {
 import { contactProfileSlug } from "../lib/crm";
 import { spend } from "../lib/focus";
 import { personByProfileUrl } from "../lib/people";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -16,32 +17,34 @@ export default defineTool({
 	inputSchema: z.object({
 		contactId: z.string(),
 	}),
-	async execute({ contactId }) {
-		if (!(await enabled(CONTEXT_DEV_PEOPLE))) {
-			return { found: false as const, ...unavailable(CONTEXT_DEV_SOURCE) };
-		}
+	async execute({ contactId }, ctx) {
+		return runInSessionTenant(ctx, async () => {
+			if (!(await enabled(CONTEXT_DEV_PEOPLE))) {
+				return { found: false as const, ...unavailable(CONTEXT_DEV_SOURCE) };
+			}
 
-		const profileRef = await contactProfileSlug(contactId);
-		if (!profileRef) {
-			return {
-				found: false as const,
-				reason: "This contact has no LinkedIn URL on file.",
-			};
-		}
+			const profileRef = await contactProfileSlug(contactId);
+			if (!profileRef) {
+				return {
+					found: false as const,
+					reason: "This contact has no LinkedIn URL on file.",
+				};
+			}
 
-		const charge = spend(2);
-		if (!charge.ok) return { found: false as const, reason: charge.reason };
+			const charge = spend(2);
+			if (!charge.ok) return { found: false as const, reason: charge.reason };
 
-		const result = await personByProfileUrl(profileRef.profileUrl);
-		if (result.outcome !== "found") {
-			return { found: false as const, reason: result.reason };
-		}
+			const result = await personByProfileUrl(profileRef.profileUrl);
+			if (result.outcome !== "found") {
+				return { found: false as const, reason: result.reason };
+			}
 
-		return {
-			found: true as const,
-			profile: result.person,
-			sourceUrl: profileRef.profileUrl,
-			note: "Everything here is self-reported by the person. Write only what it says.",
-		};
+			return {
+				found: true as const,
+				profile: result.person,
+				sourceUrl: profileRef.profileUrl,
+				note: "Everything here is self-reported by the person. Write only what it says.",
+			};
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/get_linkedin_profile.ts b/apps/agent/agent/tools/get_linkedin_profile.ts
index 92ebd7cc1..062844f24 100644
--- a/apps/agent/agent/tools/get_linkedin_profile.ts
+++ b/apps/agent/agent/tools/get_linkedin_profile.ts
@@ -10,6 +10,7 @@ import { spend } from "../lib/focus";
 import { verdictFor } from "../lib/identity";
 import { personByProfileUrl } from "../lib/people";
 import { storePortrait } from "../lib/portrait";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -26,39 +27,41 @@ export default defineTool({
 				"The CRM contact this candidate is for. Supply it and their photo is copied automatically if — and only if — the profile turns out to be them.",
 			),
 	}),
-	async execute({ slug, email, companyName, companyDomain, contactId }) {
-		if (!(await enabled(CONTEXT_DEV_PEOPLE))) {
-			return { found: false as const, ...unavailable(CONTEXT_DEV_SOURCE) };
-		}
+	async execute({ slug, email, companyName, companyDomain, contactId }, ctx) {
+		return runInSessionTenant(ctx, async () => {
+			if (!(await enabled(CONTEXT_DEV_PEOPLE))) {
+				return { found: false as const, ...unavailable(CONTEXT_DEV_SOURCE) };
+			}
 
-		const charge = spend(2);
-		if (!charge.ok) return { found: false as const, reason: charge.reason };
+			const charge = spend(2);
+			if (!charge.ok) return { found: false as const, reason: charge.reason };
 
-		const requestedUrl = `https://www.linkedin.com/in/${slug}`;
-		const result = await personByProfileUrl(requestedUrl);
+			const requestedUrl = `https://www.linkedin.com/in/${slug}`;
+			const result = await personByProfileUrl(requestedUrl);
 
-		if (result.outcome !== "found") {
-			return { found: false as const, reason: result.reason };
-		}
+			if (result.outcome !== "found") {
+				return { found: false as const, reason: result.reason };
+			}
 
-		const person = result.person;
-		const verdict = verdictFor(person, { email, companyName, companyDomain });
+			const person = result.person;
+			const verdict = verdictFor(person, { email, companyName, companyDomain });
 
-		const portrait =
-			contactId && verdict.isSamePerson
-				? await storePortrait({
-						contactId,
-						sourceUrl: person.photoUrl,
-						verified: true,
-					})
-				: null;
+			const portrait =
+				contactId && verdict.isSamePerson
+					? await storePortrait({
+							contactId,
+							sourceUrl: person.photoUrl,
+							verified: true,
+						})
+					: null;
 
-		return {
-			found: true as const,
-			profile: person,
-			sourceUrl: person.profileUrl ?? requestedUrl,
-			photo: portrait ?? undefined,
-			verdict,
-		};
+			return {
+				found: true as const,
+				profile: person,
+				sourceUrl: person.profileUrl ?? requestedUrl,
+				photo: portrait ?? undefined,
+				verdict,
+			};
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/identify_contact.ts b/apps/agent/agent/tools/identify_contact.ts
index c6953fd92..5d9a66942 100644
--- a/apps/agent/agent/tools/identify_contact.ts
+++ b/apps/agent/agent/tools/identify_contact.ts
@@ -4,7 +4,10 @@ import type { Evidence, EvidenceKind } from "../lib/evidence";
 import { WEIGHTS } from "../lib/evidence";
 import { recordFact } from "../lib/facts";
 import { focusOn } from "../lib/focus";
-import { assertResearchPurpose } from "../lib/session-purpose";
+import {
+	assertResearchPurpose,
+	runInSessionTenant,
+} from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -27,24 +30,26 @@ export default defineTool({
 	}),
 	async execute(input, ctx) {
 		assertResearchPurpose(ctx);
-		focusOn({ contactId: input.contactId });
+		return runInSessionTenant(ctx, async () => {
+			focusOn({ contactId: input.contactId });
 
-		const result = await recordFact({
-			contactId: input.contactId,
-			field: "name",
-			value: input.fullName,
-			evidence: input.evidence as Evidence[],
-			method: "identity",
-			sourceUrl: input.sourceUrl,
-		});
+			const result = await recordFact({
+				contactId: input.contactId,
+				field: "name",
+				value: input.fullName,
+				evidence: input.evidence as Evidence[],
+				method: "identity",
+				sourceUrl: input.sourceUrl,
+			});
 
-		return {
-			applied: result.applied,
-			stored: result.stored,
-			band: result.band,
-			score: Number(result.score.toFixed(2)),
-			rationale: result.rationale,
-			reason: result.reason || undefined,
-		};
+			return {
+				applied: result.applied,
+				stored: result.stored,
+				band: result.band,
+				score: Number(result.score.toFixed(2)),
+				rationale: result.rationale,
+				reason: result.reason || undefined,
+			};
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/kaneo_task_update.ts b/apps/agent/agent/tools/kaneo_task_update.ts
new file mode 100644
index 000000000..9ace2ebfa
--- /dev/null
+++ b/apps/agent/agent/tools/kaneo_task_update.ts
@@ -0,0 +1,29 @@
+import { defineTool } from "eve/tools";
+import { z } from "zod";
+import { updateTask } from "../lib/kaneo-writes";
+
+export default defineTool({
+	description:
+		"Update a Kaneo task: its title, description, status, priority, assignee or due date. Pass only the fields that change. Free.",
+	inputSchema: z.object({
+		taskId: z.string().describe("The id of the task to update."),
+		title: z.string().min(1).max(500).optional(),
+		description: z.string().optional(),
+		status: z.string().optional(),
+		priority: z.string().optional(),
+		assigneeId: z
+			.string()
+			.nullable()
+			.optional()
+			.describe("Set to null to clear the assignee."),
+		dueDate: z
+			.string()
+			.nullable()
+			.optional()
+			.describe("An ISO date, or null to clear it."),
+	}),
+	async execute({ taskId, ...input }) {
+		const task = await updateTask(taskId, input);
+		return { task };
+	},
+});
diff --git a/apps/agent/agent/tools/list_deals.ts b/apps/agent/agent/tools/list_deals.ts
index 1c0644f04..62c395879 100644
--- a/apps/agent/agent/tools/list_deals.ts
+++ b/apps/agent/agent/tools/list_deals.ts
@@ -1,6 +1,7 @@
 import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { listDeals } from "../lib/lookup";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -21,8 +22,8 @@ export default defineTool({
 		limit: z.number().int().min(1).max(100).default(50),
 		cursor: z.string().optional(),
 	}),
-	async execute(input) {
-		return listDeals(input);
+	async execute(input, ctx) {
+		return runInSessionTenant(ctx, () => listDeals(input));
 	},
 	toModelOutput(output) {
 		return {
diff --git a/apps/agent/agent/tools/list_fields.ts b/apps/agent/agent/tools/list_fields.ts
index 669f40aee..dca45f67d 100644
--- a/apps/agent/agent/tools/list_fields.ts
+++ b/apps/agent/agent/tools/list_fields.ts
@@ -1,6 +1,7 @@
 import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { listFields } from "../lib/fields";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -10,8 +11,8 @@ export default defineTool({
 			.enum(["COMPANY", "CONTACT", "DEAL"])
 			.describe("Which record type the fields belong to."),
 	}),
-	async execute({ entity }) {
-		const fields = await listFields(entity);
+	async execute({ entity }, ctx) {
+		const fields = await runInSessionTenant(ctx, () => listFields(entity));
 
 		return {
 			fields: fields.map((field) => ({
diff --git a/apps/agent/agent/tools/list_outstanding_work.ts b/apps/agent/agent/tools/list_outstanding_work.ts
index fb6045d93..2511ffa2f 100644
--- a/apps/agent/agent/tools/list_outstanding_work.ts
+++ b/apps/agent/agent/tools/list_outstanding_work.ts
@@ -1,6 +1,7 @@
 import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { contactsNeedingWork } from "../lib/crm";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -8,8 +9,10 @@ export default defineTool({
 	inputSchema: z.object({
 		limit: z.number().int().min(1).max(25).default(10),
 	}),
-	async execute({ limit }) {
-		const contacts = await contactsNeedingWork(limit);
+	async execute({ limit }, ctx) {
+		const contacts = await runInSessionTenant(ctx, () =>
+			contactsNeedingWork(limit),
+		);
 		return { count: contacts.length, contacts };
 	},
 });
diff --git a/apps/agent/agent/tools/manage_fields.ts b/apps/agent/agent/tools/manage_fields.ts
index 0eb2d5629..de131b0da 100644
--- a/apps/agent/agent/tools/manage_fields.ts
+++ b/apps/agent/agent/tools/manage_fields.ts
@@ -1,6 +1,7 @@
 import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { createField, updateFieldBrief } from "../lib/fields";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -46,36 +47,38 @@ export default defineTool({
 			.optional()
 			.describe("False hands the field back to the rep entirely."),
 	}),
-	async execute(input) {
-		if (input.action === "create") {
-			if (!input.label || !input.type) {
+	async execute(input, ctx) {
+		return runInSessionTenant(ctx, async () => {
+			if (input.action === "create") {
+				if (!input.label || !input.type) {
+					return {
+						created: false,
+						reason: "Creating a field needs both a label and a type.",
+					};
+				}
+
+				return createField({
+					entity: input.entity,
+					label: input.label,
+					type: input.type,
+					options: input.options,
+					agentBrief: input.agentBrief,
+				});
+			}
+
+			if (!input.key) {
 				return {
-					created: false,
-					reason: "Creating a field needs both a label and a type.",
+					updated: false,
+					reason: "Changing a brief needs the field key.",
 				};
 			}
 
-			return createField({
+			return updateFieldBrief({
 				entity: input.entity,
-				label: input.label,
-				type: input.type,
-				options: input.options,
-				agentBrief: input.agentBrief,
+				key: input.key,
+				agentBrief: input.agentBrief ?? null,
+				agentFilled: input.agentFilled,
 			});
-		}
-
-		if (!input.key) {
-			return {
-				updated: false,
-				reason: "Changing a brief needs the field key.",
-			};
-		}
-
-		return updateFieldBrief({
-			entity: input.entity,
-			key: input.key,
-			agentBrief: input.agentBrief ?? null,
-			agentFilled: input.agentFilled,
 		});
 	},
 });
diff --git a/apps/agent/agent/tools/project_list.ts b/apps/agent/agent/tools/project_list.ts
new file mode 100644
index 000000000..377480504
--- /dev/null
+++ b/apps/agent/agent/tools/project_list.ts
@@ -0,0 +1,12 @@
+import { defineTool } from "eve/tools";
+import { z } from "zod";
+import { listProjects } from "../lib/kaneo";
+
+export default defineTool({
+	description:
+		"List the project-management projects, each with its task count and id. Use this before creating or finding tasks, so you never ask a rep for a project id. Free.",
+	inputSchema: z.object({}),
+	async execute() {
+		return { projects: await listProjects() };
+	},
+});
diff --git a/apps/agent/agent/tools/read_company_history.ts b/apps/agent/agent/tools/read_company_history.ts
index aeab5da12..9ec88eb8d 100644
--- a/apps/agent/agent/tools/read_company_history.ts
+++ b/apps/agent/agent/tools/read_company_history.ts
@@ -2,6 +2,7 @@ import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { readCompanyHistory } from "../lib/accounts";
 import { focusOn } from "../lib/focus";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -23,19 +24,22 @@ export default defineTool({
 			.default(25)
 			.describe("How many contacts to list."),
 	}),
-	async execute({ companyId, threads, people }) {
-		focusOn({ companyId });
+	async execute({ companyId, threads, people }, ctx) {
+		return runInSessionTenant(ctx, async () => {
+			focusOn({ companyId });
 
-		const history = await readCompanyHistory(companyId, { threads, people });
-		if (!history) return { found: false as const, reason: "No such company." };
+			const history = await readCompanyHistory(companyId, { threads, people });
+			if (!history)
+				return { found: false as const, reason: "No such company." };
 
-		return {
-			found: true as const,
-			...history,
-			note:
-				history.people.length === 0
-					? "We have no contacts on file at this company, so there is nobody here to research yet."
-					: "Every person above carries their contact id — use it directly with read_crm_history, identify_contact or record_fact. Never ask a rep for an id that is in this list.",
-		};
+			return {
+				found: true as const,
+				...history,
+				note:
+					history.people.length === 0
+						? "We have no contacts on file at this company, so there is nobody here to research yet."
+						: "Every person above carries their contact id — use it directly with read_crm_history, identify_contact or record_fact. Never ask a rep for an id that is in this list.",
+			};
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/read_crm_history.ts b/apps/agent/agent/tools/read_crm_history.ts
index a1370cbd0..4aa38edbd 100644
--- a/apps/agent/agent/tools/read_crm_history.ts
+++ b/apps/agent/agent/tools/read_crm_history.ts
@@ -2,6 +2,7 @@ import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { readCrmHistory } from "../lib/crm";
 import { focusOn } from "../lib/focus";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -16,25 +17,28 @@ export default defineTool({
 			.default(5)
 			.describe("How many recent threads to read."),
 	}),
-	async execute({ contactId, threads }) {
-		focusOn({ contactId });
+	async execute({ contactId, threads }, ctx) {
+		return runInSessionTenant(ctx, async () => {
+			focusOn({ contactId });
 
-		const history = await readCrmHistory(contactId, { threads });
-		if (!history) return { found: false as const, reason: "No such contact." };
+			const history = await readCrmHistory(contactId, { threads });
+			if (!history)
+				return { found: false as const, reason: "No such contact." };
 
-		const evidence =
-			history.stats.emails === 0 && history.stats.meetings === 0
-				? "We have never actually spoken to this person. Nothing here is evidence of anything."
-				: "A signature block or a reply from their own address is primary evidence — record it as `crm.signature-block` or `crm.thread-reply`.";
+			const evidence =
+				history.stats.emails === 0 && history.stats.meetings === 0
+					? "We have never actually spoken to this person. Nothing here is evidence of anything."
+					: "A signature block or a reply from their own address is primary evidence — record it as `crm.signature-block` or `crm.thread-reply`.";
 
-		const reach = history.contact.company
-			? ` Their company is \`${history.contact.company.id}\` — read_company_history or enrich_company take that id directly.`
-			: " They are not attached to a company; search_crm will find one by name or domain if the question needs it.";
+			const reach = history.contact.company
+				? ` Their company is \`${history.contact.company.id}\` — read_company_history or enrich_company take that id directly.`
+				: " They are not attached to a company; search_crm will find one by name or domain if the question needs it.";
 
-		return {
-			found: true as const,
-			...history,
-			note: evidence + reach,
-		};
+			return {
+				found: true as const,
+				...history,
+				note: evidence + reach,
+			};
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/read_deal_history.ts b/apps/agent/agent/tools/read_deal_history.ts
index 183c7b23d..8d08ecf19 100644
--- a/apps/agent/agent/tools/read_deal_history.ts
+++ b/apps/agent/agent/tools/read_deal_history.ts
@@ -2,6 +2,7 @@ import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { readDealHistory } from "../lib/accounts";
 import { focusOn } from "../lib/focus";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -16,12 +17,14 @@ export default defineTool({
 			.default(5)
 			.describe("How many recent threads to read."),
 	}),
-	async execute({ dealId, threads }) {
-		const history = await readDealHistory(dealId, { threads });
-		if (!history) return { found: false as const, reason: "No such deal." };
+	async execute({ dealId, threads }, ctx) {
+		return runInSessionTenant(ctx, async () => {
+			const history = await readDealHistory(dealId, { threads });
+			if (!history) return { found: false as const, reason: "No such deal." };
 
-		focusOn({ companyId: history.company.id });
+			focusOn({ companyId: history.company.id });
 
-		return { found: true as const, ...history };
+			return { found: true as const, ...history };
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/record_fact.ts b/apps/agent/agent/tools/record_fact.ts
index efe6612d7..97e22750e 100644
--- a/apps/agent/agent/tools/record_fact.ts
+++ b/apps/agent/agent/tools/record_fact.ts
@@ -4,7 +4,10 @@ import type { Evidence, EvidenceKind } from "../lib/evidence";
 import { WEIGHTS } from "../lib/evidence";
 import { FACT_FIELDS, type FactField, recordFact } from "../lib/facts";
 import { focusOn } from "../lib/focus";
-import { assertResearchPurpose } from "../lib/session-purpose";
+import {
+	assertResearchPurpose,
+	runInSessionTenant,
+} from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -47,24 +50,26 @@ export default defineTool({
 	}),
 	async execute(input, ctx) {
 		assertResearchPurpose(ctx);
-		focusOn({ contactId: input.contactId });
+		return runInSessionTenant(ctx, async () => {
+			focusOn({ contactId: input.contactId });
 
-		const result = await recordFact({
-			contactId: input.contactId,
-			field: input.field,
-			value: input.value,
-			evidence: input.evidence as Evidence[],
-			method: input.method,
-			sourceUrl: input.sourceUrl,
-		});
+			const result = await recordFact({
+				contactId: input.contactId,
+				field: input.field,
+				value: input.value,
+				evidence: input.evidence as Evidence[],
+				method: input.method,
+				sourceUrl: input.sourceUrl,
+			});
 
-		return {
-			stored: result.stored,
-			applied: result.applied,
-			band: result.band,
-			score: Number(result.score.toFixed(2)),
-			rationale: result.rationale,
-			reason: result.reason || undefined,
-		};
+			return {
+				stored: result.stored,
+				applied: result.applied,
+				band: result.band,
+				score: Number(result.score.toFixed(2)),
+				rationale: result.rationale,
+				reason: result.reason || undefined,
+			};
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/record_job_change.ts b/apps/agent/agent/tools/record_job_change.ts
index d7fdbb726..abb983dbf 100644
--- a/apps/agent/agent/tools/record_job_change.ts
+++ b/apps/agent/agent/tools/record_job_change.ts
@@ -1,11 +1,14 @@
-import { db } from "@crm/db";
+import { scopedDb as db } from "@crm/db/tenant-scope";
 import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { sensitiveWrite } from "../lib/approval";
 import { writeTimelineNote } from "../lib/crm";
 import { lastEmployerChange } from "../lib/facts";
 import { focusOn } from "../lib/focus";
-import { assertResearchPurpose } from "../lib/session-purpose";
+import {
+	assertResearchPurpose,
+	runInSessionTenant,
+} from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -24,60 +27,63 @@ export default defineTool({
 	),
 	async execute({ contactId, moveToCompanyId }, ctx) {
 		assertResearchPurpose(ctx);
-		focusOn({ contactId });
+		return runInSessionTenant(ctx, async () => {
+			focusOn({ contactId });
 
-		const change = await lastEmployerChange(contactId);
-		if (!change) {
-			return {
-				raised: false as const,
-				reason: "No employer change on the facts for this contact.",
-			};
-		}
-
-		const contact = await db.contact.findUnique({
-			where: { id: contactId },
-			select: {
-				firstName: true,
-				lastName: true,
-				ownerId: true,
-				companyId: true,
-			},
-		});
-		if (!contact) return { raised: false as const, reason: "No such contact." };
+			const change = await lastEmployerChange(contactId);
+			if (!change) {
+				return {
+					raised: false as const,
+					reason: "No employer change on the facts for this contact.",
+				};
+			}
 
-		const name = [contact.firstName, contact.lastName]
-			.filter(Boolean)
-			.join(" ");
+			const contact = await db.contact.findUnique({
+				where: { id: contactId },
+				select: {
+					firstName: true,
+					lastName: true,
+					ownerId: true,
+					companyId: true,
+				},
+			});
+			if (!contact)
+				return { raised: false as const, reason: "No such contact." };
 
-		await writeTimelineNote(
-			contactId,
-			`${name} has moved to ${change.to}`,
-			[
-				`${name} appears to have left ${change.from} for ${change.to}.`,
-				change.sourceUrl ?? "",
-				"",
-				"Worth a conversation either way: a champion in a new seat is the",
-				"warmest introduction there is, and their replacement at the old",
-				"account is a relationship nobody owns yet.",
-			]
+			const name = [contact.firstName, contact.lastName]
 				.filter(Boolean)
-				.join("\n"),
-			{ source: "job-change", from: change.from, to: change.to },
-		);
+				.join(" ");
 
-		if (moveToCompanyId) {
-			await db.contact.update({
-				where: { id: contactId },
-				data: { companyId: moveToCompanyId },
-			});
-		}
+			await writeTimelineNote(
+				contactId,
+				`${name} has moved to ${change.to}`,
+				[
+					`${name} appears to have left ${change.from} for ${change.to}.`,
+					change.sourceUrl ?? "",
+					"",
+					"Worth a conversation either way: a champion in a new seat is the",
+					"warmest introduction there is, and their replacement at the old",
+					"account is a relationship nobody owns yet.",
+				]
+					.filter(Boolean)
+					.join("\n"),
+				{ source: "job-change", from: change.from, to: change.to },
+			);
+
+			if (moveToCompanyId) {
+				await db.contact.update({
+					where: { id: contactId },
+					data: { companyId: moveToCompanyId },
+				});
+			}
 
-		return {
-			raised: true as const,
-			from: change.from,
-			to: change.to,
-			moved: Boolean(moveToCompanyId),
-			ownerNotified: contact.ownerId !== null,
-		};
+			return {
+				raised: true as const,
+				from: change.from,
+				to: change.to,
+				moved: Boolean(moveToCompanyId),
+				ownerNotified: contact.ownerId !== null,
+			};
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/research_company.ts b/apps/agent/agent/tools/research_company.ts
index fd6ea10cb..eceb6033a 100644
--- a/apps/agent/agent/tools/research_company.ts
+++ b/apps/agent/agent/tools/research_company.ts
@@ -1,8 +1,10 @@
-import { ActivityType, db } from "@crm/db";
+import { ActivityType } from "@crm/db";
+import { scopedDb as db } from "@crm/db/tenant-scope";
 import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { extract, type JsonSchema } from "../lib/context-dev";
 import { spend } from "../lib/focus";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 const RESEARCH_SCHEMA: JsonSchema = {
 	type: "object",
@@ -74,76 +76,79 @@ export default defineTool({
 	inputSchema: z.object({
 		companyId: z.string(),
 	}),
-	async execute({ companyId }) {
-		const company = await db.company.findUnique({
-			where: { id: companyId },
-			select: {
-				id: true,
-				name: true,
-				domain: true,
-				website: true,
-				ownerId: true,
-			},
-		});
-
-		if (!company)
-			return { written: false as const, reason: "No such company." };
-
-		const url =
-			company.website ?? (company.domain ? `https://${company.domain}` : null);
-
-		if (!url) {
-			return {
-				written: false as const,
-				reason: "This company has no website.",
-			};
-		}
-
-		const charge = spend(2);
-		if (!charge.ok) return { written: false as const, reason: charge.reason };
-
-		const result = await extract(url, RESEARCH_SCHEMA, RESEARCH_INSTRUCTIONS);
-
-		if (result.outcome === "failed") {
-			return { written: false as const, reason: result.reason };
-		}
-
-		const author =
-			company.ownerId ??
-			(await db.user.findFirst({ select: { id: true } }))?.id ??
-			null;
-
-		if (!author)
-			return { written: false as const, reason: "No user to attribute to." };
-
-		const scalar = briefScalar.parse(result.data);
-		const activity = await db.activity.create({
-			data: {
-				type: ActivityType.ENRICHMENT,
-				subject: `Research brief — ${company.name}`,
-				body:
-					scalar === null
-						? formatBrief(researchBrief.parse(result.data))
-						: String(scalar),
-				occurredAt: new Date(),
-				companyId: company.id,
-				createdById: author,
-				meta: {
-					source: "context.dev",
-					endpoint: "web/extract",
-					creditCost: 10,
-					agent: "people-research",
+	async execute({ companyId }, ctx) {
+		return runInSessionTenant(ctx, async () => {
+			const company = await db.company.findUnique({
+				where: { id: companyId },
+				select: {
+					id: true,
+					name: true,
+					domain: true,
+					website: true,
+					ownerId: true,
 				},
-			},
-			select: { id: true },
-		});
+			});
+
+			if (!company)
+				return { written: false as const, reason: "No such company." };
+
+			const url =
+				company.website ??
+				(company.domain ? `https://${company.domain}` : null);
+
+			if (!url) {
+				return {
+					written: false as const,
+					reason: "This company has no website.",
+				};
+			}
+
+			const charge = spend(2);
+			if (!charge.ok) return { written: false as const, reason: charge.reason };
+
+			const result = await extract(url, RESEARCH_SCHEMA, RESEARCH_INSTRUCTIONS);
+
+			if (result.outcome === "failed") {
+				return { written: false as const, reason: result.reason };
+			}
+
+			const author =
+				company.ownerId ??
+				(await db.user.findFirst({ select: { id: true } }))?.id ??
+				null;
+
+			if (!author)
+				return { written: false as const, reason: "No user to attribute to." };
+
+			const scalar = briefScalar.parse(result.data);
+			const activity = await db.activity.create({
+				data: {
+					type: ActivityType.ENRICHMENT,
+					subject: `Research brief — ${company.name}`,
+					body:
+						scalar === null
+							? formatBrief(researchBrief.parse(result.data))
+							: String(scalar),
+					occurredAt: new Date(),
+					companyId: company.id,
+					createdById: author,
+					meta: {
+						source: "context.dev",
+						endpoint: "web/extract",
+						creditCost: 10,
+						agent: "people-research",
+					},
+				},
+				select: { id: true },
+			});
 
-		await db.company.update({
-			where: { id: companyId },
-			data: { lastActivityAt: new Date() },
-		});
+			await db.company.update({
+				where: { id: companyId },
+				data: { lastActivityAt: new Date() },
+			});
 
-		return { written: true as const, activityId: activity.id };
+			return { written: true as const, activityId: activity.id };
+		});
 	},
 });
 
diff --git a/apps/agent/agent/tools/research_person.ts b/apps/agent/agent/tools/research_person.ts
index d44a43e8a..6ddf94a66 100644
--- a/apps/agent/agent/tools/research_person.ts
+++ b/apps/agent/agent/tools/research_person.ts
@@ -3,6 +3,7 @@ import { z } from "zod";
 import { enabled, unavailable } from "../lib/capabilities";
 import { spend } from "../lib/focus";
 import { ask } from "../lib/perplexity";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -18,28 +19,30 @@ export default defineTool({
 			.default(false)
 			.describe("Reason over more sources. Slower, better for prep briefs."),
 	}),
-	async execute({ question, deep }) {
-		if (!(await enabled("PERPLEXITY_API_KEY")))
-			return unavailable("PERPLEXITY_API_KEY");
+	async execute({ question, deep }, ctx) {
+		return runInSessionTenant(ctx, async () => {
+			if (!(await enabled("PERPLEXITY_API_KEY")))
+				return unavailable("PERPLEXITY_API_KEY");
 
-		const charge = spend(deep ? 2 : 1);
-		if (!charge.ok) return { ok: false as const, reason: charge.reason };
+			const charge = spend(deep ? 2 : 1);
+			if (!charge.ok) return { ok: false as const, reason: charge.reason };
 
-		const answer = await ask(question, {
-			model: deep ? "sonar-pro" : "sonar",
-			system:
-				"You are researching for a B2B sales rep. Be specific and factual. " +
-				"State only what your sources support, prefer recent information, and " +
-				"say plainly when you do not know. Never speculate about a person.",
-		});
+			const answer = await ask(question, {
+				model: deep ? "sonar-pro" : "sonar",
+				system:
+					"You are researching for a B2B sales rep. Be specific and factual. " +
+					"State only what your sources support, prefer recent information, and " +
+					"say plainly when you do not know. Never speculate about a person.",
+			});
 
-		if (!answer.ok) return { ok: false as const, reason: answer.reason };
+			if (!answer.ok) return { ok: false as const, reason: answer.reason };
 
-		return {
-			ok: true as const,
-			answer: answer.data.text,
-			citations: answer.data.citations,
-			note: "Only write claims that have a citation.",
-		};
+			return {
+				ok: true as const,
+				answer: answer.data.text,
+				citations: answer.data.citations,
+				note: "Only write claims that have a citation.",
+			};
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/resolve_linkedin_profile.ts b/apps/agent/agent/tools/resolve_linkedin_profile.ts
index b300a57fc..94faff856 100644
--- a/apps/agent/agent/tools/resolve_linkedin_profile.ts
+++ b/apps/agent/agent/tools/resolve_linkedin_profile.ts
@@ -10,6 +10,7 @@ import { CONTEXT } from "../lib/context-config";
 import { spend } from "../lib/focus";
 import { verdictFor } from "../lib/identity";
 import { personByClues } from "../lib/people";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -29,41 +30,46 @@ export default defineTool({
 			.optional()
 			.describe("The last name, if the CRM holds one."),
 	}),
-	async execute({ email, companyName, companyDomain, firstName, lastName }) {
-		if (!(await enabled(CONTEXT_DEV_PEOPLE))) {
-			return { found: false as const, ...unavailable(CONTEXT_DEV_SOURCE) };
-		}
+	async execute(
+		{ email, companyName, companyDomain, firstName, lastName },
+		ctx,
+	) {
+		return runInSessionTenant(ctx, async () => {
+			if (!(await enabled(CONTEXT_DEV_PEOPLE))) {
+				return { found: false as const, ...unavailable(CONTEXT_DEV_SOURCE) };
+			}
 
-		const charge = spend(CONTEXT.people.enrichCost);
-		if (!charge.ok) return { found: false as const, reason: charge.reason };
+			const charge = spend(CONTEXT.people.enrichCost);
+			if (!charge.ok) return { found: false as const, reason: charge.reason };
 
-		const result = await personByClues({
-			email,
-			firstName: firstName ?? null,
-			lastName: lastName ?? null,
-			companyName,
-			companyDomain,
-		});
+			const result = await personByClues({
+				email,
+				firstName: firstName ?? null,
+				lastName: lastName ?? null,
+				companyName,
+				companyDomain,
+			});
+
+			if (result.outcome !== "found") {
+				return { found: false as const, reason: result.reason };
+			}
 
-		if (result.outcome !== "found") {
-			return { found: false as const, reason: result.reason };
-		}
+			const person = result.person;
+			if (!person.profileUrl) {
+				return {
+					found: false as const,
+					reason:
+						"Somebody matched, but no LinkedIn profile came back with them. There is nothing to cite.",
+				};
+			}
 
-		const person = result.person;
-		if (!person.profileUrl) {
 			return {
-				found: false as const,
-				reason:
-					"Somebody matched, but no LinkedIn profile came back with them. There is nothing to cite.",
+				found: true as const,
+				profile: person,
+				sourceUrl: person.profileUrl,
+				verdict: verdictFor(person, { email, companyName, companyDomain }),
+				note: "One candidate, not proof. Read the verdict before you write anything.",
 			};
-		}
-
-		return {
-			found: true as const,
-			profile: person,
-			sourceUrl: person.profileUrl,
-			verdict: verdictFor(person, { email, companyName, companyDomain }),
-			note: "One candidate, not proof. Read the verdict before you write anything.",
-		};
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/schedule_recheck.ts b/apps/agent/agent/tools/schedule_recheck.ts
index fa9188913..7522c9d78 100644
--- a/apps/agent/agent/tools/schedule_recheck.ts
+++ b/apps/agent/agent/tools/schedule_recheck.ts
@@ -1,7 +1,11 @@
 import { PRIORITY } from "@crm/db/agent-tasks";
 import { defineTool } from "eve/tools";
 import { z } from "zod";
-import { assertResearchPurpose } from "../lib/session-purpose";
+import {
+	assertResearchPurpose,
+	requireOrganizationId,
+	runInSessionTenant,
+} from "../lib/session-purpose";
 import { scheduleTask } from "../lib/tasks";
 
 const MIN_DAYS = 1;
@@ -36,16 +40,20 @@ export default defineTool({
 	}),
 	async execute({ contactId, days, reason, budget }, ctx) {
 		assertResearchPurpose(ctx);
+		const organizationId = requireOrganizationId(ctx);
 		const dueAt = new Date(Date.now() + days * 24 * 60 * 60 * 1000);
 
-		await scheduleTask({
-			contactId,
-			kind: "recheck",
-			reason,
-			dueAt,
-			budget,
-			priority: PRIORITY.recheck,
-		});
+		await runInSessionTenant(ctx, () =>
+			scheduleTask({
+				organizationId,
+				contactId,
+				kind: "recheck",
+				reason,
+				dueAt,
+				budget,
+				priority: PRIORITY.recheck,
+			}),
+		);
 
 		return { scheduled: true as const, dueAt: dueAt.toISOString(), reason };
 	},
diff --git a/apps/agent/agent/tools/search_crm.ts b/apps/agent/agent/tools/search_crm.ts
index ffe1a1376..7995bc68b 100644
--- a/apps/agent/agent/tools/search_crm.ts
+++ b/apps/agent/agent/tools/search_crm.ts
@@ -1,6 +1,7 @@
 import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { searchCrm } from "../lib/lookup";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -18,8 +19,10 @@ export default defineTool({
 			.describe("Narrow the search. Defaults to all three."),
 		limit: z.number().int().min(1).max(25).default(10),
 	}),
-	async execute({ query, kinds, limit }) {
-		const result = await searchCrm(query, { kinds, limit });
+	async execute({ query, kinds, limit }, ctx) {
+		const result = await runInSessionTenant(ctx, () =>
+			searchCrm(query, { kinds, limit }),
+		);
 
 		return {
 			...result,
diff --git a/apps/agent/agent/tools/set_chat_title.ts b/apps/agent/agent/tools/set_chat_title.ts
index 9ad62cf30..94089e779 100644
--- a/apps/agent/agent/tools/set_chat_title.ts
+++ b/apps/agent/agent/tools/set_chat_title.ts
@@ -4,7 +4,11 @@ import {
 	BUILDER_CONVERSATION_TITLE_MAX_LENGTH,
 	setBuilderConversationTitle,
 } from "../lib/conversation-title";
-import { purposeOf, requireAttribute } from "../lib/session-purpose";
+import {
+	purposeOf,
+	requireAttribute,
+	runInSessionTenant,
+} from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -17,10 +21,12 @@ export default defineTool({
 			throw new Error("Chat titles can only be set in builder conversations.");
 		}
 
-		return setBuilderConversationTitle(
-			requireAttribute(ctx, "conversationId"),
-			requireAttribute(ctx, "userId"),
-			title,
+		return runInSessionTenant(ctx, () =>
+			setBuilderConversationTitle(
+				requireAttribute(ctx, "conversationId"),
+				requireAttribute(ctx, "userId"),
+				title,
+			),
 		);
 	},
 });
diff --git a/apps/agent/agent/tools/set_contact_socials.ts b/apps/agent/agent/tools/set_contact_socials.ts
index 8011c730e..b86e45a7c 100644
--- a/apps/agent/agent/tools/set_contact_socials.ts
+++ b/apps/agent/agent/tools/set_contact_socials.ts
@@ -4,7 +4,10 @@ import { personForVerification } from "../lib/crm";
 import type { Evidence } from "../lib/evidence";
 import { recordFact } from "../lib/facts";
 import { focusOn } from "../lib/focus";
-import { assertResearchPurpose } from "../lib/session-purpose";
+import {
+	assertResearchPurpose,
+	runInSessionTenant,
+} from "../lib/session-purpose";
 import { parseSocialUrl, verifyGithub, verifyX } from "../lib/socials";
 
 export default defineTool({
@@ -25,78 +28,85 @@ export default defineTool({
 	}),
 	async execute({ contactId, twitterUrl, githubUrl }, ctx) {
 		assertResearchPurpose(ctx);
-		focusOn({ contactId });
+		return runInSessionTenant(ctx, async () => {
+			focusOn({ contactId });
 
-		const person = await personForVerification(contactId);
-		if (!person) {
-			return { written: false as const, reason: "No such contact." };
-		}
+			const person = await personForVerification(contactId);
+			if (!person) {
+				return { written: false as const, reason: "No such contact." };
+			}
 
-		const rejected: string[] = [];
-		const outcomes: {
-			field: "twitterUrl" | "githubUrl";
-			url: string;
-			band: string | null;
-			applied: boolean;
-		}[] = [];
+			const rejected: string[] = [];
+			const outcomes: {
+				field: "twitterUrl" | "githubUrl";
+				url: string;
+				band: string | null;
+				applied: boolean;
+			}[] = [];
 
-		const candidates = [
-			{ field: "twitterUrl" as const, raw: twitterUrl, network: "x" as const },
-			{
-				field: "githubUrl" as const,
-				raw: githubUrl,
-				network: "github" as const,
-			},
-		];
+			const candidates = [
+				{
+					field: "twitterUrl" as const,
+					raw: twitterUrl,
+					network: "x" as const,
+				},
+				{
+					field: "githubUrl" as const,
+					raw: githubUrl,
+					network: "github" as const,
+				},
+			];
 
-		for (const candidate of candidates) {
-			if (!candidate.raw) continue;
+			for (const candidate of candidates) {
+				if (!candidate.raw) continue;
 
-			const parsed = parseSocialUrl(candidate.raw);
-			if (parsed?.network !== candidate.network) {
-				rejected.push(
-					`${candidate.raw} is not a ${candidate.network} profile URL.`,
-				);
-				continue;
-			}
+				const parsed = parseSocialUrl(candidate.raw);
+				if (parsed?.network !== candidate.network) {
+					rejected.push(
+						`${candidate.raw} is not a ${candidate.network} profile URL.`,
+					);
+					continue;
+				}
 
-			const verdict =
-				candidate.network === "x"
-					? await verifyX(parsed, person)
-					: await verifyGithub(parsed, person);
+				const verdict =
+					candidate.network === "x"
+						? await verifyX(parsed, person)
+						: await verifyGithub(parsed, person);
 
-			if (!verdict.accepted) {
-				rejected.push(verdict.reason);
-				continue;
-			}
+				if (!verdict.accepted) {
+					rejected.push(verdict.reason);
+					continue;
+				}
 
-			const result = await recordFact({
-				contactId,
-				field: candidate.field,
-				value: verdict.profile.url,
-				evidence: verdict.evidence as Evidence[],
-				method: candidate.network === "x" ? "x.handle+citation" : "github.api",
-				sourceUrl: verdict.profile.url,
-			});
+				const result = await recordFact({
+					contactId,
+					field: candidate.field,
+					value: verdict.profile.url,
+					evidence: verdict.evidence as Evidence[],
+					method:
+						candidate.network === "x" ? "x.handle+citation" : "github.api",
+					sourceUrl: verdict.profile.url,
+				});
 
-			outcomes.push({
-				field: candidate.field,
-				url: verdict.profile.url,
-				band: result.band,
-				applied: result.applied,
-			});
+				outcomes.push({
+					field: candidate.field,
+					url: verdict.profile.url,
+					band: result.band,
+					applied: result.applied,
+				});
 
-			if (!result.stored && result.reason) rejected.push(result.reason);
-		}
+				if (!result.stored && result.reason) rejected.push(result.reason);
+			}
 
-		return {
-			written: outcomes.some((outcome) => outcome.applied),
-			outcomes,
-			rejected,
-			note:
-				outcomes.length === 0 && rejected.length > 0
-					? "Nothing was written. There is no other route to this write — do not look for one."
-					: undefined,
-		};
+			return {
+				written: outcomes.some((outcome) => outcome.applied),
+				outcomes,
+				rejected,
+				note:
+					outcomes.length === 0 && rejected.length > 0
+						? "Nothing was written. There is no other route to this write — do not look for one."
+						: undefined,
+			};
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/set_field_value.ts b/apps/agent/agent/tools/set_field_value.ts
index ccccd23a0..cc0fd763b 100644
--- a/apps/agent/agent/tools/set_field_value.ts
+++ b/apps/agent/agent/tools/set_field_value.ts
@@ -2,6 +2,7 @@ import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { writeField } from "../lib/fields";
 import { focusOn } from "../lib/focus";
+import { runInSessionTenant } from "../lib/session-purpose";
 
 export default defineTool({
 	description:
@@ -18,10 +19,12 @@ export default defineTool({
 				"The value. A select takes the option's label, a date takes YYYY-MM-DD, and null clears it.",
 			),
 	}),
-	async execute({ entity, recordId, key, value }) {
-		if (entity === "COMPANY") focusOn({ companyId: recordId });
-		if (entity === "CONTACT") focusOn({ contactId: recordId });
+	async execute({ entity, recordId, key, value }, ctx) {
+		return runInSessionTenant(ctx, async () => {
+			if (entity === "COMPANY") focusOn({ companyId: recordId });
+			if (entity === "CONTACT") focusOn({ contactId: recordId });
 
-		return writeField({ entity, recordId, key, value });
+			return writeField({ entity, recordId, key, value });
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/task_comment.ts b/apps/agent/agent/tools/task_comment.ts
new file mode 100644
index 000000000..9efbf5e20
--- /dev/null
+++ b/apps/agent/agent/tools/task_comment.ts
@@ -0,0 +1,16 @@
+import { defineTool } from "eve/tools";
+import { z } from "zod";
+import { addTaskComment } from "../lib/kaneo-writes";
+
+export default defineTool({
+	description:
+		"Add a comment to a project task. A rep will see it in the task's comment thread. Free.",
+	inputSchema: z.object({
+		taskId: z.string().describe("The id of the task to comment on."),
+		content: z.string().min(1).max(4000).describe("The comment text."),
+	}),
+	async execute({ taskId, content }) {
+		const comment = await addTaskComment(taskId, content);
+		return { comment };
+	},
+});
diff --git a/apps/agent/agent/tools/task_create.ts b/apps/agent/agent/tools/task_create.ts
new file mode 100644
index 000000000..f7d73de0e
--- /dev/null
+++ b/apps/agent/agent/tools/task_create.ts
@@ -0,0 +1,33 @@
+import { defineTool } from "eve/tools";
+import { z } from "zod";
+import { createTask } from "../lib/kaneo-writes";
+
+export default defineTool({
+	description:
+		"Create a task in a project. The project id comes from project_list. Returns the new task id and number. The task starts in the 'to-do' state with kaneo's default priority unless you say otherwise. Free.",
+	inputSchema: z.object({
+		projectId: z.string().describe("The project to create the task in."),
+		title: z.string().min(1).max(500).describe("The task title."),
+		description: z
+			.string()
+			.optional()
+			.describe("A longer description of what the task is."),
+		status: z.string().optional(),
+		priority: z.string().optional(),
+		assigneeId: z
+			.string()
+			.optional()
+			.describe("The user id to assign the task to."),
+		dueDate: z
+			.string()
+			.optional()
+			.describe("An ISO date, for example 2026-09-30."),
+	}),
+	async execute(input) {
+		const task = await createTask(input);
+		return {
+			task,
+			note: "The task is created in the project. A rep will see it on the board.",
+		};
+	},
+});
diff --git a/apps/agent/agent/tools/task_list.ts b/apps/agent/agent/tools/task_list.ts
new file mode 100644
index 000000000..1ae70027b
--- /dev/null
+++ b/apps/agent/agent/tools/task_list.ts
@@ -0,0 +1,25 @@
+import { defineTool } from "eve/tools";
+import { z } from "zod";
+import { listTasks } from "../lib/kaneo";
+
+export default defineTool({
+	description:
+		"List project tasks by project, assignee or status. Returns each task with its id and number, so you never have to ask a rep for one. Free.",
+	inputSchema: z.object({
+		projectId: z.string().optional().describe("The project to list tasks for."),
+		assigneeId: z
+			.string()
+			.optional()
+			.describe("Only tasks assigned to this user id."),
+		status: z
+			.string()
+			.optional()
+			.describe(
+				"Only tasks with this status, for example 'to-do' or 'in-progress'.",
+			),
+		limit: z.number().int().min(1).max(100).default(50),
+	}),
+	async execute(input) {
+		return { tasks: await listTasks(input) };
+	},
+});
diff --git a/apps/agent/agent/tools/task_read.ts b/apps/agent/agent/tools/task_read.ts
new file mode 100644
index 000000000..8fac9c785
--- /dev/null
+++ b/apps/agent/agent/tools/task_read.ts
@@ -0,0 +1,20 @@
+import { defineTool } from "eve/tools";
+import { z } from "zod";
+import { readTask } from "../lib/kaneo";
+
+export default defineTool({
+	description:
+		"Read one project task in full: description, status, priority, due date, assignee, labels and its comments. Free.",
+	inputSchema: z.object({
+		taskId: z.string().describe("The id of the task to read."),
+	}),
+	async execute({ taskId }) {
+		const task = await readTask(taskId);
+		return task
+			? { task }
+			: {
+					task: null,
+					note: "No task with that id exists. Say so rather than guessing.",
+				};
+	},
+});
diff --git a/apps/agent/agent/tools/write_brief.ts b/apps/agent/agent/tools/write_brief.ts
index 190d1f04b..a4d81e355 100644
--- a/apps/agent/agent/tools/write_brief.ts
+++ b/apps/agent/agent/tools/write_brief.ts
@@ -4,7 +4,10 @@ import type { Evidence, EvidenceKind } from "../lib/evidence";
 import { WEIGHTS } from "../lib/evidence";
 import { writeBrief } from "../lib/facts";
 import { focusOn } from "../lib/focus";
-import { assertResearchPurpose } from "../lib/session-purpose";
+import {
+	assertResearchPurpose,
+	runInSessionTenant,
+} from "../lib/session-purpose";
 
 const MAX_NARRATIVE = 400;
 
@@ -50,28 +53,30 @@ export default defineTool({
 	}),
 	async execute(input, ctx) {
 		assertResearchPurpose(ctx);
-		focusOn({ contactId: input.contactId });
+		return runInSessionTenant(ctx, async () => {
+			focusOn({ contactId: input.contactId });
 
-		const narrative = input.narrative.trim();
+			const narrative = input.narrative.trim();
 
-		if (narrative.length < 40) {
-			return {
-				written: false as const,
-				reason:
-					"Too short to be worth a panel. Say something the record does not already show, or write nothing.",
-			};
-		}
+			if (narrative.length < 40) {
+				return {
+					written: false as const,
+					reason:
+						"Too short to be worth a panel. Say something the record does not already show, or write nothing.",
+				};
+			}
 
-		const result = await writeBrief({
-			contactId: input.contactId,
-			narrative,
-			sections: input.sections,
-			evidence: input.evidence as Evidence[],
-			sourceUrl: input.sourceUrl,
-		});
+			const result = await writeBrief({
+				contactId: input.contactId,
+				narrative,
+				sections: input.sections,
+				evidence: input.evidence as Evidence[],
+				sourceUrl: input.sourceUrl,
+			});
 
-		return result.written
-			? { written: true as const, score: Number(result.score.toFixed(2)) }
-			: { written: false as const, reason: result.reason };
+			return result.written
+				? { written: true as const, score: Number(result.score.toFixed(2)) }
+				: { written: false as const, reason: result.reason };
+		});
 	},
 });
diff --git a/apps/agent/agent/tools/write_workspace_profile.ts b/apps/agent/agent/tools/write_workspace_profile.ts
index 5618f3579..be5c4e4d1 100644
--- a/apps/agent/agent/tools/write_workspace_profile.ts
+++ b/apps/agent/agent/tools/write_workspace_profile.ts
@@ -1,4 +1,4 @@
-import { db } from "@crm/db";
+import { scopedTransaction } from "@crm/db/tenant-scope";
 import {
 	MAX_LINE,
 	MAX_NARRATIVE,
@@ -7,7 +7,10 @@ import {
 import { defineTool } from "eve/tools";
 import { z } from "zod";
 import { currentFocus } from "../lib/focus";
-import { assertResearchPurpose } from "../lib/session-purpose";
+import {
+	assertResearchPurpose,
+	runInSessionTenant,
+} from "../lib/session-purpose";
 import { identity } from "../lib/workspace";
 
 const line = (what: string) =>
@@ -38,43 +41,48 @@ export default defineTool({
 	}),
 	async execute(input, ctx) {
 		assertResearchPurpose(ctx);
-		const us = await identity();
+		return runInSessionTenant(ctx, async () => {
+			const us = await identity();
 
-		if (!us?.website) {
-			return {
-				written: false as const,
-				reason:
-					"This install has not been told its own website, so there is nothing to file a profile against.",
-			};
-		}
+			if (!us?.website) {
+				return {
+					written: false as const,
+					reason:
+						"This install has not been told its own website, so there is nothing to file a profile against.",
+				};
+			}
+			const website = us.website;
+
+			const narrative = input.narrative.trim();
 
-		const narrative = input.narrative.trim();
+			if (narrative.length < 40) {
+				return {
+					written: false as const,
+					reason:
+						"Too short to tell anybody anything. Say what we sell and to whom, or say nothing.",
+				};
+			}
+
+			const profile = await scopedTransaction((tx) =>
+				writeWorkspaceProfile(tx, {
+					website,
+					narrative,
+					sections: {
+						sells: input.sells,
+						sellsTo: input.sellsTo,
+						edge: input.edge,
+					},
+					sourceUrl: input.sourceUrl,
+					sessionId: currentFocus().sessionId,
+				}),
+			);
 
-		if (narrative.length < 40) {
 			return {
-				written: false as const,
-				reason:
-					"Too short to tell anybody anything. Say what we sell and to whom, or say nothing.",
+				written: true as const,
+				website: profile.website,
+				narrative: profile.narrative,
+				sections: profile.sections,
 			};
-		}
-
-		const profile = await writeWorkspaceProfile(db, {
-			website: us.website,
-			narrative,
-			sections: {
-				sells: input.sells,
-				sellsTo: input.sellsTo,
-				edge: input.edge,
-			},
-			sourceUrl: input.sourceUrl,
-			sessionId: currentFocus().sessionId,
 		});
-
-		return {
-			written: true as const,
-			website: profile.website,
-			narrative: profile.narrative,
-			sections: profile.sections,
-		};
 	},
 });
diff --git a/apps/agent/evals/agent-builder.eval.ts b/apps/agent/evals/agent-builder.eval.ts
index 6612ee907..7f513c7cd 100644
--- a/apps/agent/evals/agent-builder.eval.ts
+++ b/apps/agent/evals/agent-builder.eval.ts
@@ -36,10 +36,12 @@ export default defineEval({
 			});
 			const conversation = await db.agentConversation.create({
 				data: {
+					organizationId: "workspace",
 					kind: "BUILDER",
 					userId,
 					submissions: {
 						create: {
+							organizationId: "workspace",
 							submittedById: userId,
 							clientRequestId: crypto.randomUUID(),
 							commandType: "CREATE_AGENT",
diff --git a/apps/agent/package.json b/apps/agent/package.json
index 2360a75ad..8005dca33 100644
--- a/apps/agent/package.json
+++ b/apps/agent/package.json
@@ -13,25 +13,33 @@
 		"build": "eve build",
 		"start": "bun scripts/start.ts",
 		"check-types": "tsc --noEmit",
-		"test": "CRM_TELEMETRY_DISABLED=1 bun test",
+		"test": "CRM_TELEMETRY_DISABLED=1 bun test --max-concurrency=1",
 		"eval": "CRM_TELEMETRY_DISABLED=1 eve eval",
+		"e2e:xmpp": "bun test/e2e/xmpp-export.e2e.ts",
 		"lint": "biome check .",
 		"clean": "rm -rf .turbo .eve node_modules"
 	},
 	"dependencies": {
+		"@agent-xmpp/core": "workspace:*",
+		"@agent-xmpp/gateway": "workspace:*",
+		"@agent-xmpp/protocol": "workspace:*",
 		"@crm/db": "workspace:*",
 		"@crm/env": "workspace:*",
 		"@crm/telemetry": "workspace:*",
 		"@crm/validation": "workspace:*",
-		"context.dev": "2.10.0",
-		"eve": "^0.29.4",
-		"zod": "^4.4.3"
+		"context.dev": "2.14.0",
+		"eve": "^0.52.3",
+		"ai": "7.0.94",
+		"ulid": "3.0.2",
+		"zod": "^4.5.4"
 	},
 	"devDependencies": {
 		"@crm/typescript-config": "workspace:*",
-		"@types/node": "^24.0.0",
-		"just-bash": "^3.2.0",
-		"microsandbox": "^0.6.8",
-		"typescript": "^5.9.2"
+		"@types/bun": "^1.4.2",
+		"@types/node": "^26.5.0",
+		"@xmpp/client": "0.14.0",
+		"just-bash": "^3.4.2",
+		"microsandbox": "^0.6.17",
+		"typescript": "^7.0.2"
 	}
 }
diff --git a/apps/agent/scripts/start.ts b/apps/agent/scripts/start.ts
index af93f7e5c..016e4a20d 100644
--- a/apps/agent/scripts/start.ts
+++ b/apps/agent/scripts/start.ts
@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import { constants } from "node:os";
+import { startXmppGatewayHost } from "../src/xmpp/gateway-host";
 
 const rawPort = process.env.AGENT_PORT ?? process.env.PORT ?? "2000";
 const port = Number(rawPort);
@@ -10,6 +11,10 @@ if (!Number.isInteger(port) || port < 1 || port > 65_535) {
 	);
 }
 
+const gateway =
+	process.env.XMPP_COMPONENT_ENABLED === "1"
+		? await startXmppGatewayHost()
+		: null;
 const cli = process.platform === "win32" ? "eve.cmd" : "eve";
 const child = spawn(cli, ["start", "--port", String(port)], {
 	stdio: "inherit",
@@ -18,9 +23,10 @@ const child = spawn(cli, ["start", "--port", String(port)], {
 
 let settled = false;
 
-const finish = (code: number) => {
+const finish = async (code: number) => {
 	if (settled) return;
 	settled = true;
+	await gateway?.close();
 	process.exitCode = code;
 };
 
@@ -33,10 +39,10 @@ process.once("SIGTERM", forward);
 
 child.once("exit", (code, signal) => {
 	const signalNumber = signal ? constants.signals[signal] : null;
-	finish(code ?? (signalNumber ? 128 + signalNumber : 1));
+	void finish(code ?? (signalNumber ? 128 + signalNumber : 1));
 });
 
 child.once("error", (error) => {
 	console.error(`[agent] could not start eve: ${error.message}`);
-	finish(1);
+	void finish(1);
 });
diff --git a/apps/agent/src/export-tools/define-export-tool.ts b/apps/agent/src/export-tools/define-export-tool.ts
new file mode 100644
index 000000000..22c953ab3
--- /dev/null
+++ b/apps/agent/src/export-tools/define-export-tool.ts
@@ -0,0 +1,9 @@
+import type { ExportToolDefinition } from "./types";
+
+export type DefinedExportTool<I, O> = ExportToolDefinition<I, O>;
+
+export function defineExportTool<I, O>(
+	definition: ExportToolDefinition<I, O>,
+): DefinedExportTool<I, O> {
+	return Object.freeze(definition);
+}
diff --git a/apps/agent/src/export-tools/errors.ts b/apps/agent/src/export-tools/errors.ts
new file mode 100644
index 000000000..ae48f1781
--- /dev/null
+++ b/apps/agent/src/export-tools/errors.ts
@@ -0,0 +1,70 @@
+import type { StandardSchemaIssue } from "./types";
+
+export type ExportToolErrorCode =
+	| "EXPORT_TOOL_NOT_FOUND"
+	| "INVALID_ARGUMENTS"
+	| "EXECUTION_FAILED"
+	| "AGENT_RUN_FAILED"
+	| "CANCELLED"
+	| "OUTPUT_VALIDATION_FAILED";
+
+export class ExportToolError extends Error {
+	constructor(
+		message: string,
+		readonly code: ExportToolErrorCode,
+		options?: ErrorOptions,
+	) {
+		super(message, options);
+		this.name = new.target.name;
+	}
+}
+
+export class ExportToolNotFoundError extends ExportToolError {
+	constructor(readonly operation: string) {
+		super(`Export tool not found: ${operation}`, "EXPORT_TOOL_NOT_FOUND");
+	}
+}
+
+export class ExportToolValidationError extends ExportToolError {
+	constructor(
+		message: string,
+		readonly issues: readonly StandardSchemaIssue[],
+		code: Extract<
+			ExportToolErrorCode,
+			"INVALID_ARGUMENTS" | "OUTPUT_VALIDATION_FAILED"
+		>,
+	) {
+		super(message, code);
+	}
+}
+
+export class ExportToolExecutionError extends ExportToolError {
+	constructor(cause: unknown) {
+		super("Export tool execution failed", "EXECUTION_FAILED", {
+			cause,
+		});
+	}
+}
+
+export class ExportAgentRunError extends ExportToolError {
+	constructor(message: string, cause?: unknown) {
+		super(message, "AGENT_RUN_FAILED", { cause });
+	}
+}
+
+export class ExportCancelledError extends ExportToolError {
+	constructor() {
+		super("Export invocation was cancelled", "CANCELLED");
+	}
+}
+
+export function normalizeExportToolError(error: Error): ExportToolError {
+	if (error instanceof ExportToolError) return error;
+	if (
+		error instanceof DOMException &&
+		(error.name === "AbortError" || error.name === "TimeoutError")
+	) {
+		return new ExportCancelledError();
+	}
+	return new ExportToolExecutionError(error);
+}
diff --git a/apps/agent/src/export-tools/eve-adapter.ts b/apps/agent/src/export-tools/eve-adapter.ts
new file mode 100644
index 000000000..37deb4e8c
--- /dev/null
+++ b/apps/agent/src/export-tools/eve-adapter.ts
@@ -0,0 +1,97 @@
+import type { ChannelFrom, Session } from "eve/channels";
+
+import { ExportAgentRunError, ExportCancelledError } from "./errors";
+import { toJsonSchema, validateSchema } from "./schema";
+import type {
+	ExportAgentRequest,
+	ExportAgentResult,
+	StandardSchemaV1,
+} from "./types";
+import { type ExportInvocation, exportJsonValueSchema } from "./wire";
+
+type ExportSession = Pick<Session, "id" | "cancel" | "getEventStream">;
+
+export function createEveExportSend(
+	from: ChannelFrom,
+	invocation: ExportInvocation,
+	abortSignal: AbortSignal,
+): <T>(request: ExportAgentRequest<T>) => Promise<ExportAgentResult<T>> {
+	return async <T>(request: ExportAgentRequest<T>) => {
+		if (abortSignal.aborted) throw new ExportCancelledError();
+		const session = await from(invocation.requestId).send(request.message, {
+			auth: {
+				authenticator: "xmpp-agent-gateway",
+				principalType: "agent",
+				principalId: invocation.caller ?? "xmpp-agent-gateway",
+				attributes: {
+					requestId: invocation.requestId,
+					operation: invocation.operation,
+				},
+			},
+			context:
+				request.clientContext === undefined
+					? undefined
+					: [JSON.stringify(request.clientContext)],
+			outputSchema: request.outputSchema
+				? toJsonSchema(request.outputSchema)
+				: undefined,
+			mode: request.taskMode === false ? "conversation" : "task",
+			title: request.title,
+		});
+		let cancellation: ReturnType<ExportSession["cancel"]> | undefined;
+		const cancel = () =>
+			(cancellation ??= session.cancel().catch(() => ({
+				status: "no_active_turn" as const,
+			})));
+		abortSignal.addEventListener("abort", cancel, { once: true });
+		try {
+			if (abortSignal.aborted) {
+				await cancel();
+				throw new ExportCancelledError();
+			}
+			return await collectAgentResult(session, request.outputSchema);
+		} finally {
+			abortSignal.removeEventListener("abort", cancel);
+		}
+	};
+}
+
+export async function collectAgentResult<T>(
+	session: ExportSession,
+	schema?: StandardSchemaV1<unknown, T>,
+): Promise<ExportAgentResult<T>> {
+	const stream = await session.getEventStream();
+	const reader = stream.getReader();
+	try {
+		for (;;) {
+			const item = await reader.read();
+			if (item.done) break;
+			const event = item.value;
+			if (event.type === "result.completed") {
+				const raw = exportJsonValueSchema.parse(event.data?.result);
+				const value = schema
+					? await validateSchema(
+							schema,
+							raw,
+							"Invalid agent result",
+							"OUTPUT_VALIDATION_FAILED",
+						)
+					: (raw as T);
+				return { sessionId: session.id, value };
+			}
+			if (event.type === "turn.cancelled") {
+				throw new ExportCancelledError();
+			}
+			if (event.type === "turn.failed" || event.type === "session.failed") {
+				throw new ExportAgentRunError(
+					String(event.data?.message ?? "Eve agent run failed"),
+					event.data,
+				);
+			}
+		}
+	} finally {
+		await reader.cancel().catch(() => undefined);
+		reader.releaseLock();
+	}
+	throw new ExportAgentRunError("Eve session ended without a result");
+}
diff --git a/apps/agent/src/export-tools/executor.ts b/apps/agent/src/export-tools/executor.ts
new file mode 100644
index 000000000..67617247a
--- /dev/null
+++ b/apps/agent/src/export-tools/executor.ts
@@ -0,0 +1,38 @@
+import { ExportCancelledError, normalizeExportToolError } from "./errors";
+import { exportTool } from "./registry";
+import { validateSchema } from "./schema";
+import type { ExportToolContext } from "./types";
+import { type ExportJsonValue, exportJsonValueSchema } from "./wire";
+
+export async function executeExportTool(
+	name: string,
+	rawInput: ExportJsonValue,
+	ctx: ExportToolContext,
+): Promise<ExportJsonValue> {
+	const definition = exportTool(name);
+	if (ctx.abortSignal.aborted) throw new ExportCancelledError();
+	const input = await validateSchema(
+		definition.inputSchema,
+		rawInput,
+		"Invalid export tool input",
+		"INVALID_ARGUMENTS",
+	);
+	try {
+		const output = await definition.execute(input, ctx);
+		const jsonOutput = exportJsonValueSchema.parse(output);
+		if (!definition.outputSchema) return jsonOutput;
+		const validated = await validateSchema(
+			definition.outputSchema,
+			jsonOutput,
+			"Invalid export tool output",
+			"OUTPUT_VALIDATION_FAILED",
+		);
+		return exportJsonValueSchema.parse(validated);
+	} catch (error) {
+		throw normalizeExportToolError(
+			error instanceof Error
+				? error
+				: new Error("Export tool threw a non-error value", { cause: error }),
+		);
+	}
+}
diff --git a/apps/agent/src/export-tools/export-tools.test.ts b/apps/agent/src/export-tools/export-tools.test.ts
new file mode 100644
index 000000000..59b7af851
--- /dev/null
+++ b/apps/agent/src/export-tools/export-tools.test.ts
@@ -0,0 +1,179 @@
+import { describe, expect, it } from "bun:test";
+import type { ChannelFrom, Session } from "eve/channels";
+
+import handleCrmRequest from "../exports/handle_crm_request";
+import { ExportCancelledError, ExportToolValidationError } from "./errors";
+import { collectAgentResult, createEveExportSend } from "./eve-adapter";
+import { executeExportTool } from "./executor";
+import { exportToolManifest } from "./manifest";
+import type { ExportToolContext } from "./types";
+import { exportInvocationRequestSchema, exportStreamEventSchema } from "./wire";
+
+function context(
+	overrides: Partial<ExportToolContext> = {},
+): ExportToolContext {
+	return {
+		abortSignal: new AbortController().signal,
+		invocation: { requestId: "req_1", operation: "ping" },
+		progress: async () => {},
+		send: async () => {
+			throw new Error("Unexpected agent call");
+		},
+		...overrides,
+	};
+}
+
+describe("export tools", () => {
+	it("runs a deterministic export without an agent call", async () => {
+		await expect(executeExportTool("ping", {}, context())).resolves.toEqual({
+			status: "ok",
+			requestId: "req_1",
+		});
+	});
+
+	it("rejects invalid input before progress or agent work", async () => {
+		const calls: string[] = [];
+		const run = executeExportTool(
+			"handle_crm_request",
+			{ request: "" },
+			context({
+				progress: async () => {
+					calls.push("progress");
+				},
+				send: async <T>() => {
+					calls.push("send");
+					return { sessionId: "ses_1", value: {} as T };
+				},
+			}),
+		);
+		await expect(run).rejects.toBeInstanceOf(ExportToolValidationError);
+		expect(calls).toEqual([]);
+	});
+
+	it("runs agent work between progress events", async () => {
+		const calls: string[] = [];
+		const result = await handleCrmRequest.execute(
+			{ request: "Review the current relationship" },
+			context({
+				progress: async (update) => {
+					calls.push(update.stage ?? "");
+				},
+				send: async <T>() => {
+					calls.push("send");
+					return {
+						sessionId: "ses_1",
+						value: { summary: "Reviewed", actionsTaken: [] } as T,
+					};
+				},
+			}),
+		);
+		expect(calls).toEqual(["reasoning", "send", "complete"]);
+		expect(result).toEqual({ summary: "Reviewed", actionsTaken: [] });
+	});
+
+	it("publishes only the explicit export registry", () => {
+		expect(exportToolManifest().map((tool) => tool.name)).toEqual([
+			"handle_crm_request",
+			"ping",
+		]);
+	});
+
+	it("uses one strict wire contract for invocation and stream events", () => {
+		expect(
+			exportInvocationRequestSchema.safeParse({
+				requestId: "req_1",
+				operation: "ping",
+				arguments: {},
+				metadata: {},
+			}).success,
+		).toBe(false);
+		expect(
+			exportStreamEventSchema.safeParse({
+				type: "result",
+				value: {},
+				metadata: {},
+			}).success,
+		).toBe(false);
+	});
+
+	it("collects a native structured Eve result", async () => {
+		let streamCancelled = false;
+		const stream = new ReadableStream({
+			start(controller) {
+				controller.enqueue({
+					type: "result.completed",
+					data: { result: { summary: "Done", actionsTaken: [] } },
+				});
+			},
+			cancel() {
+				streamCancelled = true;
+			},
+		});
+		await expect(
+			collectAgentResult(
+				{
+					id: "ses_1",
+					cancel: async () => ({ sessionId: "ses_1", status: "accepted" }),
+					getEventStream: async () => stream,
+				},
+				handleCrmRequest.outputSchema,
+			),
+		).resolves.toEqual({
+			sessionId: "ses_1",
+			value: { summary: "Done", actionsTaken: [] },
+		});
+		expect(streamCancelled).toBe(true);
+	});
+
+	it("cancels when the request aborts while Eve accepts the send", async () => {
+		const controller = new AbortController();
+		let cancellations = 0;
+		const session = {
+			id: "ses_1",
+			cancel: async () => {
+				cancellations++;
+				return { sessionId: "ses_1", status: "accepted" };
+			},
+			getEventStream: async () => new ReadableStream(),
+			getStreamTailIndex: async () => -1,
+		} as Session;
+
+		const from: ChannelFrom = () => ({
+			send: async () => {
+				controller.abort();
+				return session;
+			},
+			respond: async () => session,
+			cancel: async () => ({ sessionId: "ses_1", status: "accepted" }),
+			compact: async () => ({ sessionId: "ses_1", status: "accepted" }),
+			clear: async () => ({ sessionId: "ses_1", status: "accepted" }),
+			reset: async () => ({ status: "no_active_session" }),
+		});
+		const run = createEveExportSend(
+			from,
+			{ requestId: "req_1", operation: "ping" },
+			controller.signal,
+		);
+
+		await expect(run({ message: "Run" })).rejects.toBeInstanceOf(
+			ExportCancelledError,
+		);
+		expect(cancellations).toBe(1);
+	});
+
+	it("maps Eve cancellation to the export cancellation error", async () => {
+		const stream = new ReadableStream({
+			start(controller) {
+				controller.enqueue({ type: "turn.cancelled" });
+				controller.close();
+			},
+		});
+		await expect(
+			collectAgentResult({
+				id: "ses_1",
+				cancel: async () => ({ sessionId: "ses_1", status: "accepted" }),
+				getEventStream: async () => stream,
+			}),
+		).rejects.toBeInstanceOf(ExportCancelledError);
+	});
+});
diff --git a/apps/agent/src/export-tools/manifest.ts b/apps/agent/src/export-tools/manifest.ts
new file mode 100644
index 000000000..b98d9945c
--- /dev/null
+++ b/apps/agent/src/export-tools/manifest.ts
@@ -0,0 +1,18 @@
+import { exportTools } from "./registry";
+import { toJsonSchema } from "./schema";
+import type { ExportToolManifestEntry } from "./types";
+
+export function exportToolManifest(): readonly ExportToolManifestEntry[] {
+	return Object.entries(exportTools).map(([name, definition]) => {
+		const entry: ExportToolManifestEntry = {
+			name,
+			description: definition.description,
+			inputSchema: toJsonSchema(definition.inputSchema),
+		};
+		if (definition.outputSchema) {
+			entry.outputSchema = toJsonSchema(definition.outputSchema);
+		}
+		if (definition.annotations) entry.annotations = definition.annotations;
+		return entry;
+	});
+}
diff --git a/apps/agent/src/export-tools/registry.ts b/apps/agent/src/export-tools/registry.ts
new file mode 100644
index 000000000..8575b6ed3
--- /dev/null
+++ b/apps/agent/src/export-tools/registry.ts
@@ -0,0 +1,20 @@
+import handleCrmRequest from "../exports/handle_crm_request";
+import ping from "../exports/ping";
+import { ExportToolNotFoundError } from "./errors";
+import type { AnyExportToolDefinition } from "./types";
+
+export const exportTools = {
+	handle_crm_request: handleCrmRequest,
+	ping,
+} as const;
+
+export function exportTool(name: string): AnyExportToolDefinition {
+	switch (name) {
+		case "handle_crm_request":
+			return handleCrmRequest as AnyExportToolDefinition;
+		case "ping":
+			return ping as AnyExportToolDefinition;
+		default:
+			throw new ExportToolNotFoundError(name);
+	}
+}
diff --git a/apps/agent/src/export-tools/schema.ts b/apps/agent/src/export-tools/schema.ts
new file mode 100644
index 000000000..1c740a9e5
--- /dev/null
+++ b/apps/agent/src/export-tools/schema.ts
@@ -0,0 +1,45 @@
+import { z } from "zod";
+
+import { ExportToolValidationError } from "./errors";
+import type {
+	JsonSchema,
+	StandardSchemaIssue,
+	StandardSchemaV1,
+} from "./types";
+import type { ExportJsonValue } from "./wire";
+
+export async function validateSchema<T>(
+	schema: StandardSchemaV1<unknown, T>,
+	value: ExportJsonValue,
+	message: string,
+	code: "INVALID_ARGUMENTS" | "OUTPUT_VALIDATION_FAILED",
+): Promise<T> {
+	const result = await schema["~standard"].validate(value);
+	if (result.issues) {
+		throw new ExportToolValidationError(message, result.issues, code);
+	}
+	return result.value;
+}
+
+export function schemaIssues(
+	issues: readonly StandardSchemaIssue[],
+): ReadonlyArray<{ path: string; message: string }> {
+	return issues.map((issue) => ({
+		path:
+			issue.path
+				?.map((part) => String(part instanceof Object ? part.key : part))
+				.join(".") ?? "",
+		message: issue.message,
+	}));
+}
+
+export function toJsonSchema(
+	schema: StandardSchemaV1<unknown, unknown>,
+): JsonSchema {
+	if (schema instanceof z.ZodType) {
+		return z.toJSONSchema(schema, { target: "draft-2020-12" }) as JsonSchema;
+	}
+	throw new TypeError(
+		`JSON Schema export is unavailable for ${schema["~standard"].vendor}`,
+	);
+}
diff --git a/apps/agent/src/export-tools/types.ts b/apps/agent/src/export-tools/types.ts
new file mode 100644
index 000000000..29309a195
--- /dev/null
+++ b/apps/agent/src/export-tools/types.ts
@@ -0,0 +1,77 @@
+import type { UserContent } from "ai";
+import type { ChannelSendOptions } from "eve/channels";
+
+import type {
+	ExportInvocation,
+	ExportJsonObject,
+	ExportProgress,
+} from "./wire";
+
+export interface StandardSchemaV1<Input = unknown, Output = Input> {
+	readonly "~standard": {
+		readonly version: 1;
+		readonly vendor: string;
+		validate(
+			value: Input,
+		): StandardSchemaResult<Output> | Promise<StandardSchemaResult<Output>>;
+	};
+}
+
+export type StandardSchemaResult<T> =
+	| { readonly value: T; readonly issues?: undefined }
+	| { readonly issues: readonly StandardSchemaIssue[] };
+
+export interface StandardSchemaIssue {
+	readonly message: string;
+	readonly path?: ReadonlyArray<PropertyKey | { readonly key: PropertyKey }>;
+}
+
+export interface ExportToolAnnotations {
+	readonly title?: string;
+	readonly idempotent?: boolean;
+	readonly readOnly?: boolean;
+	readonly destructive?: boolean;
+	readonly longRunning?: boolean;
+}
+
+export interface ExportAgentRequest<T> {
+	readonly message: string | UserContent;
+	readonly outputSchema?: StandardSchemaV1<unknown, T>;
+	readonly title?: string;
+	readonly taskMode?: boolean;
+	readonly clientContext?: ExportJsonObject;
+}
+
+export interface ExportAgentResult<T> {
+	readonly sessionId: string;
+	readonly value: T;
+}
+
+export interface ExportToolContext {
+	readonly abortSignal: AbortSignal;
+	readonly invocation: ExportInvocation;
+	progress(update: ExportProgress): Promise<void>;
+	send<T = unknown>(
+		request: ExportAgentRequest<T>,
+	): Promise<ExportAgentResult<T>>;
+}
+
+export interface ExportToolDefinition<I, O> {
+	readonly description: string;
+	readonly inputSchema: StandardSchemaV1<unknown, I>;
+	readonly outputSchema?: StandardSchemaV1<unknown, O>;
+	readonly annotations?: ExportToolAnnotations;
+	execute(input: I, ctx: ExportToolContext): Promise<O> | O;
+}
+
+export type AnyExportToolDefinition = ExportToolDefinition<unknown, unknown>;
+
+export type JsonSchema = NonNullable<ChannelSendOptions["outputSchema"]>;
+
+export interface ExportToolManifestEntry {
+	readonly name: string;
+	readonly description: string;
+	readonly inputSchema: JsonSchema;
+	outputSchema?: JsonSchema;
+	annotations?: ExportToolAnnotations;
+}
diff --git a/apps/agent/src/export-tools/wire.ts b/apps/agent/src/export-tools/wire.ts
new file mode 100644
index 000000000..87aea9262
--- /dev/null
+++ b/apps/agent/src/export-tools/wire.ts
@@ -0,0 +1,62 @@
+import { z } from "zod";
+
+export const jsonObjectSchema = z.record(z.string(), z.json());
+export const exportJsonValueSchema = z.json();
+
+export const exportInvocationSchema = z
+	.object({
+		requestId: z.string().trim().min(1).max(160),
+		operation: z.string().trim().min(1).max(128),
+		caller: z.string().trim().min(1).max(3071).optional(),
+	})
+	.strict();
+
+export const exportInvocationRequestSchema = exportInvocationSchema.extend({
+	arguments: exportJsonValueSchema,
+});
+
+export const exportProgressSchema = z
+	.object({
+		stage: z.string().optional(),
+		percent: z.number().optional(),
+		message: z.string().optional(),
+	})
+	.strict();
+
+const exportIssueSchema = z
+	.object({
+		path: z.string(),
+		message: z.string(),
+	})
+	.strict();
+
+export const exportStreamEventSchema = z.discriminatedUnion("type", [
+	z
+		.object({ type: z.literal("progress"), update: exportProgressSchema })
+		.strict(),
+	z
+		.object({
+			type: z.literal("result"),
+			value: exportJsonValueSchema,
+			sessionId: z.string().optional(),
+		})
+		.strict(),
+	z
+		.object({
+			type: z.literal("error"),
+			error: z
+				.object({
+					code: z.string(),
+					message: z.string(),
+					issues: z.array(exportIssueSchema).optional(),
+				})
+				.strict(),
+		})
+		.strict(),
+]);
+
+export type ExportInvocation = z.infer<typeof exportInvocationSchema>;
+export type ExportProgress = z.infer<typeof exportProgressSchema>;
+export type ExportStreamEvent = z.infer<typeof exportStreamEventSchema>;
+export type ExportJsonObject = z.infer<typeof jsonObjectSchema>;
+export type ExportJsonValue = z.infer<typeof exportJsonValueSchema>;
diff --git a/apps/agent/src/exports/handle_crm_request.ts b/apps/agent/src/exports/handle_crm_request.ts
new file mode 100644
index 000000000..c065a9316
--- /dev/null
+++ b/apps/agent/src/exports/handle_crm_request.ts
@@ -0,0 +1,68 @@
+import { z } from "zod";
+
+import { defineExportTool } from "../export-tools/define-export-tool";
+
+const resultSchema = z.object({
+	summary: z.string().min(1),
+	actionsTaken: z.array(
+		z.object({
+			type: z.string().min(1),
+			description: z.string().min(1),
+		}),
+	),
+});
+
+export default defineExportTool({
+	description:
+		"Process a bounded CRM request with the agent's normal evidence and action tools.",
+	inputSchema: z.object({
+		request: z.string().trim().min(1).max(2_000),
+		record: z
+			.object({
+				type: z.enum(["contact", "company", "deal"]),
+				id: z.string().trim().min(1).max(120),
+			})
+			.optional(),
+	}),
+	outputSchema: resultSchema,
+	annotations: {
+		title: "Handle CRM request",
+		idempotent: false,
+		readOnly: false,
+		destructive: true,
+		longRunning: true,
+	},
+	async execute(input, ctx) {
+		await ctx.progress({
+			stage: "reasoning",
+			percent: 10,
+			message: "Processing CRM request",
+		});
+		const target = input.record
+			? `${input.record.type} ${input.record.id}`
+			: "the relevant CRM records";
+		const result = await ctx.send({
+			taskMode: true,
+			title: "Remote CRM request",
+			message: [
+				`Process this external request about ${target}.`,
+				input.request,
+				"Use normal CRM evidence rules and available tools.",
+				"Report only actions that completed successfully.",
+				"Return a concise summary and the actions taken.",
+			].join("\n\n"),
+			outputSchema: resultSchema,
+			clientContext: {
+				requestId: ctx.invocation.requestId,
+				caller: ctx.invocation.caller ?? null,
+				operation: ctx.invocation.operation,
+			},
+		});
+		await ctx.progress({
+			stage: "complete",
+			percent: 100,
+			message: "CRM request complete",
+		});
+		return result.value;
+	},
+});
diff --git a/apps/agent/src/exports/ping.ts b/apps/agent/src/exports/ping.ts
new file mode 100644
index 000000000..3f1549d40
--- /dev/null
+++ b/apps/agent/src/exports/ping.ts
@@ -0,0 +1,22 @@
+import { z } from "zod";
+
+import { defineExportTool } from "../export-tools/define-export-tool";
+
+export default defineExportTool({
+	description: "Confirm that the CRM agent export endpoint is available.",
+	inputSchema: z.object({}),
+	outputSchema: z.object({
+		status: z.literal("ok"),
+		requestId: z.string(),
+	}),
+	annotations: {
+		title: "Ping CRM agent",
+		idempotent: true,
+		readOnly: true,
+		destructive: false,
+		longRunning: false,
+	},
+	execute(_input, ctx) {
+		return { status: "ok" as const, requestId: ctx.invocation.requestId };
+	},
+});
diff --git a/apps/agent/src/xmpp/config.ts b/apps/agent/src/xmpp/config.ts
new file mode 100644
index 000000000..4d268fc8a
--- /dev/null
+++ b/apps/agent/src/xmpp/config.ts
@@ -0,0 +1,61 @@
+import {
+	type GatewayConfig,
+	loadConfig as loadGatewayConfig,
+} from "@agent-xmpp/gateway";
+
+const SECOND_MS = 1_000;
+const MINUTE_MS = 60 * SECOND_MS;
+const HOUR_MS = 60 * MINUTE_MS;
+
+export const XMPP_EXPORT = {
+	task: {
+		leaseMs: 30 * SECOND_MS,
+		retentionMs: 24 * HOUR_MS,
+	},
+	gateway: {
+		sweepMs: 5 * SECOND_MS,
+	},
+} as const;
+
+export interface XmppHostConfig {
+	readonly gateway: GatewayConfig;
+	readonly organizationId: string;
+	readonly bridgeSecret: string;
+	readonly agentUrl: string;
+	readonly agentVersion?: string;
+	readonly allowedCallerDomains: ReadonlySet<string>;
+	readonly destructiveCallers: ReadonlySet<string>;
+}
+
+export function loadXmppHostConfig(): XmppHostConfig {
+	const gateway = loadGatewayConfig();
+	return {
+		gateway,
+		organizationId: requiredEnv("XMPP_ORGANIZATION_ID"),
+		bridgeSecret: requiredEnv("AGENT_BRIDGE_SECRET"),
+		agentUrl: process.env.AGENT_URL ?? "http://127.0.0.1:2000",
+		agentVersion: process.env.XMPP_AGENT_VERSION,
+		allowedCallerDomains: commaSeparatedSet(
+			process.env.XMPP_ALLOWED_CALLER_DOMAINS ??
+				`${gateway.serverDomain},${gateway.agentDomain}`,
+		),
+		destructiveCallers: commaSeparatedSet(
+			process.env.XMPP_ALLOW_DESTRUCTIVE_CALLERS,
+		),
+	};
+}
+
+function requiredEnv(name: string): string {
+	const value = process.env[name]?.trim();
+	if (!value) throw new Error(`Missing required env: ${name}`);
+	return value;
+}
+
+function commaSeparatedSet(value: string | undefined): ReadonlySet<string> {
+	return new Set(
+		(value ?? "")
+			.split(",")
+			.map((item) => item.trim())
+			.filter(Boolean),
+	);
+}
diff --git a/apps/agent/src/xmpp/gateway-host.ts b/apps/agent/src/xmpp/gateway-host.ts
new file mode 100644
index 000000000..3695238c9
--- /dev/null
+++ b/apps/agent/src/xmpp/gateway-host.ts
@@ -0,0 +1,232 @@
+import {
+	EmbeddedXmppGateway,
+	type GatewayRuntimeMailbox,
+	type TaskWireEvent,
+} from "@agent-xmpp/gateway";
+import {
+	type AgentTaskError,
+	type AgentTaskEventType,
+	type AgentTaskRecord,
+	type McpToolResult,
+	terminalTaskStates,
+} from "@agent-xmpp/protocol";
+import { ulid } from "ulid";
+
+import {
+	type ExportJsonValue,
+	type ExportStreamEvent,
+	exportInvocationRequestSchema,
+	exportStreamEventSchema,
+	jsonObjectSchema,
+} from "../export-tools/wire";
+import { loadXmppHostConfig, XMPP_EXPORT } from "./config";
+import { createXmppIqHandler } from "./iq-handler";
+import { createXmppManifest } from "./manifest";
+import { PostgresXmppTaskStore } from "./task-store";
+
+export async function startXmppGatewayHost(): Promise<{
+	close(): Promise<void>;
+}> {
+	const config = loadXmppHostConfig();
+	const store = new PostgresXmppTaskStore(config.organizationId);
+	const agent = createXmppManifest({
+		jid: config.gateway.defaultAgentJid,
+		organizationId: config.organizationId,
+		version: config.agentVersion,
+	});
+	const controllers = new Map<string, AbortController>();
+	let gateway: EmbeddedXmppGateway;
+	const emit = async (
+		task: AgentTaskRecord,
+		type: AgentTaskEventType,
+		payload: TaskWireEvent["payload"],
+	) => {
+		await gateway.deliverTaskEvent({
+			taskId: task.taskId,
+			eventId: ulid(),
+			revision: task.revision,
+			type,
+			from: task.targetJid,
+			to: task.notificationJid || task.callerJid,
+			payload,
+		});
+	};
+	const run = async (initial: AgentTaskRecord) => {
+		const controller = new AbortController();
+		controllers.set(initial.taskId, controller);
+		let task = initial;
+		try {
+			task = await store.transition(task.taskId, task.revision, {
+				state: "RUNNING",
+			});
+			await emit(task, "status", {
+				state: "running",
+				updatedAt: task.updatedAt,
+			});
+			const response = await fetch(
+				new URL("/internal/xmpp/export-tools/invoke", config.agentUrl),
+				{
+					method: "POST",
+					headers: {
+						authorization: `Bearer ${config.bridgeSecret}`,
+						"content-type": "application/json",
+					},
+					body: JSON.stringify(
+						exportInvocationRequestSchema.parse({
+							requestId: task.taskId,
+							operation: task.tool,
+							arguments: task.arguments,
+							caller: task.callerJid,
+						}),
+					),
+					signal: controller.signal,
+				},
+			);
+			if (!response.ok || !response.body) {
+				throw new Error(`Eve export endpoint returned ${response.status}`);
+			}
+			for await (const event of readNdjson(response.body)) {
+				if (event.type === "progress") {
+					task = await store.transition(task.taskId, task.revision, {
+						progress: jsonObjectSchema.parse(event.update),
+					});
+					await emit(task, "progress", event.update);
+					continue;
+				}
+				if (event.type === "error") {
+					if (event.error.code === "CANCELLED") {
+						throw new DOMException(event.error.message, "AbortError");
+					}
+					throw new ExportEndpointError(event.error.code, event.error.message);
+				}
+				const result = mcpResult(event.value);
+				const transition = {
+					state: "COMPLETED",
+					result: jsonObjectSchema.parse(result),
+					eveSessionId: event.sessionId,
+				} as const;
+				task = await store.transition(task.taskId, task.revision, transition);
+				await emit(task, "completed", { result });
+				return;
+			}
+			throw new Error("Eve export endpoint ended without a result");
+		} catch (error) {
+			const current = await store.get(initial.taskId);
+			if (!current || terminalTaskStates.has(current.state)) return;
+			if (
+				(error instanceof DOMException && error.name === "AbortError") ||
+				current.state === "cancelling"
+			) {
+				task = await store.transition(current.taskId, current.revision, {
+					state: "CANCELLED",
+				});
+				await emit(task, "cancelled", { reason: "Task cancelled" });
+				return;
+			}
+			const failure: AgentTaskError = {
+				code:
+					error instanceof ExportEndpointError ? error.code : "gateway-error",
+				message:
+					error instanceof Error ? error.message : "Task execution failed",
+				retryable: !(error instanceof ExportEndpointError),
+			};
+			task = await store.transition(current.taskId, current.revision, {
+				state: "FAILED",
+				error: jsonObjectSchema.parse(failure),
+			});
+			await emit(task, "failed", { error: failure });
+		} finally {
+			controllers.delete(initial.taskId);
+		}
+	};
+	const iqHandler = createXmppIqHandler({
+		componentJid: config.gateway.componentJid,
+		agent,
+		store,
+		allowedCallerDomains: config.allowedCallerDomains,
+		destructiveCallers: config.destructiveCallers,
+		onAccepted: (task) => {
+			void run(task).catch((error) => {
+				console.error(`[xmpp-gateway] task ${task.taskId} failed:`, error);
+			});
+		},
+		onCancel: async (task) => {
+			controllers.get(task.taskId)?.abort();
+		},
+	});
+	const mailbox: GatewayRuntimeMailbox = {
+		async deliverInbound() {},
+		async deliverFormResponse() {},
+		async deliverTaskEvent(_event: TaskWireEvent) {},
+	};
+	gateway = new EmbeddedXmppGateway(config.gateway, mailbox, {
+		onIqGet: iqHandler,
+		resolveVirtualAgent: (jid) =>
+			jid === agent.manifest.agent.jid
+				? {
+						jid,
+						name: agent.manifest.agent.title ?? agent.manifest.agent.name,
+					}
+				: null,
+	});
+	await store.failInterrupted();
+	await gateway.start();
+	const maintain = () =>
+		Promise.all([store.renewLeases(), store.deleteExpired()]).catch((error) => {
+			console.error("[xmpp-gateway] task maintenance failed:", error);
+		});
+	const sweep = setInterval(() => void maintain(), XMPP_EXPORT.gateway.sweepMs);
+	sweep.unref?.();
+	return {
+		async close() {
+			clearInterval(sweep);
+			for (const controller of controllers.values()) controller.abort();
+			await gateway.stop();
+		},
+	};
+}
+
+async function* readNdjson(
+	stream: ReadableStream<Uint8Array>,
+): AsyncGenerator<ExportStreamEvent> {
+	const reader = stream.getReader();
+	const decoder = new TextDecoder();
+	let pending = "";
+	try {
+		for (;;) {
+			const chunk = await reader.read();
+			if (chunk.done) break;
+			pending += decoder.decode(chunk.value, { stream: true });
+			for (;;) {
+				const boundary = pending.indexOf("\n");
+				if (boundary < 0) break;
+				const line = pending.slice(0, boundary);
+				pending = pending.slice(boundary + 1);
+				if (line) yield exportStreamEventSchema.parse(JSON.parse(line));
+			}
+		}
+		pending += decoder.decode();
+		if (pending.trim()) {
+			yield exportStreamEventSchema.parse(JSON.parse(pending));
+		}
+	} finally {
+		await reader.cancel().catch(() => undefined);
+		reader.releaseLock();
+	}
+}
+
+function mcpResult(value: ExportJsonValue): McpToolResult {
+	return {
+		content: [{ type: "text", text: JSON.stringify(value) }],
+		structuredContent: jsonObjectSchema.parse(value),
+	};
+}
+
+class ExportEndpointError extends Error {
+	constructor(
+		readonly code: string,
+		message: string,
+	) {
+		super(message);
+	}
+}
diff --git a/apps/agent/src/xmpp/iq-handler.ts b/apps/agent/src/xmpp/iq-handler.ts
new file mode 100644
index 000000000..8da4d8bd6
--- /dev/null
+++ b/apps/agent/src/xmpp/iq-handler.ts
@@ -0,0 +1,331 @@
+import { digestJson, validateJsonBounded } from "@agent-xmpp/core";
+import {
+	buildAcceptedResult,
+	buildAgentDirectory,
+	buildAgentInfo,
+	buildGatewayInfo,
+	buildManifestResult,
+	buildPingResponse,
+	buildSchemaResult,
+	buildTaskResultResponse,
+	buildTaskStateResponse,
+	buildToolCollectionInfo,
+	buildToolInfo,
+	buildToolItems,
+	DISCO_INFO_NS,
+	DISCO_ITEMS_NS,
+	type Element,
+	hiddenObjectError,
+	isPingRequest,
+	ProtocolError,
+	parseManifestRequest,
+	parseSchemaRequest,
+	parseTaskCancellation,
+	parseTaskInput,
+	parseTaskInvocation,
+	parseTaskRecoveryRequest,
+	protocolErrorIq,
+	toolFromNode,
+	toolsNode,
+	xml,
+} from "@agent-xmpp/gateway";
+import {
+	AGENT_TASK_NS,
+	type AgentTaskRecord,
+	bareJid,
+	type RegisteredAgent,
+	terminalTaskStates,
+} from "@agent-xmpp/protocol";
+import { ulid } from "ulid";
+import { z } from "zod";
+
+import { XMPP_EXPORT } from "./config";
+import {
+	type PostgresXmppTaskStore,
+	XmppTaskConflictError,
+} from "./task-store";
+
+export interface XmppIqHandlerOptions {
+	readonly componentJid: string;
+	readonly agent: RegisteredAgent;
+	readonly store: PostgresXmppTaskStore;
+	readonly allowedCallerDomains: ReadonlySet<string>;
+	readonly destructiveCallers: ReadonlySet<string>;
+	onAccepted(task: AgentTaskRecord): void;
+	onCancel(task: AgentTaskRecord, reason?: string): Promise<void>;
+}
+
+export function createXmppIqHandler(options: XmppIqHandlerOptions) {
+	return async (stanza: Element): Promise<Element | null> => {
+		try {
+			return await routeIq(stanza, options);
+		} catch (error) {
+			if (error instanceof ProtocolError) {
+				return protocolErrorIq(stanza, error);
+			}
+			if (error instanceof XmppTaskConflictError) {
+				return protocolErrorIq(
+					stanza,
+					new ProtocolError("conflict", error.message),
+				);
+			}
+			return protocolErrorIq(
+				stanza,
+				new ProtocolError("internal-server-error", "Request processing failed"),
+			);
+		}
+	};
+}
+
+async function routeIq(
+	stanza: Element,
+	options: XmppIqHandlerOptions,
+): Promise<Element | null> {
+	if (
+		stanza.name !== "iq" ||
+		!["get", "set"].includes(String(stanza.attrs.type))
+	) {
+		return null;
+	}
+	const from = String(stanza.attrs.from ?? "");
+	const caller = bareJid(from);
+	const callerDomain = caller.split("@")[1] ?? caller;
+	if (!options.allowedCallerDomains.has(callerDomain)) {
+		throw hiddenObjectError();
+	}
+	const to = bareJid(String(stanza.attrs.to ?? ""));
+	if (
+		isPingRequest(stanza) &&
+		(to === options.componentJid || to === options.agent.manifest.agent.jid)
+	) {
+		return buildPingResponse(stanza);
+	}
+	if (to === options.componentJid) return routeGateway(stanza, options);
+	if (to !== options.agent.manifest.agent.jid) throw hiddenObjectError();
+	return routeAgent(stanza, options, caller);
+}
+
+function routeGateway(
+	stanza: Element,
+	options: XmppIqHandlerOptions,
+): Element | null {
+	const info = stanza.getChild("query", DISCO_INFO_NS);
+	const items = stanza.getChild("query", DISCO_ITEMS_NS);
+	if (info && !info.attrs.node)
+		return buildGatewayInfo(stanza, options.componentJid);
+	if (items && !items.attrs.node) {
+		return buildAgentDirectory(stanza, options.componentJid, [options.agent]);
+	}
+	return null;
+}
+
+async function routeAgent(
+	stanza: Element,
+	options: XmppIqHandlerOptions,
+	caller: string,
+): Promise<Element | null> {
+	const invocation = parseTaskInvocation(stanza);
+	if (invocation) return acceptInvocation(stanza, invocation, options, caller);
+	const cancellation = parseTaskCancellation(stanza);
+	if (cancellation) return cancelTask(stanza, cancellation, options, caller);
+	if (parseTaskInput(stanza)) {
+		throw new ProtocolError(
+			"unexpected-request",
+			"Task input is not supported",
+		);
+	}
+	const recovery = parseTaskRecoveryRequest(stanza);
+	if (recovery) {
+		const task = await options.store.getForCaller(
+			recovery.taskId,
+			caller,
+			options.agent.manifest.agent.jid,
+		);
+		if (!task) throw hiddenObjectError();
+		if (recovery.kind === "result" && !terminalTaskStates.has(task.state)) {
+			throw new ProtocolError("unexpected-request", "Task is not terminal");
+		}
+		return recovery.kind === "state"
+			? buildTaskStateResponse(stanza, task)
+			: buildTaskResultResponse(stanza, task);
+	}
+	const info = stanza.getChild("query", DISCO_INFO_NS);
+	const items = stanza.getChild("query", DISCO_ITEMS_NS);
+	const manifestRequest = parseManifestRequest(stanza);
+	const schemaRequest = parseSchemaRequest(stanza);
+	const version = options.agent.manifest.agent.version;
+	if (info && !info.attrs.node) return buildAgentInfo(stanza, options.agent);
+	if (info?.attrs.node === toolsNode(version)) {
+		return buildToolCollectionInfo(stanza, options.agent);
+	}
+	if (items?.attrs.node === toolsNode(version)) {
+		return buildToolItems(stanza, options.agent);
+	}
+	if (info?.attrs.node) {
+		const selected = toolFromNode(String(info.attrs.node));
+		if (!selected || selected.version !== version) throw hiddenObjectError();
+		const tool = options.agent.tools.find(
+			(candidate) => candidate.name === selected.name,
+		);
+		if (!tool) throw hiddenObjectError();
+		return buildToolInfo(stanza, options.agent, tool);
+	}
+	if (manifestRequest) {
+		if (manifestRequest.version && manifestRequest.version !== version)
+			throw hiddenObjectError();
+		return buildManifestResult(stanza, options.agent);
+	}
+	if (schemaRequest) {
+		if (
+			schemaRequest.version !== version ||
+			schemaRequest.manifestHash !== options.agent.manifestHash
+		) {
+			throw new ProtocolError("conflict", "Manifest selection conflict");
+		}
+		const tool = options.agent.tools.find(
+			(candidate) => candidate.name === schemaRequest.tool,
+		);
+		if (!tool) throw hiddenObjectError();
+		return buildSchemaResult(
+			stanza,
+			options.agent,
+			tool,
+			schemaRequest.direction,
+		);
+	}
+	return null;
+}
+
+async function acceptInvocation(
+	stanza: Element,
+	invocation: NonNullable<ReturnType<typeof parseTaskInvocation>>,
+	options: XmppIqHandlerOptions,
+	caller: string,
+): Promise<Element> {
+	if (
+		invocation.apiVersion !== options.agent.manifest.agent.version ||
+		invocation.manifestHash !== options.agent.manifestHash
+	) {
+		throw new ProtocolError("conflict", "Manifest selection conflict");
+	}
+	const tool = options.agent.tools.find(
+		(candidate) => candidate.name === invocation.tool,
+	);
+	if (!tool) throw hiddenObjectError();
+	if (tool.xmpp?.approvalRequired && !options.destructiveCallers.has(caller)) {
+		throw new ProtocolError("forbidden", "Tool approval is unavailable");
+	}
+	const errors = await validateJsonBounded(
+		tool.inputSchema,
+		invocation.arguments,
+	);
+	if (errors.length) {
+		throw new ProtocolError(
+			"bad-request",
+			`Argument validation failed: ${errors.join("; ")}`,
+		);
+	}
+	const now = new Date();
+	const deadline = invocation.deadline
+		? new Date(invocation.deadline)
+		: undefined;
+	if (deadline && deadline.getTime() <= now.getTime()) {
+		throw new ProtocolError("not-acceptable", "Task deadline is expired");
+	}
+	const maximumTimeoutSeconds = tool.xmpp?.maximumTimeoutSeconds;
+	if (
+		deadline &&
+		maximumTimeoutSeconds &&
+		deadline.getTime() > now.getTime() + maximumTimeoutSeconds * 1_000
+	) {
+		throw new ProtocolError(
+			"not-acceptable",
+			"Task deadline exceeds the tool maximum",
+		);
+	}
+	const retainUntil = new Date(
+		Math.max(
+			now.getTime() + XMPP_EXPORT.task.retentionMs,
+			deadline?.getTime() ?? 0,
+		),
+	);
+	const fingerprint = digestJson({
+		caller,
+		target: invocation.toJid,
+		requestId: invocation.requestId,
+		tool: invocation.tool,
+		apiVersion: invocation.apiVersion,
+		manifestHash: invocation.manifestHash,
+		arguments: invocation.arguments,
+		deadline: invocation.deadline ?? null,
+	});
+	const admission = {
+		id: ulid(),
+		requestId: invocation.requestId,
+		callerJid: caller,
+		notificationJid: invocation.notificationJid,
+		targetJid: invocation.toJid,
+		tool: invocation.tool,
+		apiVersion: invocation.apiVersion,
+		manifestHash: invocation.manifestHash,
+		fingerprint,
+		arguments: z.record(z.string(), z.json()).parse(invocation.arguments),
+		retainUntil,
+	};
+	if (deadline) Object.assign(admission, { deadline });
+	const admitted = await options.store.admit(admission);
+	if (!admitted.replay) options.onAccepted(admitted.task);
+	return buildAcceptedResult(
+		stanza,
+		{
+			requestId: admitted.task.requestId,
+			taskId: admitted.task.taskId,
+			revision: admitted.task.revision,
+			created: admitted.task.createdAt,
+			retainUntil: admitted.task.retainUntil,
+		},
+		options.agent.manifest.agent.jid,
+	);
+}
+
+async function cancelTask(
+	stanza: Element,
+	cancellation: NonNullable<ReturnType<typeof parseTaskCancellation>>,
+	options: XmppIqHandlerOptions,
+	caller: string,
+): Promise<Element> {
+	const task = await options.store.getForCaller(
+		cancellation.taskId,
+		caller,
+		options.agent.manifest.agent.jid,
+	);
+	if (!task) throw hiddenObjectError();
+	if (terminalTaskStates.has(task.state)) {
+		throw new ProtocolError("unexpected-request", "Task is terminal");
+	}
+	if (task.revision !== cancellation.expectedRevision) {
+		throw new ProtocolError("conflict", "Task revision conflict");
+	}
+	const cancelling = await options.store.transition(
+		task.taskId,
+		task.revision,
+		{
+			state: "CANCELLING",
+		},
+	);
+	await options.onCancel(cancelling, cancellation.reason);
+	return xml(
+		"iq",
+		{
+			type: "result",
+			id: stanza.attrs.id,
+			from: options.agent.manifest.agent.jid,
+			to: stanza.attrs.from,
+		},
+		xml("cancel-accepted", {
+			xmlns: AGENT_TASK_NS,
+			"task-id": cancelling.taskId,
+			revision: String(cancelling.revision),
+		}),
+	);
+}
diff --git a/apps/agent/src/xmpp/manifest.test.ts b/apps/agent/src/xmpp/manifest.test.ts
new file mode 100644
index 000000000..4091687fe
--- /dev/null
+++ b/apps/agent/src/xmpp/manifest.test.ts
@@ -0,0 +1,24 @@
+import { describe, expect, it } from "bun:test";
+import { AGENT_API_NS } from "@agent-xmpp/protocol";
+
+import { createXmppManifest } from "./manifest";
+
+describe("XMPP export manifest", () => {
+	it("derives the public tool surface from export schemas", () => {
+		const agent = createXmppManifest({
+			jid: "assistant@agents.example.com",
+			organizationId: "org_1",
+		});
+		expect(agent.tools.map((tool) => tool.name)).toEqual([
+			"handle_crm_request",
+			"ping",
+		]);
+		expect(agent.tools[0]?.xmpp?.approvalRequired).toBe(true);
+		expect(agent.manifest.tools[0]?.[AGENT_API_NS]).toEqual(
+			expect.objectContaining({
+				supportsProgress: true,
+				supportsCancellation: true,
+			}),
+		);
+	});
+});
diff --git a/apps/agent/src/xmpp/manifest.ts b/apps/agent/src/xmpp/manifest.ts
new file mode 100644
index 000000000..1b87dd775
--- /dev/null
+++ b/apps/agent/src/xmpp/manifest.ts
@@ -0,0 +1,76 @@
+import {
+	canonicalJson,
+	digestJson,
+	registeredTools,
+	validateManifest,
+} from "@agent-xmpp/core";
+import {
+	AGENT_API_NS,
+	type AgentApiManifest,
+	type RegisteredAgent,
+} from "@agent-xmpp/protocol";
+
+import { exportToolManifest } from "../export-tools/manifest";
+
+export interface XmppManifestOptions {
+	readonly jid: string;
+	readonly organizationId: string;
+	readonly version?: string;
+}
+
+export function createXmppManifest(
+	options: XmppManifestOptions,
+): RegisteredAgent {
+	const tools = exportToolManifest().map((tool) => {
+		const annotations: NonNullable<
+			AgentApiManifest["tools"][number]["annotations"]
+		> = {};
+		const manifestTool: AgentApiManifest["tools"][number] = {
+			name: tool.name,
+			description: tool.description,
+			inputSchema: { ...tool.inputSchema },
+			annotations,
+			[AGENT_API_NS]: {
+				supportsProgress: true,
+				supportsCancellation: true,
+				supportsInput: false,
+				approvalRequired: tool.annotations?.destructive === true,
+			},
+		};
+		if (tool.annotations?.title) manifestTool.title = tool.annotations.title;
+		if (tool.outputSchema) {
+			manifestTool.outputSchema = { ...tool.outputSchema };
+		}
+		if (tool.annotations?.readOnly !== undefined) {
+			annotations.readOnlyHint = tool.annotations.readOnly;
+		}
+		if (tool.annotations?.destructive !== undefined) {
+			annotations.destructiveHint = tool.annotations.destructive;
+		}
+		if (tool.annotations?.idempotent !== undefined) {
+			annotations.idempotentHint = tool.annotations.idempotent;
+		}
+		return manifestTool;
+	});
+	const manifest = validateManifest({
+		manifestSpecVersion: "0",
+		agent: {
+			jid: options.jid,
+			name: "compcrm",
+			title: "CRM Agent",
+			description: "Researches CRM records and performs bounded CRM work.",
+			version: options.version ?? "1.0.0",
+		},
+		implementation: { name: "compcrm-eve", version: "1.0.0" },
+		tools,
+	} satisfies AgentApiManifest);
+	return {
+		manifest,
+		manifestHash: digestJson(manifest),
+		canonicalManifest: canonicalJson(manifest),
+		tools: registeredTools(manifest),
+		tenantId: options.organizationId,
+		active: true,
+		registeredAt: new Date().toISOString(),
+	};
+}
diff --git a/apps/agent/src/xmpp/task-store.ts b/apps/agent/src/xmpp/task-store.ts
new file mode 100644
index 000000000..b4e8f7698
--- /dev/null
+++ b/apps/agent/src/xmpp/task-store.ts
@@ -0,0 +1,253 @@
+import type {
+	AgentTaskError,
+	AgentTaskRecord,
+	McpToolResult,
+} from "@agent-xmpp/protocol";
+import { db, Prisma, type XmppAgentTaskState } from "@crm/db";
+import { z } from "zod";
+
+import { XMPP_EXPORT } from "./config";
+
+const storedTaskResult = z.object({
+	content: z.array(z.object({ type: z.literal("text"), text: z.string() })),
+	structuredContent: z.record(z.string(), z.unknown()).optional(),
+});
+
+const storedTaskError = z.object({
+	code: z.string(),
+	message: z.string(),
+	retryable: z.boolean(),
+});
+
+export interface AdmitXmppTask {
+	readonly id: string;
+	readonly requestId: string;
+	readonly callerJid: string;
+	readonly notificationJid: string;
+	readonly targetJid: string;
+	readonly tool: string;
+	readonly apiVersion: string;
+	readonly manifestHash: string;
+	readonly fingerprint: string;
+	readonly arguments: Prisma.InputJsonValue;
+	readonly deadline?: Date;
+	readonly retainUntil: Date;
+}
+
+export interface XmppTaskTransition {
+	readonly state?: XmppAgentTaskState;
+	readonly progress?: Prisma.InputJsonValue;
+	readonly result?: Prisma.InputJsonValue;
+	readonly error?: Prisma.InputJsonValue;
+	readonly summary?: string;
+	readonly eveSessionId?: string;
+}
+
+export class XmppTaskConflictError extends Error {
+	constructor(readonly kind: "replay" | "revision") {
+		super(`XMPP task ${kind} conflict`);
+	}
+}
+
+export class PostgresXmppTaskStore {
+	constructor(
+		readonly organizationId: string,
+		readonly ownerId = crypto.randomUUID(),
+		readonly leaseMs = XMPP_EXPORT.task.leaseMs,
+	) {}
+
+	async admit(
+		input: AdmitXmppTask,
+	): Promise<{ task: AgentTaskRecord; replay: boolean }> {
+		const replayKey = {
+			organizationId: this.organizationId,
+			callerJid: input.callerJid,
+			targetJid: input.targetJid,
+			requestId: input.requestId,
+		};
+		const where = {
+			organizationId_callerJid_targetJid_requestId: replayKey,
+		};
+		const existing = await db.xmppAgentTask.findUnique({
+			where: {
+				...where,
+			},
+		});
+		if (existing) return this.replay(existing, input.fingerprint);
+		try {
+			const created = await db.xmppAgentTask.create({
+				data: {
+					...input,
+					organizationId: this.organizationId,
+					ownerId: this.ownerId,
+					leaseUntil: this.leaseUntil(),
+				},
+			});
+			return { task: taskRecord(created), replay: false };
+		} catch (error) {
+			if (
+				!(error instanceof Prisma.PrismaClientKnownRequestError) ||
+				error.code !== "P2002"
+			) {
+				throw error;
+			}
+			const concurrent = await db.xmppAgentTask.findUniqueOrThrow({
+				where,
+			});
+			return this.replay(concurrent, input.fingerprint);
+		}
+	}
+
+	async get(id: string): Promise<AgentTaskRecord | null> {
+		const task = await db.xmppAgentTask.findFirst({
+			where: { id, organizationId: this.organizationId },
+		});
+		return task ? taskRecord(task) : null;
+	}
+
+	async getForCaller(
+		id: string,
+		callerJid: string,
+		targetJid: string,
+	): Promise<AgentTaskRecord | null> {
+		const task = await db.xmppAgentTask.findFirst({
+			where: {
+				id,
+				organizationId: this.organizationId,
+				callerJid,
+				targetJid,
+			},
+		});
+		return task ? taskRecord(task) : null;
+	}
+
+	async transition(
+		id: string,
+		expectedRevision: number,
+		transition: XmppTaskTransition,
+	): Promise<AgentTaskRecord> {
+		const updated = await db.xmppAgentTask.updateMany({
+			where: {
+				id,
+				organizationId: this.organizationId,
+				revision: expectedRevision,
+			},
+			data: {
+				...transition,
+				leaseUntil:
+					transition.state !== undefined &&
+					terminalDatabaseStates.has(transition.state)
+						? null
+						: this.leaseUntil(),
+				revision: { increment: 1 },
+			},
+		});
+		if (updated.count !== 1) throw new XmppTaskConflictError("revision");
+		return taskRecord(
+			await db.xmppAgentTask.findFirstOrThrow({
+				where: { id, organizationId: this.organizationId },
+			}),
+		);
+	}
+
+	async failInterrupted(now = new Date()): Promise<number> {
+		const result = await db.xmppAgentTask.updateMany({
+			where: {
+				organizationId: this.organizationId,
+				state: { in: ["ACCEPTED", "RUNNING", "CANCELLING"] },
+				OR: [{ leaseUntil: null }, { leaseUntil: { lt: now } }],
+			},
+			data: {
+				state: "FAILED",
+				ownerId: null,
+				leaseUntil: null,
+				revision: { increment: 1 },
+				error: {
+					code: "gateway-restarted",
+					message: "The XMPP gateway restarted before the task completed",
+					retryable: true,
+				},
+			},
+		});
+		return result.count;
+	}
+
+	async renewLeases(now = new Date()): Promise<number> {
+		const result = await db.xmppAgentTask.updateMany({
+			where: {
+				organizationId: this.organizationId,
+				ownerId: this.ownerId,
+				state: { in: ["ACCEPTED", "RUNNING", "CANCELLING"] },
+			},
+			data: { leaseUntil: this.leaseUntil(now) },
+		});
+		return result.count;
+	}
+
+	async deleteExpired(now = new Date()): Promise<number> {
+		const result = await db.xmppAgentTask.deleteMany({
+			where: {
+				organizationId: this.organizationId,
+				retainUntil: { lt: now },
+				state: { in: ["COMPLETED", "FAILED", "CANCELLED"] },
+			},
+		});
+		return result.count;
+	}
+
+	private replay(task: Prisma.XmppAgentTaskModel, fingerprint: string) {
+		if (task.fingerprint !== fingerprint) {
+			throw new XmppTaskConflictError("replay");
+		}
+		return { task: taskRecord(task), replay: true };
+	}
+
+	private leaseUntil(now = new Date()): Date {
+		return new Date(now.getTime() + this.leaseMs);
+	}
+}
+
+const terminalDatabaseStates = new Set<XmppAgentTaskState>([
+	"COMPLETED",
+	"FAILED",
+	"CANCELLED",
+]);
+
+const taskStates = {
+	ACCEPTED: "accepted",
+	RUNNING: "running",
+	CANCELLING: "cancelling",
+	COMPLETED: "completed",
+	FAILED: "failed",
+	CANCELLED: "cancelled",
+} satisfies Record<XmppAgentTaskState, AgentTaskRecord["state"]>;
+
+function taskRecord(task: Prisma.XmppAgentTaskModel): AgentTaskRecord {
+	const record: AgentTaskRecord = {
+		taskId: task.id,
+		requestId: task.requestId,
+		callerJid: task.callerJid,
+		notificationJid: task.notificationJid,
+		targetJid: task.targetJid,
+		tenantId: task.organizationId,
+		tool: task.tool,
+		apiVersion: task.apiVersion,
+		manifestHash: task.manifestHash,
+		arguments: task.arguments,
+		state: taskStates[task.state],
+		revision: task.revision,
+		fingerprint: task.fingerprint,
+		createdAt: task.createdAt.toISOString(),
+		updatedAt: task.updatedAt.toISOString(),
+		retainUntil: task.retainUntil.toISOString(),
+	};
+	if (task.deadline) record.deadline = task.deadline.toISOString();
+	if (task.result) {
+		record.result = storedTaskResult.parse(task.result) satisfies McpToolResult;
+	}
+	if (task.error) {
+		record.error = storedTaskError.parse(task.error) satisfies AgentTaskError;
+	}
+	if (task.summary) record.summary = task.summary;
+	return record;
+}
diff --git a/apps/agent/test/accounts.integration.spec.ts b/apps/agent/test/accounts.integration.spec.ts
index 536eaf0e7..35ad0af01 100644
--- a/apps/agent/test/accounts.integration.spec.ts
+++ b/apps/agent/test/accounts.integration.spec.ts
@@ -1,9 +1,19 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { ActivityType, DealStage, db, EmailDirection } from "@crm/db";
+import { describe, expect } from "bun:test";
+import { ActivityType, DealStage, EmailDirection } from "@crm/db";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterAll,
+	tenantBeforeAll,
+	tenantTest,
+} from "@crm/db/test-support";
 import { readCompanyHistory, readDealHistory } from "../agent/lib/accounts";
 
 const suffix = process.env.TEST_RUN_ID ?? "accounts-spec";
 const domain = `fernhill-${suffix}.test`;
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
+const beforeAll = tenantBeforeAll(organizationId);
+const afterAll = tenantAfterAll(organizationId);
 
 let companyId: string;
 let dealId: string;
@@ -30,6 +40,7 @@ beforeAll(async () => {
 
 	const company = await db.company.create({
 		data: {
+			organizationId,
 			name: `Fernhill Systems ${suffix}`,
 			domain,
 			industry: "Security software",
@@ -41,6 +52,7 @@ beforeAll(async () => {
 
 	const paula = await db.contact.create({
 		data: {
+			organizationId,
 			firstName: "Paula",
 			lastName: "Marchetti",
 			title: "Growth Specialist",
@@ -54,6 +66,7 @@ beforeAll(async () => {
 
 	const placeholder = await db.contact.create({
 		data: {
+			organizationId,
 			firstName: "Tsomerville",
 			lastName: null,
 			email: `tsomerville@${domain}`,
@@ -66,6 +79,7 @@ beforeAll(async () => {
 
 	const deal = await db.deal.create({
 		data: {
+			organizationId,
 			name: `Fernhill platform ${suffix}`,
 			companyId,
 			ownerId: userId,
@@ -75,7 +89,9 @@ beforeAll(async () => {
 			currency: "USD",
 			expectedCloseDate: daysAhead(14),
 			lastActivityAt: daysAgo(3),
-			contacts: { create: [{ contactId: paulaId, role: "Champion" }] },
+			contacts: {
+				create: [{ organizationId, contactId: paulaId, role: "Champion" }],
+			},
 		},
 		select: { id: true },
 	});
@@ -84,6 +100,7 @@ beforeAll(async () => {
 	await db.activity.createMany({
 		data: [
 			{
+				organizationId,
 				type: ActivityType.STAGE_CHANGE,
 				subject: "Stage changed",
 				companyId,
@@ -93,6 +110,7 @@ beforeAll(async () => {
 				meta: { from: "DEMO_BOOKED", to: "QUALIFIED_TO_BUY" },
 			},
 			{
+				organizationId,
 				type: ActivityType.STAGE_CHANGE,
 				subject: "Stage changed",
 				companyId,
@@ -102,6 +120,7 @@ beforeAll(async () => {
 				meta: { from: "QUALIFIED_TO_BUY", to: "CONTRACT_SENT" },
 			},
 			{
+				organizationId,
 				type: ActivityType.NOTE,
 				subject: "Pricing pushback",
 				body: "They want the security review done before signing.",
@@ -111,6 +130,7 @@ beforeAll(async () => {
 				createdById: userId,
 			},
 			{
+				organizationId,
 				type: ActivityType.EMAIL,
 				subject: "Re: Contract",
 				companyId,
@@ -122,6 +142,7 @@ beforeAll(async () => {
 
 	const thread = await db.emailThread.create({
 		data: {
+			organizationId,
 			rootMessageId: `<root.${suffix}@example.test>`,
 			subject: "Re: Contract",
 			companyId,
@@ -136,6 +157,7 @@ beforeAll(async () => {
 	await db.emailMessage.createMany({
 		data: [
 			{
+				organizationId,
 				threadId: thread.id,
 				rfcMessageId: `<out.${suffix}@example.test>`,
 				direction: EmailDirection.OUTBOUND,
@@ -146,6 +168,7 @@ beforeAll(async () => {
 				sentAt: daysAgo(9),
 			},
 			{
+				organizationId,
 				threadId: thread.id,
 				rfcMessageId: `<in.${suffix}@example.test>`,
 				direction: EmailDirection.INBOUND,
@@ -161,6 +184,7 @@ beforeAll(async () => {
 
 	await db.calendarEvent.create({
 		data: {
+			organizationId,
 			iCalUid: `event.${suffix}@example.test`,
 			originalStartTime: daysAhead(4),
 			title: "Security review",
@@ -171,7 +195,11 @@ beforeAll(async () => {
 			contactId: paulaId,
 			attendees: {
 				create: [
-					{ email: `paula.marchetti@${domain}`, name: "Paula Marchetti" },
+					{
+						organizationId,
+						email: `paula.marchetti@${domain}`,
+						name: "Paula Marchetti",
+					},
 				],
 			},
 		},
diff --git a/apps/agent/test/audit-tenant.integration.spec.ts b/apps/agent/test/audit-tenant.integration.spec.ts
new file mode 100644
index 000000000..b6cdf04c5
--- /dev/null
+++ b/apps/agent/test/audit-tenant.integration.spec.ts
@@ -0,0 +1,82 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { tenantTransaction } from "@crm/db/tenant-scope";
+import audit from "../agent/hooks/audit";
+
+const suffix = crypto.randomUUID();
+const ORG_A = `audit-tenant-org-a-${suffix}`;
+const EVENT_ID = `audit-tenant-event-${suffix}`;
+const SESSION_ID = `audit-tenant-session-${suffix}`;
+
+type AuditHandler = (
+	event: {
+		type: string;
+		data: object;
+		meta: { id: string; at: string };
+	},
+	ctx: {
+		session: {
+			id: string;
+			auth: {
+				current: { attributes: Record<string, string> };
+				initiator: null;
+			};
+		};
+	},
+) => Promise<void>;
+
+const handler = audit.events["*"] as unknown as AuditHandler;
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: {
+			id: ORG_A,
+			name: "Audit Tenant A",
+			slug: ORG_A,
+			createdAt: new Date(),
+		},
+	});
+});
+
+afterAll(async () => {
+	await tenantTransaction(ORG_A, (tx) =>
+		tx.agentEvent.deleteMany({ where: { id: EVENT_ID } }),
+	);
+	await db.organization.delete({ where: { id: ORG_A } });
+});
+
+describe("audit tenant scope", () => {
+	it("persists an event through its session tenant", async () => {
+		const emittedAt = new Date().toISOString();
+		const data = { message: "Tenant A audit event" };
+
+		await handler(
+			{
+				type: "message.completed",
+				data,
+				meta: { id: EVENT_ID, at: emittedAt },
+			},
+			{
+				session: {
+					id: SESSION_ID,
+					auth: {
+						current: { attributes: { organizationId: ORG_A } },
+						initiator: null,
+					},
+				},
+			},
+		);
+
+		const event = await tenantTransaction(ORG_A, (tx) =>
+			tx.agentEvent.findUnique({ where: { id: EVENT_ID } }),
+		);
+
+		expect(event).toMatchObject({
+			id: EVENT_ID,
+			organizationId: ORG_A,
+			sessionId: SESSION_ID,
+			type: "message.completed",
+			data,
+		});
+	});
+});
diff --git a/apps/agent/test/blank-facts-tenant.integration.spec.ts b/apps/agent/test/blank-facts-tenant.integration.spec.ts
new file mode 100644
index 000000000..410e9af02
--- /dev/null
+++ b/apps/agent/test/blank-facts-tenant.integration.spec.ts
@@ -0,0 +1,136 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db, FactBand, FactStatus } from "@crm/db";
+import { tenantTransaction } from "@crm/db/tenant-scope";
+import { sweepBlankFacts } from "../agent/lib/blank-facts";
+
+const suffix = crypto.randomUUID();
+const ORG_A = `blank-facts-tenant-a-${suffix}`;
+const ORG_B = `blank-facts-tenant-b-${suffix}`;
+
+let contactAId = "";
+let contactBId = "";
+let factAId = "";
+let factBId = "";
+
+async function seedTenant(
+	organizationId: string,
+	name: string,
+): Promise<{ contactId: string; factId: string }> {
+	return tenantTransaction(organizationId, async (tx) => {
+		const contact = await tx.contact.create({
+			data: {
+				firstName: name,
+				email: `${organizationId}@example.test`,
+			},
+			select: { id: true },
+		});
+		const fact = await tx.contactFact.create({
+			data: {
+				contactId: contact.id,
+				field: "title",
+				value: `Title for ${name}`,
+				score: 0.61,
+				band: FactBand.PROBABLE,
+				evidence: [{ kind: "web.cited-claim", detail: "a page said so" }],
+				method: "web",
+				status: FactStatus.PROPOSED,
+			},
+			select: { id: true },
+		});
+
+		return { contactId: contact.id, factId: fact.id };
+	});
+}
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: [
+			{
+				id: ORG_A,
+				name: "Blank Facts Tenant A",
+				slug: ORG_A,
+				createdAt: new Date(),
+			},
+			{
+				id: ORG_B,
+				name: "Blank Facts Tenant B",
+				slug: ORG_B,
+				createdAt: new Date(),
+			},
+		],
+	});
+
+	const [tenantA, tenantB] = await Promise.all([
+		seedTenant(ORG_A, "Tenant A Contact"),
+		seedTenant(ORG_B, "Tenant B Contact"),
+	]);
+	contactAId = tenantA.contactId;
+	contactBId = tenantB.contactId;
+	factAId = tenantA.factId;
+	factBId = tenantB.factId;
+});
+
+afterAll(async () => {
+	await tenantTransaction(ORG_A, (tx) =>
+		tx.contact.deleteMany({ where: { id: contactAId } }),
+	);
+	await tenantTransaction(ORG_B, (tx) =>
+		tx.contact.deleteMany({ where: { id: contactBId } }),
+	);
+	await db.organization.deleteMany({ where: { id: { in: [ORG_A, ORG_B] } } });
+});
+
+describe("blank fact tenant sweep", () => {
+	it("fills pending facts across organizations through tenant scopes", async () => {
+		const organizationCount = await db.organization.count({
+			where: { id: { in: [ORG_A, ORG_B] } },
+		});
+		const [pendingA, pendingB] = await Promise.all([
+			tenantTransaction(ORG_A, (tx) =>
+				tx.contactFact.count({
+					where: { organizationId: ORG_A, status: FactStatus.PROPOSED },
+				}),
+			),
+			tenantTransaction(ORG_B, (tx) =>
+				tx.contactFact.count({
+					where: { organizationId: ORG_B, status: FactStatus.PROPOSED },
+				}),
+			),
+		]);
+
+		expect(organizationCount).toBe(2);
+		expect(pendingA).toBe(1);
+		expect(pendingB).toBe(1);
+
+		const sweep = await sweepBlankFacts();
+		const [tenantA, tenantB] = await Promise.all([
+			tenantTransaction(ORG_A, async (tx) => ({
+				contact: await tx.contact.findUnique({ where: { id: contactAId } }),
+				fact: await tx.contactFact.findUnique({ where: { id: factAId } }),
+			})),
+			tenantTransaction(ORG_B, async (tx) => ({
+				contact: await tx.contact.findUnique({ where: { id: contactBId } }),
+				fact: await tx.contactFact.findUnique({ where: { id: factBId } }),
+			})),
+		]);
+
+		expect(sweep.fills).toEqual(
+			expect.arrayContaining([
+				expect.objectContaining({
+					contactId: contactAId,
+					field: "title",
+					value: "Title for Tenant A Contact",
+				}),
+				expect.objectContaining({
+					contactId: contactBId,
+					field: "title",
+					value: "Title for Tenant B Contact",
+				}),
+			]),
+		);
+		expect(tenantA.contact?.title).toBe("Title for Tenant A Contact");
+		expect(tenantA.fact?.status).toBe(FactStatus.APPLIED);
+		expect(tenantB.contact?.title).toBe("Title for Tenant B Contact");
+		expect(tenantB.fact?.status).toBe(FactStatus.APPLIED);
+	});
+});
diff --git a/apps/agent/test/blank-facts.integration.spec.ts b/apps/agent/test/blank-facts.integration.spec.ts
index 412677369..2c3f0d03c 100644
--- a/apps/agent/test/blank-facts.integration.spec.ts
+++ b/apps/agent/test/blank-facts.integration.spec.ts
@@ -1,9 +1,19 @@
-import { afterAll, beforeEach, describe, expect, it } from "bun:test";
-import { db, FactBand, FactStatus } from "@crm/db";
+import { describe, expect } from "bun:test";
+import { FactBand, FactStatus } from "@crm/db";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterAll,
+	tenantBeforeEach,
+	tenantTest,
+} from "@crm/db/test-support";
 import { sweepBlankFacts } from "../agent/lib/blank-facts";
 
 const suffix = process.env.TEST_RUN_ID ?? "blank-facts-spec";
 const email = `blank.subject.${suffix}@example.test`;
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
+const beforeEach = tenantBeforeEach(organizationId);
+const afterAll = tenantAfterAll(organizationId);
 
 let contactId: string;
 
@@ -14,6 +24,7 @@ async function propose(input: {
 }): Promise<string> {
 	const fact = await db.contactFact.create({
 		data: {
+			organizationId,
 			contactId,
 			field: input.field,
 			value: input.value,
@@ -38,7 +49,7 @@ function statusOf(id: string) {
 beforeEach(async () => {
 	await db.contact.deleteMany({ where: { email } });
 	const contact = await db.contact.create({
-		data: { firstName: "Blank", lastName: "Subject", email },
+		data: { organizationId, firstName: "Blank", lastName: "Subject", email },
 		select: { id: true },
 	});
 	contactId = contact.id;
diff --git a/apps/agent/test/builder-input-tenant.integration.spec.ts b/apps/agent/test/builder-input-tenant.integration.spec.ts
new file mode 100644
index 000000000..48f37cf2c
--- /dev/null
+++ b/apps/agent/test/builder-input-tenant.integration.spec.ts
@@ -0,0 +1,128 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { tenantTransaction } from "@crm/db/tenant-scope";
+import { persistBuilderInputRequest } from "../agent/lib/builder-input";
+import { builderToken } from "../agent/lib/custom-agent-dispatch";
+
+const suffix = crypto.randomUUID();
+const ORG_A = `builder-input-tenant-a-${suffix}`;
+const ORG_B = `builder-input-tenant-b-${suffix}`;
+const USER_ID = `builder-input-user-${suffix}`;
+const SESSION_ID = `builder-input-session-${suffix}`;
+
+let conversationId = "";
+
+function event(requestId: string, prompt: string) {
+	return {
+		requests: [
+			{
+				kind: "question" as const,
+				requestId,
+				prompt,
+				action: {
+					kind: "tool-call" as const,
+					callId: `call-${requestId}`,
+					toolName: "ask_question",
+					input: { prompt },
+				},
+				display: "text" as const,
+			},
+		],
+		sequence: 1,
+		stepIndex: 0,
+		turnId: `turn-${requestId}`,
+	};
+}
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: [
+			{
+				id: ORG_A,
+				name: "Builder Input Tenant A",
+				slug: ORG_A,
+				createdAt: new Date(),
+			},
+			{
+				id: ORG_B,
+				name: "Builder Input Tenant B",
+				slug: ORG_B,
+				createdAt: new Date(),
+			},
+		],
+	});
+	await db.user.create({
+		data: {
+			id: USER_ID,
+			name: "Builder Input User",
+			email: `${USER_ID}@example.test`,
+		},
+	});
+	conversationId = await tenantTransaction(ORG_A, async (tx) => {
+		const conversation = await tx.agentConversation.create({
+			data: {
+				kind: "BUILDER",
+				userId: USER_ID,
+				sessionId: SESSION_ID,
+			},
+			select: { id: true },
+		});
+		return conversation.id;
+	});
+});
+
+afterAll(async () => {
+	await tenantTransaction(ORG_A, (tx) =>
+		tx.agentConversation.deleteMany({ where: { id: conversationId } }),
+	);
+	await db.user.delete({ where: { id: USER_ID } });
+	await db.organization.deleteMany({ where: { id: { in: [ORG_A, ORG_B] } } });
+});
+
+describe("builder input tenant scope", () => {
+	it("persists input for its tenant and rejects another tenant", async () => {
+		const accepted = event("accepted", "Which channel?");
+		const rejected = event("rejected", "Which stage?");
+
+		expect(
+			await persistBuilderInputRequest(
+				accepted,
+				undefined,
+				ORG_A,
+				conversationId,
+			),
+		).toBe(true);
+		expect(
+			await persistBuilderInputRequest(
+				rejected,
+				undefined,
+				ORG_B,
+				conversationId,
+			),
+		).toBe(false);
+
+		const persisted = await tenantTransaction(ORG_A, async (tx) => ({
+			conversation: await tx.agentConversation.findUnique({
+				where: { id: conversationId },
+				select: { continuationToken: true, pendingInputRequest: true },
+			}),
+			accepted: await tx.agentEvent.findUnique({
+				where: { id: `builder-input:${conversationId}:accepted` },
+				select: { organizationId: true, data: true },
+			}),
+			rejectedCount: await tx.agentEvent.count({
+				where: { id: `builder-input:${conversationId}:rejected` },
+			}),
+		}));
+
+		expect(persisted.conversation).toEqual({
+			continuationToken: builderToken(conversationId),
+			pendingInputRequest: accepted.requests[0],
+		});
+		expect(persisted.accepted).toEqual({
+			organizationId: ORG_A,
+			data: accepted,
+		});
+		expect(persisted.rejectedCount).toBe(0);
+	});
+});
diff --git a/apps/agent/test/builder-runtime-tenant.integration.spec.ts b/apps/agent/test/builder-runtime-tenant.integration.spec.ts
new file mode 100644
index 000000000..951d626f8
--- /dev/null
+++ b/apps/agent/test/builder-runtime-tenant.integration.spec.ts
@@ -0,0 +1,211 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { tenantTransaction } from "@crm/db/tenant-scope";
+import {
+	builderContext,
+	saveBuilderDraft,
+	writeBuilderArtifact,
+} from "../agent/lib/builder-runtime";
+
+const suffix = crypto.randomUUID();
+const ORG_A = `builder-runtime-tenant-a-${suffix}`;
+const ORG_B = `builder-runtime-tenant-b-${suffix}`;
+const USER_ID = `builder-runtime-user-${suffix}`;
+
+let conversationId = "";
+let agentId = "";
+
+const draft = {
+	name: "Tenant pipeline summary",
+	description: "Summarize the tenant pipeline.",
+	instructions:
+		"When manually triggered, read the approved workspace records and return one concise pipeline summary without changing CRM records.",
+	triggers: [
+		{
+			type: "MANUAL" as const,
+			name: "Manual",
+			summary: "Run when a teammate requests a pipeline summary.",
+		},
+	],
+	recordScope: "WORKSPACE" as const,
+	resources: [],
+	actions: [
+		{
+			type: "run.summary" as const,
+			provider: "crm" as const,
+			summary: "Write a pipeline summary.",
+		},
+	],
+	access: ["Read workspace CRM records"],
+};
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: [
+			{
+				id: ORG_A,
+				name: "Builder Runtime Tenant A",
+				slug: ORG_A,
+				createdAt: new Date(),
+			},
+			{
+				id: ORG_B,
+				name: "Builder Runtime Tenant B",
+				slug: ORG_B,
+				createdAt: new Date(),
+			},
+		],
+	});
+	await db.user.create({
+		data: {
+			id: USER_ID,
+			name: "Builder Runtime User",
+			email: `${USER_ID}@example.test`,
+		},
+	});
+	conversationId = await tenantTransaction(ORG_A, async (tx) => {
+		const conversation = await tx.agentConversation.create({
+			data: { kind: "BUILDER", userId: USER_ID },
+			select: { id: true },
+		});
+		return conversation.id;
+	});
+});
+
+afterAll(async () => {
+	await tenantTransaction(ORG_A, async (tx) => {
+		await tx.agentBuilderArtifact.deleteMany({
+			where: { conversationId },
+		});
+		if (agentId) {
+			await tx.agentAuditEvent.deleteMany({ where: { agentId } });
+			await tx.agentTrigger.deleteMany({ where: { agentId } });
+			await tx.agentDefinition.updateMany({
+				where: { id: agentId },
+				data: { currentVersionId: null },
+			});
+			await tx.agentVersion.deleteMany({ where: { agentId } });
+			await tx.agentDefinition.deleteMany({ where: { id: agentId } });
+		}
+		await tx.agentConversation.deleteMany({ where: { id: conversationId } });
+	});
+	await db.user.deleteMany({ where: { id: USER_ID } });
+	await db.organization.deleteMany({ where: { id: { in: [ORG_A, ORG_B] } } });
+});
+
+describe("builder runtime tenant scope", () => {
+	it("persists builder output for its tenant and rejects another tenant", async () => {
+		await expect(
+			writeBuilderArtifact(
+				ORG_B,
+				conversationId,
+				USER_ID,
+				"agent/instructions.md",
+				`${draft.instructions}\n`,
+			),
+		).rejects.toThrow("This builder conversation is unavailable.");
+
+		const artifact = await writeBuilderArtifact(
+			ORG_A,
+			conversationId,
+			USER_ID,
+			"agent/instructions.md",
+			`${draft.instructions}\n`,
+		);
+		expect(artifact).toMatchObject({ saved: true, revision: 1 });
+
+		await expect(
+			saveBuilderDraft(ORG_B, conversationId, USER_ID, draft),
+		).rejects.toThrow("This builder conversation is unavailable.");
+
+		const saved = await saveBuilderDraft(ORG_A, conversationId, USER_ID, draft);
+		if (!saved.saved) throw new Error("Tenant draft was not saved");
+		agentId = saved.agentId;
+
+		await expect(
+			builderContext(ORG_B, conversationId, USER_ID),
+		).rejects.toThrow("This builder conversation is unavailable.");
+		const context = await builderContext(ORG_A, conversationId, USER_ID);
+		expect(context).toMatchObject({
+			conversation: { id: conversationId, title: draft.name },
+			existingDraft: {
+				id: saved.agentId,
+				name: draft.name,
+				versions: [{ id: saved.versionId, number: 1, status: "READY" }],
+			},
+		});
+
+		const persisted = await tenantTransaction(ORG_A, async (tx) => ({
+			definition: await tx.agentDefinition.findUnique({
+				where: { id: saved.agentId },
+				select: { organizationId: true },
+			}),
+			version: await tx.agentVersion.findUnique({
+				where: { id: saved.versionId },
+				select: { organizationId: true },
+			}),
+			artifacts: await tx.agentBuilderArtifact.findMany({
+				where: { conversationId },
+				orderBy: { path: "asc" },
+				select: { organizationId: true, path: true, status: true },
+			}),
+			triggers: await tx.agentTrigger.findMany({
+				where: { agentId: saved.agentId },
+				select: { organizationId: true, type: true },
+			}),
+			auditEvents: await tx.agentAuditEvent.findMany({
+				where: { agentId: saved.agentId },
+				orderBy: { type: "asc" },
+				select: { organizationId: true, type: true },
+			}),
+		}));
+
+		expect(persisted.definition).toEqual({ organizationId: ORG_A });
+		expect(persisted.version).toEqual({ organizationId: ORG_A });
+		expect(persisted.artifacts).toHaveLength(3);
+		expect(persisted.artifacts).toEqual(
+			expect.arrayContaining([
+				{
+					organizationId: ORG_A,
+					path: "agent/README.md",
+					status: "READY",
+				},
+				{
+					organizationId: ORG_A,
+					path: "agent/instructions.md",
+					status: "READY",
+				},
+				{
+					organizationId: ORG_A,
+					path: "agent/manifest.json",
+					status: "READY",
+				},
+			]),
+		);
+		expect(persisted.triggers).toEqual([
+			{ organizationId: ORG_A, type: "MANUAL" },
+		]);
+		expect(persisted.auditEvents).toEqual([
+			{ organizationId: ORG_A, type: "agent.created" },
+			{ organizationId: ORG_A, type: "version.created" },
+		]);
+
+		const otherTenantRows = await tenantTransaction(ORG_B, async (tx) =>
+			Promise.all([
+				tx.agentConversation.count({
+					where: { id: conversationId, organizationId: ORG_B },
+				}),
+				tx.agentBuilderArtifact.count({
+					where: { conversationId, organizationId: ORG_B },
+				}),
+				tx.agentDefinition.count({
+					where: { id: saved.agentId, organizationId: ORG_B },
+				}),
+				tx.agentVersion.count({
+					where: { id: saved.versionId, organizationId: ORG_B },
+				}),
+			]),
+		);
+		expect(otherTenantRows).toEqual([0, 0, 0, 0]);
+	});
+});
diff --git a/apps/agent/test/builder-runtime.integration.spec.ts b/apps/agent/test/builder-runtime.integration.spec.ts
index f390d37ce..0b1cdf9c0 100644
--- a/apps/agent/test/builder-runtime.integration.spec.ts
+++ b/apps/agent/test/builder-runtime.integration.spec.ts
@@ -1,19 +1,56 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { db } from "@crm/db";
+import { describe, expect } from "bun:test";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterAll,
+	tenantBeforeAll,
+	tenantTest,
+} from "@crm/db/test-support";
 import { persistBuilderInputRequest } from "../agent/lib/builder-input";
 import {
-	saveBuilderDraft,
-	writeBuilderArtifact,
+	saveBuilderDraft as saveBuilderDraftForTenant,
+	writeBuilderArtifact as writeBuilderArtifactForTenant,
 } from "../agent/lib/builder-runtime";
 import { setBuilderConversationTitle } from "../agent/lib/conversation-title";
 import { builderToken } from "../agent/lib/custom-agent-dispatch";
 
 const suffix = crypto.randomUUID();
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
+const beforeAll = tenantBeforeAll(organizationId);
+const afterAll = tenantAfterAll(organizationId);
 const userId = `builder-runtime-user-${suffix}`;
 let conversationId = "";
 let agentId = "";
 const conversationIds: string[] = [];
 
+function writeBuilderArtifact(
+	conversationId: string,
+	userId: string,
+	path: Parameters<typeof writeBuilderArtifactForTenant>[3],
+	content: string,
+) {
+	return writeBuilderArtifactForTenant(
+		organizationId,
+		conversationId,
+		userId,
+		path,
+		content,
+	);
+}
+
+function saveBuilderDraft(
+	conversationId: string,
+	userId: string,
+	input: Parameters<typeof saveBuilderDraftForTenant>[3],
+) {
+	return saveBuilderDraftForTenant(
+		organizationId,
+		conversationId,
+		userId,
+		input,
+	);
+}
+
 beforeAll(async () => {
 	await db.user.create({
 		data: {
@@ -24,6 +61,7 @@ beforeAll(async () => {
 	});
 	const conversation = await db.agentConversation.create({
 		data: {
+			organizationId,
 			kind: "BUILDER",
 			userId,
 			sessionId: `builder-question-session-${suffix}`,
@@ -96,7 +134,12 @@ describe("builder persistence", () => {
 		};
 
 		expect(
-			await persistBuilderInputRequest(event, undefined, conversationId),
+			await persistBuilderInputRequest(
+				event,
+				undefined,
+				organizationId,
+				conversationId,
+			),
 		).toBe(true);
 		expect(
 			await db.agentConversation.findUnique({
@@ -132,11 +175,21 @@ describe("builder persistence", () => {
 			],
 		};
 		expect(
-			await persistBuilderInputRequest(newer, undefined, conversationId),
+			await persistBuilderInputRequest(
+				newer,
+				undefined,
+				organizationId,
+				conversationId,
+			),
 		).toBe(true);
 
 		expect(
-			await persistBuilderInputRequest(event, undefined, conversationId),
+			await persistBuilderInputRequest(
+				event,
+				undefined,
+				organizationId,
+				conversationId,
+			),
 		).toBe(false);
 		expect(
 			await persistBuilderInputRequest(
@@ -146,6 +199,7 @@ describe("builder persistence", () => {
 					requests: [{ ...request, requestId: "stale-question-from-child" }],
 				},
 				undefined,
+				organizationId,
 				conversationId,
 			),
 		).toBe(false);
@@ -168,6 +222,7 @@ describe("builder persistence", () => {
 	it("ignores a delayed question from a turn the session has already left", async () => {
 		const conversation = await db.agentConversation.create({
 			data: {
+				organizationId,
 				kind: "BUILDER",
 				userId,
 				sessionId: `builder-stale-turn-session-${suffix}`,
@@ -199,6 +254,7 @@ describe("builder persistence", () => {
 					turnId: "turn_5",
 				},
 				undefined,
+				organizationId,
 				conversation.id,
 			),
 		).toBe(true);
@@ -212,6 +268,7 @@ describe("builder persistence", () => {
 					turnId: "turn_3",
 				},
 				undefined,
+				organizationId,
 				conversation.id,
 			),
 		).toBe(false);
@@ -233,7 +290,7 @@ describe("builder persistence", () => {
 
 	it("sets a concise model-authored title only once", async () => {
 		const conversation = await db.agentConversation.create({
-			data: { kind: "BUILDER", userId },
+			data: { organizationId, kind: "BUILDER", userId },
 			select: { id: true },
 		});
 		conversationIds.push(conversation.id);
@@ -323,7 +380,7 @@ describe("builder persistence", () => {
 
 	it("assigns consecutive versions to distinct concurrent drafts", async () => {
 		const conversation = await db.agentConversation.create({
-			data: { kind: "BUILDER", userId },
+			data: { organizationId, kind: "BUILDER", userId },
 			select: { id: true },
 		});
 		conversationIds.push(conversation.id);
@@ -372,7 +429,7 @@ describe("builder persistence", () => {
 
 	it("persists every event trigger on one agent version", async () => {
 		const conversation = await db.agentConversation.create({
-			data: { kind: "BUILDER", userId },
+			data: { organizationId, kind: "BUILDER", userId },
 			select: { id: true },
 		});
 		conversationIds.push(conversation.id);
@@ -442,7 +499,7 @@ describe("builder persistence", () => {
 
 	it("fails closed on unsupported integrations and ambiguous record scope", async () => {
 		const conversation = await db.agentConversation.create({
-			data: { kind: "BUILDER", userId },
+			data: { organizationId, kind: "BUILDER", userId },
 			select: { id: true },
 		});
 		conversationIds.push(conversation.id);
@@ -522,7 +579,7 @@ describe("builder persistence", () => {
 
 	it("keeps a live definition unchanged until a revised version is deployed", async () => {
 		const conversation = await db.agentConversation.create({
-			data: { kind: "BUILDER", userId },
+			data: { organizationId, kind: "BUILDER", userId },
 			select: { id: true },
 		});
 		conversationIds.push(conversation.id);
diff --git a/apps/agent/test/capabilities.spec.ts b/apps/agent/test/capabilities.spec.ts
index db3dd6cf1..4706c6b4b 100644
--- a/apps/agent/test/capabilities.spec.ts
+++ b/apps/agent/test/capabilities.spec.ts
@@ -106,6 +106,34 @@ describe("reading a person comes from the same Context key", () => {
 	});
 });
 
+describe("optional Context research", () => {
+	it("restores company and person research when a key is configured", () => {
+		process.env.PERPLEXITY_API_KEY = "pplx-test";
+		process.env.BLOB_READ_WRITE_TOKEN = "blob-test";
+
+		const missing = capabilitiesFrom(null);
+		const configured = capabilitiesFrom("ctx-test");
+
+		for (const id of [CONTEXT_DEV, CONTEXT_DEV_PEOPLE]) {
+			expect(missing.find((capability) => capability.id === id)?.enabled).toBe(
+				false,
+			);
+			expect(
+				configured.find((capability) => capability.id === id)?.enabled,
+			).toBe(true);
+		}
+
+		for (const id of KEYS) {
+			expect(missing.find((capability) => capability.id === id)?.enabled).toBe(
+				true,
+			);
+			expect(
+				configured.find((capability) => capability.id === id)?.enabled,
+			).toBe(true);
+		}
+	});
+});
+
 describe("the unavailable result", () => {
 	it("says retrying will not help", () => {
 		const result = unavailable(CONTEXT_DEV_SOURCE);
diff --git a/apps/agent/test/close-task.integration.spec.ts b/apps/agent/test/close-task.integration.spec.ts
index 08ef60806..99456dd40 100644
--- a/apps/agent/test/close-task.integration.spec.ts
+++ b/apps/agent/test/close-task.integration.spec.ts
@@ -1,9 +1,19 @@
-import { afterEach, beforeEach, describe, expect, it } from "bun:test";
-import { db, EnrichmentStatus } from "@crm/db";
+import { describe, expect } from "bun:test";
+import { EnrichmentStatus } from "@crm/db";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterEach,
+	tenantBeforeEach,
+	tenantTest,
+} from "@crm/db/test-support";
 import { closeTask, taskToken } from "../agent/channels/crm";
 
 const kind = "identify";
 const email = `close-task-${crypto.randomUUID()}@example.test`;
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
+const beforeEach = tenantBeforeEach(organizationId);
+const afterEach = tenantAfterEach(organizationId);
 
 const taskIds: string[] = [];
 
@@ -12,6 +22,16 @@ async function clear() {
 		await db.agentTask.deleteMany({ where: { id: { in: taskIds.splice(0) } } });
 	}
 	await db.contact.deleteMany({ where: { email } });
+	await db.organization.upsert({
+		where: { id: organizationId },
+		create: {
+			id: organizationId,
+			name: "Workspace",
+			slug: "workspace",
+			createdAt: new Date(),
+		},
+		update: {},
+	});
 }
 
 beforeEach(clear);
@@ -22,6 +42,7 @@ async function running() {
 		data: {
 			firstName: "Close",
 			email,
+			organizationId,
 			enrichmentStatus: EnrichmentStatus.RUNNING,
 		},
 		select: { id: true },
@@ -29,6 +50,7 @@ async function running() {
 
 	const task = await db.agentTask.create({
 		data: {
+			organizationId,
 			kind,
 			reason: "test",
 			dueAt: new Date(Date.now() - 1000),
diff --git a/apps/agent/test/custom-agent-runtime.spec.ts b/apps/agent/test/custom-agent-runtime.spec.ts
index 330d2a581..d307103e3 100644
--- a/apps/agent/test/custom-agent-runtime.spec.ts
+++ b/apps/agent/test/custom-agent-runtime.spec.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it } from "bun:test";
+import { currentOrganizationId } from "@crm/db/tenant-context";
 import { builderTaskMarkdown } from "../agent/instructions/task";
 import { AGENT_ACTION_EXECUTORS } from "../agent/lib/agent-actions";
 import { recordBuilderDelegation } from "../agent/lib/builder-delegation";
@@ -26,6 +27,7 @@ import {
 	purposeOf,
 	requireBuilderAttribute,
 	requireTeamAgentAttribute,
+	runInSessionTenant,
 } from "../agent/lib/session-purpose";
 import {
 	builderDraftToolInput,
@@ -43,11 +45,12 @@ const context = (purpose?: string, commandType?: string) => ({
 				? {
 						attributes: {
 							purpose,
+							organizationId: "workspace",
 							conversationId: "chat-1",
 							commandType,
 						},
 					}
-				: { attributes: {} },
+				: { attributes: { organizationId: "workspace" } },
 			initiator: { attributes: { userId: "user-1" } },
 		},
 	},
@@ -81,36 +84,37 @@ describe("builder delivery messages", () => {
 	});
 
 	it("routes a selected answer back to the parked Eve input request", () => {
-		expect(
-			builderDeliveryMessage("submission-1", {
-				text: "Use a CRM task instead",
-				inputResponse: {
-					requestId: "question-1",
-					optionId: "crm-task",
-				},
-			}),
-		).toEqual({
-			inputResponses: [{ requestId: "question-1", optionId: "crm-task" }],
-		});
+		const value = {
+			text: "Use a CRM task instead",
+			inputResponse: {
+				requestId: "question-1",
+				optionId: "crm-task",
+			},
+		};
+		expect(builderCommandType("CHAT", value)).toBe("CREATE_AGENT");
+		expect(builderDeliveryMessage("submission-1", value)).toEqual([
+			{
+				type: "text",
+				text: "Submission id: submission-1\n\nUse a CRM task instead",
+			},
+		]);
 	});
 
 	it("routes a written answer back to the parked Eve input request", () => {
-		expect(
-			builderDeliveryMessage("submission-1", {
+		const value = {
+			text: "Use the private renewals channel",
+			inputResponse: {
+				requestId: "question-2",
 				text: "Use the private renewals channel",
-				inputResponse: {
-					requestId: "question-2",
-					text: "Use the private renewals channel",
-				},
-			}),
-		).toEqual({
-			inputResponses: [
-				{
-					requestId: "question-2",
-					text: "Use the private renewals channel",
-				},
-			],
-		});
+			},
+		};
+		expect(builderCommandType("CHAT", value)).toBe("CREATE_AGENT");
+		expect(builderDeliveryMessage("submission-1", value)).toEqual([
+			{
+				type: "text",
+				text: "Submission id: submission-1\n\nUse the private renewals channel",
+			},
+		]);
 	});
 
 	it("delivers persisted attachment bytes with model-visible metadata", () => {
@@ -153,6 +157,12 @@ describe("session purpose boundaries", () => {
 		expect(() => assertResearchPurpose(context())).not.toThrow();
 	});
 
+	it("enters the organization carried by the session", () => {
+		expect(runInSessionTenant(context(), () => currentOrganizationId())).toBe(
+			"workspace",
+		);
+	});
+
 	it("rejects research writes from builder and team-agent sessions", () => {
 		expect(() => assertResearchPurpose(context("builder"))).toThrow();
 		expect(() => assertResearchPurpose(context("team-agent"))).toThrow();
diff --git a/apps/agent/test/dispatch-health.spec.ts b/apps/agent/test/dispatch-health.spec.ts
index bd42ca172..cde317e5b 100644
--- a/apps/agent/test/dispatch-health.spec.ts
+++ b/apps/agent/test/dispatch-health.spec.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it } from "bun:test";
+import { collapsing } from "@crm/db/pool";
 import { settledWithin } from "../agent/lib/deadline";
 import {
 	DRAIN_TIMEOUT_MS,
@@ -6,7 +7,6 @@ import {
 	linkSession,
 	runDirect,
 } from "../agent/lib/dispatch";
-import { collapsing } from "../agent/lib/pool";
 import type { LeasedTask } from "../agent/lib/tasks";
 
 describe("dispatch wedging", () => {
@@ -90,6 +90,7 @@ async function flush(): Promise<void> {
 function directTask(overrides: Partial<LeasedTask> = {}): LeasedTask {
 	return {
 		id: "task_direct",
+		organizationId: "workspace_1",
 		contactId: null,
 		companyId: null,
 		dealId: null,
diff --git a/apps/agent/test/dispatch-tenant.integration.spec.ts b/apps/agent/test/dispatch-tenant.integration.spec.ts
new file mode 100644
index 000000000..5ab08532e
--- /dev/null
+++ b/apps/agent/test/dispatch-tenant.integration.spec.ts
@@ -0,0 +1,182 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { runDirect } from "../agent/lib/dispatch";
+import { claimDue, type LeasedTask } from "../agent/lib/tasks";
+
+const suffix = crypto.randomUUID();
+const ORG_A = `dispatch-tenant-org-a-${suffix}`;
+const ORG_B = `dispatch-tenant-org-b-${suffix}`;
+const TASK_KIND = `dispatch-tenant-test-${suffix}`;
+
+let companyAId = "";
+let companyBId = "";
+let taskAId = "";
+let taskBId = "";
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: [
+			{
+				id: ORG_A,
+				name: "Org A",
+				slug: `dispatch-tenant-org-a-${suffix}`,
+				createdAt: new Date(),
+			},
+			{
+				id: ORG_B,
+				name: "Org B",
+				slug: `dispatch-tenant-org-b-${suffix}`,
+				createdAt: new Date(),
+			},
+		],
+		skipDuplicates: true,
+	});
+
+	const dueAt = new Date(Date.now() - 1000);
+	const [companyA, companyB] = await Promise.all([
+		runInTenant(ORG_A, () =>
+			scopedDb.company.create({
+				data: { organizationId: ORG_A, name: "Acme A" },
+				select: { id: true },
+			}),
+		),
+		runInTenant(ORG_B, () =>
+			scopedDb.company.create({
+				data: { organizationId: ORG_B, name: "Acme B" },
+				select: { id: true },
+			}),
+		),
+	]);
+	companyAId = companyA.id;
+	companyBId = companyB.id;
+
+	const [taskA, taskB] = await Promise.all([
+		runInTenant(ORG_A, () =>
+			scopedDb.agentTask.create({
+				data: {
+					organizationId: ORG_A,
+					companyId: companyAId,
+					kind: TASK_KIND,
+					reason: "test",
+					dueAt,
+					budget: 4,
+				},
+				select: { id: true },
+			}),
+		),
+		runInTenant(ORG_B, () =>
+			scopedDb.agentTask.create({
+				data: {
+					organizationId: ORG_B,
+					companyId: companyBId,
+					kind: TASK_KIND,
+					reason: "test",
+					dueAt,
+					budget: 4,
+				},
+				select: { id: true },
+			}),
+		),
+	]);
+	taskAId = taskA.id;
+	taskBId = taskB.id;
+});
+
+afterAll(async () => {
+	await Promise.all([
+		runInTenant(ORG_A, () =>
+			scopedDb.agentTask.deleteMany({ where: { id: taskAId } }),
+		),
+		runInTenant(ORG_B, () =>
+			scopedDb.agentTask.deleteMany({ where: { id: taskBId } }),
+		),
+		runInTenant(ORG_A, () =>
+			scopedDb.company.deleteMany({ where: { id: companyAId } }),
+		),
+		runInTenant(ORG_B, () =>
+			scopedDb.company.deleteMany({ where: { id: companyBId } }),
+		),
+	]);
+	await db.organization.deleteMany({
+		where: { id: { in: [ORG_A, ORG_B] } },
+	});
+});
+
+async function writeTenantMarker(task: LeasedTask): Promise<void> {
+	if (!task.companyId) throw new Error("Test task has no company.");
+
+	await scopedDb.company.update({
+		where: { id: task.companyId },
+		data: { description: `handled by ${task.organizationId}` },
+	});
+}
+
+describe("runDirect across orgs", () => {
+	it("claims both tasks, keeps data in tenant scope, and never leaks reads", async () => {
+		const claimed = await claimDue(10, { only: [TASK_KIND] });
+		expect(claimed).toHaveLength(2);
+
+		const organizationById = new Map(
+			claimed.map((task) => [task.id, task.organizationId]),
+		);
+		expect(organizationById.get(taskAId)).toBe(ORG_A);
+		expect(organizationById.get(taskBId)).toBe(ORG_B);
+		expect(organizationById.get(taskAId)).not.toBe(
+			organizationById.get(taskBId),
+		);
+
+		const claimedA = claimed.find((task) => task.id === taskAId);
+		const claimedB = claimed.find((task) => task.id === taskBId);
+		if (!claimedA || !claimedB)
+			throw new Error("Both test tasks must be claimable.");
+
+		await Promise.all([
+			runDirect(claimedB, writeTenantMarker),
+			runDirect(claimedA, writeTenantMarker),
+		]);
+
+		const [companyA, companyB] = await Promise.all([
+			runInTenant(ORG_A, () =>
+				scopedDb.company.findUnique({
+					where: { id: companyAId },
+					select: { description: true, organizationId: true },
+				}),
+			),
+			runInTenant(ORG_B, () =>
+				scopedDb.company.findUnique({
+					where: { id: companyBId },
+					select: { description: true, organizationId: true },
+				}),
+			),
+		]);
+
+		expect(companyA?.organizationId).toBe(ORG_A);
+		expect(companyB?.organizationId).toBe(ORG_B);
+		expect(companyA?.description).toBe(`handled by ${ORG_A}`);
+		expect(companyB?.description).toBe(`handled by ${ORG_B}`);
+
+		const [taskInWrongOrgA, taskInWrongOrgB] = await Promise.all([
+			runInTenant(ORG_A, () =>
+				scopedDb.agentTask.findUnique({ where: { id: taskBId } }),
+			),
+			runInTenant(ORG_B, () =>
+				scopedDb.agentTask.findUnique({ where: { id: taskAId } }),
+			),
+		]);
+		expect(taskInWrongOrgA).toBeNull();
+		expect(taskInWrongOrgB).toBeNull();
+
+		const [companyInWrongOrgA, companyInWrongOrgB] = await Promise.all([
+			runInTenant(ORG_A, () =>
+				scopedDb.company.findUnique({ where: { id: companyBId } }),
+			),
+			runInTenant(ORG_B, () =>
+				scopedDb.company.findUnique({ where: { id: companyAId } }),
+			),
+		]);
+		expect(companyInWrongOrgA).toBeNull();
+		expect(companyInWrongOrgB).toBeNull();
+	});
+});
diff --git a/apps/agent/test/drain.spec.ts b/apps/agent/test/drain.spec.ts
index f1ea31864..4eca5d5d9 100644
--- a/apps/agent/test/drain.spec.ts
+++ b/apps/agent/test/drain.spec.ts
@@ -1,8 +1,9 @@
 import { describe, expect, it } from "bun:test";
+import { collapsing } from "@crm/db/pool";
+import { currentOrganizationId } from "@crm/db/tenant-context";
 import { APP_AUTH } from "../agent/lib/app-auth";
 import { isAutomated } from "../agent/lib/approval";
-import { taskAuth } from "../agent/lib/dispatch";
-import { collapsing } from "../agent/lib/pool";
+import { runDirect, taskAuth } from "../agent/lib/dispatch";
 import type { LeasedTask } from "../agent/lib/tasks";
 
 function deferred() {
@@ -90,6 +91,7 @@ describe("collapsing", () => {
 function task(overrides: Partial<LeasedTask> = {}): LeasedTask {
 	return {
 		id: "task_1",
+		organizationId: "workspace_1",
 		contactId: "contact_1",
 		companyId: null,
 		dealId: null,
@@ -104,6 +106,17 @@ function task(overrides: Partial<LeasedTask> = {}): LeasedTask {
 	};
 }
 
+describe("runDirect", () => {
+	it("runs each task inside its tenant context", async () => {
+		let organizationId: string | undefined;
+		await runDirect(task(), async () => {
+			organizationId = currentOrganizationId();
+		});
+
+		expect(organizationId).toBe("workspace_1");
+	});
+});
+
 describe("taskAuth", () => {
 	it("reads as the app principal, so an unattended turn is not asked to approve itself", () => {
 		const auth = taskAuth(task());
@@ -117,6 +130,7 @@ describe("taskAuth", () => {
 		expect(auth.attributes).toMatchObject({
 			taskKind: "identify",
 			budget: "4",
+			organizationId: "workspace_1",
 			contactId: "contact_1",
 			companyId: "company_1",
 		});
diff --git a/apps/agent/test/durable-agent-runtime.integration.spec.ts b/apps/agent/test/durable-agent-runtime.integration.spec.ts
index 27f74db78..98a044516 100644
--- a/apps/agent/test/durable-agent-runtime.integration.spec.ts
+++ b/apps/agent/test/durable-agent-runtime.integration.spec.ts
@@ -1,6 +1,14 @@
-import { afterAll, afterEach, beforeAll, describe, expect, it } from "bun:test";
-import { db } from "@crm/db";
-import type { SendFn } from "eve/channels";
+import { describe, expect } from "bun:test";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterAll,
+	tenantAfterEach,
+	tenantBeforeAll,
+	tenantTest,
+} from "@crm/db/test-support";
+import type { UserContent } from "ai";
+import type { ChannelFrom, ChannelSendOptions, Session } from "eve/channels";
 import { z } from "zod";
 import audit from "../agent/hooks/audit";
 import {
@@ -14,15 +22,38 @@ import {
 	queueEventAgentRuns,
 } from "../agent/lib/custom-agent-dispatch";
 import {
-	createRunActivity,
-	finishRun,
+	createRunActivity as createRunActivityInTenant,
+	finishRun as finishRunInTenant,
 	runResultOf,
-	stageRunResult,
+	stageRunResult as stageRunResultInTenant,
 } from "../agent/lib/run-runtime";
 
 const attachmentBytes = z.object({ data: z.instanceof(Uint8Array) });
 
+const channelFrom =
+	(
+		send: (
+			message: string | UserContent,
+			options: ChannelSendOptions,
+		) => Promise<Session>,
+	): ChannelFrom =>
+	() => ({
+		send,
+		respond: async () => {
+			throw new Error("unused");
+		},
+		cancel: async () => ({ sessionId: "", status: "accepted" }),
+		compact: async () => ({ sessionId: "", status: "accepted" }),
+		clear: async () => ({ sessionId: "", status: "accepted" }),
+		reset: async () => ({ status: "no_active_session" }),
+	});
+
 const suffix = crypto.randomUUID();
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
+const beforeAll = tenantBeforeAll(organizationId);
+const afterEach = tenantAfterEach(organizationId);
+const afterAll = tenantAfterAll(organizationId);
 const userId = `durable-runtime-user-${suffix}`;
 const domain = `durable-${suffix}.example.test`;
 let agentId = "";
@@ -32,6 +63,16 @@ let otherCompanyId = "";
 let triggerId = "";
 const builderConversationIds: string[] = [];
 
+const createRunActivity = (
+	...args: Parameters<typeof createRunActivityInTenant>
+) => runInTenant(organizationId, () => createRunActivityInTenant(...args));
+
+const finishRun = (...args: Parameters<typeof finishRunInTenant>) =>
+	runInTenant(organizationId, () => finishRunInTenant(...args));
+
+const stageRunResult = (...args: Parameters<typeof stageRunResultInTenant>) =>
+	runInTenant(organizationId, () => stageRunResultInTenant(...args));
+
 beforeAll(async () => {
 	await db.user.create({
 		data: {
@@ -42,11 +83,15 @@ beforeAll(async () => {
 	});
 	const [company, otherCompany] = await Promise.all([
 		db.company.create({
-			data: { name: "Durable Runtime Company", domain },
+			data: { organizationId, name: "Durable Runtime Company", domain },
 			select: { id: true },
 		}),
 		db.company.create({
-			data: { name: "Out of Scope Company", domain: `other-${domain}` },
+			data: {
+				organizationId,
+				name: "Out of Scope Company",
+				domain: `other-${domain}`,
+			},
 			select: { id: true },
 		}),
 	]);
@@ -55,6 +100,7 @@ beforeAll(async () => {
 
 	const agent = await db.agentDefinition.create({
 		data: {
+			organizationId,
 			name: "Durable runtime",
 			status: "LIVE",
 			createdById: userId,
@@ -64,6 +110,7 @@ beforeAll(async () => {
 	agentId = agent.id;
 	const version = await db.agentVersion.create({
 		data: {
+			organizationId,
 			agentId,
 			number: 1,
 			status: "DEPLOYED",
@@ -120,6 +167,7 @@ beforeAll(async () => {
 	});
 	const trigger = await db.agentTrigger.create({
 		data: {
+			organizationId,
 			agentId,
 			versionId,
 			type: "SCHEDULE",
@@ -189,6 +237,7 @@ async function createRun(
 ) {
 	return db.agentRun.create({
 		data: {
+			organizationId,
 			agentId,
 			versionId,
 			triggerType,
@@ -197,7 +246,9 @@ async function createRun(
 			sessionId,
 			idempotencyKey: `durable-run-${crypto.randomUUID()}`,
 			correlationId: crypto.randomUUID(),
-			events: { create: { sequence: 0, type: "run.queued", data: {} } },
+			events: {
+				create: { organizationId, sequence: 0, type: "run.queued", data: {} },
+			},
 		},
 		select: { id: true },
 	});
@@ -217,6 +268,7 @@ describe("durable custom-agent runtime", () => {
 	it("queues one run per matching event trigger and event occurrence", async () => {
 		const trigger = await db.agentTrigger.create({
 			data: {
+				organizationId,
 				agentId,
 				versionId,
 				type: "EVENT",
@@ -227,17 +279,28 @@ describe("durable custom-agent runtime", () => {
 			},
 			select: { id: true },
 		});
+		const eventDeal = await db.deal.create({
+			data: {
+				organizationId,
+				id: `event-deal-${suffix}`,
+				name: "Event deal",
+				ownerId: userId,
+				companyId,
+			},
+			select: { id: true },
+		});
 		const occurredAt = new Date().toISOString();
 		const task = {
 			id: `event-task-${suffix}`,
+			organizationId,
 			contactId: null,
 			companyId: null,
-			dealId: `event-deal-${suffix}`,
+			dealId: eventDeal.id,
 			payload: {
 				type: "deal.closed",
-				record: { kind: "deal", id: `event-deal-${suffix}` },
+				record: { kind: "deal", id: eventDeal.id },
 				occurredAt,
-				data: { from: "NEGOTIATION", to: "CLOSED_WON" },
+				data: { from: "DECISION_MAKER_BOUGHT_IN", to: "CLOSED_WON" },
 			},
 		};
 
@@ -249,22 +312,24 @@ describe("durable custom-agent runtime", () => {
 
 		const runs = await db.agentRun.findMany({
 			where: { triggerId: trigger.id },
-			select: { triggerType: true, status: true, input: true },
+			select: { triggerType: true, status: true, dealId: true, input: true },
 		});
 		expect(runs).toEqual([
 			{
 				triggerType: "EVENT",
 				status: "QUEUED",
+				dealId: eventDeal.id,
 				input: {
 					event: {
 						type: "deal.closed",
 						occurredAt,
-						data: { from: "NEGOTIATION", to: "CLOSED_WON" },
+						data: { from: "DECISION_MAKER_BOUGHT_IN", to: "CLOSED_WON" },
 					},
-					record: { kind: "deal", id: `event-deal-${suffix}` },
+					record: { kind: "deal", id: eventDeal.id },
 				},
 			},
 		]);
+		await db.deal.delete({ where: { id: eventDeal.id } });
 	});
 
 	it("advances a due trigger only when its run is committed", async () => {
@@ -313,14 +378,14 @@ describe("durable custom-agent runtime", () => {
 		const run = await createRun("QUEUED", null);
 		let deliveries = 0;
 		const sessionId = `durable-session-${suffix}-agent-dispatch`;
-		const send = (async () => {
+		const from = channelFrom(async () => {
 			deliveries += 1;
-			return { id: sessionId };
-		}) as unknown as SendFn;
+			return { id: sessionId } as Session;
+		});
 
 		const attempts = await Promise.allSettled([
-			dispatchAgentRun(run.id, send),
-			dispatchAgentRun(run.id, send),
+			dispatchAgentRun(run.id, from),
+			dispatchAgentRun(run.id, from),
 		]);
 		const persisted = await db.agentRun.findUniqueOrThrow({
 			where: { id: run.id },
@@ -342,14 +407,14 @@ describe("durable custom-agent runtime", () => {
 			createRun("QUEUED", null),
 		]);
 		const deliveries: string[] = [];
-		const send = (async (message: string) => {
+		const from = channelFrom(async (message: string) => {
 			deliveries.push(message);
-			return { id: `durable-session-${suffix}-serialized` };
-		}) as unknown as SendFn;
+			return { id: `durable-session-${suffix}-serialized` } as Session;
+		});
 
 		const results = await Promise.allSettled([
-			dispatchAgentRun(first.id, send),
-			dispatchAgentRun(second.id, send),
+			dispatchAgentRun(first.id, from),
+			dispatchAgentRun(second.id, from),
 		]);
 
 		expect(
@@ -374,12 +439,14 @@ describe("durable custom-agent runtime", () => {
 	it("restores a builder continuation when a delivery lease expires", async () => {
 		const conversation = await db.agentConversation.create({
 			data: {
+				organizationId,
 				kind: "BUILDER",
 				userId,
 				sessionId: `durable-session-${suffix}-builder`,
 				continuationToken: null,
 				submissions: {
 					create: {
+						organizationId,
 						submittedById: userId,
 						clientRequestId: crypto.randomUUID(),
 						message: { text: "Continue building" },
@@ -408,7 +475,7 @@ describe("durable custom-agent runtime", () => {
 
 	it("keeps concurrent builder dispatches in conversation order", async () => {
 		const conversation = await db.agentConversation.create({
-			data: { kind: "BUILDER", userId },
+			data: { organizationId, kind: "BUILDER", userId },
 			select: { id: true },
 		});
 		builderConversationIds.push(conversation.id);
@@ -416,6 +483,7 @@ describe("durable custom-agent runtime", () => {
 		const [first, second] = await Promise.all([
 			db.agentConversationSubmission.create({
 				data: {
+					organizationId,
 					conversationId: conversation.id,
 					submittedById: userId,
 					clientRequestId: crypto.randomUUID(),
@@ -426,6 +494,7 @@ describe("durable custom-agent runtime", () => {
 			}),
 			db.agentConversationSubmission.create({
 				data: {
+					organizationId,
 					conversationId: conversation.id,
 					submittedById: userId,
 					clientRequestId: crypto.randomUUID(),
@@ -438,18 +507,18 @@ describe("durable custom-agent runtime", () => {
 		const started = Promise.withResolvers<void>();
 		const release = Promise.withResolvers<void>();
 		let deliveries = 0;
-		const send = (async () => {
+		const from = channelFrom(async () => {
 			deliveries += 1;
 			started.resolve();
 			await release.promise;
-			return { id: `durable-session-${suffix}-builder-dispatch` };
-		}) as unknown as SendFn;
+			return { id: `durable-session-${suffix}-builder-dispatch` } as Session;
+		});
 
-		const firstDispatch = dispatchBuilderSubmission(first.id, send);
+		const firstDispatch = dispatchBuilderSubmission(first.id, from);
 		await started.promise;
 		let secondError: Error | null = null;
 		try {
-			await dispatchBuilderSubmission(second.id, send);
+			await dispatchBuilderSubmission(second.id, from);
 		} catch (error) {
 			secondError = error as Error;
 		}
@@ -475,10 +544,12 @@ describe("durable custom-agent runtime", () => {
 		const content = Buffer.from("durable attachment");
 		const conversation = await db.agentConversation.create({
 			data: {
+				organizationId,
 				kind: "BUILDER",
 				userId,
 				submissions: {
 					create: {
+						organizationId,
 						submittedById: userId,
 						clientRequestId: crypto.randomUUID(),
 						message: {
@@ -494,6 +565,7 @@ describe("durable custom-agent runtime", () => {
 						},
 						attachments: {
 							create: {
+								organizationId,
 								position: 0,
 								name: "brief.txt",
 								mediaType: "text/plain",
@@ -507,15 +579,15 @@ describe("durable custom-agent runtime", () => {
 			select: { id: true, submissions: { select: { id: true } } },
 		});
 		builderConversationIds.push(conversation.id);
-		let delivered: Parameters<SendFn>[0] | null = null;
-		const send = (async (input: Parameters<SendFn>[0]) => {
+		let delivered: UserContent | null = null;
+		const from = channelFrom(async (input: UserContent) => {
 			delivered = input;
-			return { id: `durable-session-${suffix}-attachment` };
-		}) as unknown as SendFn;
+			return { id: `durable-session-${suffix}-attachment` } as Session;
+		});
 
 		await dispatchBuilderSubmission(
 			conversation.submissions[0]?.id ?? "",
-			send,
+			from,
 		);
 		const parts = Array.isArray(delivered) ? delivered : [];
 		expect(parts).toHaveLength(2);
@@ -557,7 +629,11 @@ describe("durable custom-agent runtime", () => {
 				id: `durable-session-${suffix}-usage`,
 				auth: {
 					current: {
-						attributes: { purpose: "team-agent", runId: run.id },
+						attributes: {
+							purpose: "team-agent",
+							runId: run.id,
+							organizationId,
+						},
 					},
 					initiator: null,
 				},
@@ -617,7 +693,11 @@ describe("durable custom-agent runtime", () => {
 					parent: { id: rootSessionId },
 					auth: {
 						current: {
-							attributes: { purpose: "team-agent", runId: run.id },
+							attributes: {
+								purpose: "team-agent",
+								runId: run.id,
+								organizationId,
+							},
 						},
 						initiator: null,
 					},
diff --git a/apps/agent/test/e2e/xmpp-export.e2e.ts b/apps/agent/test/e2e/xmpp-export.e2e.ts
new file mode 100644
index 000000000..9c5db24d5
--- /dev/null
+++ b/apps/agent/test/e2e/xmpp-export.e2e.ts
@@ -0,0 +1,142 @@
+import assert from "node:assert/strict";
+import { randomUUID } from "node:crypto";
+import {
+	buildTaskInvocation,
+	type Element,
+	parseTaskEvent,
+	xml,
+} from "@agent-xmpp/gateway";
+import { AGENT_TASK_NS, type AgentTaskRecord } from "@agent-xmpp/protocol";
+import { client } from "@xmpp/client";
+import { z } from "zod";
+import { createXmppManifest } from "../../src/xmpp/manifest";
+
+const domain = process.env.XMPP_E2E_DOMAIN ?? "example.org";
+const service = process.env.XMPP_E2E_SERVICE ?? "xmpp://127.0.0.1:15222";
+const username = process.env.XMPP_E2E_USERNAME ?? "john";
+const password = process.env.XMPP_E2E_PASSWORD ?? "secret";
+const callerJid = `${username}@${domain}`;
+const targetJid =
+	process.env.XMPP_DEFAULT_AGENT_JID ?? `assistant@gateway.${domain}`;
+const organizationId = process.env.XMPP_ORGANIZATION_ID;
+const bridgeSecret = process.env.AGENT_BRIDGE_SECRET;
+
+if (process.env.XMPP_E2E_ALLOW_SELF_SIGNED === "1") {
+	process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+}
+
+assert.ok(organizationId, "XMPP_ORGANIZATION_ID is required");
+assert.ok(bridgeSecret, "AGENT_BRIDGE_SECRET is required");
+
+const manifestResponse = await fetch(
+	`${process.env.AGENT_URL ?? "http://127.0.0.1:2000"}/internal/xmpp/export-tools/manifest`,
+	{ headers: { authorization: `Bearer ${bridgeSecret}` } },
+);
+assert.equal(manifestResponse.status, 200);
+const exported = z
+	.object({ tools: z.array(z.object({ name: z.string() })) })
+	.parse(await manifestResponse.json());
+assert.deepEqual(
+	exported.tools.map((tool) => tool.name),
+	["handle_crm_request", "ping"],
+);
+
+const agent = createXmppManifest({
+	jid: targetJid,
+	organizationId,
+	version: process.env.XMPP_AGENT_VERSION,
+});
+const xmpp = client({
+	service,
+	domain,
+	username,
+	password,
+	resource: `compcrm-e2e-${randomUUID()}`,
+});
+const stanzas: Element[] = [];
+const waiters = new Set<() => void>();
+xmpp.on("stanza", (stanza) => {
+	stanzas.push(stanza);
+	for (const notify of waiters) notify();
+});
+
+try {
+	await xmpp.start();
+	await xmpp.send(xml("presence"));
+	const requestId = `request-${randomUUID()}`;
+	const task: AgentTaskRecord = {
+		taskId: `caller-${randomUUID()}`,
+		requestId,
+		callerJid,
+		notificationJid: callerJid,
+		targetJid,
+		tenantId: organizationId,
+		tool: "ping",
+		apiVersion: agent.manifest.agent.version,
+		manifestHash: agent.manifestHash,
+		arguments: {},
+		state: "accepted",
+		revision: 0,
+		fingerprint: "caller-fingerprint",
+		createdAt: new Date().toISOString(),
+		updatedAt: new Date().toISOString(),
+		retainUntil: new Date(Date.now() + 60_000).toISOString(),
+	};
+	const invocation = buildTaskInvocation(task);
+	await xmpp.send(invocation);
+	const acceptedIq = await waitFor(
+		(stanza) =>
+			stanza.is("iq") &&
+			stanza.attrs.id === invocation.attrs.id &&
+			stanza.attrs.type === "result",
+	);
+	const accepted = acceptedIq.getChild("accepted", AGENT_TASK_NS);
+	assert.ok(accepted);
+	const taskId = String(accepted.attrs["task-id"]);
+	const completedStanza = await waitFor((stanza) => {
+		const event = parseTaskEvent(stanza);
+		return event?.taskId === taskId && event.type === "completed";
+	});
+	const completed = parseTaskEvent(completedStanza);
+	assert.ok(completed);
+	const result = z
+		.object({
+			structuredContent: z.object({
+				status: z.literal("ok"),
+				requestId: z.string(),
+			}),
+		})
+		.parse(completed.payload.result);
+	assert.deepEqual(result.structuredContent, {
+		status: "ok",
+		requestId: taskId,
+	});
+	console.log("XMPP export E2E passed");
+} finally {
+	await xmpp.stop();
+}
+
+async function waitFor(
+	predicate: (stanza: Element) => boolean,
+	timeoutMs = 30_000,
+): Promise<Element> {
+	const deadline = Date.now() + timeoutMs;
+	for (;;) {
+		const match = stanzas.find(predicate);
+		if (match) return match;
+		const remaining = deadline - Date.now();
+		if (remaining <= 0) throw new Error("Timed out waiting for XMPP stanza");
+		await new Promise<void>((resolve, reject) => {
+			const timer = setTimeout(() => {
+				waiters.delete(notify);
+				reject(new Error("Timed out waiting for XMPP stanza"));
+			}, remaining);
+			const notify = () => {
+				clearTimeout(timer);
+				waiters.delete(notify);
+				resolve();
+			};
+			waiters.add(notify);
+		});
+	}
+}
diff --git a/apps/agent/test/enrichment.integration.spec.ts b/apps/agent/test/enrichment.integration.spec.ts
index 3db33938d..9548ce960 100644
--- a/apps/agent/test/enrichment.integration.spec.ts
+++ b/apps/agent/test/enrichment.integration.spec.ts
@@ -1,8 +1,29 @@
-import { afterEach, beforeEach, describe, expect, it } from "bun:test";
-import { db, EnrichmentStatus } from "@crm/db";
-import { markRunning, settle } from "../agent/lib/enrichment";
+import { describe, expect } from "bun:test";
+import { EnrichmentStatus } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterEach,
+	tenantBeforeEach,
+	tenantTest,
+} from "@crm/db/test-support";
+import {
+	markRunning as markRunningWithoutTenant,
+	settle as settleWithoutTenant,
+} from "../agent/lib/enrichment";
 
 const domain = "lifecycle.example.test";
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
+const beforeEach = tenantBeforeEach(organizationId);
+const afterEach = tenantAfterEach(organizationId);
+
+const markRunning: typeof markRunningWithoutTenant = (subject) =>
+	runInTenant(organizationId, () => markRunningWithoutTenant(subject));
+const settle: typeof settleWithoutTenant = (subject, status, error) =>
+	runInTenant(organizationId, () =>
+		settleWithoutTenant(subject, status, error),
+	);
 
 async function clear() {
 	await db.agentTask.deleteMany({ where: { reason: "lifecycle" } });
@@ -17,7 +38,7 @@ afterEach(clear);
 
 async function company() {
 	return db.company.create({
-		data: { name: "Lifecycle", domain },
+		data: { organizationId, name: "Lifecycle", domain },
 		select: { id: true },
 	});
 }
@@ -25,6 +46,7 @@ async function company() {
 async function contact() {
 	return db.contact.create({
 		data: {
+			organizationId,
 			firstName: "Lifecycle",
 			email: `lifecycle-${crypto.randomUUID()}@example.test`,
 		},
@@ -47,8 +69,9 @@ async function retiredTask(companyId: string) {
 		select: { updatedAt: true },
 	});
 
-	return db.agentTask.create({
+	return await db.agentTask.create({
 		data: {
+			organizationId,
 			companyId,
 			kind: "company-profile",
 			reason: "lifecycle",
@@ -192,6 +215,7 @@ describe("the record follows the task", () => {
 		const org = await company();
 		const open = await db.agentTask.create({
 			data: {
+				organizationId,
 				companyId: org.id,
 				kind: "company-profile",
 				reason: "lifecycle",
@@ -227,6 +251,7 @@ describe("the record follows the task", () => {
 		const task = await retiredTask(org.id);
 		await db.agentTask.create({
 			data: {
+				organizationId,
 				companyId: org.id,
 				kind: "recheck",
 				reason: "lifecycle",
@@ -316,6 +341,7 @@ describe("the record follows the task", () => {
 
 		const task = await db.agentTask.create({
 			data: {
+				organizationId,
 				contactId: person.id,
 				kind: "identify",
 				reason: "lifecycle",
@@ -346,6 +372,7 @@ describe("the record follows the task", () => {
 
 		const ended = await db.agentTask.create({
 			data: {
+				organizationId,
 				contactId: person.id,
 				kind: "identify",
 				reason: "lifecycle",
@@ -358,6 +385,7 @@ describe("the record follows the task", () => {
 
 		await db.agentTask.create({
 			data: {
+				organizationId,
 				contactId: person.id,
 				kind: "recheck",
 				reason: "lifecycle",
diff --git a/apps/agent/test/facts.integration.spec.ts b/apps/agent/test/facts.integration.spec.ts
index 4c9fc42e8..39650b9b3 100644
--- a/apps/agent/test/facts.integration.spec.ts
+++ b/apps/agent/test/facts.integration.spec.ts
@@ -1,9 +1,23 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { db } from "@crm/db";
+import { describe, expect } from "bun:test";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterAll,
+	tenantBeforeAll,
+	tenantTest,
+} from "@crm/db/test-support";
 import type { Evidence } from "../agent/lib/evidence";
-import { recordFact, writeBrief } from "../agent/lib/facts";
+import {
+	type RecordFactInput,
+	recordFact as recordFactInTenant,
+	writeBrief as writeBriefInTenant,
+} from "../agent/lib/facts";
 
 const suffix = process.env.TEST_RUN_ID ?? "facts-spec";
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
+const beforeAll = tenantBeforeAll(organizationId);
+const afterAll = tenantAfterAll(organizationId);
 const email = `evidence.subject.${suffix}@example.test`;
 
 let contactId: string;
@@ -13,10 +27,16 @@ const seen = (kind: Evidence["kind"], detail = "observed"): Evidence => ({
 	detail,
 });
 
+const recordFact = (input: RecordFactInput) =>
+	runInTenant(organizationId, () => recordFactInTenant(input));
+
+const writeBrief = (input: Parameters<typeof writeBriefInTenant>[0]) =>
+	runInTenant(organizationId, () => writeBriefInTenant(input));
+
 beforeAll(async () => {
 	await db.contact.deleteMany({ where: { email } });
 	const contact = await db.contact.create({
-		data: { firstName: "Subject", lastName: null, email },
+		data: { organizationId, firstName: "Subject", lastName: null, email },
 		select: { id: true },
 	});
 	contactId = contact.id;
diff --git a/apps/agent/test/fields.integration.spec.ts b/apps/agent/test/fields.integration.spec.ts
new file mode 100644
index 000000000..9c86b298e
--- /dev/null
+++ b/apps/agent/test/fields.integration.spec.ts
@@ -0,0 +1,127 @@
+import { describe, expect } from "bun:test";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterAll,
+	tenantBeforeAll,
+	tenantTest,
+} from "@crm/db/test-support";
+import {
+	archiveField,
+	createField,
+	listFields,
+	readFields,
+	updateFieldBrief,
+	writeField,
+} from "../agent/lib/fields";
+
+const suffix = process.env.TEST_RUN_ID ?? crypto.randomUUID();
+const organizationId = `fields-org-${suffix}`;
+const it = tenantTest(organizationId);
+const beforeAll = tenantBeforeAll(organizationId);
+const afterAll = tenantAfterAll(organizationId);
+const contactId = `fields-contact-${suffix}`;
+
+beforeAll(async () => {
+	await db.organization.create({
+		data: {
+			id: organizationId,
+			name: "Fields Test",
+			slug: organizationId,
+			createdAt: new Date(),
+		},
+	});
+	await db.contact.create({
+		data: {
+			id: contactId,
+			organizationId,
+			firstName: "Field",
+			email: `${suffix}@fields.test`,
+		},
+	});
+});
+
+afterAll(async () => {
+	await db.organization.delete({ where: { id: organizationId } });
+});
+
+describe("custom field persistence", () => {
+	it("creates, writes, updates, reads, and archives through tenant transactions", async () => {
+		await runInTenant(organizationId, async () => {
+			const created = await createField({
+				entity: "CONTACT",
+				label: "Research Note",
+				type: "TEXT",
+				agentBrief: "Record verified research.",
+			});
+
+			if ("created" in created) throw new Error(created.reason);
+			expect(created.key).toBe("research_note");
+
+			const listed = await listFields("CONTACT");
+			expect(listed.map((field) => field.key)).toContain("research_note");
+
+			const written = await writeField({
+				entity: "CONTACT",
+				recordId: contactId,
+				key: "research_note",
+				value: "Confirmed by the customer.",
+			});
+			expect(written).toEqual({
+				written: true,
+				key: "research_note",
+				value: "Confirmed by the customer.",
+			});
+
+			const fields = await readFields("CONTACT", contactId);
+			expect(fields.find((field) => field.key === "research_note")?.value).toBe(
+				"Confirmed by the customer.",
+			);
+
+			const updated = await updateFieldBrief({
+				entity: "CONTACT",
+				key: "research_note",
+				agentBrief: "A rep maintains this field.",
+				agentFilled: false,
+			});
+			if ("updated" in updated) throw new Error(updated.reason);
+			expect(updated.agentFilled).toBe(false);
+
+			const refused = await writeField({
+				entity: "CONTACT",
+				recordId: contactId,
+				key: "research_note",
+				value: "Agent replacement",
+			});
+			expect(refused.written).toBe(false);
+
+			expect(
+				await archiveField({ entity: "CONTACT", key: "research_note" }),
+			).toEqual({ archived: true });
+			expect(await listFields("CONTACT")).toEqual([]);
+		});
+	});
+
+	it("rejects a field write when the record does not exist", async () => {
+		await runInTenant(organizationId, async () => {
+			const created = await createField({
+				entity: "CONTACT",
+				label: "Source Detail",
+				type: "TEXT",
+			});
+			if ("created" in created) throw new Error(created.reason);
+
+			const result = await writeField({
+				entity: "CONTACT",
+				recordId: "missing-contact",
+				key: created.key,
+				value: "Never stored",
+			});
+
+			expect(result).toEqual({
+				written: false,
+				reason: 'There is no contact with id "missing-contact".',
+			});
+		});
+	});
+});
diff --git a/apps/agent/test/kaneo.integration.spec.ts b/apps/agent/test/kaneo.integration.spec.ts
new file mode 100644
index 000000000..1f4a45721
--- /dev/null
+++ b/apps/agent/test/kaneo.integration.spec.ts
@@ -0,0 +1,136 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { WORKSPACE_ID } from "@crm/db/workspace";
+import { listProjects, listTasks, readTask } from "../agent/lib/kaneo";
+import {
+	addTaskComment,
+	createTask,
+	updateTask,
+} from "../agent/lib/kaneo-writes";
+
+const OWNER_ID = "kaneo-agent-test-owner";
+
+describe("kaneo agent operations", () => {
+	let projectId: string;
+
+	beforeAll(async () => {
+		await db.organization.upsert({
+			where: { id: WORKSPACE_ID },
+			create: {
+				id: WORKSPACE_ID,
+				name: "Agent test",
+				slug: "agent-test",
+				createdAt: new Date(),
+			},
+			update: {},
+		});
+		await db.workspace.upsert({
+			where: { id: WORKSPACE_ID },
+			create: {
+				id: WORKSPACE_ID,
+				name: "Agent test",
+				slug: "agent-test",
+				createdAt: new Date(),
+			},
+			update: {},
+		});
+		await db.user.upsert({
+			where: { id: OWNER_ID },
+			create: {
+				id: OWNER_ID,
+				name: "Agent Test Owner",
+				email: `agent-owner-${Date.now()}@test.local`,
+			},
+			update: {},
+		});
+		await db.member.upsert({
+			where: {
+				organizationId_userId: {
+					organizationId: WORKSPACE_ID,
+					userId: OWNER_ID,
+				},
+			},
+			create: {
+				id: crypto.randomUUID(),
+				organizationId: WORKSPACE_ID,
+				userId: OWNER_ID,
+				role: "owner",
+				createdAt: new Date(),
+			},
+			update: { role: "owner" },
+		});
+		const project = await db.project.create({
+			data: {
+				workspaceId: WORKSPACE_ID,
+				name: "Agent integration",
+				slug: `agent-integration-${Date.now()}`,
+			},
+		});
+		projectId = project.id;
+		await db.projectColumn.createMany({
+			data: [
+				{ projectId, name: "To do", slug: "to-do", position: 0 },
+				{ projectId, name: "In progress", slug: "in-progress", position: 1 },
+				{ projectId, name: "Done", slug: "done", position: 2 },
+			],
+		});
+	});
+
+	afterAll(async () => {
+		await db.project
+			.delete({ where: { id: projectId } })
+			.catch(() => undefined);
+		await db.member
+			.delete({
+				where: {
+					organizationId_userId: {
+						organizationId: WORKSPACE_ID,
+						userId: OWNER_ID,
+					},
+				},
+			})
+			.catch(() => undefined);
+		await db.user.delete({ where: { id: OWNER_ID } }).catch(() => undefined);
+	});
+
+	it("creates tasks with sequential numbers", async () => {
+		const first = await createTask({ projectId, title: "First" });
+		const second = await createTask({
+			projectId,
+			title: "Second",
+			status: "in-progress",
+		});
+		expect(first.number).toBe(1);
+		expect(second.number).toBe(2);
+	});
+
+	it("lists tasks and projects", async () => {
+		const projects = await listProjects();
+		const found = projects.find((project) => project.id === projectId);
+		expect(found?.taskCount).toBe(2);
+
+		const all = await listTasks({ projectId });
+		expect(all).toHaveLength(2);
+
+		const open = await listTasks({ projectId, status: "to-do" });
+		expect(open).toHaveLength(1);
+	});
+
+	it("updates a task", async () => {
+		const [task] = await listTasks({ projectId });
+		const updated = await updateTask(task.id, {
+			status: "done",
+			priority: "high",
+		});
+		expect(updated.status).toBe("done");
+		expect(updated.priority).toBe("high");
+	});
+
+	it("reads a task with its comments", async () => {
+		const [task] = await listTasks({ projectId });
+		await addTaskComment(task.id, "The agent left this note.");
+		const read = await readTask(task.id);
+		expect(read?.comments).toHaveLength(1);
+		expect(read?.comments[0].content).toBe("The agent left this note.");
+	});
+});
diff --git a/apps/agent/test/keyless-brand.integration.spec.ts b/apps/agent/test/keyless-brand.integration.spec.ts
index d6487b6b9..522a34f3a 100644
--- a/apps/agent/test/keyless-brand.integration.spec.ts
+++ b/apps/agent/test/keyless-brand.integration.spec.ts
@@ -1,8 +1,16 @@
-import { afterAll, afterEach, beforeAll, describe, expect, it } from "bun:test";
-import { db, EnrichmentStatus } from "@crm/db";
+import { describe, expect } from "bun:test";
+import { EnrichmentStatus, db as rawDb } from "@crm/db";
 import { readContextDevKey, writeContextDevKey } from "@crm/db/settings";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterAll,
+	tenantAfterEach,
+	tenantBeforeAll,
+	tenantTest,
+} from "@crm/db/test-support";
 import { runBrand } from "../agent/lib/brand";
-import { settle } from "../agent/lib/enrichment";
+import { settle as settleWithoutTenant } from "../agent/lib/enrichment";
 
 /**
  * An install with no Context key still creates companies, and a `brand` task
@@ -19,6 +27,30 @@ import { settle } from "../agent/lib/enrichment";
  */
 const created: string[] = [];
 const tasks: string[] = [];
+const organizationId = `keyless-brand-${crypto.randomUUID()}`;
+const it = tenantTest(organizationId);
+const beforeAll = tenantBeforeAll(organizationId);
+const afterEach = tenantAfterEach(organizationId);
+const afterAll = tenantAfterAll(organizationId);
+const settle: typeof settleWithoutTenant = (subject, status, error) =>
+	runInTenant(organizationId, () =>
+		settleWithoutTenant(subject, status, error),
+	);
+
+beforeAll(async () => {
+	await rawDb.organization.create({
+		data: {
+			id: organizationId,
+			name: "Keyless brand tests",
+			slug: organizationId,
+			createdAt: new Date(),
+		},
+	});
+});
+
+afterAll(async () => {
+	await rawDb.organization.deleteMany({ where: { id: organizationId } });
+});
 
 afterEach(async () => {
 	if (tasks.length > 0) {
@@ -31,6 +63,7 @@ afterEach(async () => {
 async function company(status: EnrichmentStatus) {
 	const row = await db.company.create({
 		data: {
+			organizationId,
 			name: "Keyless Probe",
 			domain: `keyless-${created.length}-${status}.test`.toLowerCase(),
 			enrichmentStatus: status,
@@ -51,14 +84,14 @@ const subjectOf = (companyId: string) => ({
 });
 
 async function retiredSubjectOf(companyId: string) {
-	await db.$executeRaw`
-		UPDATE "company"
-		SET "updatedAt" = NOW() - INTERVAL '1 second'
-		WHERE id = ${companyId}
-	`;
+	await db.company.update({
+		where: { id: companyId },
+		data: { updatedAt: new Date(Date.now() - 1_000) },
+	});
 
 	const row = await db.agentTask.create({
 		data: {
+			organizationId,
 			companyId,
 			kind: "brand",
 			reason: "keyless",
@@ -138,6 +171,7 @@ describe("a brand task with no key", () => {
 async function domainlessCompany(status: EnrichmentStatus) {
 	const row = await db.company.create({
 		data: {
+			organizationId,
 			name: `Keyless Probe ${created.length}`,
 			enrichmentStatus: status,
 		},
@@ -152,28 +186,34 @@ describe("a brand task on a company with no domain", () => {
 	let key: string | null;
 
 	beforeAll(async () => {
-		key = await readContextDevKey(db);
+		key = await runInTenant(organizationId, () => readContextDevKey(db));
 	});
 
 	afterAll(async () => {
-		await writeContextDevKey(db, key ?? "");
+		await runInTenant(organizationId, () => writeContextDevKey(db, key ?? ""));
 	});
 
 	it("marks the company skipped, because no sweep will find it again", async () => {
-		await writeContextDevKey(db, "ctx-test-key");
+		await runInTenant(organizationId, () =>
+			writeContextDevKey(db, "ctx-test-key"),
+		);
 		const id = await domainlessCompany(EnrichmentStatus.PENDING);
 
-		const result = await runBrand({ companyId: id });
+		const result = await runInTenant(organizationId, () =>
+			runBrand({ companyId: id }),
+		);
 
 		expect(result.enriched).toBe(false);
 		expect(await statusOf(id)).toBe(EnrichmentStatus.SKIPPED);
 	});
 
 	it("still leaves a keyless install's company pending for the sweep", async () => {
-		await writeContextDevKey(db, "");
+		await runInTenant(organizationId, () => writeContextDevKey(db, ""));
 		const id = await domainlessCompany(EnrichmentStatus.PENDING);
 
-		const result = await runBrand({ companyId: id });
+		const result = await runInTenant(organizationId, () =>
+			runBrand({ companyId: id }),
+		);
 
 		expect(result.enriched).toBe(false);
 		expect(await statusOf(id)).toBe(EnrichmentStatus.PENDING);
diff --git a/apps/agent/test/lanes.integration.spec.ts b/apps/agent/test/lanes.integration.spec.ts
index a2cde1ce9..f2177e281 100644
--- a/apps/agent/test/lanes.integration.spec.ts
+++ b/apps/agent/test/lanes.integration.spec.ts
@@ -1,10 +1,19 @@
-import { afterEach, beforeEach, describe, expect, it } from "bun:test";
-import { db } from "@crm/db";
+import { describe, expect } from "bun:test";
 import { DIRECT_KINDS, isDirectKind, PRIORITY } from "@crm/db/agent-tasks";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterEach,
+	tenantBeforeEach,
+	tenantTest,
+} from "@crm/db/test-support";
 import { claimDue } from "../agent/lib/tasks";
 
 const REASON = "lane-test";
 const TEST_PRIORITY_OFFSET = 1_000_000;
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
+const beforeEach = tenantBeforeEach(organizationId);
+const afterEach = tenantAfterEach(organizationId);
 
 const VISIBLE = { only: DIRECT_KINDS } as const;
 const RESEARCH = { except: DIRECT_KINDS } as const;
@@ -19,6 +28,7 @@ afterEach(clear);
 async function queue(kind: string, priority: number) {
 	return db.agentTask.create({
 		data: {
+			organizationId,
 			kind,
 			reason: REASON,
 			dueAt: new Date(Date.now() - 1000),
diff --git a/apps/agent/test/lookup.integration.spec.ts b/apps/agent/test/lookup.integration.spec.ts
index c903c5650..b4922242e 100644
--- a/apps/agent/test/lookup.integration.spec.ts
+++ b/apps/agent/test/lookup.integration.spec.ts
@@ -1,10 +1,20 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { DealStage, db } from "@crm/db";
+import { describe, expect } from "bun:test";
+import { DealStage } from "@crm/db";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterAll,
+	tenantBeforeAll,
+	tenantTest,
+} from "@crm/db/test-support";
 import { listDeals, searchCrm } from "../agent/lib/lookup";
 
 const suffix = process.env.TEST_RUN_ID ?? "lookup-spec";
 const domain = `northwind-${suffix}.test`;
 const otherDomain = `brightwater-${suffix}.test`;
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
+const beforeAll = tenantBeforeAll(organizationId);
+const afterAll = tenantAfterAll(organizationId);
 
 let northwindId: string;
 let brightwaterId: string;
@@ -30,6 +40,7 @@ beforeAll(async () => {
 
 	const northwind = await db.company.create({
 		data: {
+			organizationId,
 			name: `Northwind ${suffix}`,
 			domain,
 			iconUrl: "https://cdn.example.test/northwind-icon.png",
@@ -42,13 +53,18 @@ beforeAll(async () => {
 	northwindId = northwind.id;
 
 	const brightwater = await db.company.create({
-		data: { name: `Brightwater ${suffix}`, domain: otherDomain },
+		data: {
+			organizationId,
+			name: `Brightwater ${suffix}`,
+			domain: otherDomain,
+		},
 		select: { id: true },
 	});
 	brightwaterId = brightwater.id;
 
 	const paula = await db.contact.create({
 		data: {
+			organizationId,
 			firstName: "Paula",
 			lastName: "Marchetti",
 			title: "Growth Specialist",
@@ -62,6 +78,7 @@ beforeAll(async () => {
 
 	const peter = await db.contact.create({
 		data: {
+			organizationId,
 			firstName: "Peter",
 			lastName: "Marchetti",
 			title: "Controller",
@@ -74,6 +91,7 @@ beforeAll(async () => {
 
 	const deal = await db.deal.create({
 		data: {
+			organizationId,
 			name: `Northwind renewal ${suffix}`,
 			companyId: northwindId,
 			ownerId: user.id,
@@ -87,6 +105,7 @@ beforeAll(async () => {
 
 	const freshDeal = await db.deal.create({
 		data: {
+			organizationId,
 			name: `Fresh expansion ${suffix}`,
 			companyId: northwindId,
 			ownerId: user.id,
@@ -99,6 +118,7 @@ beforeAll(async () => {
 
 	const closedDeal = await db.deal.create({
 		data: {
+			organizationId,
 			name: `Closed renewal ${suffix}`,
 			companyId: brightwaterId,
 			ownerId: user.id,
diff --git a/apps/agent/test/model.integration.spec.ts b/apps/agent/test/model.integration.spec.ts
index 13f5e17cd..73116979c 100644
--- a/apps/agent/test/model.integration.spec.ts
+++ b/apps/agent/test/model.integration.spec.ts
@@ -1,41 +1,56 @@
-import {
-	afterAll,
-	afterEach,
-	beforeAll,
-	beforeEach,
-	describe,
-	expect,
-	it,
-} from "bun:test";
-import { db, type Prisma } from "@crm/db";
+import { describe, expect } from "bun:test";
 import {
 	DEFAULT_AGENT_MODEL,
-	readAgentModel,
-	SETTINGS_ID,
-	writeAgentModel,
+	readAgentModel as readAgentModelWithoutTenant,
+	writeAgentModel as writeAgentModelWithoutTenant,
 } from "@crm/db/settings";
-import { selectedModel } from "../agent/lib/model";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterAll,
+	tenantAfterEach,
+	tenantBeforeAll,
+	tenantBeforeEach,
+	tenantTest,
+} from "@crm/db/test-support";
+import { selectedModel as selectedModelWithoutTenant } from "../agent/lib/model";
+
+const testPrefix = `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+const organizationId = `model-test-org-${testPrefix}`;
+const it = tenantTest(organizationId);
+const beforeAll = tenantBeforeAll(organizationId);
+const beforeEach = tenantBeforeEach(organizationId);
+const afterEach = tenantAfterEach(organizationId);
+const afterAll = tenantAfterAll(organizationId);
+const readAgentModel: typeof readAgentModelWithoutTenant = (client) =>
+	runInTenant(organizationId, () => readAgentModelWithoutTenant(client));
+const writeAgentModel: typeof writeAgentModelWithoutTenant = (client, input) =>
+	runInTenant(organizationId, () =>
+		writeAgentModelWithoutTenant(client, input),
+	);
+const selectedModel: typeof selectedModelWithoutTenant = () =>
+	runInTenant(organizationId, selectedModelWithoutTenant);
 
 async function clear() {
-	await db.appSetting.deleteMany({ where: { id: SETTINGS_ID } });
+	await db.appSetting.deleteMany({ where: { organizationId } });
 }
 
-/**
- * The row holds the Context key a rep typed and the model they chose, and
- * DATABASE_URL is somebody's working database. Deleting it and not putting it
- * back sends them through the research-key gate again with nothing saying why.
- */
-let saved: Prisma.AppSettingUncheckedCreateInput | null = null;
-
 beforeAll(async () => {
-	saved = await db.appSetting.findUnique({ where: { id: SETTINGS_ID } });
+	await db.organization.create({
+		data: {
+			id: organizationId,
+			name: `Model test ${testPrefix}`,
+			slug: `model-test-${testPrefix}`,
+			createdAt: new Date(),
+		},
+	});
 });
 
 beforeEach(clear);
 afterEach(clear);
 
 afterAll(async () => {
-	if (saved) await db.appSetting.create({ data: saved });
+	await db.organization.delete({ where: { id: organizationId } });
 });
 
 describe("the configured model", () => {
@@ -75,7 +90,7 @@ describe("the configured model", () => {
 		await writeAgentModel(db, { id: "openai/gpt-5.5", contextWindowTokens: 1 });
 		await writeAgentModel(db, { id: "zai/glm-5.2", contextWindowTokens: 2 });
 
-		expect(await db.appSetting.count()).toBe(1);
+		expect(await db.appSetting.count({ where: { organizationId } })).toBe(1);
 		expect((await readAgentModel(db)).id).toBe("zai/glm-5.2");
 	});
 });
diff --git a/apps/agent/test/preamble.integration.spec.ts b/apps/agent/test/preamble.integration.spec.ts
index c47b71aa9..48be0f82e 100644
--- a/apps/agent/test/preamble.integration.spec.ts
+++ b/apps/agent/test/preamble.integration.spec.ts
@@ -1,18 +1,42 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { DealStage, db } from "@crm/db";
+import { describe, expect } from "bun:test";
+import { DealStage } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb as db } from "@crm/db/tenant-scope";
 import {
-	companyPreamble,
-	composeClosing,
-	contactPreamble,
-	dealPreamble,
-	noRecordPreamble,
-	sessionPreamble,
-	workspacePreamble,
+	tenantAfterAll,
+	tenantBeforeAll,
+	tenantTest,
+} from "@crm/db/test-support";
+import {
+	companyPreamble as companyPreambleWithoutTenant,
+	composeClosing as composeClosingWithoutTenant,
+	contactPreamble as contactPreambleWithoutTenant,
+	dealPreamble as dealPreambleWithoutTenant,
+	noRecordPreamble as noRecordPreambleWithoutTenant,
+	sessionPreamble as sessionPreambleWithoutTenant,
+	workspacePreamble as workspacePreambleWithoutTenant,
 } from "../agent/lib/preamble";
-import { identity } from "../agent/lib/workspace";
+import { identity as identityWithoutTenant } from "../agent/lib/workspace";
 
 const suffix = process.env.TEST_RUN_ID ?? "preamble-spec";
 const domain = `fernhill-${suffix}.test`;
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
+const beforeAll = tenantBeforeAll(organizationId);
+const afterAll = tenantAfterAll(organizationId);
+
+const tenantBound =
+	<TArgs extends unknown[], TResult>(fn: (...args: TArgs) => TResult) =>
+	(...args: TArgs): TResult =>
+		runInTenant(organizationId, () => fn(...args));
+const companyPreamble = tenantBound(companyPreambleWithoutTenant);
+const composeClosing = tenantBound(composeClosingWithoutTenant);
+const contactPreamble = tenantBound(contactPreambleWithoutTenant);
+const dealPreamble = tenantBound(dealPreambleWithoutTenant);
+const noRecordPreamble = tenantBound(noRecordPreambleWithoutTenant);
+const sessionPreamble = tenantBound(sessionPreambleWithoutTenant);
+const workspacePreamble = tenantBound(workspacePreambleWithoutTenant);
+const identity = tenantBound(identityWithoutTenant);
 
 let companyId: string;
 let dealId: string;
@@ -36,6 +60,7 @@ beforeAll(async () => {
 
 	const company = await db.company.create({
 		data: {
+			organizationId,
 			name: `Fernhill Systems ${suffix}`,
 			domain,
 			industry: "Security software",
@@ -46,6 +71,7 @@ beforeAll(async () => {
 
 	const paula = await db.contact.create({
 		data: {
+			organizationId,
 			firstName: "Paula",
 			lastName: "Marchetti",
 			title: "Growth Specialist",
@@ -59,6 +85,7 @@ beforeAll(async () => {
 
 	const tomi = await db.contact.create({
 		data: {
+			organizationId,
 			firstName: "Tomi",
 			lastName: "Okonkwo",
 			title: "Head of Security",
@@ -71,12 +98,15 @@ beforeAll(async () => {
 
 	const deal = await db.deal.create({
 		data: {
+			organizationId,
 			name: `Fernhill platform ${suffix}`,
 			companyId,
 			ownerId: user.id,
 			stage: DealStage.CONTRACT_SENT,
 			amount: 48_000,
-			contacts: { create: [{ contactId: paulaId, role: "Champion" }] },
+			contacts: {
+				create: [{ organizationId, contactId: paulaId, role: "Champion" }],
+			},
 		},
 		select: { id: true },
 	});
@@ -86,6 +116,9 @@ beforeAll(async () => {
 afterAll(cleanup);
 
 async function cleanup(): Promise<void> {
+	await db.contact.deleteMany({
+		where: { email: `nobody.${suffix}@example.test` },
+	});
 	const company = await db.company.findFirst({
 		where: { domain },
 		select: { id: true },
@@ -143,7 +176,11 @@ describe("contactPreamble", () => {
 
 	it("offers a way out when they have no company", async () => {
 		const orphan = await db.contact.create({
-			data: { firstName: "Nobody", email: `nobody.${suffix}@example.test` },
+			data: {
+				organizationId,
+				firstName: "Nobody",
+				email: `nobody.${suffix}@example.test`,
+			},
 			select: { id: true },
 		});
 
diff --git a/apps/agent/test/slack-connection.integration.spec.ts b/apps/agent/test/slack-connection.integration.spec.ts
new file mode 100644
index 000000000..65d2600ca
--- /dev/null
+++ b/apps/agent/test/slack-connection.integration.spec.ts
@@ -0,0 +1,75 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { createTenantRows } from "@crm/db/test-support";
+import {
+	slackAccessToken,
+	slackUserToken,
+} from "../agent/lib/slack-connection";
+
+const suffix = process.env.TEST_RUN_ID ?? crypto.randomUUID();
+const organizationA = `agent-slack-a-${suffix}`;
+const organizationB = `agent-slack-b-${suffix}`;
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: [
+			{
+				id: organizationA,
+				name: "Agent Slack A",
+				slug: organizationA,
+				createdAt: new Date(),
+			},
+			{
+				id: organizationB,
+				name: "Agent Slack B",
+				slug: organizationB,
+				createdAt: new Date(),
+			},
+		],
+	});
+	await createTenantRows(
+		[
+			{
+				organizationId: organizationA,
+				teamId: `agent-slack-team-a-${suffix}`,
+				botToken: "xoxb-agent-a",
+				botScopes: "chat:write",
+				userToken: "xoxp-agent-a",
+				userScopes: "channels:read",
+			},
+			{
+				organizationId: organizationB,
+				teamId: `agent-slack-team-b-${suffix}`,
+				botToken: "xoxb-agent-b",
+				botScopes: "chat:write",
+				userToken: "xoxp-agent-b",
+				userScopes: "channels:read",
+			},
+		],
+		(row) => scopedDb.slackWorkspaceGrant.create({ data: row }),
+	);
+});
+
+afterAll(async () => {
+	await db.organization.deleteMany({
+		where: { id: { in: [organizationA, organizationB] } },
+	});
+});
+
+describe("tenant-scoped Slack runtime credentials", () => {
+	it("returns each organization's bot and user tokens", async () => {
+		const [tokensA, tokensB] = await Promise.all([
+			runInTenant(organizationA, () =>
+				Promise.all([slackAccessToken(), slackUserToken()]),
+			),
+			runInTenant(organizationB, () =>
+				Promise.all([slackAccessToken(), slackUserToken()]),
+			),
+		]);
+
+		expect(tokensA).toEqual(["xoxb-agent-a", "xoxp-agent-a"]);
+		expect(tokensB).toEqual(["xoxb-agent-b", "xoxp-agent-b"]);
+	});
+});
diff --git a/apps/agent/test/slack-membership.integration.spec.ts b/apps/agent/test/slack-membership.integration.spec.ts
index b5796ad9d..490d043af 100644
--- a/apps/agent/test/slack-membership.integration.spec.ts
+++ b/apps/agent/test/slack-membership.integration.spec.ts
@@ -1,5 +1,11 @@
-import { afterEach, beforeEach, describe, expect, it } from "bun:test";
-import { db } from "@crm/db";
+import { describe, expect } from "bun:test";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterEach,
+	tenantBeforeEach,
+	tenantTest,
+} from "@crm/db/test-support";
 import { joinSlackChannel } from "../agent/lib/slack-membership";
 
 const USER_ID = "slack-join-spec-user";
@@ -7,6 +13,10 @@ const ACCOUNT_ID = "slack-join-spec-account";
 const CHANNEL_ID = "CJOINSPEC1";
 const GRANT_ID = "slack-join-spec-grant";
 const INVENTORY_KIND = "slack-people-match";
+const ORGANIZATION_ID = "workspace";
+const it = tenantTest(ORGANIZATION_ID);
+const beforeEach = tenantBeforeEach(ORGANIZATION_ID);
+const afterEach = tenantAfterEach(ORGANIZATION_ID);
 
 const realFetch = globalThis.fetch;
 
@@ -24,6 +34,7 @@ async function connect() {
 		where: { id: ACCOUNT_ID },
 		create: {
 			id: ACCOUNT_ID,
+			issuer: "local:oauth:slack",
 			accountId: "T-JOIN-SPEC",
 			providerId: "slack",
 			userId: USER_ID,
@@ -31,6 +42,30 @@ async function connect() {
 		},
 		update: { accessToken: "xoxb-join-spec" },
 	});
+	await db.slackWorkspaceGrant.upsert({
+		where: {
+			organizationId_teamId: {
+				organizationId: ORGANIZATION_ID,
+				teamId: "T-JOIN-SPEC",
+			},
+		},
+		create: {
+			id: GRANT_ID,
+			organizationId: ORGANIZATION_ID,
+			teamId: "T-JOIN-SPEC",
+			botToken: "xoxb-join-spec",
+			botScopes: "channels:read",
+			userToken: "xoxp-join-spec",
+			userScopes: "groups:write",
+		},
+		update: {
+			organizationId: ORGANIZATION_ID,
+			botToken: "xoxb-join-spec",
+			botScopes: "channels:read",
+			userToken: "xoxp-join-spec",
+			userScopes: "groups:write",
+		},
+	});
 }
 
 function answers(error: string) {
@@ -55,6 +90,16 @@ function replies(reply: (url: string) => object) {
 let inventoryTaskIds: string[] = [];
 
 beforeEach(async () => {
+	await db.organization.upsert({
+		where: { id: ORGANIZATION_ID },
+		create: {
+			id: ORGANIZATION_ID,
+			name: "Workspace",
+			slug: "workspace",
+			createdAt: new Date(),
+		},
+		update: {},
+	});
 	requested.length = 0;
 	inventoryTaskIds = (
 		await db.agentTask.findMany({
@@ -67,6 +112,7 @@ beforeEach(async () => {
 	await db.slackChannel.create({
 		data: {
 			id: CHANNEL_ID,
+			organizationId: ORGANIZATION_ID,
 			name: "join-spec",
 			isPrivate: false,
 			isMember: false,
@@ -90,7 +136,9 @@ describe("joining a Slack channel", () => {
 	it("does not claim membership of an archived channel", async () => {
 		answers("is_archived");
 
-		const outcome = await joinSlackChannel(CHANNEL_ID);
+		const outcome = await runInTenant(ORGANIZATION_ID, () =>
+			joinSlackChannel(ORGANIZATION_ID, CHANNEL_ID),
+		);
 
 		expect(outcome.joined).toBe(false);
 		expect(outcome).toMatchObject({ needsHuman: true });
@@ -109,7 +157,9 @@ describe("joining a Slack channel", () => {
 				: { ok: false, error: "method_not_supported_for_channel_type" },
 		);
 
-		const outcome = await joinSlackChannel(CHANNEL_ID);
+		const outcome = await runInTenant(ORGANIZATION_ID, () =>
+			joinSlackChannel(ORGANIZATION_ID, CHANNEL_ID),
+		);
 
 		expect(outcome).toEqual({ joined: true, already: true });
 		expect(requested.some((url) => url.includes("conversations.join"))).toBe(
@@ -129,14 +179,6 @@ describe("joining a Slack channel", () => {
 	});
 
 	it("invites itself to a private channel a stale row calls public", async () => {
-		await db.slackWorkspaceGrant.create({
-			data: {
-				id: GRANT_ID,
-				teamId: "T-JOIN-SPEC",
-				userToken: "xoxp-join-spec",
-				userScopes: "groups:write",
-			},
-		});
 		replies((url) => {
 			if (url.includes("conversations.info")) {
 				return { ok: false, error: "channel_not_found" };
@@ -145,7 +187,9 @@ describe("joining a Slack channel", () => {
 			return { ok: true };
 		});
 
-		const outcome = await joinSlackChannel(CHANNEL_ID);
+		const outcome = await runInTenant(ORGANIZATION_ID, () =>
+			joinSlackChannel(ORGANIZATION_ID, CHANNEL_ID),
+		);
 
 		expect(outcome).toEqual({ joined: true, already: false });
 		expect(requested.some((url) => url.includes("conversations.invite"))).toBe(
@@ -165,7 +209,9 @@ describe("joining a Slack channel", () => {
 	it("accepts a channel Slack says it is already in", async () => {
 		answers("already_in_channel");
 
-		const outcome = await joinSlackChannel(CHANNEL_ID);
+		const outcome = await runInTenant(ORGANIZATION_ID, () =>
+			joinSlackChannel(ORGANIZATION_ID, CHANNEL_ID),
+		);
 
 		expect(outcome).toEqual({ joined: true, already: true });
 
diff --git a/apps/agent/test/slack-people.integration.spec.ts b/apps/agent/test/slack-people.integration.spec.ts
index 91fc768d7..a62712cba 100644
--- a/apps/agent/test/slack-people.integration.spec.ts
+++ b/apps/agent/test/slack-people.integration.spec.ts
@@ -1,5 +1,11 @@
-import { afterEach, beforeEach, describe, expect, it } from "bun:test";
-import { db } from "@crm/db";
+import { describe, expect } from "bun:test";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterEach,
+	tenantBeforeEach,
+	tenantTest,
+} from "@crm/db/test-support";
 import {
 	persistSlackChannels,
 	refreshSlackChannels,
@@ -8,6 +14,13 @@ import {
 const USER_ID = "slack-people-spec-user";
 const ACCOUNT_ID = "slack-people-spec-account";
 const PREFIX = "CSPEC";
+const ORGANIZATION_ID = "workspace";
+const it = tenantTest(ORGANIZATION_ID);
+const beforeEach = tenantBeforeEach(ORGANIZATION_ID);
+const afterEach = tenantAfterEach(ORGANIZATION_ID);
+const OTHER_ORGANIZATION_ID = "slack-people-other-workspace";
+const OTHER_USER_ID = "slack-people-other-user";
+const OTHER_ACCOUNT_ID = "slack-people-other-account";
 
 const realFetch = globalThis.fetch;
 
@@ -27,6 +40,7 @@ async function connect() {
 		where: { id: ACCOUNT_ID },
 		create: {
 			id: ACCOUNT_ID,
+			issuer: "local:oauth:slack",
 			accountId: "T-SPEC",
 			providerId: "slack",
 			userId: USER_ID,
@@ -34,14 +48,46 @@ async function connect() {
 		},
 		update: { accessToken: "xoxb-spec" },
 	});
+	await db.slackWorkspaceGrant.upsert({
+		where: {
+			organizationId_teamId: {
+				organizationId: ORGANIZATION_ID,
+				teamId: "T-SPEC",
+			},
+		},
+		create: {
+			organizationId: ORGANIZATION_ID,
+			teamId: "T-SPEC",
+			botToken: "xoxb-spec",
+			botScopes: "channels:read",
+			userToken: "xoxp-spec",
+			userScopes: "channels:read",
+		},
+		update: {
+			organizationId: ORGANIZATION_ID,
+			botToken: "xoxb-spec",
+			botScopes: "channels:read",
+		},
+	});
 }
 
 async function disconnect() {
 	await db.account.deleteMany({ where: { providerId: "slack" } });
+	await db.slackWorkspaceGrant.deleteMany({ where: { teamId: "T-SPEC" } });
 	await db.slackChannel.deleteMany({ where: { id: { startsWith: PREFIX } } });
 }
 
 beforeEach(async () => {
+	await db.organization.upsert({
+		where: { id: ORGANIZATION_ID },
+		create: {
+			id: ORGANIZATION_ID,
+			name: "Workspace",
+			slug: "workspace",
+			createdAt: new Date(),
+		},
+		update: {},
+	});
 	restore = await db.slackChannel.findMany({
 		select: { id: true, available: true },
 	});
@@ -53,6 +99,11 @@ afterEach(async () => {
 	globalThis.fetch = realFetch;
 	await db.slackChannel.deleteMany({ where: { id: { startsWith: PREFIX } } });
 	await db.account.deleteMany({ where: { id: ACCOUNT_ID } });
+	await db.slackWorkspaceGrant.deleteMany({ where: { teamId: "T-SPEC" } });
+	await db.slackWorkspaceGrant.deleteMany({ where: { teamId: "T-OTHER" } });
+	await db.account.deleteMany({ where: { id: OTHER_ACCOUNT_ID } });
+	await db.user.deleteMany({ where: { id: OTHER_USER_ID } });
+	await db.organization.deleteMany({ where: { id: OTHER_ORGANIZATION_ID } });
 	await db.user.deleteMany({ where: { id: USER_ID } });
 	for (const row of restore) {
 		await db.slackChannel.updateMany({
@@ -88,34 +139,43 @@ describe("persistSlackChannels", () => {
 		await db.slackChannel.create({
 			data: {
 				id: `${PREFIX}-keep`,
+				organizationId: ORGANIZATION_ID,
 				name: "old-name",
 				memberCount: 1,
 				available: false,
 			},
 		});
 		await db.slackChannel.create({
-			data: { id: `${PREFIX}-gone`, name: "gone", available: true },
+			data: {
+				id: `${PREFIX}-gone`,
+				organizationId: ORGANIZATION_ID,
+				name: "gone",
+				available: true,
+			},
 		});
 
-		const written = await persistSlackChannels(
-			[
-				{
-					id: `${PREFIX}-keep`,
-					name: "keep",
-					num_members: 12,
-					is_member: true,
-				},
-				{
-					id: `${PREFIX}-new`,
-					name: "new",
-					num_members: 3,
-					is_private: true,
-					is_member: false,
-				},
-				{ id: `${PREFIX}-quiet`, name: "quiet", is_member: true },
-				{ id: `${PREFIX}-archived`, name: "archived", is_archived: true },
-			],
-			true,
+		const written = await runInTenant(ORGANIZATION_ID, () =>
+			persistSlackChannels(
+				[
+					{
+						id: `${PREFIX}-keep`,
+						name: "keep",
+						num_members: 12,
+						is_member: true,
+					},
+					{
+						id: `${PREFIX}-new`,
+						name: "new",
+						num_members: 3,
+						is_private: true,
+						is_member: false,
+					},
+					{ id: `${PREFIX}-quiet`, name: "quiet", is_member: true },
+					{ id: `${PREFIX}-archived`, name: "archived", is_archived: true },
+				],
+				true,
+				ORGANIZATION_ID,
+			),
 		);
 
 		expect(written).toBe(3);
@@ -170,14 +230,24 @@ describe("persistSlackChannels", () => {
 	});
 
 	it("retires every channel when nothing is available", async () => {
+		const emptyId = `${PREFIX}-empty-${crypto.randomUUID()}`;
 		await db.slackChannel.create({
-			data: { id: `${PREFIX}-only`, name: "only", available: true },
+			data: {
+				id: emptyId,
+				organizationId: ORGANIZATION_ID,
+				name: "only",
+				available: true,
+			},
 		});
 
-		expect(await persistSlackChannels([], false)).toBe(0);
+		expect(
+			await runInTenant(ORGANIZATION_ID, () =>
+				persistSlackChannels([], false, ORGANIZATION_ID),
+			),
+		).toBe(0);
 
 		const row = await db.slackChannel.findUnique({
-			where: { id: `${PREFIX}-only` },
+			where: { id: emptyId },
 			select: { available: true },
 		});
 		expect(row?.available).toBe(false);
@@ -186,9 +256,12 @@ describe("persistSlackChannels", () => {
 	it("writes nothing when Slack is disconnected", async () => {
 		await disconnect();
 
-		const written = await persistSlackChannels(
-			[{ id: `${PREFIX}-ghost`, name: "ghost", is_member: true }],
-			false,
+		const written = await runInTenant(ORGANIZATION_ID, () =>
+			persistSlackChannels(
+				[{ id: `${PREFIX}-ghost`, name: "ghost", is_member: true }],
+				false,
+				ORGANIZATION_ID,
+			),
 		);
 
 		expect(written).toBe(0);
@@ -196,6 +269,60 @@ describe("persistSlackChannels", () => {
 			await db.slackChannel.count({ where: { id: `${PREFIX}-ghost` } }),
 		).toBe(0);
 	});
+
+	it("ignores another organization's active Slack connection", async () => {
+		await disconnect();
+		await db.organization.create({
+			data: {
+				id: OTHER_ORGANIZATION_ID,
+				name: "Other Workspace",
+				slug: OTHER_ORGANIZATION_ID,
+				createdAt: new Date(),
+			},
+		});
+		await db.user.create({
+			data: {
+				id: OTHER_USER_ID,
+				name: "Other Slack User",
+				email: `${OTHER_USER_ID}@example.com`,
+			},
+		});
+		await db.account.create({
+			data: {
+				id: OTHER_ACCOUNT_ID,
+				issuer: "local:oauth:slack",
+				accountId: "T-OTHER",
+				providerId: "slack",
+				userId: OTHER_USER_ID,
+				accessToken: "xoxb-other",
+			},
+		});
+		await runInTenant(OTHER_ORGANIZATION_ID, () =>
+			db.slackWorkspaceGrant.create({
+				data: {
+					organizationId: OTHER_ORGANIZATION_ID,
+					teamId: "T-OTHER",
+					botToken: "xoxb-other",
+					botScopes: "channels:read",
+					userToken: "xoxp-other",
+					userScopes: "channels:read",
+				},
+			}),
+		);
+
+		const written = await runInTenant(ORGANIZATION_ID, () =>
+			persistSlackChannels(
+				[{ id: `${PREFIX}-other`, name: "other", is_member: true }],
+				false,
+				ORGANIZATION_ID,
+			),
+		);
+
+		expect(written).toBe(0);
+		expect(
+			await db.slackChannel.count({ where: { id: `${PREFIX}-other` } }),
+		).toBe(0);
+	});
 });
 
 describe("refreshSlackChannels", () => {
@@ -209,7 +336,9 @@ describe("refreshSlackChannels", () => {
 			return slackReply({ ok: true, channels: [] });
 		}) as typeof fetch;
 
-		await refreshSlackChannels();
+		await runInTenant(ORGANIZATION_ID, () =>
+			refreshSlackChannels(ORGANIZATION_ID),
+		);
 
 		expect(signal).toBeInstanceOf(AbortSignal);
 	});
@@ -235,7 +364,11 @@ describe("refreshSlackChannels", () => {
 			});
 		}) as unknown as typeof fetch;
 
-		expect(await refreshSlackChannels()).toBe(2);
+		expect(
+			await runInTenant(ORGANIZATION_ID, () =>
+				refreshSlackChannels(ORGANIZATION_ID),
+			),
+		).toBe(2);
 		expect([...new Set(seen)]).toEqual(["", "page-2"]);
 	});
 
@@ -248,7 +381,11 @@ describe("refreshSlackChannels", () => {
 			});
 		}) as typeof fetch;
 
-		expect(await refreshSlackChannels()).toBe(0);
+		expect(
+			await runInTenant(ORGANIZATION_ID, () =>
+				refreshSlackChannels(ORGANIZATION_ID),
+			),
+		).toBe(0);
 		expect(
 			await db.slackChannel.count({ where: { id: { startsWith: PREFIX } } }),
 		).toBe(0);
@@ -258,7 +395,9 @@ describe("refreshSlackChannels", () => {
 		globalThis.fetch = (async () =>
 			slackReply({ ok: false, error: "missing_scope" })) as typeof fetch;
 
-		expect(refreshSlackChannels()).rejects.toThrow(
+		expect(
+			runInTenant(ORGANIZATION_ID, () => refreshSlackChannels(ORGANIZATION_ID)),
+		).rejects.toThrow(
 			"Slack channel lookup needs an additional permission. Reconnect Slack and retry.",
 		);
 	});
diff --git a/apps/agent/test/stale-tasks.integration.spec.ts b/apps/agent/test/stale-tasks.integration.spec.ts
index adc78db18..c2ee5185f 100644
--- a/apps/agent/test/stale-tasks.integration.spec.ts
+++ b/apps/agent/test/stale-tasks.integration.spec.ts
@@ -1,11 +1,23 @@
-import { afterEach, beforeEach, describe, expect, it } from "bun:test";
-import { db, EnrichmentStatus } from "@crm/db";
+import { describe, expect } from "bun:test";
+import { EnrichmentStatus, db as rawDb } from "@crm/db";
 import { MAX_ATTEMPTS, RETIRED_OUTCOME } from "@crm/db/agent-tasks";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterEach,
+	tenantBeforeEach,
+	tenantTest,
+} from "@crm/db/test-support";
 import { reconcileStaleTasks } from "../agent/lib/stale-tasks";
 
 const kind = "recheck";
 
 const REASON = "stale-spec";
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
+const beforeEach = tenantBeforeEach(organizationId);
+const afterEach = tenantAfterEach(organizationId);
+const otherOrganizationId = "stale-other-workspace";
 
 const MINUTE_MS = 60_000;
 
@@ -13,32 +25,68 @@ async function clear() {
 	await db.agentTask.deleteMany({ where: { reason: REASON } });
 	await db.contact.deleteMany({ where: { email: { startsWith: "stale-" } } });
 	await db.company.deleteMany({ where: { name: { startsWith: "Stale Co " } } });
+	await db.organization.deleteMany({ where: { id: otherOrganizationId } });
+	await db.organization.upsert({
+		where: { id: organizationId },
+		create: {
+			id: organizationId,
+			name: "Workspace",
+			slug: "workspace",
+			createdAt: new Date(),
+		},
+		update: {},
+	});
 }
 
 beforeEach(clear);
 afterEach(clear);
 
-async function someone(status: EnrichmentStatus, enrichedAt?: Date) {
-	return db.contact.create({
+async function createOtherOrganization() {
+	await db.organization.create({
 		data: {
-			firstName: "Stale",
-			email: `stale-${crypto.randomUUID()}@example.test`,
-			enrichmentStatus: status,
-			enrichedAt: enrichedAt ?? null,
+			id: otherOrganizationId,
+			name: "Other Workspace",
+			slug: otherOrganizationId,
+			createdAt: new Date(),
 		},
-		select: { id: true },
 	});
 }
 
-async function anAccount(status: EnrichmentStatus, enrichedAt?: Date) {
-	return db.company.create({
-		data: {
-			name: `Stale Co ${crypto.randomUUID()}`,
-			enrichmentStatus: status,
-			enrichedAt: enrichedAt ?? null,
-		},
-		select: { id: true },
-	});
+async function someone(
+	status: EnrichmentStatus,
+	enrichedAt?: Date,
+	workspaceId = organizationId,
+) {
+	return runInTenant(workspaceId, () =>
+		db.contact.create({
+			data: {
+				firstName: "Stale",
+				email: `stale-${crypto.randomUUID()}@example.test`,
+				organizationId: workspaceId,
+				enrichmentStatus: status,
+				enrichedAt: enrichedAt ?? null,
+			},
+			select: { id: true },
+		}),
+	);
+}
+
+async function anAccount(
+	status: EnrichmentStatus,
+	enrichedAt?: Date,
+	workspaceId = organizationId,
+) {
+	return runInTenant(workspaceId, () =>
+		db.company.create({
+			data: {
+				name: `Stale Co ${crypto.randomUUID()}`,
+				organizationId: workspaceId,
+				enrichmentStatus: status,
+				enrichedAt: enrichedAt ?? null,
+			},
+			select: { id: true },
+		}),
+	);
 }
 
 async function queue(overrides: {
@@ -49,29 +97,36 @@ async function queue(overrides: {
 	dueAt?: Date;
 	startedAt?: Date | null;
 	leasedUntil?: Date | null;
+	organizationId?: string;
 }) {
-	return db.agentTask.create({
-		data: {
-			kind: overrides.kind ?? (overrides.companyId ? "brand" : kind),
-			reason: REASON,
-			dueAt: overrides.dueAt ?? new Date(Date.now() - MINUTE_MS),
-			priority: 0,
-			budget: 4,
-			contactId: overrides.contactId ?? null,
-			companyId: overrides.companyId ?? null,
-			attempts: overrides.attempts ?? 0,
-			startedAt: overrides.startedAt ?? null,
-			leasedUntil: overrides.leasedUntil ?? null,
-		},
-		select: { id: true },
-	});
+	const tenant = overrides.organizationId ?? organizationId;
+	return runInTenant(tenant, () =>
+		db.agentTask.create({
+			data: {
+				organizationId: overrides.organizationId ?? organizationId,
+				kind: overrides.kind ?? (overrides.companyId ? "brand" : kind),
+				reason: REASON,
+				dueAt: overrides.dueAt ?? new Date(Date.now() - MINUTE_MS),
+				priority: 0,
+				budget: 4,
+				contactId: overrides.contactId ?? null,
+				companyId: overrides.companyId ?? null,
+				attempts: overrides.attempts ?? 0,
+				startedAt: overrides.startedAt ?? null,
+				leasedUntil: overrides.leasedUntil ?? null,
+			},
+			select: { id: true },
+		}),
+	);
 }
 
-async function row(id: string) {
-	return db.agentTask.findUnique({
-		where: { id },
-		select: { finishedAt: true, outcome: true, leasedUntil: true },
-	});
+async function row(id: string, tenant = organizationId) {
+	return runInTenant(tenant, () =>
+		db.agentTask.findUnique({
+			where: { id },
+			select: { finishedAt: true, outcome: true, leasedUntil: true },
+		}),
+	);
 }
 
 describe("a task whose lease ran out", () => {
@@ -240,21 +295,24 @@ describe("a task whose record is already done", () => {
 			leasedUntil: new Date(Date.now() - MINUTE_MS),
 		});
 
-		const findMany = db.agentTask.findMany;
-		db.agentTask.findMany = async (...args) => {
-			const rows = await findMany.apply(db.agentTask, args);
-			await db.agentTask.update({
-				where: { id: task.id },
-				data: { leasedUntil: new Date(Date.now() + 10 * MINUTE_MS) },
-			});
-
-			return rows;
+		const organizationCount = await db.organization.count();
+		const transaction = rawDb.$transaction.bind(rawDb);
+		let calls = 0;
+		rawDb.$transaction = async (...args) => {
+			calls += 1;
+			if (calls === organizationCount + 1) {
+				await db.agentTask.update({
+					where: { id: task.id },
+					data: { leasedUntil: new Date(Date.now() + 10 * MINUTE_MS) },
+				});
+			}
+			return transaction(...args);
 		};
 
 		try {
 			await reconcileStaleTasks();
 		} finally {
-			db.agentTask.findMany = findMany;
+			rawDb.$transaction = transaction;
 		}
 
 		expect((await row(task.id))?.finishedAt).toBeNull();
@@ -297,6 +355,31 @@ describe("a task whose record is already done", () => {
 	});
 });
 
+describe("multiple workspaces", () => {
+	it("reconciles stale tasks in every workspace", async () => {
+		await createOtherOrganization();
+		const first = await queue({
+			contactId: (await someone(EnrichmentStatus.RUNNING)).id,
+			attempts: 1,
+			leasedUntil: new Date(Date.now() - MINUTE_MS),
+		});
+		const second = await queue({
+			contactId: (
+				await someone(EnrichmentStatus.RUNNING, undefined, otherOrganizationId)
+			).id,
+			attempts: 1,
+			leasedUntil: new Date(Date.now() - MINUTE_MS),
+			organizationId: otherOrganizationId,
+		});
+
+		const sweep = await reconcileStaleTasks();
+
+		expect(sweep.released).toBeGreaterThanOrEqual(2);
+		expect((await row(first.id))?.leasedUntil).toBeNull();
+		expect((await row(second.id, otherOrganizationId))?.leasedUntil).toBeNull();
+	});
+});
+
 describe("running it twice", () => {
 	it("changes nothing the second time", async () => {
 		const startedAt = new Date(Date.now() - 30 * MINUTE_MS);
@@ -336,8 +419,8 @@ describe("running it twice", () => {
 	});
 
 	it("reports a database failure instead of throwing", async () => {
-		const findMany = db.agentTask.findMany;
-		db.agentTask.findMany = () => {
+		const findMany = rawDb.organization.findMany;
+		rawDb.organization.findMany = () => {
 			throw new Error("the database is unreachable");
 		};
 
@@ -346,7 +429,7 @@ describe("running it twice", () => {
 			expect(sweep.error).toBe("the database is unreachable");
 			expect(sweep.scanned).toBe(0);
 		} finally {
-			db.agentTask.findMany = findMany;
+			rawDb.organization.findMany = findMany;
 		}
 
 		expect((await reconcileStaleTasks()).error).toBeNull();
@@ -360,16 +443,20 @@ describe("running it twice", () => {
 			leasedUntil: new Date(Date.now() - MINUTE_MS),
 		});
 
-		const updateMany = db.agentTask.updateMany;
-		db.agentTask.updateMany = () => {
-			throw new Error("the write failed");
+		const organizationCount = await db.organization.count();
+		const transaction = rawDb.$transaction.bind(rawDb);
+		let calls = 0;
+		rawDb.$transaction = async (...args) => {
+			calls += 1;
+			if (calls === organizationCount + 1) throw new Error("the write failed");
+			return transaction(...args);
 		};
 
 		let sweep: Awaited<ReturnType<typeof reconcileStaleTasks>>;
 		try {
 			sweep = await reconcileStaleTasks();
 		} finally {
-			db.agentTask.updateMany = updateMany;
+			rawDb.$transaction = transaction;
 		}
 
 		expect(sweep.error).toBe("the write failed");
diff --git a/apps/agent/test/tasks.integration.spec.ts b/apps/agent/test/tasks.integration.spec.ts
index 3100f0c1f..2031cc155 100644
--- a/apps/agent/test/tasks.integration.spec.ts
+++ b/apps/agent/test/tasks.integration.spec.ts
@@ -1,39 +1,80 @@
-import { afterEach, beforeEach, describe, expect, it } from "bun:test";
-import { db } from "@crm/db";
-import { DIRECT_KINDS } from "@crm/db/agent-tasks";
+import { describe, expect } from "bun:test";
+import { DIRECT_KINDS, MAX_ATTEMPTS } from "@crm/db/agent-tasks";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	tenantAfterEach,
+	tenantBeforeEach,
+	tenantTest,
+} from "@crm/db/test-support";
 import {
 	claimDue,
 	completeTask,
-	MAX_ATTEMPTS,
 	retireExhausted,
 	scheduleTask,
 } from "../agent/lib/tasks";
 
 const kind = "test-lease";
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
+const beforeEach = tenantBeforeEach(organizationId);
+const afterEach = tenantAfterEach(organizationId);
+const otherOrganizationId = "task-queue-other-workspace";
 
 const RESEARCH = { except: DIRECT_KINDS } as const;
 
 async function clear() {
 	await db.agentTask.deleteMany({ where: { kind } });
 	await db.contact.deleteMany({ where: { email: { startsWith: "lease-" } } });
+	await db.organization.deleteMany({ where: { id: otherOrganizationId } });
+	await db.organization.upsert({
+		where: { id: organizationId },
+		create: {
+			id: organizationId,
+			name: "Workspace",
+			slug: "workspace",
+			createdAt: new Date(),
+		},
+		update: {},
+	});
 }
 
 beforeEach(clear);
 afterEach(clear);
 
 async function queue(
-	overrides: { priority?: number; dueAt?: Date; contactId?: string } = {},
+	overrides: {
+		priority?: number;
+		dueAt?: Date;
+		contactId?: string;
+		organizationId?: string;
+	} = {},
 ) {
-	return db.agentTask.create({
+	const tenant = overrides.organizationId ?? organizationId;
+	return runInTenant(tenant, () =>
+		db.agentTask.create({
+			data: {
+				kind,
+				reason: "test",
+				dueAt: overrides.dueAt ?? new Date(Date.now() - 1000),
+				priority: overrides.priority ?? 0,
+				budget: 4,
+				organizationId: overrides.organizationId ?? organizationId,
+				contactId: overrides.contactId ?? null,
+			},
+			select: { id: true },
+		}),
+	);
+}
+
+async function createOtherOrganization() {
+	await db.organization.create({
 		data: {
-			kind,
-			reason: "test",
-			dueAt: overrides.dueAt ?? new Date(Date.now() - 1000),
-			priority: overrides.priority ?? 0,
-			budget: 4,
-			contactId: overrides.contactId ?? null,
+			id: otherOrganizationId,
+			name: "Other Workspace",
+			slug: otherOrganizationId,
+			createdAt: new Date(),
 		},
-		select: { id: true },
 	});
 }
 
@@ -49,6 +90,7 @@ async function someone() {
 		data: {
 			firstName: "Lease",
 			email: `lease-${crypto.randomUUID()}@example.test`,
+			organizationId,
 		},
 		select: { id: true },
 	});
@@ -66,6 +108,15 @@ describe("claimDue", () => {
 		expect(row?.startedAt).not.toBeNull();
 	});
 
+	it("returns the organizationId on every leased row", async () => {
+		const task = await queue();
+
+		const [claimed] = await claimDue(10, RESEARCH);
+
+		expect(claimed?.id).toBe(task.id);
+		expect(claimed?.organizationId).toBe(organizationId);
+	});
+
 	it("does not hand the same row to two dispatchers", async () => {
 		await Promise.all([queue(), queue(), queue()]);
 
@@ -94,6 +145,20 @@ describe("claimDue", () => {
 		expect(claimed[0]?.id).not.toBe(low.id);
 	});
 
+	it("takes the most urgent task across workspaces", async () => {
+		await createOtherOrganization();
+		const low = await queue({ priority: 0 });
+		const high = await queue({
+			priority: 100,
+			organizationId: otherOrganizationId,
+		});
+
+		const claimed = await claimDue(1, RESEARCH);
+		expect(claimed[0]?.id).toBe(high.id);
+		expect(claimed[0]?.id).not.toBe(low.id);
+		expect(claimed[0]?.organizationId).toBe(otherOrganizationId);
+	});
+
 	it("does not re-claim a leased row, and does re-claim an expired one", async () => {
 		const task = await queue();
 		await claimDue(10, RESEARCH);
@@ -132,7 +197,7 @@ describe("claimDue", () => {
 	it("stops claiming once the work is finished", async () => {
 		const task = await queue();
 		await claimDue(10, RESEARCH);
-		await completeTask(task.id, "ran");
+		await runInTenant(organizationId, () => completeTask(task.id, "ran"));
 
 		await db.agentTask.update({
 			where: { id: task.id },
@@ -182,7 +247,9 @@ describe("retireExhausted", () => {
 
 	it("retires no more rows than the limit allows", async () => {
 		const mine: string[] = [];
-		for (let row = 0; row < 3; row++) mine.push((await queue()).id);
+		for (let row = 0; row < 3; row++) {
+			mine.push((await queue({ dueAt: new Date(0) })).id);
+		}
 
 		for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
 			const claimed = await claimDue(10, RESEARCH);
@@ -198,6 +265,31 @@ describe("retireExhausted", () => {
 		});
 		expect(open).toBe(0);
 	});
+
+	it("retires the oldest exhausted task across workspaces", async () => {
+		await createOtherOrganization();
+		const newer = await queue({ dueAt: new Date(1000) });
+		const older = await queue({
+			dueAt: new Date(0),
+			organizationId: otherOrganizationId,
+		});
+		await Promise.all([
+			db.agentTask.update({
+				where: { id: newer.id },
+				data: { attempts: MAX_ATTEMPTS },
+			}),
+			runInTenant(otherOrganizationId, () =>
+				db.agentTask.update({
+					where: { id: older.id },
+					data: { attempts: MAX_ATTEMPTS },
+				}),
+			),
+		]);
+
+		const retired = await retireExhausted(1);
+		expect(retired.map(({ id }) => id)).toEqual([older.id]);
+		expect(retired[0]?.organizationId).toBe(otherOrganizationId);
+	});
 });
 
 describe("completeTask", () => {
@@ -206,10 +298,16 @@ describe("completeTask", () => {
 		const task = await queue({ contactId: contact.id });
 		await claimDue(10, RESEARCH);
 
-		const subject = await completeTask(task.id, "ran");
+		const subject = await runInTenant(organizationId, () =>
+			completeTask(task.id, "ran"),
+		);
 		expect(subject?.contactId).toBe(contact.id);
 
-		expect(await completeTask(task.id, "ran again")).toBeNull();
+		expect(
+			await runInTenant(organizationId, () =>
+				completeTask(task.id, "ran again"),
+			),
+		).toBeNull();
 		const row = await db.agentTask.findUnique({ where: { id: task.id } });
 		expect(row?.outcome).toBe("ran");
 	});
@@ -218,11 +316,14 @@ describe("completeTask", () => {
 describe("scheduleTask", () => {
 	it("books work with the agent's own reason", async () => {
 		const dueAt = new Date(Date.now() + 14 * 24 * 60 * 60 * 1000);
-		const { id } = await scheduleTask({
-			kind,
-			reason: "a job change here would move the Acme deal",
-			dueAt,
-		});
+		const { id } = await runInTenant(organizationId, () =>
+			scheduleTask({
+				organizationId,
+				kind,
+				reason: "a job change here would move the Acme deal",
+				dueAt,
+			}),
+		);
 
 		const row = await db.agentTask.findUnique({ where: { id } });
 		expect(row?.reason).toContain("Acme");
@@ -232,8 +333,12 @@ describe("scheduleTask", () => {
 		const soon = new Date(Date.now() + 1000);
 		const later = new Date(Date.now() + 90 * 24 * 60 * 60 * 1000);
 
-		const first = await scheduleTask({ kind, reason: "first", dueAt: soon });
-		const second = await scheduleTask({ kind, reason: "second", dueAt: later });
+		const first = await runInTenant(organizationId, () =>
+			scheduleTask({ organizationId, kind, reason: "first", dueAt: soon }),
+		);
+		const second = await runInTenant(organizationId, () =>
+			scheduleTask({ organizationId, kind, reason: "second", dueAt: later }),
+		);
 
 		expect(second.id).toBe(first.id);
 		expect(await db.agentTask.count({ where: { kind } })).toBe(1);
diff --git a/apps/agent/test/xmpp-task-store.integration.spec.ts b/apps/agent/test/xmpp-task-store.integration.spec.ts
new file mode 100644
index 000000000..35fad1326
--- /dev/null
+++ b/apps/agent/test/xmpp-task-store.integration.spec.ts
@@ -0,0 +1,113 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { XMPP_EXPORT } from "../src/xmpp/config";
+import { PostgresXmppTaskStore } from "../src/xmpp/task-store";
+
+const suffix = crypto.randomUUID();
+const organizationId = `xmpp-store-${suffix}`;
+const otherOrganizationId = `xmpp-store-other-${suffix}`;
+const store = new PostgresXmppTaskStore(organizationId);
+const LEASE_EXPIRATION_MARGIN_MS = 1;
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: [
+			{
+				id: organizationId,
+				name: "XMPP Store Test",
+				slug: organizationId,
+				createdAt: new Date(),
+			},
+			{
+				id: otherOrganizationId,
+				name: "XMPP Store Other Test",
+				slug: otherOrganizationId,
+				createdAt: new Date(),
+			},
+		],
+	});
+});
+
+afterAll(async () => {
+	await db.organization.deleteMany({
+		where: { id: { in: [organizationId, otherOrganizationId] } },
+	});
+	await db.$disconnect();
+});
+
+describe("PostgreSQL XMPP task state", () => {
+	it("replays identical requests and rejects changed requests", async () => {
+		const first = await store.admit(admission("replay", "fingerprint-a"));
+		const replay = await store.admit(admission("replay", "fingerprint-a"));
+
+		expect(first.replay).toBe(false);
+		expect(replay.replay).toBe(true);
+		expect(replay.task.taskId).toBe(first.task.taskId);
+
+		await expect(
+			store.admit(admission("replay", "fingerprint-b")),
+		).rejects.toThrow("replay conflict");
+	});
+
+	it("enforces organization ownership and optimistic revisions", async () => {
+		const admitted = await store.admit(admission("transition", "transition"));
+		const running = await store.transition(admitted.task.taskId, 0, {
+			state: "RUNNING",
+			progress: { stage: "started" },
+		});
+
+		expect(running.state).toBe("running");
+		expect(running.revision).toBe(1);
+		expect(
+			await new PostgresXmppTaskStore(otherOrganizationId).get(
+				admitted.task.taskId,
+			),
+		).toBeNull();
+		await expect(
+			store.transition(admitted.task.taskId, 0, { state: "COMPLETED" }),
+		).rejects.toThrow("revision conflict");
+	});
+
+	it("fails interrupted work and deletes expired terminal rows", async () => {
+		const interrupted = await store.admit(
+			admission("interrupted", "interrupted"),
+		);
+		const expired = await store.admit(
+			admission("expired", "expired", new Date(Date.now() - 1_000)),
+		);
+		await store.transition(expired.task.taskId, 0, { state: "COMPLETED" });
+
+		const recoveringStore = new PostgresXmppTaskStore(
+			organizationId,
+			"recovering-owner",
+		);
+		expect(await recoveringStore.failInterrupted()).toBe(0);
+		expect((await store.get(interrupted.task.taskId))?.state).toBe("accepted");
+		expect(
+			await recoveringStore.failInterrupted(
+				new Date(
+					Date.now() + XMPP_EXPORT.task.leaseMs + LEASE_EXPIRATION_MARGIN_MS,
+				),
+			),
+		).toBeGreaterThanOrEqual(1);
+		expect((await store.get(interrupted.task.taskId))?.state).toBe("failed");
+		expect(await store.deleteExpired()).toBe(1);
+		expect(await store.get(expired.task.taskId)).toBeNull();
+	});
+});
+
+function admission(requestId: string, fingerprint: string, retainUntil?: Date) {
+	return {
+		id: crypto.randomUUID(),
+		requestId,
+		callerJid: "caller@example.test",
+		notificationJid: "caller@example.test/device",
+		targetJid: "assistant@agents.example.test",
+		tool: "ping",
+		apiVersion: "1.0.0",
+		manifestHash: "manifest",
+		fingerprint,
+		arguments: { message: requestId },
+		retainUntil: retainUntil ?? new Date(Date.now() + 60_000),
+	};
+}
diff --git a/apps/agent/tsconfig.json b/apps/agent/tsconfig.json
index 14ff6177c..ef1b137fe 100644
--- a/apps/agent/tsconfig.json
+++ b/apps/agent/tsconfig.json
@@ -5,8 +5,8 @@
 		"module": "preserve",
 		"moduleResolution": "bundler",
 		"allowImportingTsExtensions": true,
-		"types": ["node"]
+		"types": ["node", "bun"]
 	},
-	"include": ["agent/**/*.ts", "evals/**/*.ts"],
+	"include": ["agent/**/*.ts", "evals/**/*.ts", "src/**/*.ts"],
 	"exclude": ["node_modules", ".eve"]
 }
diff --git a/apps/agent/turbo.json b/apps/agent/turbo.json
index 6432b1236..da5033412 100644
--- a/apps/agent/turbo.json
+++ b/apps/agent/turbo.json
@@ -1,5 +1,5 @@
 {
-	"$schema": "https://turborepo.dev/schema.json",
+	"$schema": "https://v2-10-12.turborepo.dev/schema.json",
 	"extends": ["//"],
 	"tasks": {
 		"build": {
diff --git a/apps/api/package.json b/apps/api/package.json
index 151aec0f8..01c38aa69 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -23,42 +23,44 @@
 		"clean": "rm -rf .turbo dist node_modules src/generated"
 	},
 	"dependencies": {
+		"@aws-sdk/client-s3": "^3.1128.0",
+		"@aws-sdk/s3-request-presigner": "^3.1128.0",
 		"@crm/auth": "workspace:*",
 		"@crm/db": "workspace:*",
 		"@crm/env": "workspace:*",
 		"@crm/telemetry": "workspace:*",
 		"@crm/validation": "workspace:*",
 		"@keyv/redis": "^5.1.6",
-		"@nestjs/cache-manager": "^3.1.3",
-		"@nestjs/common": "^11.0.1",
-		"@nestjs/config": "^4.0.4",
-		"@nestjs/core": "^11.0.1",
-		"@nestjs/platform-express": "^11.0.1",
+		"@nestjs/cache-manager": "^12.0.0",
+		"@nestjs/common": "^11.2.3",
+		"@nestjs/config": "^12.0.0",
+		"@nestjs/core": "^11.2.3",
+		"@nestjs/platform-express": "^11.2.3",
 		"@nestjs/swagger": "^11.4.7",
-		"@thallesp/nestjs-better-auth": "^2.7.0",
+		"@thallesp/nestjs-better-auth": "^2.8.0",
 		"@trpc/server": "^11.18.0",
-		"@vercel/blob": "^2.6.1",
-		"better-auth": "^1.6.25",
+		"@vercel/blob": "^2.8.0",
+		"better-auth": "1.7.3",
 		"cache-manager": "^7.2.9",
 		"class-transformer": "^0.5.1",
 		"class-validator": "^0.15.1",
-		"context.dev": "^2.7.0",
+		"context.dev": "^2.14.0",
 		"helmet": "^8.3.0",
 		"nestjs-trpc": "^2.13.0",
 		"reflect-metadata": "^0.2.2",
-		"rxjs": "^7.8.1",
+		"rxjs": "^7.8.2",
 		"trpc-to-openapi": "^3.3.0",
-		"zod": "^4.4.3"
+		"zod": "^4.5.4"
 	},
 	"devDependencies": {
 		"@crm/typescript-config": "workspace:*",
-		"@nestjs/testing": "^11.0.1",
-		"@types/bun": "^1.3.14",
-		"@types/express": "^5.0.0",
-		"@types/node": "^24.0.0",
-		"@types/supertest": "^7.0.0",
-		"concurrently": "^9.1.0",
-		"supertest": "^7.0.0",
-		"typescript": "^5.9.2"
+		"@nestjs/testing": "^11.2.3",
+		"@types/bun": "^1.4.2",
+		"@types/express": "^5.0.6",
+		"@types/node": "^26.5.0",
+		"@types/supertest": "^7.2.1",
+		"concurrently": "^10.0.5",
+		"supertest": "^7.2.2",
+		"typescript": "^7.0.2"
 	}
 }
diff --git a/apps/api/src/activities/activities.contracts.ts b/apps/api/src/activities/activities.contracts.ts
index ad984fded..47a8a3978 100644
--- a/apps/api/src/activities/activities.contracts.ts
+++ b/apps/api/src/activities/activities.contracts.ts
@@ -36,7 +36,16 @@ const TIMELINE_FILTERS = [
 
 export type TimelineFilter = (typeof TIMELINE_FILTERS)[number];
 
+const activityArchivedInput = z
+	.preprocess(
+		(value: string | boolean) =>
+			value === "true" ? true : value === "false" ? false : value,
+		z.boolean(),
+	)
+	.default(false);
+
 export const timelineInput = z.object({
+	archived: activityArchivedInput,
 	companyId: z.string().optional(),
 	contactId: z.string().optional(),
 	dealId: z.string().optional(),
@@ -48,6 +57,7 @@ export const timelineInput = z.object({
 export type TimelineInput = z.infer<typeof timelineInput>;
 
 export const timelineCountsInput = z.object({
+	archived: activityArchivedInput,
 	companyId: z.string().optional(),
 	contactId: z.string().optional(),
 	dealId: z.string().optional(),
diff --git a/apps/api/src/activities/activities.service.ts b/apps/api/src/activities/activities.service.ts
index 50439fcbc..1e2f5f7ae 100644
--- a/apps/api/src/activities/activities.service.ts
+++ b/apps/api/src/activities/activities.service.ts
@@ -1,4 +1,5 @@
-import { ActivityType, type Db, type Prisma } from "@crm/db";
+import { ActivityType, type Prisma } from "@crm/db";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import { activityMeta } from "@crm/validation/activity-meta";
 import {
 	BadRequestException,
@@ -8,7 +9,8 @@ import {
 } from "@nestjs/common";
 import { ActivityStampService } from "../crm/activity-stamp.service";
 import { blankToNull } from "../crm/values";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
+import { archivedFilter } from "../trpc/list-input";
 import type {
 	ActivityCreateInput,
 	ActivityEntry,
@@ -73,12 +75,15 @@ export class ActivitiesService {
 	private readonly logger = new Logger(ActivitiesService.name);
 
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly stamp: ActivityStampService,
 	) {}
 
 	async timeline(input: TimelineInput): Promise<TimelineResult> {
-		const where = this.anchor(input);
+		const where = {
+			...this.anchor(input),
+			...archivedFilter(input.archived ?? false),
+		};
 		Object.assign(where, filterClause(input.filter));
 
 		const rows = await this.db.activity.findMany({
@@ -103,9 +108,14 @@ export class ActivitiesService {
 	}
 
 	async timelineCounts(
-		input: Pick<TimelineInput, "companyId" | "contactId" | "dealId">,
+		input: Pick<TimelineInput, "companyId" | "contactId" | "dealId"> & {
+			archived?: boolean;
+		},
 	): Promise<TimelineCounts> {
-		const anchor = this.anchor(input);
+		const anchor = {
+			...this.anchor(input),
+			...archivedFilter(input.archived ?? false),
+		};
 
 		const [all, notes, upcoming, done, email, meetings] = await Promise.all([
 			this.db.activity.count({ where: anchor }),
diff --git a/apps/api/src/agent/agent-access.service.ts b/apps/api/src/agent/agent-access.service.ts
index 9d44cc482..6fdad038f 100644
--- a/apps/api/src/agent/agent-access.service.ts
+++ b/apps/api/src/agent/agent-access.service.ts
@@ -1,25 +1,26 @@
 import {
+	activeWorkspaceRoleOf,
 	isWorkspaceAdmin,
 	toWorkspaceRole,
-	WORKSPACE_ID,
 	type WorkspaceRole,
-	workspaceRoleOf,
 } from "@crm/auth";
-import type { Db, Prisma } from "@crm/db";
+import type { Prisma } from "@crm/db";
+import { currentOrganizationId } from "@crm/db/tenant-context";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import {
 	ForbiddenException,
 	Injectable,
 	NotFoundException,
 } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import { canReadAgent, isPrivateAgentDraft } from "./agent-visibility";
 
 @Injectable()
 export class AgentAccessService {
-	constructor(@InjectDatabase() private readonly db: Db) {}
+	constructor(@InjectScopedDatabase() private readonly scoped: ScopedDb) {}
 
 	async assertMember(userId: string): Promise<WorkspaceRole> {
-		const role = await workspaceRoleOf(userId);
+		const role = await activeWorkspaceRoleOf(userId);
 
 		if (!role) {
 			throw new ForbiddenException("You are not a member of this workspace.");
@@ -36,7 +37,7 @@ export class AgentAccessService {
 		const [member] = await tx.$queryRaw<Array<{ role: string }>>`
 			SELECT role
 			FROM "member"
-			WHERE "organizationId" = ${WORKSPACE_ID}
+			WHERE "organizationId" = ${currentOrganizationId()}
 				AND "userId" = ${userId}
 			FOR SHARE
 		`;
@@ -76,7 +77,7 @@ export class AgentAccessService {
 
 	async assertCanRead(agentId: string, userId: string) {
 		const role = await this.assertMember(userId);
-		const agent = await this.db.agentDefinition.findFirst({
+		const agent = await this.scoped.agentDefinition.findFirst({
 			where: { id: agentId, status: { not: "DELETED" } },
 			select: {
 				id: true,
diff --git a/apps/api/src/agent/agent-definitions.service.ts b/apps/api/src/agent/agent-definitions.service.ts
index a211d5718..fe2f97df5 100644
--- a/apps/api/src/agent/agent-definitions.service.ts
+++ b/apps/api/src/agent/agent-definitions.service.ts
@@ -1,5 +1,6 @@
-import type { Db, Prisma } from "@crm/db";
+import type { Prisma } from "@crm/db";
 import type { AgentDefinitionStatus } from "@crm/db/enums";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import { schemas } from "@crm/validation";
 import { readAgentManifestSummary } from "@crm/validation/agent-manifest";
 import {
@@ -8,7 +9,7 @@ import {
 	NotFoundException,
 } from "@nestjs/common";
 import { z } from "zod";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import { AgentAccessService } from "./agent-access.service";
 import { AgentTriggerService } from "./agent-trigger.service";
 import { TEAM_AGENT_STATUSES } from "./agent-visibility";
@@ -37,7 +38,7 @@ const versionValidation = z
 @Injectable()
 export class AgentDefinitionsService {
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly access: AgentAccessService,
 		private readonly trigger: AgentTriggerService,
 	) {}
@@ -178,7 +179,7 @@ export class AgentDefinitionsService {
 	async update(input: AgentUpdateInput, userId: string) {
 		const description = input.description?.trim() || null;
 
-		const updated = await this.db.$transaction(async (tx) => {
+		const updated = await scopedTransaction(this.db, async (tx) => {
 			await this.access.assertCanManageInTransaction(tx, input.id, userId);
 			const agent = await this.lockAgent(tx, input.id);
 			const row = await tx.agentDefinition.update({
@@ -238,7 +239,7 @@ export class AgentDefinitionsService {
 	}
 
 	async saveFile(input: AgentSaveFileInput, userId: string) {
-		return this.db.$transaction(async (tx) => {
+		return scopedTransaction(this.db, async (tx) => {
 			await this.access.assertCanManageInTransaction(tx, input.id, userId);
 			const agent = await this.lockAgent(tx, input.id);
 
@@ -505,7 +506,7 @@ export class AgentDefinitionsService {
 	}
 
 	async deploy(input: AgentDeployInput, userId: string) {
-		return this.db.$transaction(async (tx) => {
+		return scopedTransaction(this.db, async (tx) => {
 			await this.access.assertCanManageInTransaction(tx, input.id, userId);
 			const agent = await this.lockAgent(tx, input.id);
 			const existing = await tx.agentAuditEvent.findFirst({
@@ -654,7 +655,7 @@ export class AgentDefinitionsService {
 	async remove(id: string, userId: string) {
 		const now = new Date();
 
-		return this.db.$transaction(async (tx) => {
+		return scopedTransaction(this.db, async (tx) => {
 			await this.access.assertCanManageInTransaction(tx, id, userId);
 			const [current] = await tx.$queryRaw<
 				Array<{ id: string; status: string }>
@@ -752,7 +753,7 @@ export class AgentDefinitionsService {
 		invalidStatusMessage: string,
 		extra: Prisma.AgentDefinitionUpdateInput = {},
 	) {
-		return this.db.$transaction(async (tx) => {
+		return scopedTransaction(this.db, async (tx) => {
 			await this.access.assertCanManageInTransaction(tx, id, userId);
 			const before = await this.lockAgent(tx, id);
 			if (!allowedFrom.includes(before.status)) {
diff --git a/apps/api/src/agent/agent-queue.service.ts b/apps/api/src/agent/agent-queue.service.ts
index f408f160c..0a422541c 100644
--- a/apps/api/src/agent/agent-queue.service.ts
+++ b/apps/api/src/agent/agent-queue.service.ts
@@ -1,10 +1,11 @@
-import type { Db, Prisma } from "@crm/db";
+import type { Prisma } from "@crm/db";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import { Injectable } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 
 @Injectable()
 export class AgentQueueService {
-	constructor(@InjectDatabase() private readonly db: Db) {}
+	constructor(@InjectScopedDatabase() private readonly db: ScopedDb) {}
 
 	async queuedCompanies(ids: readonly string[]): Promise<Set<string>> {
 		if (ids.length === 0) return new Set();
diff --git a/apps/api/src/agent/agent-runs.service.ts b/apps/api/src/agent/agent-runs.service.ts
index 6cff770b4..3d432c3d0 100644
--- a/apps/api/src/agent/agent-runs.service.ts
+++ b/apps/api/src/agent/agent-runs.service.ts
@@ -1,7 +1,8 @@
 import { randomUUID } from "node:crypto";
-import { type Db, Prisma } from "@crm/db";
+import { Prisma } from "@crm/db";
 import type { AgentRunStatus } from "@crm/db/enums";
 import { lockIdempotencyKey } from "@crm/db/idempotency";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import {
 	BadRequestException,
 	ConflictException,
@@ -9,7 +10,7 @@ import {
 	Injectable,
 	NotFoundException,
 } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import { AgentAccessService } from "./agent-access.service";
 import { AGENT_DISPATCH } from "./agent-dispatch.config";
 import { AgentTriggerService } from "./agent-trigger.service";
@@ -27,10 +28,31 @@ const CANCELLABLE_STATUSES: readonly AgentRunStatus[] = [
 
 const RUN_EVENT_LIMIT = 200;
 
+type QueuedRunFields = Pick<
+	Prisma.AgentRunUncheckedCreateInput,
+	"agentId" | "versionId" | "initiatedById" | "triggerType" | "idempotencyKey"
+> &
+	Partial<
+		Pick<Prisma.AgentRunUncheckedCreateInput, "triggerId" | "dealId" | "input">
+	>;
+
+type RunnableAgentTransaction = {
+	$queryRaw<T>(
+		query: TemplateStringsArray | Prisma.Sql,
+		...values: unknown[]
+	): Promise<T>;
+	agentRun: {
+		findFirst(args: {
+			where: { agentId: string; status: { in: AgentRunStatus[] } };
+			select: { id: true };
+		}): Promise<{ id: string } | null>;
+	};
+};
+
 @Injectable()
 export class AgentRunsService {
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly access: AgentAccessService,
 		private readonly trigger: AgentTriggerService,
 	) {}
@@ -158,7 +180,7 @@ export class AgentRunsService {
 			return { id: existing.id };
 		}
 
-		const run = await this.db.$transaction(async (tx) => {
+		const run = await scopedTransaction(this.db, async (tx) => {
 			await lockIdempotencyKey(tx, input.clientRequestId);
 			const replay = await tx.agentRun.findUnique({
 				where: { idempotencyKey: input.clientRequestId },
@@ -169,66 +191,27 @@ export class AgentRunsService {
 				return { id: replay.id };
 			}
 
-			const [agent] = await tx.$queryRaw<
-				Array<{
-					id: string;
-					status: string;
-					currentVersionId: string | null;
-				}>
-			>`
-					SELECT id, status, "currentVersionId"
-					FROM "agentDefinition"
-					WHERE id = ${input.id}
-					FOR UPDATE
-				`;
-
-			if (!agent || agent.status === "DELETED") {
-				throw new NotFoundException(`No agent with id ${input.id}.`);
-			}
-
-			if (agent.status !== "LIVE" || !agent.currentVersionId) {
-				throw new BadRequestException("This agent is not live yet.");
-			}
-
-			const active = await tx.agentRun.findFirst({
-				where: {
-					agentId: input.id,
-					status: { in: [...CANCELLABLE_STATUSES] },
-				},
-				select: { id: true },
-			});
-			if (active) {
-				throw new ConflictException(
-					"This agent already has an active run. Stop it or wait for it to finish.",
-				);
-			}
+			const agent = await this.lockRunnableAgent(tx, input.id);
 
 			const created = await tx.agentRun.create({
-				data: {
+				data: this.queuedRunData({
 					agentId: input.id,
 					versionId: agent.currentVersionId,
 					initiatedById: userId,
 					triggerType: "MANUAL",
 					idempotencyKey: input.clientRequestId,
-					correlationId: randomUUID(),
-					events: {
-						create: { sequence: 0, type: "run.queued", data: {} },
-					},
-				},
+				}),
 				select: { id: true },
 			});
 
 			await tx.agentAuditEvent.create({
-				data: {
+				data: this.requestedRunAuditData({
 					agentId: input.id,
 					versionId: agent.currentVersionId,
-					actorUserId: userId,
-					actorType: "USER",
-					actorId: userId,
-					type: "run.requested",
-					summary: "Requested a manual run",
+					userId,
 					requestId: input.clientRequestId,
-				},
+					summary: "Requested a manual run",
+				}),
 			});
 
 			return created;
@@ -241,7 +224,7 @@ export class AgentRunsService {
 	async retryRun(input: AgentRetryRunInput, userId: string) {
 		await this.access.assertMember(userId);
 
-		const run = await this.db.$transaction(async (tx) => {
+		const run = await scopedTransaction(this.db, async (tx) => {
 			await lockIdempotencyKey(tx, input.clientRequestId);
 			const replay = await tx.agentRun.findUnique({
 				where: { idempotencyKey: input.clientRequestId },
@@ -260,6 +243,7 @@ export class AgentRunsService {
 					versionId: true,
 					triggerId: true,
 					triggerType: true,
+					dealId: true,
 					input: true,
 				},
 			});
@@ -270,57 +254,30 @@ export class AgentRunsService {
 				throw new ConflictException("This run has not finished yet.");
 			}
 
-			const [agent] = await tx.$queryRaw<
-				Array<{ id: string; status: string; currentVersionId: string | null }>
-			>`
-					SELECT id, status, "currentVersionId"
-					FROM "agentDefinition"
-					WHERE id = ${input.id}
-					FOR UPDATE
-				`;
-			if (!agent || agent.status === "DELETED") {
-				throw new NotFoundException(`No agent with id ${input.id}.`);
-			}
-			if (agent.status !== "LIVE" || !agent.currentVersionId) {
-				throw new BadRequestException("This agent is not live yet.");
-			}
-
-			const active = await tx.agentRun.findFirst({
-				where: { agentId: input.id, status: { in: [...CANCELLABLE_STATUSES] } },
-				select: { id: true },
-			});
-			if (active) {
-				throw new ConflictException(
-					"This agent already has an active run. Stop it or wait for it to finish.",
-				);
-			}
+			await this.lockRunnableAgent(tx, input.id);
 
 			const created = await tx.agentRun.create({
-				data: {
+				data: this.queuedRunData({
 					agentId: input.id,
 					versionId: previous.versionId,
 					initiatedById: userId,
 					triggerId: previous.triggerId,
 					triggerType: previous.triggerType,
+					dealId: previous.dealId,
 					input: previous.input ?? Prisma.DbNull,
 					idempotencyKey: input.clientRequestId,
-					correlationId: randomUUID(),
-					events: { create: { sequence: 0, type: "run.queued", data: {} } },
-				},
+				}),
 				select: { id: true },
 			});
 
 			await tx.agentAuditEvent.create({
-				data: {
+				data: this.requestedRunAuditData({
 					agentId: input.id,
 					versionId: previous.versionId,
-					actorUserId: userId,
-					actorType: "USER",
-					actorId: userId,
-					type: "run.requested",
-					summary: `Retried run ${input.runId}`,
+					userId,
 					requestId: input.clientRequestId,
-				},
+					summary: `Retried run ${input.runId}`,
+				}),
 			});
 
 			return created;
@@ -333,7 +290,7 @@ export class AgentRunsService {
 	async cancelRun(input: AgentCancelRunInput, userId: string) {
 		const agent = await this.readableAgent(input.id, userId);
 
-		const outcome = await this.db.$transaction(async (tx) => {
+		const outcome = await scopedTransaction(this.db, async (tx) => {
 			const [run] = await tx.$queryRaw<
 				Array<{
 					id: string;
@@ -434,6 +391,76 @@ export class AgentRunsService {
 		return this.access.assertCanRead(agentId, userId);
 	}
 
+	private async lockRunnableAgent(
+		tx: RunnableAgentTransaction,
+		agentId: string,
+	): Promise<{ id: string; status: string; currentVersionId: string }> {
+		const [agent] = await tx.$queryRaw<
+			Array<{ id: string; status: string; currentVersionId: string | null }>
+		>`
+			SELECT id, status, "currentVersionId"
+			FROM "agentDefinition"
+			WHERE id = ${agentId}
+			FOR UPDATE
+		`;
+
+		if (!agent || agent.status === "DELETED") {
+			throw new NotFoundException(`No agent with id ${agentId}.`);
+		}
+
+		if (agent.status !== "LIVE" || !agent.currentVersionId) {
+			throw new BadRequestException("This agent is not live yet.");
+		}
+
+		const active = await tx.agentRun.findFirst({
+			where: {
+				agentId,
+				status: { in: [...CANCELLABLE_STATUSES] },
+			},
+			select: { id: true },
+		});
+		if (active) {
+			throw new ConflictException(
+				"This agent already has an active run. Stop it or wait for it to finish.",
+			);
+		}
+
+		return { ...agent, currentVersionId: agent.currentVersionId };
+	}
+
+	private queuedRunData(fields: QueuedRunFields) {
+		return {
+			...fields,
+			correlationId: randomUUID(),
+			events: {
+				create: {
+					sequence: 0,
+					type: "run.queued",
+					data: {},
+				},
+			},
+		};
+	}
+
+	private requestedRunAuditData(input: {
+		agentId: string;
+		versionId: string;
+		userId: string;
+		requestId: string;
+		summary: string;
+	}) {
+		return {
+			agentId: input.agentId,
+			versionId: input.versionId,
+			actorUserId: input.userId,
+			actorType: "USER" as const,
+			actorId: input.userId,
+			type: "run.requested",
+			summary: input.summary,
+			requestId: input.requestId,
+		};
+	}
+
 	private assertReplayMatches(
 		existingAgentId: string,
 		requestedAgentId: string,
diff --git a/apps/api/src/agent/agent-trigger.service.ts b/apps/api/src/agent/agent-trigger.service.ts
index 3b2143302..65c87ec55 100644
--- a/apps/api/src/agent/agent-trigger.service.ts
+++ b/apps/api/src/agent/agent-trigger.service.ts
@@ -1,11 +1,12 @@
-import { type Db, type FieldEntity, Prisma } from "@crm/db";
+import { type FieldEntity, Prisma } from "@crm/db";
 import { PRIORITY } from "@crm/db/agent-tasks";
 import { CRM_EVENT_CATALOG, type CrmEventType } from "@crm/db/crm-events";
 import { RECORD_ID_COLUMNS } from "@crm/db/fields";
 import { lockIdempotencyKey } from "@crm/db/idempotency";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import { fieldBackfillPayload } from "@crm/validation/field-backfill";
 import { Injectable, Logger } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import { AGENT_DISPATCH } from "./agent-dispatch.config";
 import { bridge } from "./bridge";
 
@@ -48,7 +49,7 @@ export class AgentTriggerService {
 	private readonly logger = new Logger(AgentTriggerService.name);
 	private readonly cancellationsDelivered = new Set<string>();
 
-	constructor(@InjectDatabase() private readonly db: Db) {}
+	constructor(@InjectScopedDatabase() private readonly db: ScopedDb) {}
 
 	async companyCreated(
 		companyId: string,
@@ -150,7 +151,7 @@ export class AgentTriggerService {
 	): Promise<Result> {
 		let queued = false;
 
-		const result = await this.db.$transaction((tx) =>
+		const result = await scopedTransaction(this.db, (tx) =>
 			work(tx, {
 				slackChannelJoinRequested: async (channelId, channelName) => {
 					const created = await this.queueSlackChannelJoin(
@@ -198,7 +199,7 @@ export class AgentTriggerService {
 		) => Promise<Result>,
 	): Promise<Result> {
 		const queued: CrmEventInput[] = [];
-		const result = await this.db.$transaction((tx) =>
+		const result = await scopedTransaction(this.db, (tx) =>
 			work(tx, async (input) => {
 				await this.createEventTask(tx, input);
 				queued.push(input);
@@ -234,7 +235,7 @@ export class AgentTriggerService {
 
 		const queueOne = async (id: string): Promise<void> => {
 			try {
-				const outcome = await this.db.$transaction(async (tx) => {
+				const outcome = await scopedTransaction(this.db, async (tx) => {
 					await lockIdempotencyKey(
 						tx,
 						`agent-task:field-backfill:${entity}:${id}`,
@@ -494,7 +495,7 @@ export class AgentTriggerService {
 
 			const created = client
 				? await write(client)
-				: await this.db.$transaction(write);
+				: await scopedTransaction(this.db, write);
 			if (!created) return false;
 
 			this.logger.log({
diff --git a/apps/api/src/api-keys/api-keys.router.ts b/apps/api/src/api-keys/api-keys.router.ts
index 190ee60ba..635f26c2d 100644
--- a/apps/api/src/api-keys/api-keys.router.ts
+++ b/apps/api/src/api-keys/api-keys.router.ts
@@ -39,11 +39,8 @@ export class ApiKeysRouter {
 		output: apiKeyListOutput,
 		meta: restMeta("GET", "/api-keys", ["API Keys"]),
 	})
-	async list(
-		@Ctx() ctx: AuthedTrpcContext,
-		@Input() input: z.infer<typeof apiKeyListInput>,
-	) {
-		return this.apiKeys.list(ctx.user.id, input);
+	async list(@Input() input: z.infer<typeof apiKeyListInput>) {
+		return this.apiKeys.list(input);
 	}
 
 	@Mutation({
diff --git a/apps/api/src/api-keys/api-keys.service.ts b/apps/api/src/api-keys/api-keys.service.ts
index 6266368d5..2d1fd1d14 100644
--- a/apps/api/src/api-keys/api-keys.service.ts
+++ b/apps/api/src/api-keys/api-keys.service.ts
@@ -1,5 +1,6 @@
 import { auth, DAY_SECONDS } from "@crm/auth";
 import type { Db, Prisma } from "@crm/db";
+import { currentOrganizationId } from "@crm/db/tenant-context";
 import {
 	HttpException,
 	Injectable,
@@ -68,11 +69,8 @@ export class ApiKeysService {
 
 	constructor(@InjectDatabase() private readonly db: Db) {}
 
-	async list(
-		userId: string,
-		input: ApiKeyListInput,
-	): Promise<ListResult<ApiKeySummary>> {
-		const where = this.searchWhere(userId, input.q);
+	async list(input: ApiKeyListInput): Promise<ListResult<ApiKeySummary>> {
+		const where = this.searchWhere(input.q);
 		const { skip, take } = paginate(input);
 
 		const [rows, total] = await Promise.all([
@@ -98,6 +96,8 @@ export class ApiKeysService {
 			auth.api.createApiKey({
 				headers,
 				body: {
+					organizationId: currentOrganizationId(),
+					metadata: { createdByUserId: userId },
 					name: input.name,
 					expiresIn:
 						input.expiresInDays === null
@@ -130,6 +130,14 @@ export class ApiKeysService {
 		headers: Headers,
 		input: RevokeApiKeyInput,
 	): Promise<{ id: string }> {
+		const existing = await this.db.apikey.findFirst({
+			where: { id: input.id, referenceId: currentOrganizationId() },
+			select: { id: true },
+		});
+		if (!existing) {
+			throw new HttpException("The API key was not found.", 404);
+		}
+
 		await this.call(() =>
 			auth.api.deleteApiKey({ headers, body: { keyId: input.id } }),
 		);
@@ -143,8 +151,10 @@ export class ApiKeysService {
 		return { id: input.id };
 	}
 
-	private searchWhere(userId: string, q: string): Prisma.ApikeyWhereInput {
-		const where: Prisma.ApikeyWhereInput = { referenceId: userId };
+	private searchWhere(q: string): Prisma.ApikeyWhereInput {
+		const where: Prisma.ApikeyWhereInput = {
+			referenceId: currentOrganizationId(),
+		};
 		const term = q.trim();
 
 		if (term) {
diff --git a/apps/api/src/app.module.ts b/apps/api/src/app.module.ts
index 82a345df2..7f8e9be54 100644
--- a/apps/api/src/app.module.ts
+++ b/apps/api/src/app.module.ts
@@ -5,7 +5,9 @@ import { AuthModule as BetterAuthModule } from "@thallesp/nestjs-better-auth";
 import { ActivitiesModule } from "./activities/activities.module";
 import { AgentModule } from "./agent/agent.module";
 import { ApiKeysModule } from "./api-keys/api-keys.module";
+import { AppointmentsModule } from "./appointments/appointments.module";
 import { ArchiveModule } from "./archive/archive.module";
+import { AssetsModule } from "./assets/assets.module";
 import { AuthModule } from "./auth/auth.module";
 import { BackfillModule } from "./backfill/backfill.module";
 import { AppCacheModule } from "./cache/cache.module";
@@ -26,6 +28,7 @@ import { LoggingModule } from "./logging/logging.module";
 import { logAuthRoute } from "./logging/request-logger.middleware";
 import { MailboxModule } from "./mailbox/mailbox.module";
 import { MicrosoftModule } from "./microsoft/microsoft.module";
+import { PushTokensModule } from "./push-tokens/push-tokens.module";
 import { SavedViewsModule } from "./saved-views/saved-views.module";
 import { SearchModule } from "./search/search.module";
 import { SettingsModule } from "./settings/settings.module";
@@ -33,6 +36,7 @@ import { SlackModule } from "./slack/slack.module";
 import { SsoModule } from "./sso/sso.module";
 import { SyncModule } from "./sync/sync.module";
 import { TelemetryModule } from "./telemetry/telemetry.module";
+
 import { TrackingModule } from "./tracking/tracking.module";
 import { TrpcModule } from "./trpc/trpc.module";
 import { UsersModule } from "./users/users.module";
@@ -49,7 +53,11 @@ import { WorkspaceModule } from "./workspace/workspace.module";
 		AppCacheModule,
 		DatabaseModule,
 		CrmModule,
-		BetterAuthModule.forRoot({ auth, middleware: logAuthRoute }),
+		BetterAuthModule.forRoot({
+			auth,
+			middleware: logAuthRoute,
+			disableGlobalAuthGuard: true,
+		}),
 		AuthModule,
 		HealthModule,
 		TrpcModule,
@@ -62,6 +70,7 @@ import { WorkspaceModule } from "./workspace/workspace.module";
 		DealsModule,
 		FieldsModule,
 		ActivitiesModule,
+		AppointmentsModule,
 		AgentModule,
 		EnrichmentModule,
 		DashboardModule,
@@ -78,7 +87,9 @@ import { WorkspaceModule } from "./workspace/workspace.module";
 		TelemetryModule,
 		TrackingModule,
 		ArchiveModule,
+		AssetsModule,
 		SavedViewsModule,
+		PushTokensModule,
 	],
 })
 export class AppModule {}
diff --git a/apps/api/src/appointments/appointment-access.service.ts b/apps/api/src/appointments/appointment-access.service.ts
new file mode 100644
index 000000000..8ed8148dd
--- /dev/null
+++ b/apps/api/src/appointments/appointment-access.service.ts
@@ -0,0 +1,81 @@
+import type { Db, Prisma } from "@crm/db";
+import { currentOrganizationId } from "@crm/db/tenant-context";
+import { missing } from "../assets/asset-access.service";
+import type { AssetActor } from "../assets/asset-actor";
+
+export async function appointmentActor(
+	db: Pick<Db, "member">,
+	actor: AssetActor,
+) {
+	if (actor.type !== "USER") missing();
+	await appointmentOwner(db, actor.userId);
+	return actor.userId;
+}
+
+export async function appointmentOwner(
+	db: Pick<Db, "member">,
+	ownerId: string,
+) {
+	if (
+		!(await db.member.findFirst({
+			where: { organizationId: currentOrganizationId(), userId: ownerId },
+			select: { id: true },
+		}))
+	)
+		missing();
+}
+
+export const appointmentInclude = {
+	appointmentDetails: true,
+	deal: { select: { companyId: true, organizationId: true } },
+} as const;
+
+export async function findAppointment(
+	tx: Prisma.TransactionClient,
+	projectId: string,
+	appointmentId: string,
+) {
+	const row = await tx.activity.findFirst({
+		where: {
+			id: appointmentId,
+			dealId: projectId,
+			type: "MEETING",
+			appointmentDetails: { isNot: null },
+		},
+		include: appointmentInclude,
+	});
+	if (
+		!row?.appointmentDetails ||
+		!row.deal ||
+		row.organizationId !== row.appointmentDetails.organizationId ||
+		row.organizationId !== row.deal.organizationId
+	)
+		missing();
+	return { ...row, appointmentDetails: row.appointmentDetails };
+}
+
+export function appointmentResponse(
+	row: Prisma.ActivityGetPayload<{ include: typeof appointmentInclude }>,
+) {
+	const details = row.appointmentDetails;
+	if (!details || !row.deal || !row.dealId || !row.subject) missing();
+	return {
+		id: row.id,
+		projectId: row.dealId,
+		customerId: row.deal.companyId,
+		title: row.subject,
+		notes: row.body,
+		startsAt: details.startsAt.toISOString(),
+		endsAt: details.endsAt?.toISOString() ?? null,
+		timeZone: details.timeZone,
+		location: details.location,
+		ownerId: details.ownerId,
+		status: details.status,
+		statusChangedAt: details.statusChangedAt.toISOString(),
+		version: details.version,
+		archivedAt: row.archivedAt?.toISOString() ?? null,
+		createdById: row.createdById,
+		createdAt: row.createdAt.toISOString(),
+		updatedAt: row.updatedAt.toISOString(),
+	};
+}
diff --git a/apps/api/src/appointments/appointment-create.service.ts b/apps/api/src/appointments/appointment-create.service.ts
new file mode 100644
index 000000000..04eed3b6d
--- /dev/null
+++ b/apps/api/src/appointments/appointment-create.service.ts
@@ -0,0 +1,99 @@
+import type { Db } from "@crm/db";
+import { requireActiveProject } from "../assets/asset-access.service";
+import type { AssetActor } from "../assets/asset-actor";
+import { AssetMutations } from "../assets/asset-mutation.service";
+import {
+	appointmentActor,
+	appointmentInclude,
+	appointmentOwner,
+	appointmentResponse,
+} from "./appointment-access.service";
+import {
+	parseAppointment,
+	validateAppointmentSchedule,
+	validateAppointmentTransition,
+} from "./appointment-validation";
+import {
+	type AppointmentCreateInput,
+	appointmentCreateInput,
+	appointmentDetailSchema,
+} from "./appointments.contracts";
+
+export async function createAppointment(
+	db: Db,
+	actor: AssetActor,
+	projectId: string,
+	raw: AppointmentCreateInput,
+	key: string,
+) {
+	const input = parseAppointment(appointmentCreateInput, raw);
+	const createdById = await appointmentActor(db, actor);
+	return new AssetMutations(db).run(
+		actor,
+		projectId,
+		"CREATE_APPOINTMENT",
+		`/projects/${projectId}/appointments`,
+		key,
+		input,
+		appointmentDetailSchema,
+		async (tx, project) => {
+			requireActiveProject(project);
+			const now = new Date();
+			const status = input.status ?? "SCHEDULED";
+			const startsAt = new Date(input.startsAt);
+			const endsAt = input.endsAt ? new Date(input.endsAt) : null;
+			const ownerId = input.ownerId ?? project.ownerId;
+			await appointmentOwner(tx, ownerId);
+			validateAppointmentTransition(null, status);
+			validateAppointmentSchedule(
+				startsAt,
+				endsAt,
+				input.timeZone,
+				status,
+				now,
+			);
+			const row = await tx.activity.create({
+				data: {
+					organizationId: project.organizationId,
+					type: "MEETING",
+					subject: input.title,
+					body: input.notes ?? null,
+					dealId: projectId,
+					companyId: project.companyId,
+					createdById,
+					occurredAt: status === "COMPLETED" ? startsAt : null,
+					createdAt: now,
+					updatedAt: now,
+					appointmentDetails: {
+						create: {
+							organizationId: project.organizationId,
+							startsAt,
+							endsAt,
+							timeZone: input.timeZone,
+							location: input.location ?? null,
+							ownerId,
+							status,
+							statusChangedAt: now,
+						},
+					},
+				},
+				include: appointmentInclude,
+			});
+			const stale = {
+				OR: [
+					{ lastActivityAt: null },
+					{ lastActivityAt: { lt: row.createdAt } },
+				],
+			};
+			await tx.company.updateMany({
+				where: { id: project.companyId, ...stale },
+				data: { lastActivityAt: row.createdAt },
+			});
+			await tx.deal.updateMany({
+				where: { id: projectId, ...stale },
+				data: { lastActivityAt: row.createdAt },
+			});
+			return { appointment: appointmentResponse(row) };
+		},
+	);
+}
diff --git a/apps/api/src/appointments/appointment-openapi.ts b/apps/api/src/appointments/appointment-openapi.ts
new file mode 100644
index 000000000..0ff4d0142
--- /dev/null
+++ b/apps/api/src/appointments/appointment-openapi.ts
@@ -0,0 +1,41 @@
+import { assetRestMeta } from "../assets/asset-openapi";
+import { type RestMethod, restMeta } from "../trpc/openapi";
+
+function appointmentRestMeta(method: RestMethod, path: `/${string}`) {
+	const meta = assetRestMeta(method, path);
+	if (meta.openapi) meta.openapi.tags = ["Appointments"];
+	return meta;
+}
+
+export const appointmentRoutes = {
+	createAppointment: appointmentRestMeta(
+		"POST",
+		"/projects/{projectId}/appointments",
+	),
+	listAppointments: appointmentRestMeta(
+		"GET",
+		"/projects/{projectId}/appointments",
+	),
+	getAppointment: appointmentRestMeta(
+		"GET",
+		"/projects/{projectId}/appointments/{appointmentId}",
+	),
+	updateAppointment: appointmentRestMeta(
+		"PATCH",
+		"/projects/{projectId}/appointments/{appointmentId}",
+	),
+	archiveAppointment: appointmentRestMeta(
+		"DELETE",
+		"/projects/{projectId}/appointments/{appointmentId}",
+	),
+	requestRecordingUploadUrl: restMeta(
+		"POST",
+		"/appointments/{appointmentId}/recordings/upload-url",
+		["Appointments"],
+	),
+	completeRecordingUpload: restMeta(
+		"POST",
+		"/appointments/{appointmentId}/recordings/complete",
+		["Appointments"],
+	),
+};
diff --git a/apps/api/src/appointments/appointment-validation.ts b/apps/api/src/appointments/appointment-validation.ts
new file mode 100644
index 000000000..b909b8a5a
--- /dev/null
+++ b/apps/api/src/appointments/appointment-validation.ts
@@ -0,0 +1,73 @@
+import type { AppointmentStatus } from "@crm/db";
+import type { z } from "zod";
+import { AssetError } from "../assets/asset-error";
+import type { AppointmentUpdateInput } from "./appointments.contracts";
+
+export function parseAppointment<T extends z.ZodType>(
+	schema: T,
+	raw: z.input<T>,
+): z.output<T> {
+	const parsed = schema.safeParse(raw);
+	if (!parsed.success) invalidAppointment("Appointment fields are invalid.");
+	return parsed.data;
+}
+
+export function invalidAppointment(message: string): never {
+	throw new AssetError(400, "VALIDATION_ERROR", message);
+}
+
+export function validateAppointmentSchedule(
+	startsAt: Date,
+	endsAt: Date | null,
+	timeZone: string,
+	status: AppointmentStatus,
+	now: Date,
+) {
+	try {
+		new Intl.DateTimeFormat("en-US", { timeZone });
+	} catch {
+		invalidAppointment("Use an IANA time zone.");
+	}
+	if (/^[+-]/.test(timeZone)) invalidAppointment("Use an IANA time zone.");
+	if (endsAt && endsAt <= startsAt)
+		invalidAppointment("The end must follow the start.");
+	if (status === "COMPLETED" && startsAt > now)
+		invalidAppointment("A completed appointment cannot start in the future.");
+}
+
+export function validateAppointmentTransition(
+	before: AppointmentStatus | null,
+	after: AppointmentStatus,
+) {
+	if (
+		before === after ||
+		after === "SCHEDULED" ||
+		before === "SCHEDULED" ||
+		(!before && after === "COMPLETED")
+	)
+		return;
+	throw new AssetError(
+		409,
+		"INVALID_APPOINTMENT_STATE",
+		"The appointment status transition is invalid.",
+	);
+}
+
+export function validateAppointmentPatch(input: AppointmentUpdateInput) {
+	const fields = Object.keys(input).filter(
+		(key) => key !== "expectedVersion" && key !== "archived",
+	);
+	if (input.archived === false && fields.length)
+		invalidAppointment("Restore cannot include appointment edits.");
+	if (input.archived === undefined && !fields.length)
+		invalidAppointment("Supply an appointment field to update.");
+}
+
+export function requireAppointmentVersion(actual: number, expected: number) {
+	if (actual !== expected)
+		throw new AssetError(
+			409,
+			"VERSION_CONFLICT",
+			"Read the current appointment before updating it.",
+		);
+}
diff --git a/apps/api/src/appointments/appointment-write.service.ts b/apps/api/src/appointments/appointment-write.service.ts
new file mode 100644
index 000000000..bec876611
--- /dev/null
+++ b/apps/api/src/appointments/appointment-write.service.ts
@@ -0,0 +1,178 @@
+import type { Db } from "@crm/db";
+import { requireActiveProject } from "../assets/asset-access.service";
+import type { AssetActor } from "../assets/asset-actor";
+import { AssetError } from "../assets/asset-error";
+import { AssetMutations } from "../assets/asset-mutation.service";
+import {
+	appointmentActor,
+	appointmentInclude,
+	appointmentOwner,
+	appointmentResponse,
+	findAppointment,
+} from "./appointment-access.service";
+import { createAppointment } from "./appointment-create.service";
+import {
+	parseAppointment,
+	requireAppointmentVersion,
+	validateAppointmentPatch,
+	validateAppointmentSchedule,
+	validateAppointmentTransition,
+} from "./appointment-validation";
+import {
+	type AppointmentCreateInput,
+	type AppointmentUpdateInput,
+	appointmentArchiveSchema,
+	appointmentDetailSchema,
+	appointmentUpdateInput,
+} from "./appointments.contracts";
+
+export class AppointmentWrites {
+	private readonly mutations: AssetMutations;
+	constructor(private readonly db: Db) {
+		this.mutations = new AssetMutations(db);
+	}
+
+	createAppointment(
+		actor: AssetActor,
+		projectId: string,
+		raw: AppointmentCreateInput,
+		key: string,
+	) {
+		return createAppointment(this.db, actor, projectId, raw, key);
+	}
+
+	async updateAppointment(
+		actor: AssetActor,
+		projectId: string,
+		appointmentId: string,
+		raw: AppointmentUpdateInput,
+		key: string,
+	) {
+		const input = parseAppointment(appointmentUpdateInput, raw);
+		validateAppointmentPatch(input);
+		await appointmentActor(this.db, actor);
+		return this.mutations.run(
+			actor,
+			projectId,
+			"UPDATE_APPOINTMENT",
+			`/projects/${projectId}/appointments/${appointmentId}`,
+			key,
+			input,
+			appointmentDetailSchema,
+			async (tx, project) => {
+				requireActiveProject(project);
+				const row = await findAppointment(tx, projectId, appointmentId);
+				const details = row.appointmentDetails;
+				if (row.archivedAt && input.archived !== false)
+					throw new AssetError(
+						409,
+						"APPOINTMENT_ARCHIVED",
+						"Restore the appointment before editing it.",
+					);
+				requireAppointmentVersion(details.version, input.expectedVersion);
+				const now = new Date();
+				if (input.archived === false) {
+					await tx.appointmentDetails.update({
+						where: { activityId: appointmentId },
+						data: { version: { increment: 1 } },
+					});
+					const restored = await tx.activity.update({
+						where: { id: appointmentId },
+						data: { archivedAt: null, updatedAt: now },
+						include: appointmentInclude,
+					});
+					return { appointment: appointmentResponse(restored) };
+				}
+				const startsAt = input.startsAt
+					? new Date(input.startsAt)
+					: details.startsAt;
+				const endsAt =
+					input.endsAt === undefined
+						? details.endsAt
+						: input.endsAt === null
+							? null
+							: new Date(input.endsAt);
+				const status = input.status ?? details.status;
+				const ownerId = input.ownerId ?? details.ownerId;
+				await appointmentOwner(tx, ownerId);
+				validateAppointmentTransition(details.status, status);
+				validateAppointmentSchedule(
+					startsAt,
+					endsAt,
+					input.timeZone ?? details.timeZone,
+					status,
+					now,
+				);
+				await tx.appointmentDetails.update({
+					where: { activityId: appointmentId },
+					data: {
+						startsAt,
+						endsAt,
+						status,
+						ownerId,
+						timeZone: input.timeZone,
+						location: input.location,
+						statusChangedAt:
+							status === details.status ? details.statusChangedAt : now,
+						version: { increment: 1 },
+					},
+				});
+				const updated = await tx.activity.update({
+					where: { id: appointmentId },
+					data: {
+						subject: input.title,
+						body: input.notes,
+						occurredAt: status === "COMPLETED" ? startsAt : null,
+						updatedAt: now,
+					},
+					include: appointmentInclude,
+				});
+				return { appointment: appointmentResponse(updated) };
+			},
+			{ appointmentId },
+		);
+	}
+
+	async archiveAppointment(
+		actor: AssetActor,
+		projectId: string,
+		appointmentId: string,
+		key: string,
+	) {
+		await appointmentActor(this.db, actor);
+		return this.mutations.run(
+			actor,
+			projectId,
+			"ARCHIVE_APPOINTMENT",
+			`/projects/${projectId}/appointments/${appointmentId}`,
+			key,
+			{},
+			appointmentArchiveSchema,
+			async (tx) => {
+				const row = await findAppointment(tx, projectId, appointmentId);
+				const details = row.appointmentDetails;
+				if (row.archivedAt)
+					return {
+						appointmentId,
+						archivedAt: row.archivedAt.toISOString(),
+						version: details.version,
+					};
+				const now = new Date();
+				const updated = await tx.appointmentDetails.update({
+					where: { activityId: appointmentId },
+					data: { version: { increment: 1 } },
+				});
+				await tx.activity.update({
+					where: { id: appointmentId },
+					data: { archivedAt: now, updatedAt: now },
+				});
+				return {
+					appointmentId,
+					archivedAt: now.toISOString(),
+					version: updated.version,
+				};
+			},
+			{ appointmentId },
+		);
+	}
+}
diff --git a/apps/api/src/appointments/appointments.contracts.ts b/apps/api/src/appointments/appointments.contracts.ts
new file mode 100644
index 000000000..e4f0a4424
--- /dev/null
+++ b/apps/api/src/appointments/appointments.contracts.ts
@@ -0,0 +1,103 @@
+import { z } from "zod";
+
+export const appointmentStatusSchema = z.enum([
+	"SCHEDULED",
+	"COMPLETED",
+	"CANCELED",
+]);
+const dateTime = z.string().datetime({ offset: true });
+const identity = z.string().min(1).max(128);
+
+export const appointmentFields = z.object({
+	title: z.string().trim().min(1).max(255),
+	notes: z.string().max(20000).nullable().optional(),
+	startsAt: dateTime,
+	endsAt: dateTime.nullable().optional(),
+	timeZone: z.string().min(1).max(100),
+	location: z.string().max(1000).nullable().optional(),
+	ownerId: identity.optional(),
+	status: appointmentStatusSchema.optional(),
+});
+
+export const appointmentCreateInput = appointmentFields.strict();
+export const appointmentUpdateInput = appointmentFields
+	.partial()
+	.extend({
+		expectedVersion: z.number().int().positive().pipe(z.number()),
+		archived: z.literal(false).optional(),
+	})
+	.strict();
+
+export const appointmentListInput = z
+	.object({
+		page: z.number().int().min(1).default(1),
+		pageSize: z.number().int().min(1).max(100).default(25),
+		status: appointmentStatusSchema.optional(),
+		ownerId: identity.optional(),
+		from: dateTime.optional(),
+		to: dateTime.optional(),
+		archived: z
+			.preprocess(
+				(value: string | boolean) =>
+					value === "true" ? true : value === "false" ? false : value,
+				z.boolean(),
+			)
+			.default(false),
+	})
+	.strict();
+
+export const projectAppointmentInput = z
+	.object({
+		projectId: identity,
+		appointmentId: identity,
+	})
+	.strict();
+export const projectAppointmentCreateInput = appointmentCreateInput.extend({
+	projectId: identity,
+});
+export const projectAppointmentUpdateInput = appointmentUpdateInput.extend({
+	projectId: identity,
+	appointmentId: identity,
+});
+export const projectAppointmentListInput = appointmentListInput.extend({
+	projectId: identity,
+});
+
+export const appointmentSchema = z.object({
+	id: z.string(),
+	projectId: z.string(),
+	customerId: z.string(),
+	title: z.string(),
+	notes: z.string().nullable(),
+	startsAt: dateTime,
+	endsAt: dateTime.nullable(),
+	timeZone: z.string(),
+	location: z.string().nullable(),
+	ownerId: z.string(),
+	status: appointmentStatusSchema,
+	statusChangedAt: dateTime,
+	version: z.number().int().positive(),
+	archivedAt: dateTime.nullable(),
+	createdById: z.string(),
+	createdAt: dateTime,
+	updatedAt: dateTime,
+});
+export const appointmentDetailSchema = z.object({
+	appointment: appointmentSchema,
+});
+export const appointmentListSchema = z.object({
+	items: z.array(appointmentSchema),
+	page: z.number().int(),
+	pageSize: z.number().int(),
+	total: z.number().int(),
+	hasNextPage: z.boolean(),
+});
+export const appointmentArchiveSchema = z.object({
+	appointmentId: z.string(),
+	archivedAt: dateTime,
+	version: z.number().int().positive(),
+});
+
+export type AppointmentCreateInput = z.infer<typeof appointmentCreateInput>;
+export type AppointmentUpdateInput = z.infer<typeof appointmentUpdateInput>;
+export type AppointmentListInput = z.input<typeof appointmentListInput>;
diff --git a/apps/api/src/appointments/appointments.module.ts b/apps/api/src/appointments/appointments.module.ts
new file mode 100644
index 000000000..094edaadd
--- /dev/null
+++ b/apps/api/src/appointments/appointments.module.ts
@@ -0,0 +1,13 @@
+import { Module } from "@nestjs/common";
+import { AssetsModule } from "../assets/assets.module";
+import { TrpcModule } from "../trpc/trpc.module";
+import { AppointmentsRouter } from "./appointments.router";
+import { AppointmentsService } from "./appointments.service";
+import { RecordingUploadService } from "./recording-upload.service";
+
+@Module({
+	imports: [TrpcModule, AssetsModule],
+	providers: [AppointmentsRouter, AppointmentsService, RecordingUploadService],
+	exports: [AppointmentsService, RecordingUploadService],
+})
+export class AppointmentsModule {}
diff --git a/apps/api/src/appointments/appointments.router.ts b/apps/api/src/appointments/appointments.router.ts
new file mode 100644
index 000000000..ea79a0611
--- /dev/null
+++ b/apps/api/src/appointments/appointments.router.ts
@@ -0,0 +1,165 @@
+import { Inject } from "@nestjs/common";
+import {
+	Ctx,
+	Input,
+	Mutation,
+	Query,
+	Router,
+	UseMiddlewares,
+} from "nestjs-trpc";
+import type { z } from "zod";
+import {
+	assetUser,
+	idempotencyKey,
+	optionalIdempotencyKey,
+} from "../assets/asset-request";
+import type { AuthedTrpcContext } from "../trpc/context.types";
+import { AuthMiddleware } from "../trpc/middlewares/auth.middleware";
+import { appointmentRoutes } from "./appointment-openapi";
+import {
+	appointmentArchiveSchema,
+	appointmentDetailSchema,
+	appointmentListSchema,
+	projectAppointmentCreateInput,
+	projectAppointmentInput,
+	projectAppointmentListInput,
+	projectAppointmentUpdateInput,
+} from "./appointments.contracts";
+import { AppointmentsService } from "./appointments.service";
+import {
+	recordingCompleteInput,
+	recordingCompleteSchema,
+	recordingUploadSlotSchema,
+	recordingUploadUrlInput,
+} from "./recording-upload.contracts";
+import { RecordingUploadService } from "./recording-upload.service";
+
+@Router({ alias: "appointments" })
+@UseMiddlewares(AuthMiddleware)
+export class AppointmentsRouter {
+	constructor(
+		@Inject(AppointmentsService)
+		private readonly appointments: AppointmentsService,
+		@Inject(RecordingUploadService)
+		private readonly recordings: RecordingUploadService,
+	) {}
+
+	@Mutation({
+		input: projectAppointmentCreateInput,
+		output: appointmentDetailSchema,
+		meta: appointmentRoutes.createAppointment,
+	})
+	createAppointment(
+		@Ctx() ctx: AuthedTrpcContext,
+		@Input() input: z.infer<typeof projectAppointmentCreateInput>,
+	) {
+		const { projectId, ...body } = input;
+		return this.appointments.createAppointment(
+			assetUser(ctx),
+			projectId,
+			body,
+			idempotencyKey(ctx),
+		);
+	}
+
+	@Query({
+		input: projectAppointmentListInput,
+		output: appointmentListSchema,
+		meta: appointmentRoutes.listAppointments,
+	})
+	listAppointments(
+		@Ctx() ctx: AuthedTrpcContext,
+		@Input() input: z.infer<typeof projectAppointmentListInput>,
+	) {
+		const { projectId, ...body } = input;
+		return this.appointments.listAppointments(assetUser(ctx), projectId, body);
+	}
+
+	@Query({
+		input: projectAppointmentInput,
+		output: appointmentDetailSchema,
+		meta: appointmentRoutes.getAppointment,
+	})
+	getAppointment(
+		@Ctx() ctx: AuthedTrpcContext,
+		@Input() input: z.infer<typeof projectAppointmentInput>,
+	) {
+		return this.appointments.getAppointment(
+			assetUser(ctx),
+			input.projectId,
+			input.appointmentId,
+		);
+	}
+
+	@Mutation({
+		input: projectAppointmentUpdateInput,
+		output: appointmentDetailSchema,
+		meta: appointmentRoutes.updateAppointment,
+	})
+	updateAppointment(
+		@Ctx() ctx: AuthedTrpcContext,
+		@Input() input: z.infer<typeof projectAppointmentUpdateInput>,
+	) {
+		const { projectId, appointmentId, ...body } = input;
+		return this.appointments.updateAppointment(
+			assetUser(ctx),
+			projectId,
+			appointmentId,
+			body,
+			idempotencyKey(ctx),
+		);
+	}
+
+	@Mutation({
+		input: projectAppointmentInput,
+		output: appointmentArchiveSchema,
+		meta: appointmentRoutes.archiveAppointment,
+	})
+	archiveAppointment(
+		@Ctx() ctx: AuthedTrpcContext,
+		@Input() input: z.infer<typeof projectAppointmentInput>,
+	) {
+		return this.appointments.archiveAppointment(
+			assetUser(ctx),
+			input.projectId,
+			input.appointmentId,
+			idempotencyKey(ctx),
+		);
+	}
+
+	@Mutation({
+		input: recordingUploadUrlInput,
+		output: recordingUploadSlotSchema,
+		meta: appointmentRoutes.requestRecordingUploadUrl,
+	})
+	requestRecordingUploadUrl(
+		@Ctx() ctx: AuthedTrpcContext,
+		@Input() input: z.infer<typeof recordingUploadUrlInput>,
+	) {
+		const { appointmentId, ...body } = input;
+		return this.recordings.requestUploadUrl(
+			assetUser(ctx),
+			appointmentId,
+			body,
+			optionalIdempotencyKey(ctx),
+		);
+	}
+
+	@Mutation({
+		input: recordingCompleteInput,
+		output: recordingCompleteSchema,
+		meta: appointmentRoutes.completeRecordingUpload,
+	})
+	completeRecordingUpload(
+		@Ctx() ctx: AuthedTrpcContext,
+		@Input() input: z.infer<typeof recordingCompleteInput>,
+	) {
+		const { appointmentId, ...body } = input;
+		return this.recordings.completeUpload(
+			assetUser(ctx),
+			appointmentId,
+			body,
+			optionalIdempotencyKey(ctx),
+		);
+	}
+}
diff --git a/apps/api/src/appointments/appointments.service.ts b/apps/api/src/appointments/appointments.service.ts
new file mode 100644
index 000000000..b3d603f39
--- /dev/null
+++ b/apps/api/src/appointments/appointments.service.ts
@@ -0,0 +1,122 @@
+import type { Db, Prisma } from "@crm/db";
+import { scopedTransaction } from "@crm/db/tenant-scope";
+import { Injectable } from "@nestjs/common";
+import { findAssetProject } from "../assets/asset-access.service";
+import type { AssetActor } from "../assets/asset-actor";
+import { InjectScopedDatabase } from "../database/database.constants";
+import { archivedFilter } from "../trpc/list-input";
+import {
+	appointmentActor,
+	appointmentInclude,
+	appointmentResponse,
+	findAppointment,
+} from "./appointment-access.service";
+import { invalidAppointment, parseAppointment } from "./appointment-validation";
+import { AppointmentWrites } from "./appointment-write.service";
+import {
+	type AppointmentCreateInput,
+	type AppointmentListInput,
+	type AppointmentUpdateInput,
+	appointmentListInput,
+} from "./appointments.contracts";
+
+@Injectable()
+export class AppointmentsService {
+	private readonly writes: AppointmentWrites;
+	constructor(@InjectScopedDatabase() private readonly db: Db) {
+		this.writes = new AppointmentWrites(db);
+	}
+
+	createAppointment(
+		actor: AssetActor,
+		projectId: string,
+		raw: AppointmentCreateInput,
+		key: string,
+	) {
+		return this.writes.createAppointment(actor, projectId, raw, key);
+	}
+	updateAppointment(
+		actor: AssetActor,
+		projectId: string,
+		appointmentId: string,
+		raw: AppointmentUpdateInput,
+		key: string,
+	) {
+		return this.writes.updateAppointment(
+			actor,
+			projectId,
+			appointmentId,
+			raw,
+			key,
+		);
+	}
+	archiveAppointment(
+		actor: AssetActor,
+		projectId: string,
+		appointmentId: string,
+		key: string,
+	) {
+		return this.writes.archiveAppointment(actor, projectId, appointmentId, key);
+	}
+	getAppointment(actor: AssetActor, projectId: string, appointmentId: string) {
+		return scopedTransaction(this.db, async (tx) => {
+			await appointmentActor(tx, actor);
+			await findAssetProject(tx, actor, projectId);
+			return {
+				appointment: appointmentResponse(
+					await findAppointment(tx, projectId, appointmentId),
+				),
+			};
+		});
+	}
+	async listAppointments(
+		actor: AssetActor,
+		projectId: string,
+		raw: AppointmentListInput,
+	) {
+		const input = parseAppointment(appointmentListInput, raw);
+		if (input.from && input.to && new Date(input.to) <= new Date(input.from))
+			invalidAppointment("The upper date must follow the lower date.");
+		return scopedTransaction(this.db, async (tx) => {
+			await appointmentActor(tx, actor);
+			await findAssetProject(tx, actor, projectId);
+			const where: Prisma.ActivityWhereInput = {
+				dealId: projectId,
+				type: "MEETING",
+				...archivedFilter(input.archived),
+				appointmentDetails: {
+					is: {
+						status: input.status,
+						ownerId: input.ownerId,
+						startsAt: {
+							gte: input.from ? new Date(input.from) : undefined,
+							lt: input.to ? new Date(input.to) : undefined,
+						},
+					},
+				},
+			};
+			const total = await tx.activity.count({ where });
+			const offset = (input.page - 1) * input.pageSize;
+			const rows =
+				offset >= total
+					? []
+					: await tx.activity.findMany({
+							where,
+							skip: offset,
+							take: input.pageSize,
+							orderBy: [
+								{ appointmentDetails: { startsAt: "asc" } },
+								{ id: "asc" },
+							],
+							include: appointmentInclude,
+						});
+			return {
+				items: rows.map(appointmentResponse),
+				page: input.page,
+				pageSize: input.pageSize,
+				total,
+				hasNextPage: offset + rows.length < total,
+			};
+		});
+	}
+}
diff --git a/apps/api/src/appointments/recording-upload.contracts.ts b/apps/api/src/appointments/recording-upload.contracts.ts
new file mode 100644
index 000000000..629a6629c
--- /dev/null
+++ b/apps/api/src/appointments/recording-upload.contracts.ts
@@ -0,0 +1,53 @@
+import { z } from "zod";
+
+const appointmentId = z.string().min(1).max(128);
+const contentType = z
+	.string()
+	.min(1)
+	.max(255)
+	.regex(/^[^\p{Cc}]+$/u);
+const byteSize = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const filename = z
+	.string()
+	.min(1)
+	.max(255)
+	.regex(/^[^/\\\p{Cc}]+$/u);
+
+export const recordingUploadUrlBody = z.strictObject({
+	contentType,
+	byteSize,
+	filename,
+});
+export type RecordingUploadUrlBody = z.infer<typeof recordingUploadUrlBody>;
+
+export const recordingUploadUrlInput = recordingUploadUrlBody.extend({
+	appointmentId,
+});
+
+export const recordingUploadSlotSchema = z.object({
+	uploadUrl: z.url(),
+	method: z.literal("PUT"),
+	headers: z.object({
+		"Content-Type": z.string(),
+		"Content-Length": z.string(),
+	}),
+	objectKey: z.string().min(1).max(128),
+	expiresAt: z.iso.datetime(),
+});
+export type RecordingUploadSlot = z.infer<typeof recordingUploadSlotSchema>;
+
+export const recordingCompleteBody = z.strictObject({
+	objectKey: z.string().min(1).max(128),
+	contentType,
+	byteSize,
+	durationSeconds: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+});
+export type RecordingCompleteBody = z.infer<typeof recordingCompleteBody>;
+
+export const recordingCompleteInput = recordingCompleteBody.extend({
+	appointmentId,
+});
+
+export const recordingCompleteSchema = z.object({
+	ok: z.literal(true),
+});
diff --git a/apps/api/src/appointments/recording-upload.service.ts b/apps/api/src/appointments/recording-upload.service.ts
new file mode 100644
index 000000000..3b1b3952d
--- /dev/null
+++ b/apps/api/src/appointments/recording-upload.service.ts
@@ -0,0 +1,170 @@
+import { randomUUID } from "node:crypto";
+import type { Db } from "@crm/db";
+import { Injectable } from "@nestjs/common";
+import type { AssetActor } from "../assets/asset-actor";
+import { appointmentProjectId } from "../assets/asset-context.service";
+import { AssetError } from "../assets/asset-error";
+import { AssetFiles } from "../assets/asset-files.service";
+import { AssetMutations } from "../assets/asset-mutation.service";
+import { AssetStorageService } from "../assets/asset-storage.service";
+import { AssetTransfers } from "../assets/asset-transfer.service";
+import { completeAssetUpload } from "../assets/asset-upload-completion";
+import { AssetCreation } from "../assets/asset-upload-create.service";
+import { InjectScopedDatabase } from "../database/database.constants";
+import {
+	type RecordingCompleteBody,
+	type RecordingUploadSlot,
+	type RecordingUploadUrlBody,
+	recordingCompleteSchema,
+	recordingUploadSlotSchema,
+} from "./recording-upload.contracts";
+
+@Injectable()
+export class RecordingUploadService {
+	private readonly creation: AssetCreation;
+	private readonly transfers: AssetTransfers;
+	private readonly files: AssetFiles;
+	private readonly mutations: AssetMutations;
+
+	constructor(
+		@InjectScopedDatabase() private readonly db: Db,
+		private readonly storage: AssetStorageService,
+	) {
+		this.mutations = new AssetMutations(db);
+		this.creation = new AssetCreation(this.mutations, storage);
+		this.transfers = new AssetTransfers(db, storage);
+		this.files = new AssetFiles(this.mutations);
+	}
+
+	async requestUploadUrl(
+		actor: AssetActor,
+		appointmentId: string,
+		raw: RecordingUploadUrlBody,
+		key?: string,
+	): Promise<RecordingUploadSlot> {
+		const projectId = await appointmentProjectId(this.db, actor, appointmentId);
+		const pending = await this.findPending(appointmentId);
+		if (pending) return this.slot(actor, projectId, pending.id);
+		await this.retirePrevious(actor, projectId, appointmentId);
+		const createKey =
+			key ?? `mobile-recording:${appointmentId}:${randomUUID()}`;
+		const { assetId } = await this.creation.createAsset(
+			actor,
+			projectId,
+			{
+				fileName: raw.filename,
+				contentType: raw.contentType,
+				sizeBytes: raw.byteSize,
+				kind: "meeting_recording",
+				source: "MOBILE_RECORDING",
+			},
+			createKey,
+			appointmentId,
+		);
+		return this.slot(actor, projectId, assetId);
+	}
+
+	async completeUpload(
+		actor: AssetActor,
+		appointmentId: string,
+		raw: RecordingCompleteBody,
+		key?: string,
+	) {
+		const projectId = await appointmentProjectId(this.db, actor, appointmentId);
+		const completeKey = key ?? `mobile-recording-complete:${raw.objectKey}`;
+		return this.mutations.run(
+			actor,
+			projectId,
+			"COMPLETE_RECORDING",
+			`/appointments/${appointmentId}/recordings/complete`,
+			completeKey,
+			raw,
+			recordingCompleteSchema,
+			async (tx) => {
+				const asset = await tx.artifact.findFirst({
+					where: {
+						id: raw.objectKey,
+						dealId: projectId,
+						activityId: appointmentId,
+						kind: "meeting_recording",
+						source: "MOBILE_RECORDING",
+						status: { in: ["UNVERIFIED", "READY"] },
+					},
+				});
+				if (!asset)
+					throw new AssetError(
+						409,
+						"ASSET_NOT_READY",
+						"The recording upload is missing or does not belong to this appointment.",
+					);
+				await tx.artifact.update({
+					where: { id: asset.id },
+					data: {
+						durationMilliseconds: BigInt(raw.durationSeconds * 1000),
+						updatedAt: new Date(),
+					},
+				});
+				await completeAssetUpload(tx, this.storage, projectId, asset.id);
+				return { ok: true as const };
+			},
+			{ appointmentId },
+		);
+	}
+
+	private async slot(actor: AssetActor, projectId: string, assetId: string) {
+		const transfer = await this.transfers.issue(actor, projectId, assetId);
+		if (!transfer)
+			throw new AssetError(
+				409,
+				"ASSET_NOT_READY",
+				"The recording upload no longer accepts a transfer.",
+			);
+		return recordingUploadSlotSchema.parse({
+			uploadUrl: transfer.url,
+			method: transfer.method,
+			headers: transfer.headers,
+			objectKey: assetId,
+			expiresAt: transfer.expiresAt,
+		});
+	}
+
+	private async findPending(appointmentId: string) {
+		const assets = await this.db.artifact.findMany({
+			where: {
+				activityId: appointmentId,
+				kind: "meeting_recording",
+				source: "MOBILE_RECORDING",
+				status: "UNVERIFIED",
+			},
+			orderBy: [{ createdAt: "desc" }, { id: "desc" }],
+			take: 5,
+		});
+		for (const asset of assets) {
+			const upload = await this.db.assetUpload.findUnique({
+				where: { assetId: asset.id },
+			});
+			if (upload?.status === "PENDING" && upload.expiresAt > new Date())
+				return asset;
+		}
+		return null;
+	}
+
+	private async retirePrevious(
+		actor: AssetActor,
+		projectId: string,
+		appointmentId: string,
+	) {
+		const previous = await this.db.artifact.findMany({
+			where: {
+				activityId: appointmentId,
+				kind: "meeting_recording",
+				source: "MOBILE_RECORDING",
+				status: { in: ["UNVERIFIED", "READY"] },
+			},
+			select: { id: true },
+		});
+		for (const asset of previous) {
+			await this.files.deleteAsset(actor, projectId, asset.id, randomUUID());
+		}
+	}
+}
diff --git a/apps/api/src/assets/asset-access.service.ts b/apps/api/src/assets/asset-access.service.ts
new file mode 100644
index 000000000..e93f8a39c
--- /dev/null
+++ b/apps/api/src/assets/asset-access.service.ts
@@ -0,0 +1,120 @@
+import type { Prisma } from "@crm/db";
+import type { AssetActor } from "./asset-actor";
+import { AssetError } from "./asset-error";
+
+export function missing(): never {
+	throw new AssetError(
+		404,
+		"RESOURCE_NOT_FOUND",
+		"The record does not exist or is inaccessible.",
+	);
+}
+
+export async function findAssetProject(
+	tx: Prisma.TransactionClient,
+	actor: AssetActor,
+	projectId: string,
+	lock = false,
+) {
+	if (lock)
+		await tx.$queryRaw`SELECT "id" FROM "deal" WHERE "id" = ${projectId} FOR UPDATE`;
+	const project = await tx.deal.findUnique({ where: { id: projectId } });
+	if (!project) missing();
+	if (actor.type === "USER") {
+		if (
+			!(await tx.user.findUnique({
+				where: { id: actor.userId },
+				select: { id: true },
+			}))
+		)
+			missing();
+	} else {
+		const message = await tx.emailMessage.findUnique({
+			where: { id: actor.messageId },
+			include: { thread: true },
+		});
+		if (!message || message.syncedByUserId !== actor.mailboxOwnerId) missing();
+		const mailboxSources: string[] = [];
+		if (message.gmailMessageId) mailboxSources.push("gmail");
+		if (message.outlookMessageId) mailboxSources.push("outlook");
+		if (
+			!(await tx.mailboxSync.findFirst({
+				where: {
+					userId: actor.mailboxOwnerId,
+					source: { in: mailboxSources },
+				},
+				select: { id: true },
+			}))
+		)
+			missing();
+		if (
+			message.thread.companyId !== null &&
+			message.thread.companyId !== project.companyId
+		) {
+			throw new AssetError(
+				409,
+				"PROJECT_MISMATCH",
+				"The email belongs to another customer.",
+			);
+		}
+	}
+	return project;
+}
+
+export function requireActiveProject(project: { archivedAt: Date | null }) {
+	if (project.archivedAt)
+		throw new AssetError(
+			409,
+			"PROJECT_ARCHIVED",
+			"Restore the project before uploading files.",
+		);
+}
+
+export async function findProjectAsset(
+	tx: Prisma.TransactionClient,
+	projectId: string,
+	assetId: string,
+	actor: AssetActor,
+) {
+	const asset = await tx.artifact.findFirst({
+		where: { id: assetId, dealId: projectId },
+		include: { deal: { select: { companyId: true } } },
+	});
+	if (!asset) missing();
+	if (asset.activityId)
+		await validateAssetAppointment(tx, projectId, asset.activityId, false);
+	if (actor.type === "SYSTEM" && asset.emailMessageId !== actor.messageId)
+		missing();
+	return asset;
+}
+
+export async function validateAssetAppointment(
+	tx: Prisma.TransactionClient,
+	projectId: string,
+	appointmentId: string,
+	active = true,
+) {
+	const appointment = await tx.activity.findUnique({
+		where: { id: appointmentId },
+		include: { appointmentDetails: true },
+	});
+	if (
+		!appointment?.appointmentDetails ||
+		appointment.type !== "MEETING" ||
+		appointment.organizationId !== appointment.appointmentDetails.organizationId
+	)
+		missing();
+	if (appointment.dealId !== projectId)
+		throw new AssetError(
+			409,
+			"PROJECT_MISMATCH",
+			"The appointment belongs to another project.",
+		);
+	if (active && appointment.archivedAt)
+		throw new AssetError(
+			409,
+			"APPOINTMENT_ARCHIVED",
+			"Restore the appointment before linking files.",
+		);
+	return appointment;
+}
diff --git a/apps/api/src/assets/asset-actor.ts b/apps/api/src/assets/asset-actor.ts
new file mode 100644
index 000000000..00aea0c2c
--- /dev/null
+++ b/apps/api/src/assets/asset-actor.ts
@@ -0,0 +1,8 @@
+export type AssetActor =
+	| { type: "USER"; userId: string }
+	| { type: "SYSTEM"; mailboxOwnerId: string; messageId: string };
+export function assetActorKey(actor: AssetActor) {
+	return actor.type === "USER"
+		? `user:${actor.userId}`
+		: `mailbox:${actor.mailboxOwnerId}`;
+}
diff --git a/apps/api/src/assets/asset-catalog.service.ts b/apps/api/src/assets/asset-catalog.service.ts
new file mode 100644
index 000000000..898f40619
--- /dev/null
+++ b/apps/api/src/assets/asset-catalog.service.ts
@@ -0,0 +1,111 @@
+import type { Db, Prisma } from "@crm/db";
+import { scopedTransaction } from "@crm/db/tenant-scope";
+import {
+	findAssetProject,
+	findProjectAsset,
+	validateAssetAppointment,
+} from "./asset-access.service";
+import type { AssetActor } from "./asset-actor";
+import { assetProjectId } from "./asset-context.service";
+import { downloadAssetFile } from "./asset-files.service";
+import { assetResponse } from "./asset-responses";
+import type { AssetStorageService } from "./asset-storage.service";
+import {
+	type AssetListInput,
+	assetDetailSchema,
+	assetListInput,
+} from "./assets.contracts";
+
+export class AssetCatalog {
+	constructor(
+		private readonly db: Db,
+		private readonly storage: AssetStorageService,
+	) {}
+
+	async listProjectAssets(
+		actor: AssetActor,
+		projectId: string,
+		raw: AssetListInput,
+		appointmentId?: string,
+	) {
+		const input = assetListInput.parse(raw);
+		return scopedTransaction(this.db, async (tx) => {
+			await findAssetProject(tx, actor, projectId);
+			if (appointmentId)
+				await validateAssetAppointment(tx, projectId, appointmentId, false);
+			return this.list(
+				tx,
+				{
+					dealId: projectId,
+					activityId: appointmentId,
+					emailMessageId: actor.type === "SYSTEM" ? actor.messageId : undefined,
+				},
+				input,
+			);
+		});
+	}
+
+	private async list(
+		tx: Prisma.TransactionClient,
+		parent: Prisma.ArtifactWhereInput,
+		input: AssetListInput,
+	) {
+		const where: Prisma.ArtifactWhereInput = {
+			...parent,
+			status: { in: ["READY", "UNVERIFIED"] },
+			kind: input.kind,
+			source: input.source,
+		};
+		const total = await tx.artifact.count({ where });
+		const offset = (input.page - 1) * input.pageSize;
+		const items =
+			offset >= total
+				? []
+				: await tx.artifact.findMany({
+						where,
+						include: { deal: { select: { companyId: true } } },
+						orderBy: [{ createdAt: "desc" }, { id: "desc" }],
+						skip: offset,
+						take: input.pageSize,
+					});
+		return {
+			items: items.map(assetResponse),
+			page: input.page,
+			pageSize: input.pageSize,
+			total,
+			hasNextPage: input.page * input.pageSize < total,
+		};
+	}
+
+	async getAsset(actor: AssetActor, assetId: string) {
+		const projectId = await assetProjectId(this.db, actor, assetId);
+		return scopedTransaction(this.db, async (tx) => {
+			await findAssetProject(tx, actor, projectId, true);
+			const asset = await findProjectAsset(tx, projectId, assetId, actor);
+			const upload = await tx.assetUpload.findUnique({ where: { assetId } });
+			const expired =
+				upload?.status === "EXPIRED" ||
+				(upload?.status === "PENDING" && upload.expiresAt <= new Date());
+			const failure =
+				asset.status !== "UNVERIFIED"
+					? null
+					: expired
+						? {
+								code: "UPLOAD_EXPIRED",
+								message:
+									"The upload expired. Create a new asset to send the file again.",
+							}
+						: upload?.failureCode
+							? {
+									code: upload.failureCode,
+									message: upload.failureMessage ?? "File verification failed.",
+								}
+							: null;
+			return assetDetailSchema.parse({
+				asset: assetResponse(asset),
+				failure,
+				download: await downloadAssetFile(this.storage, asset),
+			});
+		});
+	}
+}
diff --git a/apps/api/src/assets/asset-config.ts b/apps/api/src/assets/asset-config.ts
new file mode 100644
index 000000000..aefc7a9a5
--- /dev/null
+++ b/apps/api/src/assets/asset-config.ts
@@ -0,0 +1,29 @@
+const SECOND_MS = 1_000;
+const MINUTE_MS = 60 * SECOND_MS;
+const HOUR_MS = 60 * MINUTE_MS;
+const DAY_MS = 24 * HOUR_MS;
+
+export const ASSETS = {
+	uploadUrlMs: 15 * MINUTE_MS,
+	downloadUrlMs: 15 * MINUTE_MS,
+	intentMs: 24 * HOUR_MS,
+	replayMs: 24 * HOUR_MS,
+	temporaryRetentionMs: 7 * DAY_MS,
+	maxPresignSeconds: (7 * DAY_MS) / SECOND_MS,
+	reservationLimit: 20,
+	maxSingleUploadBytes: 5 * 1024 ** 3 - 5 * 1024 ** 2,
+	network: {
+		connectionTimeoutMs: 5 * SECOND_MS,
+		requestTimeoutMs: 30 * SECOND_MS,
+	},
+	worker: {
+		leaseMs: 2 * MINUTE_MS,
+		heartbeatMs: 30 * SECOND_MS,
+		batchSize: 20,
+		deadlineMs: 50 * SECOND_MS,
+		maxFinalizeAttempts: 5,
+		finalizeDeadlineMs: 24 * HOUR_MS,
+		retryBaseMs: 5 * SECOND_MS,
+		retryMaxMs: HOUR_MS,
+	},
+} as const;
diff --git a/apps/api/src/assets/asset-context.service.ts b/apps/api/src/assets/asset-context.service.ts
new file mode 100644
index 000000000..6f439c869
--- /dev/null
+++ b/apps/api/src/assets/asset-context.service.ts
@@ -0,0 +1,40 @@
+import type { Db } from "@crm/db";
+import { scopedTransaction } from "@crm/db/tenant-scope";
+import {
+	findAssetProject,
+	findProjectAsset,
+	missing,
+	validateAssetAppointment,
+} from "./asset-access.service";
+import type { AssetActor } from "./asset-actor";
+
+export function assetProjectId(db: Db, actor: AssetActor, assetId: string) {
+	return scopedTransaction(db, async (tx) => {
+		const asset = await tx.artifact.findUnique({ where: { id: assetId } });
+		if (!asset) missing();
+		await findAssetProject(tx, actor, asset.dealId);
+		await findProjectAsset(tx, asset.dealId, assetId, actor);
+		return asset.dealId;
+	});
+}
+
+export function appointmentProjectId(
+	db: Db,
+	actor: AssetActor,
+	appointmentId: string,
+) {
+	return scopedTransaction(db, async (tx) => {
+		const appointment = await tx.activity.findUnique({
+			where: { id: appointmentId },
+		});
+		if (!appointment?.dealId) missing();
+		await findAssetProject(tx, actor, appointment.dealId);
+		await validateAssetAppointment(
+			tx,
+			appointment.dealId,
+			appointmentId,
+			false,
+		);
+		return appointment.dealId;
+	});
+}
diff --git a/apps/api/src/assets/asset-error.ts b/apps/api/src/assets/asset-error.ts
new file mode 100644
index 000000000..23c112731
--- /dev/null
+++ b/apps/api/src/assets/asset-error.ts
@@ -0,0 +1,25 @@
+import { HttpException } from "@nestjs/common";
+import { z } from "zod";
+
+const assetErrorDetails = z.object({
+	state: z.string().optional(),
+	maxBytes: z.number().optional(),
+	maxSeconds: z.number().optional(),
+	fields: z
+		.array(z.object({ field: z.string(), message: z.string() }))
+		.optional(),
+});
+export type AssetErrorDetails = z.infer<typeof assetErrorDetails>;
+
+export class AssetError extends HttpException {
+	constructor(
+		status: number,
+		readonly code: string,
+		message: string,
+		readonly details?: AssetErrorDetails,
+		readonly retryable = false,
+	) {
+		super({ code, message, details, retryable }, status);
+		this.name = "AssetError";
+	}
+}
diff --git a/apps/api/src/assets/asset-files.service.ts b/apps/api/src/assets/asset-files.service.ts
new file mode 100644
index 000000000..3a453dadf
--- /dev/null
+++ b/apps/api/src/assets/asset-files.service.ts
@@ -0,0 +1,101 @@
+import type { ArtifactModel as Artifact } from "@crm/db";
+import { findProjectAsset } from "./asset-access.service";
+import type { AssetActor } from "./asset-actor";
+import { ASSETS } from "./asset-config";
+import { AssetError } from "./asset-error";
+import type { AssetMutations } from "./asset-mutation.service";
+import { enqueueAssetObjectDeletion } from "./asset-purge";
+import type { AssetStorageService } from "./asset-storage.service";
+import { assetDeletionSchema, assetDownloadSchema } from "./assets.contracts";
+
+export async function downloadAssetFile(
+	storage: AssetStorageService,
+	asset: Artifact,
+) {
+	if (
+		asset.status !== "READY" ||
+		!asset.storageBucket ||
+		asset.sizeBytes === null ||
+		!storage.configured()
+	)
+		return null;
+	const expiresAt = new Date(Date.now() + ASSETS.downloadUrlMs);
+	try {
+		const url = await storage.presignGet(
+			asset.storageBucket,
+			asset.storageKey,
+			asset.fileName,
+			asset.contentType,
+			expiresAt,
+		);
+		return assetDownloadSchema.parse({
+			url,
+			expiresAt: expiresAt.toISOString(),
+		});
+	} catch (error) {
+		if (error instanceof AssetError) throw error;
+		throw new AssetError(
+			503,
+			"STORAGE_UNAVAILABLE",
+			"File storage is temporarily unavailable.",
+			undefined,
+			true,
+		);
+	}
+}
+
+export class AssetFiles {
+	constructor(private readonly mutations: AssetMutations) {}
+
+	async deleteAsset(
+		actor: AssetActor,
+		projectId: string,
+		assetId: string,
+		key: string,
+	) {
+		return this.mutations.run(
+			actor,
+			projectId,
+			"DELETE_ASSET",
+			`/assets/${assetId}`,
+			key,
+			{},
+			assetDeletionSchema,
+			async (tx) => {
+				const asset = await findProjectAsset(tx, projectId, assetId, actor);
+				if (asset.status === "DELETED") return { assetId, status: "DELETED" };
+				await tx.artifact.update({
+					where: { id: assetId },
+					data: { status: "DELETING" },
+				});
+				await tx.assetEmailSource.updateMany({
+					where: { assetId },
+					data: { deletedAt: new Date() },
+				});
+				const upload = await tx.assetUpload.findUnique({ where: { assetId } });
+				if (upload) {
+					await tx.assetUpload.updateMany({
+						where: { id: upload.id, status: { not: "READY" } },
+						data: { status: "CANCELED", completedAt: new Date() },
+					});
+					await enqueueAssetObjectDeletion(tx, {
+						projectId,
+						bucket: upload.bucket,
+						objectKey: upload.temporaryKey,
+						uploadId: upload.id,
+						temporary: true,
+					});
+				}
+				await enqueueAssetObjectDeletion(tx, {
+					projectId,
+					bucket: asset.storageBucket,
+					objectKey: asset.storageKey,
+					artifactId: assetId,
+					uploadId: upload?.id,
+				});
+				return { assetId, status: "DELETING" };
+			},
+			{ assetId },
+		);
+	}
+}
diff --git a/apps/api/src/assets/asset-metadata.contracts.ts b/apps/api/src/assets/asset-metadata.contracts.ts
new file mode 100644
index 000000000..8cc5942f3
--- /dev/null
+++ b/apps/api/src/assets/asset-metadata.contracts.ts
@@ -0,0 +1,41 @@
+import { z } from "zod";
+import { assetId, assetSchema } from "./assets.contracts";
+
+export const assetMetadataUpdateInput = z
+	.strictObject({
+		expectedVersion: z.number().int().positive().pipe(z.number()).optional(),
+		fileName: z
+			.string()
+			.min(1)
+			.max(255)
+			.regex(/^[^/\\\p{Cc}]+$/u)
+			.optional(),
+		kind: z.string().min(1).max(64).optional(),
+		uploadCompleted: z.literal(true).optional(),
+	})
+	.superRefine((input, context) => {
+		const metadata = input.fileName !== undefined || input.kind !== undefined;
+		if (!metadata && !input.uploadCompleted)
+			context.addIssue({
+				code: "custom",
+				message: "Supply an asset field to update.",
+			});
+		if (metadata && input.expectedVersion === undefined)
+			context.addIssue({
+				code: "custom",
+				path: ["expectedVersion"],
+				message: "Metadata changes require the current version.",
+			});
+		if (!metadata && input.expectedVersion !== undefined)
+			context.addIssue({
+				code: "custom",
+				path: ["expectedVersion"],
+				message: "Only metadata changes accept a version.",
+			});
+	});
+
+export const assetUpdateInput = assetMetadataUpdateInput.safeExtend({
+	assetId,
+});
+export type AssetMetadataUpdateInput = z.infer<typeof assetMetadataUpdateInput>;
+export const assetMetadataResponseSchema = z.object({ asset: assetSchema });
diff --git a/apps/api/src/assets/asset-metadata.service.ts b/apps/api/src/assets/asset-metadata.service.ts
new file mode 100644
index 000000000..02833ffa8
--- /dev/null
+++ b/apps/api/src/assets/asset-metadata.service.ts
@@ -0,0 +1,84 @@
+import type { Prisma } from "@crm/db";
+import { findProjectAsset, requireActiveProject } from "./asset-access.service";
+import type { AssetActor } from "./asset-actor";
+import { AssetError } from "./asset-error";
+import {
+	type AssetMetadataUpdateInput,
+	assetMetadataResponseSchema,
+	assetMetadataUpdateInput,
+} from "./asset-metadata.contracts";
+import type { AssetMutations } from "./asset-mutation.service";
+import { assetResponse } from "./asset-responses";
+import type { AssetStorageService } from "./asset-storage.service";
+import { completeAssetUpload } from "./asset-upload-completion";
+
+export class AssetMetadataService {
+	constructor(
+		private readonly mutations: AssetMutations,
+		private readonly storage: AssetStorageService,
+	) {}
+
+	async updateAsset(
+		actor: AssetActor,
+		projectId: string,
+		assetId: string,
+		raw: AssetMetadataUpdateInput,
+		key: string,
+	) {
+		const parsed = assetMetadataUpdateInput.safeParse(raw);
+		if (!parsed.success)
+			throw new AssetError(
+				400,
+				"VALIDATION_ERROR",
+				"Asset metadata is invalid.",
+			);
+		const input = parsed.data;
+		return this.mutations.run(
+			actor,
+			projectId,
+			"UPDATE_ASSET",
+			`/assets/${assetId}`,
+			key,
+			input,
+			assetMetadataResponseSchema,
+			async (tx, project) => {
+				const asset = await findProjectAsset(tx, projectId, assetId, actor);
+				if (!["READY", "UNVERIFIED"].includes(asset.status))
+					throw new AssetError(
+						409,
+						"ASSET_NOT_READY",
+						"The asset cannot be changed in its current state.",
+						{ state: asset.status },
+					);
+				if (
+					input.expectedVersion !== undefined &&
+					asset.version !== input.expectedVersion
+				)
+					throw new AssetError(
+						409,
+						"VERSION_CONFLICT",
+						"Read the current asset before updating it.",
+					);
+				if (input.uploadCompleted) {
+					requireActiveProject(project);
+					await completeAssetUpload(tx, this.storage, projectId, assetId);
+				}
+				const data: Prisma.ArtifactUpdateInput = {};
+				if (input.fileName !== undefined) data.fileName = input.fileName;
+				if (input.kind !== undefined) {
+					data.kind = input.kind;
+					data.type = input.kind;
+				}
+				if (input.fileName === undefined && input.kind === undefined)
+					return { asset: assetResponse(asset) };
+				const updated = await tx.artifact.update({
+					where: { id: assetId },
+					data: { ...data, updatedAt: new Date(), version: { increment: 1 } },
+					include: { deal: { select: { companyId: true } } },
+				});
+				return { asset: assetResponse(updated) };
+			},
+			{ assetId },
+		);
+	}
+}
diff --git a/apps/api/src/assets/asset-mutation.service.ts b/apps/api/src/assets/asset-mutation.service.ts
new file mode 100644
index 000000000..0f346c844
--- /dev/null
+++ b/apps/api/src/assets/asset-mutation.service.ts
@@ -0,0 +1,107 @@
+import { createHash } from "node:crypto";
+import type { Db, Prisma } from "@crm/db";
+import { scopedTransaction } from "@crm/db/tenant-scope";
+import type { z } from "zod";
+import {
+	findAssetProject,
+	findProjectAsset,
+	missing,
+} from "./asset-access.service";
+import { type AssetActor, assetActorKey } from "./asset-actor";
+import { ASSETS } from "./asset-config";
+import { AssetError } from "./asset-error";
+
+export function hashAssetRequest(value: Prisma.InputJsonValue) {
+	return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+
+export class AssetMutations {
+	constructor(private readonly db: Db) {}
+
+	async run<T>(
+		actor: AssetActor,
+		projectId: string,
+		operation: string,
+		path: string,
+		key: string,
+		input: Prisma.InputJsonValue,
+		schema: z.ZodType<T>,
+		action: (
+			tx: Prisma.TransactionClient,
+			project: Awaited<ReturnType<typeof findAssetProject>>,
+		) => Promise<T>,
+		target?: {
+			assetId?: string;
+			appointmentId?: string;
+			emailMessageId?: string;
+		},
+	) {
+		if (!/^[\x20-\x7e]{1,128}$/.test(key ?? ""))
+			throw new AssetError(
+				400,
+				"VALIDATION_ERROR",
+				"A valid Idempotency-Key is required.",
+			);
+		const actorKey = assetActorKey(actor);
+		const requestHash = hashAssetRequest(input);
+		return scopedTransaction(
+			this.db,
+			async (tx) => {
+				await tx.$executeRaw`SELECT pg_advisory_xact_lock(hashtextextended(${actorKey}, 0))`;
+				const project = await findAssetProject(tx, actor, projectId, true);
+				if (target?.assetId)
+					await findProjectAsset(tx, projectId, target.assetId, actor);
+				if (
+					target?.appointmentId &&
+					!(await tx.activity.findFirst({
+						where: {
+							id: target.appointmentId,
+							dealId: projectId,
+							type: "MEETING",
+							appointmentDetails: { isNot: null },
+						},
+						select: { id: true },
+					}))
+				)
+					missing();
+				if (
+					target?.emailMessageId &&
+					!(await tx.emailMessage.findUnique({
+						where: { id: target.emailMessageId },
+						select: { id: true },
+					}))
+				)
+					missing();
+				const identity = { actorKey, operation, path, idempotencyKey: key };
+				const prior = await tx.assetApiRequest.findUnique({
+					where: { actorKey_operation_path_idempotencyKey: identity },
+				});
+				if (prior && prior.expiresAt > new Date()) {
+					if (prior.requestHash !== requestHash)
+						throw new AssetError(
+							409,
+							"IDEMPOTENCY_CONFLICT",
+							"The idempotency key has different request data.",
+						);
+					return schema.parse(prior.responseBody);
+				}
+				const response = schema.parse(await action(tx, project));
+				const data = {
+					requestHash,
+					responseStatus: 200,
+					responseBody: JSON.parse(
+						JSON.stringify(response),
+					) as Prisma.InputJsonValue,
+					expiresAt: new Date(Date.now() + ASSETS.replayMs),
+				};
+				await tx.assetApiRequest.upsert({
+					where: { actorKey_operation_path_idempotencyKey: identity },
+					create: { ...identity, ...data },
+					update: data,
+				});
+				return response;
+			},
+			{ timeout: ASSETS.worker.leaseMs },
+		);
+	}
+}
diff --git a/apps/api/src/assets/asset-openapi.ts b/apps/api/src/assets/asset-openapi.ts
new file mode 100644
index 000000000..d36ae10be
--- /dev/null
+++ b/apps/api/src/assets/asset-openapi.ts
@@ -0,0 +1,64 @@
+import type { OpenAPIObject } from "trpc-to-openapi";
+import { z } from "zod";
+import { type RestMethod, restMeta } from "../trpc/openapi";
+import { isProjectResourcePath } from "./asset-public-routes";
+import { assetErrorEnvelopeSchema } from "./assets.contracts";
+
+const requestHeaders = z.object({
+	"X-Request-Id": z.string().max(128).optional(),
+});
+const mutationHeaders = requestHeaders.extend({
+	"Idempotency-Key": z
+		.string()
+		.min(1)
+		.max(128)
+		.regex(/^[\x20-\x7e]+$/),
+});
+
+export function assetRestMeta(method: RestMethod, path: `/${string}`) {
+	const meta = restMeta(method, path, ["Assets"]);
+	if (meta.openapi) {
+		meta.openapi.requestHeaders =
+			method === "GET" ? requestHeaders : mutationHeaders;
+		meta.openapi.responseHeaders = z.object({
+			"Cache-Control": z.literal("private, no-store"),
+			"X-Request-Id": z.string(),
+		});
+		meta.openapi.errorResponses = [400, 401, 403, 404, 409, 413, 429, 500, 503];
+	}
+	return meta;
+}
+
+export const assetRoutes = {
+	createProjectAsset: assetRestMeta("POST", "/projects/{projectId}/assets"),
+	createAppointmentAsset: assetRestMeta(
+		"POST",
+		"/appointments/{appointmentId}/assets",
+	),
+	listProjectAssets: assetRestMeta("GET", "/projects/{projectId}/assets"),
+	listAppointmentAssets: assetRestMeta(
+		"GET",
+		"/appointments/{appointmentId}/assets",
+	),
+	getAsset: assetRestMeta("GET", "/assets/{assetId}"),
+	updateAsset: assetRestMeta("PATCH", "/assets/{assetId}"),
+	deleteAsset: assetRestMeta("DELETE", "/assets/{assetId}"),
+};
+
+export function describeAssetErrors(document: OpenAPIObject): void {
+	for (const [path, methods] of Object.entries(document.paths ?? {})) {
+		if (!isProjectResourcePath(path)) continue;
+		for (const method of ["get", "post", "patch", "delete"] as const) {
+			const responses = methods[method]?.responses;
+			if (!responses) continue;
+			for (const [status, response] of Object.entries(responses)) {
+				if (Number(status) < 400 || "$ref" in response) continue;
+				response.content = {
+					"application/json": {
+						schema: z.toJSONSchema(assetErrorEnvelopeSchema),
+					},
+				};
+			}
+		}
+	}
+}
diff --git a/apps/api/src/assets/asset-public-routes.ts b/apps/api/src/assets/asset-public-routes.ts
new file mode 100644
index 000000000..112f6353d
--- /dev/null
+++ b/apps/api/src/assets/asset-public-routes.ts
@@ -0,0 +1,7 @@
+const assetPath =
+	/^\/(?:assets(?:\/|$)|(?:projects|appointments)\/[^/]+\/assets(?:\/|$))/i;
+const appointmentPath = /^\/projects\/[^/]+\/appointments(?:\/|$)/i;
+
+export function isProjectResourcePath(path: string): boolean {
+	return assetPath.test(path) || appointmentPath.test(path);
+}
diff --git a/apps/api/src/assets/asset-purge.ts b/apps/api/src/assets/asset-purge.ts
new file mode 100644
index 000000000..d5fae056b
--- /dev/null
+++ b/apps/api/src/assets/asset-purge.ts
@@ -0,0 +1,73 @@
+import type { Prisma } from "@crm/db";
+
+export async function enqueueAssetObjectDeletion(
+	tx: Prisma.TransactionClient,
+	input: {
+		projectId: string;
+		bucket: string | null;
+		objectKey: string;
+		uploadId?: string;
+		artifactId?: string;
+		temporary?: boolean;
+	},
+) {
+	const operationKey = input.temporary
+		? `temporary:${input.uploadId}`
+		: input.artifactId
+			? `artifact:${input.artifactId}`
+			: `orphan:${input.uploadId}`;
+	return tx.assetStorageJob.upsert({
+		where: { operationKey },
+		create: {
+			...input,
+			operationKey,
+			operation: "DELETE_OBJECT",
+			nextAttemptAt: new Date(),
+		},
+		update: {},
+	});
+}
+
+export async function enqueueProjectAssetPurge(
+	tx: Prisma.TransactionClient,
+	projectId: string,
+) {
+	await tx.$queryRaw`SELECT "id" FROM "deal" WHERE "id" = ${projectId} FOR UPDATE`;
+	const artifacts = await tx.artifact.findMany({
+		where: { dealId: projectId },
+	});
+	const uploads = await tx.assetUpload.findMany({ where: { projectId } });
+	for (const asset of artifacts) {
+		await enqueueAssetObjectDeletion(tx, {
+			projectId,
+			bucket: asset.storageBucket,
+			objectKey: asset.storageKey,
+			artifactId: asset.id,
+		});
+	}
+	for (const upload of uploads) {
+		await enqueueAssetObjectDeletion(tx, {
+			projectId,
+			bucket: upload.bucket,
+			objectKey: upload.temporaryKey,
+			uploadId: upload.id,
+			temporary: true,
+		});
+		if (!upload.assetId) {
+			await enqueueAssetObjectDeletion(tx, {
+				projectId,
+				bucket: upload.bucket,
+				objectKey: upload.finalKey,
+				uploadId: upload.id,
+			});
+		}
+	}
+	await tx.assetUpload.updateMany({
+		where: { projectId, status: { in: ["PENDING", "FINALIZING"] } },
+		data: { status: "CANCELED", completedAt: new Date() },
+	});
+	await tx.assetEmailSource.updateMany({
+		where: { projectId, deletedAt: null },
+		data: { deletedAt: new Date() },
+	});
+}
diff --git a/apps/api/src/assets/asset-request.ts b/apps/api/src/assets/asset-request.ts
new file mode 100644
index 000000000..de3c3223c
--- /dev/null
+++ b/apps/api/src/assets/asset-request.ts
@@ -0,0 +1,34 @@
+import type { AuthedTrpcContext } from "../trpc/context.types";
+import type { AssetActor } from "./asset-actor";
+import { AssetError } from "./asset-error";
+
+export function assetUser(ctx: AuthedTrpcContext): AssetActor {
+	return { type: "USER", userId: ctx.user.id };
+}
+
+export function idempotencyKey(ctx: AuthedTrpcContext): string {
+	const key = optionalIdempotencyKey(ctx);
+	if (!key) {
+		throw new AssetError(
+			400,
+			"VALIDATION_ERROR",
+			"A valid Idempotency-Key header is required.",
+		);
+	}
+	return key;
+}
+
+export function optionalIdempotencyKey(
+	ctx: AuthedTrpcContext,
+): string | undefined {
+	const key = ctx.req?.header("Idempotency-Key");
+	if (key === undefined || key === "") return undefined;
+	if (!/^[\x20-\x7e]{1,128}$/.test(key)) {
+		throw new AssetError(
+			400,
+			"VALIDATION_ERROR",
+			"A valid Idempotency-Key header is required.",
+		);
+	}
+	return key;
+}
diff --git a/apps/api/src/assets/asset-responses.ts b/apps/api/src/assets/asset-responses.ts
new file mode 100644
index 000000000..f3ba09672
--- /dev/null
+++ b/apps/api/src/assets/asset-responses.ts
@@ -0,0 +1,35 @@
+import type { ArtifactModel as Artifact } from "@crm/db";
+
+export function assetResponse(
+	asset: Artifact & { deal: { companyId: string } },
+) {
+	return {
+		id: asset.id,
+		customerId: asset.deal.companyId,
+		projectId: asset.dealId,
+		appointmentId: asset.activityId,
+		fileName: asset.fileName,
+		contentType: asset.contentType,
+		sizeBytes: asset.sizeBytes === null ? null : Number(asset.sizeBytes),
+		kind: asset.kind,
+		source: asset.source,
+		emailSource:
+			asset.emailMessageId && asset.emailAttachmentId
+				? {
+						messageId: asset.emailMessageId,
+						attachmentId: asset.emailAttachmentId,
+					}
+				: null,
+		uploadedById: asset.uploadedById,
+		durationMilliseconds:
+			asset.durationMilliseconds === null
+				? null
+				: Number(asset.durationMilliseconds),
+		capturedAt: asset.capturedAt?.toISOString() ?? null,
+		createdAt: asset.createdAt.toISOString(),
+		updatedAt: asset.updatedAt.toISOString(),
+		version: asset.version,
+		status: asset.status,
+		deletedAt: asset.deletedAt?.toISOString() ?? null,
+	};
+}
diff --git a/apps/api/src/assets/asset-rest.ts b/apps/api/src/assets/asset-rest.ts
new file mode 100644
index 000000000..1b1055fb4
--- /dev/null
+++ b/apps/api/src/assets/asset-rest.ts
@@ -0,0 +1,194 @@
+import { randomUUID } from "node:crypto";
+import type { TRPCError } from "@trpc/server";
+import type { Request, Response } from "express";
+import { z } from "zod";
+import { AssetError } from "./asset-error";
+import { isProjectResourcePath } from "./asset-public-routes";
+import { assetErrorEnvelopeSchema } from "./assets.contracts";
+
+const domainFailure = assetErrorEnvelopeSchema.shape.error
+	.omit({ requestId: true })
+	.partial({ retryable: true });
+const rawMutationNumbers = z.object({
+	sizeBytes: z.number().optional(),
+	durationMilliseconds: z.number().nullable().optional(),
+	expectedVersion: z.number().optional(),
+	uploadCompleted: z.literal(true).optional(),
+});
+type AssetFailure = {
+	status: number;
+	body: {
+		error: z.infer<typeof domainFailure> & {
+			requestId: string;
+			retryable: boolean;
+		};
+	};
+};
+type AssetRequestState = { requestId: string; failure?: AssetFailure };
+const requests = new WeakMap<Request, AssetRequestState>();
+
+export function prepareAssetRestResponse(req: Request, res: Response): void {
+	if (
+		!isProjectResourcePath(
+			new URL(req.originalUrl, "http://localhost").pathname,
+		)
+	)
+		return;
+	const supplied = req.header("X-Request-Id");
+	const requestId =
+		supplied && /^[A-Za-z0-9._:-]{1,128}$/.test(supplied)
+			? supplied
+			: randomUUID();
+	const state: AssetRequestState = { requestId };
+	requests.set(req, state);
+	res.setHeader("Cache-Control", "private, no-store");
+	res.setHeader("X-Request-Id", requestId);
+	res.end = new Proxy(res.end, {
+		apply(end, response, args) {
+			requests.delete(req);
+			if (!state.failure) return Reflect.apply(end, response, args);
+			res.statusCode = state.failure.status;
+			res.removeHeader("Content-Length");
+			if (state.failure.status === 429) res.setHeader("Retry-After", "60");
+			return Reflect.apply(end, response, [JSON.stringify(state.failure.body)]);
+		},
+	});
+}
+
+export function validateAssetRestRequest(req: Request): void {
+	if (!requests.has(req)) return;
+	const url = new URL(req.originalUrl, "http://localhost");
+	const forbiddenQuery = [
+		"customerId",
+		"projectId",
+		"uploadId",
+		"assetId",
+		"appointmentId",
+	];
+	if (forbiddenQuery.some((key) => url.searchParams.has(key))) {
+		throw new AssetError(
+			400,
+			"VALIDATION_ERROR",
+			"Path identifiers cannot appear in the query.",
+		);
+	}
+	if (["POST", "PATCH", "DELETE"].includes(req.method) && url.search)
+		throw new AssetError(
+			400,
+			"VALIDATION_ERROR",
+			"Mutations do not accept query parameters.",
+		);
+	if (req.method === "POST" || req.method === "PATCH") {
+		const body = z.record(z.string(), z.json()).safeParse(req.body);
+		if (
+			!body.success ||
+			["projectId", "uploadId", "assetId", "customerId", "appointmentId"].some(
+				(key) => key in body.data,
+			)
+		) {
+			throw new AssetError(
+				400,
+				"VALIDATION_ERROR",
+				"Send a JSON object without path identifiers.",
+			);
+		}
+		if (!rawMutationNumbers.safeParse(body.data).success) {
+			throw new AssetError(
+				400,
+				"VALIDATION_ERROR",
+				"Byte counts, durations, and versions must use JSON numbers.",
+			);
+		}
+	}
+	if (
+		(req.method === "DELETE" || req.method === "GET") &&
+		(req.headers["transfer-encoding"] ||
+			Number(req.header("content-length") ?? 0) > 0)
+	) {
+		throw new AssetError(
+			400,
+			"VALIDATION_ERROR",
+			"This operation does not accept a request body.",
+		);
+	}
+}
+
+export function recordAssetRestError(req: Request, error: TRPCError): void {
+	const state = requests.get(req);
+	if (!state) return;
+	const cause = error.cause;
+	if (cause instanceof AssetError) {
+		const parsed = domainFailure.safeParse(cause.getResponse());
+		if (parsed.success) {
+			state.failure = {
+				status: cause.getStatus(),
+				body: {
+					error: {
+						...parsed.data,
+						requestId: state.requestId,
+						retryable: parsed.data.retryable ?? false,
+					},
+				},
+			};
+			return;
+		}
+	}
+	const failure = fallbackFailure(error);
+	state.failure = {
+		status: failure.status,
+		body: {
+			error: {
+				code: failure.code,
+				message: failure.message,
+				requestId: state.requestId,
+				retryable: false,
+			},
+		},
+	};
+	if (error.code === "BAD_REQUEST" && cause instanceof z.ZodError) {
+		state.failure.body.error.details = {
+			fields: cause.issues.map((issue) => ({
+				field: issue.path.join("."),
+				message: issue.message,
+			})),
+		};
+	}
+}
+
+function fallbackFailure(error: TRPCError) {
+	switch (error.code) {
+		case "UNAUTHORIZED":
+			return {
+				status: 401,
+				code: "AUTH_REQUIRED",
+				message: "Authentication is required.",
+			};
+		case "FORBIDDEN":
+			return {
+				status: 403,
+				code: "FORBIDDEN",
+				message: "This operation is not permitted.",
+			};
+		case "NOT_FOUND":
+			return {
+				status: 404,
+				code: "RESOURCE_NOT_FOUND",
+				message: "The resource was not found.",
+			};
+		case "BAD_REQUEST":
+		case "PARSE_ERROR":
+		case "UNSUPPORTED_MEDIA_TYPE":
+		case "PAYLOAD_TOO_LARGE":
+			return {
+				status: 400,
+				code: "VALIDATION_ERROR",
+				message: "The request metadata is invalid.",
+			};
+		default:
+			return {
+				status: 500,
+				code: "INTERNAL_ERROR",
+				message: "The operation failed. Check its status before retrying.",
+			};
+	}
+}
diff --git a/apps/api/src/assets/asset-storage-client.ts b/apps/api/src/assets/asset-storage-client.ts
new file mode 100644
index 000000000..ecc46b084
--- /dev/null
+++ b/apps/api/src/assets/asset-storage-client.ts
@@ -0,0 +1,93 @@
+import { S3Client } from "@aws-sdk/client-s3";
+import { ConfigService } from "@nestjs/config";
+import type { EnvironmentVariables } from "../config/env.validation";
+import { ASSETS } from "./asset-config";
+import { AssetError } from "./asset-error";
+
+export type R2Config = {
+	accountId?: string;
+	accessKeyId?: string;
+	secretAccessKey?: string;
+	bucket?: string;
+};
+
+export function readR2Config(
+	config?: ConfigService<EnvironmentVariables, false>,
+): R2Config {
+	return {
+		accountId: readConfigValue(config, "R2_ACCOUNT_ID"),
+		accessKeyId: readConfigValue(config, "R2_ACCESS_KEY_ID"),
+		secretAccessKey: readConfigValue(config, "R2_SECRET_ACCESS_KEY"),
+		bucket: readConfigValue(config, "R2_BUCKET"),
+	};
+}
+
+export function isR2Configured(r2: R2Config): boolean {
+	return Boolean(
+		r2.accountId && r2.accessKeyId && r2.secretAccessKey && r2.bucket,
+	);
+}
+
+export function createR2Client(r2: R2Config): S3Client | null {
+	if (!isR2Configured(r2)) return null;
+
+	return new S3Client({
+		region: "auto",
+		endpoint: `https://${r2.accountId}.r2.cloudflarestorage.com`,
+		forcePathStyle: true,
+		credentials: {
+			accessKeyId: r2.accessKeyId as string,
+			secretAccessKey: r2.secretAccessKey as string,
+		},
+		maxAttempts: 1,
+		requestChecksumCalculation: "WHEN_REQUIRED",
+		responseChecksumValidation: "WHEN_REQUIRED",
+		requestHandler: {
+			connectionTimeout: ASSETS.network.connectionTimeoutMs,
+			requestTimeout: ASSETS.network.requestTimeoutMs,
+			throwOnRequestTimeout: true,
+		},
+	});
+}
+
+export function requireStorageClient(
+	client: S3Client | null,
+	configured: boolean,
+): S3Client {
+	if (!configured || !client) {
+		throw new AssetError(
+			503,
+			"STORAGE_UNAVAILABLE",
+			"Object storage is not configured.",
+			undefined,
+			false,
+		);
+	}
+
+	return client;
+}
+
+export function requireBucketName(bucket: string): void {
+	if (!bucket.trim()) {
+		throw new AssetError(
+			400,
+			"VALIDATION_ERROR",
+			"A storage bucket is required.",
+			undefined,
+			false,
+		);
+	}
+}
+
+function readConfigValue(
+	config: ConfigService<EnvironmentVariables, false> | undefined,
+	key: keyof Pick<
+		EnvironmentVariables,
+		"R2_ACCOUNT_ID" | "R2_ACCESS_KEY_ID" | "R2_SECRET_ACCESS_KEY" | "R2_BUCKET"
+	>,
+): string | undefined {
+	const configured = config?.get<string>(key);
+	const value = configured ?? process.env[key];
+	const normalized = value?.trim();
+	return normalized || undefined;
+}
diff --git a/apps/api/src/assets/asset-storage-errors.ts b/apps/api/src/assets/asset-storage-errors.ts
new file mode 100644
index 000000000..828d449ae
--- /dev/null
+++ b/apps/api/src/assets/asset-storage-errors.ts
@@ -0,0 +1,56 @@
+import { z } from "zod";
+import { AssetError } from "./asset-error";
+
+const s3ErrorSchema = z.object({
+	$metadata: z
+		.object({ httpStatusCode: z.number().int().optional() })
+		.optional(),
+	Code: z.string().optional(),
+	code: z.string().optional(),
+	name: z.string().optional(),
+	statusCode: z.number().int().optional(),
+});
+
+type S3Error = z.infer<typeof s3ErrorSchema>;
+
+export function parseS3Error(cause: unknown): S3Error {
+	const parsed = s3ErrorSchema.safeParse(cause);
+	return parsed.success ? parsed.data : {};
+}
+
+export function isNotFound(error: S3Error): boolean {
+	const status = statusCode(error);
+	const name = errorName(error);
+	return (
+		status === 404 ||
+		name === "NotFound" ||
+		name === "NoSuchKey" ||
+		name === "NoSuchObject"
+	);
+}
+
+export function isPreconditionFailure(error: S3Error): boolean {
+	const status = statusCode(error);
+	const name = errorName(error);
+	return status === 412 || name === "PreconditionFailed";
+}
+
+export function storageError(error: S3Error): AssetError {
+	const status = statusCode(error);
+	const retryable = status === undefined || status >= 500 || status === 429;
+	return new AssetError(
+		503,
+		"STORAGE_UNAVAILABLE",
+		"Object storage request failed.",
+		undefined,
+		retryable,
+	);
+}
+
+function statusCode(error: S3Error): number | undefined {
+	return error.$metadata?.httpStatusCode ?? error.statusCode;
+}
+
+function errorName(error: S3Error): string | undefined {
+	return error.name ?? error.Code ?? error.code;
+}
diff --git a/apps/api/src/assets/asset-storage-keys.ts b/apps/api/src/assets/asset-storage-keys.ts
new file mode 100644
index 000000000..1e7fd906d
--- /dev/null
+++ b/apps/api/src/assets/asset-storage-keys.ts
@@ -0,0 +1,12 @@
+export function createAssetStorageKeys(input: {
+	organizationId: string;
+	projectId: string;
+	uploadId: string;
+	objectId: string;
+}) {
+	const projectPrefix = `${input.organizationId}/projects/${input.projectId}`;
+	return {
+		temporaryKey: `temporary/${projectPrefix}/${input.uploadId}`,
+		finalKey: `${projectPrefix}/assets/${input.objectId}`,
+	};
+}
diff --git a/apps/api/src/assets/asset-storage-objects.ts b/apps/api/src/assets/asset-storage-objects.ts
new file mode 100644
index 000000000..a433e3664
--- /dev/null
+++ b/apps/api/src/assets/asset-storage-objects.ts
@@ -0,0 +1,101 @@
+import {
+	CopyObjectCommand,
+	DeleteObjectCommand,
+	HeadObjectCommand,
+	S3Client,
+} from "@aws-sdk/client-s3";
+import { AssetError } from "./asset-error";
+import {
+	isNotFound,
+	isPreconditionFailure,
+	parseS3Error,
+	storageError,
+} from "./asset-storage-errors";
+
+export type AssetStorageHead = {
+	sizeBytes: number;
+	etag: string;
+	contentType: string | null;
+};
+
+export async function headObject(
+	client: S3Client,
+	bucket: string,
+	key: string,
+	signal?: AbortSignal,
+): Promise<AssetStorageHead | null> {
+	try {
+		const response = await client.send(
+			new HeadObjectCommand({ Bucket: bucket, Key: key }),
+			{ abortSignal: signal },
+		);
+		if (response.ContentLength === undefined || !response.ETag) {
+			throw new AssetError(
+				503,
+				"STORAGE_UNAVAILABLE",
+				"Object storage returned incomplete metadata.",
+				undefined,
+				false,
+			);
+		}
+
+		return {
+			sizeBytes: response.ContentLength,
+			etag: response.ETag,
+			contentType: response.ContentType ?? null,
+		};
+	} catch (error) {
+		if (error instanceof AssetError) throw error;
+		const parsedError = parseS3Error(error);
+		if (isNotFound(parsedError)) return null;
+		throw storageError(parsedError);
+	}
+}
+
+export async function copyObject(
+	client: S3Client,
+	bucket: string,
+	sourceKey: string,
+	finalKey: string,
+	sourceEtag: string,
+	signal?: AbortSignal,
+): Promise<void> {
+	try {
+		await client.send(
+			new CopyObjectCommand({
+				Bucket: bucket,
+				Key: finalKey,
+				CopySource: `${bucket}/${sourceKey}`,
+				CopySourceIfMatch: sourceEtag,
+			}),
+			{ abortSignal: signal },
+		);
+	} catch (error) {
+		const parsedError = parseS3Error(error);
+		if (isPreconditionFailure(parsedError)) {
+			throw new AssetError(
+				409,
+				"SOURCE_ETAG_MISMATCH",
+				"The source object changed before finalization.",
+				undefined,
+				false,
+			);
+		}
+		throw storageError(parsedError);
+	}
+}
+
+export async function deleteObject(
+	client: S3Client,
+	bucket: string,
+	key: string,
+	signal?: AbortSignal,
+): Promise<void> {
+	try {
+		await client.send(new DeleteObjectCommand({ Bucket: bucket, Key: key }), {
+			abortSignal: signal,
+		});
+	} catch (error) {
+		throw storageError(parseS3Error(error));
+	}
+}
diff --git a/apps/api/src/assets/asset-storage-signing.ts b/apps/api/src/assets/asset-storage-signing.ts
new file mode 100644
index 000000000..e4e01c0dc
--- /dev/null
+++ b/apps/api/src/assets/asset-storage-signing.ts
@@ -0,0 +1,74 @@
+import {
+	GetObjectCommand,
+	PutObjectCommand,
+	S3Client,
+} from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { parseS3Error, storageError } from "./asset-storage-errors";
+
+const DEFAULT_CONTENT_TYPE = "application/octet-stream";
+
+export async function presignPutObject(
+	client: S3Client,
+	bucket: string,
+	key: string,
+	contentType: string,
+	sizeBytes: number,
+	expiresIn: number,
+): Promise<string> {
+	try {
+		return await getSignedUrl(
+			client,
+			new PutObjectCommand({
+				Bucket: bucket,
+				Key: key,
+				ContentType: contentType || DEFAULT_CONTENT_TYPE,
+				ContentLength: sizeBytes,
+			}),
+			{
+				expiresIn,
+				signableHeaders: new Set(["content-length", "content-type"]),
+			},
+		);
+	} catch (error) {
+		throw storageError(parseS3Error(error));
+	}
+}
+
+export async function presignGetObject(
+	client: S3Client,
+	bucket: string,
+	key: string,
+	fileName: string,
+	contentType: string,
+	expiresIn: number,
+): Promise<string> {
+	try {
+		return await getSignedUrl(
+			client,
+			new GetObjectCommand({
+				Bucket: bucket,
+				Key: key,
+				ResponseContentDisposition: contentDisposition(fileName),
+				ResponseContentType: contentType || DEFAULT_CONTENT_TYPE,
+			}),
+			{ expiresIn },
+		);
+	} catch (error) {
+		throw storageError(parseS3Error(error));
+	}
+}
+
+function contentDisposition(fileName: string): string {
+	const fallback =
+		fileName
+			.normalize("NFKD")
+			.replace(/[^\x20-\x7e]/g, "_")
+			.replace(/[\\"]/g, "_") || "download";
+	const encoded = encodeURIComponent(fileName).replace(
+		/[!'()*]/g,
+		(character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,
+	);
+
+	return `attachment; filename="${fallback}"; filename*=UTF-8''${encoded}`;
+}
diff --git a/apps/api/src/assets/asset-storage-validation.ts b/apps/api/src/assets/asset-storage-validation.ts
new file mode 100644
index 000000000..92aa1f26e
--- /dev/null
+++ b/apps/api/src/assets/asset-storage-validation.ts
@@ -0,0 +1,39 @@
+import { ASSETS } from "./asset-config";
+import { AssetError } from "./asset-error";
+
+export function validateUploadSize(sizeBytes: number): void {
+	if (
+		!Number.isSafeInteger(sizeBytes) ||
+		sizeBytes < 0 ||
+		sizeBytes > ASSETS.maxSingleUploadBytes
+	) {
+		throw new AssetError(
+			413,
+			"UPLOAD_TOO_LARGE",
+			"The file exceeds the single-upload limit.",
+			{ maxBytes: ASSETS.maxSingleUploadBytes },
+			false,
+		);
+	}
+}
+
+export function expiresInSeconds(expiresAt: Date): number {
+	const remainingMs = expiresAt.getTime() - Date.now();
+	const seconds = Math.ceil(remainingMs / 1_000);
+
+	if (
+		!Number.isFinite(seconds) ||
+		seconds < 1 ||
+		seconds > ASSETS.maxPresignSeconds
+	) {
+		throw new AssetError(
+			400,
+			"INVALID_EXPIRY",
+			"The storage grant expiry is invalid.",
+			{ maxSeconds: ASSETS.maxPresignSeconds },
+			false,
+		);
+	}
+
+	return seconds;
+}
diff --git a/apps/api/src/assets/asset-storage.service.ts b/apps/api/src/assets/asset-storage.service.ts
new file mode 100644
index 000000000..7074d4f4f
--- /dev/null
+++ b/apps/api/src/assets/asset-storage.service.ts
@@ -0,0 +1,135 @@
+import { S3Client } from "@aws-sdk/client-s3";
+import { Injectable, Optional } from "@nestjs/common";
+import { ConfigService } from "@nestjs/config";
+import type { EnvironmentVariables } from "../config/env.validation";
+import { AssetError } from "./asset-error";
+import {
+	createR2Client,
+	isR2Configured,
+	type R2Config,
+	readR2Config,
+	requireBucketName,
+	requireStorageClient,
+} from "./asset-storage-client";
+import {
+	type AssetStorageHead,
+	copyObject,
+	deleteObject,
+	headObject,
+} from "./asset-storage-objects";
+import { presignGetObject, presignPutObject } from "./asset-storage-signing";
+import {
+	expiresInSeconds,
+	validateUploadSize,
+} from "./asset-storage-validation";
+
+export type { AssetStorageHead } from "./asset-storage-objects";
+
+@Injectable()
+export class AssetStorageService {
+	private readonly r2: R2Config;
+	private readonly client: S3Client | null;
+
+	constructor(
+		@Optional() config?: ConfigService<EnvironmentVariables, false>,
+		@Optional() client?: S3Client,
+	) {
+		this.r2 = readR2Config(config);
+		this.client = client ?? createR2Client(this.r2);
+	}
+
+	configured(): boolean {
+		return isR2Configured(this.r2);
+	}
+
+	bucket(): string {
+		if (!this.r2.bucket) {
+			throw new AssetError(
+				503,
+				"STORAGE_UNAVAILABLE",
+				"Object storage is not configured.",
+				undefined,
+				false,
+			);
+		}
+
+		return this.r2.bucket;
+	}
+
+	async presignPut(
+		bucket: string,
+		key: string,
+		contentType: string,
+		sizeBytes: number,
+		expiresAt: Date,
+	): Promise<string> {
+		validateUploadSize(sizeBytes);
+		const expiresIn = expiresInSeconds(expiresAt);
+		const client = this.requireClient();
+		requireBucketName(bucket);
+		return presignPutObject(
+			client,
+			bucket,
+			key,
+			contentType,
+			sizeBytes,
+			expiresIn,
+		);
+	}
+
+	async presignGet(
+		bucket: string,
+		key: string,
+		fileName: string,
+		contentType: string,
+		expiresAt: Date,
+	): Promise<string> {
+		const expiresIn = expiresInSeconds(expiresAt);
+		const client = this.requireClient();
+		requireBucketName(bucket);
+		return presignGetObject(
+			client,
+			bucket,
+			key,
+			fileName,
+			contentType,
+			expiresIn,
+		);
+	}
+
+	async head(
+		bucket: string,
+		key: string,
+		signal?: AbortSignal,
+	): Promise<AssetStorageHead | null> {
+		const client = this.requireClient();
+		requireBucketName(bucket);
+		return headObject(client, bucket, key, signal);
+	}
+
+	async copy(
+		bucket: string,
+		sourceKey: string,
+		finalKey: string,
+		sourceEtag: string,
+		signal?: AbortSignal,
+	): Promise<void> {
+		const client = this.requireClient();
+		requireBucketName(bucket);
+		return copyObject(client, bucket, sourceKey, finalKey, sourceEtag, signal);
+	}
+
+	async delete(
+		bucket: string,
+		key: string,
+		signal?: AbortSignal,
+	): Promise<void> {
+		const client = this.requireClient();
+		requireBucketName(bucket);
+		return deleteObject(client, bucket, key, signal);
+	}
+
+	private requireClient(): S3Client {
+		return requireStorageClient(this.client, this.configured());
+	}
+}
diff --git a/apps/api/src/assets/asset-transfer.contracts.ts b/apps/api/src/assets/asset-transfer.contracts.ts
new file mode 100644
index 000000000..b11514a4b
--- /dev/null
+++ b/apps/api/src/assets/asset-transfer.contracts.ts
@@ -0,0 +1,12 @@
+import { z } from "zod";
+
+export const assetTransferSchema = z.object({
+	method: z.literal("PUT"),
+	url: z.url(),
+	headers: z.object({
+		"Content-Type": z.string(),
+		"Content-Length": z.string(),
+	}),
+	expiresAt: z.iso.datetime(),
+	maxBytes: z.number().int(),
+});
diff --git a/apps/api/src/assets/asset-transfer.service.ts b/apps/api/src/assets/asset-transfer.service.ts
new file mode 100644
index 000000000..1b0f648bc
--- /dev/null
+++ b/apps/api/src/assets/asset-transfer.service.ts
@@ -0,0 +1,86 @@
+import type { Db } from "@crm/db";
+import { scopedTransaction } from "@crm/db/tenant-scope";
+import {
+	findAssetProject,
+	findProjectAsset,
+	missing,
+	requireActiveProject,
+} from "./asset-access.service";
+import type { AssetActor } from "./asset-actor";
+import { ASSETS } from "./asset-config";
+import { AssetError } from "./asset-error";
+import type { AssetStorageService } from "./asset-storage.service";
+import { assetTransferSchema } from "./asset-transfer.contracts";
+
+export function requireAssetStorage(storage: AssetStorageService) {
+	if (!storage.configured())
+		throw new AssetError(
+			503,
+			"STORAGE_UNAVAILABLE",
+			"File storage is not configured.",
+		);
+}
+
+export class AssetTransfers {
+	constructor(
+		private readonly db: Db,
+		private readonly storage: AssetStorageService,
+	) {}
+
+	async issue(actor: AssetActor, projectId: string, assetId: string) {
+		return scopedTransaction(this.db, async (tx) => {
+			const project = await findAssetProject(tx, actor, projectId, true);
+			const asset = await findProjectAsset(tx, projectId, assetId, actor);
+			const upload = await tx.assetUpload.findUnique({ where: { assetId } });
+			if (!upload || upload.projectId !== asset.dealId) missing();
+			if (
+				asset.status !== "UNVERIFIED" ||
+				upload.status !== "PENDING" ||
+				upload.expiresAt <= new Date()
+			)
+				return null;
+			requireActiveProject(project);
+			requireAssetStorage(this.storage);
+			const grantExpiresAt = new Date(
+				Math.min(Date.now() + ASSETS.uploadUrlMs, upload.expiresAt.getTime()),
+			);
+			await tx.assetUpload.update({
+				where: { id: upload.id },
+				data: {
+					grantExpiresAt,
+					reservationUntil: new Date(
+						grantExpiresAt.getTime() + ASSETS.temporaryRetentionMs,
+					),
+				},
+			});
+			try {
+				const url = await this.storage.presignPut(
+					upload.bucket,
+					upload.temporaryKey,
+					upload.contentType,
+					Number(upload.sizeBytes),
+					grantExpiresAt,
+				);
+				return assetTransferSchema.parse({
+					method: "PUT",
+					url,
+					headers: {
+						"Content-Type": upload.contentType,
+						"Content-Length": upload.sizeBytes.toString(),
+					},
+					expiresAt: grantExpiresAt.toISOString(),
+					maxBytes: ASSETS.maxSingleUploadBytes,
+				});
+			} catch (error) {
+				if (error instanceof AssetError) throw error;
+				throw new AssetError(
+					503,
+					"STORAGE_UNAVAILABLE",
+					"File storage is temporarily unavailable.",
+					undefined,
+					true,
+				);
+			}
+		});
+	}
+}
diff --git a/apps/api/src/assets/asset-upload-completion.ts b/apps/api/src/assets/asset-upload-completion.ts
new file mode 100644
index 000000000..77b414413
--- /dev/null
+++ b/apps/api/src/assets/asset-upload-completion.ts
@@ -0,0 +1,39 @@
+import type { Prisma } from "@crm/db";
+import { missing } from "./asset-access.service";
+import { AssetError } from "./asset-error";
+import type { AssetStorageService } from "./asset-storage.service";
+import { requireAssetStorage } from "./asset-transfer.service";
+
+export async function completeAssetUpload(
+	tx: Prisma.TransactionClient,
+	storage: AssetStorageService,
+	projectId: string,
+	assetId: string,
+) {
+	const upload = await tx.assetUpload.findUnique({ where: { assetId } });
+	if (!upload || upload.projectId !== projectId) missing();
+	if (upload.status === "READY" || upload.status === "FINALIZING") return;
+	if (upload.status !== "PENDING" || upload.expiresAt <= new Date())
+		throw new AssetError(
+			409,
+			"ASSET_NOT_READY",
+			"The upload no longer accepts completion. Read the asset for its failure.",
+		);
+	requireAssetStorage(storage);
+	await tx.assetUpload.update({
+		where: { id: upload.id },
+		data: { status: "FINALIZING", confirmedAt: new Date() },
+	});
+	await tx.assetStorageJob.create({
+		data: {
+			operationKey: `finalize:${upload.id}`,
+			operation: "FINALIZE_UPLOAD",
+			nextAttemptAt: new Date(),
+			projectId,
+			uploadId: upload.id,
+			bucket: upload.bucket,
+			objectKey: upload.temporaryKey,
+			finalKey: upload.finalKey,
+		},
+	});
+}
diff --git a/apps/api/src/assets/asset-upload-create.service.ts b/apps/api/src/assets/asset-upload-create.service.ts
new file mode 100644
index 000000000..c14408078
--- /dev/null
+++ b/apps/api/src/assets/asset-upload-create.service.ts
@@ -0,0 +1,180 @@
+import { randomUUID } from "node:crypto";
+import { z } from "zod";
+import {
+	missing,
+	requireActiveProject,
+	validateAssetAppointment,
+} from "./asset-access.service";
+import { type AssetActor, assetActorKey } from "./asset-actor";
+import { ASSETS } from "./asset-config";
+import { AssetError } from "./asset-error";
+import { AssetMutations, hashAssetRequest } from "./asset-mutation.service";
+import type { AssetStorageService } from "./asset-storage.service";
+import { createAssetStorageKeys } from "./asset-storage-keys";
+import { requireAssetStorage } from "./asset-transfer.service";
+import { resolveUploadSource } from "./asset-upload-source.service";
+import { type CreateAssetInput, createAssetInput } from "./assets.contracts";
+
+export class AssetCreation {
+	constructor(
+		private readonly mutations: AssetMutations,
+		private readonly storage: AssetStorageService,
+	) {}
+
+	async createAsset(
+		actor: AssetActor,
+		projectId: string,
+		raw: CreateAssetInput,
+		key: string,
+		appointmentId?: string,
+	) {
+		const parsed = createAssetInput.safeParse(raw);
+		if (!parsed.success)
+			throw new AssetError(
+				400,
+				"VALIDATION_ERROR",
+				"Asset metadata is invalid.",
+			);
+		const input = parsed.data;
+		if (
+			actor.type === "SYSTEM" &&
+			(input.source !== "EMAIL_ATTACHMENT" ||
+				input.emailSource?.messageId !== actor.messageId)
+		)
+			missing();
+		const metadata = {
+			fileName: input.fileName,
+			contentType: input.contentType,
+			sizeBytes: input.sizeBytes,
+			kind: input.kind,
+			source: input.source,
+			appointmentId: appointmentId ?? null,
+			durationMilliseconds: input.durationMilliseconds ?? null,
+			capturedAt: input.capturedAt
+				? new Date(input.capturedAt).toISOString()
+				: null,
+			emailSource: input.emailSource ?? null,
+		};
+		return this.mutations.run(
+			actor,
+			projectId,
+			"CREATE_ASSET",
+			appointmentId
+				? `/appointments/${appointmentId}/assets`
+				: `/projects/${projectId}/assets`,
+			key,
+			metadata,
+			z.object({ assetId: z.string() }),
+			async (tx, project) => {
+				requireActiveProject(project);
+				if (input.sizeBytes > ASSETS.maxSingleUploadBytes)
+					throw new AssetError(
+						413,
+						"UPLOAD_TOO_LARGE",
+						"The file exceeds the single-upload limit.",
+						{ maxBytes: ASSETS.maxSingleUploadBytes },
+					);
+				if (appointmentId)
+					await validateAssetAppointment(tx, projectId, appointmentId);
+				const metadataHash = hashAssetRequest(metadata);
+				const { mailboxOwnerId, existing } = await resolveUploadSource(
+					tx,
+					projectId,
+					project,
+					input,
+					metadataHash,
+				);
+				if (existing) {
+					if (!existing.assetId) missing();
+					return { assetId: existing.assetId };
+				}
+				requireAssetStorage(this.storage);
+				const actorKey = assetActorKey(actor);
+				const count = await tx.assetUpload.count({
+					where: { actorKey, reservationReleasedAt: null },
+				});
+				if (count >= ASSETS.reservationLimit)
+					throw new AssetError(
+						429,
+						"UPLOAD_CAPACITY_EXCEEDED",
+						"Temporary upload capacity is full.",
+						undefined,
+						true,
+					);
+				const id = randomUUID();
+				const assetId = randomUUID();
+				const keys = createAssetStorageKeys({
+					organizationId: project.organizationId,
+					projectId,
+					uploadId: id,
+					objectId: randomUUID(),
+				});
+				const expiresAt = new Date(Date.now() + ASSETS.intentMs);
+				const grantExpiresAt = new Date(
+					Math.min(Date.now() + ASSETS.uploadUrlMs, expiresAt.getTime()),
+				);
+				const file = {
+					fileName: input.fileName,
+					contentType: input.contentType,
+					sizeBytes: BigInt(input.sizeBytes),
+					kind: input.kind,
+					source: input.source,
+					activityId: appointmentId ?? null,
+					uploadedById: actor.type === "USER" ? actor.userId : null,
+					durationMilliseconds:
+						input.durationMilliseconds == null
+							? null
+							: BigInt(input.durationMilliseconds),
+					capturedAt: input.capturedAt ? new Date(input.capturedAt) : null,
+					emailMessageId: input.emailSource?.messageId,
+					emailAttachmentId: input.emailSource?.attachmentId,
+				};
+				await tx.artifact.create({
+					data: {
+						...file,
+						id: assetId,
+						dealId: projectId,
+						type: input.kind,
+						storageBucket: this.storage.bucket(),
+						storageKey: keys.finalKey,
+						status: "UNVERIFIED",
+					},
+				});
+				await tx.assetUpload.create({
+					data: {
+						...file,
+						id,
+						assetId,
+						projectId,
+						customerId: project.companyId,
+						actorKey,
+						mailboxOwnerId,
+						metadataHash,
+						bucket: this.storage.bucket(),
+						...keys,
+						expiresAt,
+						grantExpiresAt,
+						reservationUntil: new Date(
+							grantExpiresAt.getTime() + ASSETS.temporaryRetentionMs,
+						),
+					},
+				});
+				if (input.emailSource)
+					await tx.assetEmailSource.upsert({
+						where: { messageId_attachmentId: input.emailSource },
+						create: {
+							...input.emailSource,
+							projectId,
+							uploadId: id,
+							assetId,
+							metadataHash,
+							mailboxOwnerId,
+						},
+						update: { uploadId: id, assetId },
+					});
+				return { assetId };
+			},
+			{ appointmentId, emailMessageId: input.emailSource?.messageId },
+		);
+	}
+}
diff --git a/apps/api/src/assets/asset-upload-source.service.ts b/apps/api/src/assets/asset-upload-source.service.ts
new file mode 100644
index 000000000..0d326380a
--- /dev/null
+++ b/apps/api/src/assets/asset-upload-source.service.ts
@@ -0,0 +1,79 @@
+import type { Prisma } from "@crm/db";
+import { missing } from "./asset-access.service";
+import { AssetError } from "./asset-error";
+import { enqueueAssetObjectDeletion } from "./asset-purge";
+import type { CreateAssetInput } from "./assets.contracts";
+
+export async function resolveUploadSource(
+	tx: Prisma.TransactionClient,
+	projectId: string,
+	project: { companyId: string },
+	input: CreateAssetInput,
+	metadataHash: string,
+) {
+	let mailboxOwnerId: string | null = null;
+	if (input.emailSource) {
+		const message = await tx.emailMessage.findUnique({
+			where: { id: input.emailSource.messageId },
+			include: { thread: true },
+		});
+		if (!message) missing();
+		if (
+			message.thread.companyId &&
+			message.thread.companyId !== project.companyId
+		)
+			throw new AssetError(
+				409,
+				"PROJECT_MISMATCH",
+				"The email belongs to another customer.",
+			);
+		mailboxOwnerId = message.syncedByUserId;
+		await tx.$executeRaw`SELECT pg_advisory_xact_lock(hashtextextended(${`source:${input.emailSource.messageId}:${input.emailSource.attachmentId}`}, 0))`;
+		const source = await tx.assetEmailSource.findUnique({
+			where: { messageId_attachmentId: input.emailSource },
+		});
+		if (source) {
+			if (source.projectId !== projectId)
+				throw new AssetError(
+					409,
+					"PROJECT_MISMATCH",
+					"The attachment belongs to another project.",
+				);
+			if (source.deletedAt)
+				throw new AssetError(
+					409,
+					"SOURCE_DELETED",
+					"The source attachment was deleted.",
+				);
+			if (source.metadataHash !== metadataHash)
+				throw new AssetError(
+					409,
+					"SOURCE_CONFLICT",
+					"The source attachment has different metadata.",
+				);
+			const existing = await tx.assetUpload.findUnique({
+				where: { id: source.uploadId },
+			});
+			if (
+				existing &&
+				["PENDING", "FINALIZING", "READY"].includes(existing.status) &&
+				!(existing.status === "PENDING" && existing.expiresAt <= new Date())
+			)
+				return { mailboxOwnerId, existing };
+			if (existing?.status === "PENDING") {
+				await tx.assetUpload.update({
+					where: { id: existing.id },
+					data: { status: "EXPIRED", completedAt: new Date() },
+				});
+				await enqueueAssetObjectDeletion(tx, {
+					projectId,
+					bucket: existing.bucket,
+					objectKey: existing.temporaryKey,
+					uploadId: existing.id,
+					temporary: true,
+				});
+			}
+		}
+	}
+	return { mailboxOwnerId, existing: null };
+}
diff --git a/apps/api/src/assets/asset-worker-delete.ts b/apps/api/src/assets/asset-worker-delete.ts
new file mode 100644
index 000000000..12d74c811
--- /dev/null
+++ b/apps/api/src/assets/asset-worker-delete.ts
@@ -0,0 +1,56 @@
+import type { AssetStorageJobModel as AssetStorageJob, Db } from "@crm/db";
+import { ASSETS } from "./asset-config";
+import { AssetStorageService } from "./asset-storage.service";
+import {
+	completeAssetStorageJob,
+	withOwnedAssetStorageJob,
+} from "./asset-worker-lease";
+
+export async function removeAssetStorageJob(
+	db: Db,
+	storage: AssetStorageService,
+	job: AssetStorageJob,
+	signal: AbortSignal,
+) {
+	signal.throwIfAborted();
+	if (!job.bucket)
+		throw new Error("Storage location requires operator resolution.");
+	await storage.delete(job.bucket, job.objectKey, signal);
+	if (await storage.head(job.bucket, job.objectKey, signal))
+		throw new Error("Object deletion remains incomplete.");
+	await withOwnedAssetStorageJob(db, job, async (tx) => {
+		if (job.temporary && job.uploadId) {
+			const upload = await tx.assetUpload.findUnique({
+				where: { id: job.uploadId },
+			});
+			if (upload && upload.reservationUntil > new Date()) {
+				await tx.assetStorageJob.update({
+					where: { id: job.id },
+					data: {
+						state: "PENDING",
+						nextAttemptAt: new Date(
+							Math.min(
+								Date.now() + ASSETS.worker.retryMaxMs,
+								upload.reservationUntil.getTime(),
+							),
+						),
+						leaseUntil: null,
+						leaseToken: null,
+						lastError: null,
+					},
+				});
+				return;
+			}
+			await tx.assetUpload.updateMany({
+				where: { id: job.uploadId, reservationReleasedAt: null },
+				data: { reservationReleasedAt: new Date() },
+			});
+		}
+		if (job.artifactId)
+			await tx.artifact.updateMany({
+				where: { id: job.artifactId, status: "DELETING" },
+				data: { status: "DELETED", deletedAt: new Date() },
+			});
+		await completeAssetStorageJob(tx, job);
+	});
+}
diff --git a/apps/api/src/assets/asset-worker-errors.ts b/apps/api/src/assets/asset-worker-errors.ts
new file mode 100644
index 000000000..9bc02c9c9
--- /dev/null
+++ b/apps/api/src/assets/asset-worker-errors.ts
@@ -0,0 +1,3 @@
+export class LeaseLost extends Error {}
+export class VerificationFailed extends Error {}
+export class FinalizationExpired extends Error {}
diff --git a/apps/api/src/assets/asset-worker-finalize.ts b/apps/api/src/assets/asset-worker-finalize.ts
new file mode 100644
index 000000000..daa11bacb
--- /dev/null
+++ b/apps/api/src/assets/asset-worker-finalize.ts
@@ -0,0 +1,162 @@
+import type {
+	AssetStorageJobModel as AssetStorageJob,
+	Db,
+	Prisma,
+} from "@crm/db";
+import { ASSETS } from "./asset-config";
+import { enqueueAssetObjectDeletion } from "./asset-purge";
+import { AssetStorageService } from "./asset-storage.service";
+import {
+	FinalizationExpired,
+	LeaseLost,
+	VerificationFailed,
+} from "./asset-worker-errors";
+import {
+	completeAssetStorageJob,
+	withOwnedAssetStorageJob,
+} from "./asset-worker-lease";
+
+type Tx = Prisma.TransactionClient;
+
+async function abandonAssetStorageJob(tx: Tx, job: AssetStorageJob) {
+	if (job.finalKey) {
+		const deletion = await enqueueAssetObjectDeletion(tx, {
+			projectId: job.projectId,
+			bucket: job.bucket,
+			objectKey: job.finalKey,
+			uploadId: job.uploadId ?? undefined,
+		});
+		if (deletion.state === "COMPLETE")
+			await tx.assetStorageJob.update({
+				where: { id: deletion.id },
+				data: { state: "PENDING", nextAttemptAt: new Date() },
+			});
+	}
+	await completeAssetStorageJob(tx, job);
+}
+
+export async function finalizeAssetStorageJob(
+	db: Db,
+	storage: AssetStorageService,
+	job: AssetStorageJob,
+	signal: AbortSignal,
+) {
+	signal.throwIfAborted();
+	const upload = await withOwnedAssetStorageJob(db, job, async (tx) => {
+		const upload = job.uploadId
+			? await tx.assetUpload.findUnique({ where: { id: job.uploadId } })
+			: null;
+		const project = await tx.deal.findUnique({
+			where: { id: job.projectId },
+			select: { id: true },
+		});
+		if (upload?.status === "READY") {
+			await completeAssetStorageJob(tx, job);
+			return null;
+		}
+		const asset = upload?.assetId
+			? await tx.artifact.findUnique({ where: { id: upload.assetId } })
+			: null;
+		if (
+			!upload ||
+			!project ||
+			upload.status !== "FINALIZING" ||
+			asset?.status !== "UNVERIFIED"
+		) {
+			await abandonAssetStorageJob(tx, job);
+			return null;
+		}
+		return upload;
+	});
+	if (!upload) return;
+	if (
+		!upload.confirmedAt ||
+		Date.now() - upload.confirmedAt.getTime() >=
+			ASSETS.worker.finalizeDeadlineMs
+	)
+		throw new FinalizationExpired();
+	let sourceEtag = upload.sourceEtag;
+	if (!sourceEtag) {
+		const source = await storage.head(
+			upload.bucket,
+			upload.temporaryKey,
+			signal,
+		);
+		if (!source || source.sizeBytes !== Number(upload.sizeBytes))
+			throw new VerificationFailed();
+		sourceEtag = source.etag;
+		await withOwnedAssetStorageJob(db, job, async (tx) => {
+			const current = await tx.assetUpload.findUnique({
+				where: { id: upload.id },
+			});
+			if (current?.status !== "FINALIZING") throw new LeaseLost();
+			await tx.assetUpload.update({
+				where: { id: upload.id },
+				data: { sourceEtag },
+			});
+		});
+	}
+	let final = await storage.head(upload.bucket, upload.finalKey, signal);
+	if (!final) {
+		await withOwnedAssetStorageJob(db, job, async (tx) => {
+			const current = await tx.assetUpload.findUnique({
+				where: { id: upload.id },
+			});
+			if (current?.status !== "FINALIZING") throw new LeaseLost();
+		});
+		await storage.copy(
+			upload.bucket,
+			upload.temporaryKey,
+			upload.finalKey,
+			sourceEtag,
+			signal,
+		);
+		final = await storage.head(upload.bucket, upload.finalKey, signal);
+	}
+	if (
+		!final ||
+		final.sizeBytes !== Number(upload.sizeBytes) ||
+		final.etag !== sourceEtag
+	)
+		throw new VerificationFailed();
+	await withOwnedAssetStorageJob(db, job, async (tx) => {
+		const current = await tx.assetUpload.findUnique({
+			where: { id: upload.id },
+		});
+		const project = await tx.deal.findUnique({
+			where: { id: upload.projectId },
+			select: { id: true },
+		});
+		if (!project || !current || current.status !== "FINALIZING") {
+			await abandonAssetStorageJob(tx, job);
+			return;
+		}
+		const asset = current.assetId
+			? await tx.artifact.findUnique({ where: { id: current.assetId } })
+			: null;
+		if (asset?.status !== "UNVERIFIED" || asset.dealId !== upload.projectId) {
+			await abandonAssetStorageJob(tx, job);
+			return;
+		}
+		await tx.artifact.update({
+			where: { id: asset.id },
+			data: { status: "READY" },
+		});
+		await tx.assetUpload.update({
+			where: { id: upload.id },
+			data: { status: "READY", assetId: asset.id, completedAt: new Date() },
+		});
+		await tx.assetEmailSource.updateMany({
+			where: { uploadId: upload.id },
+			data: { assetId: asset.id },
+		});
+		await enqueueAssetObjectDeletion(tx, {
+			projectId: upload.projectId,
+			bucket: upload.bucket,
+			objectKey: upload.temporaryKey,
+			uploadId: upload.id,
+			temporary: true,
+		});
+		await completeAssetStorageJob(tx, job);
+	});
+}
diff --git a/apps/api/src/assets/asset-worker-lease.ts b/apps/api/src/assets/asset-worker-lease.ts
new file mode 100644
index 000000000..d3295bbc6
--- /dev/null
+++ b/apps/api/src/assets/asset-worker-lease.ts
@@ -0,0 +1,87 @@
+import { randomUUID } from "node:crypto";
+import type {
+	AssetStorageJobModel as AssetStorageJob,
+	Db,
+	Prisma,
+} from "@crm/db";
+import { scopedTransaction } from "@crm/db/tenant-scope";
+import { ASSETS } from "./asset-config";
+import { LeaseLost } from "./asset-worker-errors";
+
+type Tx = Prisma.TransactionClient;
+
+export async function assertAssetStorageJobLease(tx: Tx, job: AssetStorageJob) {
+	const rows = await tx.$queryRaw<
+		Array<{ id: string }>
+	>`SELECT "id" FROM "assetStorageJob" WHERE "id" = ${job.id} AND "leaseToken" = ${job.leaseToken} AND "leaseUntil" > (NOW() AT TIME ZONE 'UTC') AND "state" = 'RUNNING' FOR UPDATE`;
+	if (!rows.length) throw new LeaseLost();
+}
+
+export async function withOwnedAssetStorageJob<T>(
+	db: Db,
+	job: AssetStorageJob,
+	action: (tx: Tx) => Promise<T>,
+) {
+	return scopedTransaction(db, async (tx) => {
+		await tx.$queryRaw`SELECT "id" FROM "deal" WHERE "id" = ${job.projectId} FOR UPDATE`;
+		await assertAssetStorageJobLease(tx, job);
+		return action(tx);
+	});
+}
+
+export async function completeAssetStorageJob(tx: Tx, job: AssetStorageJob) {
+	await tx.assetStorageJob.update({
+		where: { id: job.id },
+		data: {
+			state: "COMPLETE",
+			leaseUntil: null,
+			leaseToken: null,
+			lastError: null,
+			nextAttemptAt: new Date(Date.now() + ASSETS.worker.retryMaxMs),
+		},
+	});
+}
+
+export async function claimAssetStorageJob(db: Db) {
+	const leaseToken = randomUUID();
+	return scopedTransaction(db, async (tx) => {
+		const rows = await tx.$queryRaw<
+			Array<{ id: string }>
+		>`SELECT "id" FROM "assetStorageJob" WHERE ("state" = 'PENDING' AND "nextAttemptAt" <= (NOW() AT TIME ZONE 'UTC')) OR ("state" = 'RUNNING' AND "leaseUntil" <= (NOW() AT TIME ZONE 'UTC')) OR ("state" = 'COMPLETE' AND "operation" = 'DELETE_OBJECT' AND "nextAttemptAt" <= (NOW() AT TIME ZONE 'UTC')) ORDER BY "nextAttemptAt", "id" FOR UPDATE SKIP LOCKED LIMIT 1`;
+		if (!rows[0]) return null;
+		return tx.assetStorageJob.update({
+			where: { id: rows[0].id },
+			data: {
+				state: "RUNNING",
+				leaseToken,
+				leaseUntil: new Date(Date.now() + ASSETS.worker.leaseMs),
+			},
+		});
+	});
+}
+
+export function startAssetStorageJobHeartbeat(db: Db, job: AssetStorageJob) {
+	let heartbeatPending = false;
+	const heartbeat = setInterval(() => {
+		if (heartbeatPending) return;
+		heartbeatPending = true;
+		void scopedTransaction(db, (tx) =>
+			tx.assetStorageJob.updateMany({
+				where: {
+					id: job.id,
+					state: "RUNNING",
+					leaseToken: job.leaseToken,
+					leaseUntil: { gt: new Date() },
+				},
+				data: {
+					leaseUntil: new Date(Date.now() + ASSETS.worker.leaseMs),
+				},
+			}),
+		)
+			.catch(() => {})
+			.finally(() => {
+				heartbeatPending = false;
+			});
+	}, ASSETS.worker.heartbeatMs);
+	return () => clearInterval(heartbeat);
+}
diff --git a/apps/api/src/assets/asset-worker-retry.ts b/apps/api/src/assets/asset-worker-retry.ts
new file mode 100644
index 000000000..d701ef84c
--- /dev/null
+++ b/apps/api/src/assets/asset-worker-retry.ts
@@ -0,0 +1,97 @@
+import type { AssetStorageJobModel as AssetStorageJob, Db } from "@crm/db";
+import { Logger } from "@nestjs/common";
+import { ASSETS } from "./asset-config";
+import { enqueueAssetObjectDeletion } from "./asset-purge";
+import { LeaseLost } from "./asset-worker-errors";
+import { withOwnedAssetStorageJob } from "./asset-worker-lease";
+
+export async function retryAssetStorageJob(
+	db: Db,
+	job: AssetStorageJob,
+	verification: boolean,
+	logger: Logger,
+	interrupted: boolean,
+) {
+	try {
+		await withOwnedAssetStorageJob(db, job, async (tx) => {
+			const current = await tx.assetStorageJob.findUniqueOrThrow({
+				where: { id: job.id },
+			});
+			const attempts = current.attempts + (interrupted ? 0 : 1);
+			const upload = job.uploadId
+				? await tx.assetUpload.findUnique({ where: { id: job.uploadId } })
+				: null;
+			const terminal =
+				job.operation === "FINALIZE_UPLOAD" &&
+				(verification ||
+					attempts >= ASSETS.worker.maxFinalizeAttempts ||
+					!upload?.confirmedAt ||
+					Date.now() - upload.confirmedAt.getTime() >=
+						ASSETS.worker.finalizeDeadlineMs);
+			const message = interrupted
+				? "Invocation deadline reached. A retry is scheduled."
+				: verification
+					? "Stored bytes do not match the upload intent."
+					: job.bucket
+						? "Storage operation failed. A retry is scheduled."
+						: "Storage location requires operator resolution.";
+			if (terminal) {
+				if (upload?.status === "FINALIZING")
+					await tx.assetUpload.update({
+						where: { id: upload.id },
+						data: {
+							status: "FAILED",
+							failureCode: verification
+								? "UPLOAD_VERIFICATION_FAILED"
+								: "UPLOAD_FINALIZATION_FAILED",
+							failureMessage: verification
+								? message
+								: "File finalization failed.",
+							completedAt: new Date(),
+						},
+					});
+				if (upload) {
+					await enqueueAssetObjectDeletion(tx, {
+						projectId: upload.projectId,
+						bucket: upload.bucket,
+						objectKey: upload.temporaryKey,
+						uploadId: upload.id,
+						temporary: true,
+					});
+					await enqueueAssetObjectDeletion(tx, {
+						projectId: upload.projectId,
+						bucket: upload.bucket,
+						objectKey: upload.finalKey,
+						uploadId: upload.id,
+					});
+				}
+			}
+			await tx.assetStorageJob.update({
+				where: { id: job.id },
+				data: {
+					state: terminal ? "COMPLETE" : "PENDING",
+					attempts,
+					lastError: message,
+					leaseUntil: null,
+					leaseToken: null,
+					nextAttemptAt: new Date(
+						Date.now() +
+							Math.min(
+								ASSETS.worker.retryMaxMs,
+								ASSETS.worker.retryBaseMs *
+									2 ** Math.max(0, Math.min(attempts - 1, 30)),
+							),
+					),
+				},
+			});
+			logger.warn({
+				message,
+				jobId: job.id,
+				operation: job.operation,
+				attempts,
+			});
+		});
+	} catch (error) {
+		if (!(error instanceof LeaseLost)) throw error;
+	}
+}
diff --git a/apps/api/src/assets/asset-worker-sweep.ts b/apps/api/src/assets/asset-worker-sweep.ts
new file mode 100644
index 000000000..9687bf993
--- /dev/null
+++ b/apps/api/src/assets/asset-worker-sweep.ts
@@ -0,0 +1,42 @@
+import type { Db } from "@crm/db";
+import { scopedTransaction } from "@crm/db/tenant-scope";
+import { ASSETS } from "./asset-config";
+import { enqueueAssetObjectDeletion } from "./asset-purge";
+
+export async function sweepExpiredAssetUploads(db: Db, signal: AbortSignal) {
+	if (signal.aborted) return;
+	const expired = await scopedTransaction(db, (tx) =>
+		tx.assetUpload.findMany({
+			where: { status: "PENDING", expiresAt: { lte: new Date() } },
+			take: ASSETS.worker.batchSize,
+			select: { id: true, projectId: true },
+		}),
+	);
+	for (const candidate of expired) {
+		if (signal.aborted) break;
+		await scopedTransaction(db, async (tx) => {
+			await tx.$queryRaw`SELECT "id" FROM "deal" WHERE "id" = ${candidate.projectId} FOR UPDATE`;
+			const upload = await tx.assetUpload.findUnique({
+				where: { id: candidate.id },
+			});
+			if (upload?.status !== "PENDING" || upload.expiresAt > new Date()) return;
+			await tx.assetUpload.update({
+				where: { id: upload.id },
+				data: { status: "EXPIRED", completedAt: new Date() },
+			});
+			await enqueueAssetObjectDeletion(tx, {
+				projectId: upload.projectId,
+				bucket: upload.bucket,
+				objectKey: upload.temporaryKey,
+				uploadId: upload.id,
+				temporary: true,
+			});
+		});
+	}
+	if (signal.aborted) return;
+	await scopedTransaction(
+		db,
+		(tx) =>
+			tx.$executeRaw`DELETE FROM "assetApiRequest" WHERE "id" IN (SELECT "id" FROM "assetApiRequest" WHERE "expiresAt" <= (NOW() AT TIME ZONE 'UTC') LIMIT ${ASSETS.worker.batchSize})`,
+	);
+}
diff --git a/apps/api/src/assets/asset-worker.controller.ts b/apps/api/src/assets/asset-worker.controller.ts
new file mode 100644
index 000000000..23283cac6
--- /dev/null
+++ b/apps/api/src/assets/asset-worker.controller.ts
@@ -0,0 +1,48 @@
+import { timingSafeEqual } from "node:crypto";
+import {
+	Controller,
+	ForbiddenException,
+	Get,
+	Headers,
+	ServiceUnavailableException,
+} from "@nestjs/common";
+import { ConfigService } from "@nestjs/config";
+import { ApiHeader, ApiOperation, ApiTags } from "@nestjs/swagger";
+import { AllowAnonymous } from "@thallesp/nestjs-better-auth";
+import type { EnvironmentVariables } from "../config/env.validation";
+import { AssetWorkerService } from "./asset-worker.service";
+
+@ApiTags("Internal Assets")
+@Controller("internal/assets")
+export class AssetWorkerController {
+	constructor(
+		private readonly worker: AssetWorkerService,
+		private readonly config: ConfigService<EnvironmentVariables, true>,
+	) {}
+
+	@Get("process")
+	@AllowAnonymous()
+	@ApiHeader({
+		name: "authorization",
+		required: true,
+		description: "Bearer CRON_SECRET",
+	})
+	@ApiOperation({
+		summary: "Process durable asset finalization and deletion jobs",
+	})
+	process(@Headers("authorization") authorization?: string) {
+		const secret = this.config.get("CRON_SECRET", { infer: true });
+		if (!secret)
+			throw new ServiceUnavailableException(
+				"Asset processing is not configured.",
+			);
+		const supplied = Buffer.from(authorization ?? "");
+		const expected = Buffer.from(`Bearer ${secret}`);
+		if (
+			supplied.length !== expected.length ||
+			!timingSafeEqual(supplied, expected)
+		)
+			throw new ForbiddenException();
+		return this.worker.process();
+	}
+}
diff --git a/apps/api/src/assets/asset-worker.service.ts b/apps/api/src/assets/asset-worker.service.ts
new file mode 100644
index 000000000..864204136
--- /dev/null
+++ b/apps/api/src/assets/asset-worker.service.ts
@@ -0,0 +1,95 @@
+import type { Db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { Injectable, Logger } from "@nestjs/common";
+import { InjectDatabase } from "../database/database.constants";
+import { ASSETS } from "./asset-config";
+import { AssetStorageService } from "./asset-storage.service";
+import { removeAssetStorageJob } from "./asset-worker-delete";
+import { LeaseLost, VerificationFailed } from "./asset-worker-errors";
+import { finalizeAssetStorageJob } from "./asset-worker-finalize";
+import {
+	claimAssetStorageJob,
+	startAssetStorageJobHeartbeat,
+} from "./asset-worker-lease";
+import { retryAssetStorageJob } from "./asset-worker-retry";
+import { sweepExpiredAssetUploads } from "./asset-worker-sweep";
+
+@Injectable()
+export class AssetWorkerService {
+	private readonly logger = new Logger(AssetWorkerService.name);
+
+	constructor(
+		@InjectDatabase() private readonly db: Db,
+		private readonly storage: AssetStorageService,
+	) {}
+
+	async process(externalSignal?: AbortSignal) {
+		const deadline = Date.now() + ASSETS.worker.deadlineMs;
+		const controller = new AbortController();
+		const timer = setTimeout(
+			() => controller.abort(),
+			ASSETS.worker.deadlineMs,
+		);
+		const signal = externalSignal
+			? AbortSignal.any([controller.signal, externalSignal])
+			: controller.signal;
+		try {
+			const organizations = await this.db.organization.findMany({
+				select: { id: true },
+				orderBy: { id: "asc" },
+			});
+			let processed = 0;
+			for (const organization of organizations) {
+				if (
+					processed >= ASSETS.worker.batchSize ||
+					Date.now() >= deadline ||
+					signal.aborted
+				)
+					break;
+				processed += await runInTenant(organization.id, () =>
+					this.processTenant(
+						ASSETS.worker.batchSize - processed,
+						deadline,
+						signal,
+					),
+				);
+			}
+			return { processed };
+		} finally {
+			clearTimeout(timer);
+		}
+	}
+
+	private async processTenant(
+		limit: number,
+		deadline: number,
+		signal: AbortSignal,
+	) {
+		await sweepExpiredAssetUploads(this.db, signal);
+		if (!this.storage.configured()) return 0;
+		let processed = 0;
+		while (processed < limit && Date.now() < deadline && !signal.aborted) {
+			const job = await claimAssetStorageJob(this.db);
+			if (!job) break;
+			const stopHeartbeat = startAssetStorageJobHeartbeat(this.db, job);
+			try {
+				if (job.operation === "FINALIZE_UPLOAD")
+					await finalizeAssetStorageJob(this.db, this.storage, job, signal);
+				else await removeAssetStorageJob(this.db, this.storage, job, signal);
+			} catch (error) {
+				if (!(error instanceof LeaseLost))
+					await retryAssetStorageJob(
+						this.db,
+						job,
+						error instanceof VerificationFailed,
+						this.logger,
+						signal.aborted,
+					);
+			} finally {
+				stopHeartbeat();
+			}
+			processed++;
+		}
+		return processed;
+	}
+}
diff --git a/apps/api/src/assets/assets.contracts.ts b/apps/api/src/assets/assets.contracts.ts
new file mode 100644
index 000000000..914fbd2a1
--- /dev/null
+++ b/apps/api/src/assets/assets.contracts.ts
@@ -0,0 +1,139 @@
+import { z } from "zod";
+import { assetTransferSchema } from "./asset-transfer.contracts";
+
+export const assetId = z.string().min(1).max(128);
+export const assetSource = z.enum([
+	"MANUAL",
+	"MOBILE_RECORDING",
+	"EMAIL_ATTACHMENT",
+]);
+export const emailSource = z.strictObject({
+	messageId: z.string().min(1).max(255),
+	attachmentId: z.string().min(1).max(255),
+});
+export const createAssetInput = z
+	.strictObject({
+		fileName: z
+			.string()
+			.min(1)
+			.max(255)
+			.regex(/^[^/\\\p{Cc}]+$/u),
+		contentType: z
+			.string()
+			.min(1)
+			.max(255)
+			.regex(/^[^\p{Cc}]+$/u)
+			.default("application/octet-stream"),
+		sizeBytes: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+		kind: z.string().min(1).max(64).default("file"),
+		source: assetSource,
+		durationMilliseconds: z
+			.number()
+			.int()
+			.nonnegative()
+			.max(Number.MAX_SAFE_INTEGER)
+			.nullable()
+			.optional(),
+		capturedAt: z.iso.datetime({ offset: true }).nullable().optional(),
+		emailSource: emailSource.nullable().optional(),
+	})
+	.superRefine((input, context) => {
+		if ((input.source === "EMAIL_ATTACHMENT") !== (input.emailSource != null))
+			context.addIssue({
+				code: "custom",
+				path: ["emailSource"],
+				message:
+					"Email attachments require an email source. Other sources cannot include one.",
+			});
+	});
+export type CreateAssetInput = z.infer<typeof createAssetInput>;
+export const projectAssetCreateInput = createAssetInput.safeExtend({
+	projectId: assetId,
+});
+export const appointmentAssetCreateInput = createAssetInput.safeExtend({
+	appointmentId: assetId,
+});
+export const assetMemberInput = z.strictObject({ assetId });
+
+export const assetListInput = z.strictObject({
+	page: z.coerce.number().int().min(1).max(Number.MAX_SAFE_INTEGER).default(1),
+	pageSize: z.coerce.number().int().min(1).max(100).default(25),
+	kind: z.string().min(1).max(64).optional(),
+	source: assetSource.optional(),
+});
+export type AssetListInput = z.infer<typeof assetListInput>;
+export const projectAssetListInput = assetListInput.extend({
+	projectId: assetId,
+});
+export const appointmentAssetListInput = assetListInput.extend({
+	appointmentId: assetId,
+});
+
+export const assetSchema = z.object({
+	id: assetId,
+	customerId: assetId,
+	projectId: assetId,
+	appointmentId: assetId.nullable(),
+	fileName: z.string(),
+	contentType: z.string(),
+	sizeBytes: z.number().int().nonnegative().nullable(),
+	kind: z.string(),
+	source: assetSource.nullable(),
+	emailSource: emailSource.nullable(),
+	uploadedById: assetId.nullable(),
+	durationMilliseconds: z.number().int().nonnegative().nullable(),
+	capturedAt: z.iso.datetime().nullable(),
+	createdAt: z.iso.datetime(),
+	updatedAt: z.iso.datetime(),
+	version: z.number().int().positive(),
+	status: z.enum(["UNVERIFIED", "READY", "DELETING", "DELETED"]),
+	deletedAt: z.iso.datetime().nullable(),
+});
+export const assetDownloadSchema = z.object({
+	url: z.url(),
+	expiresAt: z.iso.datetime(),
+});
+export const assetFailureSchema = z.object({
+	code: z.enum([
+		"UPLOAD_EXPIRED",
+		"UPLOAD_VERIFICATION_FAILED",
+		"UPLOAD_FINALIZATION_FAILED",
+	]),
+	message: z.string(),
+});
+export const assetDetailSchema = z.object({
+	asset: assetSchema,
+	download: assetDownloadSchema.nullable(),
+	failure: assetFailureSchema.nullable(),
+});
+export const assetCreationSchema = assetDetailSchema.extend({
+	transfer: assetTransferSchema.nullable(),
+});
+export const assetListSchema = z.object({
+	items: z.array(assetSchema),
+	page: z.number().int(),
+	pageSize: z.number().int(),
+	total: z.number().int(),
+	hasNextPage: z.boolean(),
+});
+export const assetDeletionSchema = z.object({
+	assetId,
+	status: z.enum(["DELETING", "DELETED"]),
+});
+export const assetErrorEnvelopeSchema = z.object({
+	error: z.object({
+		code: z.string(),
+		message: z.string(),
+		requestId: z.string(),
+		retryable: z.boolean(),
+		details: z
+			.object({
+				state: z.string().optional(),
+				maxBytes: z.number().optional(),
+				fields: z
+					.array(z.object({ field: z.string(), message: z.string() }))
+					.optional(),
+			})
+			.optional(),
+	}),
+});
diff --git a/apps/api/src/assets/assets.module.ts b/apps/api/src/assets/assets.module.ts
new file mode 100644
index 000000000..d8361efcc
--- /dev/null
+++ b/apps/api/src/assets/assets.module.ts
@@ -0,0 +1,20 @@
+import { Module } from "@nestjs/common";
+import { TrpcModule } from "../trpc/trpc.module";
+import { AssetStorageService } from "./asset-storage.service";
+import { AssetWorkerController } from "./asset-worker.controller";
+import { AssetWorkerService } from "./asset-worker.service";
+import { AssetsRouter } from "./assets.router";
+import { AssetsService } from "./assets.service";
+
+@Module({
+	imports: [TrpcModule],
+	controllers: [AssetWorkerController],
+	providers: [
+		AssetsService,
+		AssetsRouter,
+		AssetStorageService,
+		AssetWorkerService,
+	],
+	exports: [AssetsService, AssetStorageService],
+})
+export class AssetsModule {}
diff --git a/apps/api/src/assets/assets.router.ts b/apps/api/src/assets/assets.router.ts
new file mode 100644
index 000000000..1188d2f90
--- /dev/null
+++ b/apps/api/src/assets/assets.router.ts
@@ -0,0 +1,145 @@
+import { Inject } from "@nestjs/common";
+import {
+	Ctx,
+	Input,
+	Mutation,
+	Query,
+	Router,
+	UseMiddlewares,
+} from "nestjs-trpc";
+import type { z } from "zod";
+import type { AuthedTrpcContext } from "../trpc/context.types";
+import { AuthMiddleware } from "../trpc/middlewares/auth.middleware";
+import { assetUpdateInput } from "./asset-metadata.contracts";
+import { assetRoutes } from "./asset-openapi";
+import { assetUser, idempotencyKey } from "./asset-request";
+import {
+	appointmentAssetCreateInput,
+	appointmentAssetListInput,
+	assetCreationSchema,
+	assetDeletionSchema,
+	assetDetailSchema,
+	assetListSchema,
+	assetMemberInput,
+	projectAssetCreateInput,
+	projectAssetListInput,
+} from "./assets.contracts";
+import { AssetsService } from "./assets.service";
+
+@Router({ alias: "assets" })
+@UseMiddlewares(AuthMiddleware)
+export class AssetsRouter {
+	constructor(@Inject(AssetsService) private readonly assets: AssetsService) {}
+
+	@Mutation({
+		input: projectAssetCreateInput,
+		output: assetCreationSchema,
+		meta: assetRoutes.createProjectAsset,
+	})
+	createProjectAsset(
+		@Ctx() ctx: AuthedTrpcContext,
+		@Input() input: z.infer<typeof projectAssetCreateInput>,
+	) {
+		const { projectId, ...body } = input;
+		return this.assets.createProjectAsset(
+			assetUser(ctx),
+			projectId,
+			body,
+			idempotencyKey(ctx),
+		);
+	}
+
+	@Mutation({
+		input: appointmentAssetCreateInput,
+		output: assetCreationSchema,
+		meta: assetRoutes.createAppointmentAsset,
+	})
+	createAppointmentAsset(
+		@Ctx() ctx: AuthedTrpcContext,
+		@Input() input: z.infer<typeof appointmentAssetCreateInput>,
+	) {
+		const { appointmentId, ...body } = input;
+		return this.assets.createAppointmentAsset(
+			assetUser(ctx),
+			appointmentId,
+			body,
+			idempotencyKey(ctx),
+		);
+	}
+
+	@Query({
+		input: projectAssetListInput,
+		output: assetListSchema,
+		meta: assetRoutes.listProjectAssets,
+	})
+	listProjectAssets(
+		@Ctx() ctx: AuthedTrpcContext,
+		@Input() input: z.infer<typeof projectAssetListInput>,
+	) {
+		const { projectId, ...query } = input;
+		return this.assets.listProjectAssets(assetUser(ctx), projectId, query);
+	}
+
+	@Query({
+		input: appointmentAssetListInput,
+		output: assetListSchema,
+		meta: assetRoutes.listAppointmentAssets,
+	})
+	listAppointmentAssets(
+		@Ctx() ctx: AuthedTrpcContext,
+		@Input() input: z.infer<typeof appointmentAssetListInput>,
+	) {
+		const { appointmentId, ...query } = input;
+		return this.assets.listAppointmentAssets(
+			assetUser(ctx),
+			appointmentId,
+			query,
+		);
+	}
+
+	@Query({
+		input: assetMemberInput,
+		output: assetDetailSchema,
+		meta: assetRoutes.getAsset,
+	})
+	getAsset(
+		@Ctx() ctx: AuthedTrpcContext,
+		@Input() input: z.infer<typeof assetMemberInput>,
+	) {
+		return this.assets.getAsset(assetUser(ctx), input.assetId);
+	}
+
+	@Mutation({
+		input: assetUpdateInput,
+		output: assetDetailSchema,
+		meta: assetRoutes.updateAsset,
+	})
+	updateAsset(
+		@Ctx() ctx: AuthedTrpcContext,
+		@Input() input: z.infer<typeof assetUpdateInput>,
+	) {
+		const { assetId, ...body } = input;
+		return this.assets.updateAsset(
+			assetUser(ctx),
+			assetId,
+			body,
+			idempotencyKey(ctx),
+		);
+	}
+
+	@Mutation({
+		input: assetMemberInput,
+		output: assetDeletionSchema,
+		meta: assetRoutes.deleteAsset,
+	})
+	deleteAsset(
+		@Ctx() ctx: AuthedTrpcContext,
+		@Input() input: z.infer<typeof assetMemberInput>,
+	) {
+		return this.assets.deleteAsset(
+			assetUser(ctx),
+			input.assetId,
+			idempotencyKey(ctx),
+		);
+	}
+}
diff --git a/apps/api/src/assets/assets.service.ts b/apps/api/src/assets/assets.service.ts
new file mode 100644
index 000000000..f385fbe89
--- /dev/null
+++ b/apps/api/src/assets/assets.service.ts
@@ -0,0 +1,107 @@
+import type { Db } from "@crm/db";
+import { Injectable } from "@nestjs/common";
+import { InjectScopedDatabase } from "../database/database.constants";
+import type { AssetActor } from "./asset-actor";
+import { AssetCatalog } from "./asset-catalog.service";
+import { appointmentProjectId, assetProjectId } from "./asset-context.service";
+import { AssetFiles } from "./asset-files.service";
+import type { AssetMetadataUpdateInput } from "./asset-metadata.contracts";
+import { AssetMetadataService } from "./asset-metadata.service";
+import { AssetMutations } from "./asset-mutation.service";
+import { AssetStorageService } from "./asset-storage.service";
+import { AssetTransfers } from "./asset-transfer.service";
+import { AssetCreation } from "./asset-upload-create.service";
+import type { AssetListInput, CreateAssetInput } from "./assets.contracts";
+
+export type { AssetActor } from "./asset-actor";
+
+@Injectable()
+export class AssetsService {
+	private readonly creation: AssetCreation;
+	private readonly transfers: AssetTransfers;
+	private readonly catalog: AssetCatalog;
+	private readonly files: AssetFiles;
+	private readonly metadata: AssetMetadataService;
+
+	constructor(
+		@InjectScopedDatabase() private readonly db: Db,
+		storage: AssetStorageService,
+	) {
+		const mutations = new AssetMutations(db);
+		this.creation = new AssetCreation(mutations, storage);
+		this.transfers = new AssetTransfers(db, storage);
+		this.catalog = new AssetCatalog(db, storage);
+		this.files = new AssetFiles(mutations);
+		this.metadata = new AssetMetadataService(mutations, storage);
+	}
+
+	async createProjectAsset(
+		actor: AssetActor,
+		projectId: string,
+		raw: CreateAssetInput,
+		key: string,
+	) {
+		return this.create(actor, projectId, raw, key);
+	}
+
+	async createAppointmentAsset(
+		actor: AssetActor,
+		appointmentId: string,
+		raw: CreateAssetInput,
+		key: string,
+	) {
+		const projectId = await appointmentProjectId(this.db, actor, appointmentId);
+		return this.create(actor, projectId, raw, key, appointmentId);
+	}
+
+	private async create(
+		actor: AssetActor,
+		projectId: string,
+		raw: CreateAssetInput,
+		key: string,
+		appointmentId?: string,
+	) {
+		const { assetId } = await this.creation.createAsset(
+			actor,
+			projectId,
+			raw,
+			key,
+			appointmentId,
+		);
+		const transfer = await this.transfers.issue(actor, projectId, assetId);
+		return { ...(await this.catalog.getAsset(actor, assetId)), transfer };
+	}
+
+	listProjectAssets(actor: AssetActor, projectId: string, raw: AssetListInput) {
+		return this.catalog.listProjectAssets(actor, projectId, raw);
+	}
+
+	async listAppointmentAssets(
+		actor: AssetActor,
+		appointmentId: string,
+		raw: AssetListInput,
+	) {
+		const projectId = await appointmentProjectId(this.db, actor, appointmentId);
+		return this.catalog.listProjectAssets(actor, projectId, raw, appointmentId);
+	}
+
+	getAsset(actor: AssetActor, assetId: string) {
+		return this.catalog.getAsset(actor, assetId);
+	}
+
+	async updateAsset(
+		actor: AssetActor,
+		assetId: string,
+		raw: AssetMetadataUpdateInput,
+		key: string,
+	) {
+		const projectId = await assetProjectId(this.db, actor, assetId);
+		await this.metadata.updateAsset(actor, projectId, assetId, raw, key);
+		return this.catalog.getAsset(actor, assetId);
+	}
+
+	async deleteAsset(actor: AssetActor, assetId: string, key: string) {
+		const projectId = await assetProjectId(this.db, actor, assetId);
+		return this.files.deleteAsset(actor, projectId, assetId, key);
+	}
+}
diff --git a/apps/api/src/auth/auth.controller.ts b/apps/api/src/auth/auth.controller.ts
index dc283ca70..6e7b4385f 100644
--- a/apps/api/src/auth/auth.controller.ts
+++ b/apps/api/src/auth/auth.controller.ts
@@ -1,23 +1,23 @@
-import { type auth, SESSION_COOKIE_NAME } from "@crm/auth";
+import { SESSION_COOKIE_NAME } from "@crm/auth";
 import { Controller, Get } from "@nestjs/common";
 import {
+	ApiBearerAuth,
 	ApiCookieAuth,
 	ApiOkResponse,
 	ApiOperation,
+	ApiSecurity,
 	ApiTags,
 	ApiUnauthorizedResponse,
 } from "@nestjs/swagger";
-import {
-	OptionalAuth,
-	Session,
-	type UserSession,
-} from "@thallesp/nestjs-better-auth";
+import { OptionalAuth } from "@thallesp/nestjs-better-auth";
 import { AuthService } from "./auth.service";
-
-type CrmSession = UserSession<typeof auth>;
+import type { RequestPrincipal } from "./request-principal";
+import { Principal } from "./request-principal.decorator";
 
 @ApiTags("Auth")
 @ApiCookieAuth(SESSION_COOKIE_NAME)
+@ApiSecurity("apiKey")
+@ApiBearerAuth("oauth")
 @Controller("auth")
 export class AuthController {
 	constructor(private readonly authService: AuthService) {}
@@ -26,8 +26,8 @@ export class AuthController {
 	@ApiOperation({ summary: "Get the signed-in user's profile" })
 	@ApiOkResponse({ description: "The signed-in user's profile." })
 	@ApiUnauthorizedResponse({ description: "No valid session." })
-	async getMe(@Session() session: CrmSession) {
-		return { user: await this.authService.getProfile(session.user.id) };
+	async getMe(@Principal() principal: RequestPrincipal) {
+		return { user: await this.authService.getProfile(principal.user.id) };
 	}
 
 	@Get("session")
@@ -38,15 +38,15 @@ export class AuthController {
 	@ApiOkResponse({
 		description: "Whether the request is authenticated, and as whom.",
 	})
-	getSession(@Session() session?: CrmSession) {
-		if (!session) {
+	getSession(@Principal() principal: RequestPrincipal | null) {
+		if (!principal) {
 			return { authenticated: false, user: null };
 		}
 
 		return {
 			authenticated: true,
-			user: { id: session.user.id, email: session.user.email },
-			expiresAt: session.session.expiresAt,
+			user: { id: principal.user.id, email: principal.user.email },
+			expiresAt: principal.expiresAt,
 		};
 	}
 }
diff --git a/apps/api/src/auth/auth.module.ts b/apps/api/src/auth/auth.module.ts
index 505c5c855..ea44a8006 100644
--- a/apps/api/src/auth/auth.module.ts
+++ b/apps/api/src/auth/auth.module.ts
@@ -1,11 +1,23 @@
-import { Module } from "@nestjs/common";
+import { Global, Module } from "@nestjs/common";
+import { APP_GUARD } from "@nestjs/core";
 import { AuthController } from "./auth.controller";
 import { AuthService } from "./auth.service";
 import { AuthHooksService } from "./auth-hooks.service";
+import { OAuthBootstrapService } from "./oauth-bootstrap.service";
+import { OAuthMetadataController } from "./oauth-metadata.controller";
+import { RequestPrincipalGuard } from "./request-principal.guard";
+import { RequestPrincipalService } from "./request-principal.service";
 
+@Global()
 @Module({
-	controllers: [AuthController],
-	providers: [AuthService, AuthHooksService],
-	exports: [AuthService],
+	controllers: [AuthController, OAuthMetadataController],
+	providers: [
+		AuthService,
+		AuthHooksService,
+		OAuthBootstrapService,
+		RequestPrincipalService,
+		{ provide: APP_GUARD, useClass: RequestPrincipalGuard },
+	],
+	exports: [AuthService, RequestPrincipalService],
 })
 export class AuthModule {}
diff --git a/apps/api/src/auth/oauth-bootstrap.service.ts b/apps/api/src/auth/oauth-bootstrap.service.ts
new file mode 100644
index 000000000..1643d3e5f
--- /dev/null
+++ b/apps/api/src/auth/oauth-bootstrap.service.ts
@@ -0,0 +1,19 @@
+import { ensureOfficialOAuthClient } from "@crm/auth";
+import { Injectable, Logger, type OnModuleInit } from "@nestjs/common";
+
+@Injectable()
+export class OAuthBootstrapService implements OnModuleInit {
+	private readonly logger = new Logger(OAuthBootstrapService.name);
+
+	async onModuleInit(): Promise<void> {
+		try {
+			await ensureOfficialOAuthClient();
+			this.logger.log({ message: "Official OAuth client reconciled" });
+		} catch (error) {
+			this.logger.error({
+				message: "Official OAuth client reconciliation failed",
+				reason: error instanceof Error ? error.message : String(error),
+			});
+		}
+	}
+}
diff --git a/apps/api/src/auth/oauth-metadata.controller.ts b/apps/api/src/auth/oauth-metadata.controller.ts
new file mode 100644
index 000000000..4dc47ae33
--- /dev/null
+++ b/apps/api/src/auth/oauth-metadata.controller.ts
@@ -0,0 +1,27 @@
+import { auth, getProtectedResourceMetadata, OAUTH } from "@crm/auth";
+import { Controller, Get } from "@nestjs/common";
+import { ApiOkResponse, ApiOperation, ApiTags } from "@nestjs/swagger";
+import { AllowAnonymous } from "@thallesp/nestjs-better-auth";
+
+@ApiTags("OAuth")
+@AllowAnonymous()
+@Controller()
+export class OAuthMetadataController {
+	@Get(".well-known/oauth-authorization-server/api/auth")
+	@ApiOperation({ summary: "Get OAuth authorization-server metadata" })
+	@ApiOkResponse({ description: "OAuth authorization-server metadata." })
+	getAuthorizationServerMetadata() {
+		return auth.api.getOAuthServerConfig();
+	}
+
+	@Get(".well-known/oauth-protected-resource/api")
+	@ApiOperation({ summary: "Get OAuth protected-resource metadata" })
+	@ApiOkResponse({ description: "OAuth protected-resource metadata." })
+	getResourceMetadata() {
+		return getProtectedResourceMetadata({
+			resource: OAUTH.resource,
+			authorization_servers: [OAUTH.issuer],
+			scopes_supported: [OAUTH.scopes.crm.read, OAUTH.scopes.crm.write],
+		});
+	}
+}
diff --git a/apps/api/src/auth/request-principal.decorator.ts b/apps/api/src/auth/request-principal.decorator.ts
new file mode 100644
index 000000000..6a6b19124
--- /dev/null
+++ b/apps/api/src/auth/request-principal.decorator.ts
@@ -0,0 +1,7 @@
+import { createParamDecorator, type ExecutionContext } from "@nestjs/common";
+import type { RequestPrincipal } from "./request-principal";
+
+export const Principal = createParamDecorator(
+	(_data: undefined, context: ExecutionContext): RequestPrincipal | null =>
+		context.switchToHttp().getRequest().principal ?? null,
+);
diff --git a/apps/api/src/auth/request-principal.guard.ts b/apps/api/src/auth/request-principal.guard.ts
new file mode 100644
index 000000000..6e674e66a
--- /dev/null
+++ b/apps/api/src/auth/request-principal.guard.ts
@@ -0,0 +1,83 @@
+import {
+	bearerChallenge,
+	oauthScopeFailure,
+	requiredCrmScope,
+} from "@crm/auth";
+import {
+	BadRequestException,
+	type CanActivate,
+	type ExecutionContext,
+	ForbiddenException,
+	Injectable,
+	UnauthorizedException,
+} from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import type { Request, Response } from "express";
+import { RequestPrincipalError } from "./request-principal";
+import { RequestPrincipalService } from "./request-principal.service";
+
+@Injectable()
+export class RequestPrincipalGuard implements CanActivate {
+	constructor(
+		private readonly reflector: Reflector,
+		private readonly principals: RequestPrincipalService,
+	) {}
+
+	async canActivate(context: ExecutionContext): Promise<boolean> {
+		const request = context.switchToHttp().getRequest<Request>();
+		const response = context.switchToHttp().getResponse<Response>();
+		const isPublic = this.reflector.getAllAndOverride<boolean>("PUBLIC", [
+			context.getHandler(),
+			context.getClass(),
+		]);
+		if (isPublic) return true;
+
+		const isOptional = this.reflector.getAllAndOverride<boolean>("OPTIONAL", [
+			context.getHandler(),
+			context.getClass(),
+		]);
+
+		try {
+			request.principal = await this.principals.resolve(request);
+		} catch (error) {
+			if (!(error instanceof RequestPrincipalError)) throw error;
+			if (isOptional && error.status === 401) {
+				request.principal = null;
+				return true;
+			}
+			if (error.challenge)
+				response.setHeader("WWW-Authenticate", error.challenge);
+			if (error.status === 400) throw new BadRequestException(error.message);
+			if (error.status === 403) throw new ForbiddenException(error.message);
+			throw new UnauthorizedException(error.message);
+		}
+
+		if (isOptional) return true;
+		if (!request.principal) {
+			response.setHeader("WWW-Authenticate", bearerChallenge());
+			throw new UnauthorizedException();
+		}
+		if (request.principal.credentialKind === "oauth") {
+			const requiredScope = requiredCrmScope(
+				!["GET", "HEAD"].includes(request.method),
+			);
+			const failure = oauthScopeFailure(
+				request.principal.scopes,
+				requiredScope,
+			);
+			if (failure) {
+				response.setHeader("WWW-Authenticate", failure.challenge);
+				throw new ForbiddenException(failure.message);
+			}
+		}
+		return true;
+	}
+}
+
+declare global {
+	namespace Express {
+		interface Request {
+			principal?: import("./request-principal").RequestPrincipal | null;
+		}
+	}
+}
diff --git a/apps/api/src/auth/request-principal.service.ts b/apps/api/src/auth/request-principal.service.ts
new file mode 100644
index 000000000..ce610c900
--- /dev/null
+++ b/apps/api/src/auth/request-principal.service.ts
@@ -0,0 +1,232 @@
+import {
+	API_KEY_HEADER,
+	activeOrganizationIdOf,
+	apiUrl,
+	auth,
+	bearerChallenge,
+	OAUTH,
+	OAUTH_ORGANIZATION_CLAIM,
+	parseScopes,
+	SESSION_COOKIE_NAME,
+	type Session,
+	type SessionUser,
+	verifyAccessTokenRequest,
+} from "@crm/auth";
+import type { Db } from "@crm/db";
+import { parseApiKeyPrincipalMetadata } from "@crm/validation/api-key-principal";
+import { Injectable, Logger } from "@nestjs/common";
+import { fromNodeHeaders } from "better-auth/node";
+import type { Request } from "express";
+import { z } from "zod";
+import { InjectDatabase } from "../database/database.constants";
+import {
+	type CredentialKind,
+	type RequestPrincipal,
+	RequestPrincipalError,
+} from "./request-principal";
+
+const oauthClaims = z.object({
+	sub: z.string().trim().min(1),
+	client_id: z.string().trim().min(1).optional(),
+	azp: z.string().trim().min(1).optional(),
+	scope: z.string().default(""),
+	exp: z.number().int().positive(),
+});
+const organizationClaim = z.string().trim().min(1);
+
+@Injectable()
+export class RequestPrincipalService {
+	private readonly logger = new Logger(RequestPrincipalService.name);
+
+	constructor(@InjectDatabase() private readonly db: Db) {}
+
+	async resolve(request: Request): Promise<RequestPrincipal | null> {
+		const kinds = credentialKinds(request);
+		if (kinds.length > 1) {
+			throw new RequestPrincipalError(
+				400,
+				"multiple_credentials",
+				"Send exactly one credential type.",
+			);
+		}
+
+		const kind = kinds[0];
+		if (!kind) return null;
+
+		try {
+			const principal =
+				kind === "oauth"
+					? await this.resolveOAuth(request)
+					: kind === "apiKey"
+						? await this.resolveApiKey(request)
+						: await this.resolveSession(request);
+			this.logger.debug({
+				message: "Authentication accepted",
+				method: kind,
+				clientId: principal.clientId,
+				userId: principal.user.id,
+			});
+			return principal;
+		} catch (error) {
+			const reason =
+				error instanceof RequestPrincipalError
+					? error.code
+					: error instanceof Error
+						? error.name
+						: "invalid_credential";
+			this.logger.warn({
+				message: "Authentication rejected",
+				method: kind,
+				reason,
+			});
+			if (error instanceof RequestPrincipalError) throw error;
+			throw unauthorized("invalid_token", "The credential is invalid.");
+		}
+	}
+
+	private async resolveSession(request: Request): Promise<RequestPrincipal> {
+		const session = await auth.api.getSession({
+			headers: fromNodeHeaders(request.headers),
+		});
+		if (!session) {
+			throw unauthorized("invalid_credential", "The credential is invalid.");
+		}
+
+		const enrichedSession = session as Session;
+
+		return {
+			credentialKind: "session",
+			user: enrichedSession.user,
+			clientId: null,
+			scopes: new Set(),
+			session: enrichedSession,
+			organizationId: activeOrganizationIdOf(enrichedSession),
+			expiresAt: enrichedSession.session.expiresAt,
+		};
+	}
+
+	private async resolveApiKey(request: Request): Promise<RequestPrincipal> {
+		const keyValue = headerValue(request.headers[API_KEY_HEADER]);
+		if (!keyValue) {
+			throw unauthorized("invalid_credential", "The credential is invalid.");
+		}
+
+		const verified = await auth.api.verifyApiKey({ body: { key: keyValue } });
+		if (!verified.valid || !verified.key) {
+			throw unauthorized("invalid_credential", "The credential is invalid.");
+		}
+
+		const metadata = parseApiKeyPrincipalMetadata(verified.key.metadata);
+		const user = await this.findUser(metadata.createdByUserId);
+		if (!user) {
+			throw unauthorized("invalid_credential", "The credential is invalid.");
+		}
+
+		return {
+			credentialKind: "apiKey",
+			user: user satisfies SessionUser,
+			clientId: null,
+			scopes: new Set(),
+			session: null,
+			organizationId: verified.key.referenceId,
+			expiresAt: verified.key.expiresAt,
+		};
+	}
+
+	private async resolveOAuth(request: Request): Promise<RequestPrincipal> {
+		const rawClaims = await verifyAccessTokenRequest(
+			{
+				authorizationHeader: headerValue(request.headers.authorization),
+				method: request.method,
+				url: new URL(request.originalUrl || request.url, apiUrl).toString(),
+			},
+			{
+				verifyOptions: {
+					issuer: OAUTH.issuer,
+					audience: OAUTH.resource,
+				},
+			},
+		);
+		const claims = oauthClaims.parse(rawClaims);
+		const organizationId = organizationClaim.parse(
+			rawClaims[OAUTH_ORGANIZATION_CLAIM],
+		);
+		const clientId = claims.client_id ?? claims.azp;
+		if (!clientId) {
+			throw unauthorized(
+				"invalid_token",
+				"The token has no client identifier.",
+			);
+		}
+
+		const [user, client] = await Promise.all([
+			this.findUser(claims.sub),
+			this.db.oauthClient.findUnique({
+				where: { clientId },
+				select: { disabled: true },
+			}),
+		]);
+		if (!user || !client || client.disabled) {
+			throw unauthorized("invalid_token", "The token principal is inactive.");
+		}
+
+		return {
+			credentialKind: "oauth",
+			user: user satisfies SessionUser,
+			clientId,
+			scopes: parseScopes(claims.scope),
+			session: null,
+			organizationId,
+			expiresAt: new Date(claims.exp * 1000),
+		};
+	}
+
+	private findUser(userId: string) {
+		return this.db.user.findUnique({
+			where: { id: userId },
+			select: {
+				id: true,
+				name: true,
+				email: true,
+				emailVerified: true,
+				image: true,
+				createdAt: true,
+				updatedAt: true,
+			},
+		});
+	}
+}
+
+export function credentialKinds(request: Request): CredentialKind[] {
+	const kinds: CredentialKind[] = [];
+	if (hasSessionCookie(request.headers.cookie)) kinds.push("session");
+	if (headerValue(request.headers[API_KEY_HEADER])) kinds.push("apiKey");
+	if (isBearerAuthorization(request.headers.authorization)) kinds.push("oauth");
+	return kinds;
+}
+
+function hasSessionCookie(cookieHeader: string | undefined): boolean {
+	if (!cookieHeader) return false;
+	const names = new Set([
+		SESSION_COOKIE_NAME,
+		`__Secure-${SESSION_COOKIE_NAME}`,
+	]);
+	return cookieHeader.split(";").some((entry) => {
+		const separator = entry.indexOf("=");
+		return separator > 0 && names.has(entry.slice(0, separator).trim());
+	});
+}
+
+function headerValue(value: string | string[] | undefined): string | null {
+	if (Array.isArray(value)) return value.find(Boolean) ?? null;
+	return value?.trim() || null;
+}
+
+function isBearerAuthorization(value: string | string[] | undefined): boolean {
+	const authorization = headerValue(value);
+	return authorization ? /^Bearer\s+\S+/i.test(authorization) : false;
+}
+
+function unauthorized(code: string, message: string): RequestPrincipalError {
+	return new RequestPrincipalError(401, code, message, bearerChallenge(code));
+}
diff --git a/apps/api/src/auth/request-principal.ts b/apps/api/src/auth/request-principal.ts
new file mode 100644
index 000000000..dca884c01
--- /dev/null
+++ b/apps/api/src/auth/request-principal.ts
@@ -0,0 +1,25 @@
+import type { Session, SessionUser } from "@crm/auth";
+
+export type CredentialKind = "session" | "apiKey" | "oauth";
+
+export type RequestPrincipal = {
+	credentialKind: CredentialKind;
+	user: SessionUser;
+	clientId: string | null;
+	scopes: ReadonlySet<string>;
+	session: Session | null;
+	organizationId: string | null;
+	expiresAt: Date | null;
+};
+
+export class RequestPrincipalError extends Error {
+	constructor(
+		readonly status: 400 | 401 | 403,
+		readonly code: string,
+		message: string,
+		readonly challenge?: string,
+	) {
+		super(message);
+		this.name = "RequestPrincipalError";
+	}
+}
diff --git a/apps/api/src/backfill/backfill.service.ts b/apps/api/src/backfill/backfill.service.ts
index 303c82375..f7b9af29c 100644
--- a/apps/api/src/backfill/backfill.service.ts
+++ b/apps/api/src/backfill/backfill.service.ts
@@ -1,13 +1,16 @@
 import { onSignedIn } from "@crm/auth";
-import { type Db, EnrichmentStatus, type Prisma } from "@crm/db";
+import { EnrichmentStatus, type Prisma } from "@crm/db";
 import { PRIORITY } from "@crm/db/agent-tasks";
+import { runInTenant } from "@crm/db/tenant-context";
+import type { ScopedDb } from "@crm/db/tenant-scope";
+import { organizationIds } from "@crm/db/tenants";
 import { readWorkspaceIdentity } from "@crm/db/workspace";
 import { CACHE_MANAGER } from "@nestjs/cache-manager";
 import { Inject, Injectable, Logger, type OnModuleInit } from "@nestjs/common";
 import type { Cache } from "cache-manager";
 import { AgentTriggerService } from "../agent/agent-trigger.service";
 import { FaviconService } from "../companies/favicon.service";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import { ImageMirrorService } from "./image-mirror.service";
 
 export type BackfillScope = "companies" | "contacts" | "deals";
@@ -49,7 +52,7 @@ export class BackfillService implements OnModuleInit {
 	private readonly logger = new Logger(BackfillService.name);
 
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly agent: AgentTriggerService,
 		private readonly favicon: FaviconService,
 		private readonly images: ImageMirrorService,
@@ -68,19 +71,30 @@ export class BackfillService implements OnModuleInit {
 
 		void (async () => {
 			try {
-				await this.sweepWorkspace();
-
-				const companies = await this.runCompanies(false);
-				const contacts = await this.runContacts();
-
-				const mirrored = await this.images.sweep();
+				const organizations = await organizationIds(this.db);
+				let queued = 0;
+				let remaining = 0;
+				let iconsResolving = 0;
+				let imagesMirrored = 0;
+				for (const organizationId of organizations) {
+					await runInTenant(organizationId, async () => {
+						await this.sweepWorkspace();
+						const companies = await this.runCompanies(false);
+						const contacts = await this.runContacts();
+						const mirrored = await this.images.sweep();
+						queued += companies.queued + contacts.queued;
+						remaining += companies.remaining + contacts.remaining;
+						iconsResolving += companies.iconsResolving;
+						imagesMirrored += mirrored.copied;
+					});
+				}
 
 				this.logger.log({
 					message: "Automatic backfill swept",
-					queued: companies.queued + contacts.queued,
-					remaining: companies.remaining + contacts.remaining,
-					iconsResolving: companies.iconsResolving,
-					imagesMirrored: mirrored.copied,
+					queued,
+					remaining,
+					iconsResolving,
+					imagesMirrored,
 				});
 			} catch (error) {
 				this.logger.error(
diff --git a/apps/api/src/backfill/image-mirror.service.ts b/apps/api/src/backfill/image-mirror.service.ts
index 1f295de76..63924f8c6 100644
--- a/apps/api/src/backfill/image-mirror.service.ts
+++ b/apps/api/src/backfill/image-mirror.service.ts
@@ -5,8 +5,12 @@ import {
 	COMPANY_IMAGE_FIELDS,
 	type CompanyImageField,
 } from "@crm/db/images";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import { Injectable, Logger } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import {
+	InjectDatabase,
+	InjectScopedDatabase,
+} from "../database/database.constants";
 
 const MAX_PER_SWEEP = 25;
 
@@ -31,7 +35,10 @@ export type ImageMirrorResult = {
 export class ImageMirrorService {
 	private readonly logger = new Logger(ImageMirrorService.name);
 
-	constructor(@InjectDatabase() private readonly db: Db) {}
+	constructor(
+		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly scoped: ScopedDb,
+	) {}
 
 	async sweep(): Promise<ImageMirrorResult> {
 		if (!blobEnabled()) return { scanned: 0, copied: 0 };
@@ -58,7 +65,7 @@ export class ImageMirrorService {
 	}
 
 	private async sweepCompanies(): Promise<ImageMirrorResult> {
-		const rows = await this.db.company.findMany({
+		const rows = await this.scoped.company.findMany({
 			where: {
 				OR: COMPANY_IMAGE_FIELDS.map(externalCompanyImage),
 			},
@@ -91,7 +98,7 @@ export class ImageMirrorService {
 
 			if (Object.keys(data).length === 0) continue;
 
-			await this.db.company.updateMany({
+			await this.scoped.company.updateMany({
 				where: { id: row.id, ...unchanged(row) },
 				data,
 			});
@@ -101,7 +108,7 @@ export class ImageMirrorService {
 	}
 
 	private async sweepContacts(): Promise<ImageMirrorResult> {
-		const rows = await this.db.contact.findMany({
+		const rows = await this.scoped.contact.findMany({
 			where: EXTERNAL_CONTACT_IMAGE,
 			orderBy: { createdAt: "asc" },
 			take: MAX_PER_SWEEP,
@@ -116,7 +123,7 @@ export class ImageMirrorService {
 			const stored = await mirror(row.imageUrl, `contacts/${row.id}`);
 			if (!stored || stored === row.imageUrl) continue;
 
-			const { count } = await this.db.contact.updateMany({
+			const { count } = await this.scoped.contact.updateMany({
 				where: { id: row.id, imageUrl: row.imageUrl },
 				data: { imageUrl: stored },
 			});
diff --git a/apps/api/src/companies/companies.router.ts b/apps/api/src/companies/companies.router.ts
index ac11ccd35..23d560740 100644
--- a/apps/api/src/companies/companies.router.ts
+++ b/apps/api/src/companies/companies.router.ts
@@ -48,15 +48,6 @@ export class CompaniesRouter {
 		return this.companies.list(input);
 	}
 
-	@Query({
-		input: companyIdInput,
-		output: companyDetailOutput,
-		meta: restMeta("GET", "/companies/{id}", ["Companies"]),
-	})
-	async byId(@Input("id") id: string) {
-		return this.companies.byId(id);
-	}
-
 	@Query({
 		input: companyOptionsInput,
 		output: companyOptionOutput,
@@ -66,6 +57,15 @@ export class CompaniesRouter {
 		return this.companies.options(q);
 	}
 
+	@Query({
+		input: companyIdInput,
+		output: companyDetailOutput,
+		meta: restMeta("GET", "/companies/{id}", ["Companies"]),
+	})
+	async byId(@Input("id") id: string) {
+		return this.companies.byId(id);
+	}
+
 	@Mutation({
 		input: companyCreateInput,
 		output: companySummaryOutput,
diff --git a/apps/api/src/companies/companies.service.ts b/apps/api/src/companies/companies.service.ts
index 3960dc33c..970285d71 100644
--- a/apps/api/src/companies/companies.service.ts
+++ b/apps/api/src/companies/companies.service.ts
@@ -1,5 +1,4 @@
 import {
-	type Db,
 	type EnrichmentStatus,
 	type Prisma,
 	Prisma as PrismaNamespace,
@@ -7,6 +6,7 @@ import {
 } from "@crm/db";
 import { OPEN_DEAL_STAGES } from "@crm/db/deal-stage";
 import type { FieldDefinitionWithOptions } from "@crm/db/fields";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import {
 	BadRequestException,
 	ConflictException,
@@ -24,7 +24,7 @@ import {
 import { type BulkResult, requireOwner, runBulk } from "../crm/bulk";
 import { blankToNull, toCents } from "../crm/values";
 import { ConversionService } from "../currency/conversion.service";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import { FieldsService } from "../fields/fields.service";
 import {
 	activityFacetCounts,
@@ -72,7 +72,7 @@ export class CompaniesService {
 	private readonly logger = new Logger(CompaniesService.name);
 
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly agent: AgentTriggerService,
 		private readonly queue: AgentQueueService,
 		private readonly favicon: FaviconService,
@@ -367,7 +367,7 @@ export class CompaniesService {
 		}
 
 		try {
-			const updated = await this.db.$transaction(async (tx) => {
+			const updated = await scopedTransaction(this.db, async (tx) => {
 				if (input.fields) {
 					await this.fields.applyValues(tx, "COMPANY", id, input.fields);
 				}
@@ -437,7 +437,7 @@ export class CompaniesService {
 		let deleted: { targets: StampTargets; name: string } | null;
 
 		try {
-			deleted = await this.db.$transaction(async (tx) => {
+			deleted = await scopedTransaction(this.db, async (tx) => {
 				const [row] = await tx.$queryRaw<Array<{ archivedAt: Date | null }>>`
 					SELECT "archivedAt" FROM company WHERE id = ${id} FOR UPDATE
 				`;
@@ -453,6 +453,16 @@ export class CompaniesService {
 					return null;
 				}
 
+				const deal = await tx.deal.findFirst({
+					where: { companyId: id },
+					select: { id: true },
+				});
+				if (deal) {
+					throw new ConflictException(
+						"Delete this company's deals before deleting the company.",
+					);
+				}
+
 				const targets = await this.stamp.targetsOf(
 					{ OR: [{ companyId: id }, { deal: { companyId: id } }] },
 					tx,
diff --git a/apps/api/src/companies/favicon.service.ts b/apps/api/src/companies/favicon.service.ts
index 47f3c58e2..c9daf46a7 100644
--- a/apps/api/src/companies/favicon.service.ts
+++ b/apps/api/src/companies/favicon.service.ts
@@ -1,14 +1,14 @@
-import type { Db } from "@crm/db";
 import { mirror } from "@crm/db/blob";
 import { resolveFavicon } from "@crm/db/favicon";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import { Injectable, Logger } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 
 @Injectable()
 export class FaviconService {
 	private readonly logger = new Logger(FaviconService.name);
 
-	constructor(@InjectDatabase() private readonly db: Db) {}
+	constructor(@InjectScopedDatabase() private readonly db: ScopedDb) {}
 
 	async backfill(companyId: string, domain: string | null): Promise<boolean> {
 		try {
diff --git a/apps/api/src/config/env.validation.ts b/apps/api/src/config/env.validation.ts
index 08cb676c2..694949075 100644
--- a/apps/api/src/config/env.validation.ts
+++ b/apps/api/src/config/env.validation.ts
@@ -109,6 +109,22 @@ export class EnvironmentVariables {
 	@IsString()
 	BLOB_READ_WRITE_TOKEN?: string;
 
+	@IsOptional()
+	@IsString()
+	R2_ACCOUNT_ID?: string;
+
+	@IsOptional()
+	@IsString()
+	R2_ACCESS_KEY_ID?: string;
+
+	@IsOptional()
+	@IsString()
+	R2_SECRET_ACCESS_KEY?: string;
+
+	@IsOptional()
+	@IsString()
+	R2_BUCKET?: string;
+
 	@IsOptional()
 	@IsUrl(
 		{ require_tld: false, require_protocol: true },
diff --git a/apps/api/src/contacts/contacts.service.ts b/apps/api/src/contacts/contacts.service.ts
index 043fd4b78..dc345dc38 100644
--- a/apps/api/src/contacts/contacts.service.ts
+++ b/apps/api/src/contacts/contacts.service.ts
@@ -1,6 +1,5 @@
 import {
 	type ContactBriefSections,
-	type Db,
 	type FactEvidence,
 	FactStatus,
 	type Prisma,
@@ -8,6 +7,8 @@ import {
 	type RecordSource,
 } from "@crm/db";
 import type { FieldDefinitionWithOptions } from "@crm/db/fields";
+import { currentOrganizationId } from "@crm/db/tenant-context";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import {
 	ConflictException,
 	Injectable,
@@ -24,7 +25,7 @@ import {
 } from "../crm/activity-stamp.service";
 import { type BulkResult, requireOwner, runBulk } from "../crm/bulk";
 import { blankToNull, normalizeEmail, toCents } from "../crm/values";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import { FieldsService } from "../fields/fields.service";
 import {
 	activityFacetCounts,
@@ -95,7 +96,7 @@ export class ContactsService {
 	private readonly logger = new Logger(ContactsService.name);
 
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly companies: CompanyDirectoryService,
 		private readonly agent: AgentTriggerService,
 		private readonly queue: AgentQueueService,
@@ -395,7 +396,7 @@ export class ContactsService {
 		} | null;
 
 		try {
-			deleted = await this.db.$transaction(async (tx) => {
+			deleted = await scopedTransaction(this.db, async (tx) => {
 				const [row] = await tx.$queryRaw<Array<{ archivedAt: Date | null }>>`
 					SELECT "archivedAt" FROM contact WHERE id = ${id} FOR UPDATE
 				`;
@@ -426,7 +427,12 @@ export class ContactsService {
 
 				if (suppress) {
 					await tx.suppressedContact.upsert({
-						where: { email: suppress },
+						where: {
+							organizationId_email: {
+								organizationId: currentOrganizationId(),
+								email: suppress,
+							},
+						},
 						create: {
 							email: suppress,
 							reason: `Deleted from the CRM (${name})`,
@@ -499,7 +505,7 @@ export class ContactsService {
 		}
 
 		try {
-			return await this.db.$transaction(async (tx) => {
+			return await scopedTransaction(this.db, async (tx) => {
 				if (input.fields) {
 					await this.fields.applyValues(tx, "CONTACT", id, input.fields);
 				}
@@ -725,7 +731,7 @@ export class ContactsService {
 		const accepted = input.decision === "accept";
 		const column = FACT_COLUMNS[fact.field];
 
-		await this.db.$transaction(async (tx) => {
+		await scopedTransaction(this.db, async (tx) => {
 			if (accepted) {
 				await tx.contactFact.updateMany({
 					where: {
diff --git a/apps/api/src/conversations/conversation-attachments.controller.ts b/apps/api/src/conversations/conversation-attachments.controller.ts
index fe1d08609..85c247d20 100644
--- a/apps/api/src/conversations/conversation-attachments.controller.ts
+++ b/apps/api/src/conversations/conversation-attachments.controller.ts
@@ -1,4 +1,4 @@
-import { type auth, SESSION_COOKIE_NAME } from "@crm/auth";
+import { SESSION_COOKIE_NAME } from "@crm/auth";
 import {
 	Controller,
 	Get,
@@ -8,21 +8,24 @@ import {
 	StreamableFile,
 } from "@nestjs/common";
 import {
+	ApiBearerAuth,
 	ApiCookieAuth,
 	ApiOkResponse,
 	ApiOperation,
 	ApiParam,
 	ApiQuery,
+	ApiSecurity,
 	ApiTags,
 } from "@nestjs/swagger";
-import { Session, type UserSession } from "@thallesp/nestjs-better-auth";
 import type { Response } from "express";
+import type { RequestPrincipal } from "../auth/request-principal";
+import { Principal } from "../auth/request-principal.decorator";
 import { ConversationsService } from "./conversations.service";
 
-type CrmSession = UserSession<typeof auth>;
-
 @ApiTags("Conversations")
 @ApiCookieAuth(SESSION_COOKIE_NAME)
+@ApiSecurity("apiKey")
+@ApiBearerAuth("oauth")
 @Controller("api/conversations/attachments")
 export class ConversationAttachmentsController {
 	constructor(private readonly conversations: ConversationsService) {}
@@ -39,12 +42,12 @@ export class ConversationAttachmentsController {
 	async read(
 		@Param("id") id: string,
 		@Query("share") shareToken: string | undefined,
-		@Session() session: CrmSession,
+		@Principal() principal: RequestPrincipal,
 		@Res({ passthrough: true }) response: Response,
 	) {
 		const attachment = await this.conversations.attachment(
 			id,
-			session.user.id,
+			principal.user.id,
 			shareToken,
 		);
 		const content = Buffer.from(attachment.content);
diff --git a/apps/api/src/conversations/conversation-sharing.service.ts b/apps/api/src/conversations/conversation-sharing.service.ts
index 3f742acfa..6e200b56c 100644
--- a/apps/api/src/conversations/conversation-sharing.service.ts
+++ b/apps/api/src/conversations/conversation-sharing.service.ts
@@ -1,18 +1,19 @@
 import { randomBytes } from "node:crypto";
-import { WORKSPACE_ID } from "@crm/auth";
-import type { Db, Prisma } from "@crm/db";
+import type { Prisma } from "@crm/db";
+import { currentOrganizationId } from "@crm/db/tenant-context";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import {
 	ForbiddenException,
 	Injectable,
 	NotFoundException,
 } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import { builderMessageWithAttachments } from "./conversation-attachments";
 import { conversationShareTokenHash } from "./conversation-share-token";
 
 @Injectable()
 export class ConversationSharingService {
-	constructor(@InjectDatabase() private readonly db: Db) {}
+	constructor(@InjectScopedDatabase() private readonly db: ScopedDb) {}
 
 	async status(conversationId: string, userId: string) {
 		await this.ownedBuilder(conversationId, userId);
@@ -37,7 +38,7 @@ export class ConversationSharingService {
 		const token = randomBytes(32).toString("base64url");
 		const tokenHash = conversationShareTokenHash(token);
 
-		const created = await this.db.$transaction(async (tx) => {
+		const created = await scopedTransaction(this.db, async (tx) => {
 			if (!(await this.lockOwnedBuilder(tx, conversationId, userId))) {
 				return false;
 			}
@@ -59,7 +60,7 @@ export class ConversationSharingService {
 	}
 
 	async revoke(conversationId: string, userId: string) {
-		const revoked = await this.db.$transaction(async (tx) => {
+		const revoked = await scopedTransaction(this.db, async (tx) => {
 			if (!(await this.lockOwnedBuilder(tx, conversationId, userId))) {
 				return false;
 			}
@@ -225,7 +226,10 @@ export class ConversationSharingService {
 	private async assertWorkspaceMember(userId: string): Promise<void> {
 		const member = await this.db.member.findUnique({
 			where: {
-				organizationId_userId: { organizationId: WORKSPACE_ID, userId },
+				organizationId_userId: {
+					organizationId: currentOrganizationId(),
+					userId,
+				},
 			},
 			select: { id: true },
 		});
diff --git a/apps/api/src/conversations/conversations.service.ts b/apps/api/src/conversations/conversations.service.ts
index d025c9e26..1301a4b2d 100644
--- a/apps/api/src/conversations/conversations.service.ts
+++ b/apps/api/src/conversations/conversations.service.ts
@@ -1,5 +1,6 @@
-import { WORKSPACE_ID } from "@crm/auth";
-import { type Db, type Prisma, Prisma as PrismaNamespace } from "@crm/db";
+import { type Prisma, Prisma as PrismaNamespace } from "@crm/db";
+import { currentOrganizationId } from "@crm/db/tenant-context";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import { readAgentManifestSummary } from "@crm/validation/agent-manifest";
 import {
 	type BuilderQuestion,
@@ -13,7 +14,7 @@ import {
 	Optional,
 } from "@nestjs/common";
 import { AgentTriggerService } from "../agent/agent-trigger.service";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import {
 	builderMessageWithAttachments,
 	isPreviewableImage,
@@ -46,7 +47,7 @@ export class ConversationsService {
 	private readonly logger = new Logger(ConversationsService.name);
 
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		@Optional() private readonly agent?: AgentTriggerService,
 	) {}
 
@@ -200,8 +201,8 @@ export class ConversationsService {
 					company: { select: { name: true, logoUrl: true } },
 				},
 			}),
-			this.db.account.findFirst({
-				where: { providerId: "slack", accessToken: { not: null } },
+			this.db.slackWorkspaceGrant.findFirst({
+				where: { botToken: { not: null } },
 				select: { id: true },
 			}),
 		]);
@@ -468,27 +469,13 @@ export class ConversationsService {
 				input,
 				userId,
 			);
-			const submission = await this.db.$transaction(async (tx) => {
-				const created = await tx.agentConversationSubmission.create({
-					data: {
-						conversationId: input.id,
-						submittedById: userId,
-						clientRequestId: input.clientRequestId,
-						commandType: input.commandType,
-						message: this.builderMessage(input),
-						attachments: {
-							create: attachmentWrites,
-						},
-					},
-					select: { id: true },
-				});
-
-				await tx.agentConversation.update({
-					where: { id: input.id },
-					data: { lastMessageAt: new Date(), lastReadAt: new Date() },
-				});
-
-				return created;
+			const submission = await this.storeBuilderSubmission(input.id, {
+				conversationId: input.id,
+				submittedById: userId,
+				clientRequestId: input.clientRequestId,
+				commandType: input.commandType,
+				message: this.builderMessage(input),
+				attachments: { create: attachmentWrites },
 			});
 
 			this.agent?.builderConversationQueued();
@@ -574,30 +561,18 @@ export class ConversationsService {
 			? { requestId: input.requestId, optionId: input.optionId }
 			: { requestId: input.requestId, text: input.text };
 		try {
-			const submission = await this.db.$transaction(async (tx) => {
-				const created = await tx.agentConversationSubmission.create({
-					data: {
-						conversationId: input.id,
-						submittedById: userId,
-						clientRequestId: input.clientRequestId,
-						inputRequestId: input.requestId,
-						commandType: "CREATE_AGENT",
-						message: {
-							text: displayText,
-							resources: [],
-							attachments: [],
-							inputResponse,
-						},
-					},
-					select: { id: true },
-				});
-
-				await tx.agentConversation.update({
-					where: { id: input.id },
-					data: { lastMessageAt: new Date(), lastReadAt: new Date() },
-				});
-
-				return created;
+			const submission = await this.storeBuilderSubmission(input.id, {
+				conversationId: input.id,
+				submittedById: userId,
+				clientRequestId: input.clientRequestId,
+				inputRequestId: input.requestId,
+				commandType: "CREATE_AGENT",
+				message: {
+					text: displayText,
+					resources: [],
+					attachments: [],
+					inputResponse,
+				},
 			});
 
 			this.agent?.builderConversationQueued();
@@ -903,7 +878,7 @@ export class ConversationsService {
 			await this.assertWorkspaceMember(userId);
 		}
 
-		await this.db.$transaction(async (tx) => {
+		await scopedTransaction(this.db, async (tx) => {
 			await tx.agentBuilderArtifact.deleteMany({
 				where: { conversationId: id, versionId: null },
 			});
@@ -963,22 +938,70 @@ export class ConversationsService {
 		};
 	}
 
+	private async storeBuilderSubmission(
+		conversationId: string,
+		data: Prisma.AgentConversationSubmissionCreateArgs["data"],
+	): Promise<{ id: string }> {
+		return scopedTransaction(this.db, async (tx) => {
+			const submission = await tx.agentConversationSubmission.create({
+				data,
+				select: { id: true },
+			});
+
+			await tx.agentConversation.update({
+				where: { id: conversationId },
+				data: { lastMessageAt: new Date(), lastReadAt: new Date() },
+			});
+
+			return submission;
+		});
+	}
+
 	private attachmentWrites(
 		attachments: BuilderConversationCreateInput["attachments"],
+	): Prisma.AgentConversationAttachmentUncheckedCreateWithoutSubmissionInput[] {
+		return attachments.map((attachment, position) =>
+			this.attachmentWrite(
+				{
+					name: attachment.name,
+					mediaType: attachment.type,
+					size: attachment.size,
+					content: Buffer.from(attachment.contentBase64, "base64"),
+				},
+				position,
+			),
+		);
+	}
+
+	private attachmentWrite(
+		{
+			name,
+			mediaType,
+			size,
+			content,
+		}: {
+			name: string;
+			mediaType: string;
+			size: number;
+			content: Prisma.AgentConversationAttachmentUncheckedCreateWithoutSubmissionInput["content"];
+		},
+		position: number,
 	) {
-		return attachments.map((attachment, position) => ({
-			name: attachment.name,
-			mediaType: attachment.type,
-			size: attachment.size,
-			content: Buffer.from(attachment.contentBase64, "base64"),
+		return {
+			name,
+			mediaType,
+			size,
+			content,
 			position,
-		}));
+		};
 	}
 
 	private async submissionAttachmentWrites(
 		input: BuilderConversationSubmitInput,
 		userId: string,
-	) {
+	): Promise<
+		Prisma.AgentConversationAttachmentUncheckedCreateWithoutSubmissionInput[]
+	> {
 		const referencedIds = input.attachments.flatMap((attachment) =>
 			"contentBase64" in attachment ? [] : [attachment.id],
 		);
@@ -1010,13 +1033,15 @@ export class ConversationsService {
 
 		return input.attachments.map((attachment, position) => {
 			if ("contentBase64" in attachment) {
-				return {
-					name: attachment.name,
-					mediaType: attachment.type,
-					size: attachment.size,
-					content: Buffer.from(attachment.contentBase64, "base64"),
+				return this.attachmentWrite(
+					{
+						name: attachment.name,
+						mediaType: attachment.type,
+						size: attachment.size,
+						content: Buffer.from(attachment.contentBase64, "base64"),
+					},
 					position,
-				};
+				);
 			}
 
 			const stored = referencedById.get(attachment.id);
@@ -1025,20 +1050,17 @@ export class ConversationsService {
 					"One or more attachments are no longer available.",
 				);
 			}
-			return {
-				name: stored.name,
-				mediaType: stored.mediaType,
-				size: stored.size,
-				content: stored.content,
-				position,
-			};
+			return this.attachmentWrite(stored, position);
 		});
 	}
 
 	private async assertWorkspaceMember(userId: string): Promise<void> {
 		const member = await this.db.member.findUnique({
 			where: {
-				organizationId_userId: { organizationId: WORKSPACE_ID, userId },
+				organizationId_userId: {
+					organizationId: currentOrganizationId(),
+					userId,
+				},
 			},
 			select: { id: true },
 		});
diff --git a/apps/api/src/create-app.ts b/apps/api/src/create-app.ts
index 4a436e71c..b55cb6566 100644
--- a/apps/api/src/create-app.ts
+++ b/apps/api/src/create-app.ts
@@ -1,4 +1,4 @@
-import { API_KEY_HEADER, apiUrl, SESSION_COOKIE_NAME } from "@crm/auth";
+import { API_KEY_HEADER, apiUrl, OAUTH, SESSION_COOKIE_NAME } from "@crm/auth";
 import { ValidationPipe } from "@nestjs/common";
 import { NestFactory } from "@nestjs/core";
 import {
@@ -10,12 +10,18 @@ import type { NextFunction, Request, Response } from "express";
 import helmet from "helmet";
 import { AppRouterHost } from "nestjs-trpc";
 import {
-	createOpenApiExpressMiddleware,
+	createOpenApiNodeHttpHandler,
 	generateOpenApiDocument,
 } from "trpc-to-openapi";
 import { AppModule } from "./app.module";
+import { describeAssetErrors } from "./assets/asset-openapi";
+import {
+	prepareAssetRestResponse,
+	recordAssetRestError,
+	validateAssetRestRequest,
+} from "./assets/asset-rest";
+import { RequestPrincipalService } from "./auth/request-principal.service";
 import { ContextLogger } from "./logging/context-logger";
-import { REST_BRIDGE_PATH } from "./trpc/openapi";
 import { createBaseTrpcContext } from "./trpc/trpc.context";
 
 export async function createApp(): Promise<NestExpressApplication> {
@@ -35,23 +41,26 @@ export async function createApp(): Promise<NestExpressApplication> {
 		}),
 	);
 
-	let restBridge: ((req: Request, res: Response) => Promise<void>) | undefined;
-	app.use(
-		REST_BRIDGE_PATH,
-		(req: Request, res: Response, next: NextFunction) => {
-			if (!restBridge) {
-				next();
-				return;
-			}
-			void restBridge(req, res);
-		},
-	);
+	let restBridge:
+		| ((req: Request, res: Response, next: NextFunction) => Promise<void>)
+		| undefined;
+	app.use((req: Request, res: Response, next: NextFunction) => {
+		if (!restBridge) return next();
+		prepareAssetRestResponse(req, res);
+		void restBridge(req, res, next);
+	});
 
 	const apiKeySecurityScheme = {
 		type: "apiKey",
 		in: "header",
 		name: API_KEY_HEADER,
 	} as const;
+	const oauthSecurityScheme = {
+		type: "http",
+		scheme: "bearer",
+		bearerFormat: "JWT",
+		description: `CompCRM OAuth access token with ${OAUTH.scopes.crm.read} or ${OAUTH.scopes.crm.write} scope.`,
+	} as const;
 
 	// SwaggerModule.setup() registers its Express routes synchronously, so it must
 	// happen before app.init() the same way the REST bridge does — Nest's own
@@ -69,27 +78,50 @@ export async function createApp(): Promise<NestExpressApplication> {
 				description:
 					"Every tRPC procedure, reachable over REST for tooling that cannot speak tRPC. Same validation, same middlewares, same services as the tRPC transport — this only translates the wire format.",
 				version: "1.0",
-				baseUrl: `${apiUrl}${REST_BRIDGE_PATH}`,
-				securitySchemes: { apiKey: apiKeySecurityScheme },
+				baseUrl: apiUrl,
+				securitySchemes: {
+					apiKey: apiKeySecurityScheme,
+					oauth: oauthSecurityScheme,
+				},
 			});
+			describeAssetErrors(trpcDocument);
 
 			const swaggerConfig = new DocumentBuilder()
 				.setTitle("CRM API")
 				.setDescription(
-					`REST surface of the CRM API — auth, health, the internal cron routes, and a generated REST bridge (under ${REST_BRIDGE_PATH}) for every tRPC procedure.`,
+					"REST surface of the CRM API: auth, health, internal cron routes, and tRPC procedures at root resource paths.",
 				)
 				.setVersion("1.0")
 				.addCookieAuth(SESSION_COOKIE_NAME)
 				.addApiKey(apiKeySecurityScheme, "apiKey")
+				.addBearerAuth(oauthSecurityScheme, "oauth")
 				.build();
 			const swaggerDocument = SwaggerModule.createDocument(app, swaggerConfig);
+			for (const path of Object.values(trpcDocument.paths ?? {})) {
+				for (const method of [
+					"get",
+					"post",
+					"put",
+					"patch",
+					"delete",
+				] as const) {
+					const operation = path[method];
+					if (!operation?.security?.length) continue;
+					operation.security = [{ cookie: [] }, { apiKey: [] }, { oauth: [] }];
+				}
+			}
 
 			swaggerDocument.paths = {
 				...swaggerDocument.paths,
 				...(trpcDocument.paths as typeof swaggerDocument.paths),
 			};
+			swaggerDocument.servers = [{ url: apiUrl }];
 			swaggerDocument.components = {
 				...swaggerDocument.components,
+				securitySchemes: {
+					...swaggerDocument.components?.securitySchemes,
+					...trpcDocument.components?.securitySchemes,
+				},
 				schemas: {
 					...swaggerDocument.components?.schemas,
 					...(trpcDocument.components?.schemas as NonNullable<
@@ -106,10 +138,16 @@ export async function createApp(): Promise<NestExpressApplication> {
 	await app.init();
 
 	const { appRouter } = app.get(AppRouterHost);
+	const principals = app.get(RequestPrincipalService);
 
-	restBridge = createOpenApiExpressMiddleware({
+	restBridge = createOpenApiNodeHttpHandler({
 		router: appRouter,
-		createContext: ({ req }) => createBaseTrpcContext(req),
+		createContext: async ({ req }) => {
+			const context = await createBaseTrpcContext(req, principals);
+			validateAssetRestRequest(req);
+			return context;
+		},
+		onError: ({ req, error }) => recordAssetRestError(req, error),
 	});
 
 	return app;
diff --git a/apps/api/src/crm/activity-stamp.service.ts b/apps/api/src/crm/activity-stamp.service.ts
index 63d83fb10..30b7dae99 100644
--- a/apps/api/src/crm/activity-stamp.service.ts
+++ b/apps/api/src/crm/activity-stamp.service.ts
@@ -1,6 +1,7 @@
-import { type Db, type Prisma, Prisma as PrismaNamespace } from "@crm/db";
+import { type Prisma, Prisma as PrismaNamespace } from "@crm/db";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import { Injectable, Logger } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 
 export type ActivityTarget = {
 	companyId?: string | null;
@@ -22,7 +23,7 @@ function present(ids: (string | null)[]): string[] {
 export class ActivityStampService {
 	private readonly logger = new Logger(ActivityStampService.name);
 
-	constructor(@InjectDatabase() private readonly db: Db) {}
+	constructor(@InjectScopedDatabase() private readonly db: ScopedDb) {}
 
 	async touch(target: ActivityTarget, at: Date): Promise<void> {
 		const stale = {
@@ -104,15 +105,23 @@ export class ActivityStampService {
 	}
 
 	async recomputeMany(targets: StampTargets): Promise<void> {
-		const statements = [
-			this.restamp("company", "companyId", targets.companyIds),
-			this.restamp("contact", "contactId", targets.contactIds),
-			this.restamp("deal", "dealId", targets.dealIds),
-		].filter((statement) => statement !== null);
-
-		if (statements.length === 0) return;
+		if (
+			targets.companyIds.length === 0 &&
+			targets.contactIds.length === 0 &&
+			targets.dealIds.length === 0
+		) {
+			return;
+		}
 
-		await this.db.$transaction(statements);
+		await scopedTransaction(this.db, async (tx) => {
+			await Promise.all(
+				[
+					this.restamp(tx, "company", "companyId", targets.companyIds),
+					this.restamp(tx, "contact", "contactId", targets.contactIds),
+					this.restamp(tx, "deal", "dealId", targets.dealIds),
+				].filter((statement) => statement !== null),
+			);
+		});
 	}
 
 	async recomputeAfterDelete(
@@ -133,13 +142,18 @@ export class ActivityStampService {
 		}
 	}
 
-	private restamp(table: string, column: string, ids: string[]) {
+	private restamp(
+		client: Prisma.TransactionClient,
+		table: string,
+		column: string,
+		ids: string[],
+	) {
 		if (ids.length === 0) return null;
 
 		const record = PrismaNamespace.raw(`"${table}"`);
 		const key = PrismaNamespace.raw(`"${column}"`);
 
-		return this.db.$executeRaw`
+		return client.$executeRaw`
 			UPDATE ${record} r
 			SET "lastActivityAt" = (
 				SELECT MAX(a."createdAt") FROM "activity" a WHERE a.${key} = r.id
@@ -148,43 +162,63 @@ export class ActivityStampService {
 	}
 
 	async recomputeAll(): Promise<void> {
-		await this.db.$transaction([
-			this.db.$executeRaw`
+		await scopedTransaction(this.db, async (tx) => {
+			await Promise.all([
+				tx.$executeRaw`
 				UPDATE "company" c
 				SET "lastActivityAt" = a.max
 				FROM (
 					SELECT "companyId" AS id, MAX("createdAt") AS max
-					FROM "activity" WHERE "companyId" IS NOT NULL GROUP BY "companyId"
+					FROM "activity"
+					WHERE "companyId" IS NOT NULL
+					GROUP BY "companyId"
 				) a
-				WHERE c.id = a.id AND c."lastActivityAt" IS DISTINCT FROM a.max`,
-			this.db.$executeRaw`
+				WHERE c.id = a.id
+				AND c."lastActivityAt" IS DISTINCT FROM a.max`,
+				tx.$executeRaw`
 				UPDATE "company" SET "lastActivityAt" = NULL
 				WHERE "lastActivityAt" IS NOT NULL
-				AND id NOT IN (SELECT "companyId" FROM "activity" WHERE "companyId" IS NOT NULL)`,
-			this.db.$executeRaw`
+				AND id NOT IN (
+					SELECT "companyId" FROM "activity"
+					WHERE "companyId" IS NOT NULL
+				)`,
+				tx.$executeRaw`
 				UPDATE "contact" c
 				SET "lastActivityAt" = a.max
 				FROM (
 					SELECT "contactId" AS id, MAX("createdAt") AS max
-					FROM "activity" WHERE "contactId" IS NOT NULL GROUP BY "contactId"
+					FROM "activity"
+					WHERE "contactId" IS NOT NULL
+					GROUP BY "contactId"
 				) a
-				WHERE c.id = a.id AND c."lastActivityAt" IS DISTINCT FROM a.max`,
-			this.db.$executeRaw`
+				WHERE c.id = a.id
+				AND c."lastActivityAt" IS DISTINCT FROM a.max`,
+				tx.$executeRaw`
 				UPDATE "contact" SET "lastActivityAt" = NULL
 				WHERE "lastActivityAt" IS NOT NULL
-				AND id NOT IN (SELECT "contactId" FROM "activity" WHERE "contactId" IS NOT NULL)`,
-			this.db.$executeRaw`
+				AND id NOT IN (
+					SELECT "contactId" FROM "activity"
+					WHERE "contactId" IS NOT NULL
+				)`,
+				tx.$executeRaw`
 				UPDATE "deal" d
 				SET "lastActivityAt" = a.max
 				FROM (
 					SELECT "dealId" AS id, MAX("createdAt") AS max
-					FROM "activity" WHERE "dealId" IS NOT NULL GROUP BY "dealId"
+					FROM "activity"
+					WHERE "dealId" IS NOT NULL
+					GROUP BY "dealId"
 				) a
-				WHERE d.id = a.id AND d."lastActivityAt" IS DISTINCT FROM a.max`,
-			this.db.$executeRaw`
+				WHERE d.id = a.id
+				AND d."lastActivityAt" IS DISTINCT FROM a.max`,
+				tx.$executeRaw`
 				UPDATE "deal" SET "lastActivityAt" = NULL
 				WHERE "lastActivityAt" IS NOT NULL
-				AND id NOT IN (SELECT "dealId" FROM "activity" WHERE "dealId" IS NOT NULL)`,
-		]);
+				AND id NOT IN (
+					SELECT "dealId" FROM "activity"
+					WHERE "dealId" IS NOT NULL
+				)`,
+			]);
+		});
 	}
 }
diff --git a/apps/api/src/crm/enrichment-log.service.ts b/apps/api/src/crm/enrichment-log.service.ts
index c5087d8e8..59462bc75 100644
--- a/apps/api/src/crm/enrichment-log.service.ts
+++ b/apps/api/src/crm/enrichment-log.service.ts
@@ -1,7 +1,11 @@
 import { ActivityType, type Db } from "@crm/db";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import type { ActivityMetaFields } from "@crm/validation/activity-meta";
 import { Injectable } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import {
+	InjectDatabase,
+	InjectScopedDatabase,
+} from "../database/database.constants";
 import { ActivityStampService } from "./activity-stamp.service";
 
 export type EnrichmentEvent = {
@@ -16,6 +20,7 @@ export type EnrichmentEvent = {
 export class EnrichmentLogService {
 	constructor(
 		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly scoped: ScopedDb,
 		private readonly stamp: ActivityStampService,
 	) {}
 
@@ -23,7 +28,7 @@ export class EnrichmentLogService {
 		const author = await this.authorFor(event);
 		if (!author) return null;
 
-		const activity = await this.db.activity.create({
+		const activity = await this.scoped.activity.create({
 			data: {
 				type: ActivityType.ENRICHMENT,
 				subject: event.subject,
@@ -47,7 +52,7 @@ export class EnrichmentLogService {
 
 	private async authorFor(event: EnrichmentEvent): Promise<string | null> {
 		if (event.contactId) {
-			const contact = await this.db.contact.findUnique({
+			const contact = await this.scoped.contact.findUnique({
 				where: { id: event.contactId },
 				select: { ownerId: true },
 			});
@@ -55,7 +60,7 @@ export class EnrichmentLogService {
 		}
 
 		if (event.companyId) {
-			const company = await this.db.company.findUnique({
+			const company = await this.scoped.company.findUnique({
 				where: { id: event.companyId },
 				select: { ownerId: true },
 			});
diff --git a/apps/api/src/currency/conversion.service.ts b/apps/api/src/currency/conversion.service.ts
index d4c35ebd1..a9931a936 100644
--- a/apps/api/src/currency/conversion.service.ts
+++ b/apps/api/src/currency/conversion.service.ts
@@ -1,4 +1,4 @@
-import type { Db, Prisma as PrismaTypes } from "@crm/db";
+import type { Prisma as PrismaTypes } from "@crm/db";
 import { Prisma } from "@crm/db";
 import { minorUnitsOf, normalizeCurrency } from "@crm/db/currency";
 import {
@@ -8,8 +8,9 @@ import {
 	resolveRate,
 } from "@crm/db/fx";
 import { readReportingCurrency } from "@crm/db/settings";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import { Injectable, Logger } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 
 export interface DealFxFields {
 	baseAmount: PrismaTypes.Decimal | null;
@@ -33,7 +34,7 @@ export interface RerateResult {
 export class ConversionService {
 	private readonly logger = new Logger(ConversionService.name);
 
-	constructor(@InjectDatabase() private readonly db: Db) {}
+	constructor(@InjectScopedDatabase() private readonly db: ScopedDb) {}
 
 	async reportingCurrency(): Promise<string> {
 		return readReportingCurrency(this.db);
@@ -182,27 +183,33 @@ export class ConversionService {
 			? Prisma.sql`AND ("baseAmount" IS NULL OR "baseCurrency" IS DISTINCT FROM ${base})`
 			: Prisma.empty;
 
-		return this.db.$executeRaw`
-			UPDATE "deal"
-			SET "baseAmount" = ROUND("amount" * ${value}::numeric, ${places}::int),
-			    "baseCurrency" = ${base},
-			    "fxRate" = ${value}::numeric,
-			    "fxRateAt" = ${rate.asOf}
-			WHERE "amount" IS NOT NULL
-			  AND upper(btrim("currency")) = ${code}
-			  ${filter}
-		`;
+		return scopedTransaction(
+			this.db,
+			(tx) => tx.$executeRaw`
+				UPDATE "deal"
+				SET "baseAmount" = ROUND("amount" * ${value}::numeric, ${places}::int),
+				    "baseCurrency" = ${base},
+				    "fxRate" = ${value}::numeric,
+				    "fxRateAt" = ${rate.asOf}
+				WHERE "amount" IS NOT NULL
+				  AND upper(btrim("currency")) = ${code}
+				  ${filter}
+			`,
+		);
 	}
 
 	private async clear(code: string): Promise<number> {
-		return this.db.$executeRaw`
-			UPDATE "deal"
-			SET "baseAmount" = NULL,
-			    "baseCurrency" = NULL,
-			    "fxRate" = NULL,
-			    "fxRateAt" = NULL
-			WHERE upper(btrim("currency")) = ${code}
-			  AND "baseAmount" IS NOT NULL
-		`;
+		return scopedTransaction(
+			this.db,
+			(tx) => tx.$executeRaw`
+				UPDATE "deal"
+				SET "baseAmount" = NULL,
+				    "baseCurrency" = NULL,
+				    "fxRate" = NULL,
+				    "fxRateAt" = NULL
+				WHERE upper(btrim("currency")) = ${code}
+				  AND "baseAmount" IS NOT NULL
+			`,
+		);
 	}
 }
diff --git a/apps/api/src/currency/currency.service.ts b/apps/api/src/currency/currency.service.ts
index 5dae1d1b6..6b1a60007 100644
--- a/apps/api/src/currency/currency.service.ts
+++ b/apps/api/src/currency/currency.service.ts
@@ -1,15 +1,19 @@
-import { canManageCurrency, workspaceRoleOf } from "@crm/auth";
+import { activeWorkspaceRoleOf, canManageCurrency } from "@crm/auth";
 import type { Db } from "@crm/db";
 import { Prisma, RateSource } from "@crm/db";
 import { CURRENCIES, currencyName, normalizeCurrency } from "@crm/db/currency";
 import { writeReportingCurrency } from "@crm/db/settings";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import {
 	BadRequestException,
 	ForbiddenException,
 	Injectable,
 	Logger,
 } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import {
+	InjectDatabase,
+	InjectScopedDatabase,
+} from "../database/database.constants";
 import { ConversionService } from "./conversion.service";
 import type { CurrencyRate, CurrencySettings } from "./currency.contracts";
 import { RatesService } from "./rates.service";
@@ -20,6 +24,7 @@ export class CurrencyService {
 
 	constructor(
 		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly scoped: ScopedDb,
 		private readonly conversion: ConversionService,
 		private readonly rates: RatesService,
 	) {}
@@ -40,7 +45,7 @@ export class CurrencyService {
 			}),
 			this.rates.refreshedAt(),
 			this.conversion.unconverted(),
-			this.db.deal.groupBy({
+			this.scoped.deal.groupBy({
 				by: ["currency"],
 				where: { amount: { not: null } },
 				_count: { _all: true },
@@ -97,12 +102,12 @@ export class CurrencyService {
 				),
 			unconverted,
 			catalog: [...CURRENCIES],
-			canManage: canManageCurrency(await workspaceRoleOf(actingUserId)),
+			canManage: canManageCurrency(await activeWorkspaceRoleOf(actingUserId)),
 		};
 	}
 
 	private async requireManager(userId: string): Promise<void> {
-		if (!canManageCurrency(await workspaceRoleOf(userId))) {
+		if (!canManageCurrency(await activeWorkspaceRoleOf(userId))) {
 			throw new ForbiddenException(
 				"Only an owner or an admin can change how money is reported.",
 			);
diff --git a/apps/api/src/dashboard/dashboard.service.ts b/apps/api/src/dashboard/dashboard.service.ts
index 75065fc24..0089a98c6 100644
--- a/apps/api/src/dashboard/dashboard.service.ts
+++ b/apps/api/src/dashboard/dashboard.service.ts
@@ -1,10 +1,11 @@
-import { ActivityType, type Db, DealStage } from "@crm/db";
+import { ActivityType, DealStage } from "@crm/db";
 import { OPEN_DEAL_STAGES } from "@crm/db/deal-stage";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import { activityMeta } from "@crm/validation/activity-meta";
 import { Injectable } from "@nestjs/common";
 import { toCents } from "../crm/values";
 import { ConversionService } from "../currency/conversion.service";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import type { DashboardSummaryInput } from "./dashboard.contracts";
 
 const OWNER_SELECT = {
@@ -33,7 +34,7 @@ function monthKey(date: Date): number {
 @Injectable()
 export class DashboardService {
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly conversion: ConversionService,
 	) {}
 
@@ -150,7 +151,10 @@ export class DashboardService {
 				},
 			}),
 			this.db.activity.findMany({
-				where: mine ? { createdById: actingUserId } : {},
+				where: {
+					archivedAt: null,
+					createdById: mine ? actingUserId : undefined,
+				},
 				orderBy: [{ createdAt: "desc" }],
 				take: 12,
 				select: {
diff --git a/apps/api/src/database/database.constants.ts b/apps/api/src/database/database.constants.ts
index 49ff962b6..a58b4f2ed 100644
--- a/apps/api/src/database/database.constants.ts
+++ b/apps/api/src/database/database.constants.ts
@@ -1,5 +1,7 @@
 import { Inject } from "@nestjs/common";
 
 export const DATABASE = Symbol("DATABASE");
+export const SCOPED_DATABASE = Symbol("SCOPED_DATABASE");
 
 export const InjectDatabase = () => Inject(DATABASE);
+export const InjectScopedDatabase = () => Inject(SCOPED_DATABASE);
diff --git a/apps/api/src/database/database.module.ts b/apps/api/src/database/database.module.ts
index 5c0fa1317..8ba7ccaf4 100644
--- a/apps/api/src/database/database.module.ts
+++ b/apps/api/src/database/database.module.ts
@@ -1,4 +1,5 @@
 import { type Db, db } from "@crm/db";
+import { scopedDb } from "@crm/db/tenant-scope";
 import {
 	Global,
 	Logger,
@@ -6,12 +7,19 @@ import {
 	type OnApplicationShutdown,
 	type OnModuleInit,
 } from "@nestjs/common";
-import { DATABASE, InjectDatabase } from "./database.constants";
+import {
+	DATABASE,
+	InjectDatabase,
+	SCOPED_DATABASE,
+} from "./database.constants";
 
 @Global()
 @Module({
-	providers: [{ provide: DATABASE, useValue: db }],
-	exports: [DATABASE],
+	providers: [
+		{ provide: DATABASE, useValue: db },
+		{ provide: SCOPED_DATABASE, useValue: scopedDb },
+	],
+	exports: [DATABASE, SCOPED_DATABASE],
 })
 export class DatabaseModule implements OnModuleInit, OnApplicationShutdown {
 	private readonly logger = new Logger(DatabaseModule.name);
diff --git a/apps/api/src/deals/deals.contracts.ts b/apps/api/src/deals/deals.contracts.ts
index a80b38b56..3613bc1a2 100644
--- a/apps/api/src/deals/deals.contracts.ts
+++ b/apps/api/src/deals/deals.contracts.ts
@@ -49,6 +49,13 @@ export const dealCreateInput = z.object({
 	amountCents,
 	currency: currencyCode.optional(),
 	expectedCloseDate: z.string().nullable().optional(),
+	leadSource: z.string().trim().nullable().optional(),
+	projectType: z.string().trim().nullable().optional(),
+	addressLine1: z.string().trim().nullable().optional(),
+	addressLine2: z.string().trim().nullable().optional(),
+	city: z.string().trim().nullable().optional(),
+	state: z.string().trim().nullable().optional(),
+	postalCode: z.string().trim().nullable().optional(),
 });
 
 export type DealCreateInput = z.infer<typeof dealCreateInput>;
@@ -61,6 +68,13 @@ const dealUpdateInput = z.object({
 	amountCents,
 	currency: currencyCode.optional(),
 	expectedCloseDate: z.string().nullable().optional(),
+	leadSource: z.string().trim().nullable().optional(),
+	projectType: z.string().trim().nullable().optional(),
+	addressLine1: z.string().trim().nullable().optional(),
+	addressLine2: z.string().trim().nullable().optional(),
+	city: z.string().trim().nullable().optional(),
+	state: z.string().trim().nullable().optional(),
+	postalCode: z.string().trim().nullable().optional(),
 	fields: recordFieldValues.optional(),
 });
 
@@ -200,6 +214,13 @@ const dealListRowOutput = z.object({
 	currency: z.string(),
 	company: dealCompanyOutput,
 	owner: dealOwnerOutput,
+	leadSource: z.string().nullable(),
+	projectType: z.string().nullable(),
+	addressLine1: z.string().nullable(),
+	addressLine2: z.string().nullable(),
+	city: z.string().nullable(),
+	state: z.string().nullable(),
+	postalCode: z.string().nullable(),
 	amountCents: z.number().nullable(),
 	baseAmountCents: z.number().nullable(),
 	expectedCloseDate: z.string().nullable(),
@@ -233,6 +254,13 @@ export const dealDetailOutput = z.object({
 	closedReason: z.string().nullable(),
 	company: dealCompanyDetailOutput,
 	owner: dealOwnerOutput,
+	leadSource: z.string().nullable(),
+	projectType: z.string().nullable(),
+	addressLine1: z.string().nullable(),
+	addressLine2: z.string().nullable(),
+	city: z.string().nullable(),
+	state: z.string().nullable(),
+	postalCode: z.string().nullable(),
 	fields: z.array(recordFieldOutput),
 	amountCents: z.number().nullable(),
 	baseAmountCents: z.number().nullable(),
diff --git a/apps/api/src/deals/deals.service.ts b/apps/api/src/deals/deals.service.ts
index 4a4d01c86..7041a5675 100644
--- a/apps/api/src/deals/deals.service.ts
+++ b/apps/api/src/deals/deals.service.ts
@@ -1,6 +1,5 @@
 import {
 	ActivityType,
-	type Db,
 	type DealStage,
 	type Prisma,
 	Prisma as PrismaNamespace,
@@ -13,6 +12,7 @@ import {
 	OPEN_DEAL_STAGES,
 } from "@crm/db/deal-stage";
 import type { FieldDefinitionWithOptions } from "@crm/db/fields";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import {
 	BadRequestException,
 	Injectable,
@@ -21,6 +21,7 @@ import {
 } from "@nestjs/common";
 import { AgentTriggerService } from "../agent/agent-trigger.service";
 import { ARCHIVE } from "../archive/archive-config";
+import { enqueueProjectAssetPurge } from "../assets/asset-purge";
 import {
 	ActivityStampService,
 	type StampTargets,
@@ -33,7 +34,7 @@ import {
 	toCents,
 } from "../crm/values";
 import { ConversionService } from "../currency/conversion.service";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import { FieldsService } from "../fields/fields.service";
 import {
 	archivedFilter,
@@ -87,6 +88,17 @@ const CONTACT_SELECT = {
 
 const LOSING = new Set<DealStage>(LOSING_DEAL_STAGES);
 
+const DEAL_TEXT_FIELDS = [
+	"leadSource",
+	"projectType",
+	"addressLine1",
+	"addressLine2",
+	"city",
+	"state",
+	"postalCode",
+] as const;
+type DealTextField = (typeof DEAL_TEXT_FIELDS)[number];
+
 const SORTABLE: OrderByColumns<Prisma.DealOrderByWithRelationInput[]> = {
 	name: (dir) => [{ name: dir }],
 	company: (dir) => [{ company: { name: dir } }, { name: "asc" }],
@@ -104,7 +116,7 @@ export class DealsService {
 	private readonly logger = new Logger(DealsService.name);
 
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly agent: AgentTriggerService,
 		private readonly stamp: ActivityStampService,
 		private readonly conversion: ConversionService,
@@ -130,6 +142,13 @@ export class DealsService {
 						id: true,
 						name: true,
 						stage: true,
+						leadSource: true,
+						projectType: true,
+						addressLine1: true,
+						addressLine2: true,
+						city: true,
+						state: true,
+						postalCode: true,
 						amount: true,
 						currency: true,
 						baseAmount: true,
@@ -199,6 +218,13 @@ export class DealsService {
 				name: true,
 				description: true,
 				stage: true,
+				leadSource: true,
+				projectType: true,
+				addressLine1: true,
+				addressLine2: true,
+				city: true,
+				state: true,
+				postalCode: true,
 				stageChangedAt: true,
 				amount: true,
 				currency: true,
@@ -277,6 +303,7 @@ export class DealsService {
 						currency,
 						...fx,
 						expectedCloseDate: parseDate(input.expectedCloseDate),
+						...dealTextInput(input),
 					},
 					select: { id: true, name: true, companyId: true },
 				});
@@ -330,6 +357,10 @@ export class DealsService {
 		if (input.expectedCloseDate !== undefined) {
 			data.expectedCloseDate = parseDate(input.expectedCloseDate);
 		}
+		const dealFields = dealTextInput(input);
+		for (const field of DEAL_TEXT_FIELDS) {
+			if (dealFields[field] !== undefined) data[field] = dealFields[field];
+		}
 
 		if (input.amountCents !== undefined || input.currency !== undefined) {
 			const current = await this.db.deal.findUnique({
@@ -354,7 +385,7 @@ export class DealsService {
 		}
 
 		try {
-			return await this.db.$transaction(async (tx) => {
+			return await scopedTransaction(this.db, async (tx) => {
 				if (input.fields) {
 					await this.fields.applyValues(tx, "DEAL", id, input.fields);
 				}
@@ -414,7 +445,7 @@ export class DealsService {
 		let deleted: { targets: StampTargets; name: string } | null;
 
 		try {
-			deleted = await this.db.$transaction(async (tx) => {
+			deleted = await scopedTransaction(this.db, async (tx) => {
 				const [row] = await tx.$queryRaw<Array<{ archivedAt: Date | null }>>`
 					SELECT "archivedAt" FROM deal WHERE id = ${id} FOR UPDATE
 				`;
@@ -432,6 +463,7 @@ export class DealsService {
 
 				const targets = await this.stamp.targetsOf({ dealId: id }, tx);
 				await tx.agentTask.deleteMany({ where: { dealId: id } });
+				await enqueueProjectAssetPurge(tx, id);
 
 				const deal = await tx.deal.delete({
 					where: { id },
@@ -586,7 +618,7 @@ export class DealsService {
 			throw new NotFoundException(`No deal with id ${dealId}.`);
 		}
 
-		return this.db.contact.findMany({
+		return await this.db.contact.findMany({
 			where: {
 				companyId: deal.companyId,
 				id: { notIn: deal.contacts.map((row) => row.contactId) },
@@ -623,7 +655,11 @@ export class DealsService {
 					contactId: input.contactId,
 				},
 			},
-			create: { dealId: input.dealId, contactId: input.contactId, role },
+			create: {
+				dealId: input.dealId,
+				contactId: input.contactId,
+				role,
+			},
 			update: role === null ? {} : { role },
 		});
 
@@ -881,6 +917,28 @@ function roleOrNull(value: string | null): string | null {
 	return value === null ? null : blankToNull(value);
 }
 
+function textOrNull(
+	value: string | null | undefined,
+): string | null | undefined {
+	return value === undefined
+		? undefined
+		: value === null
+			? null
+			: blankToNull(value);
+}
+
+type DealTextFields = Record<DealTextField, string | null | undefined>;
+
+function dealTextInput(
+	input: Pick<DealCreateInput | DealUpdateInput, DealTextField>,
+): DealTextFields {
+	const out = {} as DealTextFields;
+	for (const field of DEAL_TEXT_FIELDS) {
+		out[field] = textOrNull(input[field]);
+	}
+	return out;
+}
+
 function parseDate(value: string | null | undefined): Date | null {
 	if (value === null || value === undefined || value === "") return null;
 	const date = new Date(value);
diff --git a/apps/api/src/enrichment/enrichment.service.ts b/apps/api/src/enrichment/enrichment.service.ts
index 65dc1af9e..869254244 100644
--- a/apps/api/src/enrichment/enrichment.service.ts
+++ b/apps/api/src/enrichment/enrichment.service.ts
@@ -1,7 +1,8 @@
-import type { Db, Prisma } from "@crm/db";
+import type { Prisma } from "@crm/db";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import { ENRICHMENT_PAGE, pageSize } from "@crm/validation/enrichment-queue";
 import { Injectable } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import {
 	type EnrichmentQueueState,
 	enrichmentDueLabel,
@@ -71,7 +72,7 @@ type QueuedTask = {
 
 @Injectable()
 export class EnrichmentService {
-	constructor(@InjectDatabase() private readonly db: Db) {}
+	constructor(@InjectScopedDatabase() private readonly db: ScopedDb) {}
 
 	async queue(limit: number = ENRICHMENT_PAGE): Promise<EnrichmentQueue> {
 		const take = pageSize(limit);
diff --git a/apps/api/src/fields/fields.router.ts b/apps/api/src/fields/fields.router.ts
index c3d4baac5..d1ce988da 100644
--- a/apps/api/src/fields/fields.router.ts
+++ b/apps/api/src/fields/fields.router.ts
@@ -35,15 +35,6 @@ export class FieldsRouter {
 		return this.fields.list(input.entity, input.includeArchived);
 	}
 
-	@Query({
-		input: fieldByKeyInput,
-		output: serializedFieldOutput,
-		meta: restMeta("GET", "/fields/{entity}/{key}", ["Fields"]),
-	})
-	async byKey(@Input() input: z.infer<typeof fieldByKeyInput>) {
-		return this.fields.byKey(input.entity, input.key);
-	}
-
 	@Query({
 		input: fieldEntityInput,
 		output: fieldFiltersOutput,
@@ -62,6 +53,15 @@ export class FieldsRouter {
 		return this.fields.coverage(id);
 	}
 
+	@Query({
+		input: fieldByKeyInput,
+		output: serializedFieldOutput,
+		meta: restMeta("GET", "/fields/{entity}/{key}", ["Fields"]),
+	})
+	async byKey(@Input() input: z.infer<typeof fieldByKeyInput>) {
+		return this.fields.byKey(input.entity, input.key);
+	}
+
 	@Mutation({
 		input: fieldCreateInput,
 		output: serializedFieldOutput,
diff --git a/apps/api/src/fields/fields.service.ts b/apps/api/src/fields/fields.service.ts
index be1855ff3..a9875f25f 100644
--- a/apps/api/src/fields/fields.service.ts
+++ b/apps/api/src/fields/fields.service.ts
@@ -1,5 +1,4 @@
 import {
-	type Db,
 	type FieldEntity,
 	type Prisma,
 	Prisma as PrismaNamespace,
@@ -18,6 +17,7 @@ import {
 	usesOptions,
 	writeValues,
 } from "@crm/db/fields";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import {
 	BadRequestException,
 	ConflictException,
@@ -25,7 +25,7 @@ import {
 	NotFoundException,
 } from "@nestjs/common";
 import { AgentTriggerService } from "../agent/agent-trigger.service";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import type {
 	FieldCreateInput,
 	FieldReorderInput,
@@ -46,7 +46,7 @@ const RELATIONS = {
 @Injectable()
 export class FieldsService {
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly agent: AgentTriggerService,
 	) {}
 
@@ -64,8 +64,8 @@ export class FieldsService {
 	}
 
 	async byKey(entity: FieldEntity, key: string): Promise<SerializedField> {
-		const definition = await this.db.fieldDefinition.findUnique({
-			where: { entity_key: { entity, key } },
+		const definition = await this.db.fieldDefinition.findFirst({
+			where: { entity, key },
 			include: WITH_OPTIONS,
 		});
 
@@ -81,8 +81,8 @@ export class FieldsService {
 			throw new BadRequestException("That label does not make a usable key.");
 		}
 
-		const taken = await this.db.fieldDefinition.findUnique({
-			where: { entity_key: { entity: input.entity, key } },
+		const taken = await this.db.fieldDefinition.findFirst({
+			where: { entity: input.entity, key },
 			select: { id: true },
 		});
 
@@ -172,7 +172,7 @@ export class FieldsService {
 			throw new BadRequestException("A select needs at least one option.");
 		}
 
-		const definition = await this.db.$transaction(async (tx) => {
+		const definition = await scopedTransaction(this.db, async (tx) => {
 			if (data.options && usesOptions(type)) {
 				const keep = new Set(
 					data.options
@@ -195,7 +195,11 @@ export class FieldsService {
 					}
 
 					await tx.fieldOption.create({
-						data: { fieldId: id, label: option.label, position: index },
+						data: {
+							fieldId: id,
+							label: option.label,
+							position: index,
+						},
 					});
 				}
 			}
@@ -251,14 +255,16 @@ export class FieldsService {
 			);
 		}
 
-		await this.db.$transaction(
-			input.ids.map((id, index) =>
-				this.db.fieldDefinition.update({
-					where: { id },
-					data: { position: index },
-				}),
-			),
-		);
+		await scopedTransaction(this.db, async (tx) => {
+			await Promise.all(
+				input.ids.map((id, index) =>
+					tx.fieldDefinition.update({
+						where: { id },
+						data: { position: index },
+					}),
+				),
+			);
+		});
 
 		return this.list(input.entity, false);
 	}
diff --git a/apps/api/src/generated/server.ts b/apps/api/src/generated/server.ts
index b77da4001..5c4c8156f 100644
--- a/apps/api/src/generated/server.ts
+++ b/apps/api/src/generated/server.ts
@@ -16,14 +16,18 @@ const publicProcedure = t.procedure;
 import { timelineInput, timelineOutput, timelineCountsInput, timelineCountsOutput, myTasksInput, myTasksOutput, activityCreateInput, activityCreateOutput, completeInput, completeOutput } from "../activities/activities.contracts";
 import { agentListOutput, agentReviseInput, agentReviseOutput, agentIdInput, agentFilesOutput, agentSaveFileInput, agentSaveFileOutput, agentByIdOutput, agentHistoryInput, agentHistoryOutput, agentActivityOutput, agentUpdateInput, agentUpdateOutput, agentDeployInput, agentDeployOutput, agentPauseOutput, agentResumeOutput, agentArchiveOutput, agentRestoreOutput, agentRemoveOutput, agentRunNowInput, agentRunNowOutput, agentRetryRunInput, agentRetryRunOutput, agentCancelRunInput, agentCancelRunOutput } from "../agent/agents.contracts";
 import { apiKeyListInput, apiKeyListOutput, createApiKeyInput, createApiKeyOutput, revokeApiKeyInput, revokeApiKeyOutput } from "../api-keys/api-keys.contracts";
-import { companyListInput, companyListOutput, companyIdInput, companyDetailOutput, companyOptionsInput, companyOptionOutput, companyCreateInput, companySummaryOutput, companyUpdateArgs, companyArchiveResultOutput, companyBulkOwnerInput, companyBulkResultOutput, companyBulkInput, companyEnrichOutput, companyResearchOutput, setPrimaryContactInput, companySetPrimaryContactOutput } from "../companies/companies.contracts";
+import { projectAppointmentCreateInput, appointmentDetailSchema, projectAppointmentListInput, appointmentListSchema, projectAppointmentInput, projectAppointmentUpdateInput, appointmentArchiveSchema } from "../appointments/appointments.contracts";
+import { recordingUploadUrlInput, recordingUploadSlotSchema, recordingCompleteInput, recordingCompleteSchema } from "../appointments/recording-upload.contracts";
+import { projectAssetCreateInput, assetCreationSchema, appointmentAssetCreateInput, projectAssetListInput, assetListSchema, appointmentAssetListInput, assetMemberInput, assetDetailSchema, assetDeletionSchema } from "../assets/assets.contracts";
+import { assetUpdateInput } from "../assets/asset-metadata.contracts";
+import { companyListInput, companyListOutput, companyOptionsInput, companyOptionOutput, companyIdInput, companyDetailOutput, companyCreateInput, companySummaryOutput, companyUpdateArgs, companyArchiveResultOutput, companyBulkOwnerInput, companyBulkResultOutput, companyBulkInput, companyEnrichOutput, companyResearchOutput, setPrimaryContactInput, companySetPrimaryContactOutput } from "../companies/companies.contracts";
 import { contactListInput, contactListOutput, contactIdInput, contactByIdOutput, contactCreateInput, contactBasicOutput, contactUpdateArgs, contactNameOutput, contactEnrichOutput, contactBulkOwnerInput, bulkResultOutput, contactBulkCompanyInput, contactBulkInput, factDecisionInput, decideFactOutput } from "../contacts/contacts.contracts";
 import { conversationListInput, conversationListOutput, builderListOutput, builderResourceSearchInput, builderResourcesOutput, conversationIdInput, builderConversationDetailOutput, conversationEventsInput, conversationEventsOutput, conversationSaveInput, conversationIdOutput, builderConversationCreateInput, builderConversationSubmitInput, builderQuestionResponseInput, builderResponseRatingInput, builderResponseRatingOutput, conversationShareStatusOutput, conversationShareTokenOutput, sharedConversationInput, sharedConversationOutput } from "../conversations/conversations.contracts";
 import { currencySettingsOutput, setReportingCurrencyInput, setManualRateInput, removeManualRateInput } from "../currency/currency.contracts";
 import { dashboardSummaryInput, dashboardSummaryOutput } from "../dashboard/dashboard.contracts";
 import { dealListInput, dealListOutput, dealIdInput, dealDetailOutput, dealCreateInput, dealCreateOutput, dealUpdateArgs, dealMutateOutput, setStageInput, dealSetStageOutput, dealContactsInput, dealContactOptionsOutput, dealAttachContactInput, dealContactLinkOutput, dealDetachContactInput, dealContactRoleInput, dealContactRoleOutput, dealBulkOwnerInput, dealBulkResultOutput, dealBulkStageInput, dealBulkInput } from "../deals/deals.contracts";
 import { enrichmentQueueInput } from "@crm/validation/enrichment-queue";
-import { fieldListInput, fieldListOutput, fieldByKeyInput, serializedFieldOutput, fieldEntityInput, fieldFiltersOutput, fieldIdInput, fieldCoverageOutput, fieldCreateInput, fieldUpdateArgs, fieldReorderInput, fieldReorderOutput, fieldDeleteOutput, fieldBackfillOutput } from "../fields/fields.contracts";
+import { fieldListInput, fieldListOutput, fieldEntityInput, fieldFiltersOutput, fieldIdInput, fieldCoverageOutput, fieldByKeyInput, serializedFieldOutput, fieldCreateInput, fieldUpdateArgs, fieldReorderInput, fieldReorderOutput, fieldDeleteOutput, fieldBackfillOutput } from "../fields/fields.contracts";
 import { googleConnectionStatusOutput, setAutoCreateInput, suppressDomainInput, suppressDomainOutput, threadInput, emailThreadOutput, calendarEventInput, calendarEventOutput } from "../google/google.contracts";
 import { purgeSyncedDataOutput, revokeAccessOutput, microsoftConnectionStatusOutput, setOutlookAutoCreateInput } from "../microsoft/microsoft.contracts";
 import { savedViewListInput, savedViewListOutput, savedViewCreateInput, savedViewOutput, savedViewUpdateArgs, savedViewIdInput, savedViewDeleteOutput } from "../saved-views/saved-views.contracts";
@@ -32,6 +36,7 @@ import { slackStatusOutput, slackMatchesOutput, slackChannelsInput, slackChannel
 import { ssoSignInOptionsOutput, ssoSettingsOutput, ssoProviderListInput, ssoProviderListOutput, registerSsoProviderInput, ssoProviderOutput, deleteSsoProviderInput, deleteSsoProviderOutput } from "../sso/sso.contracts";
 import { trackingSettingsOutput, trackingFlagInput, cookieLifetimeInput, addDomainInput, trackedDomainOutput, removeDomainInput, rotateSiteIdOutput, verifyInput, verifyOutput, sourcesOutput, companyActivityInput, websiteActivityOutput, contactActivityInput } from "../tracking/tracking.contracts";
 import { workspaceOutput, memberListInput, memberListOutput, updateWorkspaceInput, setMemberRoleInput, workspaceMemberOutput } from "../workspace/workspace.contracts";
+import { workspaceGate } from "@crm/validation/workspace-gate";
 import type { UsersRouter } from "../users/users.router";
 
 const appRouter = t.router({
@@ -140,19 +145,79 @@ const appRouter = t.router({
       .output(revokeApiKeyOutput)
       .mutation(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any)
     }),
+  appointments: t.router({
+    createAppointment: publicProcedure
+      .input(projectAppointmentCreateInput)
+      .output(appointmentDetailSchema)
+      .mutation(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
+    listAppointments: publicProcedure
+      .input(projectAppointmentListInput)
+      .output(appointmentListSchema)
+      .query(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
+    getAppointment: publicProcedure
+      .input(projectAppointmentInput)
+      .output(appointmentDetailSchema)
+      .query(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
+    updateAppointment: publicProcedure
+      .input(projectAppointmentUpdateInput)
+      .output(appointmentDetailSchema)
+      .mutation(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
+    archiveAppointment: publicProcedure
+      .input(projectAppointmentInput)
+      .output(appointmentArchiveSchema)
+      .mutation(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
+    requestRecordingUploadUrl: publicProcedure
+      .input(recordingUploadUrlInput)
+      .output(recordingUploadSlotSchema)
+      .mutation(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
+    completeRecordingUpload: publicProcedure
+      .input(recordingCompleteInput)
+      .output(recordingCompleteSchema)
+      .mutation(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any)
+    }),
+  assets: t.router({
+    createProjectAsset: publicProcedure
+      .input(projectAssetCreateInput)
+      .output(assetCreationSchema)
+      .mutation(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
+    createAppointmentAsset: publicProcedure
+      .input(appointmentAssetCreateInput)
+      .output(assetCreationSchema)
+      .mutation(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
+    listProjectAssets: publicProcedure
+      .input(projectAssetListInput)
+      .output(assetListSchema)
+      .query(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
+    listAppointmentAssets: publicProcedure
+      .input(appointmentAssetListInput)
+      .output(assetListSchema)
+      .query(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
+    getAsset: publicProcedure
+      .input(assetMemberInput)
+      .output(assetDetailSchema)
+      .query(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
+    updateAsset: publicProcedure
+      .input(assetUpdateInput)
+      .output(assetDetailSchema)
+      .mutation(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
+    deleteAsset: publicProcedure
+      .input(assetMemberInput)
+      .output(assetDeletionSchema)
+      .mutation(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any)
+    }),
   companies: t.router({
     list: publicProcedure
       .input(companyListInput)
       .output(companyListOutput)
       .query(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
-    byId: publicProcedure
-      .input(companyIdInput)
-      .output(companyDetailOutput)
-      .query(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
     options: publicProcedure
       .input(companyOptionsInput)
       .output(companyOptionOutput)
       .query(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
+    byId: publicProcedure
+      .input(companyIdInput)
+      .output(companyDetailOutput)
+      .query(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
     create: publicProcedure
       .input(companyCreateInput)
       .output(companySummaryOutput)
@@ -487,10 +552,6 @@ const appRouter = t.router({
       .input(fieldListInput)
       .output(fieldListOutput)
       .query(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
-    byKey: publicProcedure
-      .input(fieldByKeyInput)
-      .output(serializedFieldOutput)
-      .query(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
     filters: publicProcedure
       .input(fieldEntityInput)
       .output(fieldFiltersOutput)
@@ -499,6 +560,10 @@ const appRouter = t.router({
       .input(fieldIdInput)
       .output(fieldCoverageOutput)
       .query(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
+    byKey: publicProcedure
+      .input(fieldByKeyInput)
+      .output(serializedFieldOutput)
+      .query(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
     create: publicProcedure
       .input(fieldCreateInput)
       .output(serializedFieldOutput)
@@ -738,6 +803,9 @@ const appRouter = t.router({
     get: publicProcedure
       .output(workspaceOutput)
       .query(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
+    gate: publicProcedure
+      .output(workspaceGate)
+      .query(async () => "PLACEHOLDER_DO_NOT_REMOVE" as any),
     members: publicProcedure
       .input(memberListInput)
       .output(memberListOutput)
diff --git a/apps/api/src/google/calendar-sync.service.ts b/apps/api/src/google/calendar-sync.service.ts
index d219b3e9e..4241bfdab 100644
--- a/apps/api/src/google/calendar-sync.service.ts
+++ b/apps/api/src/google/calendar-sync.service.ts
@@ -1,14 +1,14 @@
 import {
 	ActivityType,
-	type Db,
 	GoogleSyncStatus,
 	type MailboxSyncModel as MailboxSync,
 	RecordSource,
 } from "@crm/db";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import { Injectable, Logger } from "@nestjs/common";
 import { AgentTriggerService } from "../agent/agent-trigger.service";
 import { ActivityStampService } from "../crm/activity-stamp.service";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import {
 	MailboxMatchService,
 	type MatchContext,
@@ -41,7 +41,7 @@ export class CalendarSyncService {
 	private readonly logger = new Logger(CalendarSyncService.name);
 
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly calendar: CalendarClient,
 		private readonly tokens: MailboxTokenService,
 		private readonly match: MailboxMatchService,
diff --git a/apps/api/src/google/conversation.service.ts b/apps/api/src/google/conversation.service.ts
index 232b84f58..d70695a6f 100644
--- a/apps/api/src/google/conversation.service.ts
+++ b/apps/api/src/google/conversation.service.ts
@@ -1,7 +1,11 @@
 import type { Db, Prisma } from "@crm/db";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import { Injectable, NotFoundException } from "@nestjs/common";
 import { z } from "zod";
-import { InjectDatabase } from "../database/database.constants";
+import {
+	InjectDatabase,
+	InjectScopedDatabase,
+} from "../database/database.constants";
 
 const storedRecipient = z.object({
 	email: z.string(),
@@ -15,10 +19,13 @@ const storedRecipients = z.array(z.json()).catch([]);
 
 @Injectable()
 export class ConversationService {
-	constructor(@InjectDatabase() private readonly db: Db) {}
+	constructor(
+		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly scoped: ScopedDb,
+	) {}
 
 	async thread(threadId: string) {
-		const thread = await this.db.emailThread.findUnique({
+		const thread = await this.scoped.emailThread.findUnique({
 			where: { id: threadId },
 			select: {
 				id: true,
@@ -83,7 +90,7 @@ export class ConversationService {
 		if (emails.length === 0) return new Map();
 
 		const [contacts, users] = await Promise.all([
-			this.db.contact.findMany({
+			this.scoped.contact.findMany({
 				where: { email: { in: emails, mode: "insensitive" } },
 				select: { email: true, imageUrl: true },
 			}),
@@ -107,7 +114,7 @@ export class ConversationService {
 	}
 
 	async event(eventId: string) {
-		const event = await this.db.calendarEvent.findUnique({
+		const event = await this.scoped.calendarEvent.findUnique({
 			where: { id: eventId },
 			select: {
 				id: true,
diff --git a/apps/api/src/google/gmail-sync.service.ts b/apps/api/src/google/gmail-sync.service.ts
index a693261bd..79d68f08a 100644
--- a/apps/api/src/google/gmail-sync.service.ts
+++ b/apps/api/src/google/gmail-sync.service.ts
@@ -1,10 +1,10 @@
 import {
-	type Db,
 	GoogleSyncStatus,
 	type MailboxSyncModel as MailboxSync,
 } from "@crm/db";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import { Injectable, Logger } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import type { MatchContext } from "../mailbox/mailbox-match.service";
 import { MailboxTokenService } from "../mailbox/mailbox-token.service";
 import {
@@ -41,7 +41,7 @@ export class GmailSyncService {
 	private readonly logger = new Logger(GmailSyncService.name);
 
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly gmail: GmailClient,
 		private readonly tokens: MailboxTokenService,
 		private readonly state: SyncStateService,
diff --git a/apps/api/src/google/google-connection.service.ts b/apps/api/src/google/google-connection.service.ts
index 7c583b8e1..e9bb139a7 100644
--- a/apps/api/src/google/google-connection.service.ts
+++ b/apps/api/src/google/google-connection.service.ts
@@ -1,9 +1,14 @@
 import { isGoogleConfigured, signsInWithGoogle } from "@crm/auth";
 import type { Db, Prisma } from "@crm/db";
+import { currentOrganizationId, runInTenant } from "@crm/db/tenant-context";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import { Injectable, Logger, NotFoundException } from "@nestjs/common";
 import { normalizeDomain } from "../companies/domain";
 import { ActivityStampService } from "../crm/activity-stamp.service";
-import { InjectDatabase } from "../database/database.constants";
+import {
+	InjectDatabase,
+	InjectScopedDatabase,
+} from "../database/database.constants";
 import { MailboxMatchService } from "../mailbox/mailbox-match.service";
 import { MailboxTokenService } from "../mailbox/mailbox-token.service";
 import { SyncStateService } from "../mailbox/sync-state.service";
@@ -29,6 +34,7 @@ export class GoogleConnectionService {
 
 	constructor(
 		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly scoped: ScopedDb,
 		private readonly tokens: MailboxTokenService,
 		private readonly state: SyncStateService,
 		private readonly match: MailboxMatchService,
@@ -106,11 +112,18 @@ export class GoogleConnectionService {
 					scope: { contains: SCOPE_FOR_SOURCE[source] },
 				})),
 			},
-			select: { userId: true },
+			select: {
+				userId: true,
+				user: { select: { members: { select: { organizationId: true } } } },
+			},
 		});
 
-		for (const account of new Set(accounts.map((row) => row.userId))) {
-			await this.onConnected(account);
+		for (const account of accounts) {
+			for (const member of account.user.members) {
+				await runInTenant(member.organizationId, () =>
+					this.onConnected(account.userId),
+				);
+			}
 		}
 	}
 
@@ -120,7 +133,8 @@ export class GoogleConnectionService {
 			gmailMessageId: { not: null },
 		};
 
-		const purged = await this.db.$transaction(
+		const purged = await scopedTransaction(
+			this.scoped,
 			async (tx) => {
 				const touched = await tx.emailMessage.findMany({
 					where: mine,
@@ -191,25 +205,37 @@ export class GoogleConnectionService {
 			);
 		}
 
-		await this.db.suppressedDomain.upsert({
-			where: { domain: normalised },
-			create: { domain: normalised, reason: options.reason ?? null },
+		await this.scoped.suppressedDomain.upsert({
+			where: {
+				organizationId_domain: {
+					organizationId: currentOrganizationId(),
+					domain: normalised,
+				},
+			},
+			create: {
+				domain: normalised,
+				reason: options.reason ?? null,
+			},
 			update: { reason: options.reason ?? null },
 		});
 
 		if (!options.purge) return { domain: normalised, purged: 0 };
 
-		const company = await this.db.company.findUnique({
+		const company = await this.scoped.company.findFirst({
 			where: { domain: normalised },
 			select: { id: true },
 		});
 
 		if (!company) return { domain: normalised, purged: 0 };
 
-		const [threads, events] = await this.db.$transaction([
-			this.db.emailThread.deleteMany({ where: { companyId: company.id } }),
-			this.db.calendarEvent.deleteMany({ where: { companyId: company.id } }),
-		]);
+		const [threads, events] = await scopedTransaction(this.scoped, (tx) =>
+			Promise.all([
+				tx.emailThread.deleteMany({ where: { companyId: company.id } }),
+				tx.calendarEvent.deleteMany({
+					where: { companyId: company.id },
+				}),
+			]),
+		);
 
 		await this.stamp.recomputeAll();
 
diff --git a/apps/api/src/logging/request-logger.middleware.ts b/apps/api/src/logging/request-logger.middleware.ts
index 699549fec..5d8483f66 100644
--- a/apps/api/src/logging/request-logger.middleware.ts
+++ b/apps/api/src/logging/request-logger.middleware.ts
@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { runSsoRequestInTenant } from "@crm/auth";
 import { Injectable, Logger, type NestMiddleware } from "@nestjs/common";
 import type { NextFunction, Request, Response } from "express";
 import { type RequestContext, runInRequestContext } from "./request-context";
@@ -93,8 +94,15 @@ export function logAuthRoute(
 	request: Request,
 	response: Response,
 	next: NextFunction,
-): void {
-	sharedInstance.use(request, response, next);
+): Promise<void> {
+	return new Promise((resolve, reject) => {
+		sharedInstance.use(request, response, () => {
+			Promise.resolve(runSsoRequestInTenant(request, () => next())).then(
+				() => resolve(),
+				reject,
+			);
+		});
+	});
 }
 
 function sessionUserId(request: Request): string | undefined {
diff --git a/apps/api/src/mailbox/mailbox-match.service.ts b/apps/api/src/mailbox/mailbox-match.service.ts
index 436e6b5fd..3862819f6 100644
--- a/apps/api/src/mailbox/mailbox-match.service.ts
+++ b/apps/api/src/mailbox/mailbox-match.service.ts
@@ -1,11 +1,15 @@
 import { workspaceDomains } from "@crm/auth/workspace";
 import { type Db, RecordSource } from "@crm/db";
 import { lockIdempotencyKey } from "@crm/db/idempotency";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import { Injectable, Logger } from "@nestjs/common";
 import { AgentTriggerService } from "../agent/agent-trigger.service";
 import { CompanyDirectoryService } from "../companies/company-directory.service";
 import { EnrichmentLogService } from "../crm/enrichment-log.service";
-import { InjectDatabase } from "../database/database.constants";
+import {
+	InjectDatabase,
+	InjectScopedDatabase,
+} from "../database/database.constants";
 import {
 	dominantDomain,
 	externalParticipants,
@@ -45,6 +49,7 @@ export class MailboxMatchService {
 
 	constructor(
 		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly scoped: ScopedDb,
 		private readonly companies: CompanyDirectoryService,
 		private readonly agent: AgentTriggerService,
 		private readonly log: EnrichmentLogService,
@@ -71,14 +76,14 @@ export class MailboxMatchService {
 	}
 
 	async suppressedDomains(): Promise<Set<string>> {
-		const rows = await this.db.suppressedDomain.findMany({
+		const rows = await this.scoped.suppressedDomain.findMany({
 			select: { domain: true },
 		});
 		return new Set(rows.map((row) => row.domain));
 	}
 
 	async suppressedEmails(): Promise<Set<string>> {
-		const rows = await this.db.suppressedContact.findMany({
+		const rows = await this.scoped.suppressedContact.findMany({
 			select: { email: true },
 		});
 		return new Set(rows.map((row) => row.email.toLowerCase()));
@@ -99,7 +104,7 @@ export class MailboxMatchService {
 			return { companyId: null, contactId: null, external };
 		}
 
-		const contact = await this.db.contact.findFirst({
+		const contact = await this.scoped.contact.findFirst({
 			where: { email: { in: external.map((person) => person.email) } },
 			select: { id: true, companyId: true },
 		});
@@ -120,7 +125,7 @@ export class MailboxMatchService {
 			),
 		];
 
-		const known = await this.db.company.findMany({
+		const known = await this.scoped.company.findMany({
 			where: { domain: { in: domains } },
 			select: { id: true, domain: true },
 		});
@@ -170,7 +175,7 @@ export class MailboxMatchService {
 			return { companyId: null, contactId: null, external };
 		}
 
-		await this.db.company.update({
+		await this.scoped.company.update({
 			where: { id: companyId },
 			data: { source: request.source },
 		});
@@ -216,7 +221,7 @@ export class MailboxMatchService {
 
 		const outcome = await this.agent.withCrmEvents(async (tx, emit) => {
 			await lockIdempotencyKey(tx, `mailbox-contact:${person.email}`);
-			const existing = await tx.contact.findUnique({
+			const existing = await tx.contact.findFirst({
 				where: { email: person.email },
 				select: {
 					id: true,
@@ -281,7 +286,7 @@ export class MailboxMatchService {
 		);
 
 		if (hasRealName && isPlaceholder) {
-			await this.db.contact.update({
+			await this.scoped.contact.update({
 				where: { id: contact.id },
 				data: { firstName, lastName },
 			});
diff --git a/apps/api/src/mailbox/mailbox-token.service.ts b/apps/api/src/mailbox/mailbox-token.service.ts
index bc5df6ece..245461b86 100644
--- a/apps/api/src/mailbox/mailbox-token.service.ts
+++ b/apps/api/src/mailbox/mailbox-token.service.ts
@@ -32,22 +32,14 @@ export class MailboxTokenService {
 		userId: string,
 		providerId: MailboxProviderId,
 	): Promise<Set<string>> {
-		const account = await this.db.account.findFirst({
-			where: { userId, providerId },
+		const account = await this.db.account.findUnique({
+			where: { userId_providerId: { userId, providerId } },
 			select: { scope: true },
 		});
 
 		return parseScopes(account?.scope);
 	}
 
-	async isConnected(userId: string, source: SyncSource): Promise<boolean> {
-		const scopes = await this.grantedScopes(
-			userId,
-			PROVIDER_FOR_SOURCE[source],
-		);
-		return scopes.has(SCOPE_FOR_SOURCE[source]);
-	}
-
 	async signInAccounts(userId: string): Promise<SignInAccount[]> {
 		return this.db.account.findMany({
 			where: { userId },
@@ -59,8 +51,8 @@ export class MailboxTokenService {
 		userId: string,
 		providerId: MailboxProviderId,
 	): Promise<boolean> {
-		const account = await this.db.account.findFirst({
-			where: { userId, providerId },
+		const account = await this.db.account.findUnique({
+			where: { userId_providerId: { userId, providerId } },
 			select: { refreshToken: true },
 		});
 
@@ -72,8 +64,17 @@ export class MailboxTokenService {
 		source: SyncSource,
 	): Promise<TokenResult> {
 		const providerId = PROVIDER_FOR_SOURCE[source];
-
-		if (!(await this.isConnected(userId, source))) {
+		const account = await this.db.account.findUnique({
+			where: { userId_providerId: { userId, providerId } },
+			select: { id: true, scope: true },
+		});
+		if (!account) {
+			return {
+				outcome: "needs-reconnect",
+				reason: `${label(providerId)} has no connected account.`,
+			};
+		}
+		if (!parseScopes(account.scope).has(SCOPE_FOR_SOURCE[source])) {
 			return {
 				outcome: "not-connected",
 				reason: `The ${source} scope has not been granted.`,
@@ -82,7 +83,7 @@ export class MailboxTokenService {
 
 		try {
 			const { accessToken } = await auth.api.getAccessToken({
-				body: { providerId, userId },
+				body: { accountId: account.id, userId },
 			});
 
 			if (!accessToken) {
@@ -138,8 +139,10 @@ export class MailboxTokenService {
 	}
 
 	private async revokeWithGoogle(userId: string): Promise<boolean> {
-		const account = await this.db.account.findFirst({
-			where: { userId, providerId: GOOGLE_PROVIDER_ID },
+		const account = await this.db.account.findUnique({
+			where: {
+				userId_providerId: { userId, providerId: GOOGLE_PROVIDER_ID },
+			},
 			select: { refreshToken: true, accessToken: true },
 		});
 
diff --git a/apps/api/src/mailbox/sync-state.service.ts b/apps/api/src/mailbox/sync-state.service.ts
index ca56462b4..062a80c32 100644
--- a/apps/api/src/mailbox/sync-state.service.ts
+++ b/apps/api/src/mailbox/sync-state.service.ts
@@ -1,11 +1,12 @@
 import {
-	type Db,
 	GoogleSyncStatus,
 	type MailboxSyncModel as MailboxSync,
 	type Prisma,
 } from "@crm/db";
+import { currentOrganizationId } from "@crm/db/tenant-context";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import { Injectable, Logger } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import type { SyncSource } from "./mailbox.constants";
 
 export const SYNC_LEASE_MS = 300_000;
@@ -14,11 +15,17 @@ export const SYNC_LEASE_MS = 300_000;
 export class SyncStateService {
 	private readonly logger = new Logger(SyncStateService.name);
 
-	constructor(@InjectDatabase() private readonly db: Db) {}
+	constructor(@InjectScopedDatabase() private readonly db: ScopedDb) {}
 
 	async get(userId: string, source: SyncSource): Promise<MailboxSync | null> {
 		return this.db.mailboxSync.findUnique({
-			where: { userId_source: { userId, source } },
+			where: {
+				organizationId_userId_source: {
+					organizationId: currentOrganizationId(),
+					userId,
+					source,
+				},
+			},
 		});
 	}
 
@@ -64,7 +71,13 @@ export class SyncStateService {
 		options: { autoCreate: boolean },
 	): Promise<MailboxSync> {
 		return this.db.mailboxSync.upsert({
-			where: { userId_source: { userId, source } },
+			where: {
+				organizationId_userId_source: {
+					organizationId: currentOrganizationId(),
+					userId,
+					source,
+				},
+			},
 			create: {
 				userId,
 				source,
diff --git a/apps/api/src/mailbox/thread-writer.service.ts b/apps/api/src/mailbox/thread-writer.service.ts
index 9b06692c6..af770a203 100644
--- a/apps/api/src/mailbox/thread-writer.service.ts
+++ b/apps/api/src/mailbox/thread-writer.service.ts
@@ -1,15 +1,15 @@
 import {
 	ActivityType,
-	type Db,
 	EmailDirection,
 	type MailboxSyncModel as MailboxSync,
 	type Prisma,
 	Prisma as PrismaNamespace,
 	RecordSource,
 } from "@crm/db";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import { Injectable, Logger } from "@nestjs/common";
 import { ActivityStampService } from "../crm/activity-stamp.service";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import type { SyncSource } from "./mailbox.constants";
 import {
 	MailboxMatchService,
@@ -36,7 +36,7 @@ export class ThreadWriterService {
 	private readonly logger = new Logger(ThreadWriterService.name);
 
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly match: MailboxMatchService,
 		private readonly stamp: ActivityStampService,
 	) {}
@@ -121,7 +121,7 @@ export class ThreadWriterService {
 		let occurredAt: Date;
 
 		try {
-			occurredAt = await this.db.$transaction(async (tx) => {
+			occurredAt = await scopedTransaction(this.db, async (tx) => {
 				const record = existing
 					? { id: existing.threadId }
 					: await tx.emailThread.upsert({
diff --git a/apps/api/src/microsoft/microsoft-connection.service.ts b/apps/api/src/microsoft/microsoft-connection.service.ts
index 73b1c6e25..f4f12107a 100644
--- a/apps/api/src/microsoft/microsoft-connection.service.ts
+++ b/apps/api/src/microsoft/microsoft-connection.service.ts
@@ -1,8 +1,13 @@
 import { isMicrosoftConfigured, signsInWithMicrosoft } from "@crm/auth";
 import type { Db, Prisma } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import { Injectable, Logger, NotFoundException } from "@nestjs/common";
 import { ActivityStampService } from "../crm/activity-stamp.service";
-import { InjectDatabase } from "../database/database.constants";
+import {
+	InjectDatabase,
+	InjectScopedDatabase,
+} from "../database/database.constants";
 import { MailboxTokenService } from "../mailbox/mailbox-token.service";
 import { SyncStateService } from "../mailbox/sync-state.service";
 import {
@@ -26,6 +31,7 @@ export class MicrosoftConnectionService {
 
 	constructor(
 		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly scoped: ScopedDb,
 		private readonly tokens: MailboxTokenService,
 		private readonly state: SyncStateService,
 		private readonly stamp: ActivityStampService,
@@ -106,11 +112,18 @@ export class MicrosoftConnectionService {
 					scope: { contains: SCOPE_FOR_SOURCE[source] },
 				})),
 			},
-			select: { userId: true },
+			select: {
+				userId: true,
+				user: { select: { members: { select: { organizationId: true } } } },
+			},
 		});
 
-		for (const userId of new Set(accounts.map((row) => row.userId))) {
-			await this.onConnected(userId);
+		for (const account of accounts) {
+			for (const member of account.user.members) {
+				await runInTenant(member.organizationId, () =>
+					this.onConnected(account.userId),
+				);
+			}
 		}
 	}
 
@@ -120,7 +133,8 @@ export class MicrosoftConnectionService {
 			outlookMessageId: { not: null },
 		};
 
-		const purged = await this.db.$transaction(
+		const purged = await scopedTransaction(
+			this.scoped,
 			async (tx) => {
 				const touched = await tx.emailMessage.findMany({
 					where: mine,
diff --git a/apps/api/src/push-tokens/push-tokens.contracts.ts b/apps/api/src/push-tokens/push-tokens.contracts.ts
new file mode 100644
index 000000000..ed1cb247f
--- /dev/null
+++ b/apps/api/src/push-tokens/push-tokens.contracts.ts
@@ -0,0 +1,10 @@
+import { z } from "zod";
+
+export const pushPlatformSchema = z.enum(["ios", "android"]);
+
+export const registerPushTokenInput = z.object({
+	token: z.string().trim().min(1),
+	platform: pushPlatformSchema,
+});
+
+export type RegisterPushTokenInput = z.infer<typeof registerPushTokenInput>;
diff --git a/apps/api/src/push-tokens/push-tokens.controller.ts b/apps/api/src/push-tokens/push-tokens.controller.ts
new file mode 100644
index 000000000..2e8bf14e7
--- /dev/null
+++ b/apps/api/src/push-tokens/push-tokens.controller.ts
@@ -0,0 +1,44 @@
+import { SESSION_COOKIE_NAME } from "@crm/auth";
+import { Body, Controller, Delete, Post, Query } from "@nestjs/common";
+import {
+	ApiBearerAuth,
+	ApiCookieAuth,
+	ApiOkResponse,
+	ApiOperation,
+	ApiSecurity,
+	ApiTags,
+	ApiUnauthorizedResponse,
+} from "@nestjs/swagger";
+import type { RequestPrincipal } from "../auth/request-principal";
+import { Principal } from "../auth/request-principal.decorator";
+import { PushTokensService } from "./push-tokens.service";
+
+@ApiTags("Push tokens")
+@ApiCookieAuth(SESSION_COOKIE_NAME)
+@ApiSecurity("apiKey")
+@ApiBearerAuth("oauth")
+@Controller("push-tokens")
+export class PushTokensController {
+	constructor(private readonly pushTokens: PushTokensService) {}
+
+	@Post()
+	@ApiOperation({ summary: "Register this device's FCM token" })
+	@ApiOkResponse({ description: "The token was stored." })
+	@ApiUnauthorizedResponse({ description: "No valid session." })
+	register(@Principal() principal: RequestPrincipal, @Body() body: unknown) {
+		return this.pushTokens.register(principal.user.id, body);
+	}
+
+	@Delete()
+	@ApiOperation({ summary: "Remove this device's FCM token" })
+	@ApiOkResponse({
+		description: "The token was removed if it belonged to the caller.",
+	})
+	@ApiUnauthorizedResponse({ description: "No valid session." })
+	unregister(
+		@Principal() principal: RequestPrincipal,
+		@Query("token") token: string,
+	) {
+		return this.pushTokens.unregister(principal.user.id, token);
+	}
+}
diff --git a/apps/api/src/push-tokens/push-tokens.module.ts b/apps/api/src/push-tokens/push-tokens.module.ts
new file mode 100644
index 000000000..9f3d0aada
--- /dev/null
+++ b/apps/api/src/push-tokens/push-tokens.module.ts
@@ -0,0 +1,9 @@
+import { Module } from "@nestjs/common";
+import { PushTokensController } from "./push-tokens.controller";
+import { PushTokensService } from "./push-tokens.service";
+
+@Module({
+	controllers: [PushTokensController],
+	providers: [PushTokensService],
+})
+export class PushTokensModule {}
diff --git a/apps/api/src/push-tokens/push-tokens.service.ts b/apps/api/src/push-tokens/push-tokens.service.ts
new file mode 100644
index 000000000..664d5f6ef
--- /dev/null
+++ b/apps/api/src/push-tokens/push-tokens.service.ts
@@ -0,0 +1,54 @@
+import type { Db } from "@crm/db";
+import { BadRequestException, Injectable } from "@nestjs/common";
+import { InjectDatabase } from "../database/database.constants";
+import {
+	type RegisterPushTokenInput,
+	registerPushTokenInput,
+} from "./push-tokens.contracts";
+
+@Injectable()
+export class PushTokensService {
+	constructor(@InjectDatabase() private readonly db: Db) {}
+
+	async register(userId: string, body: unknown): Promise<{ ok: true }> {
+		const input = this.parse(body);
+		await this.db.pushToken.upsert({
+			where: { token: input.token },
+			create: {
+				userId,
+				token: input.token,
+				platform: input.platform,
+			},
+			update: {
+				userId,
+				platform: input.platform,
+			},
+		});
+		return { ok: true };
+	}
+
+	async unregister(
+		userId: string,
+		token: string | undefined,
+	): Promise<{ ok: true }> {
+		const value = token?.trim() ?? "";
+		if (!value) {
+			throw new BadRequestException("token is required");
+		}
+
+		await this.db.pushToken.deleteMany({
+			where: { token: value, userId },
+		});
+		return { ok: true };
+	}
+
+	private parse(body: unknown): RegisterPushTokenInput {
+		const parsed = registerPushTokenInput.safeParse(body);
+		if (!parsed.success) {
+			throw new BadRequestException(
+				"token and platform (ios|android) are required",
+			);
+		}
+		return parsed.data;
+	}
+}
diff --git a/apps/api/src/saved-views/saved-views.service.ts b/apps/api/src/saved-views/saved-views.service.ts
index afd870507..fd52802de 100644
--- a/apps/api/src/saved-views/saved-views.service.ts
+++ b/apps/api/src/saved-views/saved-views.service.ts
@@ -1,11 +1,12 @@
-import { type Db, type FieldEntity, Prisma as PrismaNamespace } from "@crm/db";
+import { type FieldEntity, Prisma as PrismaNamespace } from "@crm/db";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import { parseSavedViewFilters } from "@crm/validation/saved-view";
 import {
 	ConflictException,
 	Injectable,
 	NotFoundException,
 } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import type {
 	SavedView,
 	SavedViewCreateInput,
@@ -14,7 +15,7 @@ import type {
 
 @Injectable()
 export class SavedViewsService {
-	constructor(@InjectDatabase() private readonly db: Db) {}
+	constructor(@InjectScopedDatabase() private readonly db: ScopedDb) {}
 
 	async list(entity: FieldEntity, userId: string): Promise<SavedView[]> {
 		const rows = await this.db.savedView.findMany({
diff --git a/apps/api/src/search/search.service.ts b/apps/api/src/search/search.service.ts
index 7a435dca8..43a3a22f1 100644
--- a/apps/api/src/search/search.service.ts
+++ b/apps/api/src/search/search.service.ts
@@ -1,6 +1,6 @@
-import type { Db } from "@crm/db";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import { Injectable } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 
 export type SearchHit = {
 	kind: "company" | "contact" | "deal";
@@ -17,7 +17,7 @@ const PER_KIND = 5;
 
 @Injectable()
 export class SearchService {
-	constructor(@InjectDatabase() private readonly db: Db) {}
+	constructor(@InjectScopedDatabase() private readonly db: ScopedDb) {}
 
 	async quick(q: string): Promise<{ hits: SearchHit[] }> {
 		const term = q.trim();
diff --git a/apps/api/src/settings/settings.service.ts b/apps/api/src/settings/settings.service.ts
index 1e8cfe857..4328f539f 100644
--- a/apps/api/src/settings/settings.service.ts
+++ b/apps/api/src/settings/settings.service.ts
@@ -1,4 +1,3 @@
-import type { Db } from "@crm/db";
 import {
 	DEFAULT_AGENT_MODEL,
 	maskKey,
@@ -9,10 +8,11 @@ import {
 	writeArchiveRetentionDays,
 	writeContextDevKey,
 } from "@crm/db/settings";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import { BadRequestException, Injectable, Logger } from "@nestjs/common";
 import { ResearchKeyService } from "../agent/research-key.service";
 import { BackfillService } from "../backfill/backfill.service";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import { ModelCatalogService } from "./model-catalog.service";
 import type {
 	AgentModelSettings,
@@ -26,7 +26,7 @@ export class SettingsService {
 	private readonly logger = new Logger(SettingsService.name);
 
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly catalog: ModelCatalogService,
 		private readonly researchKeys: ResearchKeyService,
 		private readonly backfill: BackfillService,
diff --git a/apps/api/src/slack/slack-connection.service.ts b/apps/api/src/slack/slack-connection.service.ts
index a71492bb0..0e0040696 100644
--- a/apps/api/src/slack/slack-connection.service.ts
+++ b/apps/api/src/slack/slack-connection.service.ts
@@ -1,9 +1,7 @@
-import {
-	canManageConnections,
-	isSlackConfigured,
-	WORKSPACE_ID,
-} from "@crm/auth";
+import { canManageConnections, isSlackConfigured } from "@crm/auth";
 import type { Db, Prisma } from "@crm/db";
+import { currentOrganizationId } from "@crm/db/tenant-context";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import { schemas } from "@crm/validation";
 import {
 	BadRequestException,
@@ -13,7 +11,10 @@ import {
 } from "@nestjs/common";
 import { AgentAccessService } from "../agent/agent-access.service";
 import { AgentTriggerService } from "../agent/agent-trigger.service";
-import { InjectDatabase } from "../database/database.constants";
+import {
+	InjectDatabase,
+	InjectScopedDatabase,
+} from "../database/database.constants";
 import type {
 	SlackChannelsInput,
 	SlackChannelsResult,
@@ -36,6 +37,7 @@ const SLACK_WORKSPACE_RESOURCE_ID =
 export class SlackConnectionService {
 	constructor(
 		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly scoped: ScopedDb,
 		private readonly agent: AgentTriggerService,
 		private readonly slackChannels: SlackChannelsService,
 		private readonly access: AgentAccessService,
@@ -43,13 +45,18 @@ export class SlackConnectionService {
 
 	async status(userId: string): Promise<SlackStatus> {
 		const role = await this.access.assertMember(userId);
-		const [account, agents, matches, memberCount, grant] = await Promise.all([
-			this.db.account.findFirst({
-				where: { providerId: "slack", accessToken: { not: null } },
-				orderBy: { updatedAt: "desc" },
-				select: { accountId: true, updatedAt: true, scope: true },
+		const [grant, agents, matches, memberCount] = await Promise.all([
+			this.scoped.slackWorkspaceGrant.findFirst({
+				select: {
+					id: true,
+					teamName: true,
+					botToken: true,
+					botScopes: true,
+					userToken: true,
+					updatedAt: true,
+				},
 			}),
-			this.db.agentDefinition.findMany({
+			this.scoped.agentDefinition.findMany({
 				where: {
 					status: { in: ["LIVE", "PAUSED"] },
 					deletedAt: null,
@@ -65,25 +72,27 @@ export class SlackConnectionService {
 				take: 30,
 				select: { id: true, name: true, description: true, status: true },
 			}),
-			this.db.slackMemberMatch.findMany({
+			this.scoped.slackMemberMatch.findMany({
 				where: {
-					crmUser: { members: { some: { organizationId: WORKSPACE_ID } } },
+					crmUser: {
+						members: { some: { organizationId: currentOrganizationId() } },
+					},
 				},
 				select: { slackUserId: true, updatedAt: true },
 			}),
-			this.db.member.count({ where: { organizationId: WORKSPACE_ID } }),
-			this.db.slackWorkspaceGrant.findFirst({
-				select: { id: true, teamName: true },
+			this.db.member.count({
+				where: { organizationId: currentOrganizationId() },
 			}),
 		]);
 
+		const connection = grant?.botToken ? grant : null;
 		const matched = matches.filter((match) => match.slackUserId).length;
 		const reviewed = matches.length;
 		const inventoryFresh =
-			account &&
+			connection &&
 			reviewed === memberCount &&
-			matches.every((match) => match.updatedAt >= account.updatedAt);
-		if (account && !inventoryFresh) {
+			matches.every((match) => match.updatedAt >= connection.updatedAt);
+		if (connection && !inventoryFresh) {
 			await this.agent.slackPeopleRequested(
 				"Match workspace members to Slack accounts by exact email",
 			);
@@ -91,14 +100,14 @@ export class SlackConnectionService {
 
 		return {
 			configured: isSlackConfigured(),
-			connected: Boolean(account),
-			workspace: account ? (grant?.teamName ?? null) : null,
-			lastConnectedAt: account?.updatedAt.toISOString() ?? null,
-			scopes: (account?.scope ?? "")
+			connected: Boolean(connection),
+			workspace: connection?.teamName ?? null,
+			lastConnectedAt: connection?.updatedAt.toISOString() ?? null,
+			scopes: (connection?.botScopes ?? "")
 				.split(",")
 				.map((scope) => scope.trim())
 				.filter(Boolean),
-			canInviteItself: Boolean(grant),
+			canInviteItself: Boolean(grant?.userToken),
 			canManage: canManageConnections(role),
 			agents,
 			people: { matched, reviewed },
@@ -109,7 +118,7 @@ export class SlackConnectionService {
 		await this.access.assertMember(userId);
 		const [members, syncing] = await Promise.all([
 			this.db.member.findMany({
-				where: { organizationId: WORKSPACE_ID },
+				where: { organizationId: currentOrganizationId() },
 				orderBy: { user: { name: "asc" } },
 				select: {
 					user: {
@@ -143,7 +152,7 @@ export class SlackConnectionService {
 	}
 
 	private async peopleSyncState(): Promise<SlackSyncState> {
-		const pending = await this.db.agentTask.findFirst({
+		const pending = await this.scoped.agentTask.findFirst({
 			where: { kind: "slack-people-match", finishedAt: null },
 			orderBy: { createdAt: "desc" },
 			select: { createdAt: true, startedAt: true, leasedUntil: true },
@@ -163,12 +172,11 @@ export class SlackConnectionService {
 
 	async refreshPeople(userId: string): Promise<SlackRefreshPeopleResult> {
 		await this.access.assertMember(userId);
-		const account = await this.db.account.findFirst({
-			where: { providerId: "slack", accessToken: { not: null } },
-			orderBy: { updatedAt: "desc" },
+		const connection = await this.scoped.slackWorkspaceGrant.findFirst({
+			where: { botToken: { not: null } },
 			select: { id: true },
 		});
-		if (!account) throw new NotFoundException("Slack is not connected.");
+		if (!connection) throw new NotFoundException("Slack is not connected.");
 
 		await this.agent.slackPeopleRequested(
 			"Refresh Slack people and channels from the connection page",
@@ -191,7 +199,7 @@ export class SlackConnectionService {
 		if (needle) where.name = { contains: needle, mode: "insensitive" };
 
 		const [rows, grant, sync] = await Promise.all([
-			this.db.slackChannel.findMany({
+			this.scoped.slackChannel.findMany({
 				where,
 				orderBy: [{ isMember: "desc" }, { name: "asc" }, { id: "asc" }],
 				take: take + 1,
@@ -207,7 +215,7 @@ export class SlackConnectionService {
 					inviteRequestedAt: true,
 				},
 			}),
-			this.db.slackWorkspaceGrant.findFirst({ select: { id: true } }),
+			this.scoped.slackWorkspaceGrant.findFirst({ select: { id: true } }),
 			this.peopleSyncState(),
 		]);
 
@@ -230,18 +238,18 @@ export class SlackConnectionService {
 		userId: string,
 	): Promise<SlackJoinChannelResult> {
 		await this.access.assertMember(userId);
-		const channel = await this.db.slackChannel.findUnique({
+		const channel = await this.scoped.slackChannel.findUnique({
 			where: { id: input.channelId },
 			select: { id: true, name: true, isMember: true, isPrivate: true },
 		});
 		if (!channel) throw new NotFoundException("No such Slack channel.");
 		if (channel.isMember) return { queued: false, alreadyJoined: true };
 
-		const grant = await this.db.slackWorkspaceGrant.findFirst({
+		const grant = await this.scoped.slackWorkspaceGrant.findFirst({
 			select: { id: true },
 		});
 		if (channel.isPrivate && !grant) {
-			await this.db.slackChannel.update({
+			await this.scoped.slackChannel.update({
 				where: { id: channel.id },
 				data: { inviteRequestedAt: new Date() },
 			});
@@ -257,7 +265,7 @@ export class SlackConnectionService {
 		userId: string,
 	): Promise<SlackCreateChannelResult> {
 		await this.access.assertMember(userId);
-		const existing = await this.db.slackChannel.findFirst({
+		const existing = await this.scoped.slackChannel.findFirst({
 			where: { name: input.name },
 			select: { id: true },
 		});
@@ -277,16 +285,15 @@ export class SlackConnectionService {
 			);
 		}
 
-		const removed = await this.db.$transaction(async (tx) => {
-			const accounts = await tx.account.deleteMany({
-				where: { providerId: "slack" },
-			});
-			await tx.slackChannel.deleteMany({});
-			await tx.slackWorkspaceGrant.deleteMany({});
-			return accounts.count;
+		const grant = await this.scoped.slackWorkspaceGrant.findFirst({
+			select: { id: true },
 		});
+		if (!grant) throw new NotFoundException("Slack is not connected.");
 
-		if (removed === 0) throw new NotFoundException("Slack is not connected.");
+		await scopedTransaction(this.scoped, async (tx) => {
+			await tx.slackChannel.deleteMany({});
+			await tx.slackWorkspaceGrant.delete({ where: { id: grant.id } });
+		});
 
 		return { disconnected: true };
 	}
diff --git a/apps/api/src/sso/sso.service.ts b/apps/api/src/sso/sso.service.ts
index 340efcb65..9fb5cafea 100644
--- a/apps/api/src/sso/sso.service.ts
+++ b/apps/api/src/sso/sso.service.ts
@@ -1,4 +1,5 @@
 import {
+	activeWorkspaceRoleOf,
 	auth,
 	canConfigureSso,
 	isGoogleConfigured,
@@ -6,10 +7,10 @@ import {
 	ssoCallbackBase,
 	ssoCallbackURL,
 	ssoProviderName,
-	WORKSPACE_ID,
-	workspaceRoleOf,
 } from "@crm/auth";
-import type { Db, Prisma } from "@crm/db";
+import { db, type Prisma } from "@crm/db";
+import { currentOrganizationId } from "@crm/db/tenant-context";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import {
 	BadRequestException,
 	ForbiddenException,
@@ -20,7 +21,7 @@ import {
 } from "@nestjs/common";
 import { APIError } from "better-auth/api";
 import { z } from "zod";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import {
 	type ListResult,
 	type OrderByColumns,
@@ -114,11 +115,10 @@ function toProvider(row: ProviderRow): SsoProvider {
 export class SsoService {
 	private readonly logger = new Logger(SsoService.name);
 
-	constructor(@InjectDatabase() private readonly db: Db) {}
+	constructor(@InjectScopedDatabase() private readonly db: ScopedDb) {}
 
 	async signInOptions(): Promise<SignInOptions> {
-		const rows = await this.db.ssoProvider.findMany({
-			where: { organizationId: WORKSPACE_ID },
+		const rows = await db.ssoProviderLocator.findMany({
 			select: { providerId: true },
 			orderBy: { providerId: "asc" },
 		});
@@ -135,7 +135,9 @@ export class SsoService {
 
 	async settings(userId: string): Promise<SsoSettings> {
 		return {
-			canConfigure: canConfigureSso(await workspaceRoleOf(userId, this.db)),
+			canConfigure: canConfigureSso(
+				await activeWorkspaceRoleOf(userId, this.db),
+			),
 			callbackBase: ssoCallbackBase(),
 		};
 	}
@@ -180,7 +182,7 @@ export class SsoService {
 					providerId: input.providerId,
 					issuer: input.issuer,
 					domain: domains.join(","),
-					organizationId: WORKSPACE_ID,
+					organizationId: currentOrganizationId(),
 					oidcConfig: {
 						clientId: input.clientId,
 						clientSecret: input.clientSecret,
@@ -231,7 +233,7 @@ export class SsoService {
 	private searchWhere(q: string): Prisma.SsoProviderWhereInput {
 		const term = q.trim();
 		const where: Prisma.SsoProviderWhereInput = {
-			organizationId: WORKSPACE_ID,
+			organizationId: currentOrganizationId(),
 		};
 
 		if (term) {
@@ -271,7 +273,7 @@ export class SsoService {
 	}
 
 	private async requireConfigurer(userId: string): Promise<void> {
-		if (!canConfigureSso(await workspaceRoleOf(userId, this.db))) {
+		if (!canConfigureSso(await activeWorkspaceRoleOf(userId, this.db))) {
 			throw new ForbiddenException(
 				"Only an owner or an admin can change how people sign in.",
 			);
diff --git a/apps/api/src/sync/mailbox-sync.service.ts b/apps/api/src/sync/mailbox-sync.service.ts
index 3eac76b26..690db4a59 100644
--- a/apps/api/src/sync/mailbox-sync.service.ts
+++ b/apps/api/src/sync/mailbox-sync.service.ts
@@ -1,3 +1,4 @@
+import { runInTenant } from "@crm/db/tenant-context";
 import { syncError } from "@crm/telemetry";
 import { Injectable, Logger } from "@nestjs/common";
 import { GoogleConnectionService } from "../google/google-connection.service";
@@ -63,7 +64,9 @@ export class MailboxSyncService {
 			summary.attempted += 1;
 
 			try {
-				const outcome = await this.runOne(row.userId, row.source);
+				const outcome = await runInTenant(row.organizationId, () =>
+					this.runOne(row.userId, row.source),
+				);
 
 				if (outcome === null || outcome.status === "skipped") {
 					summary.skipped += 1;
diff --git a/apps/api/src/telemetry/rollup.service.ts b/apps/api/src/telemetry/rollup.service.ts
index c53b77a43..d76c91139 100644
--- a/apps/api/src/telemetry/rollup.service.ts
+++ b/apps/api/src/telemetry/rollup.service.ts
@@ -5,12 +5,13 @@ import {
 	EnrichmentStatus,
 	FactBand,
 	FactStatus,
+	type Prisma,
 	RecordSource,
 } from "@crm/db";
 import { RETIRED_OUTCOME } from "@crm/db/agent-tasks";
 import { readAgentModel } from "@crm/db/settings";
+import { forEachTenant, organizationIds } from "@crm/db/tenants";
 import { CONTACT_CAP_REASON } from "@crm/db/tracking";
-import { WORKSPACE_ID } from "@crm/db/workspace";
 import {
 	bucket,
 	claimRollup,
@@ -47,6 +48,82 @@ const SANDBOX_TOOLS = new Set([
 
 type Counted = { key: string; count: number };
 
+type AgentModel = Awaited<ReturnType<typeof readAgentModel>>;
+
+type ToolMetrics = {
+	calls: Record<string, number>;
+	errors: Record<string, number>;
+	sandbox: boolean;
+};
+
+type SessionMetrics = {
+	started: number;
+	completed: number;
+	failed: number;
+	withTools: number;
+};
+
+type TaskMetrics = {
+	claimed: Record<string, number>;
+	completed: Record<string, number>;
+	retired: Record<string, number>;
+};
+
+type AttemptMetric = { mean: number; max: number; count: number };
+type AttemptMetricsByKind = Record<string, AttemptMetric>;
+
+type AgentMetrics = {
+	tools: ToolMetrics;
+	sessions: SessionMetrics;
+	tasks: TaskMetrics;
+	attempts: AttemptMetricsByKind;
+	rechecks: { total: number; buckets: Record<string, number> };
+	conversations: number;
+};
+
+type LedgerMetrics = {
+	statuses: Counted[];
+	bands: Counted[];
+	methods: Counted[];
+	evidenceKinds: Counted[];
+	superseded: number;
+};
+
+type CrmMetrics = {
+	contacts: number;
+	companies: number;
+	deals: number;
+	activities: number;
+	contactSources: Counted[];
+	companySources: Counted[];
+	stages: Counted[];
+	types: Counted[];
+	syncs: Counted[];
+	threads: number;
+	messages: number;
+	enrichment: Counted[];
+	suppressedDomains: number;
+	suppressedContacts: number;
+	workspaceProfiles: number;
+	nonSeedContacts: number;
+	trackingSites: number;
+	trackingDomains: number;
+	trackingViews: number;
+	trackingForms: number;
+	trackingContacts: number;
+	trackingCapped: number;
+	trackingPaused: number;
+};
+
+type TenantMetrics = {
+	model: AgentModel;
+	contextConfigured: boolean;
+	ssoProviders: number;
+	agent: AgentMetrics;
+	ledger: LedgerMetrics;
+	crm: CrmMetrics;
+};
+
 export type RollupOutcome = {
 	sent: boolean;
 	reason?: string;
@@ -119,13 +196,20 @@ export class RollupService {
 		since: Date,
 	): Promise<{ properties: Properties; counters: Record<string, number> }> {
 		const counters = await drainCounters();
-
-		const [shape, agent, ledger, crm] = await Promise.all([
-			this.shape(),
-			this.agent(since, counters),
-			this.ledger(),
-			this.crm(since),
+		const organizations = await organizationIds(this.db);
+		const [postgres, memberRows, tenants] = await Promise.all([
+			this.postgresMajor(),
+			this.db.$queryRaw<{ count: bigint }[]>`
+				SELECT COUNT(DISTINCT "userId") AS count
+				FROM member;
+			`,
+			this.tenantMetrics(organizations, since),
 		]);
+		const members = Number(memberRows[0]?.count ?? 0);
+		const shape = this.shape(tenants, members, postgres);
+		const agent = aggregateAgent(tenants, counters);
+		const ledger = aggregateLedger(tenants);
+		const crm = aggregateCrm(tenants);
 
 		return {
 			properties: { ...shape, ...agent, ...ledger, ...crm },
@@ -133,15 +217,47 @@ export class RollupService {
 		};
 	}
 
-	private async shape(): Promise<Properties> {
-		const [model, members, ssoProviders, postgres, contextKey] =
-			await Promise.all([
-				readAgentModel(this.db).catch(() => null),
-				this.db.member.count({ where: { organizationId: WORKSPACE_ID } }),
-				this.db.ssoProvider.count(),
-				this.postgresMajor(),
-				this.db.appSetting.findFirst({ select: { contextDevApiKey: true } }),
-			]);
+	private async tenantMetrics(
+		organizations: readonly string[],
+		since: Date,
+	): Promise<TenantMetrics[]> {
+		const tenants: TenantMetrics[] = [];
+
+		await forEachTenant(
+			async (organizationId, tx) => {
+				const [model, ssoProviders, contextKey, agent, ledger, crm] =
+					await Promise.all([
+						readAgentModel(tx),
+						tx.ssoProvider.count(),
+						tx.appSetting.findFirst({
+							select: { contextDevApiKey: true },
+						}),
+						this.agent(tx, since),
+						this.ledger(tx),
+						this.crm(tx, since),
+					]);
+
+				tenants.push({
+					model,
+					ssoProviders,
+					contextConfigured: Boolean(contextKey?.contextDevApiKey?.trim()),
+					agent,
+					ledger,
+					crm,
+				});
+			},
+			{ organizations, concurrency: 1 },
+		);
+
+		return tenants;
+	}
+
+	private shape(
+		tenants: readonly TenantMetrics[],
+		members: number,
+		postgres: string | null,
+	): Properties {
+		const model = sharedModel(tenants.map((tenant) => tenant.model));
 
 		return {
 			node_version: process.versions.node.split(".")[0] ?? null,
@@ -149,7 +265,7 @@ export class RollupService {
 			members_bucket: bucket(members),
 
 			cap_perplexity: isSet("PERPLEXITY_API_KEY"),
-			cap_context_dev: Boolean(contextKey?.contextDevApiKey?.trim()),
+			cap_context_dev: tenants.some((tenant) => tenant.contextConfigured),
 			cap_blob: isSet("BLOB_READ_WRITE_TOKEN"),
 			cap_github: isSet("GITHUB_TOKEN"),
 			cap_redis: isSet("REDIS_URL"),
@@ -158,11 +274,11 @@ export class RollupService {
 			cap_ai_gateway: isSet("AI_GATEWAY_API_KEY"),
 			cap_google_oauth:
 				isSet("GOOGLE_CLIENT_ID") && isSet("GOOGLE_CLIENT_SECRET"),
-			cap_sso_provider: ssoProviders > 0,
+			cap_sso_provider: tenants.some((tenant) => tenant.ssoProviders > 0),
 			is_marketing: process.env.IS_MARKETING === "true",
 
-			agent_model_id: model?.id ?? null,
-			agent_model_context_window: model?.contextWindowTokens ?? null,
+			agent_model_id: model.id,
+			agent_model_context_window: model.contextWindowTokens,
 		};
 	}
 
@@ -182,55 +298,31 @@ export class RollupService {
 	}
 
 	private async agent(
+		db: Prisma.TransactionClient,
 		since: Date,
-		counters: Record<string, number>,
-	): Promise<Properties> {
+	): Promise<AgentMetrics> {
 		const [tools, sessions, tasks, attempts, rechecks, conversations] =
 			await Promise.all([
-				this.toolCalls(since),
-				this.sessions(since),
-				this.tasks(since),
-				this.attempts(since),
-				this.rechecks(since),
-				this.db.agentConversation.count(),
+				this.toolCalls(db, since),
+				this.sessions(db, since),
+				this.tasks(db, since),
+				this.attempts(db, since),
+				this.rechecks(db, since),
+				db.agentConversation.count(),
 			]);
 
-		const total = Object.values(tools.calls).reduce((sum, n) => sum + n, 0);
-
-		return {
-			tool_calls: tools.calls,
-			tool_calls_total: total,
-			tool_errors: tools.errors,
-			sandbox_used: tools.sandbox,
-
-			sessions_started: sessions.started,
-			sessions_completed: sessions.completed,
-			sessions_failed: sessions.failed,
-			tools_per_session_mean: sessions.withTools
-				? round(total / sessions.withTools)
-				: 0,
-
-			tasks_claimed: tasks.claimed,
-			tasks_completed: tasks.completed,
-			tasks_retired: tasks.retired,
-			task_attempts_mean: attempts.mean,
-			task_attempts_max: attempts.max,
-
-			budget_exhausted: counters.budget_exhausted ?? 0,
-
-			recheck_scheduled: rechecks.total,
-			recheck_interval_days: rechecks.buckets,
-
-			agent_conversations: conversations,
-		};
+		return { tools, sessions, tasks, attempts, rechecks, conversations };
 	}
 
-	private async toolCalls(since: Date): Promise<{
+	private async toolCalls(
+		db: Prisma.TransactionClient,
+		since: Date,
+	): Promise<{
 		calls: Record<string, number>;
 		errors: Record<string, number>;
 		sandbox: boolean;
 	}> {
-		const rows = await this.db.$queryRaw<
+		const rows = await db.$queryRaw<
 			{ tool: string | null; failed: boolean; count: bigint }[]
 		>`
 			SELECT
@@ -238,7 +330,8 @@ export class RollupService {
 				COALESCE("data"->>'status', 'completed') <> 'completed' AS failed,
 				COUNT(*) AS count
 			FROM "agentEvent"
-			WHERE "type" = 'action.result' AND "emittedAt" >= ${since}
+			WHERE "type" = 'action.result'
+				AND "emittedAt" >= ${since}
 			GROUP BY 1, 2;
 		`;
 
@@ -258,13 +351,16 @@ export class RollupService {
 		return { calls, errors, sandbox };
 	}
 
-	private async sessions(since: Date): Promise<{
+	private async sessions(
+		db: Prisma.TransactionClient,
+		since: Date,
+	): Promise<{
 		started: number;
 		completed: number;
 		failed: number;
 		withTools: number;
 	}> {
-		const rows = await this.db.$queryRaw<{ type: string; sessions: bigint }[]>`
+		const rows = await db.$queryRaw<{ type: string; sessions: bigint }[]>`
 			SELECT "type", COUNT(DISTINCT "sessionId") AS sessions
 			FROM "agentEvent"
 			WHERE "emittedAt" >= ${since}
@@ -283,18 +379,21 @@ export class RollupService {
 		};
 	}
 
-	private async tasks(since: Date): Promise<{
+	private async tasks(
+		db: Prisma.TransactionClient,
+		since: Date,
+	): Promise<{
 		claimed: Record<string, number>;
 		completed: Record<string, number>;
 		retired: Record<string, number>;
 	}> {
 		const [claimed, finished] = await Promise.all([
-			this.db.agentTask.groupBy({
+			db.agentTask.groupBy({
 				by: ["kind"],
 				where: { startedAt: { gte: since } },
 				_count: { _all: true },
 			}),
-			this.db.agentTask.groupBy({
+			db.agentTask.groupBy({
 				by: ["kind", "outcome"],
 				where: { finishedAt: { gte: since } },
 				_count: { _all: true },
@@ -320,31 +419,43 @@ export class RollupService {
 	}
 
 	private async attempts(
+		db: Prisma.TransactionClient,
 		since: Date,
-	): Promise<{ mean: Record<string, number>; max: Record<string, number> }> {
-		const rows = await this.db.agentTask.groupBy({
+	): Promise<AttemptMetricsByKind> {
+		const rows = await db.agentTask.groupBy({
 			by: ["kind"],
 			where: { finishedAt: { gte: since } },
+			_count: { _all: true },
 			_avg: { attempts: true },
 			_max: { attempts: true },
 		});
 
-		const mean: Record<string, number> = {};
-		const max: Record<string, number> = {};
+		const attempts: AttemptMetricsByKind = {};
 
 		for (const row of rows) {
 			const kind = permittedTaskKind(row.kind);
-			mean[kind] = round(row._avg.attempts ?? 0);
-			max[kind] = row._max.attempts ?? 0;
+			const existing = attempts[kind] ?? { mean: 0, max: 0, count: 0 };
+			const count = row._count._all;
+			const combined = existing.count + count;
+			attempts[kind] = {
+				mean: combined
+					? (existing.mean * existing.count +
+							(row._avg.attempts ?? 0) * count) /
+						combined
+					: 0,
+				max: Math.max(existing.max, row._max.attempts ?? 0),
+				count: combined,
+			};
 		}
 
-		return { mean, max };
+		return attempts;
 	}
 
 	private async rechecks(
+		db: Prisma.TransactionClient,
 		since: Date,
 	): Promise<{ total: number; buckets: Record<string, number> }> {
-		const rows = await this.db.agentTask.findMany({
+		const rows = await db.agentTask.findMany({
 			where: { kind: "recheck", createdAt: { gte: since } },
 			select: { createdAt: true, dueAt: true },
 		});
@@ -363,82 +474,63 @@ export class RollupService {
 		return { total: rows.length, buckets };
 	}
 
-	private async ledger(): Promise<Properties> {
-		const [byStatus, byBand, methods, kinds, decided, superseded] =
-			await Promise.all([
-				this.db.contactFact.groupBy({
-					by: ["status"],
-					_count: { _all: true },
-				}),
-				this.db.contactFact.groupBy({ by: ["band"], _count: { _all: true } }),
-				this.db.contactFact.groupBy({
-					by: ["method"],
-					_count: { _all: true },
-				}),
-				this.evidenceKinds(),
-				this.decisionHours(),
-				this.supersededWithin(SUPERSEDE_WINDOW_DAYS),
-			]);
-
-		const statuses = countsOf(
-			byStatus.map((row) => ({ key: row.status, count: row._count._all })),
-			Object.values(FactStatus),
-		);
-
-		const dismissed = statuses[FactStatus.DISMISSED] ?? 0;
-		const proposed = statuses[FactStatus.PROPOSED] ?? 0;
-		const judged = dismissed + (statuses[FactStatus.APPLIED] ?? 0) + proposed;
+	private async ledger(db: Prisma.TransactionClient): Promise<LedgerMetrics> {
+		const [byStatus, byBand, methods, kinds, superseded] = await Promise.all([
+			db.contactFact.groupBy({
+				by: ["status"],
+				_count: { _all: true },
+			}),
+			db.contactFact.groupBy({
+				by: ["band"],
+				_count: { _all: true },
+			}),
+			db.contactFact.groupBy({
+				by: ["method"],
+				_count: { _all: true },
+			}),
+			this.evidenceKinds(db),
+			this.supersededWithin(db, SUPERSEDE_WINDOW_DAYS),
+		]);
 
 		return {
-			facts_by_status: statuses,
-			facts_by_band: countsOf(
-				byBand.map((row) => ({ key: row.band, count: row._count._all })),
-				Object.values(FactBand),
-			),
-			facts_by_method: merge(
-				methods.map((row) => ({
-					key: permittedMethod(row.method),
-					count: row._count._all,
-				})),
-			),
-			facts_by_evidence_kind: kinds,
-			fact_dismissal_rate: judged ? round(dismissed / judged) : 0,
-			fact_decision_median_hours: decided,
-			facts_superseded_within_7_days: superseded,
+			statuses: byStatus.map((row) => ({
+				key: row.status,
+				count: row._count._all,
+			})),
+			bands: byBand.map((row) => ({
+				key: row.band,
+				count: row._count._all,
+			})),
+			methods: methods.map((row) => ({
+				key: permittedMethod(row.method),
+				count: row._count._all,
+			})),
+			evidenceKinds: kinds,
+			superseded,
 		};
 	}
 
-	private async evidenceKinds(): Promise<Record<string, number>> {
-		const rows = await this.db.$queryRaw<{ kind: string; count: bigint }[]>`
+	private async evidenceKinds(
+		db: Prisma.TransactionClient,
+	): Promise<Counted[]> {
+		const rows = await db.$queryRaw<{ kind: string; count: bigint }[]>`
 			SELECT item->>'kind' AS kind, COUNT(*) AS count
 			FROM "contactFact", jsonb_array_elements("evidence") AS item
 			WHERE jsonb_typeof("evidence") = 'array'
 			GROUP BY 1;
 		`;
 
-		return merge(
-			rows.map((row) => ({
-				key: permittedEvidenceKind(row.kind),
-				count: Number(row.count),
-			})),
-		);
-	}
-
-	private async decisionHours(): Promise<number | null> {
-		const rows = await this.db.$queryRaw<{ median: number | null }[]>`
-			SELECT PERCENTILE_CONT(0.5) WITHIN GROUP (
-				ORDER BY EXTRACT(EPOCH FROM ("decidedAt" - "observedAt")) / 3600
-			) AS median
-			FROM "contactFact"
-			WHERE "decidedAt" IS NOT NULL;
-		`;
-
-		const median = rows[0]?.median;
-		return median === null || median === undefined ? null : round(median);
+		return rows.map((row) => ({
+			key: permittedEvidenceKind(row.kind),
+			count: Number(row.count),
+		}));
 	}
 
-	private async supersededWithin(days: number): Promise<number> {
-		const rows = await this.db.$queryRaw<{ count: bigint }[]>`
+	private async supersededWithin(
+		db: Prisma.TransactionClient,
+		days: number,
+	): Promise<number> {
+		const rows = await db.$queryRaw<{ count: bigint }[]>`
 			SELECT COUNT(*) AS count
 			FROM "contactFact"
 			WHERE "supersededAt" IS NOT NULL
@@ -448,7 +540,10 @@ export class RollupService {
 		return Number(rows[0]?.count ?? 0);
 	}
 
-	private async crm(since: Date): Promise<Properties> {
+	private async crm(
+		db: Prisma.TransactionClient,
+		since: Date,
+	): Promise<CrmMetrics> {
 		const [
 			contacts,
 			companies,
@@ -467,25 +562,44 @@ export class RollupService {
 			workspaceProfile,
 			nonSeedContacts,
 		] = await Promise.all([
-			this.db.contact.count(),
-			this.db.company.count(),
-			this.db.deal.count(),
-			this.db.activity.count(),
-			this.db.contact.groupBy({ by: ["source"], _count: { _all: true } }),
-			this.db.company.groupBy({ by: ["source"], _count: { _all: true } }),
-			this.db.deal.groupBy({ by: ["stage"], _count: { _all: true } }),
-			this.db.activity.groupBy({ by: ["type"], _count: { _all: true } }),
-			this.db.mailboxSync.groupBy({ by: ["status"], _count: { _all: true } }),
-			this.db.emailThread.count({ where: { createdAt: { gte: since } } }),
-			this.db.emailMessage.count({ where: { createdAt: { gte: since } } }),
-			this.db.company.groupBy({
+			db.contact.count(),
+			db.company.count(),
+			db.deal.count(),
+			db.activity.count(),
+			db.contact.groupBy({
+				by: ["source"],
+				_count: { _all: true },
+			}),
+			db.company.groupBy({
+				by: ["source"],
+				_count: { _all: true },
+			}),
+			db.deal.groupBy({
+				by: ["stage"],
+				_count: { _all: true },
+			}),
+			db.activity.groupBy({
+				by: ["type"],
+				_count: { _all: true },
+			}),
+			db.mailboxSync.groupBy({
+				by: ["status"],
+				_count: { _all: true },
+			}),
+			db.emailThread.count({
+				where: { createdAt: { gte: since } },
+			}),
+			db.emailMessage.count({
+				where: { createdAt: { gte: since } },
+			}),
+			db.company.groupBy({
 				by: ["enrichmentStatus"],
 				_count: { _all: true },
 			}),
-			this.db.suppressedDomain.count(),
-			this.db.suppressedContact.count(),
-			this.db.workspaceProfile.count(),
-			this.db.contact.count({
+			db.suppressedDomain.count(),
+			db.suppressedContact.count(),
+			db.workspaceProfile.count(),
+			db.contact.count({
 				where: {
 					OR: [
 						{ ownerId: null },
@@ -504,82 +618,262 @@ export class RollupService {
 			trackingCapped,
 			trackingPaused,
 		] = await Promise.all([
-			this.db.appSetting.count({ where: { trackingSiteId: { not: null } } }),
-			this.db.trackedDomain.count(),
-			this.db.trackedEvent.count({
-				where: { type: "page_view", occurredAt: { gte: since } },
+			db.appSetting.count({
+				where: { trackingSiteId: { not: null } },
+			}),
+			db.trackedDomain.count(),
+			db.trackedEvent.count({
+				where: {
+					type: "page_view",
+					occurredAt: { gte: since },
+				},
+			}),
+			db.formSubmission.count({
+				where: { createdAt: { gte: since } },
 			}),
-			this.db.formSubmission.count({ where: { createdAt: { gte: since } } }),
-			this.db.contact.count({
-				where: { createdAt: { gte: since }, source: RecordSource.TRACKING },
+			db.contact.count({
+				where: {
+					createdAt: { gte: since },
+					source: RecordSource.TRACKING,
+				},
 			}),
-			this.db.formSubmission.count({
-				where: { createdAt: { gte: since }, skipReason: CONTACT_CAP_REASON },
+			db.formSubmission.count({
+				where: {
+					createdAt: { gte: since },
+					skipReason: CONTACT_CAP_REASON,
+				},
 			}),
-			this.db.appSetting.count({ where: { trackingPaused: true } }),
+			db.appSetting.count({ where: { trackingPaused: true } }),
 		]);
 
-		const configured = syncs.reduce((sum, row) => sum + row._count._all, 0);
-
 		return {
-			seed_only: contacts > 0 && nonSeedContacts === 0,
-
-			contacts_bucket: bucket(contacts),
-			companies_bucket: bucket(companies),
-			deals_bucket: bucket(deals),
-			activities_bucket: bucket(activities),
-
-			contacts_by_source: countsOf(
-				contactSources.map((row) => ({
-					key: row.source,
-					count: row._count._all,
-				})),
-				Object.values(RecordSource),
-			),
-			companies_by_source: countsOf(
-				companySources.map((row) => ({
-					key: row.source,
-					count: row._count._all,
-				})),
-				Object.values(RecordSource),
-			),
-			deals_by_stage: countsOf(
-				stages.map((row) => ({ key: row.stage, count: row._count._all })),
-				Object.values(DealStage),
-			),
-			activities_by_type: countsOf(
-				types.map((row) => ({ key: row.type, count: row._count._all })),
-				Object.values(ActivityType),
-			),
+			contacts,
+			companies,
+			deals,
+			activities,
+			contactSources: counted(contactSources, "source"),
+			companySources: counted(companySources, "source"),
+			stages: counted(stages, "stage"),
+			types: counted(types, "type"),
+			syncs: counted(syncs, "status"),
+			threads,
+			messages,
+			enrichment: counted(enrichment, "enrichmentStatus"),
+			suppressedDomains,
+			suppressedContacts,
+			workspaceProfiles: workspaceProfile,
+			nonSeedContacts,
+			trackingSites: trackingSite,
+			trackingDomains,
+			trackingViews,
+			trackingForms,
+			trackingContacts,
+			trackingCapped,
+			trackingPaused,
+		};
+	}
+}
 
-			cap_tracking: trackingSite > 0,
-			tracking_domains: bucket(trackingDomains),
-			tracking_page_views: trackingViews,
-			tracking_forms: trackingForms,
-			tracking_contacts_created: trackingContacts,
-			tracking_capped: trackingCapped,
-			tracking_paused: trackingPaused > 0,
-
-			mailbox_sync_configured: configured > 0,
-			mailbox_sync_status: merge(
-				syncs.map((row) => ({ key: row.status, count: row._count._all })),
-			),
-			threads_ingested: threads,
-			messages_ingested: messages,
-
-			enrichment_by_status: countsOf(
-				enrichment.map((row) => ({
-					key: row.enrichmentStatus,
-					count: row._count._all,
-				})),
-				Object.values(EnrichmentStatus),
-			),
+function aggregateAgent(
+	tenants: readonly TenantMetrics[],
+	counters: Record<string, number>,
+): Properties {
+	const tools = mergeMaps(tenants.map((tenant) => tenant.agent.tools.calls));
+	const toolErrors = mergeMaps(
+		tenants.map((tenant) => tenant.agent.tools.errors),
+	);
+	const sessions = tenants.reduce<SessionMetrics>(
+		(total, tenant) => ({
+			started: total.started + tenant.agent.sessions.started,
+			completed: total.completed + tenant.agent.sessions.completed,
+			failed: total.failed + tenant.agent.sessions.failed,
+			withTools: total.withTools + tenant.agent.sessions.withTools,
+		}),
+		{ started: 0, completed: 0, failed: 0, withTools: 0 },
+	);
+	const attempts = mergeAttempts(
+		tenants.map((tenant) => tenant.agent.attempts),
+	);
+	const total = Object.values(tools).reduce((sum, count) => sum + count, 0);
+
+	return {
+		tool_calls: tools,
+		tool_calls_total: total,
+		tool_errors: toolErrors,
+		sandbox_used: tenants.some((tenant) => tenant.agent.tools.sandbox),
+		sessions_started: sessions.started,
+		sessions_completed: sessions.completed,
+		sessions_failed: sessions.failed,
+		tools_per_session_mean: sessions.withTools
+			? round(total / sessions.withTools)
+			: 0,
+		tasks_claimed: mergeMaps(
+			tenants.map((tenant) => tenant.agent.tasks.claimed),
+		),
+		tasks_completed: mergeMaps(
+			tenants.map((tenant) => tenant.agent.tasks.completed),
+		),
+		tasks_retired: mergeMaps(
+			tenants.map((tenant) => tenant.agent.tasks.retired),
+		),
+		task_attempts_mean: Object.fromEntries(
+			Object.entries(attempts).map(([kind, value]) => [
+				kind,
+				round(value.mean),
+			]),
+		),
+		task_attempts_max: Object.fromEntries(
+			Object.entries(attempts).map(([kind, value]) => [kind, value.max]),
+		),
+		budget_exhausted: counters.budget_exhausted ?? 0,
+		recheck_scheduled: tenants.reduce(
+			(total, tenant) => total + tenant.agent.rechecks.total,
+			0,
+		),
+		recheck_interval_days: mergeMaps(
+			tenants.map((tenant) => tenant.agent.rechecks.buckets),
+		),
+		agent_conversations: tenants.reduce(
+			(total, tenant) => total + tenant.agent.conversations,
+			0,
+		),
+	};
+}
+
+function aggregateLedger(tenants: readonly TenantMetrics[]): Properties {
+	const statuses = countsOf(
+		tenants.flatMap((tenant) => tenant.ledger.statuses),
+		Object.values(FactStatus),
+	);
+	const dismissed = statuses[FactStatus.DISMISSED] ?? 0;
+	const proposed = statuses[FactStatus.PROPOSED] ?? 0;
+	const judged = dismissed + (statuses[FactStatus.APPLIED] ?? 0) + proposed;
+
+	return {
+		facts_by_status: statuses,
+		facts_by_band: countsOf(
+			tenants.flatMap((tenant) => tenant.ledger.bands),
+			Object.values(FactBand),
+		),
+		facts_by_method: merge(tenants.flatMap((tenant) => tenant.ledger.methods)),
+		facts_by_evidence_kind: merge(
+			tenants.flatMap((tenant) => tenant.ledger.evidenceKinds),
+		),
+		fact_dismissal_rate: judged ? round(dismissed / judged) : 0,
+		facts_superseded_within_7_days: tenants.reduce(
+			(total, tenant) => total + tenant.ledger.superseded,
+			0,
+		),
+	};
+}
 
-			suppressed_domains: suppressedDomains,
-			suppressed_contacts: suppressedContacts,
-			workspace_profile_written: workspaceProfile > 0,
+function aggregateCrm(tenants: readonly TenantMetrics[]): Properties {
+	const total = (read: (metrics: CrmMetrics) => number) =>
+		tenants.reduce((sum, tenant) => sum + read(tenant.crm), 0);
+	const contacts = total((crm) => crm.contacts);
+	const nonSeedContacts = total((crm) => crm.nonSeedContacts);
+	const syncs = tenants.flatMap((tenant) => tenant.crm.syncs);
+
+	return {
+		seed_only: contacts > 0 && nonSeedContacts === 0,
+		contacts_bucket: bucket(contacts),
+		companies_bucket: bucket(total((crm) => crm.companies)),
+		deals_bucket: bucket(total((crm) => crm.deals)),
+		activities_bucket: bucket(total((crm) => crm.activities)),
+		contacts_by_source: countsOf(
+			tenants.flatMap((tenant) => tenant.crm.contactSources),
+			Object.values(RecordSource),
+		),
+		companies_by_source: countsOf(
+			tenants.flatMap((tenant) => tenant.crm.companySources),
+			Object.values(RecordSource),
+		),
+		deals_by_stage: countsOf(
+			tenants.flatMap((tenant) => tenant.crm.stages),
+			Object.values(DealStage),
+		),
+		activities_by_type: countsOf(
+			tenants.flatMap((tenant) => tenant.crm.types),
+			Object.values(ActivityType),
+		),
+		cap_tracking: total((crm) => crm.trackingSites) > 0,
+		tracking_domains: bucket(total((crm) => crm.trackingDomains)),
+		tracking_page_views: total((crm) => crm.trackingViews),
+		tracking_forms: total((crm) => crm.trackingForms),
+		tracking_contacts_created: total((crm) => crm.trackingContacts),
+		tracking_capped: total((crm) => crm.trackingCapped),
+		tracking_paused: total((crm) => crm.trackingPaused) > 0,
+		mailbox_sync_configured: syncs.some((row) => row.count > 0),
+		mailbox_sync_status: merge(syncs),
+		threads_ingested: total((crm) => crm.threads),
+		messages_ingested: total((crm) => crm.messages),
+		enrichment_by_status: countsOf(
+			tenants.flatMap((tenant) => tenant.crm.enrichment),
+			Object.values(EnrichmentStatus),
+		),
+		suppressed_domains: total((crm) => crm.suppressedDomains),
+		suppressed_contacts: total((crm) => crm.suppressedContacts),
+		workspace_profile_written: total((crm) => crm.workspaceProfiles) > 0,
+	};
+}
+
+type SharedModel = { id: string | null; contextWindowTokens: number | null };
+
+function sharedModel(models: readonly AgentModel[]): SharedModel {
+	const first = models[0];
+	if (!first) return { id: null, contextWindowTokens: null };
+	if (
+		models.every(
+			(model) =>
+				model.id === first.id &&
+				model.contextWindowTokens === first.contextWindowTokens,
+		)
+	) {
+		return {
+			id: first.id,
+			contextWindowTokens: first.contextWindowTokens,
 		};
 	}
+
+	return { id: "mixed", contextWindowTokens: null };
+}
+
+function mergeAttempts(
+	groups: readonly AttemptMetricsByKind[],
+): AttemptMetricsByKind {
+	const combined: AttemptMetricsByKind = {};
+
+	for (const group of groups) {
+		for (const [kind, metric] of Object.entries(group)) {
+			const existing = combined[kind] ?? { mean: 0, max: 0, count: 0 };
+			const count = existing.count + metric.count;
+			combined[kind] = {
+				mean: count
+					? (existing.mean * existing.count + metric.mean * metric.count) /
+						count
+					: 0,
+				max: Math.max(existing.max, metric.max),
+				count,
+			};
+		}
+	}
+
+	return combined;
+}
+
+function mergeMaps(groups: readonly Record<string, number>[]): CountsByKey {
+	return merge(
+		groups.flatMap((group) =>
+			Object.entries(group).map(([key, count]) => ({ key, count })),
+		),
+	);
+}
+
+function counted<K extends string>(
+	rows: readonly ({ _count: { _all: number } } & Record<K, string>)[],
+	key: K,
+): Counted[] {
+	return rows.map((row) => ({ key: row[key], count: row._count._all }));
 }
 
 function isSet(name: string): boolean {
diff --git a/apps/api/src/tracking/tracking-config.service.ts b/apps/api/src/tracking/tracking-config.service.ts
index b6db8efbd..705d09daf 100644
--- a/apps/api/src/tracking/tracking-config.service.ts
+++ b/apps/api/src/tracking/tracking-config.service.ts
@@ -1,5 +1,5 @@
-import type { Db } from "@crm/db";
-import { SETTINGS_ID } from "@crm/db/settings";
+import { currentOrganizationId, runInTenant } from "@crm/db/tenant-context";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import {
 	configHash,
 	mintSiteId,
@@ -9,7 +9,8 @@ import {
 import { CACHE_MANAGER } from "@nestjs/cache-manager";
 import { Inject, Injectable, Logger } from "@nestjs/common";
 import type { Cache } from "cache-manager";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
+import { TrackingSiteLocatorService } from "./tracking-site-locator.service";
 
 const CONFIG_TTL_MS = 5 * 60_000;
 
@@ -27,12 +28,13 @@ export class TrackingConfigService {
 	private generation = 0;
 
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		@Inject(CACHE_MANAGER) private readonly cache: Cache,
+		private readonly locator: TrackingSiteLocatorService,
 	) {}
 
 	async compiled(): Promise<CompiledConfig | null> {
-		const cached = await this.cache.get<CompiledConfig>(CONFIG_KEY);
+		const cached = await this.cache.get<CompiledConfig>(this.cacheKey());
 		if (cached) return cached;
 
 		const read = this.generation;
@@ -42,7 +44,7 @@ export class TrackingConfigService {
 		const compiled = { config, hash: configHash(config) };
 
 		if (read === this.generation && (await this.current(compiled.hash))) {
-			await this.cache.set(CONFIG_KEY, compiled, CONFIG_TTL_MS);
+			await this.cache.set(this.cacheKey(), compiled, CONFIG_TTL_MS);
 		}
 
 		return compiled;
@@ -50,7 +52,7 @@ export class TrackingConfigService {
 
 	private async current(hash: string): Promise<boolean> {
 		const row = await this.db.appSetting.findUnique({
-			where: { id: SETTINGS_ID },
+			where: { organizationId: currentOrganizationId() },
 			select: { trackingConfigHash: true },
 		});
 
@@ -58,21 +60,26 @@ export class TrackingConfigService {
 	}
 
 	async forSite(siteId: string): Promise<CompiledConfig | null> {
-		const compiled = await this.compiled();
-		return compiled?.config.siteId === siteId ? compiled : null;
+		const organizationId = await this.locator.resolve(siteId);
+		if (!organizationId) return null;
+
+		return runInTenant(organizationId, async () => {
+			const compiled = await this.compiled();
+			return compiled?.config.siteId === siteId ? compiled : null;
+		});
 	}
 
 	async invalidate(): Promise<void> {
 		this.generation += 1;
 		const written = this.generation;
 
-		await this.cache.del(CONFIG_KEY);
+		await this.cache.del(this.cacheKey());
 
 		const config = await readTrackingConfig(this.db);
 
 		if (!config) {
 			await this.db.appSetting.updateMany({
-				where: { id: SETTINGS_ID },
+				where: {},
 				data: { trackingConfigHash: null },
 			});
 
@@ -82,33 +89,25 @@ export class TrackingConfigService {
 		const hash = configHash(config);
 
 		await this.db.appSetting.update({
-			where: { id: SETTINGS_ID },
+			where: { organizationId: currentOrganizationId() },
 			data: { trackingConfigHash: hash },
 		});
 
 		if (written !== this.generation) return;
 		if (!(await this.current(hash))) return;
 
-		await this.cache.set(CONFIG_KEY, { config, hash }, CONFIG_TTL_MS);
+		await this.cache.set(this.cacheKey(), { config, hash }, CONFIG_TTL_MS);
 	}
 
 	async ensureSiteId(): Promise<string> {
 		const existing = await this.db.appSetting.findUnique({
-			where: { id: SETTINGS_ID },
+			where: { organizationId: currentOrganizationId() },
 			select: { trackingSiteId: true },
 		});
 
 		if (existing?.trackingSiteId) return existing.trackingSiteId;
 
-		const trackingSiteId = mintSiteId();
-
-		await this.db.appSetting.upsert({
-			where: { id: SETTINGS_ID },
-			create: { id: SETTINGS_ID, trackingSiteId },
-			update: { trackingSiteId },
-		});
-
-		await this.invalidate();
+		const trackingSiteId = await this.writeSiteId();
 
 		this.logger.log({ message: "Tracking site id minted" });
 
@@ -116,18 +115,35 @@ export class TrackingConfigService {
 	}
 
 	async rotateSiteId(): Promise<string> {
+		const trackingSiteId = await this.writeSiteId();
+
+		this.logger.warn({ message: "Tracking site id rotated" });
+
+		return trackingSiteId;
+	}
+
+	private async writeSiteId(): Promise<string> {
+		const organizationId = currentOrganizationId();
 		const trackingSiteId = mintSiteId();
 
-		await this.db.appSetting.upsert({
-			where: { id: SETTINGS_ID },
-			create: { id: SETTINGS_ID, trackingSiteId },
-			update: { trackingSiteId },
+		await scopedTransaction(async (tx) => {
+			await tx.appSetting.upsert({
+				where: { organizationId },
+				create: { trackingSiteId },
+				update: { trackingSiteId },
+			});
+			await tx.trackingSiteLocator.upsert({
+				where: { organizationId },
+				create: { organizationId, siteId: trackingSiteId },
+				update: { siteId: trackingSiteId },
+			});
 		});
-
 		await this.invalidate();
 
-		this.logger.warn({ message: "Tracking site id rotated" });
-
 		return trackingSiteId;
 	}
+
+	private cacheKey(): string {
+		return `${CONFIG_KEY}:${currentOrganizationId()}`;
+	}
 }
diff --git a/apps/api/src/tracking/tracking-counter.service.ts b/apps/api/src/tracking/tracking-counter.service.ts
index 95006936d..327349913 100644
--- a/apps/api/src/tracking/tracking-counter.service.ts
+++ b/apps/api/src/tracking/tracking-counter.service.ts
@@ -1,27 +1,30 @@
-import type { Db } from "@crm/db";
+import { currentOrganizationId } from "@crm/db/tenant-context";
+import { scopedTransaction } from "@crm/db/tenant-scope";
 import { windowExpiry } from "@crm/db/tracking";
 import { Injectable, Logger } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
 
 @Injectable()
 export class TrackingCounterService {
 	private readonly logger = new Logger(TrackingCounterService.name);
 
-	constructor(@InjectDatabase() private readonly db: Db) {}
-
 	async take(key: string, limit: number, amount = 1): Promise<boolean> {
 		if (amount <= 0) return true;
 		if (amount > limit) return false;
 
 		try {
-			const charged = await this.db.$queryRaw<{ value: number }[]>`
-				INSERT INTO "trackingCounter" ("key", "value", "expiresAt")
-				VALUES (${key}, ${amount}, ${windowExpiry(key)})
-				ON CONFLICT ("key") DO UPDATE
-					SET "value" = "trackingCounter"."value" + ${amount}
-					WHERE "trackingCounter"."value" + ${amount} <= ${limit}
-				RETURNING "value";
-			`;
+			const organizationId = currentOrganizationId();
+			const charged = await scopedTransaction(
+				(tx) =>
+					tx.$queryRaw<{ value: number }[]>`
+					INSERT INTO "trackingCounter" ("organizationId", "key", "value", "expiresAt")
+					VALUES (${organizationId}, ${key}, ${amount}, ${windowExpiry(key)})
+					ON CONFLICT ("organizationId", "key") DO UPDATE
+						SET "value" = "trackingCounter"."value" + ${amount}
+						WHERE "trackingCounter"."organizationId" = ${organizationId}
+							AND "trackingCounter"."value" + ${amount} <= ${limit}
+					RETURNING "value";
+				`,
+			);
 
 			return charged.length > 0;
 		} catch (error) {
@@ -36,11 +39,15 @@ export class TrackingCounterService {
 
 	async release(key: string, amount = 1): Promise<void> {
 		try {
-			await this.db.$executeRaw`
-				UPDATE "trackingCounter"
-				SET "value" = GREATEST("value" - ${amount}, 0)
-				WHERE "key" = ${key};
-			`;
+			const organizationId = currentOrganizationId();
+			await scopedTransaction(
+				(tx) =>
+					tx.$executeRaw`
+					UPDATE "trackingCounter"
+					SET "value" = GREATEST("value" - ${amount}, 0)
+					WHERE "organizationId" = ${organizationId} AND "key" = ${key};
+				`,
+			);
 		} catch (error) {
 			this.logger.error(
 				{ message: "Tracking counter could not be released" },
@@ -50,9 +57,11 @@ export class TrackingCounterService {
 	}
 
 	async sweep(): Promise<number> {
-		const removed = await this.db.trackingCounter.deleteMany({
-			where: { expiresAt: { lt: new Date() } },
-		});
+		const removed = await scopedTransaction((tx) =>
+			tx.trackingCounter.deleteMany({
+				where: { expiresAt: { lt: new Date() } },
+			}),
+		);
 
 		return removed.count;
 	}
diff --git a/apps/api/src/tracking/tracking-filing.service.ts b/apps/api/src/tracking/tracking-filing.service.ts
index 257307a62..7d29871a3 100644
--- a/apps/api/src/tracking/tracking-filing.service.ts
+++ b/apps/api/src/tracking/tracking-filing.service.ts
@@ -1,6 +1,7 @@
 import { workspaceDomains } from "@crm/auth";
-import { ActivityType, type Db, Prisma, RecordSource } from "@crm/db";
+import { ActivityType, Prisma, RecordSource } from "@crm/db";
 import type { Touch } from "@crm/db/attribution";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import {
 	CONTACT_CAP_REASON,
 	CONTACTS_PER_HOUR,
@@ -12,7 +13,7 @@ import { CompanyDirectoryService } from "../companies/company-directory.service"
 import { isMachineDomain } from "../companies/domain";
 import { ActivityStampService } from "../crm/activity-stamp.service";
 import { normalizeEmail } from "../crm/values";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import {
 	isAutomatedAddress,
 	isMachineAddress,
@@ -49,7 +50,7 @@ export class TrackingFilingService {
 	private readonly logger = new Logger(TrackingFilingService.name);
 
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly counters: TrackingCounterService,
 		private readonly companies: CompanyDirectoryService,
 		private readonly agent: AgentTriggerService,
@@ -210,7 +211,12 @@ export class TrackingFilingService {
 
 		await this.db.trackedVisitor.upsert({
 			where: { id: visitorId },
-			create: { id: visitorId, contactId, ...first, ...last },
+			create: {
+				id: visitorId,
+				contactId,
+				...first,
+				...last,
+			},
 			update: { contactId, ...last },
 		});
 	}
@@ -249,7 +255,7 @@ export class TrackingFilingService {
 				where: { email: { equals: email, mode: "insensitive" } },
 				select: { email: true },
 			}),
-			this.db.suppressedDomain.findUnique({
+			this.db.suppressedDomain.findFirst({
 				where: { domain },
 				select: { domain: true },
 			}),
diff --git a/apps/api/src/tracking/tracking-ingest.service.ts b/apps/api/src/tracking/tracking-ingest.service.ts
index e4f265b1a..5fbee6a96 100644
--- a/apps/api/src/tracking/tracking-ingest.service.ts
+++ b/apps/api/src/tracking/tracking-ingest.service.ts
@@ -1,5 +1,5 @@
-import type { Db } from "@crm/db";
 import { classifyTouch, type RawTouch, type Touch } from "@crm/db/attribution";
+import type { ScopedDb } from "@crm/db/tenant-scope";
 import {
 	dedupeKey,
 	EVENTS_PER_MINUTE,
@@ -15,7 +15,7 @@ import {
 import { Injectable, Logger } from "@nestjs/common";
 import { z } from "zod";
 import { normalizeEmail } from "../crm/values";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import { TrackingConfigService } from "./tracking-config.service";
 import { TrackingCounterService } from "./tracking-counter.service";
 import { TrackingFilingService } from "./tracking-filing.service";
@@ -79,7 +79,7 @@ export class TrackingIngestService {
 	private readonly logger = new Logger(TrackingIngestService.name);
 
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly config: TrackingConfigService,
 		private readonly counters: TrackingCounterService,
 		private readonly filing: TrackingFilingService,
diff --git a/apps/api/src/tracking/tracking-retention.config.ts b/apps/api/src/tracking/tracking-retention.config.ts
new file mode 100644
index 000000000..582b44d51
--- /dev/null
+++ b/apps/api/src/tracking/tracking-retention.config.ts
@@ -0,0 +1,6 @@
+export const TRACKING_RETENTION = {
+	sweep: {
+		batchSize: 10_000,
+		maxPasses: 50,
+	},
+} as const;
diff --git a/apps/api/src/tracking/tracking-retention.service.ts b/apps/api/src/tracking/tracking-retention.service.ts
new file mode 100644
index 000000000..59589f90a
--- /dev/null
+++ b/apps/api/src/tracking/tracking-retention.service.ts
@@ -0,0 +1,110 @@
+import { type Db, type Prisma } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedTransaction } from "@crm/db/tenant-scope";
+import { organizationIds } from "@crm/db/tenants";
+import { Injectable } from "@nestjs/common";
+import { InjectDatabase } from "../database/database.constants";
+import { TrackingCounterService } from "./tracking-counter.service";
+import { TRACKING_RETENTION } from "./tracking-retention.config";
+import { TrackingRollupService } from "./tracking-rollup.service";
+
+export type TrackingRetentionOutcome = {
+	rolled: number;
+	removed: number;
+	complete: boolean;
+	visitors: number;
+	counters: number;
+};
+
+@Injectable()
+export class TrackingRetentionService {
+	constructor(
+		@InjectDatabase() private readonly db: Db,
+		private readonly rollups: TrackingRollupService,
+		private readonly counters: TrackingCounterService,
+	) {}
+
+	async run(before: Date): Promise<TrackingRetentionOutcome> {
+		const organizations = await organizationIds(this.db);
+		const outcome: TrackingRetentionOutcome = {
+			rolled: 0,
+			removed: 0,
+			complete: true,
+			visitors: 0,
+			counters: 0,
+		};
+
+		for (const organizationId of organizations) {
+			const tenant = await runInTenant(organizationId, async () => {
+				const rolled = await this.rollups.run(before);
+				const events = await this.sweepEvents(before);
+				const visitors = await this.sweepVisitors(before);
+				const counters = await this.counters.sweep();
+
+				return {
+					rolled,
+					removed: events.removed,
+					complete: events.complete,
+					visitors,
+					counters,
+				};
+			});
+
+			outcome.rolled += tenant.rolled;
+			outcome.removed += tenant.removed;
+			outcome.complete = outcome.complete && tenant.complete;
+			outcome.visitors += tenant.visitors;
+			outcome.counters += tenant.counters;
+		}
+
+		return outcome;
+	}
+
+	private async sweepEvents(
+		before: Date,
+	): Promise<{ removed: number; complete: boolean }> {
+		return scopedTransaction(async (tx) => {
+			let removed = 0;
+
+			for (let pass = 0; pass < TRACKING_RETENTION.sweep.maxPasses; pass += 1) {
+				const deleted = await this.deleteEvents(tx, before);
+
+				removed += deleted;
+				if (deleted < TRACKING_RETENTION.sweep.batchSize) {
+					return { removed, complete: true };
+				}
+			}
+
+			return { removed, complete: false };
+		});
+	}
+
+	private async deleteEvents(
+		tx: Prisma.TransactionClient,
+		before: Date,
+	): Promise<number> {
+		return tx.$executeRaw`
+			DELETE FROM "trackedEvent"
+			WHERE "id" IN (
+				SELECT "id" FROM "trackedEvent"
+				WHERE "occurredAt" < ${before}
+				LIMIT ${TRACKING_RETENTION.sweep.batchSize}
+			);
+		`;
+	}
+
+	private async sweepVisitors(before: Date): Promise<number> {
+		return scopedTransaction(
+			(tx) =>
+				tx.$executeRaw`
+					DELETE FROM "trackedVisitor"
+					WHERE "contactId" IS NULL
+						AND "lastSeen" < ${before}
+						AND NOT EXISTS (
+							SELECT 1 FROM "trackedEvent"
+							WHERE "trackedEvent"."visitorId" = "trackedVisitor"."id"
+						);
+				`,
+		);
+	}
+}
diff --git a/apps/api/src/tracking/tracking-rollup.service.ts b/apps/api/src/tracking/tracking-rollup.service.ts
index c30e2413a..dc01aecdb 100644
--- a/apps/api/src/tracking/tracking-rollup.service.ts
+++ b/apps/api/src/tracking/tracking-rollup.service.ts
@@ -1,27 +1,29 @@
-import type { Db } from "@crm/db";
+import { scopedTransaction } from "@crm/db/tenant-scope";
 import { Injectable } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
 
 @Injectable()
 export class TrackingRollupService {
-	constructor(@InjectDatabase() private readonly db: Db) {}
-
 	async run(before: Date): Promise<number> {
-		const rolled = await this.db.$executeRaw`
-			INSERT INTO "trackedPageDaily" ("day", "host", "path", "views", "visitors")
-			SELECT
-				date_trunc('day', "occurredAt") AS "day",
-				"host",
-				"path",
-				count(*)::int AS "views",
-				count(DISTINCT "visitorId")::int AS "visitors"
-			FROM "trackedEvent"
-			WHERE "occurredAt" < ${before} AND "type" = 'page_view'
-			GROUP BY 1, 2, 3
-			ON CONFLICT ("day", "host", "path") DO UPDATE
-			SET "views" = GREATEST("trackedPageDaily"."views", EXCLUDED."views"),
-				"visitors" = GREATEST("trackedPageDaily"."visitors", EXCLUDED."visitors");
-		`;
+		const rolled = await scopedTransaction(
+			(tx) =>
+				tx.$executeRaw`
+				INSERT INTO "trackedPageDaily" ("organizationId", "day", "host", "path", "views", "visitors")
+				SELECT
+					"organizationId",
+					date_trunc('day', "occurredAt") AS "day",
+					"host",
+					"path",
+					count(*)::int AS "views",
+					count(DISTINCT "visitorId")::int AS "visitors"
+				FROM "trackedEvent"
+				WHERE "occurredAt" < ${before}
+					AND "type" = 'page_view'
+				GROUP BY 1, 2, 3, 4
+				ON CONFLICT ("organizationId", "day", "host", "path") DO UPDATE
+				SET "views" = GREATEST("trackedPageDaily"."views", EXCLUDED."views"),
+					"visitors" = GREATEST("trackedPageDaily"."visitors", EXCLUDED."visitors");
+			`,
+		);
 
 		return rolled;
 	}
diff --git a/apps/api/src/tracking/tracking-site-locator.service.ts b/apps/api/src/tracking/tracking-site-locator.service.ts
new file mode 100644
index 000000000..8b2339a1a
--- /dev/null
+++ b/apps/api/src/tracking/tracking-site-locator.service.ts
@@ -0,0 +1,20 @@
+import type { Db } from "@crm/db";
+import { isSiteId } from "@crm/db/tracking";
+import { Injectable } from "@nestjs/common";
+import { InjectDatabase } from "../database/database.constants";
+
+@Injectable()
+export class TrackingSiteLocatorService {
+	constructor(@InjectDatabase() private readonly db: Db) {}
+
+	async resolve(siteId: string): Promise<string | null> {
+		if (!isSiteId(siteId)) return null;
+
+		const site = await this.db.trackingSiteLocator.findUnique({
+			where: { siteId },
+			select: { organizationId: true },
+		});
+
+		return site?.organizationId ?? null;
+	}
+}
diff --git a/apps/api/src/tracking/tracking.controller.ts b/apps/api/src/tracking/tracking.controller.ts
index 2a3603e79..3af41b826 100644
--- a/apps/api/src/tracking/tracking.controller.ts
+++ b/apps/api/src/tracking/tracking.controller.ts
@@ -1,5 +1,5 @@
 import type { IncomingMessage } from "node:http";
-import type { Db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
 import {
 	EVENT_RETENTION_DAYS,
 	isSiteId,
@@ -34,18 +34,13 @@ import { AllowAnonymous } from "@thallesp/nestjs-better-auth";
 import type { Response } from "express";
 import { z } from "zod";
 import type { EnvironmentVariables } from "../config/env.validation";
-import { InjectDatabase } from "../database/database.constants";
 import { TrackingConfigService } from "./tracking-config.service";
-import { TrackingCounterService } from "./tracking-counter.service";
 import {
 	type IncomingBatch,
 	TrackingIngestService,
 } from "./tracking-ingest.service";
-import { TrackingRollupService } from "./tracking-rollup.service";
-
-const SWEEP_BATCH = 10_000;
-
-const MAX_SWEEP_PASSES = 50;
+import { TrackingRetentionService } from "./tracking-retention.service";
+import { TrackingSiteLocatorService } from "./tracking-site-locator.service";
 
 const parsedBody = z
 	.union([
@@ -65,6 +60,7 @@ export class TrackingController {
 	private readonly logger = new Logger(TrackingController.name);
 
 	constructor(
+		private readonly locator: TrackingSiteLocatorService,
 		private readonly config: TrackingConfigService,
 		private readonly ingest: TrackingIngestService,
 	) {}
@@ -117,12 +113,16 @@ export class TrackingController {
 		}
 
 		if (!isSiteId(batch?.siteId) || !Array.isArray(batch?.events)) return;
+		const organizationId = await this.locator.resolve(batch.siteId);
+		if (!organizationId) return;
 
 		try {
-			await this.ingest.accept(batch, {
-				origin: origin ?? null,
-				userAgent: userAgent ?? null,
-			});
+			await runInTenant(organizationId, () =>
+				this.ingest.accept(batch, {
+					origin: origin ?? null,
+					userAgent: userAgent ?? null,
+				}),
+			);
 		} catch (error) {
 			this.logger.error(
 				{ message: "Tracking event was not stored" },
@@ -146,9 +146,7 @@ export class TrackingRetentionController {
 	private readonly secret: string | undefined;
 
 	constructor(
-		@InjectDatabase() private readonly db: Db,
-		private readonly rollups: TrackingRollupService,
-		private readonly counters: TrackingCounterService,
+		private readonly retention: TrackingRetentionService,
 		config: ConfigService<EnvironmentVariables, true>,
 	) {
 		this.secret = config.get("CRON_SECRET", { infer: true });
@@ -187,10 +185,8 @@ export class TrackingRetentionController {
 			new Date(Date.now() - EVENT_RETENTION_DAYS * 24 * 60 * 60_000),
 		);
 
-		const rolled = await this.rollups.run(before);
-		const { removed, complete } = await this.sweepEvents(before);
-		const visitors = await this.sweepVisitors(before);
-		const counters = await this.counters.sweep();
+		const { rolled, removed, complete, visitors, counters } =
+			await this.retention.run(before);
 
 		if (!complete) {
 			this.logger.warn({
@@ -213,42 +209,6 @@ export class TrackingRetentionController {
 
 		return { rolled, removed, complete, visitors, counters };
 	}
-
-	private async sweepEvents(
-		before: Date,
-	): Promise<{ removed: number; complete: boolean }> {
-		let removed = 0;
-
-		for (let pass = 0; pass < MAX_SWEEP_PASSES; pass += 1) {
-			const deleted = await this.db.$executeRaw`
-				DELETE FROM "trackedEvent"
-				WHERE "id" IN (
-					SELECT "id" FROM "trackedEvent"
-					WHERE "occurredAt" < ${before}
-					LIMIT ${SWEEP_BATCH}
-				);
-			`;
-
-			removed += deleted;
-			if (deleted < SWEEP_BATCH) return { removed, complete: true };
-		}
-
-		return { removed, complete: false };
-	}
-
-	private async sweepVisitors(before: Date): Promise<number> {
-		const orphaned = await this.db.$executeRaw`
-			DELETE FROM "trackedVisitor"
-			WHERE "contactId" IS NULL
-				AND "lastSeen" < ${before}
-				AND NOT EXISTS (
-					SELECT 1 FROM "trackedEvent"
-					WHERE "trackedEvent"."visitorId" = "trackedVisitor"."id"
-				);
-		`;
-
-		return orphaned;
-	}
 }
 
 async function read(
diff --git a/apps/api/src/tracking/tracking.module.ts b/apps/api/src/tracking/tracking.module.ts
index d462dab51..ae0570ab4 100644
--- a/apps/api/src/tracking/tracking.module.ts
+++ b/apps/api/src/tracking/tracking.module.ts
@@ -12,7 +12,9 @@ import { TrackingConfigService } from "./tracking-config.service";
 import { TrackingCounterService } from "./tracking-counter.service";
 import { TrackingFilingService } from "./tracking-filing.service";
 import { TrackingIngestService } from "./tracking-ingest.service";
+import { TrackingRetentionService } from "./tracking-retention.service";
 import { TrackingRollupService } from "./tracking-rollup.service";
+import { TrackingSiteLocatorService } from "./tracking-site-locator.service";
 
 @Module({
 	imports: [TrpcModule, AgentModule, CompaniesModule],
@@ -22,7 +24,9 @@ import { TrackingRollupService } from "./tracking-rollup.service";
 		TrackingCounterService,
 		TrackingFilingService,
 		TrackingIngestService,
+		TrackingRetentionService,
 		TrackingRollupService,
+		TrackingSiteLocatorService,
 		TrackingService,
 		TrackingRouter,
 	],
diff --git a/apps/api/src/tracking/tracking.service.ts b/apps/api/src/tracking/tracking.service.ts
index 7b67416cb..e4e9823e7 100644
--- a/apps/api/src/tracking/tracking.service.ts
+++ b/apps/api/src/tracking/tracking.service.ts
@@ -2,13 +2,13 @@ import {
 	appUrl,
 	canManageTracking,
 	isWorkspaceRole,
-	WORKSPACE_ID,
 	type WorkspaceRole,
 } from "@crm/auth";
-import { type Db, DomainScope, Prisma } from "@crm/db";
+import { DomainScope, Prisma } from "@crm/db";
 import { describeTouch } from "@crm/db/attribution";
 import { safeFetch } from "@crm/db/safe-fetch";
-import { SETTINGS_ID } from "@crm/db/settings";
+import { currentOrganizationId } from "@crm/db/tenant-context";
+import { type ScopedDb, scopedTransaction } from "@crm/db/tenant-scope";
 import {
 	COOKIE_LIFETIMES,
 	gtmContainers,
@@ -29,7 +29,7 @@ import {
 	Injectable,
 	NotFoundException,
 } from "@nestjs/common";
-import { InjectDatabase } from "../database/database.constants";
+import { InjectScopedDatabase } from "../database/database.constants";
 import type {
 	FoundInContainer,
 	SourceRow,
@@ -37,7 +37,6 @@ import type {
 	TrackedDomainRow,
 	TrackingSettings,
 	VerifyResult,
-	VisitedPage,
 	WebsiteActivity,
 } from "./tracking.contracts";
 import { TrackingConfigService } from "./tracking-config.service";
@@ -45,14 +44,14 @@ import { TrackingConfigService } from "./tracking-config.service";
 @Injectable()
 export class TrackingService {
 	constructor(
-		@InjectDatabase() private readonly db: Db,
+		@InjectScopedDatabase() private readonly db: ScopedDb,
 		private readonly config: TrackingConfigService,
 	) {}
 
 	async settings(userId: string): Promise<TrackingSettings> {
 		const [row, domains, latest, pageViews, submissions] = await Promise.all([
 			this.db.appSetting.findUnique({
-				where: { id: SETTINGS_ID },
+				where: { organizationId: currentOrganizationId() },
 				select: {
 					trackingSiteId: true,
 					trackingCrossDomain: true,
@@ -133,8 +132,8 @@ export class TrackingService {
 		}[flag];
 
 		await this.db.appSetting.upsert({
-			where: { id: SETTINGS_ID },
-			create: { id: SETTINGS_ID, [column]: enabled },
+			where: { organizationId: currentOrganizationId() },
+			create: { [column]: enabled },
 			update: { [column]: enabled },
 		});
 
@@ -149,8 +148,8 @@ export class TrackingService {
 		}
 
 		await this.db.appSetting.upsert({
-			where: { id: SETTINGS_ID },
-			create: { id: SETTINGS_ID, trackingCookieDays: days },
+			where: { organizationId: currentOrganizationId() },
+			create: { trackingCookieDays: days },
 			update: { trackingCookieDays: days },
 		});
 
@@ -172,7 +171,10 @@ export class TrackingService {
 
 		try {
 			const domain = await this.db.trackedDomain.create({
-				data: { host, scope: input.scope },
+				data: {
+					host,
+					scope: input.scope,
+				},
 			});
 
 			await this.config.invalidate();
@@ -226,7 +228,7 @@ export class TrackingService {
 
 		const domains = await this.db.trackedDomain.count();
 		const row = await this.db.appSetting.findUnique({
-			where: { id: SETTINGS_ID },
+			where: { organizationId: currentOrganizationId() },
 			select: { trackingLimitToDomains: true },
 		});
 
@@ -418,59 +420,67 @@ export class TrackingService {
 	}
 
 	async sources(userId: string): Promise<SourceRow[]> {
-		await this.assertCanManage(userId);
-
-		const [views, contacts] = await Promise.all([
-			this.db.trackedEvent.groupBy({
-				by: ["source", "medium"],
-				where: { type: "page_view", source: { not: null } },
-				_count: { _all: true },
-			}),
-			this.db.$queryRaw<
-				{ firstSource: string; firstMedium: string | null; contacts: bigint }[]
-			>`
-				SELECT "firstSource", "firstMedium", count(DISTINCT "contactId") AS contacts
-				FROM "trackedVisitor"
-				WHERE "contactId" IS NOT NULL AND "firstSource" IS NOT NULL
-				GROUP BY 1, 2;
-			`,
-		]);
-
-		const rows = new Map<string, SourceRow>();
-
-		for (const row of views) {
-			if (!row.source) continue;
-			const key = `${row.source}|${row.medium ?? ""}`;
-			rows.set(key, {
-				source: row.source,
-				medium: row.medium,
-				views: row._count._all,
-				contacts: 0,
-			});
-		}
-
-		for (const row of contacts) {
-			if (!row.firstSource) continue;
-			const key = `${row.firstSource}|${row.firstMedium ?? ""}`;
-			const existing = rows.get(key);
-			const count = Number(row.contacts);
-
-			if (existing) {
-				existing.contacts = count;
-				continue;
+		return scopedTransaction(async (tx) => {
+			await this.assertCanManage(userId);
+			const [views, contacts] = await Promise.all([
+				tx.trackedEvent.groupBy({
+					by: ["source", "medium"],
+					where: {
+						type: "page_view",
+						source: { not: null },
+					},
+					_count: { _all: true },
+				}),
+				tx.$queryRaw<
+					{
+						firstSource: string;
+						firstMedium: string | null;
+						contacts: bigint;
+					}[]
+				>`
+					SELECT "firstSource", "firstMedium", count(DISTINCT "contactId") AS contacts
+					FROM "trackedVisitor"
+					WHERE "contactId" IS NOT NULL AND "firstSource" IS NOT NULL
+					GROUP BY 1, 2;
+				`,
+			]);
+
+			const rows = new Map<string, SourceRow>();
+
+			for (const row of views) {
+				if (!row.source) continue;
+				const key = `${row.source}|${row.medium ?? ""}`;
+				rows.set(key, {
+					source: row.source,
+					medium: row.medium,
+					views: row._count._all,
+					contacts: 0,
+				});
 			}
 
-			rows.set(key, {
-				source: row.firstSource,
-				medium: row.firstMedium,
-				views: 0,
-				contacts: count,
-			});
-		}
+			for (const row of contacts) {
+				if (!row.firstSource) continue;
+				const key = `${row.firstSource}|${row.firstMedium ?? ""}`;
+				const existing = rows.get(key);
+				const count = Number(row.contacts);
+
+				if (existing) {
+					existing.contacts = count;
+					continue;
+				}
+
+				rows.set(key, {
+					source: row.firstSource,
+					medium: row.firstMedium,
+					views: 0,
+					contacts: count,
+				});
+			}
 
-		return [...rows.values()]
-			.sort((a, b) => b.contacts - a.contacts || b.views - a.views)
-			.slice(0, 20);
+			return [...rows.values()]
+				.sort((a, b) => b.contacts - a.contacts || b.views - a.views)
+				.slice(0, 20);
+		});
 	}
 
 	private async assertCanManage(userId: string): Promise<void> {
@@ -483,7 +493,7 @@ export class TrackingService {
 
 	private async roleOf(userId: string): Promise<WorkspaceRole | null> {
 		const member = await this.db.member.findFirst({
-			where: { organizationId: WORKSPACE_ID, userId },
+			where: { organizationId: currentOrganizationId(), userId },
 			select: { role: true },
 		});
 
diff --git a/apps/api/src/trpc/context.types.ts b/apps/api/src/trpc/context.types.ts
index 39b4c9ffd..1f4391d7d 100644
--- a/apps/api/src/trpc/context.types.ts
+++ b/apps/api/src/trpc/context.types.ts
@@ -1,11 +1,21 @@
 import type { Session, SessionUser } from "@crm/auth";
 import type { Request } from "express";
+import type { RequestPrincipal } from "../auth/request-principal";
 
 export type BaseTrpcContext = {
 	req?: Request;
+	principal: RequestPrincipal | null;
 	session: Session | null;
 };
 
+export type SessionTrpcContext = BaseTrpcContext & {
+	session: Session;
+	user: SessionUser;
+	principal: RequestPrincipal;
+};
+
 export type AuthedTrpcContext = BaseTrpcContext & {
 	user: SessionUser;
+	principal: RequestPrincipal;
+	organizationId: string;
 };
diff --git a/apps/api/src/trpc/middlewares/auth.middleware.ts b/apps/api/src/trpc/middlewares/auth.middleware.ts
index a76be83bd..7c01c6273 100644
--- a/apps/api/src/trpc/middlewares/auth.middleware.ts
+++ b/apps/api/src/trpc/middlewares/auth.middleware.ts
@@ -1,3 +1,5 @@
+import type { Db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
 import { Injectable } from "@nestjs/common";
 import { TRPCError } from "@trpc/server";
 import type {
@@ -5,22 +7,73 @@ import type {
 	MiddlewareResponse,
 	TRPCMiddleware,
 } from "nestjs-trpc";
+import { InjectDatabase } from "../../database/database.constants";
 import { setRequestUserId } from "../../logging/request-context";
-import type { AuthedTrpcContext, BaseTrpcContext } from "../context.types";
+import type {
+	AuthedTrpcContext,
+	BaseTrpcContext,
+	SessionTrpcContext,
+} from "../context.types";
+
+function authenticatedSession(ctx: BaseTrpcContext): SessionTrpcContext {
+	const session = ctx.session;
+	const principal = ctx.principal;
+	if (!session || !principal || principal.credentialKind !== "session") {
+		throw new TRPCError({ code: "UNAUTHORIZED" });
+	}
+
+	setRequestUserId(principal.user.id);
+	return { ...ctx, principal, session, user: principal.user };
+}
+
+@Injectable()
+export class SessionMiddleware implements TRPCMiddleware {
+	async use(opts: MiddlewareOptions): Promise<MiddlewareResponse> {
+		return opts.next({
+			ctx: authenticatedSession(opts.ctx as BaseTrpcContext),
+		});
+	}
+}
 
 @Injectable()
 export class AuthMiddleware implements TRPCMiddleware {
+	constructor(@InjectDatabase() private readonly db: Db) {}
+
 	async use(opts: MiddlewareOptions): Promise<MiddlewareResponse> {
 		const ctx = opts.ctx as BaseTrpcContext;
-		const user = ctx.session?.user;
-
-		if (!user) {
+		const principal = ctx.principal;
+		if (!principal) {
 			throw new TRPCError({ code: "UNAUTHORIZED" });
 		}
 
+		const user = principal.user;
 		setRequestUserId(user.id);
 
-		const nextCtx: AuthedTrpcContext = { ...ctx, user };
-		return opts.next({ ctx: nextCtx });
+		const organizationId = principal.organizationId;
+		if (!organizationId) {
+			throw new TRPCError({
+				code: "FORBIDDEN",
+				message: "You have no active organization.",
+			});
+		}
+
+		const membership = await this.db.member.findUnique({
+			where: { organizationId_userId: { organizationId, userId: user.id } },
+			select: { id: true },
+		});
+		if (!membership) {
+			throw new TRPCError({
+				code: "FORBIDDEN",
+				message: "You are not a member of the active organization.",
+			});
+		}
+
+		const nextCtx: AuthedTrpcContext = {
+			...ctx,
+			principal,
+			user,
+			organizationId,
+		};
+		return runInTenant(organizationId, () => opts.next({ ctx: nextCtx }));
 	}
 }
diff --git a/apps/api/src/trpc/middlewares/domain-error.middleware.ts b/apps/api/src/trpc/middlewares/domain-error.middleware.ts
index 2b7bf7fb5..54352a84b 100644
--- a/apps/api/src/trpc/middlewares/domain-error.middleware.ts
+++ b/apps/api/src/trpc/middlewares/domain-error.middleware.ts
@@ -13,6 +13,8 @@ type TrpcErrorCode =
 	| "NOT_FOUND"
 	| "CONFLICT"
 	| "TOO_MANY_REQUESTS"
+	| "PAYLOAD_TOO_LARGE"
+	| "SERVICE_UNAVAILABLE"
 	| "INTERNAL_SERVER_ERROR";
 
 function statusToTrpcCode(status: number): TrpcErrorCode {
@@ -29,6 +31,10 @@ function statusToTrpcCode(status: number): TrpcErrorCode {
 			return "CONFLICT";
 		case 429:
 			return "TOO_MANY_REQUESTS";
+		case 413:
+			return "PAYLOAD_TOO_LARGE";
+		case 503:
+			return "SERVICE_UNAVAILABLE";
 		default:
 			return "INTERNAL_SERVER_ERROR";
 	}
@@ -50,6 +56,7 @@ export class DomainErrorMiddleware implements TRPCMiddleware {
 			throw new TRPCError({
 				code: statusToTrpcCode(cause.getStatus()),
 				message: cause.message,
+				cause,
 			});
 		}
 
diff --git a/apps/api/src/trpc/middlewares/oauth-scope.middleware.ts b/apps/api/src/trpc/middlewares/oauth-scope.middleware.ts
new file mode 100644
index 000000000..dd27aa6af
--- /dev/null
+++ b/apps/api/src/trpc/middlewares/oauth-scope.middleware.ts
@@ -0,0 +1,30 @@
+import { oauthScopeFailure, requiredCrmScope } from "@crm/auth";
+import { Injectable } from "@nestjs/common";
+import { TRPCError } from "@trpc/server";
+import type {
+	MiddlewareOptions,
+	MiddlewareResponse,
+	TRPCMiddleware,
+} from "nestjs-trpc";
+import type { BaseTrpcContext } from "../context.types";
+
+@Injectable()
+export class OAuthScopeMiddleware implements TRPCMiddleware {
+	async use(opts: MiddlewareOptions): Promise<MiddlewareResponse> {
+		const ctx = opts.ctx as BaseTrpcContext;
+		const principal = ctx.principal;
+		if (principal?.credentialKind !== "oauth") return opts.next();
+
+		const requiredScope = requiredCrmScope(opts.type === "mutation");
+		const failure = oauthScopeFailure(principal.scopes, requiredScope);
+		if (failure) {
+			ctx.req?.res?.setHeader("WWW-Authenticate", failure.challenge);
+			throw new TRPCError({
+				code: "FORBIDDEN",
+				message: failure.message,
+			});
+		}
+
+		return opts.next();
+	}
+}
diff --git a/apps/api/src/trpc/middlewares/session-only.middleware.ts b/apps/api/src/trpc/middlewares/session-only.middleware.ts
index 1216ad998..2ebddc477 100644
--- a/apps/api/src/trpc/middlewares/session-only.middleware.ts
+++ b/apps/api/src/trpc/middlewares/session-only.middleware.ts
@@ -1,4 +1,3 @@
-import { API_KEY_HEADER } from "@crm/auth";
 import { Injectable } from "@nestjs/common";
 import { TRPCError } from "@trpc/server";
 import type {
@@ -12,7 +11,7 @@ import type { BaseTrpcContext } from "../context.types";
 export class SessionOnlyMiddleware implements TRPCMiddleware {
 	async use(opts: MiddlewareOptions): Promise<MiddlewareResponse> {
 		const ctx = opts.ctx as BaseTrpcContext;
-		if (ctx.req?.headers[API_KEY_HEADER]) {
+		if (ctx.principal?.credentialKind !== "session") {
 			throw new TRPCError({ code: "UNAUTHORIZED" });
 		}
 		return opts.next();
diff --git a/apps/api/src/trpc/openapi.ts b/apps/api/src/trpc/openapi.ts
index 7cca22ca0..87aaaa50f 100644
--- a/apps/api/src/trpc/openapi.ts
+++ b/apps/api/src/trpc/openapi.ts
@@ -1,7 +1,5 @@
 import type { OpenApiMeta } from "trpc-to-openapi";
 
-export const REST_BRIDGE_PATH = "/rest";
-
 export type RestMethod = "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
 
 export function restMeta(
diff --git a/apps/api/src/trpc/trpc.context.ts b/apps/api/src/trpc/trpc.context.ts
index 873d5a801..e811248dd 100644
--- a/apps/api/src/trpc/trpc.context.ts
+++ b/apps/api/src/trpc/trpc.context.ts
@@ -1,25 +1,40 @@
-import { auth } from "@crm/auth";
 import { Injectable } from "@nestjs/common";
-import { fromNodeHeaders } from "better-auth/node";
+import { TRPCError } from "@trpc/server";
 import type { Request } from "express";
 import type { ContextOptions, TRPCContext } from "nestjs-trpc";
+import { RequestPrincipalError } from "../auth/request-principal";
+import { RequestPrincipalService } from "../auth/request-principal.service";
 import type { BaseTrpcContext } from "./context.types";
 
 export async function createBaseTrpcContext(
 	req: Request | undefined,
+	principals: RequestPrincipalService,
 ): Promise<BaseTrpcContext> {
-	const session = req
-		? await auth.api
-				.getSession({ headers: fromNodeHeaders(req.headers) })
-				.catch(() => null)
-		: null;
-	return { req, session };
+	try {
+		const principal = req ? await principals.resolve(req) : null;
+		return { req, principal, session: principal?.session ?? null };
+	} catch (error) {
+		if (!(error instanceof RequestPrincipalError)) throw error;
+		if (error.challenge)
+			req?.res?.setHeader("WWW-Authenticate", error.challenge);
+		throw new TRPCError({
+			code:
+				error.status === 400
+					? "BAD_REQUEST"
+					: error.status === 403
+						? "FORBIDDEN"
+						: "UNAUTHORIZED",
+			message: error.message,
+		});
+	}
 }
 
 @Injectable()
 export class TrpcContext implements TRPCContext {
+	constructor(private readonly principals: RequestPrincipalService) {}
+
 	async create(opts: ContextOptions): Promise<BaseTrpcContext> {
 		const req = "req" in opts ? opts.req : undefined;
-		return createBaseTrpcContext(req);
+		return createBaseTrpcContext(req, this.principals);
 	}
 }
diff --git a/apps/api/src/trpc/trpc.module.ts b/apps/api/src/trpc/trpc.module.ts
index a4ffa5602..0ea1dac87 100644
--- a/apps/api/src/trpc/trpc.module.ts
+++ b/apps/api/src/trpc/trpc.module.ts
@@ -2,9 +2,13 @@ import { Module } from "@nestjs/common";
 import { TRPCModule } from "nestjs-trpc";
 import { ContextLogger } from "../logging/context-logger";
 import { formatTrpcError } from "./error-formatter";
-import { AuthMiddleware } from "./middlewares/auth.middleware";
+import {
+	AuthMiddleware,
+	SessionMiddleware,
+} from "./middlewares/auth.middleware";
 import { DomainErrorMiddleware } from "./middlewares/domain-error.middleware";
 import { LoggingMiddleware } from "./middlewares/logging.middleware";
+import { OAuthScopeMiddleware } from "./middlewares/oauth-scope.middleware";
 import { SessionOnlyMiddleware } from "./middlewares/session-only.middleware";
 import { TrpcContext } from "./trpc.context";
 import { TrpcErrorHandler } from "./trpc-error.handler";
@@ -17,7 +21,11 @@ import { TrpcErrorHandler } from "./trpc-error.handler";
 			logger: new ContextLogger(),
 			errorFormatter: formatTrpcError,
 			onError: TrpcErrorHandler,
-			globalMiddlewares: [LoggingMiddleware, DomainErrorMiddleware],
+			globalMiddlewares: [
+				LoggingMiddleware,
+				DomainErrorMiddleware,
+				OAuthScopeMiddleware,
+			],
 		}),
 	],
 	providers: [
@@ -25,9 +33,11 @@ import { TrpcErrorHandler } from "./trpc-error.handler";
 		TrpcErrorHandler,
 		LoggingMiddleware,
 		DomainErrorMiddleware,
+		OAuthScopeMiddleware,
 		AuthMiddleware,
 		SessionOnlyMiddleware,
+		SessionMiddleware,
 	],
-	exports: [AuthMiddleware, SessionOnlyMiddleware],
+	exports: [AuthMiddleware, SessionMiddleware, SessionOnlyMiddleware],
 })
 export class TrpcModule {}
diff --git a/apps/api/src/workspace/workspace.contracts.ts b/apps/api/src/workspace/workspace.contracts.ts
index a3f50172b..2a7d97b63 100644
--- a/apps/api/src/workspace/workspace.contracts.ts
+++ b/apps/api/src/workspace/workspace.contracts.ts
@@ -1,5 +1,5 @@
 import { WORKSPACE_ROLES } from "@crm/auth";
-import { MAX_SLUG } from "@crm/db/workspace";
+import { MAX_SLUG } from "@crm/db/workspace-slug";
 import { z } from "zod";
 import { listInput } from "../trpc/list-input";
 
diff --git a/apps/api/src/workspace/workspace.router.ts b/apps/api/src/workspace/workspace.router.ts
index 1dddb91c9..12928657f 100644
--- a/apps/api/src/workspace/workspace.router.ts
+++ b/apps/api/src/workspace/workspace.router.ts
@@ -1,3 +1,4 @@
+import { workspaceGate } from "@crm/validation/workspace-gate";
 import { Inject } from "@nestjs/common";
 import {
 	Ctx,
@@ -8,8 +9,14 @@ import {
 	UseMiddlewares,
 } from "nestjs-trpc";
 import type { z } from "zod";
-import type { AuthedTrpcContext } from "../trpc/context.types";
-import { AuthMiddleware } from "../trpc/middlewares/auth.middleware";
+import type {
+	AuthedTrpcContext,
+	SessionTrpcContext,
+} from "../trpc/context.types";
+import {
+	AuthMiddleware,
+	SessionMiddleware,
+} from "../trpc/middlewares/auth.middleware";
 import { restMeta } from "../trpc/openapi";
 import {
 	memberListInput,
@@ -22,7 +29,6 @@ import {
 import { WorkspaceService } from "./workspace.service";
 
 @Router({ alias: "workspace" })
-@UseMiddlewares(AuthMiddleware)
 export class WorkspaceRouter {
 	constructor(
 		@Inject(WorkspaceService) private readonly workspace: WorkspaceService,
@@ -32,15 +38,26 @@ export class WorkspaceRouter {
 		output: workspaceOutput,
 		meta: restMeta("GET", "/workspace", ["Workspace"]),
 	})
+	@UseMiddlewares(AuthMiddleware)
 	async get(@Ctx() ctx: AuthedTrpcContext) {
 		return this.workspace.get(ctx.user.id);
 	}
 
+	@Query({ output: workspaceGate })
+	@UseMiddlewares(SessionMiddleware)
+	async gate(@Ctx() ctx: SessionTrpcContext) {
+		return this.workspace.gate(
+			ctx.user.id,
+			ctx.session.session.activeOrganizationId,
+		);
+	}
+
 	@Query({
 		input: memberListInput,
 		output: memberListOutput,
 		meta: restMeta("POST", "/workspace/members/search", ["Workspace"]),
 	})
+	@UseMiddlewares(AuthMiddleware)
 	async members(
 		@Ctx() ctx: AuthedTrpcContext,
 		@Input() input: z.infer<typeof memberListInput>,
@@ -53,6 +70,7 @@ export class WorkspaceRouter {
 		output: workspaceOutput,
 		meta: restMeta("PATCH", "/workspace", ["Workspace"]),
 	})
+	@UseMiddlewares(AuthMiddleware)
 	async update(
 		@Ctx() ctx: AuthedTrpcContext,
 		@Input() input: z.infer<typeof updateWorkspaceInput>,
@@ -67,6 +85,7 @@ export class WorkspaceRouter {
 			"Workspace",
 		]),
 	})
+	@UseMiddlewares(AuthMiddleware)
 	async setMemberRole(
 		@Ctx() ctx: AuthedTrpcContext,
 		@Input() input: z.infer<typeof setMemberRoleInput>,
diff --git a/apps/api/src/workspace/workspace.service.ts b/apps/api/src/workspace/workspace.service.ts
index 65cc99ab6..a211096e5 100644
--- a/apps/api/src/workspace/workspace.service.ts
+++ b/apps/api/src/workspace/workspace.service.ts
@@ -1,14 +1,15 @@
 import {
+	activeWorkspaceRoleOf,
 	canChangeRole,
 	canRenameWorkspace,
-	ensureWorkspaceMembership,
 	isWorkspaceRole,
-	WORKSPACE_ID,
 	type WorkspaceRole,
-	workspaceRoleOf,
 } from "@crm/auth";
 import type { Db, Prisma } from "@crm/db";
-import { isOnboarded, markOnboarded, workspaceSlug } from "@crm/db/workspace";
+import { currentOrganizationId } from "@crm/db/tenant-context";
+import { isOnboarded, markOnboarded } from "@crm/db/workspace";
+import { workspaceSlug } from "@crm/db/workspace-slug";
+import type { WorkspaceGate } from "@crm/validation/workspace-gate";
 import {
 	BadRequestException,
 	ForbiddenException,
@@ -35,6 +36,12 @@ import type {
 	WorkspaceMember,
 } from "./workspace.contracts";
 
+const NO_WORKSPACE_GATE: WorkspaceGate = {
+	organizationId: null,
+	slug: null,
+	onboarded: null,
+	canRename: null,
+};
 const MEMBER_SELECT = {
 	id: true,
 	role: true,
@@ -66,12 +73,7 @@ export class WorkspaceService {
 	) {}
 
 	async get(userId: string): Promise<Workspace> {
-		let row = await this.readWorkspace();
-
-		if (!row) {
-			await ensureWorkspaceMembership(userId);
-			row = await this.readWorkspace();
-		}
+		const row = await this.readWorkspace();
 
 		if (!row) {
 			throw new ServiceUnavailableException(
@@ -79,7 +81,7 @@ export class WorkspaceService {
 			);
 		}
 
-		const role = await workspaceRoleOf(userId);
+		const role = await activeWorkspaceRoleOf(userId);
 
 		return {
 			id: row.id,
@@ -93,11 +95,45 @@ export class WorkspaceService {
 		};
 	}
 
+	async gate(
+		userId: string,
+		activeOrganizationId: string | null,
+	): Promise<WorkspaceGate> {
+		if (!activeOrganizationId) {
+			return NO_WORKSPACE_GATE;
+		}
+
+		const member = await this.db.member.findUnique({
+			where: {
+				organizationId_userId: {
+					organizationId: activeOrganizationId,
+					userId,
+				},
+			},
+			select: {
+				role: true,
+				organization: { select: { slug: true, metadata: true } },
+			},
+		});
+
+		if (!member) {
+			return NO_WORKSPACE_GATE;
+		}
+
+		const role = toRole(member.role);
+		return {
+			organizationId: activeOrganizationId,
+			slug: member.organization.slug,
+			onboarded: isOnboarded(member.organization.metadata),
+			canRename: canRenameWorkspace(role),
+		};
+	}
+
 	async update(
 		userId: string,
 		input: UpdateWorkspaceInput,
 	): Promise<Workspace> {
-		const role = await workspaceRoleOf(userId);
+		const role = await activeWorkspaceRoleOf(userId);
 
 		if (!canRenameWorkspace(role)) {
 			throw new ForbiddenException(
@@ -106,7 +142,7 @@ export class WorkspaceService {
 		}
 
 		const before = await this.db.organization.findUnique({
-			where: { id: WORKSPACE_ID },
+			where: { id: currentOrganizationId() },
 			select: { website: true, metadata: true },
 		});
 
@@ -119,7 +155,7 @@ export class WorkspaceService {
 		}
 
 		await this.db.organization.update({
-			where: { id: WORKSPACE_ID },
+			where: { id: currentOrganizationId() },
 			data: {
 				name: input.name,
 				slug: workspaceSlug(input.slug ?? input.name),
@@ -176,7 +212,7 @@ export class WorkspaceService {
 		userId: string,
 		input: SetMemberRoleInput,
 	): Promise<WorkspaceMember> {
-		const role = await workspaceRoleOf(userId);
+		const role = await activeWorkspaceRoleOf(userId);
 
 		if (!canChangeRole(role)) {
 			throw new ForbiddenException(
@@ -186,7 +222,7 @@ export class WorkspaceService {
 
 		const updated = await this.db.$transaction(async (tx) => {
 			const target = await tx.member.findFirst({
-				where: { id: input.memberId, organizationId: WORKSPACE_ID },
+				where: { id: input.memberId, organizationId: currentOrganizationId() },
 				select: { id: true, role: true },
 			});
 
@@ -197,7 +233,7 @@ export class WorkspaceService {
 			if (target.role === "owner" && input.role !== "owner") {
 				const owners = await tx.$queryRaw<{ id: string }[]>`
 					SELECT id FROM "member"
-					WHERE "organizationId" = ${WORKSPACE_ID} AND role = 'owner'
+					WHERE "organizationId" = ${currentOrganizationId()} AND role = 'owner'
 					FOR UPDATE
 				`;
 
@@ -240,7 +276,9 @@ export class WorkspaceService {
 
 	private searchWhere(q: string): Prisma.MemberWhereInput {
 		const term = q.trim();
-		const where: Prisma.MemberWhereInput = { organizationId: WORKSPACE_ID };
+		const where: Prisma.MemberWhereInput = {
+			organizationId: currentOrganizationId(),
+		};
 
 		if (term) {
 			where.user = {
@@ -266,7 +304,7 @@ export class WorkspaceService {
 
 	private async readWorkspace() {
 		return this.db.organization.findUnique({
-			where: { id: WORKSPACE_ID },
+			where: { id: currentOrganizationId() },
 			select: {
 				id: true,
 				slug: true,
diff --git a/apps/api/test/agent-delete.spec.ts b/apps/api/test/agent-delete.spec.ts
index 9e9d599d7..b7f0ec075 100644
--- a/apps/api/test/agent-delete.spec.ts
+++ b/apps/api/test/agent-delete.spec.ts
@@ -1,22 +1,28 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { DEFAULT_WORKSPACE_NAME, WORKSPACE_ID } from "@crm/auth";
-import { db } from "@crm/db";
-import { workspaceSlug } from "@crm/db/workspace";
+import { afterAll, beforeAll, describe, expect } from "bun:test";
+import { db as globalDb } from "@crm/db";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound, tenantContext, tenantTest } from "@crm/db/test-support";
 import { AgentAccessService } from "../src/agent/agent-access.service";
 import { AgentDefinitionsService } from "../src/agent/agent-definitions.service";
 import { AgentTriggerService } from "../src/agent/agent-trigger.service";
+import { ensureTestWorkspace } from "./workspace.fixture";
 
+const WORKSPACE_ID = "agent-delete-spec-workspace";
+const DEFAULT_WORKSPACE_NAME = "Agent Delete Spec Workspace";
 const suffix = crypto.randomUUID();
 const userId = `agent-delete-user-${suffix}`;
 const memberId = `agent-delete-member-${suffix}`;
 const idempotencyPrefix = `agent-delete-${suffix}`;
+const it = tenantTest(WORKSPACE_ID);
 
-const access = new AgentAccessService(db);
-const agents = new AgentDefinitionsService(
-	db,
+const db = scopedDb;
+const access = new AgentAccessService(db as never);
+const rawAgents = new AgentDefinitionsService(
+	db as never,
 	access,
-	new AgentTriggerService(db),
+	new AgentTriggerService(db as never),
 );
+const agents = tenantBound(WORKSPACE_ID, rawAgents);
 
 let agentId: string;
 let versionId: string;
@@ -26,6 +32,8 @@ let waitingRunId: string;
 let runningRunId: string;
 let deliveryRunId: string;
 
+const inTenant = tenantContext(WORKSPACE_ID);
+
 async function clean() {
 	if (agentId) {
 		await db.agentRunEvent.deleteMany({ where: { run: { agentId } } });
@@ -42,142 +50,142 @@ async function clean() {
 	}
 
 	await db.member.deleteMany({ where: { id: memberId } });
-	await db.user.deleteMany({ where: { id: userId } });
+	await globalDb.user.deleteMany({ where: { id: userId } });
 }
 
-beforeAll(async () => {
-	await db.organization.upsert({
-		where: { id: WORKSPACE_ID },
-		update: {},
-		create: {
-			id: WORKSPACE_ID,
-			name: DEFAULT_WORKSPACE_NAME,
-			slug: workspaceSlug(DEFAULT_WORKSPACE_NAME),
-			createdAt: new Date(),
-		},
-	});
-	await db.user.create({
-		data: {
-			id: userId,
-			name: "Agent Delete Test",
-			email: `${userId}@example.test`,
-		},
-	});
-	await db.member.create({
-		data: {
-			id: memberId,
-			organizationId: WORKSPACE_ID,
-			userId,
-			role: "member",
-			createdAt: new Date(),
-		},
-	});
-
-	const agent = await db.agentDefinition.create({
-		data: {
-			name: "Delete me",
-			status: "PAUSED",
-			createdById: userId,
-		},
-		select: { id: true },
-	});
-	agentId = agent.id;
-
-	const version = await db.agentVersion.create({
-		data: {
-			agentId,
-			number: 1,
-			status: "DEPLOYED",
-			instructions: "Test deletion behavior.",
-			manifest: {},
-			modelId: "test/model",
-			sandboxPolicy: {},
-			createdById: userId,
-			approvedAt: new Date(),
-			deployedAt: new Date(),
-		},
-		select: { id: true },
-	});
-	versionId = version.id;
-	await db.agentDefinition.update({
-		where: { id: agentId },
-		data: { currentVersionId: versionId },
-	});
-
-	const trigger = await db.agentTrigger.create({
-		data: {
-			agentId,
-			versionId,
-			type: "SCHEDULE",
-			name: "Every hour",
-			config: { intervalMinutes: 60 },
-			createdById: userId,
-			enabled: true,
-			nextRunAt: new Date(Date.now() + 60 * 60 * 1000),
-		},
-		select: { id: true },
-	});
-	triggerId = trigger.id;
-
-	const [queued, waiting, running, delivery] = await Promise.all([
-		db.agentRun.create({
+beforeAll(() =>
+	inTenant(async () => {
+		await ensureTestWorkspace(WORKSPACE_ID, DEFAULT_WORKSPACE_NAME);
+		await globalDb.user.create({
 			data: {
-				agentId,
-				versionId,
-				triggerId,
-				triggerType: "SCHEDULE",
-				status: "QUEUED",
-				idempotencyKey: `${idempotencyPrefix}-queued`,
-				correlationId: `${idempotencyPrefix}-queued`,
+				id: userId,
+				name: "Agent Delete Test",
+				email: `${userId}@example.test`,
 			},
-			select: { id: true },
-		}),
-		db.agentRun.create({
+		});
+		await db.member.createMany({
+			data: [
+				{
+					id: memberId,
+					userId,
+					organizationId: WORKSPACE_ID,
+					role: "member",
+					createdAt: new Date(),
+				},
+			],
+		});
+
+		const agent = await db.agentDefinition.create({
 			data: {
-				agentId,
-				versionId,
-				triggerType: "MANUAL",
-				status: "WAITING_FOR_APPROVAL",
-				idempotencyKey: `${idempotencyPrefix}-waiting`,
-				correlationId: `${idempotencyPrefix}-waiting`,
+				organizationId: WORKSPACE_ID,
+				name: "Delete me",
+				status: "PAUSED",
+				createdById: userId,
 			},
 			select: { id: true },
-		}),
-		db.agentRun.create({
+		});
+		agentId = agent.id;
+
+		const version = await db.agentVersion.create({
 			data: {
+				organizationId: WORKSPACE_ID,
 				agentId,
-				versionId,
-				triggerType: "MANUAL",
-				status: "RUNNING",
-				idempotencyKey: `${idempotencyPrefix}-running`,
-				correlationId: `${idempotencyPrefix}-running`,
-				startedAt: new Date(),
-				sessionId: `${idempotencyPrefix}-active-session`,
+				number: 1,
+				status: "DEPLOYED",
+				instructions: "Test deletion behavior.",
+				manifest: {},
+				modelId: "test/model",
+				sandboxPolicy: {},
+				createdById: userId,
+				approvedAt: new Date(),
+				deployedAt: new Date(),
 			},
 			select: { id: true },
-		}),
-		db.agentRun.create({
+		});
+		versionId = version.id;
+		await db.agentDefinition.update({
+			where: { id: agentId },
+			data: { currentVersionId: versionId },
+		});
+
+		const trigger = await db.agentTrigger.create({
 			data: {
+				organizationId: WORKSPACE_ID,
 				agentId,
 				versionId,
-				triggerType: "MANUAL",
-				status: "RUNNING",
-				idempotencyKey: `${idempotencyPrefix}-delivery`,
-				correlationId: `${idempotencyPrefix}-delivery`,
-				startedAt: new Date(),
+				type: "SCHEDULE",
+				name: "Every hour",
+				config: { intervalMinutes: 60 },
+				createdById: userId,
+				enabled: true,
+				nextRunAt: new Date(Date.now() + 60 * 60 * 1000),
 			},
 			select: { id: true },
-		}),
-	]);
-	queuedRunId = queued.id;
-	waitingRunId = waiting.id;
-	runningRunId = running.id;
-	deliveryRunId = delivery.id;
-});
+		});
+		triggerId = trigger.id;
 
-afterAll(async () => {
-	await clean();
-});
+		const [queued, waiting, running, delivery] = await Promise.all([
+			db.agentRun.create({
+				data: {
+					organizationId: WORKSPACE_ID,
+					agentId,
+					versionId,
+					triggerId,
+					triggerType: "SCHEDULE",
+					status: "QUEUED",
+					idempotencyKey: `${idempotencyPrefix}-queued`,
+					correlationId: `${idempotencyPrefix}-queued`,
+				},
+				select: { id: true },
+			}),
+			db.agentRun.create({
+				data: {
+					organizationId: WORKSPACE_ID,
+					agentId,
+					versionId,
+					triggerType: "MANUAL",
+					status: "WAITING_FOR_APPROVAL",
+					idempotencyKey: `${idempotencyPrefix}-waiting`,
+					correlationId: `${idempotencyPrefix}-waiting`,
+				},
+				select: { id: true },
+			}),
+			db.agentRun.create({
+				data: {
+					organizationId: WORKSPACE_ID,
+					agentId,
+					versionId,
+					triggerType: "MANUAL",
+					status: "RUNNING",
+					idempotencyKey: `${idempotencyPrefix}-running`,
+					correlationId: `${idempotencyPrefix}-running`,
+					startedAt: new Date(),
+					sessionId: `${idempotencyPrefix}-active-session`,
+				},
+				select: { id: true },
+			}),
+			db.agentRun.create({
+				data: {
+					organizationId: WORKSPACE_ID,
+					agentId,
+					versionId,
+					triggerType: "MANUAL",
+					status: "RUNNING",
+					idempotencyKey: `${idempotencyPrefix}-delivery`,
+					correlationId: `${idempotencyPrefix}-delivery`,
+					startedAt: new Date(),
+				},
+				select: { id: true },
+			}),
+		]);
+		queuedRunId = queued.id;
+		waitingRunId = waiting.id;
+		runningRunId = running.id;
+		deliveryRunId = delivery.id;
+	}),
+);
+
+afterAll(() => inTenant(clean));
 
 describe("deleting an agent", () => {
 	it("stops future work while preserving its audit history", async () => {
diff --git a/apps/api/test/agent-events.spec.ts b/apps/api/test/agent-events.spec.ts
index 2fe38f520..526ac770d 100644
--- a/apps/api/test/agent-events.spec.ts
+++ b/apps/api/test/agent-events.spec.ts
@@ -1,20 +1,34 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { db } from "@crm/db";
+import { afterAll, beforeAll, describe, expect } from "bun:test";
+import { db as globalDb } from "@crm/db";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound, tenantContext, tenantTest } from "@crm/db/test-support";
 import { AgentTriggerService } from "../src/agent/agent-trigger.service";
 import { ActivityStampService } from "../src/crm/activity-stamp.service";
 import { ConversionService } from "../src/currency/conversion.service";
 import { DealsService } from "../src/deals/deals.service";
 import { FieldsService } from "../src/fields/fields.service";
+import { ensureTestWorkspace } from "./workspace.fixture";
 
 const suffix = crypto.randomUUID();
 const dealId = `event-deal-${suffix}`;
 const contactId = `event-contact-${suffix}`;
 const companyId = `event-company-${suffix}`;
-const service = new AgentTriggerService(db);
-const stamp = new ActivityStampService(db);
-const conversion = new ConversionService(db);
-const fields = new FieldsService(db, service);
-const deals = new DealsService(db, service, stamp, conversion, fields);
+const organizationId = `event-organization-${suffix}`;
+const it = tenantTest(organizationId);
+const db = scopedDb;
+const rawService = new AgentTriggerService(db as never);
+const service = tenantBound(organizationId, rawService);
+const stamp = new ActivityStampService(db as never);
+const conversion = new ConversionService(db as never);
+const fields = new FieldsService(db as never, service);
+const rawDeals = new DealsService(
+	db as never,
+	service,
+	stamp,
+	conversion,
+	fields,
+);
+const deals = tenantBound(organizationId, rawDeals);
 const channelId = `event-channel-${suffix}`;
 const ownerId = `event-owner-${suffix}`;
 const domain = `event-${suffix}.example.test`;
@@ -22,55 +36,63 @@ let persistedCompanyId = "";
 let persistedDealId = "";
 let previousBridgeSecret: string | undefined;
 
-beforeAll(async () => {
-	previousBridgeSecret = process.env.AGENT_BRIDGE_SECRET;
-	delete process.env.AGENT_BRIDGE_SECRET;
-	await db.agentTask.deleteMany({
-		where: { OR: [{ dealId }, { contactId }] },
-	});
-	await db.user.create({
-		data: {
-			id: ownerId,
-			name: "Event Test Owner",
-			email: `${ownerId}@example.test`,
-		},
-	});
-	const company = await db.company.create({
-		data: { name: "Event Test Company", domain },
-		select: { id: true },
-	});
-	persistedCompanyId = company.id;
-});
+const inTenant = tenantContext(organizationId);
 
-afterAll(async () => {
-	await db.agentTask.deleteMany({
-		where: {
-			OR: [
-				{ dealId: { in: [dealId, persistedDealId].filter(Boolean) } },
-				{ contactId },
-			],
-		},
-	});
-	await db.agentTask.deleteMany({
-		where: {
-			kind: "slack-channel-join",
-			payload: { path: ["channelId"], equals: channelId },
-		},
-	});
-	if (persistedDealId) {
-		await db.activity.deleteMany({ where: { dealId: persistedDealId } });
-		await db.deal.deleteMany({ where: { id: persistedDealId } });
-	}
-	if (persistedCompanyId) {
-		await db.company.deleteMany({ where: { id: persistedCompanyId } });
-	}
-	await db.user.deleteMany({ where: { id: ownerId } });
-	if (previousBridgeSecret === undefined) {
+beforeAll(() =>
+	inTenant(async () => {
+		previousBridgeSecret = process.env.AGENT_BRIDGE_SECRET;
 		delete process.env.AGENT_BRIDGE_SECRET;
-	} else {
-		process.env.AGENT_BRIDGE_SECRET = previousBridgeSecret;
-	}
-});
+		await db.agentTask.deleteMany({
+			where: { OR: [{ dealId }, { contactId }] },
+		});
+		await globalDb.user.create({
+			data: {
+				id: ownerId,
+				name: "Event Test Owner",
+				email: `${ownerId}@example.test`,
+			},
+		});
+		await ensureTestWorkspace(organizationId, organizationId);
+		const company = await db.company.create({
+			data: { organizationId, name: "Event Test Company", domain },
+			select: { id: true },
+		});
+		persistedCompanyId = company.id;
+	}),
+);
+
+afterAll(() =>
+	inTenant(async () => {
+		await db.agentTask.deleteMany({
+			where: {
+				OR: [
+					{ dealId: { in: [dealId, persistedDealId].filter(Boolean) } },
+					{ contactId },
+				],
+			},
+		});
+		await db.agentTask.deleteMany({
+			where: {
+				kind: "slack-channel-join",
+				payload: { path: ["channelId"], equals: channelId },
+			},
+		});
+		if (persistedDealId) {
+			await db.activity.deleteMany({ where: { dealId: persistedDealId } });
+			await db.deal.deleteMany({ where: { id: persistedDealId } });
+		}
+		if (persistedCompanyId) {
+			await db.company.deleteMany({ where: { id: persistedCompanyId } });
+		}
+		await globalDb.user.deleteMany({ where: { id: ownerId } });
+		await globalDb.organization.deleteMany({ where: { id: organizationId } });
+		if (previousBridgeSecret === undefined) {
+			delete process.env.AGENT_BRIDGE_SECRET;
+		} else {
+			process.env.AGENT_BRIDGE_SECRET = previousBridgeSecret;
+		}
+	}),
+);
 
 describe("CRM agent events", () => {
 	it("routes every event to its catalog record kind", async () => {
@@ -122,7 +144,11 @@ describe("CRM agent events", () => {
 				type: "deal.closed",
 				record: { kind: "deal", id: dealId },
 				occurredAt: closedAt,
-				data: { companyId, from: "NEGOTIATION", to: "CLOSED_WON" },
+				data: {
+					companyId,
+					from: "DECISION_MAKER_BOUGHT_IN",
+					to: "CLOSED_WON",
+				},
 			});
 		});
 
@@ -155,7 +181,11 @@ describe("CRM agent events", () => {
 				type: "deal.closed",
 				record: { kind: "deal", id: dealId },
 				occurredAt: closedAt.toISOString(),
-				data: { companyId, from: "NEGOTIATION", to: "CLOSED_WON" },
+				data: {
+					companyId,
+					from: "DECISION_MAKER_BOUGHT_IN",
+					to: "CLOSED_WON",
+				},
 			},
 			finishedAt: null,
 		});
@@ -184,6 +214,7 @@ describe("CRM agent events", () => {
 			await service.withCrmEvents(async (tx, emit) => {
 				const company = await tx.company.create({
 					data: {
+						organizationId,
 						id: rollbackCompanyId,
 						name: "Rollback Event Company",
 					},
diff --git a/apps/api/test/agent-lifecycle.spec.ts b/apps/api/test/agent-lifecycle.spec.ts
index 06dace00b..f13e96091 100644
--- a/apps/api/test/agent-lifecycle.spec.ts
+++ b/apps/api/test/agent-lifecycle.spec.ts
@@ -1,11 +1,15 @@
 import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { DEFAULT_WORKSPACE_NAME, WORKSPACE_ID } from "@crm/auth";
 import { db, type Prisma } from "@crm/db";
-import { workspaceSlug } from "@crm/db/workspace";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb, scopedTransaction } from "@crm/db/tenant-scope";
+import { tenantBound } from "@crm/db/test-support";
 import { AgentAccessService } from "../src/agent/agent-access.service";
 import { AgentDefinitionsService } from "../src/agent/agent-definitions.service";
 import { AgentTriggerService } from "../src/agent/agent-trigger.service";
+import { createTestMembers, ensureTestWorkspace } from "./workspace.fixture";
 
+const WORKSPACE_ID = "agent-lifecycle-spec-workspace";
+const DEFAULT_WORKSPACE_NAME = "Agent Lifecycle Spec Workspace";
 const suffix = crypto.randomUUID();
 const userId = `agent-lifecycle-user-${suffix}`;
 const teammateId = `agent-lifecycle-teammate-${suffix}`;
@@ -13,24 +17,22 @@ const memberId = `agent-lifecycle-member-${suffix}`;
 const teammateMemberId = `agent-lifecycle-teammate-member-${suffix}`;
 const joinChannel = `renewals-${suffix}`;
 const joinReason = `Add Comp AI to #${joinChannel}`;
-const access = new AgentAccessService(db);
-const agents = new AgentDefinitionsService(
-	db,
+const access = new AgentAccessService(scopedDb as never);
+const rawAgents = new AgentDefinitionsService(
+	scopedDb as never,
 	access,
-	new AgentTriggerService(db),
+	new AgentTriggerService(scopedDb as never),
 );
+const agents = tenantBound(WORKSPACE_ID, rawAgents);
+
+function tenantQuery<T>(
+	query: (tx: Prisma.TransactionClient) => Promise<T>,
+): Promise<T> {
+	return runInTenant(WORKSPACE_ID, () => scopedTransaction(query));
+}
 
 beforeAll(async () => {
-	await db.organization.upsert({
-		where: { id: WORKSPACE_ID },
-		update: {},
-		create: {
-			id: WORKSPACE_ID,
-			name: DEFAULT_WORKSPACE_NAME,
-			slug: workspaceSlug(DEFAULT_WORKSPACE_NAME),
-			createdAt: new Date(),
-		},
-	});
+	await ensureTestWorkspace(WORKSPACE_ID, DEFAULT_WORKSPACE_NAME);
 	await db.user.createMany({
 		data: [
 			{
@@ -45,65 +47,53 @@ beforeAll(async () => {
 			},
 		],
 	});
-	await db.member.createMany({
-		data: [
-			{
-				id: memberId,
-				organizationId: WORKSPACE_ID,
-				userId,
-				role: "member",
-				createdAt: new Date(),
-			},
-			{
-				id: teammateMemberId,
-				organizationId: WORKSPACE_ID,
-				userId: teammateId,
-				role: "member",
-				createdAt: new Date(),
-			},
-		],
-	});
+	await createTestMembers(WORKSPACE_ID, [
+		{ id: memberId, userId },
+		{ id: teammateMemberId, userId: teammateId },
+	]);
 });
 
 afterAll(async () => {
-	const agentIds = (
-		await db.agentDefinition.findMany({
-			where: { createdById: userId },
-			select: { id: true },
-		})
-	).map((agent) => agent.id);
-	if (agentIds.length > 0) {
-		await db.agentRunEvent.deleteMany({
-			where: { run: { agentId: { in: agentIds } } },
-		});
-		await db.agentAction.deleteMany({
-			where: { agentId: { in: agentIds } },
-		});
-		await db.agentAuditEvent.deleteMany({
-			where: { agentId: { in: agentIds } },
-		});
-		await db.agentRun.deleteMany({
-			where: { agentId: { in: agentIds } },
-		});
-		await db.agentTrigger.deleteMany({
-			where: { agentId: { in: agentIds } },
-		});
-		await db.agentBuilderArtifact.deleteMany({
-			where: { version: { agentId: { in: agentIds } } },
-		});
-		await db.agentDefinition.updateMany({
-			where: { id: { in: agentIds } },
-			data: { currentVersionId: null },
-		});
-		await db.agentVersion.deleteMany({
-			where: { agentId: { in: agentIds } },
-		});
-		await db.agentDefinition.deleteMany({
-			where: { id: { in: agentIds } },
+	await tenantQuery(async (tx) => {
+		const agentIds = (
+			await tx.agentDefinition.findMany({
+				where: { createdById: userId },
+				select: { id: true },
+			})
+		).map((agent) => agent.id);
+		if (agentIds.length > 0) {
+			await tx.agentRunEvent.deleteMany({
+				where: { run: { agentId: { in: agentIds } } },
+			});
+			await tx.agentAction.deleteMany({
+				where: { agentId: { in: agentIds } },
+			});
+			await tx.agentAuditEvent.deleteMany({
+				where: { agentId: { in: agentIds } },
+			});
+			await tx.agentRun.deleteMany({
+				where: { agentId: { in: agentIds } },
+			});
+			await tx.agentTrigger.deleteMany({
+				where: { agentId: { in: agentIds } },
+			});
+			await tx.agentBuilderArtifact.deleteMany({
+				where: { version: { agentId: { in: agentIds } } },
+			});
+			await tx.agentDefinition.updateMany({
+				where: { id: { in: agentIds } },
+				data: { currentVersionId: null },
+			});
+			await tx.agentVersion.deleteMany({
+				where: { agentId: { in: agentIds } },
+			});
+			await tx.agentDefinition.deleteMany({
+				where: { id: { in: agentIds } },
+			});
+		}
+		await tx.agentTask.deleteMany({
+			where: { kind: "slack-channel-join", reason: joinReason },
 		});
-	}
-	await db.agentTask.deleteMany({
-		where: { kind: "slack-channel-join", reason: joinReason },
 	});
 	await db.member.deleteMany({
 		where: { id: { in: [memberId, teammateMemberId] } },
@@ -112,33 +102,37 @@ afterAll(async () => {
 });
 
 async function createAgent(versionCount = 1, status = "DRAFT" as const) {
-	const agent = await db.agentDefinition.create({
-		data: {
-			name: `Lifecycle agent ${crypto.randomUUID()}`,
-			status,
-			createdById: userId,
-		},
-		select: { id: true },
+	return tenantQuery(async (tx) => {
+		const agent = await tx.agentDefinition.create({
+			data: {
+				organizationId: WORKSPACE_ID,
+				name: `Lifecycle agent ${crypto.randomUUID()}`,
+				status,
+				createdById: userId,
+			},
+			select: { id: true },
+		});
+		const versions = [];
+		for (let number = 1; number <= versionCount; number += 1) {
+			versions.push(
+				await tx.agentVersion.create({
+					data: {
+						organizationId: WORKSPACE_ID,
+						agentId: agent.id,
+						number,
+						status: "READY",
+						instructions: `Version ${number}`,
+						manifest: {},
+						modelId: "test/model",
+						sandboxPolicy: {},
+						createdById: userId,
+					},
+					select: { id: true, number: true },
+				}),
+			);
+		}
+		return { agentId: agent.id, versions };
 	});
-	const versions = [];
-	for (let number = 1; number <= versionCount; number += 1) {
-		versions.push(
-			await db.agentVersion.create({
-				data: {
-					agentId: agent.id,
-					number,
-					status: "READY",
-					instructions: `Version ${number}`,
-					manifest: {},
-					modelId: "test/model",
-					sandboxPolicy: {},
-					createdById: userId,
-				},
-				select: { id: true, number: true },
-			}),
-		);
-	}
-	return { agentId: agent.id, versions };
 }
 
 const postAction = {
@@ -166,10 +160,12 @@ async function deployedAgent(manifest: Prisma.InputJsonObject) {
 	const versionId = versions[0]?.id;
 	if (!versionId) throw new Error("Missing version");
 
-	await db.agentVersion.update({
-		where: { id: versionId },
-		data: { manifest },
-	});
+	await tenantQuery((tx) =>
+		tx.agentVersion.update({
+			where: { id: versionId },
+			data: { manifest },
+		}),
+	);
 	await agents.deploy(
 		{ id: agentId, versionId, clientRequestId: crypto.randomUUID() },
 		userId,
@@ -225,25 +221,30 @@ describe("agent lifecycle", () => {
 		);
 		const nextRunAt = new Date("2036-08-06T12:00:00.000Z");
 		const lastRunAt = new Date("2036-08-05T12:00:00.000Z");
-		await db.agentTrigger.create({
-			data: {
-				agentId,
-				versionId,
-				type: "SCHEDULE",
-				name: "Every morning",
-				config: { intervalMinutes: 1440 },
-				createdById: userId,
-				enabled: true,
-				nextRunAt,
-				lastRunAt,
-			},
-		});
+		await tenantQuery((tx) =>
+			tx.agentTrigger.create({
+				data: {
+					organizationId: WORKSPACE_ID,
+					agentId,
+					versionId,
+					type: "SCHEDULE",
+					name: "Every morning",
+					config: { intervalMinutes: 1440 },
+					createdById: userId,
+					enabled: true,
+					nextRunAt,
+					lastRunAt,
+				},
+			}),
+		);
 
 		const detail = await agents.byId(agentId, teammateId);
 		const listed = await agents.list(teammateId);
-		const audit = await db.agentAuditEvent.findFirstOrThrow({
-			where: { agentId, type: "agent.updated" },
-		});
+		const audit = await tenantQuery((tx) =>
+			tx.agentAuditEvent.findFirstOrThrow({
+				where: { agentId, type: "agent.updated" },
+			}),
+		);
 		const listItem = listed.find((agent) => agent.id === agentId);
 		expect(detail).toMatchObject({
 			id: agentId,
@@ -286,19 +287,23 @@ describe("agent lifecycle", () => {
 		const versionId = versions[0]?.id;
 		if (!versionId) throw new Error("Missing version");
 
-		await db.agentVersion.update({
-			where: { id: versionId },
-			data: {
-				manifest: {
-					name: "Pipeline health monitor",
-					description: "Summarize pipeline health for the team.",
+		await tenantQuery((tx) =>
+			tx.agentVersion.update({
+				where: { id: versionId },
+				data: {
+					manifest: {
+						name: "Pipeline health monitor",
+						description: "Summarize pipeline health for the team.",
+					},
 				},
-			},
-		});
-		const before = await db.agentDefinition.findUniqueOrThrow({
-			where: { id: agentId },
-			select: { name: true, description: true, status: true },
-		});
+			}),
+		);
+		const before = await tenantQuery((tx) =>
+			tx.agentDefinition.findUniqueOrThrow({
+				where: { id: agentId },
+				select: { name: true, description: true, status: true },
+			}),
+		);
 		expect(before).toMatchObject({
 			name: expect.stringContaining("Lifecycle agent"),
 			description: null,
@@ -310,15 +315,17 @@ describe("agent lifecycle", () => {
 			userId,
 		);
 
-		const after = await db.agentDefinition.findUniqueOrThrow({
-			where: { id: agentId },
-			select: {
-				name: true,
-				description: true,
-				status: true,
-				currentVersionId: true,
-			},
-		});
+		const after = await tenantQuery((tx) =>
+			tx.agentDefinition.findUniqueOrThrow({
+				where: { id: agentId },
+				select: {
+					name: true,
+					description: true,
+					status: true,
+					currentVersionId: true,
+				},
+			}),
+		);
 		expect(after).toEqual({
 			name: "Pipeline health monitor",
 			description: "Summarize pipeline health for the team.",
@@ -344,7 +351,9 @@ describe("agent lifecycle", () => {
 		]);
 
 		const [definition, teamAgents] = await Promise.all([
-			db.agentDefinition.findUnique({ where: { id: agentId } }),
+			tenantQuery((tx) =>
+				tx.agentDefinition.findUnique({ where: { id: agentId } }),
+			),
 			agents.list(userId),
 		]);
 		expect(definition?.status).toBe("DRAFT");
@@ -379,13 +388,15 @@ describe("agent lifecycle", () => {
 			userId,
 		);
 
-		const [definition, deployedVersions] = await Promise.all([
-			db.agentDefinition.findUnique({ where: { id: agentId } }),
-			db.agentVersion.findMany({
-				where: { agentId, status: "DEPLOYED" },
-				select: { id: true },
-			}),
-		]);
+		const [definition, deployedVersions] = await tenantQuery((tx) =>
+			Promise.all([
+				tx.agentDefinition.findUnique({ where: { id: agentId } }),
+				tx.agentVersion.findMany({
+					where: { agentId, status: "DEPLOYED" },
+					select: { id: true },
+				}),
+			]),
+		);
 		expect(definition).toMatchObject({
 			status: "LIVE",
 			currentVersionId: secondVersionId,
@@ -419,10 +430,12 @@ describe("agent lifecycle", () => {
 			collision.filter((result) => result.status === "rejected"),
 		).toHaveLength(1);
 
-		const definition = await db.agentDefinition.findUniqueOrThrow({
-			where: { id: agentId },
-			select: { currentVersionId: true },
-		});
+		const definition = await tenantQuery((tx) =>
+			tx.agentDefinition.findUniqueOrThrow({
+				where: { id: agentId },
+				select: { currentVersionId: true },
+			}),
+		);
 		const currentVersionId = definition.currentVersionId;
 		if (!currentVersionId) throw new Error("Missing current version");
 		const retries = await Promise.all(
@@ -440,33 +453,42 @@ describe("agent lifecycle", () => {
 		expect(new Set(retries.map((retry) => retry.versionId))).toEqual(
 			new Set([currentVersionId]),
 		);
-		expect(
-			await db.agentAuditEvent.count({
-				where: { agentId, type: "agent.deployed", requestId: clientRequestId },
-			}),
-		).toBe(1);
-		expect(
-			await db.agentVersion.count({
-				where: { agentId, status: "DEPLOYED" },
-			}),
-		).toBe(1);
+		const [auditCount, versionCount] = await tenantQuery((tx) =>
+			Promise.all([
+				tx.agentAuditEvent.count({
+					where: {
+						agentId,
+						type: "agent.deployed",
+						requestId: clientRequestId,
+					},
+				}),
+				tx.agentVersion.count({
+					where: { agentId, status: "DEPLOYED" },
+				}),
+			]),
+		);
+		expect(auditCount).toBe(1);
+		expect(versionCount).toBe(1);
 	});
 
 	it("moves triggers onto the version a revision creates", async () => {
 		const { agentId, versionId } = await deployedAgent(capableManifest);
-		const trigger = await db.agentTrigger.create({
-			data: {
-				agentId,
-				versionId,
-				type: "SCHEDULE",
-				name: "Every morning",
-				config: { intervalMinutes: 1440 },
-				createdById: userId,
-				enabled: true,
-				nextRunAt: new Date("2036-08-12T06:00:00.000Z"),
-			},
-			select: { id: true },
-		});
+		const trigger = await tenantQuery((tx) =>
+			tx.agentTrigger.create({
+				data: {
+					organizationId: WORKSPACE_ID,
+					agentId,
+					versionId,
+					type: "SCHEDULE",
+					name: "Every morning",
+					config: { intervalMinutes: 1440 },
+					createdById: userId,
+					enabled: true,
+					nextRunAt: new Date("2036-08-12T06:00:00.000Z"),
+				},
+				select: { id: true },
+			}),
+		);
 
 		const revised = await agents.revise(
 			{
@@ -480,20 +502,22 @@ describe("agent lifecycle", () => {
 		const revisedId = revised.versionId;
 		if (!revisedId) throw new Error("Missing revised version");
 
-		const [definition, revision, moved] = await Promise.all([
-			db.agentDefinition.findUniqueOrThrow({
-				where: { id: agentId },
-				select: { currentVersionId: true },
-			}),
-			db.agentVersion.findUniqueOrThrow({
-				where: { id: revisedId },
-				select: { manifest: true },
-			}),
-			db.agentTrigger.findUniqueOrThrow({
-				where: { id: trigger.id },
-				select: { versionId: true, enabled: true },
-			}),
-		]);
+		const [definition, revision, moved] = await tenantQuery((tx) =>
+			Promise.all([
+				tx.agentDefinition.findUniqueOrThrow({
+					where: { id: agentId },
+					select: { currentVersionId: true },
+				}),
+				tx.agentVersion.findUniqueOrThrow({
+					where: { id: revisedId },
+					select: { manifest: true },
+				}),
+				tx.agentTrigger.findUniqueOrThrow({
+					where: { id: trigger.id },
+					select: { versionId: true, enabled: true },
+				}),
+			]),
+		);
 
 		expect(revisedId).not.toBe(versionId);
 		expect(definition.currentVersionId).toBe(revisedId);
@@ -516,28 +540,32 @@ describe("agent lifecycle", () => {
 
 	it("moves triggers onto the version a file save creates", async () => {
 		const { agentId, versionId } = await deployedAgent(capableManifest);
-		await db.agentBuilderArtifact.create({
-			data: {
-				versionId,
-				path: "agent/instructions.md",
-				language: "markdown",
-				content: "Watch renewals.",
-				revision: 1,
-				status: "READY",
-			},
-		});
-		const trigger = await db.agentTrigger.create({
-			data: {
-				agentId,
-				versionId,
-				type: "SCHEDULE",
-				name: "Every morning",
-				config: { intervalMinutes: 1440 },
-				createdById: userId,
-				enabled: true,
-				nextRunAt: new Date("2036-08-12T06:00:00.000Z"),
-			},
-			select: { id: true },
+		const trigger = await tenantQuery(async (tx) => {
+			await tx.agentBuilderArtifact.create({
+				data: {
+					organizationId: WORKSPACE_ID,
+					versionId,
+					path: "agent/instructions.md",
+					language: "markdown",
+					content: "Watch renewals.",
+					revision: 1,
+					status: "READY",
+				},
+			});
+			return tx.agentTrigger.create({
+				data: {
+					organizationId: WORKSPACE_ID,
+					agentId,
+					versionId,
+					type: "SCHEDULE",
+					name: "Every morning",
+					config: { intervalMinutes: 1440 },
+					createdById: userId,
+					enabled: true,
+					nextRunAt: new Date("2036-08-12T06:00:00.000Z"),
+				},
+				select: { id: true },
+			});
 		});
 
 		const saved = await agents.saveFile(
@@ -552,20 +580,22 @@ describe("agent lifecycle", () => {
 		const savedId = saved.versionId;
 		if (!savedId) throw new Error("Missing saved version");
 
-		const [definition, moved, audit] = await Promise.all([
-			db.agentDefinition.findUniqueOrThrow({
-				where: { id: agentId },
-				select: { currentVersionId: true },
-			}),
-			db.agentTrigger.findUniqueOrThrow({
-				where: { id: trigger.id },
-				select: { versionId: true, enabled: true },
-			}),
-			db.agentAuditEvent.findFirstOrThrow({
-				where: { agentId, type: "agent.file.saved" },
-				select: { after: true },
-			}),
-		]);
+		const [definition, moved, audit] = await tenantQuery((tx) =>
+			Promise.all([
+				tx.agentDefinition.findUniqueOrThrow({
+					where: { id: agentId },
+					select: { currentVersionId: true },
+				}),
+				tx.agentTrigger.findUniqueOrThrow({
+					where: { id: trigger.id },
+					select: { versionId: true, enabled: true },
+				}),
+				tx.agentAuditEvent.findFirstOrThrow({
+					where: { agentId, type: "agent.file.saved" },
+					select: { after: true },
+				}),
+			]),
+		);
 
 		expect(saved.saved).toBe(true);
 		expect(savedId).not.toBe(versionId);
@@ -576,18 +606,21 @@ describe("agent lifecycle", () => {
 
 	it("numbers a revision above every existing version", async () => {
 		const { agentId } = await deployedAgent(capableManifest);
-		await db.agentVersion.create({
-			data: {
-				agentId,
-				number: 9,
-				status: "DRAFT",
-				instructions: "A later draft",
-				manifest: capableManifest,
-				modelId: "test/model",
-				sandboxPolicy: {},
-				createdById: userId,
-			},
-		});
+		await tenantQuery((tx) =>
+			tx.agentVersion.create({
+				data: {
+					organizationId: WORKSPACE_ID,
+					agentId,
+					number: 9,
+					status: "DRAFT",
+					instructions: "A later draft",
+					manifest: capableManifest,
+					modelId: "test/model",
+					sandboxPolicy: {},
+					createdById: userId,
+				},
+			}),
+		);
 
 		const revised = await agents.revise(
 			{
@@ -598,13 +631,15 @@ describe("agent lifecycle", () => {
 			userId,
 		);
 		if (!revised.versionId) throw new Error("Missing revised version");
+		const revisedId = revised.versionId;
 
-		expect(
-			await db.agentVersion.findUniqueOrThrow({
-				where: { id: revised.versionId },
+		const version = await tenantQuery((tx) =>
+			tx.agentVersion.findUniqueOrThrow({
+				where: { id: revisedId },
 				select: { number: true },
 			}),
-		).toEqual({ number: 10 });
+		);
+		expect(version).toEqual({ number: 10 });
 	});
 
 	it("queues the channel join with the version that moves the agent", async () => {
@@ -619,17 +654,20 @@ describe("agent lifecycle", () => {
 			userId,
 		);
 		if (!revised.versionId) throw new Error("Missing revised version");
+		const revisedId = revised.versionId;
 
-		const [version, join] = await Promise.all([
-			db.agentVersion.findUniqueOrThrow({
-				where: { id: revised.versionId },
-				select: { manifest: true },
-			}),
-			db.agentTask.findFirst({
-				where: { kind: "slack-channel-join", reason: joinReason },
-				select: { payload: true },
-			}),
-		]);
+		const [version, join] = await tenantQuery((tx) =>
+			Promise.all([
+				tx.agentVersion.findUniqueOrThrow({
+					where: { id: revisedId },
+					select: { manifest: true },
+				}),
+				tx.agentTask.findFirst({
+					where: { kind: "slack-channel-join", reason: joinReason },
+					select: { payload: true },
+				}),
+			]),
+		);
 
 		expect(version.manifest).toMatchObject({
 			actions: [
@@ -670,7 +708,9 @@ describe("agent lifecycle", () => {
 		expect((refusal as Error).message).toBe(
 			"None of this agent's actions post to a channel, so its channel cannot be changed.",
 		);
-		expect(await db.agentVersion.count({ where: { agentId } })).toBe(1);
+		expect(
+			await tenantQuery((tx) => tx.agentVersion.count({ where: { agentId } })),
+		).toBe(1);
 	});
 
 	it("cannot resurrect an agent when deletion races a transition", async () => {
@@ -691,11 +731,12 @@ describe("agent lifecycle", () => {
 			agents.remove(agentId, userId),
 		]);
 
-		expect(
-			await db.agentDefinition.findUnique({
+		const definition = await tenantQuery((tx) =>
+			tx.agentDefinition.findUnique({
 				where: { id: agentId },
 				select: { status: true },
 			}),
-		).toEqual({ status: "DELETED" });
+		);
+		expect(definition).toEqual({ status: "DELETED" });
 	});
 });
diff --git a/apps/api/test/agent-queue.spec.ts b/apps/api/test/agent-queue.spec.ts
index 3a658e235..66cb7ffe4 100644
--- a/apps/api/test/agent-queue.spec.ts
+++ b/apps/api/test/agent-queue.spec.ts
@@ -1,13 +1,19 @@
 import { afterAll, beforeAll, describe, expect, it } from "bun:test";
 import { db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound } from "@crm/db/test-support";
 import { AgentQueueService } from "../src/agent/agent-queue.service";
+import { ensureTestWorkspace } from "./workspace.fixture";
 
 const suffix = process.env.TEST_RUN_ID ?? "agent-queue-spec";
 const email = `badge-${suffix}@example.test`;
 const name = `Badge Co ${suffix}`;
 const kind = "test-queue-badge";
+const organizationId = `agent-queue-organization-${suffix}`;
 
-const queue = new AgentQueueService(db);
+const rawQueue = new AgentQueueService(scopedDb as never);
+const queue = tenantBound(organizationId, rawQueue);
 
 const DAY_MS = 86_400_000;
 
@@ -15,44 +21,57 @@ let contactId: string;
 let companyId: string;
 
 async function clean() {
-	await db.agentTask.deleteMany({ where: { kind } });
-	await db.contact.deleteMany({ where: { email } });
-	await db.company.deleteMany({ where: { name } });
+	await runInTenant(organizationId, async () => {
+		await scopedDb.agentTask.deleteMany({ where: { kind } });
+		await scopedDb.contact.deleteMany({ where: { email } });
+		await scopedDb.company.deleteMany({ where: { name } });
+	});
+	await db.organization.deleteMany({ where: { id: organizationId } });
 }
 
 beforeAll(async () => {
 	await clean();
+	await ensureTestWorkspace(organizationId, organizationId);
 
-	const contact = await db.contact.create({
-		data: { firstName: "Badge", lastName: "Later", email },
-		select: { id: true },
-	});
-	const company = await db.company.create({
-		data: { name },
-		select: { id: true },
-	});
+	await runInTenant(organizationId, async () => {
+		const contact = await scopedDb.contact.create({
+			data: {
+				organizationId,
+				firstName: "Badge",
+				lastName: "Later",
+				email,
+			},
+			select: { id: true },
+		});
+		const company = await scopedDb.company.create({
+			data: { organizationId, name },
+			select: { id: true },
+		});
 
-	contactId = contact.id;
-	companyId = company.id;
+		contactId = contact.id;
+		companyId = company.id;
 
-	await db.agentTask.create({
-		data: {
-			kind,
-			reason: "recheck in three months",
-			dueAt: new Date(Date.now() + 90 * DAY_MS),
-			budget: 4,
-			contactId,
-		},
-	});
+		await scopedDb.agentTask.create({
+			data: {
+				organizationId,
+				kind,
+				reason: "recheck in three months",
+				dueAt: new Date(Date.now() + 90 * DAY_MS),
+				budget: 4,
+				contactId,
+			},
+		});
 
-	await db.agentTask.create({
-		data: {
-			kind,
-			reason: "due now",
-			dueAt: new Date(Date.now() - 60_000),
-			budget: 4,
-			companyId,
-		},
+		await scopedDb.agentTask.create({
+			data: {
+				organizationId,
+				kind,
+				reason: "due now",
+				dueAt: new Date(Date.now() - 60_000),
+				budget: 4,
+				companyId,
+			},
+		});
 	});
 });
 
diff --git a/apps/api/test/agent-runs.spec.ts b/apps/api/test/agent-runs.spec.ts
index 22d4d8c40..a571790df 100644
--- a/apps/api/test/agent-runs.spec.ts
+++ b/apps/api/test/agent-runs.spec.ts
@@ -1,17 +1,23 @@
-import { afterAll, afterEach, beforeAll, describe, expect, it } from "bun:test";
-import { DEFAULT_WORKSPACE_NAME, WORKSPACE_ID } from "@crm/auth";
-import { db } from "@crm/db";
-import { workspaceSlug } from "@crm/db/workspace";
+import { afterAll, afterEach, beforeAll, describe, expect } from "bun:test";
+import { db as globalDb } from "@crm/db";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound, tenantContext, tenantTest } from "@crm/db/test-support";
 import { AgentAccessService } from "../src/agent/agent-access.service";
 import { AgentRunsService } from "../src/agent/agent-runs.service";
 import { AgentTriggerService } from "../src/agent/agent-trigger.service";
+import { ensureTestWorkspace } from "./workspace.fixture";
 
+const WORKSPACE_ID = "agent-runs-spec-workspace";
+const DEFAULT_WORKSPACE_NAME = "Agent Runs Spec Workspace";
+const it = tenantTest(WORKSPACE_ID);
 const suffix = crypto.randomUUID();
 const userId = `agent-run-user-${suffix}`;
 const outsiderId = `agent-run-outsider-${suffix}`;
 const memberId = `agent-run-member-${suffix}`;
 let agentId = "";
 let versionId = "";
+let companyId = "";
+let dealId = "";
 let pokeCount = 0;
 let cancelPokes: string[] = [];
 const trigger = {
@@ -22,117 +28,152 @@ const trigger = {
 		cancelPokes.push(runId);
 	},
 } as AgentTriggerService;
-const service = new AgentRunsService(db, new AgentAccessService(db), trigger);
-
-beforeAll(async () => {
-	await db.organization.upsert({
-		where: { id: WORKSPACE_ID },
-		update: {},
-		create: {
-			id: WORKSPACE_ID,
-			name: DEFAULT_WORKSPACE_NAME,
-			slug: workspaceSlug(DEFAULT_WORKSPACE_NAME),
-			createdAt: new Date(),
-		},
-	});
-	await db.user.createMany({
-		data: [
-			{
-				id: userId,
-				name: "Agent Run Test",
-				email: `${userId}@example.test`,
-			},
-			{
-				id: outsiderId,
-				name: "Agent Run Outsider",
-				email: `${outsiderId}@example.test`,
+const rawService = new AgentRunsService(
+	scopedDb as never,
+	new AgentAccessService(scopedDb as never),
+	trigger,
+);
+const service = tenantBound(WORKSPACE_ID, rawService);
+const db = scopedDb;
+
+const inTenant = tenantContext(WORKSPACE_ID);
+
+beforeAll(() =>
+	inTenant(async () => {
+		await ensureTestWorkspace(WORKSPACE_ID, DEFAULT_WORKSPACE_NAME);
+		await globalDb.user.createMany({
+			data: [
+				{
+					id: userId,
+					name: "Agent Run Test",
+					email: `${userId}@example.test`,
+				},
+				{
+					id: outsiderId,
+					name: "Agent Run Outsider",
+					email: `${outsiderId}@example.test`,
+				},
+			],
+		});
+		await db.member.createMany({
+			data: [
+				{
+					id: memberId,
+					userId,
+					organizationId: WORKSPACE_ID,
+					role: "member",
+					createdAt: new Date(),
+				},
+			],
+		});
+		const agent = await db.agentDefinition.create({
+			data: {
+				organizationId: WORKSPACE_ID,
+				name: "Run safely",
+				status: "LIVE",
+				createdById: userId,
 			},
-		],
-	});
-	await db.member.create({
-		data: {
-			id: memberId,
-			organizationId: WORKSPACE_ID,
-			userId,
-			role: "member",
-			createdAt: new Date(),
-		},
-	});
-	const agent = await db.agentDefinition.create({
-		data: { name: "Run safely", status: "LIVE", createdById: userId },
-		select: { id: true },
-	});
-	agentId = agent.id;
-	const version = await db.agentVersion.create({
-		data: {
-			agentId,
-			number: 1,
-			status: "DEPLOYED",
-			instructions: "Run once.",
-			manifest: {},
-			modelId: "test/model",
-			sandboxPolicy: {},
-			createdById: userId,
-		},
-		select: { id: true },
-	});
-	versionId = version.id;
-	await db.agentDefinition.update({
-		where: { id: agentId },
-		data: { currentVersionId: versionId },
-	});
-});
-
-afterAll(async () => {
-	const agentIds = (
-		await db.agentDefinition.findMany({
-			where: { createdById: userId },
 			select: { id: true },
-		})
-	).map((agent) => agent.id);
-	if (agentIds.length > 0) {
-		await db.agentRunEvent.deleteMany({
-			where: { run: { agentId: { in: agentIds } } },
 		});
-		await db.agentAction.deleteMany({
-			where: { agentId: { in: agentIds } },
+		agentId = agent.id;
+		const version = await db.agentVersion.create({
+			data: {
+				organizationId: WORKSPACE_ID,
+				agentId,
+				number: 1,
+				status: "DEPLOYED",
+				instructions: "Run once.",
+				manifest: {},
+				modelId: "test/model",
+				sandboxPolicy: {},
+				createdById: userId,
+			},
+			select: { id: true },
 		});
-		await db.agentAuditEvent.deleteMany({
-			where: { agentId: { in: agentIds } },
+		versionId = version.id;
+		const company = await db.company.create({
+			data: {
+				organizationId: WORKSPACE_ID,
+				name: `Agent run company ${suffix}`,
+			},
+			select: { id: true },
 		});
-		await db.agentRun.deleteMany({
-			where: { agentId: { in: agentIds } },
+		companyId = company.id;
+		const deal = await db.deal.create({
+			data: {
+				organizationId: WORKSPACE_ID,
+				name: "Agent run deal",
+				companyId,
+				ownerId: userId,
+			},
+			select: { id: true },
 		});
-		await db.agentDefinition.updateMany({
-			where: { id: { in: agentIds } },
-			data: { currentVersionId: null },
+		dealId = deal.id;
+		await db.agentDefinition.update({
+			where: { id: agentId },
+			data: { currentVersionId: versionId },
 		});
-		await db.agentVersion.deleteMany({
-			where: { agentId: { in: agentIds } },
+	}),
+);
+
+afterAll(() =>
+	inTenant(async () => {
+		const agentIds = (
+			await db.agentDefinition.findMany({
+				where: { createdById: userId },
+				select: { id: true },
+			})
+		).map((agent) => agent.id);
+		if (agentIds.length > 0) {
+			await db.agentRunEvent.deleteMany({
+				where: { run: { agentId: { in: agentIds } } },
+			});
+			await db.agentAction.deleteMany({
+				where: { agentId: { in: agentIds } },
+			});
+			await db.agentAuditEvent.deleteMany({
+				where: { agentId: { in: agentIds } },
+			});
+			await db.agentRun.deleteMany({
+				where: { agentId: { in: agentIds } },
+			});
+			await db.agentDefinition.updateMany({
+				where: { id: { in: agentIds } },
+				data: { currentVersionId: null },
+			});
+			await db.agentVersion.deleteMany({
+				where: { agentId: { in: agentIds } },
+			});
+			await db.agentDefinition.deleteMany({
+				where: { id: { in: agentIds } },
+			});
+		}
+		await db.member.deleteMany({ where: { id: memberId } });
+		await db.deal.deleteMany({ where: { id: dealId } });
+		await db.company.deleteMany({ where: { id: companyId } });
+		await globalDb.user.deleteMany({
+			where: { id: { in: [userId, outsiderId] } },
 		});
-		await db.agentDefinition.deleteMany({
-			where: { id: { in: agentIds } },
+	}),
+);
+
+afterEach(() =>
+	inTenant(async () => {
+		if (!agentId) return;
+		await db.agentRun.updateMany({
+			where: {
+				agentId,
+				status: { in: ["QUEUED", "RUNNING", "WAITING_FOR_APPROVAL"] },
+			},
+			data: {
+				status: "CANCELLED",
+				errorCode: "TEST_CLEANUP",
+				errorMessage: "Settled between tests.",
+				finishedAt: new Date(),
+			},
 		});
-	}
-	await db.member.deleteMany({ where: { id: memberId } });
-	await db.user.deleteMany({ where: { id: { in: [userId, outsiderId] } } });
-});
-
-afterEach(async () => {
-	if (!agentId) return;
-	await db.agentRun.updateMany({
-		where: {
-			agentId,
-			status: { in: ["QUEUED", "RUNNING", "WAITING_FOR_APPROVAL"] },
-		},
-		data: {
-			status: "CANCELLED",
-			errorCode: "TEST_CLEANUP",
-			errorMessage: "Settled between tests.",
-			finishedAt: new Date(),
-		},
-	});
-});
+	}),
+);
 
 describe("manual agent runs", () => {
 	it("returns ordered, transport-safe run and activity history", async () => {
@@ -158,6 +199,7 @@ describe("manual agent runs", () => {
 		});
 		await db.agentRunEvent.create({
 			data: {
+				organizationId: WORKSPACE_ID,
 				runId,
 				sequence: 1,
 				type: "run.completed",
@@ -167,6 +209,7 @@ describe("manual agent runs", () => {
 		});
 		await db.agentAction.create({
 			data: {
+				organizationId: WORKSPACE_ID,
 				agentId,
 				runId,
 				type: "timeline.note.created",
@@ -228,6 +271,7 @@ describe("manual agent runs", () => {
 		const beforePokeCount = pokeCount;
 		const draft = await db.agentDefinition.create({
 			data: {
+				organizationId: WORKSPACE_ID,
 				name: "Draft run guard",
 				status: "DRAFT",
 				createdById: userId,
@@ -322,6 +366,7 @@ describe("manual agent runs", () => {
 		await db.agentRun.update({
 			where: { id: first.id },
 			data: {
+				dealId,
 				status: "FAILED",
 				errorCode: "TEST_FAILURE",
 				errorMessage: "Broke before the retry.",
@@ -330,6 +375,7 @@ describe("manual agent runs", () => {
 		});
 		const redeployed = await db.agentVersion.create({
 			data: {
+				organizationId: WORKSPACE_ID,
 				agentId,
 				number: 2,
 				status: "DEPLOYED",
@@ -359,9 +405,19 @@ describe("manual agent runs", () => {
 					select: { versionId: true },
 				}),
 			).toEqual({ versionId });
+			expect(
+				await db.agentRun.findUniqueOrThrow({
+					where: { id: retried.id },
+					select: { dealId: true },
+				}),
+			).toEqual({ dealId });
 			expect(
 				await db.agentAuditEvent.findFirstOrThrow({
-					where: { agentId, type: "run.requested", requestId: clientRequestId },
+					where: {
+						agentId,
+						type: "run.requested",
+						requestId: clientRequestId,
+					},
 					select: { versionId: true },
 				}),
 			).toEqual({ versionId });
@@ -375,11 +431,17 @@ describe("manual agent runs", () => {
 
 	it("allows only one agent to claim a globally reused request id", async () => {
 		const otherAgent = await db.agentDefinition.create({
-			data: { name: "Other live agent", status: "LIVE", createdById: userId },
+			data: {
+				organizationId: WORKSPACE_ID,
+				name: "Other live agent",
+				status: "LIVE",
+				createdById: userId,
+			},
 			select: { id: true },
 		});
 		const otherVersion = await db.agentVersion.create({
 			data: {
+				organizationId: WORKSPACE_ID,
 				agentId: otherAgent.id,
 				number: 1,
 				status: "DEPLOYED",
@@ -464,6 +526,7 @@ describe("cancelling a run", () => {
 		await db.agentAction.createMany({
 			data: [
 				{
+					organizationId: WORKSPACE_ID,
 					agentId,
 					runId,
 					type: "crm.activity.create",
@@ -474,6 +537,7 @@ describe("cancelling a run", () => {
 					requestHash: "planned",
 				},
 				{
+					organizationId: WORKSPACE_ID,
 					agentId,
 					runId,
 					type: "slack.message.post",
@@ -530,7 +594,12 @@ describe("cancelling a run", () => {
 	it("refuses a run id that belongs to another agent", async () => {
 		const runId = await queuedRun();
 		const other = await db.agentDefinition.create({
-			data: { name: "Unrelated", status: "LIVE", createdById: userId },
+			data: {
+				organizationId: WORKSPACE_ID,
+				name: "Unrelated",
+				status: "LIVE",
+				createdById: userId,
+			},
 			select: { id: true },
 		});
 
@@ -575,7 +644,7 @@ describe("cancelling a run", () => {
 		});
 		await service.cancelRun({ id: agentId, runId }, userId);
 
-		const trigger = new AgentTriggerService(db);
+		const trigger = new AgentTriggerService(db as never);
 		const asked: string[] = [];
 		const asksForRun = () => asked.filter((id) => id === runId).length;
 		let status = 502;
diff --git a/apps/api/test/agent-trigger.stub.ts b/apps/api/test/agent-trigger.stub.ts
index 6661d7890..41485a849 100644
--- a/apps/api/test/agent-trigger.stub.ts
+++ b/apps/api/test/agent-trigger.stub.ts
@@ -1,4 +1,5 @@
-import { db, type Prisma } from "@crm/db";
+import type { Prisma } from "@crm/db";
+import { scopedTransaction } from "@crm/db/tenant-scope";
 import type { CrmEventInput } from "../src/agent/agent-trigger.service";
 
 export function withDiscardedCrmEvents<Result>(
@@ -7,5 +8,5 @@ export function withDiscardedCrmEvents<Result>(
 		emit: (input: CrmEventInput) => Promise<void>,
 	) => Promise<Result>,
 ): Promise<Result> {
-	return db.$transaction((tx) => work(tx, async () => undefined));
+	return scopedTransaction((tx) => work(tx, async () => undefined));
 }
diff --git a/apps/api/test/appointment-assets-locks.integration.spec.ts b/apps/api/test/appointment-assets-locks.integration.spec.ts
new file mode 100644
index 000000000..ad82688c1
--- /dev/null
+++ b/apps/api/test/appointment-assets-locks.integration.spec.ts
@@ -0,0 +1,147 @@
+import {
+	afterAll,
+	afterEach,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+} from "bun:test";
+import {
+	AppointmentAssetsFixture,
+	assertLocalTestDatabase,
+	assetTest as it,
+	rawDb,
+	scopedDb,
+} from "./appointment-assets.fixture";
+import { ASSET_TEST_ORGANIZATION_ID } from "./assets-tenant.fixture";
+
+let fixture: AppointmentAssetsFixture;
+
+async function lockedProject(projectId: string, organizationId: string) {
+	let releaseLock!: () => void;
+	const released = new Promise<void>((resolve) => {
+		releaseLock = resolve;
+	});
+	let acquired!: () => void;
+	const lockAcquired = new Promise<void>((resolve) => {
+		acquired = resolve;
+	});
+	const transaction = rawDb.$transaction(async (tx) => {
+		await tx.$executeRaw`SELECT set_config('app.current_organization_id', ${organizationId}, true)`;
+		await tx.$queryRaw`SELECT "id" FROM "deal" WHERE "id" = ${projectId} FOR UPDATE`;
+		acquired();
+		await released;
+	});
+	await lockAcquired;
+	let open = true;
+	return {
+		async waitFor(waiters: number) {
+			for (let attempt = 0; attempt < 200; attempt++) {
+				const result = await rawDb.$queryRaw<{ count: number }[]>`
+					SELECT count(*)::int AS count
+					FROM pg_stat_activity
+					WHERE pid <> pg_backend_pid()
+					AND wait_event_type = 'Lock'
+					AND query ILIKE '%deal%FOR UPDATE%'
+				`;
+				if ((result[0]?.count ?? 0) >= waiters) return;
+				await new Promise<void>((resolve) => setImmediate(resolve));
+			}
+			throw new Error(`Expected ${waiters} project lock waiters.`);
+		},
+		async release() {
+			if (!open) return;
+			open = false;
+			releaseLock();
+			await transaction;
+		},
+	};
+}
+
+async function associationRace(order: "archive" | "create") {
+	const target = await fixture.appointment({ title: "Target appointment" });
+	const gate = await lockedProject(
+		fixture.assets.projectId,
+		ASSET_TEST_ORGANIZATION_ID,
+	);
+	const operations: Promise<unknown>[] = [];
+	let released = false;
+	const archive = () => fixture.archive(target.appointment.id, fixture.actor);
+	const create = () =>
+		fixture.createUpload(
+			{ appointmentId: target.appointment.id },
+			fixture.otherActor,
+		);
+	try {
+		operations.push(order === "archive" ? archive() : create());
+		await gate.waitFor(1);
+		operations.push(order === "archive" ? create() : archive());
+		await gate.waitFor(2);
+		await gate.release();
+		released = true;
+		return { target, results: await Promise.allSettled(operations) };
+	} finally {
+		if (!released) await gate.release();
+		await Promise.allSettled(operations);
+	}
+}
+
+describe("appointment and asset project lock ordering", () => {
+	beforeAll(assertLocalTestDatabase);
+	beforeEach(async () => {
+		fixture = new AppointmentAssetsFixture();
+		await fixture.setup();
+	});
+	afterEach(async () => fixture.cleanup());
+	afterAll(async () => rawDb.$disconnect());
+
+	it("rejects an appointment asset association queued behind archive", async () => {
+		const { results } = await associationRace("archive");
+		expect(results[0]?.status).toBe("fulfilled");
+		expect(results[1]?.status).toBe("rejected");
+		if (results[1]?.status === "rejected")
+			expect(results[1].reason).toMatchObject({ code: "APPOINTMENT_ARCHIVED" });
+	});
+
+	it("preserves an accepted same-project association before archive", async () => {
+		const { target, results } = await associationRace("create");
+		expect(results.every((result) => result.status === "fulfilled")).toBe(true);
+		const created = results[0];
+		if (created?.status !== "fulfilled")
+			throw new Error("Appointment asset creation did not start.");
+		const upload = created.value as Awaited<
+			ReturnType<AppointmentAssetsFixture["createUpload"]>
+		>;
+		expect(upload.asset).toMatchObject({
+			projectId: fixture.assets.projectId,
+			appointmentId: target.appointment.id,
+			status: "UNVERIFIED",
+		});
+		await fixture.assets.put(upload.upload.id);
+		await fixture.updateAsset(
+			upload.asset.id,
+			{ uploadCompleted: true },
+			fixture.otherActor,
+		);
+		await fixture.assets.worker.process();
+		expect(
+			(
+				await fixture.assets.service.getAsset(
+					fixture.otherActor,
+					upload.asset.id,
+				)
+			).asset,
+		).toMatchObject({
+			projectId: fixture.assets.projectId,
+			appointmentId: target.appointment.id,
+			status: "READY",
+		});
+		expect(
+			(
+				await scopedDb.activity.findUnique({
+					where: { id: target.appointment.id },
+				})
+			)?.archivedAt,
+		).not.toBeNull();
+	});
+});
diff --git a/apps/api/test/appointment-assets-migration.integration.spec.ts b/apps/api/test/appointment-assets-migration.integration.spec.ts
new file mode 100644
index 000000000..7be232f36
--- /dev/null
+++ b/apps/api/test/appointment-assets-migration.integration.spec.ts
@@ -0,0 +1,79 @@
+import { beforeAll, expect, it } from "bun:test";
+import { randomUUID } from "node:crypto";
+import { assertLocalTestDatabase, rawDb } from "./appointment-assets.fixture";
+
+beforeAll(assertLocalTestDatabase);
+
+it("backfills legacy artifact timestamps before enforcing the updatedAt column", async () => {
+	const migration = await Bun.file(
+		new URL(
+			"../../../packages/db/prisma/migrations/20260910160000_managed_appointments/migration.sql",
+			import.meta.url,
+		),
+	).text();
+	const schema = `appointment_migration_${randomUUID().replaceAll("-", "")}`;
+	const statements = [
+		...Array.from(
+			migration.matchAll(
+				/ALTER TABLE "artifact" ADD COLUMN "(?:version|updatedAt)"[^;]+;/g,
+			),
+			(match) => match[0],
+		),
+		migration.match(/DO \$\$[\s\S]*?END \$\$;/)?.[0],
+		migration.match(
+			/ALTER TABLE "artifact" ALTER COLUMN "updatedAt" SET NOT NULL;/,
+		)?.[0],
+		migration.match(
+			/ALTER TABLE "artifact" ALTER COLUMN "updatedAt" SET DEFAULT CURRENT_TIMESTAMP;/,
+		)?.[0],
+	];
+	if (statements.some((statement) => !statement))
+		throw new Error(
+			"The artifact migration backfill statements are incomplete.",
+		);
+
+	await rawDb.$transaction(async (tx) => {
+		await tx.$executeRawUnsafe(`CREATE SCHEMA "${schema}"`);
+		await tx.$executeRawUnsafe(`SET LOCAL search_path TO "${schema}"`);
+		await tx.$executeRawUnsafe(
+			`CREATE TABLE "organization" ("id" TEXT PRIMARY KEY)`,
+		);
+		await tx.$executeRawUnsafe(
+			`CREATE TABLE "artifact" ("id" TEXT PRIMARY KEY, "organizationId" TEXT NOT NULL, "dealId" TEXT NOT NULL, "type" TEXT NOT NULL, "fileName" TEXT NOT NULL, "storageKey" TEXT NOT NULL, "createdAt" TIMESTAMP(3) NOT NULL)`,
+		);
+		await tx.$executeRawUnsafe(
+			`INSERT INTO "organization" ("id") VALUES ('tenant-a'), ('tenant-b')`,
+		);
+		await tx.$executeRawUnsafe(
+			`INSERT INTO "artifact" ("id", "organizationId", "dealId", "type", "fileName", "storageKey", "createdAt") VALUES ('old-a', 'tenant-a', 'deal-a', 'photo', 'a.jpg', 'a/key', '2025-01-02 03:04:05.006'), ('old-b', 'tenant-b', 'deal-b', 'document', 'b.pdf', 'b/key', '2025-02-03 04:05:06.007')`,
+		);
+		for (const statement of statements) {
+			if (!statement) throw new Error("Missing artifact migration statement");
+			await tx.$executeRawUnsafe(statement);
+		}
+		const rows = await tx.$queryRawUnsafe<
+			Array<{ id: string; created: string; updated: string; version: number }>
+		>(
+			`SELECT "id", to_char("createdAt", 'YYYY-MM-DD HH24:MI:SS.MS') AS created, to_char("updatedAt", 'YYYY-MM-DD HH24:MI:SS.MS') AS updated, "version" FROM "artifact" ORDER BY "id"`,
+		);
+		expect(rows).toEqual([
+			{
+				id: "old-a",
+				created: "2025-01-02 03:04:05.006",
+				updated: "2025-01-02 03:04:05.006",
+				version: 1,
+			},
+			{
+				id: "old-b",
+				created: "2025-02-03 04:05:06.007",
+				updated: "2025-02-03 04:05:06.007",
+				version: 1,
+			},
+		]);
+		const columns = await tx.$queryRawUnsafe<Array<{ isNullable: string }>>(
+			`SELECT "is_nullable" AS "isNullable" FROM information_schema.columns WHERE table_schema = '${schema}' AND table_name = 'artifact' AND column_name = 'updatedAt'`,
+		);
+		expect(columns[0]?.isNullable).toBe("NO");
+		await tx.$executeRawUnsafe(`DROP SCHEMA "${schema}" CASCADE`);
+	});
+});
diff --git a/apps/api/test/appointment-assets-purge.integration.spec.ts b/apps/api/test/appointment-assets-purge.integration.spec.ts
new file mode 100644
index 000000000..324f70d4c
--- /dev/null
+++ b/apps/api/test/appointment-assets-purge.integration.spec.ts
@@ -0,0 +1,106 @@
+import {
+	afterAll,
+	afterEach,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+} from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedTransaction } from "@crm/db/tenant-scope";
+import { enqueueProjectAssetPurge } from "../src/assets/asset-purge";
+import {
+	AppointmentAssetsFixture,
+	assertLocalTestDatabase,
+	assetTest as it,
+	scopedDb,
+} from "./appointment-assets.fixture";
+
+let fixture: AppointmentAssetsFixture;
+
+describe("appointment and asset purge boundaries", () => {
+	beforeAll(assertLocalTestDatabase);
+	beforeEach(async () => {
+		fixture = new AppointmentAssetsFixture();
+		await fixture.setup();
+	});
+	afterEach(async () => fixture.cleanup());
+	afterAll(async () => scopedDb.$disconnect());
+
+	it("purges synced calendar rows without deleting application appointments or files", async () => {
+		const { appointment } = await fixture.appointment();
+		const { assetId } = await fixture.ready({ appointmentId: appointment.id });
+		const eventId = randomUUID();
+		const event = await scopedDb.calendarEvent.create({
+			data: {
+				id: eventId,
+				iCalUid: `appointment-${randomUUID()}`,
+				originalStartTime: new Date("2099-09-10T15:00:00Z"),
+				title: "Imported event",
+				startsAt: new Date("2099-09-10T15:00:00Z"),
+				endsAt: new Date("2099-09-10T16:00:00Z"),
+				status: "confirmed",
+				companyId: fixture.assets.companyId,
+				syncedByUserId: fixture.assets.userId,
+			},
+		});
+		const imported = await scopedDb.activity.create({
+			data: {
+				type: "MEETING",
+				dealId: fixture.assets.projectId,
+				createdById: fixture.assets.userId,
+				calendarEventId: event.id,
+			},
+		});
+		expect(
+			(await fixture.google.purgeSyncedData(fixture.assets.userId)).purged,
+		).toBe(1);
+		expect(
+			await scopedDb.calendarEvent.findUnique({ where: { id: eventId } }),
+		).toBeNull();
+		expect(
+			await scopedDb.activity.findUnique({ where: { id: imported.id } }),
+		).toBeNull();
+		expect(
+			(
+				await fixture.appointments.getAppointment(
+					fixture.actor,
+					fixture.assets.projectId,
+					appointment.id,
+				)
+			).appointment.id,
+		).toBe(appointment.id);
+		expect(
+			(await fixture.assets.service.getAsset(fixture.actor, assetId)).asset,
+		).toMatchObject({ appointmentId: appointment.id, status: "READY" });
+	});
+
+	it("purges project files before the deal cascade removes appointment rows", async () => {
+		const { appointment } = await fixture.appointment({
+			status: "COMPLETED",
+			startsAt: "2025-09-10T15:00:00Z",
+		});
+		const { uploadId } = await fixture.ready({ appointmentId: appointment.id });
+		const upload = await scopedDb.assetUpload.findUniqueOrThrow({
+			where: { id: uploadId },
+		});
+		await scopedTransaction(async (tx) => {
+			await enqueueProjectAssetPurge(tx, fixture.assets.projectId);
+			await tx.deal.delete({ where: { id: fixture.assets.projectId } });
+		});
+		await fixture.assets.worker.process();
+		expect(fixture.assets.storage.objects.has(upload.finalKey)).toBe(false);
+		expect(
+			await scopedDb.appointmentDetails.findUnique({
+				where: { activityId: appointment.id },
+			}),
+		).toBeNull();
+		expect(
+			await scopedDb.activity.findUnique({ where: { id: appointment.id } }),
+		).toBeNull();
+		if (!upload.assetId) throw new Error("The ready upload has no asset.");
+		expect(
+			await scopedDb.artifact.findUnique({ where: { id: upload.assetId } }),
+		).toBeNull();
+	});
+});
diff --git a/apps/api/test/appointment-assets-references.integration.spec.ts b/apps/api/test/appointment-assets-references.integration.spec.ts
new file mode 100644
index 000000000..ea2b093c1
--- /dev/null
+++ b/apps/api/test/appointment-assets-references.integration.spec.ts
@@ -0,0 +1,164 @@
+import {
+	afterAll,
+	afterEach,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+} from "bun:test";
+import { randomUUID } from "node:crypto";
+import {
+	AppointmentAssetsFixture,
+	assertLocalTestDatabase,
+	assetTest as it,
+	scopedDb,
+} from "./appointment-assets.fixture";
+
+let fixture: AppointmentAssetsFixture;
+
+describe("appointment and asset references", () => {
+	beforeAll(assertLocalTestDatabase);
+	beforeEach(async () => {
+		fixture = new AppointmentAssetsFixture();
+		await fixture.setup();
+	});
+	afterEach(async () => fixture.cleanup());
+	afterAll(async () => scopedDb.$disconnect());
+
+	it("lists recordings, photos, and documents under their managed appointment", async () => {
+		const { appointment } = await fixture.appointment({
+			status: "COMPLETED",
+			startsAt: "2025-09-10T15:00:00Z",
+		});
+		const files = [
+			{
+				fileName: "visit.wav",
+				kind: "recording",
+				source: "MOBILE_RECORDING" as const,
+				contentType: "audio/wav",
+				durationMilliseconds: 12_000,
+			},
+			{
+				fileName: "kitchen.jpg",
+				kind: "photo",
+				source: "MANUAL" as const,
+				contentType: "image/jpeg",
+			},
+			{
+				fileName: "measurements.pdf",
+				kind: "document",
+				source: "MANUAL" as const,
+				contentType: "application/pdf",
+			},
+		];
+		const assets = [];
+		for (const file of files)
+			assets.push(
+				await fixture.ready({
+					...file,
+					sizeBytes: 4,
+					appointmentId: appointment.id,
+				}),
+			);
+		const listed = await fixture.assets.service.listAppointmentAssets(
+			fixture.actor,
+			appointment.id,
+			{ page: 1, pageSize: 25 },
+		);
+		expect(listed.items.map((asset) => asset.appointmentId)).toEqual(
+			assets.map(() => appointment.id),
+		);
+		expect(listed.items.map((asset) => asset.status)).toEqual([
+			"READY",
+			"READY",
+			"READY",
+		]);
+		const projectAssets = await fixture.assets.service.listProjectAssets(
+			fixture.actor,
+			fixture.assets.projectId,
+			{ page: 1, pageSize: 25 },
+		);
+		expect(projectAssets.total).toBe(3);
+		expect(projectAssets.items.map((asset) => asset.appointmentId)).toEqual(
+			assets.map(() => appointment.id),
+		);
+		expect(
+			(
+				await fixture.appointments.getAppointment(
+					fixture.actor,
+					fixture.assets.projectId,
+					appointment.id,
+				)
+			).appointment.status,
+		).toBe("COMPLETED");
+	});
+
+	it("associates through the appointment create path and keeps the parent immutable", async () => {
+		const { appointment } = await fixture.appointment();
+		const projectAsset = await fixture.ready();
+		const appointmentAsset = await fixture.ready({
+			appointmentId: appointment.id,
+		});
+		const appointmentListing =
+			await fixture.assets.service.listAppointmentAssets(
+				fixture.actor,
+				appointment.id,
+				{ page: 1, pageSize: 25 },
+			);
+		expect(appointmentListing.items.map((asset) => asset.id)).toEqual([
+			appointmentAsset.assetId,
+		]);
+		const projectListing = await fixture.assets.service.listProjectAssets(
+			fixture.actor,
+			fixture.assets.projectId,
+			{ page: 1, pageSize: 25 },
+		);
+		expect(new Set(projectListing.items.map((asset) => asset.id))).toEqual(
+			new Set([projectAsset.assetId, appointmentAsset.assetId]),
+		);
+
+		const before = await scopedDb.artifact.findUniqueOrThrow({
+			where: { id: appointmentAsset.assetId },
+		});
+		const updated = await fixture.updateAsset(appointmentAsset.assetId, {
+			expectedVersion: 1,
+			fileName: "edited.pdf",
+		});
+		expect(updated.asset).toMatchObject({
+			appointmentId: appointment.id,
+			fileName: "edited.pdf",
+			version: 2,
+		});
+		const after = await scopedDb.artifact.findUniqueOrThrow({
+			where: { id: appointmentAsset.assetId },
+		});
+		expect(after.activityId).toBe(before.activityId);
+		expect(after.activityId).toBe(appointment.id);
+	});
+
+	it("replays an accepted appointment create but rejects a missing target before replay", async () => {
+		const { appointment } = await fixture.appointment();
+		const key = randomUUID();
+		const first = await fixture.createUpload(
+			{ appointmentId: appointment.id },
+			fixture.actor,
+			key,
+		);
+		await fixture.archive(appointment.id);
+		const replay = await fixture.createUpload(
+			{ appointmentId: appointment.id },
+			fixture.actor,
+			key,
+		);
+		expect(replay.asset.id).toBe(first.asset.id);
+		expect(replay.upload.id).toBe(first.upload.id);
+		await scopedDb.activity.delete({ where: { id: appointment.id } });
+		await expect(
+			fixture.createUpload(
+				{ appointmentId: appointment.id },
+				fixture.actor,
+				key,
+			),
+		).rejects.toMatchObject({ code: "RESOURCE_NOT_FOUND" });
+	});
+});
diff --git a/apps/api/test/appointment-assets.fixture.ts b/apps/api/test/appointment-assets.fixture.ts
new file mode 100644
index 000000000..2f6e0934f
--- /dev/null
+++ b/apps/api/test/appointment-assets.fixture.ts
@@ -0,0 +1,157 @@
+import { randomUUID } from "node:crypto";
+import { db as rawDb } from "@crm/db";
+import { scopedDb } from "@crm/db/tenant-scope";
+import type { AppointmentCreateInput } from "../src/appointments/appointments.contracts";
+import { AppointmentsService } from "../src/appointments/appointments.service";
+import type { AssetActor } from "../src/assets/assets.service";
+import { ActivityStampService } from "../src/crm/activity-stamp.service";
+import { GoogleConnectionService } from "../src/google/google-connection.service";
+import {
+	AssetsCoreFixture,
+	assertLocalTestDatabase,
+} from "./assets-core.fixture";
+import {
+	addAssetTestMember,
+	assetTest,
+	inAssetTenant,
+	removeAssetTestMember,
+} from "./assets-tenant.fixture";
+
+export { assertLocalTestDatabase, assetTest, inAssetTenant, rawDb, scopedDb };
+
+export class AppointmentAssetsFixture {
+	readonly assets = new AssetsCoreFixture();
+	readonly appointments = new AppointmentsService(rawDb);
+	readonly google = new GoogleConnectionService(
+		rawDb,
+		scopedDb as never,
+		{} as never,
+		{} as never,
+		{} as never,
+		new ActivityStampService(scopedDb as never),
+	);
+	actor!: AssetActor;
+	otherActor!: AssetActor;
+	otherUserId!: string;
+
+	async setup() {
+		await this.assets.setup();
+		this.actor = this.assets.actor;
+		this.otherUserId = randomUUID();
+		await rawDb.user.create({
+			data: {
+				id: this.otherUserId,
+				name: `${this.assets.run}-other`,
+				email: `${this.otherUserId}@assets.test`,
+			},
+		});
+		await addAssetTestMember(this.otherUserId, randomUUID());
+		this.otherActor = { type: "USER", userId: this.otherUserId };
+	}
+
+	async cleanup() {
+		try {
+			await inAssetTenant(() =>
+				scopedDb.assetApiRequest.deleteMany({
+					where: { actorKey: `user:${this.otherUserId}` },
+				}),
+			);
+			await this.assets.cleanup();
+		} finally {
+			await removeAssetTestMember(this.otherUserId);
+			await rawDb.user.deleteMany({ where: { id: this.otherUserId } });
+		}
+	}
+
+	appointment(
+		overrides: Partial<AppointmentCreateInput> = {},
+		actor = this.actor,
+		projectId = this.assets.projectId,
+		key = randomUUID(),
+	) {
+		return inAssetTenant(() =>
+			this.appointments.createAppointment(
+				actor,
+				projectId,
+				{
+					title: "Kitchen site visit",
+					startsAt: "2099-09-10T15:00:00Z",
+					timeZone: "America/Chicago",
+					...overrides,
+				},
+				key,
+			),
+		);
+	}
+
+	archive(appointmentId: string, actor = this.actor, key = randomUUID()) {
+		return inAssetTenant(() =>
+			this.appointments.archiveAppointment(
+				actor,
+				this.assets.projectId,
+				appointmentId,
+				key,
+			),
+		);
+	}
+
+	createUpload(
+		input: Parameters<AssetsCoreFixture["create"]>[0] = {},
+		actor = this.actor,
+		key = randomUUID(),
+	) {
+		const { appointmentId, ...metadata } = input;
+		return inAssetTenant(async () => {
+			const result = appointmentId
+				? await this.assets.service.createAppointmentAsset(
+						actor,
+						appointmentId,
+						this.assets.metadata(metadata),
+						key,
+					)
+				: await this.assets.service.createProjectAsset(
+						actor,
+						this.assets.projectId,
+						this.assets.metadata(metadata),
+						key,
+					);
+			const upload = await scopedDb.assetUpload.findUniqueOrThrow({
+				where: { assetId: result.asset.id },
+			});
+			return { ...result, upload };
+		});
+	}
+
+	async ready(
+		input: Parameters<AssetsCoreFixture["ready"]>[0] = {},
+		actor = this.actor,
+	) {
+		const created = await this.createUpload(input, actor);
+		const upload = await this.assets.put(
+			created.upload.id,
+			input.sizeBytes ?? 4,
+		);
+		await this.assets.service.updateAsset(
+			actor,
+			created.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		await this.assets.worker.process();
+		const state = await this.assets.service.getAsset(actor, created.asset.id);
+		if (state.asset.status !== "READY")
+			throw new Error("The asset did not become ready.");
+		return { uploadId: upload.id, assetId: state.asset.id };
+	}
+
+	updateAsset(
+		assetId: string,
+		input: Parameters<AssetsCoreFixture["service"]["updateAsset"]>[2],
+		actor = this.actor,
+		key = randomUUID(),
+	) {
+		return inAssetTenant(() =>
+			this.assets.service.updateAsset(actor, assetId, input, key),
+		);
+	}
+}
diff --git a/apps/api/test/appointment-recordings-http.e2e.spec.ts b/apps/api/test/appointment-recordings-http.e2e.spec.ts
new file mode 100644
index 000000000..601819913
--- /dev/null
+++ b/apps/api/test/appointment-recordings-http.e2e.spec.ts
@@ -0,0 +1,182 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb } from "@crm/db/tenant-scope";
+import request from "supertest";
+import type { OpenAPIObject } from "trpc-to-openapi";
+import { AssetsHttpFixture } from "./assets-http.fixture";
+import { inAssetTenant } from "./assets-tenant.fixture";
+
+describe("JobSteward recording upload REST contract", () => {
+	const fixture = new AssetsHttpFixture();
+	const appointmentBody = {
+		title: "Kitchen site visit",
+		startsAt: "2026-09-15T15:00:00Z",
+		timeZone: "America/Chicago",
+	};
+	const recordingBody = {
+		contentType: "audio/mp4",
+		byteSize: 1843200,
+		filename: "recording.m4a",
+	};
+
+	beforeAll(() => fixture.setup());
+	afterAll(() => fixture.cleanup());
+
+	async function createAppointment() {
+		const response = await request(fixture.app.getHttpServer())
+			.post(`/projects/${fixture.projectId}/appointments`)
+			.set("x-asset-test-user", fixture.userId)
+			.set("Idempotency-Key", randomUUID())
+			.send(appointmentBody)
+			.expect(200);
+		return response.body.appointment.id as string;
+	}
+
+	function uploadUrl(appointmentId: string) {
+		return request(fixture.app.getHttpServer())
+			.post(`/appointments/${appointmentId}/recordings/upload-url`)
+			.set("x-asset-test-user", fixture.userId)
+			.send(recordingBody);
+	}
+
+	function complete(
+		appointmentId: string,
+		objectKey: string,
+		durationSeconds = 767,
+	) {
+		return request(fixture.app.getHttpServer())
+			.post(`/appointments/${appointmentId}/recordings/complete`)
+			.set("x-asset-test-user", fixture.userId)
+			.send({
+				objectKey,
+				contentType: "audio/mp4",
+				byteSize: recordingBody.byteSize,
+				durationSeconds,
+			});
+	}
+
+	it("accepts JobSteward upload-url bodies and returns a flat PUT slot", async () => {
+		const appointmentId = await createAppointment();
+		const response = await uploadUrl(appointmentId).expect(200);
+		const objectKey = response.body.objectKey;
+		const expiresAt = response.body.expiresAt;
+		expect(objectKey).toEqual(expect.any(String));
+		expect(expiresAt).toEqual(expect.any(String));
+		expect(response.body).toMatchObject({
+			method: "PUT",
+			headers: {
+				"Content-Type": "audio/mp4",
+				"Content-Length": "1843200",
+			},
+		});
+		expect(response.body.uploadUrl).toMatch(/^https:\/\//);
+		expect(response.body).not.toHaveProperty("asset");
+		expect(response.body).not.toHaveProperty("transfer");
+		expect(typeof objectKey).toBe("string");
+		expect(objectKey.length).toBeGreaterThan(0);
+		const asset = await inAssetTenant(() =>
+			scopedDb.artifact.findUniqueOrThrow({
+				where: { id: objectKey },
+			}),
+		);
+		expect(asset).toMatchObject({
+			activityId: appointmentId,
+			kind: "meeting_recording",
+			source: "MOBILE_RECORDING",
+			contentType: "audio/mp4",
+			fileName: "recording.m4a",
+			status: "UNVERIFIED",
+		});
+	});
+
+	it("refreshes the same objectKey while the upload stays PENDING", async () => {
+		const appointmentId = await createAppointment();
+		const first = await uploadUrl(appointmentId).expect(200);
+		const second = await uploadUrl(appointmentId).expect(200);
+		expect(second.body.objectKey).toBe(first.body.objectKey);
+		expect(second.body.uploadUrl).not.toBe(first.body.uploadUrl);
+		expect(
+			await inAssetTenant(() =>
+				scopedDb.artifact.count({
+					where: {
+						activityId: appointmentId,
+						kind: "meeting_recording",
+						source: "MOBILE_RECORDING",
+						status: "UNVERIFIED",
+					},
+				}),
+			),
+		).toBe(1);
+	});
+
+	it("completes without a client poll and accepts a second complete", async () => {
+		const appointmentId = await createAppointment();
+		const slot = await uploadUrl(appointmentId).expect(200);
+		await fixture.put(slot.body.objectKey, recordingBody.byteSize);
+		const first = await complete(appointmentId, slot.body.objectKey).expect(
+			200,
+		);
+		expect(first.body).toEqual({ ok: true });
+		const upload = await fixture.uploadFor(slot.body.objectKey);
+		expect(upload.status).toBe("FINALIZING");
+		expect(
+			await inAssetTenant(() =>
+				scopedDb.assetStorageJob.count({
+					where: { uploadId: upload.id, operation: "FINALIZE_UPLOAD" },
+				}),
+			),
+		).toBe(1);
+		const asset = await inAssetTenant(() =>
+			scopedDb.artifact.findUniqueOrThrow({
+				where: { id: slot.body.objectKey },
+			}),
+		);
+		expect(Number(asset.durationMilliseconds)).toBe(767_000);
+		expect(
+			(await complete(appointmentId, slot.body.objectKey).expect(200)).body,
+		).toEqual({ ok: true });
+	});
+
+	it("returns 409 for foreign, missing, and expired complete requests", async () => {
+		const appointmentId = await createAppointment();
+		const otherAppointmentId = await createAppointment();
+		const slot = await uploadUrl(appointmentId).expect(200);
+		await complete(otherAppointmentId, slot.body.objectKey).expect(409);
+		await complete(appointmentId, randomUUID()).expect(409);
+		await inAssetTenant(() =>
+			scopedDb.assetUpload.update({
+				where: { assetId: slot.body.objectKey },
+				data: { expiresAt: new Date(Date.now() - 1_000) },
+			}),
+		);
+		await complete(appointmentId, slot.body.objectKey).expect(409);
+	});
+
+	it("documents recordings under Appointments and keeps Assets at seven", async () => {
+		const document = await request(fixture.app.getHttpServer())
+			.get("/openapi.json")
+			.expect(200);
+		const openapi = document.body as OpenAPIObject;
+		const paths = openapi.paths ?? {};
+		const upload = paths["/appointments/{appointmentId}/recordings/upload-url"];
+		const done = paths["/appointments/{appointmentId}/recordings/complete"];
+		expect(upload?.post?.tags).toEqual(["Appointments"]);
+		expect(done?.post?.tags).toEqual(["Appointments"]);
+		expect(upload?.post?.parameters ?? []).not.toContainEqual(
+			expect.objectContaining({
+				name: "Idempotency-Key",
+				required: true,
+			}),
+		);
+		const assetOperations = Object.entries(paths)
+			.flatMap(([path, pathItem]) =>
+				(["get", "post", "patch", "delete"] as const).flatMap((method) =>
+					pathItem[method]?.tags?.includes("Assets")
+						? [`${method} ${path}`]
+						: [],
+				),
+			)
+			.sort();
+		expect(assetOperations).toHaveLength(7);
+	});
+});
diff --git a/apps/api/test/appointments-archive.integration.spec.ts b/apps/api/test/appointments-archive.integration.spec.ts
new file mode 100644
index 000000000..ef2d02a42
--- /dev/null
+++ b/apps/api/test/appointments-archive.integration.spec.ts
@@ -0,0 +1,97 @@
+import { expect } from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb } from "@crm/db/tenant-scope";
+import type { AppointmentUpdateInput } from "../src/appointments/appointments.contracts";
+import { appointmentError, appointmentFixture } from "./appointments.fixture";
+
+const f = appointmentFixture();
+const update = (
+	id: string,
+	expectedVersion: number,
+	body: Omit<AppointmentUpdateInput, "expectedVersion">,
+) =>
+	f.service.updateAppointment(
+		f.actor,
+		f.projectId,
+		id,
+		{ expectedVersion, ...body },
+		randomUUID(),
+	);
+
+f.test(
+	"archives idempotently, preserves details, rejects edits, and restores by version",
+	async () => {
+		const { appointment: a } = await f.create({ status: "COMPLETED" });
+		const archived = await f.service.archiveAppointment(
+			f.actor,
+			f.projectId,
+			a.id,
+			randomUUID(),
+		);
+		expect(archived.version).toBe(2);
+		expect(
+			await f.service.archiveAppointment(
+				f.actor,
+				f.projectId,
+				a.id,
+				randomUUID(),
+			),
+		).toEqual(archived);
+		await appointmentError(
+			update(a.id, 2, { notes: "Blocked" }),
+			"APPOINTMENT_ARCHIVED",
+		);
+		await appointmentError(
+			update(a.id, 1, { archived: false }),
+			"VERSION_CONFLICT",
+		);
+		const restored = await update(a.id, 2, { archived: false });
+		expect(restored.appointment).toMatchObject({
+			archivedAt: null,
+			version: 3,
+			status: "COMPLETED",
+			startsAt: a.startsAt,
+			statusChangedAt: a.statusChangedAt,
+		});
+	},
+);
+
+f.test(
+	"allows reads and archive on archived projects but blocks creation, update and restore",
+	async () => {
+		const { appointment: a } = await f.create();
+		await scopedDb.deal.update({
+			where: { id: f.projectId },
+			data: { archivedAt: new Date() },
+		});
+		try {
+			await appointmentError(f.create(), "PROJECT_ARCHIVED");
+			await appointmentError(
+				update(a.id, 1, { title: "Blocked" }),
+				"PROJECT_ARCHIVED",
+			);
+			expect(
+				(await f.service.getAppointment(f.actor, f.projectId, a.id)).appointment
+					.id,
+			).toBe(a.id);
+			expect(
+				(await f.service.listAppointments(f.actor, f.projectId, {})).total,
+			).toBeGreaterThan(0);
+			await f.service.archiveAppointment(
+				f.actor,
+				f.projectId,
+				a.id,
+				randomUUID(),
+			);
+			await appointmentError(
+				update(a.id, 2, { archived: false }),
+				"PROJECT_ARCHIVED",
+			);
+		} finally {
+			await scopedDb.deal.update({
+				where: { id: f.projectId },
+				data: { archivedAt: null },
+			});
+		}
+	},
+);
diff --git a/apps/api/test/appointments-coercion.spec.ts b/apps/api/test/appointments-coercion.spec.ts
new file mode 100644
index 000000000..29f3bd62f
--- /dev/null
+++ b/apps/api/test/appointments-coercion.spec.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it } from "bun:test";
+import {
+	timelineCountsInput,
+	timelineInput,
+} from "../src/activities/activities.contracts";
+import {
+	appointmentListInput,
+	projectAppointmentUpdateInput,
+} from "../src/appointments/appointments.contracts";
+
+describe("appointment transport validation", () => {
+	it("uses strict archive filters for activity timelines and counts", () => {
+		for (const schema of [timelineInput, timelineCountsInput]) {
+			expect(schema.parse({}).archived).toBe(false);
+			for (const archived of [false, "false"])
+				expect(schema.parse({ archived }).archived).toBe(false);
+			for (const archived of [true, "true"])
+				expect(schema.parse({ archived }).archived).toBe(true);
+			for (const archived of ["invalid", "", "0", "1", 0, 1, null])
+				expect(schema.safeParse({ archived }).success).toBe(false);
+		}
+	});
+	it("accepts explicit archive booleans and rejects other query values", () => {
+		for (const archived of [false, "false"]) {
+			expect(appointmentListInput.parse({ archived }).archived).toBe(false);
+		}
+		for (const archived of [true, "true"]) {
+			expect(appointmentListInput.parse({ archived }).archived).toBe(true);
+		}
+		for (const archived of ["invalid", "", "0", "1", 0, 1, null]) {
+			expect(appointmentListInput.safeParse({ archived }).success).toBe(false);
+		}
+		expect(appointmentListInput.parse({}).archived).toBe(false);
+	});
+
+	it("requires numeric positive integer versions", () => {
+		const input = {
+			projectId: "project",
+			appointmentId: "appointment",
+			title: "Changed",
+		};
+		for (const expectedVersion of ["1", "", 0, -1, 1.5, null, true]) {
+			expect(
+				projectAppointmentUpdateInput.safeParse({ ...input, expectedVersion })
+					.success,
+			).toBe(false);
+		}
+		expect(
+			projectAppointmentUpdateInput.parse({ ...input, expectedVersion: 1 })
+				.expectedVersion,
+		).toBe(1);
+	});
+});
diff --git a/apps/api/test/appointments-http.e2e.spec.ts b/apps/api/test/appointments-http.e2e.spec.ts
new file mode 100644
index 000000000..5055c75b9
--- /dev/null
+++ b/apps/api/test/appointments-http.e2e.spec.ts
@@ -0,0 +1,156 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { randomUUID } from "node:crypto";
+import request from "supertest";
+import { AssetsHttpFixture } from "./assets-http.fixture";
+
+describe("managed appointment REST contract", () => {
+	const fixture = new AssetsHttpFixture();
+	const base = `/projects/${fixture.projectId}/appointments`;
+	const body = {
+		title: "Site visit",
+		startsAt: "2026-01-01T10:00:00Z",
+		timeZone: "America/Chicago",
+	};
+	beforeAll(() => fixture.setup());
+	afterAll(() => fixture.cleanup());
+	const call = (
+		method: "get" | "post" | "patch" | "delete",
+		path = base,
+		key = randomUUID(),
+	) =>
+		request(fixture.app.getHttpServer())
+			[method](path)
+			.set("x-asset-test-user", fixture.userId)
+			.set("Idempotency-Key", key);
+
+	it("creates, edits, archives, restores, and replays through public paths", async () => {
+		const key = randomUUID();
+		const first = await call("post", base, key).send(body).expect(200);
+		expect((await call("post", base, key).send(body).expect(200)).body).toEqual(
+			first.body,
+		);
+		expect(first.headers["cache-control"]).toBe("private, no-store");
+		expect(first.headers["x-request-id"]).toBeString();
+		const id = first.body.appointment.id;
+		const path = `${base}/${id}`;
+		const detail = await call("get", path).expect(200);
+		expect(detail.body.appointment).toMatchObject({
+			id,
+			version: 1,
+			status: "SCHEDULED",
+			archivedAt: null,
+		});
+		const edited = await call("patch", path)
+			.send({ expectedVersion: 1, status: "COMPLETED", notes: "Measured wall" })
+			.expect(200);
+		expect(edited.body.appointment).toMatchObject({
+			version: 2,
+			status: "COMPLETED",
+			notes: "Measured wall",
+		});
+		const archived = await call("delete", path).expect(200);
+		expect(archived.body).toEqual({
+			appointmentId: id,
+			archivedAt: expect.any(String),
+			version: 3,
+		});
+		expect((await call("delete", path).expect(200)).body).toEqual(
+			archived.body,
+		);
+		const active = await call(
+			"get",
+			`${base}?page=1&pageSize=1&archived=false`,
+		).expect(200);
+		expect(active.body.total).toBe(0);
+		const archive = await call(
+			"get",
+			`${base}?archived=true&status=COMPLETED&from=2026-01-01T00%3A00%3A00Z&to=2026-01-02T00%3A00%3A00Z`,
+		).expect(200);
+		expect(archive.body.items.map((item: { id: string }) => item.id)).toEqual([
+			id,
+		]);
+		const restoreKey = randomUUID();
+		const restored = await call("patch", path, restoreKey)
+			.send({ expectedVersion: 3, archived: false })
+			.expect(200);
+		expect(restored.body.appointment).toMatchObject({
+			version: 4,
+			status: "COMPLETED",
+			archivedAt: null,
+		});
+		expect(
+			(
+				await call("patch", path, restoreKey)
+					.send({ expectedVersion: 3, archived: false })
+					.expect(200)
+			).body,
+		).toEqual(restored.body);
+	});
+
+	it("rejects unsafe body fields, query controls, and malformed versions", async () => {
+		for (const invalid of [
+			{ ...body, projectId: "other" },
+			{ ...body, appointmentId: "other" },
+			{ ...body, unexpected: true },
+		]) {
+			const response = await call("post").send(invalid).expect(400);
+			expect(response.body.error.code).toBe("VALIDATION_ERROR");
+		}
+		const created = await call("post").send(body).expect(200);
+		const path = `${base}/${created.body.appointment.id}`;
+		for (const invalid of [
+			{ expectedVersion: "1", title: "Changed" },
+			{ expectedVersion: 1, archived: true },
+			{ expectedVersion: 1, archived: false, title: "Changed" },
+			{ expectedVersion: 1, projectId: "other", title: "Changed" },
+			{ expectedVersion: 1 },
+		]) {
+			const response = await call("patch", path).send(invalid).expect(400);
+			expect(response.body.error.code).toBe("VALIDATION_ERROR");
+		}
+		for (const query of [
+			"archived=invalid",
+			"projectId=other",
+			"appointmentId=other",
+			"page=1.5",
+			"extra=1",
+		])
+			await call("get", `${base}?${query}`).expect(400);
+		await call("delete", `${path}?expectedVersion=1`).expect(400);
+		await call("delete", path).send({ expectedVersion: 1 }).expect(400);
+		await call("get", path).send({}).expect(400);
+		await call(
+			"get",
+			`/projects/${fixture.otherProjectId}/appointments/${created.body.appointment.id}`,
+		).expect(404);
+	});
+
+	it("enforces authentication, scopes, and documents each route once", async () => {
+		const denied = await request(fixture.app.getHttpServer())
+			.get(base)
+			.expect(401);
+		expect(denied.body.error.code).toBe("AUTH_REQUIRED");
+		await call("post")
+			.set("x-asset-test-scope", "crm.read")
+			.send(body)
+			.expect(403);
+		await call("get").set("x-asset-test-scope", "crm.write").expect(403);
+		const document = await request(fixture.app.getHttpServer())
+			.get("/openapi.json")
+			.expect(200);
+		const paths = document.body.paths;
+		expect(paths["/projects/{projectId}/appointments"].post).toBeDefined();
+		expect(
+			paths["/projects/{projectId}/appointments/{appointmentId}"].patch,
+		).toBeDefined();
+		expect(paths).not.toHaveProperty("/rest/projects/{projectId}/appointments");
+		const operationIds = Object.values(paths).flatMap((methods) =>
+			Object.entries(methods as object)
+				.filter(([method]) =>
+					["get", "post", "put", "patch", "delete"].includes(method),
+				)
+				.map(([, operation]) => operation.operationId),
+		);
+		expect(new Set(operationIds).size).toBe(operationIds.length);
+	});
+});
diff --git a/apps/api/test/appointments-lifecycle.integration.spec.ts b/apps/api/test/appointments-lifecycle.integration.spec.ts
new file mode 100644
index 000000000..6f5f8f808
--- /dev/null
+++ b/apps/api/test/appointments-lifecycle.integration.spec.ts
@@ -0,0 +1,161 @@
+import { expect } from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb } from "@crm/db/tenant-scope";
+import type { AppointmentUpdateInput } from "../src/appointments/appointments.contracts";
+import { appointmentError, appointmentFixture } from "./appointments.fixture";
+
+const f = appointmentFixture();
+const update = (
+	id: string,
+	expectedVersion: number,
+	body: Omit<AppointmentUpdateInput, "expectedVersion">,
+) =>
+	f.service.updateAppointment(
+		f.actor,
+		f.projectId,
+		id,
+		{ expectedVersion, ...body },
+		randomUUID(),
+	);
+
+f.test(
+	"creates an application-owned meeting with typed details and no contact or calendar link",
+	async () => {
+		const { appointment } = await f.create();
+		expect(appointment).toMatchObject({
+			projectId: f.projectId,
+			customerId: f.companyId,
+			ownerId: f.userId,
+			title: "Site visit",
+			startsAt: "2025-09-10T15:00:00.000Z",
+			status: "SCHEDULED",
+			version: 1,
+			archivedAt: null,
+		});
+		const row = await scopedDb.activity.findUniqueOrThrow({
+			where: { id: appointment.id },
+		});
+		expect(row).toMatchObject({
+			occurredAt: null,
+			contactId: null,
+			calendarEventId: null,
+			completedAt: null,
+			dueAt: null,
+		});
+		expect(appointment.createdAt).toBe(appointment.updatedAt);
+		const project = await scopedDb.deal.findUniqueOrThrow({
+			where: { id: f.projectId },
+		});
+		const customer = await scopedDb.company.findUniqueOrThrow({
+			where: { id: f.companyId },
+		});
+		expect(project.lastActivityAt?.toISOString()).toBe(appointment.createdAt);
+		expect(customer.lastActivityAt?.toISOString()).toBe(appointment.createdAt);
+	},
+);
+
+f.test(
+	"completes, corrects dates, reopens, and cancels without treating files as state",
+	async () => {
+		const { appointment: a } = await f.create();
+		const completed = await update(a.id, 1, { status: "COMPLETED" });
+		expect(completed.appointment.version).toBe(2);
+		let row = await scopedDb.activity.findUniqueOrThrow({
+			where: { id: a.id },
+		});
+		expect(row.occurredAt?.toISOString()).toBe(a.startsAt);
+		const corrected = await update(a.id, 2, {
+			startsAt: "2025-09-09T10:00:00Z",
+		});
+		expect(corrected.appointment.statusChangedAt).toBe(
+			completed.appointment.statusChangedAt,
+		);
+		row = await scopedDb.activity.findUniqueOrThrow({ where: { id: a.id } });
+		expect(row.occurredAt?.toISOString()).toBe("2025-09-09T10:00:00.000Z");
+		await appointmentError(
+			update(a.id, 3, { status: "CANCELED" }),
+			"INVALID_APPOINTMENT_STATE",
+		);
+		await update(a.id, 3, { status: "SCHEDULED" });
+		row = await scopedDb.activity.findUniqueOrThrow({ where: { id: a.id } });
+		expect(row.occurredAt).toBeNull();
+		await update(a.id, 4, { status: "CANCELED" });
+		await appointmentError(
+			update(a.id, 5, { status: "COMPLETED" }),
+			"INVALID_APPOINTMENT_STATE",
+		);
+		await update(a.id, 5, { status: "SCHEDULED" });
+	},
+);
+
+f.test(
+	"rejects future completed creation and correction, invalid dates and time zones",
+	async () => {
+		await appointmentError(
+			f.create({ status: "COMPLETED", startsAt: "2099-01-01T00:00:00Z" }),
+			"VALIDATION_ERROR",
+		);
+		await appointmentError(
+			f.create({ status: "CANCELED" }),
+			"INVALID_APPOINTMENT_STATE",
+		);
+		await appointmentError(
+			f.create({ startsAt: "2025-01-01T10:00:00" }),
+			"VALIDATION_ERROR",
+		);
+		await appointmentError(
+			f.create({ endsAt: "2025-09-09T10:00:00Z" }),
+			"VALIDATION_ERROR",
+		);
+		await appointmentError(
+			f.create({ timeZone: "wrong/timezone" }),
+			"VALIDATION_ERROR",
+		);
+		const { appointment: a } = await f.create({
+			status: "COMPLETED",
+			endsAt: "2025-09-10T16:00:00Z",
+		});
+		await appointmentError(
+			update(a.id, 1, { startsAt: "2099-01-01T00:00:00Z", endsAt: null }),
+			"VALIDATION_ERROR",
+		);
+		await appointmentError(
+			update(a.id, 1, { startsAt: "2025-09-10T17:00:00Z" }),
+			"VALIDATION_ERROR",
+		);
+		const changed = await update(a.id, 1, {
+			notes: null,
+			endsAt: null,
+			location: null,
+		});
+		expect(changed.appointment).toMatchObject({
+			notes: null,
+			endsAt: null,
+			location: null,
+		});
+	},
+);
+
+f.test(
+	"rejects empty, unknown, mixed restore and incorrectly typed mutation fields",
+	async () => {
+		const { appointment: a } = await f.create();
+		for (const body of [
+			{},
+			{ nope: true },
+			{ archived: true },
+			{ archived: "false" },
+			{ archived: false, title: "Mixed" },
+			{ expectedVersion: "1", title: "Bad" },
+		]) {
+			await appointmentError(
+				update(
+					a.id,
+					1,
+					body as Omit<AppointmentUpdateInput, "expectedVersion">,
+				),
+				"VALIDATION_ERROR",
+			);
+		}
+	},
+);
diff --git a/apps/api/test/appointments-read.integration.spec.ts b/apps/api/test/appointments-read.integration.spec.ts
new file mode 100644
index 000000000..38a155529
--- /dev/null
+++ b/apps/api/test/appointments-read.integration.spec.ts
@@ -0,0 +1,195 @@
+import { expect } from "bun:test";
+import { randomUUID } from "node:crypto";
+import type { Db } from "@crm/db";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { timelineInput } from "../src/activities/activities.contracts";
+import { ActivitiesService } from "../src/activities/activities.service";
+import { ActivityStampService } from "../src/crm/activity-stamp.service";
+import { ConversionService } from "../src/currency/conversion.service";
+import { DashboardService } from "../src/dashboard/dashboard.service";
+import { appointmentError, appointmentFixture } from "./appointments.fixture";
+
+const f = appointmentFixture();
+const serviceDb = scopedDb as unknown as Db;
+const stamp = new ActivityStampService(serviceDb);
+const activities = new ActivitiesService(serviceDb, stamp);
+
+f.test(
+	"filters and paginates managed appointments by start, owner, status and archive",
+	async () => {
+		const { appointment: first } = await f.create({
+			startsAt: "2025-01-01T00:00:00Z",
+		});
+		const { appointment: second } = await f.create({
+			startsAt: "2025-01-02T00:00:00Z",
+			ownerId: f.otherUserId,
+			status: "COMPLETED",
+		});
+		await scopedDb.activity.create({
+			data: { dealId: f.projectId, type: "MEETING", createdById: f.userId },
+		});
+		const page = await f.service.listAppointments(f.actor, f.projectId, {
+			pageSize: 1,
+		});
+		expect(page).toMatchObject({
+			total: 2,
+			page: 1,
+			pageSize: 1,
+			hasNextPage: true,
+		});
+		expect(page.items[0]?.id).toBe(first.id);
+		const next = await f.service.listAppointments(f.actor, f.projectId, {
+			page: 2,
+			pageSize: 1,
+		});
+		expect(next.items[0]?.id).toBe(second.id);
+		expect(next.hasNextPage).toBe(false);
+		const filtered = await f.service.listAppointments(f.actor, f.projectId, {
+			from: first.startsAt,
+			to: second.startsAt,
+		});
+		expect(filtered.items.map((a) => a.id)).toEqual([first.id]);
+		expect(
+			(
+				await f.service.listAppointments(f.actor, f.projectId, {
+					status: "COMPLETED",
+					ownerId: f.otherUserId,
+				})
+			).items.map((a) => a.id),
+		).toEqual([second.id]);
+		await appointmentError(
+			f.service.listAppointments(f.actor, f.projectId, {
+				from: second.startsAt,
+				to: first.startsAt,
+			}),
+			"VALIDATION_ERROR",
+		);
+		await f.service.archiveAppointment(
+			f.actor,
+			f.projectId,
+			first.id,
+			randomUUID(),
+		);
+		expect(
+			(await f.service.listAppointments(f.actor, f.projectId, {})).items.map(
+				(a) => a.id,
+			),
+		).toEqual([second.id]);
+		expect(
+			(
+				await f.service.listAppointments(f.actor, f.projectId, {
+					archived: true,
+				})
+			).items.map((a) => a.id),
+		).toEqual([first.id]);
+	},
+);
+
+f.test(
+	"archives timeline and dashboard entries while preserving files, stamps and retained activity totals",
+	async () => {
+		const { appointment: a } = await f.create({
+			startsAt: "2099-01-01T00:00:00Z",
+		});
+		const asset = await scopedDb.artifact.create({
+			data: {
+				dealId: f.projectId,
+				type: "photo",
+				fileName: "retained.jpg",
+				storageKey: randomUUID(),
+				activityId: a.id,
+			},
+		});
+		await stamp.recompute({ dealId: f.projectId, companyId: f.companyId });
+		const before = await scopedDb.deal.findUniqueOrThrow({
+			where: { id: f.projectId },
+		});
+		const total = await scopedDb.activity.count({
+			where: { dealId: f.projectId },
+		});
+		const dashboard = new DashboardService(
+			serviceDb,
+			new ConversionService(serviceDb),
+		);
+		expect(
+			(await dashboard.summary(f.userId, { scope: "me" })).recentActivity.some(
+				(row) => row.id === a.id,
+			),
+		).toBe(true);
+		const activeBefore = await activities.timelineCounts({
+			dealId: f.projectId,
+		});
+		await f.service.archiveAppointment(
+			f.actor,
+			f.projectId,
+			a.id,
+			randomUUID(),
+		);
+		expect((await activities.timelineCounts({ dealId: f.projectId })).all).toBe(
+			activeBefore.all - 1,
+		);
+		expect(
+			(
+				await activities.timeline(timelineInput.parse({ dealId: f.projectId }))
+			).entries.some((row) => row.id === a.id),
+		).toBe(false);
+		expect(
+			(
+				await activities.timeline(
+					timelineInput.parse({ dealId: f.projectId, archived: true }),
+				)
+			).entries.some((row) => row.id === a.id),
+		).toBe(true);
+		expect(
+			(await dashboard.summary(f.userId, { scope: "me" })).recentActivity.some(
+				(row) => row.id === a.id,
+			),
+		).toBe(false);
+		expect(
+			(await scopedDb.deal.findUniqueOrThrow({ where: { id: f.projectId } }))
+				.lastActivityAt,
+		).toEqual(before.lastActivityAt);
+		expect(
+			await scopedDb.activity.count({ where: { dealId: f.projectId } }),
+		).toBe(total);
+		expect(
+			(await scopedDb.artifact.findUniqueOrThrow({ where: { id: asset.id } }))
+				.activityId,
+		).toBe(a.id);
+		await f.service.updateAppointment(
+			f.actor,
+			f.projectId,
+			a.id,
+			{ expectedVersion: 2, archived: false },
+			randomUUID(),
+		);
+		expect((await activities.timelineCounts({ dealId: f.projectId })).all).toBe(
+			activeBefore.all,
+		);
+		expect(
+			(await dashboard.summary(f.userId, { scope: "me" })).recentActivity.some(
+				(row) => row.id === a.id,
+			),
+		).toBe(true);
+		expect(
+			(await scopedDb.deal.findUniqueOrThrow({ where: { id: f.projectId } }))
+				.lastActivityAt,
+		).toEqual(before.lastActivityAt);
+	},
+);
+
+f.test(
+	"places future scheduled appointments after dated timeline entries",
+	async () => {
+		const { appointment: a } = await f.create({
+			startsAt: "2099-01-01T00:00:00Z",
+		});
+		const { appointment: b } = await f.create({ status: "COMPLETED" });
+		const timeline = await activities.timeline(
+			timelineInput.parse({ dealId: f.projectId, limit: 100 }),
+		);
+		expect(timeline.entries.findIndex((row) => row.id === b.id)).toBeLessThan(
+			timeline.entries.findIndex((row) => row.id === a.id),
+		);
+	},
+);
diff --git a/apps/api/test/appointments-replay.integration.spec.ts b/apps/api/test/appointments-replay.integration.spec.ts
new file mode 100644
index 000000000..1e262e466
--- /dev/null
+++ b/apps/api/test/appointments-replay.integration.spec.ts
@@ -0,0 +1,195 @@
+import { expect } from "bun:test";
+import { randomUUID } from "node:crypto";
+import { db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { appointmentError, appointmentFixture } from "./appointments.fixture";
+
+const f = appointmentFixture();
+
+f.test(
+	"replays create and update before stale version checks and rejects changed bodies",
+	async () => {
+		const key = randomUUID();
+		const first = await f.create({}, key);
+		expect(await f.create({}, key)).toEqual(first);
+		await appointmentError(
+			f.create({ title: "Changed" }, key),
+			"IDEMPOTENCY_CONFLICT",
+		);
+		const id = first.appointment.id;
+		const editKey = randomUUID();
+		const body = { expectedVersion: 1, notes: "Saved" };
+		const edited = await f.service.updateAppointment(
+			f.actor,
+			f.projectId,
+			id,
+			body,
+			editKey,
+		);
+		await f.service.updateAppointment(
+			f.actor,
+			f.projectId,
+			id,
+			{ expectedVersion: 2, title: "Next" },
+			randomUUID(),
+		);
+		expect(
+			await f.service.updateAppointment(
+				f.actor,
+				f.projectId,
+				id,
+				body,
+				editKey,
+			),
+		).toEqual(edited);
+		await appointmentError(
+			f.service.updateAppointment(f.actor, f.projectId, id, body, randomUUID()),
+			"VERSION_CONFLICT",
+		);
+		await f.service.archiveAppointment(f.actor, f.projectId, id, randomUUID());
+		expect(
+			await f.service.updateAppointment(
+				f.actor,
+				f.projectId,
+				id,
+				body,
+				editKey,
+			),
+		).toEqual(edited);
+		await scopedDb.activity.delete({ where: { id } });
+		await appointmentError(
+			f.service.updateAppointment(f.actor, f.projectId, id, body, editKey),
+			"RESOURCE_NOT_FOUND",
+		);
+	},
+);
+
+f.test("rejects missing, other-project and generic meeting IDs", async () => {
+	const { appointment: a } = await f.create();
+	await appointmentError(
+		f.service.getAppointment(f.actor, f.otherProjectId, a.id),
+		"RESOURCE_NOT_FOUND",
+	);
+	await appointmentError(
+		f.service.updateAppointment(
+			f.actor,
+			f.otherProjectId,
+			a.id,
+			{ expectedVersion: 1, title: "Other" },
+			randomUUID(),
+		),
+		"RESOURCE_NOT_FOUND",
+	);
+	const generic = await scopedDb.activity.create({
+		data: { type: "MEETING", dealId: f.projectId, createdById: f.userId },
+	});
+	for (const id of [randomUUID(), generic.id]) {
+		await appointmentError(
+			f.service.getAppointment(f.actor, f.projectId, id),
+			"RESOURCE_NOT_FOUND",
+		);
+		await appointmentError(
+			f.service.archiveAppointment(f.actor, f.projectId, id, randomUUID()),
+			"RESOURCE_NOT_FOUND",
+		);
+	}
+});
+
+f.test(
+	"enforces assigned-owner membership and denies saved replay after actor membership loss",
+	async () => {
+		await appointmentError(
+			f.create({ ownerId: randomUUID() }),
+			"RESOURCE_NOT_FOUND",
+		);
+		const key = randomUUID();
+		await f.create({}, key);
+		const membership = await db.member.findFirstOrThrow({
+			where: { userId: f.userId, organizationId: f.organizationId },
+		});
+		await db.member.delete({ where: { id: membership.id } });
+		try {
+			await appointmentError(f.create({}, key), "RESOURCE_NOT_FOUND");
+		} finally {
+			await db.member.create({ data: membership });
+		}
+	},
+);
+
+f.test(
+	"isolates appointment details and project reads across organizations",
+	async () => {
+		const { appointment: a } = await f.create();
+		const otherOrganization = randomUUID();
+		await db.organization.create({
+			data: {
+				id: otherOrganization,
+				name: "Other",
+				slug: otherOrganization,
+				createdAt: new Date(),
+			},
+		});
+		await db.member.create({
+			data: {
+				id: randomUUID(),
+				organizationId: otherOrganization,
+				userId: f.userId,
+				role: "member",
+				createdAt: new Date(),
+			},
+		});
+		try {
+			await runInTenant(otherOrganization, async () => {
+				expect(
+					await scopedDb.appointmentDetails.findUnique({
+						where: { activityId: a.id },
+					}),
+				).toBeNull();
+				await appointmentError(
+					f.service.getAppointment(f.actor, f.projectId, a.id),
+					"RESOURCE_NOT_FOUND",
+				);
+				await appointmentError(
+					f.service.listAppointments(f.actor, f.projectId, {}),
+					"RESOURCE_NOT_FOUND",
+				);
+				await appointmentError(
+					f.service.updateAppointment(
+						f.actor,
+						f.projectId,
+						a.id,
+						{ expectedVersion: 1, title: "Cross tenant" },
+						randomUUID(),
+					),
+					"RESOURCE_NOT_FOUND",
+				);
+			});
+		} finally {
+			await db.organization.delete({ where: { id: otherOrganization } });
+		}
+	},
+);
+
+f.test(
+	"serializes updates from two actors so exactly one expected version succeeds",
+	async () => {
+		const { appointment: a } = await f.create();
+		const results = await Promise.allSettled(
+			[f.actor, { type: "USER" as const, userId: f.otherUserId }].map((actor) =>
+				f.service.updateAppointment(
+					actor,
+					f.projectId,
+					a.id,
+					{ expectedVersion: 1, title: actor.userId },
+					randomUUID(),
+				),
+			),
+		);
+		expect(results.filter((r) => r.status === "fulfilled")).toHaveLength(1);
+		const rejected = results.find((r) => r.status === "rejected");
+		expect(rejected?.status === "rejected" && rejected.reason.code).toBe(
+			"VERSION_CONFLICT",
+		);
+	},
+);
diff --git a/apps/api/test/appointments.fixture.ts b/apps/api/test/appointments.fixture.ts
new file mode 100644
index 000000000..8bce047e8
--- /dev/null
+++ b/apps/api/test/appointments.fixture.ts
@@ -0,0 +1,110 @@
+import { afterAll, beforeAll, expect } from "bun:test";
+import { randomUUID } from "node:crypto";
+import { db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedTransaction } from "@crm/db/tenant-scope";
+import { tenantTest } from "@crm/db/test-support";
+import type { AppointmentCreateInput } from "../src/appointments/appointments.contracts";
+import { AppointmentsService } from "../src/appointments/appointments.service";
+import { AssetError } from "../src/assets/asset-error";
+
+export function appointmentFixture() {
+	const organizationId = randomUUID();
+	const userId = randomUUID();
+	const otherUserId = randomUUID();
+	const companyId = randomUUID();
+	const projectId = randomUUID();
+	const otherProjectId = randomUUID();
+	const actor = { type: "USER" as const, userId };
+	const service = new AppointmentsService(db);
+	const input = {
+		title: "Site visit",
+		startsAt: "2025-09-10T10:00:00-05:00",
+		timeZone: "America/Chicago",
+	};
+	const within = <T>(work: () => Promise<T>) =>
+		runInTenant(organizationId, work);
+	beforeAll(async () => {
+		await db.organization.create({
+			data: {
+				id: organizationId,
+				name: "Appointment tests",
+				slug: organizationId,
+				createdAt: new Date(),
+			},
+		});
+		for (const id of [userId, otherUserId]) {
+			await db.user.create({
+				data: { id, name: "Appointment tester", email: `${id}@example.com` },
+			});
+			await db.member.create({
+				data: {
+					id: randomUUID(),
+					organizationId,
+					userId: id,
+					role: "member",
+					createdAt: new Date(),
+				},
+			});
+		}
+		await within(() =>
+			scopedTransaction(async (tx) => {
+				await tx.company.create({
+					data: { id: companyId, name: "Appointment customer" },
+				});
+				for (const id of [projectId, otherProjectId])
+					await tx.deal.create({
+						data: {
+							id,
+							companyId,
+							ownerId: userId,
+							name: "Appointment project",
+						},
+					});
+			}),
+		);
+	});
+	afterAll(async () => {
+		await within(() =>
+			scopedTransaction(async (tx) => {
+				await tx.company.deleteMany({ where: { id: companyId } });
+				await tx.assetApiRequest.deleteMany({ where: { organizationId } });
+			}),
+		);
+		await db.organization.delete({ where: { id: organizationId } });
+		await db.user.deleteMany({ where: { id: { in: [userId, otherUserId] } } });
+	});
+	return {
+		organizationId,
+		userId,
+		otherUserId,
+		companyId,
+		projectId,
+		otherProjectId,
+		actor,
+		service,
+		input,
+		within,
+		test: tenantTest(organizationId),
+		create: (
+			overrides: Partial<AppointmentCreateInput> = {},
+			key = randomUUID(),
+		) =>
+			service.createAppointment(
+				actor,
+				projectId,
+				{ ...input, ...overrides },
+				key,
+			),
+	};
+}
+
+export async function appointmentError(work: Promise<unknown>, code: string) {
+	try {
+		await work;
+		throw new Error(`Expected ${code}`);
+	} catch (error) {
+		expect(error).toBeInstanceOf(AssetError);
+		expect((error as AssetError).code).toBe(code);
+	}
+}
diff --git a/apps/api/test/asset-metadata-state.integration.spec.ts b/apps/api/test/asset-metadata-state.integration.spec.ts
new file mode 100644
index 000000000..dd3f0daed
--- /dev/null
+++ b/apps/api/test/asset-metadata-state.integration.spec.ts
@@ -0,0 +1,180 @@
+import {
+	afterAll,
+	afterEach,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+} from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	AssetsCoreFixture,
+	assertLocalTestDatabase,
+	assetTest as it,
+} from "./assets-core.fixture";
+
+let fixture: AssetsCoreFixture;
+let service: AssetsCoreFixture["service"];
+let worker: AssetsCoreFixture["worker"];
+let actor: AssetsCoreFixture["actor"];
+let userId: string;
+let projectId: string;
+let create: AssetsCoreFixture["create"];
+let put: AssetsCoreFixture["put"];
+
+describe("asset metadata state", () => {
+	beforeAll(async () => {
+		await assertLocalTestDatabase();
+	});
+
+	beforeEach(async () => {
+		fixture = new AssetsCoreFixture();
+		await fixture.setup();
+		service = fixture.service;
+		worker = fixture.worker;
+		actor = fixture.actor;
+		userId = fixture.userId;
+		projectId = fixture.projectId;
+		create = fixture.create.bind(fixture);
+		put = fixture.put.bind(fixture);
+	});
+
+	afterEach(async () => {
+		await fixture.cleanup();
+	});
+
+	afterAll(async () => {
+		await db.$disconnect();
+	});
+
+	async function meeting(managed = false, archived = false) {
+		const activity = await db.activity.create({
+			data: {
+				type: "MEETING",
+				dealId: projectId,
+				createdById: userId,
+				subject: "Site visit",
+			},
+		});
+		if (managed)
+			await db.appointmentDetails.create({
+				data: {
+					activityId: activity.id,
+					startsAt: new Date("2026-09-01T15:00:00.000Z"),
+					timeZone: "America/Chicago",
+					ownerId: userId,
+				},
+			});
+		if (archived)
+			await db.activity.update({
+				where: { id: activity.id },
+				data: { archivedAt: new Date() },
+			});
+		return activity;
+	}
+
+	it("updates UNVERIFIED assets and blocks other states", async () => {
+		const unverified = await db.artifact.create({
+			data: {
+				dealId: projectId,
+				type: "legacy",
+				fileName: "legacy.bin",
+				storageKey: `legacy-${randomUUID()}`,
+			},
+		});
+		const updated = await service.updateAsset(
+			actor,
+			unverified.id,
+			{ expectedVersion: 1, kind: "document" },
+			randomUUID(),
+		);
+		expect(updated.asset).toMatchObject({
+			status: "UNVERIFIED",
+			version: 2,
+			kind: "document",
+		});
+		await db.artifact.update({
+			where: { id: unverified.id },
+			data: { status: "DELETING" },
+		});
+		await expect(
+			service.updateAsset(
+				actor,
+				unverified.id,
+				{ expectedVersion: 2, fileName: "blocked.bin" },
+				randomUUID(),
+			),
+		).rejects.toMatchObject({ code: "ASSET_NOT_READY" });
+	});
+
+	it("rejects archived managed meetings but accepts generic meetings", async () => {
+		const archivedAppointment = await meeting(true, true);
+		await expect(
+			create({ appointmentId: archivedAppointment.id }),
+		).rejects.toMatchObject({
+			code: "APPOINTMENT_ARCHIVED",
+		});
+		const generic = await meeting(false, true);
+		await expect(create({ appointmentId: generic.id })).rejects.toMatchObject({
+			code: "RESOURCE_NOT_FOUND",
+		});
+		const active = await meeting(true);
+		const created = await create({ appointmentId: active.id });
+		expect(created.asset).toMatchObject({
+			appointmentId: active.id,
+			status: "UNVERIFIED",
+		});
+	});
+
+	it("finishes an accepted upload after appointment archive", async () => {
+		const appointment = await meeting(true);
+		const created = await create({ appointmentId: appointment.id });
+		await put(created.upload.id);
+		await db.activity.update({
+			where: { id: appointment.id },
+			data: { archivedAt: new Date() },
+		});
+		await service.updateAsset(
+			actor,
+			created.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		await worker.process();
+		expect(
+			(await service.getAsset(actor, created.asset.id)).asset,
+		).toMatchObject({
+			appointmentId: appointment.id,
+			status: "READY",
+			version: 1,
+		});
+	});
+
+	it("replays completion without creating duplicate worker jobs", async () => {
+		const created = await create();
+		await put(created.upload.id);
+		const key = randomUUID();
+		const first = await service.updateAsset(
+			actor,
+			created.asset.id,
+			{ uploadCompleted: true },
+			key,
+		);
+		const replay = await service.updateAsset(
+			actor,
+			created.asset.id,
+			{ uploadCompleted: true },
+			key,
+		);
+		expect(replay).toEqual(first);
+		expect(
+			await db.assetStorageJob.count({
+				where: {
+					uploadId: created.upload.id,
+					operation: "FINALIZE_UPLOAD",
+				},
+			}),
+		).toBe(1);
+	});
+});
diff --git a/apps/api/test/asset-metadata.integration.spec.ts b/apps/api/test/asset-metadata.integration.spec.ts
new file mode 100644
index 000000000..4f97d7222
--- /dev/null
+++ b/apps/api/test/asset-metadata.integration.spec.ts
@@ -0,0 +1,163 @@
+import {
+	afterAll,
+	afterEach,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+} from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	AssetsCoreFixture,
+	assertLocalTestDatabase,
+	assetTest as it,
+} from "./assets-core.fixture";
+
+let fixture: AssetsCoreFixture;
+let service: AssetsCoreFixture["service"];
+let worker: AssetsCoreFixture["worker"];
+let actor: AssetsCoreFixture["actor"];
+let create: AssetsCoreFixture["create"];
+let put: AssetsCoreFixture["put"];
+let ready: AssetsCoreFixture["ready"];
+
+describe("asset metadata updates", () => {
+	beforeAll(async () => {
+		await assertLocalTestDatabase();
+	});
+
+	beforeEach(async () => {
+		fixture = new AssetsCoreFixture();
+		await fixture.setup();
+		service = fixture.service;
+		worker = fixture.worker;
+		actor = fixture.actor;
+		create = fixture.create.bind(fixture);
+		put = fixture.put.bind(fixture);
+		ready = fixture.ready.bind(fixture);
+	});
+
+	afterEach(async () => {
+		await fixture.cleanup();
+	});
+
+	afterAll(async () => {
+		await db.$disconnect();
+	});
+
+	it("updates editable metadata and preserves upload fields", async () => {
+		const created = await create({
+			fileName: "before.bin",
+			kind: "document",
+			sizeBytes: 4,
+		});
+		await put(created.upload.id);
+		await service.updateAsset(
+			actor,
+			created.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		await worker.process();
+		const before = await db.artifact.findUniqueOrThrow({
+			where: { id: created.asset.id },
+		});
+		const updated = await service.updateAsset(
+			actor,
+			before.id,
+			{
+				expectedVersion: 1,
+				fileName: "after.jpg",
+				kind: "photo",
+			},
+			randomUUID(),
+		);
+		expect(updated.asset).toMatchObject({
+			fileName: "after.jpg",
+			kind: "photo",
+			appointmentId: null,
+			status: "READY",
+			version: 2,
+		});
+		const after = await db.artifact.findUniqueOrThrow({
+			where: { id: before.id },
+		});
+		expect(after.type).toBe("photo");
+		expect(after.storageKey).toBe(before.storageKey);
+		expect(after.storageBucket).toBe(before.storageBucket);
+		expect(after.sizeBytes).toBe(before.sizeBytes);
+		expect(after.contentType).toBe(before.contentType);
+		expect(after.source).toBe(before.source);
+		expect(after.updatedAt.getTime()).toBeGreaterThanOrEqual(
+			before.updatedAt.getTime(),
+		);
+	});
+
+	it("requires a numeric current version and rejects stale retries", async () => {
+		const { assetId } = await ready();
+		await expect(
+			service.updateAsset(
+				actor,
+				assetId,
+				{
+					expectedVersion: "1" as never,
+					fileName: "wrong.bin",
+				},
+				randomUUID(),
+			),
+		).rejects.toMatchObject({ code: "VALIDATION_ERROR" });
+		const first = await service.updateAsset(
+			actor,
+			assetId,
+			{
+				expectedVersion: 1,
+				fileName: "first.bin",
+			},
+			randomUUID(),
+		);
+		expect(first.asset.version).toBe(2);
+		await expect(
+			service.updateAsset(
+				actor,
+				assetId,
+				{
+					expectedVersion: 1,
+					fileName: "stale.bin",
+				},
+				randomUUID(),
+			),
+		).rejects.toMatchObject({ code: "VERSION_CONFLICT" });
+	});
+
+	it("serializes concurrent metadata updates under the project lock", async () => {
+		const { assetId } = await ready();
+		const results = await Promise.allSettled([
+			service.updateAsset(
+				actor,
+				assetId,
+				{ expectedVersion: 1, fileName: "first.bin" },
+				randomUUID(),
+			),
+			service.updateAsset(
+				actor,
+				assetId,
+				{ expectedVersion: 1, kind: "photo" },
+				randomUUID(),
+			),
+		]);
+		expect(
+			results.filter((result) => result.status === "fulfilled"),
+		).toHaveLength(1);
+		expect(
+			results.filter((result) => result.status === "rejected"),
+		).toHaveLength(1);
+		expect(
+			(
+				results.find(
+					(result) => result.status === "rejected",
+				) as PromiseRejectedResult
+			).reason,
+		).toMatchObject({ code: "VERSION_CONFLICT" });
+	});
+});
diff --git a/apps/api/test/asset-public-routes.spec.ts b/apps/api/test/asset-public-routes.spec.ts
new file mode 100644
index 000000000..048facc5f
--- /dev/null
+++ b/apps/api/test/asset-public-routes.spec.ts
@@ -0,0 +1,33 @@
+import { describe, expect, it } from "bun:test";
+import { isProjectResourcePath } from "../src/assets/asset-public-routes";
+
+describe("public asset resource routing", () => {
+	it("recognizes canonical assets and managed appointment paths", () => {
+		for (const path of [
+			"/projects/p/assets",
+			"/projects/p/assets/a",
+			"/appointments/a/assets",
+			"/assets/a",
+			"/projects/p/appointments",
+			"/projects/p/appointments/a",
+		])
+			expect(isProjectResourcePath(path)).toBe(true);
+	});
+
+	it("excludes workflow, customer, versioned, and unrelated paths", () => {
+		for (const path of [
+			"/projects/p/asset-uploads",
+			"/projects/p/asset-uploads/a/confirm",
+			"/customers/c/assets",
+			"/rest/v1/projects/p/assets",
+			"/rest/projects/p/appointments",
+			"/v1/customers/c/assets",
+			"/companies/c",
+			"/projects/p/assets-extra",
+			"/api/auth",
+			"/appointments/a/recordings/upload-url",
+			"/appointments/a/recordings/complete",
+		])
+			expect(isProjectResourcePath(path)).toBe(false);
+	});
+});
diff --git a/apps/api/test/asset-purge-automatic.integration.spec.ts b/apps/api/test/asset-purge-automatic.integration.spec.ts
new file mode 100644
index 000000000..5597d9586
--- /dev/null
+++ b/apps/api/test/asset-purge-automatic.integration.spec.ts
@@ -0,0 +1,86 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	AssetPurgeFixture,
+	createAssetPurgeFixture,
+} from "./asset-purge.fixture";
+import { inAssetTenant } from "./assets-tenant.fixture";
+
+let fixture: AssetPurgeFixture;
+let deals: AssetPurgeFixture["deals"];
+let project: AssetPurgeFixture["project"];
+let assetFixture: AssetPurgeFixture["assetFixture"];
+
+describe("asset storage cleanup during automatic deal purge", () => {
+	beforeAll(async () => {
+		fixture = createAssetPurgeFixture();
+		await fixture.setup();
+		deals = fixture.deals;
+		project = fixture.project;
+		assetFixture = fixture.assetFixture;
+	});
+
+	afterAll(async () => {
+		await fixture.clean();
+	});
+	it("keeps automatic purge jobs after the deal cascade", async () => {
+		await inAssetTenant(async () => {
+			const before = new Date("2026-09-01T00:00:00.000Z");
+			const deleted = await project(
+				"automatic-deleted",
+				new Date("2026-08-01T00:00:00.000Z"),
+			);
+			const survivor = await project("automatic-survivor");
+			const deletedAssets = await assetFixture(
+				deleted.id,
+				deleted.companyId,
+				"automatic-deleted",
+			);
+			const survivorAssets = await assetFixture(
+				survivor.id,
+				survivor.companyId,
+				"automatic-survivor",
+			);
+
+			expect(await deals.purgeExpired(before)).toMatchObject({
+				requested: 1,
+				succeeded: 1,
+				skipped: 0,
+				failed: 0,
+			});
+
+			expect(
+				await db.deal.findUnique({ where: { id: deleted.id } }),
+			).toBeNull();
+			expect(
+				await db.assetStorageJob.findMany({
+					where: { projectId: deleted.id },
+					select: { artifactId: true, uploadId: true, objectKey: true },
+				}),
+			).toHaveLength(3);
+			expect(
+				await db.assetUpload.findUnique({
+					where: { id: deletedAssets.upload.id },
+					select: { status: true },
+				}),
+			).toEqual({ status: "CANCELED" });
+
+			expect(
+				await db.deal.findUnique({ where: { id: survivor.id } }),
+			).not.toBeNull();
+			expect(
+				await db.assetStorageJob.count({ where: { projectId: survivor.id } }),
+			).toBe(0);
+			expect(
+				await db.artifact.findUnique({
+					where: { id: survivorAssets.artifact.id },
+				}),
+			).not.toBeNull();
+			expect(
+				await db.assetUpload.findUnique({
+					where: { id: survivorAssets.upload.id },
+				}),
+			).not.toBeNull();
+		});
+	});
+});
diff --git a/apps/api/test/asset-purge.fixture.ts b/apps/api/test/asset-purge.fixture.ts
new file mode 100644
index 000000000..d72a6a8f1
--- /dev/null
+++ b/apps/api/test/asset-purge.fixture.ts
@@ -0,0 +1,176 @@
+import { randomUUID } from "node:crypto";
+import { type Db, db } from "@crm/db";
+import { scopedDb } from "@crm/db/tenant-scope";
+import type { AgentTriggerService } from "../src/agent/agent-trigger.service";
+import { ActivityStampService } from "../src/crm/activity-stamp.service";
+import { ConversionService } from "../src/currency/conversion.service";
+import { DealsService } from "../src/deals/deals.service";
+import { FieldsService } from "../src/fields/fields.service";
+import { withDiscardedCrmEvents } from "./agent-trigger.stub";
+import {
+	addAssetTestMember,
+	inAssetTenant,
+	removeAssetTestMember,
+} from "./assets-tenant.fixture";
+
+export const purgeKeys = [
+	"explicit-deleted",
+	"explicit-survivor",
+	"automatic-deleted",
+	"automatic-survivor",
+] as const;
+export type PurgeKey = (typeof purgeKeys)[number];
+
+export function createAssetPurgeFixture() {
+	const suffix = `${process.env.TEST_RUN_ID ?? "asset-purge-spec"}-${randomUUID()}`;
+	const ownerId = `asset-purge-owner-${suffix}`;
+	const domains = purgeKeys.map((key) => `${key}-${suffix}.test`);
+	const agent = {
+		withCrmEvents: withDiscardedCrmEvents,
+	} as unknown as AgentTriggerService;
+	const serviceDb = scopedDb as unknown as Db;
+	const dealService = new DealsService(
+		serviceDb,
+		agent,
+		new ActivityStampService(serviceDb),
+		new ConversionService(serviceDb),
+		new FieldsService(serviceDb, {
+			fieldBackfill: async () => undefined,
+		} as never),
+	);
+	const deals = {
+		purge: (id: string) => inAssetTenant(() => dealService.purge(id)),
+		purgeExpired: (before: Date) =>
+			inAssetTenant(() => dealService.purgeExpired(before)),
+	};
+
+	async function clean() {
+		const companies = await inAssetTenant(() =>
+			scopedDb.company.findMany({
+				where: { domain: { in: domains } },
+				select: { id: true },
+			}),
+		);
+		const companyIds = companies.map((company) => company.id);
+		const projectIds = purgeKeys.map(
+			(key) => `asset-purge-project-${key}-${suffix}`,
+		);
+
+		await inAssetTenant(async () => {
+			await scopedDb.assetStorageJob.deleteMany({
+				where: { projectId: { in: projectIds } },
+			});
+			await scopedDb.assetEmailSource.deleteMany({
+				where: { projectId: { in: projectIds } },
+			});
+			await scopedDb.assetUpload.deleteMany({
+				where: { projectId: { in: projectIds } },
+			});
+			await scopedDb.artifact.deleteMany({
+				where: { dealId: { in: projectIds } },
+			});
+			await scopedDb.agentTask.deleteMany({
+				where: { dealId: { in: projectIds } },
+			});
+			await scopedDb.deal.deleteMany({ where: { id: { in: projectIds } } });
+			await scopedDb.company.deleteMany({ where: { id: { in: companyIds } } });
+		});
+		await removeAssetTestMember(ownerId);
+		await db.user.deleteMany({ where: { id: ownerId } });
+	}
+
+	async function project(key: PurgeKey, archivedAt: Date | null = null) {
+		return inAssetTenant(async () => {
+			const company = await scopedDb.company.create({
+				data: {
+					id: `asset-purge-company-${key}-${suffix}`,
+					name: `Asset purge ${key} ${suffix}`,
+					domain: `${key}-${suffix}.test`,
+				},
+				select: { id: true },
+			});
+
+			return scopedDb.deal.create({
+				data: {
+					id: `asset-purge-project-${key}-${suffix}`,
+					name: `Asset purge project ${key} ${suffix}`,
+					companyId: company.id,
+					ownerId,
+					archivedAt,
+				},
+				select: { id: true, companyId: true },
+			});
+		});
+	}
+
+	async function assetFixture(
+		projectId: string,
+		companyId: string,
+		key: string,
+	) {
+		return inAssetTenant(async () => {
+			const artifact = await scopedDb.artifact.create({
+				data: {
+					id: `asset-purge-artifact-${key}-${suffix}`,
+					dealId: projectId,
+					type: "file",
+					fileName: `${key}.txt`,
+					storageKey: `projects/${projectId}/${key}.txt`,
+					storageBucket: "crm-assets",
+				},
+				select: { id: true, storageKey: true },
+			});
+
+			const now = Date.now();
+			const upload = await scopedDb.assetUpload.create({
+				data: {
+					id: `asset-purge-upload-${key}-${suffix}`,
+					projectId,
+					customerId: companyId,
+					actorKey: `user:${ownerId}`,
+					fileName: `${key}-upload.txt`,
+					contentType: "text/plain",
+					sizeBytes: 32n,
+					kind: "file",
+					source: "MANUAL",
+					metadataHash: `metadata-${key}-${suffix}`,
+					bucket: "crm-assets",
+					temporaryKey: `temporary/${projectId}/${key}.txt`,
+					finalKey: `projects/${projectId}/${key}-upload.txt`,
+					expiresAt: new Date(now + 60 * 60_000),
+					grantExpiresAt: new Date(now + 60 * 60_000),
+					reservationUntil: new Date(now + 60 * 60_000),
+				},
+				select: { id: true, temporaryKey: true, finalKey: true },
+			});
+
+			return { artifact, upload };
+		});
+	}
+
+	async function setup() {
+		await clean();
+		await db.user.create({
+			data: {
+				id: ownerId,
+				name: "Asset purge owner",
+				email: `${ownerId}@example.test`,
+				emailVerified: true,
+			},
+		});
+		await addAssetTestMember(ownerId, randomUUID());
+	}
+
+	return {
+		suffix,
+		ownerId,
+		keys: purgeKeys,
+		deals,
+		clean,
+		setup,
+		project,
+		assetFixture,
+	};
+}
+
+export type AssetPurgeFixture = ReturnType<typeof createAssetPurgeFixture>;
diff --git a/apps/api/test/asset-purge.integration.spec.ts b/apps/api/test/asset-purge.integration.spec.ts
new file mode 100644
index 000000000..14777d01a
--- /dev/null
+++ b/apps/api/test/asset-purge.integration.spec.ts
@@ -0,0 +1,125 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	AssetPurgeFixture,
+	createAssetPurgeFixture,
+} from "./asset-purge.fixture";
+import { inAssetTenant } from "./assets-tenant.fixture";
+
+let fixture: AssetPurgeFixture;
+let deals: AssetPurgeFixture["deals"];
+let project: AssetPurgeFixture["project"];
+let assetFixture: AssetPurgeFixture["assetFixture"];
+let suffix: AssetPurgeFixture["suffix"];
+
+describe("asset storage cleanup during explicit deal purge", () => {
+	beforeAll(async () => {
+		fixture = createAssetPurgeFixture();
+		await fixture.setup();
+		deals = fixture.deals;
+		project = fixture.project;
+		assetFixture = fixture.assetFixture;
+		suffix = fixture.suffix;
+	});
+
+	afterAll(async () => {
+		await fixture.clean();
+	});
+	it("keeps explicit purge jobs and isolates another project", async () => {
+		await inAssetTenant(async () => {
+			const deleted = await project("explicit-deleted");
+			const survivor = await project("explicit-survivor");
+			const deletedAssets = await assetFixture(
+				deleted.id,
+				deleted.companyId,
+				"explicit-deleted",
+			);
+			const survivorAssets = await assetFixture(
+				survivor.id,
+				survivor.companyId,
+				"explicit-survivor",
+			);
+
+			await expect(deals.purge(deleted.id)).resolves.toEqual({
+				id: deleted.id,
+				name: `Asset purge project explicit-deleted ${suffix}`,
+			});
+
+			const jobs = await db.assetStorageJob.findMany({
+				where: { projectId: deleted.id },
+				orderBy: { operationKey: "asc" },
+				select: {
+					operationKey: true,
+					projectId: true,
+					uploadId: true,
+					artifactId: true,
+					bucket: true,
+					objectKey: true,
+					temporary: true,
+				},
+			});
+
+			expect(jobs).toEqual([
+				{
+					operationKey: `artifact:${deletedAssets.artifact.id}`,
+					projectId: deleted.id,
+					uploadId: null,
+					artifactId: deletedAssets.artifact.id,
+					bucket: "crm-assets",
+					objectKey: deletedAssets.artifact.storageKey,
+					temporary: false,
+				},
+				{
+					operationKey: `orphan:${deletedAssets.upload.id}`,
+					projectId: deleted.id,
+					uploadId: deletedAssets.upload.id,
+					artifactId: null,
+					bucket: "crm-assets",
+					objectKey: deletedAssets.upload.finalKey,
+					temporary: false,
+				},
+				{
+					operationKey: `temporary:${deletedAssets.upload.id}`,
+					projectId: deleted.id,
+					uploadId: deletedAssets.upload.id,
+					artifactId: null,
+					bucket: "crm-assets",
+					objectKey: deletedAssets.upload.temporaryKey,
+					temporary: true,
+				},
+			]);
+
+			expect(
+				await db.deal.findUnique({ where: { id: deleted.id } }),
+			).toBeNull();
+			expect(
+				await db.artifact.findUnique({
+					where: { id: deletedAssets.artifact.id },
+				}),
+			).toBeNull();
+			expect(
+				await db.assetUpload.findUnique({
+					where: { id: deletedAssets.upload.id },
+					select: { status: true },
+				}),
+			).toEqual({ status: "CANCELED" });
+
+			expect(
+				await db.deal.findUnique({ where: { id: survivor.id } }),
+			).not.toBeNull();
+			expect(
+				await db.assetStorageJob.count({ where: { projectId: survivor.id } }),
+			).toBe(0);
+			expect(
+				await db.artifact.findUnique({
+					where: { id: survivorAssets.artifact.id },
+				}),
+			).not.toBeNull();
+			expect(
+				await db.assetUpload.findUnique({
+					where: { id: survivorAssets.upload.id },
+				}),
+			).not.toBeNull();
+		});
+	});
+});
diff --git a/apps/api/test/asset-route-normalization.e2e.spec.ts b/apps/api/test/asset-route-normalization.e2e.spec.ts
new file mode 100644
index 000000000..976cc3ec5
--- /dev/null
+++ b/apps/api/test/asset-route-normalization.e2e.spec.ts
@@ -0,0 +1,72 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { get } from "node:http";
+import type { AddressInfo } from "node:net";
+import request from "supertest";
+import { AssetsHttpFixture } from "./assets-http.fixture";
+
+describe("normalized project resource routes", () => {
+	const fixture = new AssetsHttpFixture();
+	let port: number;
+	beforeAll(async () => {
+		await fixture.setup();
+		await fixture.app.listen(0, "127.0.0.1");
+		port = (fixture.app.getHttpServer().address() as AddressInfo).port;
+	});
+	afterAll(() => fixture.cleanup());
+
+	it("enforces validation and private responses for raw route variants", async () => {
+		for (const path of [
+			`/Projects/${fixture.projectId}/Assets`,
+			`/unused/../projects/${fixture.projectId}/assets`,
+			`/unused/%2e%2e/projects/${fixture.projectId}/assets`,
+			`/Projects/${fixture.projectId}/Appointments`,
+		]) {
+			const response = await new Promise<{
+				status: number | undefined;
+				cache: string | undefined;
+				requestId: string | string[] | undefined;
+				body: string;
+			}>((resolve, reject) => {
+				get(
+					{
+						host: "127.0.0.1",
+						port,
+						path: `${path}?projectId=other`,
+						headers: { "x-asset-test-user": fixture.userId },
+					},
+					(res) => {
+						let body = "";
+						res.setEncoding("utf8");
+						res.on("data", (chunk: string) => {
+							body += chunk;
+						});
+						res.on("error", reject);
+						res.on("end", () =>
+							resolve({
+								status: res.statusCode,
+								cache: res.headers["cache-control"],
+								requestId: res.headers["x-request-id"],
+								body,
+							}),
+						);
+					},
+				).on("error", reject);
+			});
+			expect(response.status).toBe(400);
+			expect(response.cache).toBe("private, no-store");
+			expect(response.requestId).toEqual(expect.any(String));
+			expect(JSON.parse(response.body)).toMatchObject({
+				error: { code: "VALIDATION_ERROR", requestId: response.requestId },
+			});
+		}
+	});
+
+	it("rejects the removed customer asset route", async () => {
+		await request(fixture.app.getHttpServer())
+			.get(
+				`/Customers/${fixture.customerId}/Assets?projectId=${fixture.projectId}`,
+			)
+			.set("x-asset-test-user", fixture.userId)
+			.expect(404);
+	});
+});
diff --git a/apps/api/test/asset-storage-errors.spec.ts b/apps/api/test/asset-storage-errors.spec.ts
new file mode 100644
index 000000000..52e7bf3d8
--- /dev/null
+++ b/apps/api/test/asset-storage-errors.spec.ts
@@ -0,0 +1,122 @@
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { ASSETS } from "../src/assets/asset-config";
+import { AssetStorageService } from "../src/assets/asset-storage.service";
+import type { CapturedRequest } from "./asset-storage.fixture";
+import { testClient, withR2Environment } from "./asset-storage.fixture";
+
+let restore: (() => void) | undefined;
+
+describe("AssetStorageService error behavior", () => {
+	beforeEach(() => {
+		restore = withR2Environment();
+	});
+
+	afterEach(() => {
+		restore?.();
+	});
+
+	it("returns null when HEAD reports a missing object", async () => {
+		const service = new AssetStorageService(
+			undefined,
+			testClient([], [], { statusCode: 404, headers: {} }),
+		);
+
+		expect(await service.head("assets", "temporary/missing")).toBeNull();
+	});
+
+	it("turns a changed source ETag into a state conflict", async () => {
+		const service = new AssetStorageService(
+			undefined,
+			testClient([], [], {
+				statusCode: 412,
+				headers: {},
+				body: new TextEncoder().encode("secret provider details"),
+			}),
+		);
+
+		const promise = service.copy(
+			"assets",
+			"temporary/upload-1",
+			"final/upload-1",
+			'"old"',
+		);
+		await expect(promise).rejects.toMatchObject({
+			status: 409,
+			code: "SOURCE_ETAG_MISMATCH",
+		});
+		await expect(promise).rejects.not.toThrow("secret provider details");
+	});
+
+	it("redacts provider errors and keeps transient errors retryable", async () => {
+		const service = new AssetStorageService(
+			undefined,
+			testClient(
+				[],
+				[],
+				undefined,
+				Object.assign(new Error("secret-key"), {
+					$metadata: { httpStatusCode: 503 },
+				}),
+			),
+		);
+
+		const error = await service
+			.delete("assets", "final/upload-1")
+			.catch((value) => value);
+		expect(error).toMatchObject({
+			status: 503,
+			code: "STORAGE_UNAVAILABLE",
+			retryable: true,
+		});
+		expect(error.message).toBe("Object storage request failed.");
+		expect(error.message).not.toContain("secret-key");
+	});
+
+	it("passes an aborted request signal and sanitizes the provider error", async () => {
+		const requests: CapturedRequest[] = [];
+		const controller = new AbortController();
+		const service = new AssetStorageService(
+			undefined,
+			testClient(
+				requests,
+				[],
+				undefined,
+				Object.assign(new Error("secret provider details"), {
+					name: "AbortError",
+				}),
+			),
+		);
+
+		controller.abort();
+		const error = await service
+			.delete("assets", "temporary/upload-1", controller.signal)
+			.catch((value) => value);
+
+		expect(requests[0]?.abortSignal).toBe(controller.signal);
+		expect(error).toMatchObject({
+			status: 503,
+			code: "STORAGE_UNAVAILABLE",
+			retryable: true,
+		});
+		expect(error.message).toBe("Object storage request failed.");
+		expect(error.message).not.toContain("secret provider details");
+	});
+
+	it("rejects a PUT above the single-request R2 limit", async () => {
+		const service = new AssetStorageService();
+
+		await expect(
+			service.presignPut(
+				"assets",
+				"temporary/upload-1",
+				"application/octet-stream",
+				ASSETS.maxSingleUploadBytes + 1,
+				new Date(Date.now() + 60_000),
+			),
+		).rejects.toMatchObject({
+			status: 413,
+			code: "UPLOAD_TOO_LARGE",
+			details: { maxBytes: 5363466240 },
+		});
+	});
+});
diff --git a/apps/api/test/asset-storage.fixture.ts b/apps/api/test/asset-storage.fixture.ts
new file mode 100644
index 000000000..4ed8cb791
--- /dev/null
+++ b/apps/api/test/asset-storage.fixture.ts
@@ -0,0 +1,86 @@
+import { S3Client } from "@aws-sdk/client-s3";
+
+export const r2Keys = [
+	"R2_ACCOUNT_ID",
+	"R2_ACCESS_KEY_ID",
+	"R2_SECRET_ACCESS_KEY",
+	"R2_BUCKET",
+] as const;
+
+export type ResponseSpec = {
+	statusCode: number;
+	headers?: Record<string, string>;
+	body?: Uint8Array;
+};
+
+export type CapturedRequest = {
+	method: string;
+	path: string;
+	headers: Record<string, string>;
+	abortSignal?: AbortSignal;
+};
+
+export function withR2Environment() {
+	const previous: Partial<Record<(typeof r2Keys)[number], string | undefined>> =
+		{};
+	for (const key of r2Keys) {
+		previous[key] = process.env[key];
+		process.env[key] =
+			key === "R2_ACCOUNT_ID"
+				? "account-id"
+				: key === "R2_ACCESS_KEY_ID"
+					? "access-key"
+					: key === "R2_SECRET_ACCESS_KEY"
+						? "secret-key"
+						: "assets";
+	}
+	return () => {
+		for (const key of r2Keys) {
+			const value = previous[key];
+			if (value === undefined) delete process.env[key];
+			else process.env[key] = value;
+		}
+	};
+}
+
+export function testClient(
+	requests: CapturedRequest[],
+	responses: ResponseSpec[],
+	defaultResponse?: ResponseSpec,
+	failure?: Error,
+): S3Client {
+	const requestHandler = {
+		handle: async (
+			request: CapturedRequest,
+			options: { abortSignal?: AbortSignal },
+		) => {
+			requests.push({
+				method: request.method,
+				path: request.path,
+				headers: request.headers,
+				abortSignal: options.abortSignal,
+			});
+			if (failure) throw failure;
+			const response = responses.shift() ??
+				defaultResponse ?? { statusCode: 204 };
+			return {
+				response: {
+					statusCode: response.statusCode,
+					headers: response.headers ?? {},
+					body: response.body ?? new Uint8Array(),
+				},
+			};
+		},
+	};
+
+	return new S3Client({
+		region: "auto",
+		endpoint: "http://r2.test",
+		forcePathStyle: true,
+		credentials: { accessKeyId: "access-key", secretAccessKey: "secret-key" },
+		maxAttempts: 1,
+		requestChecksumCalculation: "WHEN_REQUIRED",
+		responseChecksumValidation: "WHEN_REQUIRED",
+		requestHandler: requestHandler as never,
+	});
+}
diff --git a/apps/api/test/asset-storage.spec.ts b/apps/api/test/asset-storage.spec.ts
new file mode 100644
index 000000000..514b544ec
--- /dev/null
+++ b/apps/api/test/asset-storage.spec.ts
@@ -0,0 +1,122 @@
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { AssetError } from "../src/assets/asset-error";
+import { AssetStorageService } from "../src/assets/asset-storage.service";
+import type { CapturedRequest, ResponseSpec } from "./asset-storage.fixture";
+import { r2Keys, testClient, withR2Environment } from "./asset-storage.fixture";
+
+let restore: (() => void) | undefined;
+
+describe("AssetStorageService request and signing behavior", () => {
+	beforeEach(() => {
+		restore = withR2Environment();
+	});
+
+	afterEach(() => {
+		restore?.();
+	});
+
+	it("starts without R2 and reports a sanitized unavailable error", () => {
+		for (const key of r2Keys) delete process.env[key];
+		const service = new AssetStorageService();
+
+		expect(service.configured()).toBe(false);
+		expect(() => service.bucket()).toThrow(AssetError);
+		try {
+			service.bucket();
+		} catch (error) {
+			expect(error).toMatchObject({
+				status: 503,
+				code: "STORAGE_UNAVAILABLE",
+				retryable: false,
+			});
+			expect((error as Error).message).not.toContain("secret-key");
+		}
+	});
+
+	it("signs PUT content type and content length without an R2 checksum", async () => {
+		const service = new AssetStorageService();
+		const url = await service.presignPut(
+			"assets",
+			"temporary/upload-1",
+			"audio/mpeg",
+			1234,
+			new Date(Date.now() + 60_000),
+		);
+		const parsed = new URL(url);
+
+		expect(parsed.searchParams.get("X-Amz-SignedHeaders")).toContain(
+			"content-length",
+		);
+		expect(parsed.searchParams.get("X-Amz-SignedHeaders")).toContain(
+			"content-type",
+		);
+		expect(url).not.toContain("checksum");
+	});
+
+	it("signs private GET attachment disposition and response type", async () => {
+		const service = new AssetStorageService();
+		const url = await service.presignGet(
+			"assets",
+			"final/upload-1",
+			"réunion 1.mp3",
+			"audio/mpeg",
+			new Date(Date.now() + 60_000),
+		);
+		const parsed = new URL(url);
+
+		expect(parsed.searchParams.get("response-content-type")).toBe("audio/mpeg");
+		expect(parsed.searchParams.get("response-content-disposition")).toContain(
+			"attachment",
+		);
+		expect(parsed.searchParams.get("response-content-disposition")).toContain(
+			"filename*=UTF-8''r%C3%A9union%201.mp3",
+		);
+	});
+
+	it("intercepts HEAD, conditional COPY, and DELETE requests", async () => {
+		const requests: CapturedRequest[] = [];
+		const responses: ResponseSpec[] = [
+			{
+				statusCode: 200,
+				headers: {
+					"content-length": "42",
+					etag: '"source-etag"',
+					"content-type": "audio/mpeg",
+				},
+			},
+			{
+				statusCode: 200,
+				body: new TextEncoder().encode("<CopyObjectResult/>"),
+			},
+			{ statusCode: 204 },
+		];
+		const service = new AssetStorageService(
+			undefined,
+			testClient(requests, responses),
+		);
+
+		expect(await service.head("assets", "temporary/upload-1")).toEqual({
+			sizeBytes: 42,
+			etag: '"source-etag"',
+			contentType: "audio/mpeg",
+		});
+		await service.copy(
+			"assets",
+			"temporary/upload-1",
+			"final/upload-1",
+			'"source-etag"',
+		);
+		await service.delete("assets", "temporary/upload-1");
+
+		expect(requests).toHaveLength(3);
+		expect(requests[0]?.method).toBe("HEAD");
+		expect(requests[1]?.method).toBe("PUT");
+		expect(requests[1]?.headers["x-amz-copy-source"]).toContain(
+			"assets/temporary/upload-1",
+		);
+		expect(requests[1]?.headers["x-amz-copy-source-if-match"]).toBe(
+			'"source-etag"',
+		);
+		expect(requests[2]?.method).toBe("DELETE");
+	});
+});
diff --git a/apps/api/test/assets-core-abort.integration.spec.ts b/apps/api/test/assets-core-abort.integration.spec.ts
new file mode 100644
index 000000000..a7b482a0d
--- /dev/null
+++ b/apps/api/test/assets-core-abort.integration.spec.ts
@@ -0,0 +1,135 @@
+import {
+	afterAll,
+	afterEach,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+} from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	AssetsCoreFixture,
+	assertLocalTestDatabase,
+	assetTest as it,
+} from "./assets-core.fixture";
+
+let fixture: AssetsCoreFixture;
+let storage: AssetsCoreFixture["storage"];
+let service: AssetsCoreFixture["service"];
+let worker: AssetsCoreFixture["worker"];
+let actor: AssetsCoreFixture["actor"];
+let create: AssetsCoreFixture["create"];
+let put: AssetsCoreFixture["put"];
+let due: AssetsCoreFixture["due"];
+
+describe("asset worker deadlines", () => {
+	beforeAll(async () => {
+		await assertLocalTestDatabase();
+	});
+
+	beforeEach(async () => {
+		fixture = new AssetsCoreFixture();
+		await fixture.setup();
+		storage = fixture.storage;
+		service = fixture.service;
+		worker = fixture.worker;
+		actor = fixture.actor;
+		create = fixture.create.bind(fixture);
+		put = fixture.put.bind(fixture);
+		due = fixture.due.bind(fixture);
+	});
+
+	afterEach(async () => {
+		await fixture.cleanup();
+	});
+
+	afterAll(async () => {
+		await db.$disconnect();
+	});
+
+	it("aborts in-flight storage work at the invocation boundary and durably defers it", async () => {
+		const created = await create();
+		await put(created.upload.id);
+		await service.updateAsset(
+			actor,
+			created.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		const controller = new AbortController();
+		storage.copyHook = async (signal) => {
+			if (!signal) throw new Error("The worker did not pass an abort signal.");
+			await new Promise<void>((_resolve, reject) => {
+				signal.addEventListener("abort", () => reject(signal.reason), {
+					once: true,
+				});
+				setTimeout(() => controller.abort(), 5);
+			});
+		};
+		const start = Date.now();
+		await worker.process(controller.signal);
+		expect(Date.now() - start).toBeLessThan(1_000);
+		const job = await db.assetStorageJob.findUniqueOrThrow({
+			where: { operationKey: `finalize:${created.upload.id}` },
+		});
+		expect(job).toMatchObject({
+			state: "PENDING",
+			attempts: 0,
+			leaseToken: null,
+		});
+		expect(job.lastError).toContain("Invocation deadline");
+		expect((await service.getAsset(actor, created.asset.id)).asset.status).toBe(
+			"UNVERIFIED",
+		);
+		storage.copyHook = null;
+		await due();
+		await worker.process();
+		expect((await service.getAsset(actor, created.asset.id)).asset.status).toBe(
+			"READY",
+		);
+	});
+	it("aborts the initial source metadata request and defers finalization", async () => {
+		const created = await create();
+		await put(created.upload.id);
+		await service.updateAsset(
+			actor,
+			created.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		const controller = new AbortController();
+		storage.headHook = async (signal) => {
+			if (!signal)
+				throw new Error("The worker did not pass an abort signal to HEAD.");
+			await new Promise<void>((_resolve, reject) => {
+				signal.addEventListener("abort", () => reject(signal.reason), {
+					once: true,
+				});
+				setTimeout(() => controller.abort(), 5);
+			});
+		};
+		const start = Date.now();
+		await worker.process(controller.signal);
+		expect(Date.now() - start).toBeLessThan(1_000);
+		expect(storage.copyCount).toBe(0);
+		const job = await db.assetStorageJob.findUniqueOrThrow({
+			where: { operationKey: `finalize:${created.upload.id}` },
+		});
+		expect(job).toMatchObject({
+			state: "PENDING",
+			attempts: 0,
+			leaseToken: null,
+		});
+		expect(job.lastError).toContain("Invocation deadline");
+		expect((await service.getAsset(actor, created.asset.id)).asset.status).toBe(
+			"UNVERIFIED",
+		);
+		storage.headHook = null;
+		await due();
+		await worker.process();
+		expect((await service.getAsset(actor, created.asset.id)).asset.status).toBe(
+			"READY",
+		);
+	});
+});
diff --git a/apps/api/test/assets-core-appointments.integration.spec.ts b/apps/api/test/assets-core-appointments.integration.spec.ts
new file mode 100644
index 000000000..20b619777
--- /dev/null
+++ b/apps/api/test/assets-core-appointments.integration.spec.ts
@@ -0,0 +1,88 @@
+import {
+	afterAll,
+	afterEach,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+} from "bun:test";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	AssetsCoreFixture,
+	assertLocalTestDatabase,
+	assetTest as it,
+} from "./assets-core.fixture";
+
+let fixture: AssetsCoreFixture;
+let service: AssetsCoreFixture["service"];
+let actor: AssetsCoreFixture["actor"];
+let userId: AssetsCoreFixture["userId"];
+let projectId: AssetsCoreFixture["projectId"];
+let otherProjectId: AssetsCoreFixture["otherProjectId"];
+let create: AssetsCoreFixture["create"];
+
+describe("asset appointment resources", () => {
+	beforeAll(async () => {
+		await assertLocalTestDatabase();
+	});
+
+	beforeEach(async () => {
+		fixture = new AssetsCoreFixture();
+		await fixture.setup();
+		service = fixture.service;
+		actor = fixture.actor;
+		userId = fixture.userId;
+		projectId = fixture.projectId;
+		otherProjectId = fixture.otherProjectId;
+		create = fixture.create.bind(fixture);
+	});
+
+	afterEach(async () => {
+		await fixture.cleanup();
+	});
+
+	afterAll(async () => {
+		await db.$disconnect();
+	});
+
+	it("requires a managed appointment for appointment asset creation", async () => {
+		const note = await db.activity.create({
+			data: { type: "NOTE", dealId: projectId, createdById: userId },
+		});
+		await expect(create({ appointmentId: note.id })).rejects.toMatchObject({
+			code: "RESOURCE_NOT_FOUND",
+		});
+		const genericMeeting = await db.activity.create({
+			data: { type: "MEETING", dealId: otherProjectId, createdById: userId },
+		});
+		await expect(
+			create({ appointmentId: genericMeeting.id }),
+		).rejects.toMatchObject({
+			code: "RESOURCE_NOT_FOUND",
+		});
+		await expect(create({ appointmentId: "absent" })).rejects.toMatchObject({
+			code: "RESOURCE_NOT_FOUND",
+		});
+		const managed = await db.activity.create({
+			data: { type: "MEETING", dealId: projectId, createdById: userId },
+		});
+		await db.appointmentDetails.create({
+			data: {
+				activityId: managed.id,
+				startsAt: new Date("2026-09-01T15:00:00.000Z"),
+				timeZone: "America/Chicago",
+				ownerId: userId,
+			},
+		});
+		const created = await create({ appointmentId: managed.id });
+		expect(created.asset).toMatchObject({
+			appointmentId: managed.id,
+			status: "UNVERIFIED",
+		});
+		const listed = await service.listAppointmentAssets(actor, managed.id, {
+			page: 1,
+			pageSize: 25,
+		});
+		expect(listed.items.map((asset) => asset.id)).toEqual([created.asset.id]);
+	});
+});
diff --git a/apps/api/test/assets-core-deletion.integration.spec.ts b/apps/api/test/assets-core-deletion.integration.spec.ts
new file mode 100644
index 000000000..c5f970a01
--- /dev/null
+++ b/apps/api/test/assets-core-deletion.integration.spec.ts
@@ -0,0 +1,188 @@
+import {
+	afterAll,
+	afterEach,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+} from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb as db, scopedTransaction } from "@crm/db/tenant-scope";
+import { AssetError } from "../src/assets/asset-error";
+import { enqueueProjectAssetPurge } from "../src/assets/asset-purge";
+import {
+	AssetsCoreFixture,
+	assertLocalTestDatabase,
+	assetTest as it,
+} from "./assets-core.fixture";
+
+let fixture: AssetsCoreFixture;
+let storage: AssetsCoreFixture["storage"];
+let service: AssetsCoreFixture["service"];
+let worker: AssetsCoreFixture["worker"];
+let actor: AssetsCoreFixture["actor"];
+let projectId: AssetsCoreFixture["projectId"];
+let otherProjectId: AssetsCoreFixture["otherProjectId"];
+let create: AssetsCoreFixture["create"];
+let put: AssetsCoreFixture["put"];
+let ready: AssetsCoreFixture["ready"];
+let due: AssetsCoreFixture["due"];
+
+describe("asset deletion and stale work", () => {
+	beforeAll(async () => {
+		await assertLocalTestDatabase();
+	});
+
+	beforeEach(async () => {
+		fixture = new AssetsCoreFixture();
+		await fixture.setup();
+		storage = fixture.storage;
+		service = fixture.service;
+		worker = fixture.worker;
+		actor = fixture.actor;
+		projectId = fixture.projectId;
+		otherProjectId = fixture.otherProjectId;
+		create = fixture.create.bind(fixture);
+		put = fixture.put.bind(fixture);
+		ready = fixture.ready.bind(fixture);
+		due = fixture.due.bind(fixture);
+	});
+
+	afterEach(async () => {
+		await fixture.cleanup();
+	});
+
+	afterAll(async () => {
+		await db.$disconnect();
+	});
+
+	it("hides deleting assets and retries object deletion without duplicate jobs", async () => {
+		const result = await ready();
+		storage.deleteFailures = 2;
+		expect(
+			(await service.deleteAsset(actor, result.assetId, randomUUID())).status,
+		).toBe("DELETING");
+		await service.deleteAsset(actor, result.assetId, randomUUID());
+		expect((await service.getAsset(actor, result.assetId)).download).toBeNull();
+		expect(
+			(
+				await service.listProjectAssets(actor, projectId, {
+					page: 1,
+					pageSize: 25,
+				})
+			).total,
+		).toBe(0);
+		await worker.process();
+		expect((await service.getAsset(actor, result.assetId)).asset.status).toBe(
+			"DELETING",
+		);
+		storage.deleteFailures = 0;
+		await due();
+		await worker.process();
+		expect((await service.getAsset(actor, result.assetId)).asset).toMatchObject(
+			{ status: "DELETED", deletedAt: expect.any(String) },
+		);
+		expect(
+			await db.assetStorageJob.count({ where: { artifactId: result.assetId } }),
+		).toBe(1);
+	});
+	it("preserves unknown legacy storage references during deletion", async () => {
+		const legacy = await db.artifact.create({
+			data: {
+				dealId: projectId,
+				type: "legacy",
+				fileName: "old.pdf",
+				storageKey: "unknown-original-location",
+			},
+		});
+		const detail = await service.getAsset(actor, legacy.id);
+		expect(detail.asset).toMatchObject({
+			status: "UNVERIFIED",
+			source: null,
+			sizeBytes: null,
+			uploadedById: null,
+		});
+		expect((await service.getAsset(actor, legacy.id)).download).toBeNull();
+		await service.deleteAsset(actor, legacy.id, randomUUID());
+		await worker.process();
+		expect((await service.getAsset(actor, legacy.id)).asset.status).toBe(
+			"DELETING",
+		);
+		const job = await db.assetStorageJob.findFirstOrThrow({
+			where: { artifactId: legacy.id },
+		});
+		expect(job.bucket).toBeNull();
+		expect(job.objectKey).toBe("unknown-original-location");
+		expect(job.lastError).toContain("operator resolution");
+	});
+	it("purges a project during conditional copy and removes its orphan final object", async () => {
+		const created = await create();
+		const upload = await put(created.upload.id);
+		await service.updateAsset(
+			actor,
+			created.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		storage.copyHook = async () => {
+			await scopedTransaction(async (tx) => {
+				await enqueueProjectAssetPurge(tx, projectId);
+				await tx.deal.delete({ where: { id: projectId } });
+			});
+		};
+		await worker.process();
+		expect(await db.artifact.count({ where: { dealId: projectId } })).toBe(0);
+		expect(storage.objects.has(upload.finalKey)).toBe(false);
+		expect(
+			await db.deal.findUnique({ where: { id: otherProjectId } }),
+		).not.toBeNull();
+		await expect(
+			service.getAsset(actor, created.asset.id),
+		).rejects.toBeInstanceOf(AssetError);
+	});
+	it("reconciles final objects from a stale copy after deletion already completes", async () => {
+		const created = await create();
+		const upload = await put(created.upload.id);
+		await service.updateAsset(
+			actor,
+			upload.assetId as string,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		let release: (() => void) | undefined;
+		let copying: (() => void) | undefined;
+		const started = new Promise<void>((resolve) => {
+			copying = resolve;
+		});
+		const delayed = new Promise<void>((resolve) => {
+			release = resolve;
+		});
+		storage.copyHook = async () => {
+			storage.copyHook = null;
+			copying?.();
+			await delayed;
+		};
+		const staleWorker = worker.process();
+		await started;
+		await db.assetStorageJob.update({
+			where: { operationKey: `finalize:${upload.id}` },
+			data: { leaseUntil: new Date(0) },
+		});
+		await worker.process();
+		const complete = await service.getAsset(actor, created.asset.id);
+		expect(complete.asset.status).toBe("READY");
+		await service.deleteAsset(actor, created.asset.id, randomUUID());
+		await worker.process();
+		expect(storage.objects.has(upload.finalKey)).toBe(false);
+		storage.put(upload.temporaryKey);
+		release?.();
+		await staleWorker;
+		expect(storage.objects.has(upload.finalKey)).toBe(true);
+		await db.assetStorageJob.updateMany({
+			where: { projectId },
+			data: { nextAttemptAt: new Date(0) },
+		});
+		await worker.process();
+		expect(storage.objects.has(upload.finalKey)).toBe(false);
+	});
+});
diff --git a/apps/api/test/assets-core-legacy.integration.spec.ts b/apps/api/test/assets-core-legacy.integration.spec.ts
new file mode 100644
index 000000000..456b1eb62
--- /dev/null
+++ b/apps/api/test/assets-core-legacy.integration.spec.ts
@@ -0,0 +1,133 @@
+import {
+	afterAll,
+	afterEach,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+} from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	AssetsCoreFixture,
+	assertLocalTestDatabase,
+	assetTest as it,
+} from "./assets-core.fixture";
+
+let fixture: AssetsCoreFixture;
+let storage: AssetsCoreFixture["storage"];
+let service: AssetsCoreFixture["service"];
+let actor: AssetsCoreFixture["actor"];
+let projectId: AssetsCoreFixture["projectId"];
+let create: AssetsCoreFixture["create"];
+let ready: AssetsCoreFixture["ready"];
+
+describe("asset legacy compatibility", () => {
+	beforeAll(async () => {
+		await assertLocalTestDatabase();
+	});
+
+	beforeEach(async () => {
+		fixture = new AssetsCoreFixture();
+		await fixture.setup();
+		storage = fixture.storage;
+		service = fixture.service;
+		actor = fixture.actor;
+		projectId = fixture.projectId;
+		create = fixture.create.bind(fixture);
+		ready = fixture.ready.bind(fixture);
+	});
+
+	afterEach(async () => {
+		await fixture.cleanup();
+	});
+
+	afterAll(async () => {
+		await db.$disconnect();
+	});
+
+	it("migrates legacy artifacts without inventing object locations or source metadata", async () => {
+		const schema = `asset_migration_${randomUUID().replaceAll("-", "")}`;
+		const migration = await Bun.file(
+			new URL(
+				"../../../packages/db/prisma/migrations/20260907160000_customer_project_assets/migration.sql",
+				import.meta.url,
+			),
+		).text();
+		await db.$transaction(async (tx) => {
+			await tx.$executeRawUnsafe(`CREATE SCHEMA "${schema}"`);
+			await tx.$executeRawUnsafe(`SET LOCAL search_path TO "${schema}"`);
+			await tx.$executeRaw`CREATE TABLE "artifact" ("id" TEXT PRIMARY KEY, "dealId" TEXT NOT NULL, "type" TEXT NOT NULL, "fileName" TEXT NOT NULL, "storageKey" TEXT NOT NULL, "createdAt" TIMESTAMP(3) NOT NULL)`;
+			await tx.$executeRaw`INSERT INTO "artifact" VALUES ('known', 'project-a', 'photo', 'photo.jpg', 'existing/key', '2025-01-01'), ('unknown', 'project-b', ${"x".repeat(65)}, 'unknown.bin', 'unresolved/key', '2025-02-01'), ('missing', 'project-c', '', 'missing', '', '2025-03-01')`;
+			for (const statement of migration
+				.split(";")
+				.map((statement) => statement.trim())
+				.filter(Boolean))
+				await tx.$executeRawUnsafe(statement);
+			const rows = await tx.$queryRaw<
+				Array<{
+					id: string;
+					dealId: string;
+					kind: string;
+					storageKey: string;
+					storageBucket: string | null;
+					sizeBytes: bigint | null;
+					source: string | null;
+					status: string;
+				}>
+			>`SELECT "id", "dealId", "kind", "storageKey", "storageBucket", "sizeBytes", "source", "status" FROM "artifact" ORDER BY "id"`;
+			expect(rows).toEqual([
+				{
+					id: "known",
+					dealId: "project-a",
+					kind: "photo",
+					storageKey: "existing/key",
+					storageBucket: null,
+					sizeBytes: null,
+					source: null,
+					status: "UNVERIFIED",
+				},
+				{
+					id: "missing",
+					dealId: "project-c",
+					kind: "file",
+					storageKey: "",
+					storageBucket: null,
+					sizeBytes: null,
+					source: null,
+					status: "UNVERIFIED",
+				},
+				{
+					id: "unknown",
+					dealId: "project-b",
+					kind: "file",
+					storageKey: "unresolved/key",
+					storageBucket: null,
+					sizeBytes: null,
+					source: null,
+					status: "UNVERIFIED",
+				},
+			]);
+			await tx.$executeRawUnsafe(`DROP SCHEMA "${schema}" CASCADE`);
+		});
+	});
+	it("keeps metadata reads available without storage configuration", async () => {
+		const result = await ready();
+		storage.enabled = false;
+		await expect(create()).rejects.toMatchObject({
+			code: "STORAGE_UNAVAILABLE",
+			retryable: false,
+		});
+		expect((await service.getAsset(actor, result.assetId)).asset.status).toBe(
+			"READY",
+		);
+		expect(
+			(
+				await service.listProjectAssets(actor, projectId, {
+					page: 1,
+					pageSize: 25,
+				})
+			).total,
+		).toBe(1);
+	});
+});
diff --git a/apps/api/test/assets-core-mailbox.integration.spec.ts b/apps/api/test/assets-core-mailbox.integration.spec.ts
new file mode 100644
index 000000000..060ea8589
--- /dev/null
+++ b/apps/api/test/assets-core-mailbox.integration.spec.ts
@@ -0,0 +1,161 @@
+import {
+	afterAll,
+	afterEach,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+} from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import type { AssetActor } from "../src/assets/assets.service";
+import {
+	AssetsCoreFixture,
+	assertLocalTestDatabase,
+	assetTest as it,
+} from "./assets-core.fixture";
+
+let fixture: AssetsCoreFixture;
+let service: AssetsCoreFixture["service"];
+let userId: AssetsCoreFixture["userId"];
+let projectId: AssetsCoreFixture["projectId"];
+let metadata: AssetsCoreFixture["metadata"];
+let email: AssetsCoreFixture["email"];
+
+describe("asset mailbox actors", () => {
+	beforeAll(async () => {
+		await assertLocalTestDatabase();
+	});
+
+	beforeEach(async () => {
+		fixture = new AssetsCoreFixture();
+		await fixture.setup();
+		service = fixture.service;
+		userId = fixture.userId;
+		projectId = fixture.projectId;
+		metadata = fixture.metadata.bind(fixture);
+		email = fixture.email.bind(fixture);
+	});
+
+	afterEach(async () => {
+		await fixture.cleanup();
+	});
+
+	afterAll(async () => {
+		await db.$disconnect();
+	});
+
+	it("binds system upload operations to their verified email source", async () => {
+		const firstSource = await email();
+		const secondSource = await email();
+		await db.mailboxSync.create({ data: { userId, source: "gmail" } });
+		const firstActor: AssetActor = {
+			type: "SYSTEM",
+			mailboxOwnerId: userId,
+			messageId: firstSource.messageId,
+		};
+		const secondActor: AssetActor = {
+			type: "SYSTEM",
+			mailboxOwnerId: userId,
+			messageId: secondSource.messageId,
+		};
+		const created = await service.createProjectAsset(
+			secondActor,
+			projectId,
+			metadata({ source: "EMAIL_ATTACHMENT", emailSource: secondSource }),
+			randomUUID(),
+		);
+		await expect(
+			service.getAsset(firstActor, created.asset.id),
+		).rejects.toMatchObject({ code: "RESOURCE_NOT_FOUND" });
+		await expect(
+			service.updateAsset(
+				firstActor,
+				created.asset.id,
+				{ uploadCompleted: true },
+				randomUUID(),
+			),
+		).rejects.toMatchObject({ code: "RESOURCE_NOT_FOUND" });
+		await db.emailMessage.delete({ where: { id: secondSource.messageId } });
+		await expect(
+			service.getAsset(secondActor, created.asset.id),
+		).rejects.toMatchObject({ code: "RESOURCE_NOT_FOUND" });
+	});
+	it("rejects a system creation replay from a different message actor", async () => {
+		const firstSource = await email();
+		const secondSource = await email();
+		await db.mailboxSync.create({ data: { userId, source: "gmail" } });
+		const firstActor: AssetActor = {
+			type: "SYSTEM",
+			mailboxOwnerId: userId,
+			messageId: firstSource.messageId,
+		};
+		const secondActor: AssetActor = {
+			type: "SYSTEM",
+			mailboxOwnerId: userId,
+			messageId: secondSource.messageId,
+		};
+		const key = randomUUID();
+		const input = metadata({
+			source: "EMAIL_ATTACHMENT",
+			emailSource: secondSource,
+		});
+		const created = await service.createProjectAsset(
+			secondActor,
+			projectId,
+			input,
+			key,
+		);
+		await expect(
+			service.createProjectAsset(firstActor, projectId, input, key),
+		).rejects.toMatchObject({ code: "RESOURCE_NOT_FOUND" });
+		const replay = await service.createProjectAsset(
+			secondActor,
+			projectId,
+			input,
+			key,
+		);
+		expect(replay.asset.id).toBe(created.asset.id);
+		expect(replay.transfer).not.toBeNull();
+		expect(await db.assetUpload.count({ where: { projectId } })).toBe(1);
+	});
+	it("rejects a revoked source mailbox even when another provider remains connected", async () => {
+		const emailSource = await email();
+		await db.mailboxSync.createMany({
+			data: [
+				{ userId, source: "gmail" },
+				{ userId, source: "outlook" },
+			],
+		});
+		const system: AssetActor = {
+			type: "SYSTEM",
+			mailboxOwnerId: userId,
+			messageId: emailSource.messageId,
+		};
+		const key = randomUUID();
+		const input = metadata({ source: "EMAIL_ATTACHMENT", emailSource });
+		const created = await service.createProjectAsset(
+			system,
+			projectId,
+			input,
+			key,
+		);
+		await db.mailboxSync.deleteMany({
+			where: { userId, source: "gmail" },
+		});
+		await expect(
+			service.createProjectAsset(system, projectId, input, key),
+		).rejects.toMatchObject({ code: "RESOURCE_NOT_FOUND" });
+		await expect(
+			service.updateAsset(
+				system,
+				created.asset.id,
+				{ uploadCompleted: true },
+				randomUUID(),
+			),
+		).rejects.toMatchObject({ code: "RESOURCE_NOT_FOUND" });
+		expect(
+			await db.mailboxSync.count({ where: { userId, source: "outlook" } }),
+		).toBe(1);
+	});
+});
diff --git a/apps/api/test/assets-core-project.integration.spec.ts b/apps/api/test/assets-core-project.integration.spec.ts
new file mode 100644
index 000000000..4db119df6
--- /dev/null
+++ b/apps/api/test/assets-core-project.integration.spec.ts
@@ -0,0 +1,178 @@
+import {
+	afterAll,
+	afterEach,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+} from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	AssetsCoreFixture,
+	assertLocalTestDatabase,
+	assetTest as it,
+} from "./assets-core.fixture";
+
+let fixture: AssetsCoreFixture;
+let service: AssetsCoreFixture["service"];
+let worker: AssetsCoreFixture["worker"];
+let actor: AssetsCoreFixture["actor"];
+let projectId: AssetsCoreFixture["projectId"];
+let otherProjectId: AssetsCoreFixture["otherProjectId"];
+let metadata: AssetsCoreFixture["metadata"];
+let create: AssetsCoreFixture["create"];
+let put: AssetsCoreFixture["put"];
+let ready: AssetsCoreFixture["ready"];
+
+describe("asset project operations", () => {
+	beforeAll(async () => {
+		await assertLocalTestDatabase();
+	});
+
+	beforeEach(async () => {
+		fixture = new AssetsCoreFixture();
+		await fixture.setup();
+		service = fixture.service;
+		worker = fixture.worker;
+		actor = fixture.actor;
+		projectId = fixture.projectId;
+		otherProjectId = fixture.otherProjectId;
+		metadata = fixture.metadata.bind(fixture);
+		create = fixture.create.bind(fixture);
+		put = fixture.put.bind(fixture);
+		ready = fixture.ready.bind(fixture);
+	});
+
+	afterEach(async () => {
+		await fixture.cleanup();
+	});
+
+	afterAll(async () => {
+		await db.$disconnect();
+	});
+
+	it("replays creation with a fresh transfer and reports expired state", async () => {
+		const key = randomUUID();
+		const created = await create({}, key);
+		expect(created.asset.status).toBe("UNVERIFIED");
+		expect(created.transfer).not.toBeNull();
+		await db.assetUpload.update({
+			where: { id: created.upload.id },
+			data: { grantExpiresAt: new Date(0), reservationUntil: new Date(0) },
+		});
+		const replay = await create({}, key);
+		expect(replay.asset.id).toBe(created.asset.id);
+		expect(replay.upload.id).toBe(created.upload.id);
+		expect(replay.transfer).not.toBeNull();
+		expect(replay.upload.grantExpiresAt.getTime()).toBeGreaterThan(0);
+		await db.assetUpload.update({
+			where: { id: created.upload.id },
+			data: { expiresAt: new Date(0) },
+		});
+		const expired = await service.getAsset(actor, created.asset.id);
+		expect(expired.asset.status).toBe("UNVERIFIED");
+		expect(expired.download).toBeNull();
+		expect(expired.failure).toMatchObject({ code: "UPLOAD_EXPIRED" });
+		expect(
+			(
+				await db.assetUpload.findUniqueOrThrow({
+					where: { id: created.upload.id },
+				})
+			).status,
+		).toBe("PENDING");
+		await worker.process();
+		expect(
+			(
+				await db.assetUpload.findUniqueOrThrow({
+					where: { id: created.upload.id },
+				})
+			).status,
+		).toBe("EXPIRED");
+		expect(
+			await db.assetStorageJob.count({
+				where: { uploadId: created.upload.id, operation: "DELETE_OBJECT" },
+			}),
+		).toBe(1);
+	});
+	it("rejects new work on archived projects but finishes accepted work", async () => {
+		const created = await create();
+		await put(created.upload.id);
+		await service.updateAsset(
+			actor,
+			created.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		await db.deal.update({
+			where: { id: projectId },
+			data: { archivedAt: new Date() },
+		});
+		await expect(create()).rejects.toMatchObject({ code: "PROJECT_ARCHIVED" });
+		await expect(
+			service.updateAsset(
+				actor,
+				created.asset.id,
+				{ uploadCompleted: true },
+				randomUUID(),
+			),
+		).rejects.toMatchObject({ code: "PROJECT_ARCHIVED" });
+		await worker.process();
+		expect((await service.getAsset(actor, created.asset.id)).asset.status).toBe(
+			"READY",
+		);
+	});
+	it("keeps files within their project and lists each project separately", async () => {
+		const first = await ready();
+		const other = await service.createProjectAsset(
+			actor,
+			otherProjectId,
+			metadata(),
+			randomUUID(),
+		);
+		const otherUpload = await db.assetUpload.findUniqueOrThrow({
+			where: { assetId: other.asset.id },
+		});
+		await put(otherUpload.id);
+		await service.updateAsset(
+			actor,
+			other.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		await worker.process();
+		const firstListing = await service.listProjectAssets(actor, projectId, {
+			page: 1,
+			pageSize: 25,
+		});
+		const otherListing = await service.listProjectAssets(
+			actor,
+			otherProjectId,
+			{
+				page: 1,
+				pageSize: 25,
+			},
+		);
+		expect(firstListing.items.map((asset) => asset.id)).toEqual([
+			first.assetId,
+		]);
+		expect(otherListing.items.map((asset) => asset.id)).toEqual([
+			other.asset.id,
+		]);
+	});
+	it("returns an empty high page without overflowing the database offset", async () => {
+		await ready();
+		expect(
+			await service.listProjectAssets(actor, projectId, {
+				page: Number.MAX_SAFE_INTEGER,
+				pageSize: 100,
+			}),
+		).toEqual({
+			items: [],
+			page: Number.MAX_SAFE_INTEGER,
+			pageSize: 100,
+			total: 1,
+			hasNextPage: false,
+		});
+	});
+});
diff --git a/apps/api/test/assets-core-sources.integration.spec.ts b/apps/api/test/assets-core-sources.integration.spec.ts
new file mode 100644
index 000000000..7b2e23db8
--- /dev/null
+++ b/apps/api/test/assets-core-sources.integration.spec.ts
@@ -0,0 +1,144 @@
+import {
+	afterAll,
+	afterEach,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+} from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import type { AssetActor } from "../src/assets/assets.service";
+import {
+	AssetsCoreFixture,
+	assertLocalTestDatabase,
+	assetTest as it,
+} from "./assets-core.fixture";
+
+let fixture: AssetsCoreFixture;
+let service: AssetsCoreFixture["service"];
+let worker: AssetsCoreFixture["worker"];
+let actor: AssetsCoreFixture["actor"];
+let userId: AssetsCoreFixture["userId"];
+let projectId: AssetsCoreFixture["projectId"];
+let otherProjectId: AssetsCoreFixture["otherProjectId"];
+let metadata: AssetsCoreFixture["metadata"];
+let create: AssetsCoreFixture["create"];
+let put: AssetsCoreFixture["put"];
+let ready: AssetsCoreFixture["ready"];
+let email: AssetsCoreFixture["email"];
+
+describe("asset email sources", () => {
+	beforeAll(async () => {
+		await assertLocalTestDatabase();
+	});
+
+	beforeEach(async () => {
+		fixture = new AssetsCoreFixture();
+		await fixture.setup();
+		service = fixture.service;
+		worker = fixture.worker;
+		actor = fixture.actor;
+		userId = fixture.userId;
+		projectId = fixture.projectId;
+		otherProjectId = fixture.otherProjectId;
+		metadata = fixture.metadata.bind(fixture);
+		create = fixture.create.bind(fixture);
+		put = fixture.put.bind(fixture);
+		ready = fixture.ready.bind(fixture);
+		email = fixture.email.bind(fixture);
+	});
+
+	afterEach(async () => {
+		await fixture.cleanup();
+	});
+
+	afterAll(async () => {
+		await db.$disconnect();
+	});
+
+	it("deduplicates email occurrences and preserves the project binding", async () => {
+		const emailSource = await email();
+		const input = { source: "EMAIL_ATTACHMENT" as const, emailSource };
+		const first = await create(input);
+		const duplicate = await create(input);
+		expect(duplicate.upload.id).toBe(first.upload.id);
+		await expect(create({ ...input, sizeBytes: 9 })).rejects.toMatchObject({
+			code: "SOURCE_CONFLICT",
+		});
+		await expect(
+			service.createProjectAsset(
+				actor,
+				otherProjectId,
+				metadata(input),
+				randomUUID(),
+			),
+		).rejects.toMatchObject({ code: "PROJECT_MISMATCH" });
+		await service.deleteAsset(actor, first.asset.id, randomUUID());
+		await expect(create(input)).rejects.toMatchObject({
+			code: "SOURCE_DELETED",
+		});
+		const distinct = await create({
+			...input,
+			emailSource: { ...emailSource, attachmentId: "gmail-part:2" },
+		});
+		expect(distinct.upload.id).not.toBe(first.upload.id);
+		expect(await db.assetEmailSource.count({ where: { projectId } })).toBe(2);
+	});
+	it("preserves email deletion markers after artifact-row removal", async () => {
+		const emailSource = await email();
+		const result = await ready({ source: "EMAIL_ATTACHMENT", emailSource });
+		const duplicate = await create({ source: "EMAIL_ATTACHMENT", emailSource });
+		expect(duplicate.transfer).toBeNull();
+		expect(duplicate.upload.assetId).toBe(result.assetId);
+		await service.deleteAsset(actor, result.assetId, randomUUID());
+		await worker.process();
+		await db.artifact.delete({ where: { id: result.assetId } });
+		await expect(
+			create({ source: "EMAIL_ATTACHMENT", emailSource }),
+		).rejects.toMatchObject({ code: "SOURCE_DELETED" });
+	});
+	it("verifies the system mailbox actor and stores null uploader attribution", async () => {
+		const emailSource = await email();
+		const system: AssetActor = {
+			type: "SYSTEM",
+			mailboxOwnerId: userId,
+			messageId: emailSource.messageId,
+		};
+		await expect(
+			service.createProjectAsset(
+				system,
+				projectId,
+				metadata({ source: "EMAIL_ATTACHMENT", emailSource }),
+				randomUUID(),
+			),
+		).rejects.toMatchObject({ code: "RESOURCE_NOT_FOUND" });
+		await db.mailboxSync.create({ data: { userId, source: "gmail" } });
+		const result = await service.createProjectAsset(
+			system,
+			projectId,
+			metadata({ source: "EMAIL_ATTACHMENT", emailSource }),
+			randomUUID(),
+		);
+		const createdUpload = await db.assetUpload.findUniqueOrThrow({
+			where: { assetId: result.asset.id },
+		});
+		await put(createdUpload.id);
+		await service.updateAsset(
+			system,
+			result.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		await worker.process();
+		const upload = await db.assetUpload.findUniqueOrThrow({
+			where: { id: createdUpload.id },
+		});
+		expect(upload.uploadedById).toBeNull();
+		expect(upload.mailboxOwnerId).toBe(userId);
+		expect(
+			(await service.getAsset(system, upload.assetId as string)).asset
+				.uploadedById,
+		).toBeNull();
+	});
+});
diff --git a/apps/api/test/assets-core-worker.integration.spec.ts b/apps/api/test/assets-core-worker.integration.spec.ts
new file mode 100644
index 000000000..a779022c6
--- /dev/null
+++ b/apps/api/test/assets-core-worker.integration.spec.ts
@@ -0,0 +1,197 @@
+import {
+	afterAll,
+	afterEach,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+} from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import { ASSETS } from "../src/assets/asset-config";
+import {
+	AssetsCoreFixture,
+	assertLocalTestDatabase,
+	assetTest as it,
+} from "./assets-core.fixture";
+
+let fixture: AssetsCoreFixture;
+let storage: AssetsCoreFixture["storage"];
+let service: AssetsCoreFixture["service"];
+let worker: AssetsCoreFixture["worker"];
+let actor: AssetsCoreFixture["actor"];
+let projectId: AssetsCoreFixture["projectId"];
+let create: AssetsCoreFixture["create"];
+let put: AssetsCoreFixture["put"];
+let due: AssetsCoreFixture["due"];
+
+describe("asset finalization workers", () => {
+	beforeAll(async () => {
+		await assertLocalTestDatabase();
+	});
+
+	beforeEach(async () => {
+		fixture = new AssetsCoreFixture();
+		await fixture.setup();
+		storage = fixture.storage;
+		service = fixture.service;
+		worker = fixture.worker;
+		actor = fixture.actor;
+		projectId = fixture.projectId;
+		create = fixture.create.bind(fixture);
+		put = fixture.put.bind(fixture);
+		due = fixture.due.bind(fixture);
+	});
+
+	afterEach(async () => {
+		await fixture.cleanup();
+	});
+
+	afterAll(async () => {
+		await db.$disconnect();
+	});
+
+	it("reclaims an expired worker lease and refuses state writes from its previous owner", async () => {
+		const created = await create();
+		await put(created.upload.id);
+		await service.updateAsset(
+			actor,
+			created.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		await db.assetStorageJob.update({
+			where: { operationKey: `finalize:${created.upload.id}` },
+			data: {
+				state: "RUNNING",
+				leaseToken: "dead-worker",
+				leaseUntil: new Date(0),
+			},
+		});
+		await worker.process();
+		expect((await service.getAsset(actor, created.asset.id)).asset.status).toBe(
+			"READY",
+		);
+		expect(
+			(await service.getAsset(actor, created.asset.id)).asset.version,
+		).toBe(1);
+		const failed = await create();
+		await put(failed.upload.id);
+		await service.updateAsset(
+			actor,
+			failed.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		storage.copyHook = async () => {
+			await db.assetStorageJob.update({
+				where: { operationKey: `finalize:${failed.upload.id}` },
+				data: {
+					leaseUntil: new Date(Date.now() + ASSETS.worker.leaseMs),
+					leaseToken: "replacement-worker",
+				},
+			});
+		};
+		await worker.process();
+		const retrying = await service.getAsset(actor, failed.asset.id);
+		expect(retrying.asset.status).toBe("UNVERIFIED");
+		expect(retrying.failure).toBeNull();
+		expect(
+			(
+				await db.assetUpload.findUniqueOrThrow({
+					where: { id: failed.upload.id },
+				})
+			).status,
+		).toBe("FINALIZING");
+		storage.copyHook = null;
+		await db.assetStorageJob.update({
+			where: { operationKey: `finalize:${failed.upload.id}` },
+			data: { leaseUntil: new Date(0) },
+		});
+		await worker.process();
+		expect((await service.getAsset(actor, failed.asset.id)).asset.status).toBe(
+			"READY",
+		);
+	});
+	it("fails verification for missing and mismatched bytes", async () => {
+		for (const size of [null, 3]) {
+			const created = await create();
+			if (size !== null) await put(created.upload.id, size);
+			await service.updateAsset(
+				actor,
+				created.asset.id,
+				{ uploadCompleted: true },
+				randomUUID(),
+			);
+			await worker.process();
+			const detail = await service.getAsset(actor, created.asset.id);
+			expect(detail.asset.status).toBe("UNVERIFIED");
+			expect(detail.failure).toMatchObject({
+				code: "UPLOAD_VERIFICATION_FAILED",
+			});
+			expect(
+				(
+					await db.assetUpload.findUniqueOrThrow({
+						where: { id: created.upload.id },
+					})
+				).status,
+			).toBe("FAILED");
+		}
+		expect(await db.artifact.count({ where: { dealId: projectId } })).toBe(2);
+	});
+	it("stops finalization after five failed attempts", async () => {
+		const created = await create();
+		await put(created.upload.id);
+		storage.copyFailures = 8;
+		await service.updateAsset(
+			actor,
+			created.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		for (let attempt = 0; attempt < 5; attempt++) {
+			await due();
+			await worker.process();
+		}
+		const detail = await service.getAsset(actor, created.asset.id);
+		expect(detail.asset.status).toBe("UNVERIFIED");
+		expect(detail.failure).toMatchObject({
+			code: "UPLOAD_FINALIZATION_FAILED",
+		});
+		expect(
+			(
+				await db.assetUpload.findUniqueOrThrow({
+					where: { id: created.upload.id },
+				})
+			).status,
+		).toBe("FAILED");
+		expect(storage.copyCount).toBe(5);
+	});
+	it("serializes cancellation and confirmation", async () => {
+		const created = await create();
+		await put(created.upload.id);
+		const results = await Promise.allSettled([
+			service.deleteAsset(actor, created.asset.id, randomUUID()),
+			service.updateAsset(
+				actor,
+				created.asset.id,
+				{ uploadCompleted: true },
+				randomUUID(),
+			),
+		]);
+		expect(
+			results.filter((result) => result.status === "fulfilled"),
+		).toHaveLength(1);
+		await worker.process();
+		const status = (await service.getAsset(actor, created.asset.id)).asset
+			.status;
+		expect(status).toBe("DELETED");
+		expect(
+			(
+				await db.assetUpload.findUniqueOrThrow({
+					where: { id: created.upload.id },
+				})
+			).status,
+		).toBe("CANCELED");
+	});
+});
diff --git a/apps/api/test/assets-core.fixture.ts b/apps/api/test/assets-core.fixture.ts
new file mode 100644
index 000000000..ebedfbb4f
--- /dev/null
+++ b/apps/api/test/assets-core.fixture.ts
@@ -0,0 +1,192 @@
+import { expect } from "bun:test";
+import { randomUUID } from "node:crypto";
+import { db as rawDb } from "@crm/db";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import { AssetWorkerService } from "../src/assets/asset-worker.service";
+import {
+	type CreateAssetInput,
+	createAssetInput,
+} from "../src/assets/assets.contracts";
+import { type AssetActor, AssetsService } from "../src/assets/assets.service";
+import { MemoryStorage } from "./assets-core.storage.fixture";
+import {
+	addAssetTestMember,
+	assetTest,
+	inAssetTenant,
+	removeAssetTestMember,
+} from "./assets-tenant.fixture";
+
+export { assetTest };
+
+export class AssetsCoreFixture {
+	readonly run = `assets-core-${randomUUID()}`;
+	readonly projectIds: string[] = [];
+	readonly threadIds: string[] = [];
+	readonly storage = new MemoryStorage();
+	readonly service = new AssetsService(rawDb, this.storage);
+	readonly worker = new AssetWorkerService(rawDb, this.storage);
+	actor!: AssetActor;
+	userId!: string;
+	companyId!: string;
+	projectId!: string;
+	otherProjectId!: string;
+
+	async setup() {
+		const user = await rawDb.user.create({
+			data: {
+				id: randomUUID(),
+				name: this.run,
+				email: `${randomUUID()}@assets.test`,
+			},
+		});
+		this.userId = user.id;
+		this.actor = { type: "USER", userId: this.userId };
+		await addAssetTestMember(this.userId, randomUUID());
+		await inAssetTenant(async () => {
+			const company = await db.company.create({
+				data: { name: this.run, domain: `${randomUUID()}.assets.test` },
+			});
+			this.companyId = company.id;
+			const project = await db.deal.create({
+				data: { name: "Kitchen", companyId: company.id, ownerId: this.userId },
+			});
+			const other = await db.deal.create({
+				data: { name: "Bathroom", companyId: company.id, ownerId: this.userId },
+			});
+			this.projectId = project.id;
+			this.otherProjectId = other.id;
+		});
+		this.projectIds.push(this.projectId, this.otherProjectId);
+	}
+
+	async cleanup() {
+		if (!this.projectIds.length) return;
+		await inAssetTenant(async () => {
+			await db.assetStorageJob.deleteMany({
+				where: { projectId: { in: this.projectIds } },
+			});
+			await db.assetEmailSource.deleteMany({
+				where: { projectId: { in: this.projectIds } },
+			});
+			await db.assetUpload.deleteMany({
+				where: { projectId: { in: this.projectIds } },
+			});
+			await db.assetApiRequest.deleteMany({
+				where: {
+					actorKey: { in: [`user:${this.userId}`, `mailbox:${this.userId}`] },
+				},
+			});
+			await db.deal.deleteMany({ where: { id: { in: this.projectIds } } });
+			await db.emailThread.deleteMany({
+				where: { id: { in: this.threadIds } },
+			});
+			await db.company.delete({ where: { id: this.companyId } });
+		});
+		await removeAssetTestMember(this.userId);
+		await rawDb.user.delete({ where: { id: this.userId } });
+	}
+
+	metadata(input: Partial<CreateAssetInput> = {}) {
+		return createAssetInput.parse({
+			fileName: "file.custom",
+			sizeBytes: 4,
+			source: "MANUAL",
+			...input,
+		});
+	}
+
+	async create(
+		input: Partial<CreateAssetInput> & { appointmentId?: string } = {},
+		key = randomUUID(),
+	) {
+		const { appointmentId, ...metadata } = input;
+		const result = appointmentId
+			? await this.service.createAppointmentAsset(
+					this.actor,
+					appointmentId,
+					this.metadata(metadata),
+					key,
+				)
+			: await this.service.createProjectAsset(
+					this.actor,
+					this.projectId,
+					this.metadata(metadata),
+					key,
+				);
+		const upload = await db.assetUpload.findUniqueOrThrow({
+			where: { assetId: result.asset.id },
+		});
+		return { ...result, upload };
+	}
+
+	async put(uploadId: string, size = 4) {
+		const upload = await db.assetUpload.findUniqueOrThrow({
+			where: { id: uploadId },
+		});
+		this.storage.put(upload.temporaryKey, size);
+		return upload;
+	}
+
+	async ready(
+		input: Partial<CreateAssetInput> & { appointmentId?: string } = {},
+	) {
+		const created = await this.create(input);
+		await this.put(created.upload.id, input.sizeBytes ?? 4);
+		await this.service.updateAsset(
+			this.actor,
+			created.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		await this.worker.process();
+		const state = await this.service.getAsset(this.actor, created.asset.id);
+		expect(state.asset.status).toBe("READY");
+		expect(state.asset.version).toBe(1);
+		return { uploadId: created.upload.id, assetId: state.asset.id };
+	}
+
+	async email(attachmentId = "gmail-part:1") {
+		const thread = await db.emailThread.create({
+			data: {
+				rootMessageId: randomUUID(),
+				companyId: this.companyId,
+				firstMessageAt: new Date(),
+				lastMessageAt: new Date(),
+			},
+		});
+		this.threadIds.push(thread.id);
+		const message = await db.emailMessage.create({
+			data: {
+				threadId: thread.id,
+				rfcMessageId: randomUUID(),
+				syncedByUserId: this.userId,
+				gmailMessageId: randomUUID(),
+				direction: "INBOUND",
+				fromEmail: "sender@example.test",
+				recipients: [],
+				sentAt: new Date(),
+			},
+		});
+		return { messageId: message.id, attachmentId };
+	}
+
+	async due() {
+		await db.assetStorageJob.updateMany({
+			where: { projectId: { in: this.projectIds }, state: "PENDING" },
+			data: { nextAttemptAt: new Date(0) },
+		});
+	}
+}
+
+export async function assertLocalTestDatabase() {
+	const url = new URL(process.env.TEST_DATABASE_URL ?? "");
+	if (
+		!["localhost", "127.0.0.1"].includes(url.hostname) ||
+		!url.pathname.endsWith("_test")
+	)
+		throw new Error("Assets integration tests require a local test database.");
+	const rows = await db.$queryRaw<Array<{ name: string }>>`
+		SELECT current_database() AS name
+	`;
+	expect(rows[0]?.name).toBe(url.pathname.slice(1));
+}
diff --git a/apps/api/test/assets-core.integration.spec.ts b/apps/api/test/assets-core.integration.spec.ts
new file mode 100644
index 000000000..dd4bcbcd6
--- /dev/null
+++ b/apps/api/test/assets-core.integration.spec.ts
@@ -0,0 +1,174 @@
+import {
+	afterAll,
+	afterEach,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+} from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import { ASSETS } from "../src/assets/asset-config";
+import {
+	AssetsCoreFixture,
+	assertLocalTestDatabase,
+	assetTest as it,
+} from "./assets-core.fixture";
+
+let fixture: AssetsCoreFixture;
+let storage: AssetsCoreFixture["storage"];
+let service: AssetsCoreFixture["service"];
+let worker: AssetsCoreFixture["worker"];
+let actor: AssetsCoreFixture["actor"];
+let userId: AssetsCoreFixture["userId"];
+let projectId: AssetsCoreFixture["projectId"];
+let create: AssetsCoreFixture["create"];
+let put: AssetsCoreFixture["put"];
+let ready: AssetsCoreFixture["ready"];
+let due: AssetsCoreFixture["due"];
+
+describe("asset state and storage transactions", () => {
+	beforeAll(async () => {
+		await assertLocalTestDatabase();
+	});
+
+	beforeEach(async () => {
+		fixture = new AssetsCoreFixture();
+		await fixture.setup();
+		storage = fixture.storage;
+		service = fixture.service;
+		worker = fixture.worker;
+		actor = fixture.actor;
+		userId = fixture.userId;
+		projectId = fixture.projectId;
+		create = fixture.create.bind(fixture);
+		put = fixture.put.bind(fixture);
+		ready = fixture.ready.bind(fixture);
+		due = fixture.due.bind(fixture);
+	});
+
+	afterEach(async () => {
+		await fixture.cleanup();
+	});
+
+	afterAll(async () => {
+		await db.$disconnect();
+	});
+
+	it("serializes concurrent creation and rejects a changed retry body", async () => {
+		const key = randomUUID();
+		const results = await Promise.all(
+			Array.from({ length: 5 }, () => create({}, key)),
+		);
+		expect(new Set(results.map((result) => result.upload.id)).size).toBe(1);
+		expect(await db.assetUpload.count({ where: { projectId } })).toBe(1);
+		await expect(create({ fileName: "other" }, key)).rejects.toMatchObject({
+			code: "IDEMPOTENCY_CONFLICT",
+		});
+		await db.deal.delete({ where: { id: projectId } });
+		await expect(create({}, key)).rejects.toMatchObject({
+			code: "RESOURCE_NOT_FOUND",
+		});
+	});
+	it("accepts arbitrary formats and zero bytes without a duration cap", async () => {
+		const { assetId } = await ready({
+			fileName: "empty.unknown",
+			sizeBytes: 0,
+			contentType: "arbitrary/x-format",
+			durationMilliseconds: 7_200_000,
+		});
+		const detail = await service.getAsset(actor, assetId);
+		expect(detail.asset).toMatchObject({
+			sizeBytes: 0,
+			contentType: "arbitrary/x-format",
+			durationMilliseconds: 7_200_000,
+			uploadedById: userId,
+			source: "MANUAL",
+		});
+		expect(detail.asset).not.toHaveProperty("storageKey");
+		expect(detail.download).toMatchObject({
+			url: expect.any(String),
+			expiresAt: expect.any(String),
+		});
+	});
+	it("enforces the exact upload-size boundary", async () => {
+		expect(
+			(await create({ sizeBytes: ASSETS.maxSingleUploadBytes })).transfer
+				?.maxBytes,
+		).toBe(5_363_466_240);
+		await expect(
+			create({ sizeBytes: ASSETS.maxSingleUploadBytes + 1 }),
+		).rejects.toMatchObject({ code: "UPLOAD_TOO_LARGE" });
+		expect(await db.assetUpload.count({ where: { projectId } })).toBe(1);
+	});
+	it("retains reservations after cancellation and releases after late-object reconciliation", async () => {
+		const uploads = await Promise.all(
+			Array.from({ length: ASSETS.reservationLimit }, () => create()),
+		);
+		for (const upload of uploads)
+			await service.deleteAsset(actor, upload.asset.id, randomUUID());
+		await worker.process();
+		await expect(create()).rejects.toMatchObject({
+			code: "UPLOAD_CAPACITY_EXCEEDED",
+			retryable: true,
+		});
+		const firstUpload = uploads[0];
+		if (!firstUpload) throw new Error("The reservation fixture is empty.");
+		const first = await put(firstUpload.upload.id);
+		await db.assetUpload.updateMany({
+			where: { projectId },
+			data: { reservationUntil: new Date(0) },
+		});
+		await due();
+		await worker.process();
+		expect(storage.objects.has(first.temporaryKey)).toBe(false);
+		const replacement = await create();
+		expect(replacement.asset.status).toBe("UNVERIFIED");
+		expect(replacement.upload.status).toBe("PENDING");
+	});
+	it("keeps the final object unchanged after an old PUT grant is reused", async () => {
+		const result = await ready();
+		const upload = await db.assetUpload.findUniqueOrThrow({
+			where: { id: result.uploadId },
+		});
+		storage.put(upload.temporaryKey, 88, '"replacement"');
+		await service.updateAsset(
+			actor,
+			result.assetId,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		await worker.process();
+		expect(storage.objects.get(upload.finalKey)?.sizeBytes).toBe(4);
+		expect(storage.copyCount).toBe(1);
+		expect(await db.artifact.count({ where: { dealId: projectId } })).toBe(1);
+	});
+	it("reconciles a copy timeout without copying or inserting twice", async () => {
+		const created = await create();
+		await put(created.upload.id);
+		storage.copyTimeout = true;
+		await service.updateAsset(
+			actor,
+			created.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		await worker.process();
+		const retrying = await service.getAsset(actor, created.asset.id);
+		expect(retrying.asset.status).toBe("UNVERIFIED");
+		expect(retrying.failure).toBeNull();
+		expect(
+			(
+				await db.assetUpload.findUniqueOrThrow({
+					where: { id: created.upload.id },
+				})
+			).status,
+		).toBe("FINALIZING");
+		await due();
+		await worker.process();
+		expect((await service.getAsset(actor, created.asset.id)).asset.status).toBe(
+			"READY",
+		);
+		expect(storage.copyCount).toBe(1);
+	});
+});
diff --git a/apps/api/test/assets-core.storage.fixture.ts b/apps/api/test/assets-core.storage.fixture.ts
new file mode 100644
index 000000000..da4d2f8a5
--- /dev/null
+++ b/apps/api/test/assets-core.storage.fixture.ts
@@ -0,0 +1,86 @@
+import { ConfigService } from "@nestjs/config";
+import type { AssetStorageHead } from "../src/assets/asset-storage.service";
+import { AssetStorageService } from "../src/assets/asset-storage.service";
+
+export class MemoryStorage extends AssetStorageService {
+	objects = new Map<string, AssetStorageHead>();
+	copyCount = 0;
+	deleteFailures = 0;
+	copyFailures = 0;
+	copyTimeout = false;
+	enabled = true;
+	copyHook: ((signal?: AbortSignal) => Promise<void>) | null = null;
+	headHook: ((signal?: AbortSignal) => Promise<void>) | null = null;
+	constructor() {
+		super(
+			new ConfigService({
+				R2_ACCOUNT_ID: "test",
+				R2_ACCESS_KEY_ID: "test",
+				R2_SECRET_ACCESS_KEY: "test",
+				R2_BUCKET: "test",
+			}),
+		);
+	}
+	override configured() {
+		return this.enabled !== false;
+	}
+	override bucket() {
+		return "test";
+	}
+	override async presignPut(
+		_bucket: string,
+		key: string,
+		_type: string,
+		_size: number,
+		expires: Date,
+	) {
+		return `https://storage.test/${key}?expires=${expires.getTime()}`;
+	}
+	override async presignGet(_bucket: string, key: string) {
+		return `https://storage.test/${key}`;
+	}
+	override async head(_bucket: string, key: string, signal?: AbortSignal) {
+		signal?.throwIfAborted();
+		if (this.headHook) await this.headHook(signal);
+		signal?.throwIfAborted();
+		return this.objects.get(key) ?? null;
+	}
+	override async copy(
+		_bucket: string,
+		sourceKey: string,
+		finalKey: string,
+		sourceEtag: string,
+		signal?: AbortSignal,
+	) {
+		signal?.throwIfAborted();
+		this.copyCount++;
+		if (this.copyFailures > 0) {
+			this.copyFailures--;
+			throw new Error("Transient copy failure");
+		}
+		if (this.copyHook) await this.copyHook(signal);
+		signal?.throwIfAborted();
+		const source = this.objects.get(sourceKey);
+		if (!source || source.etag !== sourceEtag)
+			throw new Error("Precondition failed");
+		this.objects.set(finalKey, { ...source });
+		if (this.copyTimeout) {
+			this.copyTimeout = false;
+			throw new Error("Unknown copy result");
+		}
+	}
+	override async delete(_bucket: string, key: string) {
+		if (this.deleteFailures > 0) {
+			this.deleteFailures--;
+			throw new Error("Transient delete failure");
+		}
+		this.objects.delete(key);
+	}
+	put(key: string, sizeBytes = 4, etag = '"source-1"') {
+		this.objects.set(key, {
+			sizeBytes,
+			etag,
+			contentType: "arbitrary/example",
+		});
+	}
+}
diff --git a/apps/api/test/assets-http-contract.e2e.spec.ts b/apps/api/test/assets-http-contract.e2e.spec.ts
new file mode 100644
index 000000000..96178cedd
--- /dev/null
+++ b/apps/api/test/assets-http-contract.e2e.spec.ts
@@ -0,0 +1,115 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import request from "supertest";
+import type { OpenAPIObject } from "trpc-to-openapi";
+import { AssetsHttpFixture } from "./assets-http.fixture";
+
+const assetMethods = ["get", "post", "patch", "delete"] as const;
+const openapiMethods = [
+	"get",
+	"post",
+	"put",
+	"patch",
+	"delete",
+	"options",
+	"head",
+	"trace",
+] as const;
+
+describe("Asset HTTP route contract", () => {
+	const fixture = new AssetsHttpFixture();
+
+	beforeAll(() => fixture.setup());
+	afterAll(() => fixture.cleanup());
+
+	it("publishes exactly seven canonical asset operations", async () => {
+		const document = await request(fixture.app.getHttpServer())
+			.get("/openapi.json")
+			.expect(200);
+		const openapi = document.body as OpenAPIObject;
+		const paths = openapi.paths ?? {};
+		const expected = {
+			"/projects/{projectId}/assets": ["get", "post"],
+			"/appointments/{appointmentId}/assets": ["get", "post"],
+			"/assets/{assetId}": ["get", "patch", "delete"],
+		} as const;
+		for (const path of Object.keys(expected) as Array<keyof typeof expected>) {
+			const methods = expected[path];
+			const pathItem = paths[path];
+			expect(pathItem).toBeDefined();
+			if (!pathItem) continue;
+			const actual = assetMethods.filter(
+				(method) => pathItem[method] !== undefined,
+			);
+			expect(actual).toEqual([...methods]);
+			for (const method of methods) {
+				const operation = pathItem[method];
+				expect(operation).toBeDefined();
+				if (method !== "get" && operation)
+					expect(operation.parameters).toContainEqual(
+						expect.objectContaining({
+							name: "Idempotency-Key",
+							in: "header",
+							required: true,
+						}),
+					);
+			}
+		}
+		const expectedOperations = Object.entries(expected)
+			.flatMap(([path, methods]) =>
+				methods.map((method) => `${method} ${path}`),
+			)
+			.sort();
+		const taggedAssetOperations = Object.entries(paths)
+			.flatMap(([path, pathItem]) =>
+				openapiMethods.flatMap((method) =>
+					pathItem[method]?.tags?.includes("Assets")
+						? [`${method} ${path}`]
+						: [],
+				),
+			)
+			.sort();
+		expect(taggedAssetOperations).toEqual(expectedOperations);
+		expect(taggedAssetOperations).toHaveLength(7);
+	});
+
+	it("does not publish workflow, customer, nested member, or compatibility paths", async () => {
+		const document = await request(fixture.app.getHttpServer())
+			.get("/openapi.json")
+			.expect(200);
+		const openapi = document.body as OpenAPIObject;
+		const paths = Object.keys(openapi.paths ?? {});
+		expect(paths).not.toContain("/projects/{projectId}/asset-uploads");
+		expect(paths).not.toContain("/customers/{customerId}/assets");
+		expect(paths).not.toContain("/projects/{projectId}/assets/{assetId}");
+		expect(paths.some((path) => path.startsWith("/rest"))).toBe(false);
+		expect(paths.some((path) => path.startsWith("/v1"))).toBe(false);
+
+		for (const path of [
+			`${fixture.base}/asset-uploads`,
+			`/customers/${fixture.customerId}/assets`,
+			`${fixture.base}/assets/missing`,
+			`/rest/v1${fixture.base}/assets`,
+		]) {
+			await request(fixture.app.getHttpServer()).get(path).expect(404);
+		}
+	});
+
+	it("returns private no-store 404 responses without exposing asset metadata", async () => {
+		const response = await request(fixture.app.getHttpServer())
+			.get("/assets/missing")
+			.set("x-asset-test-user", fixture.userId)
+			.set("X-Request-Id", "asset-private-test")
+			.expect(404);
+		expect(response.body).toEqual({
+			error: {
+				code: "RESOURCE_NOT_FOUND",
+				message: "The record does not exist or is inaccessible.",
+				requestId: "asset-private-test",
+				retryable: false,
+			},
+		});
+		expect(response.headers["cache-control"]).toBe("private, no-store");
+		expect(response.headers["x-request-id"]).toBe("asset-private-test");
+		expect(response.body).not.toHaveProperty("asset");
+	});
+});
diff --git a/apps/api/test/assets-http-flow.e2e.spec.ts b/apps/api/test/assets-http-flow.e2e.spec.ts
new file mode 100644
index 000000000..af7c280be
--- /dev/null
+++ b/apps/api/test/assets-http-flow.e2e.spec.ts
@@ -0,0 +1,99 @@
+import { afterAll, beforeAll, describe, expect, it, spyOn } from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb } from "@crm/db/tenant-scope";
+import request from "supertest";
+import { AssetError } from "../src/assets/asset-error";
+import { AssetStorageService } from "../src/assets/asset-storage.service";
+import { AssetsService } from "../src/assets/assets.service";
+import { AssetsHttpFixture } from "./assets-http.fixture";
+import { inAssetTenant } from "./assets-tenant.fixture";
+
+let fixture: AssetsHttpFixture;
+
+describe("Asset HTTP error handling", () => {
+	beforeAll(async () => {
+		fixture = new AssetsHttpFixture();
+		await fixture.setup();
+	});
+
+	afterAll(async () => {
+		await fixture.cleanup();
+	});
+
+	it("returns 413 and its exact byte limit without creating an asset", async () => {
+		const before = await inAssetTenant(() =>
+			scopedDb.assetUpload.count({ where: { projectId: fixture.projectId } }),
+		);
+		const response = await request(fixture.app.getHttpServer())
+			.post(`${fixture.base}/assets`)
+			.set("x-asset-test-user", fixture.userId)
+			.set("Idempotency-Key", randomUUID())
+			.send({ ...fixture.metadata, sizeBytes: 5363466241 })
+			.expect(413);
+		expect(response.body.error).toMatchObject({
+			code: "UPLOAD_TOO_LARGE",
+			retryable: false,
+			details: { maxBytes: 5363466240 },
+		});
+		expect(
+			await inAssetTenant(() =>
+				scopedDb.assetUpload.count({ where: { projectId: fixture.projectId } }),
+			),
+		).toBe(before);
+	});
+
+	it("returns storage and capacity errors without exposing internal data", async () => {
+		const unavailable = spyOn(
+			fixture.app.get(AssetStorageService),
+			"configured",
+		).mockReturnValue(false);
+		const response = await request(fixture.app.getHttpServer())
+			.post(`${fixture.base}/assets`)
+			.set("x-asset-test-user", fixture.userId)
+			.set("Idempotency-Key", randomUUID())
+			.send(fixture.metadata)
+			.expect(503);
+		expect(response.body.error).toMatchObject({
+			code: "STORAGE_UNAVAILABLE",
+			retryable: false,
+		});
+		unavailable.mockReturnValue(true);
+
+		const create = spyOn(
+			fixture.app.get(AssetsService),
+			"createProjectAsset",
+		).mockRejectedValueOnce(
+			new AssetError(
+				429,
+				"UPLOAD_CAPACITY_EXCEEDED",
+				"Temporary upload capacity is full.",
+				undefined,
+				true,
+			),
+		);
+		const capacity = await request(fixture.app.getHttpServer())
+			.post(`${fixture.base}/assets`)
+			.set("x-asset-test-user", fixture.userId)
+			.set("Idempotency-Key", randomUUID())
+			.send(fixture.metadata)
+			.expect(429);
+		expect(capacity.body.error).toMatchObject({
+			code: "UPLOAD_CAPACITY_EXCEEDED",
+			retryable: true,
+		});
+		expect(capacity.headers["retry-after"]).toBe("60");
+
+		create.mockRejectedValueOnce(new Error("secret provider credential"));
+		const failure = await request(fixture.app.getHttpServer())
+			.post(`${fixture.base}/assets`)
+			.set("x-asset-test-user", fixture.userId)
+			.set("Idempotency-Key", randomUUID())
+			.send(fixture.metadata)
+			.expect(500);
+		expect(JSON.stringify(failure.body)).not.toContain(
+			"secret provider credential",
+		);
+		create.mockRestore();
+		unavailable.mockRestore();
+	});
+});
diff --git a/apps/api/test/assets-http-lifecycle.e2e.spec.ts b/apps/api/test/assets-http-lifecycle.e2e.spec.ts
new file mode 100644
index 000000000..a89fdcc82
--- /dev/null
+++ b/apps/api/test/assets-http-lifecycle.e2e.spec.ts
@@ -0,0 +1,141 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb } from "@crm/db/tenant-scope";
+import request from "supertest";
+import { AssetWorkerService } from "../src/assets/asset-worker.service";
+import { AssetsHttpFixture } from "./assets-http.fixture";
+import { inAssetTenant } from "./assets-tenant.fixture";
+
+let fixture: AssetsHttpFixture;
+
+describe("Asset HTTP upload lifecycle", () => {
+	beforeAll(async () => {
+		fixture = new AssetsHttpFixture();
+		await fixture.setup();
+	});
+
+	afterAll(async () => {
+		await fixture.cleanup();
+	});
+
+	it("creates, completes, lists, downloads, and deletes an asset", async () => {
+		const key = randomUUID();
+		const create = () =>
+			request(fixture.app.getHttpServer())
+				.post(`${fixture.base}/assets`)
+				.set("x-asset-test-user", fixture.userId)
+				.set("Idempotency-Key", key)
+				.send(fixture.metadata);
+		const first = await create().expect(200);
+		expect(first.body.asset).toMatchObject({
+			projectId: fixture.projectId,
+			customerId: fixture.customerId,
+			status: "UNVERIFIED",
+			sizeBytes: fixture.metadata.sizeBytes,
+			source: "MANUAL",
+			uploadedById: fixture.userId,
+		});
+		expect(first.body.download).toBeNull();
+		expect(first.body.failure).toBeNull();
+		expect(first.body.transfer).toMatchObject({
+			method: "PUT",
+			headers: {
+				"Content-Type": "application/octet-stream",
+				"Content-Length": "4",
+			},
+			maxBytes: 5363466240,
+		});
+		expect(first.body).not.toHaveProperty("upload");
+		expect(first.body).not.toHaveProperty("uploadId");
+
+		const assetId = first.body.asset.id as string;
+		const replay = await create().expect(200);
+		expect(replay.body.asset.id).toBe(assetId);
+		expect(replay.body.transfer).not.toBeNull();
+		expect(replay.body.transfer.url).not.toBe(first.body.transfer.url);
+		expect(
+			await inAssetTenant(() =>
+				scopedDb.assetUpload.count({ where: { assetId } }),
+			),
+		).toBe(1);
+
+		await fixture.put(assetId);
+		const pending = await request(fixture.app.getHttpServer())
+			.get(`/assets/${assetId}`)
+			.set("x-asset-test-user", fixture.userId)
+			.expect(200);
+		expect(pending.body.asset.status).toBe("UNVERIFIED");
+		expect(pending.body.download).toBeNull();
+		expect(pending.body).not.toHaveProperty("transfer");
+
+		const accepted = await request(fixture.app.getHttpServer())
+			.patch(`/assets/${assetId}`)
+			.set("x-asset-test-user", fixture.userId)
+			.set("Idempotency-Key", randomUUID())
+			.send({ uploadCompleted: true })
+			.expect(200);
+		expect(accepted.body.asset.status).toBe("UNVERIFIED");
+		const upload = await fixture.uploadFor(assetId);
+		expect(
+			await inAssetTenant(() =>
+				scopedDb.assetStorageJob.count({ where: { uploadId: upload.id } }),
+			),
+		).toBe(1);
+
+		const processed = await fixture.app.get(AssetWorkerService).process();
+		expect(processed.processed).toBeGreaterThan(0);
+		const ready = await request(fixture.app.getHttpServer())
+			.get(`/assets/${assetId}`)
+			.set("x-asset-test-user", fixture.userId)
+			.set("x-asset-test-scope", "crm.read")
+			.expect(200);
+		expect(ready.body.asset.status).toBe("READY");
+		expect(ready.body.download).toMatchObject({
+			url: expect.stringContaining(upload.finalKey),
+			expiresAt: expect.any(String),
+		});
+		expect(ready.body).not.toHaveProperty("transfer");
+
+		const listed = await request(fixture.app.getHttpServer())
+			.get(`${fixture.base}/assets`)
+			.set("x-asset-test-user", fixture.userId)
+			.set("x-asset-test-scope", "crm.read")
+			.expect(200);
+		expect(listed.body.items.map((item: { id: string }) => item.id)).toContain(
+			assetId,
+		);
+		const otherProject = await request(fixture.app.getHttpServer())
+			.get(`/projects/${fixture.otherProjectId}/assets`)
+			.set("x-asset-test-user", fixture.userId)
+			.set("x-asset-test-scope", "crm.read")
+			.expect(200);
+		expect(
+			otherProject.body.items.map((item: { id: string }) => item.id),
+		).not.toContain(assetId);
+
+		const deleting = await request(fixture.app.getHttpServer())
+			.delete(`/assets/${assetId}`)
+			.set("x-asset-test-user", fixture.userId)
+			.set("Idempotency-Key", randomUUID())
+			.expect(200);
+		expect(deleting.body).toEqual({ assetId, status: "DELETING" });
+		await request(fixture.app.getHttpServer())
+			.get(`/assets/${assetId}`)
+			.set("x-asset-test-user", fixture.userId)
+			.expect(200)
+			.then((response) => {
+				expect(response.body.asset.status).toBe("DELETING");
+			});
+		await fixture.app.get(AssetWorkerService).process();
+		const deleted = await request(fixture.app.getHttpServer())
+			.get(`/assets/${assetId}`)
+			.set("x-asset-test-user", fixture.userId)
+			.expect(200);
+		expect(deleted.body.asset).toMatchObject({
+			status: "DELETED",
+			deletedAt: expect.any(String),
+		});
+		expect(deleted.body.download).toBeNull();
+		expect(fixture.objects.has(upload.finalKey)).toBe(false);
+	});
+});
diff --git a/apps/api/test/assets-http.e2e.spec.ts b/apps/api/test/assets-http.e2e.spec.ts
new file mode 100644
index 000000000..9c504ea9a
--- /dev/null
+++ b/apps/api/test/assets-http.e2e.spec.ts
@@ -0,0 +1,130 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { randomUUID } from "node:crypto";
+import request from "supertest";
+import { AssetsHttpFixture } from "./assets-http.fixture";
+
+let fixture: AssetsHttpFixture;
+
+describe("Asset HTTP authentication and validation", () => {
+	beforeAll(async () => {
+		fixture = new AssetsHttpFixture();
+		await fixture.setup();
+	});
+
+	afterAll(async () => {
+		await fixture.cleanup();
+	});
+
+	it("protects the exact seven asset endpoints with the error envelope", async () => {
+		const endpoints = [
+			["post", `${fixture.base}/assets`, fixture.metadata],
+			["get", `${fixture.base}/assets`, undefined],
+			["post", "/appointments/missing/assets", fixture.metadata],
+			["get", "/appointments/missing/assets", undefined],
+			["get", "/assets/missing", undefined],
+			["patch", "/assets/missing", { uploadCompleted: true }],
+			["delete", "/assets/missing", undefined],
+		] as const;
+		for (const [method, path, body] of endpoints) {
+			const call = request(fixture.app.getHttpServer())
+				[method](path)
+				.set("X-Request-Id", "asset-request-test");
+			if (body) call.send(body);
+			const response = await call.expect(401);
+			expect(response.body).toEqual({
+				error: {
+					code: "AUTH_REQUIRED",
+					message: "Authentication is required.",
+					requestId: "asset-request-test",
+					retryable: false,
+				},
+			});
+			expect(response.headers["cache-control"]).toBe("private, no-store");
+			expect(response.headers["x-request-id"]).toBe("asset-request-test");
+		}
+	});
+
+	it("enforces read and write OAuth scopes", async () => {
+		for (const [method, path, body] of [
+			["post", `${fixture.base}/assets`, fixture.metadata],
+			["patch", "/assets/missing", { uploadCompleted: true }],
+			["delete", "/assets/missing", undefined],
+		] as const) {
+			const call = request(fixture.app.getHttpServer())
+				[method](path)
+				.set("x-asset-test-user", fixture.userId)
+				.set("x-asset-test-scope", "crm.read")
+				.set("Idempotency-Key", randomUUID());
+			if (body) call.send(body);
+			const response = await call.expect(403);
+			expect(response.body.error.code).toBe("FORBIDDEN");
+			expect(response.headers["www-authenticate"]).toContain("crm.write");
+		}
+
+		for (const path of [
+			`${fixture.base}/assets`,
+			"/appointments/missing/assets",
+			"/assets/missing",
+		]) {
+			const response = await request(fixture.app.getHttpServer())
+				.get(path)
+				.set("x-asset-test-user", fixture.userId)
+				.set("x-asset-test-scope", "crm.write")
+				.expect(403);
+			expect(response.body.error.code).toBe("FORBIDDEN");
+		}
+	});
+
+	it("rejects shadowed identifiers, unknown fields, and invalid JSON numbers", async () => {
+		for (const [path, body] of [
+			[
+				`${fixture.base}/assets`,
+				{ ...fixture.metadata, projectId: fixture.otherProjectId },
+			],
+			[
+				"/appointments/missing/assets",
+				{ ...fixture.metadata, appointmentId: "shadowed" },
+			],
+			[`${fixture.base}/assets`, { ...fixture.metadata, extra: true }],
+			[`${fixture.base}/assets`, { ...fixture.metadata, sizeBytes: "4" }],
+			[`${fixture.base}/assets`, { ...fixture.metadata, fileName: "../file" }],
+		] as const) {
+			const response = await request(fixture.app.getHttpServer())
+				.post(path)
+				.set("x-asset-test-user", fixture.userId)
+				.set("Idempotency-Key", randomUUID())
+				.send(body)
+				.expect(400);
+			expect(response.body.error.code).toBe("VALIDATION_ERROR");
+		}
+	});
+
+	it("rejects path identifiers in queries and requires mutation keys", async () => {
+		for (const query of [
+			"unknown=1",
+			`projectId=${fixture.otherProjectId}`,
+			"appointmentId=other",
+			"assetId=other",
+		]) {
+			const response = await request(fixture.app.getHttpServer())
+				.get(`${fixture.base}/assets?${query}`)
+				.set("x-asset-test-user", fixture.userId)
+				.expect(400);
+			expect(response.body.error.code).toBe("VALIDATION_ERROR");
+		}
+		const missingKey = await request(fixture.app.getHttpServer())
+			.post(`${fixture.base}/assets`)
+			.set("x-asset-test-user", fixture.userId)
+			.send(fixture.metadata)
+			.expect(400);
+		expect(missingKey.body.error.code).toBe("VALIDATION_ERROR");
+		const invalidJson = await request(fixture.app.getHttpServer())
+			.post(`${fixture.base}/assets`)
+			.set("x-asset-test-user", fixture.userId)
+			.set("Idempotency-Key", randomUUID())
+			.set("Content-Type", "application/json")
+			.send("{")
+			.expect(400);
+		expect(invalidJson.body.error.code).toBe("VALIDATION_ERROR");
+	});
+});
diff --git a/apps/api/test/assets-http.fixture.ts b/apps/api/test/assets-http.fixture.ts
new file mode 100644
index 000000000..38b22709b
--- /dev/null
+++ b/apps/api/test/assets-http.fixture.ts
@@ -0,0 +1,194 @@
+import { spyOn } from "bun:test";
+import { randomUUID } from "node:crypto";
+import type { Db } from "@crm/db";
+import { scopedDb } from "@crm/db/tenant-scope";
+import type { INestApplication } from "@nestjs/common";
+import { AssetStorageService } from "../src/assets/asset-storage.service";
+import type { RequestPrincipal } from "../src/auth/request-principal";
+import { RequestPrincipalService } from "../src/auth/request-principal.service";
+import {
+	ASSET_TEST_ORGANIZATION_ID,
+	addAssetTestMember,
+	inAssetTenant,
+	removeAssetTestMember,
+} from "./assets-tenant.fixture";
+export class AssetsHttpFixture {
+	readonly prefix = `asset-http-${randomUUID()}`;
+	readonly projectId = `${this.prefix}-project`;
+	readonly otherProjectId = `${this.prefix}-other-project`;
+	readonly customerId = `${this.prefix}-customer`;
+	readonly userId = `${this.prefix}-user`;
+	readonly foreignOrganizationId = `${this.prefix}-foreign-org`;
+	readonly foreignUserId = `${this.prefix}-foreign-user`;
+	readonly base = `/projects/${this.projectId}`;
+	readonly metadata = {
+		fileName: "evidence.unusual",
+		sizeBytes: 4,
+		source: "MANUAL",
+	};
+	readonly objects = new Map<
+		string,
+		{ sizeBytes: number; etag: string; contentType: string | null }
+	>();
+	app!: INestApplication;
+	db!: Db;
+	principal!: RequestPrincipal;
+	foreignPrincipal!: RequestPrincipal;
+	private restores: Array<() => void> = [];
+	async setup() {
+		const testUrl = process.env.TEST_DATABASE_URL;
+		if (!testUrl || !new URL(testUrl).pathname.endsWith("_test"))
+			throw new Error("A disposable TEST_DATABASE_URL is required.");
+		process.env.DATABASE_URL = testUrl;
+		({ db: this.db } = await import("@crm/db"));
+		const user = await this.db.user.create({
+			data: {
+				id: this.userId,
+				email: `${this.prefix}@example.com`,
+				name: "Asset HTTP test",
+				emailVerified: true,
+			},
+		});
+		await addAssetTestMember(this.userId, randomUUID());
+		const foreignUser = await this.db.user.create({
+			data: {
+				id: this.foreignUserId,
+				email: `${this.foreignUserId}@example.com`,
+				name: "Foreign asset HTTP test",
+				emailVerified: true,
+			},
+		});
+		await this.db.organization.create({
+			data: {
+				id: this.foreignOrganizationId,
+				name: "Foreign asset tests",
+				slug: this.foreignOrganizationId,
+				createdAt: new Date(),
+			},
+		});
+		await this.db.member.create({
+			data: {
+				id: randomUUID(),
+				organizationId: this.foreignOrganizationId,
+				userId: this.foreignUserId,
+				role: "member",
+				createdAt: new Date(),
+			},
+		});
+		await inAssetTenant(async () => {
+			await scopedDb.company.create({
+				data: { id: this.customerId, name: "Asset HTTP test" },
+			});
+			await scopedDb.deal.createMany({
+				data: [this.projectId, this.otherProjectId].map((id) => ({
+					id,
+					name: id,
+					companyId: this.customerId,
+					ownerId: this.userId,
+				})),
+			});
+		});
+		this.principal = {
+			credentialKind: "oauth",
+			user,
+			clientId: "asset-test-client",
+			scopes: new Set(["crm.read", "crm.write"]),
+			session: null,
+			organizationId: ASSET_TEST_ORGANIZATION_ID,
+			expiresAt: null,
+		};
+		this.foreignPrincipal = {
+			...this.principal,
+			user: foreignUser,
+			organizationId: this.foreignOrganizationId,
+		};
+		const { createApp } = await import("../src/create-app");
+		this.app = await createApp();
+		const resolve = spyOn(
+			this.app.get(RequestPrincipalService),
+			"resolve",
+		).mockImplementation(async (req) => {
+			const requestedUser = req.header("x-asset-test-user");
+			const principal =
+				requestedUser === this.userId
+					? this.principal
+					: requestedUser === this.foreignUserId
+						? this.foreignPrincipal
+						: null;
+			if (!principal) return null;
+			const scope = req.header("x-asset-test-scope");
+			return scope ? { ...principal, scopes: new Set([scope]) } : principal;
+		});
+		const storage = this.app.get(AssetStorageService);
+		const mocks = [
+			resolve,
+			spyOn(storage, "configured").mockReturnValue(true),
+			spyOn(storage, "bucket").mockReturnValue("asset-tests"),
+			spyOn(storage, "presignPut").mockImplementation(
+				async (_bucket, key, _contentType, _sizeBytes, expiresAt) =>
+					`https://storage.invalid/${key}?signed=put&expires=${expiresAt.getTime()}`,
+			),
+			spyOn(storage, "presignGet").mockImplementation(
+				async (_bucket, key) => `https://storage.invalid/${key}?signed=get`,
+			),
+			spyOn(storage, "head").mockImplementation(
+				async (_bucket, key) => this.objects.get(key) ?? null,
+			),
+			spyOn(storage, "copy").mockImplementation(
+				async (_bucket, source, target, etag) => {
+					const object = this.objects.get(source);
+					if (!object || object.etag !== etag)
+						throw new Error("Source changed.");
+					this.objects.set(target, { ...object });
+				},
+			),
+			spyOn(storage, "delete").mockImplementation(async (_bucket, key) => {
+				this.objects.delete(key);
+			}),
+		];
+		this.restores = mocks.map((mock) => () => mock.mockRestore());
+	}
+	async uploadFor(assetId: string) {
+		return inAssetTenant(() =>
+			scopedDb.assetUpload.findUniqueOrThrow({ where: { assetId } }),
+		);
+	}
+	async put(assetId: string, sizeBytes = this.metadata.sizeBytes) {
+		const upload = await this.uploadFor(assetId);
+		this.objects.set(upload.temporaryKey, {
+			sizeBytes,
+			etag: `"${this.prefix}-${assetId}"`,
+			contentType: "application/octet-stream",
+		});
+		return upload;
+	}
+	async cleanup() {
+		for (const restore of this.restores) restore();
+		if (this.app) await this.app.close();
+		if (!this.db) return;
+		await inAssetTenant(async () => {
+			await scopedDb.assetStorageJob.deleteMany({
+				where: { projectId: { in: [this.projectId, this.otherProjectId] } },
+			});
+			await scopedDb.assetApiRequest.deleteMany({
+				where: { actorKey: `user:${this.userId}` },
+			});
+			await scopedDb.assetEmailSource.deleteMany({
+				where: { projectId: { in: [this.projectId, this.otherProjectId] } },
+			});
+			await scopedDb.assetUpload.deleteMany({
+				where: { projectId: { in: [this.projectId, this.otherProjectId] } },
+			});
+			await scopedDb.deal.deleteMany({
+				where: { id: { in: [this.projectId, this.otherProjectId] } },
+			});
+			await scopedDb.company.delete({ where: { id: this.customerId } });
+		});
+		await removeAssetTestMember(this.userId);
+		await this.db.user.delete({ where: { id: this.userId } });
+		await this.db.organization.delete({
+			where: { id: this.foreignOrganizationId },
+		});
+		await this.db.user.delete({ where: { id: this.foreignUserId } });
+	}
+}
diff --git a/apps/api/test/assets-key-hierarchy-contract.spec.ts b/apps/api/test/assets-key-hierarchy-contract.spec.ts
new file mode 100644
index 000000000..a29f9fa1d
--- /dev/null
+++ b/apps/api/test/assets-key-hierarchy-contract.spec.ts
@@ -0,0 +1,18 @@
+import { describe, expect, it } from "bun:test";
+import { createAssetStorageKeys } from "../src/assets/asset-storage-keys";
+
+describe("asset storage key hierarchy", () => {
+	it("builds temporary and final keys from the same project prefix", () => {
+		expect(
+			createAssetStorageKeys({
+				organizationId: "org-1",
+				projectId: "project-1",
+				uploadId: "upload-1",
+				objectId: "object-1",
+			}),
+		).toEqual({
+			temporaryKey: "temporary/org-1/projects/project-1/upload-1",
+			finalKey: "org-1/projects/project-1/assets/object-1",
+		});
+	});
+});
diff --git a/apps/api/test/assets-key-hierarchy.spec.ts b/apps/api/test/assets-key-hierarchy.spec.ts
new file mode 100644
index 000000000..6367e22ac
--- /dev/null
+++ b/apps/api/test/assets-key-hierarchy.spec.ts
@@ -0,0 +1,171 @@
+import {
+	afterAll,
+	afterEach,
+	beforeAll,
+	beforeEach,
+	describe,
+	expect,
+} from "bun:test";
+import { randomUUID } from "node:crypto";
+import { db as rawDb } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb as db } from "@crm/db/tenant-scope";
+import {
+	AssetsCoreFixture,
+	assertLocalTestDatabase,
+	assetTest as it,
+} from "./assets-core.fixture";
+import { ASSET_TEST_ORGANIZATION_ID } from "./assets-tenant.fixture";
+
+describe("stored asset storage keys", () => {
+	let fixture: AssetsCoreFixture;
+
+	beforeAll(async () => {
+		await assertLocalTestDatabase();
+	});
+
+	beforeEach(async () => {
+		fixture = new AssetsCoreFixture();
+		await fixture.setup();
+	});
+
+	afterEach(async () => {
+		await fixture.cleanup();
+	});
+
+	afterAll(async () => {
+		await db.$disconnect();
+	});
+
+	it("stores organization and project prefixes on each new upload", async () => {
+		const created = await fixture.create();
+		const upload = await db.assetUpload.findUniqueOrThrow({
+			where: { id: created.upload.id },
+		});
+		expect(upload.organizationId).toBe(ASSET_TEST_ORGANIZATION_ID);
+		expect(upload.projectId).toBe(fixture.projectId);
+		expect(upload.temporaryKey).toBe(
+			`temporary/${ASSET_TEST_ORGANIZATION_ID}/projects/${fixture.projectId}/${upload.id}`,
+		);
+		expect(upload.finalKey).toMatch(
+			new RegExp(
+				`^${ASSET_TEST_ORGANIZATION_ID}/projects/${fixture.projectId}/assets/[0-9a-f-]{36}$`,
+			),
+		);
+	});
+
+	it("denies a first tenant's upload from a second tenant", async () => {
+		const created = await fixture.create();
+		await fixture.put(created.upload.id);
+		await fixture.service.updateAsset(
+			fixture.actor,
+			created.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		await fixture.due();
+		await fixture.worker.process();
+		const ready = await fixture.service.getAsset(
+			fixture.actor,
+			created.asset.id,
+		);
+		expect(ready.asset.status).toBe("READY");
+		const otherOrganizationId = `asset-key-other-${randomUUID()}`;
+		await rawDb.organization.create({
+			data: {
+				id: otherOrganizationId,
+				name: "Asset key other tenant",
+				slug: otherOrganizationId,
+				createdAt: new Date(),
+			},
+		});
+		try {
+			await expect(
+				runInTenant(otherOrganizationId, () =>
+					fixture.service.createProjectAsset(
+						fixture.actor,
+						fixture.projectId,
+						fixture.metadata(),
+						randomUUID(),
+					),
+				),
+			).rejects.toMatchObject({ code: "RESOURCE_NOT_FOUND" });
+			await expect(
+				runInTenant(otherOrganizationId, () =>
+					fixture.service.updateAsset(
+						fixture.actor,
+						created.asset.id,
+						{ uploadCompleted: true },
+						randomUUID(),
+					),
+				),
+			).rejects.toMatchObject({ code: "RESOURCE_NOT_FOUND" });
+			await expect(
+				runInTenant(otherOrganizationId, () =>
+					fixture.service.getAsset(fixture.actor, created.asset.id),
+				),
+			).rejects.toMatchObject({ code: "RESOURCE_NOT_FOUND" });
+		} finally {
+			await rawDb.organization.delete({ where: { id: otherOrganizationId } });
+		}
+	});
+
+	it("reuses stored keys and refreshes the transfer on idempotent creation", async () => {
+		const key = randomUUID();
+		const first = await fixture.create({}, key);
+		const stored = await db.assetUpload.findUniqueOrThrow({
+			where: { id: first.upload.id },
+		});
+		await db.assetUpload.update({
+			where: { id: first.upload.id },
+			data: { grantExpiresAt: new Date(0), reservationUntil: new Date(0) },
+		});
+		const replay = await fixture.create({}, key);
+		const after = await db.assetUpload.findUniqueOrThrow({
+			where: { id: first.upload.id },
+		});
+		expect(replay.upload.id).toBe(first.upload.id);
+		expect(replay.transfer).not.toBeNull();
+		expect(after.grantExpiresAt.getTime()).toBeGreaterThan(0);
+		expect(after.temporaryKey).toBe(stored.temporaryKey);
+		expect(after.finalKey).toBe(stored.finalKey);
+	});
+
+	it("completes and deletes an old pending upload with its stored keys", async () => {
+		const created = await fixture.create();
+		const legacyTemporaryKey = `temporary/${created.upload.id}`;
+		const legacyFinalKey = `assets/${randomUUID()}`;
+		await db.assetUpload.update({
+			where: { id: created.upload.id },
+			data: { temporaryKey: legacyTemporaryKey, finalKey: legacyFinalKey },
+		});
+		await db.artifact.update({
+			where: { id: created.asset.id },
+			data: { storageKey: legacyFinalKey },
+		});
+		fixture.storage.put(legacyTemporaryKey);
+		await fixture.service.updateAsset(
+			fixture.actor,
+			created.asset.id,
+			{ uploadCompleted: true },
+			randomUUID(),
+		);
+		await fixture.due();
+		await fixture.worker.process();
+		const ready = await fixture.service.getAsset(
+			fixture.actor,
+			created.asset.id,
+		);
+		expect(ready.asset.status).toBe("READY");
+		const assetId = ready.asset.id;
+		const asset = await db.artifact.findUniqueOrThrow({
+			where: { id: assetId },
+		});
+		expect(asset.storageKey).toBe(legacyFinalKey);
+		expect(ready.download?.url).toContain(legacyFinalKey);
+		await fixture.service.deleteAsset(fixture.actor, assetId, randomUUID());
+		await fixture.due();
+		await fixture.worker.process();
+		expect(fixture.storage.objects.has(legacyFinalKey)).toBe(false);
+	});
+});
diff --git a/apps/api/test/assets-public-http.e2e.spec.ts b/apps/api/test/assets-public-http.e2e.spec.ts
new file mode 100644
index 000000000..4ad6ff48f
--- /dev/null
+++ b/apps/api/test/assets-public-http.e2e.spec.ts
@@ -0,0 +1,133 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { randomUUID } from "node:crypto";
+import { scopedDb } from "@crm/db/tenant-scope";
+import request from "supertest";
+import { AssetsHttpFixture } from "./assets-http.fixture";
+import { inAssetTenant } from "./assets-tenant.fixture";
+
+describe("canonical asset HTTP routes", () => {
+	const fixture = new AssetsHttpFixture();
+
+	beforeAll(() => fixture.setup());
+	afterAll(() => fixture.cleanup());
+
+	it("rejects workflow, customer, nested member, and compatibility paths", async () => {
+		for (const path of [
+			`${fixture.base}/asset-uploads`,
+			`${fixture.base}/asset-uploads/missing`,
+			`${fixture.base}/assets/missing`,
+			`/customers/${fixture.customerId}/assets`,
+			`/rest${fixture.base}/assets`,
+			`/rest/v1${fixture.base}/assets`,
+			`/v1${fixture.base}/assets`,
+		])
+			await request(fixture.app.getHttpServer()).get(path).expect(404);
+	});
+
+	it("rejects path identifiers in query strings and mutation bodies", async () => {
+		for (const path of [
+			`${fixture.base}/assets?unknown=1`,
+			`${fixture.base}/assets?projectId=${fixture.otherProjectId}`,
+			"/appointments/missing/assets?appointmentId=other",
+			"/assets/missing?assetId=other",
+		]) {
+			const response = await request(fixture.app.getHttpServer())
+				.get(path)
+				.set("x-asset-test-user", fixture.userId)
+				.expect(400);
+			expect(response.body.error.code).toBe("VALIDATION_ERROR");
+		}
+		for (const [path, body] of [
+			[
+				`${fixture.base}/assets`,
+				{ ...fixture.metadata, projectId: fixture.otherProjectId },
+			],
+			[
+				"/appointments/missing/assets",
+				{ ...fixture.metadata, appointmentId: "other" },
+			],
+		] as const) {
+			const response = await request(fixture.app.getHttpServer())
+				.post(path)
+				.set("x-asset-test-user", fixture.userId)
+				.set("Idempotency-Key", randomUUID())
+				.send(body);
+			expect(response.status).toBe(400);
+			expect(response.body.error.code).toBe("VALIDATION_ERROR");
+		}
+		const patch = await request(fixture.app.getHttpServer())
+			.patch("/assets/missing")
+			.set("x-asset-test-user", fixture.userId)
+			.set("Idempotency-Key", randomUUID())
+			.send({ uploadCompleted: true, appointmentId: "other" })
+			.expect(400);
+		expect(patch.body.error.code).toBe("VALIDATION_ERROR");
+	});
+
+	it("keeps asset member reads tenant-scoped and private", async () => {
+		const created = await request(fixture.app.getHttpServer())
+			.post(`${fixture.base}/assets`)
+			.set("x-asset-test-user", fixture.userId)
+			.set("Idempotency-Key", randomUUID())
+			.send(fixture.metadata)
+			.expect(200);
+		const response = await request(fixture.app.getHttpServer())
+			.get(`/assets/${created.body.asset.id}`)
+			.set("x-asset-test-user", fixture.foreignUserId)
+			.set("X-Request-Id", "foreign-asset-test")
+			.expect(404);
+		expect(response.body).toEqual({
+			error: {
+				code: "RESOURCE_NOT_FOUND",
+				message: "The record does not exist or is inaccessible.",
+				requestId: "foreign-asset-test",
+				retryable: false,
+			},
+		});
+		expect(response.headers["cache-control"]).toBe("private, no-store");
+		expect(response.body).not.toHaveProperty("asset");
+	});
+
+	it("updates unverified metadata at the root member path without file access", async () => {
+		const asset = await inAssetTenant(() =>
+			scopedDb.artifact.create({
+				data: {
+					dealId: fixture.projectId,
+					type: "file",
+					fileName: "legacy.txt",
+					storageKey: `${fixture.prefix}-legacy`,
+				},
+			}),
+		);
+		const body = {
+			expectedVersion: 1,
+			fileName: "site-notes.txt",
+			kind: "document",
+		};
+		const updated = await request(fixture.app.getHttpServer())
+			.patch(`/assets/${asset.id}`)
+			.set("x-asset-test-user", fixture.userId)
+			.set("Idempotency-Key", randomUUID())
+			.send(body)
+			.expect(200);
+		expect(updated.body.asset).toMatchObject({
+			id: asset.id,
+			version: 2,
+			status: "UNVERIFIED",
+			kind: "document",
+			fileName: "site-notes.txt",
+		});
+		expect(updated.body.download).toBeNull();
+		expect(updated.body).not.toHaveProperty("transfer");
+		const detail = await request(fixture.app.getHttpServer())
+			.get(`/assets/${asset.id}`)
+			.set("x-asset-test-user", fixture.userId)
+			.expect(200);
+		expect(detail.body.asset.appointmentId).toBeNull();
+		expect(detail.body.download).toBeNull();
+		await request(fixture.app.getHttpServer())
+			.get(`/projects/${fixture.projectId}/assets/${asset.id}`)
+			.set("x-asset-test-user", fixture.userId)
+			.expect(404);
+	});
+});
diff --git a/apps/api/test/assets-tenant.fixture.ts b/apps/api/test/assets-tenant.fixture.ts
new file mode 100644
index 000000000..5ed868191
--- /dev/null
+++ b/apps/api/test/assets-tenant.fixture.ts
@@ -0,0 +1,50 @@
+import { randomUUID } from "node:crypto";
+import { db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { tenantTest } from "@crm/db/test-support";
+
+export const ASSET_TEST_ORGANIZATION_ID = `asset-tests-${randomUUID()}`;
+export const assetTest = tenantTest(ASSET_TEST_ORGANIZATION_ID);
+
+export async function inAssetTenant<T>(
+	work: () => T | PromiseLike<T>,
+): Promise<T> {
+	return await runInTenant(ASSET_TEST_ORGANIZATION_ID, work);
+}
+
+export async function addAssetTestMember(
+	userId: string,
+	memberId: string,
+): Promise<void> {
+	await db.organization.upsert({
+		where: { id: ASSET_TEST_ORGANIZATION_ID },
+		update: {},
+		create: {
+			id: ASSET_TEST_ORGANIZATION_ID,
+			name: "Asset tests",
+			slug: ASSET_TEST_ORGANIZATION_ID,
+			createdAt: new Date(),
+		},
+	});
+	await db.member.create({
+		data: {
+			id: memberId,
+			organizationId: ASSET_TEST_ORGANIZATION_ID,
+			userId,
+			role: "member",
+			createdAt: new Date(),
+		},
+	});
+}
+
+export async function removeAssetTestMember(userId: string): Promise<void> {
+	await db.member.deleteMany({
+		where: { organizationId: ASSET_TEST_ORGANIZATION_ID, userId },
+	});
+	await db.organization.deleteMany({
+		where: {
+			id: ASSET_TEST_ORGANIZATION_ID,
+			members: { none: {} },
+		},
+	});
+}
diff --git a/apps/api/test/auth-middleware.spec.ts b/apps/api/test/auth-middleware.spec.ts
new file mode 100644
index 000000000..3244f1e19
--- /dev/null
+++ b/apps/api/test/auth-middleware.spec.ts
@@ -0,0 +1,112 @@
+import { describe, expect, it } from "bun:test";
+import type { Session } from "@crm/auth";
+import type { Db } from "@crm/db";
+import { tryCurrentOrganizationId } from "@crm/db/tenant-context";
+import { TRPCError } from "@trpc/server";
+import type { RequestPrincipal } from "../src/auth/request-principal";
+import type { BaseTrpcContext } from "../src/trpc/context.types";
+import {
+	AuthMiddleware,
+	SessionMiddleware,
+} from "../src/trpc/middlewares/auth.middleware";
+
+const member = { findUnique: async () => ({ id: "member-1" }) };
+const middleware = new AuthMiddleware({ member } as unknown as Db);
+const removedMemberMiddleware = new AuthMiddleware({
+	member: { findUnique: async () => null },
+} as unknown as Db);
+const sessionMiddleware = new SessionMiddleware();
+
+function principal(
+	credentialKind: RequestPrincipal["credentialKind"],
+	organizationId: string | null,
+): RequestPrincipal {
+	const session =
+		credentialKind === "session"
+			? ({
+					user: { id: "user-1" },
+					session: { activeOrganizationId: organizationId },
+				} as Session)
+			: null;
+
+	return {
+		credentialKind,
+		user: { id: "user-1" } as RequestPrincipal["user"],
+		clientId: credentialKind === "oauth" ? "client-1" : null,
+		scopes: new Set(),
+		session,
+		organizationId,
+		expiresAt: null,
+	};
+}
+
+function context(value: RequestPrincipal | null): BaseTrpcContext {
+	return { principal: value, session: value?.session ?? null };
+}
+
+function options(ctx: BaseTrpcContext) {
+	return {
+		ctx,
+		next: async ({ ctx: nextCtx }: { ctx: unknown }) => ({ ctx: nextCtx }),
+	} as never;
+}
+
+describe("AuthMiddleware", () => {
+	it("rejects an unauthenticated request", async () => {
+		await expect(middleware.use(options(context(null)))).rejects.toMatchObject(
+			new TRPCError({ code: "UNAUTHORIZED" }),
+		);
+	});
+
+	it("rejects a principal without an active organization", async () => {
+		await expect(
+			middleware.use(options(context(principal("session", null)))),
+		).rejects.toMatchObject(new TRPCError({ code: "FORBIDDEN" }));
+	});
+
+	for (const credentialKind of ["session", "apiKey", "oauth"] as const) {
+		it(`establishes tenant context for ${credentialKind}`, async () => {
+			let activeOrganizationId: string | undefined;
+			const ctx = context(principal(credentialKind, "org-a"));
+			const result = await middleware.use({
+				ctx,
+				next: async ({ ctx: nextCtx }: { ctx: unknown }) => {
+					activeOrganizationId = tryCurrentOrganizationId();
+					return { ctx: nextCtx };
+				},
+			} as never);
+
+			expect(activeOrganizationId).toBe("org-a");
+			expect(result).toMatchObject({
+				ctx: { organizationId: "org-a", user: { id: "user-1" } },
+			});
+			expect(tryCurrentOrganizationId()).toBeUndefined();
+		});
+	}
+
+	it("rejects a principal removed from its organization", async () => {
+		await expect(
+			removedMemberMiddleware.use(
+				options(context(principal("oauth", "org-a"))),
+			),
+		).rejects.toMatchObject(new TRPCError({ code: "FORBIDDEN" }));
+	});
+});
+
+describe("SessionMiddleware", () => {
+	it("allows a signed-in user without an active organization", async () => {
+		const ctx = context(principal("session", null));
+
+		expect(await sessionMiddleware.use(options(ctx))).toMatchObject({
+			ctx: { user: { id: "user-1" }, session: ctx.session },
+		});
+	});
+
+	it("rejects API keys and OAuth tokens", async () => {
+		for (const kind of ["apiKey", "oauth"] as const) {
+			await expect(
+				sessionMiddleware.use(options(context(principal(kind, "org-a")))),
+			).rejects.toMatchObject(new TRPCError({ code: "UNAUTHORIZED" }));
+		}
+	});
+});
diff --git a/apps/api/test/auth.e2e.spec.ts b/apps/api/test/auth.e2e.spec.ts
index d5d79131d..acdfda27e 100644
--- a/apps/api/test/auth.e2e.spec.ts
+++ b/apps/api/test/auth.e2e.spec.ts
@@ -2,6 +2,12 @@ import { afterAll, beforeAll, describe, expect, it } from "bun:test";
 import type { INestApplication } from "@nestjs/common";
 import { Test, type TestingModule } from "@nestjs/testing";
 import request from "supertest";
+import { z } from "zod";
+
+Object.assign(process.env, { NODE_ENV: "test" });
+const testDatabaseUrl = process.env.TEST_DATABASE_URL;
+if (!testDatabaseUrl) throw new Error("TEST_DATABASE_URL is required.");
+process.env.DATABASE_URL = testDatabaseUrl;
 
 const fallback = (key: string, value: string) => {
 	if (!process.env[key]) {
@@ -9,16 +15,10 @@ const fallback = (key: string, value: string) => {
 	}
 };
 
-fallback(
-	"DATABASE_URL",
-	"postgresql://postgres:postgres@localhost:5432/crm?schema=public",
-);
-fallback("BETTER_AUTH_SECRET", "test-secret-at-least-32-characters-long");
 fallback("API_URL", "http://localhost:3001");
 fallback("ALLOWED_SIGN_IN", "example.com");
 fallback("GOOGLE_CLIENT_ID", "test-google-client-id");
 fallback("GOOGLE_CLIENT_SECRET", "test-google-client-secret");
-
 describe("Auth (e2e)", () => {
 	let app: INestApplication;
 
@@ -41,6 +41,20 @@ describe("Auth (e2e)", () => {
 		await request(app.getHttpServer()).get("/auth/me").expect(401);
 	});
 
+	it("rejects unauthenticated push-token registration", async () => {
+		await request(app.getHttpServer())
+			.post("/push-tokens")
+			.send({ token: "fcm-test", platform: "ios" })
+			.expect(401);
+	});
+
+	it("rejects unauthenticated push-token deletion", async () => {
+		await request(app.getHttpServer())
+			.delete("/push-tokens")
+			.query({ token: "fcm-test" })
+			.expect(401);
+	});
+
 	it("allows an unauthenticated request to an optional-auth route", async () => {
 		const response = await request(app.getHttpServer())
 			.get("/auth/session")
@@ -49,12 +63,239 @@ describe("Auth (e2e)", () => {
 		expect(response.body).toEqual({ authenticated: false, user: null });
 	});
 
+	it("ignores an invalid credential on an optional-auth route", async () => {
+		const response = await request(app.getHttpServer())
+			.get("/auth/session")
+			.set("authorization", "Bearer invalid")
+			.expect(200);
+
+		expect(response.body).toEqual({ authenticated: false, user: null });
+	});
+
 	it("mounts the Better Auth handler", async () => {
 		const response = await request(app.getHttpServer()).get("/api/auth/ok");
 
 		expect(response.status).not.toBe(404);
 	});
 
+	it("publishes OAuth authorization-server metadata", async () => {
+		const response = await request(app.getHttpServer())
+			.get("/.well-known/oauth-authorization-server/api/auth")
+			.expect(200);
+
+		expect(response.body.issuer).toBe("http://localhost:3001/api/auth");
+		expect(response.body.authorization_endpoint).toBe(
+			"http://localhost:3001/api/auth/oauth2/authorize",
+		);
+		expect(response.body.code_challenge_methods_supported).toContain("S256");
+	});
+
+	it("keeps public metadata available with an invalid bearer token", async () => {
+		await request(app.getHttpServer())
+			.get("/.well-known/oauth-authorization-server/api/auth")
+			.set("authorization", "Bearer invalid")
+			.expect(200);
+	});
+
+	it("publishes OpenID Connect metadata", async () => {
+		const response = await request(app.getHttpServer())
+			.get("/api/auth/.well-known/openid-configuration")
+			.expect(200);
+
+		expect(response.body.issuer).toBe("http://localhost:3001/api/auth");
+		expect(response.body.jwks_uri).toBe("http://localhost:3001/api/auth/jwks");
+	});
+
+	it("publishes protected-resource metadata", async () => {
+		const response = await request(app.getHttpServer())
+			.get("/.well-known/oauth-protected-resource/api")
+			.expect(200);
+
+		expect(response.body.resource).toBe("http://localhost:3001/api");
+		expect(response.body.scopes_supported).toEqual(["crm.read", "crm.write"]);
+	});
+
+	it("rejects multiple credential types", async () => {
+		await request(app.getHttpServer())
+			.get("/auth/session")
+			.set("cookie", "crm.session_token=invalid")
+			.set("authorization", "Bearer invalid")
+			.expect(400);
+	});
+
+	it("returns a bearer challenge for an invalid token", async () => {
+		const response = await request(app.getHttpServer())
+			.get("/auth/me")
+			.set("authorization", "Bearer invalid")
+			.expect(401);
+
+		expect(response.headers["www-authenticate"]).toContain("invalid_token");
+	});
+
+	it("issues and refreshes OAuth tokens through PKCE", async () => {
+		const { db } = await import("@crm/db");
+		const { OAUTH_ORGANIZATION_CLAIM } = await import("@crm/auth");
+		const userId = `oauth-test-${crypto.randomUUID()}`;
+		const organizationId = `oauth-organization-${crypto.randomUUID()}`;
+		const sessionToken = `oauth-session-${crypto.randomUUID()}`;
+		const verifier = `${crypto.randomUUID()}${crypto.randomUUID()}`.replaceAll(
+			"-",
+			"",
+		);
+		const challenge = Buffer.from(
+			await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)),
+		).toString("base64url");
+
+		await db.user.create({
+			data: {
+				id: userId,
+				email: `${userId}@example.com`,
+				name: "OAuth Test",
+				emailVerified: true,
+				updatedAt: new Date(),
+			},
+		});
+		await db.organization.create({
+			data: {
+				id: organizationId,
+				name: "OAuth Test Organization",
+				slug: organizationId,
+				createdAt: new Date(),
+			},
+		});
+		await db.member.create({
+			data: {
+				id: `oauth-member-${crypto.randomUUID()}`,
+				userId,
+				organizationId,
+				role: "owner",
+				createdAt: new Date(),
+			},
+		});
+		await db.session.create({
+			data: {
+				id: sessionToken,
+				token: sessionToken,
+				userId,
+				activeOrganizationId: organizationId,
+				expiresAt: new Date(Date.now() + 60_000),
+				updatedAt: new Date(),
+			},
+		});
+
+		try {
+			const cookie = `crm.session_token=${await signCookieValue(sessionToken)}`;
+			const cookiePrincipal = await request(app.getHttpServer())
+				.get("/auth/session")
+				.set("cookie", cookie)
+				.set("authorization", "Basic ignored")
+				.expect(200);
+			expect(cookiePrincipal.body.user.id).toBe(userId);
+
+			const authorization = await request(app.getHttpServer())
+				.get("/api/auth/oauth2/authorize")
+				.set("cookie", cookie)
+				.query({
+					client_id: "compcrm-flutter",
+					redirect_uri: "ai.trycrm.app:/oauth/callback",
+					response_type: "code",
+					scope: "openid profile email offline_access crm.read",
+					code_challenge: challenge,
+					code_challenge_method: "S256",
+					state: "oauth-test-state",
+					nonce: "oauth-test-nonce",
+					resource: "http://localhost:3001/api",
+				})
+				.expect(302);
+			const location = authorization.headers.location;
+			if (!location)
+				throw new Error("OAuth authorization returned no redirect.");
+			const redirectUrl = new URL(location);
+			const code = redirectUrl.searchParams.get("code");
+			expect(code).toBeTruthy();
+			expect(redirectUrl.searchParams.get("state")).toBe("oauth-test-state");
+
+			const tokenResponse = await request(app.getHttpServer())
+				.post("/api/auth/oauth2/token")
+				.type("form")
+				.send({
+					grant_type: "authorization_code",
+					client_id: "compcrm-flutter",
+					redirect_uri: "ai.trycrm.app:/oauth/callback",
+					resource: "http://localhost:3001/api",
+					code,
+					code_verifier: verifier,
+				})
+				.expect(200);
+			expect(tokenResponse.body.access_token).toEqual(expect.any(String));
+			expect(tokenResponse.body.id_token).toEqual(expect.any(String));
+			expect(tokenResponse.body.refresh_token).toEqual(expect.any(String));
+			expect(tokenResponse.body.access_token.split(".")).toHaveLength(3);
+			const encodedPayload = tokenResponse.body.access_token.split(".")[1];
+			if (!encodedPayload) throw new Error("Access token has no payload.");
+			const accessTokenPayload = z
+				.object({ exp: z.number() })
+				.catchall(z.unknown())
+				.parse(
+					JSON.parse(Buffer.from(encodedPayload, "base64url").toString("utf8")),
+				);
+			expect(accessTokenPayload.exp).toBeGreaterThan(
+				Math.floor(Date.now() / 1000),
+			);
+			expect(accessTokenPayload.exp).toBeLessThanOrEqual(
+				Math.floor(Date.now() / 1000) + 610,
+			);
+			expect(accessTokenPayload[OAUTH_ORGANIZATION_CLAIM]).toBe(organizationId);
+			const { verifyAccessTokenRequest } = await import("@crm/auth");
+			await verifyAccessTokenRequest(
+				new Request("http://localhost:3001/auth/session", {
+					headers: {
+						authorization: `Bearer ${tokenResponse.body.access_token}`,
+					},
+				}),
+				{
+					verifyOptions: {
+						issuer: "http://localhost:3001/api/auth",
+						audience: "http://localhost:3001/api",
+					},
+				},
+			);
+
+			const principal = await request(app.getHttpServer())
+				.get("/auth/session")
+				.set("authorization", `Bearer ${tokenResponse.body.access_token}`)
+				.expect(200);
+			expect(principal.body.user.id).toBe(userId);
+			await request(app.getHttpServer())
+				.head("/auth/me")
+				.set("authorization", `Bearer ${tokenResponse.body.access_token}`)
+				.expect(200);
+
+			const refreshed = await request(app.getHttpServer())
+				.post("/api/auth/oauth2/token")
+				.type("form")
+				.send({
+					grant_type: "refresh_token",
+					client_id: "compcrm-flutter",
+					refresh_token: tokenResponse.body.refresh_token,
+					resource: "http://localhost:3001/api",
+				})
+				.expect(200);
+			expect(refreshed.body.access_token).toEqual(expect.any(String));
+			expect(refreshed.body.refresh_token).toEqual(expect.any(String));
+			const refreshedPayload = JSON.parse(
+				Buffer.from(
+					refreshed.body.access_token.split(".")[1],
+					"base64url",
+				).toString("utf8"),
+			) as Record<string, string>;
+			expect(refreshedPayload[OAUTH_ORGANIZATION_CLAIM]).toBe(organizationId);
+		} finally {
+			await db.user.delete({ where: { id: userId } });
+			await db.organization.delete({ where: { id: organizationId } });
+		}
+	});
+
 	it("lets the sign-in page read what it may offer", async () => {
 		const response = await request(app.getHttpServer())
 			.get("/api/trpc/sso.signInOptions")
@@ -79,3 +320,23 @@ describe("Auth (e2e)", () => {
 		expect(response.status).toBe(401);
 	});
 });
+
+async function signCookieValue(value: string): Promise<string> {
+	const secret = process.env.BETTER_AUTH_SECRET;
+	if (!secret) throw new Error("BETTER_AUTH_SECRET is required.");
+	const key = await crypto.subtle.importKey(
+		"raw",
+		new TextEncoder().encode(secret),
+		{ name: "HMAC", hash: "SHA-256" },
+		false,
+		["sign"],
+	);
+	const signature = await crypto.subtle.sign(
+		"HMAC",
+		key,
+		new TextEncoder().encode(value),
+	);
+	return encodeURIComponent(
+		`${value}.${Buffer.from(signature).toString("base64")}`,
+	);
+}
diff --git a/apps/api/test/backfill-auto-scope.spec.ts b/apps/api/test/backfill-auto-scope.spec.ts
new file mode 100644
index 000000000..f94070d7b
--- /dev/null
+++ b/apps/api/test/backfill-auto-scope.spec.ts
@@ -0,0 +1,72 @@
+import { describe, expect, it } from "bun:test";
+import { currentOrganizationId } from "@crm/db/tenant-context";
+import type { ScopedDb } from "@crm/db/tenant-scope";
+import type { Cache } from "cache-manager";
+import type { AgentTriggerService } from "../src/agent/agent-trigger.service";
+import { BackfillService } from "../src/backfill/backfill.service";
+import type { ImageMirrorService } from "../src/backfill/image-mirror.service";
+import type { FaviconService } from "../src/companies/favicon.service";
+
+const ORGANIZATIONS = ["organization-a", "organization-b"] as const;
+
+type BackfillServiceInternals = {
+	sweepWorkspace: () => Promise<void>;
+	runCompanies: () => Promise<{
+		queued: number;
+		remaining: number;
+		iconsResolving: number;
+	}>;
+	runContacts: () => Promise<{ queued: number; remaining: number }>;
+};
+
+describe("BackfillService automatic sweep", () => {
+	it("debounces globally while one run sweeps every organization", async () => {
+		const entries = new Map<string, unknown>();
+		const cache = {
+			get: async (key: string) => entries.get(key),
+			set: async <T>(key: string, value: T) => {
+				entries.set(key, value);
+			},
+		} as unknown as Cache;
+		const db = {
+			organization: {
+				findMany: async () => ORGANIZATIONS.map((id) => ({ id })),
+			},
+		} as unknown as ScopedDb;
+		const visited: string[] = [];
+		let finish: (() => void) | undefined;
+		const finished = new Promise<void>((resolve) => {
+			finish = resolve;
+		});
+		const service = new BackfillService(
+			db,
+			{} as AgentTriggerService,
+			{} as FaviconService,
+			{
+				sweep: async () => {
+					visited.push(currentOrganizationId());
+					if (visited.length === ORGANIZATIONS.length) finish?.();
+					return { copied: 0 };
+				},
+			} as unknown as ImageMirrorService,
+			cache,
+		);
+		const controlled = service as unknown as BackfillServiceInternals;
+		controlled.sweepWorkspace = async () => undefined;
+		controlled.runCompanies = async () => ({
+			queued: 0,
+			remaining: 0,
+			iconsResolving: 0,
+		});
+		controlled.runContacts = async () => ({ queued: 0, remaining: 0 });
+
+		const first = await service.auto();
+		const second = await service.auto();
+		await finished;
+
+		expect(first).toEqual({ started: true });
+		expect(second).toEqual({ started: false });
+		expect([...entries.keys()]).toEqual(["backfill:auto"]);
+		expect(visited).toEqual([...ORGANIZATIONS]);
+	});
+});
diff --git a/apps/api/test/bulk.spec.ts b/apps/api/test/bulk.spec.ts
index 9a0315188..b2438bf3e 100644
--- a/apps/api/test/bulk.spec.ts
+++ b/apps/api/test/bulk.spec.ts
@@ -1,5 +1,8 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { afterAll, beforeAll, describe, expect } from "bun:test";
 import { db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound, tenantTest } from "@crm/db/test-support";
 import { AgentQueueService } from "../src/agent/agent-queue.service";
 import type { AgentTriggerService } from "../src/agent/agent-trigger.service";
 import { CompaniesService } from "../src/companies/companies.service";
@@ -16,6 +19,8 @@ const suffix = process.env.TEST_RUN_ID ?? "bulk-spec";
 const domain = `bulk-${suffix}.test`;
 const ownerId = `owner-${suffix}`;
 const secondOwnerId = `second-owner-${suffix}`;
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
 const ours = { OR: [{ email: { endsWith: `@${domain}` } }] };
 
 const agent = {
@@ -25,67 +30,99 @@ const agent = {
 	withCrmEvents: withDiscardedCrmEvents,
 } as unknown as AgentTriggerService;
 
-const stamp = new ActivityStampService(db);
-const queue = new AgentQueueService(db);
-const conversion = new ConversionService(db);
-const directory = new CompanyDirectoryService(agent);
-
-const fields = new FieldsService(db, agent);
-const contacts = new ContactsService(
-	db,
-	directory,
-	agent,
-	queue,
-	stamp,
-	fields,
+const stamp = tenantBound(
+	organizationId,
+	new ActivityStampService(scopedDb as never),
 );
-const companies = new CompaniesService(
-	db,
-	agent,
-	queue,
-	{ backfill: async () => undefined } as unknown as FaviconService,
-	stamp,
-	conversion,
-	fields,
+const queue = tenantBound(
+	organizationId,
+	new AgentQueueService(scopedDb as never),
+);
+const conversion = tenantBound(
+	organizationId,
+	new ConversionService(scopedDb as never),
+);
+const directory = tenantBound(
+	organizationId,
+	new CompanyDirectoryService(agent),
+);
+
+const fields = tenantBound(
+	organizationId,
+	new FieldsService(scopedDb as never, agent),
+);
+const contacts = tenantBound(
+	organizationId,
+	new ContactsService(
+		scopedDb as never,
+		directory,
+		agent,
+		queue,
+		stamp,
+		fields,
+	),
+);
+const companies = tenantBound(
+	organizationId,
+	new CompaniesService(
+		scopedDb as never,
+		agent,
+		queue,
+		{ backfill: async () => undefined } as unknown as FaviconService,
+		stamp,
+		conversion,
+		fields,
+	),
+);
+const deals = tenantBound(
+	organizationId,
+	new DealsService(scopedDb as never, agent, stamp, conversion, fields),
 );
-const deals = new DealsService(db, agent, stamp, conversion, fields);
 
 let companyId: string;
 
 async function clean() {
-	const owned = await db.company.findMany({
+	const owned = await scopedDb.company.findMany({
 		where: { domain: { endsWith: domain } },
 		select: { id: true },
 	});
 	const companyIds = owned.map((row) => row.id);
 
-	await db.deal.deleteMany({ where: { companyId: { in: companyIds } } });
-	await db.activity.deleteMany({ where: { companyId: { in: companyIds } } });
-	await db.agentTask.deleteMany({ where: { companyId: { in: companyIds } } });
-	await db.contact.deleteMany({ where: ours });
-	await db.suppressedContact.deleteMany({ where: ours });
-	await db.company.deleteMany({ where: { domain: { endsWith: domain } } });
+	await scopedDb.deal.deleteMany({ where: { companyId: { in: companyIds } } });
+	await scopedDb.activity.deleteMany({
+		where: { companyId: { in: companyIds } },
+	});
+	await scopedDb.agentTask.deleteMany({
+		where: { companyId: { in: companyIds } },
+	});
+	await scopedDb.contact.deleteMany({ where: ours });
+	await scopedDb.suppressedContact.deleteMany({ where: ours });
+	await scopedDb.company.deleteMany({
+		where: { domain: { endsWith: domain } },
+	});
 	await db.user.deleteMany({ where: { id: { in: [ownerId, secondOwnerId] } } });
 }
 
-beforeAll(async () => {
-	await clean();
+beforeAll(() =>
+	runInTenant(organizationId, async () => {
+		await clean();
 
-	await db.user.createMany({
-		data: [
-			{ id: ownerId, name: "First Rep", email: `first@${domain}` },
-			{ id: secondOwnerId, name: "Second Rep", email: `second@${domain}` },
-		],
-	});
+		await db.user.createMany({
+			data: [
+				{ id: ownerId, name: "First Rep", email: `first@${domain}` },
+				{ id: secondOwnerId, name: "Second Rep", email: `second@${domain}` },
+			],
+		});
 
-	const company = await db.company.create({
-		data: { name: `Bulk Co ${suffix}`, domain },
-		select: { id: true },
-	});
-	companyId = company.id;
-});
+		const company = await scopedDb.company.create({
+			data: { organizationId, name: `Bulk Co ${suffix}`, domain },
+			select: { id: true },
+		});
+		companyId = company.id;
+	}),
+);
 
-afterAll(clean);
+afterAll(() => runInTenant(organizationId, clean));
 
 describe("assigning an owner to a selection", () => {
 	it("moves every record it was given", async () => {
@@ -114,7 +151,7 @@ describe("assigning an owner to a selection", () => {
 		});
 
 		expect(
-			await db.contact.count({
+			await scopedDb.contact.count({
 				where: { id: { in: [first.id, second.id] }, ownerId: secondOwnerId },
 			}),
 		).toBe(2);
@@ -158,7 +195,7 @@ describe("assigning an owner to a selection", () => {
 		expect(refused?.message).toMatch(/does not work here/);
 
 		expect(
-			await db.contact.findUnique({
+			await scopedDb.contact.findUnique({
 				where: { id: contact.id },
 				select: { ownerId: true },
 			}),
@@ -186,7 +223,7 @@ describe("purging a selection", () => {
 		});
 
 		expect(
-			await db.suppressedContact.count({
+			await scopedDb.suppressedContact.count({
 				where: { email: { in: [`gone@${domain}`, `also-gone@${domain}`] } },
 			}),
 		).toBe(2);
@@ -204,11 +241,11 @@ describe("purging a selection", () => {
 		expect(result.failed).toBe(1);
 		expect(result.message).toMatch(/No contact with id/);
 		expect(
-			await db.contact.findUnique({ where: { id: survivor.id } }),
+			await scopedDb.contact.findUnique({ where: { id: survivor.id } }),
 		).toBeNull();
 	});
 
-	it("takes a company's deals with it", async () => {
+	it("refuses to delete a company that still has deals", async () => {
 		const doomed = await companies.create({
 			name: `Doomed Co ${suffix}`,
 			domain: `doomed-${domain}`,
@@ -221,13 +258,20 @@ describe("purging a selection", () => {
 
 		expect(await companies.bulkPurge([doomed.id])).toEqual({
 			requested: 1,
-			succeeded: 1,
+			succeeded: 0,
 			skipped: 0,
-			failed: 0,
-			message: null,
+			failed: 1,
+			message: "Delete this company's deals before deleting the company.",
 		});
 
-		expect(await db.deal.findUnique({ where: { id: deal.id } })).toBeNull();
+		expect(
+			await scopedDb.deal.findUnique({
+				where: { id: deal.id },
+				select: { companyId: true },
+			}),
+		).toEqual({ companyId: doomed.id });
+		await scopedDb.deal.delete({ where: { id: deal.id } });
+		await scopedDb.company.delete({ where: { id: doomed.id } });
 	});
 });
 
@@ -251,7 +295,7 @@ describe("moving a selection of deals to a stage", () => {
 		expect(refused?.message).toMatch(/teaches nobody anything/);
 
 		expect(
-			await db.deal.findUnique({
+			await scopedDb.deal.findUnique({
 				where: { id: deal.id },
 				select: { stage: true },
 			}),
@@ -287,7 +331,7 @@ describe("moving a selection of deals to a stage", () => {
 			message: null,
 		});
 
-		const closed = await db.deal.findMany({
+		const closed = await scopedDb.deal.findMany({
 			where: { id: { in: [first.id, second.id] } },
 			select: { stage: true, closedReason: true, closedAt: true },
 		});
@@ -299,7 +343,7 @@ describe("moving a selection of deals to a stage", () => {
 		expect(closed.every((deal) => deal.closedAt !== null)).toBe(true);
 
 		expect(
-			await db.activity.count({
+			await scopedDb.activity.count({
 				where: {
 					dealId: { in: [first.id, second.id] },
 					type: "STAGE_CHANGE",
diff --git a/apps/api/test/company-requested.spec.ts b/apps/api/test/company-requested.spec.ts
index 138a1d36d..387f7cf26 100644
--- a/apps/api/test/company-requested.spec.ts
+++ b/apps/api/test/company-requested.spec.ts
@@ -1,54 +1,85 @@
 import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { db } from "@crm/db";
+import { type Db, db as globalDb } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantContext } from "@crm/db/test-support";
 import { AgentTriggerService } from "../src/agent/agent-trigger.service";
+import { ensureTestWorkspace } from "./workspace.fixture";
 
 const suffix = process.env.TEST_RUN_ID ?? "company-requested-spec";
 const name = `Requested Co ${suffix}`;
 const reason = `A rep asked for a fresh look (${suffix})`;
+const organizationId = `${suffix}-organization`;
+const db = scopedDb as unknown as Db;
 
 const agent = new AgentTriggerService(db);
 
 let companyId: string;
 let bridgeSecret: string | undefined;
 
+const inTenant = tenantContext(organizationId);
+
 async function clean() {
 	if (companyId) await db.agentTask.deleteMany({ where: { companyId } });
 	await db.company.deleteMany({ where: { name } });
+	await globalDb.organization.deleteMany({ where: { id: organizationId } });
 }
 
-beforeAll(async () => {
-	bridgeSecret = process.env.AGENT_BRIDGE_SECRET;
-	process.env.AGENT_BRIDGE_SECRET = "";
+beforeAll(() =>
+	inTenant(async () => {
+		bridgeSecret = process.env.AGENT_BRIDGE_SECRET;
+		process.env.AGENT_BRIDGE_SECRET = "";
 
-	await db.company.deleteMany({ where: { name } });
-	const company = await db.company.create({
-		data: { name, domain: `requested-${suffix}.test`.toLowerCase() },
-		select: { id: true },
-	});
-	companyId = company.id;
-});
+		await ensureTestWorkspace(organizationId, "Company Requested Workspace");
+		await db.company.deleteMany({ where: { name } });
+		const company = await db.company.create({
+			data: {
+				organizationId,
+				name,
+				domain: `requested-${suffix}.test`.toLowerCase(),
+			},
+			select: { id: true },
+		});
+		companyId = company.id;
+	}),
+);
 
-afterAll(async () => {
-	await clean();
+afterAll(() =>
+	inTenant(async () => {
+		await clean();
 
-	if (bridgeSecret === undefined) {
-		delete process.env.AGENT_BRIDGE_SECRET;
-	} else {
-		process.env.AGENT_BRIDGE_SECRET = bridgeSecret;
-	}
-});
+		if (bridgeSecret === undefined) {
+			delete process.env.AGENT_BRIDGE_SECRET;
+		} else {
+			process.env.AGENT_BRIDGE_SECRET = bridgeSecret;
+		}
+	}),
+);
 
 describe("asking for a fresh look", () => {
-	it("says what it actually queued", async () => {
-		expect(await agent.companyRequested(companyId, reason)).toBe(true);
+	it("says what it actually queued", () =>
+		inTenant(async () => {
+			expect(
+				await runInTenant(organizationId, () =>
+					agent.companyRequested(companyId, reason),
+				),
+			).toBe(true);
 
-		expect(await agent.companyRequested(companyId, reason)).toBe(false);
+			expect(
+				await runInTenant(organizationId, () =>
+					agent.companyRequested(companyId, reason),
+				),
+			).toBe(false);
 
-		await db.agentTask.updateMany({
-			where: { companyId, reason, finishedAt: null },
-			data: { finishedAt: new Date(), outcome: "done" },
-		});
+			await db.agentTask.updateMany({
+				where: { companyId, reason, finishedAt: null },
+				data: { finishedAt: new Date(), outcome: "done" },
+			});
 
-		expect(await agent.companyRequested(companyId, reason)).toBe(true);
-	});
+			expect(
+				await runInTenant(organizationId, () =>
+					agent.companyRequested(companyId, reason),
+				),
+			).toBe(true);
+		}));
 });
diff --git a/apps/api/test/contacts-tenant-scope.spec.ts b/apps/api/test/contacts-tenant-scope.spec.ts
new file mode 100644
index 000000000..4d853063b
--- /dev/null
+++ b/apps/api/test/contacts-tenant-scope.spec.ts
@@ -0,0 +1,92 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db, type Prisma } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import type { ScopedDb } from "@crm/db/tenant-scope";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { ConflictException } from "@nestjs/common";
+import { AgentQueueService } from "../src/agent/agent-queue.service";
+import type {
+	AgentTriggerService,
+	CrmEventInput,
+} from "../src/agent/agent-trigger.service";
+import { CompanyDirectoryService } from "../src/companies/company-directory.service";
+import { ContactsService } from "../src/contacts/contacts.service";
+import { ActivityStampService } from "../src/crm/activity-stamp.service";
+import { FieldsService } from "../src/fields/fields.service";
+
+const suffix = process.env.TEST_RUN_ID ?? "contacts-tenant-scope-spec";
+const orgAId = `${suffix}-org-a`;
+const orgBId = `${suffix}-org-b`;
+const sharedEmail = `shared-${suffix}@example.test`;
+const scoped = scopedDb as unknown as ScopedDb;
+
+const agent = {
+	withCrmEvents: (
+		work: (
+			tx: Prisma.TransactionClient,
+			emit: (input: CrmEventInput) => Promise<void>,
+		) => unknown,
+	) =>
+		scopedDb.$transaction(
+			async (tx) =>
+				await work(
+					tx as unknown as Prisma.TransactionClient,
+					async () => undefined,
+				),
+		),
+	companyCreated: async () => undefined,
+	contactCreated: async () => undefined,
+} as unknown as AgentTriggerService;
+
+const directory = new CompanyDirectoryService(agent);
+const queue = new AgentQueueService(scoped);
+const stamp = new ActivityStampService(scoped);
+const fields = new FieldsService(scoped, agent);
+const contacts = new ContactsService(
+	scoped,
+	directory,
+	agent,
+	queue,
+	stamp,
+	fields,
+);
+
+async function clear(): Promise<void> {
+	await db.contact.deleteMany({
+		where: { organizationId: { in: [orgAId, orgBId] } },
+	});
+	await db.organization.deleteMany({ where: { id: { in: [orgAId, orgBId] } } });
+}
+
+beforeAll(async () => {
+	await clear();
+	await db.organization.createMany({
+		data: [
+			{ id: orgAId, name: "Org A", slug: orgAId, createdAt: new Date() },
+			{ id: orgBId, name: "Org B", slug: orgBId, createdAt: new Date() },
+		],
+	});
+});
+
+afterAll(clear);
+
+describe("ContactsService.create under tenant scope", () => {
+	it("allows one email address in separate organizations", async () => {
+		const inA = await runInTenant(orgAId, () =>
+			contacts.create({ firstName: "A", email: sharedEmail } as never),
+		);
+		const inB = await runInTenant(orgBId, () =>
+			contacts.create({ firstName: "B", email: sharedEmail } as never),
+		);
+
+		expect(inA.id).not.toBe(inB.id);
+	});
+
+	it("rejects duplicate email addresses in one organization", async () => {
+		await expect(
+			runInTenant(orgAId, () =>
+				contacts.create({ firstName: "A Again", email: sharedEmail } as never),
+			),
+		).rejects.toThrow(ConflictException);
+	});
+});
diff --git a/apps/api/test/conversation-sharing.spec.ts b/apps/api/test/conversation-sharing.spec.ts
index 75f1f60dc..d951d6611 100644
--- a/apps/api/test/conversation-sharing.spec.ts
+++ b/apps/api/test/conversation-sharing.spec.ts
@@ -1,15 +1,20 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { DEFAULT_WORKSPACE_NAME, WORKSPACE_ID } from "@crm/auth";
+import { afterAll, beforeAll, describe, expect } from "bun:test";
 import { db } from "@crm/db";
-import { workspaceSlug } from "@crm/db/workspace";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound, tenantTest } from "@crm/db/test-support";
 import { z } from "zod";
 import { ConversationSharingService } from "../src/conversations/conversation-sharing.service";
 import { ConversationsService } from "../src/conversations/conversations.service";
+import { createTestMembers, ensureTestWorkspace } from "./workspace.fixture";
 
 const record = z.record(z.string(), z.unknown()).catch({});
 
 const list = z.array(z.unknown()).catch([]);
 
+const WORKSPACE_ID = "conversation-sharing-spec-workspace";
+const it = tenantTest(WORKSPACE_ID);
+const DEFAULT_WORKSPACE_NAME = "Conversation Sharing Spec Workspace";
 const suffix = crypto.randomUUID();
 const userId = `share-user-${suffix}`;
 const outsiderId = `share-outsider-${suffix}`;
@@ -19,98 +24,86 @@ const viewerMemberId = `share-viewer-member-${suffix}`;
 const sessionId = `share-session-${suffix}`;
 let conversationId = "";
 let attachmentId = "";
-const service = new ConversationSharingService(db);
-const conversations = new ConversationsService(db);
-
-beforeAll(async () => {
-	await db.organization.upsert({
-		where: { id: WORKSPACE_ID },
-		update: {},
-		create: {
-			id: WORKSPACE_ID,
-			name: DEFAULT_WORKSPACE_NAME,
-			slug: workspaceSlug(DEFAULT_WORKSPACE_NAME),
-			createdAt: new Date(),
-		},
-	});
-	await db.user.createMany({
-		data: [
-			{ id: userId, name: "Share Owner", email: `${userId}@example.test` },
-			{
-				id: outsiderId,
-				name: "Share Outsider",
-				email: `${outsiderId}@example.test`,
-			},
-			{
-				id: viewerId,
-				name: "Share Viewer",
-				email: `${viewerId}@example.test`,
-			},
-		],
-	});
-	await db.member.createMany({
-		data: [
-			{
-				id: memberId,
+const rawService = new ConversationSharingService(scopedDb as never);
+const service = tenantBound(WORKSPACE_ID, rawService);
+const rawConversations = new ConversationsService(scopedDb as never);
+const conversations = tenantBound(WORKSPACE_ID, rawConversations);
+
+beforeAll(() =>
+	runInTenant(WORKSPACE_ID, async () => {
+		await ensureTestWorkspace(WORKSPACE_ID, DEFAULT_WORKSPACE_NAME);
+		await db.user.createMany({
+			data: [
+				{ id: userId, name: "Share Owner", email: `${userId}@example.test` },
+				{
+					id: outsiderId,
+					name: "Share Outsider",
+					email: `${outsiderId}@example.test`,
+				},
+				{
+					id: viewerId,
+					name: "Share Viewer",
+					email: `${viewerId}@example.test`,
+				},
+			],
+		});
+		await createTestMembers(WORKSPACE_ID, [
+			{ id: memberId, userId },
+			{ id: viewerMemberId, userId: viewerId },
+		]);
+		const conversation = await scopedDb.agentConversation.create({
+			data: {
 				organizationId: WORKSPACE_ID,
+				kind: "BUILDER",
 				userId,
-				role: "member",
-				createdAt: new Date(),
+				title: "Share safely",
+				sessionId,
 			},
-			{
-				id: viewerMemberId,
+			select: { id: true },
+		});
+		conversationId = conversation.id;
+		const submission = await scopedDb.agentConversationSubmission.create({
+			data: {
 				organizationId: WORKSPACE_ID,
-				userId: viewerId,
-				role: "member",
-				createdAt: new Date(),
-			},
-		],
-	});
-	const conversation = await db.agentConversation.create({
-		data: {
-			kind: "BUILDER",
-			userId,
-			title: "Share safely",
-			sessionId,
-		},
-		select: { id: true },
-	});
-	conversationId = conversation.id;
-	const submission = await db.agentConversationSubmission.create({
-		data: {
-			conversationId,
-			submittedById: userId,
-			clientRequestId: crypto.randomUUID(),
-			message: {
-				text: "Review the image",
-				resources: [],
-				attachments: [{ name: "shared.png", type: "image/png", size: 4 }],
-			},
-			attachments: {
-				create: {
-					name: "shared.png",
-					mediaType: "image/png",
-					size: 4,
-					content: Buffer.from([1, 2, 3, 4]),
-					position: 0,
+				conversationId,
+				submittedById: userId,
+				clientRequestId: crypto.randomUUID(),
+				message: {
+					text: "Review the image",
+					resources: [],
+					attachments: [{ name: "shared.png", type: "image/png", size: 4 }],
+				},
+				attachments: {
+					create: {
+						organizationId: WORKSPACE_ID,
+						name: "shared.png",
+						mediaType: "image/png",
+						size: 4,
+						content: Buffer.from([1, 2, 3, 4]),
+						position: 0,
+					},
 				},
 			},
-		},
-		select: { attachments: { select: { id: true } } },
-	});
-	attachmentId = submission.attachments[0]?.id ?? "";
-});
-
-afterAll(async () => {
-	await db.agentEvent.deleteMany({ where: { sessionId } });
-	await db.agentConversation.deleteMany({ where: { id: conversationId } });
-	await db.member.deleteMany({
-		where: { id: { in: [memberId, viewerMemberId] } },
-	});
-	await db.user.deleteMany({
-		where: { id: { in: [userId, outsiderId, viewerId] } },
-	});
-});
+			select: { attachments: { select: { id: true } } },
+		});
+		attachmentId = submission.attachments[0]?.id ?? "";
+	}),
+);
+
+afterAll(() =>
+	runInTenant(WORKSPACE_ID, async () => {
+		await scopedDb.agentEvent.deleteMany({ where: { sessionId } });
+		await scopedDb.agentConversation.deleteMany({
+			where: { id: conversationId },
+		});
+		await db.member.deleteMany({
+			where: { id: { in: [memberId, viewerMemberId] } },
+		});
+		await db.user.deleteMany({
+			where: { id: { in: [userId, outsiderId, viewerId] } },
+		});
+	}),
+);
 
 describe("conversation sharing", () => {
 	it("keeps a builder chat private until its owner creates a link", async () => {
@@ -149,7 +142,7 @@ describe("conversation sharing", () => {
 		const results = await Promise.all(
 			Array.from({ length: 4 }, () => service.create(conversationId, userId)),
 		);
-		const activeShares = await db.agentConversationShare.findMany({
+		const activeShares = await scopedDb.agentConversationShare.findMany({
 			where: { conversationId, revokedAt: null },
 			select: { tokenHash: true },
 		});
@@ -206,7 +199,7 @@ describe("conversation sharing", () => {
 		await service.revoke(conversationId, userId);
 
 		expect(
-			await db.agentConversationShare.count({
+			await scopedDb.agentConversationShare.count({
 				where: { conversationId, revokedAt: null },
 			}),
 		).toBe(0);
diff --git a/apps/api/test/conversations.spec.ts b/apps/api/test/conversations.spec.ts
index 25c99ca66..29ae2b7a3 100644
--- a/apps/api/test/conversations.spec.ts
+++ b/apps/api/test/conversations.spec.ts
@@ -1,7 +1,8 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { DEFAULT_WORKSPACE_NAME, WORKSPACE_ID } from "@crm/auth";
+import { afterAll, beforeAll, describe, expect } from "bun:test";
 import { db } from "@crm/db";
-import { workspaceSlug } from "@crm/db/workspace";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound, tenantTest } from "@crm/db/test-support";
 import { z } from "zod";
 import {
 	builderConversationCreateInput,
@@ -9,6 +10,7 @@ import {
 	conversationSaveInput,
 } from "../src/conversations/conversations.contracts";
 import { ConversationsService } from "../src/conversations/conversations.service";
+import { createTestMembers, ensureTestWorkspace } from "./workspace.fixture";
 
 const record = z.record(z.string(), z.unknown()).catch({});
 
@@ -20,69 +22,65 @@ const suffix = process.env.TEST_RUN_ID ?? "conversations-spec";
 const email = `conversation.subject.${suffix}@example.test`;
 const userId = `user-${suffix}`;
 const memberId = `conversation-member-${suffix}`;
+const WORKSPACE_ID = "conversations-spec-workspace";
+const it = tenantTest(WORKSPACE_ID);
+const DEFAULT_WORKSPACE_NAME = "Conversations Spec Workspace";
 
 let contactId: string;
 let service: ConversationsService;
 
-beforeAll(async () => {
-	await db.agentEvent.deleteMany({
-		where: {
-			OR: [
-				{ sessionId: { startsWith: `builder-question-${suffix}` } },
-				{ sessionId: { startsWith: `ses_${suffix}` } },
-			],
-		},
-	});
-	await db.agentConversation.deleteMany({ where: { userId } });
-	await db.member.deleteMany({ where: { id: memberId } });
-	await db.user.deleteMany({ where: { id: userId } });
-	await db.contact.deleteMany({ where: { email } });
-	await db.organization.upsert({
-		where: { id: WORKSPACE_ID },
-		update: {},
-		create: {
-			id: WORKSPACE_ID,
-			name: DEFAULT_WORKSPACE_NAME,
-			slug: workspaceSlug(DEFAULT_WORKSPACE_NAME),
-			createdAt: new Date(),
-		},
-	});
-
-	await db.user.create({
-		data: { id: userId, name: "Test Rep", email: `${userId}@example.test` },
-	});
-	await db.member.create({
-		data: {
-			id: memberId,
-			organizationId: WORKSPACE_ID,
-			userId,
-			role: "member",
-			createdAt: new Date(),
-		},
-	});
-	const contact = await db.contact.create({
-		data: { firstName: "Conversation", lastName: "Subject", email },
-		select: { id: true },
-	});
-	contactId = contact.id;
-
-	service = new ConversationsService(db);
-});
-
-afterAll(async () => {
-	await db.agentEvent.deleteMany({
-		where: {
-			OR: [
-				{ sessionId: { startsWith: `builder-question-${suffix}` } },
-				{ sessionId: { startsWith: `ses_${suffix}` } },
-			],
-		},
-	});
-	await db.contact.deleteMany({ where: { email } });
-	await db.agentConversation.deleteMany({ where: { userId } });
-	await db.member.deleteMany({ where: { id: memberId } });
-	await db.user.deleteMany({ where: { id: userId } });
-});
+beforeAll(() =>
+	runInTenant(WORKSPACE_ID, async () => {
+		await scopedDb.agentEvent.deleteMany({
+			where: {
+				OR: [
+					{ sessionId: { startsWith: `builder-question-${suffix}` } },
+					{ sessionId: { startsWith: `ses_${suffix}` } },
+				],
+			},
+		});
+		await scopedDb.agentConversation.deleteMany({ where: { userId } });
+		await db.member.deleteMany({ where: { id: memberId } });
+		await db.user.deleteMany({ where: { id: userId } });
+		await scopedDb.contact.deleteMany({ where: { email } });
+		await ensureTestWorkspace(WORKSPACE_ID, DEFAULT_WORKSPACE_NAME);
+
+		await db.user.create({
+			data: { id: userId, name: "Test Rep", email: `${userId}@example.test` },
+		});
+		await createTestMembers(WORKSPACE_ID, [{ id: memberId, userId }]);
+		const contact = await scopedDb.contact.create({
+			data: {
+				organizationId: WORKSPACE_ID,
+				firstName: "Conversation",
+				lastName: "Subject",
+				email,
+			},
+			select: { id: true },
+		});
+		contactId = contact.id;
+
+		const rawService = new ConversationsService(scopedDb as never);
+		service = tenantBound(WORKSPACE_ID, rawService);
+	}),
+);
+
+afterAll(() =>
+	runInTenant(WORKSPACE_ID, async () => {
+		await scopedDb.agentEvent.deleteMany({
+			where: {
+				OR: [
+					{ sessionId: { startsWith: `builder-question-${suffix}` } },
+					{ sessionId: { startsWith: `ses_${suffix}` } },
+				],
+			},
+		});
+		await scopedDb.contact.deleteMany({ where: { email } });
+		await scopedDb.agentConversation.deleteMany({ where: { userId } });
+		await db.member.deleteMany({ where: { id: memberId } });
+		await db.user.deleteMany({ where: { id: userId } });
+	}),
+);
 
 describe("ConversationsService", () => {
 	it("starts a record with no history", async () => {
@@ -205,7 +203,7 @@ describe("ConversationsService", () => {
 		expect(ownershipError).toBeDefined();
 
 		expect(
-			await db.agentConversation.findUnique({
+			await scopedDb.agentConversation.findUnique({
 				where: { sessionId },
 				select: { continuationToken: true, streamIndex: true },
 			}),
@@ -235,7 +233,9 @@ describe("ConversationsService", () => {
 		);
 
 		expect(new Set(results.map((result) => result.id)).size).toBe(1);
-		expect(await db.agentConversation.count({ where: { sessionId } })).toBe(1);
+		expect(
+			await scopedDb.agentConversation.count({ where: { sessionId } }),
+		).toBe(1);
 	});
 
 	it("does not treat a builder session as a record conversation", async () => {
@@ -250,7 +250,7 @@ describe("ConversationsService", () => {
 			userId,
 		);
 		const sessionId = `ses_${suffix}_builder`;
-		await db.agentConversation.update({
+		await scopedDb.agentConversation.update({
 			where: { id: builder.id },
 			data: { sessionId },
 		});
@@ -263,7 +263,7 @@ describe("ConversationsService", () => {
 		}
 		expect(saveError).toBeDefined();
 		expect(
-			await db.agentConversation.findUnique({
+			await scopedDb.agentConversation.findUnique({
 				where: { id: builder.id },
 				select: { kind: true, contactId: true },
 			}),
@@ -274,8 +274,9 @@ describe("ConversationsService", () => {
 		const sessionId = `ses_${suffix}_events`;
 		const saved = await service.save({ contactId, sessionId }, userId);
 		const emittedAt = new Date("2026-08-05T12:00:00.000Z");
-		await db.agentEvent.createMany({
+		await scopedDb.agentEvent.createMany({
 			data: [0, 1, 2, 3].map((position) => ({
+				organizationId: WORKSPACE_ID,
 				id: `evt_${suffix}_window_${position}`,
 				sessionId,
 				contactId,
@@ -304,14 +305,15 @@ describe("ConversationsService", () => {
 			userId,
 		);
 		const rootSessionId = `builder-question-${suffix}-root`;
-		await db.agentConversation.update({
+		await scopedDb.agentConversation.update({
 			where: { id: builder.id },
 			data: { sessionId: rootSessionId },
 		});
 		const emittedAt = new Date("2026-08-05T13:00:00.000Z");
-		await db.agentEvent.createMany({
+		await scopedDb.agentEvent.createMany({
 			data: [
 				{
+					organizationId: WORKSPACE_ID,
 					id: `evt_${suffix}_builder_root`,
 					sessionId: rootSessionId,
 					conversationId: builder.id,
@@ -320,6 +322,7 @@ describe("ConversationsService", () => {
 					emittedAt,
 				},
 				{
+					organizationId: WORKSPACE_ID,
 					id: `evt_${suffix}_builder_child`,
 					sessionId: `builder-question-${suffix}-child`,
 					conversationId: builder.id,
@@ -341,8 +344,9 @@ describe("ConversationsService", () => {
 		const sessionId = `ses_${suffix}_delete`;
 		const conversation = await service.save({ contactId, sessionId }, userId);
 
-		await db.agentEvent.create({
+		await scopedDb.agentEvent.create({
 			data: {
+				organizationId: WORKSPACE_ID,
 				id: `evt_${suffix}`,
 				sessionId,
 				contactId,
@@ -351,8 +355,9 @@ describe("ConversationsService", () => {
 				emittedAt: new Date(),
 			},
 		});
-		await db.agentBuilderArtifact.create({
+		await scopedDb.agentBuilderArtifact.create({
 			data: {
+				organizationId: WORKSPACE_ID,
 				conversationId: conversation.id,
 				path: "agent/instructions.md",
 				language: "markdown",
@@ -364,15 +369,17 @@ describe("ConversationsService", () => {
 		await service.remove(conversation.id, userId);
 
 		expect(
-			await db.agentConversation.findUnique({ where: { id: conversation.id } }),
+			await scopedDb.agentConversation.findUnique({
+				where: { id: conversation.id },
+			}),
 		).toBeNull();
 		expect(
-			await db.agentEvent.count({
+			await scopedDb.agentEvent.count({
 				where: { sessionId },
 			}),
 		).toBe(0);
 		expect(
-			await db.agentBuilderArtifact.count({
+			await scopedDb.agentBuilderArtifact.count({
 				where: { conversationId: conversation.id },
 			}),
 		).toBe(0);
@@ -392,7 +399,9 @@ describe("ConversationsService", () => {
 		}
 		expect(removeError).toBeDefined();
 		expect(
-			await db.agentConversation.findUnique({ where: { id: conversation.id } }),
+			await scopedDb.agentConversation.findUnique({
+				where: { id: conversation.id },
+			}),
 		).not.toBeNull();
 	});
 
@@ -639,7 +648,7 @@ describe("ConversationsService", () => {
 
 		expect(new Set(results.map((result) => result.id)).size).toBe(1);
 		expect(
-			await db.agentConversationSubmission.count({
+			await scopedDb.agentConversationSubmission.count({
 				where: { clientRequestId },
 			}),
 		).toBe(1);
@@ -675,7 +684,7 @@ describe("ConversationsService", () => {
 
 		expect(new Set(results.map((result) => result.id)).size).toBe(1);
 		expect(
-			await db.agentConversationSubmission.count({
+			await scopedDb.agentConversationSubmission.count({
 				where: { clientRequestId },
 			}),
 		).toBe(1);
@@ -693,7 +702,7 @@ describe("ConversationsService", () => {
 			userId,
 		);
 		const sessionId = `builder-question-${suffix}-1`;
-		await db.agentConversation.update({
+		await scopedDb.agentConversation.update({
 			where: { id: conversation.id },
 			data: {
 				sessionId,
@@ -724,7 +733,7 @@ describe("ConversationsService", () => {
 			},
 			userId,
 		);
-		const submission = await db.agentConversationSubmission.findUnique({
+		const submission = await scopedDb.agentConversationSubmission.findUnique({
 			where: { id: response.id },
 			select: {
 				commandType: true,
@@ -759,7 +768,7 @@ describe("ConversationsService", () => {
 			},
 			userId,
 		);
-		await db.agentConversation.update({
+		await scopedDb.agentConversation.update({
 			where: { id: conversation.id },
 			data: {
 				sessionId: `builder-question-${suffix}-recovery`,
@@ -798,7 +807,7 @@ describe("ConversationsService", () => {
 			userId,
 		);
 		const sessionId = `builder-question-${suffix}-2`;
-		await db.agentConversation.update({
+		await scopedDb.agentConversation.update({
 			where: { id: conversation.id },
 			data: {
 				sessionId,
@@ -844,7 +853,7 @@ describe("ConversationsService", () => {
 			results.filter((result) => result.status === "rejected"),
 		).toHaveLength(1);
 		expect(
-			await db.agentConversationSubmission.count({
+			await scopedDb.agentConversationSubmission.count({
 				where: {
 					conversationId: conversation.id,
 					inputRequestId: "question-concurrent",
diff --git a/apps/api/test/currency-totals.integration.spec.ts b/apps/api/test/currency-totals.integration.spec.ts
index 5cb97c7a4..d529f4979 100644
--- a/apps/api/test/currency-totals.integration.spec.ts
+++ b/apps/api/test/currency-totals.integration.spec.ts
@@ -1,7 +1,10 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { afterAll, beforeAll, describe, expect } from "bun:test";
 import { DealStage, db, RateSource } from "@crm/db";
 import { normalizeCurrency } from "@crm/db/currency";
-import { SETTINGS_ID, writeReportingCurrency } from "@crm/db/settings";
+import { writeReportingCurrency as writeReportingCurrencyRaw } from "@crm/db/settings";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound, tenantTest } from "@crm/db/test-support";
 import type { AgentTriggerService } from "../src/agent/agent-trigger.service";
 import { ActivityStampService } from "../src/crm/activity-stamp.service";
 import { ConversionService } from "../src/currency/conversion.service";
@@ -13,20 +16,42 @@ import { withDiscardedCrmEvents } from "./agent-trigger.stub";
 const suffix = process.env.TEST_RUN_ID ?? "currency-totals-spec";
 const userId = `user-${suffix}`;
 const domain = `money-${suffix}.test`;
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
+
+function writeReportingCurrency(code: string): Promise<string> {
+	return runInTenant(organizationId, () =>
+		writeReportingCurrencyRaw(scopedDb as never, code),
+	);
+}
 
 const agent = {
 	withCrmEvents: withDiscardedCrmEvents,
 } as unknown as AgentTriggerService;
 
-const conversion = new ConversionService(db);
-const deals = new DealsService(
-	db,
-	agent,
-	new ActivityStampService(db),
-	conversion,
-	new FieldsService(db, { fieldBackfill: async () => undefined } as never),
+const conversion = tenantBound(
+	organizationId,
+	new ConversionService(scopedDb as never),
+);
+const deals = tenantBound(
+	organizationId,
+	new DealsService(
+		scopedDb as never,
+		agent,
+		new ActivityStampService(scopedDb as never),
+		conversion,
+		new FieldsService(
+			scopedDb as never,
+			{
+				fieldBackfill: async () => undefined,
+			} as never,
+		),
+	),
+);
+const dashboard = tenantBound(
+	organizationId,
+	new DashboardService(scopedDb as never, conversion),
 );
-const dashboard = new DashboardService(db, conversion);
 
 let companyId: string;
 let previousReportingCurrency: string | null = null;
@@ -68,52 +93,58 @@ async function pipelineCents(): Promise<number> {
 	return summary.pipeline.totalCents;
 }
 
-beforeAll(async () => {
-	const existing = await db.appSetting.findUnique({
-		where: { id: SETTINGS_ID },
-		select: { reportingCurrency: true },
-	});
-	previousReportingCurrency = existing?.reportingCurrency ?? null;
+beforeAll(() =>
+	runInTenant(organizationId, async () => {
+		const existing = await scopedDb.appSetting.findUnique({
+			where: { organizationId },
+			select: { reportingCurrency: true },
+		});
+		previousReportingCurrency = existing?.reportingCurrency ?? null;
 
-	await writeReportingCurrency(db, "USD");
-	await clearRates();
+		await writeReportingCurrency("USD");
+		await clearRates();
 
-	await db.user.upsert({
-		where: { id: userId },
-		create: {
-			id: userId,
-			name: "Rate Tester",
-			email: `rates@${domain}`,
-			emailVerified: true,
-		},
-		update: {},
-	});
+		await db.user.upsert({
+			where: { id: userId },
+			create: {
+				id: userId,
+				name: "Rate Tester",
+				email: `rates@${domain}`,
+				emailVerified: true,
+			},
+			update: {},
+		});
 
-	const company = await db.company.upsert({
-		where: { domain },
-		create: { name: `Money Co ${suffix}`, domain },
-		update: {},
-		select: { id: true },
-	});
-	companyId = company.id;
+		const company = await scopedDb.company.upsert({
+			where: { organizationId_domain: { organizationId, domain } },
+			create: { organizationId, name: `Money Co ${suffix}`, domain },
+			update: {},
+			select: { id: true },
+		});
+		companyId = company.id;
 
-	await rate("EUR", "1.10", RateSource.FETCHED);
-});
+		await rate("EUR", "1.10", RateSource.FETCHED);
+	}),
+);
 
-afterAll(async () => {
-	await db.deal.deleteMany({ where: { companyId } });
-	await db.company.deleteMany({ where: { domain } });
-	await db.user.deleteMany({ where: { id: userId } });
-	await clearRates();
+afterAll(() =>
+	runInTenant(organizationId, async () => {
+		await scopedDb.deal.deleteMany({ where: { companyId } });
+		await scopedDb.company.deleteMany({ where: { domain } });
+		await db.user.deleteMany({ where: { id: userId } });
+		await clearRates();
 
-	if (previousReportingCurrency) {
-		await writeReportingCurrency(db, previousReportingCurrency);
-	} else {
-		await db.appSetting.updateMany({ data: { reportingCurrency: null } });
-	}
+		if (previousReportingCurrency) {
+			await writeReportingCurrency(previousReportingCurrency);
+		} else {
+			await scopedDb.appSetting.updateMany({
+				data: { reportingCurrency: null },
+			});
+		}
 
-	await conversion.rerateAll();
-});
+		await conversion.rerateAll();
+	}),
+);
 
 describe("a total across currencies", () => {
 	it("converts on write and never adds two currencies together", async () => {
@@ -137,7 +168,7 @@ describe("a total across currencies", () => {
 	});
 
 	it("locks the rate onto the deal, so the row says how it was converted", async () => {
-		const row = await db.deal.findFirst({
+		const row = await scopedDb.deal.findFirst({
 			where: { companyId, currency: "EUR" },
 			select: { amount: true, baseAmount: true, fxRate: true, fxRateAt: true },
 		});
@@ -186,7 +217,7 @@ describe("a total across currencies", () => {
 
 		await conversion.fillMissing();
 
-		const row = await db.deal.findFirst({
+		const row = await scopedDb.deal.findFirst({
 			where: { companyId, currency: "EUR" },
 			select: { baseAmount: true },
 		});
@@ -199,7 +230,7 @@ describe("a total across currencies", () => {
 
 		await conversion.rerateAll();
 
-		const row = await db.deal.findFirst({
+		const row = await scopedDb.deal.findFirst({
 			where: { companyId, currency: "EUR" },
 			select: { baseAmount: true, fxRate: true },
 		});
@@ -209,7 +240,7 @@ describe("a total across currencies", () => {
 	});
 
 	it("re-rates everything when the reporting currency changes", async () => {
-		await writeReportingCurrency(db, "EUR");
+		await writeReportingCurrency("EUR");
 
 		const rerated = await conversion.rerateAll();
 		expect(rerated.missing).toContain("USD");
@@ -224,7 +255,7 @@ describe("a total across currencies", () => {
 
 describe("the deals list", () => {
 	it("reports its open pipeline in the reporting currency and discloses the rest", async () => {
-		await writeReportingCurrency(db, "USD");
+		await writeReportingCurrency("USD");
 		await conversion.rerateAll();
 
 		const list = await deals.list({
@@ -254,7 +285,7 @@ describe("the deals list", () => {
 
 describe("a converted figure knows which currency it is in", () => {
 	it("leaves a deal whose baseAmount predates a currency change out of totals", async () => {
-		await writeReportingCurrency(db, "USD");
+		await writeReportingCurrency("USD");
 		await conversion.rerateAll();
 
 		const before = await pipelineCents();
@@ -271,7 +302,7 @@ describe("a converted figure knows which currency it is in", () => {
 
 		expect(await pipelineCents()).toBe(before + MILLION);
 
-		await db.deal.update({
+		await scopedDb.deal.update({
 			where: { id: deal.id },
 			data: { baseCurrency: "JPY" },
 		});
@@ -286,17 +317,18 @@ describe("a converted figure knows which currency it is in", () => {
 
 		expect(await pipelineCents()).toBe(before + MILLION);
 
-		await db.deal.delete({ where: { id: deal.id } });
+		await scopedDb.deal.delete({ where: { id: deal.id } });
 	});
 
 	it("never lets a converted figure with no currency on it go unnoticed", async () => {
-		await writeReportingCurrency(db, "USD");
+		await writeReportingCurrency("USD");
 		await conversion.rerateAll();
 
 		const before = await pipelineCents();
 
-		const orphan = await db.deal.create({
+		const orphan = await scopedDb.deal.create({
 			data: {
+				organizationId,
 				name: `Orphan ${suffix}`,
 				companyId,
 				ownerId: userId,
@@ -316,21 +348,22 @@ describe("a converted figure knows which currency it is in", () => {
 
 		await conversion.fillMissing();
 
-		const healed = await db.deal.findUnique({
+		const healed = await scopedDb.deal.findUnique({
 			where: { id: orphan.id },
 			select: { baseCurrency: true },
 		});
 		expect(healed?.baseCurrency).toBe("USD");
 		expect(await pipelineCents()).toBe(before + 5_000_000);
 
-		await db.deal.delete({ where: { id: orphan.id } });
+		await scopedDb.deal.delete({ where: { id: orphan.id } });
 	});
 
 	it("counts a currency once however it was cased or padded", async () => {
 		const rows = await Promise.all(
 			[" usd ", "Usd"].map((currency, index) =>
-				db.deal.create({
+				scopedDb.deal.create({
 					data: {
+						organizationId,
 						name: `Variant ${index} ${suffix}`,
 						companyId,
 						ownerId: userId,
@@ -349,7 +382,7 @@ describe("a converted figure knows which currency it is in", () => {
 
 		const rerated = await conversion.rerateAll();
 
-		const written = await db.deal.findMany({
+		const written = await scopedDb.deal.findMany({
 			where: { id: { in: rows.map((row) => row.id) } },
 			select: { baseAmount: true, baseCurrency: true },
 		});
@@ -359,7 +392,7 @@ describe("a converted figure knows which currency it is in", () => {
 			expect(row.baseAmount?.toNumber()).toBe(1000);
 		}
 
-		const groups = await db.deal.groupBy({
+		const groups = await scopedDb.deal.groupBy({
 			by: ["currency"],
 			where: { amount: { not: null } },
 			_count: { _all: true },
@@ -373,13 +406,13 @@ describe("a converted figure knows which currency it is in", () => {
 
 		expect(rerated.converted).toBe(convertible);
 
-		await db.deal.deleteMany({
+		await scopedDb.deal.deleteMany({
 			where: { id: { in: rows.map((row) => row.id) } },
 		});
 	});
 
 	it("keeps a converted deal when the rate behind it has gone away", async () => {
-		await writeReportingCurrency(db, "USD");
+		await writeReportingCurrency("USD");
 		await conversion.rerateAll();
 
 		const deal = await deals.create({
@@ -390,7 +423,7 @@ describe("a converted figure knows which currency it is in", () => {
 			currency: "EUR",
 		});
 
-		const frozen = await db.deal.findUnique({
+		const frozen = await scopedDb.deal.findUnique({
 			where: { id: deal.id },
 			select: { baseAmount: true },
 		});
@@ -400,8 +433,9 @@ describe("a converted figure knows which currency it is in", () => {
 
 		await clearRates();
 
-		const stranded = await db.deal.create({
+		const stranded = await scopedDb.deal.create({
 			data: {
+				organizationId,
 				name: `Stranded ${suffix}`,
 				companyId,
 				ownerId: userId,
@@ -415,7 +449,7 @@ describe("a converted figure knows which currency it is in", () => {
 		expect(filled.missing).toContain("EUR");
 		expect(filled.cleared).toBe(0);
 
-		const kept = await db.deal.findUnique({
+		const kept = await scopedDb.deal.findUnique({
 			where: { id: deal.id },
 			select: { baseAmount: true, baseCurrency: true },
 		});
@@ -423,7 +457,7 @@ describe("a converted figure knows which currency it is in", () => {
 		expect(kept?.baseAmount?.toNumber()).toBe(frozen?.baseAmount?.toNumber());
 		expect(await pipelineCents()).toBe(before);
 
-		await db.deal.deleteMany({
+		await scopedDb.deal.deleteMany({
 			where: { id: { in: [deal.id, stranded.id] } },
 		});
 		await rate("EUR", "1.10", RateSource.FETCHED);
@@ -433,31 +467,36 @@ describe("a converted figure knows which currency it is in", () => {
 describe("the dashboard only values what it can convert", () => {
 	const analystId = `analyst-${suffix}`;
 
-	beforeAll(async () => {
-		await writeReportingCurrency(db, "USD");
-
-		await db.user.upsert({
-			where: { id: analystId },
-			create: {
-				id: analystId,
-				name: "Dashboard Tester",
-				email: `dashboard@${domain}`,
-				emailVerified: true,
-			},
-			update: {},
-		});
-	});
-
-	afterAll(async () => {
-		await db.deal.deleteMany({ where: { ownerId: analystId } });
-		await db.user.deleteMany({ where: { id: analystId } });
-	});
+	beforeAll(() =>
+		runInTenant(organizationId, async () => {
+			await writeReportingCurrency("USD");
+
+			await db.user.upsert({
+				where: { id: analystId },
+				create: {
+					id: analystId,
+					name: "Dashboard Tester",
+					email: `dashboard@${domain}`,
+					emailVerified: true,
+				},
+				update: {},
+			});
+		}),
+	);
+
+	afterAll(() =>
+		runInTenant(organizationId, async () => {
+			await scopedDb.deal.deleteMany({ where: { ownerId: analystId } });
+			await db.user.deleteMany({ where: { id: analystId } });
+		}),
+	);
 
 	async function stale(name: string, stage: DealStage) {
 		const closed = stage === DealStage.CLOSED_WON;
 
-		return db.deal.create({
+		return scopedDb.deal.create({
 			data: {
+				organizationId,
 				name: `${name} ${suffix}`,
 				companyId,
 				ownerId: analystId,
@@ -492,7 +531,9 @@ describe("the dashboard only values what it can convert", () => {
 		expect(summary.performance.avgDealCents).toBe(10_000);
 		expect(summary.unconverted.count).toBe(1);
 
-		await db.deal.deleteMany({ where: { id: { in: [won.id, unvalued.id] } } });
+		await scopedDb.deal.deleteMany({
+			where: { id: { in: [won.id, unvalued.id] } },
+		});
 	});
 
 	it("does not let a stale figure set the largest open deal", async () => {
@@ -515,6 +556,8 @@ describe("the dashboard only values what it can convert", () => {
 				?.baseAmountCents,
 		).toBeNull();
 
-		await db.deal.deleteMany({ where: { id: { in: [open.id, unvalued.id] } } });
+		await scopedDb.deal.deleteMany({
+			where: { id: { in: [open.id, unvalued.id] } },
+		});
 	});
 });
diff --git a/apps/api/test/database-module.spec.ts b/apps/api/test/database-module.spec.ts
new file mode 100644
index 000000000..fa3ddbc2b
--- /dev/null
+++ b/apps/api/test/database-module.spec.ts
@@ -0,0 +1,84 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import type { Db } from "@crm/db";
+import { db } from "@crm/db";
+import { runInTenant, TenantContextError } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { Test, type TestingModule } from "@nestjs/testing";
+import { DATABASE, SCOPED_DATABASE } from "../src/database/database.constants";
+import { DatabaseModule } from "../src/database/database.module";
+
+const makeName = (label: string) =>
+	`${label}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+
+const makeOrganizationId = (label: string) => makeName(`org-${label}`);
+
+let database: Db;
+let scoped: typeof scopedDb;
+let moduleFixture: TestingModule;
+const organizationIds: string[] = [];
+
+beforeAll(async () => {
+	moduleFixture = await Test.createTestingModule({
+		imports: [DatabaseModule],
+	}).compile();
+
+	database = moduleFixture.get(DATABASE);
+	scoped = moduleFixture.get(SCOPED_DATABASE);
+});
+
+afterAll(async () => {
+	await db.company.deleteMany({
+		where: { organizationId: { in: organizationIds } },
+	});
+
+	await db.organization.deleteMany({
+		where: { id: { in: organizationIds } },
+	});
+
+	await moduleFixture.close();
+});
+
+describe("database module", () => {
+	it("resolves raw and scoped providers from dependency injection", () => {
+		expect(database).toBe(db);
+		expect(scoped).toBe(scopedDb);
+	});
+
+	it("rejects tenant access on scoped models when outside tenant context", async () => {
+		await expect(Promise.resolve(scoped.company.findMany())).rejects.toThrow(
+			TenantContextError,
+		);
+		await expect(
+			Promise.resolve(
+				scoped.company.create({
+					data: { name: makeName("outside") },
+				} as never),
+			),
+		).rejects.toThrow(TenantContextError);
+	});
+
+	it("stamps the active tenant on scoped Company writes", async () => {
+		const organizationId = makeOrganizationId("write");
+		const companyName = makeName("company");
+		organizationIds.push(organizationId);
+
+		await db.organization.create({
+			data: {
+				id: organizationId,
+				name: `Org ${organizationId}`,
+				slug: `org-${organizationId}`,
+				createdAt: new Date(),
+			},
+		});
+
+		const created = await runInTenant(organizationId, () =>
+			Promise.resolve(
+				scoped.company.create({
+					data: { name: companyName } as never,
+				}),
+			),
+		);
+
+		expect(created.organizationId).toBe(organizationId);
+	});
+});
diff --git a/apps/api/test/deal-contacts.spec.ts b/apps/api/test/deal-contacts.spec.ts
index ccf9af4e4..2ecd80169 100644
--- a/apps/api/test/deal-contacts.spec.ts
+++ b/apps/api/test/deal-contacts.spec.ts
@@ -1,5 +1,7 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { db } from "@crm/db";
+import { afterAll, beforeAll, describe, expect } from "bun:test";
+import { type Db, db as globalDb } from "@crm/db";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound, tenantContext, tenantTest } from "@crm/db/test-support";
 import type { AgentTriggerService } from "../src/agent/agent-trigger.service";
 import { ActivityStampService } from "../src/crm/activity-stamp.service";
 import { ConversionService } from "../src/currency/conversion.service";
@@ -11,18 +13,22 @@ const suffix = process.env.TEST_RUN_ID ?? "deal-contacts-spec";
 const userId = `user-${suffix}`;
 const domain = `dealpeople-${suffix}.test`;
 const otherDomain = `elsewhere-${suffix}.test`;
+const organizationId = "workspace";
+const db = scopedDb as unknown as Db;
+const it = tenantTest(organizationId);
 
 const agent = {
 	withCrmEvents: withDiscardedCrmEvents,
 } as unknown as AgentTriggerService;
 
-const deals = new DealsService(
+const rawDeals = new DealsService(
 	db,
 	agent,
 	new ActivityStampService(db),
 	new ConversionService(db),
 	new FieldsService(db, { fieldBackfill: async () => undefined } as never),
 );
+const deals = tenantBound(organizationId, rawDeals);
 
 let companyId: string;
 let dealId: string;
@@ -30,6 +36,8 @@ let championId: string;
 let colleagueId: string;
 let outsiderId: string;
 
+const inTenant = tenantContext(organizationId);
+
 async function clean() {
 	await db.deal.deleteMany({ where: { company: { domain } } });
 	await db.contact.deleteMany({
@@ -38,13 +46,13 @@ async function clean() {
 	await db.company.deleteMany({
 		where: { domain: { in: [domain, otherDomain] } },
 	});
-	await db.user.deleteMany({ where: { id: userId } });
+	await globalDb.user.deleteMany({ where: { id: userId } });
 }
 
-beforeAll(async () => {
+async function seed() {
 	await clean();
 
-	await db.user.create({
+	await globalDb.user.create({
 		data: {
 			id: userId,
 			name: "Deal Rep",
@@ -54,30 +62,45 @@ beforeAll(async () => {
 	});
 
 	const company = await db.company.create({
-		data: { name: `People Co ${suffix}`, domain },
+		data: { organizationId, name: `People Co ${suffix}`, domain },
 		select: { id: true },
 	});
 	companyId = company.id;
 
 	const other = await db.company.create({
-		data: { name: `Other Co ${suffix}`, domain: otherDomain },
+		data: { organizationId, name: `Other Co ${suffix}`, domain: otherDomain },
 		select: { id: true },
 	});
 
 	const champion = await db.contact.create({
-		data: { firstName: "Ada", lastName: "Champion", companyId },
+		data: {
+			organizationId,
+			firstName: "Ada",
+			lastName: "Champion",
+			companyId,
+		},
 		select: { id: true },
 	});
 	championId = champion.id;
 
 	const colleague = await db.contact.create({
-		data: { firstName: "Beau", lastName: "Colleague", companyId },
+		data: {
+			organizationId,
+			firstName: "Beau",
+			lastName: "Colleague",
+			companyId,
+		},
 		select: { id: true },
 	});
 	colleagueId = colleague.id;
 
 	const outsider = await db.contact.create({
-		data: { firstName: "Cass", lastName: "Outsider", companyId: other.id },
+		data: {
+			organizationId,
+			firstName: "Cass",
+			lastName: "Outsider",
+			companyId: other.id,
+		},
 		select: { id: true },
 	});
 	outsiderId = outsider.id;
@@ -88,11 +111,125 @@ beforeAll(async () => {
 		ownerId: userId,
 	});
 	dealId = deal.id;
-});
+}
+
+beforeAll(() => inTenant(seed));
 
-afterAll(clean);
+afterAll(() => inTenant(clean));
 
 describe("bringing a contact onto a deal", () => {
+	it("rejects a database deal without a company", async () => {
+		const attempt =
+			db.$executeRaw`INSERT INTO "deal" ("id", "name", "ownerId", "updatedAt") VALUES (${`no-company-${suffix}`}, ${`No company ${suffix}`}, ${userId}, ${new Date()})`.then(
+				async () => {
+					await db.deal.delete({ where: { id: `no-company-${suffix}` } });
+				},
+			);
+
+		await expect(attempt).rejects.toThrow();
+	});
+
+	it("creates, updates, lists, and reads deal fields", async () => {
+		const deal = await deals.create({
+			name: `Deal ${suffix}`,
+			companyId,
+			ownerId: userId,
+			leadSource: "Referral",
+			projectType: "Type A",
+			addressLine1: "1 Main Street",
+			addressLine2: "Unit 2",
+			city: "Austin",
+			state: "TX",
+			postalCode: "78701",
+		});
+
+		await deals.update(deal.id, {
+			leadSource: "Website",
+			projectType: "Type B",
+			addressLine1: "2 Main Street",
+			addressLine2: "Unit 3",
+			city: "Dallas",
+			state: "TX",
+			postalCode: "75201",
+		});
+
+		const detail = await deals.byId(deal.id);
+		expect(detail).toMatchObject({
+			stage: "DEMO_BOOKED",
+			company: { id: companyId },
+			leadSource: "Website",
+			projectType: "Type B",
+			addressLine1: "2 Main Street",
+			addressLine2: "Unit 3",
+			city: "Dallas",
+			state: "TX",
+			postalCode: "75201",
+		});
+
+		const list = await deals.list({
+			q: "",
+			page: 1,
+			pageSize: 100,
+			sort: "createdAt",
+			dir: "desc",
+			status: "all",
+			owner: [],
+			stage: [],
+			closing: [],
+			fields: {},
+			archived: false,
+		});
+		expect(list.rows.find((row) => row.id === deal.id)).toMatchObject({
+			leadSource: "Website",
+			projectType: "Type B",
+			addressLine1: "2 Main Street",
+			addressLine2: "Unit 3",
+			city: "Dallas",
+			state: "TX",
+			postalCode: "75201",
+		});
+
+		await deals.purge(deal.id);
+	});
+
+	it("stores a document and its line items on a deal", async () => {
+		const document = await db.document.create({
+			data: {
+				dealId,
+				type: "ESTIMATE",
+				number: `DRAFT-${suffix}`,
+				status: "DRAFT",
+				recipientSnapshot: { name: "Recipient" },
+				contractorSnapshot: { name: "Company" },
+				projectSnapshot: { name: "Deal" },
+				subtotal: "100.00",
+				tax: "8.25",
+				total: "108.25",
+				lineItems: {
+					create: {
+						description: "Line item",
+						quantity: "1.00",
+						unitPrice: "100.00",
+						total: "100.00",
+						position: 0,
+					},
+				},
+			},
+			select: {
+				id: true,
+				currency: true,
+				issuedAt: true,
+				lineItems: { select: { description: true } },
+			},
+		});
+
+		expect(document.issuedAt).toBeNull();
+		expect(document.currency).toBe("USD");
+		expect(document.lineItems[0]?.description).toBe("Line item");
+
+		await db.document.delete({ where: { id: document.id } });
+	});
+
 	it("offers the people at the deal's company and nobody else", async () => {
 		const options = await deals.contactOptions(dealId);
 		const ids = options.map((option) => option.id);
diff --git a/apps/api/test/enrichment-queue.spec.ts b/apps/api/test/enrichment-queue.spec.ts
index dbece0abc..d24ac8d87 100644
--- a/apps/api/test/enrichment-queue.spec.ts
+++ b/apps/api/test/enrichment-queue.spec.ts
@@ -1,5 +1,7 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { db } from "@crm/db";
+import { afterAll, beforeAll, describe, expect } from "bun:test";
+import type { Db } from "@crm/db";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound, tenantContext, tenantTest } from "@crm/db/test-support";
 import {
 	ENRICHMENT_PAGE,
 	ENRICHMENT_PAGE_MAX,
@@ -12,8 +14,12 @@ const suffix = process.env.TEST_RUN_ID ?? "enrichment-queue-spec";
 const email = `queue-${suffix}@example.test`;
 const name = `Queue Co ${suffix}`;
 const kind = "test-queue-split";
+const organizationId = "workspace";
+const db = scopedDb as unknown as Db;
+const it = tenantTest(organizationId);
 
-const enrichment = new EnrichmentService(db);
+const rawEnrichment = new EnrichmentService(db);
+const enrichment = tenantBound(organizationId, rawEnrichment);
 
 const DAY_MS = 86_400_000;
 
@@ -24,6 +30,8 @@ let companyId: string;
 let dueId: string;
 let scheduledId: string;
 
+const inTenant = tenantContext(organizationId);
+
 async function clean() {
 	await db.agentTask.deleteMany({ where: { kind } });
 	await db.contact.deleteMany({ where: { email } });
@@ -33,68 +41,74 @@ async function clean() {
 	await db.company.deleteMany({ where: { name } });
 }
 
-beforeAll(async () => {
-	await clean();
+beforeAll(() =>
+	inTenant(async () => {
+		await clean();
 
-	const contact = await db.contact.create({
-		data: { firstName: "Queue", lastName: "Split", email },
-		select: { id: true },
-	});
-	const company = await db.company.create({
-		data: { name },
-		select: { id: true },
-	});
-
-	contactId = contact.id;
-	companyId = company.id;
-
-	const due = await db.agentTask.create({
-		data: {
-			kind,
-			reason: "due now",
-			dueAt: new Date(Date.now() - 60_000),
-			budget: 4,
-			companyId,
-		},
-		select: { id: true },
-	});
-	const scheduled = await db.agentTask.create({
-		data: {
-			kind,
-			reason: "booked for later",
-			dueAt: new Date(Date.now() + 90 * DAY_MS),
-			budget: 4,
-			contactId,
-		},
-		select: { id: true },
-	});
+		const contact = await db.contact.create({
+			data: { organizationId, firstName: "Queue", lastName: "Split", email },
+			select: { id: true },
+		});
+		const company = await db.company.create({
+			data: { organizationId, name },
+			select: { id: true },
+		});
 
-	dueId = due.id;
-	scheduledId = scheduled.id;
+		contactId = contact.id;
+		companyId = company.id;
 
-	for (let index = 0; index < EXTRA_ROWS; index++) {
-		const extra = await db.contact.create({
+		const due = await db.agentTask.create({
 			data: {
-				firstName: "Queue",
-				lastName: `Page ${index}`,
-				email: `page-${index}-${suffix}@example.test`,
+				organizationId,
+				kind,
+				reason: "due now",
+				dueAt: new Date(Date.now() - 60_000),
+				budget: 4,
+				companyId,
 			},
 			select: { id: true },
 		});
-
-		await db.agentTask.create({
+		const scheduled = await db.agentTask.create({
 			data: {
+				organizationId,
 				kind,
-				reason: "due now",
-				dueAt: new Date(Date.now() - 60_000),
+				reason: "booked for later",
+				dueAt: new Date(Date.now() + 90 * DAY_MS),
 				budget: 4,
-				contactId: extra.id,
+				contactId,
 			},
+			select: { id: true },
 		});
-	}
-});
 
-afterAll(clean);
+		dueId = due.id;
+		scheduledId = scheduled.id;
+
+		for (let index = 0; index < EXTRA_ROWS; index++) {
+			const extra = await db.contact.create({
+				data: {
+					organizationId,
+					firstName: "Queue",
+					lastName: `Page ${index}`,
+					email: `page-${index}-${suffix}@example.test`,
+				},
+				select: { id: true },
+			});
+
+			await db.agentTask.create({
+				data: {
+					organizationId,
+					kind,
+					reason: "due now",
+					dueAt: new Date(Date.now() - 60_000),
+					budget: 4,
+					contactId: extra.id,
+				},
+			});
+		}
+	}),
+);
+
+afterAll(() => inTenant(clean));
 
 describe("what the enrichment widget reads", () => {
 	it("lists work that is due now", async () => {
diff --git a/apps/api/test/fields.spec.ts b/apps/api/test/fields.spec.ts
index acecd1376..2d050b272 100644
--- a/apps/api/test/fields.spec.ts
+++ b/apps/api/test/fields.spec.ts
@@ -1,12 +1,7 @@
-import {
-	afterAll,
-	beforeAll,
-	beforeEach,
-	describe,
-	expect,
-	it,
-} from "bun:test";
-import { db, type FieldEntity } from "@crm/db";
+import { afterAll, beforeAll, beforeEach, describe, expect } from "bun:test";
+import { type Db, type FieldEntity, db as globalDb } from "@crm/db";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound, tenantContext, tenantTest } from "@crm/db/test-support";
 import { AgentQueueService } from "../src/agent/agent-queue.service";
 import { AgentTriggerService } from "../src/agent/agent-trigger.service";
 import { CompaniesService } from "../src/companies/companies.service";
@@ -22,6 +17,9 @@ import { withDiscardedCrmEvents } from "./agent-trigger.stub";
 const suffix = process.env.TEST_RUN_ID ?? "fields-spec";
 const domain = `fields-${suffix}.test`;
 const ownerId = `owner-${suffix}`;
+const organizationId = "workspace";
+const db = scopedDb as unknown as Db;
+const it = tenantTest(organizationId);
 
 const queued: {
 	entity: FieldEntity;
@@ -46,33 +44,44 @@ const agent = {
 	},
 } as unknown as AgentTriggerService;
 
-const stamp = new ActivityStampService(db);
-const queue = new AgentQueueService(db);
-const conversion = new ConversionService(db);
-
-const fields = new FieldsService(db, agent);
-const companies = new CompaniesService(
-	db,
-	agent,
-	queue,
-	{ backfill: async () => undefined } as unknown as FaviconService,
-	stamp,
-	conversion,
-	fields,
+const stamp = tenantBound(organizationId, new ActivityStampService(db));
+const queue = tenantBound(organizationId, new AgentQueueService(db));
+const conversion = tenantBound(organizationId, new ConversionService(db));
+
+const fields = tenantBound(organizationId, new FieldsService(db, agent));
+const companies = tenantBound(
+	organizationId,
+	new CompaniesService(
+		db,
+		agent,
+		queue,
+		{ backfill: async () => undefined } as unknown as FaviconService,
+		stamp,
+		conversion,
+		fields,
+	),
 );
-const contacts = new ContactsService(
-	db,
-	new CompanyDirectoryService(agent),
-	agent,
-	queue,
-	stamp,
-	fields,
+const contacts = tenantBound(
+	organizationId,
+	new ContactsService(
+		db,
+		new CompanyDirectoryService(agent),
+		agent,
+		queue,
+		stamp,
+		fields,
+	),
+);
+const deals = tenantBound(
+	organizationId,
+	new DealsService(db, agent, stamp, conversion, fields),
 );
-const deals = new DealsService(db, agent, stamp, conversion, fields);
 
 let companyId: string;
 let bridgeSecret: string | undefined;
 
+const inTenant = tenantContext(organizationId);
+
 async function clean() {
 	const owned = await db.company.findMany({
 		where: { domain: { endsWith: domain } },
@@ -104,40 +113,48 @@ async function clean() {
 		where: { key: { startsWith: "spec_" } },
 	});
 	await db.company.deleteMany({ where: { domain: { endsWith: domain } } });
-	await db.user.deleteMany({ where: { id: ownerId } });
+	await globalDb.user.deleteMany({ where: { id: ownerId } });
 }
 
 async function makeCompany(name: string): Promise<string> {
 	const company = await db.company.create({
-		data: { name: `${name} ${suffix}`, domain: `${name}-${domain}` },
+		data: {
+			organizationId,
+			name: `${name} ${suffix}`,
+			domain: `${name}-${domain}`,
+		},
 		select: { id: true },
 	});
 
 	return company.id;
 }
 
-beforeAll(async () => {
-	bridgeSecret = process.env.AGENT_BRIDGE_SECRET;
-	process.env.AGENT_BRIDGE_SECRET = "";
+beforeAll(() =>
+	inTenant(async () => {
+		bridgeSecret = process.env.AGENT_BRIDGE_SECRET;
+		process.env.AGENT_BRIDGE_SECRET = "";
 
-	await clean();
+		await clean();
 
-	await db.user.create({
-		data: { id: ownerId, name: "Fields Rep", email: `rep@${domain}` },
-	});
+		await globalDb.user.create({
+			data: { id: ownerId, name: "Fields Rep", email: `rep@${domain}` },
+		});
 
-	companyId = await makeCompany("fields-co");
-});
+		companyId = await makeCompany("fields-co");
+	}),
+);
 
-afterAll(async () => {
-	await clean();
+afterAll(() =>
+	inTenant(async () => {
+		await clean();
 
-	if (bridgeSecret === undefined) {
-		delete process.env.AGENT_BRIDGE_SECRET;
-	} else {
-		process.env.AGENT_BRIDGE_SECRET = bridgeSecret;
-	}
-});
+		if (bridgeSecret === undefined) {
+			delete process.env.AGENT_BRIDGE_SECRET;
+		} else {
+			process.env.AGENT_BRIDGE_SECRET = bridgeSecret;
+		}
+	}),
+);
 
 beforeEach(() => {
 	queued.length = 0;
@@ -560,6 +577,7 @@ describe("a record update that fails", () => {
 
 		const contact = await db.contact.create({
 			data: {
+				organizationId,
 				firstName: "Ada",
 				email: `ada@${domain}`,
 				companyId,
@@ -598,7 +616,12 @@ describe("a record update that fails", () => {
 		});
 
 		const deal = await db.deal.create({
-			data: { name: `Spec deal ${suffix}`, companyId, ownerId },
+			data: {
+				organizationId,
+				name: `Spec deal ${suffix}`,
+				companyId,
+				ownerId,
+			},
 			select: { id: true },
 		});
 
@@ -623,7 +646,7 @@ describe("a record update that fails", () => {
 
 describe("queueing a backfill", () => {
 	it("targets the record, and merges a second field into the same pending task", async () => {
-		const trigger = new AgentTriggerService(db);
+		const trigger = tenantBound(organizationId, new AgentTriggerService(db));
 		const otherCompanyId = await makeCompany("fields-co-2");
 
 		const first = await trigger.fieldBackfillRecords(
@@ -659,9 +682,14 @@ describe("queueing a backfill", () => {
 	});
 
 	it("keeps a company's field apart from a contact's field with the same key", async () => {
-		const trigger = new AgentTriggerService(db);
+		const trigger = tenantBound(organizationId, new AgentTriggerService(db));
 		const contact = await db.contact.create({
-			data: { firstName: "Backfill", email: `backfill@${domain}`, companyId },
+			data: {
+				organizationId,
+				firstName: "Backfill",
+				email: `backfill@${domain}`,
+				companyId,
+			},
 			select: { id: true },
 		});
 
diff --git a/apps/api/test/mailbox-purge.spec.ts b/apps/api/test/mailbox-purge.spec.ts
index 7545fa6d9..dd66d40f8 100644
--- a/apps/api/test/mailbox-purge.spec.ts
+++ b/apps/api/test/mailbox-purge.spec.ts
@@ -1,5 +1,8 @@
-import { afterAll, beforeEach, describe, expect, it } from "bun:test";
+import { afterAll, beforeEach, describe, expect } from "bun:test";
 import { ActivityType, db, EmailDirection, GoogleSyncStatus } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound, tenantTest } from "@crm/db/test-support";
 import { ActivityStampService } from "../src/crm/activity-stamp.service";
 import { GoogleConnectionService } from "../src/google/google-connection.service";
 import {
@@ -25,19 +28,31 @@ const shared = `shared-${suffix}`;
 const solo = `solo-${suffix}`;
 const theirs = `theirs-${suffix}`;
 const roots = [shared, solo, theirs];
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
 
 const tokens = new MailboxTokenService(db);
-const state = new SyncStateService(db);
-const stamp = new ActivityStampService(db);
+const rawState = new SyncStateService(scopedDb as never);
+const stamp = new ActivityStampService(scopedDb as never);
+const state = tenantBound(organizationId, rawState);
 
-const google = new GoogleConnectionService(
+const rawGoogle = new GoogleConnectionService(
 	db,
+	scopedDb as never,
 	tokens,
 	state,
 	{} as unknown as MailboxMatchService,
 	stamp,
 );
-const microsoft = new MicrosoftConnectionService(db, tokens, state, stamp);
+const google = tenantBound(organizationId, rawGoogle);
+const rawMicrosoft = new MicrosoftConnectionService(
+	db,
+	scopedDb as never,
+	tokens,
+	state,
+	stamp,
+);
+const microsoft = tenantBound(organizationId, rawMicrosoft);
 
 function at(hour: number): Date {
 	return new Date(Date.UTC(2026, 0, 1, hour));
@@ -61,8 +76,9 @@ async function thread(
 	const last = messages[messages.length - 1];
 	if (!first || !last) return;
 
-	await db.emailThread.create({
+	await scopedDb.emailThread.create({
 		data: {
+			organizationId,
 			rootMessageId,
 			subject: first.subject,
 			companyId,
@@ -71,6 +87,7 @@ async function thread(
 			messageCount: messages.length,
 			messages: {
 				create: messages.map((message) => ({
+					organizationId,
 					rfcMessageId: `${message.id}@${domain}`,
 					syncedByUserId: message.syncedByUserId,
 					gmailMessageId: message.provider === "gmail" ? message.id : null,
@@ -85,6 +102,7 @@ async function thread(
 			},
 			activity: {
 				create: {
+					organizationId,
 					type: ActivityType.EMAIL,
 					subject: first.subject,
 					body: last.snippet,
@@ -99,8 +117,8 @@ async function thread(
 }
 
 async function seed(): Promise<void> {
-	const company = await db.company.create({
-		data: { name: "Purge Co", domain },
+	const company = await scopedDb.company.create({
+		data: { organizationId, name: "Purge Co", domain },
 		select: { id: true },
 	});
 
@@ -153,8 +171,9 @@ async function seed(): Promise<void> {
 		},
 	]);
 
-	await db.calendarEvent.create({
+	await scopedDb.calendarEvent.create({
 		data: {
+			organizationId,
 			iCalUid: `ical-${suffix}`,
 			originalStartTime: at(12),
 			startsAt: at(12),
@@ -167,18 +186,20 @@ async function seed(): Promise<void> {
 }
 
 async function clean(): Promise<void> {
-	await db.calendarEvent.deleteMany({
+	await scopedDb.calendarEvent.deleteMany({
 		where: { syncedByUserId: { in: userIds } },
 	});
-	await db.emailThread.deleteMany({ where: { rootMessageId: { in: roots } } });
-	await db.mailboxSync.deleteMany({ where: { userId: { in: userIds } } });
+	await scopedDb.emailThread.deleteMany({
+		where: { rootMessageId: { in: roots } },
+	});
+	await scopedDb.mailboxSync.deleteMany({ where: { userId: { in: userIds } } });
 	await db.account.deleteMany({ where: { userId: { in: userIds } } });
 	await db.user.deleteMany({ where: { id: { in: userIds } } });
-	await db.company.deleteMany({ where: { domain } });
+	await scopedDb.company.deleteMany({ where: { domain } });
 }
 
 async function messagesOn(rootMessageId: string): Promise<string[]> {
-	const rows = await db.emailMessage.findMany({
+	const rows = await scopedDb.emailMessage.findMany({
 		where: { thread: { rootMessageId } },
 		orderBy: { sentAt: "asc" },
 		select: { snippet: true },
@@ -188,7 +209,7 @@ async function messagesOn(rootMessageId: string): Promise<string[]> {
 }
 
 async function threadState(rootMessageId: string) {
-	return db.emailThread.findUnique({
+	return scopedDb.emailThread.findUnique({
 		where: { rootMessageId },
 		select: {
 			subject: true,
@@ -200,21 +221,23 @@ async function threadState(rootMessageId: string) {
 	});
 }
 
-beforeEach(async () => {
-	await clean();
+beforeEach(() =>
+	runInTenant(organizationId, async () => {
+		await clean();
 
-	await db.user.createMany({
-		data: userIds.map((id) => ({
-			id,
-			name: id,
-			email: `${id}@${domain}`,
-		})),
-	});
+		await db.user.createMany({
+			data: userIds.map((id) => ({
+				id,
+				name: id,
+				email: `${id}@${domain}`,
+			})),
+		});
 
-	await seed();
-});
+		await seed();
+	}),
+);
 
-afterAll(clean);
+afterAll(() => runInTenant(organizationId, clean));
 
 describe("purging Gmail data", () => {
 	it("removes only the caller's Gmail messages and counts them", async () => {
@@ -238,9 +261,9 @@ describe("purging Gmail data", () => {
 		await google.purgeSyncedData(gmailRep);
 
 		expect(await threadState(solo)).toBeNull();
-		expect(await db.activity.count({ where: { subject: "Only mine" } })).toBe(
-			0,
-		);
+		expect(
+			await scopedDb.activity.count({ where: { subject: "Only mine" } }),
+		).toBe(0);
 	});
 
 	it("cannot reach a thread the caller never synced into", async () => {
@@ -259,7 +282,9 @@ describe("purging Gmail data", () => {
 
 describe("purging Outlook data", () => {
 	it("removes only the caller's Outlook messages and counts them", async () => {
-		expect(await microsoft.purgeSyncedData(outlookRep)).toEqual({ purged: 2 });
+		expect(await microsoft.purgeSyncedData(outlookRep)).toEqual({
+			purged: 2,
+		});
 	});
 
 	it("leaves the Gmail messages on a shared thread alone", async () => {
@@ -280,7 +305,9 @@ describe("purging Outlook data", () => {
 
 		expect(await messagesOn(solo)).toEqual(["alone"]);
 		expect(
-			await db.calendarEvent.count({ where: { iCalUid: `ical-${suffix}` } }),
+			await scopedDb.calendarEvent.count({
+				where: { iCalUid: `ical-${suffix}` },
+			}),
 		).toBe(1);
 	});
 });
@@ -290,6 +317,7 @@ describe("disconnecting Microsoft", () => {
 		await db.account.create({
 			data: {
 				id: `ms-${suffix}`,
+				issuer: `https://login.microsoftonline.com/${suffix}/v2.0`,
 				accountId: `ms-account-${suffix}`,
 				providerId: MICROSOFT_PROVIDER_ID,
 				userId: outlookRep,
@@ -349,6 +377,7 @@ describe("disconnecting Google", () => {
 		await db.account.create({
 			data: {
 				id: `goog-${suffix}`,
+				issuer: "https://accounts.google.com",
 				accountId: `goog-account-${suffix}`,
 				providerId: GOOGLE_PROVIDER_ID,
 				userId: gmailRep,
diff --git a/apps/api/test/mailbox-sync-tick.spec.ts b/apps/api/test/mailbox-sync-tick.spec.ts
index e721ed07f..71d34880f 100644
--- a/apps/api/test/mailbox-sync-tick.spec.ts
+++ b/apps/api/test/mailbox-sync-tick.spec.ts
@@ -3,6 +3,7 @@ import {
 	GoogleSyncStatus,
 	type MailboxSyncModel as MailboxSync,
 } from "@crm/db";
+import { runInTenant, tryCurrentOrganizationId } from "@crm/db/tenant-context";
 import type { GoogleConnectionService } from "../src/google/google-connection.service";
 import type { GoogleSyncService } from "../src/google/google-sync.service";
 import {
@@ -26,6 +27,7 @@ class FakeState {
 	add(id: string, source: string, overrides: Partial<MailboxSync> = {}): void {
 		this.rows.set(id, {
 			id,
+			organizationId: `organization-${id}`,
 			userId: `user-${id}`,
 			source,
 			status: GoogleSyncStatus.IDLE,
@@ -133,6 +135,20 @@ beforeEach(() => {
 });
 
 describe("runDue claims a mailbox before it syncs", () => {
+	it("runs each row inside its organization context", async () => {
+		state.add("a", "gmail");
+		let seenOrganizationId: string | undefined;
+
+		const service = build(state, async (userId, source) => {
+			seenOrganizationId = tryCurrentOrganizationId();
+			return { source, userId, status: "synced" };
+		});
+
+		await runInTenant("another-organization", () => service.runDue());
+
+		expect(seenOrganizationId).toBe(state.rows.get("a")?.organizationId);
+	});
+
 	it("does not let two overlapping ticks run the same mailbox", async () => {
 		state.add("a", "gmail");
 
diff --git a/apps/api/test/mailbox-thread-writer.spec.ts b/apps/api/test/mailbox-thread-writer.spec.ts
index da6b34862..650032985 100644
--- a/apps/api/test/mailbox-thread-writer.spec.ts
+++ b/apps/api/test/mailbox-thread-writer.spec.ts
@@ -1,5 +1,8 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { afterAll, beforeAll, describe, expect } from "bun:test";
 import { db, type MailboxSyncModel as MailboxSync } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound, tenantTest } from "@crm/db/test-support";
 import type { AgentTriggerService } from "../src/agent/agent-trigger.service";
 import { CompanyDirectoryService } from "../src/companies/company-directory.service";
 import { ActivityStampService } from "../src/crm/activity-stamp.service";
@@ -18,6 +21,8 @@ const mailbox = `rep-${suffix}@example.test`;
 const person = `buyer@${domain}`;
 const rootId = `<root-${suffix}@mail.test>`;
 const movedRoot = `outlook-conversation:${suffix}`;
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
 
 const agent = {
 	contactCreated: async () => true,
@@ -26,11 +31,22 @@ const agent = {
 	companyRequested: async () => true,
 } as unknown as AgentTriggerService;
 
-const stamp = new ActivityStampService(db);
+const stamp = new ActivityStampService(scopedDb as never);
 const directory = new CompanyDirectoryService(agent);
-const log = new EnrichmentLogService(db, stamp);
-const match = new MailboxMatchService(db, directory, agent, log);
-const threads = new ThreadWriterService(db, match, stamp);
+const log = new EnrichmentLogService(
+	scopedDb as never,
+	scopedDb as never,
+	stamp,
+);
+const match = new MailboxMatchService(
+	scopedDb as never,
+	scopedDb as never,
+	directory,
+	agent,
+	log,
+);
+const rawThreads = new ThreadWriterService(scopedDb as never, match, stamp);
+const threads = tenantBound(organizationId, rawThreads);
 
 let row: MailboxSync;
 
@@ -50,40 +66,43 @@ function message(id: string, sentAt: Date, root = rootId): IncomingMessage {
 }
 
 async function clean() {
-	await db.emailThread.deleteMany({
+	await scopedDb.emailThread.deleteMany({
 		where: { rootMessageId: { in: [rootId, movedRoot] } },
 	});
-	await db.contact.deleteMany({ where: { email: person } });
-	await db.company.deleteMany({ where: { domain } });
-	await db.mailboxSync.deleteMany({ where: { userId } });
+	await scopedDb.contact.deleteMany({ where: { email: person } });
+	await scopedDb.company.deleteMany({ where: { domain } });
+	await scopedDb.mailboxSync.deleteMany({ where: { userId } });
 	await db.user.deleteMany({ where: { id: userId } });
 }
 
-beforeAll(async () => {
-	await clean();
+beforeAll(() =>
+	runInTenant(organizationId, async () => {
+		await clean();
 
-	await db.user.create({
-		data: { id: userId, name: "Test Rep", email: mailbox },
-	});
-	row = await db.mailboxSync.create({
-		data: { userId, source: "gmail", autoCreate: false },
-	});
+		await db.user.create({
+			data: { id: userId, name: "Test Rep", email: mailbox },
+		});
+		row = await scopedDb.mailboxSync.create({
+			data: { organizationId, userId, source: "gmail", autoCreate: false },
+		});
 
-	const company = await db.company.create({
-		data: { name: "Buyer Co", domain },
-		select: { id: true },
-	});
-	await db.contact.create({
-		data: {
-			firstName: "A",
-			lastName: "Buyer",
-			email: person,
-			companyId: company.id,
-		},
-	});
-});
+		const company = await scopedDb.company.create({
+			data: { organizationId, name: "Buyer Co", domain },
+			select: { id: true },
+		});
+		await scopedDb.contact.create({
+			data: {
+				organizationId,
+				firstName: "A",
+				lastName: "Buyer",
+				email: person,
+				companyId: company.id,
+			},
+		});
+	}),
+);
 
-afterAll(clean);
+afterAll(() => runInTenant(organizationId, clean));
 
 describe("storing a synced email", () => {
 	it("writes the message, the counts and the activity together", async () => {
@@ -96,7 +115,7 @@ describe("storing a synced email", () => {
 
 		expect(stored).toBe(true);
 
-		const thread = await db.emailThread.findUnique({
+		const thread = await scopedDb.emailThread.findUnique({
 			where: { rootMessageId: rootId },
 			select: {
 				id: true,
@@ -110,14 +129,14 @@ describe("storing a synced email", () => {
 	});
 
 	it("repairs a thread whose projection was lost rather than skipping it forever", async () => {
-		const thread = await db.emailThread.findUnique({
+		const thread = await scopedDb.emailThread.findUnique({
 			where: { rootMessageId: rootId },
 			select: { id: true },
 		});
 		if (!thread) throw new Error("the first message was not stored");
 
-		await db.activity.deleteMany({ where: { emailThreadId: thread.id } });
-		await db.emailThread.update({
+		await scopedDb.activity.deleteMany({ where: { emailThreadId: thread.id } });
+		await scopedDb.emailThread.update({
 			where: { id: thread.id },
 			data: { messageCount: 0 },
 		});
@@ -131,7 +150,7 @@ describe("storing a synced email", () => {
 
 		expect(stored).toBe(false);
 
-		const repaired = await db.emailThread.findUnique({
+		const repaired = await scopedDb.emailThread.findUnique({
 			where: { id: thread.id },
 			select: { messageCount: true, activity: { select: { id: true } } },
 		});
@@ -154,12 +173,12 @@ describe("storing a synced email", () => {
 
 		expect(results.filter(Boolean)).toHaveLength(1);
 		expect(
-			await db.emailMessage.count({
+			await scopedDb.emailMessage.count({
 				where: { rfcMessageId: parsed.rfcMessageId },
 			}),
 		).toBe(1);
 
-		const thread = await db.emailThread.findUnique({
+		const thread = await scopedDb.emailThread.findUnique({
 			where: { rootMessageId: rootId },
 			select: { messageCount: true, activity: { select: { id: true } } },
 		});
@@ -169,14 +188,14 @@ describe("storing a synced email", () => {
 	});
 
 	it("repairs the thread the message is already on when the root id has moved", async () => {
-		const thread = await db.emailThread.findUnique({
+		const thread = await scopedDb.emailThread.findUnique({
 			where: { rootMessageId: rootId },
 			select: { id: true },
 		});
 		if (!thread) throw new Error("the first message was not stored");
 
-		await db.activity.deleteMany({ where: { emailThreadId: thread.id } });
-		await db.emailThread.update({
+		await scopedDb.activity.deleteMany({ where: { emailThreadId: thread.id } });
+		await scopedDb.emailThread.update({
 			where: { id: thread.id },
 			data: { messageCount: 0 },
 		});
@@ -194,10 +213,10 @@ describe("storing a synced email", () => {
 
 		expect(stored).toBe(false);
 		expect(
-			await db.emailThread.count({ where: { rootMessageId: movedRoot } }),
+			await scopedDb.emailThread.count({ where: { rootMessageId: movedRoot } }),
 		).toBe(0);
 
-		const repaired = await db.emailThread.findUnique({
+		const repaired = await scopedDb.emailThread.findUnique({
 			where: { id: thread.id },
 			select: { messageCount: true, activity: { select: { id: true } } },
 		});
diff --git a/apps/api/test/multi-tenant-agent-queue-isolation.spec.ts b/apps/api/test/multi-tenant-agent-queue-isolation.spec.ts
new file mode 100644
index 000000000..56af4aba0
--- /dev/null
+++ b/apps/api/test/multi-tenant-agent-queue-isolation.spec.ts
@@ -0,0 +1,73 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import type { TestingModule } from "@nestjs/testing";
+import { Test } from "@nestjs/testing";
+import { AgentQueueService } from "../src/agent/agent-queue.service";
+
+const suffix = process.env.TEST_RUN_ID ?? crypto.randomUUID();
+const organizationA = `mt-queue-a-${suffix}`;
+const organizationB = `mt-queue-b-${suffix}`;
+const companyId = `mt-queue-company-${suffix}`;
+
+let moduleFixture: TestingModule | undefined;
+let queue: AgentQueueService;
+
+beforeAll(async () => {
+	const { AppModule } = await import("../src/app.module");
+
+	moduleFixture = await Test.createTestingModule({
+		imports: [AppModule],
+	}).compile();
+	queue = moduleFixture.get(AgentQueueService);
+
+	await db.organization.createMany({
+		data: [
+			{
+				id: organizationA,
+				name: "Queue Organization A",
+				slug: organizationA,
+				createdAt: new Date(),
+			},
+			{
+				id: organizationB,
+				name: "Queue Organization B",
+				slug: organizationB,
+				createdAt: new Date(),
+			},
+		],
+	});
+	await runInTenant(organizationA, () =>
+		scopedDb.agentTask.create({
+			data: {
+				organizationId: organizationA,
+				kind: "tenant-isolation",
+				reason: "focused integration test",
+				companyId,
+				dueAt: new Date(Date.now() - 1_000),
+			},
+		}),
+	);
+});
+
+afterAll(async () => {
+	await moduleFixture?.close();
+	await db.organization.deleteMany({
+		where: { id: { in: [organizationA, organizationB] } },
+	});
+});
+
+describe("cross-tenant AgentTask isolation through Nest services", () => {
+	it("hides another organization's queued company", async () => {
+		const queuedInA = await runInTenant(organizationA, () =>
+			queue.isQueued({ companyId }),
+		);
+		const queuedInB = await runInTenant(organizationB, () =>
+			queue.isQueued({ companyId }),
+		);
+
+		expect(queuedInA).toBe(true);
+		expect(queuedInB).toBe(false);
+	});
+});
diff --git a/apps/api/test/multi-tenant-crm-isolation.e2e.spec.ts b/apps/api/test/multi-tenant-crm-isolation.e2e.spec.ts
new file mode 100644
index 000000000..63b193f60
--- /dev/null
+++ b/apps/api/test/multi-tenant-crm-isolation.e2e.spec.ts
@@ -0,0 +1,180 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import type { TestingModule } from "@nestjs/testing";
+import { Test } from "@nestjs/testing";
+import {
+	companyCreateInput,
+	companyListInput,
+} from "../src/companies/companies.contracts";
+import { CompaniesService } from "../src/companies/companies.service";
+import {
+	contactCreateInput,
+	contactListInput,
+} from "../src/contacts/contacts.contracts";
+import { ContactsService } from "../src/contacts/contacts.service";
+import { dealCreateInput, dealListInput } from "../src/deals/deals.contracts";
+import { DealsService } from "../src/deals/deals.service";
+
+const suffix = process.env.TEST_RUN_ID ?? crypto.randomUUID();
+const organizationA = `mt-crm-a-${suffix}`;
+const organizationB = `mt-crm-b-${suffix}`;
+const ownerA = `mt-crm-owner-a-${suffix}`;
+const ownerB = `mt-crm-owner-b-${suffix}`;
+const sharedEmail = `shared-${suffix}@example.com`;
+
+let moduleFixture: TestingModule | undefined;
+let companies: CompaniesService;
+let contacts: ContactsService;
+let deals: DealsService;
+
+beforeAll(async () => {
+	const { AppModule } = await import("../src/app.module");
+
+	moduleFixture = await Test.createTestingModule({
+		imports: [AppModule],
+	}).compile();
+	companies = moduleFixture.get(CompaniesService);
+	contacts = moduleFixture.get(ContactsService);
+	deals = moduleFixture.get(DealsService);
+
+	await db.organization.createMany({
+		data: [
+			{
+				id: organizationA,
+				name: "Isolation Organization A",
+				slug: organizationA,
+				createdAt: new Date(),
+			},
+			{
+				id: organizationB,
+				name: "Isolation Organization B",
+				slug: organizationB,
+				createdAt: new Date(),
+			},
+		],
+	});
+	await db.user.createMany({
+		data: [
+			{
+				id: ownerA,
+				name: "Isolation Owner A",
+				email: `${ownerA}@example.com`,
+				emailVerified: true,
+			},
+			{
+				id: ownerB,
+				name: "Isolation Owner B",
+				email: `${ownerB}@example.com`,
+				emailVerified: true,
+			},
+		],
+	});
+	await Promise.all([
+		runInTenant(organizationA, () =>
+			scopedDb.appSetting.create({
+				data: { organizationId: organizationA, reportingCurrency: "USD" },
+			}),
+		),
+		runInTenant(organizationB, () =>
+			scopedDb.appSetting.create({
+				data: { organizationId: organizationB, reportingCurrency: "USD" },
+			}),
+		),
+	]);
+});
+
+afterAll(async () => {
+	await moduleFixture?.close();
+	await db.organization.deleteMany({
+		where: { id: { in: [organizationA, organizationB] } },
+	});
+	await db.user.deleteMany({ where: { id: { in: [ownerA, ownerB] } } });
+});
+
+describe("cross-tenant CRM isolation through Nest services", () => {
+	it("isolates company writes, lists, and reads", async () => {
+		const companyA = await runInTenant(organizationA, () =>
+			companies.create(
+				companyCreateInput.parse({ name: "Company A", ownerId: ownerA }),
+			),
+		);
+		await runInTenant(organizationB, () =>
+			companies.create(
+				companyCreateInput.parse({ name: "Company B", ownerId: ownerB }),
+			),
+		);
+
+		const listA = await runInTenant(organizationA, () =>
+			companies.list(companyListInput.parse({ pageSize: 100 })),
+		);
+
+		expect(listA.rows.map((row) => row.name)).toEqual(["Company A"]);
+		await expect(
+			runInTenant(organizationB, () => companies.byId(companyA.id)),
+		).rejects.toThrow(`No company with id ${companyA.id}.`);
+	});
+
+	it("permits the same contact email without cross-tenant reads", async () => {
+		await runInTenant(organizationA, () =>
+			contacts.create(
+				contactCreateInput.parse({
+					firstName: "Contact A",
+					email: sharedEmail,
+				}),
+			),
+		);
+		await runInTenant(organizationB, () =>
+			contacts.create(
+				contactCreateInput.parse({
+					firstName: "Contact B",
+					email: sharedEmail,
+				}),
+			),
+		);
+
+		const listA = await runInTenant(organizationA, () =>
+			contacts.list(contactListInput.parse({ pageSize: 100 })),
+		);
+
+		expect(listA.rows.map((row) => row.firstName)).toEqual(["Contact A"]);
+	});
+
+	it("isolates deal writes and lists", async () => {
+		const companyA = await runInTenant(organizationA, () =>
+			companies.create(companyCreateInput.parse({ name: "Deal Company A" })),
+		);
+		const companyB = await runInTenant(organizationB, () =>
+			companies.create(companyCreateInput.parse({ name: "Deal Company B" })),
+		);
+		await runInTenant(organizationA, () =>
+			deals.create(
+				dealCreateInput.parse({
+					name: "Deal A",
+					companyId: companyA.id,
+					ownerId: ownerA,
+					amountCents: 10_000,
+					currency: "USD",
+				}),
+			),
+		);
+		await runInTenant(organizationB, () =>
+			deals.create(
+				dealCreateInput.parse({
+					name: "Deal B",
+					companyId: companyB.id,
+					ownerId: ownerB,
+					amountCents: 20_000,
+					currency: "USD",
+				}),
+			),
+		);
+
+		const listA = await runInTenant(organizationA, () =>
+			deals.list(dealListInput.parse({ pageSize: 100 })),
+		);
+
+		expect(listA.rows.map((row) => row.name)).toEqual(["Deal A"]);
+	});
+});
diff --git a/apps/api/test/multi-tenant-mailbox-attribution.e2e.spec.ts b/apps/api/test/multi-tenant-mailbox-attribution.e2e.spec.ts
new file mode 100644
index 000000000..ee6fd83df
--- /dev/null
+++ b/apps/api/test/multi-tenant-mailbox-attribution.e2e.spec.ts
@@ -0,0 +1,223 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db, type MailboxSyncModel } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import type { TestingModule } from "@nestjs/testing";
+import { Test } from "@nestjs/testing";
+import {
+	type IncomingMessage,
+	ThreadWriterService,
+} from "../src/mailbox/thread-writer.service";
+
+const fallback = (key: string, value: string) => {
+	if (!process.env[key]) process.env[key] = value;
+};
+
+fallback(
+	"DATABASE_URL",
+	"postgresql://postgres:postgres@localhost:5432/crm?schema=public",
+);
+fallback("BETTER_AUTH_SECRET", "test-secret-at-least-32-characters-long");
+fallback("API_URL", "http://localhost:3001");
+fallback("ALLOWED_SIGN_IN", "example.com");
+fallback("GOOGLE_CLIENT_ID", "test-google-client-id");
+fallback("GOOGLE_CLIENT_SECRET", "test-google-client-secret");
+
+const suffix = process.env.TEST_RUN_ID ?? crypto.randomUUID();
+const organizationA = `mt-mailbox-a-${suffix}`;
+const organizationB = `mt-mailbox-b-${suffix}`;
+const userA = `mt-mailbox-user-a-${suffix}`;
+const userB = `mt-mailbox-user-b-${suffix}`;
+const mailboxA = `${userA}@internal.test`;
+const mailboxB = `${userB}@internal.test`;
+const externalEmail = `buyer@mt-mailbox-${suffix}.test`;
+const externalDomain = `mt-mailbox-${suffix}.test`;
+
+let moduleFixture: TestingModule | undefined;
+let threads: ThreadWriterService;
+let mailboxSyncA: MailboxSyncModel;
+let mailboxSyncB: MailboxSyncModel;
+let companyA: { id: string };
+let companyB: { id: string };
+let contactA: { id: string };
+let contactB: { id: string };
+
+function message(organization: "a" | "b", mailbox: string): IncomingMessage {
+	return {
+		rfcMessageId: `<mt-mailbox-${organization}-${suffix}@mail.test>`,
+		rootId: `<mt-mailbox-root-${organization}-${suffix}@mail.test>`,
+		subject: "Pricing",
+		from: { email: mailbox, name: "Test Rep" },
+		recipients: [{ email: externalEmail, name: "A Buyer", kind: "to" }],
+		body: "The numbers you asked for.",
+		sentAt: new Date("2026-09-05T10:00:00Z"),
+		gmailMessageId: null,
+		outlookMessageId: null,
+		outlookWebLink: null,
+	};
+}
+
+beforeAll(async () => {
+	const { AppModule } = await import("../src/app.module");
+
+	moduleFixture = await Test.createTestingModule({
+		imports: [AppModule],
+	}).compile();
+	threads = moduleFixture.get(ThreadWriterService);
+
+	await db.organization.createMany({
+		data: [
+			{
+				id: organizationA,
+				name: "Mailbox Organization A",
+				slug: organizationA,
+				createdAt: new Date(),
+			},
+			{
+				id: organizationB,
+				name: "Mailbox Organization B",
+				slug: organizationB,
+				createdAt: new Date(),
+			},
+		],
+	});
+	await db.user.createMany({
+		data: [
+			{ id: userA, name: "Mailbox User A", email: mailboxA },
+			{ id: userB, name: "Mailbox User B", email: mailboxB },
+		],
+	});
+
+	[mailboxSyncA, mailboxSyncB] = await Promise.all([
+		runInTenant(organizationA, () =>
+			scopedDb.mailboxSync.create({
+				data: {
+					organizationId: organizationA,
+					userId: userA,
+					source: "gmail",
+				},
+			}),
+		),
+		runInTenant(organizationB, () =>
+			scopedDb.mailboxSync.create({
+				data: {
+					organizationId: organizationB,
+					userId: userB,
+					source: "gmail",
+				},
+			}),
+		),
+	]);
+
+	[companyA, companyB] = await Promise.all([
+		runInTenant(organizationA, () =>
+			scopedDb.company.create({
+				data: {
+					organizationId: organizationA,
+					name: "Buyer Company A",
+					domain: externalDomain,
+				},
+				select: { id: true },
+			}),
+		),
+		runInTenant(organizationB, () =>
+			scopedDb.company.create({
+				data: {
+					organizationId: organizationB,
+					name: "Buyer Company B",
+					domain: externalDomain,
+				},
+				select: { id: true },
+			}),
+		),
+	]);
+
+	[contactA, contactB] = await Promise.all([
+		runInTenant(organizationA, () =>
+			scopedDb.contact.create({
+				data: {
+					organizationId: organizationA,
+					firstName: "Buyer A",
+					email: externalEmail,
+					companyId: companyA.id,
+				},
+				select: { id: true },
+			}),
+		),
+		runInTenant(organizationB, () =>
+			scopedDb.contact.create({
+				data: {
+					organizationId: organizationB,
+					firstName: "Buyer B",
+					email: externalEmail,
+					companyId: companyB.id,
+				},
+				select: { id: true },
+			}),
+		),
+	]);
+});
+
+afterAll(async () => {
+	await moduleFixture?.close();
+	await db.organization.deleteMany({
+		where: { id: { in: [organizationA, organizationB] } },
+	});
+	await db.user.deleteMany({ where: { id: { in: [userA, userB] } } });
+});
+
+describe("cross-tenant mailbox attribution through Nest services", () => {
+	it("attributes identical external participants inside each organization", async () => {
+		const messageA = message("a", mailboxA);
+		const messageB = message("b", mailboxB);
+
+		const storedA = await runInTenant(organizationA, async () =>
+			threads.store(
+				mailboxSyncA,
+				{ mailbox: mailboxA, origin: "gmail" },
+				messageA,
+				await threads.context(),
+			),
+		);
+		const storedB = await runInTenant(organizationB, async () =>
+			threads.store(
+				mailboxSyncB,
+				{ mailbox: mailboxB, origin: "gmail" },
+				messageB,
+				await threads.context(),
+			),
+		);
+
+		expect([storedA, storedB]).toEqual([true, true]);
+
+		const [threadA, threadB] = await Promise.all([
+			runInTenant(organizationA, () =>
+				scopedDb.emailThread.findUnique({
+					where: { rootMessageId: messageA.rootId },
+					include: { activity: true, messages: true },
+				}),
+			),
+			runInTenant(organizationB, () =>
+				scopedDb.emailThread.findUnique({
+					where: { rootMessageId: messageB.rootId },
+					include: { activity: true, messages: true },
+				}),
+			),
+		]);
+
+		expect(threadA).toMatchObject({
+			organizationId: organizationA,
+			companyId: companyA.id,
+			contactId: contactA.id,
+			activity: { organizationId: organizationA, createdById: userA },
+			messages: [{ organizationId: organizationA, syncedByUserId: userA }],
+		});
+		expect(threadB).toMatchObject({
+			organizationId: organizationB,
+			companyId: companyB.id,
+			contactId: contactB.id,
+			activity: { organizationId: organizationB, createdById: userB },
+			messages: [{ organizationId: organizationB, syncedByUserId: userB }],
+		});
+	});
+});
diff --git a/apps/api/test/multi-tenant-slack-connection.e2e.spec.ts b/apps/api/test/multi-tenant-slack-connection.e2e.spec.ts
new file mode 100644
index 000000000..cfa540a64
--- /dev/null
+++ b/apps/api/test/multi-tenant-slack-connection.e2e.spec.ts
@@ -0,0 +1,180 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { createTenantRows } from "@crm/db/test-support";
+import type { TestingModule } from "@nestjs/testing";
+import { Test } from "@nestjs/testing";
+import { SlackConnectionService } from "../src/slack/slack-connection.service";
+
+const fallback = (key: string, value: string) => {
+	if (!process.env[key]) process.env[key] = value;
+};
+
+fallback(
+	"DATABASE_URL",
+	"postgresql://postgres:postgres@localhost:5432/crm?schema=public",
+);
+fallback("BETTER_AUTH_SECRET", "test-secret-at-least-32-characters-long");
+fallback("API_URL", "http://localhost:3001");
+fallback("ALLOWED_SIGN_IN", "example.com");
+fallback("GOOGLE_CLIENT_ID", "test-google-client-id");
+fallback("GOOGLE_CLIENT_SECRET", "test-google-client-secret");
+
+const suffix = process.env.TEST_RUN_ID ?? crypto.randomUUID();
+const organizationA = `mt-slack-a-${suffix}`;
+const organizationB = `mt-slack-b-${suffix}`;
+const userA = `mt-slack-user-a-${suffix}`;
+const userB = `mt-slack-user-b-${suffix}`;
+const teamA = `mt-slack-team-a-${suffix}`;
+const teamB = `mt-slack-team-b-${suffix}`;
+
+let moduleFixture: TestingModule | undefined;
+let slack: SlackConnectionService;
+
+function grant(organizationId: string, teamId: string) {
+	return runInTenant(organizationId, () =>
+		scopedDb.slackWorkspaceGrant.findUnique({
+			where: { organizationId_teamId: { organizationId, teamId } },
+		}),
+	);
+}
+
+beforeAll(async () => {
+	const { AppModule } = await import("../src/app.module");
+
+	moduleFixture = await Test.createTestingModule({
+		imports: [AppModule],
+	}).compile();
+	slack = moduleFixture.get(SlackConnectionService);
+
+	await db.organization.createMany({
+		data: [
+			{
+				id: organizationA,
+				name: "Slack Organization A",
+				slug: organizationA,
+				createdAt: new Date(),
+			},
+			{
+				id: organizationB,
+				name: "Slack Organization B",
+				slug: organizationB,
+				createdAt: new Date(),
+			},
+		],
+	});
+	await db.user.createMany({
+		data: [
+			{
+				id: userA,
+				name: "Slack Owner A",
+				email: `${userA}@example.com`,
+			},
+			{
+				id: userB,
+				name: "Slack Owner B",
+				email: `${userB}@example.com`,
+			},
+		],
+	});
+	await db.member.createMany({
+		data: [
+			{
+				id: `mt-slack-member-a-${suffix}`,
+				organizationId: organizationA,
+				userId: userA,
+				role: "owner",
+				createdAt: new Date(),
+			},
+			{
+				id: `mt-slack-member-b-${suffix}`,
+				organizationId: organizationB,
+				userId: userB,
+				role: "owner",
+				createdAt: new Date(),
+			},
+		],
+	});
+	await createTenantRows(
+		[
+			{
+				organizationId: organizationA,
+				teamId: teamA,
+				teamName: "Slack Team A",
+				botToken: "xoxb-tenant-a",
+				botScopes: "chat:write,channels:read",
+				userToken: "xoxp-tenant-a",
+				userScopes: "channels:read",
+			},
+			{
+				organizationId: organizationB,
+				teamId: teamB,
+				teamName: "Slack Team B",
+				botToken: "xoxb-tenant-b",
+				botScopes: "chat:write",
+				userToken: "xoxp-tenant-b",
+				userScopes: "channels:read",
+			},
+		],
+		(data) => scopedDb.slackWorkspaceGrant.create({ data: data as never }),
+	);
+	await createTenantRows(
+		[
+			{
+				organizationId: organizationA,
+				crmUserId: userA,
+				slackUserId: "UA",
+			},
+			{
+				organizationId: organizationB,
+				crmUserId: userB,
+				slackUserId: "UB",
+			},
+		],
+		(data) => scopedDb.slackMemberMatch.create({ data: data as never }),
+	);
+});
+
+afterAll(async () => {
+	await moduleFixture?.close();
+	await db.organization.deleteMany({
+		where: { id: { in: [organizationA, organizationB] } },
+	});
+	await db.user.deleteMany({ where: { id: { in: [userA, userB] } } });
+});
+
+describe("cross-tenant Slack connections through Nest services", () => {
+	it("returns each organization's own connection and scopes", async () => {
+		const [statusA, statusB] = await Promise.all([
+			runInTenant(organizationA, () => slack.status(userA)),
+			runInTenant(organizationB, () => slack.status(userB)),
+		]);
+
+		expect(statusA).toMatchObject({
+			connected: true,
+			workspace: "Slack Team A",
+			scopes: ["chat:write", "channels:read"],
+		});
+		expect(statusB).toMatchObject({
+			connected: true,
+			workspace: "Slack Team B",
+			scopes: ["chat:write"],
+		});
+	});
+
+	it("disconnects only the active organization's connection", async () => {
+		await expect(
+			runInTenant(organizationA, () => slack.disconnect(userA)),
+		).resolves.toEqual({ disconnected: true });
+
+		expect(await grant(organizationA, teamA)).toBeNull();
+		expect(await grant(organizationB, teamB)).not.toBeNull();
+
+		const statusB = await runInTenant(organizationB, () => slack.status(userB));
+		expect(statusB).toMatchObject({
+			connected: true,
+			workspace: "Slack Team B",
+		});
+	});
+});
diff --git a/apps/api/test/oauth-openapi.e2e.spec.ts b/apps/api/test/oauth-openapi.e2e.spec.ts
new file mode 100644
index 000000000..f27d2abc2
--- /dev/null
+++ b/apps/api/test/oauth-openapi.e2e.spec.ts
@@ -0,0 +1,42 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import type { INestApplication } from "@nestjs/common";
+import request from "supertest";
+
+const fallback = (key: string, value: string) => {
+	if (!process.env[key]) process.env[key] = value;
+};
+
+fallback("BETTER_AUTH_SECRET", "test-secret-at-least-32-characters-long");
+fallback("API_URL", "http://localhost:3001");
+fallback("ALLOWED_SIGN_IN", "example.com");
+fallback("GOOGLE_CLIENT_ID", "test-google-client-id");
+fallback("GOOGLE_CLIENT_SECRET", "test-google-client-secret");
+
+describe("OAuth OpenAPI", () => {
+	let app: INestApplication;
+
+	beforeAll(async () => {
+		const { createApp } = await import("../src/create-app");
+		app = await createApp();
+	});
+
+	afterAll(async () => {
+		await app.close();
+	});
+
+	it("publishes cookie, API-key, and OAuth security schemes", async () => {
+		const response = await request(app.getHttpServer())
+			.get("/openapi.json")
+			.expect(200);
+
+		expect(response.body.components.securitySchemes).toMatchObject({
+			apiKey: { type: "apiKey", name: "x-api-key", in: "header" },
+			oauth: { type: "http", scheme: "bearer", bearerFormat: "JWT" },
+		});
+		expect(response.body.paths["/companies/{id}"].get.security).toEqual([
+			{ cookie: [] },
+			{ apiKey: [] },
+			{ oauth: [] },
+		]);
+	});
+});
diff --git a/apps/api/test/push-tokens.spec.ts b/apps/api/test/push-tokens.spec.ts
new file mode 100644
index 000000000..2bf230326
--- /dev/null
+++ b/apps/api/test/push-tokens.spec.ts
@@ -0,0 +1,83 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { BadRequestException } from "@nestjs/common";
+import { PushTokensService } from "../src/push-tokens/push-tokens.service";
+
+const suffix = process.env.TEST_RUN_ID ?? "push-tokens-spec";
+const userId = `user-push-${suffix}`;
+const otherUserId = `user-push-other-${suffix}`;
+const token = `fcm-${suffix}`;
+
+let service: PushTokensService;
+
+beforeAll(async () => {
+	await db.pushToken.deleteMany({
+		where: { OR: [{ userId }, { userId: otherUserId }, { token }] },
+	});
+	await db.user.deleteMany({ where: { id: { in: [userId, otherUserId] } } });
+	await db.user.create({
+		data: { id: userId, name: "Push User", email: `${userId}@example.test` },
+	});
+	await db.user.create({
+		data: {
+			id: otherUserId,
+			name: "Other Push User",
+			email: `${otherUserId}@example.test`,
+		},
+	});
+	service = new PushTokensService(db);
+});
+
+afterAll(async () => {
+	await db.pushToken.deleteMany({
+		where: { OR: [{ userId }, { userId: otherUserId }, { token }] },
+	});
+	await db.user.deleteMany({ where: { id: { in: [userId, otherUserId] } } });
+});
+
+describe("PushTokensService", () => {
+	it("upserts a token for the current user", async () => {
+		await expect(
+			service.register(userId, { token, platform: "ios" }),
+		).resolves.toEqual({ ok: true });
+
+		const row = await db.pushToken.findUnique({ where: { token } });
+		expect(row?.userId).toBe(userId);
+		expect(row?.platform).toBe("ios");
+	});
+
+	it("moves the token to the latest user", async () => {
+		await service.register(otherUserId, { token, platform: "android" });
+
+		const row = await db.pushToken.findUnique({ where: { token } });
+		expect(row?.userId).toBe(otherUserId);
+		expect(row?.platform).toBe("android");
+	});
+
+	it("deletes a token that belongs to the caller", async () => {
+		await expect(service.unregister(otherUserId, token)).resolves.toEqual({
+			ok: true,
+		});
+		expect(await db.pushToken.findUnique({ where: { token } })).toBeNull();
+	});
+
+	it("treats an unknown token as already gone", async () => {
+		await expect(service.unregister(userId, "missing-token")).resolves.toEqual({
+			ok: true,
+		});
+	});
+
+	it("does not delete another user's token", async () => {
+		await service.register(userId, { token, platform: "ios" });
+		await expect(service.unregister(otherUserId, token)).resolves.toEqual({
+			ok: true,
+		});
+		expect(await db.pushToken.findUnique({ where: { token } })).not.toBeNull();
+	});
+
+	it("rejects a missing token on register", async () => {
+		await expect(
+			service.register(userId, { platform: "ios" }),
+		).rejects.toBeInstanceOf(BadRequestException);
+	});
+});
diff --git a/apps/api/test/record-delete.spec.ts b/apps/api/test/record-delete.spec.ts
index cac084ab1..e86a4b939 100644
--- a/apps/api/test/record-delete.spec.ts
+++ b/apps/api/test/record-delete.spec.ts
@@ -1,5 +1,8 @@
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { afterAll, beforeAll, describe, expect } from "bun:test";
 import { db, RecordSource } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound, tenantTest } from "@crm/db/test-support";
 import { AgentQueueService } from "../src/agent/agent-queue.service";
 import { AgentTriggerService } from "../src/agent/agent-trigger.service";
 import { CompaniesService } from "../src/companies/companies.service";
@@ -21,8 +24,13 @@ const orphanDomain = `orphaned-${suffix}.test`;
 const email = `gone@${domain}`;
 const colleague = `stays@${domain}`;
 const userId = `user-${suffix}`;
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
 
-const stamp = new ActivityStampService(db);
+const stamp = tenantBound(
+	organizationId,
+	new ActivityStampService(scopedDb as never),
+);
 
 const agent = {
 	contactCreated: async () => true,
@@ -31,30 +39,61 @@ const agent = {
 	companyRequested: async () => true,
 } as unknown as AgentTriggerService;
 
-const directory = new CompanyDirectoryService(agent);
-const log = new EnrichmentLogService(db, stamp);
-const queue = new AgentQueueService(db);
-const conversion = new ConversionService(db);
-
-const fields = new FieldsService(db, agent);
-const contacts = new ContactsService(
-	db,
-	directory,
-	agent,
-	queue,
-	stamp,
-	fields,
+const directory = tenantBound(
+	organizationId,
+	new CompanyDirectoryService(agent),
 );
-const companies = new CompaniesService(
-	db,
-	agent,
-	queue,
-	{ backfill: async () => undefined } as unknown as FaviconService,
+const log = new EnrichmentLogService(
+	scopedDb as never,
+	scopedDb as never,
 	stamp,
-	conversion,
-	fields,
 );
-const match = new MailboxMatchService(db, directory, agent, log);
+const queue = tenantBound(
+	organizationId,
+	new AgentQueueService(scopedDb as never),
+);
+const conversion = tenantBound(
+	organizationId,
+	new ConversionService(scopedDb as never),
+);
+
+const fields = tenantBound(
+	organizationId,
+	new FieldsService(scopedDb as never, agent),
+);
+const contacts = tenantBound(
+	organizationId,
+	new ContactsService(
+		scopedDb as never,
+		directory,
+		agent,
+		queue,
+		stamp,
+		fields,
+	),
+);
+const companies = tenantBound(
+	organizationId,
+	new CompaniesService(
+		scopedDb as never,
+		agent,
+		queue,
+		{ backfill: async () => undefined } as unknown as FaviconService,
+		stamp,
+		conversion,
+		fields,
+	),
+);
+const match = tenantBound(
+	organizationId,
+	new MailboxMatchService(
+		scopedDb as never,
+		scopedDb as never,
+		directory,
+		agent,
+		log,
+	),
+);
 
 async function matchContext() {
 	const internal = await match.internalIdentity();
@@ -71,9 +110,14 @@ const ours = {
 	OR: domains.map((host) => ({ email: { endsWith: `@${host}` } })),
 };
 
-async function parked(subject: { contactId?: string; companyId?: string }) {
-	return db.agentTask.create({
+async function parked(subject: {
+	contactId?: string;
+	companyId?: string;
+	dealId?: string;
+}) {
+	return scopedDb.agentTask.create({
 		data: {
+			organizationId,
 			...subject,
 			kind: "identify",
 			reason: `record-delete-spec (${suffix})`,
@@ -84,31 +128,38 @@ async function parked(subject: { contactId?: string; companyId?: string }) {
 }
 
 async function clean() {
-	const [existingContacts, existingCompanies] = await Promise.all([
-		db.contact.findMany({ where: ours, select: { id: true } }),
-		db.company.findMany({
-			where: { domain: { in: domains } },
-			select: { id: true },
-		}),
-	]);
-
-	const contactIds = existingContacts.map((row) => row.id);
-	const companyIds = existingCompanies.map((row) => row.id);
-
-	await db.agentTask.deleteMany({
-		where: {
-			OR: [
-				{ reason: `record-delete-spec (${suffix})` },
-				{ contactId: { in: contactIds } },
-				{ companyId: { in: companyIds } },
-			],
-		},
+	await runInTenant(organizationId, async () => {
+		const [existingContacts, existingCompanies] = await Promise.all([
+			scopedDb.contact.findMany({ where: ours, select: { id: true } }),
+			scopedDb.company.findMany({
+				where: { domain: { in: domains } },
+				select: { id: true },
+			}),
+		]);
+
+		const contactIds = existingContacts.map((row) => row.id);
+		const companyIds = existingCompanies.map((row) => row.id);
+
+		await scopedDb.agentTask.deleteMany({
+			where: {
+				OR: [
+					{ reason: `record-delete-spec (${suffix})` },
+					{ contactId: { in: contactIds } },
+					{ companyId: { in: companyIds } },
+				],
+			},
+		});
+		await scopedDb.agentEvent.deleteMany({
+			where: { contactId: { in: contactIds } },
+		});
+		await scopedDb.deal.deleteMany({
+			where: { OR: [{ companyId: { in: companyIds } }, { ownerId: userId }] },
+		});
+		await scopedDb.contact.deleteMany({ where: ours });
+		await scopedDb.company.deleteMany({ where: { domain: { in: domains } } });
+		await scopedDb.suppressedContact.deleteMany({ where: ours });
+		await db.user.deleteMany({ where: { id: userId } });
 	});
-	await db.agentEvent.deleteMany({ where: { contactId: { in: contactIds } } });
-	await db.contact.deleteMany({ where: ours });
-	await db.company.deleteMany({ where: { domain: { in: domains } } });
-	await db.suppressedContact.deleteMany({ where: ours });
-	await db.user.deleteMany({ where: { id: userId } });
 }
 
 beforeAll(async () => {
@@ -134,8 +185,9 @@ describe("purging a contact", () => {
 
 		await parked({ contactId });
 
-		await db.agentEvent.create({
+		await scopedDb.agentEvent.create({
 			data: {
+				organizationId,
 				id: `evt-${suffix}`,
 				sessionId: `ses-${suffix}`,
 				contactId,
@@ -151,15 +203,15 @@ describe("purging a contact", () => {
 		});
 
 		expect(
-			await db.contact.findUnique({ where: { id: contactId } }),
+			await scopedDb.contact.findUnique({ where: { id: contactId } }),
 		).toBeNull();
-		expect(await db.agentTask.count({ where: { contactId } })).toBe(0);
-		expect(await db.agentEvent.count({ where: { contactId } })).toBe(0);
+		expect(await scopedDb.agentTask.count({ where: { contactId } })).toBe(0);
+		expect(await scopedDb.agentEvent.count({ where: { contactId } })).toBe(0);
 	});
 
 	it("remembers the address so the sync cannot bring them back", async () => {
-		const suppressed = await db.suppressedContact.findUnique({
-			where: { email },
+		const suppressed = await scopedDb.suppressedContact.findUnique({
+			where: { organizationId_email: { organizationId, email } },
 		});
 		expect(suppressed).not.toBeNull();
 
@@ -175,7 +227,7 @@ describe("purging a contact", () => {
 
 		expect(result.external).toEqual([]);
 		expect(result.contactId).toBeNull();
-		expect(await db.contact.findFirst({ where: { email } })).toBeNull();
+		expect(await scopedDb.contact.findFirst({ where: { email } })).toBeNull();
 	});
 
 	it("still files the colleagues who were not deleted", async () => {
@@ -194,7 +246,9 @@ describe("purging a contact", () => {
 
 		expect(result.external.map((person) => person.email)).toEqual([colleague]);
 
-		const created = await db.contact.findFirst({ where: { email: colleague } });
+		const created = await scopedDb.contact.findFirst({
+			where: { email: colleague },
+		});
 		expect(created?.id).toBe(result.contactId ?? undefined);
 	});
 
@@ -202,21 +256,26 @@ describe("purging a contact", () => {
 		const readded = await contacts.create({ firstName: "Gone", email });
 
 		expect(
-			await db.suppressedContact.findUnique({ where: { email } }),
+			await scopedDb.suppressedContact.findUnique({
+				where: { organizationId_email: { organizationId, email } },
+			}),
 		).toBeNull();
 
-		await db.contact.delete({ where: { id: readded.id } });
-		await db.suppressedContact.deleteMany({ where: { email } });
+		await scopedDb.contact.delete({ where: { id: readded.id } });
+		await scopedDb.suppressedContact.deleteMany({ where: { email } });
 	});
 
 	it("suppresses an address a rep typed in caps as the sync will see it", async () => {
 		const typed = `Mixed.Case@${domain.toUpperCase()}`;
 		const asSynced = typed.toLowerCase();
 
-		const created = await contacts.create({ firstName: "Mixed", email: typed });
+		const created = await contacts.create({
+			firstName: "Mixed",
+			email: typed,
+		});
 
 		expect(
-			await db.contact.findUnique({
+			await scopedDb.contact.findUnique({
 				where: { id: created.id },
 				select: { email: true },
 			}),
@@ -225,7 +284,11 @@ describe("purging a contact", () => {
 		await contacts.purge(created.id);
 
 		expect(
-			await db.suppressedContact.findUnique({ where: { email: asSynced } }),
+			await scopedDb.suppressedContact.findUnique({
+				where: {
+					organizationId_email: { organizationId, email: asSynced },
+				},
+			}),
 		).not.toBeNull();
 
 		const result = await match.resolve(
@@ -240,13 +303,13 @@ describe("purging a contact", () => {
 
 		expect(result.external).toEqual([]);
 		expect(
-			await db.contact.findFirst({ where: { email: asSynced } }),
+			await scopedDb.contact.findFirst({ where: { email: asSynced } }),
 		).toBeNull();
 	});
 });
 
 describe("purging a company", () => {
-	it("takes its deals and leaves its people without a company", async () => {
+	it("refuses to delete a company that still has deals", async () => {
 		const company = await companies.create({
 			name: "Doomed",
 			domain: doomedDomain,
@@ -257,30 +320,57 @@ describe("purging a company", () => {
 			email: `left@${doomedDomain}`,
 			companyId: company.id,
 		});
-		const deal = await db.deal.create({
-			data: { name: "Doomed deal", companyId: company.id, ownerId: userId },
+		const deal = await scopedDb.deal.create({
+			data: {
+				organizationId,
+				name: "Doomed deal",
+				companyId: company.id,
+				ownerId: userId,
+			},
 			select: { id: true },
 		});
 
-		await parked({ companyId: company.id });
-
-		expect(await companies.purge(company.id)).toEqual({
-			id: company.id,
-			name: "Doomed",
+		const companyTask = await parked({ companyId: company.id });
+		const dealTask = await parked({
+			companyId: company.id,
+			dealId: deal.id,
 		});
 
-		expect(await db.deal.findUnique({ where: { id: deal.id } })).toBeNull();
-		expect(await db.agentTask.count({ where: { companyId: company.id } })).toBe(
-			0,
+		await expect(companies.purge(company.id)).rejects.toThrow(
+			"Delete this company's deals before deleting the company.",
 		);
 
-		const survivor = await db.contact.findUnique({
+		expect(
+			await scopedDb.deal.findUnique({
+				where: { id: deal.id },
+				select: { companyId: true },
+			}),
+		).toEqual({ companyId: company.id });
+		expect(
+			await scopedDb.agentTask.count({ where: { companyId: company.id } }),
+		).toBe(2);
+		expect(
+			await scopedDb.agentTask.findUnique({ where: { id: companyTask.id } }),
+		).not.toBe(null);
+		expect(
+			await scopedDb.agentTask.findUnique({
+				where: { id: dealTask.id },
+				select: { companyId: true, dealId: true },
+			}),
+		).toEqual({ companyId: company.id, dealId: deal.id });
+
+		const survivor = await scopedDb.contact.findUnique({
 			where: { id: contact.id },
 			select: { companyId: true },
 		});
-		expect(survivor?.companyId).toBeNull();
+		expect(survivor?.companyId).toBe(company.id);
 
-		await db.contact.delete({ where: { id: contact.id } });
+		await scopedDb.agentTask.deleteMany({
+			where: { id: { in: [companyTask.id, dealTask.id] } },
+		});
+		await scopedDb.deal.delete({ where: { id: deal.id } });
+		await scopedDb.contact.delete({ where: { id: contact.id } });
+		await scopedDb.company.delete({ where: { id: company.id } });
 	});
 });
 
@@ -295,14 +385,20 @@ describe("the activity stamps a purge leaves behind", () => {
 			email: `stamped@${stampDomain}`,
 			companyId: company.id,
 		});
-		const deal = await db.deal.create({
-			data: { name: "Stamped deal", companyId: company.id, ownerId: userId },
+		const deal = await scopedDb.deal.create({
+			data: {
+				organizationId,
+				name: "Stamped deal",
+				companyId: company.id,
+				ownerId: userId,
+			},
 			select: { id: true },
 		});
 
 		const at = new Date();
-		await db.activity.create({
+		await scopedDb.activity.create({
 			data: {
+				organizationId,
 				type: "NOTE",
 				subject: "The only thing on this account",
 				companyId: company.id,
@@ -320,20 +416,20 @@ describe("the activity stamps a purge leaves behind", () => {
 		await contacts.purge(contact.id);
 
 		expect(
-			await db.company.findUnique({
+			await scopedDb.company.findUnique({
 				where: { id: company.id },
 				select: { lastActivityAt: true },
 			}),
 		).toEqual({ lastActivityAt: null });
 		expect(
-			await db.deal.findUnique({
+			await scopedDb.deal.findUnique({
 				where: { id: deal.id },
 				select: { lastActivityAt: true },
 			}),
 		).toEqual({ lastActivityAt: null });
 	});
 
-	it("follow a deleted company through the deals it takes with it", async () => {
+	it("keeps deal activity when company deletion is refused", async () => {
 		const company = await companies.create({
 			name: "Orphaner",
 			domain: orphanDomain,
@@ -343,16 +439,23 @@ describe("the activity stamps a purge leaves behind", () => {
 			email: `orphaned@${orphanDomain}`,
 			companyId: company.id,
 		});
-		const deal = await db.deal.create({
-			data: { name: "Orphaned deal", companyId: company.id, ownerId: userId },
+		const deal = await scopedDb.deal.create({
+			data: {
+				organizationId,
+				name: "Orphaned deal",
+				companyId: company.id,
+				ownerId: userId,
+			},
 			select: { id: true },
 		});
 
 		const at = new Date();
-		await db.activity.create({
+		await scopedDb.activity.create({
 			data: {
+				organizationId,
 				type: "MEETING",
 				subject: "Only ever attached to the deal",
+				companyId: company.id,
 				contactId: contact.id,
 				dealId: deal.id,
 				createdById: userId,
@@ -361,15 +464,32 @@ describe("the activity stamps a purge leaves behind", () => {
 		});
 		await stamp.touch({ contactId: contact.id, dealId: deal.id }, at);
 
-		await companies.purge(company.id);
+		await expect(companies.purge(company.id)).rejects.toThrow(
+			"Delete this company's deals before deleting the company.",
+		);
 
 		expect(
-			await db.contact.findUnique({
-				where: { id: contact.id },
-				select: { companyId: true, lastActivityAt: true },
+			await scopedDb.deal.findUnique({
+				where: { id: deal.id },
+				select: { companyId: true },
+			}),
+		).toEqual({ companyId: company.id });
+		expect(
+			await scopedDb.activity.findFirst({
+				where: { dealId: deal.id },
+				select: { companyId: true, dealId: true },
 			}),
-		).toEqual({ companyId: null, lastActivityAt: null });
+		).toEqual({ companyId: company.id, dealId: deal.id });
+
+		const survivor = await scopedDb.contact.findUnique({
+			where: { id: contact.id },
+			select: { companyId: true, lastActivityAt: true },
+		});
+		expect(survivor?.companyId).toBe(company.id);
+		expect(survivor?.lastActivityAt).not.toBeNull();
 
-		await db.contact.delete({ where: { id: contact.id } });
+		await scopedDb.contact.delete({ where: { id: contact.id } });
+		await scopedDb.deal.delete({ where: { id: deal.id } });
+		await scopedDb.company.delete({ where: { id: company.id } });
 	});
 });
diff --git a/apps/api/test/request-principal.integration.spec.ts b/apps/api/test/request-principal.integration.spec.ts
new file mode 100644
index 000000000..2f7e7333e
--- /dev/null
+++ b/apps/api/test/request-principal.integration.spec.ts
@@ -0,0 +1,72 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { auth } from "@crm/auth";
+import { db } from "@crm/db";
+import type { Request } from "express";
+import { RequestPrincipalService } from "../src/auth/request-principal.service";
+
+const suffix = process.env.TEST_RUN_ID ?? "request-principal-spec";
+const userId = `${suffix}-user`;
+const organizationId = `${suffix}-organization`;
+let apiKey = "";
+
+beforeAll(async () => {
+	await db.user.create({
+		data: {
+			id: userId,
+			name: "API key creator",
+			email: `${suffix}@example.test`,
+		},
+	});
+	await db.organization.create({
+		data: {
+			id: organizationId,
+			name: "API key organization",
+			slug: organizationId,
+			createdAt: new Date(),
+		},
+	});
+	await db.member.create({
+		data: {
+			id: `${suffix}-member`,
+			userId,
+			organizationId,
+			role: "owner",
+			createdAt: new Date(),
+		},
+	});
+
+	const created = await auth.api.createApiKey({
+		body: {
+			userId,
+			organizationId,
+			name: "Integration key",
+			metadata: { createdByUserId: userId },
+		},
+	});
+	apiKey = created.key;
+});
+
+afterAll(async () => {
+	await db.apikey.deleteMany({ where: { referenceId: organizationId } });
+	await db.organization.delete({ where: { id: organizationId } });
+	await db.user.delete({ where: { id: userId } });
+});
+
+describe("RequestPrincipalService", () => {
+	it("resolves an organization-owned API key", async () => {
+		const service = new RequestPrincipalService(db);
+		const request = {
+			headers: { "x-api-key": apiKey },
+			method: "GET",
+			url: "/api/trpc/companies.list",
+			originalUrl: "/api/trpc/companies.list",
+		} as unknown as Request;
+
+		await expect(service.resolve(request)).resolves.toMatchObject({
+			credentialKind: "apiKey",
+			organizationId,
+			user: { id: userId },
+			session: null,
+		});
+	});
+});
diff --git a/apps/api/test/root-rest-http.e2e.spec.ts b/apps/api/test/root-rest-http.e2e.spec.ts
new file mode 100644
index 000000000..bb46b5f45
--- /dev/null
+++ b/apps/api/test/root-rest-http.e2e.spec.ts
@@ -0,0 +1,172 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { SwaggerModule } from "@nestjs/swagger";
+import { AppRouterHost } from "nestjs-trpc";
+import request from "supertest";
+import { generateOpenApiDocument } from "trpc-to-openapi";
+import { AssetsHttpFixture } from "./assets-http.fixture";
+import { inAssetTenant } from "./assets-tenant.fixture";
+
+describe("root REST bridge", () => {
+	const fixture = new AssetsHttpFixture();
+	beforeAll(() => fixture.setup());
+	afterAll(() => fixture.cleanup());
+
+	it("serves root reads and mutations with the existing principal", async () => {
+		const response = await request(fixture.app.getHttpServer())
+			.get(`/companies/${fixture.customerId}`)
+			.set("x-asset-test-user", fixture.userId)
+			.expect(200);
+		expect(response.body.id).toBe(fixture.customerId);
+		const options = await request(fixture.app.getHttpServer())
+			.get("/companies/options?q=Asset%20HTTP")
+			.set("x-asset-test-user", fixture.userId)
+			.expect(200);
+		expect(options.body).toEqual(expect.any(Array));
+		await request(fixture.app.getHttpServer())
+			.post(`/companies/${fixture.customerId}/archive`)
+			.set("x-asset-test-user", fixture.userId)
+			.send({})
+			.expect(200);
+	});
+
+	it("routes field filters and coverage before field keys", async () => {
+		const field = await inAssetTenant(() =>
+			scopedDb.fieldDefinition.create({
+				data: {
+					entity: "COMPANY",
+					key: fixture.prefix,
+					label: "Route test",
+					position: 0,
+					type: "TEXT",
+				},
+			}),
+		);
+		try {
+			const filters = await request(fixture.app.getHttpServer())
+				.get("/fields/COMPANY/filterable")
+				.set("x-asset-test-user", fixture.userId)
+				.expect(200);
+			expect(filters.body).toEqual(expect.any(Array));
+			const coverage = await request(fixture.app.getHttpServer())
+				.get(`/fields/${field.id}/coverage`)
+				.set("x-asset-test-user", fixture.userId)
+				.expect(200);
+			expect(coverage.body).toMatchObject({ filled: 0 });
+			const byKey = await request(fixture.app.getHttpServer())
+				.get(`/fields/COMPANY/${field.key}`)
+				.set("x-asset-test-user", fixture.userId)
+				.expect(200);
+			expect(byKey.body.id).toBe(field.id);
+		} finally {
+			await inAssetTenant(() =>
+				scopedDb.fieldDefinition.delete({ where: { id: field.id } }),
+			);
+		}
+	});
+
+	it("preserves authentication, OAuth scopes, tenancy, and session-only operations", async () => {
+		await request(fixture.app.getHttpServer())
+			.get(`/companies/${fixture.customerId}`)
+			.expect(401);
+		await request(fixture.app.getHttpServer())
+			.get(`/companies/${fixture.customerId}`)
+			.set("x-asset-test-user", fixture.userId)
+			.set("x-asset-test-scope", "crm.write")
+			.expect(403);
+		await request(fixture.app.getHttpServer())
+			.post(`/companies/${fixture.customerId}/restore`)
+			.set("x-asset-test-user", fixture.userId)
+			.set("x-asset-test-scope", "crm.read")
+			.send({})
+			.expect(403);
+		await request(fixture.app.getHttpServer())
+			.get("/api-keys")
+			.set("x-asset-test-user", fixture.userId)
+			.expect(401);
+		const organizationId = fixture.principal.organizationId;
+		fixture.principal.organizationId = "other-organization";
+		try {
+			await request(fixture.app.getHttpServer())
+				.get(`/companies/${fixture.customerId}`)
+				.set("x-asset-test-user", fixture.userId)
+				.expect(403);
+		} finally {
+			fixture.principal.organizationId = organizationId;
+		}
+	});
+
+	it("keeps native controllers, public endpoints, Swagger, and tRPC reachable", async () => {
+		for (const path of [
+			"/health",
+			"/auth/session",
+			"/",
+			"/sso/sign-in-options",
+		])
+			await request(fixture.app.getHttpServer()).get(path).expect(200);
+		await request(fixture.app.getHttpServer()).get("/auth/me").expect(401);
+		await request(fixture.app.getHttpServer())
+			.post("/push-tokens")
+			.send({})
+			.expect(401);
+		const registered = await request(fixture.app.getHttpServer())
+			.post("/push-tokens")
+			.set("x-asset-test-user", fixture.userId)
+			.send({ token: `${fixture.prefix}-fcm`, platform: "ios" })
+			.expect(201);
+		expect(registered.body).toEqual({ ok: true });
+		await request(fixture.app.getHttpServer())
+			.delete("/push-tokens")
+			.set("x-asset-test-user", fixture.userId)
+			.query({ token: `${fixture.prefix}-fcm` })
+			.expect(200);
+		await request(fixture.app.getHttpServer())
+			.get("/api/auth/get-session")
+			.expect(200);
+		await request(fixture.app.getHttpServer())
+			.get("/api/trpc/companies.byId")
+			.query({ input: JSON.stringify({ id: fixture.customerId }) })
+			.set("x-asset-test-user", fixture.userId)
+			.expect(200);
+	});
+
+	it("publishes distinct root operations and rejects every old bridge route", async () => {
+		const { appRouter } = fixture.app.get(AppRouterHost);
+		const bridge = generateOpenApiDocument(appRouter, {
+			title: "Test",
+			version: "1",
+			baseUrl: "http://localhost",
+		});
+		const native = SwaggerModule.createDocument(fixture.app, {
+			info: { title: "Test", version: "1" },
+			openapi: "3.0.0",
+		});
+		const response = await request(fixture.app.getHttpServer())
+			.get("/openapi.json")
+			.expect(200);
+		expect(
+			Object.keys(response.body.paths).some((path) =>
+				/^\/(rest|v1)(\/|$)/.test(path),
+			),
+		).toBe(false);
+		for (const [path, methods] of Object.entries(bridge.paths ?? {})) {
+			for (const method of ["get", "post", "put", "patch", "delete"] as const) {
+				if (!methods[method]) continue;
+				expect(native.paths[path]?.[method]).toBeUndefined();
+				expect(response.body.paths[path][method].operationId).toBe(
+					methods[method]?.operationId,
+				);
+				await request(fixture.app.getHttpServer())
+					[method](`/rest${path.replace(/\{[^}]+\}/g, "missing")}`)
+					.send({})
+					.expect(404);
+			}
+		}
+		for (const path of [
+			"/rest",
+			"/rest/v1/customers/c/assets",
+			"/rest/v1/projects/p/assets",
+		])
+			await request(fixture.app.getHttpServer()).get(path).expect(404);
+	});
+});
diff --git a/apps/api/test/setup.ts b/apps/api/test/setup.ts
index f8ec45ffe..3f4eaa08d 100644
--- a/apps/api/test/setup.ts
+++ b/apps/api/test/setup.ts
@@ -1,5 +1,21 @@
 import { afterAll } from "bun:test";
 
+const fallback = (key: string, value: string) => {
+	if (!process.env[key]) {
+		process.env[key] = value;
+	}
+};
+
+fallback(
+	"DATABASE_URL",
+	"postgresql://postgres:postgres@localhost:5432/crm?schema=public",
+);
+fallback("BETTER_AUTH_SECRET", "test-secret-at-least-32-characters-long");
+fallback("API_URL", "http://localhost:3001");
+fallback("ALLOWED_SIGN_IN", "example.com");
+fallback("GOOGLE_CLIENT_ID", "test-google-client-id");
+fallback("GOOGLE_CLIENT_SECRET", "test-google-client-secret");
+
 afterAll(async () => {
 	if (!process.env.DATABASE_URL) return;
 	const { db } = await import("@crm/db");
diff --git a/apps/api/test/slack-connection.spec.ts b/apps/api/test/slack-connection.spec.ts
index 74512c305..f67b8977b 100644
--- a/apps/api/test/slack-connection.spec.ts
+++ b/apps/api/test/slack-connection.spec.ts
@@ -1,12 +1,14 @@
 import { describe, expect, it } from "bun:test";
 import type { WorkspaceRole } from "@crm/auth";
 import type { Db } from "@crm/db";
+import { tenantBound } from "@crm/db/test-support";
 import type { AgentAccessService } from "../src/agent/agent-access.service";
 import type { AgentTriggerService } from "../src/agent/agent-trigger.service";
 import type { SlackChannelsService } from "../src/slack/slack-channels.service";
 import { SlackConnectionService } from "../src/slack/slack-connection.service";
 
 const userId = "crm-1";
+const organizationId = "workspace";
 
 function serviceFor(input: {
 	accountUpdatedAt?: Date;
@@ -37,12 +39,7 @@ function serviceFor(input: {
 		[];
 	const deleted: string[] = [];
 	const tx = {
-		account: {
-			deleteMany: async () => {
-				deleted.push("account");
-				return { count: input.accountUpdatedAt ? 1 : 0 };
-			},
-		},
+		$queryRaw: async () => [{ set_config: organizationId }],
 		slackChannel: {
 			deleteMany: async () => {
 				deleted.push("slackChannel");
@@ -50,28 +47,28 @@ function serviceFor(input: {
 			},
 		},
 		slackWorkspaceGrant: {
-			deleteMany: async () => {
+			delete: async () => {
 				deleted.push("slackWorkspaceGrant");
-				return { count: 0 };
+				return { id: "grant-1" };
 			},
 		},
 	};
 	const db = {
 		$transaction: async <T>(run: (client: typeof tx) => Promise<T>) => run(tx),
-		account: {
-			findFirst: async () =>
-				input.accountUpdatedAt
-					? {
-							id: "account-1",
-							accountId: "slack-user",
-							updatedAt: input.accountUpdatedAt,
-						}
-					: null,
-		},
 		agentDefinition: { findMany: async () => input.agents ?? [] },
 		slackMemberMatch: { findMany: async () => input.matches ?? [] },
 		slackWorkspaceGrant: {
-			findFirst: async () => (input.grant ? { id: "grant-1" } : null),
+			findFirst: async () => {
+				if (!input.accountUpdatedAt && !input.grant) return null;
+				return {
+					id: "grant-1",
+					teamName: "Test Team",
+					botToken: input.accountUpdatedAt ? "xoxb-test" : null,
+					botScopes: "chat:write",
+					userToken: input.grant ? "xoxp-test" : null,
+					updatedAt: input.accountUpdatedAt ?? new Date(),
+				};
+			},
 		},
 		member: {
 			count: async () => input.memberCount ?? 0,
@@ -91,8 +88,16 @@ function serviceFor(input: {
 		assertMember: async () => input.role ?? "member",
 	} as unknown as AgentAccessService;
 
+	const rawService = new SlackConnectionService(
+		db,
+		db as never,
+		agent,
+		channels,
+		access,
+	);
+
 	return {
-		service: new SlackConnectionService(db, agent, channels, access),
+		service: tenantBound(organizationId, rawService),
 		requested,
 		deleted,
 	};
@@ -240,6 +245,6 @@ describe("Slack connection", () => {
 		});
 
 		expect(await service.disconnect(userId)).toEqual({ disconnected: true });
-		expect(deleted).toEqual(["account", "slackChannel", "slackWorkspaceGrant"]);
+		expect(deleted).toEqual(["slackChannel", "slackWorkspaceGrant"]);
 	});
 });
diff --git a/apps/api/test/sso.spec.ts b/apps/api/test/sso.spec.ts
index 6f28a3ccb..d2c84cebf 100644
--- a/apps/api/test/sso.spec.ts
+++ b/apps/api/test/sso.spec.ts
@@ -1,6 +1,9 @@
-import { describe, expect, it } from "bun:test";
-import { isGoogleConfigured, WORKSPACE_ID } from "@crm/auth";
-import type { Db } from "@crm/db";
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { isGoogleConfigured, ssoProviderName } from "@crm/auth";
+import { db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { type ScopedDb, scopedDb } from "@crm/db/tenant-scope";
+import { tenantContext } from "@crm/db/test-support";
 import { ForbiddenException } from "@nestjs/common";
 import { SsoService } from "../src/sso/sso.service";
 
@@ -19,6 +22,12 @@ const LIST = {
 	page: 1,
 	pageSize: 25,
 };
+const organizationId = "sso-spec-organization";
+const publicSuffix = `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+const publicOrganizationId = `sso-public-org-${publicSuffix}`;
+const publicProviderId = `sso-public-provider-${publicSuffix}`;
+
+const inTenant = tenantContext(organizationId);
 
 type Seen = { providerWhere?: unknown };
 
@@ -36,7 +45,7 @@ function service(role: string | null, rows: Row[] = []) {
 			},
 			count: async () => rows.length,
 		},
-	} as unknown as Db;
+	} as unknown as ScopedDb;
 
 	return { sso: new SsoService(db), seen };
 }
@@ -56,40 +65,44 @@ describe("who may configure SSO", () => {
 	it("lets an owner and an admin", async () => {
 		for (const role of ["owner", "admin"]) {
 			const { sso } = service(role);
-			expect((await sso.settings("u1")).canConfigure).toBe(true);
+			expect((await inTenant(() => sso.settings("u1"))).canConfigure).toBe(
+				true,
+			);
 		}
 	});
 
 	it("refuses a member, and refuses them the writes too", async () => {
 		const { sso } = service("member");
 
-		expect((await sso.settings("u1")).canConfigure).toBe(false);
+		expect((await inTenant(() => sso.settings("u1"))).canConfigure).toBe(false);
 
 		expect(
-			sso.remove("u1", new Headers(), { providerId: "okta" }),
+			inTenant(() => sso.remove("u1", new Headers(), { providerId: "okta" })),
 		).rejects.toBeInstanceOf(ForbiddenException);
 
 		expect(
-			sso.register("u1", new Headers(), {
-				providerId: "okta",
-				issuer: "https://acme.okta.com",
-				domain: "acme.com",
-				clientId: "id",
-				clientSecret: "secret",
-			}),
+			inTenant(() =>
+				sso.register("u1", new Headers(), {
+					providerId: "okta",
+					issuer: "https://acme.okta.com",
+					domain: "acme.com",
+					clientId: "id",
+					clientSecret: "secret",
+				}),
+			),
 		).rejects.toBeInstanceOf(ForbiddenException);
 	});
 
 	it("refuses somebody who is not in the workspace at all", async () => {
 		const { sso } = service(null);
-		expect((await sso.settings("u1")).canConfigure).toBe(false);
+		expect((await inTenant(() => sso.settings("u1"))).canConfigure).toBe(false);
 	});
 });
 
 describe("what a provider looks like once it is saved", () => {
 	it("never hands back the client secret", async () => {
 		const { sso } = service("owner", [OKTA]);
-		const [provider] = (await sso.list(LIST)).rows;
+		const [provider] = (await inTenant(() => sso.list(LIST))).rows;
 
 		expect(JSON.stringify(provider)).not.toContain("shhh");
 		expect(provider?.clientIdLastFour).toBe("WXYZ");
@@ -97,7 +110,7 @@ describe("what a provider looks like once it is saved", () => {
 
 	it("splits the domains and names the callback the IdP needs", async () => {
 		const { sso } = service("owner", [OKTA]);
-		const [provider] = (await sso.list(LIST)).rows;
+		const [provider] = (await inTenant(() => sso.list(LIST))).rows;
 
 		expect(provider?.domains).toEqual(["acme.com", "subsidiary.com"]);
 		expect(provider?.type).toBe("oidc");
@@ -107,17 +120,17 @@ describe("what a provider looks like once it is saved", () => {
 
 	it("reads only the one workspace, never an organization it was passed", async () => {
 		const { sso, seen } = service("owner", [OKTA]);
-		await sso.list(LIST);
+		await inTenant(() => sso.list(LIST));
 
-		expect(seen.providerWhere).toEqual({ organizationId: WORKSPACE_ID });
+		expect(seen.providerWhere).toEqual({ organizationId });
 	});
 
 	it("searches the name, the domain and the issuer", async () => {
 		const { sso, seen } = service("owner", [OKTA]);
-		await sso.list({ ...LIST, q: " acme " });
+		await inTenant(() => sso.list({ ...LIST, q: " acme " }));
 
 		expect(seen.providerWhere).toEqual({
-			organizationId: WORKSPACE_ID,
+			organizationId,
 			OR: [
 				{ providerId: { contains: "acme", mode: "insensitive" } },
 				{ domain: { contains: "acme", mode: "insensitive" } },
@@ -128,16 +141,91 @@ describe("what a provider looks like once it is saved", () => {
 });
 
 describe("the sign-in page's read", () => {
+	beforeAll(async () => {
+		await db.organization.create({
+			data: {
+				id: publicOrganizationId,
+				name: `SSO Public ${publicSuffix}`,
+				slug: publicOrganizationId,
+				createdAt: new Date(),
+			},
+		});
+		await runInTenant(publicOrganizationId, () =>
+			scopedDb.ssoProvider.create({
+				data: {
+					id: `sso-public-row-${publicSuffix}`,
+					organizationId: publicOrganizationId,
+					providerId: publicProviderId,
+					issuer: "https://public.example.com",
+					domain: "public.example.com",
+				},
+			}),
+		);
+	});
+
+	afterAll(async () => {
+		await db.organization.delete({ where: { id: publicOrganizationId } });
+	});
+
 	it("carries the name and nothing else", async () => {
-		const { sso } = service(null, [OKTA]);
+		const { sso } = service(null);
+		const provider = (await sso.signInOptions()).providers.find(
+			(row) => row.providerId === publicProviderId,
+		);
 
-		expect((await sso.signInOptions()).providers).toEqual([
-			{ providerId: "okta", name: "Okta" },
-		]);
+		expect(provider).toEqual({
+			providerId: publicProviderId,
+			name: ssoProviderName(publicProviderId),
+		});
+	});
+
+	it("keeps the public locator synchronized with the protected provider", async () => {
+		const providerId = `${publicProviderId}-trigger`;
+
+		await runInTenant(publicOrganizationId, () =>
+			scopedDb.ssoProvider.create({
+				data: {
+					id: `sso-public-trigger-${publicSuffix}`,
+					organizationId: publicOrganizationId,
+					providerId,
+					issuer: "https://trigger.example.com",
+					domain: "first.example.com",
+				},
+			}),
+		);
+
+		try {
+			expect(
+				await db.ssoProviderLocator.findUnique({ where: { providerId } }),
+			).toMatchObject({
+				providerId,
+				organizationId: publicOrganizationId,
+				domain: "first.example.com",
+			});
+
+			await runInTenant(publicOrganizationId, () =>
+				scopedDb.ssoProvider.update({
+					where: { providerId },
+					data: { domain: "second.example.com" },
+				}),
+			);
+
+			expect(
+				await db.ssoProviderLocator.findUnique({ where: { providerId } }),
+			).toMatchObject({ domain: "second.example.com" });
+		} finally {
+			await runInTenant(publicOrganizationId, () =>
+				scopedDb.ssoProvider.delete({ where: { providerId } }),
+			);
+		}
+
+		expect(
+			await db.ssoProviderLocator.findUnique({ where: { providerId } }),
+		).toBeNull();
 	});
 
 	it("says whether Google is configured, so the page can offer nothing", async () => {
-		const { sso } = service(null, [OKTA]);
+		const { sso } = service(null);
 
 		expect((await sso.signInOptions()).google).toBe(isGoogleConfigured());
 	});
diff --git a/apps/api/test/telemetry-rollup.integration.spec.ts b/apps/api/test/telemetry-rollup.integration.spec.ts
new file mode 100644
index 000000000..4d78a317c
--- /dev/null
+++ b/apps/api/test/telemetry-rollup.integration.spec.ts
@@ -0,0 +1,189 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db, FactBand, FactStatus } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { createTenantRows } from "@crm/db/test-support";
+import {
+	bucket,
+	drainCounters,
+	type Properties,
+	restoreCounters,
+} from "@crm/telemetry";
+import { FunnelService } from "../src/telemetry/funnel.service";
+import { RollupService } from "../src/telemetry/rollup.service";
+
+const suffix = process.env.TEST_RUN_ID ?? crypto.randomUUID();
+const organizationA = `telemetry-rollup-a-${suffix}`;
+const organizationB = `telemetry-rollup-b-${suffix}`;
+const userId = `telemetry-rollup-user-${suffix}`;
+const now = new Date();
+const since = new Date(now.getTime() - 24 * 60 * 60 * 1000);
+
+beforeAll(async () => {
+	await db.user.create({
+		data: {
+			id: userId,
+			name: "Telemetry Rollup Tester",
+			email: `${userId}@example.test`,
+			emailVerified: true,
+		},
+	});
+	await db.organization.createMany({
+		data: [
+			{
+				id: organizationA,
+				name: "Telemetry Rollup A",
+				slug: organizationA,
+				createdAt: now,
+			},
+			{
+				id: organizationB,
+				name: "Telemetry Rollup B",
+				slug: organizationB,
+				createdAt: now,
+			},
+		],
+	});
+	await db.member.createMany({
+		data: [
+			{
+				id: `telemetry-rollup-member-a-${suffix}`,
+				organizationId: organizationA,
+				userId,
+				createdAt: now,
+			},
+			{
+				id: `telemetry-rollup-member-b-${suffix}`,
+				organizationId: organizationB,
+				userId,
+				createdAt: now,
+			},
+		],
+	});
+	await createTenantRows(
+		[
+			{
+				organizationId: organizationA,
+				agentModelId: "telemetry/model-a",
+				agentModelContextWindow: 100_000,
+			},
+			{
+				organizationId: organizationB,
+				agentModelId: "telemetry/model-b",
+				agentModelContextWindow: 200_000,
+			},
+		],
+		(data) => scopedDb.appSetting.create({ data: data as never }),
+	);
+
+	const contacts = await Promise.all(
+		[organizationA, organizationB].flatMap((organizationId) =>
+			Array.from({ length: 5 }, (_, index) =>
+				runInTenant(organizationId, () =>
+					scopedDb.contact.create({
+						data: {
+							organizationId,
+							firstName: `Telemetry ${index}`,
+							email: `${organizationId}-${index}@example.test`,
+						},
+						select: { id: true, organizationId: true },
+					}),
+				),
+			),
+		),
+	);
+
+	const hours = [1, 100, 2, 3];
+	await createTenantRows(
+		contacts.slice(0, hours.length).map((contact, index) => ({
+			organizationId: contact.organizationId,
+			contactId: contact.id,
+			field: `telemetry.${index}`,
+			value: "test",
+			score: 1,
+			band: FactBand.VERIFIED,
+			evidence: [],
+			method: "telemetry.test",
+			status: FactStatus.APPLIED,
+			observedAt: new Date(
+				now.getTime() - (hours[index] ?? 0) * 60 * 60 * 1000,
+			),
+			decidedAt: now,
+		})),
+		(data) => scopedDb.contactFact.create({ data: data as never }),
+	);
+	await createTenantRows(
+		[organizationA, organizationB].map((organizationId, index) => ({
+			organizationId,
+			kind: "recheck",
+			reason: "telemetry integration test",
+			dueAt: now,
+			startedAt: now,
+			finishedAt: now,
+			attempts: index * 2 + 1,
+			outcome: "completed",
+		})),
+		(data) => scopedDb.agentTask.create({ data: data as never }),
+	);
+});
+
+afterAll(async () => {
+	await db.organization.deleteMany({
+		where: { id: { in: [organizationA, organizationB] } },
+	});
+	await db.user.deleteMany({ where: { id: userId } });
+});
+
+describe("installation telemetry rollup", () => {
+	it("combines raw workspace metrics inside tenant contexts", async () => {
+		const existingCounters = await drainCounters();
+		let gatheredCounters: Record<string, number> = {};
+
+		try {
+			const service = new RollupService(db, new FunnelService(db));
+			const gather = Reflect.get(service, "gather") as (
+				this: RollupService,
+				since: Date,
+			) => Promise<{
+				properties: Properties;
+				counters: Record<string, number>;
+			}>;
+			const gathered = await gather.call(service, since);
+			gatheredCounters = gathered.counters;
+
+			const [members, contactsA, contactsB, tasksA, tasksB] = await Promise.all(
+				[
+					db.$queryRaw<{ count: bigint }[]>`
+						SELECT COUNT(DISTINCT "userId") AS count
+						FROM member;
+					`,
+					runInTenant(organizationA, () => scopedDb.contact.count()),
+					runInTenant(organizationB, () => scopedDb.contact.count()),
+					runInTenant(organizationA, () =>
+						scopedDb.agentTask.count({
+							where: { kind: "recheck", startedAt: { gte: since } },
+						}),
+					),
+					runInTenant(organizationB, () =>
+						scopedDb.agentTask.count({
+							where: { kind: "recheck", startedAt: { gte: since } },
+						}),
+					),
+				],
+			);
+			const contacts = contactsA + contactsB;
+			const tasks = tasksA + tasksB;
+			expect(gathered.properties.members_bucket).toBe(
+				bucket(Number(members[0]?.count ?? 0)),
+			);
+			expect(gathered.properties.contacts_bucket).toBe(bucket(contacts));
+			expect(gathered.properties.tasks_claimed).toMatchObject({
+				recheck: tasks,
+			});
+			expect(gathered.properties.agent_model_id).toBe("mixed");
+			expect(gathered.properties.agent_model_context_window).toBeNull();
+		} finally {
+			await restoreCounters({ ...existingCounters, ...gatheredCounters });
+		}
+	});
+});
diff --git a/apps/api/test/tracking-config-tenant-scope.spec.ts b/apps/api/test/tracking-config-tenant-scope.spec.ts
new file mode 100644
index 000000000..b3b0b1689
--- /dev/null
+++ b/apps/api/test/tracking-config-tenant-scope.spec.ts
@@ -0,0 +1,75 @@
+import { describe, expect, it } from "bun:test";
+import { currentOrganizationId, runInTenant } from "@crm/db/tenant-context";
+import type { ScopedDb } from "@crm/db/tenant-scope";
+import { configHash, type TrackingConfig } from "@crm/db/tracking";
+import type { Cache } from "cache-manager";
+import { TrackingConfigService } from "../src/tracking/tracking-config.service";
+import type { TrackingSiteLocatorService } from "../src/tracking/tracking-site-locator.service";
+
+const ORG_A = "organization-a";
+const ORG_B = "organization-b";
+const SITE_A = "cmp_aaaaaaaa";
+const SITE_B = "cmp_bbbbbbbb";
+
+function trackingConfig(siteId: string): TrackingConfig {
+	return {
+		siteId,
+		crossDomain: false,
+		limitToDomains: false,
+		cookieSubdomains: false,
+		secureCookies: true,
+		honourDnt: true,
+		cookieDays: 30,
+		hosts: [],
+	};
+}
+
+function setting(siteId: string) {
+	return {
+		trackingSiteId: siteId,
+		trackingCrossDomain: false,
+		trackingLimitToDomains: false,
+		trackingCookieSubdomains: false,
+		trackingSecureCookies: true,
+		trackingHonourDnt: true,
+		trackingCookieDays: 30,
+		trackingPaused: false,
+		trackingConfigHash: configHash(trackingConfig(siteId)),
+	};
+}
+
+describe("TrackingConfigService cache", () => {
+	it("keeps compiled configurations separate by organization", async () => {
+		const settings = new Map([
+			[ORG_A, setting(SITE_A)],
+			[ORG_B, setting(SITE_B)],
+		]);
+		const entries = new Map<string, unknown>();
+		const scopedDb = {
+			appSetting: {
+				findUnique: async () => settings.get(currentOrganizationId()),
+			},
+			trackedDomain: { findMany: async () => [] },
+		} as unknown as ScopedDb;
+		const cache = {
+			get: async (key: string) => entries.get(key),
+			set: async <T>(key: string, value: T) => entries.set(key, value),
+			del: async (key: string) => entries.delete(key),
+		} as unknown as Cache;
+		const service = new TrackingConfigService(
+			scopedDb,
+			cache,
+			{} as TrackingSiteLocatorService,
+		);
+
+		const first = await runInTenant(ORG_A, () => service.compiled());
+		const second = await runInTenant(ORG_B, () => service.compiled());
+
+		expect(first?.config.siteId).toBe(SITE_A);
+		expect(second?.config.siteId).toBe(SITE_B);
+		expect([...entries.keys()].sort()).toEqual([
+			`tracking:config:${ORG_A}`,
+			`tracking:config:${ORG_B}`,
+		]);
+	});
+});
diff --git a/apps/api/test/tracking-filing.integration.spec.ts b/apps/api/test/tracking-filing.integration.spec.ts
index f9da07670..98a050049 100644
--- a/apps/api/test/tracking-filing.integration.spec.ts
+++ b/apps/api/test/tracking-filing.integration.spec.ts
@@ -1,12 +1,8 @@
-import {
-	afterAll,
-	beforeAll,
-	beforeEach,
-	describe,
-	expect,
-	it,
-} from "bun:test";
+import { afterAll, beforeAll, beforeEach, describe, expect } from "bun:test";
 import { db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound, tenantTest } from "@crm/db/test-support";
 import {
 	CONTACT_CAP_REASON,
 	CONTACTS_PER_HOUR,
@@ -22,6 +18,8 @@ import { withDiscardedCrmEvents } from "./agent-trigger.stub";
 const suffix = process.env.TEST_RUN_ID ?? "filing-spec";
 const domain = `visitors-${suffix}.test`;
 const host = `www.${domain}`;
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
 
 const queued: string[] = [];
 
@@ -35,16 +33,25 @@ const agent = {
 	withCrmEvents: withDiscardedCrmEvents,
 } as unknown as AgentTriggerService;
 
-const stamp = new ActivityStampService(db);
-const counters = new TrackingCounterService(db);
+const stamp = new ActivityStampService(scopedDb as never);
+const rawCounters = new TrackingCounterService();
+const counters = tenantBound(organizationId, rawCounters);
 const directory = new CompanyDirectoryService(agent);
-const filing = new TrackingFilingService(db, counters, directory, agent, stamp);
+const rawFiling = new TrackingFilingService(
+	scopedDb as never,
+	counters,
+	directory,
+	agent,
+	stamp,
+);
+const filing = tenantBound(organizationId, rawFiling);
 
 let userId: string;
 
 async function submit(email: string | null, name: string | null = "Dana Reed") {
-	const row = await db.formSubmission.create({
+	const row = await scopedDb.formSubmission.create({
 		data: {
+			organizationId,
 			host,
 			path: "/pricing",
 			email,
@@ -62,7 +69,7 @@ async function submit(email: string | null, name: string | null = "Dana Reed") {
 		name,
 	});
 
-	const stored = await db.formSubmission.findUnique({
+	const stored = await scopedDb.formSubmission.findUnique({
 		where: { id: row.id },
 		select: { contactId: true, filedAt: true, skipReason: true },
 	});
@@ -71,19 +78,25 @@ async function submit(email: string | null, name: string | null = "Dana Reed") {
 }
 
 async function clean() {
-	await db.activity.deleteMany({ where: { body: { contains: host } } });
-	await db.formSubmission.deleteMany({ where: { host } });
-	await db.trackedVisitor.deleteMany({
-		where: { id: { startsWith: "visitor-" } },
-	});
-	await db.contact.deleteMany({ where: { email: { endsWith: `@${domain}` } } });
-	await db.contact.deleteMany({ where: { email: `free-${suffix}@gmail.com` } });
-	await db.company.deleteMany({ where: { domain } });
-	await db.suppressedContact.deleteMany({
-		where: { email: { endsWith: `@${domain}` } },
+	await runInTenant(organizationId, async () => {
+		await scopedDb.activity.deleteMany({ where: { body: { contains: host } } });
+		await scopedDb.formSubmission.deleteMany({ where: { host } });
+		await scopedDb.trackedVisitor.deleteMany({
+			where: { id: { startsWith: "visitor-" } },
+		});
+		await scopedDb.contact.deleteMany({
+			where: { email: { endsWith: `@${domain}` } },
+		});
+		await scopedDb.contact.deleteMany({
+			where: { email: `free-${suffix}@gmail.com` },
+		});
+		await scopedDb.company.deleteMany({ where: { domain } });
+		await scopedDb.suppressedContact.deleteMany({
+			where: { email: { endsWith: `@${domain}` } },
+		});
+		await scopedDb.suppressedDomain.deleteMany({ where: { domain } });
+		await scopedDb.trackingCounter.deleteMany({ where: {} });
 	});
-	await db.suppressedDomain.deleteMany({ where: { domain } });
-	await db.trackingCounter.deleteMany({ where: {} });
 }
 
 beforeAll(async () => {
@@ -104,10 +117,12 @@ beforeAll(async () => {
 		).id;
 });
 
-beforeEach(async () => {
-	queued.length = 0;
-	await db.trackingCounter.deleteMany({ where: {} });
-});
+beforeEach(() =>
+	runInTenant(organizationId, async () => {
+		queued.length = 0;
+		await scopedDb.trackingCounter.deleteMany({ where: {} });
+	}),
+);
 
 afterAll(async () => {
 	await clean();
@@ -134,7 +149,9 @@ describe("filing a form submission", () => {
 
 	it("refuses an address a rep has deleted", async () => {
 		const email = `deleted@${domain}`;
-		await db.suppressedContact.create({ data: { email } });
+		await scopedDb.suppressedContact.create({
+			data: { organizationId, email },
+		});
 
 		const { outcome, stored } = await submit(email);
 
@@ -143,14 +160,16 @@ describe("filing a form submission", () => {
 	});
 
 	it("refuses a suppressed domain", async () => {
-		await db.suppressedDomain.create({ data: { domain } });
+		await scopedDb.suppressedDomain.create({
+			data: { organizationId, domain },
+		});
 
 		const { outcome, stored } = await submit(`someone@${domain}`);
 
 		expect(outcome.filed).toBe(false);
 		expect(stored?.skipReason).toContain("suppressed");
 
-		await db.suppressedDomain.deleteMany({ where: { domain } });
+		await scopedDb.suppressedDomain.deleteMany({ where: { domain } });
 	});
 
 	it("files a free-mail address as a contact with no company", async () => {
@@ -159,8 +178,13 @@ describe("filing a form submission", () => {
 		expect(outcome.filed).toBe(true);
 		expect(stored?.filedAt).not.toBeNull();
 
-		const contact = await db.contact.findUnique({
-			where: { email: `free-${suffix}@gmail.com` },
+		const contact = await scopedDb.contact.findUnique({
+			where: {
+				organizationId_email: {
+					organizationId,
+					email: `free-${suffix}@gmail.com`,
+				},
+			},
 			select: { companyId: true, source: true },
 		});
 
@@ -176,8 +200,8 @@ describe("filing a form submission", () => {
 		expect(stored?.contactId).toBeTruthy();
 		expect(queued).toHaveLength(1);
 
-		const contact = await db.contact.findUnique({
-			where: { email },
+		const contact = await scopedDb.contact.findUnique({
+			where: { organizationId_email: { organizationId, email } },
 			select: { companyId: true, firstName: true },
 		});
 
@@ -187,8 +211,9 @@ describe("filing a form submission", () => {
 
 	it("writes one note when the same submission is filed twice at once", async () => {
 		const email = `raced@${domain}`;
-		const row = await db.formSubmission.create({
+		const row = await scopedDb.formSubmission.create({
 			data: {
+				organizationId,
 				host,
 				path: "/pricing",
 				email,
@@ -211,9 +236,9 @@ describe("filing a form submission", () => {
 
 		expect(first.filed).toBe(true);
 		expect(second.filed).toBe(true);
-		expect(await db.contact.count({ where: { email } })).toBe(1);
+		expect(await scopedDb.contact.count({ where: { email } })).toBe(1);
 
-		const notes = await db.activity.count({
+		const notes = await scopedDb.activity.count({
 			where: { body: { contains: host }, contact: { email } },
 		});
 
@@ -224,8 +249,9 @@ describe("filing a form submission", () => {
 		const email = `refunded@${domain}`;
 		const rows = await Promise.all(
 			[1, 2].map((n) =>
-				db.formSubmission.create({
+				scopedDb.formSubmission.create({
 					data: {
+						organizationId,
 						host,
 						path: "/pricing",
 						email,
@@ -249,10 +275,12 @@ describe("filing a form submission", () => {
 			),
 		);
 
-		expect(await db.contact.count({ where: { email } })).toBe(1);
+		expect(await scopedDb.contact.count({ where: { email } })).toBe(1);
 
-		const counter = await db.trackingCounter.findUnique({
-			where: { key: contactWindowKey() },
+		const counter = await scopedDb.trackingCounter.findUnique({
+			where: {
+				organizationId_key: { organizationId, key: contactWindowKey() },
+			},
 			select: { value: true },
 		});
 
@@ -271,14 +299,17 @@ describe("filing a form submission", () => {
 		expect(second.stored?.contactId).toBe(first.stored?.contactId ?? "");
 		expect(queued).toHaveLength(0);
 
-		const count = await db.contact.count({ where: { email } });
+		const count = await scopedDb.contact.count({ where: { email } });
 		expect(count).toBe(1);
 	});
 
 	it("stores but does not file once the hourly cap is reached", async () => {
-		await db.trackingCounter.upsert({
-			where: { key: contactWindowKey() },
+		await scopedDb.trackingCounter.upsert({
+			where: {
+				organizationId_key: { organizationId, key: contactWindowKey() },
+			},
 			create: {
+				organizationId,
 				key: contactWindowKey(),
 				value: CONTACTS_PER_HOUR,
 				expiresAt: new Date(Date.now() + 3_600_000),
@@ -303,17 +334,23 @@ describe("the hourly counter", () => {
 		expect(await counters.take(key, 2)).toBe(false);
 		expect(await counters.take(key, 2)).toBe(false);
 
-		await db.trackingCounter.deleteMany({ where: { key } });
+		await scopedDb.trackingCounter.deleteMany({
+			where: { organizationId, key },
+		});
 	});
 
 	it("keeps a fixed window rather than sliding on every write", async () => {
 		const key = contactWindowKey();
 
 		await counters.take(key, 10);
-		const first = await db.trackingCounter.findUnique({ where: { key } });
+		const first = await scopedDb.trackingCounter.findUnique({
+			where: { organizationId_key: { organizationId, key } },
+		});
 
 		await counters.take(key, 10);
-		const second = await db.trackingCounter.findUnique({ where: { key } });
+		const second = await scopedDb.trackingCounter.findUnique({
+			where: { organizationId_key: { organizationId, key } },
+		});
 
 		expect(second?.expiresAt.getTime()).toBe(first?.expiresAt.getTime() ?? 0);
 		expect(second?.value).toBe(2);
diff --git a/apps/api/test/tracking-ingest.integration.spec.ts b/apps/api/test/tracking-ingest.integration.spec.ts
index 510629793..1e0062778 100644
--- a/apps/api/test/tracking-ingest.integration.spec.ts
+++ b/apps/api/test/tracking-ingest.integration.spec.ts
@@ -1,12 +1,7 @@
-import {
-	afterAll,
-	beforeAll,
-	beforeEach,
-	describe,
-	expect,
-	it,
-} from "bun:test";
-import { db } from "@crm/db";
+import { afterAll, beforeAll, beforeEach, describe, expect } from "bun:test";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound, tenantTest } from "@crm/db/test-support";
 import { EVENTS_PER_MINUTE, type TrackingConfig } from "@crm/db/tracking";
 import type { TrackingConfigService } from "../src/tracking/tracking-config.service";
 import { TrackingCounterService } from "../src/tracking/tracking-counter.service";
@@ -22,6 +17,8 @@ const child = `docs.${parent}`;
 const exact = `shop-${suffix}.test`;
 
 const SITE_ID = "cmp_1234abcd";
+const organizationId = "workspace";
+const it = tenantTest(organizationId);
 
 const config: TrackingConfig = {
 	siteId: SITE_ID,
@@ -46,7 +43,7 @@ const filed: string[] = [];
 
 const filing = {
 	file: async ({ id }: { id: string }) => {
-		const claimed = await db.formSubmission.updateMany({
+		const claimed = await scopedDb.formSubmission.updateMany({
 			where: { id, filedAt: null },
 			data: { filedAt: new Date() },
 		});
@@ -61,8 +58,15 @@ const filing = {
 	},
 } as unknown as TrackingFilingService;
 
-const counters = new TrackingCounterService(db);
-const ingest = new TrackingIngestService(db, configService, counters, filing);
+const rawCounters = new TrackingCounterService();
+const counters = tenantBound(organizationId, rawCounters);
+const rawIngest = new TrackingIngestService(
+	scopedDb as never,
+	configService,
+	counters,
+	filing,
+);
+const ingest = tenantBound(organizationId, rawIngest);
 
 const REQUEST = {
 	origin: `https://${child}`,
@@ -92,29 +96,33 @@ function view(host: string, path = "/pricing"): IncomingEvent {
 }
 
 async function clean() {
-	for (const host of [parent, child, exact]) {
-		await db.formSubmission.deleteMany({ where: { host } });
-		await db.trackedEvent.deleteMany({ where: { host } });
-	}
+	await runInTenant(organizationId, async () => {
+		for (const host of [parent, child, exact]) {
+			await scopedDb.formSubmission.deleteMany({ where: { host } });
+			await scopedDb.trackedEvent.deleteMany({ where: { host } });
+		}
 
-	await db.trackedDomain.deleteMany({
-		where: { host: { in: [parent, exact] } },
+		await scopedDb.trackedDomain.deleteMany({
+			where: { host: { in: [parent, exact] } },
+		});
+		await scopedDb.trackingCounter.deleteMany({ where: {} });
 	});
-	await db.trackingCounter.deleteMany({ where: {} });
 }
 
 beforeAll(clean);
 
-beforeEach(async () => {
-	filed.length = 0;
-	await clean();
-	await db.trackedDomain.createMany({
-		data: [
-			{ host: parent, scope: "SITE_AND_SUBDOMAINS" },
-			{ host: exact, scope: "EXACT_HOST" },
-		],
-	});
-});
+beforeEach(() =>
+	runInTenant(organizationId, async () => {
+		filed.length = 0;
+		await clean();
+		await scopedDb.trackedDomain.createMany({
+			data: [
+				{ organizationId, host: parent, scope: "SITE_AND_SUBDOMAINS" },
+				{ organizationId, host: exact, scope: "EXACT_HOST" },
+			],
+		});
+	}),
+);
 
 afterAll(clean);
 
@@ -122,8 +130,8 @@ describe("counting page views against a domain", () => {
 	it("credits a subdomain's views to the parent that covers it", async () => {
 		await accept([view(child), view(child), view(parent)]);
 
-		const row = await db.trackedDomain.findUnique({
-			where: { host: parent },
+		const row = await scopedDb.trackedDomain.findUnique({
+			where: { organizationId_host: { organizationId, host: parent } },
 			select: { pageViews: true },
 		});
 
@@ -133,7 +141,7 @@ describe("counting page views against a domain", () => {
 	it("gives each domain only the views that were its own", async () => {
 		await accept([view(child), view(exact), view(exact)]);
 
-		const rows = await db.trackedDomain.findMany({
+		const rows = await scopedDb.trackedDomain.findMany({
 			where: { host: { in: [parent, exact] } },
 			select: { host: true, pageViews: true },
 			orderBy: { host: "asc" },
@@ -149,8 +157,8 @@ describe("counting page views against a domain", () => {
 			{ type: "click", host: parent, path: "/pricing", at: Date.now() },
 		]);
 
-		const row = await db.trackedDomain.findUnique({
-			where: { host: parent },
+		const row = await scopedDb.trackedDomain.findUnique({
+			where: { organizationId_host: { organizationId, host: parent } },
 			select: { pageViews: true },
 		});
 
@@ -162,7 +170,7 @@ describe("the rate limit", () => {
 	it("charges every event in the batch, not one per request", async () => {
 		await accept([view(parent), view(parent), view(parent)]);
 
-		const counter = await db.trackingCounter.findFirst({
+		const counter = await scopedDb.trackingCounter.findFirst({
 			where: { key: { startsWith: "rate:" } },
 			select: { value: true },
 		});
@@ -171,7 +179,7 @@ describe("the rate limit", () => {
 	});
 
 	it("stops writing once the window is spent", async () => {
-		await db.trackingCounter.deleteMany({ where: {} });
+		await scopedDb.trackingCounter.deleteMany({ where: {} });
 
 		for (const key of spendableWindows()) {
 			await counters.take(key, EVENTS_PER_MINUTE, EVENTS_PER_MINUTE);
@@ -179,21 +187,27 @@ describe("the rate limit", () => {
 
 		await accept([view(parent)]);
 
-		expect(await db.trackedEvent.count({ where: { host: parent } })).toBe(0);
+		expect(await scopedDb.trackedEvent.count({ where: { host: parent } })).toBe(
+			0,
+		);
 	});
 
 	it("does not spend the window on a batch it refuses", async () => {
-		await db.trackingCounter.deleteMany({ where: {} });
+		await scopedDb.trackingCounter.deleteMany({ where: {} });
 
 		for (const key of spendableWindows()) {
 			await counters.take(key, EVENTS_PER_MINUTE, EVENTS_PER_MINUTE - 1);
 		}
 
 		await accept([view(parent), view(parent)]);
-		expect(await db.trackedEvent.count({ where: { host: parent } })).toBe(0);
+		expect(await scopedDb.trackedEvent.count({ where: { host: parent } })).toBe(
+			0,
+		);
 
 		await accept([view(parent)]);
-		expect(await db.trackedEvent.count({ where: { host: parent } })).toBe(1);
+		expect(await scopedDb.trackedEvent.count({ where: { host: parent } })).toBe(
+			1,
+		);
 	});
 });
 
@@ -210,7 +224,7 @@ describe("what a stored event keeps", () => {
 			},
 		]);
 
-		const row = await db.trackedEvent.findFirst({
+		const row = await scopedDb.trackedEvent.findFirst({
 			where: { host: parent },
 			select: { path: true, referrer: true },
 		});
@@ -232,7 +246,7 @@ describe("what a stored event keeps", () => {
 			},
 		]);
 
-		const row = await db.formSubmission.findFirst({
+		const row = await scopedDb.formSubmission.findFirst({
 			where: { host: parent },
 			select: { firstTouch: true, lastTouch: true },
 		});
@@ -256,7 +270,7 @@ describe("a batch delivered twice", () => {
 		await accept([submission], id);
 		expect(filed).toHaveLength(1);
 
-		await db.formSubmission.updateMany({
+		await scopedDb.formSubmission.updateMany({
 			where: { host: parent },
 			data: { filedAt: null, contactId: null, skipReason: null },
 		});
@@ -264,7 +278,9 @@ describe("a batch delivered twice", () => {
 		await accept([submission], id);
 
 		expect(filed).toHaveLength(2);
-		expect(await db.formSubmission.count({ where: { host: parent } })).toBe(1);
+		expect(
+			await scopedDb.formSubmission.count({ where: { host: parent } }),
+		).toBe(1);
 	});
 
 	it("files once when both deliveries arrive together", async () => {
@@ -280,7 +296,9 @@ describe("a batch delivered twice", () => {
 		const id = visitorId();
 		await Promise.all([accept([submission], id), accept([submission], id)]);
 
-		expect(await db.formSubmission.count({ where: { host: parent } })).toBe(1);
+		expect(
+			await scopedDb.formSubmission.count({ where: { host: parent } }),
+		).toBe(1);
 		expect(filed).toHaveLength(1);
 	});
 
@@ -296,7 +314,7 @@ describe("a batch delivered twice", () => {
 
 		const id = visitorId();
 		await accept([submission], id);
-		await db.formSubmission.updateMany({
+		await scopedDb.formSubmission.updateMany({
 			where: { host: parent },
 			data: { filedAt: new Date() },
 		});
@@ -317,7 +335,9 @@ describe("a batch that looks scripted", () => {
 			{ type: "page_view", host: parent, path: "/c", at },
 		]);
 
-		expect(await db.trackedEvent.count({ where: { host: parent } })).toBe(0);
+		expect(await scopedDb.trackedEvent.count({ where: { host: parent } })).toBe(
+			0,
+		);
 	});
 
 	it("keeps a batch whose events carry no timestamp at all", async () => {
@@ -327,7 +347,9 @@ describe("a batch that looks scripted", () => {
 			{ type: "page_view", host: parent, path: "/c" },
 		]);
 
-		expect(await db.trackedEvent.count({ where: { host: parent } })).toBe(3);
+		expect(await scopedDb.trackedEvent.count({ where: { host: parent } })).toBe(
+			3,
+		);
 	});
 });
 
diff --git a/apps/api/test/tracking-public-tenant.spec.ts b/apps/api/test/tracking-public-tenant.spec.ts
new file mode 100644
index 000000000..1b1fe45b4
--- /dev/null
+++ b/apps/api/test/tracking-public-tenant.spec.ts
@@ -0,0 +1,128 @@
+import { describe, expect, it } from "bun:test";
+import type { IncomingMessage } from "node:http";
+import { Readable } from "node:stream";
+import type { Db } from "@crm/db";
+import { currentOrganizationId } from "@crm/db/tenant-context";
+import type { ScopedDb } from "@crm/db/tenant-scope";
+import { configHash, type TrackingConfig } from "@crm/db/tracking";
+import type { Cache } from "cache-manager";
+import type { Response } from "express";
+import { TrackingController } from "../src/tracking/tracking.controller";
+import { TrackingConfigService } from "../src/tracking/tracking-config.service";
+import type { TrackingIngestService } from "../src/tracking/tracking-ingest.service";
+import { TrackingSiteLocatorService } from "../src/tracking/tracking-site-locator.service";
+
+const ORG_A = "organization-a";
+const ORG_B = "organization-b";
+const SITE_A = "cmp_aaaaaaaa";
+const SITE_B = "cmp_bbbbbbbb";
+
+function config(siteId: string) {
+	return {
+		trackingSiteId: siteId,
+		trackingCrossDomain: false,
+		trackingLimitToDomains: false,
+		trackingCookieSubdomains: false,
+		trackingSecureCookies: true,
+		trackingHonourDnt: true,
+		trackingCookieDays: 30,
+		trackingPaused: false,
+		trackingConfigHash: configHash(trackingConfig(siteId)),
+	};
+}
+
+function trackingConfig(siteId: string): TrackingConfig {
+	return {
+		siteId,
+		crossDomain: false,
+		limitToDomains: false,
+		cookieSubdomains: false,
+		secureCookies: true,
+		honourDnt: true,
+		cookieDays: 30,
+		hosts: [],
+	};
+}
+
+describe("public tracking tenant context", () => {
+	it("rejects a malformed site id before database lookup", async () => {
+		let queried = false;
+		const locator = new TrackingSiteLocatorService({
+			trackingSiteLocator: {
+				findUnique: async () => {
+					queried = true;
+					return null;
+				},
+			},
+		} as unknown as Db);
+
+		expect(await locator.resolve("not-a-site")).toBeNull();
+		expect(queried).toBe(false);
+	});
+
+	it("runs ingest inside the organization resolved from the site id", async () => {
+		let acceptedOrganizationId: string | undefined;
+		const locator = new TrackingSiteLocatorService({
+			trackingSiteLocator: {
+				findUnique: async () => ({ organizationId: ORG_A }),
+			},
+		} as unknown as Db);
+		const controller = new TrackingController(
+			locator,
+			{} as TrackingConfigService,
+			{
+				accept: async () => {
+					acceptedOrganizationId = currentOrganizationId();
+				},
+			} as unknown as TrackingIngestService,
+		);
+		const request = Readable.from([
+			Buffer.from(
+				JSON.stringify({ siteId: SITE_A, visitorId: "visitor", events: [] }),
+			),
+		]) as unknown as IncomingMessage;
+		const response = { setHeader: () => undefined } as unknown as Response;
+
+		await controller.collect(request, response);
+
+		expect(acceptedOrganizationId).toBe(ORG_A);
+	});
+
+	it("keeps public configurations separate by organization", async () => {
+		const settings = new Map([
+			[ORG_A, config(SITE_A)],
+			[ORG_B, config(SITE_B)],
+		]);
+		const cached = new Map<string, unknown>();
+		const locator = new TrackingSiteLocatorService({
+			trackingSiteLocator: {
+				findUnique: async ({ where }: { where: { siteId: string } }) => ({
+					organizationId: where.siteId === SITE_A ? ORG_A : ORG_B,
+				}),
+			},
+		} as unknown as Db);
+		const service = new TrackingConfigService(
+			{
+				appSetting: {
+					findUnique: async () => settings.get(currentOrganizationId()),
+				},
+				trackedDomain: { findMany: async () => [] },
+			} as unknown as ScopedDb,
+			{
+				get: async (key: string) => cached.get(key),
+				set: async <T>(key: string, value: T) => cached.set(key, value),
+				del: async (key: string) => cached.delete(key),
+			} as unknown as Cache,
+			locator,
+		);
+
+		const [first, second] = await Promise.all([
+			service.forSite(SITE_A),
+			service.forSite(SITE_B),
+		]);
+
+		expect(first?.config.siteId).toBe(SITE_A);
+		expect(second?.config.siteId).toBe(SITE_B);
+		expect(cached.size).toBe(2);
+	});
+});
diff --git a/apps/api/test/tracking-retention.integration.spec.ts b/apps/api/test/tracking-retention.integration.spec.ts
new file mode 100644
index 000000000..f04618057
--- /dev/null
+++ b/apps/api/test/tracking-retention.integration.spec.ts
@@ -0,0 +1,274 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { createTenantRows } from "@crm/db/test-support";
+import { TrackingCounterService } from "../src/tracking/tracking-counter.service";
+import { TrackingRetentionService } from "../src/tracking/tracking-retention.service";
+import { TrackingRollupService } from "../src/tracking/tracking-rollup.service";
+
+const suffix = process.env.TEST_RUN_ID ?? crypto.randomUUID();
+const organizationA = `tracking-retention-a-${suffix}`;
+const organizationB = `tracking-retention-b-${suffix}`;
+const orphanA = `tracking-orphan-a-${suffix}`;
+const orphanB = `tracking-orphan-b-${suffix}`;
+const linkedVisitor = `tracking-linked-${suffix}`;
+const recentVisitor = `tracking-recent-${suffix}`;
+const old = new Date("2025-01-02T12:00:00.000Z");
+const day = new Date("2025-01-02T00:00:00.000Z");
+const recent = new Date();
+let linkedContactId = "";
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: [
+			{
+				id: organizationA,
+				name: "Tracking Retention A",
+				slug: organizationA,
+				createdAt: recent,
+			},
+			{
+				id: organizationB,
+				name: "Tracking Retention B",
+				slug: organizationB,
+				createdAt: recent,
+			},
+		],
+	});
+	const contact = await runInTenant(organizationA, () =>
+		scopedDb.contact.create({
+			data: {
+				organizationId: organizationA,
+				firstName: "Tracked",
+				email: `tracked-${suffix}@example.test`,
+			},
+			select: { id: true },
+		}),
+	);
+	linkedContactId = contact.id;
+
+	await createTenantRows(
+		[
+			{
+				id: orphanA,
+				organizationId: organizationA,
+				firstSeen: old,
+				lastSeen: old,
+			},
+			{
+				id: orphanB,
+				organizationId: organizationB,
+				firstSeen: old,
+				lastSeen: old,
+			},
+			{
+				id: linkedVisitor,
+				organizationId: organizationA,
+				contactId: linkedContactId,
+				firstSeen: old,
+				lastSeen: old,
+			},
+			{
+				id: recentVisitor,
+				organizationId: organizationB,
+				firstSeen: recent,
+				lastSeen: recent,
+			},
+		],
+		(data) => scopedDb.trackedVisitor.create({ data: data as never }),
+	);
+	await createTenantRows(
+		[
+			{
+				organizationId: organizationA,
+				visitorId: orphanA,
+				type: "page_view",
+				host: "a.example.test",
+				path: "/pricing",
+				occurredAt: old,
+			},
+			{
+				organizationId: organizationA,
+				visitorId: orphanA,
+				type: "page_view",
+				host: "a.example.test",
+				path: "/pricing",
+				occurredAt: old,
+			},
+			{
+				organizationId: organizationA,
+				visitorId: orphanA,
+				type: "click",
+				host: "a.example.test",
+				path: "/pricing",
+				occurredAt: old,
+			},
+			{
+				organizationId: organizationB,
+				visitorId: orphanB,
+				type: "page_view",
+				host: "b.example.test",
+				path: "/demo",
+				occurredAt: old,
+			},
+			{
+				organizationId: organizationB,
+				visitorId: recentVisitor,
+				type: "page_view",
+				host: "b.example.test",
+				path: "/recent",
+				occurredAt: recent,
+			},
+		],
+		(data) => scopedDb.trackedEvent.create({ data: data as never }),
+	);
+	await runInTenant(organizationA, () =>
+		scopedDb.trackedPageDaily.create({
+			data: {
+				organizationId: organizationA,
+				day,
+				host: "a.example.test",
+				path: "/pricing",
+				views: 1,
+				visitors: 0,
+			},
+		}),
+	);
+	await createTenantRows(
+		[
+			{
+				organizationId: organizationA,
+				key: `expired-${suffix}`,
+				value: 1,
+				expiresAt: old,
+			},
+			{
+				organizationId: organizationB,
+				key: `expired-${suffix}`,
+				value: 1,
+				expiresAt: old,
+			},
+			{
+				organizationId: organizationA,
+				key: `current-${suffix}`,
+				value: 1,
+				expiresAt: new Date(recent.getTime() + 60 * 60 * 1000),
+			},
+			{
+				organizationId: organizationB,
+				key: `current-${suffix}`,
+				value: 1,
+				expiresAt: new Date(recent.getTime() + 60 * 60 * 1000),
+			},
+		],
+		(data) => scopedDb.trackingCounter.create({ data: data as never }),
+	);
+});
+
+afterAll(async () => {
+	await db.organization.deleteMany({
+		where: { id: { in: [organizationA, organizationB] } },
+	});
+});
+
+describe("tracking retention across workspaces", () => {
+	it("rolls up and removes each workspace's expired tracking data", async () => {
+		const retention = new TrackingRetentionService(
+			db,
+			new TrackingRollupService(),
+			new TrackingCounterService(),
+		);
+
+		const outcome = await retention.run(new Date("2025-02-01T00:00:00.000Z"));
+		const [
+			dailyA,
+			dailyB,
+			oldEventsA,
+			oldEventsB,
+			recentEvents,
+			visitorsA,
+			visitorsB,
+			countersA,
+			countersB,
+		] = await Promise.all([
+			runInTenant(organizationA, () =>
+				scopedDb.trackedPageDaily.findUnique({
+					where: {
+						organizationId_day_host_path: {
+							organizationId: organizationA,
+							day,
+							host: "a.example.test",
+							path: "/pricing",
+						},
+					},
+					select: { views: true, visitors: true },
+				}),
+			),
+			runInTenant(organizationB, () =>
+				scopedDb.trackedPageDaily.findUnique({
+					where: {
+						organizationId_day_host_path: {
+							organizationId: organizationB,
+							day,
+							host: "b.example.test",
+							path: "/demo",
+						},
+					},
+					select: { views: true, visitors: true },
+				}),
+			),
+			runInTenant(organizationA, () =>
+				scopedDb.trackedEvent.count({ where: { visitorId: orphanA } }),
+			),
+			runInTenant(organizationB, () =>
+				scopedDb.trackedEvent.count({ where: { visitorId: orphanB } }),
+			),
+			runInTenant(organizationB, () =>
+				scopedDb.trackedEvent.count({
+					where: { visitorId: recentVisitor },
+				}),
+			),
+			runInTenant(organizationA, () =>
+				scopedDb.trackedVisitor.findMany({
+					where: { id: { in: [orphanA, linkedVisitor] } },
+					select: { id: true },
+				}),
+			),
+			runInTenant(organizationB, () =>
+				scopedDb.trackedVisitor.findMany({
+					where: { id: orphanB },
+					select: { id: true },
+				}),
+			),
+			runInTenant(organizationA, () =>
+				scopedDb.trackingCounter.findMany({
+					select: { key: true },
+				}),
+			),
+			runInTenant(organizationB, () =>
+				scopedDb.trackingCounter.findMany({
+					select: { key: true },
+				}),
+			),
+		]);
+		const oldEvents = oldEventsA + oldEventsB;
+		const visitors = [...visitorsA, ...visitorsB];
+		const counters = [...countersA, ...countersB];
+
+		expect(outcome.rolled).toBeGreaterThanOrEqual(2);
+		expect(outcome.removed).toBeGreaterThanOrEqual(4);
+		expect(outcome.complete).toBe(true);
+		expect(outcome.visitors).toBeGreaterThanOrEqual(2);
+		expect(outcome.counters).toBeGreaterThanOrEqual(2);
+		expect(dailyA).toEqual({ views: 2, visitors: 1 });
+		expect(dailyB).toEqual({ views: 1, visitors: 1 });
+		expect(oldEvents).toBe(0);
+		expect(recentEvents).toBe(1);
+		expect(visitors).toEqual([{ id: linkedVisitor }]);
+		expect(counters).toEqual([
+			{ key: `current-${suffix}` },
+			{ key: `current-${suffix}` },
+		]);
+	});
+});
diff --git a/apps/api/test/tracking-site-locator.integration.spec.ts b/apps/api/test/tracking-site-locator.integration.spec.ts
new file mode 100644
index 000000000..3e4deed52
--- /dev/null
+++ b/apps/api/test/tracking-site-locator.integration.spec.ts
@@ -0,0 +1,64 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { tenantBound } from "@crm/db/test-support";
+import { isSiteId } from "@crm/db/tracking";
+import type { Cache } from "cache-manager";
+import { TrackingConfigService } from "../src/tracking/tracking-config.service";
+import { TrackingSiteLocatorService } from "../src/tracking/tracking-site-locator.service";
+
+const suffix = process.env.TEST_RUN_ID ?? crypto.randomUUID();
+const organizationId = `tracking-site-locator-${suffix}`;
+
+beforeAll(async () => {
+	await db.organization.create({
+		data: {
+			id: organizationId,
+			name: "Tracking Site Locator",
+			slug: organizationId,
+			createdAt: new Date(),
+		},
+	});
+});
+
+afterAll(async () => {
+	await db.organization.delete({ where: { id: organizationId } });
+});
+
+describe("tracking site locator", () => {
+	it("replaces the public locator atomically when the site id rotates", async () => {
+		const entries = new Map<string, unknown>();
+		const cache = {
+			get: async (key: string) => entries.get(key),
+			set: async <T>(key: string, value: T) => entries.set(key, value),
+			del: async (key: string) => entries.delete(key),
+		} as unknown as Cache;
+		const locator = new TrackingSiteLocatorService(db);
+		const raw = new TrackingConfigService(scopedDb as never, cache, locator);
+		const service = tenantBound(organizationId, raw);
+
+		const first = await service.rotateSiteId();
+		const second = await service.rotateSiteId();
+		const [setting, locators] = await Promise.all([
+			runInTenant(organizationId, () =>
+				scopedDb.appSetting.findUnique({
+					where: { organizationId },
+					select: { trackingSiteId: true },
+				}),
+			),
+			db.trackingSiteLocator.findMany({
+				where: { organizationId },
+				select: { siteId: true },
+			}),
+		]);
+
+		expect(isSiteId(first)).toBe(true);
+		expect(isSiteId(second)).toBe(true);
+		expect(second).not.toBe(first);
+		expect(await locator.resolve(first)).toBeNull();
+		expect(await locator.resolve(second)).toBe(organizationId);
+		expect(setting?.trackingSiteId).toBe(second);
+		expect(locators).toEqual([{ siteId: second }]);
+	});
+});
diff --git a/apps/api/test/tracking-sources.integration.spec.ts b/apps/api/test/tracking-sources.integration.spec.ts
new file mode 100644
index 000000000..f12cd16da
--- /dev/null
+++ b/apps/api/test/tracking-sources.integration.spec.ts
@@ -0,0 +1,168 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { createTenantRows, tenantBound } from "@crm/db/test-support";
+import { TrackingService } from "../src/tracking/tracking.service";
+import type { TrackingConfigService } from "../src/tracking/tracking-config.service";
+
+const suffix = process.env.TEST_RUN_ID ?? crypto.randomUUID();
+const userId = `tracking-sources-user-${suffix}`;
+const organizationA = `tracking-sources-a-${suffix}`;
+const organizationB = `tracking-sources-b-${suffix}`;
+const contactA = `tracking-sources-contact-a-${suffix}`;
+const contactB = `tracking-sources-contact-b-${suffix}`;
+const visitorA = `tracking-sources-visitor-a-${suffix}`;
+const visitorB = `tracking-sources-visitor-b-${suffix}`;
+const occurredAt = new Date("2026-08-01T12:00:00.000Z");
+
+beforeAll(async () => {
+	await db.user.create({
+		data: {
+			id: userId,
+			name: "Tracking Sources User",
+			email: `${userId}@example.test`,
+			emailVerified: true,
+		},
+	});
+	await db.organization.createMany({
+		data: [
+			{
+				id: organizationA,
+				name: "Tracking Sources A",
+				slug: organizationA,
+				createdAt: occurredAt,
+			},
+			{
+				id: organizationB,
+				name: "Tracking Sources B",
+				slug: organizationB,
+				createdAt: occurredAt,
+			},
+		],
+	});
+	await db.member.createMany({
+		data: [
+			{
+				id: `tracking-sources-member-a-${suffix}`,
+				organizationId: organizationA,
+				userId,
+				role: "owner",
+				createdAt: occurredAt,
+			},
+			{
+				id: `tracking-sources-member-b-${suffix}`,
+				organizationId: organizationB,
+				userId,
+				role: "owner",
+				createdAt: occurredAt,
+			},
+		],
+	});
+	await createTenantRows(
+		[
+			{
+				id: contactA,
+				organizationId: organizationA,
+				firstName: "Source A",
+			},
+			{
+				id: contactB,
+				organizationId: organizationB,
+				firstName: "Source B",
+			},
+		],
+		(data) => scopedDb.contact.create({ data: data as never }),
+	);
+	await createTenantRows(
+		[
+			{
+				id: visitorA,
+				organizationId: organizationA,
+				contactId: contactA,
+				firstSource: "Google",
+				firstMedium: "organic",
+				firstSeen: occurredAt,
+				lastSeen: occurredAt,
+			},
+			{
+				id: visitorB,
+				organizationId: organizationB,
+				contactId: contactB,
+				firstSource: "Google",
+				firstMedium: "organic",
+				firstSeen: occurredAt,
+				lastSeen: occurredAt,
+			},
+		],
+		(data) => scopedDb.trackedVisitor.create({ data: data as never }),
+	);
+	await createTenantRows(
+		[
+			{
+				organizationId: organizationA,
+				visitorId: visitorA,
+				type: "page_view",
+				host: "a.example.test",
+				path: "/one",
+				source: "Google",
+				medium: "organic",
+				occurredAt,
+			},
+			{
+				organizationId: organizationA,
+				visitorId: visitorA,
+				type: "page_view",
+				host: "a.example.test",
+				path: "/two",
+				source: "Newsletter",
+				medium: "email",
+				occurredAt,
+			},
+			{
+				organizationId: organizationB,
+				visitorId: visitorB,
+				type: "page_view",
+				host: "b.example.test",
+				path: "/one",
+				source: "Google",
+				medium: "organic",
+				occurredAt,
+			},
+			{
+				organizationId: organizationB,
+				visitorId: visitorB,
+				type: "page_view",
+				host: "b.example.test",
+				path: "/two",
+				source: "Google",
+				medium: "organic",
+				occurredAt,
+			},
+		],
+		(data) => scopedDb.trackedEvent.create({ data: data as never }),
+	);
+});
+
+afterAll(async () => {
+	await db.organization.deleteMany({
+		where: { id: { in: [organizationA, organizationB] } },
+	});
+	await db.user.delete({ where: { id: userId } });
+});
+
+describe("tracking sources across workspaces", () => {
+	it("returns only the active workspace source totals", async () => {
+		const raw = new TrackingService(
+			scopedDb as never,
+			{} as TrackingConfigService,
+		);
+		const service = tenantBound(organizationA, raw);
+
+		const sources = await service.sources(userId);
+
+		expect(sources).toEqual([
+			{ source: "Google", medium: "organic", views: 1, contacts: 1 },
+			{ source: "Newsletter", medium: "email", views: 1, contacts: 0 },
+		]);
+	});
+});
diff --git a/apps/api/test/workspace-gate.spec.ts b/apps/api/test/workspace-gate.spec.ts
new file mode 100644
index 000000000..67432fd68
--- /dev/null
+++ b/apps/api/test/workspace-gate.spec.ts
@@ -0,0 +1,64 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { WorkspaceService } from "../src/workspace/workspace.service";
+
+const suffix =
+	process.env.TEST_RUN_ID ?? `workspace-gate-${crypto.randomUUID()}`;
+const organizationId = `${suffix}-organization`;
+const userId = `${suffix}-user`;
+const memberId = `${suffix}-member`;
+const service = new WorkspaceService(db, {} as never);
+
+beforeAll(async () => {
+	await db.organization.create({
+		data: {
+			id: organizationId,
+			name: "Workspace Gate",
+			slug: `${suffix}-slug`,
+			metadata: JSON.stringify({ onboardedAt: new Date().toISOString() }),
+			createdAt: new Date(),
+		},
+	});
+	await db.user.create({
+		data: {
+			id: userId,
+			name: "Workspace Gate User",
+			email: `${userId}@example.test`,
+		},
+	});
+	await db.member.create({
+		data: {
+			id: memberId,
+			organizationId,
+			userId,
+			role: "owner",
+			createdAt: new Date(),
+		},
+	});
+});
+
+afterAll(async () => {
+	await db.member.deleteMany({ where: { id: memberId } });
+	await db.user.deleteMany({ where: { id: userId } });
+	await db.organization.deleteMany({ where: { id: organizationId } });
+});
+
+describe("WorkspaceService.gate", () => {
+	it("returns an explicit no-organization result", async () => {
+		expect(await service.gate(userId, null)).toEqual({
+			organizationId: null,
+			slug: null,
+			onboarded: null,
+			canRename: null,
+		});
+	});
+
+	it("returns the active member organization gate", async () => {
+		expect(await service.gate(userId, organizationId)).toEqual({
+			organizationId,
+			slug: `${suffix}-slug`,
+			onboarded: true,
+			canRename: true,
+		});
+	});
+});
diff --git a/apps/api/test/workspace.fixture.ts b/apps/api/test/workspace.fixture.ts
new file mode 100644
index 000000000..e02456f36
--- /dev/null
+++ b/apps/api/test/workspace.fixture.ts
@@ -0,0 +1,27 @@
+import { db } from "@crm/db";
+import { workspaceSlug } from "@crm/db/workspace-slug";
+
+export async function ensureTestWorkspace(
+	id: string,
+	name: string,
+): Promise<void> {
+	await db.organization.upsert({
+		where: { id },
+		update: {},
+		create: { id, name, slug: workspaceSlug(name), createdAt: new Date() },
+	});
+}
+
+export async function createTestMembers(
+	organizationId: string,
+	members: Array<{ id: string; userId: string }>,
+): Promise<void> {
+	await db.member.createMany({
+		data: members.map((member) => ({
+			...member,
+			organizationId,
+			role: "member" as const,
+			createdAt: new Date(),
+		})),
+	});
+}
diff --git a/apps/api/turbo.json b/apps/api/turbo.json
index 04699fe51..734740578 100644
--- a/apps/api/turbo.json
+++ b/apps/api/turbo.json
@@ -1,5 +1,5 @@
 {
-	"$schema": "https://turborepo.dev/schema.json",
+	"$schema": "https://v2-10-12.turborepo.dev/schema.json",
 	"extends": ["//"],
 	"tasks": {
 		"build": {
@@ -31,6 +31,10 @@
 				"MICROSOFT_CLIENT_ID",
 				"MICROSOFT_CLIENT_SECRET",
 				"MICROSOFT_TENANT_ID",
+				"R2_ACCOUNT_ID",
+				"R2_ACCESS_KEY_ID",
+				"R2_SECRET_ACCESS_KEY",
+				"R2_BUCKET",
 				"PORT",
 				"REDIS_URL"
 			]
@@ -49,6 +53,10 @@
 				"MICROSOFT_CLIENT_ID",
 				"MICROSOFT_CLIENT_SECRET",
 				"MICROSOFT_TENANT_ID",
+				"R2_ACCOUNT_ID",
+				"R2_ACCESS_KEY_ID",
+				"R2_SECRET_ACCESS_KEY",
+				"R2_BUCKET",
 				"PORT",
 				"REDIS_URL"
 			]
diff --git a/apps/api/vercel.json b/apps/api/vercel.json
index ffce1ccc0..8f0fc48b3 100644
--- a/apps/api/vercel.json
+++ b/apps/api/vercel.json
@@ -20,6 +20,10 @@
 		{
 			"path": "/internal/archive/prune",
 			"schedule": "0 5 * * *"
+		},
+		{
+			"path": "/internal/assets/process",
+			"schedule": "* * * * *"
 		}
 	]
 }
diff --git a/apps/app/app/(app)/[slug]/forbidden.tsx b/apps/app/app/(app)/[slug]/forbidden.tsx
new file mode 100644
index 000000000..be43aac99
--- /dev/null
+++ b/apps/app/app/(app)/[slug]/forbidden.tsx
@@ -0,0 +1,30 @@
+import { Button } from "@crm/ui/components/button";
+import {
+	Card,
+	CardContent,
+	CardDescription,
+	CardHeader,
+	CardTitle,
+} from "@crm/ui/components/card";
+
+export default function Forbidden() {
+	return (
+		<div className="flex h-svh items-center justify-center p-6">
+			<Card className="max-w-sm">
+				<CardHeader>
+					<CardTitle>You do not have access to this workspace</CardTitle>
+					<CardDescription>
+						You do not have access to this workspace. Ask an admin of this
+						organization to add you, or switch to a workspace you already have
+						access to.
+					</CardDescription>
+				</CardHeader>
+				<CardContent>
+					<Button asChild>
+						<a href="/sign-in">Back to sign in</a>
+					</Button>
+				</CardContent>
+			</Card>
+		</div>
+	);
+}
diff --git a/apps/app/app/(app)/[slug]/layout.tsx b/apps/app/app/(app)/[slug]/layout.tsx
index 863d0da85..1ab498180 100644
--- a/apps/app/app/(app)/[slug]/layout.tsx
+++ b/apps/app/app/(app)/[slug]/layout.tsx
@@ -1,4 +1,6 @@
-import { notFound, unstable_rethrow } from "next/navigation";
+import { auth } from "@crm/auth";
+import { headers } from "next/headers";
+import { forbidden, notFound, redirect } from "next/navigation";
 import { connection } from "next/server";
 import { Suspense } from "react";
 import { AppHeader, AppHeaderFallback } from "@/components/app-header";
@@ -7,8 +9,8 @@ import { QuickSwitcher } from "@/components/crm/quick-switcher";
 import { RecordSheetHost } from "@/components/crm/record-sheet/record-sheet-host";
 import { MobileNavProvider } from "@/components/mobile-nav";
 import { requireMailboxAccess } from "@/lib/session";
+import { resolveTenantForSlug } from "@/lib/tenant-gate";
 import { HydrateClient } from "@/lib/trpc/hydrate";
-import { getServerQueryClient, getServerTrpc } from "@/lib/trpc/server";
 
 export default function AppLayout({
 	children,
@@ -40,28 +42,32 @@ export default function AppLayout({
 	);
 }
 
-async function loadWorkspace() {
-	try {
-		return await getServerQueryClient().fetchQuery(
-			getServerTrpc().workspace.get.queryOptions(),
-		);
-	} catch (error) {
-		unstable_rethrow(error);
-		return null;
-	}
-}
-
 async function WorkspaceHeader({
 	params,
 }: Pick<LayoutProps<"/[slug]">, "params">) {
 	await connection();
-	const [{ user }, { slug }, workspace] = await Promise.all([
+	const [session, { slug }] = await Promise.all([
 		requireMailboxAccess(),
 		params,
-		loadWorkspace(),
 	]);
+	const gate = await resolveTenantForSlug(
+		slug,
+		session.user.id,
+		session.session.activeOrganizationId,
+	);
 
-	if (workspace && workspace.slug !== slug) notFound();
+	if (gate.status === "not-found") notFound();
+	if (gate.status === "forbidden") forbidden();
+
+	if (gate.needsActiveOrgSwitch) {
+		await auth.api.setActiveOrganization({
+			headers: await headers(),
+			body: { organizationId: gate.organization.id },
+		});
+		redirect(`/${gate.organization.slug}`);
+	}
+
+	const { user } = session;
 
 	return (
 		<HydrateClient>
@@ -71,6 +77,10 @@ async function WorkspaceHeader({
 					email: user.email,
 					image: user.image ?? null,
 				}}
+				organizationSwitcher={{
+					current: gate.organization,
+					options: gate.organizations,
+				}}
 			/>
 		</HydrateClient>
 	);
diff --git a/apps/app/app/(app)/[slug]/settings/connections/slack/slack-connect-button.tsx b/apps/app/app/(app)/[slug]/settings/connections/slack/slack-connect-button.tsx
index 74b7fc389..5a463f458 100644
--- a/apps/app/app/(app)/[slug]/settings/connections/slack/slack-connect-button.tsx
+++ b/apps/app/app/(app)/[slug]/settings/connections/slack/slack-connect-button.tsx
@@ -30,8 +30,8 @@ const CONNECT_ERRORS = new Map([
 
 async function startSlackOAuth(slug: string) {
 	try {
-		const { error } = await authClient.oauth2.link({
-			providerId: "slack",
+		const { error } = await authClient.linkSocial({
+			provider: "slack",
 			callbackURL: `${window.location.origin}/${slug}/settings/connections/slack/people`,
 			errorCallbackURL: `${window.location.origin}/${slug}/settings/connections/slack?provider=slack`,
 		});
diff --git a/apps/app/app/(app)/[slug]/settings/page.tsx b/apps/app/app/(app)/[slug]/settings/page.tsx
index 284c9f0e8..5796d96c3 100644
--- a/apps/app/app/(app)/[slug]/settings/page.tsx
+++ b/apps/app/app/(app)/[slug]/settings/page.tsx
@@ -1,3 +1,4 @@
+import { CONTEXT_DEV_SIGNUP_URL } from "@crm/db/settings";
 import type { Metadata } from "next";
 import { Suspense } from "react";
 import {
@@ -60,7 +61,7 @@ async function Settings() {
 		<HydrateClient>
 			<div className="flex max-w-3xl flex-col gap-6">
 				<WorkspaceForm />
-				<ResearchKey />
+				<ResearchKey signupUrl={CONTEXT_DEV_SIGNUP_URL} />
 				<ArchiveRetention />
 				<AgentModel />
 			</div>
diff --git a/apps/app/app/(app)/[slug]/settings/research-key.tsx b/apps/app/app/(app)/[slug]/settings/research-key.tsx
index 3c5dab1a4..563a536b3 100644
--- a/apps/app/app/(app)/[slug]/settings/research-key.tsx
+++ b/apps/app/app/(app)/[slug]/settings/research-key.tsx
@@ -1,6 +1,5 @@
 "use client";
 
-import { CONTEXT_DEV_SIGNUP_URL } from "@crm/db/settings";
 import { Button } from "@crm/ui/components/button";
 import {
 	Card,
@@ -25,7 +24,7 @@ import { toast } from "sonner";
 import { useCrmCache } from "@/lib/trpc/cache";
 import { useTRPC } from "@/lib/trpc/client";
 
-export function ResearchKey() {
+export function ResearchKey({ signupUrl }: { signupUrl: string }) {
 	const trpc = useTRPC();
 	const cache = useCrmCache();
 
@@ -103,7 +102,7 @@ export function ResearchKey() {
 							<FieldDescription>
 								Don't have a Context API key?{" "}
 								<a
-									href={CONTEXT_DEV_SIGNUP_URL}
+									href={signupUrl}
 									target="_blank"
 									rel="noreferrer"
 									className="underline underline-offset-4 hover:text-foreground"
diff --git a/apps/app/app/(landing)/no-organization/page.tsx b/apps/app/app/(landing)/no-organization/page.tsx
new file mode 100644
index 000000000..7fc54ad3d
--- /dev/null
+++ b/apps/app/app/(landing)/no-organization/page.tsx
@@ -0,0 +1,26 @@
+import {
+	Card,
+	CardContent,
+	CardDescription,
+	CardHeader,
+	CardTitle,
+} from "@crm/ui/components/card";
+import { SignOutButton } from "./sign-out-button";
+
+export default function NoOrganizationPage() {
+	return (
+		<div className="flex h-svh items-center justify-center p-6">
+			<Card className="max-w-sm">
+				<CardHeader>
+					<CardTitle>You are not part of a workspace yet</CardTitle>
+					<CardDescription>
+						An admin must add you to an organization before you can use the CRM.
+					</CardDescription>
+				</CardHeader>
+				<CardContent>
+					<SignOutButton />
+				</CardContent>
+			</Card>
+		</div>
+	);
+}
diff --git a/apps/app/app/(landing)/no-organization/sign-out-button.tsx b/apps/app/app/(landing)/no-organization/sign-out-button.tsx
new file mode 100644
index 000000000..fb6527944
--- /dev/null
+++ b/apps/app/app/(landing)/no-organization/sign-out-button.tsx
@@ -0,0 +1,17 @@
+"use client";
+
+import { Button } from "@crm/ui/components/button";
+import { toast } from "sonner";
+import { signOutAndRedirect } from "@/lib/sign-out";
+
+export function SignOutButton() {
+	return (
+		<Button
+			onClick={() => {
+				signOutAndRedirect().catch(() => toast.error("Could not sign out."));
+			}}
+		>
+			Sign out
+		</Button>
+	);
+}
diff --git a/apps/app/app/(landing)/oauth/consent/consent-form.tsx b/apps/app/app/(landing)/oauth/consent/consent-form.tsx
new file mode 100644
index 000000000..254010f00
--- /dev/null
+++ b/apps/app/app/(landing)/oauth/consent/consent-form.tsx
@@ -0,0 +1,56 @@
+"use client";
+
+import { authClient } from "@crm/auth/client";
+import { Button } from "@crm/ui/components/button";
+import { Spinner } from "@crm/ui/components/spinner";
+import { useState } from "react";
+import { toast } from "sonner";
+
+export type ConsentFormProps = {
+	oauthQuery: string;
+};
+
+export function ConsentForm({ oauthQuery }: ConsentFormProps) {
+	const [pending, setPending] = useState<"approve" | "deny" | null>(null);
+
+	async function decide(accept: boolean) {
+		setPending(accept ? "approve" : "deny");
+		try {
+			const { data, error } = await authClient.oauth2.consent({
+				accept,
+				oauth_query: oauthQuery,
+			});
+			if (error || !data || !("url" in data)) {
+				toast.error(error?.message ?? "Could not complete authorization.");
+				setPending(null);
+				return;
+			}
+			window.location.assign(data.url);
+		} catch {
+			toast.error("Could not complete authorization.");
+			setPending(null);
+		}
+	}
+
+	return (
+		<div className="grid gap-3 sm:grid-cols-2">
+			<Button
+				disabled={pending !== null}
+				onClick={() => void decide(false)}
+				type="button"
+				variant="outline"
+			>
+				{pending === "deny" ? <Spinner data-icon="inline-start" /> : null}
+				Deny
+			</Button>
+			<Button
+				disabled={pending !== null}
+				onClick={() => void decide(true)}
+				type="button"
+			>
+				{pending === "approve" ? <Spinner data-icon="inline-start" /> : null}
+				Approve
+			</Button>
+		</div>
+	);
+}
diff --git a/apps/app/app/(landing)/oauth/consent/page.tsx b/apps/app/app/(landing)/oauth/consent/page.tsx
new file mode 100644
index 000000000..6179cca64
--- /dev/null
+++ b/apps/app/app/(landing)/oauth/consent/page.tsx
@@ -0,0 +1,92 @@
+import { auth, isOAuthScope, type OAuthScope, parseScopes } from "@crm/auth";
+import { db } from "@crm/db";
+import type { Metadata } from "next";
+import { headers } from "next/headers";
+import { redirect } from "next/navigation";
+import {
+	AuthHeading,
+	AuthShell,
+	InvalidOAuthRequest,
+} from "@/components/auth-shell";
+import { consentSearchParams, serializeOAuthQuery } from "@/lib/oauth-query";
+import { getSession } from "@/lib/session";
+import { ConsentForm } from "./consent-form";
+
+export const metadata: Metadata = {
+	title: "Authorize application",
+};
+
+export const instant = false;
+
+type OAuthConsentPageProps = {
+	searchParams: Promise<Record<string, string | string[] | undefined>>;
+};
+
+const PERMISSIONS = {
+	openid: "Confirm your identity",
+	profile: "Read your profile",
+	email: "Read your email address",
+	offline_access: "Keep access after you close the application",
+	"crm.read": "Read CRM records",
+	"crm.write": "Create and change CRM records",
+} as const satisfies Record<OAuthScope, string>;
+
+export default async function OAuthConsentPage({
+	searchParams,
+}: OAuthConsentPageProps) {
+	const parsedParams = consentSearchParams.safeParse(await searchParams);
+	if (!parsedParams.success) {
+		return (
+			<AuthShell>
+				<InvalidOAuthRequest />
+			</AuthShell>
+		);
+	}
+	const params = parsedParams.data;
+	const oauthQuery = serializeOAuthQuery(params);
+
+	const session = await getSession();
+	if (!session) redirect(`/sign-in?${oauthQuery}`);
+	const organizationId = session.session.activeOrganizationId;
+	if (!organizationId) redirect("/no-organization");
+
+	const membership = await db.member.findUnique({
+		where: {
+			organizationId_userId: {
+				organizationId,
+				userId: session.user.id,
+			},
+		},
+		select: { organization: { select: { name: true } } },
+	});
+	if (!membership) redirect("/no-organization");
+
+	const client = await auth.api.getOAuthClientPublic({
+		query: { client_id: params.client_id },
+		headers: await headers(),
+	});
+	const scopes = [...parseScopes(params.scope)];
+
+	return (
+		<AuthShell>
+			<AuthHeading
+				title={`Authorize ${client.client_name ?? client.client_id}`}
+				description={`Grant access to ${membership.organization.name} as ${session.user.email}`}
+			/>
+			<div className="space-y-4">
+				<p className="text-muted-foreground text-sm">
+					This application requests these permissions:
+				</p>
+				<ul className="list-disc space-y-2 pl-5 text-sm">
+					{scopes.map((scope) => (
+						<li key={scope}>{permissionLabel(scope)}</li>
+					))}
+				</ul>
+				<ConsentForm oauthQuery={oauthQuery} />
+			</div>
+		</AuthShell>
+	);
+}
+function permissionLabel(scope: string): string {
+	return isOAuthScope(scope) ? PERMISSIONS[scope] : scope;
+}
diff --git a/apps/app/app/(landing)/onboarding/onboarding-form.tsx b/apps/app/app/(landing)/onboarding/onboarding-form.tsx
index 7f813dbb5..63d40435f 100644
--- a/apps/app/app/(landing)/onboarding/onboarding-form.tsx
+++ b/apps/app/app/(landing)/onboarding/onboarding-form.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import { workspaceSlug } from "@crm/db/workspace";
+import { workspaceSlug } from "@crm/db/workspace-slug";
 import { Button } from "@crm/ui/components/button";
 import {
 	Field,
@@ -37,7 +37,7 @@ export function OnboardingForm({ placeholder }: { placeholder: string }) {
 		trpc.workspace.update.mutationOptions({
 			onSuccess: () => {
 				router.refresh();
-				router.replace("/onboarding/research");
+				router.replace("/");
 			},
 			onError: (error) => toast.error(error.message),
 		}),
diff --git a/apps/app/app/(landing)/onboarding/page.tsx b/apps/app/app/(landing)/onboarding/page.tsx
index c6133f3b8..aaf5cf444 100644
--- a/apps/app/app/(landing)/onboarding/page.tsx
+++ b/apps/app/app/(landing)/onboarding/page.tsx
@@ -1,4 +1,3 @@
-import { DEFAULT_WORKSPACE_NAME } from "@crm/auth";
 import type { Metadata } from "next";
 import { AuthHeading, AuthShell } from "@/components/auth-shell";
 import { requireMailboxAccess } from "@/lib/session";
@@ -20,7 +19,7 @@ export default async function OnboardingPage() {
 				description="Two things, once. The name is what the CRM calls you; the website is how the agent learns what you sell."
 			/>
 
-			<OnboardingForm placeholder={DEFAULT_WORKSPACE_NAME} />
+			<OnboardingForm placeholder="CRM" />
 		</AuthShell>
 	);
 }
diff --git a/apps/app/app/(landing)/onboarding/research/page.tsx b/apps/app/app/(landing)/onboarding/research/page.tsx
index 4fc83d2d7..951cdd012 100644
--- a/apps/app/app/(landing)/onboarding/research/page.tsx
+++ b/apps/app/app/(landing)/onboarding/research/page.tsx
@@ -1,25 +1,9 @@
-import type { Metadata } from "next";
-import { AuthHeading, AuthShell } from "@/components/auth-shell";
+import { redirect } from "next/navigation";
 import { requireMailboxAccess } from "@/lib/session";
-import { ResearchForm } from "./research-form";
-
-export const metadata: Metadata = {
-	title: "Research key",
-};
 
 export const instant = false;
 
 export default async function ResearchKeyPage() {
 	await requireMailboxAccess();
-
-	return (
-		<AuthShell>
-			<AuthHeading
-				title="Level up your CRM data"
-				description="Power your research agent with Context to research every company added to your CRM."
-			/>
-
-			<ResearchForm />
-		</AuthShell>
-	);
+	redirect("/");
 }
diff --git a/apps/app/app/(landing)/onboarding/research/research-form.tsx b/apps/app/app/(landing)/onboarding/research/research-form.tsx
deleted file mode 100644
index 30887d2eb..000000000
--- a/apps/app/app/(landing)/onboarding/research/research-form.tsx
+++ /dev/null
@@ -1,79 +0,0 @@
-"use client";
-
-import { CONTEXT_DEV_SIGNUP_URL } from "@crm/db/settings";
-import { Button } from "@crm/ui/components/button";
-import {
-	Field,
-	FieldDescription,
-	FieldGroup,
-	FieldLabel,
-} from "@crm/ui/components/field";
-import { Input } from "@crm/ui/components/input";
-import { Spinner } from "@crm/ui/components/spinner";
-import { useMutation } from "@tanstack/react-query";
-import { useRouter } from "next/navigation";
-import { useId } from "react";
-import { toast } from "sonner";
-import { useTRPC } from "@/lib/trpc/client";
-
-export function ResearchForm() {
-	const trpc = useTRPC();
-	const router = useRouter();
-
-	const keyId = useId();
-
-	const save = useMutation(
-		trpc.settings.setResearchKey.mutationOptions({
-			onSuccess: () => {
-				router.refresh();
-				router.replace("/");
-			},
-			onError: (error) => toast.error(error.message),
-		}),
-	);
-
-	return (
-		<form
-			onSubmit={(event) => {
-				event.preventDefault();
-				const form = new FormData(event.currentTarget);
-				save.mutate({ apiKey: String(form.get("apiKey") ?? "").trim() });
-			}}
-			className="flex flex-col gap-6"
-		>
-			<FieldGroup>
-				<Field>
-					<FieldLabel htmlFor={keyId}>Context API key</FieldLabel>
-					<Input
-						id={keyId}
-						name="apiKey"
-						type="password"
-						placeholder="Paste the key"
-						autoComplete="off"
-						autoCapitalize="off"
-						autoCorrect="off"
-						spellCheck={false}
-						autoFocus
-						required
-					/>
-					<FieldDescription>
-						Don't have a Context API key?{" "}
-						<a
-							href={CONTEXT_DEV_SIGNUP_URL}
-							target="_blank"
-							rel="noreferrer"
-							className="underline underline-offset-4 hover:text-foreground"
-						>
-							Sign up here
-						</a>
-					</FieldDescription>
-				</Field>
-			</FieldGroup>
-
-			<Button type="submit" disabled={save.isPending}>
-				{save.isPending ? <Spinner data-icon="inline-start" /> : null}
-				Continue
-			</Button>
-		</form>
-	);
-}
diff --git a/apps/app/app/(landing)/sign-in/page.tsx b/apps/app/app/(landing)/sign-in/page.tsx
index 5b0e451af..f79556472 100644
--- a/apps/app/app/(landing)/sign-in/page.tsx
+++ b/apps/app/app/(landing)/sign-in/page.tsx
@@ -1,8 +1,15 @@
+import { auth } from "@crm/auth";
 import type { MailboxProviderId } from "@crm/auth/scopes";
 import type { Metadata } from "next";
+import { headers } from "next/headers";
 import { redirect, unstable_rethrow } from "next/navigation";
 import { Suspense } from "react";
-import { AuthHeading, AuthShell } from "@/components/auth-shell";
+import {
+	AuthHeading,
+	AuthShell,
+	InvalidOAuthRequest,
+} from "@/components/auth-shell";
+import { serializeOAuthQuery, signInSearchParams } from "@/lib/oauth-query";
 import { getSession } from "@/lib/session";
 import { getServerQueryClient, getServerTrpc } from "@/lib/trpc/server";
 import { SocialSignIn } from "./social-sign-in";
@@ -60,13 +67,29 @@ export default function SignInPage({ searchParams }: PageProps<"/sign-in">) {
 async function SignIn({
 	searchParams,
 }: Pick<PageProps<"/sign-in">, "searchParams">) {
-	const [session, options, { method }] = await Promise.all([
+	const [session, options, params] = await Promise.all([
 		currentSession(),
 		signInOptions(),
 		searchParams,
 	]);
+	const parsedParams = signInSearchParams.safeParse(params);
+	if (!parsedParams.success) {
+		return <InvalidOAuthRequest />;
+	}
+	const parsedSearchParams = parsedParams.data;
+	const oauthQuery = parsedSearchParams.sig
+		? serializeOAuthQuery(parsedSearchParams)
+		: null;
+	const method = parsedSearchParams.method;
 
 	if (session) {
+		if (oauthQuery) {
+			const continuation = await auth.api.oauth2Continue({
+				body: { oauth_query: oauthQuery },
+				headers: await headers(),
+			});
+			if ("url" in continuation) redirect(continuation.url);
+		}
 		redirect("/");
 	}
 
@@ -110,9 +133,15 @@ async function SignIn({
 				description="Sign in with your account to continue."
 			/>
 
-			{showSso ? <SsoSignIn providers={providers} /> : null}
+			{showSso ? (
+				<SsoSignIn providers={providers} oauthQuery={oauthQuery} />
+			) : null}
 			{social.map((provider) => (
-				<SocialSignIn key={provider} provider={provider} />
+				<SocialSignIn
+					key={provider}
+					provider={provider}
+					oauthQuery={oauthQuery}
+				/>
 			))}
 		</>
 	);
diff --git a/apps/app/app/(landing)/sign-in/social-sign-in.tsx b/apps/app/app/(landing)/sign-in/social-sign-in.tsx
index 882f89c12..f3e7df734 100644
--- a/apps/app/app/(landing)/sign-in/social-sign-in.tsx
+++ b/apps/app/app/(landing)/sign-in/social-sign-in.tsx
@@ -9,6 +9,7 @@ import { Spinner } from "@crm/ui/components/spinner";
 import type { FC, SVGProps } from "react";
 import { useState } from "react";
 import { toast } from "sonner";
+import { oauthSignInOptions } from "@/lib/oauth-query";
 
 type ProviderChoice = {
 	label: string;
@@ -20,7 +21,13 @@ const PROVIDERS = {
 	microsoft: { label: "Continue with Microsoft", Logo: MicrosoftLogo },
 } as const satisfies Record<MailboxProviderId, ProviderChoice>;
 
-export function SocialSignIn({ provider }: { provider: MailboxProviderId }) {
+export function SocialSignIn({
+	provider,
+	oauthQuery,
+}: {
+	provider: MailboxProviderId;
+	oauthQuery: string | null;
+}) {
 	const [pending, setPending] = useState(false);
 
 	const { label, Logo } = PROVIDERS[provider];
@@ -38,7 +45,7 @@ export function SocialSignIn({ provider }: { provider: MailboxProviderId }) {
 		const { error } = await signIn.social({
 			provider,
 			callbackURL: `${origin}/`,
-			errorCallbackURL: `${origin}/sign-in`,
+			...oauthSignInOptions(oauthQuery, origin),
 		});
 
 		if (error) fail(error.message);
diff --git a/apps/app/app/(landing)/sign-in/sso-sign-in.tsx b/apps/app/app/(landing)/sign-in/sso-sign-in.tsx
index 623592766..51c836351 100644
--- a/apps/app/app/(landing)/sign-in/sso-sign-in.tsx
+++ b/apps/app/app/(landing)/sign-in/sso-sign-in.tsx
@@ -5,13 +5,20 @@ import { Button } from "@crm/ui/components/button";
 import { Spinner } from "@crm/ui/components/spinner";
 import { useState } from "react";
 import { toast } from "sonner";
+import { oauthSignInOptions } from "@/lib/oauth-query";
 
 export type SsoProvider = {
 	providerId: string;
 	name: string;
 };
 
-export function SsoSignIn({ providers }: { providers: SsoProvider[] }) {
+export function SsoSignIn({
+	providers,
+	oauthQuery,
+}: {
+	providers: SsoProvider[];
+	oauthQuery: string | null;
+}) {
 	const [pending, setPending] = useState<string | null>(null);
 
 	async function handleClick(providerId: string) {
@@ -22,7 +29,7 @@ export function SsoSignIn({ providers }: { providers: SsoProvider[] }) {
 		const { error } = await signIn.sso({
 			providerId,
 			callbackURL: `${origin}/`,
-			errorCallbackURL: `${origin}/sign-in`,
+			...oauthSignInOptions(oauthQuery, origin),
 		});
 
 		if (error) {
diff --git a/apps/app/app/(legal)/layout.tsx b/apps/app/app/(legal)/layout.tsx
new file mode 100644
index 000000000..25a3e1218
--- /dev/null
+++ b/apps/app/app/(legal)/layout.tsx
@@ -0,0 +1,27 @@
+import Link from "next/link";
+import type { ReactNode } from "react";
+import { LandingNav } from "@/components/landing/landing-nav";
+
+export default function LegalLayout({ children }: { children: ReactNode }) {
+	return (
+		<div className="dark flex min-h-svh flex-col bg-background text-foreground">
+			<LandingNav />
+			<main className="mx-auto w-full max-w-3xl flex-1 px-6 py-12 sm:py-16">
+				{children}
+			</main>
+			<footer className="border-border border-t">
+				<nav className="mx-auto flex w-full max-w-3xl flex-wrap gap-5 px-6 py-6 text-muted-foreground text-sm">
+					<Link className="hover:text-foreground" href="/">
+						JobSteward
+					</Link>
+					<Link className="hover:text-foreground" href="/privacy">
+						Privacy
+					</Link>
+					<Link className="hover:text-foreground" href="/terms">
+						Terms
+					</Link>
+				</nav>
+			</footer>
+		</div>
+	);
+}
diff --git a/apps/app/app/(legal)/privacy/page.tsx b/apps/app/app/(legal)/privacy/page.tsx
new file mode 100644
index 000000000..09521afcd
--- /dev/null
+++ b/apps/app/app/(legal)/privacy/page.tsx
@@ -0,0 +1,160 @@
+import { Link } from "@crm/ui/components/link";
+import type { Metadata } from "next";
+
+export const metadata: Metadata = {
+	title: "Privacy Policy",
+	description: "How JobSteward accesses, uses, stores, and shares user data.",
+};
+
+const sectionClass = "space-y-3";
+const headingClass = "font-semibold text-xl tracking-tight";
+const listClass = "list-disc space-y-2 pl-6 text-muted-foreground";
+
+export default function PrivacyPage() {
+	return (
+		<article className="space-y-10 text-[15px]/7">
+			<header className="space-y-3 border-border border-b pb-8">
+				<p className="font-mono text-muted-foreground text-xs uppercase tracking-widest">
+					JobSteward
+				</p>
+				<h1 className="font-semibold text-4xl tracking-tight">
+					Privacy Policy
+				</h1>
+				<p className="text-muted-foreground">Effective September 6, 2026</p>
+			</header>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Who we are</h2>
+				<p className="text-muted-foreground">
+					JobSteward is an agentic customer relationship management service
+					operated by Majestic Labs. This policy explains how JobSteward handles
+					personal information and Google user data.
+				</p>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Information we collect</h2>
+				<ul className={listClass}>
+					<li>
+						Account information, such as your name, email address, profile
+						image, and authentication identifiers.
+					</li>
+					<li>
+						CRM information that you or your workspace adds, such as contacts,
+						companies, deals, notes, settings, and agent instructions.
+					</li>
+					<li>
+						Service information, such as session, security, error, and usage
+						records needed to operate and protect JobSteward.
+					</li>
+				</ul>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Google user data</h2>
+				<p className="text-muted-foreground">
+					When you connect a Google account, JobSteward requests read-only
+					access to Gmail and Google Calendar. Depending on the access you
+					grant, this can include email messages, threads, message metadata and
+					settings, and calendar names, events, times, attendees, descriptions,
+					locations, and conference links. JobSteward also receives your basic
+					Google profile information for sign-in.
+				</p>
+				<p className="text-muted-foreground">
+					JobSteward uses this data to authenticate you, sync email and calendar
+					activity into your CRM, match activity to contacts and companies, and
+					provide the search and assistant features that your workspace
+					requests. JobSteward does not send email, change calendars, or act
+					through your Google account with these read-only permissions.
+				</p>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>How we use information</h2>
+				<ul className={listClass}>
+					<li>Provide, maintain, and secure JobSteward.</li>
+					<li>
+						Show CRM records and connected account activity to your workspace.
+					</li>
+					<li>
+						Run sync, search, automation, and assistant features that users
+						request.
+					</li>
+					<li>Respond to support requests and comply with applicable law.</li>
+				</ul>
+				<p className="text-muted-foreground">
+					When a workspace user requests an AI feature, JobSteward can send the
+					content needed for that request to the AI service selected for the
+					workspace. JobSteward does not use Google user data for advertising,
+					credit decisions, or to train its own general-purpose AI models.
+				</p>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>How we share information</h2>
+				<p className="text-muted-foreground">
+					We share information only with authorized workspace members, service
+					providers that help us host and operate JobSteward, and authorities
+					when required by law or needed to protect the service. A service
+					provider can use information only to perform services for us. We do
+					not sell personal information or Google user data.
+				</p>
+				<p className="text-muted-foreground">
+					Humans do not read Google user data unless you ask us to inspect
+					specific data for support, access is necessary for security, or access
+					is required by law.
+				</p>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Google API Limited Use</h2>
+				<p className="text-muted-foreground">
+					JobSteward&apos;s use and transfer of information received from Google
+					APIs follows the{" "}
+					<Link href="https://developers.google.com/terms/api-services-user-data-policy">
+						Google API Services User Data Policy
+					</Link>
+					, including the Limited Use requirements.
+				</p>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Storage and security</h2>
+				<p className="text-muted-foreground">
+					JobSteward stores account credentials and synced CRM data in its
+					service database. We use HTTPS, access controls, and managed
+					infrastructure to protect data. No method of storage or transmission
+					is completely secure.
+				</p>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Retention and deletion</h2>
+				<p className="text-muted-foreground">
+					We retain information while it is needed to provide JobSteward, meet
+					legal duties, resolve disputes, and protect the service. You can
+					revoke Google access from JobSteward&apos;s connection settings or
+					your Google Account. Revocation stops future access. You can
+					separately delete the synced Gmail and Calendar data from
+					JobSteward&apos;s connection settings.
+				</p>
+				<p className="text-muted-foreground">
+					To request account or personal data deletion, email{" "}
+					<Link href="mailto:support@jobsteward.ai">support@jobsteward.ai</Link>
+					.
+				</p>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Changes and contact</h2>
+				<p className="text-muted-foreground">
+					We can update this policy as JobSteward changes. We will update the
+					effective date and give additional notice when a material change
+					requires it. Send privacy questions to{" "}
+					<Link href="mailto:support@jobsteward.ai">support@jobsteward.ai</Link>
+					.
+				</p>
+			</section>
+		</article>
+	);
+}
diff --git a/apps/app/app/(legal)/terms/page.tsx b/apps/app/app/(legal)/terms/page.tsx
new file mode 100644
index 000000000..f873ae774
--- /dev/null
+++ b/apps/app/app/(legal)/terms/page.tsx
@@ -0,0 +1,132 @@
+import { Link } from "@crm/ui/components/link";
+import type { Metadata } from "next";
+
+export const metadata: Metadata = {
+	title: "Terms of Service",
+	description: "Terms for using the JobSteward service.",
+};
+
+const sectionClass = "space-y-3";
+const headingClass = "font-semibold text-xl tracking-tight";
+const listClass = "list-disc space-y-2 pl-6 text-muted-foreground";
+
+export default function TermsPage() {
+	return (
+		<article className="space-y-10 text-[15px]/7">
+			<header className="space-y-3 border-border border-b pb-8">
+				<p className="font-mono text-muted-foreground text-xs uppercase tracking-widest">
+					JobSteward
+				</p>
+				<h1 className="font-semibold text-4xl tracking-tight">
+					Terms of Service
+				</h1>
+				<p className="text-muted-foreground">Effective September 6, 2026</p>
+			</header>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Agreement</h2>
+				<p className="text-muted-foreground">
+					These terms govern your use of JobSteward, an agentic customer
+					relationship management service operated by Majestic Labs. By using
+					JobSteward, you agree to these terms. A separate written agreement
+					takes priority if it conflicts with these terms.
+				</p>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Accounts and access</h2>
+				<ul className={listClass}>
+					<li>You must provide accurate account information.</li>
+					<li>You are responsible for activity through your account.</li>
+					<li>
+						You must protect your account and tell us about unauthorized access.
+					</li>
+					<li>
+						You must have authority to add data and connect third-party
+						accounts.
+					</li>
+				</ul>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Connected services</h2>
+				<p className="text-muted-foreground">
+					You can authorize JobSteward to read data from services such as Google
+					Gmail and Google Calendar. Your use of those services remains subject
+					to the provider&apos;s terms. You can revoke access at any time. Some
+					JobSteward features will stop working after you revoke access.
+				</p>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Your data</h2>
+				<p className="text-muted-foreground">
+					You keep your rights to the information that you provide. You give
+					Majestic Labs permission to host, process, copy, and transmit that
+					information only as needed to provide, secure, and support JobSteward.
+					You are responsible for the accuracy and legality of your data and for
+					giving required notices to other people whose information you add.
+				</p>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Acceptable use</h2>
+				<p className="text-muted-foreground">You must not:</p>
+				<ul className={listClass}>
+					<li>
+						Use JobSteward to break a law or another person&apos;s rights.
+					</li>
+					<li>Access an account, workspace, or data without permission.</li>
+					<li>Interfere with the service or bypass its security controls.</li>
+					<li>
+						Upload malware or use JobSteward to send abusive or deceptive
+						content.
+					</li>
+					<li>Resell the service unless Majestic Labs agrees in writing.</li>
+				</ul>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Service changes</h2>
+				<p className="text-muted-foreground">
+					We can change, suspend, or discontinue a feature. We aim to keep
+					JobSteward available, but we do not promise uninterrupted or
+					error-free operation. We can limit or suspend access when needed to
+					protect users, the service, or other people.
+				</p>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Warranty and liability</h2>
+				<p className="text-muted-foreground">
+					JobSteward is provided as available. To the extent permitted by law,
+					Majestic Labs disclaims implied warranties and is not liable for
+					indirect, incidental, special, consequential, or punitive damages, or
+					for lost profits, revenue, data, or business opportunities. These
+					limits do not apply where the law does not allow them.
+				</p>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Ending use</h2>
+				<p className="text-muted-foreground">
+					You can stop using JobSteward at any time. To request account
+					deletion, email{" "}
+					<Link href="mailto:support@jobsteward.ai">support@jobsteward.ai</Link>
+					. Terms that must continue by their nature, including ownership,
+					warranty, and liability terms, continue after access ends.
+				</p>
+			</section>
+
+			<section className={sectionClass}>
+				<h2 className={headingClass}>Changes and contact</h2>
+				<p className="text-muted-foreground">
+					We can update these terms. We will update the effective date and give
+					additional notice when required. Send questions about these terms to{" "}
+					<Link href="mailto:support@jobsteward.ai">support@jobsteward.ai</Link>
+					.
+				</p>
+			</section>
+		</article>
+	);
+}
diff --git a/apps/app/app/api/[...path]/route.ts b/apps/app/app/api/[...path]/route.ts
index 1b4211571..d2e9c5fe2 100644
--- a/apps/app/app/api/[...path]/route.ts
+++ b/apps/app/app/api/[...path]/route.ts
@@ -1,4 +1,5 @@
 import { connection } from "next/server";
+import { apiProxyPath } from "@/lib/api-proxy-path";
 import { bufferedProxyResponse } from "@/lib/api-proxy-response";
 import { API_URL } from "@/lib/env";
 
@@ -6,7 +7,7 @@ async function handler(request: Request): Promise<Response> {
 	await connection();
 
 	const url = new URL(request.url);
-	const target = `${API_URL}${url.pathname}${url.search}`;
+	const target = `${API_URL}${apiProxyPath(url.pathname)}${url.search}`;
 
 	const headers = new Headers(request.headers);
 	for (const header of [
diff --git a/apps/app/app/eve/v1/[...path]/route.ts b/apps/app/app/eve/v1/[...path]/route.ts
index 5c7e45084..24b0dd1fd 100644
--- a/apps/app/app/eve/v1/[...path]/route.ts
+++ b/apps/app/app/eve/v1/[...path]/route.ts
@@ -21,6 +21,13 @@ async function handler(request: Request): Promise<Response> {
 	if (!session) {
 		return Response.json({ error: "Not signed in." }, { status: 401 });
 	}
+	const organizationId = session.session.activeOrganizationId;
+	if (!organizationId) {
+		return Response.json(
+			{ error: "No organization is selected." },
+			{ status: 409 },
+		);
+	}
 
 	const url = new URL(request.url);
 	const target = `${AGENT_URL}${url.pathname}${url.search}`;
@@ -57,7 +64,7 @@ async function handler(request: Request): Promise<Response> {
 
 	if (requestedSession) {
 		const conversation = await db.agentConversation.findUnique({
-			where: { sessionId: requestedSession },
+			where: { sessionId: requestedSession, organizationId },
 			select: { userId: true },
 		});
 		if (conversation && conversation.userId !== session.user.id) {
@@ -72,6 +79,7 @@ async function handler(request: Request): Promise<Response> {
 		const conversation = await db.agentConversation.findFirst({
 			where: {
 				id: builderConversationId,
+				organizationId,
 				userId: session.user.id,
 				kind: "BUILDER",
 			},
@@ -96,6 +104,7 @@ async function handler(request: Request): Promise<Response> {
 				email: session.user.email,
 				name: session.user.name,
 			},
+			organizationId,
 			{
 				contactId: cuid(contactId),
 				companyId: cuid(companyId),
diff --git a/apps/app/components/agent-builder/agent-builder-chat.tsx b/apps/app/components/agent-builder/agent-builder-chat.tsx
index b2e3626ea..8165c6d8f 100644
--- a/apps/app/components/agent-builder/agent-builder-chat.tsx
+++ b/apps/app/components/agent-builder/agent-builder-chat.tsx
@@ -588,7 +588,7 @@ function BuilderEventFollower({
 		});
 
 		const follow = async () => {
-			const session = client.session({ sessionId, streamIndex: 0 });
+			const session = client.sessions.attach(sessionId, { streamIndex: 0 });
 			const snapshot = await session.snapshot({ signal: controller.signal });
 			if (controller.signal.aborted) return;
 			onSnapshot(snapshot.events);
diff --git a/apps/app/components/agent-builder/agent-code.tsx b/apps/app/components/agent-builder/agent-code.tsx
index a41f1617a..5b128cf25 100644
--- a/apps/app/components/agent-builder/agent-code.tsx
+++ b/apps/app/components/agent-builder/agent-code.tsx
@@ -8,13 +8,19 @@ import {
 	parseDiffFromFile,
 } from "@pierre/diffs";
 import { Editor, type EditorOptions } from "@pierre/diffs/edit";
-import { EditProvider, File, FileDiff, Virtualizer } from "@pierre/diffs/react";
+import {
+	type EditorFactory,
+	EditProvider,
+	File,
+	FileDiff,
+	Virtualizer,
+} from "@pierre/diffs/react";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { useCallback, useMemo, useRef, useState } from "react";
 import { toast } from "sonner";
 import { useTRPC } from "@/lib/trpc/client";
 
-const FILE_OPTIONS: FileOptions<undefined> = {
+const FILE_OPTIONS: FileOptions<undefined, undefined> = {
 	theme: { dark: "pierre-dark-soft", light: "pierre-light-soft" },
 	stickyHeader: true,
 };
@@ -30,9 +36,11 @@ const VIRTUALIZER_STYLE = {
 	overflow: "auto",
 } as const;
 
-function createEditor(options: EditorOptions<undefined>) {
-	return new Editor(options);
-}
+const createEditor: EditorFactory<undefined, undefined> = (
+	editorType,
+	options,
+	editStateKey,
+) => new Editor(editorType, options, editStateKey);
 
 export function AgentCode({
 	agentId,
@@ -50,7 +58,7 @@ export function AgentCode({
 	const [changed, setChanged] = useState<string[]>([]);
 	const [saving, setSaving] = useState(false);
 	const draft = useRef(new Map<string, string>());
-	const editorRef = useRef<Editor<undefined> | null>(null);
+	const editorRef = useRef<Editor<"file", undefined, undefined> | null>(null);
 
 	const code = useQuery(trpc.agents.files.queryOptions({ id: agentId }));
 	const files = code.data?.files ?? [];
@@ -98,16 +106,17 @@ export function AgentCode({
 		toast.success("Saved.");
 	}, [agentId, queryClient, save, trpc]);
 
-	const editorOptions = useMemo<EditorOptions<undefined>>(
+	const editorOptions = useMemo<EditorOptions<"file", undefined, undefined>>(
 		() => ({
 			persistState: true,
 			onAttach(editor) {
 				editorRef.current = editor;
 			},
-			onChange(next) {
-				draft.current.set(next.name, next.contents);
+			onChange(event) {
+				const file = event.file;
+				draft.current.set(file.name, file.contents);
 				setChanged((paths) =>
-					paths.includes(next.name) ? paths : [...paths, next.name],
+					paths.includes(file.name) ? paths : [...paths, file.name],
 				);
 			},
 		}),
diff --git a/apps/app/components/app-header.tsx b/apps/app/components/app-header.tsx
index 807d15bec..282021465 100644
--- a/apps/app/components/app-header.tsx
+++ b/apps/app/components/app-header.tsx
@@ -28,10 +28,19 @@ import { signOutAndRedirect } from "@/lib/sign-out";
 import { useTRPC } from "@/lib/trpc/client";
 import { useWorkspaceUrl } from "@/lib/use-workspace-url";
 import { workspaceLabel } from "@/lib/workspace-label";
+import { type OrgOption, OrgSwitcher } from "./org-switcher";
 
 type User = { name: string; email: string; image: string | null };
 
-export function AppHeader({ user }: { user: User }) {
+type OrganizationSwitcher = { current: OrgOption; options: OrgOption[] };
+
+export function AppHeader({
+	user,
+	organizationSwitcher,
+}: {
+	user: User;
+	organizationSwitcher: OrganizationSwitcher;
+}) {
 	const { setOpen: setMobileNavOpen } = useMobileNav();
 	const trpc = useTRPC();
 	const workspaceUrl = useWorkspaceUrl();
@@ -58,6 +67,7 @@ export function AppHeader({ user }: { user: User }) {
 					<Logo className="size-5" />
 				</Link>
 				<Separator orientation="vertical" className="mx-1 h-5 bg-transparent" />
+				<OrgSwitcher {...organizationSwitcher} />
 				<span className="min-w-0 truncate font-medium text-sm">{label}</span>
 			</div>
 
diff --git a/apps/app/components/auth-shell.tsx b/apps/app/components/auth-shell.tsx
index 72a493866..a5cb372aa 100644
--- a/apps/app/components/auth-shell.tsx
+++ b/apps/app/components/auth-shell.tsx
@@ -75,3 +75,12 @@ export function AuthHeading({
 		</div>
 	);
 }
+
+export function InvalidOAuthRequest() {
+	return (
+		<AuthHeading
+			title="Invalid OAuth request"
+			description="The authorization request is missing required values or contains invalid values."
+		/>
+	);
+}
diff --git a/apps/app/components/crm/agent-panel.tsx b/apps/app/components/crm/agent-panel.tsx
index 61990ef01..1df9c32e9 100644
--- a/apps/app/components/crm/agent-panel.tsx
+++ b/apps/app/components/crm/agent-panel.tsx
@@ -231,7 +231,7 @@ function Thread({
 		if (!message.trim() || locked) return;
 		opening.current ||= message.trim();
 		setDraft("");
-		void agent.send({ message: message.trim() });
+		void agent.send(message.trim());
 	};
 
 	return (
@@ -289,7 +289,7 @@ function Thread({
 						key={question.requestId}
 						question={question}
 						pending={busy}
-						onSubmit={(response) => agent.send({ inputResponses: [response] })}
+						onSubmit={(response) => agent.respond([response])}
 					/>
 				) : (
 					<form
diff --git a/apps/app/components/crm/project-assets/appointment-detail.tsx b/apps/app/components/crm/project-assets/appointment-detail.tsx
new file mode 100644
index 000000000..44e0bcb02
--- /dev/null
+++ b/apps/app/components/crm/project-assets/appointment-detail.tsx
@@ -0,0 +1,196 @@
+"use client";
+
+import Archive from "@carbon/icons-react/es/Archive";
+import Edit from "@carbon/icons-react/es/Edit";
+import Undo from "@carbon/icons-react/es/Undo";
+import Upload from "@carbon/icons-react/es/Upload";
+import { Button } from "@crm/ui/components/button";
+import { Icon } from "@crm/ui/components/icon";
+import { Spinner } from "@crm/ui/components/spinner";
+import { StatusIndicator } from "@crm/ui/components/status-indicator";
+import { useQuery } from "@tanstack/react-query";
+import { formatAppointmentDate } from "@/lib/project-assets/date-time";
+import { appointmentQuery } from "@/lib/project-assets/queries";
+import type {
+	Appointment,
+	AppointmentStatus,
+} from "@/lib/project-assets/schemas";
+
+const STATUS_TONE = {
+	SCHEDULED: "info",
+	COMPLETED: "success",
+	CANCELED: "neutral",
+} as const;
+
+export function AppointmentDetail({
+	projectId,
+	appointmentId,
+	onBack,
+	onEdit,
+	onUpload,
+	onArchive,
+	onRestore,
+	onStatusChange,
+	actionPending,
+}: {
+	projectId: string;
+	appointmentId: string;
+	onBack: () => void;
+	onEdit: (appointment: Appointment) => void;
+	onUpload: (appointment: Appointment) => void;
+	onArchive: (appointment: Appointment) => void;
+	onRestore: (appointment: Appointment) => void;
+	onStatusChange: (appointment: Appointment, status: AppointmentStatus) => void;
+	actionPending: boolean;
+}) {
+	const query = useQuery(appointmentQuery(projectId, appointmentId));
+	const appointment = query.data?.appointment;
+	if (query.isPending)
+		return (
+			<div className="flex justify-center py-8">
+				<Spinner />
+			</div>
+		);
+	if (query.error || !appointment)
+		return (
+			<div className="space-y-3 p-4">
+				<Button variant="outline" size="sm" onClick={onBack}>
+					Back
+				</Button>
+				<p className="text-destructive text-xs">
+					{query.error?.message ?? "Appointment not found."}
+				</p>
+			</div>
+		);
+
+	return (
+		<div className="space-y-4 rounded-lg border bg-card p-4">
+			<div className="flex items-start justify-between gap-3">
+				<div className="min-w-0">
+					<Button
+						variant="ghost"
+						size="sm"
+						onClick={onBack}
+						className="-ml-2 mb-2"
+					>
+						Back
+					</Button>
+					<h3 className="truncate font-medium text-base">
+						{appointment.title}
+					</h3>
+					<p className="mt-1 text-muted-foreground text-xs">
+						{formatAppointmentDate(appointment.startsAt, appointment.timeZone)}{" "}
+						· {appointment.timeZone}
+					</p>
+				</div>
+				<StatusIndicator
+					tone={STATUS_TONE[appointment.status]}
+					label={appointment.status.toLowerCase()}
+				/>
+			</div>
+			<div className="grid gap-3 text-xs sm:grid-cols-2">
+				<Detail label="Location" value={appointment.location} />
+				<Detail label="Owner" value={appointment.ownerId} />
+				<Detail
+					label="Ends"
+					value={
+						appointment.endsAt
+							? formatAppointmentDate(appointment.endsAt, appointment.timeZone)
+							: "No end time"
+					}
+				/>
+				<Detail label="Version" value={String(appointment.version)} />
+				<Detail label="Notes" value={appointment.notes} wide />
+			</div>
+			<div className="flex flex-wrap gap-2 border-t pt-3">
+				<Button
+					variant="outline"
+					size="sm"
+					onClick={() => onEdit(appointment)}
+					disabled={actionPending || Boolean(appointment.archivedAt)}
+				>
+					<Icon icon={Edit} data-icon="inline-start" />
+					Edit
+				</Button>
+				<Button
+					variant="outline"
+					size="sm"
+					onClick={() => onUpload(appointment)}
+					disabled={actionPending || Boolean(appointment.archivedAt)}
+				>
+					<Icon icon={Upload} data-icon="inline-start" />
+					Upload files
+				</Button>
+				{appointment.archivedAt ? (
+					<Button
+						variant="outline"
+						size="sm"
+						onClick={() => onRestore(appointment)}
+						disabled={actionPending}
+					>
+						<Icon icon={Undo} data-icon="inline-start" />
+						Restore
+					</Button>
+				) : (
+					<Button
+						variant="outline"
+						size="sm"
+						onClick={() => onArchive(appointment)}
+						disabled={actionPending}
+					>
+						<Icon icon={Archive} data-icon="inline-start" />
+						Archive
+					</Button>
+				)}
+				{!appointment.archivedAt && appointment.status === "SCHEDULED" ? (
+					<>
+						<Button
+							size="sm"
+							onClick={() => onStatusChange(appointment, "COMPLETED")}
+							disabled={actionPending}
+						>
+							Complete
+						</Button>
+						<Button
+							variant="outline"
+							size="sm"
+							onClick={() => onStatusChange(appointment, "CANCELED")}
+							disabled={actionPending}
+						>
+							Cancel meeting
+						</Button>
+					</>
+				) : null}
+				{!appointment.archivedAt && appointment.status !== "SCHEDULED" ? (
+					<Button
+						variant="outline"
+						size="sm"
+						onClick={() => onStatusChange(appointment, "SCHEDULED")}
+						disabled={actionPending}
+					>
+						Reopen
+					</Button>
+				) : null}
+			</div>
+		</div>
+	);
+}
+
+function Detail({
+	label,
+	value,
+	wide = false,
+}: {
+	label: string;
+	value: string | null;
+	wide?: boolean;
+}) {
+	return (
+		<div className={wide ? "sm:col-span-2" : ""}>
+			<dt className="text-muted-foreground">{label}</dt>
+			<dd className="mt-1 whitespace-pre-wrap text-foreground">
+				{value || "Not set"}
+			</dd>
+		</div>
+	);
+}
diff --git a/apps/app/components/crm/project-assets/appointment-filters.tsx b/apps/app/components/crm/project-assets/appointment-filters.tsx
new file mode 100644
index 000000000..77c059687
--- /dev/null
+++ b/apps/app/components/crm/project-assets/appointment-filters.tsx
@@ -0,0 +1,98 @@
+"use client";
+
+import { DatePicker } from "@crm/ui/components/date-picker";
+import {
+	Select,
+	SelectContent,
+	SelectItem,
+	SelectTrigger,
+	SelectValue,
+} from "@crm/ui/components/select";
+import type { Dispatch, SetStateAction } from "react";
+import type { AppointmentFilters } from "@/lib/project-assets/client";
+import { dateBoundary } from "@/lib/project-assets/date-time";
+import type { AppointmentStatus } from "@/lib/project-assets/schemas";
+import type { UserOption } from "./appointments-list";
+
+export function AppointmentFilterControls({
+	filters,
+	setFilters,
+	users,
+}: {
+	filters: AppointmentFilters;
+	setFilters: Dispatch<SetStateAction<AppointmentFilters>>;
+	users: UserOption[];
+}) {
+	const patch = (next: Partial<AppointmentFilters>) =>
+		setFilters((current) => ({ ...current, ...next, page: 1 }));
+	const filterDate = (value: string | undefined, end = false) => {
+		if (!value) return "";
+		const date = new Date(value);
+		if (end) date.setUTCDate(date.getUTCDate() - 1);
+		return date.toISOString().slice(0, 10);
+	};
+	return (
+		<div className="grid gap-2 sm:grid-cols-2 lg:grid-cols-4">
+			<Select
+				value={filters.archived ? "archived" : "active"}
+				onValueChange={(value) => patch({ archived: value === "archived" })}
+			>
+				<SelectTrigger aria-label="Appointment list">
+					<SelectValue />
+				</SelectTrigger>
+				<SelectContent>
+					<SelectItem value="active">Active appointments</SelectItem>
+					<SelectItem value="archived">Archived appointments</SelectItem>
+				</SelectContent>
+			</Select>
+			<Select
+				value={filters.status ?? "all"}
+				onValueChange={(value) =>
+					patch({
+						status: value === "all" ? undefined : (value as AppointmentStatus),
+					})
+				}
+			>
+				<SelectTrigger aria-label="Appointment status">
+					<SelectValue placeholder="All statuses" />
+				</SelectTrigger>
+				<SelectContent>
+					<SelectItem value="all">All statuses</SelectItem>
+					<SelectItem value="SCHEDULED">Scheduled</SelectItem>
+					<SelectItem value="COMPLETED">Completed</SelectItem>
+					<SelectItem value="CANCELED">Canceled</SelectItem>
+				</SelectContent>
+			</Select>
+			<Select
+				value={filters.ownerId ?? "all"}
+				onValueChange={(value) =>
+					patch({ ownerId: value === "all" ? undefined : value })
+				}
+			>
+				<SelectTrigger aria-label="Appointment owner">
+					<SelectValue placeholder="All owners" />
+				</SelectTrigger>
+				<SelectContent>
+					<SelectItem value="all">All owners</SelectItem>
+					{users.map((user) => (
+						<SelectItem key={user.id} value={user.id}>
+							{user.name || user.id}
+						</SelectItem>
+					))}
+				</SelectContent>
+			</Select>
+			<div className="flex gap-2">
+				<DatePicker
+					value={filterDate(filters.from)}
+					onChange={(value) => patch({ from: dateBoundary(value) })}
+					placeholder="From"
+				/>
+				<DatePicker
+					value={filterDate(filters.to, true)}
+					onChange={(value) => patch({ to: dateBoundary(value, true) })}
+					placeholder="To"
+				/>
+			</div>
+		</div>
+	);
+}
diff --git a/apps/app/components/crm/project-assets/appointment-form-dialog.tsx b/apps/app/components/crm/project-assets/appointment-form-dialog.tsx
new file mode 100644
index 000000000..d4668022e
--- /dev/null
+++ b/apps/app/components/crm/project-assets/appointment-form-dialog.tsx
@@ -0,0 +1,193 @@
+"use client";
+
+import {
+	Dialog,
+	DialogContent,
+	DialogDescription,
+	DialogHeader,
+	DialogTitle,
+} from "@crm/ui/components/dialog";
+import { useMutation, useQuery } from "@tanstack/react-query";
+import { useRef, useState } from "react";
+import { projectApi } from "@/lib/project-assets/client";
+import {
+	defaultTimeZone,
+	isoToLocalInput,
+	localInputToIso,
+} from "@/lib/project-assets/date-time";
+import { appointmentQuery } from "@/lib/project-assets/queries";
+import type { Appointment } from "@/lib/project-assets/schemas";
+import {
+	operationKey,
+	ProjectAssetsApiError,
+} from "@/lib/project-assets/transport";
+import {
+	type AppointmentDraft,
+	AppointmentFormView,
+} from "./appointment-form-view";
+import type { UserOption } from "./appointments-list";
+
+type ScheduleSnapshot = {
+	startsAt: string;
+	endsAt: string | null;
+	timeZone: string;
+	startsLocal: string;
+	endsLocal: string;
+};
+
+function initialDraft(
+	appointment: Appointment | null,
+	defaultOwner: string,
+): AppointmentDraft {
+	const zone = appointment?.timeZone ?? defaultTimeZone();
+	const start =
+		appointment?.startsAt ?? new Date(Date.now() + 3_600_000).toISOString();
+	return {
+		title: appointment?.title ?? "",
+		notes: appointment?.notes ?? "",
+		startsAt: isoToLocalInput(start, zone),
+		endsAt: isoToLocalInput(appointment?.endsAt ?? null, zone),
+		timeZone: zone,
+		location: appointment?.location ?? "",
+		ownerId: appointment?.ownerId ?? defaultOwner,
+		status: appointment?.status ?? "SCHEDULED",
+	};
+}
+
+function scheduleSnapshot(
+	appointment: Appointment | null,
+): ScheduleSnapshot | null {
+	if (!appointment) return null;
+	return {
+		startsAt: appointment.startsAt,
+		endsAt: appointment.endsAt,
+		timeZone: appointment.timeZone,
+		startsLocal: isoToLocalInput(appointment.startsAt, appointment.timeZone),
+		endsLocal: isoToLocalInput(appointment.endsAt, appointment.timeZone),
+	};
+}
+
+export function AppointmentFormDialog({
+	projectId,
+	open,
+	appointment,
+	users,
+	defaultOwner,
+	onOpenChange,
+	onSaved,
+}: {
+	projectId: string;
+	open: boolean;
+	appointment: Appointment | null;
+	users: UserOption[];
+	defaultOwner: string;
+	onOpenChange: (open: boolean) => void;
+	onSaved: (appointment: Appointment) => void;
+}) {
+	const latest = useQuery(appointmentQuery(projectId, appointment?.id ?? null));
+	const [draft, setDraft] = useState(() =>
+		initialDraft(appointment, defaultOwner),
+	);
+	const [editingAppointment, setEditingAppointment] =
+		useState<Appointment | null>(appointment);
+	const [formError, setFormError] = useState<string | null>(null);
+	const requestKey = useRef<string | null>(null);
+	const schedule = useRef<ScheduleSnapshot | null>(
+		scheduleSnapshot(appointment),
+	);
+	const save = useMutation({
+		mutationFn: async () => {
+			const key = requestKey.current ?? operationKey();
+			requestKey.current = key;
+			const currentSchedule = schedule.current;
+			const sameScheduleZone = currentSchedule?.timeZone === draft.timeZone;
+			const startsAt =
+				sameScheduleZone && currentSchedule?.startsLocal === draft.startsAt
+					? currentSchedule.startsAt
+					: localInputToIso(draft.startsAt, draft.timeZone);
+			const endsAt = draft.endsAt
+				? sameScheduleZone && currentSchedule?.endsLocal === draft.endsAt
+					? currentSchedule.endsAt
+					: localInputToIso(draft.endsAt, draft.timeZone)
+				: null;
+			const body = {
+				title: draft.title.trim(),
+				notes: draft.notes.trim() || null,
+				startsAt,
+				endsAt,
+				timeZone: draft.timeZone.trim(),
+				location: draft.location.trim() || null,
+				ownerId: draft.ownerId,
+				status: draft.status,
+			};
+			return editingAppointment
+				? projectApi.updateAppointment(
+						projectId,
+						editingAppointment.id,
+						{ ...body, expectedVersion: editingAppointment.version },
+						key,
+					)
+				: projectApi.createAppointment(projectId, body, key);
+		},
+		onSuccess: (result) => {
+			requestKey.current = null;
+			onSaved(result.appointment);
+			onOpenChange(false);
+		},
+		onError: async (error) => {
+			setFormError(error.message);
+			if (
+				error instanceof ProjectAssetsApiError &&
+				error.code === "VERSION_CONFLICT"
+			) {
+				requestKey.current = null;
+				const refreshed = await latest.refetch();
+				const current = refreshed.data?.appointment;
+				if (current) {
+					setEditingAppointment(current);
+					setDraft(initialDraft(current, defaultOwner));
+					schedule.current = scheduleSnapshot(current);
+					setFormError(
+						"This appointment changed elsewhere. The latest values are loaded for review.",
+					);
+				}
+			}
+		},
+	});
+
+	const change = (next: Partial<AppointmentDraft>) => {
+		requestKey.current = null;
+		setDraft((current) => ({ ...current, ...next }));
+		setFormError(null);
+	};
+	const fieldError =
+		save.error instanceof ProjectAssetsApiError
+			? save.error.details?.fields
+			: undefined;
+	if (!open) return null;
+	return (
+		<Dialog open onOpenChange={onOpenChange}>
+			<DialogContent className="max-h-[90vh] overflow-y-auto sm:max-w-lg">
+				<DialogHeader>
+					<DialogTitle>
+						{editingAppointment ? "Edit appointment" : "New appointment"}
+					</DialogTitle>
+					<DialogDescription>
+						Keep schedule details and collection context with the project.
+					</DialogDescription>
+				</DialogHeader>
+				<AppointmentFormView
+					draft={draft}
+					users={users}
+					formError={formError}
+					latestVersion={latest.data?.appointment?.version}
+					fieldError={fieldError}
+					saving={save.isPending}
+					onChange={change}
+					onSubmit={() => save.mutate()}
+					onCancel={() => onOpenChange(false)}
+				/>
+			</DialogContent>
+		</Dialog>
+	);
+}
diff --git a/apps/app/components/crm/project-assets/appointment-form-view.tsx b/apps/app/components/crm/project-assets/appointment-form-view.tsx
new file mode 100644
index 000000000..0f14c6644
--- /dev/null
+++ b/apps/app/components/crm/project-assets/appointment-form-view.tsx
@@ -0,0 +1,189 @@
+"use client";
+
+import { Button } from "@crm/ui/components/button";
+import { DialogFooter } from "@crm/ui/components/dialog";
+import {
+	Field,
+	FieldDescription,
+	FieldGroup,
+	FieldLabel,
+} from "@crm/ui/components/field";
+import { Input } from "@crm/ui/components/input";
+import {
+	Select,
+	SelectContent,
+	SelectItem,
+	SelectTrigger,
+	SelectValue,
+} from "@crm/ui/components/select";
+import { Spinner } from "@crm/ui/components/spinner";
+import { Textarea } from "@crm/ui/components/textarea";
+import type { Appointment } from "@/lib/project-assets/schemas";
+import type { UserOption } from "./appointments-list";
+
+export type AppointmentDraft = {
+	title: string;
+	notes: string;
+	startsAt: string;
+	endsAt: string;
+	timeZone: string;
+	location: string;
+	ownerId: string;
+	status: Appointment["status"];
+};
+
+type FieldError = { field: string; message: string };
+
+export function AppointmentFormView({
+	draft,
+	users,
+	formError,
+	latestVersion,
+	fieldError,
+	saving,
+	onChange,
+	onSubmit,
+	onCancel,
+}: {
+	draft: AppointmentDraft;
+	users: UserOption[];
+	formError: string | null;
+	latestVersion?: number;
+	fieldError?: FieldError[];
+	saving: boolean;
+	onChange: (next: Partial<AppointmentDraft>) => void;
+	onSubmit: () => void;
+	onCancel: () => void;
+}) {
+	return (
+		<>
+			<form
+				id="appointment-form"
+				onSubmit={(event) => {
+					event.preventDefault();
+					onSubmit();
+				}}
+			>
+				<FieldGroup>
+					<Field>
+						<FieldLabel htmlFor="appointment-title">Title</FieldLabel>
+						<Input
+							id="appointment-title"
+							value={draft.title}
+							onChange={(event) => onChange({ title: event.target.value })}
+							required
+						/>
+					</Field>
+					<Field>
+						<FieldLabel htmlFor="appointment-start">Starts</FieldLabel>
+						<Input
+							id="appointment-start"
+							type="datetime-local"
+							value={draft.startsAt}
+							onChange={(event) => onChange({ startsAt: event.target.value })}
+							required
+						/>
+						<FieldDescription>
+							Enter the local time for the selected IANA time zone.
+						</FieldDescription>
+					</Field>
+					<Field>
+						<FieldLabel htmlFor="appointment-end">Ends</FieldLabel>
+						<Input
+							id="appointment-end"
+							type="datetime-local"
+							value={draft.endsAt}
+							onChange={(event) => onChange({ endsAt: event.target.value })}
+						/>
+					</Field>
+					<Field>
+						<FieldLabel htmlFor="appointment-time-zone">Time zone</FieldLabel>
+						<Input
+							id="appointment-time-zone"
+							value={draft.timeZone}
+							onChange={(event) => onChange({ timeZone: event.target.value })}
+							placeholder="America/Chicago"
+							required
+						/>
+					</Field>
+					<Field>
+						<FieldLabel htmlFor="appointment-location">Location</FieldLabel>
+						<Input
+							id="appointment-location"
+							value={draft.location}
+							onChange={(event) => onChange({ location: event.target.value })}
+						/>
+					</Field>
+					<Field>
+						<FieldLabel htmlFor="appointment-owner">Owner</FieldLabel>
+						<Select
+							value={draft.ownerId}
+							onValueChange={(ownerId) => onChange({ ownerId })}
+						>
+							<SelectTrigger id="appointment-owner">
+								<SelectValue placeholder="Choose an owner" />
+							</SelectTrigger>
+							<SelectContent>
+								{users.map((user) => (
+									<SelectItem key={user.id} value={user.id}>
+										{user.name || user.id}
+									</SelectItem>
+								))}
+							</SelectContent>
+						</Select>
+					</Field>
+					<Field>
+						<FieldLabel htmlFor="appointment-status">Status</FieldLabel>
+						<Select
+							value={draft.status}
+							onValueChange={(status) =>
+								onChange({ status: status as Appointment["status"] })
+							}
+						>
+							<SelectTrigger id="appointment-status">
+								<SelectValue />
+							</SelectTrigger>
+							<SelectContent>
+								<SelectItem value="SCHEDULED">Scheduled</SelectItem>
+								<SelectItem value="COMPLETED">Completed</SelectItem>
+								<SelectItem value="CANCELED">Canceled</SelectItem>
+							</SelectContent>
+						</Select>
+					</Field>
+					<Field>
+						<FieldLabel htmlFor="appointment-notes">Notes</FieldLabel>
+						<Textarea
+							id="appointment-notes"
+							value={draft.notes}
+							onChange={(event) => onChange({ notes: event.target.value })}
+							rows={4}
+						/>
+					</Field>
+					{formError ? (
+						<p className="text-destructive text-xs">
+							{formError}
+							{latestVersion ? ` Latest version is ${latestVersion}.` : ""}
+						</p>
+					) : null}
+					{fieldError?.map((field) => (
+						<p key={field.field} className="text-destructive text-xs">
+							{field.field}: {field.message}
+						</p>
+					))}
+				</FieldGroup>
+			</form>
+			<DialogFooter>
+				<Button
+					type="submit"
+					form="appointment-form"
+					disabled={saving || !draft.title.trim() || !draft.ownerId}
+				>
+					{saving ? <Spinner /> : null}Save appointment
+				</Button>
+				<Button type="button" variant="outline" onClick={onCancel}>
+					Cancel
+				</Button>
+			</DialogFooter>
+		</>
+	);
+}
diff --git a/apps/app/components/crm/project-assets/appointments-list.tsx b/apps/app/components/crm/project-assets/appointments-list.tsx
new file mode 100644
index 000000000..a18b32bf1
--- /dev/null
+++ b/apps/app/components/crm/project-assets/appointments-list.tsx
@@ -0,0 +1,151 @@
+"use client";
+
+import Add from "@carbon/icons-react/es/Add";
+import { Button } from "@crm/ui/components/button";
+import { Spinner } from "@crm/ui/components/spinner";
+import { StatusIndicator } from "@crm/ui/components/status-indicator";
+import type { Dispatch, SetStateAction } from "react";
+import type { AppointmentFilters } from "@/lib/project-assets/client";
+import { formatAppointmentDate } from "@/lib/project-assets/date-time";
+import type { Appointment } from "@/lib/project-assets/schemas";
+import { AppointmentFilterControls } from "./appointment-filters";
+
+export type UserOption = { id: string; name: string | null };
+
+type AppointmentResult = {
+	items: Appointment[];
+	page: number;
+	pageSize: number;
+	total: number;
+	hasNextPage: boolean;
+};
+
+const STATUS_TONE = {
+	SCHEDULED: "info",
+	COMPLETED: "success",
+	CANCELED: "neutral",
+} as const;
+
+export function AppointmentsList({
+	filters,
+	setFilters,
+	result,
+	loading,
+	error,
+	users,
+	onSelect,
+	onCreate,
+}: {
+	filters: AppointmentFilters;
+	setFilters: Dispatch<SetStateAction<AppointmentFilters>>;
+	result?: AppointmentResult;
+	loading: boolean;
+	error?: string;
+	users: UserOption[];
+	onSelect: (id: string) => void;
+	onCreate: () => void;
+}) {
+	const ownerName = new Map(
+		users.map((user) => [user.id, user.name || user.id]),
+	);
+	return (
+		<section className="space-y-3 border-b pb-4">
+			<div className="flex items-center justify-between gap-3">
+				<div>
+					<h2 className="font-medium text-sm">Appointments</h2>
+					<p className="text-muted-foreground text-xs">
+						Schedule and retain project meetings.
+					</p>
+				</div>
+				<Button size="sm" onClick={onCreate}>
+					<Add data-icon="inline-start" />
+					New appointment
+				</Button>
+			</div>
+
+			<AppointmentFilterControls
+				filters={filters}
+				setFilters={setFilters}
+				users={users}
+			/>
+
+			{loading ? (
+				<div className="flex justify-center py-6">
+					<Spinner />
+				</div>
+			) : error ? (
+				<p className="py-4 text-destructive text-xs">{error}</p>
+			) : result?.items.length ? (
+				<div className="divide-y rounded-lg border">
+					{result.items.map((appointment) => (
+						<button
+							key={appointment.id}
+							type="button"
+							onClick={() => onSelect(appointment.id)}
+							className="flex w-full items-start justify-between gap-3 px-3 py-3 text-left hover:bg-muted/40"
+						>
+							<span className="min-w-0 space-y-1">
+								<span className="block truncate font-medium text-sm">
+									{appointment.title}
+								</span>
+								<span className="block truncate text-muted-foreground text-xs">
+									{formatAppointmentDate(
+										appointment.startsAt,
+										appointment.timeZone,
+									)}{" "}
+									· {ownerName.get(appointment.ownerId) ?? appointment.ownerId}
+								</span>
+							</span>
+							<StatusIndicator
+								tone={STATUS_TONE[appointment.status]}
+								label={appointment.status.toLowerCase()}
+								size="sm"
+							/>
+						</button>
+					))}
+				</div>
+			) : (
+				<p className="rounded-lg border border-dashed p-5 text-center text-muted-foreground text-xs">
+					No appointments match these filters.
+				</p>
+			)}
+
+			{result ? (
+				<div className="flex items-center justify-between text-muted-foreground text-xs">
+					<span>
+						{result.total} result{result.total === 1 ? "" : "s"}
+					</span>
+					<span className="flex items-center gap-2">
+						<Button
+							variant="outline"
+							size="sm"
+							disabled={result.page <= 1}
+							onClick={() =>
+								setFilters((current) => ({
+									...current,
+									page: result.page - 1,
+								}))
+							}
+						>
+							Previous
+						</Button>
+						<span>Page {result.page}</span>
+						<Button
+							variant="outline"
+							size="sm"
+							disabled={!result.hasNextPage}
+							onClick={() =>
+								setFilters((current) => ({
+									...current,
+									page: result.page + 1,
+								}))
+							}
+						>
+							Next
+						</Button>
+					</span>
+				</div>
+			) : null}
+		</section>
+	);
+}
diff --git a/apps/app/components/crm/project-assets/asset-editor-dialog.tsx b/apps/app/components/crm/project-assets/asset-editor-dialog.tsx
new file mode 100644
index 000000000..3c31e36ae
--- /dev/null
+++ b/apps/app/components/crm/project-assets/asset-editor-dialog.tsx
@@ -0,0 +1,163 @@
+"use client";
+
+import { Button } from "@crm/ui/components/button";
+import {
+	Dialog,
+	DialogContent,
+	DialogDescription,
+	DialogFooter,
+	DialogHeader,
+	DialogTitle,
+} from "@crm/ui/components/dialog";
+import { Spinner } from "@crm/ui/components/spinner";
+import { useMutation, useQuery } from "@tanstack/react-query";
+import { useRef, useState } from "react";
+import { projectApi } from "@/lib/project-assets/client";
+import { assetQuery } from "@/lib/project-assets/queries";
+import type { Asset } from "@/lib/project-assets/schemas";
+import {
+	operationKey,
+	ProjectAssetsApiError,
+} from "@/lib/project-assets/transport";
+import { type AssetEditorDraft, AssetEditorView } from "./asset-editor-view";
+
+function draftFor(asset: Asset): AssetEditorDraft {
+	return {
+		fileName: asset.fileName,
+		kind: asset.kind,
+	};
+}
+
+export function AssetEditorDialog({
+	projectId,
+	assetId,
+	open,
+	onOpenChange,
+	onSaved,
+}: {
+	projectId: string;
+	assetId: string | null;
+	open: boolean;
+	onOpenChange: (open: boolean) => void;
+	onSaved: (asset: Asset) => void;
+}) {
+	const query = useQuery(assetQuery(projectId, assetId));
+	if (!open) return null;
+	if (query.isPending)
+		return (
+			<Dialog open onOpenChange={onOpenChange}>
+				<DialogContent>
+					<Spinner />
+				</DialogContent>
+			</Dialog>
+		);
+	if (query.error || !query.data?.asset)
+		return (
+			<Dialog open onOpenChange={onOpenChange}>
+				<DialogContent>
+					<DialogHeader>
+						<DialogTitle>Edit file</DialogTitle>
+						<DialogDescription>
+							{query.error?.message ?? "Asset not found."}
+						</DialogDescription>
+					</DialogHeader>
+					<DialogFooter>
+						<Button variant="outline" onClick={() => onOpenChange(false)}>
+							Close
+						</Button>
+					</DialogFooter>
+				</DialogContent>
+			</Dialog>
+		);
+	const asset = query.data.asset;
+	return (
+		<Dialog open onOpenChange={onOpenChange}>
+			<DialogContent>
+				<DialogHeader>
+					<DialogTitle>Edit file metadata</DialogTitle>
+					<DialogDescription>Change the file name or kind.</DialogDescription>
+				</DialogHeader>
+				<AssetEditorForm
+					key={asset.id}
+					projectId={projectId}
+					asset={asset}
+					onOpenChange={onOpenChange}
+					onSaved={onSaved}
+				/>
+			</DialogContent>
+		</Dialog>
+	);
+}
+
+function AssetEditorForm({
+	projectId,
+	asset,
+	onOpenChange,
+	onSaved,
+}: {
+	projectId: string;
+	asset: Asset;
+	onOpenChange: (open: boolean) => void;
+	onSaved: (asset: Asset) => void;
+}) {
+	const [draft, setDraft] = useState(() => draftFor(asset));
+	const [error, setError] = useState<string | null>(null);
+	const requestKey = useRef<string | null>(null);
+	const draftVersion = useRef(asset.version);
+	const latest = useQuery(assetQuery(projectId, asset.id));
+	const save = useMutation({
+		mutationFn: () => {
+			const key = requestKey.current ?? operationKey();
+			requestKey.current = key;
+			return projectApi.updateAsset(
+				asset.id,
+				{
+					expectedVersion: draftVersion.current,
+					fileName: draft.fileName.trim(),
+					kind: draft.kind.trim(),
+				},
+				key,
+			);
+		},
+		onSuccess: (result) => {
+			requestKey.current = null;
+			onSaved(result.asset);
+			onOpenChange(false);
+		},
+		onError: async (next) => {
+			setError(next.message);
+			if (
+				next instanceof ProjectAssetsApiError &&
+				next.code === "VERSION_CONFLICT"
+			) {
+				requestKey.current = null;
+				const refreshed = await latest.refetch();
+				const current = refreshed.data?.asset;
+				if (current) {
+					draftVersion.current = current.version;
+					setDraft(draftFor(current));
+					setError(
+						"This file changed elsewhere. The latest values are loaded for review.",
+					);
+				}
+			}
+		},
+	});
+	const change = (next: Partial<AssetEditorDraft>) => {
+		requestKey.current = null;
+		setDraft((current) => ({ ...current, ...next }));
+		setError(null);
+	};
+	return (
+		<AssetEditorView
+			draft={draft}
+			error={error}
+			latestVersion={latest.data?.asset?.version}
+			editable={asset.status === "READY" || asset.status === "UNVERIFIED"}
+			saving={save.isPending}
+			onChange={change}
+			onSubmit={() => save.mutate()}
+			onCancel={() => onOpenChange(false)}
+		/>
+	);
+}
diff --git a/apps/app/components/crm/project-assets/asset-editor-view.tsx b/apps/app/components/crm/project-assets/asset-editor-view.tsx
new file mode 100644
index 000000000..2bd4b0725
--- /dev/null
+++ b/apps/app/components/crm/project-assets/asset-editor-view.tsx
@@ -0,0 +1,87 @@
+"use client";
+
+import { Button } from "@crm/ui/components/button";
+import { DialogFooter } from "@crm/ui/components/dialog";
+import { Field, FieldGroup, FieldLabel } from "@crm/ui/components/field";
+import { Input } from "@crm/ui/components/input";
+import { Spinner } from "@crm/ui/components/spinner";
+
+export type AssetEditorDraft = {
+	fileName: string;
+	kind: string;
+};
+
+export function AssetEditorView({
+	draft,
+	error,
+	latestVersion,
+	editable,
+	saving,
+	onChange,
+	onSubmit,
+	onCancel,
+}: {
+	draft: AssetEditorDraft;
+	error: string | null;
+	latestVersion?: number;
+	editable: boolean;
+	saving: boolean;
+	onChange: (next: Partial<AssetEditorDraft>) => void;
+	onSubmit: () => void;
+	onCancel: () => void;
+}) {
+	return (
+		<>
+			<form
+				id="asset-editor"
+				onSubmit={(event) => {
+					event.preventDefault();
+					onSubmit();
+				}}
+			>
+				<FieldGroup>
+					<Field>
+						<FieldLabel htmlFor="asset-file-name">File name</FieldLabel>
+						<Input
+							id="asset-file-name"
+							value={draft.fileName}
+							onChange={(event) => onChange({ fileName: event.target.value })}
+							disabled={!editable}
+							required
+						/>
+					</Field>
+					<Field>
+						<FieldLabel htmlFor="asset-kind">Kind</FieldLabel>
+						<Input
+							id="asset-kind"
+							value={draft.kind}
+							onChange={(event) => onChange({ kind: event.target.value })}
+							disabled={!editable}
+							required
+						/>
+					</Field>
+					{error ? (
+						<p className="text-destructive text-xs">
+							{error}
+							{latestVersion ? ` Latest version is ${latestVersion}.` : ""}
+						</p>
+					) : null}
+				</FieldGroup>
+			</form>
+			<DialogFooter>
+				<Button
+					type="submit"
+					form="asset-editor"
+					disabled={
+						!editable || saving || !draft.fileName.trim() || !draft.kind.trim()
+					}
+				>
+					{saving ? <Spinner /> : null}Save changes
+				</Button>
+				<Button type="button" variant="outline" onClick={onCancel}>
+					Cancel
+				</Button>
+			</DialogFooter>
+		</>
+	);
+}
diff --git a/apps/app/components/crm/project-assets/asset-row.tsx b/apps/app/components/crm/project-assets/asset-row.tsx
new file mode 100644
index 000000000..733c99a52
--- /dev/null
+++ b/apps/app/components/crm/project-assets/asset-row.tsx
@@ -0,0 +1,93 @@
+"use client";
+
+import Download from "@carbon/icons-react/es/Download";
+import Edit from "@carbon/icons-react/es/Edit";
+import OverflowMenuVertical from "@carbon/icons-react/es/OverflowMenuVertical";
+import TrashCan from "@carbon/icons-react/es/TrashCan";
+import { Button } from "@crm/ui/components/button";
+import {
+	DropdownMenuContent,
+	DropdownMenuItem,
+	DropdownMenu as DropdownMenuPrimitive,
+	DropdownMenuTrigger,
+} from "@crm/ui/components/dropdown-menu";
+import { Icon } from "@crm/ui/components/icon";
+import { StatusIndicator } from "@crm/ui/components/status-indicator";
+import { formatBytes } from "@/lib/project-assets/date-time";
+import type { Asset } from "@/lib/project-assets/schemas";
+
+const STATUS_TONE = {
+	READY: "success",
+	UNVERIFIED: "warning",
+	DELETING: "warning",
+	DELETED: "neutral",
+} as const;
+
+export function AssetRow({
+	asset,
+	onDownload,
+	onEdit,
+	onDelete,
+}: {
+	asset: Asset;
+	onDownload: () => void;
+	onEdit: () => void;
+	onDelete: () => void;
+}) {
+	return (
+		<div className="flex items-center gap-3 border-b px-3 py-2.5 last:border-b-0">
+			<button
+				type="button"
+				onClick={asset.status === "READY" ? onDownload : undefined}
+				disabled={asset.status !== "READY"}
+				className="min-w-0 flex-1 text-left disabled:cursor-default"
+			>
+				<span className="block truncate font-medium text-sm">
+					{asset.fileName}
+				</span>
+				<span className="block truncate text-muted-foreground text-xs">
+					{asset.kind} · {formatBytes(asset.sizeBytes)}
+				</span>
+			</button>
+			<StatusIndicator
+				tone={STATUS_TONE[asset.status]}
+				label={asset.status.toLowerCase()}
+				size="sm"
+			/>
+			{asset.status === "READY" || asset.status === "UNVERIFIED" ? (
+				<>
+					<Button
+						variant="ghost"
+						size="icon-sm"
+						onClick={asset.status === "READY" ? onDownload : undefined}
+						disabled={asset.status !== "READY"}
+						aria-label={`Download ${asset.fileName}`}
+					>
+						<Icon icon={Download} />
+					</Button>
+					<DropdownMenuPrimitive>
+						<DropdownMenuTrigger asChild>
+							<Button
+								variant="ghost"
+								size="icon-sm"
+								aria-label={`Actions for ${asset.fileName}`}
+							>
+								<Icon icon={OverflowMenuVertical} />
+							</Button>
+						</DropdownMenuTrigger>
+						<DropdownMenuContent align="end">
+							<DropdownMenuItem onSelect={onEdit}>
+								<Icon icon={Edit} />
+								Edit metadata
+							</DropdownMenuItem>
+							<DropdownMenuItem variant="destructive" onSelect={onDelete}>
+								<Icon icon={TrashCan} />
+								Delete file
+							</DropdownMenuItem>
+						</DropdownMenuContent>
+					</DropdownMenuPrimitive>
+				</>
+			) : null}
+		</div>
+	);
+}
diff --git a/apps/app/components/crm/project-assets/assets-list.tsx b/apps/app/components/crm/project-assets/assets-list.tsx
new file mode 100644
index 000000000..b8b10c061
--- /dev/null
+++ b/apps/app/components/crm/project-assets/assets-list.tsx
@@ -0,0 +1,171 @@
+"use client";
+
+import Upload from "@carbon/icons-react/es/Upload";
+import { Button } from "@crm/ui/components/button";
+import {
+	Select,
+	SelectContent,
+	SelectItem,
+	SelectTrigger,
+	SelectValue,
+} from "@crm/ui/components/select";
+import { Spinner } from "@crm/ui/components/spinner";
+import type { Dispatch, SetStateAction } from "react";
+import type { AssetFilters } from "@/lib/project-assets/client";
+import type { Appointment, Asset } from "@/lib/project-assets/schemas";
+import { AssetRow } from "./asset-row";
+
+type AssetResult = {
+	items: Asset[];
+	page: number;
+	total: number;
+	hasNextPage: boolean;
+};
+
+export function AssetsList({
+	filters,
+	setFilters,
+	result,
+	loading,
+	error,
+	appointments,
+	onUpload,
+	onDownload,
+	onEdit,
+	onDelete,
+}: {
+	filters: AssetFilters;
+	setFilters: Dispatch<SetStateAction<AssetFilters>>;
+	result?: AssetResult;
+	loading: boolean;
+	error?: string;
+	appointments: Appointment[];
+	onUpload: () => void;
+	onDownload: (asset: Asset) => void;
+	onEdit: (asset: Asset) => void;
+	onDelete: (asset: Asset) => void;
+}) {
+	const patch = (next: Partial<AssetFilters>) =>
+		setFilters((current) => ({ ...current, ...next, page: next.page ?? 1 }));
+
+	return (
+		<section className="space-y-3 pt-4">
+			<div className="flex items-center justify-between gap-3">
+				<div>
+					<h2 className="font-medium text-sm">Project files</h2>
+					<p className="text-muted-foreground text-xs">
+						Recordings, photos, and documents collected for this project.
+					</p>
+				</div>
+				<Button size="sm" onClick={onUpload}>
+					<Upload data-icon="inline-start" />
+					Upload files
+				</Button>
+			</div>
+			<div className="grid gap-2 sm:grid-cols-3">
+				<Select
+					value={filters.appointmentId ?? "all"}
+					onValueChange={(value) =>
+						patch({ appointmentId: value === "all" ? undefined : value })
+					}
+				>
+					<SelectTrigger aria-label="File appointment">
+						<SelectValue placeholder="All appointments" />
+					</SelectTrigger>
+					<SelectContent>
+						<SelectItem value="all">All appointments</SelectItem>
+						{appointments.map((appointment) => (
+							<SelectItem key={appointment.id} value={appointment.id}>
+								{appointment.title}
+							</SelectItem>
+						))}
+					</SelectContent>
+				</Select>
+				<Select
+					value={filters.kind ?? "all"}
+					onValueChange={(value) =>
+						patch({ kind: value === "all" ? undefined : value })
+					}
+				>
+					<SelectTrigger aria-label="File type">
+						<SelectValue placeholder="All file types" />
+					</SelectTrigger>
+					<SelectContent>
+						<SelectItem value="all">All file types</SelectItem>
+						<SelectItem value="meeting_recording">Recordings</SelectItem>
+						<SelectItem value="photo">Photos</SelectItem>
+						<SelectItem value="document">Documents</SelectItem>
+					</SelectContent>
+				</Select>
+				<Select
+					value={filters.source ?? "all"}
+					onValueChange={(value) =>
+						patch({
+							source:
+								value === "all" ? undefined : (value as AssetFilters["source"]),
+						})
+					}
+				>
+					<SelectTrigger aria-label="File source">
+						<SelectValue placeholder="All sources" />
+					</SelectTrigger>
+					<SelectContent>
+						<SelectItem value="all">All sources</SelectItem>
+						<SelectItem value="MANUAL">Manual</SelectItem>
+						<SelectItem value="MOBILE_RECORDING">Mobile recording</SelectItem>
+						<SelectItem value="EMAIL_ATTACHMENT">Email attachment</SelectItem>
+					</SelectContent>
+				</Select>
+			</div>
+			{loading ? (
+				<div className="flex justify-center py-6">
+					<Spinner />
+				</div>
+			) : error ? (
+				<p className="py-4 text-destructive text-xs">{error}</p>
+			) : result?.items.length ? (
+				<div className="rounded-lg border">
+					{result.items.map((asset) => (
+						<AssetRow
+							key={asset.id}
+							asset={asset}
+							onDownload={() => onDownload(asset)}
+							onEdit={() => onEdit(asset)}
+							onDelete={() => onDelete(asset)}
+						/>
+					))}
+				</div>
+			) : (
+				<p className="rounded-lg border border-dashed p-5 text-center text-muted-foreground text-xs">
+					No project files match these filters.
+				</p>
+			)}
+			{result ? (
+				<div className="flex items-center justify-between text-muted-foreground text-xs">
+					<span>
+						{result.total} file{result.total === 1 ? "" : "s"}
+					</span>
+					<span className="flex items-center gap-2">
+						<Button
+							variant="outline"
+							size="sm"
+							disabled={result.page <= 1}
+							onClick={() => patch({ page: result.page - 1 })}
+						>
+							Previous
+						</Button>
+						<span>Page {result.page}</span>
+						<Button
+							variant="outline"
+							size="sm"
+							disabled={!result.hasNextPage}
+							onClick={() => patch({ page: result.page + 1 })}
+						>
+							Next
+						</Button>
+					</span>
+				</div>
+			) : null}
+		</section>
+	);
+}
diff --git a/apps/app/components/crm/project-assets/confirmation-dialog.tsx b/apps/app/components/crm/project-assets/confirmation-dialog.tsx
new file mode 100644
index 000000000..2099f2613
--- /dev/null
+++ b/apps/app/components/crm/project-assets/confirmation-dialog.tsx
@@ -0,0 +1,56 @@
+"use client";
+
+import {
+	AlertDialog,
+	AlertDialogAction,
+	AlertDialogCancel,
+	AlertDialogContent,
+	AlertDialogDescription,
+	AlertDialogFooter,
+	AlertDialogHeader,
+	AlertDialogTitle,
+} from "@crm/ui/components/alert-dialog";
+import { Spinner } from "@crm/ui/components/spinner";
+
+export function ConfirmationDialog({
+	open,
+	title,
+	description,
+	action,
+	pending,
+	error,
+	onOpenChange,
+	onConfirm,
+}: {
+	open: boolean;
+	title: string;
+	description: string;
+	action: string;
+	pending: boolean;
+	error?: string | null;
+	onOpenChange: (open: boolean) => void;
+	onConfirm: () => void;
+}) {
+	return (
+		<AlertDialog open={open} onOpenChange={onOpenChange}>
+			<AlertDialogContent>
+				<AlertDialogHeader>
+					<AlertDialogTitle>{title}</AlertDialogTitle>
+					<AlertDialogDescription>{description}</AlertDialogDescription>
+					{error ? <p className="text-destructive text-xs">{error}</p> : null}
+				</AlertDialogHeader>
+				<AlertDialogFooter>
+					<AlertDialogCancel disabled={pending}>Cancel</AlertDialogCancel>
+					<AlertDialogAction
+						variant="destructive"
+						onClick={onConfirm}
+						disabled={pending}
+					>
+						{pending ? <Spinner /> : null}
+						{action}
+					</AlertDialogAction>
+				</AlertDialogFooter>
+			</AlertDialogContent>
+		</AlertDialog>
+	);
+}
diff --git a/apps/app/components/crm/project-assets/project-workspace-actions.ts b/apps/app/components/crm/project-assets/project-workspace-actions.ts
new file mode 100644
index 000000000..5245bfcab
--- /dev/null
+++ b/apps/app/components/crm/project-assets/project-workspace-actions.ts
@@ -0,0 +1,117 @@
+"use client";
+
+import { useMutation } from "@tanstack/react-query";
+import { type Dispatch, type SetStateAction, useRef } from "react";
+import { toast } from "sonner";
+import { projectApi } from "@/lib/project-assets/client";
+import { createOperationKeyStore } from "@/lib/project-assets/mutation-keys";
+import type {
+	Appointment,
+	AppointmentStatus,
+	Asset,
+} from "@/lib/project-assets/schemas";
+
+export type ConfirmTarget =
+	| { type: "archive"; appointment: Appointment }
+	| { type: "restore"; appointment: Appointment }
+	| { type: "delete"; asset: Asset };
+
+export function actionFingerprint(target: ConfirmTarget): string {
+	if (target.type === "delete")
+		return `asset:${target.asset.id}:delete:${target.asset.version}`;
+	return `appointment:${target.appointment.id}:${target.type}:${target.appointment.version}`;
+}
+
+export function useProjectWorkspaceActions({
+	projectId,
+	invalidate,
+	setSelectedAppointmentId,
+	setConfirm,
+}: {
+	projectId: string;
+	invalidate: () => void;
+	setSelectedAppointmentId: Dispatch<SetStateAction<string | null>>;
+	setConfirm: Dispatch<SetStateAction<ConfirmTarget | null>>;
+}) {
+	const actionKeys = useRef(createOperationKeyStore());
+	const report = (error: Error) => toast.error(error.message);
+	const status = useMutation<
+		{ appointment: Appointment },
+		Error,
+		{ appointment: Appointment; next: AppointmentStatus }
+	>({
+		mutationFn: ({ appointment, next }) =>
+			projectApi.updateAppointment(
+				projectId,
+				appointment.id,
+				{ expectedVersion: appointment.version, status: next },
+				actionKeys.current.for(
+					`appointment:${appointment.id}:status:${next}:${appointment.version}`,
+				),
+			),
+		onSuccess: (result, variables) => {
+			actionKeys.current.clear(
+				`appointment:${variables.appointment.id}:status:${variables.next}:${variables.appointment.version}`,
+			);
+			invalidate();
+			setSelectedAppointmentId(result.appointment.id);
+		},
+		onError: report,
+	});
+	const archive = useMutation<
+		unknown,
+		Error,
+		{ appointment: Appointment; restore: boolean }
+	>({
+		mutationFn: ({ appointment, restore }) =>
+			restore
+				? projectApi.updateAppointment(
+						projectId,
+						appointment.id,
+						{ expectedVersion: appointment.version, archived: false },
+						actionKeys.current.for(
+							actionFingerprint({ type: "restore", appointment }),
+						),
+					)
+				: projectApi.archiveAppointment(
+						projectId,
+						appointment.id,
+						actionKeys.current.for(
+							actionFingerprint({ type: "archive", appointment }),
+						),
+					),
+		onSuccess: (_, variables) => {
+			actionKeys.current.clear(
+				actionFingerprint({
+					type: variables.restore ? "restore" : "archive",
+					appointment: variables.appointment,
+				}),
+			);
+			invalidate();
+			setConfirm(null);
+		},
+		onError: report,
+	});
+	const deleteAsset = useMutation<unknown, Error, Asset>({
+		mutationFn: (asset) =>
+			projectApi.deleteAsset(
+				asset.id,
+				actionKeys.current.for(actionFingerprint({ type: "delete", asset })),
+			),
+		onSuccess: (_, asset) => {
+			actionKeys.current.clear(actionFingerprint({ type: "delete", asset }));
+			invalidate();
+			setConfirm(null);
+		},
+		onError: report,
+	});
+	return {
+		status,
+		archive,
+		deleteAsset,
+		discard: (target: ConfirmTarget) =>
+			actionKeys.current.clear(actionFingerprint(target)),
+		pendingAction:
+			status.isPending || archive.isPending || deleteAsset.isPending,
+	};
+}
diff --git a/apps/app/components/crm/project-assets/project-workspace-dialogs.tsx b/apps/app/components/crm/project-assets/project-workspace-dialogs.tsx
new file mode 100644
index 000000000..364b4b9ce
--- /dev/null
+++ b/apps/app/components/crm/project-assets/project-workspace-dialogs.tsx
@@ -0,0 +1,106 @@
+"use client";
+
+import type { Appointment, Asset } from "@/lib/project-assets/schemas";
+import { AppointmentFormDialog } from "./appointment-form-dialog";
+import type { UserOption } from "./appointments-list";
+import { AssetEditorDialog } from "./asset-editor-dialog";
+import { ConfirmationDialog } from "./confirmation-dialog";
+import type { ConfirmTarget } from "./project-workspace-actions";
+import { UploadDialog } from "./upload-dialog";
+
+export function ProjectWorkspaceDialogs({
+	projectId,
+	users,
+	defaultOwnerId,
+	appointments,
+	appointmentForm,
+	onAppointmentFormOpenChange,
+	onAppointmentSaved,
+	upload,
+	onUploadOpenChange,
+	onAssetsChanged,
+	assetEditorId,
+	onAssetEditorOpenChange,
+	onAssetSaved,
+	confirm,
+	pendingAction,
+	confirmError,
+	onConfirmOpenChange,
+	onConfirm,
+}: {
+	projectId: string;
+	users: UserOption[];
+	defaultOwnerId: string;
+	appointments: Appointment[];
+	appointmentForm: { open: boolean; appointment: Appointment | null };
+	onAppointmentFormOpenChange: (open: boolean) => void;
+	onAppointmentSaved: (appointment: Appointment) => void;
+	upload: { open: boolean; appointmentId: string | null };
+	onUploadOpenChange: (open: boolean) => void;
+	onAssetsChanged: () => void;
+	assetEditorId: string | null;
+	onAssetEditorOpenChange: (open: boolean) => void;
+	onAssetSaved: (asset: Asset) => void;
+	confirm: ConfirmTarget | null;
+	pendingAction: boolean;
+	confirmError?: string | null;
+	onConfirmOpenChange: (open: boolean) => void;
+	onConfirm: () => void;
+}) {
+	return (
+		<>
+			{appointmentForm.open ? (
+				<AppointmentFormDialog
+					key={appointmentForm.appointment?.id ?? "new"}
+					projectId={projectId}
+					open
+					appointment={appointmentForm.appointment}
+					users={users}
+					defaultOwner={defaultOwnerId}
+					onOpenChange={onAppointmentFormOpenChange}
+					onSaved={onAppointmentSaved}
+				/>
+			) : null}
+			<UploadDialog
+				projectId={projectId}
+				open={upload.open}
+				appointmentId={upload.appointmentId}
+				appointments={appointments}
+				onOpenChange={onUploadOpenChange}
+				onAssetsChanged={onAssetsChanged}
+			/>
+			{assetEditorId ? (
+				<AssetEditorDialog
+					key={assetEditorId}
+					projectId={projectId}
+					assetId={assetEditorId}
+					open
+					onOpenChange={onAssetEditorOpenChange}
+					onSaved={onAssetSaved}
+				/>
+			) : null}
+			<ConfirmationDialog
+				open={Boolean(confirm)}
+				title={`${confirm?.type === "delete" ? "Delete" : confirm?.type === "restore" ? "Restore" : "Archive"} ${confirm?.type === "delete" ? confirm.asset.fileName : (confirm?.appointment.title ?? "appointment")}?`}
+				description={
+					confirm?.type === "delete"
+						? "The file leaves project lists and enters storage cleanup. This does not delete the appointment."
+						: confirm?.type === "restore"
+							? "The appointment returns to the active list. Its files and status stay unchanged."
+							: "The appointment leaves the active list. Its files and collection references stay in the project."
+				}
+				action={
+					confirm?.type === "delete"
+						? "Delete file"
+						: confirm?.type === "restore"
+							? "Restore appointment"
+							: "Archive appointment"
+				}
+				pending={pendingAction}
+				error={confirmError}
+				onOpenChange={onConfirmOpenChange}
+				onConfirm={onConfirm}
+			/>
+		</>
+	);
+}
diff --git a/apps/app/components/crm/project-assets/project-workspace-download.ts b/apps/app/components/crm/project-assets/project-workspace-download.ts
new file mode 100644
index 000000000..a3735830b
--- /dev/null
+++ b/apps/app/components/crm/project-assets/project-workspace-download.ts
@@ -0,0 +1,16 @@
+import { projectApi } from "@/lib/project-assets/client";
+import type { Asset } from "@/lib/project-assets/schemas";
+
+export async function downloadProjectAsset(asset: Asset) {
+	const result = await projectApi.getAsset(asset.id);
+	if (!result.download)
+		throw new Error(
+			result.failure?.message ?? "The file is not available for download.",
+		);
+	const link = document.createElement("a");
+	link.href = result.download.url;
+	link.download = result.asset.fileName;
+	link.target = "_blank";
+	link.rel = "noreferrer";
+	link.click();
+}
diff --git a/apps/app/components/crm/project-assets/project-workspace.tsx b/apps/app/components/crm/project-assets/project-workspace.tsx
new file mode 100644
index 000000000..9efe952c0
--- /dev/null
+++ b/apps/app/components/crm/project-assets/project-workspace.tsx
@@ -0,0 +1,196 @@
+"use client";
+
+import { Button } from "@crm/ui/components/button";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { useState } from "react";
+import { toast } from "sonner";
+import { invalidateProjectWorkspace } from "@/lib/project-assets/cache";
+import type {
+	AppointmentFilters,
+	AssetFilters,
+} from "@/lib/project-assets/client";
+import { appointmentsQuery, assetsQuery } from "@/lib/project-assets/queries";
+import type { Appointment, Asset } from "@/lib/project-assets/schemas";
+import { ProjectAssetsApiError } from "@/lib/project-assets/transport";
+import { useCrmCache } from "@/lib/trpc/cache";
+import { useTRPC } from "@/lib/trpc/client";
+import { AppointmentDetail } from "./appointment-detail";
+import { AppointmentsList, type UserOption } from "./appointments-list";
+import { AssetsList } from "./assets-list";
+import {
+	type ConfirmTarget,
+	useProjectWorkspaceActions,
+} from "./project-workspace-actions";
+import { ProjectWorkspaceDialogs } from "./project-workspace-dialogs";
+import { downloadProjectAsset } from "./project-workspace-download";
+
+export function ProjectWorkspace({
+	projectId,
+	defaultOwnerId,
+}: {
+	projectId: string;
+	defaultOwnerId?: string;
+}) {
+	const trpc = useTRPC();
+	const queryClient = useQueryClient();
+	const crmCache = useCrmCache();
+	const usersQuery = useQuery(trpc.users.list.queryOptions());
+	const users: UserOption[] = (usersQuery.data ?? []).map((user) => ({
+		id: user.id,
+		name: user.name,
+	}));
+	const [appointmentFilters, setAppointmentFilters] =
+		useState<AppointmentFilters>({ page: 1, pageSize: 25, archived: false });
+	const [assetFilters, setAssetFilters] = useState<AssetFilters>({
+		page: 1,
+		pageSize: 25,
+	});
+	const appointments = useQuery(
+		appointmentsQuery(projectId, appointmentFilters),
+	);
+	const assets = useQuery(assetsQuery(projectId, assetFilters));
+	const [selectedAppointmentId, setSelectedAppointmentId] = useState<
+		string | null
+	>(null);
+	const [appointmentForm, setAppointmentForm] = useState<{
+		open: boolean;
+		appointment: Appointment | null;
+	}>({ open: false, appointment: null });
+	const [upload, setUpload] = useState<{
+		open: boolean;
+		appointmentId: string | null;
+	}>({ open: false, appointmentId: null });
+	const [assetEditorId, setAssetEditorId] = useState<string | null>(null);
+	const [confirm, setConfirm] = useState<ConfirmTarget | null>(null);
+	const invalidate = () =>
+		void invalidateProjectWorkspace(queryClient, crmCache, projectId);
+	const actions = useProjectWorkspaceActions({
+		projectId,
+		invalidate,
+		setSelectedAppointmentId,
+		setConfirm,
+	});
+	const download = async (asset: Asset) => {
+		try {
+			await downloadProjectAsset(asset);
+		} catch (error) {
+			toast.error(
+				error instanceof Error ? error.message : "The operation failed.",
+			);
+		}
+	};
+	const appointmentsItems = appointments.data?.items ?? [];
+	return (
+		<div className="flex min-h-0 flex-1 flex-col overflow-y-auto p-4">
+			<div className="space-y-4">
+				{selectedAppointmentId ? (
+					<AppointmentDetail
+						projectId={projectId}
+						appointmentId={selectedAppointmentId}
+						onBack={() => setSelectedAppointmentId(null)}
+						onEdit={(appointment) =>
+							setAppointmentForm({ open: true, appointment })
+						}
+						onUpload={(appointment) =>
+							setUpload({ open: true, appointmentId: appointment.id })
+						}
+						onArchive={(appointment) =>
+							setConfirm({ type: "archive", appointment })
+						}
+						onRestore={(appointment) =>
+							setConfirm({ type: "restore", appointment })
+						}
+						onStatusChange={(appointment, next) =>
+							actions.status.mutate({ appointment, next })
+						}
+						actionPending={actions.pendingAction}
+					/>
+				) : null}
+				<AppointmentsList
+					filters={appointmentFilters}
+					setFilters={setAppointmentFilters}
+					result={appointments.data}
+					loading={appointments.isPending}
+					error={appointments.error?.message}
+					users={users}
+					onSelect={setSelectedAppointmentId}
+					onCreate={() => setAppointmentForm({ open: true, appointment: null })}
+				/>
+				<AssetsList
+					filters={assetFilters}
+					setFilters={setAssetFilters}
+					result={assets.data}
+					loading={assets.isPending}
+					error={assets.error?.message}
+					appointments={appointmentsItems}
+					onUpload={() =>
+						setUpload({ open: true, appointmentId: selectedAppointmentId })
+					}
+					onDownload={download}
+					onEdit={(asset) => setAssetEditorId(asset.id)}
+					onDelete={(asset) => setConfirm({ type: "delete", asset })}
+				/>
+			</div>
+			<ProjectWorkspaceDialogs
+				projectId={projectId}
+				users={users}
+				defaultOwnerId={defaultOwnerId ?? users[0]?.id ?? ""}
+				appointments={appointmentsItems}
+				appointmentForm={appointmentForm}
+				onAppointmentFormOpenChange={(open) =>
+					setAppointmentForm((current) => ({ ...current, open }))
+				}
+				onAppointmentSaved={(appointment) => {
+					invalidate();
+					setSelectedAppointmentId(appointment.id);
+				}}
+				upload={upload}
+				onUploadOpenChange={(open) =>
+					setUpload((current) => ({ ...current, open }))
+				}
+				onAssetsChanged={invalidate}
+				assetEditorId={assetEditorId}
+				onAssetEditorOpenChange={(open) => {
+					if (!open) setAssetEditorId(null);
+				}}
+				onAssetSaved={() => {
+					invalidate();
+					setAssetEditorId(null);
+				}}
+				confirm={confirm}
+				pendingAction={actions.pendingAction}
+				confirmError={
+					actions.archive.error?.message ?? actions.deleteAsset.error?.message
+				}
+				onConfirmOpenChange={(open) => {
+					if (!open && !actions.pendingAction) {
+						if (confirm) actions.discard(confirm);
+						setConfirm(null);
+					}
+				}}
+				onConfirm={() => {
+					if (!confirm) return;
+					if (confirm.type === "delete")
+						actions.deleteAsset.mutate(confirm.asset);
+					else
+						actions.archive.mutate({
+							appointment: confirm.appointment,
+							restore: confirm.type === "restore",
+						});
+				}}
+			/>
+			{usersQuery.error ? (
+				<p className="mt-3 text-muted-foreground text-xs">
+					Owner choices could not be loaded. The project owner remains
+					available.
+				</p>
+			) : null}
+			{actions.status.error instanceof ProjectAssetsApiError &&
+			actions.status.error.code === "VERSION_CONFLICT" ? (
+				<Button variant="outline" size="sm" onClick={invalidate}>
+					Refresh appointment data
+				</Button>
+			) : null}
+		</div>
+	);
+}
diff --git a/apps/app/components/crm/project-assets/transfer-list.tsx b/apps/app/components/crm/project-assets/transfer-list.tsx
new file mode 100644
index 000000000..4131d1cd9
--- /dev/null
+++ b/apps/app/components/crm/project-assets/transfer-list.tsx
@@ -0,0 +1,96 @@
+"use client";
+
+import Close from "@carbon/icons-react/es/Close";
+import Renew from "@carbon/icons-react/es/Renew";
+import {
+	Attachment,
+	AttachmentAction,
+	AttachmentActions,
+	AttachmentContent,
+	AttachmentDescription,
+	AttachmentGroup,
+	AttachmentMedia,
+	AttachmentTitle,
+} from "@crm/ui/components/attachment";
+import { Icon } from "@crm/ui/components/icon";
+import type { UploadItem } from "./upload-session";
+
+const LABELS = {
+	QUEUED: "Queued",
+	UPLOADING: "Uploading",
+	FINALIZING: "Processing",
+	READY: "Ready",
+	FAILED: "Failed",
+	CANCELED: "Canceled",
+} as const;
+
+export function TransferList({
+	items,
+	onRetry,
+	onCancel,
+}: {
+	items: UploadItem[];
+	onRetry: (item: UploadItem) => void;
+	onCancel: (item: UploadItem) => void;
+}) {
+	if (!items.length) return null;
+	return (
+		<AttachmentGroup className="flex-col overflow-visible">
+			{items.map((item) => {
+				const state =
+					item.status === "UPLOADING"
+						? "uploading"
+						: item.status === "FINALIZING"
+							? "processing"
+							: item.status === "FAILED"
+								? "error"
+								: "done";
+				const canRetry = item.status === "FAILED";
+				const canCancel = [
+					"QUEUED",
+					"UPLOADING",
+					"FAILED",
+					"CANCELED",
+				].includes(item.status);
+				return (
+					<Attachment key={item.id} state={state} className="w-full">
+						<AttachmentMedia>
+							<span className="text-muted-foreground text-xs">
+								{item.kind.slice(0, 3).toUpperCase()}
+							</span>
+						</AttachmentMedia>
+						<AttachmentContent>
+							<AttachmentTitle>{item.file.name}</AttachmentTitle>
+							<AttachmentDescription>
+								{LABELS[item.status]}
+								{item.assetId
+									? ` · ${item.assetId}`
+									: item.error
+										? ` · ${item.error}`
+										: ""}
+							</AttachmentDescription>
+						</AttachmentContent>
+						<AttachmentActions>
+							{canRetry ? (
+								<AttachmentAction
+									onClick={() => onRetry(item)}
+									aria-label={`Retry ${item.file.name}`}
+								>
+									<Icon icon={Renew} />
+								</AttachmentAction>
+							) : null}
+							{canCancel ? (
+								<AttachmentAction
+									onClick={() => onCancel(item)}
+									aria-label={`Cancel ${item.file.name}`}
+								>
+									<Icon icon={Close} />
+								</AttachmentAction>
+							) : null}
+						</AttachmentActions>
+					</Attachment>
+				);
+			})}
+		</AttachmentGroup>
+	);
+}
diff --git a/apps/app/components/crm/project-assets/upload-dialog.tsx b/apps/app/components/crm/project-assets/upload-dialog.tsx
new file mode 100644
index 000000000..5122c619b
--- /dev/null
+++ b/apps/app/components/crm/project-assets/upload-dialog.tsx
@@ -0,0 +1,82 @@
+"use client";
+
+import { useRef, useState } from "react";
+import type { Appointment } from "@/lib/project-assets/schemas";
+import { operationKey } from "@/lib/project-assets/transport";
+import { TransferList } from "./transfer-list";
+import { UploadForm } from "./upload-form";
+import { UploadRunner } from "./upload-runner";
+import type { UploadItem } from "./upload-session";
+
+export function UploadDialog({
+	projectId,
+	open,
+	appointmentId,
+	appointments,
+	onOpenChange,
+	onAssetsChanged,
+}: {
+	projectId: string;
+	open: boolean;
+	appointmentId: string | null;
+	appointments: Appointment[];
+	onOpenChange: (open: boolean) => void;
+	onAssetsChanged: () => void;
+}) {
+	const [items, setItems] = useState<UploadItem[]>([]);
+	const runners = useRef(new Map<string, UploadRunner>());
+	const submit = (
+		files: File[],
+		kind: string,
+		selectedAppointment: string | null,
+	) => {
+		const next = files.map<UploadItem>((file) => ({
+			id: operationKey(),
+			file,
+			kind,
+			appointmentId: selectedAppointment,
+			createKey: operationKey(),
+			completeKey: operationKey(),
+			deleteKey: operationKey(),
+			transferred: false,
+			assetId: null,
+			transfer: null,
+			status: "QUEUED",
+			error: null,
+		}));
+		setItems((current) => [...current, ...next]);
+		onOpenChange(false);
+		for (const item of next) {
+			const runner = new UploadRunner(
+				projectId,
+				item,
+				(updated) => {
+					setItems((current) =>
+						current.map((row) => (row.id === updated.id ? updated : row)),
+					);
+				},
+				onAssetsChanged,
+			);
+			runners.current.set(item.id, runner);
+			void runner.run();
+		}
+	};
+	return (
+		<>
+			{open ? (
+				<UploadForm
+					key={appointmentId ?? "none"}
+					appointmentId={appointmentId}
+					appointments={appointments}
+					onClose={() => onOpenChange(false)}
+					onSubmit={submit}
+				/>
+			) : null}
+			<TransferList
+				items={items}
+				onRetry={(item) => void runners.current.get(item.id)?.run()}
+				onCancel={(item) => void runners.current.get(item.id)?.cancel()}
+			/>
+		</>
+	);
+}
diff --git a/apps/app/components/crm/project-assets/upload-form.tsx b/apps/app/components/crm/project-assets/upload-form.tsx
new file mode 100644
index 000000000..9e8073f27
--- /dev/null
+++ b/apps/app/components/crm/project-assets/upload-form.tsx
@@ -0,0 +1,134 @@
+"use client";
+
+import { Button } from "@crm/ui/components/button";
+import {
+	Dialog,
+	DialogContent,
+	DialogDescription,
+	DialogFooter,
+	DialogHeader,
+	DialogTitle,
+} from "@crm/ui/components/dialog";
+import { Field, FieldGroup, FieldLabel } from "@crm/ui/components/field";
+import { Input } from "@crm/ui/components/input";
+import {
+	Select,
+	SelectContent,
+	SelectGroup,
+	SelectItem,
+	SelectTrigger,
+	SelectValue,
+} from "@crm/ui/components/select";
+import { useState } from "react";
+import type { Appointment } from "@/lib/project-assets/schemas";
+
+export function UploadForm({
+	appointmentId,
+	appointments,
+	onClose,
+	onSubmit,
+}: {
+	appointmentId: string | null;
+	appointments: Appointment[];
+	onClose: () => void;
+	onSubmit: (files: File[], kind: string, appointmentId: string | null) => void;
+}) {
+	const [files, setFiles] = useState<File[]>([]);
+	const [kind, setKind] = useState("document");
+	const [selectedAppointment, setSelectedAppointment] = useState(
+		appointmentId ?? "none",
+	);
+	return (
+		<Dialog
+			open
+			onOpenChange={(open) => {
+				if (!open) onClose();
+			}}
+		>
+			<DialogContent className="max-h-[90vh] overflow-y-auto sm:max-w-lg">
+				<DialogHeader>
+					<DialogTitle>Upload project files</DialogTitle>
+					<DialogDescription>
+						Each file uploads independently. Keep this project open until all
+						uploads finish.
+					</DialogDescription>
+				</DialogHeader>
+				<FieldGroup>
+					<Field>
+						<FieldLabel htmlFor="project-files">Files</FieldLabel>
+						<Input
+							id="project-files"
+							type="file"
+							multiple
+							onChange={(event) =>
+								setFiles(Array.from(event.target.files ?? []))
+							}
+						/>
+					</Field>
+					<Field>
+						<FieldLabel htmlFor="project-file-kind">Kind</FieldLabel>
+						<Select value={kind} onValueChange={setKind}>
+							<SelectTrigger id="project-file-kind">
+								<SelectValue />
+							</SelectTrigger>
+							<SelectContent>
+								<SelectGroup>
+									<SelectItem value="meeting_recording">
+										Meeting recording
+									</SelectItem>
+									<SelectItem value="photo">Photo</SelectItem>
+									<SelectItem value="document">Document</SelectItem>
+								</SelectGroup>
+							</SelectContent>
+						</Select>
+					</Field>
+					<Field>
+						<FieldLabel htmlFor="project-file-appointment">
+							Collection appointment
+						</FieldLabel>
+						<Select
+							value={selectedAppointment}
+							onValueChange={setSelectedAppointment}
+						>
+							<SelectTrigger id="project-file-appointment">
+								<SelectValue placeholder="No appointment" />
+							</SelectTrigger>
+							<SelectContent>
+								<SelectGroup>
+									<SelectItem value="none">No appointment</SelectItem>
+									{appointments.map((appointment) => (
+										<SelectItem key={appointment.id} value={appointment.id}>
+											{appointment.title}
+										</SelectItem>
+									))}
+								</SelectGroup>
+							</SelectContent>
+						</Select>
+					</Field>
+					{files.length ? (
+						<p className="text-muted-foreground text-xs">
+							{files.length} file{files.length === 1 ? "" : "s"} selected.
+						</p>
+					) : null}
+				</FieldGroup>
+				<DialogFooter>
+					<Button
+						disabled={!files.length}
+						onClick={() =>
+							onSubmit(
+								files,
+								kind,
+								selectedAppointment === "none" ? null : selectedAppointment,
+							)
+						}
+					>
+						Start upload
+					</Button>
+					<Button type="button" variant="outline" onClick={onClose}>
+						Close
+					</Button>
+				</DialogFooter>
+			</DialogContent>
+		</Dialog>
+	);
+}
diff --git a/apps/app/components/crm/project-assets/upload-runner.ts b/apps/app/components/crm/project-assets/upload-runner.ts
new file mode 100644
index 000000000..41e5d384c
--- /dev/null
+++ b/apps/app/components/crm/project-assets/upload-runner.ts
@@ -0,0 +1,143 @@
+import { projectApi } from "@/lib/project-assets/client";
+import { PROJECT_ASSETS } from "@/lib/project-assets/config";
+import type { AssetDetail } from "@/lib/project-assets/schemas";
+import type { UploadItem } from "./upload-session";
+
+export class UploadRunner {
+	private running = false;
+	private canceled = false;
+	private transferController: AbortController | null = null;
+	constructor(
+		private readonly projectId: string,
+		private item: UploadItem,
+		private readonly changed: (item: UploadItem) => void,
+		private readonly ready: () => void,
+		private readonly api = projectApi,
+		private readonly delay = (milliseconds: number) =>
+			new Promise<void>((resolve) => setTimeout(resolve, milliseconds)),
+	) {}
+
+	private patch(patch: Partial<UploadItem>) {
+		this.item = { ...this.item, ...patch };
+		this.changed(this.item);
+	}
+
+	async cancel() {
+		this.canceled = true;
+		this.transferController?.abort();
+		if (!this.running) await this.run();
+	}
+
+	private async cancelIfRequested(assetId: string) {
+		if (!this.canceled) return false;
+		await this.api.deleteAsset(assetId, this.item.deleteKey);
+		this.patch({ status: "CANCELED", error: null });
+		this.ready();
+		return true;
+	}
+
+	private finished(result: AssetDetail) {
+		if (result.failure) throw new Error(result.failure.message);
+		if (result.asset.status === "READY") {
+			this.patch({ status: "READY", assetId: result.asset.id, error: null });
+			this.ready();
+			return true;
+		}
+		if (["DELETING", "DELETED"].includes(result.asset.status)) {
+			this.patch({ status: "CANCELED", error: null });
+			this.ready();
+			return true;
+		}
+		return false;
+	}
+
+	private async poll(assetId: string) {
+		this.patch({ status: "FINALIZING" });
+		for (
+			let attempt = 0;
+			attempt < PROJECT_ASSETS.upload.pollAttempts;
+			attempt += 1
+		) {
+			if (await this.cancelIfRequested(assetId)) return;
+			if (this.finished(await this.api.getAsset(assetId))) return;
+			await this.delay(PROJECT_ASSETS.upload.pollSeconds * 1000);
+		}
+		throw new Error(
+			"The file is still being verified. Retry to check its status.",
+		);
+	}
+
+	async run() {
+		if (this.running || ["READY", "CANCELED"].includes(this.item.status))
+			return;
+		this.running = true;
+		this.patch({ status: "UPLOADING", error: null });
+		try {
+			let assetId = this.item.assetId;
+			if (!assetId || !this.item.transferred) {
+				const body = {
+					fileName: this.item.file.name,
+					contentType: this.item.file.type || "application/octet-stream",
+					sizeBytes: this.item.file.size,
+					kind: this.item.kind,
+					source: "MANUAL" as const,
+				};
+				const created = this.item.appointmentId
+					? await this.api.createAppointmentAsset(
+							this.item.appointmentId,
+							body,
+							this.item.createKey,
+						)
+					: await this.api.createProjectAsset(
+							this.projectId,
+							body,
+							this.item.createKey,
+						);
+				assetId = created.asset.id;
+				this.patch({ assetId, transfer: created.transfer });
+				if (await this.cancelIfRequested(assetId)) return;
+				if (this.finished(created)) return;
+				if (!created.transfer) {
+					await this.poll(assetId);
+					return;
+				}
+				if (Date.parse(created.transfer.expiresAt) <= Date.now())
+					throw new Error("Upload authorization expired. Retry to refresh it.");
+				if (created.transfer.maxBytes < this.item.file.size)
+					throw new Error("The file exceeds the upload limit.");
+				this.transferController = new AbortController();
+				await this.api.putTransfer(
+					created.transfer,
+					this.item.file,
+					this.transferController.signal,
+				);
+				this.patch({ transferred: true });
+			}
+			if (await this.cancelIfRequested(assetId)) return;
+			await this.api.updateAsset(
+				assetId,
+				{ uploadCompleted: true },
+				this.item.completeKey,
+			);
+			await this.poll(assetId);
+		} catch (error) {
+			let failure = error;
+			if (this.canceled && this.item.assetId) {
+				try {
+					await this.cancelIfRequested(this.item.assetId);
+					return;
+				} catch (deleteError) {
+					failure = deleteError;
+				}
+			}
+			this.patch({
+				status: "FAILED",
+				error:
+					failure instanceof Error ? failure.message : "The upload failed.",
+			});
+		} finally {
+			this.transferController = null;
+			this.running = false;
+		}
+	}
+}
diff --git a/apps/app/components/crm/project-assets/upload-session.ts b/apps/app/components/crm/project-assets/upload-session.ts
new file mode 100644
index 000000000..725496d49
--- /dev/null
+++ b/apps/app/components/crm/project-assets/upload-session.ts
@@ -0,0 +1,24 @@
+import type { AssetCreation } from "@/lib/project-assets/schemas";
+
+export type UploadItemStatus =
+	| "QUEUED"
+	| "UPLOADING"
+	| "FINALIZING"
+	| "READY"
+	| "FAILED"
+	| "CANCELED";
+
+export type UploadItem = {
+	id: string;
+	file: File;
+	kind: string;
+	appointmentId: string | null;
+	createKey: string;
+	completeKey: string;
+	deleteKey: string;
+	transferred: boolean;
+	assetId: string | null;
+	transfer: AssetCreation["transfer"];
+	status: UploadItemStatus;
+	error: string | null;
+};
diff --git a/apps/app/components/crm/record-sheet/deal-sheet.tsx b/apps/app/components/crm/record-sheet/deal-sheet.tsx
index 681a15ec6..628b1f164 100644
--- a/apps/app/components/crm/record-sheet/deal-sheet.tsx
+++ b/apps/app/components/crm/record-sheet/deal-sheet.tsx
@@ -36,6 +36,7 @@ import {
 	savingValue,
 } from "@/components/crm/inline-field";
 import { OwnerCell } from "@/components/crm/owner-cell";
+import { ProjectWorkspace } from "@/components/crm/project-assets/project-workspace";
 import { DealStageMenu } from "@/components/crm/stage-change";
 import { StageStepper } from "@/components/crm/stage-stepper";
 import { Timeline } from "@/components/crm/timeline/timeline";
@@ -158,6 +159,17 @@ export function DealSheet({ dealId }: { dealId: string }) {
 					label: "Activity",
 					content: <Timeline anchor={{ dealId: deal.id }} />,
 				},
+				{
+					value: "project",
+					label: "Project",
+					content: (
+						<ProjectWorkspace
+							projectId={deal.id}
+							defaultOwnerId={deal.owner.id}
+						/>
+					),
+					keepMounted: true,
+				},
 				{
 					value: "agent",
 					label: "Agent",
diff --git a/apps/app/components/landing/hero.tsx b/apps/app/components/landing/hero.tsx
index 3fd11ef67..e89a16c27 100644
--- a/apps/app/components/landing/hero.tsx
+++ b/apps/app/components/landing/hero.tsx
@@ -6,7 +6,7 @@ export function Hero() {
 		<section className="relative flex w-full shrink-0 flex-col items-center px-6 pt-20 pb-10 md:pt-30">
 			<div className="relative flex w-full max-w-6xl flex-col items-center gap-7">
 				<h1 className="max-w-[900px] text-balance text-center font-semibold text-5xl/[52px] tracking-tight md:text-[72px]/[76px]">
-					The CRM built for Agents
+					JobSteward, the CRM built for agents
 				</h1>
 
 				<p className="max-w-[640px] text-pretty text-center text-muted-foreground text-lg/[28px] md:text-xl/[30px]">
diff --git a/apps/app/components/landing/landing-footer.tsx b/apps/app/components/landing/landing-footer.tsx
index 8858eb405..ce94ee424 100644
--- a/apps/app/components/landing/landing-footer.tsx
+++ b/apps/app/components/landing/landing-footer.tsx
@@ -10,7 +10,7 @@ export function LandingFooter() {
 				<div className="flex w-[280px] max-w-full shrink-0 flex-col gap-[14px]">
 					<Wordmark />
 					<p className="text-[13px]/[21px] text-muted-foreground">
-						The open source agentic CRM.
+						JobSteward is an agentic CRM.
 					</p>
 				</div>
 
@@ -47,6 +47,15 @@ export function LandingFooter() {
 						</Link>
 					</p>
 
+					<nav className="flex items-center gap-4 text-[13px]/5 text-muted-foreground">
+						<Link variant="quiet" href="/privacy">
+							Privacy
+						</Link>
+						<Link variant="quiet" href="/terms">
+							Terms
+						</Link>
+					</nav>
+
 					<p className="flex items-center gap-2 text-[13px]/5 text-muted-foreground">
 						<span className="size-1.5 shrink-0 rounded-full bg-ring" />
 						All systems normal
diff --git a/apps/app/components/org-switcher.tsx b/apps/app/components/org-switcher.tsx
new file mode 100644
index 000000000..f117d0a9d
--- /dev/null
+++ b/apps/app/components/org-switcher.tsx
@@ -0,0 +1,64 @@
+"use client";
+
+import { authClient } from "@crm/auth/client";
+import { Button } from "@crm/ui/components/button";
+import {
+	DropdownMenu,
+	DropdownMenuContent,
+	DropdownMenuItem,
+	DropdownMenuTrigger,
+} from "@crm/ui/components/dropdown-menu";
+import { useTransition } from "react";
+import { toast } from "sonner";
+
+export type OrgOption = { id: string; name: string; slug: string };
+
+export function OrgSwitcher({
+	current,
+	options,
+}: {
+	current: OrgOption;
+	options: OrgOption[];
+}) {
+	const [isPending, startTransition] = useTransition();
+
+	if (options.length <= 1) return null;
+
+	function switchTo(option: OrgOption) {
+		if (option.id === current.id) return;
+
+		startTransition(async () => {
+			const { error } = await authClient.organization.setActive({
+				organizationId: option.id,
+			});
+
+			if (error) {
+				toast.error(error.message ?? "Could not switch workspace.");
+				return;
+			}
+
+			window.location.assign(`/${option.slug}`);
+		});
+	}
+
+	return (
+		<DropdownMenu>
+			<DropdownMenuTrigger asChild>
+				<Button variant="outline" disabled={isPending}>
+					{current.name}
+				</Button>
+			</DropdownMenuTrigger>
+			<DropdownMenuContent>
+				{options.map((option) => (
+					<DropdownMenuItem
+						key={option.id}
+						disabled={option.id === current.id}
+						onSelect={() => switchTo(option)}
+					>
+						{option.name}
+					</DropdownMenuItem>
+				))}
+			</DropdownMenuContent>
+		</DropdownMenu>
+	);
+}
diff --git a/apps/app/lib/agent-bridge.ts b/apps/app/lib/agent-bridge.ts
index 9b57449b2..98d8b4065 100644
--- a/apps/app/lib/agent-bridge.ts
+++ b/apps/app/lib/agent-bridge.ts
@@ -15,6 +15,7 @@ type BridgeClaims = {
 	sub: string;
 	email: string;
 	name: string;
+	organizationId: string;
 	contactId?: string;
 	companyId?: string;
 	dealId?: string;
@@ -29,6 +30,7 @@ export async function mintBridgeToken(
 		email: string;
 		name: string;
 	},
+	organizationId: string,
 	record: { contactId?: string; companyId?: string; dealId?: string } = {},
 ): Promise<string> {
 	const secret = process.env.AGENT_BRIDGE_SECRET;
@@ -43,6 +45,7 @@ export async function mintBridgeToken(
 		sub: user.id,
 		email: user.email,
 		name: user.name,
+		organizationId,
 		iat: now,
 		nbf: now - 5,
 		exp: now + TTL_SECONDS,
diff --git a/apps/app/lib/agent-session.ts b/apps/app/lib/agent-session.ts
index 5d59dfbb2..7fde239e9 100644
--- a/apps/app/lib/agent-session.ts
+++ b/apps/app/lib/agent-session.ts
@@ -1,4 +1,4 @@
-import type { MessageStreamEvent, SessionState } from "eve/client";
+import type { ClientSessionState, MessageStreamEvent } from "eve/client";
 import { Client } from "eve/client";
 
 const ABANDONED_AFTER_MS = 90_000;
@@ -9,17 +9,17 @@ export type Thread =
 	  }
 	| {
 			status: "ready";
-			session: SessionState;
+			session: ClientSessionState;
 			events: readonly MessageStreamEvent[];
 	  }
 	| {
 			status: "working";
-			session: SessionState;
+			session: ClientSessionState;
 			events: readonly MessageStreamEvent[];
 	  }
 	| {
 			status: "ended";
-			session: SessionState;
+			session: ClientSessionState;
 			events: readonly MessageStreamEvent[];
 	  }
 	| {
@@ -33,12 +33,12 @@ export async function loadThread(
 	signal?: AbortSignal,
 ): Promise<Thread> {
 	try {
-		const snapshot = await new Client({ headers, host: "" })
-			.session({ sessionId, streamIndex: 0 })
+		const snapshot = await new Client({ headers, host: "" }).sessions
+			.attach(sessionId, { streamIndex: 0 })
 			.snapshot({ signal });
 
 		return {
-			status: classify(snapshot.session, snapshot.events),
+			status: classify(snapshot.events),
 			session: snapshot.session,
 			events: snapshot.events,
 		} as Thread;
@@ -54,13 +54,11 @@ export function offlineThread(events: readonly MessageStreamEvent[]): Thread {
 }
 
 export function classify(
-	session: SessionState,
 	events: readonly MessageStreamEvent[],
 	now: number = Date.now(),
 ): "ready" | "working" | "ended" {
-	if (session.continuationToken) return "ready";
-
 	const last = events.at(-1);
+	if (last?.type === "session.waiting") return "ready";
 	if (!last) return "ended";
 
 	if (last.type === "session.completed" || last.type === "session.failed") {
diff --git a/apps/app/lib/agent-transcript.ts b/apps/app/lib/agent-transcript.ts
index 2898c35bb..1e1991e85 100644
--- a/apps/app/lib/agent-transcript.ts
+++ b/apps/app/lib/agent-transcript.ts
@@ -83,7 +83,12 @@ const VERBS: ToolVerbs = {
 	set_field_value: "Filled in a custom field",
 	manage_fields: "Changed what the CRM tracks",
 	archive_field: "Asked to retire a field",
-
+	project_list: "Reviewed the project list",
+	task_list: "Reviewed the project tasks",
+	task_read: "Read a project task",
+	task_create: "Created a project task",
+	kaneo_task_update: "Updated a project task",
+	task_comment: "Commented on a project task",
 	load_skill: "Read its instructions for this",
 	web_search: "Searched the web",
 	web_fetch: "Read a web page",
diff --git a/apps/app/lib/api-proxy-path.ts b/apps/app/lib/api-proxy-path.ts
new file mode 100644
index 000000000..8ce98e30c
--- /dev/null
+++ b/apps/app/lib/api-proxy-path.ts
@@ -0,0 +1,8 @@
+const canonicalResourcePath =
+	/^\/api\/(?:assets\/[^/]+|appointments\/[^/]+\/assets|projects\/[^/]+\/(?:assets|appointments))(?:\/|$)/;
+
+export function apiProxyPath(pathname: string): string {
+	return canonicalResourcePath.test(pathname)
+		? pathname.replace(/^\/api/, "")
+		: pathname;
+}
diff --git a/apps/app/lib/app-path.ts b/apps/app/lib/app-path.ts
new file mode 100644
index 000000000..f8d3083f6
--- /dev/null
+++ b/apps/app/lib/app-path.ts
@@ -0,0 +1,37 @@
+import { workspaceUrl } from "@/lib/workspace-url";
+
+const LANDING_PATH = "/";
+const NO_ORGANIZATION_PATH = "/no-organization";
+const SECTIONS = ["/companies", "/contacts", "/deals", "/settings"];
+
+export function appPath(
+	pathname: string,
+	workspace: { slug: string | null; hasOrganization: boolean | null },
+	onboardingPath = "/onboarding",
+	researchPath = "/onboarding/research",
+): string {
+	if (workspace.hasOrganization !== true || !workspace.slug) {
+		return NO_ORGANIZATION_PATH;
+	}
+
+	if (
+		pathname === LANDING_PATH ||
+		pathname === onboardingPath ||
+		pathname === researchPath
+	) {
+		return workspaceUrl(workspace.slug);
+	}
+
+	if (SECTIONS.some((section) => isUnder(pathname, section))) {
+		return workspaceUrl(workspace.slug, pathname);
+	}
+
+	const [, first, ...rest] = pathname.split("/");
+	return first === workspace.slug
+		? pathname
+		: workspaceUrl(workspace.slug, rest.length ? `/${rest.join("/")}` : "/");
+}
+
+export function isUnder(pathname: string, prefix: string): boolean {
+	return pathname === prefix || pathname.startsWith(`${prefix}/`);
+}
diff --git a/apps/app/lib/oauth-query.ts b/apps/app/lib/oauth-query.ts
new file mode 100644
index 000000000..f53f81200
--- /dev/null
+++ b/apps/app/lib/oauth-query.ts
@@ -0,0 +1,54 @@
+import { z } from "zod";
+
+const searchParamValue = z.union([
+	z.string(),
+	z.array(z.string()),
+	z.undefined(),
+]);
+
+const searchParams = z.record(z.string(), searchParamValue);
+
+export const signInSearchParams = searchParams.and(
+	z.object({
+		method: z.string().optional(),
+		sig: z.string().optional(),
+	}),
+);
+
+export const consentSearchParams = searchParams.and(
+	z.object({
+		client_id: z.string(),
+		scope: z.string().optional(),
+		sig: z.string(),
+	}),
+);
+
+export function serializeOAuthQuery(
+	params: z.infer<typeof searchParams>,
+): string {
+	const query = new URLSearchParams();
+	for (const [key, value] of Object.entries(params)) {
+		if (Array.isArray(value)) {
+			for (const item of value) query.append(key, item);
+		} else if (value !== undefined) {
+			query.set(key, value);
+		}
+	}
+	return query.toString();
+}
+
+export type OAuthSignInOptions = {
+	errorCallbackURL: string;
+	oauth_query?: string;
+};
+
+export function oauthSignInOptions(
+	oauthQuery: string | null,
+	origin: string,
+): OAuthSignInOptions {
+	const errorUrl = new URL("/sign-in", origin);
+	if (oauthQuery) errorUrl.search = oauthQuery;
+	const options: OAuthSignInOptions = { errorCallbackURL: errorUrl.toString() };
+	if (oauthQuery) options.oauth_query = oauthQuery;
+	return options;
+}
diff --git a/apps/app/lib/onboarding.ts b/apps/app/lib/onboarding.ts
index ea8273789..7fd257492 100644
--- a/apps/app/lib/onboarding.ts
+++ b/apps/app/lib/onboarding.ts
@@ -1,3 +1,4 @@
+import { workspaceGate } from "@crm/validation/workspace-gate";
 import type { NextRequest } from "next/server";
 import { z } from "zod";
 import { API_URL } from "@/lib/env";
@@ -14,18 +15,6 @@ const procedureResult = z
 	.object({ result: z.object({ data: z.json() }).catch({ data: null }) })
 	.catch({ result: { data: null } });
 
-const workspaceAnswer = z
-	.object({
-		onboarded: z.boolean().nullable().catch(null),
-		canRename: z.boolean().nullable().catch(null),
-		slug: z.string().min(1).nullable().catch(null),
-	})
-	.catch({ onboarded: null, canRename: null, slug: null });
-
-const researchKeyAnswer = z
-	.object({ configured: z.boolean().nullable().catch(null) })
-	.catch({ configured: null });
-
 async function read(request: NextRequest, procedure: string) {
 	const cookie = request.headers.get("cookie");
 
@@ -46,17 +35,28 @@ async function read(request: NextRequest, procedure: string) {
 	}
 }
 
-export type WorkspaceGate = { gate: Gate; slug: string | null };
+export type WorkspaceGate = {
+	gate: Gate;
+	slug: string | null;
+	hasOrganization: boolean | null;
+};
 
 export async function readWorkspaceGate(
 	request: NextRequest,
 ): Promise<WorkspaceGate> {
-	const workspace = workspaceAnswer.parse(await read(request, "workspace.get"));
+	const answer = workspaceGate.safeParse(await read(request, "workspace.gate"));
+
+	if (!answer.success) {
+		return { gate: "unknown", slug: null, hasOrganization: null };
+	}
+
+	const workspace = answer.data;
 
 	const slug = workspace.slug;
+	const hasOrganization = workspace.organizationId !== null;
 
 	if (workspace.onboarded === null) {
-		return { gate: "unknown", slug };
+		return { gate: "unknown", slug, hasOrganization };
 	}
 
 	return {
@@ -65,15 +65,6 @@ export async function readWorkspaceGate(
 				? "settled"
 				: "required",
 		slug,
+		hasOrganization,
 	};
 }
-
-export async function readResearchGate(request: NextRequest): Promise<Gate> {
-	const { configured } = researchKeyAnswer.parse(
-		await read(request, "settings.researchKey"),
-	);
-
-	if (configured === null) return "unknown";
-
-	return configured ? "settled" : "required";
-}
diff --git a/apps/app/lib/project-assets/cache.ts b/apps/app/lib/project-assets/cache.ts
new file mode 100644
index 000000000..aecf086ef
--- /dev/null
+++ b/apps/app/lib/project-assets/cache.ts
@@ -0,0 +1,14 @@
+import type { QueryClient } from "@tanstack/react-query";
+import type { CrmCache } from "@/lib/trpc/cache";
+import { projectKeys } from "./queries";
+
+export async function invalidateProjectWorkspace(
+	queryClient: QueryClient,
+	crmCache: Pick<CrmCache, "activity">,
+	projectId: string,
+) {
+	await Promise.all([
+		queryClient.invalidateQueries({ queryKey: projectKeys.scope(projectId) }),
+		crmCache.activity(),
+	]);
+}
diff --git a/apps/app/lib/project-assets/client.ts b/apps/app/lib/project-assets/client.ts
new file mode 100644
index 000000000..7dc350e63
--- /dev/null
+++ b/apps/app/lib/project-assets/client.ts
@@ -0,0 +1,150 @@
+import type {
+	AppointmentCreateBody,
+	AppointmentStatus,
+	AppointmentUpdateBody,
+	Asset,
+	AssetCreateBody,
+	AssetCreation,
+	AssetUpdateBody,
+} from "./schemas";
+import {
+	appointmentArchiveSchema,
+	appointmentDetailSchema,
+	appointmentListSchema,
+	assetCreationSchema,
+	assetDeletionSchema,
+	assetDetailSchema,
+	assetListSchema,
+} from "./schemas";
+import { projectPath, query, request } from "./transport";
+
+export type AppointmentFilters = {
+	page: number;
+	pageSize: number;
+	status?: AppointmentStatus;
+	ownerId?: string;
+	from?: string;
+	to?: string;
+	archived?: boolean;
+};
+
+export type AssetFilters = {
+	page: number;
+	pageSize: number;
+	appointmentId?: string;
+	kind?: string;
+	source?: "MANUAL" | "MOBILE_RECORDING" | "EMAIL_ATTACHMENT";
+};
+
+export const projectApi = {
+	listAppointments(projectId: string, filters: AppointmentFilters) {
+		const suffix = query(filters);
+		return request(
+			`${projectPath(projectId, "appointments")}${suffix ? `?${suffix}` : ""}`,
+			appointmentListSchema,
+		);
+	},
+	getAppointment(projectId: string, appointmentId: string) {
+		return request(
+			`${projectPath(projectId, "appointments")}/${encodeURIComponent(appointmentId)}`,
+			appointmentDetailSchema,
+		);
+	},
+	createAppointment(
+		projectId: string,
+		body: AppointmentCreateBody,
+		idempotencyKey: string,
+	) {
+		return request(
+			projectPath(projectId, "appointments"),
+			appointmentDetailSchema,
+			{ method: "POST", body, idempotencyKey },
+		);
+	},
+	updateAppointment(
+		projectId: string,
+		appointmentId: string,
+		body: AppointmentUpdateBody,
+		idempotencyKey: string,
+	) {
+		return request(
+			`${projectPath(projectId, "appointments")}/${encodeURIComponent(appointmentId)}`,
+			appointmentDetailSchema,
+			{ method: "PATCH", body, idempotencyKey },
+		);
+	},
+	archiveAppointment(
+		projectId: string,
+		appointmentId: string,
+		idempotencyKey: string,
+	) {
+		return request(
+			`${projectPath(projectId, "appointments")}/${encodeURIComponent(appointmentId)}`,
+			appointmentArchiveSchema,
+			{ method: "DELETE", idempotencyKey },
+		);
+	},
+	listAssets(projectId: string, filters: AssetFilters) {
+		const { appointmentId, ...params } = filters;
+		const path = appointmentId
+			? `/appointments/${encodeURIComponent(appointmentId)}/assets`
+			: projectPath(projectId, "assets");
+		const suffix = query(params);
+		return request(`${path}${suffix ? `?${suffix}` : ""}`, assetListSchema);
+	},
+	getAsset(assetId: string) {
+		return request(`/assets/${encodeURIComponent(assetId)}`, assetDetailSchema);
+	},
+	updateAsset(assetId: string, body: AssetUpdateBody, idempotencyKey: string) {
+		return request(
+			`/assets/${encodeURIComponent(assetId)}`,
+			assetDetailSchema,
+			{ method: "PATCH", body, idempotencyKey },
+		);
+	},
+	deleteAsset(assetId: string, idempotencyKey: string) {
+		return request(
+			`/assets/${encodeURIComponent(assetId)}`,
+			assetDeletionSchema,
+			{ method: "DELETE", idempotencyKey },
+		);
+	},
+	createProjectAsset(
+		projectId: string,
+		body: AssetCreateBody,
+		idempotencyKey: string,
+	) {
+		return request(projectPath(projectId, "assets"), assetCreationSchema, {
+			method: "POST",
+			body,
+			idempotencyKey,
+		});
+	},
+	createAppointmentAsset(
+		appointmentId: string,
+		body: AssetCreateBody,
+		idempotencyKey: string,
+	) {
+		return request(
+			`/appointments/${encodeURIComponent(appointmentId)}/assets`,
+			assetCreationSchema,
+			{ method: "POST", body, idempotencyKey },
+		);
+	},
+	putTransfer(
+		transfer: NonNullable<AssetCreation["transfer"]>,
+		file: File,
+		signal?: AbortSignal,
+	) {
+		return fetch(transfer.url, {
+			method: transfer.method,
+			headers: transfer.headers,
+			body: file,
+			credentials: "omit",
+			signal,
+		}).then((response) => {
+			if (!response.ok) throw new Error("The file transfer failed.");
+		});
+	},
+};
+export type { AppointmentStatus, Asset };
diff --git a/apps/app/lib/project-assets/config.ts b/apps/app/lib/project-assets/config.ts
new file mode 100644
index 000000000..c4695f037
--- /dev/null
+++ b/apps/app/lib/project-assets/config.ts
@@ -0,0 +1,3 @@
+export const PROJECT_ASSETS = {
+	upload: { pollAttempts: 120, pollSeconds: 3 },
+} as const;
diff --git a/apps/app/lib/project-assets/date-time.ts b/apps/app/lib/project-assets/date-time.ts
new file mode 100644
index 000000000..2204be6df
--- /dev/null
+++ b/apps/app/lib/project-assets/date-time.ts
@@ -0,0 +1,132 @@
+const DATE_PARTS = ["year", "month", "day", "hour", "minute"] as const;
+
+function partsFor(date: Date, timeZone: string) {
+	return new Intl.DateTimeFormat("en-US", {
+		timeZone,
+		calendar: "gregory",
+		numberingSystem: "latn",
+		hourCycle: "h23",
+		year: "numeric",
+		month: "2-digit",
+		day: "2-digit",
+		hour: "2-digit",
+		minute: "2-digit",
+	})
+		.formatToParts(date)
+		.reduce<Record<string, string>>((parts, part) => {
+			if (DATE_PARTS.includes(part.type as (typeof DATE_PARTS)[number])) {
+				parts[part.type] = part.value;
+			}
+			return parts;
+		}, {});
+}
+
+export function isoToLocalInput(
+	value: string | null,
+	timeZone: string,
+): string {
+	if (!value) return "";
+	try {
+		const parts = partsFor(new Date(value), timeZone);
+		return `${parts.year}-${parts.month}-${parts.day}T${parts.hour}:${parts.minute}`;
+	} catch {
+		return value.slice(0, 16);
+	}
+}
+
+function zoneOffsetMs(date: Date, timeZone: string): number {
+	const parts = partsFor(date, timeZone);
+	const asUtc = Date.UTC(
+		Number(parts.year),
+		Number(parts.month) - 1,
+		Number(parts.day),
+		Number(parts.hour),
+		Number(parts.minute),
+		date.getUTCSeconds(),
+	);
+	return asUtc - date.getTime();
+}
+
+function wallKey(parts: Record<string, string>) {
+	return `${parts.year}-${parts.month}-${parts.day}T${parts.hour}:${parts.minute}`;
+}
+
+export function localInputToIso(value: string, timeZone: string): string {
+	const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})$/.exec(value);
+	if (!match) throw new Error("Enter a valid date and time.");
+	const [, yearText, monthText, dayText, hourText, minuteText] = match;
+	const year = Number(yearText);
+	const month = Number(monthText);
+	const day = Number(dayText);
+	const hour = Number(hourText);
+	const minute = Number(minuteText);
+	const localAsUtc = new Date(Date.UTC(year, month - 1, day, hour, minute));
+	if (localAsUtc.toISOString().slice(0, 16) !== value)
+		throw new Error("Enter a valid date and time.");
+	const offsets = new Set<number>();
+	for (const hours of [-48, -24, -2, -1, 0, 1, 2, 24, 48]) {
+		offsets.add(
+			zoneOffsetMs(
+				new Date(localAsUtc.getTime() + hours * 3_600_000),
+				timeZone,
+			),
+		);
+	}
+	const matches = [...offsets]
+		.map((offset) => new Date(localAsUtc.getTime() - offset))
+		.filter((candidate) => wallKey(partsFor(candidate, timeZone)) === value);
+	if (matches.length === 0)
+		throw new Error(
+			"This local time does not exist in the selected time zone.",
+		);
+	if (matches.length > 1)
+		throw new Error(
+			"This local time occurs twice in the selected time zone. Choose another time.",
+		);
+	return matches[0]?.toISOString() ?? "";
+}
+
+export function dateBoundary(value: string, end = false): string | undefined {
+	if (!value) return undefined;
+	const boundary = new Date(`${value}T00:00:00.000Z`);
+	if (end) boundary.setUTCDate(boundary.getUTCDate() + 1);
+	return boundary.toISOString();
+}
+
+export function defaultTimeZone(): string {
+	return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+}
+
+export function formatAppointmentDate(
+	value: string,
+	timeZone: string,
+	options: Intl.DateTimeFormatOptions = {
+		month: "short",
+		day: "numeric",
+		year: "numeric",
+		hour: "numeric",
+		minute: "2-digit",
+	},
+) {
+	try {
+		return new Intl.DateTimeFormat(undefined, {
+			timeZone,
+			...options,
+		}).format(new Date(value));
+	} catch {
+		return new Date(value).toLocaleString();
+	}
+}
+
+export function formatBytes(value: number | null): string {
+	if (value === null) return "Unknown size";
+	if (value < 1024) return `${value} B`;
+	const units = ["KB", "MB", "GB"];
+	let size = value / 1024;
+	let unit = 0;
+	while (size >= 1024 && unit < units.length - 1) {
+		size /= 1024;
+		unit += 1;
+	}
+	return `${size.toFixed(size >= 10 ? 0 : 1)} ${units[unit]}`;
+}
diff --git a/apps/app/lib/project-assets/mutation-keys.ts b/apps/app/lib/project-assets/mutation-keys.ts
new file mode 100644
index 000000000..2b860dbd0
--- /dev/null
+++ b/apps/app/lib/project-assets/mutation-keys.ts
@@ -0,0 +1,19 @@
+import { operationKey } from "./transport";
+
+export function createOperationKeyStore(
+	createKey: () => string = operationKey,
+) {
+	const keys = new Map<string, string>();
+	return {
+		for(fingerprint: string) {
+			const existing = keys.get(fingerprint);
+			if (existing) return existing;
+			const next = createKey();
+			keys.set(fingerprint, next);
+			return next;
+		},
+		clear(fingerprint: string) {
+			keys.delete(fingerprint);
+		},
+	};
+}
diff --git a/apps/app/lib/project-assets/queries.ts b/apps/app/lib/project-assets/queries.ts
new file mode 100644
index 000000000..8c2ab1caa
--- /dev/null
+++ b/apps/app/lib/project-assets/queries.ts
@@ -0,0 +1,53 @@
+import { queryOptions } from "@tanstack/react-query";
+import type { AppointmentFilters, AssetFilters } from "./client";
+import { projectApi } from "./client";
+
+const root = ["project-workspace"] as const;
+
+export const projectKeys = {
+	scope: (projectId: string) => [...root, projectId] as const,
+	appointments: (projectId: string, filters: AppointmentFilters) =>
+		[...projectKeys.scope(projectId), "appointments", filters] as const,
+	appointment: (projectId: string, appointmentId: string) =>
+		[...projectKeys.scope(projectId), "appointment", appointmentId] as const,
+	assets: (projectId: string, filters: AssetFilters) =>
+		[...projectKeys.scope(projectId), "assets", filters] as const,
+	asset: (projectId: string, assetId: string) =>
+		[...projectKeys.scope(projectId), "asset", assetId] as const,
+};
+
+export function appointmentsQuery(
+	projectId: string,
+	filters: AppointmentFilters,
+) {
+	return queryOptions({
+		queryKey: projectKeys.appointments(projectId, filters),
+		queryFn: () => projectApi.listAppointments(projectId, filters),
+	});
+}
+
+export function appointmentQuery(
+	projectId: string,
+	appointmentId: string | null,
+) {
+	return queryOptions({
+		queryKey: projectKeys.appointment(projectId, appointmentId ?? "none"),
+		queryFn: () => projectApi.getAppointment(projectId, appointmentId ?? ""),
+		enabled: Boolean(appointmentId),
+	});
+}
+
+export function assetsQuery(projectId: string, filters: AssetFilters) {
+	return queryOptions({
+		queryKey: projectKeys.assets(projectId, filters),
+		queryFn: () => projectApi.listAssets(projectId, filters),
+	});
+}
+
+export function assetQuery(projectId: string, assetId: string | null) {
+	return queryOptions({
+		queryKey: projectKeys.asset(projectId, assetId ?? "none"),
+		queryFn: () => projectApi.getAsset(assetId ?? ""),
+		enabled: Boolean(assetId),
+	});
+}
diff --git a/apps/app/lib/project-assets/schemas.ts b/apps/app/lib/project-assets/schemas.ts
new file mode 100644
index 000000000..a8054d49f
--- /dev/null
+++ b/apps/app/lib/project-assets/schemas.ts
@@ -0,0 +1,192 @@
+import { z } from "zod";
+
+const dateTime = z.string().datetime({ offset: true });
+
+export const appointmentStatus = z.enum(["SCHEDULED", "COMPLETED", "CANCELED"]);
+const appointmentFields = {
+	title: z.string().trim().min(1).max(255),
+	notes: z.string().max(20000).nullable().optional(),
+	startsAt: dateTime,
+	endsAt: dateTime.nullable().optional(),
+	timeZone: z.string().min(1).max(100),
+	location: z.string().max(1000).nullable().optional(),
+	ownerId: z.string().min(1).max(128),
+	status: appointmentStatus,
+};
+export const appointmentCreateBodySchema = z.object(appointmentFields);
+export const appointmentUpdateBodySchema = z
+	.object({
+		...appointmentFields,
+		expectedVersion: z.number().int().positive(),
+		archived: z.literal(false).optional(),
+	})
+	.partial({
+		title: true,
+		startsAt: true,
+		timeZone: true,
+		ownerId: true,
+		status: true,
+	});
+
+export const appointmentSchema = z.object({
+	id: z.string(),
+	projectId: z.string(),
+	customerId: z.string(),
+	title: z.string(),
+	notes: z.string().nullable(),
+	startsAt: dateTime,
+	endsAt: dateTime.nullable(),
+	timeZone: z.string(),
+	location: z.string().nullable(),
+	ownerId: z.string(),
+	status: appointmentStatus,
+	statusChangedAt: dateTime,
+	version: z.number().int().positive(),
+	archivedAt: dateTime.nullable(),
+	createdById: z.string(),
+	createdAt: dateTime,
+	updatedAt: dateTime,
+});
+
+export const appointmentDetailSchema = z.object({
+	appointment: appointmentSchema,
+});
+export const appointmentListSchema = z.object({
+	items: z.array(appointmentSchema),
+	page: z.number().int(),
+	pageSize: z.number().int(),
+	total: z.number().int(),
+	hasNextPage: z.boolean(),
+});
+export const appointmentArchiveSchema = z.object({
+	appointmentId: z.string(),
+	archivedAt: dateTime,
+	version: z.number().int().positive(),
+});
+
+export const assetSource = z.enum([
+	"MANUAL",
+	"MOBILE_RECORDING",
+	"EMAIL_ATTACHMENT",
+]);
+export const assetSchema = z.object({
+	id: z.string(),
+	customerId: z.string(),
+	projectId: z.string(),
+	appointmentId: z.string().nullable(),
+	fileName: z.string(),
+	contentType: z.string(),
+	sizeBytes: z.number().int().nonnegative().nullable(),
+	kind: z.string(),
+	source: assetSource.nullable(),
+	emailSource: z
+		.object({ messageId: z.string(), attachmentId: z.string() })
+		.nullable(),
+	uploadedById: z.string().nullable(),
+	durationMilliseconds: z.number().int().nonnegative().nullable(),
+	capturedAt: dateTime.nullable(),
+	createdAt: dateTime,
+	updatedAt: dateTime,
+	status: z.enum(["UNVERIFIED", "READY", "DELETING", "DELETED"]),
+	deletedAt: dateTime.nullable(),
+	version: z.number().int().positive(),
+});
+export const assetDetailSchema = z.object({
+	asset: assetSchema,
+	download: z.object({ url: z.string().url(), expiresAt: dateTime }).nullable(),
+	failure: z
+		.object({
+			code: z.enum([
+				"UPLOAD_EXPIRED",
+				"UPLOAD_VERIFICATION_FAILED",
+				"UPLOAD_FINALIZATION_FAILED",
+			]),
+			message: z.string(),
+		})
+		.nullable(),
+});
+export const assetUpdateBodySchema = z
+	.strictObject({
+		expectedVersion: z.number().int().positive().optional(),
+		fileName: z.string().trim().min(1).max(255).optional(),
+		kind: z.string().trim().min(1).max(64).optional(),
+		uploadCompleted: z.literal(true).optional(),
+	})
+	.superRefine((input, context) => {
+		const metadata = input.fileName !== undefined || input.kind !== undefined;
+		if (!metadata && !input.uploadCompleted)
+			context.addIssue({
+				code: "custom",
+				message: "Supply an asset field to update.",
+			});
+		if (metadata && input.expectedVersion === undefined)
+			context.addIssue({
+				code: "custom",
+				path: ["expectedVersion"],
+				message: "Metadata changes require the current version.",
+			});
+		if (!metadata && input.expectedVersion !== undefined)
+			context.addIssue({
+				code: "custom",
+				path: ["expectedVersion"],
+				message: "Only metadata changes accept a version.",
+			});
+	});
+export const assetListSchema = z.object({
+	items: z.array(assetSchema),
+	page: z.number().int(),
+	pageSize: z.number().int(),
+	total: z.number().int(),
+	hasNextPage: z.boolean(),
+});
+export const assetDeletionSchema = z.object({
+	assetId: z.string(),
+	status: z.enum(["DELETING", "DELETED"]),
+});
+export const assetCreateBodySchema = z
+	.strictObject({
+		fileName: z.string().min(1).max(255),
+		contentType: z.string().min(1).max(255),
+		sizeBytes: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+		kind: z.string().min(1).max(64),
+		source: assetSource,
+		durationMilliseconds: z.number().int().nonnegative().nullable().optional(),
+		capturedAt: dateTime.nullable().optional(),
+		emailSource: z
+			.object({ messageId: z.string().min(1), attachmentId: z.string().min(1) })
+			.nullable()
+			.optional(),
+	})
+	.superRefine((input, context) => {
+		if ((input.source === "EMAIL_ATTACHMENT") !== (input.emailSource != null))
+			context.addIssue({
+				code: "custom",
+				path: ["emailSource"],
+				message:
+					"Email attachments require an email source. Other sources cannot include one.",
+			});
+	});
+export const assetCreationSchema = assetDetailSchema.extend({
+	transfer: z
+		.object({
+			method: z.literal("PUT"),
+			url: z.string().url(),
+			headers: z.object({
+				"Content-Type": z.string(),
+				"Content-Length": z.string(),
+			}),
+			expiresAt: dateTime,
+			maxBytes: z.number().int(),
+		})
+		.nullable(),
+});
+
+export type Appointment = z.infer<typeof appointmentSchema>;
+export type AppointmentStatus = z.infer<typeof appointmentStatus>;
+export type Asset = z.infer<typeof assetSchema>;
+export type AppointmentCreateBody = z.infer<typeof appointmentCreateBodySchema>;
+export type AppointmentUpdateBody = z.infer<typeof appointmentUpdateBodySchema>;
+export type AssetUpdateBody = z.infer<typeof assetUpdateBodySchema>;
+export type AssetCreateBody = z.infer<typeof assetCreateBodySchema>;
+export type AssetCreation = z.infer<typeof assetCreationSchema>;
+export type AssetDetail = z.infer<typeof assetDetailSchema>;
diff --git a/apps/app/lib/project-assets/transport.ts b/apps/app/lib/project-assets/transport.ts
new file mode 100644
index 000000000..0dd680153
--- /dev/null
+++ b/apps/app/lib/project-assets/transport.ts
@@ -0,0 +1,129 @@
+import { z } from "zod";
+
+const jsonValueSchema = z.json();
+type JsonValue = z.infer<typeof jsonValueSchema>;
+type ResponseSchema<T> = { parse: (value: JsonValue) => T };
+
+export type ApiErrorDetails = {
+	state?: string;
+	maxBytes?: number;
+	fields?: { field: string; message: string }[];
+};
+
+export class ProjectAssetsApiError extends Error {
+	readonly code: string;
+	readonly status: number;
+	readonly retryable: boolean;
+	readonly details?: ApiErrorDetails;
+
+	constructor(
+		message: string,
+		status: number,
+		code: string,
+		retryable = false,
+		details?: ApiErrorDetails,
+	) {
+		super(message);
+		this.name = "ProjectAssetsApiError";
+		this.status = status;
+		this.code = code;
+		this.retryable = retryable;
+		this.details = details;
+	}
+}
+
+type RequestOptions = Omit<RequestInit, "body"> & {
+	body?: unknown;
+	idempotencyKey?: string;
+};
+
+export function operationKey(): string {
+	return crypto.randomUUID();
+}
+
+function proxyPath(path: string): string {
+	return path.startsWith("/api/") ? path : `/api${path}`;
+}
+
+export async function request<T>(
+	path: string,
+	schema: ResponseSchema<T>,
+	options: RequestOptions = {},
+): Promise<T> {
+	const headers = new Headers(options.headers);
+	headers.set("Accept", "application/json");
+	const method = options.method ?? "GET";
+	if (options.body !== undefined)
+		headers.set("Content-Type", "application/json");
+	if (["POST", "PATCH", "DELETE"].includes(method)) {
+		if (!options.idempotencyKey)
+			throw new Error("A mutation needs an idempotency key.");
+		headers.set("Idempotency-Key", options.idempotencyKey);
+	}
+	const response = await fetch(proxyPath(path), {
+		...options,
+		method,
+		headers,
+		body: options.body === undefined ? undefined : JSON.stringify(options.body),
+		credentials: "same-origin",
+	});
+	const raw = await response.text();
+	const parsed: JsonValue = raw ? parseJsonValue(raw) : null;
+	if (!response.ok) throw parseApiError(response.status, parsed);
+	return schema.parse(parsed);
+}
+
+function parseJsonValue(text: string): JsonValue {
+	try {
+		const parsed = jsonValueSchema.safeParse(JSON.parse(text));
+		return parsed.success ? parsed.data : text;
+	} catch {
+		return text;
+	}
+}
+
+function parseApiError(status: number, raw: JsonValue): ProjectAssetsApiError {
+	const parsed = z
+		.object({
+			error: z.object({
+				code: z.string(),
+				message: z.string(),
+				retryable: z.boolean().optional(),
+				details: z
+					.object({
+						state: z.string().optional(),
+						maxBytes: z.number().optional(),
+						fields: z
+							.array(z.object({ field: z.string(), message: z.string() }))
+							.optional(),
+					})
+					.optional(),
+			}),
+		})
+		.safeParse(raw);
+	if (parsed.success) {
+		return new ProjectAssetsApiError(
+			parsed.data.error.message,
+			status,
+			parsed.data.error.code,
+			parsed.data.error.retryable ?? false,
+			parsed.data.error.details,
+		);
+	}
+	const message = z.string().safeParse(raw).data ?? "The operation failed.";
+	return new ProjectAssetsApiError(message, status, "REQUEST_FAILED");
+}
+
+export function query(
+	filters: Record<string, string | number | boolean | undefined>,
+) {
+	const params = new URLSearchParams();
+	for (const [key, value] of Object.entries(filters)) {
+		if (value !== undefined && value !== "") params.set(key, String(value));
+	}
+	return params.toString();
+}
+
+export function projectPath(projectId: string, resource: string) {
+	return `/projects/${encodeURIComponent(projectId)}/${resource}`;
+}
diff --git a/apps/app/lib/session.ts b/apps/app/lib/session.ts
index 48fbb231e..eda9048c9 100644
--- a/apps/app/lib/session.ts
+++ b/apps/app/lib/session.ts
@@ -6,7 +6,9 @@ import { cache } from "react";
 
 export const getSession = cache(
 	async (): Promise<Session | null> =>
-		auth.api.getSession({ headers: await headers() }),
+		auth.api.getSession({
+			headers: await headers(),
+		}) as Promise<Session | null>,
 );
 
 export async function requireSession(): Promise<Session> {
diff --git a/apps/app/lib/tenant-gate.ts b/apps/app/lib/tenant-gate.ts
new file mode 100644
index 000000000..d5e86bacb
--- /dev/null
+++ b/apps/app/lib/tenant-gate.ts
@@ -0,0 +1,55 @@
+import { db } from "@crm/db";
+
+export type TenantOrganization = { id: string; name: string; slug: string };
+
+export type TenantGateResult =
+	| { status: "not-found" }
+	| { status: "forbidden" }
+	| {
+			status: "ok";
+			organization: TenantOrganization;
+			organizations: TenantOrganization[];
+			needsActiveOrgSwitch: boolean;
+	  };
+
+export async function resolveTenantForSlug(
+	slug: string,
+	userId: string,
+	currentActiveOrganizationId?: string | null,
+): Promise<TenantGateResult> {
+	const [organization, memberships] = await Promise.all([
+		db.organization.findUnique({
+			where: { slug },
+			select: { id: true },
+		}),
+		db.member.findMany({
+			where: { userId },
+			select: {
+				organization: { select: { id: true, name: true, slug: true } },
+			},
+		}),
+	]);
+
+	if (!organization) {
+		return { status: "not-found" };
+	}
+
+	const organizations = memberships.map(
+		(membership) => membership.organization,
+	);
+	const currentOrganization = organizations.find(
+		(candidate) => candidate.id === organization.id,
+	);
+
+	if (!currentOrganization) {
+		return { status: "forbidden" };
+	}
+
+	return {
+		status: "ok",
+		organization: currentOrganization,
+		organizations,
+		needsActiveOrgSwitch:
+			currentActiveOrganizationId !== currentOrganization.id,
+	};
+}
diff --git a/apps/app/next.config.ts b/apps/app/next.config.ts
index 98b199a7b..705542f35 100644
--- a/apps/app/next.config.ts
+++ b/apps/app/next.config.ts
@@ -19,6 +19,10 @@ const allowedDevOrigins = (process.env.APP_URL ?? "")
 	});
 
 const nextConfig: NextConfig = {
+	experimental: {
+		authInterrupts: true,
+	},
+
 	allowedDevOrigins,
 
 	env: {
diff --git a/apps/app/package.json b/apps/app/package.json
index 48519e3c8..fd82a6bd9 100644
--- a/apps/app/package.json
+++ b/apps/app/package.json
@@ -12,41 +12,41 @@
 		"lint": "biome check ."
 	},
 	"dependencies": {
-		"@carbon/icons-react": "^11.82.0",
+		"@carbon/icons-react": "^11.88.0",
 		"@crm/auth": "workspace:*",
 		"@crm/db": "workspace:*",
 		"@crm/env": "workspace:*",
 		"@crm/telemetry": "workspace:*",
 		"@crm/ui": "workspace:*",
 		"@crm/validation": "workspace:*",
-		"@pierre/diffs": "^1.2.12",
-		"@pierre/trees": "^1.0.0-beta.5",
-		"@tanstack/react-query": "^5.101.2",
+		"@pierre/diffs": "^1.4.1",
+		"@pierre/trees": "^1.0.0-beta.6",
+		"@tanstack/react-query": "^5.102.8",
 		"@trpc/client": "^11.18.0",
 		"@trpc/server": "^11.18.0",
 		"@trpc/tanstack-react-query": "^11.18.0",
 		"api": "workspace:*",
-		"better-auth": "^1.6.25",
-		"eve": "^0.29.4",
-		"next": "16.3.0",
+		"better-auth": "1.7.3",
+		"eve": "^0.52.3",
+		"next": "16.3.4",
 		"next-themes": "^0.4.6",
-		"nuqs": "^2.8.9",
-		"posthog-js": "^1.413.2",
-		"react": "19.2.4",
-		"react-dom": "19.2.4",
-		"sonner": "^2.0.7",
-		"zod": "^4.4.3"
+		"nuqs": "^2.10.1",
+		"posthog-js": "^1.428.8",
+		"react": "19.2.8",
+		"react-dom": "19.2.8",
+		"sonner": "^2.0.8",
+		"zod": "^4.5.4"
 	},
 	"devDependencies": {
 		"@crm/typescript-config": "workspace:*",
-		"@tailwindcss/postcss": "^4",
-		"@tanstack/react-query-devtools": "^5.101.2",
-		"@types/bun": "^1.3.14",
-		"@types/node": "^20",
-		"@types/react": "^19",
+		"@tailwindcss/postcss": "^4.3.3",
+		"@tanstack/react-query-devtools": "^5.102.8",
+		"@types/bun": "^1.4.2",
+		"@types/node": "^26.5.0",
+		"@types/react": "^19.2.18",
 		"@types/react-dom": "^19",
-		"tailwindcss": "^4",
-		"typescript": "^5"
+		"tailwindcss": "^4.3.3",
+		"typescript": "^7.0.2"
 	},
 	"ignoreScripts": [
 		"sharp",
diff --git a/apps/app/proxy.ts b/apps/app/proxy.ts
index 6040b7068..189c75649 100644
--- a/apps/app/proxy.ts
+++ b/apps/app/proxy.ts
@@ -1,29 +1,25 @@
 import { AUTH_COOKIE_PREFIX } from "@crm/auth/cookies";
 import { getSessionCookie } from "better-auth/cookies";
 import { type NextRequest, NextResponse } from "next/server";
+import { appPath, isUnder } from "@/lib/app-path";
 import { isMarketing } from "@/lib/env";
-import {
-	ONBOARDING_PATH,
-	RESEARCH_PATH,
-	readResearchGate,
-	readWorkspaceGate,
-} from "@/lib/onboarding";
-import { workspaceUrl } from "@/lib/workspace-url";
+import { ONBOARDING_PATH, readWorkspaceGate } from "@/lib/onboarding";
 
 const LANDING_PATH = "/";
 
 const SIGN_IN_PATH = "/sign-in";
 
-const UNGATED = ["/grant-access", "/eve"];
+const LEGAL_PATHS = ["/privacy", "/terms"];
 
-const ANONYMOUS = ["/t"];
+const UNGATED = ["/grant-access", "/eve", "/oauth"];
 
-const SECTIONS = ["/companies", "/contacts", "/deals", "/settings"];
+const ANONYMOUS = ["/t"];
 
 export async function proxy(request: NextRequest) {
 	const { pathname } = request.nextUrl;
 
 	if (pathname === SIGN_IN_PATH) return NextResponse.next();
+	if (LEGAL_PATHS.includes(pathname)) return NextResponse.next();
 
 	if (isAnonymous(pathname)) return NextResponse.next();
 
@@ -37,41 +33,18 @@ export async function proxy(request: NextRequest) {
 
 	if (isUngated(pathname)) return NextResponse.next();
 
-	// Both answers, every time, and concurrently — so the gate costs one round
-	// trip rather than two, and neither answer can be stale.
-	const [workspace, research] = await Promise.all([
-		readWorkspaceGate(request),
-		readResearchGate(request),
-	]);
-
-	if (workspace.gate === "required") return sendTo(ONBOARDING_PATH, request);
-	if (research === "required") return sendTo(RESEARCH_PATH, request);
-
-	const settled = workspace.gate === "settled" && research === "settled";
-
-	if (!settled || !workspace.slug) return NextResponse.next();
-
-	return sendTo(appPath(pathname, workspace.slug), request);
-}
-
-function appPath(pathname: string, slug: string): string {
-	if (pathname === LANDING_PATH || isSetup(pathname)) {
-		return workspaceUrl(slug);
+	const workspace = await readWorkspaceGate(request);
+	if (workspace.hasOrganization === false) {
+		return sendTo(appPath(pathname, workspace), request);
 	}
 
-	if (SECTIONS.some((section) => isUnder(pathname, section))) {
-		return workspaceUrl(slug, pathname);
+	if (workspace.gate === "required") {
+		return sendTo(ONBOARDING_PATH, request);
 	}
+	if (workspace.gate !== "settled" || !workspace.slug)
+		return NextResponse.next();
 
-	const [first, ...rest] = pathname.slice(1).split("/");
-
-	if (first === slug) return pathname;
-
-	return workspaceUrl(slug, rest.length ? `/${rest.join("/")}` : "/");
-}
-
-function isUnder(pathname: string, prefix: string): boolean {
-	return pathname === prefix || pathname.startsWith(`${prefix}/`);
+	return sendTo(appPath(pathname, workspace), request);
 }
 
 function isPublic(pathname: string): boolean {
@@ -86,10 +59,6 @@ function isAnonymous(pathname: string): boolean {
 	return ANONYMOUS.some((prefix) => isUnder(pathname, prefix));
 }
 
-function isSetup(pathname: string): boolean {
-	return pathname === ONBOARDING_PATH || pathname === RESEARCH_PATH;
-}
-
 function sendTo(path: string, request: NextRequest): NextResponse {
 	if (request.nextUrl.pathname === path) return NextResponse.next();
 
diff --git a/apps/app/test/agent-bridge.spec.ts b/apps/app/test/agent-bridge.spec.ts
index 0c3a4d904..7dafd2606 100644
--- a/apps/app/test/agent-bridge.spec.ts
+++ b/apps/app/test/agent-bridge.spec.ts
@@ -2,6 +2,7 @@ import { beforeAll, describe, expect, it } from "bun:test";
 import { verifyJwtHmac } from "eve/channels/auth";
 
 const SECRET = "test-secret-at-least-long-enough-to-be-a-secret";
+const ORGANIZATION_ID = "org_123";
 
 const CONFIG = {
 	algorithm: "HS256",
@@ -25,22 +26,25 @@ const rep = {
 
 describe("mintBridgeToken", () => {
 	it("mints a token eve accepts", async () => {
-		const token = await mintBridgeToken(rep);
+		const token = await mintBridgeToken(rep, ORGANIZATION_ID);
 		const result = await verifyJwtHmac(token, CONFIG);
 
 		expect(result.ok).toBe(true);
 	});
 
 	it("names the rep, so the agent knows a person is driving", async () => {
-		const token = await mintBridgeToken(rep);
+		const token = await mintBridgeToken(rep, ORGANIZATION_ID);
 		const result = await verifyJwtHmac(token, CONFIG);
 
 		expect(result.ok && result.sessionAuth.subject).toBe(rep.id);
 		expect(result.ok && result.sessionAuth.attributes?.email).toBe(rep.email);
+		expect(result.ok && result.sessionAuth.attributes?.organizationId).toBe(
+			ORGANIZATION_ID,
+		);
 	});
 
 	it("is rejected by a different secret", async () => {
-		const token = await mintBridgeToken(rep);
+		const token = await mintBridgeToken(rep, ORGANIZATION_ID);
 		const result = await verifyJwtHmac(token, {
 			...CONFIG,
 			secret: "a-different-secret-entirely",
@@ -50,7 +54,7 @@ describe("mintBridgeToken", () => {
 	});
 
 	it("is rejected by an agent expecting another audience", async () => {
-		const token = await mintBridgeToken(rep);
+		const token = await mintBridgeToken(rep, ORGANIZATION_ID);
 		const result = await verifyJwtHmac(token, {
 			...CONFIG,
 			audiences: ["someone-elses-agent"],
@@ -60,7 +64,7 @@ describe("mintBridgeToken", () => {
 	});
 
 	it("expires, so a token left in a tab stops working", async () => {
-		const token = await mintBridgeToken(rep);
+		const token = await mintBridgeToken(rep, ORGANIZATION_ID);
 		const [, payload] = token.split(".");
 		const claims = JSON.parse(
 			Buffer.from(payload as string, "base64url").toString(),
@@ -75,7 +79,7 @@ describe("mintBridgeToken", () => {
 		const secret = process.env.AGENT_BRIDGE_SECRET;
 		process.env.AGENT_BRIDGE_SECRET = "";
 
-		expect(mintBridgeToken(rep)).rejects.toThrow();
+		expect(mintBridgeToken(rep, ORGANIZATION_ID)).rejects.toThrow();
 
 		process.env.AGENT_BRIDGE_SECRET = secret;
 	});
diff --git a/apps/app/test/agent-session.spec.ts b/apps/app/test/agent-session.spec.ts
index 7e00682ce..d39610e10 100644
--- a/apps/app/test/agent-session.spec.ts
+++ b/apps/app/test/agent-session.spec.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from "bun:test";
 import { readFileSync } from "node:fs";
-import type { MessageStreamEvent, SessionState } from "eve/client";
+import type { ClientSessionState, MessageStreamEvent } from "eve/client";
 import { recordCopy, recordFilter, recordHeader } from "../lib/agent-record";
 import { classify, composerState, eventsOf } from "../lib/agent-session";
 
@@ -12,49 +12,41 @@ const event = (
 ): MessageStreamEvent =>
 	({ type, data: {}, meta: { id: `evt_${type}`, at } }) as MessageStreamEvent;
 
-const parked: SessionState = {
-	sessionId: "wrun_1",
-	continuationToken: "eve:live",
-	streamIndex: 3,
-};
-
-const unparked: SessionState = { sessionId: "wrun_1", streamIndex: 3 };
+const state: ClientSessionState = { sessionId: "wrun_1", streamIndex: 3 };
 
 describe("classify", () => {
-	it("trusts the token over any reading of the events", () => {
-		expect(classify(parked, [event("message.appended")], NOW)).toBe("ready");
+	it("treats a parked session as ready", () => {
+		expect(classify([event("session.waiting")], NOW)).toBe("ready");
 	});
 
 	it("knows a terminal session cannot be continued", () => {
-		expect(classify(unparked, [event("session.completed")], NOW)).toBe("ended");
-		expect(classify(unparked, [event("session.failed")], NOW)).toBe("ended");
+		expect(classify([event("session.completed")], NOW)).toBe("ended");
+		expect(classify([event("session.failed")], NOW)).toBe("ended");
 	});
 
 	it("reads a turn still emitting as working", () => {
 		const recent = event("message.appended", "2026-08-01T11:59:30.000Z");
 
-		expect(classify(unparked, [recent], NOW)).toBe("working");
+		expect(classify([recent], NOW)).toBe("working");
 	});
 
 	it("retires a turn that stopped mid-sentence", () => {
 		const stalled = event("message.appended", "2026-08-01T11:50:00.000Z");
 
-		expect(classify(unparked, [stalled], NOW)).toBe("ended");
+		expect(classify([stalled], NOW)).toBe("ended");
 	});
 
 	it("does not retire a live turn for want of a timestamp", () => {
 		const undated = { type: "step.started", data: {}, meta: { id: "x" } };
 
-		expect(classify(unparked, [undated as MessageStreamEvent], NOW)).toBe(
-			"working",
-		);
+		expect(classify([undated as MessageStreamEvent], NOW)).toBe("working");
 	});
 });
 
 describe("the composer", () => {
 	it("takes input on a parked thread, and on one not started yet", () => {
 		expect(
-			composerState({ status: "ready", session: parked, events: [] }, false),
+			composerState({ status: "ready", session: state, events: [] }, false),
 		).toEqual({ locked: false, ended: false });
 		expect(composerState({ status: "new" }, false)).toEqual({
 			locked: false,
@@ -68,20 +60,17 @@ describe("the composer", () => {
 
 	it("holds input while a turn is in flight, from either side", () => {
 		expect(
-			composerState({ status: "ready", session: parked, events: [] }, true)
+			composerState({ status: "ready", session: state, events: [] }, true)
 				.locked,
 		).toBe(true);
 		expect(
-			composerState(
-				{ status: "working", session: unparked, events: [] },
-				false,
-			),
+			composerState({ status: "working", session: state, events: [] }, false),
 		).toEqual({ locked: true, ended: false });
 	});
 
 	it("says an ended thread is ended rather than merely busy", () => {
 		expect(
-			composerState({ status: "ended", session: unparked, events: [] }, false),
+			composerState({ status: "ended", session: state, events: [] }, false),
 		).toEqual({ locked: true, ended: true });
 	});
 
@@ -98,7 +87,7 @@ describe("eventsOf", () => {
 		const events = [event("message.completed")];
 
 		expect(eventsOf({ status: "offline", events })).toEqual(events);
-		expect(eventsOf({ status: "ended", session: unparked, events })).toEqual(
+		expect(eventsOf({ status: "ended", session: state, events })).toEqual(
 			events,
 		);
 		expect(eventsOf({ status: "new" })).toEqual([]);
diff --git a/apps/app/test/api-proxy-path.spec.ts b/apps/app/test/api-proxy-path.spec.ts
new file mode 100644
index 000000000..dbecf48b5
--- /dev/null
+++ b/apps/app/test/api-proxy-path.spec.ts
@@ -0,0 +1,39 @@
+import { describe, expect, test } from "bun:test";
+import { apiProxyPath } from "../lib/api-proxy-path";
+
+describe("API proxy paths", () => {
+	test("maps asset collection and member paths to the API root", () => {
+		for (const [path, expected] of [
+			["/api/projects/project-1/assets", "/projects/project-1/assets"],
+			[
+				"/api/appointments/appointment-1/assets",
+				"/appointments/appointment-1/assets",
+			],
+			["/api/assets/asset-1", "/assets/asset-1"],
+		] as const) {
+			expect(apiProxyPath(path)).toBe(expected);
+		}
+	});
+
+	test("maps the project appointment collection", () => {
+		expect(apiProxyPath("/api/projects/project-1/appointments")).toBe(
+			"/projects/project-1/appointments",
+		);
+	});
+
+	test("preserves unrelated API and near-match paths", () => {
+		for (const path of [
+			"/api/auth/session",
+			"/api/projects/project-1",
+			"/api/projects/project-1/assets-extra",
+			"/api/projects/project-1/appointments-extra",
+			"/api/appointments/appointment-1/assets-extra",
+			"/api/assets",
+			"/api/assets/",
+			"/api/customers/customer-1/assets",
+			"/projects/project-1/assets",
+		]) {
+			expect(apiProxyPath(path)).toBe(path);
+		}
+	});
+});
diff --git a/apps/app/test/client-bundle.spec.ts b/apps/app/test/client-bundle.spec.ts
new file mode 100644
index 000000000..0ca664a16
--- /dev/null
+++ b/apps/app/test/client-bundle.spec.ts
@@ -0,0 +1,30 @@
+import { expect, it } from "bun:test";
+import { fileURLToPath } from "node:url";
+
+it.each([
+	"../app/(app)/[slug]/settings/research-key.tsx",
+	"../app/(landing)/onboarding/onboarding-form.tsx",
+])("bundles %s without Node.js dependencies", async (entrypoint) => {
+	const result = await Bun.build({
+		entrypoints: [fileURLToPath(new URL(entrypoint, import.meta.url))],
+		target: "browser",
+		plugins: [
+			{
+				name: "external-ui-dependencies",
+				setup(build) {
+					build.onResolve({ filter: /^[^./]/ }, ({ path }) => {
+						if (path.startsWith("node:"))
+							throw new Error(`Browser import: ${path}`);
+						if (path.startsWith("@crm/db")) {
+							return { path: fileURLToPath(import.meta.resolve(path)) };
+						}
+						return { path, external: true };
+					});
+				},
+			},
+		],
+	});
+
+	expect(result.logs).toEqual([]);
+	expect(result.success).toBe(true);
+});
diff --git a/apps/app/test/oauth-query.spec.ts b/apps/app/test/oauth-query.spec.ts
new file mode 100644
index 000000000..f34301a72
--- /dev/null
+++ b/apps/app/test/oauth-query.spec.ts
@@ -0,0 +1,20 @@
+import { describe, expect, it } from "bun:test";
+import { oauthSignInOptions } from "@/lib/oauth-query";
+
+describe("oauthSignInOptions", () => {
+	it("returns the plain sign-in page when there is no OAuth request", () => {
+		expect(oauthSignInOptions(null, "https://crm.example")).toEqual({
+			errorCallbackURL: "https://crm.example/sign-in",
+		});
+	});
+
+	it("carries the OAuth request into the error URL and the callback", () => {
+		expect(
+			oauthSignInOptions("client_id=cmp&scope=crm.read", "https://crm.example"),
+		).toEqual({
+			errorCallbackURL:
+				"https://crm.example/sign-in?client_id=cmp&scope=crm.read",
+			oauth_query: "client_id=cmp&scope=crm.read",
+		});
+	});
+});
diff --git a/apps/app/test/onboarding-form.spec.tsx b/apps/app/test/onboarding-form.spec.tsx
new file mode 100644
index 000000000..a752e26ec
--- /dev/null
+++ b/apps/app/test/onboarding-form.spec.tsx
@@ -0,0 +1,44 @@
+import { afterEach, expect, it, mock, spyOn } from "bun:test";
+import * as queries from "@tanstack/react-query";
+import * as navigation from "next/navigation";
+import { renderToStaticMarkup } from "react-dom/server";
+import { OnboardingForm } from "../app/(landing)/onboarding/onboarding-form";
+import * as client from "../lib/trpc/client";
+
+afterEach(() => mock.restore());
+
+it("enters the application after saving workspace onboarding", () => {
+	const replace = mock();
+	const refresh = mock();
+	let onSuccess: (() => void) | undefined;
+
+	spyOn(navigation, "useRouter").mockReturnValue({
+		bfcacheId: "test",
+		replace,
+		refresh,
+		push: mock(),
+		back: mock(),
+		forward: mock(),
+		prefetch: mock(),
+	});
+	spyOn(client, "useTRPC").mockReturnValue({
+		workspace: {
+			update: {
+				mutationOptions: (options: { onSuccess: () => void }) => {
+					onSuccess = options.onSuccess;
+					return options;
+				},
+			},
+		},
+	} as unknown as ReturnType<typeof client.useTRPC>);
+	spyOn(queries, "useMutation").mockReturnValue({
+		isPending: false,
+	} as ReturnType<typeof queries.useMutation>);
+
+	renderToStaticMarkup(<OnboardingForm placeholder="Acme" />);
+	expect(onSuccess).toBeDefined();
+	onSuccess?.();
+
+	expect(refresh).toHaveBeenCalledTimes(1);
+	expect(replace).toHaveBeenCalledWith("/");
+});
diff --git a/apps/app/test/onboarding-gate.spec.ts b/apps/app/test/onboarding-gate.spec.ts
index 0480f1429..cc5275d6e 100644
--- a/apps/app/test/onboarding-gate.spec.ts
+++ b/apps/app/test/onboarding-gate.spec.ts
@@ -1,7 +1,7 @@
 import { afterEach, describe, expect, it } from "bun:test";
 import { AUTH_COOKIE_PREFIX } from "@crm/auth/cookies";
 import { NextRequest } from "next/server";
-import { readResearchGate, readWorkspaceGate } from "../lib/onboarding";
+import { readWorkspaceGate } from "../lib/onboarding";
 import { proxy } from "../proxy";
 
 const SESSION_COOKIE = `${AUTH_COOKIE_PREFIX}.session_token=abc.def`;
@@ -42,34 +42,52 @@ function answerWith(body: GateResponse, status = 200) {
 	stub(async () => json(body, status));
 }
 
-const workspace = (data: {
+function workspace({
+	onboarded,
+	canRename,
+	slug = SLUG,
+	hasOrganization = true,
+}: {
 	onboarded: boolean;
 	canRename: boolean;
-	slug?: string;
-}) => ({ result: { data: { slug: SLUG, ...data } } });
+	slug?: string | null;
+	hasOrganization?: boolean;
+}) {
+	return {
+		result: {
+			data: {
+				organizationId: hasOrganization ? "org-1" : null,
+				slug: hasOrganization ? slug : null,
+				onboarded: hasOrganization ? onboarded : null,
+				canRename: hasOrganization ? canRename : null,
+			},
+		},
+	};
+}
 
 const researchKey = (configured: boolean) => ({
 	result: { data: { configured, hint: configured ? "••••9876" : null } },
 });
 
-/** Answers both gate procedures, counting the calls to each. */
 function setup({
 	onboarded = true,
 	canRename = true,
 	configured = true,
 	slug = SLUG,
+	hasOrganization = true,
 }: {
 	onboarded?: boolean;
 	canRename?: boolean;
 	configured?: boolean;
-	slug?: string;
+	slug?: string | null;
+	hasOrganization?: boolean;
 } = {}) {
 	const calls = { workspace: 0, research: 0 };
 
 	stub(async (url) => {
-		if (url.includes("workspace.get")) {
+		if (url.includes("workspace.gate")) {
 			calls.workspace += 1;
-			return json(workspace({ onboarded, canRename, slug }));
+			return json(workspace({ onboarded, canRename, slug, hasOrganization }));
 		}
 
 		calls.research += 1;
@@ -114,6 +132,23 @@ describe("readWorkspaceGate", () => {
 		expect(await readWorkspaceGate(request("/", [SESSION_COOKIE]))).toEqual({
 			gate: "settled",
 			slug: SLUG,
+			hasOrganization: true,
+		});
+	});
+
+	it("marks a signed-in user with no organization", async () => {
+		answerWith(
+			workspace({
+				onboarded: false,
+				canRename: false,
+				hasOrganization: false,
+			}),
+		);
+
+		expect(await readWorkspaceGate(request("/", [SESSION_COOKIE]))).toEqual({
+			gate: "unknown",
+			slug: null,
+			hasOrganization: false,
 		});
 	});
 
@@ -131,30 +166,6 @@ describe("readWorkspaceGate", () => {
 	});
 });
 
-describe("readResearchGate", () => {
-	it("is settled once a key is saved, and required until then", async () => {
-		answerWith(researchKey(true));
-		expect(await readResearchGate(request("/", [SESSION_COOKIE]))).toBe(
-			"settled",
-		);
-
-		answerWith(researchKey(false));
-		expect(await readResearchGate(request("/", [SESSION_COOKIE]))).toBe(
-			"required",
-		);
-	});
-
-	it("is unknown rather than required when the API cannot be read", async () => {
-		stub(async () => {
-			throw new Error("connect ECONNREFUSED");
-		});
-
-		expect(await readResearchGate(request("/", [SESSION_COOKIE]))).toBe(
-			"unknown",
-		);
-	});
-});
-
 describe("proxy", () => {
 	it("shows a stranger the landing page and nothing behind it", async () => {
 		marketing("true");
@@ -174,6 +185,20 @@ describe("proxy", () => {
 		expect(redirectedTo(await proxy(request("/sign-in")))).toBeNull();
 	});
 
+	it("keeps the legal pages public for every visitor", async () => {
+		marketing(undefined);
+		stub(async () => {
+			throw new Error("the legal pages must not call the auth gate");
+		});
+
+		for (const path of ["/privacy", "/terms"]) {
+			expect(redirectedTo(await proxy(request(path)))).toBeNull();
+			expect(
+				redirectedTo(await proxy(request(path, [SESSION_COOKIE]))),
+			).toBeNull();
+		}
+	});
+
 	it("never aims a redirect at the sign-in page itself", async () => {
 		marketing(undefined);
 		setup({ onboarded: false, configured: false });
@@ -237,11 +262,19 @@ describe("proxy", () => {
 		const first = await proxy(request(`/${SLUG}/companies`, [SESSION_COOKIE]));
 
 		expect([...first.cookies.getAll()]).toHaveLength(0);
-		expect(calls).toEqual({ workspace: 1, research: 1 });
+		expect(calls).toEqual({ workspace: 1, research: 0 });
 
 		await proxy(request(`/${SLUG}/companies`, [SESSION_COOKIE]));
 
-		expect(calls).toEqual({ workspace: 2, research: 2 });
+		expect(calls).toEqual({ workspace: 2, research: 0 });
+	});
+
+	it("sends a user with no organization to the no-organization page", async () => {
+		setup({ hasOrganization: false });
+
+		expect(
+			redirectedTo(await proxy(request("/companies", [SESSION_COOKIE]))),
+		).toBe("/no-organization");
 	});
 
 	it("notices when the answer changes underneath it", async () => {
@@ -252,8 +285,6 @@ describe("proxy", () => {
 			),
 		).toBeNull();
 
-		// A reset database, a removed key: the browser is carrying nothing that
-		// could keep saying the gate was satisfied.
 		setup({ onboarded: false });
 		expect(
 			redirectedTo(
@@ -326,7 +357,7 @@ describe("the slug the app is served under", () => {
 		);
 	});
 
-	it("moves a stale slug onto the current one, keeping the rest", async () => {
+	it("drops the stale first segment of a path from another organization", async () => {
 		setup();
 
 		expect(
@@ -355,28 +386,28 @@ describe("the slug the app is served under", () => {
 	});
 });
 
-describe("the research key gate", () => {
-	it("sends an onboarded rep with no key to the key form", async () => {
+describe("optional research configuration", () => {
+	it("lets an onboarded rep enter the CRM without a key", async () => {
 		setup({ configured: false });
 
 		expect(
 			redirectedTo(
 				await proxy(request(`/${SLUG}/companies`, [SESSION_COOKIE])),
 			),
-		).toBe("/onboarding/research");
+		).toBeNull();
 	});
 
-	it("lets that form render rather than looping onto itself", async () => {
+	it("redirects the old research URL into the CRM", async () => {
 		setup({ configured: false });
 
 		expect(
 			redirectedTo(
 				await proxy(request("/onboarding/research", [SESSION_COOKIE])),
 			),
-		).toBeNull();
+		).toBe(`/${SLUG}`);
 	});
 
-	it("asks the first question first when both are outstanding", async () => {
+	it("requires workspace onboarding without a research key", async () => {
 		setup({ onboarded: false, configured: false });
 
 		expect(
@@ -386,11 +417,11 @@ describe("the research key gate", () => {
 		).toBe("/onboarding");
 	});
 
-	it("sends them on to the key once the workspace is named", async () => {
+	it("enters the CRM after workspace onboarding without a key", async () => {
 		setup({ onboarded: true, configured: false });
 
 		expect(
 			redirectedTo(await proxy(request("/onboarding", [SESSION_COOKIE]))),
-		).toBe("/onboarding/research");
+		).toBe(`/${SLUG}`);
 	});
 });
diff --git a/apps/app/test/project-assets-cache.spec.ts b/apps/app/test/project-assets-cache.spec.ts
new file mode 100644
index 000000000..a3dd2951f
--- /dev/null
+++ b/apps/app/test/project-assets-cache.spec.ts
@@ -0,0 +1,18 @@
+import { expect, mock, test } from "bun:test";
+import { QueryClient } from "@tanstack/react-query";
+import { invalidateProjectWorkspace } from "../lib/project-assets/cache";
+import { projectKeys } from "../lib/project-assets/queries";
+
+test("appointment mutations refresh project data and existing CRM activity consumers", async () => {
+	const client = new QueryClient();
+	const project = projectKeys.appointment("project", "appointment");
+	const other = projectKeys.appointment("other", "appointment");
+	client.setQueryData(project, { title: "Old title" });
+	client.setQueryData(other, { title: "Other project" });
+	const activity = mock(async () => {});
+	await invalidateProjectWorkspace(client, { activity }, "project");
+	expect(client.getQueryState(project)?.isInvalidated).toBe(true);
+	expect(client.getQueryState(other)?.isInvalidated).toBe(false);
+	expect(activity).toHaveBeenCalledTimes(1);
+	client.clear();
+});
diff --git a/apps/app/test/project-assets-client.spec.ts b/apps/app/test/project-assets-client.spec.ts
new file mode 100644
index 000000000..56671c777
--- /dev/null
+++ b/apps/app/test/project-assets-client.spec.ts
@@ -0,0 +1,82 @@
+import { describe, expect, mock, test } from "bun:test";
+import { projectApi } from "../lib/project-assets/client";
+import { uploadFixture } from "./project-assets-upload.fixture";
+
+describe("project asset client routes", () => {
+	test("uses the seven resource endpoints", async () => {
+		const f = uploadFixture();
+		const list = {
+			items: [f.creation.asset],
+			page: 1,
+			pageSize: 25,
+			total: 1,
+			hasNextPage: false,
+		};
+		const responses = [
+			list,
+			f.creation,
+			list,
+			f.creation,
+			f.ready,
+			f.ready,
+			{ assetId: "asset", status: "DELETING" },
+		];
+		const originalFetch = globalThis.fetch;
+		const fetchMock = mock(
+			async (_input: RequestInfo | URL, _init?: RequestInit) =>
+				new Response(JSON.stringify(responses.shift()), {
+					status: 200,
+					headers: { "Content-Type": "application/json" },
+				}),
+		);
+		globalThis.fetch = fetchMock as unknown as typeof fetch;
+		try {
+			await projectApi.listAssets("project", { page: 1, pageSize: 25 });
+			await projectApi.createProjectAsset("project", assetBody(), "create");
+			await projectApi.listAssets("project", {
+				page: 1,
+				pageSize: 25,
+				appointmentId: "appointment",
+			});
+			await projectApi.createAppointmentAsset(
+				"appointment",
+				assetBody(),
+				"appointment-create",
+			);
+			await projectApi.getAsset("asset");
+			await projectApi.updateAsset(
+				"asset",
+				{ uploadCompleted: true },
+				"complete",
+			);
+			await projectApi.deleteAsset("asset", "delete");
+		} finally {
+			globalThis.fetch = originalFetch;
+		}
+
+		expect(
+			fetchMock.mock.calls.map((call) => [
+				call[1]?.method,
+				new URL(String(call[0]), "https://app.test").pathname,
+			]),
+		).toEqual([
+			["GET", "/api/projects/project/assets"],
+			["POST", "/api/projects/project/assets"],
+			["GET", "/api/appointments/appointment/assets"],
+			["POST", "/api/appointments/appointment/assets"],
+			["GET", "/api/assets/asset"],
+			["PATCH", "/api/assets/asset"],
+			["DELETE", "/api/assets/asset"],
+		]);
+	});
+});
+
+function assetBody() {
+	return {
+		fileName: "plan.txt",
+		contentType: "text/plain",
+		sizeBytes: 4,
+		kind: "document",
+		source: "MANUAL" as const,
+	};
+}
diff --git a/apps/app/test/project-assets-date-time.spec.ts b/apps/app/test/project-assets-date-time.spec.ts
new file mode 100644
index 000000000..4be3ece9e
--- /dev/null
+++ b/apps/app/test/project-assets-date-time.spec.ts
@@ -0,0 +1,31 @@
+import { describe, expect, test } from "bun:test";
+import {
+	dateBoundary,
+	isoToLocalInput,
+	localInputToIso,
+} from "../lib/project-assets/date-time";
+
+describe("project appointment date and time", () => {
+	test("formats and converts a zoned appointment", () => {
+		expect(isoToLocalInput("2026-01-15T15:00:00.000Z", "America/Chicago")).toBe(
+			"2026-01-15T09:00",
+		);
+		expect(localInputToIso("2026-01-15T09:00", "America/Chicago")).toBe(
+			"2026-01-15T15:00:00.000Z",
+		);
+	});
+
+	test("rejects nonexistent and ambiguous daylight-saving times", () => {
+		expect(() =>
+			localInputToIso("2026-03-08T02:30", "America/Chicago"),
+		).toThrow("does not exist");
+		expect(() =>
+			localInputToIso("2026-11-01T01:30", "America/Chicago"),
+		).toThrow("occurs twice");
+	});
+
+	test("uses an exclusive upper date boundary", () => {
+		expect(dateBoundary("2026-09-15")).toBe("2026-09-15T00:00:00.000Z");
+		expect(dateBoundary("2026-09-15", true)).toBe("2026-09-16T00:00:00.000Z");
+	});
+});
diff --git a/apps/app/test/project-assets-mutation-keys.spec.ts b/apps/app/test/project-assets-mutation-keys.spec.ts
new file mode 100644
index 000000000..e0286833a
--- /dev/null
+++ b/apps/app/test/project-assets-mutation-keys.spec.ts
@@ -0,0 +1,16 @@
+import { describe, expect, test } from "bun:test";
+import { createOperationKeyStore } from "../lib/project-assets/mutation-keys";
+
+describe("project mutation keys", () => {
+	test("reuses a key for a retry and rotates after discard", () => {
+		let sequence = 0;
+		const keys = createOperationKeyStore(() => `key-${++sequence}`);
+
+		const first = keys.for("appointment:1:archive:3");
+		expect(keys.for("appointment:1:archive:3")).toBe(first);
+		expect(keys.for("appointment:1:restore:3")).not.toBe(first);
+
+		keys.clear("appointment:1:archive:3");
+		expect(keys.for("appointment:1:archive:3")).not.toBe(first);
+	});
+});
diff --git a/apps/app/test/project-assets-upload.fixture.ts b/apps/app/test/project-assets-upload.fixture.ts
new file mode 100644
index 000000000..269a914cb
--- /dev/null
+++ b/apps/app/test/project-assets-upload.fixture.ts
@@ -0,0 +1,113 @@
+import { mock } from "bun:test";
+import { UploadRunner } from "../components/crm/project-assets/upload-runner";
+import type { UploadItem } from "../components/crm/project-assets/upload-session";
+import { projectApi } from "../lib/project-assets/client";
+import type {
+	Asset,
+	AssetCreation,
+	AssetDetail,
+} from "../lib/project-assets/schemas";
+
+const timestamps = {
+	createdAt: "2026-09-11T00:00:00Z",
+	updatedAt: "2026-09-11T00:00:00Z",
+};
+
+function asset(status: Asset["status"], appointmentId: string | null): Asset {
+	return {
+		id: "asset",
+		customerId: "customer",
+		projectId: "project",
+		appointmentId,
+		fileName: "plan.txt",
+		contentType: "text/plain",
+		sizeBytes: 4,
+		kind: "document",
+		source: "MANUAL",
+		emailSource: null,
+		uploadedById: "user",
+		durationMilliseconds: null,
+		capturedAt: null,
+		...timestamps,
+		status,
+		deletedAt: null,
+		version: 1,
+	};
+}
+
+export function uploadFixture(appointmentId: string | null = null) {
+	const creation: AssetCreation = {
+		asset: asset("UNVERIFIED", appointmentId),
+		download: null,
+		failure: null,
+		transfer: {
+			method: "PUT",
+			url: "https://storage.example/file",
+			headers: { "Content-Type": "text/plain", "Content-Length": "4" },
+			expiresAt: "2099-01-01T00:00:00Z",
+			maxBytes: 100,
+		},
+	};
+	const ready: AssetDetail = {
+		asset: asset("READY", appointmentId),
+		download: {
+			url: "https://storage.example/download",
+			expiresAt: "2099-01-01T00:00:00Z",
+		},
+		failure: null,
+	};
+	const item: UploadItem = {
+		id: "item",
+		file: new File(["file"], "plan.txt", { type: "text/plain" }),
+		kind: "document",
+		appointmentId,
+		createKey: "create",
+		completeKey: "complete",
+		deleteKey: "delete",
+		transferred: false,
+		assetId: null,
+		transfer: null,
+		status: "QUEUED",
+		error: null,
+	};
+	const createProjectAsset = mock<typeof projectApi.createProjectAsset>(
+		async (_projectId, _body, _idempotencyKey) => creation,
+	);
+	const createAppointmentAsset = mock<typeof projectApi.createAppointmentAsset>(
+		async (_appointmentId, _body, _idempotencyKey) => creation,
+	);
+	const getAsset = mock<typeof projectApi.getAsset>(
+		async (_assetId): Promise<AssetDetail> => ready,
+	);
+	const updateAsset = mock<typeof projectApi.updateAsset>(
+		async (_assetId, _body, _idempotencyKey): Promise<AssetDetail> => ready,
+	);
+	const deleteAsset = mock<typeof projectApi.deleteAsset>(
+		async (_assetId, _idempotencyKey) => ({
+			assetId: "asset",
+			status: "DELETING" as const,
+		}),
+	);
+	const putTransfer = mock<typeof projectApi.putTransfer>(async () => {});
+	const api = {
+		...projectApi,
+		createProjectAsset,
+		createAppointmentAsset,
+		getAsset,
+		updateAsset,
+		deleteAsset,
+		putTransfer,
+	};
+	const changes: UploadItem[] = [];
+	const onReady = mock(() => {});
+	const delay = mock(async () => {});
+	const runner = new UploadRunner(
+		"project",
+		item,
+		(updated) => changes.push(updated),
+		onReady,
+		api,
+		delay,
+	);
+	return { runner, api, creation, ready, item, changes, onReady, delay };
+}
diff --git a/apps/app/test/project-assets-upload.spec.ts b/apps/app/test/project-assets-upload.spec.ts
new file mode 100644
index 000000000..1f9459414
--- /dev/null
+++ b/apps/app/test/project-assets-upload.spec.ts
@@ -0,0 +1,153 @@
+import { describe, expect, mock, test } from "bun:test";
+import { projectApi } from "../lib/project-assets/client";
+import { uploadFixture } from "./project-assets-upload.fixture";
+
+describe("project asset upload recovery", () => {
+	test("replays lost creation with the same key before transfer", async () => {
+		const f = uploadFixture();
+		f.api.createProjectAsset.mockRejectedValueOnce(new Error("Response lost"));
+
+		await f.runner.run();
+		expect(f.changes.at(-1)?.status).toBe("FAILED");
+
+		await f.runner.run();
+		expect(f.api.createProjectAsset).toHaveBeenCalledTimes(2);
+		expect(f.api.createProjectAsset.mock.calls.map((call) => call[2])).toEqual([
+			"create",
+			"create",
+		]);
+		expect(f.api.putTransfer).toHaveBeenCalledTimes(1);
+		expect(f.api.updateAsset).toHaveBeenCalledTimes(1);
+		expect(f.onReady).toHaveBeenCalledTimes(1);
+		expect(f.changes.at(-1)?.status).toBe("READY");
+	});
+
+	test("replays lost completion without another creation or transfer", async () => {
+		const f = uploadFixture();
+		f.api.updateAsset.mockRejectedValueOnce(new Error("Response lost"));
+
+		await f.runner.run();
+		expect(f.changes.at(-1)?.status).toBe("FAILED");
+		await f.runner.run();
+
+		expect(f.api.createProjectAsset).toHaveBeenCalledTimes(1);
+		expect(f.api.putTransfer).toHaveBeenCalledTimes(1);
+		expect(f.api.updateAsset).toHaveBeenCalledTimes(2);
+		expect(f.api.updateAsset.mock.calls.map((call) => call[2])).toEqual([
+			"complete",
+			"complete",
+		]);
+		expect(f.onReady).toHaveBeenCalledTimes(1);
+		expect(f.changes.at(-1)?.status).toBe("READY");
+	});
+
+	test("cancels an accepted asset before transfer when creation was pending", async () => {
+		const f = uploadFixture();
+		const pending = Promise.withResolvers<typeof f.creation>();
+		f.api.createProjectAsset.mockImplementationOnce(() => pending.promise);
+		const run = f.runner.run();
+		await Promise.resolve();
+		await f.runner.cancel();
+		pending.resolve(f.creation);
+		await run;
+
+		expect(f.api.deleteAsset).toHaveBeenCalledTimes(1);
+		expect(f.api.putTransfer).not.toHaveBeenCalled();
+		expect(f.api.updateAsset).not.toHaveBeenCalled();
+		expect(f.onReady).toHaveBeenCalledTimes(1);
+		expect(f.changes.at(-1)?.status).toBe("CANCELED");
+	});
+
+	test("cancels an asset when the direct transfer is aborted", async () => {
+		const f = uploadFixture();
+		const started = Promise.withResolvers<void>();
+		f.api.putTransfer.mockImplementationOnce(
+			(_transfer, _file, signal) =>
+				new Promise((_resolve, reject) => {
+					signal?.addEventListener(
+						"abort",
+						() => reject(new Error("Aborted")),
+						{ once: true },
+					);
+					started.resolve();
+				}),
+		);
+		const run = f.runner.run();
+		await started.promise;
+		await f.runner.cancel();
+		await run;
+
+		expect(f.api.deleteAsset).toHaveBeenCalledTimes(1);
+		expect(f.api.updateAsset).not.toHaveBeenCalled();
+		expect(f.onReady).toHaveBeenCalledTimes(1);
+		expect(f.changes.at(-1)?.status).toBe("CANCELED");
+	});
+
+	test("refreshes the transfer by replaying the original creation on retry", async () => {
+		const f = uploadFixture();
+		if (!f.creation.transfer) throw new Error("Fixture requires a transfer");
+		const refreshed = {
+			...f.creation,
+			transfer: {
+				...f.creation.transfer,
+				url: "https://storage.example/refreshed",
+			},
+		};
+		f.api.createProjectAsset
+			.mockResolvedValueOnce(f.creation)
+			.mockResolvedValueOnce(refreshed);
+		f.api.putTransfer.mockRejectedValueOnce(new Error("Transfer failed"));
+
+		await f.runner.run();
+		expect(f.changes.at(-1)?.status).toBe("FAILED");
+		await f.runner.run();
+
+		expect(f.api.createProjectAsset).toHaveBeenCalledTimes(2);
+		expect(f.api.createProjectAsset.mock.calls.map((call) => call[2])).toEqual([
+			"create",
+			"create",
+		]);
+		expect(f.api.putTransfer.mock.calls.map((call) => call[0].url)).toEqual([
+			"https://storage.example/file",
+			"https://storage.example/refreshed",
+		]);
+		expect(f.api.updateAsset).toHaveBeenCalledTimes(1);
+	});
+
+	test("uses the appointment collection path without a body association", async () => {
+		const f = uploadFixture("appointment");
+		await f.runner.run();
+
+		expect(f.api.createProjectAsset).not.toHaveBeenCalled();
+		expect(f.api.createAppointmentAsset).toHaveBeenCalledTimes(1);
+		expect(f.api.createAppointmentAsset.mock.calls[0]?.[1]).not.toHaveProperty(
+			"appointmentId",
+		);
+	});
+
+	test("sends the signed transfer without CRM credentials", async () => {
+		const f = uploadFixture();
+		if (!f.creation.transfer) throw new Error("Fixture requires a transfer");
+		const originalFetch = globalThis.fetch;
+		const fetchMock = mock(
+			async (_input: RequestInfo | URL, _init?: RequestInit) =>
+				new Response(null, { status: 200 }),
+		);
+		globalThis.fetch = fetchMock as unknown as typeof fetch;
+		try {
+			await projectApi.putTransfer(f.creation.transfer, f.item.file);
+		} finally {
+			globalThis.fetch = originalFetch;
+		}
+
+		expect(fetchMock).toHaveBeenCalledTimes(1);
+		const [url, init] = fetchMock.mock.calls[0] ?? [];
+		expect(url).toBe(f.creation.transfer.url);
+		expect(init).toMatchObject({
+			method: "PUT",
+			credentials: "omit",
+			headers: f.creation.transfer.headers,
+			body: f.item.file,
+		});
+	});
+});
diff --git a/apps/app/test/tenant-gate.spec.ts b/apps/app/test/tenant-gate.spec.ts
new file mode 100644
index 000000000..399fbafcc
--- /dev/null
+++ b/apps/app/test/tenant-gate.spec.ts
@@ -0,0 +1,99 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { resolveTenantForSlug } from "../lib/tenant-gate";
+
+const suffix = process.env.TEST_RUN_ID ?? `tenant-gate-${Date.now()}`;
+const ORG_ID = `${suffix}-org`;
+const MEMBER_USER_ID = `${suffix}-member`;
+const STRANGER_USER_ID = `${suffix}-stranger`;
+const MEMBER_USER_EMAIL = `${MEMBER_USER_ID}@example.com`;
+const STRANGER_USER_EMAIL = `${STRANGER_USER_ID}@example.com`;
+const MEMBER_ROW_ID = `${suffix}-member-row`;
+const SLUG = `${suffix}-slug`;
+
+beforeAll(async () => {
+	await db.organization.create({
+		data: {
+			id: ORG_ID,
+			name: "Tenant gate org",
+			slug: SLUG,
+			createdAt: new Date(),
+		},
+	});
+
+	await db.user.createMany({
+		data: [
+			{ id: MEMBER_USER_ID, name: "Member", email: MEMBER_USER_EMAIL },
+			{ id: STRANGER_USER_ID, name: "Stranger", email: STRANGER_USER_EMAIL },
+		],
+	});
+
+	await db.member.create({
+		data: {
+			id: MEMBER_ROW_ID,
+			organizationId: ORG_ID,
+			userId: MEMBER_USER_ID,
+			role: "owner",
+			createdAt: new Date(),
+		},
+	});
+});
+
+afterAll(async () => {
+	await db.member.deleteMany({
+		where: { organizationId: ORG_ID },
+	});
+
+	await db.user.deleteMany({
+		where: {
+			id: { in: [MEMBER_USER_ID, STRANGER_USER_ID] },
+		},
+	});
+
+	await db.organization.deleteMany({
+		where: { id: ORG_ID },
+	});
+});
+
+describe("resolveTenantForSlug", () => {
+	it("returns not-found for a slug with no matching organization", async () => {
+		const result = await resolveTenantForSlug(
+			"no-such-tenant-gate-slug",
+			MEMBER_USER_ID,
+		);
+
+		expect(result.status).toBe("not-found");
+	});
+
+	it("returns forbidden for a real organization the user does not belong to", async () => {
+		const result = await resolveTenantForSlug(SLUG, STRANGER_USER_ID);
+
+		expect(result.status).toBe("forbidden");
+	});
+
+	it("returns ok and needsActiveOrgSwitch for a member whose active org differs", async () => {
+		const result = await resolveTenantForSlug(
+			SLUG,
+			MEMBER_USER_ID,
+			`${suffix}-other-org`,
+		);
+
+		expect(result).toEqual({
+			status: "ok",
+			organization: { id: ORG_ID, name: "Tenant gate org", slug: SLUG },
+			organizations: [{ id: ORG_ID, name: "Tenant gate org", slug: SLUG }],
+			needsActiveOrgSwitch: true,
+		});
+	});
+
+	it("returns ok and does not need switch when session already active there", async () => {
+		const result = await resolveTenantForSlug(SLUG, MEMBER_USER_ID, ORG_ID);
+
+		expect(result).toEqual({
+			status: "ok",
+			organization: { id: ORG_ID, name: "Tenant gate org", slug: SLUG },
+			organizations: [{ id: ORG_ID, name: "Tenant gate org", slug: SLUG }],
+			needsActiveOrgSwitch: false,
+		});
+	});
+});
diff --git a/apps/app/test/workspace-label.spec.ts b/apps/app/test/workspace-label.spec.ts
index f44d7bca2..5d147c636 100644
--- a/apps/app/test/workspace-label.spec.ts
+++ b/apps/app/test/workspace-label.spec.ts
@@ -1,10 +1,9 @@
 import { describe, expect, it } from "bun:test";
-import { DEFAULT_WORKSPACE_NAME } from "@crm/auth";
 import { workspaceLabel } from "../lib/workspace-label";
 
 describe("what the header calls this install", () => {
 	it("does not say CRM twice before anybody has named the workspace", () => {
-		expect(workspaceLabel(DEFAULT_WORKSPACE_NAME)).toBe("CRM");
+		expect(workspaceLabel("CRM")).toBe("CRM");
 	});
 
 	it("falls back to CRM while the workspace is still loading", () => {
diff --git a/apps/app/turbo.json b/apps/app/turbo.json
index cea0ca0ed..28c97853e 100644
--- a/apps/app/turbo.json
+++ b/apps/app/turbo.json
@@ -1,12 +1,12 @@
 {
-	"$schema": "https://turborepo.dev/schema.json",
+	"$schema": "https://v2-10-12.turborepo.dev/schema.json",
 	"extends": ["//"],
 	"tasks": {
 		"build": {
 			"dependsOn": ["^build"],
 			"inputs": ["$TURBO_DEFAULT$", ".env*"],
 			"outputs": [".next/**", "!.next/cache/**", "!.next/dev/**"],
-			"env": ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"],
+			"env": ["$TURBO_EXTENDS$", "NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"],
 			"passThroughEnv": [
 				"AGENT_BRIDGE_SECRET",
 				"AGENT_URL",
diff --git a/biome.jsonc b/biome.jsonc
index f93ad2386..5cb97a490 100644
--- a/biome.jsonc
+++ b/biome.jsonc
@@ -18,7 +18,8 @@
 			"!.claude",
 			"!.agents",
 			"!tools/oxlint/anti-slop",
-			"!skills-lock.json"
+			"!skills-lock.json",
+			"!vendor/**"
 		]
 	},
 	"formatter": {
@@ -67,6 +68,14 @@
 		}
 	},
 	"overrides": [
+		{
+			"includes": ["packages/kaneo-domain/src/drizzle.ts"],
+			"linter": {
+				"rules": {
+					"suspicious": { "noExplicitAny": "off" }
+				}
+			}
+		},
 		{
 			"includes": ["apps/app/**"],
 			"linter": {
diff --git a/bun.lock b/bun.lock
index 1c6df3e63..a870429d8 100644
--- a/bun.lock
+++ b/bun.lock
@@ -1,144 +1,196 @@
 {
-  "lockfileVersion": 1,
+  "lockfileVersion": 2,
   "configVersion": 1,
   "workspaces": {
     "": {
       "name": "crm",
       "devDependencies": {
-        "@biomejs/biome": "^2.4.10",
-        "@oxlint/plugins": "1.78.0",
-        "knip": "6.32.2",
-        "oxlint": "1.78.0",
-        "turbo": "^2.10.8",
-        "typescript": "5.9.2",
+        "@biomejs/biome": "^2.5.13",
+        "@oxlint/plugins": "^1.83.0",
+        "@paralleldrive/cuid2": "^3.3.0",
+        "drizzle-orm": "^0.45.2",
+        "knip": "^6.35.1",
+        "oxlint": "^1.83.0",
+        "turbo": "^2.10.12",
+        "typescript": "^7.0.2",
       },
     },
     "apps/agent": {
       "name": "agent",
       "version": "0.0.1",
       "dependencies": {
+        "@agent-xmpp/core": "workspace:*",
+        "@agent-xmpp/gateway": "workspace:*",
+        "@agent-xmpp/protocol": "workspace:*",
         "@crm/db": "workspace:*",
         "@crm/env": "workspace:*",
         "@crm/telemetry": "workspace:*",
         "@crm/validation": "workspace:*",
-        "context.dev": "2.10.0",
-        "eve": "^0.29.4",
-        "zod": "^4.4.3",
+        "ai": "7.0.94",
+        "context.dev": "2.14.0",
+        "eve": "^0.52.3",
+        "ulid": "3.0.2",
+        "zod": "^4.5.4",
       },
       "devDependencies": {
         "@crm/typescript-config": "workspace:*",
-        "@types/node": "^24.0.0",
-        "just-bash": "^3.2.0",
-        "microsandbox": "^0.6.8",
-        "typescript": "^5.9.2",
+        "@types/bun": "^1.4.2",
+        "@types/node": "^26.5.0",
+        "@xmpp/client": "0.14.0",
+        "just-bash": "^3.4.2",
+        "microsandbox": "^0.6.17",
+        "typescript": "^7.0.2",
       },
     },
     "apps/api": {
       "name": "api",
       "version": "0.0.1",
       "dependencies": {
+        "@aws-sdk/client-s3": "^3.1128.0",
+        "@aws-sdk/s3-request-presigner": "^3.1128.0",
         "@crm/auth": "workspace:*",
         "@crm/db": "workspace:*",
         "@crm/env": "workspace:*",
         "@crm/telemetry": "workspace:*",
         "@crm/validation": "workspace:*",
         "@keyv/redis": "^5.1.6",
-        "@nestjs/cache-manager": "^3.1.3",
-        "@nestjs/common": "^11.0.1",
-        "@nestjs/config": "^4.0.4",
-        "@nestjs/core": "^11.0.1",
-        "@nestjs/platform-express": "^11.0.1",
+        "@nestjs/cache-manager": "^12.0.0",
+        "@nestjs/common": "^11.2.3",
+        "@nestjs/config": "^12.0.0",
+        "@nestjs/core": "^11.2.3",
+        "@nestjs/platform-express": "^11.2.3",
         "@nestjs/swagger": "^11.4.7",
-        "@thallesp/nestjs-better-auth": "^2.7.0",
+        "@thallesp/nestjs-better-auth": "^2.8.0",
         "@trpc/server": "^11.18.0",
-        "@vercel/blob": "^2.6.1",
-        "better-auth": "^1.6.25",
+        "@vercel/blob": "^2.8.0",
+        "better-auth": "1.7.3",
         "cache-manager": "^7.2.9",
         "class-transformer": "^0.5.1",
         "class-validator": "^0.15.1",
-        "context.dev": "^2.7.0",
+        "context.dev": "^2.14.0",
         "helmet": "^8.3.0",
         "nestjs-trpc": "^2.13.0",
         "reflect-metadata": "^0.2.2",
-        "rxjs": "^7.8.1",
+        "rxjs": "^7.8.2",
         "trpc-to-openapi": "^3.3.0",
-        "zod": "^4.4.3",
+        "zod": "^4.5.4",
       },
       "devDependencies": {
         "@crm/typescript-config": "workspace:*",
-        "@nestjs/testing": "^11.0.1",
-        "@types/bun": "^1.3.14",
-        "@types/express": "^5.0.0",
-        "@types/node": "^24.0.0",
-        "@types/supertest": "^7.0.0",
-        "concurrently": "^9.1.0",
-        "supertest": "^7.0.0",
-        "typescript": "^5.9.2",
+        "@nestjs/testing": "^11.2.3",
+        "@types/bun": "^1.4.2",
+        "@types/express": "^5.0.6",
+        "@types/node": "^26.5.0",
+        "@types/supertest": "^7.2.1",
+        "concurrently": "^10.0.5",
+        "supertest": "^7.2.2",
+        "typescript": "^7.0.2",
       },
     },
     "apps/app": {
       "name": "app",
       "version": "0.1.0",
       "dependencies": {
-        "@carbon/icons-react": "^11.82.0",
+        "@carbon/icons-react": "^11.88.0",
         "@crm/auth": "workspace:*",
         "@crm/db": "workspace:*",
         "@crm/env": "workspace:*",
         "@crm/telemetry": "workspace:*",
         "@crm/ui": "workspace:*",
         "@crm/validation": "workspace:*",
-        "@pierre/diffs": "^1.2.12",
-        "@pierre/trees": "^1.0.0-beta.5",
-        "@tanstack/react-query": "^5.101.2",
+        "@pierre/diffs": "^1.4.1",
+        "@pierre/trees": "^1.0.0-beta.6",
+        "@tanstack/react-query": "^5.102.8",
         "@trpc/client": "^11.18.0",
         "@trpc/server": "^11.18.0",
         "@trpc/tanstack-react-query": "^11.18.0",
         "api": "workspace:*",
-        "better-auth": "^1.6.25",
-        "eve": "^0.29.4",
-        "next": "16.3.0",
+        "better-auth": "1.7.3",
+        "eve": "^0.52.3",
+        "next": "16.3.4",
         "next-themes": "^0.4.6",
-        "nuqs": "^2.8.9",
-        "posthog-js": "^1.413.2",
-        "react": "19.2.4",
-        "react-dom": "19.2.4",
-        "sonner": "^2.0.7",
-        "zod": "^4.4.3",
+        "nuqs": "^2.10.1",
+        "posthog-js": "^1.428.8",
+        "react": "19.2.8",
+        "react-dom": "19.2.8",
+        "sonner": "^2.0.8",
+        "zod": "^4.5.4",
       },
       "devDependencies": {
         "@crm/typescript-config": "workspace:*",
-        "@tailwindcss/postcss": "^4",
-        "@tanstack/react-query-devtools": "^5.101.2",
-        "@types/bun": "^1.3.14",
-        "@types/node": "^20",
-        "@types/react": "^19",
+        "@tailwindcss/postcss": "^4.3.3",
+        "@tanstack/react-query-devtools": "^5.102.8",
+        "@types/bun": "^1.4.2",
+        "@types/node": "^26.5.0",
+        "@types/react": "^19.2.18",
         "@types/react-dom": "^19",
-        "tailwindcss": "^4",
-        "typescript": "^5",
+        "tailwindcss": "^4.3.3",
+        "typescript": "^7.0.2",
+      },
+    },
+    "packages/agent-xmpp/core": {
+      "name": "@agent-xmpp/core",
+      "version": "0.1.0",
+      "dependencies": {
+        "@agent-xmpp/protocol": "workspace:*",
+        "ajv": "8.20.0",
+      },
+      "devDependencies": {
+        "@types/node": "^26.5.0",
+        "typescript": "^7.0.2",
+      },
+    },
+    "packages/agent-xmpp/gateway": {
+      "name": "@agent-xmpp/gateway",
+      "version": "0.1.0",
+      "dependencies": {
+        "@agent-xmpp/core": "workspace:*",
+        "@agent-xmpp/protocol": "workspace:*",
+        "@xmpp/component": "0.14.0",
+        "@xmpp/xml": "0.14.0",
+        "ulid": "3.0.2",
+      },
+      "devDependencies": {
+        "@types/node": "^26.5.0",
+        "typescript": "^7.0.2",
+      },
+    },
+    "packages/agent-xmpp/protocol": {
+      "name": "@agent-xmpp/protocol",
+      "version": "0.1.0",
+      "dependencies": {
+        "idn-hostname": "17.0.3",
+        "precis-wasm": "0.1.0",
+      },
+      "devDependencies": {
+        "@types/node": "^26.5.0",
+        "typescript": "^7.0.2",
       },
     },
     "packages/auth": {
       "name": "@crm/auth",
       "version": "0.0.0",
       "dependencies": {
-        "@better-auth/api-key": "1.6.25",
-        "@better-auth/sso": "1.6.25",
+        "@better-auth/api-key": "1.7.3",
+        "@better-auth/core": "1.7.3",
+        "@better-auth/oauth-provider": "1.7.3",
+        "@better-auth/sso": "1.7.3",
         "@crm/db": "workspace:*",
         "@crm/env": "workspace:*",
         "@crm/validation": "workspace:*",
-        "better-auth": "^1.6.25",
-        "zod": "^4.4.3",
+        "better-auth": "1.7.3",
+        "zod": "^4.5.4",
       },
       "devDependencies": {
-        "@better-auth/cli": "^1.4.22",
         "@crm/typescript-config": "workspace:*",
-        "@types/node": "^24.10.1",
+        "@types/node": "^26.5.0",
         "@types/react": "^19.2.18",
+        "auth": "1.7.3",
         "react": "^19.2.8",
-        "typescript": "5.9.2",
+        "typescript": "7.0.2",
       },
       "peerDependencies": {
-        "react": "^19.2.0",
+        "react": "^19.2.8",
       },
       "optionalPeers": [
         "react",
@@ -149,16 +201,17 @@
       "version": "0.0.0",
       "dependencies": {
         "@crm/env": "workspace:*",
-        "@prisma/adapter-pg": "^7.9.1",
-        "@prisma/client": "^7.9.1",
-        "@vercel/blob": "^2.6.1",
+        "@prisma/adapter-pg": "^7.10.0",
+        "@prisma/client": "^7.10.0",
+        "@vercel/blob": "^2.8.0",
       },
       "devDependencies": {
         "@crm/typescript-config": "workspace:*",
-        "@types/node": "^24.10.1",
-        "pg": "^8.22.0",
-        "prisma": "^7.9.1",
-        "typescript": "5.9.2",
+        "@types/bun": "^1.4.2",
+        "@types/node": "^26.5.0",
+        "pg": "^8.23.0",
+        "prisma": "^7.10.0",
+        "typescript": "7.0.2",
       },
     },
     "packages/env": {
@@ -166,8 +219,19 @@
       "version": "0.0.0",
       "devDependencies": {
         "@crm/typescript-config": "workspace:*",
-        "@types/node": "^24.10.1",
-        "typescript": "5.9.2",
+        "@types/node": "^26.5.0",
+        "typescript": "7.0.2",
+      },
+    },
+    "packages/kaneo-domain": {
+      "name": "@crm/kaneo-domain",
+      "version": "0.0.0",
+      "devDependencies": {
+        "@crm/typescript-config": "workspace:*",
+        "@paralleldrive/cuid2": "^3.3.0",
+        "@types/node": "^26.5.0",
+        "drizzle-orm": "^0.45.2",
+        "typescript": "7.0.2",
       },
     },
     "packages/telemetry": {
@@ -176,12 +240,12 @@
       "dependencies": {
         "@crm/db": "workspace:*",
         "@crm/env": "workspace:*",
-        "posthog-node": "^5.48.0",
+        "posthog-node": "^5.51.8",
       },
       "devDependencies": {
         "@crm/typescript-config": "workspace:*",
-        "@types/node": "^24.10.1",
-        "typescript": "5.9.2",
+        "@types/node": "^26.5.0",
+        "typescript": "7.0.2",
       },
     },
     "packages/typescript-config": {
@@ -192,46 +256,46 @@
       "name": "@crm/ui",
       "version": "0.0.0",
       "dependencies": {
-        "@carbon/icons-react": "^11.82.0",
+        "@carbon/icons-react": "^11.88.0",
         "@crm/db": "workspace:*",
         "@dnd-kit/core": "^6.3.1",
         "@dnd-kit/modifiers": "^9.0.0",
         "@dnd-kit/sortable": "^10.0.0",
         "@dnd-kit/utilities": "^3.2.2",
-        "@shadcn/react": "^0.3.0",
+        "@shadcn/react": "^0.3.1",
         "class-variance-authority": "^0.7.1",
         "clsx": "^2.1.1",
         "cmdk": "^1.1.1",
-        "lucide-react": "^1.28.0",
-        "motion": "^12.42.2",
+        "lucide-react": "^1.43.0",
+        "motion": "^13.2.0",
         "next-themes": "^0.4.6",
-        "nuqs": "^2.8.9",
-        "radix-ui": "^1.6.0",
+        "nuqs": "^2.10.1",
+        "radix-ui": "^1.6.7",
         "react-day-picker": "^10.0.1",
-        "recharts": "3.8.0",
-        "sonner": "^2.0.7",
-        "streamdown": "^2.5.0",
+        "recharts": "3.10.1",
+        "sonner": "^2.0.8",
+        "streamdown": "^2.6.0",
         "tailwind-merge": "^3.6.0",
         "tw-animate-css": "^1.4.0",
         "vaul": "^1.1.2",
       },
       "devDependencies": {
         "@crm/typescript-config": "workspace:*",
-        "@tailwindcss/postcss": "^4",
-        "@types/node": "^24.10.1",
+        "@tailwindcss/postcss": "^4.3.3",
+        "@types/node": "^26.5.0",
         "@types/react": "^19.2.18",
         "@types/react-dom": "^19",
-        "next": "16.2.12",
-        "react": "19.2.4",
-        "react-dom": "19.2.4",
-        "shadcn": "^4.16.1",
-        "tailwindcss": "^4",
-        "typescript": "5.9.2",
+        "next": "16.3.4",
+        "react": "19.2.8",
+        "react-dom": "19.2.8",
+        "shadcn": "^4.21.0",
+        "tailwindcss": "^4.3.3",
+        "typescript": "7.0.2",
       },
       "peerDependencies": {
-        "next": "^16.0.0",
-        "react": "^19.2.0",
-        "react-dom": "^19.2.0",
+        "next": "^16.3.4",
+        "react": "^19.2.8",
+        "react-dom": "^19.2.8",
       },
     },
     "packages/validation": {
@@ -239,38 +303,83 @@
       "version": "0.0.0",
       "dependencies": {
         "@crm/db": "workspace:*",
-        "zod": "^4.4.3",
+        "zod": "^4.5.4",
       },
       "devDependencies": {
         "@crm/typescript-config": "workspace:*",
-        "@types/node": "^24.10.1",
-        "typescript": "5.9.2",
+        "@types/node": "^26.5.0",
+        "typescript": "7.0.2",
       },
     },
   },
   "trustedDependencies": [
     "sharp",
   ],
+  "patchedDependencies": {
+    "@better-auth/oauth-provider@1.7.3": "patches/@better-auth%2Foauth-provider@1.7.3.patch",
+  },
   "packages": {
-    "@ai-sdk/gateway": ["@ai-sdk/gateway@4.0.36", "", { "dependencies": { "@ai-sdk/provider": "4.0.4", "@ai-sdk/provider-utils": "5.0.18", "@vercel/oidc": "3.2.0" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-N1P6bdW/aC5rxLeuGYgx3X4el3DoZy8UWlky+g+AeIZSmxaEi/AToHJL4cmZ6nCPHk1byqJWwC+PaOZG0hK0dw=="],
+    "@agent-xmpp/core": ["@agent-xmpp/core@workspace:packages/agent-xmpp/core"],
 
-    "@ai-sdk/provider": ["@ai-sdk/provider@4.0.4", "", { "dependencies": { "json-schema": "^0.4.0" } }, "sha512-tbHKNLirllUNF3ZlkCsXnwab2ZV1Sl4b1H/Cp9ruCce15IBmskE8Gwkk0yo9xDWY+jho2of7lVXtwSsyrq7cwQ=="],
+    "@agent-xmpp/gateway": ["@agent-xmpp/gateway@workspace:packages/agent-xmpp/gateway"],
 
-    "@ai-sdk/provider-utils": ["@ai-sdk/provider-utils@5.0.18", "", { "dependencies": { "@ai-sdk/provider": "4.0.4", "@standard-schema/spec": "^1.1.0", "@workflow/serde": "4.1.0", "eventsource-parser": "^3.0.8", "undici": "^7.28.0" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-UBNCrkxS5llgN2/RXLBRkjCFTIuL6YB1Goq5c+yRecnznhtX4XPjTwLHz2hrsTltTVZ0rqVegtnwFXdPBkjDHA=="],
+    "@agent-xmpp/protocol": ["@agent-xmpp/protocol@workspace:packages/agent-xmpp/protocol"],
 
-    "@alloc/quick-lru": ["@alloc/quick-lru@5.2.0", "", {}, "sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw=="],
+    "@ai-sdk/gateway": ["@ai-sdk/gateway@4.0.76", "", { "dependencies": { "@ai-sdk/provider": "4.0.11", "@ai-sdk/provider-utils": "5.0.37", "@vercel/oidc": "3.2.0" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-hWNtiveILLtkXm1t5tNmzeII8p+j/mzxlL2OtPAgU/0h4ZInkIVILX8Svx4SzI5U9d80B59gCPaKRAhb7jTtAw=="],
 
-    "@antfu/install-pkg": ["@antfu/install-pkg@1.1.0", "", { "dependencies": { "package-manager-detector": "^1.3.0", "tinyexec": "^1.0.1" } }, "sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ=="],
+    "@ai-sdk/provider": ["@ai-sdk/provider@4.0.11", "", { "dependencies": { "json-schema": "^0.4.0" } }, "sha512-A/Cyjma9RLTLsF9xv/2OSaw9eyFhOIBqzoeOVZhp+xKZD8wv5opN+qyIa83NE4Jug2SjQ/Kaf08w1JX6CESR/w=="],
+
+    "@ai-sdk/provider-utils": ["@ai-sdk/provider-utils@5.0.37", "", { "dependencies": { "@ai-sdk/provider": "4.0.11", "@standard-schema/spec": "^1.1.0", "@workflow/serde": "4.1.0", "eventsource-parser": "^3.0.8", "undici": "^7.29.0" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-WzLQPWtpLpunKBanq/TX8+rbBz7JdKpl8Io4nl/g+bLvePbxMlMuxLrxT8JzquxJmgWKbW4nfFrQ5mnX4A8mpw=="],
+
+    "@alloc/quick-lru": ["@alloc/quick-lru@5.3.0", "", {}, "sha512-U4+70Pc5ZS9osnCBCE5Jha/ciHM+Yp+CNMNC/7HvYbNRk1Ldd+f7qO65W5qfhu/TCv+/ozljlXXe9Nj8419DMA=="],
 
     "@authenio/xml-encryption": ["@authenio/xml-encryption@2.0.2", "", { "dependencies": { "@xmldom/xmldom": "^0.8.6", "escape-html": "^1.0.3", "xpath": "0.0.32" } }, "sha512-cTlrKttbrRHEw3W+0/I609A2Matj5JQaRvfLtEIGZvlN0RaPi+3ANsMeqAyCAVlH/lUIW2tmtBlSMni74lcXeg=="],
 
+    "@aws-sdk/checksums": ["@aws-sdk/checksums@3.1001.0", "", { "dependencies": { "@aws-sdk/core": "^3.978.0", "@aws-sdk/types": "^3.974.5", "@smithy/core": "^3.33.3", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-6uTniZc87q+B5eXouGTl+7Tmc482rEeCcvxpsvREP8EfF0gvloRZ41UOA9sbSJlyy8TbqIBXb3kKfKarEArUQA=="],
+
+    "@aws-sdk/client-s3": ["@aws-sdk/client-s3@3.1128.0", "", { "dependencies": { "@aws-sdk/checksums": "^3.1000.29", "@aws-sdk/core": "^3.977.9", "@aws-sdk/credential-provider-node": "^3.972.82", "@aws-sdk/middleware-sdk-s3": "^3.972.75", "@aws-sdk/signature-v4-multi-region": "^3.996.46", "@aws-sdk/types": "^3.974.5", "@smithy/core": "^3.33.3", "@smithy/fetch-http-handler": "^5.7.2", "@smithy/node-http-handler": "^4.11.3", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-tYEB4058LdhTiSS7sCVVSpqSAdjIc1jTaf1dDPoIRJbR/XI5A2ZOuCiV1Aebo/pria/pUJBOT0WjdZVIwaZtDA=="],
+
+    "@aws-sdk/core": ["@aws-sdk/core@3.978.0", "", { "dependencies": { "@aws-sdk/types": "^3.974.5", "@aws-sdk/xml-builder": "^3.972.40", "@aws/lambda-invoke-store": "^0.3.0", "@smithy/core": "^3.33.3", "@smithy/signature-v4": "^5.6.12", "@smithy/types": "^4.17.2", "bowser": "^2.11.0", "tslib": "^2.6.2" } }, "sha512-2yX9LUmxPklVjSGTb8dfnWRJSiFQ3TeH2nn7G1mdKHTfnabzF0+gfrS8rYfLWmZrQ8A3mEcxMJjRc51dL5KWaA=="],
+
+    "@aws-sdk/credential-provider-env": ["@aws-sdk/credential-provider-env@3.972.71", "", { "dependencies": { "@aws-sdk/core": "^3.978.0", "@aws-sdk/types": "^3.974.5", "@smithy/core": "^3.33.3", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-JN+JHruYZw3GUZB8YGAlDk4wTDPOEAEEdEzj5nS0xodWR4smzHsN7PnK2j6IeOsDIj2aqua5DSbhXl9Gtf90FQ=="],
+
+    "@aws-sdk/credential-provider-http": ["@aws-sdk/credential-provider-http@3.972.73", "", { "dependencies": { "@aws-sdk/core": "^3.978.0", "@aws-sdk/types": "^3.974.5", "@smithy/core": "^3.33.3", "@smithy/fetch-http-handler": "^5.7.2", "@smithy/node-http-handler": "^4.11.3", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-uyYYnJOnlis8uQzaYGPd7N1JoioCoNpXgnkXYixsWJXHXgXyYi8WXJSDfofxJeWfQIGWLe2Nwyq60Uc7MZdVOg=="],
+
+    "@aws-sdk/credential-provider-ini": ["@aws-sdk/credential-provider-ini@3.973.16", "", { "dependencies": { "@aws-sdk/core": "^3.978.0", "@aws-sdk/credential-provider-env": "^3.972.71", "@aws-sdk/credential-provider-http": "^3.972.73", "@aws-sdk/credential-provider-login": "^3.972.78", "@aws-sdk/credential-provider-process": "^3.972.71", "@aws-sdk/credential-provider-sso": "^3.973.15", "@aws-sdk/credential-provider-web-identity": "^3.972.77", "@aws-sdk/nested-clients": "^3.997.45", "@aws-sdk/types": "^3.974.5", "@smithy/core": "^3.33.3", "@smithy/credential-provider-imds": "^4.4.16", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-i++ly+0Uxa+u3ebSSyr0S/3CFhFJDxCXT3+Zj+mW2bXenEx5bKGCdTIKFu39SgXBNhWDjex/8cXUx9MUTMCrTw=="],
+
+    "@aws-sdk/credential-provider-login": ["@aws-sdk/credential-provider-login@3.972.78", "", { "dependencies": { "@aws-sdk/core": "^3.978.0", "@aws-sdk/nested-clients": "^3.997.45", "@aws-sdk/types": "^3.974.5", "@smithy/core": "^3.33.3", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-eUtswnXu0+Ii9ieRK+0L7aPFV3Z/dnW2VntJzjBP9xs8s+8p5nBNuymIXtXwZ+5r5+XJP3e32nMkuZ/r0HozEA=="],
+
+    "@aws-sdk/credential-provider-node": ["@aws-sdk/credential-provider-node@3.972.83", "", { "dependencies": { "@aws-sdk/credential-provider-env": "^3.972.71", "@aws-sdk/credential-provider-http": "^3.972.73", "@aws-sdk/credential-provider-ini": "^3.973.16", "@aws-sdk/credential-provider-process": "^3.972.71", "@aws-sdk/credential-provider-sso": "^3.973.15", "@aws-sdk/credential-provider-web-identity": "^3.972.77", "@aws-sdk/types": "^3.974.5", "@smithy/core": "^3.33.3", "@smithy/credential-provider-imds": "^4.4.16", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-jdso7ejzfRnatxMUZK4S/U6KbaDPCvfIV4XL+IQAPFDBt5rj5Fq595euqlK8Le4lNCMFR9oUpt+1l0aMgaayOQ=="],
+
+    "@aws-sdk/credential-provider-process": ["@aws-sdk/credential-provider-process@3.972.71", "", { "dependencies": { "@aws-sdk/core": "^3.978.0", "@aws-sdk/types": "^3.974.5", "@smithy/core": "^3.33.3", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-lYmXJa4gvq4xN1lrT5NiP5vIYYKcGWAdj8y+8o6dlcateB5eF3Dn8DtmjjHKfMBrTPAMr2pebIiX/UOj8c1/UA=="],
+
+    "@aws-sdk/credential-provider-sso": ["@aws-sdk/credential-provider-sso@3.973.15", "", { "dependencies": { "@aws-sdk/core": "^3.978.0", "@aws-sdk/nested-clients": "^3.997.45", "@aws-sdk/token-providers": "3.1129.0", "@aws-sdk/types": "^3.974.5", "@smithy/core": "^3.33.3", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-6Jhcf4v0pSFdjk1EW2kvzuEBKD+UZ2uNcHUIglKKLndD20YhvkL2kdmDOV5/j4mYuWWwe/a1FQ1aomU86/Cg5Q=="],
+
+    "@aws-sdk/credential-provider-web-identity": ["@aws-sdk/credential-provider-web-identity@3.972.77", "", { "dependencies": { "@aws-sdk/core": "^3.978.0", "@aws-sdk/nested-clients": "^3.997.45", "@aws-sdk/types": "^3.974.5", "@smithy/core": "^3.33.3", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-uylIQSUWpfLuH2LovxEEfwzJGM/SabLOfLMg6YXu/E8jJEKUdpdILCVCQCdFvHyu/7dLJOHPMfrSwduxO56NkQ=="],
+
+    "@aws-sdk/middleware-sdk-s3": ["@aws-sdk/middleware-sdk-s3@3.972.76", "", { "dependencies": { "@aws-sdk/core": "^3.978.0", "@aws-sdk/signature-v4-multi-region": "^3.996.46", "@aws-sdk/types": "^3.974.5", "@smithy/core": "^3.33.3", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-NfnTkVUTBKTBuBgqaapFK9r3YdkKt1b2oRvgLzZq91bwNKh6ZS0S7sEcheguttREaL4iyfs/xQnqD7Z7AsWSsA=="],
+
+    "@aws-sdk/nested-clients": ["@aws-sdk/nested-clients@3.997.45", "", { "dependencies": { "@aws-sdk/core": "^3.978.0", "@aws-sdk/signature-v4-multi-region": "^3.996.46", "@aws-sdk/types": "^3.974.5", "@smithy/core": "^3.33.3", "@smithy/fetch-http-handler": "^5.7.2", "@smithy/node-http-handler": "^4.11.3", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-mooq9Q+jLa18VoM7HouczmslZU60iiB0aKc/Ztnq/luIL1ud0z4DnYprLR/ZO1gp331S9tJctM1HZr7u6YKBXQ=="],
+
+    "@aws-sdk/s3-request-presigner": ["@aws-sdk/s3-request-presigner@3.1128.0", "", { "dependencies": { "@aws-sdk/core": "^3.977.9", "@aws-sdk/signature-v4-multi-region": "^3.996.46", "@aws-sdk/types": "^3.974.5", "@smithy/core": "^3.33.3", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-0wTgUw97lUKx94e4liC53V5z9giwqMaPsFjbXXy8qLC9Q/AaxUySmri+NFkHaOAd908sGsZ6ERMyFO4WMvYxLQ=="],
+
+    "@aws-sdk/signature-v4-multi-region": ["@aws-sdk/signature-v4-multi-region@3.996.46", "", { "dependencies": { "@aws-sdk/types": "^3.974.5", "@smithy/signature-v4": "^5.6.12", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-L+2xZTye/2T96f3lwCws0Zw6GG2JHZW9e8FpVgGBeeExSKyeoZ6CWRpBml/7DNiK/O26jrgPM9F+Ay8VkgzUWQ=="],
+
+    "@aws-sdk/token-providers": ["@aws-sdk/token-providers@3.1129.0", "", { "dependencies": { "@aws-sdk/core": "^3.978.0", "@aws-sdk/nested-clients": "^3.997.45", "@aws-sdk/types": "^3.974.5", "@smithy/core": "^3.33.3", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-Sbl3rpzQdsG4ZK2zh0JWUYyZPKKorJlVOddA2T0DVbKJFrsW8J6wgnslxxUH04+WaBMr4A1HzJZvZX0xUvkniA=="],
+
+    "@aws-sdk/types": ["@aws-sdk/types@3.974.5", "", { "dependencies": { "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-LkwLL2BLbC6wNNm4JaH9mbEqBMdOZCct6VAYqhdN4U1xrWM+fUJQEfbHwQgDypapOWTRtlk25akb5afM0P8CIQ=="],
+
+    "@aws-sdk/xml-builder": ["@aws-sdk/xml-builder@3.972.40", "", { "dependencies": { "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-wlFmCIGUlwF4zx/kncw+bmxTQh1HeSJq4mYV/V5cZUSJadDP3kXvGW8Rn21cimj/7y9ju+47oYWXi97vF7czaA=="],
+
+    "@aws/lambda-invoke-store": ["@aws/lambda-invoke-store@0.3.0", "", {}, "sha512-sl4Bm6yiMNYrZKkqqDFWN0UfnWhlS8ivKxrYl+6t0gCLrqr8y3B2IqZZbFRkfaVVp7C/baApyh71P+LeE1A2sQ=="],
+
     "@babel/code-frame": ["@babel/code-frame@7.29.7", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.29.7", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw=="],
 
     "@babel/compat-data": ["@babel/compat-data@7.29.7", "", {}, "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg=="],
 
     "@babel/core": ["@babel/core@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/generator": "^7.29.7", "@babel/helper-compilation-targets": "^7.29.7", "@babel/helper-module-transforms": "^7.29.7", "@babel/helpers": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/template": "^7.29.7", "@babel/traverse": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/remapping": "^2.3.5", "convert-source-map": "^2.0.0", "debug": "^4.1.0", "gensync": "^1.0.0-beta.2", "json5": "^2.2.3", "semver": "^6.3.1" } }, "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA=="],
 
-    "@babel/generator": ["@babel/generator@7.29.7", "", { "dependencies": { "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ=="],
+    "@babel/generator": ["@babel/generator@7.29.8", "", { "dependencies": { "@babel/parser": "^7.29.8", "@babel/types": "^7.29.8", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" } }, "sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg=="],
 
     "@babel/helper-annotate-as-pure": ["@babel/helper-annotate-as-pure@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" } }, "sha512-OoK6239jHPuSQOoS0kfTVKn0b/rVTk0seKq4Gd2UMLtmOVLjDC0ki3e+c90Trqv2gMfvJFqkiljrr568+qddiw=="],
 
@@ -302,7 +411,7 @@
 
     "@babel/helpers": ["@babel/helpers@7.29.7", "", { "dependencies": { "@babel/template": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg=="],
 
-    "@babel/parser": ["@babel/parser@7.29.7", "", { "dependencies": { "@babel/types": "^7.29.7" }, "bin": "./bin/babel-parser.js" }, "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg=="],
+    "@babel/parser": ["@babel/parser@7.29.8", "", { "dependencies": { "@babel/types": "^7.29.8" }, "bin": "./bin/babel-parser.js" }, "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA=="],
 
     "@babel/plugin-syntax-jsx": ["@babel/plugin-syntax-jsx@7.29.7", "", { "dependencies": { "@babel/helper-plugin-utils": "^7.29.7" }, "peerDependencies": { "@babel/core": "^7.0.0-0" } }, "sha512-TSu8+mHCoEaaCDEZ0I3+6mvTBYR4PCxQwf2z9/r5Tbztv6NaLR3B9thGTTxX2WGuGHJqRiAbKPeGTJ5XWXVg6A=="],
 
@@ -326,73 +435,73 @@
 
     "@babel/template": ["@babel/template@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/types": "^7.29.7" } }, "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg=="],
 
-    "@babel/traverse": ["@babel/traverse@7.29.7", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/generator": "^7.29.7", "@babel/helper-globals": "^7.29.7", "@babel/parser": "^7.29.7", "@babel/template": "^7.29.7", "@babel/types": "^7.29.7", "debug": "^4.3.1" } }, "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw=="],
+    "@babel/traverse": ["@babel/traverse@7.29.8", "", { "dependencies": { "@babel/code-frame": "^7.29.7", "@babel/generator": "^7.29.8", "@babel/helper-globals": "^7.29.7", "@babel/parser": "^7.29.8", "@babel/template": "^7.29.7", "@babel/types": "^7.29.8", "debug": "^4.3.1" } }, "sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg=="],
 
-    "@babel/types": ["@babel/types@7.29.7", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA=="],
+    "@babel/types": ["@babel/types@7.29.8", "", { "dependencies": { "@babel/helper-string-parser": "^7.29.7", "@babel/helper-validator-identifier": "^7.29.7" } }, "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg=="],
 
-    "@better-auth/api-key": ["@better-auth/api-key@1.6.25", "", { "dependencies": { "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/core": "^1.6.25", "@better-auth/utils": "0.4.2", "better-auth": "^1.6.25", "better-call": "1.3.7" } }, "sha512-A6f3YLN8Ve+D4R7f8jrSKh8Mpu9+bmc8PIb9BFgGgspcedM1PjpSEI5JKAWPUhiGgMeJdCGeCpRP+27jQmW9/w=="],
+    "@better-auth/api-key": ["@better-auth/api-key@1.7.3", "", { "dependencies": { "zod": "^4.5.4" }, "peerDependencies": { "@better-auth/core": "^1.7.3", "@better-auth/utils": "0.4.2", "better-auth": "^1.7.3", "better-call": "1.4.0" } }, "sha512-SY5IBK4YcxnQdyK6RAxSpze6Zfi2Emtp9c4BFl/FT0U7ZyBnKARKHFC1csf8kvtrbaMIIWUvcM9eeQW6OKUqRQ=="],
 
-    "@better-auth/cli": ["@better-auth/cli@1.4.22", "", { "dependencies": { "@babel/core": "^7.28.4", "@babel/preset-react": "^7.27.1", "@babel/preset-typescript": "^7.27.1", "@better-auth/core": "1.4.22", "@better-auth/telemetry": "1.4.22", "@better-auth/utils": "0.3.0", "@clack/prompts": "^0.11.0", "@mrleebo/prisma-ast": "^0.13.0", "@prisma/client": "^5.22.0", "@types/pg": "^8.15.5", "better-auth": "1.4.22", "better-sqlite3": "^12.2.0", "c12": "^3.2.0", "chalk": "^5.6.2", "commander": "^12.1.0", "dotenv": "^17.2.2", "drizzle-orm": "^0.41.0", "open": "^10.2.0", "pg": "^8.16.3", "prettier": "^3.6.2", "prompts": "^2.4.2", "semver": "^7.7.2", "yocto-spinner": "^0.2.3", "zod": "^4.3.5" }, "bin": { "better-auth": "dist/index.mjs" } }, "sha512-7azgrNiP1zJXMLqoLgCVj3KsZeYWLHeaGMapYlLblS6yU/o5n//sn1HBasRD2z4HBy2Etz/C7V483/mYvRHI2g=="],
+    "@better-auth/core": ["@better-auth/core@1.7.3", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.41.1", "@standard-schema/spec": "^1.1.0", "zod": "^4.5.4" }, "peerDependencies": { "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.4.0", "jose": "^6.1.0", "kysely": "^0.28.5 || ^0.29.0", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-JdP7lOkyE83jgjn7RilJj1XvZ7n2JjRsErKJuaXchjyuNo6cf1iVd3GtbhAtiUyJJkWdk8yL+LaUBKT80H0zLA=="],
 
-    "@better-auth/core": ["@better-auth/core@1.4.22", "", { "dependencies": { "@standard-schema/spec": "^1.0.0", "zod": "^4.3.5" }, "peerDependencies": { "@better-auth/utils": "0.3.0", "@better-fetch/fetch": "1.1.21", "better-call": "1.1.8", "jose": "^6.1.0", "kysely": "^0.28.5", "nanostores": "^1.0.1" } }, "sha512-l20Ia10lI9iGL+bkjggamQP9lQuiAeB/EYfEx5EQ4AcPrLojG6Doc0UDw5VZM66VXcMGs3bgC8P7WiaJv4Walg=="],
+    "@better-auth/drizzle-adapter": ["@better-auth/drizzle-adapter@1.7.3", "", { "peerDependencies": { "@better-auth/core": "^1.7.3", "@better-auth/utils": "0.4.2", "drizzle-orm": "^0.45.2 || >=1.0.0-rc.1 <2.0.0" }, "optionalPeers": ["drizzle-orm"] }, "sha512-S+nQRlxbUhkR43LrSv8c98ZvOvmv3nrtOnHkiZXkdDkr60PWp7maC2cqgzZ2C9exCC1a+4TugJlx2jRL+r+/9A=="],
 
-    "@better-auth/drizzle-adapter": ["@better-auth/drizzle-adapter@1.6.25", "", { "peerDependencies": { "@better-auth/core": "^1.6.25", "@better-auth/utils": "0.4.2", "drizzle-orm": "^0.45.2" }, "optionalPeers": ["drizzle-orm"] }, "sha512-ru/DeKjFPQUVeKkxF/ScazmPqIY7lwfkAV5Yt4j24wmn1Y8vFwoiPRnHgXUeZqBs10+nubaRwEqLF39CP6EhRw=="],
+    "@better-auth/kysely-adapter": ["@better-auth/kysely-adapter@1.7.3", "", { "peerDependencies": { "@better-auth/core": "^1.7.3", "@better-auth/utils": "0.4.2", "kysely": "^0.28.17 || ^0.29.0" }, "optionalPeers": ["kysely"] }, "sha512-UIsyJMIrjUnT+yTaS6dkCxYYmtPwxFHxwSJ8+CLty2II5w9BewlDxDA0/QzhoL/InYCPxQ5Y6xIgLHZG1dhwRA=="],
 
-    "@better-auth/kysely-adapter": ["@better-auth/kysely-adapter@1.6.25", "", { "peerDependencies": { "@better-auth/core": "^1.6.25", "@better-auth/utils": "0.4.2", "kysely": "^0.28.17 || ^0.29.0" }, "optionalPeers": ["kysely"] }, "sha512-zxiePhtN1YClS1irKYPVwWfN6kYp+QoYlz1hdQUOj8hXyo2aE/ny4RNAb6v332b0+U6Vu88EhYITRPdmvCo6uA=="],
+    "@better-auth/memory-adapter": ["@better-auth/memory-adapter@1.7.3", "", { "peerDependencies": { "@better-auth/core": "^1.7.3", "@better-auth/utils": "0.4.2" } }, "sha512-WdLANFY/QWC3G351RCzxU+Y9YlW+BQ1oG9NwBTSOUWQw5rZ87ws+weU8tvAMO7sQ4C9gKIlkOKBKUKXrSt91Tw=="],
 
-    "@better-auth/memory-adapter": ["@better-auth/memory-adapter@1.6.25", "", { "peerDependencies": { "@better-auth/core": "^1.6.25", "@better-auth/utils": "0.4.2" } }, "sha512-GhEzTumc8yfTz+OZ6pMg06BA49xob49x1bX+1mEl/FStDJoSF+6mTfI5M2ytFxaiN89336/aUjkW8u+qRyLexw=="],
+    "@better-auth/mongo-adapter": ["@better-auth/mongo-adapter@1.7.3", "", { "peerDependencies": { "@better-auth/core": "^1.7.3", "@better-auth/utils": "0.4.2", "mongodb": "^6.0.0 || ^7.0.0" }, "optionalPeers": ["mongodb"] }, "sha512-YL9m01tNogmFmRvOWJ46M9WwE6HirCXHDell29mtsQB/Qs1TPNLrgj7ybGMMGhQuyj6S218+8Wbls8m9s+i8RQ=="],
 
-    "@better-auth/mongo-adapter": ["@better-auth/mongo-adapter@1.6.25", "", { "peerDependencies": { "@better-auth/core": "^1.6.25", "@better-auth/utils": "0.4.2", "mongodb": "^6.0.0 || ^7.0.0" }, "optionalPeers": ["mongodb"] }, "sha512-ZtMmjcOdXR2Ziqx5y8ptTOaNpe0snNfALbBUPXJsgeyeRkDJDYzyLZ8MpuvNBTNllNeIFDbiXWAK5k+pEBZrUQ=="],
+    "@better-auth/oauth-provider": ["@better-auth/oauth-provider@1.7.3", "", { "dependencies": { "jose": "^6.2.3", "zod": "^4.5.4" }, "peerDependencies": { "@better-auth/core": "^1.7.3", "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "better-auth": "^1.7.3", "better-call": "1.4.0" } }, "sha512-Eoajj68F1ETmp4NBM98tgj1Uiip4cZiFqFsijAWIvOEQTejr/67PWK1/92N8PiNdLf03ezUWU538W93rd9fyIw=="],
 
-    "@better-auth/prisma-adapter": ["@better-auth/prisma-adapter@1.6.25", "", { "peerDependencies": { "@better-auth/core": "^1.6.25", "@better-auth/utils": "0.4.2", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0" }, "optionalPeers": ["@prisma/client", "prisma"] }, "sha512-ym7B6Iqcry+/4aQnYpFwqP/GBIiXvjrm/5B6+0qmx8mkTY/apHFTpHuGzUYYNf4vPTtzF3eYY2+s2GOsomKaRg=="],
+    "@better-auth/prisma-adapter": ["@better-auth/prisma-adapter@1.7.3", "", { "peerDependencies": { "@better-auth/core": "^1.7.3", "@better-auth/utils": "0.4.2", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0" }, "optionalPeers": ["@prisma/client", "prisma"] }, "sha512-TJ/DhlU7oLzrC626/1wfYA1Pl+lVsXa/zXBZ8d7Rlc2YO5fGd5fsAYJdRrYMyA51iZEo+rWLXMhZ0cez1BamsQ=="],
 
-    "@better-auth/sso": ["@better-auth/sso@1.6.25", "", { "dependencies": { "fast-xml-parser": "^5.8.0", "jose": "^6.1.3", "samlify": "^2.13.1", "tldts": "^6.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/core": "^1.6.25", "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "better-auth": "^1.6.25", "better-call": "1.3.7" } }, "sha512-Svbh1DFrMGlPms4YNuahtNqnro8jwPeOjGfnSEPn1x67+QcP140n9liHxXCWmFgwN1qbpU2VhiqNRQ0goWo85A=="],
+    "@better-auth/sso": ["@better-auth/sso@1.7.3", "", { "dependencies": { "@xmldom/xmldom": "^0.9.12", "fast-xml-parser": "^5.8.0", "jose": "^6.2.3", "samlify": "^2.13.1", "tldts": "^7.4.3", "zod": "^4.5.4" }, "peerDependencies": { "@better-auth/core": "^1.7.3", "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "better-auth": "^1.7.3", "better-call": "1.4.0" } }, "sha512-inxETRuOfyy8m0uEJSfi9uhScp4RkQ7ZYI+GRj+Jtz6ml/p5wTzNOjYZsG43TroUTDfrElF6CYQON5/Xk1XdmA=="],
 
-    "@better-auth/telemetry": ["@better-auth/telemetry@1.4.22", "", { "dependencies": { "@better-auth/utils": "0.3.0", "@better-fetch/fetch": "1.1.21" }, "peerDependencies": { "@better-auth/core": "1.4.22" } }, "sha512-ltoRysWQIbVlSgmVvn2EiFDkmLmtLAs9IVBvvwavGNFAklE7UcSlzR4BM5fllx5Vax927sou9MvZgUhgHRI62A=="],
+    "@better-auth/telemetry": ["@better-auth/telemetry@1.7.3", "", { "peerDependencies": { "@better-auth/core": "^1.7.3", "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1" } }, "sha512-aixgHbJhGvS8PRczX/LR3murYyBnIvOGmJw37ZZBMg6ZtLR/UBJAkufbDi1HYn5THSuTJ3D5DtY85Ahh/ABQtw=="],
 
-    "@better-auth/utils": ["@better-auth/utils@0.3.0", "", {}, "sha512-W+Adw6ZA6mgvnSnhOki270rwJ42t4XzSK6YWGF//BbVXL6SwCLWfyzBc1lN2m/4RM28KubdBKQ4X5VMoLRNPQw=="],
+    "@better-auth/utils": ["@better-auth/utils@0.4.2", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A=="],
 
     "@better-fetch/fetch": ["@better-fetch/fetch@1.3.1", "", {}, "sha512-ABkD1WhyfPZprKRQI3bhATjeiFuNWC9PXhfGWqL+sg/gKrM977oFrYkdb4msM3hgUGonr7KlOsOFT5TU2rht9g=="],
 
-    "@biomejs/biome": ["@biomejs/biome@2.5.6", "", { "optionalDependencies": { "@biomejs/cli-darwin-arm64": "2.5.6", "@biomejs/cli-darwin-x64": "2.5.6", "@biomejs/cli-linux-arm64": "2.5.6", "@biomejs/cli-linux-arm64-musl": "2.5.6", "@biomejs/cli-linux-x64": "2.5.6", "@biomejs/cli-linux-x64-musl": "2.5.6", "@biomejs/cli-win32-arm64": "2.5.6", "@biomejs/cli-win32-x64": "2.5.6" }, "bin": { "biome": "bin/biome" } }, "sha512-lxVNjv7UF6KfhMJfL9gaUHbWdJdHbsAj6OSmwSYNdhRuG67NxNQ4Xdvh3TUxsSK9sBzJBQhEJj3AopmmNJ5pSA=="],
+    "@biomejs/biome": ["@biomejs/biome@2.5.13", "", { "optionalDependencies": { "@biomejs/cli-darwin-arm64": "2.5.13", "@biomejs/cli-darwin-x64": "2.5.13", "@biomejs/cli-linux-arm64": "2.5.13", "@biomejs/cli-linux-arm64-musl": "2.5.13", "@biomejs/cli-linux-x64": "2.5.13", "@biomejs/cli-linux-x64-musl": "2.5.13", "@biomejs/cli-win32-arm64": "2.5.13", "@biomejs/cli-win32-x64": "2.5.13" }, "bin": { "biome": "bin/biome" } }, "sha512-+SEC/mFk1a+5mvUANZgbZTaiZXs1nj4iMhL/PHiqDT5TPUEPFIlliEtkKKZB4N862yylHC3UI+/Sj2I0HJEqhA=="],
 
-    "@biomejs/cli-darwin-arm64": ["@biomejs/cli-darwin-arm64@2.5.6", "", { "os": "darwin", "cpu": "arm64" }, "sha512-zMOLZP4oMrjh6m1zcSj1ud2awUPgTuMVbmQhYYWL7J8HwCnbHHBvTm7VBTRuY7epT5bez76IpKYQ11ZAqHFlnw=="],
+    "@biomejs/cli-darwin-arm64": ["@biomejs/cli-darwin-arm64@2.5.13", "", { "os": "darwin", "cpu": "arm64" }, "sha512-nYSuDJ6zgVqZUkAkJkvhXxsF2PYIrUk/g638K4voCXz7foI9f7b6C2/7+oAihsHQlivZNMUrm/y8ywlcHQtZOw=="],
 
-    "@biomejs/cli-darwin-x64": ["@biomejs/cli-darwin-x64@2.5.6", "", { "os": "darwin", "cpu": "x64" }, "sha512-JAC1VqzvO7Th5ZplU0G2uGfkZbxEe9uDDektPAhF0JLusoz1w+T4okp2bkykI0bbaO2vslKiRfj4gU43JaGreA=="],
+    "@biomejs/cli-darwin-x64": ["@biomejs/cli-darwin-x64@2.5.13", "", { "os": "darwin", "cpu": "x64" }, "sha512-KVy1ceEDuJ3AzFxjT9kkxbVy+UANw1pjEMUS6lvKfxjJ+fmkRvc7sQn1Xo6ETgseEI7wUQoV03KSga3XfE8YRQ=="],
 
-    "@biomejs/cli-linux-arm64": ["@biomejs/cli-linux-arm64@2.5.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-6XsYwCFkp5sMxl85ffhgeGpGgs6A7dRYFnkceZ7WVxvycuTnGdD5xa534Z3xfrBQ0JCMK/mujT6ZNPJoghedwg=="],
+    "@biomejs/cli-linux-arm64": ["@biomejs/cli-linux-arm64@2.5.13", "", { "os": "linux", "cpu": "arm64" }, "sha512-VlNMtoxOqs0dUR6drxxHr18SNUvI7xxAuHZlH4s/dstYSf3g6RaqVgo8JRnhcOhKz9afWrvtJTboNG1JuYlIDQ=="],
 
-    "@biomejs/cli-linux-arm64-musl": ["@biomejs/cli-linux-arm64-musl@2.5.6", "", { "os": "linux", "cpu": "arm64" }, "sha512-eUa3jeeYvfMt19LBeh6E5PUZpxnTC4JqNWo+EDjTtQjAr2xLGnWaxACtVU1DQqmHYbvThlJzLX+ZsYgrqh2qVw=="],
+    "@biomejs/cli-linux-arm64-musl": ["@biomejs/cli-linux-arm64-musl@2.5.13", "", { "os": "linux", "cpu": "arm64" }, "sha512-CH32xpep3dNS5EVJpAHlYchkBYznxyVZQrx0b6YYYlPL9u9ZeD2NtqiK/6s64+HFS2a7hGnryLlqqZAOh8ax5g=="],
 
-    "@biomejs/cli-linux-x64": ["@biomejs/cli-linux-x64@2.5.6", "", { "os": "linux", "cpu": "x64" }, "sha512-Pop9VXCFUhFTMfFefZ39S+u2rOPyNp5iHlxbZRwXGACHLy2r0jjiRgJHmaEKJzL3SyxlVeGShXhvvElvWowonA=="],
+    "@biomejs/cli-linux-x64": ["@biomejs/cli-linux-x64@2.5.13", "", { "os": "linux", "cpu": "x64" }, "sha512-Fi6gIxbUaJ3ZCIXeG3ggIBPF76O2DjDN67WrPX/ODRv54GeXPm2gbEPC96Yb0yrJoiH0Eax1JLx1Pi0XbsNFZQ=="],
 
-    "@biomejs/cli-linux-x64-musl": ["@biomejs/cli-linux-x64-musl@2.5.6", "", { "os": "linux", "cpu": "x64" }, "sha512-2Vp13QdKysH3HIWLaYLhUUwbK+jbZonJD1K+Lr0d0RO4wH7mkYd43vJixEDm8cUWrowoRz4UUHF1nm9Ae7ym8A=="],
+    "@biomejs/cli-linux-x64-musl": ["@biomejs/cli-linux-x64-musl@2.5.13", "", { "os": "linux", "cpu": "x64" }, "sha512-F3pmwl+VHoUuVJN/tbNLKeLt0SVK3EIyN1jXlMcNyQGYRQQTVqXF+GgkP0/CjGXFN87e/mv0sBfUnWqWza5PKQ=="],
 
-    "@biomejs/cli-win32-arm64": ["@biomejs/cli-win32-arm64@2.5.6", "", { "os": "win32", "cpu": "arm64" }, "sha512-tDGshcm6BdkZOCGnTDX0Y8/U4IfBSlnUU7T56nNDuPEfed+aHg+u8G36NB43fJVl0Os6+QURXIE1yuD7AaEofA=="],
+    "@biomejs/cli-win32-arm64": ["@biomejs/cli-win32-arm64@2.5.13", "", { "os": "win32", "cpu": "arm64" }, "sha512-+WD13qshXrr0Icv4BfsAdzm8Fs3TL+nZ59zEQxsYNd8lcgZJ0A5+OrlwsL1PipVCmWeRpxgIPD6DAcEd7smkCQ=="],
 
-    "@biomejs/cli-win32-x64": ["@biomejs/cli-win32-x64@2.5.6", "", { "os": "win32", "cpu": "x64" }, "sha512-WN05KwXnTO/2J45RQPvzZMXf7tZUIofHoR35xIPfCo7pQ2RFidxI8sfb5mGsaTxdMmEOzHzOPRCdA5/fCpc7xQ=="],
+    "@biomejs/cli-win32-x64": ["@biomejs/cli-win32-x64@2.5.13", "", { "os": "win32", "cpu": "x64" }, "sha512-VOofU/nW761XWzUeUNE8zzYNyPrxuMuNFMizL0qz7J75yeV8N7WFheUlk1/K6dOkaFpH9wJ+lDKlwjAbw0346w=="],
 
     "@borewit/text-codec": ["@borewit/text-codec@0.2.2", "", {}, "sha512-DDaRehssg1aNrH4+2hnj1B7vnUGEjU6OIlyRdkMd0aUdIUvKXrJfXsy8LVtXAy7DRvYVluWbMspsRhz2lcW0mQ=="],
 
-    "@braintree/sanitize-url": ["@braintree/sanitize-url@7.1.2", "", {}, "sha512-jigsZK+sMF/cuiB7sERuo9V7N9jx+dhmHHnQyDSVdpZwVutaBu7WvNYqMDLSgFgfB30n452TP3vjDAvFC973mA=="],
-
     "@cacheable/utils": ["@cacheable/utils@2.5.0", "", { "dependencies": { "hashery": "^1.5.1", "keyv": "^5.6.0" } }, "sha512-buipgOVDkkPXNR5+xBpDw7Zk2n1EvU7qBJCNUcL7rhQ//kfpOXPAvQ511Os0vpLYJ1pZnvudNytkQt2hst3wqA=="],
 
-    "@carbon/icon-helpers": ["@carbon/icon-helpers@10.79.0", "", { "dependencies": { "@ibm/telemetry-js": "^1.5.0" } }, "sha512-sg5bL9Y/Vns4W7iNRaIMoNc/FtuzJE8G5VvCbC8xcrrNoZmfhhiPFHyU8CFhrf19HJdAxOvXShIBxmm3glLAYw=="],
+    "@carbon/icon-helpers": ["@carbon/icon-helpers@10.82.0", "", { "dependencies": { "@ibm/telemetry-js": "^1.5.0" } }, "sha512-HwyUn3iOzV7ahnf2oBaDL4fui7FBbTDBf+0N+sFfs+x17PFD3WkTz4BRefnWjlfLyKmuQTUwRuoOAVBSN1qY0Q=="],
+
+    "@carbon/icons-react": ["@carbon/icons-react@11.88.0", "", { "dependencies": { "@carbon/icon-helpers": "^10.82.0", "@ibm/telemetry-js": "^1.5.0", "prop-types": "^15.8.1" }, "peerDependencies": { "react": ">=16" } }, "sha512-RvlzTmAxIJ/ujFB1vsb7IWKAhJvaBh9ims5qBQUW/OTV8Rf9If/FHFiSMyMoK7JdQB1yfn+0RQaB7t1wqZ2wag=="],
 
-    "@carbon/icons-react": ["@carbon/icons-react@11.85.0", "", { "dependencies": { "@carbon/icon-helpers": "^10.79.0", "@ibm/telemetry-js": "^1.5.0", "prop-types": "^15.8.1" }, "peerDependencies": { "react": ">=16" } }, "sha512-+fRNYyqR8aCZRSgMA8sJ+GVfCmS0pK8FaDl9rQDuy4ZqYldZ4Yj8K3YIxmcSLlvTxMmNtGAxoa80xlhXROYDQg=="],
+    "@chevrotain/cst-dts-gen": ["@chevrotain/cst-dts-gen@12.0.0", "", { "dependencies": { "@chevrotain/gast": "12.0.0", "@chevrotain/types": "12.0.0" } }, "sha512-fSL4KXjTl7cDgf0B5Rip9Q05BOrYvkJV/RrBTE/bKDN096E4hN/ySpcBK5B24T76dlQ2i32Zc3PAE27jFnFrKg=="],
 
-    "@chevrotain/cst-dts-gen": ["@chevrotain/cst-dts-gen@10.5.0", "", { "dependencies": { "@chevrotain/gast": "10.5.0", "@chevrotain/types": "10.5.0", "lodash": "4.17.21" } }, "sha512-lhmC/FyqQ2o7pGK4Om+hzuDrm9rhFYIJ/AXoQBeongmn870Xeb0L6oGEiuR8nohFNL5sMaQEJWCxr1oIVIVXrw=="],
+    "@chevrotain/gast": ["@chevrotain/gast@12.0.0", "", { "dependencies": { "@chevrotain/types": "12.0.0" } }, "sha512-1ne/m3XsIT8aEdrvT33so0GUC+wkctpUPK6zU9IlOyJLUbR0rg4G7ZiApiJbggpgPir9ERy3FRjT6T7lpgetnQ=="],
 
-    "@chevrotain/gast": ["@chevrotain/gast@10.5.0", "", { "dependencies": { "@chevrotain/types": "10.5.0", "lodash": "4.17.21" } }, "sha512-pXdMJ9XeDAbgOWKuD1Fldz4ieCs6+nLNmyVhe2gZVqoO7v8HXuHYs5OV2EzUtbuai37TlOAQHrTDvxMnvMJz3A=="],
+    "@chevrotain/regexp-to-ast": ["@chevrotain/regexp-to-ast@12.0.0", "", {}, "sha512-p+EW9MaJwgaHguhoqwOtx/FwuGr+DnNn857sXWOi/mClXIkPGl3rn7hGNWvo31HA3vyeQxjqe+H36yZJwYU8cA=="],
 
-    "@chevrotain/types": ["@chevrotain/types@10.5.0", "", {}, "sha512-f1MAia0x/pAVPWH/T73BJVyO2XU5tI4/iE7cnxb7tqdNTNhQI3Uq3XkqcoteTmD4t1aM0LbHCJOhgIDn07kl2A=="],
+    "@chevrotain/types": ["@chevrotain/types@12.0.0", "", {}, "sha512-S+04vjFQKeuYw0/eW3U52LkAHQsB1ASxsPGsLPUyQgrZ2iNNibQrsidruDzjEX2JYfespXMG0eZmXlhA6z7nWA=="],
 
-    "@chevrotain/utils": ["@chevrotain/utils@10.5.0", "", {}, "sha512-hBzuU5+JjB2cqNZyszkDHZgOSrUUT8V3dhgRl8Q9Gp6dAj/H5+KILGjbhDpc3Iy9qmqlm/akuOI2ut9VUtzJxQ=="],
+    "@chevrotain/utils": ["@chevrotain/utils@12.0.0", "", {}, "sha512-lB59uJoaGIfOOL9knQqQRfhl9g7x8/wqFkp13zTdkRu1huG9kg6IJs1O8hqj9rs6h7orGxHJUKb+mX3rPbWGhA=="],
 
-    "@clack/core": ["@clack/core@0.5.0", "", { "dependencies": { "picocolors": "^1.0.0", "sisteransi": "^1.0.5" } }, "sha512-p3y0FIOwaYRUPRcMO7+dlmLh8PSRcrjuTndsiA0WAFbWES0mLZlrjVoBRZ9DzkPFJZG6KGkJmoEAY0ZcVWTkow=="],
+    "@clack/core": ["@clack/core@1.5.1", "", { "dependencies": { "fast-wrap-ansi": "^0.2.0", "sisteransi": "^1.0.5" } }, "sha512-iHTrHA8MtVuLl2TfZySmcKv1qO2PoyC9Z7pfSDozEuV5vtY3/wcOPKJXlqJ5Oq2Cx5DDGQGAMVx6HZfRRoVEbQ=="],
 
-    "@clack/prompts": ["@clack/prompts@0.11.0", "", { "dependencies": { "@clack/core": "0.5.0", "picocolors": "^1.0.0", "sisteransi": "^1.0.5" } }, "sha512-pMN5FcrEw9hUkZA4f+zLlzivQSeQf5dRGJjSUbvVYDLvpKCdQx5OaknvKzgbtXOizhP+SJJJjqEbOe55uKKfAw=="],
+    "@clack/prompts": ["@clack/prompts@1.8.1", "", { "dependencies": { "@clack/core": "1.5.1", "fast-string-width": "^3.0.2", "fast-wrap-ansi": "^0.2.0", "sisteransi": "^1.0.5" } }, "sha512-dlT1m5e/0yUL0kRNcQn7yGLVThkgbB0Ga/1AmfDDC/8ik6AIiSf2QLQO2zPYvefsHP0aFgxO93cVLCCfDp7kzQ=="],
 
     "@crm/auth": ["@crm/auth@workspace:packages/auth"],
 
@@ -400,6 +509,8 @@
 
     "@crm/env": ["@crm/env@workspace:packages/env"],
 
+    "@crm/kaneo-domain": ["@crm/kaneo-domain@workspace:packages/kaneo-domain"],
+
     "@crm/telemetry": ["@crm/telemetry@workspace:packages/telemetry"],
 
     "@crm/typescript-config": ["@crm/typescript-config@workspace:packages/typescript-config"],
@@ -446,67 +557,63 @@
 
     "@hapi/bourne": ["@hapi/bourne@3.0.0", "", {}, "sha512-Waj1cwPXJDucOib4a3bAISsKJVb15MKi9IvmTI/7ssVEm6sywXGjVJDhl6/umt1pK1ZS7PacXU3A1PmFKHEZ2w=="],
 
-    "@hono/node-server": ["@hono/node-server@2.0.12", "", { "peerDependencies": { "hono": "^4" } }, "sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg=="],
+    "@hono/node-server": ["@hono/node-server@2.1.1", "", { "peerDependencies": { "hono": "^4" } }, "sha512-ELuehkj5VCBdgEw9zs+ivkKwyzzUCSQuE96YmiPvn1ECBoZCczbFXJLeEGMTYjphP6gydh4pHMqEYPVMYUVgQg=="],
 
     "@ibm/telemetry-js": ["@ibm/telemetry-js@1.11.0", "", { "bin": { "ibmtelemetry": "dist/collect.js" } }, "sha512-RO/9j+URJnSfseWg9ZkEX9p+a3Ousd33DBU7rOafoZB08RqdzxFVYJ2/iM50dkBuD0o7WX7GYt1sLbNgCoE+pA=="],
 
-    "@iconify/types": ["@iconify/types@2.0.0", "", {}, "sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg=="],
-
-    "@iconify/utils": ["@iconify/utils@3.1.4", "", { "dependencies": { "@antfu/install-pkg": "^1.1.0", "@iconify/types": "^2.0.0", "import-meta-resolve": "^4.2.0" } }, "sha512-b1S7B1k9ohZ+iNTi2ATxbRYG9fTrJmUT0rc46bvVnNxqNRGW7dyo/vRREwyniI5IRN2RSJHDcm+s3BjWrSAjHw=="],
-
     "@img/colour": ["@img/colour@1.1.0", "", {}, "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ=="],
 
-    "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.2.4" }, "os": "darwin", "cpu": "arm64" }, "sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w=="],
+    "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.3.3" }, "os": "darwin", "cpu": "arm64" }, "sha512-Uhfl4V4lhP2nbUVF9+hyH1+luj86f1gUFeo8ALYxFoULoU+G87D43BfeMP8XHsk9boxAnCY/bf2EHwhA7MuGsA=="],
 
-    "@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.2.4" }, "os": "darwin", "cpu": "x64" }, "sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw=="],
+    "@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.3.3" }, "os": "darwin", "cpu": "x64" }, "sha512-hWniXY3bG5qKpkKrAwPe4y+VTPmf086YQAnkxWh7uA1YrlRouWGa0M0Mxj3ZjnXFkv7/TD1bTy9lGUK26vRvWw=="],
 
-    "@img/sharp-freebsd-wasm32": ["@img/sharp-freebsd-wasm32@0.35.3", "", { "dependencies": { "@img/sharp-wasm32": "0.35.3" }, "os": "freebsd" }, "sha512-lUxcqWIj2wMQ9BrwNjngcr1gWUr5xgaGThBRqPPalIC2n67Cqj1uPh8NnA/ZhAg8hUbKl+kVHKwgUIwe6ZYPrg=="],
+    "@img/sharp-freebsd-wasm32": ["@img/sharp-freebsd-wasm32@0.35.4", "", { "dependencies": { "@img/sharp-wasm32": "0.35.4" }, "os": "freebsd" }, "sha512-lIsKw/BU+kjB4eZjxrYrZmwOJYi3Ajrv66iAlBmUPyKc3HpnloevB1g3wxGD9P/5BbQ1brBGl65VRRrCvQDEqA=="],
 
-    "@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.2.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g=="],
+    "@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.3.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-suTBPTDGrI9WodccaDdwZItTSaBYASlBk1NSfElSHrUfzu3szG6lvIF58+WiFvnfzuK8ZBFS5zE00PxqxnRiPg=="],
 
-    "@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.2.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg=="],
+    "@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.3.3", "", { "os": "darwin", "cpu": "x64" }, "sha512-FVJZ5mITMobmXIz/hPDTw0EintTW5H3WfrxwLqEqjiIihlu+hVRyGrFQ60xl0Lxn7Bt3zdpevPaQi0HEzqz9fw=="],
 
-    "@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.2.4", "", { "os": "linux", "cpu": "arm" }, "sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A=="],
+    "@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.3.3", "", { "os": "linux", "cpu": "arm" }, "sha512-3rbU4vqXXc3hY/OiXdl52xZvT0F1yEngWfvqudtPJg/KkyiaQw2DRsFrNzpmLvfavbwOq3qXn36GP8obHRULQA=="],
 
-    "@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.2.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw=="],
+    "@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-0DaL0A6Xu6sQSQFwe4iVCrKWU2cCTItnRsYsCdxAMm9NF6twAA9BKnoqy4hqz4+azQ0JHuA26qiUKsf1XJ/v5A=="],
 
-    "@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.2.4", "", { "os": "linux", "cpu": "ppc64" }, "sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA=="],
+    "@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.3.3", "", { "os": "linux", "cpu": "ppc64" }, "sha512-cdn1OvUBwsXhbC0zSzJnNzf5MZ/mTrobawDvNXBTxe8VtqKAm0sRuEY2Evzovb/w9JMk4TvRxqt1mekSuJz64w=="],
 
-    "@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.2.4", "", { "os": "linux", "cpu": "none" }, "sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA=="],
+    "@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.3.3", "", { "os": "linux", "cpu": "none" }, "sha512-HjPVx7yKz+0lqdhDlTw1tt90wamBoxhiXpvl1XZpJLiHH4RCJ5yDTqH+VlYPv2fwFs89JFw4c1IexYOcQUi4IQ=="],
 
-    "@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.2.4", "", { "os": "linux", "cpu": "s390x" }, "sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ=="],
+    "@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.3.3", "", { "os": "linux", "cpu": "s390x" }, "sha512-neWLh+3yCNThxnfy3c4BbVBeGgt9aftno+XbT56iK28RgeDs3UOFWviLWlUu0bArYVYJaFDK+RRohbicUNCm8Q=="],
 
-    "@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.2.4", "", { "os": "linux", "cpu": "x64" }, "sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw=="],
+    "@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-4vKmvAst9nrowcqquKFAyZJUDolUaIp8uRiN0mWFguJ1IplC9/pitXtlnnlU4aa/eJw3J7i67V+pwUL+wZGdsA=="],
 
-    "@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.2.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw=="],
+    "@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.3.3", "", { "os": "linux", "cpu": "arm64" }, "sha512-Y9kQaLMuNoB0bPYOOdcZMaseNrFpPodIWWMrx+CZyydf2xn68j9WYc6sWWRrDwNkzCQjKYfc68L7jKjGlHMibw=="],
 
-    "@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.2.4", "", { "os": "linux", "cpu": "x64" }, "sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg=="],
+    "@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.3.3", "", { "os": "linux", "cpu": "x64" }, "sha512-fj8Mv0HHfD1Rr+4I68+3agJynxDWtBFgicTbSOb9Bke6pIwzGcJ+RX/yHjmiEGFMCavY/dxvem7MyNaJF+wDiw=="],
 
-    "@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.2.4" }, "os": "linux", "cpu": "arm" }, "sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw=="],
+    "@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.3.3" }, "os": "linux", "cpu": "arm" }, "sha512-7OAS8gI0EReKGVN2HssHlM6umJgxF5VI3xN0p9FA91p/YO+ou5hiNghLdZ5BEHztwaaK5+bLKRf8x/o2L2nk9A=="],
 
-    "@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.2.4" }, "os": "linux", "cpu": "arm64" }, "sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg=="],
+    "@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.3.3" }, "os": "linux", "cpu": "arm64" }, "sha512-De4jpEnAU8Hd5oT0j1G3uL4ZvTuipVMn7YC6vPaJhy6/7EwEae0SVAoBrUMYQbkLGDm85taVWwuPc1a44LTzCQ=="],
 
-    "@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.2.4" }, "os": "linux", "cpu": "ppc64" }, "sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA=="],
+    "@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.3.3" }, "os": "linux", "cpu": "ppc64" }, "sha512-2oYZJeIl4kCcMGk4ouZVjnkCtFrpQFlNEtJ6GbxzhHQchwH0NH/qEb9ykmOl29dqwMq+JhFdZn+1ak2FKhI9fQ=="],
 
-    "@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.2.4" }, "os": "linux", "cpu": "none" }, "sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw=="],
+    "@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.3.3" }, "os": "linux", "cpu": "none" }, "sha512-cPbNChoRURAWdebDIHSenxRpgEdy7JkPydSnUxRm9VvKD7m0/xVaR/8Fzlu81pk5nHEvHH87UZUA7cTtwnbJSA=="],
 
-    "@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.2.4" }, "os": "linux", "cpu": "s390x" }, "sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg=="],
+    "@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.3.3" }, "os": "linux", "cpu": "s390x" }, "sha512-RY0JFY8Fd6RonCBtHz+DvadaPkXDSI1AUn6yWL9TipqkZ1vY8w8evqdgyDFnkm4/K1ve1TvZiaePP5oSd4+WVQ=="],
 
-    "@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.2.4" }, "os": "linux", "cpu": "x64" }, "sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ=="],
+    "@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.3.3" }, "os": "linux", "cpu": "x64" }, "sha512-9qvvEAuk8k89TfWUoX2htWjbAMX8p+NxCppjpcg5k6xMsjhBQPTsoIh36h9Qde4WRuGpJeYnOjdosDn/cnv+OA=="],
 
-    "@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.2.4" }, "os": "linux", "cpu": "arm64" }, "sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg=="],
+    "@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.3.3" }, "os": "linux", "cpu": "arm64" }, "sha512-KB5jxpfWQTr0nc3xdHtWChdbifHrBGsd2SM62Eyxrl8afikm+f5qGBU75SJIZBT/S1MC8XyacdlXBMSWq6OURA=="],
 
-    "@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.2.4" }, "os": "linux", "cpu": "x64" }, "sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q=="],
+    "@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.35.4", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.3.3" }, "os": "linux", "cpu": "x64" }, "sha512-f+eZJZIQNEEd26RPSW+76chwOf1XtA2Y/O+5ocVyLliHkeih3e+jhLVBdNTd2rS3IbNXK8+ug93Vf5ZXtF5Lxg=="],
 
-    "@img/sharp-wasm32": ["@img/sharp-wasm32@0.34.5", "", { "dependencies": { "@emnapi/runtime": "^1.7.0" }, "cpu": "none" }, "sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw=="],
+    "@img/sharp-wasm32": ["@img/sharp-wasm32@0.35.4", "", { "dependencies": { "@emnapi/runtime": "^1.11.3" } }, "sha512-zQnl4Kwp7Q6NHsENtU2T/00Zi+w3AQNwz3+UaTyVBy2FpXrzXzGjndpK61onhZjRtRpQXxCTeqw19bVyXOh7jA=="],
 
-    "@img/sharp-webcontainers-wasm32": ["@img/sharp-webcontainers-wasm32@0.35.3", "", { "dependencies": { "@img/sharp-wasm32": "0.35.3" }, "cpu": "none" }, "sha512-2rnq7bX3NzeR2T4YWgz8qiG4h3TSdMe+vN1iQXpJleSJ3SM5zQ8Fy2SyyXAWlbxpEZ2Y+Z4u1BePgJEYbSy80Q=="],
+    "@img/sharp-webcontainers-wasm32": ["@img/sharp-webcontainers-wasm32@0.35.4", "", { "dependencies": { "@img/sharp-wasm32": "0.35.4" }, "cpu": "none" }, "sha512-ESfNkywmCfPNyaZjxooddJQiQ+l/nTpGEOGthxiLnIHXC/CmcBixnfwUleX9mCz9ovrUUvKMap/pm8RYbzfwaA=="],
 
-    "@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.34.5", "", { "os": "win32", "cpu": "arm64" }, "sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g=="],
+    "@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.35.4", "", { "os": "win32", "cpu": "arm64" }, "sha512-iNdlBX9gLVvqe2I3uIJSIKTq6wckP/DYxZtcqxm09x5Gi24DnFBmPAWZmr60ZyYMG0xlzo6goG3670ar+RXvRw=="],
 
-    "@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.34.5", "", { "os": "win32", "cpu": "ia32" }, "sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg=="],
+    "@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.35.4", "", { "os": "win32", "cpu": "ia32" }, "sha512-kqRsbaa5CS6KHlpxnN7WhE6vAAugXyZButpRdvDWetlv6Qv4N9WTcrWzF7tXfB9T7MsoadqdI8hmwLq6UlLvtw=="],
 
-    "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.34.5", "", { "os": "win32", "cpu": "x64" }, "sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw=="],
+    "@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.35.4", "", { "os": "win32", "cpu": "x64" }, "sha512-XtmnYhBcrORsJ4XJngyzr/EWP0hRZLAZRFaApdKuviyqF78+ylxh2y06ZmtULAMOnObJ3ucpN0AcwSWnMowTRg=="],
 
     "@jitl/quickjs-ffi-types": ["@jitl/quickjs-ffi-types@0.32.0", "", {}, "sha512-v9T+GQpmk43VDJ7d72sf0Nexhk+ArvtUihW27dy7lqAl0zBObFKtSBBIm5RBjwIhE8VwsPPm9PNuvPvNqLWUEg=="],
 
@@ -524,7 +631,7 @@
 
     "@jridgewell/resolve-uri": ["@jridgewell/resolve-uri@3.1.2", "", {}, "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw=="],
 
-    "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.5.5", "", {}, "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og=="],
+    "@jridgewell/sourcemap-codec": ["@jridgewell/sourcemap-codec@1.6.0", "", {}, "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw=="],
 
     "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="],
 
@@ -534,8 +641,6 @@
 
     "@lukeed/csprng": ["@lukeed/csprng@1.1.0", "", {}, "sha512-Z7C/xXCiGWsg0KuKsHTKJxbWhpI3Vs5GwLfOean7MGyVFGqdRgBbAjOCh6u4bbjPc/8MJ2pZmK/0DLdCbivLDA=="],
 
-    "@mermaid-js/parser": ["@mermaid-js/parser@1.2.0", "", { "dependencies": { "@chevrotain/types": "~11.1.2" } }, "sha512-oYPyv8A4As1yH5Bx+04iQEQxXuIQDe0GKCNSRgao6z8AM9jixXIfP0vsppRLvGf+nKIOb9/LdpWA4YuJiVvESA=="],
-
     "@microsoft/tsdoc": ["@microsoft/tsdoc@0.16.0", "", {}, "sha512-xgAyonlVVS+q7Vc7qLW0UrJU7rSFcETRWsqdXZtjzRU8dF+6CkozTK4V4y1LwOX7j8r/vHphjDeMeGI4tNGeGA=="],
 
     "@mixmark-io/domino": ["@mixmark-io/domino@2.2.0", "", {}, "sha512-Y28PR25bHXUg88kCV7nivXrP2Nj2RueZ3/l/jdx6J9f8J4nsEGcgX0Qe6lt7Pa+J79+kPiJU3LguR6O/6zrLOw=="],
@@ -544,47 +649,47 @@
 
     "@mongodb-js/zstd": ["@mongodb-js/zstd@7.0.0", "", { "dependencies": { "node-addon-api": "^8.5.0", "prebuild-install": "^7.1.3" } }, "sha512-mQ2s0pYYiav+tzCDR05Zptem8Ey2v8s11lri5RKGhTtL4COVCvVCk5vtyRYNT+9L8qSfyOqqefF9UtnW8mC5jA=="],
 
-    "@mrleebo/prisma-ast": ["@mrleebo/prisma-ast@0.13.1", "", { "dependencies": { "chevrotain": "^10.5.0", "lilconfig": "^2.1.0" } }, "sha512-XyroGQXcHrZdvmrGJvsA9KNeOOgGMg1Vg9OlheUsBOSKznLMDl+YChxbkboRHvtFYJEMRYmlV3uoo/njCw05iw=="],
+    "@mrleebo/prisma-ast": ["@mrleebo/prisma-ast@0.16.0", "", { "dependencies": { "chevrotain": "^12.0.0", "lilconfig": "^2.1.0" } }, "sha512-a9ELYNIflEQP38tSu6gnUgSAWgXjuhMvC52868K5sWgyRmYsjiJMWTUmm8iy7hZT5EN2ZKVydMTFP2q3/+6ccg=="],
 
-    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.2.2", "", { "dependencies": { "@tybys/wasm-util": "^0.10.3" }, "peerDependencies": { "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.3", "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.3" } }, "sha512-JfB4kuJQjaoHuCTseIINHtHWeJnvgEcxjwA5t/Y00ZgaOO1Crz3fjT/p8kT28zA/Caz7oiUMn3d6H2yOVCVwuw=="],
+    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.2.4", "", { "dependencies": { "@tybys/wasm-util": "^0.10.3" }, "peerDependencies": { "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.4", "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.4" } }, "sha512-AJxoUD2/15ESHbvpcyjU274nsAPLuOtPHCk0vKJM5pj//Fg/B1FXNWjPnXTT9PymCYYiHo4zPj0ZomXBKhoy7g=="],
 
-    "@nestjs/cache-manager": ["@nestjs/cache-manager@3.1.3", "", { "peerDependencies": { "@nestjs/common": "^9.0.0 || ^10.0.0 || ^11.0.0", "@nestjs/core": "^9.0.0 || ^10.0.0 || ^11.0.0", "cache-manager": ">=6", "keyv": ">=5", "rxjs": "^7.8.1" } }, "sha512-HMtiOfHz75NZX7mJn1VnZGLSachVI04TnUc5wvEogIaKwk5BDQHgtP5htxreizjv7oxKalJbuTyxtiF6bE+bgQ=="],
+    "@nestjs/cache-manager": ["@nestjs/cache-manager@12.0.0", "", { "peerDependencies": { "@nestjs/common": "^9.0.0 || ^10.0.0 || ^11.0.0 || ^12.0.0", "@nestjs/core": "^9.0.0 || ^10.0.0 || ^11.0.0 || ^12.0.0", "cache-manager": ">=6", "keyv": ">=5", "rxjs": "^7.8.1" } }, "sha512-kYn5rgDZXZ6aIS7MxSfx0AwjRtJpq++Uac4ceWNckkYIkvnflv8hWgorhPXoVmLpTGiwrQ6G2gJh6MzsmoTqHg=="],
 
-    "@nestjs/common": ["@nestjs/common@11.1.28", "", { "dependencies": { "file-type": "21.3.4", "iterare": "1.2.1", "load-esm": "1.0.3", "tslib": "2.8.1", "uid": "2.0.2" }, "peerDependencies": { "class-transformer": ">=0.4.1", "class-validator": ">=0.13.2", "reflect-metadata": "^0.1.12 || ^0.2.0", "rxjs": "^7.1.0" }, "optionalPeers": ["class-transformer", "class-validator"] }, "sha512-bRImsxibie+AM7xjdwcrm/gr5YeacI65kSBNzTufa1Ib5iwziaY/lqMtRh9THq6pbV4e1HP9aI2ZxGUumnmaoQ=="],
+    "@nestjs/common": ["@nestjs/common@11.2.3", "", { "dependencies": { "file-type": "21.3.4", "iterare": "1.2.1", "load-esm": "1.0.3", "tslib": "2.8.1", "uid": "2.0.2" }, "peerDependencies": { "class-transformer": ">=0.4.1", "class-validator": ">=0.13.2", "reflect-metadata": "^0.1.12 || ^0.2.0", "rxjs": "^7.1.0" }, "optionalPeers": ["class-transformer", "class-validator"] }, "sha512-obdauJXHfthhepbV+LpGe88OeBlR/Kw9lwjLo0Utzc//agoLXYb9DUGhPQWtm81IpBWMv+19eiwcve9MsBZwXA=="],
 
-    "@nestjs/config": ["@nestjs/config@4.0.4", "", { "dependencies": { "dotenv": "17.4.1", "dotenv-expand": "12.0.3", "lodash": "4.18.1" }, "peerDependencies": { "@nestjs/common": "^10.0.0 || ^11.0.0", "rxjs": "^7.1.0" } }, "sha512-CJPjNitr0bAufSEnRe2N+JbnVmMmDoo6hvKCPzXgZoGwJSmp/dZPk9f/RMbuD/+Q1ZJPjwsRpq0vxna++Knwow=="],
+    "@nestjs/config": ["@nestjs/config@12.0.0", "", { "dependencies": { "@standard-schema/spec": "1.1.0", "dotenv": "17.4.2", "dotenv-expand": "13.0.0", "es-toolkit": "1.51.0" }, "peerDependencies": { "@nestjs/common": "^11.0.0 || ^12.0.0", "rxjs": "^7.1.0" } }, "sha512-pG5+fFfCo3cdgVkLJLvvhUGfxEjwzv9hIAQ1aJVHvHlHVniDWfwX5pR/utgoAkJzSikv2oTR1BmIF03FXdi42Q=="],
 
-    "@nestjs/core": ["@nestjs/core@11.1.28", "", { "dependencies": { "fast-safe-stringify": "2.1.1", "iterare": "1.2.1", "path-to-regexp": "8.4.2", "tslib": "2.8.1", "uid": "2.0.2" }, "peerDependencies": { "@nestjs/common": "^11.0.0", "@nestjs/microservices": "^11.0.0", "@nestjs/platform-express": "^11.0.0", "@nestjs/websockets": "^11.0.0", "reflect-metadata": "^0.1.12 || ^0.2.0", "rxjs": "^7.1.0" }, "optionalPeers": ["@nestjs/microservices", "@nestjs/platform-express", "@nestjs/websockets"] }, "sha512-06m63xIRj8+l8uOeh/8LnYupGubkyu4f+bPKIadaSui6vK9KpXgoz7HveT1yOVLcEt0M0oCOEW5EuEXZkEmBBQ=="],
+    "@nestjs/core": ["@nestjs/core@11.2.3", "", { "dependencies": { "fast-safe-stringify": "2.1.1", "iterare": "1.2.1", "path-to-regexp": "8.4.2", "tslib": "2.8.1", "uid": "2.0.2" }, "peerDependencies": { "@nestjs/common": "^11.0.0", "@nestjs/microservices": "^11.0.0", "@nestjs/platform-express": "^11.0.0", "@nestjs/websockets": "^11.0.0", "reflect-metadata": "^0.1.12 || ^0.2.0", "rxjs": "^7.1.0" }, "optionalPeers": ["@nestjs/microservices", "@nestjs/platform-express", "@nestjs/websockets"] }, "sha512-vkA9/Ja0Z3hvqXErSa+HaxrfF+cNXthNFi8VPNEKVli4rMd009yExAl0gLmko/Kf8peDXr72u1RN+j9Da2ukHg=="],
 
     "@nestjs/mapped-types": ["@nestjs/mapped-types@2.1.1", "", { "peerDependencies": { "@nestjs/common": "^10.0.0 || ^11.0.0", "class-transformer": "^0.4.0 || ^0.5.0", "class-validator": "^0.13.0 || ^0.14.0 || ^0.15.0", "reflect-metadata": "^0.1.12 || ^0.2.0" }, "optionalPeers": ["class-transformer", "class-validator"] }, "sha512-SCCoMEJ6jdeI5h/N+KCVF1+pmg/hmEkNA5nHTS8Gvww7T/LCl4o1gFLinw2iQ60w7slFkszHcGLKGdazVI4F8A=="],
 
-    "@nestjs/platform-express": ["@nestjs/platform-express@11.1.28", "", { "dependencies": { "cors": "2.8.6", "express": "5.2.1", "multer": "2.2.0", "path-to-regexp": "8.4.2", "tslib": "2.8.1" }, "peerDependencies": { "@nestjs/common": "^11.0.0", "@nestjs/core": "^11.0.0" } }, "sha512-hU+9Sz4m+onHrR5AmelI59QKmY/Re546bPnygnpqqeQdHDiJpBgjWbL4t6Jr73CBpS60cpyng7WzjgphNB9iwA=="],
+    "@nestjs/platform-express": ["@nestjs/platform-express@11.2.3", "", { "dependencies": { "cors": "2.8.6", "express": "5.2.1", "multer": "2.2.0", "path-to-regexp": "8.4.2", "tslib": "2.8.1" }, "peerDependencies": { "@nestjs/common": "^11.0.0", "@nestjs/core": "^11.0.0" } }, "sha512-YFQvRXT2de1qNL9LJPUBQ31+RsfI4cJ+sbpU9ENM/hDCgoHSEhm7oxUuGGKmhTZBNZEYm8mDYdfoTFmAH1LIJg=="],
 
     "@nestjs/swagger": ["@nestjs/swagger@11.4.7", "", { "dependencies": { "@microsoft/tsdoc": "0.16.0", "@nestjs/mapped-types": "2.1.1", "js-yaml": "5.3.0", "lodash": "4.18.1", "path-to-regexp": "8.4.2", "swagger-ui-dist": "5.32.13" }, "peerDependencies": { "@fastify/static": "^8.0.0 || ^9.0.0 || ^10.0.0", "@nestjs/common": "^11.0.1", "@nestjs/core": "^11.0.1", "class-transformer": "*", "class-validator": "*", "reflect-metadata": "^0.1.12 || ^0.2.0" }, "optionalPeers": ["@fastify/static", "class-transformer", "class-validator"] }, "sha512-QyDYnmfP4IRucgmtQxMqzgRBdWtjFoDp8eFvvgf92+3wdLCL+Q0xOFO1948j/ntW/Wi7qT2dyck6ka8ADzPWQQ=="],
 
-    "@nestjs/testing": ["@nestjs/testing@11.1.28", "", { "dependencies": { "tslib": "2.8.1" }, "peerDependencies": { "@nestjs/common": "^11.0.0", "@nestjs/core": "^11.0.0", "@nestjs/microservices": "^11.0.0", "@nestjs/platform-express": "^11.0.0" }, "optionalPeers": ["@nestjs/microservices", "@nestjs/platform-express"] }, "sha512-B+VgRxeLaH7jkOMgAyUP3N3rpFlisQ7JRxixRbgHvG6a0VgKbbkNSofKExexCgKmQQak80undb3+2kE1lUBmRQ=="],
+    "@nestjs/testing": ["@nestjs/testing@11.2.3", "", { "dependencies": { "tslib": "2.8.1" }, "peerDependencies": { "@nestjs/common": "^11.0.0", "@nestjs/core": "^11.0.0", "@nestjs/microservices": "^11.0.0", "@nestjs/platform-express": "^11.0.0" }, "optionalPeers": ["@nestjs/microservices", "@nestjs/platform-express"] }, "sha512-7ANDWlkm8Xw4CYIhCNZhtBzANsQUKqjteA2yx/6sjqGyWhekeBKz8wgCJykm0vo+ltrg6U34dZlm2NgiRcNHPQ=="],
 
-    "@next/env": ["@next/env@16.2.12", "", {}, "sha512-d0Z5Bc13Fa4nR8pFAKx2jay2yhJM16vlfHbTzYnUQAxlNb6B6lmn4hjt69lYNt4kRtyYP6gEM49lPRHNbIyneg=="],
+    "@next/env": ["@next/env@16.3.4", "", {}, "sha512-cjWZnUUa6jZq2kFaNe/ZyJdZonOZ/QoN0Zka2nz/FLOrfx14pQuM9c5RaSVkWMqgdt4ksgPAMWPyHSs/CyV48Q=="],
 
-    "@next/swc-darwin-arm64": ["@next/swc-darwin-arm64@16.2.12", "", { "os": "darwin", "cpu": "arm64" }, "sha512-0W1R0teHWJrqKX0FH20IzzIWAOuGtBxPGuObrxy1lE8hQvCFj49KE8a3WUg0D7sq6rn6zkM4c7YGUnhudBS6oA=="],
+    "@next/swc-darwin-arm64": ["@next/swc-darwin-arm64@16.3.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-iBr3I5LZNk5/bgl5//iTgD2tcym14MX0Xo7fD//u9dYAEgGzza1y9oywluPtf74YnOswVdH1908aK9xVz7zQTw=="],
 
-    "@next/swc-darwin-x64": ["@next/swc-darwin-x64@16.2.12", "", { "os": "darwin", "cpu": "x64" }, "sha512-Hy5Ls099+aFUmOLmIgPfLqNi6iCwhL3uQCssz5rWk+5Nkc6TUKCE83DY5BbNylfm3+mfwcSFnLRfrZDJhVxdtw=="],
+    "@next/swc-darwin-x64": ["@next/swc-darwin-x64@16.3.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-2dpiSyl2Jw/NrBPaU2MAKGSa+2MR82pJIn4Sm5Rjr+gxAeuh0z158Su3Z2O8zn7UNNq+ej4bToed6RcRN/Lydg=="],
 
-    "@next/swc-linux-arm64-gnu": ["@next/swc-linux-arm64-gnu@16.2.12", "", { "os": "linux", "cpu": "arm64" }, "sha512-+YqU2h1cQkHsGfvjAsrSmst8UIFBibBGm5x3Xgel8NLMiDQtNOM4sM2GOEMvG5YiOBNeN/Ykk8cQC2S0Xrqljg=="],
+    "@next/swc-linux-arm64-gnu": ["@next/swc-linux-arm64-gnu@16.3.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-+t+U8HZT+fApePCS5h89CSH3datz29MkzyfCn+6fpsZBG/oiEOhINcb9rtkv6sdpToLGFn2e6146NzaKCXkqrA=="],
 
-    "@next/swc-linux-arm64-musl": ["@next/swc-linux-arm64-musl@16.2.12", "", { "os": "linux", "cpu": "arm64" }, "sha512-0qjhiYBaKAqF63LA1ZWAAnKTzFUguAaZiRa5etMLGGPj/B6uEVjtIZldIzFEp3wHlB0koK6aTzqPtSdplTCjoA=="],
+    "@next/swc-linux-arm64-musl": ["@next/swc-linux-arm64-musl@16.3.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-mx03GNs1ocQA5JQ4FxDMmIsNkdrZh8cuezKCrId28e5/gIPU/l7Kcy2+vmCCzdjnnmXJy+iOAu+7K0QppO6Urg=="],
 
-    "@next/swc-linux-x64-gnu": ["@next/swc-linux-x64-gnu@16.2.12", "", { "os": "linux", "cpu": "x64" }, "sha512-7A3q26W+h7gnA15uqBToNuDqBEFZZcqh0mW2mn4AJh/G5pdg2RVE3n4slzLEliASZFG3NmsbEzng/x2Sh09mBg=="],
+    "@next/swc-linux-x64-gnu": ["@next/swc-linux-x64-gnu@16.3.4", "", { "os": "linux", "cpu": "x64" }, "sha512-YIhGY6fSMfha52bnVxnzc9zaVBzJg+cqQTOD8tXIBSx4fuv0pVMxQTE0PaS59YhnMOiYiG09IMwxJAf/CFm/Dw=="],
 
-    "@next/swc-linux-x64-musl": ["@next/swc-linux-x64-musl@16.2.12", "", { "os": "linux", "cpu": "x64" }, "sha512-qSjL/uppm+cbh21s72Ss8gkiOhQ4dExWHNGOWy6eZV7STj5WsKehgxT61beSsOj+YYQuTplL376lOCdMQU5T8w=="],
+    "@next/swc-linux-x64-musl": ["@next/swc-linux-x64-musl@16.3.4", "", { "os": "linux", "cpu": "x64" }, "sha512-+eaaX6axpDb0yF1GCpiERe6njplvdC+nks/fKfcHu3XPGRrald8P3/X7yv7QLdjA51knnxwl9pxdIJsg+w1L+Q=="],
 
-    "@next/swc-win32-arm64-msvc": ["@next/swc-win32-arm64-msvc@16.2.12", "", { "os": "win32", "cpu": "arm64" }, "sha512-X6hzsOUJac/e7AWSbn9gQ9nzHld1xWP5iyjHpYWvud8pufB679O1xg4JDyKr8Xd69Jvd+kM2Der6uftiZCmjYA=="],
+    "@next/swc-win32-arm64-msvc": ["@next/swc-win32-arm64-msvc@16.3.4", "", { "os": "win32", "cpu": "arm64" }, "sha512-0jcXW7Xs/uzICrmgV3MhDYDeRy++1CqnpDIerlPIqYO4bhzB4WNbX/aRnQclustsAyTkFKB0z6rbcjmNg5tR8A=="],
 
-    "@next/swc-win32-x64-msvc": ["@next/swc-win32-x64-msvc@16.2.12", "", { "os": "win32", "cpu": "x64" }, "sha512-F6fakeHuFTLOPt0bslQJdf+xtT+WIP9DVn/m4y1w1mRnVPyh3D/cNvzlRkxM444xfm+IvvYNSOrKiA2CDJ0Uxw=="],
+    "@next/swc-win32-x64-msvc": ["@next/swc-win32-x64-msvc@16.3.4", "", { "os": "win32", "cpu": "x64" }, "sha512-vvBzwu1pYQCp92maZCFCIw/XgOTMR5tur9GjakwIo2cmwRTMKajRZZDS9+e4KsUZWKu1E007WUeAFXRRjZeuzw=="],
 
-    "@noble/ciphers": ["@noble/ciphers@2.2.0", "", {}, "sha512-Z6pjIZ/8IJcCGzb2S/0Px5J81yij85xASuk1teLNeg75bfT07MV3a/O2Mtn1I2se43k3lkVEcFaR10N4cgQcZA=="],
+    "@noble/ciphers": ["@noble/ciphers@2.4.0", "", {}, "sha512-AnjFn0Jv92laAkvMrghlFZq4qQCIN/4DxFV/eooqtC2YTjB7kBeLMS2T9KJX4Dn+ZVXLOwK0lSgqDtx9gvxtiw=="],
 
-    "@noble/hashes": ["@noble/hashes@2.2.0", "", {}, "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg=="],
+    "@noble/hashes": ["@noble/hashes@2.4.0", "", {}, "sha512-X5XaVWZIBCT7HHZGm5I7ZQXDwLG+bGXuSrMQAW+7Zvl87h1kmc1ZB1VSRJcpUfoUrGQp4Fkoxm5kZ+Ms+aW+eA=="],
 
     "@nodable/entities": ["@nodable/entities@3.0.0", "", {}, "sha512-8L9xFeTYKhm49xfIypoe2W5wV1m/3Z58kT+7kR9A8OyFxcPduI4VmxaUMQyKYrRjUoLLSXv6EKKID5Tvj9cUVw=="],
 
@@ -596,45 +701,45 @@
 
     "@opentelemetry/semantic-conventions": ["@opentelemetry/semantic-conventions@1.43.0", "", {}, "sha512-eSYWTm620tTk45EKSedaUL8MFYI8hW164hIXsgIHyxu3VobUB3fFCu5t0hQby6OoWRPsG1KkKUG2M5UadiLiVg=="],
 
-    "@oxc-parser/binding-android-arm-eabi": ["@oxc-parser/binding-android-arm-eabi@0.143.0", "", { "os": "android", "cpu": "arm" }, "sha512-n9uozULWflPqBtdmI8lAabLqGKNgLVNN0ZH8HfgCwpKGNtzRzauB76jTiW/3YLkcA7N1zskpi9GdVnZuu1SAvg=="],
+    "@oxc-parser/binding-android-arm-eabi": ["@oxc-parser/binding-android-arm-eabi@0.148.0", "", { "os": "android", "cpu": "arm" }, "sha512-pHASv9g5pASxb7akHERZNSkrEqPhFaUix98o7d9hbTpolnnFWl7UiRrcMhCsV1+iVO4/cJwKsbKRJTFNs2tdBQ=="],
 
-    "@oxc-parser/binding-android-arm64": ["@oxc-parser/binding-android-arm64@0.143.0", "", { "os": "android", "cpu": "arm64" }, "sha512-9BbdjHETk6O3zH/DDid9IgBtF0GlpLabNKN231uraXpRDSfY+iiZxTP5bk1Z63GBownVdhdINFIeddmMz4MzpQ=="],
+    "@oxc-parser/binding-android-arm64": ["@oxc-parser/binding-android-arm64@0.148.0", "", { "os": "android", "cpu": "arm64" }, "sha512-sg/6Ez0KdAygsu0POELux9wN1Po2CP93WY8eNl4DBKIGprsd4QSHBXOb471Pu9i2OCD5sLkISSb2agZEhVn2Zw=="],
 
-    "@oxc-parser/binding-darwin-arm64": ["@oxc-parser/binding-darwin-arm64@0.143.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-gh+6ecoHUy4/sUcolBl/1qPXKBbYNxFY0Pk0ujgQvINTMSftJY7o4yb8gOkDJPeZeB8+a+u7xTe6umoP8N5HFA=="],
+    "@oxc-parser/binding-darwin-arm64": ["@oxc-parser/binding-darwin-arm64@0.148.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-yiSJmzGUvCUaJT8X3j40gVcX+ckuHQMuiOtF8DvzTs5+JtB/7XuHFPp4M+vv5u+HlBtDUd4Ks5pyHpWz8mfnkg=="],
 
-    "@oxc-parser/binding-darwin-x64": ["@oxc-parser/binding-darwin-x64@0.143.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-qd1hl2d+lXgHv/VQ/M9qm8TrMC5T4RqDBwtOnl+1D0QMjwcz+8AaB4JSg8STgeag0GP6a6L74XEGAsrTSJWNzQ=="],
+    "@oxc-parser/binding-darwin-x64": ["@oxc-parser/binding-darwin-x64@0.148.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-6ZeklaamrMy4H2JmhvcJg6iip59tYILtuLaILxyAHT3l5FDxnI5ihVievAft5ZmAbqtlWHErOi1OpJK8gy1wcA=="],
 
-    "@oxc-parser/binding-freebsd-x64": ["@oxc-parser/binding-freebsd-x64@0.143.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-M5XXcNa7aOqLPKTR41msfghKu2yQ4xWvCm11/gwU0JzOzHNk5sgW//rVEjJ+LO48+VDAMzXTSzurUVxIDKwozw=="],
+    "@oxc-parser/binding-freebsd-x64": ["@oxc-parser/binding-freebsd-x64@0.148.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-vFsPx+a/qFECPnz/H8nC6x6MDvnWscLTCo/5muojEF54ERUq1kdgbvnWo95YnkhjF9sTIcG/uDxQBh1gffaufQ=="],
 
-    "@oxc-parser/binding-linux-arm-gnueabihf": ["@oxc-parser/binding-linux-arm-gnueabihf@0.143.0", "", { "os": "linux", "cpu": "arm" }, "sha512-T/GXusuOkPNQhCQCSBbcU/N8j0rAypuDBl1IyFK+lyYT594XsVz80clPC/OtbSSpBGyJxj8uYEfctxVuxVYoww=="],
+    "@oxc-parser/binding-linux-arm-gnueabihf": ["@oxc-parser/binding-linux-arm-gnueabihf@0.148.0", "", { "os": "linux", "cpu": "arm" }, "sha512-eOr3M+6iGbbxNL4PSS0VtsyQ2eOUxSBh00BqO22SbolDimPSYsBuLr/LCrZBkiqW2BoabhR6V4R8jrRAay7hjg=="],
 
-    "@oxc-parser/binding-linux-arm-musleabihf": ["@oxc-parser/binding-linux-arm-musleabihf@0.143.0", "", { "os": "linux", "cpu": "arm" }, "sha512-oKu4RcBlXSqo3OC62dp6YTnQaZIurNDpCX3BnAM3+bJxt7s8J2TJKMnC0UYer1qhlRaDCg6wkTaTw+2IlsZ12w=="],
+    "@oxc-parser/binding-linux-arm-musleabihf": ["@oxc-parser/binding-linux-arm-musleabihf@0.148.0", "", { "os": "linux", "cpu": "arm" }, "sha512-58ZKDw0mQRbCNfrd2IDyV4o8T7enzGERJn41BH2tjrZVGyiKiFzcfDicuB7Zcpb/1xIOrObovr8Dja6lZi8dLw=="],
 
-    "@oxc-parser/binding-linux-arm64-gnu": ["@oxc-parser/binding-linux-arm64-gnu@0.143.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-WJBbD186AZmMGaSIhlktC+rPl8L3peCTXAh88Ih9uEvK0en2mPojGyCGYiL6mHtV1RPV3JyfJW5t6n5hh0lXhA=="],
+    "@oxc-parser/binding-linux-arm64-gnu": ["@oxc-parser/binding-linux-arm64-gnu@0.148.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-Fnu95O4eZ5i++GPvIzBEZ8y4ddTLR+D9paYa8JRaRk6ZK7nHQiWP5xtrhcPQsXqgat1d7sU/d5rbbI0p1FTHSQ=="],
 
-    "@oxc-parser/binding-linux-arm64-musl": ["@oxc-parser/binding-linux-arm64-musl@0.143.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-t1AcYOwEzgceadT4v5e+vaCCb0AncCA3v5AyzfBAz/tMq11qzVccXKzNHtkWdjBsgvTKwRkaUF3QvT4kot8vcQ=="],
+    "@oxc-parser/binding-linux-arm64-musl": ["@oxc-parser/binding-linux-arm64-musl@0.148.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-3CQy/BMdx7N7H3qrcPxUL+a2CwUZodUcf6oq8iJuNZ9C6Ol1aq3mcWzsgySJ7CHFLvpX21ZDPp1r1X0QLbu/AQ=="],
 
-    "@oxc-parser/binding-linux-ppc64-gnu": ["@oxc-parser/binding-linux-ppc64-gnu@0.143.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-RsnO/NoD8376LMJq8JS8TwI0ieNaFRTuNe2GVJntQg6gwZNMENZsEbknHdVwjpOmxdGLGodcwaGSbAeRr5Bgjw=="],
+    "@oxc-parser/binding-linux-ppc64-gnu": ["@oxc-parser/binding-linux-ppc64-gnu@0.148.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-9LkaYvfiF8hMOw900csAvkf1oxE8XlmMeGowu5BcastSSwV8mKvKRMNU7HsV+ycyj1dQD8pX5qgOw8ja6SJacg=="],
 
-    "@oxc-parser/binding-linux-riscv64-gnu": ["@oxc-parser/binding-linux-riscv64-gnu@0.143.0", "", { "os": "linux", "cpu": "none" }, "sha512-48fSVfR9TZi5CASZFyv0VC6z6BCoeihFsX031mAD/oSH7d9PYsPgIqza7d9mjP7Z2KTEpTFyH6SIu0Ui6R1vdg=="],
+    "@oxc-parser/binding-linux-riscv64-gnu": ["@oxc-parser/binding-linux-riscv64-gnu@0.148.0", "", { "os": "linux", "cpu": "none" }, "sha512-2GBiM9h26dR4WJfhoMvnFMnFLf7m/kYs4UMqjvrOfQG4BV1nuTJDH22Zc2MQr3INZF7nSKYQ6xlhD3hQ7A6gug=="],
 
-    "@oxc-parser/binding-linux-riscv64-musl": ["@oxc-parser/binding-linux-riscv64-musl@0.143.0", "", { "os": "linux", "cpu": "none" }, "sha512-T8CpdD+SfE01DnIOD4HpVxu0ZJOfMJ/VhCvikKfaXAxkZ+9veyLM/D2hpi7Y2hFUyPmVQO3FNZHmYzV/WlVR4g=="],
+    "@oxc-parser/binding-linux-riscv64-musl": ["@oxc-parser/binding-linux-riscv64-musl@0.148.0", "", { "os": "linux", "cpu": "none" }, "sha512-uPqZexvKJmEgq4mAu36qe2xTfXZE7oyik1R7KtZ5tl8qKlq1U1fIqTFRUEBZqRGvforoTrGIpatRzcoPKO66RA=="],
 
-    "@oxc-parser/binding-linux-s390x-gnu": ["@oxc-parser/binding-linux-s390x-gnu@0.143.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-QLdeMsCcacenPEFsfxnBUDF1y6opyz5+fmOz9bfD5Y7fiGCMupUCuB3KTPQhNwshIG1P9fPqar9MHxuBDd4bwQ=="],
+    "@oxc-parser/binding-linux-s390x-gnu": ["@oxc-parser/binding-linux-s390x-gnu@0.148.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-9oUHvnTbp7ZraFsTC8PN6XhdhPSSxZumYvixWl7Smi353gEULvK6yV0sXNVrdFMHQeaDKFCi8TgDhNK7/A+Y+Q=="],
 
-    "@oxc-parser/binding-linux-x64-gnu": ["@oxc-parser/binding-linux-x64-gnu@0.143.0", "", { "os": "linux", "cpu": "x64" }, "sha512-659ujfqLy6k7cuH3sbzhd8b+ztSq+i6E2E9pG78Q0BmHjAExfGIdgc8cGgMdwAozDXeZFHkJ+LXYJdWsaGdgyw=="],
+    "@oxc-parser/binding-linux-x64-gnu": ["@oxc-parser/binding-linux-x64-gnu@0.148.0", "", { "os": "linux", "cpu": "x64" }, "sha512-2qhDSJwKzbSZzF7lDqqk8sr/yXsmwr3PeUa4/nazIF+zFAYz1gVPEfC34GQtGxzJUUmklaYAL63368LEfrMeyw=="],
 
-    "@oxc-parser/binding-linux-x64-musl": ["@oxc-parser/binding-linux-x64-musl@0.143.0", "", { "os": "linux", "cpu": "x64" }, "sha512-/Mw/9j4TfZcnKphPrzOE6t4MMknXadcAAuVUlDRTF/ETWB5xOgQvOJV2Mh9We/bWxZdoxaGAdc+hy4GuYwQ2yQ=="],
+    "@oxc-parser/binding-linux-x64-musl": ["@oxc-parser/binding-linux-x64-musl@0.148.0", "", { "os": "linux", "cpu": "x64" }, "sha512-qQoPDZUFV0bh9xA09XydmkjMBpgc1ukJuhMvzQ9QeVmFaHTS9W5TE5CoLmSl3QQyUP9OuHO3x/WPZTIIZPWR3Q=="],
 
-    "@oxc-parser/binding-openharmony-arm64": ["@oxc-parser/binding-openharmony-arm64@0.143.0", "", { "os": "none", "cpu": "arm64" }, "sha512-8rIKWR2BFuifbIK/1XB9wTaSdtuJ25dlE7ZQYDnEwj/2xH2vHsxnvIjHT3ZjSVuLLwGGlSslIG/fbOJ8TV8rTw=="],
+    "@oxc-parser/binding-openharmony-arm64": ["@oxc-parser/binding-openharmony-arm64@0.148.0", "", { "os": "none", "cpu": "arm64" }, "sha512-1UGbaQWEXUCLqAmaR5kwRDjx/R4S5LQKZkM9CHmaHkuKhriOF32aRLfS0jCRNE2yGQJLMEA1z9UucbBVqjXnDw=="],
 
-    "@oxc-parser/binding-win32-arm64-msvc": ["@oxc-parser/binding-win32-arm64-msvc@0.143.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-5U9kQYMfRRI6Zq7KDxgbIP0RMnKrfn3gLepRMgJuRkPSUALTiRCk9d/uyhb4lGDjUdzwK7mBkKqhLgzBPCmLpQ=="],
+    "@oxc-parser/binding-win32-arm64-msvc": ["@oxc-parser/binding-win32-arm64-msvc@0.148.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-pWKdzRDNG2+NK4h/V6U/CYERcfYD6u28h5IB/VJVsrZaD3muvE58tUj22lieL5vLZ+XFi1GPv9YXckZbJZ9BLA=="],
 
-    "@oxc-parser/binding-win32-ia32-msvc": ["@oxc-parser/binding-win32-ia32-msvc@0.143.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-25P7AaHk4R88Yv2XH4gToDVmh0cOu+bEURQU10CRrmvgabfRArSGAP5osmwUKeSUHj0VS50upbpbRWWW/m7mHA=="],
+    "@oxc-parser/binding-win32-ia32-msvc": ["@oxc-parser/binding-win32-ia32-msvc@0.148.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-i3p4x+mvwtjcE1J5HM6V7ggsbXiznExN/4MkNyOy3dfXrVV3bnkSfmZxvo6/84qCVX4ShkpNE1SKt9biIF31GQ=="],
 
-    "@oxc-parser/binding-win32-x64-msvc": ["@oxc-parser/binding-win32-x64-msvc@0.143.0", "", { "os": "win32", "cpu": "x64" }, "sha512-ORMh3JE1s6V7ySicdRK7vgaDQnn5o+UHg9ct989PlWHbel8O9ARrmWXM6kZjrBMtNucxNayQ8g69G0VfWzhANw=="],
+    "@oxc-parser/binding-win32-x64-msvc": ["@oxc-parser/binding-win32-x64-msvc@0.148.0", "", { "os": "win32", "cpu": "x64" }, "sha512-Ye6vB7VQulghWYkYkECOBYFRVEizz4XyRTUAv+t8BuyurhKU7uD0P9eowL+mKG5Mf8MSYx+DI3Cm8SKZvYG7bQ=="],
 
-    "@oxc-project/types": ["@oxc-project/types@0.143.0", "", {}, "sha512-u6JZdLBTLotrNC9Vd6vPssINdzcCzleKAH6EJKImQb7GtYvX5keN2dxkoK44stCc4tffE6QQRtZTXVSzsLUlWA=="],
+    "@oxc-project/types": ["@oxc-project/types@0.148.0", "", {}, "sha512-Nm4s/jB+4FpFsPhWGEC4h7rzksesmtnMXomo6rCMcg/b8zLQuOziRgkCS1fxDCXOlJB/6Q8oABOZ/OP6RIPj9A=="],
 
     "@oxc-resolver/binding-android-arm-eabi": ["@oxc-resolver/binding-android-arm-eabi@11.24.2", "", { "os": "android", "cpu": "arm" }, "sha512-y09e0L0SRI2OA2tUIrjBgoV3eH5hvUKXNkJqXmNo5V2WxIjyC7I7aJfRLMEVpA8yi95f90gFDvO0VMgrDw+vwA=="],
 
@@ -674,49 +779,49 @@
 
     "@oxc-resolver/binding-win32-x64-msvc": ["@oxc-resolver/binding-win32-x64-msvc@11.24.2", "", { "os": "win32", "cpu": "x64" }, "sha512-UqGPmo56KDfLlfXFAFIrNflHT8tFxWGEivWg3Zeyp4Uy2NlKN1FGPr6/BxcLGG3+kZ6Wp14g5Uj+n71boqZfiw=="],
 
-    "@oxlint/binding-android-arm-eabi": ["@oxlint/binding-android-arm-eabi@1.78.0", "", { "os": "android", "cpu": "arm" }, "sha512-Bu819lmAfZMUHErrpe0cEWj3iaefuUODHSU8+UbXy67V/r7/7f4K3FL0NmbD85E+wiFLDYuhP8Zlv0XnVeXshw=="],
+    "@oxlint/binding-android-arm-eabi": ["@oxlint/binding-android-arm-eabi@1.83.0", "", { "os": "android", "cpu": "arm" }, "sha512-0yGY24EwsLk5YDe6F+VkmZyRHSwJDALa3nIrPpq7FXmp2lV2d0TzvBCGeZk+wgiULRGr5blhyr4QMp5KCXJUqA=="],
 
-    "@oxlint/binding-android-arm64": ["@oxlint/binding-android-arm64@1.78.0", "", { "os": "android", "cpu": "arm64" }, "sha512-CDfxZgB61B7buRdY2FJoAYYPPXCZ1EoC1LKscnC5dg3kjobdxiconvAvvN1BmHyW4PyFT3jRLDag/BY/roSNBQ=="],
+    "@oxlint/binding-android-arm64": ["@oxlint/binding-android-arm64@1.83.0", "", { "os": "android", "cpu": "arm64" }, "sha512-hHfJ0vc17A4iUjH5p9BsTUPYbYRNxGpvD2lbu1aBRk54bzNIx9o5TtYF39QPZcV95DagZd+4DEAw2RH3G2ZsMg=="],
 
-    "@oxlint/binding-darwin-arm64": ["@oxlint/binding-darwin-arm64@1.78.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-2Y2U9Ahrz+OO0Ej88f9SJYq51/jUBp1Mc7iZu0ukrbeeZ3gpRGfzIFnoqfHDY96xr0GEfNrPUBFEy0nN5aD7HA=="],
+    "@oxlint/binding-darwin-arm64": ["@oxlint/binding-darwin-arm64@1.83.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-hsOjYjszLb/3zym/TkzUMPAoQlTJcuzSyEPOAyA+skXJIX9M0o+4JfOtqopX/Vf4hSLrJ98j0nvFo23gzk8auQ=="],
 
-    "@oxlint/binding-darwin-x64": ["@oxlint/binding-darwin-x64@1.78.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-rpych6eJq6m9jDRypTEaPD1xysaEW5h9+xuxhGK/QhOg+/xaqPZrCrTNoIl/f3nEjuJeCEmstNDlrE9rJi/3/g=="],
+    "@oxlint/binding-darwin-x64": ["@oxlint/binding-darwin-x64@1.83.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-mjh5oH2EA+wl5yRJYT9K9G61O2zFlpuv+yf2JwZOi0+dq2FnTUtm1h8i+5Ik0fXPWIu/k84I1psZR9aQsLAnyA=="],
 
-    "@oxlint/binding-freebsd-x64": ["@oxlint/binding-freebsd-x64@1.78.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-IcMGrQT3QizkOESUJd5et+rOhVqSkNDfNik1cvrKDqIbzqx9KMtRswpFgkCuNTSwylCFLKhGUu8KmqY1ZnC0Dg=="],
+    "@oxlint/binding-freebsd-x64": ["@oxlint/binding-freebsd-x64@1.83.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-fNHr64/YaO8YssuoDVC8+F4Uk5enR86q5uxfHkQrjAPs1dbAILOrD2uaud+J7MO8Fx774g44ERLD0IGIvZE48w=="],
 
-    "@oxlint/binding-linux-arm-gnueabihf": ["@oxlint/binding-linux-arm-gnueabihf@1.78.0", "", { "os": "linux", "cpu": "arm" }, "sha512-/uLdoJ0IXE6vo/0f0LKjinQAp+re+VMaCWaNT8ENIv2EOCkSsc8SGaflXAuW0Jua2dq5+GLVWm1NQK7P3UFSNQ=="],
+    "@oxlint/binding-linux-arm-gnueabihf": ["@oxlint/binding-linux-arm-gnueabihf@1.83.0", "", { "os": "linux", "cpu": "arm" }, "sha512-Qpwy3zzAwMj+8/lyYItHmkSMwbkprFNWTK7jPYDOxSyxEhaSLOWYUTCMkjF334J8/WD0nznCCsoBbIH6hpsuIw=="],
 
-    "@oxlint/binding-linux-arm-musleabihf": ["@oxlint/binding-linux-arm-musleabihf@1.78.0", "", { "os": "linux", "cpu": "arm" }, "sha512-7xi4Wb/O8NRJhLoUXmDJMUVpNYvB5kefdhFU1Jb8rtae4QoXlTiLwI14X4YvAXVZLNZChP8m5qO9SQAlWQTbkQ=="],
+    "@oxlint/binding-linux-arm-musleabihf": ["@oxlint/binding-linux-arm-musleabihf@1.83.0", "", { "os": "linux", "cpu": "arm" }, "sha512-s+BirYLFq7JL2k9sP0XI3ZXJ9dYvJ8sX3jLCLoag7tt+zrSHpZxP0jqznfL+Gdgwu7ay0dYgGYJXrQvq3iWloA=="],
 
-    "@oxlint/binding-linux-arm64-gnu": ["@oxlint/binding-linux-arm64-gnu@1.78.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-4hFW0+fVXa3OIh1Y4A5SPkmvI4wuuBSrCVKzOyE7PTjhc7yEqZ1pmvEEeS5Lj/MaqvegFxXyF33N+6jkehxdyg=="],
+    "@oxlint/binding-linux-arm64-gnu": ["@oxlint/binding-linux-arm64-gnu@1.83.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-7lihXt3vKr+GIyapNbHrnFHm/biiW30le6Zv/DExbAFPF6YwCQXVFlONPFehxs0CpGO4CBfYPM9rdDT+XMoIlg=="],
 
-    "@oxlint/binding-linux-arm64-musl": ["@oxlint/binding-linux-arm64-musl@1.78.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-oC0mvsgBJjlMijSDEhx9KuvR9zYeHXceA9MjbuXB1F8NSR78Yj2unOBrstEvTVaq+pko+kuue6DajC00eqvTdg=="],
+    "@oxlint/binding-linux-arm64-musl": ["@oxlint/binding-linux-arm64-musl@1.83.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-q63JalLYVkZiZvls1z3PPUnpmQluOMXp0khqQMznCeAPLGydfNY8JhvuA4WlK57JfrvikU8wB5lPVveqpIXvew=="],
 
-    "@oxlint/binding-linux-ppc64-gnu": ["@oxlint/binding-linux-ppc64-gnu@1.78.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-XAllT5SUZS+ohjuZ3/5S0cwe0r7eboiuigeStCZ5DXRYx/2KVM2UvQXvAfyzXEimtQjAB7cDQ2YxDe2Zl2WNQQ=="],
+    "@oxlint/binding-linux-ppc64-gnu": ["@oxlint/binding-linux-ppc64-gnu@1.83.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-krQmDF+dRbxvdqVPV88ZuOoPPu8X5BuqDA8Hd+qcS4YMRQCb+nexA57DazgGsc/rGdKBe3QmV0mnv0bdpW/p5g=="],
 
-    "@oxlint/binding-linux-riscv64-gnu": ["@oxlint/binding-linux-riscv64-gnu@1.78.0", "", { "os": "linux", "cpu": "none" }, "sha512-trucMER/0QtecoXvc1y/UVqE3kwJipDwrx4oHfj+nNm3dq2zjP44WT0CfHNDPM3G1DXIkx/gY6lAD21NSCZVhA=="],
+    "@oxlint/binding-linux-riscv64-gnu": ["@oxlint/binding-linux-riscv64-gnu@1.83.0", "", { "os": "linux", "cpu": "none" }, "sha512-MmOl8Y6txEAXZU1RG8Rr264jQ6D7VPmqFsU/45x/FeWsGe32hklTqGrLE6UxHzp5Rjt0wP+20tY8YXKgSFB3mw=="],
 
-    "@oxlint/binding-linux-riscv64-musl": ["@oxlint/binding-linux-riscv64-musl@1.78.0", "", { "os": "linux", "cpu": "none" }, "sha512-cm3O4F/HQbdzOUX5mKHqG5KDL6E5w0pnlZ+fbBy2rmLryPOowkuLagFHTopQsEIpjcaZoPOrL+BmmAytAG9HFg=="],
+    "@oxlint/binding-linux-riscv64-musl": ["@oxlint/binding-linux-riscv64-musl@1.83.0", "", { "os": "linux", "cpu": "none" }, "sha512-u1rMymh0W3JZkq370kzQsYPULGWqhE09pZRqnZvUSoYaI9pVO5yVX+iYIslmWuEgwuzH9YAaOsScJiobWCHoOw=="],
 
-    "@oxlint/binding-linux-s390x-gnu": ["@oxlint/binding-linux-s390x-gnu@1.78.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-33wRf6HqGNsybJ3qX4cGaQN2ODPxNmc1rMa0mrTmx3eFq1VzOnvQooi9bIGVYakW8a/wmqVx1mgsUm8R2xfTiw=="],
+    "@oxlint/binding-linux-s390x-gnu": ["@oxlint/binding-linux-s390x-gnu@1.83.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-y0zK3HNwGysu7rqtE+BQG/d0bx5gh/KwlOtghN8oWeK1KcWzeaLqtZrbm8owqdma1lFyrce/hTO5ismuNu+INQ=="],
 
-    "@oxlint/binding-linux-x64-gnu": ["@oxlint/binding-linux-x64-gnu@1.78.0", "", { "os": "linux", "cpu": "x64" }, "sha512-rRdISSYegj6VganMZ9tjRjijowfHJ09IZU01i0toBAqr6n5LEtwHq2IeS4FjW2RoskOHlb6efB26H5izYb3GEQ=="],
+    "@oxlint/binding-linux-x64-gnu": ["@oxlint/binding-linux-x64-gnu@1.83.0", "", { "os": "linux", "cpu": "x64" }, "sha512-rS5gM0NgD7ngmuJmbIehsidtrOwKkLFwCQbKEeb9KuyQrrWNq5Zkn0uV6AYdXOMJ0grrWEiLwBuvMxt8w5vsNw=="],
 
-    "@oxlint/binding-linux-x64-musl": ["@oxlint/binding-linux-x64-musl@1.78.0", "", { "os": "linux", "cpu": "x64" }, "sha512-GmsP4rW0xTL6u5CVdcDsaN5Fbc7hBc382Wmar1kttbnwSEviM+rSINKOMQ+UQ6iH+AGwC+8gaAiwu134Tgh6Lg=="],
+    "@oxlint/binding-linux-x64-musl": ["@oxlint/binding-linux-x64-musl@1.83.0", "", { "os": "linux", "cpu": "x64" }, "sha512-W2IH4EtpcPaWcvNGCA95YoDg4vxqE/ZiPCi3arrxEEpsK7+JQN9WYwrlYFx9pcdP6KPXqRqkv3zdQPHcx7b6YQ=="],
 
-    "@oxlint/binding-openharmony-arm64": ["@oxlint/binding-openharmony-arm64@1.78.0", "", { "os": "none", "cpu": "arm64" }, "sha512-sy9yeYuADc8a+n4TLBayzMCZiHPW78DcIFVpOXTmdKHWQeM9xe5uzkqIIZmi326D5hY9XVwacipEB1p7tQjPAg=="],
+    "@oxlint/binding-openharmony-arm64": ["@oxlint/binding-openharmony-arm64@1.83.0", "", { "os": "none", "cpu": "arm64" }, "sha512-6LyKkUyoajssTPLlZmDbZIbu4IZ5B4bGuRUnBgCGpEvHP3FQMaYITncHA/unPUo7q+Z+pIu2HhdkQ+8d1SG7iA=="],
 
-    "@oxlint/binding-win32-arm64-msvc": ["@oxlint/binding-win32-arm64-msvc@1.78.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-rjc2hF1KfMi8fZj1X/m3AmnHbdsF3rL0v6KQg0Uc880Yb2khjz+3U14sfdZ7jWTpRnN1m1NQa/TT7uU9lJWPrA=="],
+    "@oxlint/binding-win32-arm64-msvc": ["@oxlint/binding-win32-arm64-msvc@1.83.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-Uz/fObEtF0jmNJQJ8CGRBKfefYstS0/wjD3s6IGzP8nUwsJykHQJBiN3npHwKiGRGn/vvBEgNr4B3cCzmmatvg=="],
 
-    "@oxlint/binding-win32-ia32-msvc": ["@oxlint/binding-win32-ia32-msvc@1.78.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-zcuXFVrEFHIafRfkCQT8w/Xe41o07ozl/vwHq7p94vB29xVzsB0sZGYORU1jhcYKv3Lr0J3HbJ2T4fHH5rWmvA=="],
+    "@oxlint/binding-win32-ia32-msvc": ["@oxlint/binding-win32-ia32-msvc@1.83.0", "", { "os": "win32", "cpu": "ia32" }, "sha512-u7XcvPW6Bk58tY5iWs2ESb0vJjoE/kuSpHxopbwp/p3ZtWVQXZ6wor5w3ssVTHOqd/v8b+QdhSFWQ4grEUNWpA=="],
 
-    "@oxlint/binding-win32-x64-msvc": ["@oxlint/binding-win32-x64-msvc@1.78.0", "", { "os": "win32", "cpu": "x64" }, "sha512-Sb5ocmLSuYeOuXd+CFOToGKp/gjXUEWDnvIGwhnh8aq8wY4TMmEnKnvbogSW7RdMZv77JSARduS7/gv+khYEjA=="],
+    "@oxlint/binding-win32-x64-msvc": ["@oxlint/binding-win32-x64-msvc@1.83.0", "", { "os": "win32", "cpu": "x64" }, "sha512-LZRubd7ph13QmAg4fFecTYVZkiYbROR2Htaxh/ufWRkDhPOm2wrwaEYR89e0YpPFD3dqBrPoxS7myBw5hmYA7Q=="],
 
-    "@oxlint/plugins": ["@oxlint/plugins@1.78.0", "", {}, "sha512-Ypt8KeRYw+4jUtlPirfcHWMrn5ms12VrrFPD+Mds477/7tJxG1Kcz2Yrg2nVcTQEUx/GdlhS+BUg1kmxNm04Ug=="],
+    "@oxlint/plugins": ["@oxlint/plugins@1.83.0", "", {}, "sha512-qD64wr6SS1DL7YbJQ8WWjyUfFfrJsvAy9Vo0sG/PYUQy30w0uemN2h6j4xuvj4noyETDpzcGC20sv+FH7GrN5A=="],
 
-    "@paralleldrive/cuid2": ["@paralleldrive/cuid2@2.3.1", "", { "dependencies": { "@noble/hashes": "^1.1.5" } }, "sha512-XO7cAxhnTZl0Yggq6jOgjiOHhbgcO4NqFqwSmQpjK3b6TEE6Uj/jfSk6wzYyemh3+I0sHirKSetjQwn5cZktFw=="],
+    "@paralleldrive/cuid2": ["@paralleldrive/cuid2@3.3.0", "", { "dependencies": { "@noble/hashes": "^2.0.1", "bignumber.js": "^9.3.1", "error-causes": "^3.0.2" }, "bin": { "cuid2": "bin/cuid2.js" } }, "sha512-OqiFvSOF0dBSesELYY2CAMa4YINvlLpvKOz/rv6NeZEqiyttlHgv98Juwv4Ch+GrEV7IZ8jfI2VcEoYUjXXCjw=="],
 
-    "@pierre/diffs": ["@pierre/diffs@1.3.4", "", { "dependencies": { "@pierre/theme": "2.0.0", "@pierre/theming": "1.0.1", "@shikijs/transformers": "^3.0.0 || ^4.0.0", "diff": "9.0.0", "hast-util-to-html": "9.0.5", "lru_map": "0.4.1", "shiki": "^3.0.0 || ^4.0.0" }, "peerDependencies": { "react": "^18.3.1 || ^19.0.0", "react-dom": "^18.3.1 || ^19.0.0" } }, "sha512-6Dt48jQIL+H54QyNB943Oqn5p4uRw7NpiXLSEapnaYgYvTmSHNPAUCDfg6AcRC+W02z0IYJnJJvcs3lsNp7gCw=="],
+    "@pierre/diffs": ["@pierre/diffs@1.4.1", "", { "dependencies": { "@pierre/theme": "2.0.0", "@pierre/theming": "1.0.1", "@shikijs/transformers": "^3.0.0 || ^4.0.0", "diff": "9.0.0", "hast-util-to-html": "9.0.5", "lru_map": "0.4.1", "shiki": "^3.0.0 || ^4.0.0" }, "peerDependencies": { "react": "^18.3.1 || ^19.0.0", "react-dom": "^18.3.1 || ^19.0.0" }, "optionalPeers": ["react", "react-dom"] }, "sha512-rzvY9FeeYdGtVcErjNsW6tnrjpMb0DvGtgCFNuMoYT8wufE+gO1ZXAzKAc2VPRBS3Rl5HELEQ38WDlis4qZHkQ=="],
 
     "@pierre/theme": ["@pierre/theme@2.0.0", "", {}, "sha512-yNDd9GYLQl1mEUJR8AneJ5e4ohLIHQd/wZLWr4fagt78vS2RwwZNW530vVgHqXFAyFVcFlRmGUD5ramXH46OXw=="],
 
@@ -724,31 +829,31 @@
 
     "@pierre/trees": ["@pierre/trees@1.0.0-beta.6", "", { "dependencies": { "@pierre/theming": "1.0.0", "preact": "11.0.0-beta.0", "preact-render-to-string": "6.6.5" }, "peerDependencies": { "react": "^18.3.1 || ^19.0.0", "react-dom": "^18.3.1 || ^19.0.0" } }, "sha512-zxeuSFM9TveM7b5XofweJALCtm/tGYV9HZzdbf7Uf+kBxIlUyz24/EHaGRjB0dsmmfDQl2ETz7AWwJ15lhSnpw=="],
 
-    "@posthog/browser-common": ["@posthog/browser-common@0.4.0", "", { "dependencies": { "@posthog/core": "^1.46.8", "@posthog/types": "^1.402.0" } }, "sha512-W9DCGVks15docUMPvJ2nd8NS16Gn74bsGWuaeg31beEKFSjdW8wvnQ1ETY6WSql5pYxZb3GdJmEUZVVstKSrBQ=="],
+    "@posthog/browser-common": ["@posthog/browser-common@0.8.3", "", { "dependencies": { "@posthog/core": "^1.53.2", "@posthog/types": "^1.411.1" } }, "sha512-4Hlbwyn+Hioc2+pjqSGWMTDrA5XsDshssPnGfv34khPKoJaeBe2YvPvsEPoH78jezOS6Wo3LJvCPhqyolg3S8w=="],
 
-    "@posthog/core": ["@posthog/core@1.46.8", "", { "dependencies": { "@posthog/types": "^1.401.1" } }, "sha512-WQTSwlFhsWk09xngTimHiTyhFU8QZHFZEGSm+6brY3acwYdvTLcTxpIhgl/qOCgn/XoqlCFTZqU1ldWLxNntfA=="],
+    "@posthog/core": ["@posthog/core@1.53.3", "", { "dependencies": { "@posthog/types": "^1.411.1" } }, "sha512-ioBDeZtsFZej4vfX2bGGBud3DNCvSlmUUdk2KtQWOlpGytbdirMHVxG2iAFkxqemiukqcvf/Do6BtZb5hp9MYw=="],
 
-    "@posthog/types": ["@posthog/types@1.402.1", "", {}, "sha512-4PZ9wMYI8m8AqJuZ9YR1IAHGVtSnYbBVBgTevrKpzZbcSe/OUwhEV2Ks//rJh/L8eMTU8R5DrD4D/hlrOwaAiQ=="],
+    "@posthog/types": ["@posthog/types@1.412.0", "", {}, "sha512-EP+lSTnEmftW/slhGXsuGcYAygO4oho3hjWqObP+GeceZ+6qcwK9qZwVRqJjsiZAl0xLPy5s0U0SZqGKayFyeQ=="],
 
-    "@prisma/adapter-pg": ["@prisma/adapter-pg@7.9.1", "", { "dependencies": { "@prisma/driver-adapter-utils": "7.9.1", "@types/pg": "^8.16.0", "pg": "^8.16.3", "postgres-array": "3.0.4" } }, "sha512-Ho2RK1KanQxLNSC0sR5bpiiVep10sWPLXCcxK+KXfI/Q69TMRbiafSvLPv3V9snimX72rMCqGlyJ4sBO4lKTAw=="],
+    "@prisma/adapter-pg": ["@prisma/adapter-pg@7.10.0", "", { "dependencies": { "@prisma/driver-adapter-utils": "7.10.0", "@types/pg": "^8.16.0", "pg": "^8.16.3", "postgres-array": "3.0.4" } }, "sha512-N7nwSor0HO1Kz6xBv0TPAjAPysKK0fac6p4fVN3ensLOuzc/83Fgmln5k92eK/cvzqdkSR/2kkAqlbcdwVrwpw=="],
 
-    "@prisma/client": ["@prisma/client@7.9.1", "", { "dependencies": { "@prisma/client-runtime-utils": "7.9.1" }, "peerDependencies": { "prisma": "*", "typescript": ">=5.4.0" }, "optionalPeers": ["prisma", "typescript"] }, "sha512-+xgrh2EhJVF79wC0yX5G4PI1Rdcm7Qn/nekNQ+t/O153wtNggruHal+fXHSa0QE+Tp/Cw5wvxeCEhZZ59xGm8Q=="],
+    "@prisma/client": ["@prisma/client@7.10.0", "", { "dependencies": { "@prisma/client-runtime-utils": "7.10.0" }, "peerDependencies": { "prisma": "*", "typescript": ">=5.4.0" }, "optionalPeers": ["prisma", "typescript"] }, "sha512-Ubw/QS9JGIBSBUsyxAUQuK/Jcu0Tsva7le7QbLd91Kix9yJvYDdj5QkwgEbbZniH80dd+sziQcALPc+HnvQC8Q=="],
 
-    "@prisma/client-runtime-utils": ["@prisma/client-runtime-utils@7.9.1", "", {}, "sha512-mVIBGYdO5CFmK0HvjxrtfIyQQcPdb88pSCeVQriVQPVZyDovIWblpHfOgcS8QO187j3QF0ePArH8qPhp0AU2vg=="],
+    "@prisma/client-runtime-utils": ["@prisma/client-runtime-utils@7.10.0", "", {}, "sha512-cnCy7lUV8/CctgKVEmqAbSLAmwqJdE/qAlqTBk/0NDk59zEb2cZ0M0M0E4vVPnqbSEYudRroQDvOWfUZH6RIfw=="],
 
-    "@prisma/config": ["@prisma/config@7.9.1", "", { "dependencies": { "c12": "3.3.4", "deepmerge-ts": "7.1.5", "effect": "3.20.0", "empathic": "2.0.0" } }, "sha512-4znKhxTmXmuPye9Z6pbIyYb5VZlkZ05qG1L6Dr4g+7oTwc6V50Bs9XirFBDdjWt+H/AabMn9aUnxBcvj8z05aA=="],
+    "@prisma/config": ["@prisma/config@7.10.0", "", { "dependencies": { "c12": "3.3.4", "deepmerge-ts": "7.1.5", "effect": "3.20.0", "empathic": "2.0.0" } }, "sha512-Rcg828gIRE3HOQ3pOATFjV5d/P0U9OIobxhd/IMxlfWjA4vru0eGwb0AIwFw0rmcLMVShohZYWPixVxkBHsxUA=="],
 
-    "@prisma/debug": ["@prisma/debug@7.9.1", "", {}, "sha512-/cpVZ4itxtcgB8GHBvZtcmuEjq+lWsLrRJxFMbwZrT1RIdtuKmUm7PPGo/wzfbYpBrk+9WmmBE8CHJw2rybKDQ=="],
+    "@prisma/debug": ["@prisma/debug@7.10.0", "", {}, "sha512-caygJKtltmRIgdJ3jRpkOr7yM4DW6zxo5uOmojKWFb3asnxWoRkQOwZmXBgD8FZp4htrX+nMpcWqDwzlQ1+Y4g=="],
 
     "@prisma/dev": ["@prisma/dev@0.24.17", "", { "dependencies": { "@electric-sql/pglite": "0.4.3", "@electric-sql/pglite-socket": "0.1.3", "@electric-sql/pglite-tools": "0.3.3", "@prisma/get-platform": "7.2.0", "@prisma/query-plan-executor": "7.2.0", "@prisma/streams-local": "0.1.11", "find-my-way": "9.7.0", "foreground-child": "3.3.1", "get-port-please": "3.2.0", "pathe": "2.0.3", "proper-lockfile": "4.1.2", "remeda": "2.33.4", "std-env": "3.10.0", "valibot": "1.4.2", "zeptomatch": "2.1.0" } }, "sha512-UvdZzmpFwknnfreh6Jije84ekkYGPYEJhXG1tFzCsCfQyzJifrOo38eZc0qajzvaC6OLUOrN9ML5XfCnEZL9DA=="],
 
-    "@prisma/driver-adapter-utils": ["@prisma/driver-adapter-utils@7.9.1", "", { "dependencies": { "@prisma/debug": "7.9.1" } }, "sha512-vmHehG7nn/heW32DXXpp13DxxAxVVe6n250oEt3dOL2E/4bt3olktKZN0mzSuxMMronyMSkbeW2uCOn3F4g8RQ=="],
+    "@prisma/driver-adapter-utils": ["@prisma/driver-adapter-utils@7.10.0", "", { "dependencies": { "@prisma/debug": "7.10.0" } }, "sha512-u8zkcRLlaryO652T4qavBg0HmzNW5tSKdsCn6hc1PhWAp/J6k0vrxLuUs+b9o+HcjsK7Dfa01o4OFSn0frauJA=="],
 
-    "@prisma/engines": ["@prisma/engines@7.9.1", "", { "dependencies": { "@prisma/debug": "7.9.1", "@prisma/engines-version": "7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6ad", "@prisma/fetch-engine": "7.9.1", "@prisma/get-platform": "7.9.1" } }, "sha512-UprXSMNXx2NF5ow4pqaQtE8OuBz6K78B0wc0tn2L28G5r933iWp1DR9Do2qWrsNvvFIP3x6mpEWnQtckMO0Uhg=="],
+    "@prisma/engines": ["@prisma/engines@7.10.0", "", { "dependencies": { "@prisma/debug": "7.10.0", "@prisma/engines-version": "7.10.0-4.0edf323efd1d98336f3f0a68684b56f689b900d3", "@prisma/fetch-engine": "7.10.0", "@prisma/get-platform": "7.10.0" } }, "sha512-KNumN6NHFwybvfdYzTee9pqwx5PvknpWAaHn6L5NsbrKdl+SQrsVZs9opKs6U6SAsvB26HDt3WybRjOhgoWOYQ=="],
 
-    "@prisma/engines-version": ["@prisma/engines-version@7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6ad", "", {}, "sha512-2BsPPFksz3CQUXG6af3rVCtJKg6+JJGJTtfgu2fU8DdXhOfkBjulCq8mwybCd6ge0/jhZq2kOtLAbmUDMyI1nA=="],
+    "@prisma/engines-version": ["@prisma/engines-version@7.10.0-4.0edf323efd1d98336f3f0a68684b56f689b900d3", "", {}, "sha512-8OJ6RuZTZ06eFUOtBwxVmv8XMmOW6HWN5F+uxUbZkGxR0Bfab1dfAdXaHPmR5mb59E+fmUo8IOzXlbLY1SClbw=="],
 
-    "@prisma/fetch-engine": ["@prisma/fetch-engine@7.9.1", "", { "dependencies": { "@prisma/debug": "7.9.1", "@prisma/engines-version": "7.9.0-1.e922089b7d7502aff4249d5da3420f6fa55fc6ad", "@prisma/get-platform": "7.9.1" } }, "sha512-9DwxrNTeT25Orbu9CWh0CZvVlyY1lmscpbaeLZcOnuR7zcuFrt91YSmmOfIm7zJ08YOZ6mVzURKwLoMwEBcK8w=="],
+    "@prisma/fetch-engine": ["@prisma/fetch-engine@7.10.0", "", { "dependencies": { "@prisma/debug": "7.10.0", "@prisma/engines-version": "7.10.0-4.0edf323efd1d98336f3f0a68684b56f689b900d3", "@prisma/get-platform": "7.10.0" } }, "sha512-Zqyu8DY14t6W/xwmAxUYWCXtHrvQnSvT644EAZSsdM8NSmCS74vJJbBKdVsK3ucFpnUWkEpbO1a0CxJXrg130g=="],
 
     "@prisma/get-platform": ["@prisma/get-platform@7.2.0", "", { "dependencies": { "@prisma/debug": "7.2.0" } }, "sha512-k1V0l0Td1732EHpAfi2eySTezyllok9dXb6UQanajkJQzPUGi3vO2z7jdkz67SypFTdmbnyGYxvEvYZdZsMAVA=="],
 
@@ -780,7 +885,7 @@
 
     "@radix-ui/react-collection": ["@radix-ui/react-collection@1.1.15", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.5", "@radix-ui/react-context": "1.2.2", "@radix-ui/react-primitive": "2.1.10", "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-9W+B9NPF0NaaPh/1NJd3+KqsnlLqU9H7T2rvww+fp+T/evVXdNAyYcnfRQZFOjkR1ajQp3yORlqnI8soawLvNA=="],
 
-    "@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.2", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-z4eqJvfiNnFMHIIvXP3CY57y2WJs5g2v3X0zm9mEJkrkNv4rDxu+sg9Jh8EkXyeqBkB7SOcboo9dMVqhyrACIg=="],
+    "@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
 
     "@radix-ui/react-context": ["@radix-ui/react-context@1.2.2", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-RHCUGwKHDr0hDGg4X7ma4JG4/+12qxw8rkh5QKdDldlCvtja6nUx1Ef/8HVrJze81lEsgLQlqjzjGNHantgnQA=="],
 
@@ -824,7 +929,7 @@
 
     "@radix-ui/react-presence": ["@radix-ui/react-presence@1.1.10", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.4" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-3wyzCQ6+ubRA+D4uv9m95JYLXxmOHp05qjrkjeA7uKHHtjpPggQzc6DAb0URl7j67oR0K2foO4ip27TiX037Bw=="],
 
-    "@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+    "@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
 
     "@radix-ui/react-progress": ["@radix-ui/react-progress@1.1.16", "", { "dependencies": { "@radix-ui/react-context": "1.2.2", "@radix-ui/react-primitive": "2.1.10" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-5XnomAsoZZCY+KNTxbIghpGqPruZvKFNlvcAljVAOdDRDsH4/OZQxhtwo5wdtoDM5R6MhJBb2sPnDuRFep3lzg=="],
 
@@ -882,35 +987,35 @@
 
     "@reduxjs/toolkit": ["@reduxjs/toolkit@2.12.0", "", { "dependencies": { "@standard-schema/spec": "^1.0.0", "@standard-schema/utils": "^0.3.0", "immer": "^11.0.0", "redux": "^5.0.1", "redux-thunk": "^3.1.0", "reselect": "^5.1.0" }, "peerDependencies": { "react": "^16.9.0 || ^17.0.0 || ^18 || ^19", "react-redux": "^7.2.1 || ^8.1.3 || ^9.0.0" }, "optionalPeers": ["react", "react-redux"] }, "sha512-KiT+RzZbp6mQET+Mg+h2c97+9j1sNflUxQkIHI7Yuzf6Peu+OYpmkn6nbHWmLLWj+1ZODUJFwGZ7gx3L9R9EOw=="],
 
-    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.2.1", "", { "os": "android", "cpu": "arm64" }, "sha512-02hOeOSryYxVrOIphmLAsqnCJWxwlzFk+pEt/N/i6OgT3lShHO7xGCU5cpgchRDHboAEbSjzgGh+O/u1GswQmA=="],
+    "@rolldown/binding-android-arm-eabi": ["@rolldown/binding-android-arm-eabi@1.2.8", "", { "os": "android", "cpu": "arm" }, "sha512-tN5aztYkKCte4i5SIrrz5yK/HMjEuCqCSCJa418jOV8tZ1cBY3YF2otxB1ktPxzsLA1BeTqwapK0bfjxNvHJVw=="],
 
-    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.2.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-fMsTOnN0OjFm3CyppWPitKnc8UlliVARUULW6cfU6AIqjdtgmSFWSk9vecHzZduv/yMWIHDlRhM1e8Iff9uAfA=="],
+    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.2.8", "", { "os": "android", "cpu": "arm64" }, "sha512-dIYTWl9XprMUiQFoc55KUyk/oS8SKYH3zFl0LTR7RT0Xj4hgSVyuJcroH8JUu8RcpF8fTB6E0aOwCkZoYPcDSQ=="],
 
-    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.2.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-1wjKdz/XLGKHaTNHjQveQ/B23TKx4ItAqm1JbyVuvNPc4Ze0Fb48s49TAd/2zcplPl8okE/UbTgmlVfwT7eFeQ=="],
+    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.2.8", "", { "os": "darwin", "cpu": "arm64" }, "sha512-PCSDQGXD2IyTEFrcgPyBM8jJuGmrbCMuoIOXdbEGVemruKACXoLQJrb+A45Z0L5t1RQkdfJprAYPkikbh7dzdA=="],
 
-    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.2.1", "", { "os": "freebsd", "cpu": "x64" }, "sha512-Fa0jHR07E7YBN4vOEsbVf2briYNsuOowfLJaXULZM0ldMlaCaj2LJgLMbMe4iacRyZmvR8efFhgR9wKuGclQUg=="],
+    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.2.8", "", { "os": "darwin", "cpu": "x64" }, "sha512-Uk7lRsGhPFHVX/sAUC6D5H9Ol30dFHd6iquokll2th3LpdJ3F5CzQB+7DHn0Ri2mG+U7k2zXiPHDrwZenXhwSA=="],
 
-    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.2.1", "", { "os": "linux", "cpu": "arm" }, "sha512-pzkgu1SSHGgRRyRZ4fbmSgmajbVt+epaLP99NDjFft69v/ypfTi6swBMiVdh2EkQ0OSnHE1lZDM7DRGkyAzUpA=="],
+    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.2.8", "", { "os": "freebsd", "cpu": "x64" }, "sha512-DjszaTEVogPqA5bYzsEeqDCQxbcp2fexQwKcRspYji2yzR68fCf+e4fx6kBSRDwX5/brZaHw/hWS9+A/+/w9sQ=="],
 
-    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.2.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-QI5SEDY8cbiYWHx0VO4vIc3UlS6a32vXHjU8Qy/17adEmZIPuByJg13UEvo9c/UCiUkdcVWY83C+b+JrwnNyUg=="],
+    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.2.8", "", { "os": "linux", "cpu": "arm" }, "sha512-zmwa7FTmdzB6aaEEuuls18H6Ap5JmJPSoPTuXixeJZV6tG40SyLkApQtz1g8ptZtiEKqj9OM0oNLPh1AgvE31Q=="],
 
-    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.2.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-Sm41FyCeXqmYcERoYOCbGIL5hNfd8w9LQ7Y61Bev48HkcjaJqV/iiVOaiDxjVTRMS+QKrZmD8cfPt4uMVnvM+A=="],
+    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.2.8", "", { "os": "linux", "cpu": "arm64" }, "sha512-KdYQDPHwJVnbFwdTGMgxsI9SqblBlz6STGM+w1We/d5B8OWWidYH0MwkU/uA1wM5fIpO2MkOVxXrNzzuZhw9ew=="],
 
-    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.2.1", "", { "os": "linux", "cpu": "ppc64" }, "sha512-2x+WhXTGl9yJYPbltW/BSEPTVz9OIWQyER4N+gJEDWkkn904eRcBzELqh/Hf7K0w/ubGbKNMv0ZC+94QK/IFEg=="],
+    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.2.8", "", { "os": "linux", "cpu": "arm64" }, "sha512-jFJTifHnNPY+yzOoNZQfSIysrVyXzEQPhPnOUjmD1bcQGHH6s7c8cViKWar8YplQImE5N9JRqMCLrM2CdxOrZA=="],
 
-    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.2.1", "", { "os": "linux", "cpu": "s390x" }, "sha512-eEjmQpuRQayHPWWnywaWHkFT3ToPbP3RYy42VVd/B9aBGDA+Ol25EIWHxKQST3IiWJjikCWUF7KtbfqwZrzVwQ=="],
+    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.2.8", "", { "os": "linux", "cpu": "ppc64" }, "sha512-FhiOziBDWPBjbcmRzfLyIJnaP7AVMFXT7YCXPjXxj7wKU3vx24RjrCNN/zjvVa+N2vVoHJwCoUBvsrN/DG3zIA=="],
 
-    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.2.1", "", { "os": "linux", "cpu": "x64" }, "sha512-/Orga1fZYkLc/56jBICcHrKchl8Z2UKdDSr3LG9ToWO1lQ6a4Livk9Xz+9WN91zsz5QR3XQz2NNoSDEvP6qadw=="],
+    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.2.8", "", { "os": "linux", "cpu": "s390x" }, "sha512-WnHfADMzOV2Y55wlx1hzzQnar/wDt/VdvWSD99r18Mz9ylNieIGOkRx3UV21h7m/eJvjySYJkO26VvGNFkwsIQ=="],
 
-    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.2.1", "", { "os": "linux", "cpu": "x64" }, "sha512-xxBJRL+0q0Kce7orznGWLuylHDY65vuARXZRpX+hPdv+DqK2c3NlCsVA98tlWzWNEE7yPqA/1NQ5nnCrj49Y5A=="],
+    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.2.8", "", { "os": "linux", "cpu": "x64" }, "sha512-H9tRr5ibfXFVLxbPOseVewewFpl28zcEdjRDt2FTUZU7odxP0gEv1ki4/kGmcGOh78oRwZuuQllGLZ9zTJp84g=="],
 
-    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.2.1", "", { "os": "none", "cpu": "arm64" }, "sha512-M6AdXIXw3s+/8XpKMzdGDEXGS1S7kwUsy+rcTIUIOx5Ge4nXKCtAFHFV9YKkXvGcC5WMoTjAteLzlsQROVI0Yw=="],
+    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.2.8", "", { "os": "linux", "cpu": "x64" }, "sha512-UefiqfM3D6IVNlZ8tSGs9+Ejjud2T+oxO0IHADU45Y+lyEjD2dVFyZHbkfX0LUb5Zugo/oIv1eCO/KVYhgYJYA=="],
 
-    "@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.2.1", "", { "dependencies": { "@emnapi/core": "2.0.0-alpha.3", "@emnapi/runtime": "2.0.0-alpha.3", "@napi-rs/wasm-runtime": "^1.2.0" } }, "sha512-/TX0SoRGojHzSAHpfVBbavRVSazg5U3h3Y3VXfcc0cdugq6kxdqw8LPGFiPr+/7gE/60zRcsOY2Vi9b9eT0jww=="],
+    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.2.8", "", { "os": "none", "cpu": "arm64" }, "sha512-637Ke4kWSy6rp9cxQ9gMOXlxPgIw/c1beASV4M//3+9I4uwBVOOl74G+e3zyU3u19U7RkRl/HuewixZ/Z6+Rjg=="],
 
-    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.2.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-EvRrivJieyHG+AO9lleZWgq+g0+S7oV2C51yuqlcyU/R9net+sI4Pj0F+lUoP2bEr6TWX3SqFaaS0SzfLxSzkw=="],
+    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.2.8", "", { "os": "win32", "cpu": "arm64" }, "sha512-xWBkPOF1Q9k/Gv1nQXnVdLxKu74jXppuOM4Z3mnypVUJJJwLsMl7hNJGRAUJoG8A5MgOI1ACKM+wBFxSJzKy4A=="],
 
-    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.2.1", "", { "os": "win32", "cpu": "x64" }, "sha512-Z4eCmn5QJ/5+azF9knpLWKfVd9aidn0mAe9TpJgvBLId9Ax3t0+JVxBmT25Bv7NBbVW1TZyKjQjQReouMeH5UQ=="],
+    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.2.8", "", { "os": "win32", "cpu": "x64" }, "sha512-uz2ZvfgXbxqNwijjjbxrnvALwpyODDcgc1T1N8N3rf/DXKQmaFwmB4LX4yyjggpwN2obdQLb2rgirX5ffCWYng=="],
 
     "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.1", "", {}, "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw=="],
 
@@ -920,43 +1025,55 @@
 
     "@sec-ant/readable-stream": ["@sec-ant/readable-stream@0.4.1", "", {}, "sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg=="],
 
-    "@shadcn/react": ["@shadcn/react@0.3.0", "", { "peerDependencies": { "@types/react": ">=19", "react": ">=19" }, "optionalPeers": ["@types/react", "react"] }, "sha512-iKN0NuYe850VDHlxEfvppFrpa7CMV3zArTHusXlaSmeFeQhohGbIqclv6WwPTs/44I8EkXQpcuRt6sXEVKkWqQ=="],
+    "@shadcn/react": ["@shadcn/react@0.3.1", "", { "peerDependencies": { "@types/react": ">=19", "react": ">=19" }, "optionalPeers": ["@types/react", "react"] }, "sha512-2gOR0HDMtWeRsCZfNDaU0YDFdgH3zsDQ6lz67Fv/y/qjY9y+R8kJqAn6q56phqv7/zHi0wqURjntrNO9zL7vnQ=="],
 
-    "@shikijs/core": ["@shikijs/core@4.4.2", "", { "dependencies": { "@shikijs/primitive": "4.4.2", "@shikijs/types": "4.4.2", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.5", "hast-util-to-html": "^9.0.5" } }, "sha512-StyzbAyxg2/tBGf78gwbBkGyeQ73lf8UiJArFaQhTQIDqQOCKPCQFanvrs4/Yv3Yfyc+ONInJM6K+FMIf+P+kA=="],
+    "@shikijs/core": ["@shikijs/core@4.4.3", "", { "dependencies": { "@shikijs/primitive": "4.4.3", "@shikijs/types": "4.4.3", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.5", "hast-util-to-html": "^9.0.5" } }, "sha512-QCR4q2ZO/ILJEuwiBMel4wdcTDb1JGwfjKTxPDF6x8ixOaluPrVqIn06C99AcRPhmYlBR56d/Fb+GN58GzExpg=="],
 
-    "@shikijs/engine-javascript": ["@shikijs/engine-javascript@4.4.2", "", { "dependencies": { "@shikijs/types": "4.4.2", "@shikijs/vscode-textmate": "^10.0.2", "oniguruma-to-es": "^4.3.6" } }, "sha512-MnIkeqWdVPUWsxlx8gKLVCJFTsqrQJgpTPBPpQwaFeJ56lOnJxj5aN2LUFnfxUEcvOQuNocmbaMnVrCEln6rkw=="],
+    "@shikijs/engine-javascript": ["@shikijs/engine-javascript@4.4.3", "", { "dependencies": { "@shikijs/types": "4.4.3", "@shikijs/vscode-textmate": "^10.0.2", "oniguruma-to-es": "^4.3.6" } }, "sha512-FbOjFJp9VLdo1Wevs10BBtVxiTWwNLqZh5Gkhjgda/ioL15YOgeSl9n+6XMa3qRlPQzfhFNe641SrynFHYG0nQ=="],
 
-    "@shikijs/engine-oniguruma": ["@shikijs/engine-oniguruma@4.4.2", "", { "dependencies": { "@shikijs/types": "4.4.2", "@shikijs/vscode-textmate": "^10.0.2" } }, "sha512-GLhowz1+jixjz+wiZ3wMnOn1jTxiFCGl2PkXufivbnwPHKuyw1AYqu5/hbWhZZ2oAb0NP05WUJhYeigY14drnw=="],
+    "@shikijs/engine-oniguruma": ["@shikijs/engine-oniguruma@4.4.3", "", { "dependencies": { "@shikijs/types": "4.4.3", "@shikijs/vscode-textmate": "^10.0.2" } }, "sha512-EcOQkxdxGQrc1Row/cC2c96/v1dbZqGnEVu1qTuT/MJmp6+cXCvQussowVmCv5Tqr3KuY3c7IbM6HTW3LJ1k9w=="],
 
-    "@shikijs/langs": ["@shikijs/langs@4.4.2", "", { "dependencies": { "@shikijs/types": "4.4.2" } }, "sha512-8DfeusD+Zdv/eYIDdXyJTUnSMHt+aAWjAOCXV20HNGAHRlInXpG8wh421v6B91WOm9TFwRLN+b/LG5F2NAIojg=="],
+    "@shikijs/langs": ["@shikijs/langs@4.4.3", "", { "dependencies": { "@shikijs/types": "4.4.3" } }, "sha512-ePic0yfAJGOF83D5wBHK/00EjK65oahBYxFk5epgq33WRv7X9UuxLEV8PtR0szC0z8dl7INIpIodB99JRFlR+A=="],
 
-    "@shikijs/primitive": ["@shikijs/primitive@4.4.2", "", { "dependencies": { "@shikijs/types": "4.4.2", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.5" } }, "sha512-l6fQQKsOMlz72n38fztmSgZ76MO6KSWuw8o+GJ+FhmqrpC9pIOJNQNXGgbb5yX2AwpzlEHwsaLPnk/8o4Fm+rA=="],
+    "@shikijs/primitive": ["@shikijs/primitive@4.4.3", "", { "dependencies": { "@shikijs/types": "4.4.3", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.5" } }, "sha512-m0wBeLDQDeIxRdUmrCPdQqfuUamDwRL5isCfYbguKD6NiaKpVbsv+3J81DyIKgNW5h4WAIIr8T4EkgQrBBxvaQ=="],
 
-    "@shikijs/themes": ["@shikijs/themes@4.4.2", "", { "dependencies": { "@shikijs/types": "4.4.2" } }, "sha512-H0CFoL07ddDC2Dd6EdrPYNkRhUR6YCkJlnuYFceYYUJJA5TIm2b5B33qqiDYryBExgbKMndFJPb2u1gTuqO37g=="],
+    "@shikijs/themes": ["@shikijs/themes@4.4.3", "", { "dependencies": { "@shikijs/types": "4.4.3" } }, "sha512-w8UHjeUnIR965KMWJHUPXOc2mNJUnK3vpVLYLvw5IYU2mnTTJ89E24OrJDBNiJDQ0qzb0tc4l7mrIXx5cFeIyw=="],
 
-    "@shikijs/transformers": ["@shikijs/transformers@4.4.2", "", { "dependencies": { "@shikijs/core": "4.4.2", "@shikijs/types": "4.4.2" } }, "sha512-d81PJ9KkR1tVP95FH/9296HTtDo0mh76wv10u9T1YmsZq/UcXgt0OLdBszfUQ1i+umkRMCjDnFbFZU7/tCODTQ=="],
+    "@shikijs/transformers": ["@shikijs/transformers@4.4.3", "", { "dependencies": { "@shikijs/core": "4.4.3", "@shikijs/types": "4.4.3" } }, "sha512-oJSARV6NaWd+rnNJbtnpAdj3Zg0ZVyzsnMgb3vi3HA+35y8lBWUCpOnWsmyiXZIikY+x1BDqrQUgmxfzWh7Jvw=="],
 
-    "@shikijs/types": ["@shikijs/types@4.4.2", "", { "dependencies": { "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.5" } }, "sha512-PFYitV4vpDr/iPCIhnHp+Q4ftic5N5VeNJ3KQ1O8gn3h2ar8qgwMAXF7tq4m1CWaMS60fV4VqF6vfnWH4F7vqQ=="],
+    "@shikijs/types": ["@shikijs/types@4.4.3", "", { "dependencies": { "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.5" } }, "sha512-UEJxmRR++MAGR6hugn0vgVS2W/6lWAts84FFSrnlH9sP0LNol7E5+NQ792pH8liWUhyMyjhTgSUH3k7iD7tc5g=="],
 
     "@shikijs/vscode-textmate": ["@shikijs/vscode-textmate@10.0.2", "", {}, "sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg=="],
 
     "@sindresorhus/merge-streams": ["@sindresorhus/merge-streams@4.0.0", "", {}, "sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ=="],
 
+    "@smithy/core": ["@smithy/core@3.34.1", "", { "dependencies": { "@smithy/types": "^4.18.0", "tslib": "^2.6.2" } }, "sha512-dLcOUxz8YCv1RZUMKq6GbyUf95pLbrqh34bPvpCZ1+CByFF31BEAFewZjsGCnVsZTKdThNENfGyAgk2TJqVwSw=="],
+
+    "@smithy/credential-provider-imds": ["@smithy/credential-provider-imds@4.5.2", "", { "dependencies": { "@smithy/core": "^3.33.2", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-A9uSdn72ozbRUSit0eib0TW7nXuNPlaeM0zcGkJ+nE6tFcSDbnmtwoxbTCFBukVQcszDAyvsd7+rTduPTXpygg=="],
+
+    "@smithy/fetch-http-handler": ["@smithy/fetch-http-handler@5.8.0", "", { "dependencies": { "@smithy/core": "^3.33.3", "@smithy/types": "^4.18.0", "tslib": "^2.6.2" } }, "sha512-ycSJu3tFAQ4v04CBB0agqFMVsSQ1iG3yw+SpgxRqKfaURpQD4CZ8Wn0zPMmSnOuTpTh65Vz+EA0rMrw089wvkA=="],
+
+    "@smithy/node-http-handler": ["@smithy/node-http-handler@4.12.1", "", { "dependencies": { "@smithy/core": "^3.33.3", "@smithy/types": "^4.18.0", "tslib": "^2.6.2" } }, "sha512-ThMkboGeONWXAelq9FvGsuJC4rOi+qyC4/zhUF58xYpxUg5sQKx2VXZYJmtNjr4dSuBJ1HeJXETQILCz3wOHvw=="],
+
+    "@smithy/signature-v4": ["@smithy/signature-v4@5.7.3", "", { "dependencies": { "@smithy/core": "^3.33.3", "@smithy/types": "^4.17.2", "tslib": "^2.6.2" } }, "sha512-7ImGm+FkHRLcBaRttIAMZ6bzJZWb2cJGoYjq46F2UjycujWzrL9GEN9h4w7eQyXJYnltrUhxbbieBAIRrdqpow=="],
+
+    "@smithy/types": ["@smithy/types@4.18.0", "", { "dependencies": { "tslib": "^2.6.2" } }, "sha512-CgB6HHWer/vrKps24ulRIbpcpb7K4xAU7SkZ7YHzBPlwHsvsrCJFEXK421s+cJzX+ZrqtA/TuU5w1HzI7k9N8A=="],
+
     "@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
 
     "@standard-schema/utils": ["@standard-schema/utils@0.3.0", "", {}, "sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g=="],
 
-    "@superradcompany/microsandbox-darwin-arm64": ["@superradcompany/microsandbox-darwin-arm64@0.6.8", "", { "os": "darwin", "cpu": "arm64" }, "sha512-SbPo2mb5sEWY7Sry9lxlh762oX5G4RI4Xq2i6U9covTe+4MIFznNSCPIntoCcpzVwt4VNIukvEdyTsI9kITJLw=="],
+    "@superradcompany/microsandbox-darwin-arm64": ["@superradcompany/microsandbox-darwin-arm64@0.6.17", "", { "os": "darwin", "cpu": "arm64" }, "sha512-H+h+lNGlPWpt9qQ9k/MOFAApLFloA22zJAzormM1CSISkyaLBromH4bt9XlCP3nhG3/oHuYnO7FqhKZN+klVgA=="],
 
-    "@superradcompany/microsandbox-linux-arm64-gnu": ["@superradcompany/microsandbox-linux-arm64-gnu@0.6.8", "", { "os": "linux", "cpu": "arm64" }, "sha512-cMgS/pE6N2LTbdGYMNiSzfxlsD0F1fhVuCFuIULxGfGyK+zmrYHgTgV0K6n9UQY+PjseOvNn//T7FJQ7SwyJ3g=="],
+    "@superradcompany/microsandbox-linux-arm64-gnu": ["@superradcompany/microsandbox-linux-arm64-gnu@0.6.17", "", { "os": "linux", "cpu": "arm64" }, "sha512-j7YfBbVKDpF1fC38FPI0Ut1iThpUf0U4+I4IA+lBTyxo3ptux0b2ouY0CDSB+okrWTCe/kxgxUhgOKc9V3gOPA=="],
 
-    "@superradcompany/microsandbox-linux-x64-gnu": ["@superradcompany/microsandbox-linux-x64-gnu@0.6.8", "", { "os": "linux", "cpu": "x64" }, "sha512-JCYgBsCf00bX2RA7YhdFdNOQHsWJFXYM3WJi1ONx3jLdUpiMKAVRZxCSPJe/UrFoRiqfj49AmgIBNtvs+2Ns9g=="],
+    "@superradcompany/microsandbox-linux-x64-gnu": ["@superradcompany/microsandbox-linux-x64-gnu@0.6.17", "", { "os": "linux", "cpu": "x64" }, "sha512-o9IXJNWi1Ml9VMD0IAbLdUTeujbmY39z5reuez03Svxrqy8AlGGJoNR6Nh+oAm5p0Ytke8BChI9OlYcSFFCPHw=="],
 
-    "@superradcompany/microsandbox-win32-arm64-msvc": ["@superradcompany/microsandbox-win32-arm64-msvc@0.6.8", "", { "os": "win32", "cpu": "arm64" }, "sha512-cWXaHBleVZbTddVYiUSuChNbHWhzTnNkgBqhisSDcFa1FBa0g5sBzTBlcC0RAseMzs4F+6YqLbD040QOe/6deQ=="],
+    "@superradcompany/microsandbox-win32-arm64-msvc": ["@superradcompany/microsandbox-win32-arm64-msvc@0.6.17", "", { "os": "win32", "cpu": "arm64" }, "sha512-M2wdSTTEBRKJXpYX3P0+5tQJep17HY1p7UTFLxFsiWH+xEJ6z5RvYb1U2i5BvNVvyymkfBbh5rnyBSv8vnyDcg=="],
 
-    "@superradcompany/microsandbox-win32-x64-msvc": ["@superradcompany/microsandbox-win32-x64-msvc@0.6.8", "", { "os": "win32", "cpu": "x64" }, "sha512-Asfn+8+CplKh05MyJIoRJzLCl1Z05B/n6Lc6+tpfFKmHjMkQw976L67AqqBQq4AxfkakBcpZYVHZQqUDxl5Fow=="],
+    "@superradcompany/microsandbox-win32-x64-msvc": ["@superradcompany/microsandbox-win32-x64-msvc@0.6.17", "", { "os": "win32", "cpu": "x64" }, "sha512-1Acpg7zb7o+R1BRV2pWFyMAKTqm7YvMJFPMjAA6H69jAyPTVBdJw3TVCLiN2RR5lHLvV2EdHmx/awl9X5Oj8/g=="],
 
-    "@swc/helpers": ["@swc/helpers@0.5.15", "", { "dependencies": { "tslib": "^2.8.0" } }, "sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g=="],
+    "@swc/helpers": ["@swc/helpers@0.5.23", "", { "dependencies": { "tslib": "^2.8.0" } }, "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw=="],
 
     "@tailwindcss/node": ["@tailwindcss/node@4.3.3", "", { "dependencies": { "@jridgewell/remapping": "^2.3.5", "enhanced-resolve": "^5.24.1", "jiti": "^2.7.0", "lightningcss": "1.32.0", "magic-string": "^0.30.21", "source-map-js": "^1.2.1", "tailwindcss": "4.3.3" } }, "sha512-/T8IKEsf9VTU6tLjgC7+sv2mOPtQxzE2jMw7u4Tt40Tx+QSZxpzh95/H6cMKoja9XuW7iMdLJYBB0o9G1CaAgg=="],
 
@@ -988,15 +1105,15 @@
 
     "@tailwindcss/postcss": ["@tailwindcss/postcss@4.3.3", "", { "dependencies": { "@alloc/quick-lru": "^5.2.0", "@tailwindcss/node": "4.3.3", "@tailwindcss/oxide": "4.3.3", "postcss": "^8.5.16", "tailwindcss": "4.3.3" } }, "sha512-JTSZZGQi1AyKirbLN3azmjVzef92tcX7h+iSqPdaeStyFpGpDlKvvpxeOE8njhbUanbRwr3z8DyzhICWnMtQeg=="],
 
-    "@tanstack/query-core": ["@tanstack/query-core@5.101.4", "", {}, "sha512-gNwcvOJcRbLWPOLG/2OBm+zM+Yv+MKsXKEOWC57USuZDEsI71hEErQsiEGx5wX9rzWWkfwM0fVSPoiIFSsxfiw=="],
+    "@tanstack/query-core": ["@tanstack/query-core@5.102.8", "", {}, "sha512-ZNjkJ33CqvPNec/6lZBnHqLc3EVGPZ9ySLhYahU9TcuRFdmwXewuj0c4hwSWcGHqEUwcSrKeZ+oGcvPBqXcQcg=="],
 
-    "@tanstack/query-devtools": ["@tanstack/query-devtools@5.101.4", "", {}, "sha512-z5IPHnDX3aUWeTWlRKLyooBQekaCAw4xRpZqPQ390RiWTDBcTynjpPT221BArw0u2+pnQMdGvPQI9YNNubBcmA=="],
+    "@tanstack/query-devtools": ["@tanstack/query-devtools@5.102.8", "", {}, "sha512-ZgeMKuF5d/zOE+tgWm3cSbD6Zcbr6IugVsnbHzUcSismqLZDSUPBKM6ILUxExgwe6rPAOox2x5bA5T+PSOQG0Q=="],
 
-    "@tanstack/react-query": ["@tanstack/react-query@5.101.4", "", { "dependencies": { "@tanstack/query-core": "5.101.4" }, "peerDependencies": { "react": "^18 || ^19" } }, "sha512-yRg2pfOCxIs4ZJW3XYYHU/WgtD04FHSnfHlpRT7h7pR77hwkdRG4wxbKe4aq6P0RvXUTBSQpQeadS1SUYUe+KA=="],
+    "@tanstack/react-query": ["@tanstack/react-query@5.102.8", "", { "dependencies": { "@tanstack/query-core": "5.102.8" }, "peerDependencies": { "react": "^18 || ^19" } }, "sha512-TYBea4OuXWD7MhaSHq069TWbFe7rcwWN6kzT7JF0OKi1K6c1gTv2IzD6A6ExJsCMozdkqBWeuIUZmu4KQg0O5A=="],
 
-    "@tanstack/react-query-devtools": ["@tanstack/react-query-devtools@5.101.4", "", { "dependencies": { "@tanstack/query-devtools": "5.101.4" }, "peerDependencies": { "@tanstack/react-query": "^5.101.4", "react": "^18 || ^19" } }, "sha512-VeK2gtmfj7kvRBjtxS7TKxt/6qKhn8VzabY4UiYMr7NV9CddjSRYRgeYyld+NpjAkgMV9dd+2Qdr8ah5I03NeA=="],
+    "@tanstack/react-query-devtools": ["@tanstack/react-query-devtools@5.102.8", "", { "dependencies": { "@tanstack/query-devtools": "5.102.8" }, "peerDependencies": { "@tanstack/react-query": "^5.102.8", "react": "^18 || ^19" } }, "sha512-QKb7A44BZOU7nxsGA4gFN1fofjYovar5O0T83Ff4Y+2eRq09RGFrAzzutVdF/6/emfSaMDohp6e759BjB3fxEw=="],
 
-    "@thallesp/nestjs-better-auth": ["@thallesp/nestjs-better-auth@2.7.0", "", { "peerDependencies": { "@nestjs/common": "^11.1.6", "@nestjs/core": "^11.1.6", "@nestjs/graphql": "^13.1.0", "@nestjs/websockets": "^11.1.6", "better-auth": ">=1.5.0 <2.0.0", "express": "^5.1.0", "graphql": "^16.11.0", "qs": "^6.14.0", "typescript": "^5.9.2 || ^6.0.0" }, "optionalPeers": ["@nestjs/graphql", "@nestjs/websockets", "express", "graphql", "qs"] }, "sha512-Grq74scQ4AdEjrAr9mE8780u9N4fn+X/qz7DTHa/K37g+RPw+R3Yde4leRz/UIqsLx0o8p1B5wRGPnM65Q+ZsQ=="],
+    "@thallesp/nestjs-better-auth": ["@thallesp/nestjs-better-auth@2.8.0", "", { "peerDependencies": { "@nestjs/common": "^11.1.6 || ^12.0.0", "@nestjs/core": "^11.1.6 || ^12.0.0", "@nestjs/graphql": "^13.1.0 || ^14.0.0", "@nestjs/websockets": "^11.1.6 || ^12.0.0", "better-auth": ">=1.5.0 <2.0.0", "express": "^5.1.0", "graphql": "^16.11.0", "qs": "^6.14.0", "typescript": "^5.9.2 || ^6.0.0" }, "optionalPeers": ["@nestjs/graphql", "@nestjs/websockets", "express", "graphql", "qs"] }, "sha512-B5K8Nlr0BH/tFJAPJAPefC09gKSSFofgmSTQx6XFeWDgPcG6awTh9iRFlv9it0skYgcCD2fXr53ChgXjLse0pw=="],
 
     "@tokenizer/inflate": ["@tokenizer/inflate@0.4.1", "", { "dependencies": { "debug": "^4.4.3", "token-types": "^6.1.1" } }, "sha512-2mAv+8pkG6GIZiF1kNg1jAjh27IDxEPKwdGul3snfztFerfPGI1LjDezZp3i7BElXompqEtPmoPx6c2wgtWsOA=="],
 
@@ -1010,90 +1127,54 @@
 
     "@ts-morph/common": ["@ts-morph/common@0.27.0", "", { "dependencies": { "fast-glob": "^3.3.3", "minimatch": "^10.0.1", "path-browserify": "^1.0.1" } }, "sha512-Wf29UqxWDpc+i61k3oIOzcUfQt79PIT9y/MWfAGlrkjg6lBC1hwDECLXPVJAhWjiGbfBCxZd65F/LIZF3+jeJQ=="],
 
-    "@turbo/darwin-64": ["@turbo/darwin-64@2.10.8", "", { "os": "darwin", "cpu": "x64" }, "sha512-po+7rfJfUnFXjWlcoN2RwhErgzCdRtBc1T26vYPcywHlggmCQiQe1uWaE4j+BibI2uY9/2pDoFzMN0rmSaPFOw=="],
+    "@turbo/darwin-64": ["@turbo/darwin-64@2.10.12", "", { "os": "darwin", "cpu": "x64" }, "sha512-9nKgKoF6ZOUsM+or0OtNf+TTJSfGvDNP7ZFv/ZGWVwOSCkumyctQiTeHwB4UNljHTnC41AqylgbunLDHoccNrA=="],
 
-    "@turbo/darwin-arm64": ["@turbo/darwin-arm64@2.10.8", "", { "os": "darwin", "cpu": "arm64" }, "sha512-+zB2btDJ00lnPRuqOvpVvgl4x34k/djZQGZTTCfjn7JgNCl8QFY5Njo5+dqkY1g/+9gbbsnAvWm9CmJg9ebcXA=="],
+    "@turbo/darwin-arm64": ["@turbo/darwin-arm64@2.10.12", "", { "os": "darwin", "cpu": "arm64" }, "sha512-H4Elb1jqTZVeIC9bbcNwjSzemZ6RegoTOVHeuV5Osirt2Z8UguTyisMEkvZjPVZgMeN9J4ERZBFad40tFnkb7w=="],
 
-    "@turbo/linux-64": ["@turbo/linux-64@2.10.8", "", { "os": [ "linux", "android", ], "cpu": "x64" }, "sha512-K1dxqiVisyN7cViVsfQLs6xscQbYuI8aO2nbUhFURDACgEDfZRdP/b4CCxeosBJpcMfhYyiibWqJorCnvz9kKg=="],
+    "@turbo/linux-64": ["@turbo/linux-64@2.10.12", "", { "os": [ "linux", "android", ], "cpu": "x64" }, "sha512-lr7KIotukvjZwEXiFSYAeOH3BWzjFVBbSzTbv0fuGFsNukYyH0+g1hB5ecqnJkgkYU+KHEMG1edOhnjiKON1wQ=="],
 
-    "@turbo/linux-arm64": ["@turbo/linux-arm64@2.10.8", "", { "os": [ "linux", "android", ], "cpu": "arm64" }, "sha512-Gi77ibVnrE1fEmvr+/wBD/yvRqhwp/RQuCp2+//lv1U1wNFFyVg0V7Wj8FG9FXPFAw5QHReo8rxc9+wBSDZjzA=="],
+    "@turbo/linux-arm64": ["@turbo/linux-arm64@2.10.12", "", { "os": [ "linux", "android", ], "cpu": "arm64" }, "sha512-f0pZDTtvzB5SuNwuXBaKbZHUCMCukgc8nMlHEuvLmj91Fzec+MEbr3cAvGNor5htEDqZnO6Lxt9N/GPI/77oGA=="],
 
-    "@turbo/windows-64": ["@turbo/windows-64@2.10.8", "", { "os": "win32", "cpu": "x64" }, "sha512-znnLO1haJPYTHoKMKwlAvlkjRiYbbhBzME6wIGaMd+fwir23U6jVd1ecaTWWi1fbnRVqxMfgDBKseQ/hLKb83g=="],
+    "@turbo/windows-64": ["@turbo/windows-64@2.10.12", "", { "os": "win32", "cpu": "x64" }, "sha512-SDOueJRjS/QcykWf2KCRtTLmIl5YMKsLbXkXQGhDwcTXvKXZiS5ih5lBl/gkwZIpYFjqA/rAlfMzlAFcVHNe0g=="],
 
-    "@turbo/windows-arm64": ["@turbo/windows-arm64@2.10.8", "", { "os": "win32", "cpu": "arm64" }, "sha512-VN30vh3b3Czh2WzYHNTfF1FE0YMZ5aHsLO8dBMGHJewA6792wX6iJR8ZxlzFW6WdOu0gEAKIvlYhfyT81Wkm4Q=="],
+    "@turbo/windows-arm64": ["@turbo/windows-arm64@2.10.12", "", { "os": "win32", "cpu": "arm64" }, "sha512-0i0mVUa4kKk+/B3RwEwPMf9CB+T7ul56hn5FFHNA4VUNTOoLBEd6aNf3FaKfCatDNZ6cicCEf6if9QUTVyzzcA=="],
 
-    "@tybys/wasm-util": ["@tybys/wasm-util@0.10.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg=="],
+    "@tybys/wasm-util": ["@tybys/wasm-util@0.10.4", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-W3c4gRigFS0T/Ma4qIYF3GDAc5AQdHb1yL5znJT1Zv1YaD9Kitx656wBjvr19qbiosmZT8lWDM5BEMynUqX65A=="],
 
     "@types/body-parser": ["@types/body-parser@1.19.6", "", { "dependencies": { "@types/connect": "*", "@types/node": "*" } }, "sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g=="],
 
-    "@types/bun": ["@types/bun@1.3.14", "", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="],
+    "@types/bun": ["@types/bun@1.4.2", "", { "dependencies": { "bun-types": "1.4.2" } }, "sha512-GimotNn7+ZV0uVArItBbriZsR1oNf0+WTzPkdcFrzShI7k2norL0uzEaJT8T33dWr7O/c9ZDuAFQrctKCi72oQ=="],
 
     "@types/connect": ["@types/connect@3.4.38", "", { "dependencies": { "@types/node": "*" } }, "sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug=="],
 
     "@types/cookiejar": ["@types/cookiejar@2.1.5", "", {}, "sha512-he+DHOWReW0nghN24E1WUqM0efK4kI9oTqDm6XmK8ZPe2djZ90BSNdGnIyCLzCPw7/pogPlGbzI2wHGGmi4O/Q=="],
 
-    "@types/d3": ["@types/d3@7.4.3", "", { "dependencies": { "@types/d3-array": "*", "@types/d3-axis": "*", "@types/d3-brush": "*", "@types/d3-chord": "*", "@types/d3-color": "*", "@types/d3-contour": "*", "@types/d3-delaunay": "*", "@types/d3-dispatch": "*", "@types/d3-drag": "*", "@types/d3-dsv": "*", "@types/d3-ease": "*", "@types/d3-fetch": "*", "@types/d3-force": "*", "@types/d3-format": "*", "@types/d3-geo": "*", "@types/d3-hierarchy": "*", "@types/d3-interpolate": "*", "@types/d3-path": "*", "@types/d3-polygon": "*", "@types/d3-quadtree": "*", "@types/d3-random": "*", "@types/d3-scale": "*", "@types/d3-scale-chromatic": "*", "@types/d3-selection": "*", "@types/d3-shape": "*", "@types/d3-time": "*", "@types/d3-time-format": "*", "@types/d3-timer": "*", "@types/d3-transition": "*", "@types/d3-zoom": "*" } }, "sha512-lZXZ9ckh5R8uiFVt8ogUNf+pIrK4EsWrx2Np75WvF/eTpJ0FMHNhjXk8CKEx/+gpHbNQyJWehbFaTvqmHWB3ww=="],
-
-    "@types/d3-array": ["@types/d3-array@3.0.3", "", {}, "sha512-Reoy+pKnvsksN0lQUlcH6dOGjRZ/3WRwXR//m+/8lt1BXeI4xyaUZoqULNjyXXRuh0Mj4LNpkCvhUpQlY3X5xQ=="],
-
-    "@types/d3-axis": ["@types/d3-axis@3.0.6", "", { "dependencies": { "@types/d3-selection": "*" } }, "sha512-pYeijfZuBd87T0hGn0FO1vQ/cgLk6E1ALJjfkC0oJ8cbwkZl3TpgS8bVBLZN+2jjGgg38epgxb2zmoGtSfvgMw=="],
-
-    "@types/d3-brush": ["@types/d3-brush@3.0.6", "", { "dependencies": { "@types/d3-selection": "*" } }, "sha512-nH60IZNNxEcrh6L1ZSMNA28rj27ut/2ZmI3r96Zd+1jrZD++zD3LsMIjWlvg4AYrHn/Pqz4CF3veCxGjtbqt7A=="],
-
-    "@types/d3-chord": ["@types/d3-chord@3.0.6", "", {}, "sha512-LFYWWd8nwfwEmTZG9PfQxd17HbNPksHBiJHaKuY1XeqscXacsS2tyoo6OdRsjf+NQYeB6XrNL3a25E3gH69lcg=="],
-
-    "@types/d3-color": ["@types/d3-color@3.1.0", "", {}, "sha512-HKuicPHJuvPgCD+np6Se9MQvS6OCbJmOjGvylzMJRlDwUXjKTTXs6Pwgk79O09Vj/ho3u1ofXnhFOaEWWPrlwA=="],
+    "@types/d3-array": ["@types/d3-array@3.2.2", "", {}, "sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw=="],
 
-    "@types/d3-contour": ["@types/d3-contour@3.0.6", "", { "dependencies": { "@types/d3-array": "*", "@types/geojson": "*" } }, "sha512-BjzLgXGnCWjUSYGfH1cpdo41/hgdWETu4YxpezoztawmqsvCeep+8QGfiY6YbDvfgHz/DkjeIkkZVJavB4a3rg=="],
+    "@types/d3-color": ["@types/d3-color@3.1.3", "", {}, "sha512-iO90scth9WAbmgv7ogoq57O9YpKmFBbmoEoCHDB2xMBY0+/KVrqAaCDyCE16dUspeOvIxFFRI+0sEtqDqy2b4A=="],
 
     "@types/d3-delaunay": ["@types/d3-delaunay@6.0.1", "", {}, "sha512-tLxQ2sfT0p6sxdG75c6f/ekqxjyYR0+LwPrsO1mbC9YDBzPJhs2HbJJRrn8Ez1DBoHRo2yx7YEATI+8V1nGMnQ=="],
 
-    "@types/d3-dispatch": ["@types/d3-dispatch@3.0.7", "", {}, "sha512-5o9OIAdKkhN1QItV2oqaE5KMIiXAvDWBDPrD85e58Qlz1c1kI/J0NcqbEG88CoTwJrYe7ntUCVfeUl2UJKbWgA=="],
-
-    "@types/d3-drag": ["@types/d3-drag@3.0.7", "", { "dependencies": { "@types/d3-selection": "*" } }, "sha512-HE3jVKlzU9AaMazNufooRJ5ZpWmLIoc90A37WU2JMmeq28w1FQqCZswHZ3xR+SuxYftzHq6WU6KJHvqxKzTxxQ=="],
-
-    "@types/d3-dsv": ["@types/d3-dsv@3.0.7", "", {}, "sha512-n6QBF9/+XASqcKK6waudgL0pf/S5XHPPI8APyMLLUHd8NqouBGLsU8MgtO7NINGtPBtk9Kko/W4ea0oAspwh9g=="],
-
     "@types/d3-ease": ["@types/d3-ease@3.0.2", "", {}, "sha512-NcV1JjO5oDzoK26oMzbILE6HW7uVXOHLQvHshBUW4UMdZGfiY6v5BeQwh9a9tCzv+CeefZQHJt5SRgK154RtiA=="],
 
-    "@types/d3-fetch": ["@types/d3-fetch@3.0.7", "", { "dependencies": { "@types/d3-dsv": "*" } }, "sha512-fTAfNmxSb9SOWNB9IoG5c8Hg6R+AzUHDRlsXsDZsNp6sxAEOP0tkP3gKkNSO/qmHPoBFTxNrjDprVHDQDvo5aA=="],
-
-    "@types/d3-force": ["@types/d3-force@3.0.10", "", {}, "sha512-ZYeSaCF3p73RdOKcjj+swRlZfnYpK1EbaDiYICEEp5Q6sUiqFaFQ9qgoshp5CzIyyb/yD09kD9o2zEltCexlgw=="],
-
     "@types/d3-format": ["@types/d3-format@3.0.1", "", {}, "sha512-5KY70ifCCzorkLuIkDe0Z9YTf9RR2CjBX1iaJG+rgM/cPP+sO+q9YdQ9WdhQcgPj1EQiJ2/0+yUkkziTG6Lubg=="],
 
     "@types/d3-geo": ["@types/d3-geo@3.1.0", "", { "dependencies": { "@types/geojson": "*" } }, "sha512-856sckF0oP/diXtS4jNsiQw/UuK5fQG8l/a9VVLeSouf1/PPbBE1i1W852zVwKwYCBkFJJB7nCFTbk6UMEXBOQ=="],
 
-    "@types/d3-hierarchy": ["@types/d3-hierarchy@3.1.7", "", {}, "sha512-tJFtNoYBtRtkNysX1Xq4sxtjK8YgoWUNpIiUee0/jHGRwqvzYxkq0hGVbbOGSz+JgFxxRu4K8nb3YpG3CMARtg=="],
-
-    "@types/d3-interpolate": ["@types/d3-interpolate@3.0.1", "", { "dependencies": { "@types/d3-color": "*" } }, "sha512-jx5leotSeac3jr0RePOH1KdR9rISG91QIE4Q2PYTu4OymLTZfA3SrnURSLzKH48HmXVUru50b8nje4E79oQSQw=="],
+    "@types/d3-interpolate": ["@types/d3-interpolate@3.0.4", "", { "dependencies": { "@types/d3-color": "*" } }, "sha512-mgLPETlrpVV1YRJIglr4Ez47g7Yxjl1lj7YKsiMCb27VJH9W8NVM6Bb9d8kkpG/uAQS5AmbA48q2IAolKKo1MA=="],
 
     "@types/d3-path": ["@types/d3-path@3.1.1", "", {}, "sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg=="],
 
-    "@types/d3-polygon": ["@types/d3-polygon@3.0.2", "", {}, "sha512-ZuWOtMaHCkN9xoeEMr1ubW2nGWsp4nIql+OPQRstu4ypeZ+zk3YKqQT0CXVe/PYqrKpZAi+J9mTs05TKwjXSRA=="],
+    "@types/d3-scale": ["@types/d3-scale@4.0.9", "", { "dependencies": { "@types/d3-time": "*" } }, "sha512-dLmtwB8zkAeO/juAMfnV+sItKjlsw2lKdZVVy6LRr0cBmegxSABiLEpGVmSJJ8O08i4+sGR6qQtb6WtuwJdvVw=="],
 
-    "@types/d3-quadtree": ["@types/d3-quadtree@3.0.6", "", {}, "sha512-oUzyO1/Zm6rsxKRHA1vH0NEDG58HrT5icx/azi9MF1TWdtttWl0UIUsjEQBBh+SIkrpd21ZjEv7ptxWys1ncsg=="],
+    "@types/d3-shape": ["@types/d3-shape@3.2.0", "", { "dependencies": { "@types/d3-path": "*" } }, "sha512-kVd74ta9eof3eJOvbNd1vGKS/XERRyQbT26Og63hIsvDO84cjD5gEOhsXf26w3FSoNlPVz84DOFcKv/oou+fMw=="],
 
-    "@types/d3-random": ["@types/d3-random@3.0.4", "", {}, "sha512-UHYId5WTCx4L4YNel7NU00XUXXgvgpgZOvp10PuvsQENjMDXhh2RyFc0KBjO7B45ne4Ha1yVH7ii0vnzKkuzWA=="],
-
-    "@types/d3-scale": ["@types/d3-scale@4.0.2", "", { "dependencies": { "@types/d3-time": "*" } }, "sha512-Yk4htunhPAwN0XGlIwArRomOjdoBFXC3+kCxK2Ubg7I9shQlVSJy/pG/Ht5ASN+gdMIalpk8TJ5xV74jFsetLA=="],
-
-    "@types/d3-scale-chromatic": ["@types/d3-scale-chromatic@3.1.0", "", {}, "sha512-iWMJgwkK7yTRmWqRB5plb1kadXyQ5Sj8V/zYlFGMUBbIPKQScw+Dku9cAAMgJG+z5GYDoMjWGLVOvjghDEFnKQ=="],
-
-    "@types/d3-selection": ["@types/d3-selection@3.0.11", "", {}, "sha512-bhAXu23DJWsrI45xafYpkQ4NtcKMwWnAC/vKrd2l+nxMFuvOT3XMYTIj2opv8vq8AO5Yh7Qac/nSeP/3zjTK0w=="],
-
-    "@types/d3-shape": ["@types/d3-shape@3.1.7", "", { "dependencies": { "@types/d3-path": "*" } }, "sha512-VLvUQ33C+3J+8p+Daf+nYSOsjB4GXp19/S/aGo60m9h1v6XaxjiT82lKVWJCfzhtuZ3yD7i/TPeC/fuKLLOSmg=="],
-
-    "@types/d3-time": ["@types/d3-time@3.0.0", "", {}, "sha512-sZLCdHvBUcNby1cB6Fd3ZBrABbjz3v1Vm90nysCQ6Vt7vd6e/h9Lt7SiJUoEX0l4Dzc7P5llKyhqSi1ycSf1Hg=="],
+    "@types/d3-time": ["@types/d3-time@3.0.4", "", {}, "sha512-yuzZug1nkAAaBlBBikKZTgzCeA+k1uy4ZFwWANOfKw5z5LRhV0gNA7gNkKm7HoK+HRN0wX3EkxGk0fpbWhmB7g=="],
 
     "@types/d3-time-format": ["@types/d3-time-format@2.1.0", "", {}, "sha512-/myT3I7EwlukNOX2xVdMzb8FRgNzRMpsZddwst9Ld/VFe6LyJyRp0s32l/V9XoUzk+Gqu56F/oGk6507+8BxrA=="],
 
     "@types/d3-timer": ["@types/d3-timer@3.0.2", "", {}, "sha512-Ps3T8E8dZDam6fUyNiMkekK3XUsaUEik+idO9/YjPtfj2qruF8tFBXS7XhtE4iIXBLxhmLjP3SXpLhVf21I9Lw=="],
 
-    "@types/d3-transition": ["@types/d3-transition@3.0.9", "", { "dependencies": { "@types/d3-selection": "*" } }, "sha512-uZS5shfxzO3rGlu0cC3bjmMFKsXv+SmZZcgp0KD22ts4uGXp5EVYGzu/0YdwZeKmddhcAccYtREJKkPfXkZuCg=="],
-
-    "@types/d3-zoom": ["@types/d3-zoom@3.0.8", "", { "dependencies": { "@types/d3-interpolate": "*", "@types/d3-selection": "*" } }, "sha512-iqMC4/YlFCSlO8+2Ii1GGGliCAY4XdeG748w5vQUbevlbDu0zSjH/+jojorQVBK/se0j6DUFNPBGSqD3YWYnDw=="],
-
     "@types/debug": ["@types/debug@4.1.13", "", { "dependencies": { "@types/ms": "*" } }, "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw=="],
 
     "@types/estree": ["@types/estree@1.0.9", "", {}, "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg=="],
@@ -1102,7 +1183,7 @@
 
     "@types/express": ["@types/express@5.0.6", "", { "dependencies": { "@types/body-parser": "*", "@types/express-serve-static-core": "^5.0.0", "@types/serve-static": "^2" } }, "sha512-sKYVuV7Sv9fbPIt/442koC7+IIwK5olP1KWeD88e/idgoJqDm3JV/YUiPwkoKK92ylff2MGxSz1CSjsXelx0YA=="],
 
-    "@types/express-serve-static-core": ["@types/express-serve-static-core@5.1.2", "", { "dependencies": { "@types/node": "*", "@types/qs": "*", "@types/range-parser": "*", "@types/send": "*" } }, "sha512-d3KvEXBSo/lOAMc2u6fkyDHBvetBHeqD7wm/AcXfLpSOQwlmG9D/aQ0SFswVjv05p7ullQS7Mjohj6/VdbZuTg=="],
+    "@types/express-serve-static-core": ["@types/express-serve-static-core@5.1.3", "", { "dependencies": { "@types/node": "*", "@types/qs": "*", "@types/range-parser": "*", "@types/send": "*" } }, "sha512-dPfW8NFiOF4wOHc7+N/QSxlY9cfSsenewGbAz8C8U/MULPd/YZ27LvJUIlzaXie7e6Ove9YunJGgC9tbHD2cKw=="],
 
     "@types/geojson": ["@types/geojson@7946.0.16", "", {}, "sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg=="],
 
@@ -1110,7 +1191,7 @@
 
     "@types/http-errors": ["@types/http-errors@2.0.5", "", {}, "sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg=="],
 
-    "@types/lodash": ["@types/lodash@4.17.24", "", {}, "sha512-gIW7lQLZbue7lRSWEFql49QJJWThrTFFeIMJdp3eH4tKoxm1OvEPg02rm4wCCSHS0cL3/Fizimb35b7k8atwsQ=="],
+    "@types/lodash": ["@types/lodash@4.17.25", "", {}, "sha512-+K1NIO8I+F9/wNulfVvu23QYd0Pe9/OCqRrim4NoYIf1VoEDL90Ve4ClzpyqBLc7NpGGWRvYNCKZ1BE/Jpf8dQ=="],
 
     "@types/mdast": ["@types/mdast@4.0.4", "", { "dependencies": { "@types/unist": "*" } }, "sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA=="],
 
@@ -1118,17 +1199,17 @@
 
     "@types/ms": ["@types/ms@2.1.0", "", {}, "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA=="],
 
-    "@types/node": ["@types/node@24.13.3", "", { "dependencies": { "undici-types": "~7.18.0" } }, "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q=="],
+    "@types/node": ["@types/node@26.5.1", "", { "dependencies": { "undici-types": "~8.9.0" } }, "sha512-CzNm2FezW4VR/LjG6yUdiEgLE/rAQ9Slj5gCu/C2VrdcW7I0ahNZ8DRbHT7zOZ6r3ONgd/bsQIeSaoDGrd1C6g=="],
 
-    "@types/pg": ["@types/pg@8.20.0", "", { "dependencies": { "@types/node": "*", "pg-protocol": "*", "pg-types": "^2.2.0" } }, "sha512-bEPFOaMAHTEP1EzpvHTbmwR8UsFyHSKsRisLIHVMXnpNefSbGA1bD6CVy+qKjGSqmZqNqBDV2azOBo8TgkcVow=="],
+    "@types/pg": ["@types/pg@8.23.1", "", { "dependencies": { "@types/node": "*", "pg-protocol": "*", "pg-types": "^2.2.0" } }, "sha512-fKVHpikPdg4GKks3JuLEhvwSyvwzF23hnabPy6DD8ljVbC7+6J5dQzdv4arV6jqq57djnMgs1HKBxX4P8aBI3A=="],
 
     "@types/qs": ["@types/qs@6.15.1", "", {}, "sha512-GZHUBZR9hckSUhrxmp1nG6NwdpM9fCunJwyThLW1X3AyHgd9IlHb6VANpQQqDr2o/qQp6McZ3y/IA2rVzKzSbw=="],
 
     "@types/range-parser": ["@types/range-parser@1.2.7", "", {}, "sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ=="],
 
-    "@types/react": ["@types/react@19.2.18", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-AnzbBERsrLKtk2XSfTbYRLjQPdy116Sty4q+T+Bp3IC4l6jNBvreVPAHmpq9qhXQM7CXZPjLVmGMw9sy+hxQ3w=="],
+    "@types/react": ["@types/react@19.3.0", "", { "dependencies": { "csstype": "^3.2.2" } }, "sha512-N0rFCuH9YoxG9/m61l9MfpJKfmLOVU0em7ipIz6TRgSSkvReLB9vL85GB+yr8Bs5leqpvg96JSwF4ZS1s4viQg=="],
 
-    "@types/react-dom": ["@types/react-dom@19.2.4", "", { "peerDependencies": { "@types/react": "^19.2.0" } }, "sha512-Bsc+QHgp+P/F02XDzNCY9jnZNCUuLki36KT7VKrTXXLdHf+vHMNZnW1rVu5DNW/rCK+fya3DATySbLM4yhtKUw=="],
+    "@types/react-dom": ["@types/react-dom@19.2.7", "", { "peerDependencies": { "@types/react": "^19.2.0" } }, "sha512-I8bPpDLcHBv1qiIiXDCy71Rt8eQDKJP0sMSWJphDdAcdqiJ1sGpZamavoEIRZmYzjia9LuEb2HlYdDpmoENpvQ=="],
 
     "@types/send": ["@types/send@1.2.1", "", { "dependencies": { "@types/node": "*" } }, "sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ=="],
 
@@ -1148,17 +1229,55 @@
 
     "@types/validator": ["@types/validator@13.15.10", "", {}, "sha512-T8L6i7wCuyoK8A/ZeLYt1+q0ty3Zb9+qbSSvrIVitzT3YjZqkTZ40IbRsPanlB4h1QB3JVL1SYCdR6ngtFYcuA=="],
 
-    "@ungap/structured-clone": ["@ungap/structured-clone@1.3.3", "", {}, "sha512-60YRaenCQcVjYEKOcG824+DRGGIQ3VKErcBoAEDJZz5bKIs2ZG+X/H9Nk+Q6EVkwJk5QNApxbrc5QtBSwtrXAg=="],
+    "@typescript/typescript-aix-ppc64": ["@typescript/typescript-aix-ppc64@7.0.2", "", { "os": "aix", "cpu": "ppc64" }, "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ=="],
+
+    "@typescript/typescript-darwin-arm64": ["@typescript/typescript-darwin-arm64@7.0.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA=="],
+
+    "@typescript/typescript-darwin-x64": ["@typescript/typescript-darwin-x64@7.0.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA=="],
+
+    "@typescript/typescript-freebsd-arm64": ["@typescript/typescript-freebsd-arm64@7.0.2", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ=="],
+
+    "@typescript/typescript-freebsd-x64": ["@typescript/typescript-freebsd-x64@7.0.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw=="],
+
+    "@typescript/typescript-linux-arm": ["@typescript/typescript-linux-arm@7.0.2", "", { "os": "linux", "cpu": "arm" }, "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ=="],
+
+    "@typescript/typescript-linux-arm64": ["@typescript/typescript-linux-arm64@7.0.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ=="],
+
+    "@typescript/typescript-linux-loong64": ["@typescript/typescript-linux-loong64@7.0.2", "", { "os": "linux", "cpu": "none" }, "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ=="],
+
+    "@typescript/typescript-linux-mips64el": ["@typescript/typescript-linux-mips64el@7.0.2", "", { "os": "linux", "cpu": "none" }, "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA=="],
+
+    "@typescript/typescript-linux-ppc64": ["@typescript/typescript-linux-ppc64@7.0.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA=="],
+
+    "@typescript/typescript-linux-riscv64": ["@typescript/typescript-linux-riscv64@7.0.2", "", { "os": "linux", "cpu": "none" }, "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ=="],
+
+    "@typescript/typescript-linux-s390x": ["@typescript/typescript-linux-s390x@7.0.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw=="],
+
+    "@typescript/typescript-linux-x64": ["@typescript/typescript-linux-x64@7.0.2", "", { "os": "linux", "cpu": "x64" }, "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A=="],
+
+    "@typescript/typescript-netbsd-arm64": ["@typescript/typescript-netbsd-arm64@7.0.2", "", { "os": "none", "cpu": "arm64" }, "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA=="],
+
+    "@typescript/typescript-netbsd-x64": ["@typescript/typescript-netbsd-x64@7.0.2", "", { "os": "none", "cpu": "x64" }, "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA=="],
+
+    "@typescript/typescript-openbsd-arm64": ["@typescript/typescript-openbsd-arm64@7.0.2", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ=="],
+
+    "@typescript/typescript-openbsd-x64": ["@typescript/typescript-openbsd-x64@7.0.2", "", { "os": "openbsd", "cpu": "x64" }, "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg=="],
 
-    "@upsetjs/venn.js": ["@upsetjs/venn.js@2.0.0", "", { "optionalDependencies": { "d3-selection": "^3.0.0", "d3-transition": "^3.0.1" } }, "sha512-WbBhLrooyePuQ1VZxrJjtLvTc4NVfpOyKx0sKqioq9bX1C1m7Jgykkn8gLrtwumBioXIqam8DLxp88Adbue6Hw=="],
+    "@typescript/typescript-sunos-x64": ["@typescript/typescript-sunos-x64@7.0.2", "", { "os": "sunos", "cpu": "x64" }, "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g=="],
 
-    "@vercel/blob": ["@vercel/blob@2.6.1", "", { "dependencies": { "@vercel/oidc": "^3.6.1", "async-retry": "^1.3.3", "is-buffer": "^2.0.5", "is-node-process": "^1.2.0", "throttleit": "^2.1.0", "undici": "^6.23.0" } }, "sha512-KTJytw85j1XQBxjN5d6UXI7fIWNQe1jotn4nWN+0hePqLs+Qi1B3jHdQcSKFGF0m2rsy9uhPT6GOXMtHe3qNzg=="],
+    "@typescript/typescript-win32-arm64": ["@typescript/typescript-win32-arm64@7.0.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ=="],
 
-    "@vercel/cli-config": ["@vercel/cli-config@0.2.1", "", { "dependencies": { "xdg-app-paths": "5", "zod": "4.1.11" } }, "sha512-RhfyXmRLHdbnry8RJqHDc+5rGxMZ0bu+fpysZjtv3bE+BubpuwxTancHOKiH5zKQREsdwFVr3mOI2kOvxlOyxA=="],
+    "@typescript/typescript-win32-x64": ["@typescript/typescript-win32-x64@7.0.2", "", { "os": "win32", "cpu": "x64" }, "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g=="],
 
-    "@vercel/cli-exec": ["@vercel/cli-exec@1.0.0", "", { "dependencies": { "execa": "5.1.1" } }, "sha512-kQF8LGie/Hbdq9/psJxLE7owRTcqMQMhgybU04gCeR7cbQAr5t8OrjefDNColJv1QSSucFt4pLwRiARVmlOnug=="],
+    "@ungap/structured-clone": ["@ungap/structured-clone@1.4.0", "", {}, "sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ=="],
 
-    "@vercel/oidc": ["@vercel/oidc@3.8.1", "", { "dependencies": { "@vercel/cli-config": "0.2.1", "@vercel/cli-exec": "1.0.0", "jose": "^5.9.6" } }, "sha512-ufdalm2MWOYksyj8KVpWjoOFPJO6zoYpuyvIggIQ2bB0CFCjTCiTkGXHqAKwG77GVRjOaN3/8S5ITlZpXWmqOw=="],
+    "@vercel/blob": ["@vercel/blob@2.8.0", "", { "dependencies": { "@vercel/oidc": "^3.6.1", "async-retry": "^1.3.3", "is-buffer": "^2.0.5", "is-node-process": "^1.2.0", "throttleit": "^2.1.0", "undici": "^6.23.0" } }, "sha512-Nu+HWKpkgovCh/ezlG7wCVwF7RErTzLzZMbGKFBdGBCbTKyK+s5VXPLl+0+TpNEQPH8AVaGzOpIsXUOtkqylCQ=="],
+
+    "@vercel/cli-config": ["@vercel/cli-config@0.2.6", "", { "dependencies": { "xdg-app-paths": "5", "zod": "4.1.11" } }, "sha512-2AsKCf6gE/Eniq09ARm1RK9rQMV5pcAHU7BFcR9MISO+4/RsjjkaYbQN6G85/xi9pYZ5CJNXvYn4TI6p1jKBcg=="],
+
+    "@vercel/cli-exec": ["@vercel/cli-exec@1.0.1", "", { "dependencies": { "execa": "5.1.1" } }, "sha512-g9XerViJ/paZujufXYcu5XYI2vU2rtB4sgdpjUHde5RnOkdmpu0ngH46LCFGHoPXO/C+qDPSczIHIRN+8Q2YKQ=="],
+
+    "@vercel/oidc": ["@vercel/oidc@3.8.7", "", { "dependencies": { "@vercel/cli-config": "0.2.6", "@vercel/cli-exec": "1.0.1", "jose": "^5.9.6" } }, "sha512-fRu59npOu+1vsV570tiLKskfuRyOJ1MqceAkXbTIfWPnM+c9ve1tSK81oj4umKKirymlGUss3V60Lm5I38rKDw=="],
 
     "@visx/curve": ["@visx/curve@4.0.1-alpha.0", "", { "dependencies": { "@visx/vendor": "4.0.0-alpha.0" } }, "sha512-jRu61Uz274pV1zyioXmboyrLutYbnKsgjj4njSGCnhdXj5GkZvZbg+ThDb6oOzoAnJOBRLz4rzPlWvNJOzuVMg=="],
 
@@ -1182,13 +1301,73 @@
 
     "@xmldom/is-dom-node": ["@xmldom/is-dom-node@1.0.1", "", {}, "sha512-CJDxIgE5I0FH+ttq/Fxy6nRpxP70+e2O048EPe85J2use3XKdatVM7dDVvFNjQudd9B49NPoZ+8PG49zj4Er8Q=="],
 
-    "@xmldom/xmldom": ["@xmldom/xmldom@0.8.13", "", {}, "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw=="],
+    "@xmldom/xmldom": ["@xmldom/xmldom@0.9.12", "", {}, "sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A=="],
+
+    "@xmpp/base64": ["@xmpp/base64@0.14.0", "", {}, "sha512-tz2LuzLMtjGSVVeuXDnDw19H+uOrqhrRFcQKJ3THV0HVjerDewT8WKXdrtBVSQ7n4Ue0k+awYcIE7qDD9rwMMQ=="],
+
+    "@xmpp/client": ["@xmpp/client@0.14.0", "", { "dependencies": { "@xmpp/client-core": "^0.14.0", "@xmpp/iq": "^0.14.0", "@xmpp/middleware": "^0.14.0", "@xmpp/reconnect": "^0.14.0", "@xmpp/resolve": "^0.14.0", "@xmpp/resource-binding": "^0.14.0", "@xmpp/sasl": "^0.14.0", "@xmpp/sasl-anonymous": "^0.14.0", "@xmpp/sasl-ht-sha-256-none": "^0.14.0", "@xmpp/sasl-plain": "^0.14.0", "@xmpp/sasl-scram-sha-1": "^0.14.0", "@xmpp/sasl2": "^0.14.0", "@xmpp/starttls": "^0.14.0", "@xmpp/stream-features": "^0.14.0", "@xmpp/stream-management": "^0.14.0", "@xmpp/tcp": "^0.14.0", "@xmpp/tls": "^0.14.0", "@xmpp/websocket": "^0.14.0", "saslmechanisms": "^0.1.1" } }, "sha512-Y6k77iifYOGuWncOLRr6dVmbsQvcsIFjYI9pXhkSzQDDNnd3hVJGgo/Xx+W/0/o1+kg/tPm/NwX5Yq77NTd9xA=="],
+
+    "@xmpp/client-core": ["@xmpp/client-core@0.14.0", "", { "dependencies": { "@xmpp/connection": "^0.14.0", "@xmpp/events": "^0.14.0", "@xmpp/jid": "^0.14.0", "@xmpp/sasl": "^0.14.0", "@xmpp/xml": "^0.14.0", "saslmechanisms": "^0.1.1" } }, "sha512-fW0C6vn4y8Jp1g8uBmCETuOmEDXpjFc/mfY8P0J88nhK2AdPOB5m0ntz0yyAXcPd16smnHVckiOsk9qBjF9dDA=="],
+
+    "@xmpp/component": ["@xmpp/component@0.14.0", "", { "dependencies": { "@xmpp/component-core": "^0.14.0", "@xmpp/iq": "^0.14.0", "@xmpp/middleware": "^0.14.0", "@xmpp/reconnect": "^0.14.0" } }, "sha512-+o9FDP/eOn71NreR3wI+2jxm+csYM0eVX+WtvKy94SrPSmX59cDPpVe2IABIfAInx7bTggz6k/qgrUHuiMZzMQ=="],
+
+    "@xmpp/component-core": ["@xmpp/component-core@0.14.0", "", { "dependencies": { "@xmpp/connection-tcp": "^0.14.0", "@xmpp/jid": "^0.14.0", "@xmpp/xml": "^0.14.0" } }, "sha512-rzrnLUxDu9vTxgWH0b8R8Mou67x5fZWy/0K6jWlB09jaltx4ovvewI+Mfis9LueMO9naNzjbq0PuxWII/HmccA=="],
+
+    "@xmpp/connection": ["@xmpp/connection@0.14.0", "", { "dependencies": { "@xmpp/error": "^0.14.0", "@xmpp/events": "^0.14.0", "@xmpp/jid": "^0.14.0", "@xmpp/xml": "^0.14.0" } }, "sha512-VRnukXwiXWCsRVQVISUiAxHHgRWH37nxdUaz50o0+cUAYyqtlHIJ2zy+ZHMlxkEWtl+XciNLxwkJKbypJFQheQ=="],
+
+    "@xmpp/connection-tcp": ["@xmpp/connection-tcp@0.14.0", "", { "dependencies": { "@xmpp/connection": "^0.14.0", "@xmpp/xml": "^0.14.0" } }, "sha512-gvYyUghuCHW0qalEYaZvbHeTnEoXc+hCCWP/qvoVGjjSQNwkYRUsy1/8RP/sA6RlQ2sR0nhpkJkJE6K/4rsFIQ=="],
+
+    "@xmpp/error": ["@xmpp/error@0.14.0", "", {}, "sha512-b4W/MwAZl8basfmYhcemK3De92xBOiSrIz0VY2cnN2ss1VMsa4d32GuaJGBIpa4ulN/2DFb3vPCeTn5jXvHAJw=="],
+
+    "@xmpp/events": ["@xmpp/events@0.14.0", "", { "dependencies": { "events": "^3.3.0" } }, "sha512-6mKRIEi69sYr8H9SrkJKaXobOgCq/sU6/pKTQS5cuQZCy0qLuyx9uttkOyAYmtUbVD+HSrXYS72KhMpdQQh88Q=="],
+
+    "@xmpp/id": ["@xmpp/id@0.14.0", "", {}, "sha512-0n8OFYPWkBYDi5fHGiJT6SLg9ncOflTmINzjHzt5A3NxEMVrYmqxbRB44u3NLMk1gBNqGtEkc2wl0WHjS0tHWg=="],
+
+    "@xmpp/iq": ["@xmpp/iq@0.14.0", "", { "dependencies": { "@xmpp/events": "^0.14.0", "@xmpp/id": "^0.14.0", "@xmpp/middleware": "^0.14.0", "@xmpp/xml": "^0.14.0" } }, "sha512-0r3QVKR4XAvkZ4shQwPBkSM21sSfj26Cg8+AYBkd0BKJTde7mRQCISBNidt1xiXA5VPH1+6Qx7fmtPzk3uel+Q=="],
+
+    "@xmpp/jid": ["@xmpp/jid@0.14.0", "", {}, "sha512-ggiNgjblkeHPbHJ7JLOMIqxc1qQQt0gV+LhXI16afib2wLr120YgvRChY04gjkvQ+IF2sGz7mzPvcAukTmNGHA=="],
+
+    "@xmpp/middleware": ["@xmpp/middleware@0.14.0", "", { "dependencies": { "@xmpp/error": "^0.14.0", "@xmpp/jid": "^0.14.0", "@xmpp/xml": "^0.14.0", "koa-compose": "^4.1.0" } }, "sha512-UGm7ed5NEMapE/z0jqY5daGSBqto/iciDjtyncoXHZdOnR4iFYFF9gSO/65Z1HsL2pbHQpcK0WS+Kn+FGOxPTw=="],
+
+    "@xmpp/reconnect": ["@xmpp/reconnect@0.14.0", "", { "dependencies": { "@xmpp/events": "^0.14.0" } }, "sha512-XaaT3KrFLf1ZfYZCIx11zauT8bIVXRz9FMaGj4mofq1tC8SiKvIIqJXSgrouhkibb9vPeM9XSiGkH47B/1hc6g=="],
+
+    "@xmpp/resolve": ["@xmpp/resolve@0.14.0", "", { "dependencies": { "@xmpp/events": "^0.14.0", "@xmpp/xml": "^0.14.0" } }, "sha512-S4Rhupb2zS4EtT4EFUJLPl2pPSFPfrjp/1bxPil+zBt9sNcbrvIwSNaYeQAAfLD/yYb8/DhaxC/blvdHyM1Xzw=="],
+
+    "@xmpp/resource-binding": ["@xmpp/resource-binding@0.14.0", "", { "dependencies": { "@xmpp/xml": "^0.14.0" } }, "sha512-b8EyHUOpkAS25b6cpOQ8fv7cCLfOpJq4dkgs6Td0MdODMmcfWEh38siZKaP0OoNmYWZCxBSANdsBmeidozJxqA=="],
+
+    "@xmpp/sasl": ["@xmpp/sasl@0.14.0", "", { "dependencies": { "@xmpp/base64": "^0.14.0", "@xmpp/error": "^0.14.0", "@xmpp/events": "^0.14.0", "@xmpp/xml": "^0.14.0" } }, "sha512-C6mWvtRhJCCjv0Q6uuc3FUuDdgUhnX7lCF9afmNT5umy1XB0l1iRmBJYTriSHNBwgErM3i3mydafeRjpuQfP5Q=="],
+
+    "@xmpp/sasl-anonymous": ["@xmpp/sasl-anonymous@0.14.0", "", { "dependencies": { "sasl-anonymous": "^0.1.0" } }, "sha512-lZ8jaYuKBpfQ2T5Bv+7yxII9OduV1a+mlNkKtG94WchrVzR8fU6VpbTrez88KajA42ngcVCtiO3i6tPepYyK8Q=="],
+
+    "@xmpp/sasl-ht-sha-256-none": ["@xmpp/sasl-ht-sha-256-none@0.14.0", "", {}, "sha512-LmMSzX35bI/V2lV26k/hYPm8Pn7InsBEX72b86+ugIBQpzD8/jmB1F/Mfm5vrbWkMLl2KWe61gE+L/p0mvLZdA=="],
+
+    "@xmpp/sasl-plain": ["@xmpp/sasl-plain@0.14.0", "", { "dependencies": { "sasl-plain": "^0.1.0" } }, "sha512-TGQX6gsCi6LP2lPNkkd+HoZ1ynCesRMQrtJrWbDAa6oMyCwie9xuBcG/5lDJ5fn03G7xxRh1YSQp+x8yFK+q4w=="],
+
+    "@xmpp/sasl-scram-sha-1": ["@xmpp/sasl-scram-sha-1@0.14.0", "", { "dependencies": { "sasl-scram-sha-1": "^1.3.0" } }, "sha512-0ZrsMDx9Haou2yTCzDCwvMsYPvHCxF2bkpyBuiPoYAOWRsIQH1TssZK3d88N7wSvvojter905DNwLPizdaF3og=="],
+
+    "@xmpp/sasl2": ["@xmpp/sasl2@0.14.0", "", { "dependencies": { "@xmpp/base64": "^0.14.0", "@xmpp/error": "^0.14.0", "@xmpp/events": "^0.14.0", "@xmpp/jid": "^0.14.0", "@xmpp/sasl": "^0.14.0", "@xmpp/xml": "^0.14.0" } }, "sha512-OcDIDr9xwiOO58yqr6hj0eh9CfKOvwBbNDNhC0wByA07cwOsoojLb1dv3WR7pKk1cETv6wHWQ1o/leRoDB/Yzg=="],
+
+    "@xmpp/starttls": ["@xmpp/starttls@0.14.0", "", { "dependencies": { "@xmpp/events": "^0.14.0", "@xmpp/tls": "^0.14.0", "@xmpp/xml": "^0.14.0" } }, "sha512-n21Oy5pyD6Cipo96SAVI1ASx/5qo/z3W7J1TWZSG3/gGgrTaCB+VSV0xI+FqRexVJysg3lw3cBidYQL+Lp/pHw=="],
+
+    "@xmpp/stream-features": ["@xmpp/stream-features@0.14.0", "", {}, "sha512-XoogP53qv1lzq/TNnzydT0KmmDKsJ7vpbV1c33fcuBDY0LCmPWA2U5th+Atn3JjEMlyznpVDFco9BF1NgFTHzg=="],
+
+    "@xmpp/stream-management": ["@xmpp/stream-management@0.14.0", "", { "dependencies": { "@xmpp/error": "^0.14.0", "@xmpp/events": "^0.14.0", "@xmpp/time": "^0.14.0", "@xmpp/xml": "^0.14.0" } }, "sha512-i7qLB8KXzLtm2TZXgtVlBprI4Vm8lykJ7Gth2TFavBTky+PQFNr2BH4lGxxvZ7/WkYbhx2jsmDT9JjI7sUCRdw=="],
+
+    "@xmpp/tcp": ["@xmpp/tcp@0.14.0", "", { "dependencies": { "@xmpp/connection-tcp": "^0.14.0" } }, "sha512-vJb5Y60ub+YClK01l+653+qpIe6vedw/82szuB4IU50eTDTL8voer6eGK7AMJOJzoZzRofbLh8Ow5txAyZ8vXw=="],
+
+    "@xmpp/time": ["@xmpp/time@0.14.0", "", {}, "sha512-KlOLwZXXYrRiIZ+Lg0Rg+iDxIBLfCgVQOkIaYG2nieLVtbrHItI5gv2eI2I6m0cPsX8LajGkCpvQTqUCNZclag=="],
+
+    "@xmpp/tls": ["@xmpp/tls@0.14.0", "", { "dependencies": { "@xmpp/connection": "^0.14.0", "@xmpp/connection-tcp": "^0.14.0", "@xmpp/events": "^0.14.0" } }, "sha512-nY/nHlHYgs3i2+xwt/5Ff3J4aCdZADdTOH+NwdfgqBIK9kWDJPW43nnIrbrZgmUL3YOjW5sb1lUI20bFUJACww=="],
+
+    "@xmpp/websocket": ["@xmpp/websocket@0.14.0", "", { "dependencies": { "@xmpp/connection": "^0.14.0", "@xmpp/events": "^0.14.0", "@xmpp/xml": "^0.14.0" } }, "sha512-mRjpRHtOujrPIT7I/X2xvn8w6X/7J8gGPfGIKNGLJHBQu1OlT5noUd++mslCAcGdCOf5TGwtJvE7a8CPtSnTFg=="],
+
+    "@xmpp/xml": ["@xmpp/xml@0.14.0", "", { "dependencies": { "@xmpp/events": "^0.14.0", "ltx": "^3.1.2" } }, "sha512-1rrj3SaIM51wtJUn1l2n4FK2e1QLfEmma9bsD1utaaosA8elpCyWi12QDPfaYoTyWSXNvQ7mGzvFevUJUs1mcQ=="],
 
     "accepts": ["accepts@2.0.0", "", { "dependencies": { "mime-types": "^3.0.0", "negotiator": "^1.0.0" } }, "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng=="],
 
     "agent": ["agent@workspace:apps/agent"],
 
-    "ai": ["ai@7.0.47", "", { "dependencies": { "@ai-sdk/gateway": "4.0.36", "@ai-sdk/provider": "4.0.4", "@ai-sdk/provider-utils": "5.0.18" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-e0MpNtufu6JmcmwMUTgM1smCRkP5z014iPaKgnCm7kmMsTSIZbOJN2vglhPq0WIj/6x7ewVi6W0FyIR0pjaE3Q=="],
+    "ai": ["ai@7.0.94", "", { "dependencies": { "@ai-sdk/gateway": "4.0.76", "@ai-sdk/provider": "4.0.11", "@ai-sdk/provider-utils": "5.0.37" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-N70qu4y53SjhA+kHYQCGLNTXLsztV+Rh28l2JDuEzALY5EgNWloYvUDjssL2Pi1Ie2nILcgWShLRgTpU1HxGHg=="],
 
     "ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="],
 
@@ -1196,9 +1375,9 @@
 
     "ansi-colors": ["ansi-colors@4.1.3", "", {}, "sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw=="],
 
-    "ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],
+    "ansi-regex": ["ansi-regex@6.3.0", "", {}, "sha512-WpDfL7NO6j7tH88IDBNVdUJxDh9nmCteAVW9dsep846XdwF4naCBK+/tGLX3KJgcpgMRXCFlTM2hKGoK9FsdrQ=="],
 
-    "ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
+    "ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="],
 
     "anynum": ["anynum@1.0.1", "", {}, "sha512-N6//FLET/tXYNM/F6ABca1oH6fWB+KlTt909Le28WMDBk8oaT4vY17DCrwg2MvmuqUKt3Ni4N5dGJ/EoBgcO6A=="],
 
@@ -1216,7 +1395,7 @@
 
     "asn1": ["asn1@0.2.6", "", { "dependencies": { "safer-buffer": "~2.1.0" } }, "sha512-ix/FxPn0MDjeyJ7i/yoHGFt/EX6LyNbxSEhPPXODPL+KB0VPk86UYfL0lMdy+KCnv+fmvIzySwaK5COwqVbWTQ=="],
 
-    "ast-types": ["ast-types@0.16.1", "", { "dependencies": { "tslib": "^2.0.1" } }, "sha512-6t10qk83GOG8p0vKmaCr8eiilZwO171AvbROMtvvNiwrTly62t+7XkA8RdIIVbpMhCASAsxgAzdRSwh6nw/5Dg=="],
+    "ast-types": ["ast-types@0.16.3", "", { "dependencies": { "tslib": "^2.0.1" } }, "sha512-FvWoWYfSCM6kRxCSH+MGLHIKKGRL6A6AW7Zek2O32REPQRdg131428uRTKMBYAeRd3XXAaHDS60Wpri7CdKDrA=="],
 
     "async-retry": ["async-retry@1.3.3", "", { "dependencies": { "retry": "0.13.1" } }, "sha512-wfr/jstw9xNi/0teMHrRW7dsz3Lt5ARhYNZ2ewpadnhaIp5mbALhOAP+EAdsC7t4Z6wqsDVv9+W6gm1Dk9mEyw=="],
 
@@ -1224,6 +1403,8 @@
 
     "atomically": ["atomically@1.7.0", "", {}, "sha512-Xcz9l0z7y9yQ9rdDaxlmaI4uJHf/T8g9hOEzJcsEqX2SjCj4J20uK7+ldkDHMbpJDK76wF7xEIgxc/vSlsfw5w=="],
 
+    "auth": ["auth@1.7.3", "", { "dependencies": { "@babel/core": "^7.29.7", "@babel/preset-react": "^7.28.5", "@babel/preset-typescript": "^7.28.5", "@better-auth/core": "1.7.3", "@better-auth/telemetry": "1.7.3", "@better-auth/utils": "0.4.2", "@clack/prompts": "^1.6.0", "@mrleebo/prisma-ast": "^0.16.0", "better-auth": "1.7.3", "c12": "^4.0.0-beta.5", "chalk": "^5.6.2", "commander": "^15.0.0", "dotenv": "^17.3.1", "get-tsconfig": "^4.14.0", "jiti": "^2.7.0", "open": "^11.0.0", "prettier": "^3.8.1", "prompts": "^2.4.2", "semver": "^7.8.4", "yocto-spinner": "^1.2.0", "zod": "^4.5.4" }, "bin": { "auth": "./dist/index.mjs", "better-auth": "./dist/index.mjs" } }, "sha512-95a2C+wg/UNRy9wW9rbA95KBN0MsWev3S/txmIIgyqSQtZ+Hbqz14F9sFKZ9qMsZjFEjaEQ2QS0mqmbtISIpPw=="],
+
     "aws-ssl-profiles": ["aws-ssl-profiles@1.1.2", "", {}, "sha512-NZKeq9AfyQvEeNlN0zSYAaWrmBffJh3IELMZfRpJVWgrpEbtEpnjvzqBPf+mxoI287JohRDoa+/nsfqqiZmF6g=="],
 
     "bail": ["bail@2.0.2", "", {}, "sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw=="],
@@ -1232,33 +1413,33 @@
 
     "base64-js": ["base64-js@1.5.1", "", {}, "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="],
 
-    "baseline-browser-mapping": ["baseline-browser-mapping@2.11.8", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-zAgkquC2WYF0PIc6XbNYkA2uuxxFavzgmX61R+dHDUa558V8Ejf8ozTZFR6QzM24RWu4kBcRkhJ5kpz77j9fnQ=="],
+    "baseline-browser-mapping": ["baseline-browser-mapping@2.11.23", "", { "bin": { "baseline-browser-mapping": "dist/cli.cjs" } }, "sha512-le521dGVfxM7yRX0EikCoSz+rOK+hHzdDt/E7mG1jOJB/6WAAUuwVroLwaB7ApaUsz5Q0kFlDXLSA9MheUIfRQ=="],
 
-    "better-auth": ["better-auth@1.6.25", "", { "dependencies": { "@better-auth/core": "1.6.25", "@better-auth/drizzle-adapter": "1.6.25", "@better-auth/kysely-adapter": "1.6.25", "@better-auth/memory-adapter": "1.6.25", "@better-auth/mongo-adapter": "1.6.25", "@better-auth/prisma-adapter": "1.6.25", "@better-auth/telemetry": "1.6.25", "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "@noble/ciphers": "^2.1.1", "@noble/hashes": "^2.0.1", "better-call": "1.3.7", "defu": "^6.1.4", "jose": "^6.1.3", "kysely": "^0.28.17 || ^0.29.0", "nanostores": "^1.1.1", "zod": "^4.3.6" }, "peerDependencies": { "@lynx-js/react": "*", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "@sveltejs/kit": "^2.0.0", "@tanstack/react-start": "^1.0.0", "@tanstack/solid-start": "^1.0.0", "better-sqlite3": "^12.0.0", "drizzle-kit": ">=0.31.4", "drizzle-orm": "^0.45.2", "mongodb": "^6.0.0 || ^7.0.0", "mysql2": "^3.0.0", "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "pg": "^8.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0", "solid-js": "^1.0.0", "svelte": "^4.0.0 || ^5.0.0", "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", "vue": "^3.0.0" }, "optionalPeers": ["@lynx-js/react", "@prisma/client", "@sveltejs/kit", "@tanstack/react-start", "@tanstack/solid-start", "better-sqlite3", "drizzle-kit", "drizzle-orm", "mongodb", "mysql2", "next", "pg", "prisma", "react", "react-dom", "solid-js", "svelte", "vitest", "vue"] }, "sha512-fvoq+oCO+FF5fpP3XfU7znRyGFpHB77UG2EyxsKNy+Cak7Q5pELu+auvvDveQbWQxcoKugZ7jYQQPFQLpUTGOw=="],
+    "better-auth": ["better-auth@1.7.3", "", { "dependencies": { "@better-auth/core": "1.7.3", "@better-auth/drizzle-adapter": "1.7.3", "@better-auth/kysely-adapter": "1.7.3", "@better-auth/memory-adapter": "1.7.3", "@better-auth/mongo-adapter": "1.7.3", "@better-auth/prisma-adapter": "1.7.3", "@better-auth/telemetry": "1.7.3", "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "@noble/ciphers": "^2.2.0", "@noble/hashes": "^2.2.0", "better-call": "1.4.0", "defu": "^6.1.4", "jose": "^6.2.3", "kysely": "^0.28.17 || ^0.29.0", "nanostores": "^1.3.0", "zod": "^4.5.4" }, "peerDependencies": { "@lynx-js/react": "*", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "@sveltejs/kit": "^2.0.0", "@tanstack/react-start": "^1.0.0", "@tanstack/solid-start": "^1.0.0", "better-sqlite3": "^12.0.0", "drizzle-kit": ">=0.31.4 || >=1.0.0-beta.1", "drizzle-orm": "^0.45.2 || >=1.0.0-rc.1 <2.0.0", "mongodb": "^6.0.0 || ^7.0.0", "mysql2": "^3.0.0", "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "pg": "^8.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0", "solid-js": "^1.0.0", "svelte": "^4.0.0 || ^5.0.0", "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", "vue": "^3.0.0" }, "optionalPeers": ["@lynx-js/react", "@prisma/client", "@sveltejs/kit", "@tanstack/react-start", "@tanstack/solid-start", "better-sqlite3", "drizzle-kit", "drizzle-orm", "mongodb", "mysql2", "next", "pg", "prisma", "react", "react-dom", "solid-js", "svelte", "vitest", "vue"] }, "sha512-8xGp68JQ+l36kniDEgP8bP99TLi1GdEv0NTEUBkyqnYnus/cgFUZseUfqUHKzr2BAsg2O6aD88I9f0U68shanQ=="],
 
-    "better-call": ["better-call@1.3.7", "", { "dependencies": { "@better-auth/utils": "^0.4.0", "@better-fetch/fetch": "^1.1.21", "rou3": "^0.7.12", "set-cookie-parser": "^3.0.1" }, "peerDependencies": { "zod": "^4.0.0" }, "optionalPeers": ["zod"] }, "sha512-Al51/hjp2SSp6CRTa3F2ptcx4yQVS1xWKoY6jcVXqNYOap6mHFP2jUBn5EwIL4iIed1/Sq4hlQ+Umm6EflZG+w=="],
+    "better-call": ["better-call@1.4.0", "", { "dependencies": { "@better-auth/utils": "^0.5.0", "@better-fetch/fetch": "^1.3.1", "rou3": "^0.9.1", "set-cookie-parser": "^3.1.2" }, "peerDependencies": { "zod": "^4.0.0" }, "optionalPeers": ["zod"] }, "sha512-bBKOT4vv1kZLDgxVePdilk/Jwkn+dtRRsmi3DzHcDP+WnswyVl6dR59l2HEeP/0cB+bDoopASAesWDPIdd/zZA=="],
 
     "better-result": ["better-result@2.10.0", "", {}, "sha512-oQhh0y1qo2/ZKdAAEvHZAqKKiHOFU5k/bW96fE2ScgQOVkJRiHwB+nOS1SgFsYqRlxMDWvefXi9Q3px7QvgNDw=="],
 
-    "better-sqlite3": ["better-sqlite3@12.11.1", "", { "dependencies": { "bindings": "^1.5.0", "prebuild-install": "^7.1.1" } }, "sha512-dq9AtApgg5PGFtBzPFSBl3HZQjHok5gaQCM6zh2Yk0aSmDCs1CbnVI8/HgASQkNKsWFpseIO9beg5xxpYhbIfA=="],
-
-    "bindings": ["bindings@1.5.0", "", { "dependencies": { "file-uri-to-path": "1.0.0" } }, "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ=="],
+    "bignumber.js": ["bignumber.js@9.3.1", "", {}, "sha512-Ko0uX15oIUS7wJ3Rb30Fs6SkVbLmPBAKdlm7q9+ak9bbIeFf0MwuBsQV6z7+X768/cHsfg+WlysDWJcmthjsjQ=="],
 
     "bl": ["bl@4.1.0", "", { "dependencies": { "buffer": "^5.5.0", "inherits": "^2.0.4", "readable-stream": "^3.4.0" } }, "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w=="],
 
     "body-parser": ["body-parser@2.3.0", "", { "dependencies": { "bytes": "^3.1.2", "content-type": "^2.0.0", "debug": "^4.4.3", "http-errors": "^2.0.1", "iconv-lite": "^0.7.2", "on-finished": "^2.4.1", "qs": "^6.15.2", "raw-body": "^3.0.2", "type-is": "^2.1.0" } }, "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw=="],
 
+    "bowser": ["bowser@2.14.1", "", {}, "sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg=="],
+
     "brace-expansion": ["brace-expansion@5.0.9", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg=="],
 
     "braces": ["braces@3.0.3", "", { "dependencies": { "fill-range": "^7.1.1" } }, "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA=="],
 
-    "browserslist": ["browserslist@4.28.7", "", { "dependencies": { "baseline-browser-mapping": "^2.10.44", "caniuse-lite": "^1.0.30001806", "electron-to-chromium": "^1.5.393", "node-releases": "^2.0.51", "update-browserslist-db": "^1.2.3" }, "bin": { "browserslist": "cli.js" } }, "sha512-JxV13hNrFxqjOc8alRbq9dK1MM79NEXYpma2B2J4wAtpWS5zIEIKqWPGCl7N4o7Uc7B7itylh7SuDujATRyyTw=="],
+    "browserslist": ["browserslist@4.28.9", "", { "dependencies": { "baseline-browser-mapping": "^2.11.20", "caniuse-lite": "^1.0.30001810", "electron-to-chromium": "^1.5.420", "node-releases": "^2.0.54", "update-browserslist-db": "^1.3.2" }, "bin": { "browserslist": "cli.js" } }, "sha512-EWazOblFYUvlGZcfGhPUPmYh3nikUxBVb+y9MJun5f3hBi812X+8MSQTujLBtgK3cf51fJWbWfOjyeO954d+Eg=="],
 
     "buffer": ["buffer@5.7.1", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.1.13" } }, "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ=="],
 
     "buffer-from": ["buffer-from@1.1.2", "", {}, "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ=="],
 
-    "bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="],
+    "bun-types": ["bun-types@1.4.2", "", { "dependencies": { "@types/node": "*" } }, "sha512-bxV1FgK7yBIzjRe5zBozIM4Bem11ZJcCXSrjWRG3YWLt8yFDePu4cLjpebO8OvPeIE9trbyPF4fuj3Cia4Fj3w=="],
 
     "bundle-name": ["bundle-name@4.1.0", "", { "dependencies": { "run-applescript": "^7.0.0" } }, "sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q=="],
 
@@ -1266,7 +1447,7 @@
 
     "bytes": ["bytes@3.1.2", "", {}, "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="],
 
-    "c12": ["c12@3.3.4", "", { "dependencies": { "chokidar": "^5.0.0", "confbox": "^0.2.4", "defu": "^6.1.6", "dotenv": "^17.3.1", "exsolve": "^1.0.8", "giget": "^3.2.0", "jiti": "^2.6.1", "ohash": "^2.0.11", "pathe": "^2.0.3", "perfect-debounce": "^2.1.0", "pkg-types": "^2.3.0", "rc9": "^3.0.1" }, "peerDependencies": { "magicast": "*" }, "optionalPeers": ["magicast"] }, "sha512-cM0ApFQSBXuourJejzwv/AuPRvAxordTyParRVcHjjtXirtkzM0uK2L9TTn9s0cXZbG7E55jCivRQzoxYmRAlA=="],
+    "c12": ["c12@4.0.0-rc.1", "", { "dependencies": { "confbox": "^0.3.1", "defu": "^6.1.7", "exsolve": "^1.1.1", "pathe": "^2.0.3", "pkg-types": "^2.3.2", "rc9": "^3.1.0" }, "peerDependencies": { "chokidar": "^5", "dotenv": "*", "giget": ">=3.1.0", "jiti": "*", "magicast": "*" }, "optionalPeers": ["chokidar", "dotenv", "giget", "jiti", "magicast"] }, "sha512-08UYGAVLTLqgiCzWNMNdBHdiWKzhIVwcapySI11mFTBacL5bP0dj1Vr7IcwOH0wcUTgMzm1VCh+by922viKWig=="],
 
     "cache-manager": ["cache-manager@7.2.9", "", { "dependencies": { "@cacheable/utils": "^2.5.0", "keyv": "^5.6.0" } }, "sha512-d4vceEyYe95gPxEyQchlEOH9vJlkNRW8G6gzFzzMTxJK9PahYMhC9chrEqgZN0HulROjgw3IzmWVNk7Q7ytiGw=="],
 
@@ -1276,7 +1457,7 @@
 
     "callsites": ["callsites@3.1.0", "", {}, "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ=="],
 
-    "caniuse-lite": ["caniuse-lite@1.0.30001806", "", {}, "sha512-72Cuvd95zbSYPKq6Fhg8eDJRlzgWDf7/mtoZv6Qe/DYNCEBdNxoA3+rZAU2ZhGCpZlns3EssFavaZomckT5Uuw=="],
+    "caniuse-lite": ["caniuse-lite@1.0.30001810", "", {}, "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg=="],
 
     "ccount": ["ccount@2.0.1", "", {}, "sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg=="],
 
@@ -1290,7 +1471,7 @@
 
     "character-reference-invalid": ["character-reference-invalid@2.0.1", "", {}, "sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw=="],
 
-    "chevrotain": ["chevrotain@10.5.0", "", { "dependencies": { "@chevrotain/cst-dts-gen": "10.5.0", "@chevrotain/gast": "10.5.0", "@chevrotain/types": "10.5.0", "@chevrotain/utils": "10.5.0", "lodash": "4.17.21", "regexp-to-ast": "0.5.0" } }, "sha512-Pkv5rBY3+CsHOYfV5g/Vs5JY9WTHHDEKOlohI2XeygaZhUeqhAlldZ8Hz9cRmxu709bvS08YzxHdTPHhffc13A=="],
+    "chevrotain": ["chevrotain@12.0.0", "", { "dependencies": { "@chevrotain/cst-dts-gen": "12.0.0", "@chevrotain/gast": "12.0.0", "@chevrotain/regexp-to-ast": "12.0.0", "@chevrotain/types": "12.0.0", "@chevrotain/utils": "12.0.0" } }, "sha512-csJvb+6kEiQaqo1woTdSAuOWdN0WTLIydkKrBnS+V5gZz0oqBrp4kQ35519QgK6TpBThiG3V1vNSHlIkv4AglQ=="],
 
     "chokidar": ["chokidar@5.0.0", "", { "dependencies": { "readdirp": "^5.0.0" } }, "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw=="],
 
@@ -1310,7 +1491,7 @@
 
     "client-only": ["client-only@0.0.1", "", {}, "sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA=="],
 
-    "cliui": ["cliui@8.0.1", "", { "dependencies": { "string-width": "^4.2.0", "strip-ansi": "^6.0.1", "wrap-ansi": "^7.0.0" } }, "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ=="],
+    "cliui": ["cliui@9.0.1", "", { "dependencies": { "string-width": "^7.2.0", "strip-ansi": "^7.1.0", "wrap-ansi": "^9.0.0" } }, "sha512-k7ndgKhwoQveBL+/1tqGJYNz097I7WOvwbmmU2AR5+magtbjPWQTS1C5vzGkBC8Ym8UWRzfKUzUUqFLypY4Q+w=="],
 
     "clsx": ["clsx@2.1.1", "", {}, "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA=="],
 
@@ -1318,29 +1499,27 @@
 
     "cmdk": ["cmdk@1.1.1", "", { "dependencies": { "@radix-ui/react-compose-refs": "^1.1.1", "@radix-ui/react-dialog": "^1.1.6", "@radix-ui/react-id": "^1.1.0", "@radix-ui/react-primitive": "^2.0.2" }, "peerDependencies": { "react": "^18 || ^19 || ^19.0.0-rc", "react-dom": "^18 || ^19 || ^19.0.0-rc" } }, "sha512-Vsv7kFaXm+ptHDMZ7izaRsP70GgrW9NBNGswt9OZaVBLlE0SNpDq8eu/VGXyF9r7M0azK3Wy7OlYXsuyYLFzHg=="],
 
+    "cn": ["cn@0.2.6", "", { "bin": { "cn": "bin/cn.mjs" } }, "sha512-+i4L0zUGgRcEnhsxueVrP7iBGxBx5iD0WOTYg1MwFEu2ZyCmH5Ov2V1cul2Ht5UchRQQgftCf4be/RxspuW6QQ=="],
+
     "co-body": ["co-body@6.2.0", "", { "dependencies": { "@hapi/bourne": "^3.0.0", "inflation": "^2.0.0", "qs": "^6.5.2", "raw-body": "^2.3.3", "type-is": "^1.6.16" } }, "sha512-Kbpv2Yd1NdL1V/V4cwLVxraHDV6K8ayohr2rmH0J87Er8+zJjcTa6dAn9QMPC9CRgU8+aNajKbSf1TzDB1yKPA=="],
 
     "code-block-writer": ["code-block-writer@13.0.3", "", {}, "sha512-Oofo0pq3IKnsFtuHqSF7TqBfr71aeyZDVJ0HpmqB7FBM2qEigL0iPONSCZSO9pE9dZTAxANe5XHG9Uy0YMv8cg=="],
 
-    "color-convert": ["color-convert@2.0.1", "", { "dependencies": { "color-name": "~1.1.4" } }, "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ=="],
-
-    "color-name": ["color-name@1.1.4", "", {}, "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="],
-
     "combined-stream": ["combined-stream@1.0.8", "", { "dependencies": { "delayed-stream": "~1.0.0" } }, "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg=="],
 
     "comma-separated-tokens": ["comma-separated-tokens@2.0.3", "", {}, "sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg=="],
 
-    "commander": ["commander@12.1.0", "", {}, "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA=="],
+    "commander": ["commander@15.0.0", "", {}, "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg=="],
 
     "component-emitter": ["component-emitter@1.3.1", "", {}, "sha512-T0+barUSQRTUQASh8bx02dl+DhF54GtIDY13Y3m9oWTklKbb3Wv974meRpeZ3lp1JpLVECWWNHC4vaG2XHXouQ=="],
 
     "concat-stream": ["concat-stream@2.0.0", "", { "dependencies": { "buffer-from": "^1.0.0", "inherits": "^2.0.3", "readable-stream": "^3.0.2", "typedarray": "^0.0.6" } }, "sha512-MWufYdFw53ccGjCA+Ol7XJYpAlW6/prSMzuPOTRnJGcGzuhLn4Scrz7qf6o8bROZ514ltazcIFJZevcfbo0x7A=="],
 
-    "concurrently": ["concurrently@9.2.4", "", { "dependencies": { "chalk": "4.1.2", "rxjs": "7.8.2", "shell-quote": "1.9.0", "supports-color": "8.1.1", "tree-kill": "1.2.2", "yargs": "17.7.2" }, "bin": { "conc": "dist/bin/concurrently.js", "concurrently": "dist/bin/concurrently.js" } }, "sha512-TZ0CEhyzvFjgtAvHTusDMgj7wNdihCh7LLLrzdUOXIhdlnL2JBBGA9eJxR24rtqgmdjh3OA3hrN1rCHj6HM8qA=="],
+    "concurrently": ["concurrently@10.0.5", "", { "dependencies": { "chalk": "5.6.2", "rxjs": "7.8.2", "shell-quote": "1.9.0", "supports-color": "10.2.2", "tree-kill": "1.2.2", "yargs": "18.0.0" }, "bin": { "conc": "dist/bin/index.js", "concurrently": "dist/bin/index.js" } }, "sha512-JaP/CoftUrCcAFW/g//RbgEGwlelnEae6cfBLgH6ZdO6s8jPkn6p9SB9u6pdVxYXoiSnFqseOlHfrEfF82TVOg=="],
 
     "conf": ["conf@10.2.0", "", { "dependencies": { "ajv": "^8.6.3", "ajv-formats": "^2.1.1", "atomically": "^1.7.0", "debounce-fn": "^4.0.0", "dot-prop": "^6.0.1", "env-paths": "^2.2.1", "json-schema-typed": "^7.0.3", "onetime": "^5.1.2", "pkg-up": "^3.1.0", "semver": "^7.3.5" } }, "sha512-8fLl9F04EJqjSqH+QjITQfJF8BrOVaYr1jewVgSRAEWePfxT0sku4w2hrGQ60BC/TNLGQ2pgxNlTbWQmMPFvXg=="],
 
-    "confbox": ["confbox@0.2.4", "", {}, "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ=="],
+    "confbox": ["confbox@0.3.1", "", {}, "sha512-cKUSoKa8YxFZZSmraVi7onONx3amu77ngK3kGpsYHDH7drPwCRkQE1RYMPlLRrMtnciRj274XNRxcHxnKmDSnA=="],
 
     "consola": ["consola@3.4.2", "", {}, "sha512-5IKcdX0nnYavi6G7TtOhwkYzyjfJlatbjMjuLSfE2kYT5pMDOilZ4OvMhi637CcDICTmz3wARPoyhqyX1Y+XvA=="],
 
@@ -1348,7 +1527,7 @@
 
     "content-type": ["content-type@1.0.5", "", {}, "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA=="],
 
-    "context.dev": ["context.dev@2.10.0", "", {}, "sha512-hTymKw2SrPXWt+1JSPceQcbIgnX32PdSzR9qvAMXWK5qwDTB/kJE1YK5IIXkBUUzZG2rT5QQqwYAGFooYQ8Yow=="],
+    "context.dev": ["context.dev@2.14.0", "", {}, "sha512-cx1kwP5ecCw6FPC3TV8t+JVv+xfpEDmBfs51aQIXoT2UerncizgoMyuRM/EKHp8n6ITe9YEeHJdBPyNBgHav5A=="],
 
     "convert-source-map": ["convert-source-map@2.0.0", "", {}, "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg=="],
 
@@ -1364,76 +1543,34 @@
 
     "cors": ["cors@2.8.6", "", { "dependencies": { "object-assign": "^4", "vary": "^1" } }, "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw=="],
 
-    "cose-base": ["cose-base@1.0.3", "", { "dependencies": { "layout-base": "^1.0.0" } }, "sha512-s9whTXInMSgAp/NVXVNuVxVKzGH2qck3aQlVHxDCdAEPgtMKwc4Wq6/QKhgdEdgbLSi9rBTAcPoRa6JpiG4ksg=="],
-
     "cosmiconfig": ["cosmiconfig@9.0.2", "", { "dependencies": { "env-paths": "^2.2.1", "import-fresh": "^3.3.0", "js-yaml": "^4.1.0", "parse-json": "^5.2.0" }, "peerDependencies": { "typescript": ">=4.9.5" }, "optionalPeers": ["typescript"] }, "sha512-gtTZxTDau1wL7Y7zifc2dd8jHSK/k6BTx/2Xp/BpdlAdnlYWFVt7qhJqgwi7637yRwRQ3qL4ZidbB4I8tA5VOg=="],
 
     "cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="],
 
-    "crossws": ["crossws@0.4.10", "", { "peerDependencies": { "srvx": ">=0.11.5" }, "optionalPeers": ["srvx"] }, "sha512-pz3oubH/dt12KjqsUB0IuXW4nwRDQ583iDsP4555Cpdqx0NoU7pGlWBcayyFI8f/l/idRpgjMEfwuOxSWJYlIA=="],
+    "crossws": ["crossws@0.4.12", "", { "peerDependencies": { "srvx": ">=0.11.5" }, "optionalPeers": ["srvx"] }, "sha512-aypfsr6t0uNvkqaZc6zvBfXzC6pLI0/sIulpkV6RwCVtZqG5ebBzv4weImKK0VNCj91Wl9F5j7p5WU4MNrybng=="],
 
     "cssesc": ["cssesc@3.0.0", "", { "bin": { "cssesc": "bin/cssesc" } }, "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg=="],
 
     "csstype": ["csstype@3.2.3", "", {}, "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ=="],
 
-    "cytoscape": ["cytoscape@3.34.0", "", {}, "sha512-62rNSrioXw93uliKFBwjukeQyeWwH2PqDrTac31r2P6464u3AUvTk0xS4LVvT251g7IgkFunrI48ZEZGjywSOg=="],
-
-    "cytoscape-cose-bilkent": ["cytoscape-cose-bilkent@4.1.0", "", { "dependencies": { "cose-base": "^1.0.0" }, "peerDependencies": { "cytoscape": "^3.2.0" } }, "sha512-wgQlVIUJF13Quxiv5e1gstZ08rnZj2XaLHGoFMYXz7SkNfCDOOteKBE6SYRfA9WxxI/iBc3ajfDoc6hb/MRAHQ=="],
-
-    "cytoscape-fcose": ["cytoscape-fcose@2.2.0", "", { "dependencies": { "cose-base": "^2.2.0" }, "peerDependencies": { "cytoscape": "^3.2.0" } }, "sha512-ki1/VuRIHFCzxWNrsshHYPs6L7TvLu3DL+TyIGEsRcvVERmxokbf5Gdk7mFxZnTdiGtnA4cfSmjZJMviqSuZrQ=="],
-
-    "d3": ["d3@7.9.0", "", { "dependencies": { "d3-array": "3", "d3-axis": "3", "d3-brush": "3", "d3-chord": "3", "d3-color": "3", "d3-contour": "4", "d3-delaunay": "6", "d3-dispatch": "3", "d3-drag": "3", "d3-dsv": "3", "d3-ease": "3", "d3-fetch": "3", "d3-force": "3", "d3-format": "3", "d3-geo": "3", "d3-hierarchy": "3", "d3-interpolate": "3", "d3-path": "3", "d3-polygon": "3", "d3-quadtree": "3", "d3-random": "3", "d3-scale": "4", "d3-scale-chromatic": "3", "d3-selection": "3", "d3-shape": "3", "d3-time": "3", "d3-time-format": "4", "d3-timer": "3", "d3-transition": "3", "d3-zoom": "3" } }, "sha512-e1U46jVP+w7Iut8Jt8ri1YsPOvFpg46k+K8TpCb0P+zjCkjkPnV7WzfDJzMHy1LnA+wj5pLT1wjO901gLXeEhA=="],
-
     "d3-array": ["d3-array@3.2.4", "", { "dependencies": { "internmap": "1 - 2" } }, "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg=="],
 
-    "d3-axis": ["d3-axis@3.0.0", "", {}, "sha512-IH5tgjV4jE/GhHkRV0HiVYPDtvfjHQlQfJHs0usq7M30XcSBvOotpmH1IgkcXsO/5gEQZD43B//fc7SRT5S+xw=="],
-
-    "d3-brush": ["d3-brush@3.0.0", "", { "dependencies": { "d3-dispatch": "1 - 3", "d3-drag": "2 - 3", "d3-interpolate": "1 - 3", "d3-selection": "3", "d3-transition": "3" } }, "sha512-ALnjWlVYkXsVIGlOsuWH1+3udkYFI48Ljihfnh8FZPF2QS9o+PzGLBslO0PjzVoHLZ2KCVgAM8NVkXPJB2aNnQ=="],
-
-    "d3-chord": ["d3-chord@3.0.1", "", { "dependencies": { "d3-path": "1 - 3" } }, "sha512-VE5S6TNa+j8msksl7HwjxMHDM2yNK3XCkusIlpX5kwauBfXuyLAtNg9jCp/iHH61tgI4sb6R/EIMWCqEIdjT/g=="],
-
     "d3-color": ["d3-color@3.1.0", "", {}, "sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA=="],
 
-    "d3-contour": ["d3-contour@4.0.2", "", { "dependencies": { "d3-array": "^3.2.0" } }, "sha512-4EzFTRIikzs47RGmdxbeUvLWtGedDUNkTcmzoeyg4sP/dvCexO47AaQL7VKy/gul85TOxw+IBgA8US2xwbToNA=="],
-
     "d3-delaunay": ["d3-delaunay@6.0.2", "", { "dependencies": { "delaunator": "5" } }, "sha512-IMLNldruDQScrcfT+MWnazhHbDJhcRJyOEBAJfwQnHle1RPh6WDuLvxNArUju2VSMSUuKlY5BGHRJ2cYyoFLQQ=="],
 
-    "d3-dispatch": ["d3-dispatch@3.0.1", "", {}, "sha512-rzUyPU/S7rwUflMyLc1ETDeBj0NRuHKKAcvukozwhshr6g6c5d8zh4c2gQjY2bZ0dXeGLWc1PF174P2tVvKhfg=="],
-
-    "d3-drag": ["d3-drag@3.0.0", "", { "dependencies": { "d3-dispatch": "1 - 3", "d3-selection": "3" } }, "sha512-pWbUJLdETVA8lQNJecMxoXfH6x+mO2UQo8rSmZ+QqxcbyA3hfeprFgIT//HW2nlHChWeIIMwS2Fq+gEARkhTkg=="],
-
-    "d3-dsv": ["d3-dsv@3.0.1", "", { "dependencies": { "commander": "7", "iconv-lite": "0.6", "rw": "1" }, "bin": { "csv2json": "bin/dsv2json.js", "csv2tsv": "bin/dsv2dsv.js", "dsv2dsv": "bin/dsv2dsv.js", "dsv2json": "bin/dsv2json.js", "json2csv": "bin/json2dsv.js", "json2dsv": "bin/json2dsv.js", "json2tsv": "bin/json2dsv.js", "tsv2csv": "bin/dsv2dsv.js", "tsv2json": "bin/dsv2json.js" } }, "sha512-UG6OvdI5afDIFP9w4G0mNq50dSOsXHJaRE8arAS5o9ApWnIElp8GZw1Dun8vP8OyHOZ/QJUKUJwxiiCCnUwm+Q=="],
-
     "d3-ease": ["d3-ease@3.0.1", "", {}, "sha512-wR/XK3D3XcLIZwpbvQwQ5fK+8Ykds1ip7A2Txe0yxncXSdq1L9skcG7blcedkOX+ZcgxGAmLX1FrRGbADwzi0w=="],
 
-    "d3-fetch": ["d3-fetch@3.0.1", "", { "dependencies": { "d3-dsv": "1 - 3" } }, "sha512-kpkQIM20n3oLVBKGg6oHrUchHM3xODkTzjMoj7aWQFq5QEM+R6E4WkzT5+tojDY7yjez8KgCBRoj4aEr99Fdqw=="],
-
-    "d3-force": ["d3-force@3.0.0", "", { "dependencies": { "d3-dispatch": "1 - 3", "d3-quadtree": "1 - 3", "d3-timer": "1 - 3" } }, "sha512-zxV/SsA+U4yte8051P4ECydjD/S+qeYtnaIyAs9tgHCqfguma/aAQDjo85A9Z6EKhBirHRJHXIgJUlffT4wdLg=="],
-
-    "d3-format": ["d3-format@3.1.0", "", {}, "sha512-YyUI6AEuY/Wpt8KWLgZHsIU86atmikuoOmCfommt0LYHiQSPjvX2AcFc38PX0CBpr2RCyZhjex+NS/LPOv6YqA=="],
+    "d3-format": ["d3-format@3.1.2", "", {}, "sha512-AJDdYOdnyRDV5b6ArilzCPPwc1ejkHcoyFarqlPqT7zRYjhavcT3uSrqcMvsgh2CgoPbK3RCwyHaVyxYcP2Arg=="],
 
     "d3-geo": ["d3-geo@3.1.0", "", { "dependencies": { "d3-array": "2.5.0 - 3" } }, "sha512-JEo5HxXDdDYXCaWdwLRt79y7giK8SbhZJbFWXqbRTolCHFI5jRqteLzCsq51NKbUoX0PjBVSohxrx+NoOUujYA=="],
 
-    "d3-hierarchy": ["d3-hierarchy@3.1.2", "", {}, "sha512-FX/9frcub54beBdugHjDCdikxThEqjnR93Qt7PvQTOHxyiNCAlvMrHhclk3cD5VeAaq9fxmfRp+CnWw9rEMBuA=="],
-
     "d3-interpolate": ["d3-interpolate@3.0.1", "", { "dependencies": { "d3-color": "1 - 3" } }, "sha512-3bYs1rOD33uo8aqJfKP3JWPAibgw8Zm2+L9vBKEHJ2Rg+viTR7o5Mmv5mZcieN+FRYaAOWX5SJATX6k1PWz72g=="],
 
     "d3-path": ["d3-path@3.1.0", "", {}, "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ=="],
 
-    "d3-polygon": ["d3-polygon@3.0.1", "", {}, "sha512-3vbA7vXYwfe1SYhED++fPUQlWSYTTGmFmQiany/gdbiWgU/iEyQzyymwL9SkJjFFuCS4902BSzewVGsHHmHtXg=="],
-
-    "d3-quadtree": ["d3-quadtree@3.0.1", "", {}, "sha512-04xDrxQTDTCFwP5H6hRhsRcb9xxv2RzkcsygFzmkSIOJy3PeRJP7sNk3VRIbKXcog561P9oU0/rVH6vDROAgUw=="],
-
-    "d3-random": ["d3-random@3.0.1", "", {}, "sha512-FXMe9GfxTxqd5D6jFsQ+DJ8BJS4E/fT5mqqdjovykEB2oFbTMDVdg1MGFxfQW+FBOGoB++k8swBrgwSHT1cUXQ=="],
-
-    "d3-sankey": ["d3-sankey@0.12.3", "", { "dependencies": { "d3-array": "1 - 2", "d3-shape": "^1.2.0" } }, "sha512-nQhsBRmM19Ax5xEIPLMY9ZmJ/cDvd1BG3UVvt5h3WRxKg5zGRbvnteTyWAbzeSvlh3tW7ZEmq4VwR5mB3tutmQ=="],
-
     "d3-scale": ["d3-scale@4.0.2", "", { "dependencies": { "d3-array": "2.10.0 - 3", "d3-format": "1 - 3", "d3-interpolate": "1.2.0 - 3", "d3-time": "2.1.1 - 3", "d3-time-format": "2 - 4" } }, "sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ=="],
 
-    "d3-scale-chromatic": ["d3-scale-chromatic@3.1.0", "", { "dependencies": { "d3-color": "1 - 3", "d3-interpolate": "1 - 3" } }, "sha512-A3s5PWiZ9YCXFye1o246KoscMWqf8BsD9eRiJ3He7C9OBaxKhAd5TFCdEx/7VbKtxxTsu//1mMJFrEt572cEyQ=="],
-
-    "d3-selection": ["d3-selection@3.0.0", "", {}, "sha512-fmTRWbNMmsmWq6xJV8D19U/gw/bwrHfNXxrIN+HfZgnzqTHp9jOmKMhsTUjXOJnZOdZY9Q28y4yebKzqDKlxlQ=="],
-
     "d3-shape": ["d3-shape@3.2.0", "", { "dependencies": { "d3-path": "^3.1.0" } }, "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA=="],
 
     "d3-time": ["d3-time@3.1.0", "", { "dependencies": { "d3-array": "2 - 3" } }, "sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q=="],
@@ -1442,21 +1579,13 @@
 
     "d3-timer": ["d3-timer@3.0.1", "", {}, "sha512-ndfJ/JxxMd3nw31uyKoY2naivF+r29V+Lc0svZxe1JvvIRmi8hUsrMvdOwgS1o6uBHmiz91geQ0ylPP0aj1VUA=="],
 
-    "d3-transition": ["d3-transition@3.0.1", "", { "dependencies": { "d3-color": "1 - 3", "d3-dispatch": "1 - 3", "d3-ease": "1 - 3", "d3-interpolate": "1 - 3", "d3-timer": "1 - 3" }, "peerDependencies": { "d3-selection": "2 - 3" } }, "sha512-ApKvfjsSR6tg06xrL434C0WydLr7JewBB3V+/39RMHsaXTOG0zmt/OAXeng5M5LBm0ojmxJrpomQVZ1aPvBL4w=="],
-
-    "d3-zoom": ["d3-zoom@3.0.0", "", { "dependencies": { "d3-dispatch": "1 - 3", "d3-drag": "2 - 3", "d3-interpolate": "1 - 3", "d3-selection": "2 - 3", "d3-transition": "2 - 3" } }, "sha512-b8AmV3kfQaqWAuacbPuNbL6vahnOJflOhexLzMMNLga62+/nh0JzvJ0aO/5a5MVgUFGS7Hu1P9P03o3fJkDCyw=="],
-
-    "dagre-d3-es": ["dagre-d3-es@7.0.14", "", { "dependencies": { "d3": "^7.9.0", "lodash-es": "^4.17.21" } }, "sha512-P4rFMVq9ESWqmOgK+dlXvOtLwYg0i7u0HBGJER0LZDJT2VHIPAMZ/riPxqJceWMStH5+E61QxFra9kIS3AqdMg=="],
-
     "date-fns": ["date-fns@4.4.0", "", {}, "sha512-+1UMbeh68lH1SegH83CGWwpb6OHHbpSgr3+s5Eww5M4CAgswBpoWS0AjTOfEJ33HiYKz1hdj/KTFprzXHmq/6w=="],
 
-    "dayjs": ["dayjs@1.11.21", "", {}, "sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA=="],
-
-    "db0": ["db0@0.3.4", "", { "peerDependencies": { "@electric-sql/pglite": "*", "@libsql/client": "*", "better-sqlite3": "*", "drizzle-orm": "*", "mysql2": "*", "sqlite3": "*" }, "optionalPeers": ["@electric-sql/pglite", "@libsql/client", "better-sqlite3", "drizzle-orm", "mysql2", "sqlite3"] }, "sha512-RiXXi4WaNzPTHEOu8UPQKMooIbqOEyqA1t7Z6MsdxSCeb8iUC9ko3LcmsLmeUt2SM5bctfArZKkRQggKZz7JNw=="],
+    "db0": ["db0@0.4.1", "", {}, "sha512-6RBY/bSn42UrqATwsiULj2uYFyEykB3XeA/NLIVQeHNXlYV6D4Idxx3/aa6k5Y45Dwzx7sygeLotnqHWSeURYA=="],
 
     "debounce-fn": ["debounce-fn@4.0.0", "", { "dependencies": { "mimic-fn": "^3.0.0" } }, "sha512-8pYCQiL9Xdcg0UPSD3d+0KMlOjp+KGU5EPwYddgzQ7DATsg4fuUDjQtsYLmWjnk2obnNHgV3vE2Y4jejSOJVBQ=="],
 
-    "debug": ["debug@4.4.3", "", { "dependencies": { "ms": "^2.1.3" } }, "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA=="],
+    "debug": ["debug@4.4.3", "", { "dependencies": { "ms": "^2.1.3" }, "peerDependencies": { "supports-color": "*" }, "optionalPeers": ["supports-color"] }, "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA=="],
 
     "decimal.js-light": ["decimal.js-light@2.5.1", "", {}, "sha512-qIMFpTMZmny+MMIitAB6D7iVPEorVw6YQRWkvarTkT4tBeSLLiHzcwj6q0MmYSFCiVpiqPJTJEYIrpcPzVEIvg=="],
 
@@ -1472,7 +1601,7 @@
 
     "deepmerge-ts": ["deepmerge-ts@7.1.5", "", {}, "sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw=="],
 
-    "default-browser": ["default-browser@5.5.0", "", { "dependencies": { "bundle-name": "^4.1.0", "default-browser-id": "^5.0.0" } }, "sha512-H9LMLr5zwIbSxrmvikGuI/5KGhZ8E2zH3stkMgM5LpOWDutGM2JZaj460Udnf1a+946zc7YBgrqEWwbk7zHvGw=="],
+    "default-browser": ["default-browser@5.5.1", "", { "dependencies": { "bundle-name": "^4.1.0", "default-browser-id": "^5.0.0" } }, "sha512-m1pAzaJgZ/gssEqlOhJkPJp8Xly7QyW6xcrkUa2KKcDeDSEMP7X8xipU3snUcfisTQx0w1AGae+9UtJSfVnXGw=="],
 
     "default-browser-id": ["default-browser-id@5.0.1", "", {}, "sha512-x1VCxdX4t+8wVfd1so/9w+vQ4vx7lKd2Qp5tDRutErwmR85OgmfX7RlLRMWafRMY7hbEiXIbudNrjOAPa/hL8Q=="],
 
@@ -1502,15 +1631,15 @@
 
     "diff": ["diff@8.0.4", "", {}, "sha512-DPi0FmjiSU5EvQV0++GFDOJ9ASQUVFh5kD+OzOnYdi7n3Wpm9hWWGfB/O2blfHcMVTL5WkQXSnRiK9makhrcnw=="],
 
-    "dompurify": ["dompurify@3.4.12", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg=="],
+    "dompurify": ["dompurify@3.4.15", "", { "optionalDependencies": { "@types/trusted-types": "^2.0.7" } }, "sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw=="],
 
     "dot-prop": ["dot-prop@6.0.1", "", { "dependencies": { "is-obj": "^2.0.0" } }, "sha512-tE7ztYzXHIeyvc7N+hR3oi7FIbf/NIjVP9hmAt3yMXzrQ072/fpjGLx2GxNxGxUl5V73MEqYzioOMoVhGMJ5cA=="],
 
     "dotenv": ["dotenv@17.4.2", "", {}, "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw=="],
 
-    "dotenv-expand": ["dotenv-expand@12.0.3", "", { "dependencies": { "dotenv": "^16.4.5" } }, "sha512-uc47g4b+4k/M/SeaW1y4OApx+mtLWl92l5LMPP0GNXctZqELk+YGgOPIIC5elYmUH4OuoK3JLhuRUYegeySiFA=="],
+    "dotenv-expand": ["dotenv-expand@13.0.0", "", { "dependencies": { "dotenv": "^17.4.2" } }, "sha512-aBfBS8eYIeXmpHI9ThIlA7/WLq+SLt18iXUZhb52rW89QLKQFoIpPG1bPeewoPZsTyjSSO3T7234FBVUM1V2rA=="],
 
-    "drizzle-orm": ["drizzle-orm@0.41.0", "", { "peerDependencies": { "@aws-sdk/client-rds-data": ">=3", "@cloudflare/workers-types": ">=4", "@electric-sql/pglite": ">=0.2.0", "@libsql/client": ">=0.10.0", "@libsql/client-wasm": ">=0.10.0", "@neondatabase/serverless": ">=0.10.0", "@op-engineering/op-sqlite": ">=2", "@opentelemetry/api": "^1.4.1", "@planetscale/database": ">=1", "@prisma/client": "*", "@tidbcloud/serverless": "*", "@types/better-sqlite3": "*", "@types/pg": "*", "@types/sql.js": "*", "@vercel/postgres": ">=0.8.0", "@xata.io/client": "*", "better-sqlite3": ">=7", "bun-types": "*", "expo-sqlite": ">=14.0.0", "gel": ">=2", "knex": "*", "kysely": "*", "mysql2": ">=2", "pg": ">=8", "postgres": ">=3", "sql.js": ">=1", "sqlite3": ">=5" }, "optionalPeers": ["@aws-sdk/client-rds-data", "@cloudflare/workers-types", "@electric-sql/pglite", "@libsql/client", "@libsql/client-wasm", "@neondatabase/serverless", "@op-engineering/op-sqlite", "@opentelemetry/api", "@planetscale/database", "@prisma/client", "@tidbcloud/serverless", "@types/better-sqlite3", "@types/pg", "@types/sql.js", "@vercel/postgres", "@xata.io/client", "better-sqlite3", "bun-types", "expo-sqlite", "gel", "knex", "kysely", "mysql2", "pg", "postgres", "sql.js", "sqlite3"] }, "sha512-7A4ZxhHk9gdlXmTdPj/lREtP+3u8KvZ4yEN6MYVxBzZGex5Wtdc+CWSbu7btgF6TB0N+MNPrvW7RKBbxJchs/Q=="],
+    "drizzle-orm": ["drizzle-orm@0.45.2", "", { "peerDependencies": { "@aws-sdk/client-rds-data": ">=3", "@cloudflare/workers-types": ">=4", "@electric-sql/pglite": ">=0.2.0", "@libsql/client": ">=0.10.0", "@libsql/client-wasm": ">=0.10.0", "@neondatabase/serverless": ">=0.10.0", "@op-engineering/op-sqlite": ">=2", "@opentelemetry/api": "^1.4.1", "@planetscale/database": ">=1.13", "@prisma/client": "*", "@tidbcloud/serverless": "*", "@types/better-sqlite3": "*", "@types/pg": "*", "@types/sql.js": "*", "@upstash/redis": ">=1.34.7", "@vercel/postgres": ">=0.8.0", "@xata.io/client": "*", "better-sqlite3": ">=7", "bun-types": "*", "expo-sqlite": ">=14.0.0", "gel": ">=2", "knex": "*", "kysely": "*", "mysql2": ">=2", "pg": ">=8", "postgres": ">=3", "prisma": "*", "sql.js": ">=1", "sqlite3": ">=5" }, "optionalPeers": ["@aws-sdk/client-rds-data", "@cloudflare/workers-types", "@electric-sql/pglite", "@libsql/client", "@libsql/client-wasm", "@neondatabase/serverless", "@op-engineering/op-sqlite", "@opentelemetry/api", "@planetscale/database", "@prisma/client", "@tidbcloud/serverless", "@types/better-sqlite3", "@types/pg", "@types/sql.js", "@upstash/redis", "@vercel/postgres", "@xata.io/client", "better-sqlite3", "bun-types", "expo-sqlite", "gel", "knex", "kysely", "mysql2", "pg", "postgres", "prisma", "sql.js", "sqlite3"] }, "sha512-kY0BSaTNYWnoDMVoyY8uxmyHjpJW1geOmBMdSSicKo9CIIWkSxMIj2rkeSR51b8KAPB7m+qysjuHme5nKP+E5Q=="],
 
     "dunder-proto": ["dunder-proto@1.0.1", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.1", "es-errors": "^1.3.0", "gopd": "^1.2.0" } }, "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A=="],
 
@@ -1518,7 +1647,7 @@
 
     "effect": ["effect@3.20.0", "", { "dependencies": { "@standard-schema/spec": "^1.0.0", "fast-check": "^3.23.1" } }, "sha512-qMLfDJscrNG8p/aw+IkT9W7fgj50Z4wG5bLBy0Txsxz8iUHjDIkOgO3SV0WZfnQbNG2VJYb0b+rDLMrhM4+Krw=="],
 
-    "electron-to-chromium": ["electron-to-chromium@1.5.399", "", {}, "sha512-lEcqhErbHjXRvd41rnWLpzbyU/IXfIYo7QwaFWmxGeLiLyY2TBCdHnWY88vB+p3ubnihRypDm66panXl7TylLA=="],
+    "electron-to-chromium": ["electron-to-chromium@1.5.427", "", {}, "sha512-n14zb3FdsChZ2BNobqNHAJMcP3ifFv4paox2LvCrfVAQcqGiSURgbJl+PfMpHVCNFkStnNc+RRVtPBTVW5PDgw=="],
 
     "elkjs": ["elkjs@0.11.1", "", {}, "sha512-zxxR9k+rx5ktMwT/FwyLdPCrq7xN6e4VGGHH8hA01vVYKjTFik7nHOxBnAYtrgYUB1RpAiLvA1/U2YraWxyKKg=="],
 
@@ -1530,7 +1659,7 @@
 
     "end-of-stream": ["end-of-stream@1.4.5", "", { "dependencies": { "once": "^1.4.0" } }, "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg=="],
 
-    "enhanced-resolve": ["enhanced-resolve@5.24.5", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.3" } }, "sha512-L1l8TNvomm6UVW5B253AGxQagSQr+vGwhMlrrfRS2qmhx46AMpMVJKQYLvWYbysTMY8VoicOvzHzoHMbyzB+4A=="],
+    "enhanced-resolve": ["enhanced-resolve@5.25.1", "", { "dependencies": { "graceful-fs": "^4.2.4", "tapable": "^2.3.3" } }, "sha512-nGXts5znJzmWPu+mIE9izCOzdg63oJca2mDzGWWTth7sr4aCToKcoyFVBQwN75Ij5Pf6p510EwkTqViTRzDV+w=="],
 
     "enquirer": ["enquirer@2.4.1", "", { "dependencies": { "ansi-colors": "^4.1.1", "strip-ansi": "^6.0.1" } }, "sha512-rRqJg/6gd538VHvR3PSrdRBb/1Vy2YfzHqzvbhGIQpDRKIa4FgV/54b5Q1xYSxOOwKvjXweS26E0Q+nAMwp2pQ=="],
 
@@ -1538,7 +1667,9 @@
 
     "env-paths": ["env-paths@2.2.1", "", {}, "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A=="],
 
-    "env-runner": ["env-runner@0.1.16", "", { "dependencies": { "crossws": "^0.4.8", "exsolve": "^1.1.0", "httpxy": "^0.5.4", "srvx": "^0.11.19" }, "peerDependencies": { "@netlify/runtime": "^4.1.23", "@vercel/queue": ">=0.2.0", "miniflare": "^4.20260515.0", "wrangler": "^4.0.0" }, "optionalPeers": ["@netlify/runtime", "@vercel/queue", "miniflare", "wrangler"], "bin": { "env-runner": "dist/cli.mjs" } }, "sha512-2LRJM4P2KLX6J83QZZrMqvgCDt/D5ea7wPcI3yYiy5cG/9rX5QwdwZFx0D7ktWnjdRyZxYjttGGorb5nFqb1CA=="],
+    "env-runner": ["env-runner@0.2.2", "", { "dependencies": { "crossws": "^0.4.12", "exsolve": "^1.1.1", "httpxy": "^0.5.5", "srvx": "^1.0.3" }, "bin": { "env-runner": "./dist/cli.mjs" } }, "sha512-Mg9MqUq6fMe6Smd4x/bXJJTavobIXlPsJ+/ePWkoLSVTrGmQ+1YrzwjoCn1Bl7tMD9aNqB7c5NIWKRAIl3l7hw=="],
+
+    "error-causes": ["error-causes@3.0.2", "", {}, "sha512-i0B8zq1dHL6mM85FGoxaJnVtx6LD5nL2v0hlpGdntg5FOSyzQ46c9lmz5qx0xRS2+PWHGOHcYxGIBC5Le2dRMw=="],
 
     "error-ex": ["error-ex@1.3.4", "", { "dependencies": { "is-arrayish": "^0.2.1" } }, "sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ=="],
 
@@ -1550,7 +1681,7 @@
 
     "es-set-tostringtag": ["es-set-tostringtag@2.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "get-intrinsic": "^1.2.6", "has-tostringtag": "^1.0.2", "hasown": "^2.0.2" } }, "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA=="],
 
-    "es-toolkit": ["es-toolkit@1.50.0", "", {}, "sha512-OyZKhUVvEep9ITEiwHn8GKnMRQIVqoSIX7WnRbkWgJkllCujilqP2rD0u979tkl8wqyc8ICwlc1UBVv/Sl1G6w=="],
+    "es-toolkit": ["es-toolkit@1.52.0", "", {}, "sha512-XTNEJQh1tY1ZJVcf6ayP/2n4ZPyaHlW2FWs7xvw5ddPuhUVjLD3olQVQS7kf58JbAB48iL0uL/jerTrjtV3lDA=="],
 
     "escalade": ["escalade@3.2.0", "", {}, "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA=="],
 
@@ -1564,13 +1695,15 @@
 
     "etag": ["etag@1.8.1", "", {}, "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg=="],
 
-    "eve": ["eve@0.29.4", "", { "dependencies": { "nitro": "3.0.260610-beta", "undici": "8.9.0" }, "peerDependencies": { "@opentelemetry/api": "^1.0.0", "ai": "^7.0.38", "braintrust": "^3.0.0", "just-bash": "^3.0.0", "microsandbox": "^0.5.0" }, "optionalPeers": ["@opentelemetry/api", "braintrust", "just-bash", "microsandbox"], "bin": { "eve": "./bin/eve.js" } }, "sha512-EwOmL37l+Iuu7Umno7at3flFpMs4AtT9cg1J4dt7EZ8ZdxaCvGXwvKGwiulMkG8oXkMQ5CNhxMi2ruHJwrtpwQ=="],
+    "eve": ["eve@0.52.3", "", { "dependencies": { "nitro": "3.0.260903-beta", "undici": "8.9.0" }, "peerDependencies": { "@opentelemetry/api": "^1.0.0", "ai": "^7.0.82", "braintrust": "^3.0.0", "just-bash": "^3.1.0", "microsandbox": "^0.5.0" }, "optionalPeers": ["@opentelemetry/api", "braintrust", "just-bash", "microsandbox"], "bin": { "eve": "./bin/eve.js" } }, "sha512-Ii/fs18oBX7mVoywtAy8Pmi0sHRWVx8/IR0Uzhic3e/WkcFLTmr07ewfaH3VJ1h5Y9SpeUni2WfBE5Yd83mv0A=="],
 
     "eventemitter3": ["eventemitter3@5.0.4", "", {}, "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw=="],
 
+    "events": ["events@3.3.0", "", {}, "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q=="],
+
     "eventsource": ["eventsource@3.0.7", "", { "dependencies": { "eventsource-parser": "^3.0.1" } }, "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA=="],
 
-    "eventsource-parser": ["eventsource-parser@3.1.0", "", {}, "sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg=="],
+    "eventsource-parser": ["eventsource-parser@3.1.1", "", {}, "sha512-EKN1vKAMcZ8MlYMpaNuxN6R9yakzH6uajHcHVTqWJzvu5pWw9DyhbP35HH8MVBQ+dZjAfDxk+A8NiR9KWaXiyQ=="],
 
     "execa": ["execa@9.6.1", "", { "dependencies": { "@sindresorhus/merge-streams": "^4.0.0", "cross-spawn": "^7.0.6", "figures": "^6.1.0", "get-stream": "^9.0.0", "human-signals": "^8.0.1", "is-plain-obj": "^4.1.0", "is-stream": "^4.0.1", "npm-run-path": "^6.0.0", "pretty-ms": "^9.2.0", "signal-exit": "^4.1.0", "strip-final-newline": "^4.0.0", "yoctocolors": "^2.1.1" } }, "sha512-9Be3ZoN4LmYR90tUoVu2te2BsbzHfhJyfEiAVfz7N5/zv+jduIfLrV2xdQXOHbaD6KgpGdO9PRPM1Y4Q9QkPkA=="],
 
@@ -1578,7 +1711,7 @@
 
     "express": ["express@5.2.1", "", { "dependencies": { "accepts": "^2.0.0", "body-parser": "^2.2.1", "content-disposition": "^1.0.0", "content-type": "^1.0.5", "cookie": "^0.7.1", "cookie-signature": "^1.2.1", "debug": "^4.4.0", "depd": "^2.0.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "etag": "^1.8.1", "finalhandler": "^2.1.0", "fresh": "^2.0.0", "http-errors": "^2.0.0", "merge-descriptors": "^2.0.0", "mime-types": "^3.0.0", "on-finished": "^2.4.1", "once": "^1.4.0", "parseurl": "^1.3.3", "proxy-addr": "^2.0.7", "qs": "^6.14.0", "range-parser": "^1.2.1", "router": "^2.2.0", "send": "^1.1.0", "serve-static": "^2.2.0", "statuses": "^2.0.1", "type-is": "^2.0.1", "vary": "^1.1.2" } }, "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw=="],
 
-    "express-rate-limit": ["express-rate-limit@8.6.1", "", { "dependencies": { "debug": "^4.4.3", "ip-address": "^10.2.0" }, "peerDependencies": { "express": ">= 4.11" } }, "sha512-0D493aP61w0TJ2A0wy27riRsO7FMQ7FK+KUHOKCSfPvYo0R55aiC6emCVgFUeShH0fq0ICPVzNcgoS+BsbXQCA=="],
+    "express-rate-limit": ["express-rate-limit@8.7.0", "", { "dependencies": { "debug": "^4.4.3", "ip-address": "^10.2.0" }, "peerDependencies": { "express": ">= 4.11" } }, "sha512-hOwV7WOxXfjRpAM1DSJWZDXx3GhplwD8IfwuwvogD8i1Qnkgosw/H45s4ZnFAUHDAhPjlY9hLBvJhKmGMyY26g=="],
 
     "exsolve": ["exsolve@1.1.1", "", {}, "sha512-9U/jZUgjnSGyntRr6y5Muu1MJcwFl6kPu7k8qLF0IMNfLqvw0NZ4nnVDq0RVoZ0RvCyumib4Ez3KYrVfilrw+g=="],
 
@@ -1596,13 +1729,19 @@
 
     "fast-safe-stringify": ["fast-safe-stringify@2.1.1", "", {}, "sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA=="],
 
-    "fast-uri": ["fast-uri@3.1.5", "", {}, "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw=="],
+    "fast-string-truncated-width": ["fast-string-truncated-width@3.0.3", "", {}, "sha512-0jjjIEL6+0jag3l2XWWizO64/aZVtpiGE3t0Zgqxv0DPuxiMjvB3M24fCyhZUO4KomJQPj3LTSUnDP3GpdwC0g=="],
+
+    "fast-string-width": ["fast-string-width@3.0.2", "", { "dependencies": { "fast-string-truncated-width": "^3.0.2" } }, "sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg=="],
+
+    "fast-uri": ["fast-uri@3.1.7", "", {}, "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg=="],
 
-    "fast-xml-builder": ["fast-xml-builder@1.3.0", "", { "dependencies": { "path-expression-matcher": "^1.6.2", "xml-naming": "^0.3.0" } }, "sha512-F74cZEdCvuw9P41GAC3rod4X04jjWGM1JPEv/GWSqFTWLsdyMSBMBMlm9Hk3GLBgLBbdBNY8yee0pQh2RBVESQ=="],
+    "fast-wrap-ansi": ["fast-wrap-ansi@0.2.2", "", { "dependencies": { "fast-string-width": "^3.0.2" } }, "sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q=="],
 
-    "fast-xml-parser": ["fast-xml-parser@5.10.1", "", { "dependencies": { "@nodable/entities": "^3.0.0", "fast-xml-builder": "^1.2.0", "is-unsafe": "^2.0.0", "path-expression-matcher": "^1.6.2", "strnum": "^2.4.1", "xml-naming": "^0.3.0" }, "bin": { "fxparser": "src/cli/cli.js" } }, "sha512-IEMIf7298kXuZSRFoGfMYrl7is8LpavODgbNz1cwIudv7KwVFnuU+UsMporfq6PD6aXSlawZlARiA3UywCTfMw=="],
+    "fast-xml-builder": ["fast-xml-builder@1.3.1", "", { "dependencies": { "path-expression-matcher": "^1.6.2", "xml-naming": "^0.3.0" } }, "sha512-pIM/1n3ntFXKYrUZwW7QCK0gAW7XY+wzj1YMIV3tLDvPj/V+zTGJK5e3/4WJfwj0qWw2ElNXiTixda/R+3YSug=="],
 
-    "fastq": ["fastq@1.20.1", "", { "dependencies": { "reusify": "^1.0.4" } }, "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw=="],
+    "fast-xml-parser": ["fast-xml-parser@5.11.1", "", { "dependencies": { "@nodable/entities": "^3.0.0", "fast-xml-builder": "^1.2.0", "is-unsafe": "^2.0.0", "path-expression-matcher": "^1.6.2", "strnum": "^2.4.2", "xml-naming": "^0.3.0" }, "bin": { "fxparser": "src/cli/cli.js" } }, "sha512-TBw6K/fxoQGGjCmZDw9w/ZwP3uDcnTM4YH/g+PFRWr8sbe5idXtxNN6vITh4+1ruCZaho6uBFurElsA7F0zzgw=="],
+
+    "fastq": ["fastq@1.20.3", "", { "dependencies": { "reusify": "^1.0.4" } }, "sha512-XKv5nnLs6nLF71NgiKJLIZFLkPyIEuOselLG7ujZnGrRfQK8HpvY+WqKhAJUAdLomwVHErVS4LfxFlPq0/FTAw=="],
 
     "fd-package-json": ["fd-package-json@2.0.0", "", { "dependencies": { "walk-up-path": "^4.0.0" } }, "sha512-jKmm9YtsNXN789RS/0mSzOC1NUq9mkVd65vbSSVsKdjGvYXBuE4oWe2QOEoFeRmJg+lPuZxpmrfFclNhoRMneQ=="],
 
@@ -1614,8 +1753,6 @@
 
     "file-type": ["file-type@21.3.4", "", { "dependencies": { "@tokenizer/inflate": "^0.4.1", "strtok3": "^10.3.4", "token-types": "^6.1.1", "uint8array-extras": "^1.4.0" } }, "sha512-Ievi/yy8DS3ygGvT47PjSfdFoX+2isQueoYP1cntFW1JLYAuS4GD7NUPGg4zv2iZfV52uDyk5w5Z0TdpRS6Q1g=="],
 
-    "file-uri-to-path": ["file-uri-to-path@1.0.0", "", {}, "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw=="],
-
     "fill-range": ["fill-range@7.1.1", "", { "dependencies": { "to-regex-range": "^5.0.1" } }, "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg=="],
 
     "finalhandler": ["finalhandler@2.1.1", "", { "dependencies": { "debug": "^4.4.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "on-finished": "^2.4.1", "parseurl": "^1.3.3", "statuses": "^2.0.1" } }, "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA=="],
@@ -1628,13 +1765,13 @@
 
     "form-data": ["form-data@4.0.6", "", { "dependencies": { "asynckit": "^0.4.0", "combined-stream": "^1.0.8", "es-set-tostringtag": "^2.1.0", "hasown": "^2.0.4", "mime-types": "^2.1.35" } }, "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ=="],
 
-    "formatly": ["formatly@0.3.0", "", { "dependencies": { "fd-package-json": "^2.0.0" }, "bin": { "formatly": "bin/index.mjs" } }, "sha512-9XNj/o4wrRFyhSMJOvsuyMwy8aUfBaZ1VrqHVfohyXf0Sw0e+yfKG+xZaY3arGCOMdwFsqObtzVOc1gU9KiT9w=="],
+    "formatly": ["formatly@0.7.0", "", { "dependencies": { "fd-package-json": "^2.0.0", "package-manager-detector": "^1.8.0" }, "bin": { "formatly": "bin/index.mjs" } }, "sha512-7CXJtIIA0zy/u12StsYk25qVKxvdLA2ep2sTNxK3ov0mGNIIDqIvAXDSgTnAfDJFsPfWjuz0WjfYSdpvnLA5Tg=="],
 
     "formidable": ["formidable@3.5.4", "", { "dependencies": { "@paralleldrive/cuid2": "^2.2.2", "dezalgo": "^1.0.4", "once": "^1.4.0" } }, "sha512-YikH+7CUTOtP44ZTnUhR7Ic2UASBPOqmaRkRKxRbywPTe5VxF7RRCck4af9wutiZ/QKM5nME9Bie2fFaPz5Gug=="],
 
     "forwarded": ["forwarded@0.2.0", "", {}, "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow=="],
 
-    "framer-motion": ["framer-motion@12.43.0", "", { "dependencies": { "motion-dom": "^12.43.0", "motion-utils": "^12.39.0", "tslib": "^2.4.0" }, "peerDependencies": { "@emotion/is-prop-valid": "*", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["@emotion/is-prop-valid", "react", "react-dom"] }, "sha512-1eaL3RvR/kAlbG7UYcpMptEyzPoENO0c6w7ZnB3/hh2vSAz/6uGAFn6fdoqTBguNstf3MsFhJHsD/0DHiclG+g=="],
+    "framer-motion": ["framer-motion@13.2.0", "", { "dependencies": { "motion-dom": "^13.2.0", "motion-utils": "^13.0.0", "tslib": "^2.4.0" }, "peerDependencies": { "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["react", "react-dom"] }, "sha512-9E33ebgMaO33w1nN/jEdW8z3/GO483fMi4rqbMG9rt83XgW9QLKRe4NcmJ8s+fQ3O34++UHrIQwlIWGIWTITjA=="],
 
     "fresh": ["fresh@2.0.0", "", {}, "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A=="],
 
@@ -1666,7 +1803,7 @@
 
     "get-stream": ["get-stream@9.0.1", "", { "dependencies": { "@sec-ant/readable-stream": "^0.4.1", "is-stream": "^4.0.1" } }, "sha512-kVCxPF3vQM/N0B1PmoqVUqgHP+EeVjmZSQn+1oCRPxd2P21P2F19lIgbR3HBosbB1PUhOAoctJnfEn2GbN2eZA=="],
 
-    "get-tsconfig": ["get-tsconfig@4.14.1", "", { "dependencies": { "resolve-pkg-maps": "^1.0.0" } }, "sha512-Dz/6HxkrxgNehhxLVeyv8sad9UzF2xBVeaKBQNDfJ5XiSXmp2gTR0eO0RWiT2NCKS5aGP9jjkOMggTN90qU50A=="],
+    "get-tsconfig": ["get-tsconfig@4.14.3", "", { "dependencies": { "resolve-pkg-maps": "^1.0.0" } }, "sha512-++QEw4DIY7WGoukz+/+A/8dGYPT9l9yIadnmSgZ8Rjr3YVSVDipQSO9CdnJo9ePqFqUUqh+wk9uIaoiAwsiPkA=="],
 
     "giget": ["giget@3.3.1", "", { "bin": { "giget": "dist/cli.mjs" } }, "sha512-r+mvuDjrjMpsdw46Kmeydb8bdHm7wOKw8wNBtTndkjbPjgAp5oUJUxRE76wZFknxIPokfWvep2qSXK37aXE6zg=="],
 
@@ -1684,10 +1821,6 @@
 
     "h3": ["h3@1.15.11", "", { "dependencies": { "cookie-es": "^1.2.3", "crossws": "^0.3.5", "defu": "^6.1.6", "destr": "^2.0.5", "iron-webcrypto": "^1.2.1", "node-mock-http": "^1.0.4", "radix3": "^1.1.2", "ufo": "^1.6.3", "uncrypto": "^0.1.3" } }, "sha512-L3THSe2MPeBwgIZVSH5zLdBBU90TOxarvhK9d04IDY2AmVS8j2Jz2LIWtwsGOU3lu2I5jCN7FNvVfY2+XyF+mg=="],
 
-    "hachure-fill": ["hachure-fill@0.5.2", "", {}, "sha512-3GKBOn+m2LX9iq+JC1064cSFprJY4jL1jCXTcpnfER5HYE2l/4EfWSGzkPa/ZDBmYI0ZOEj5VHV/eKnPGkHuOg=="],
-
-    "has-flag": ["has-flag@4.0.0", "", {}, "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="],
-
     "has-symbols": ["has-symbols@1.1.0", "", {}, "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ=="],
 
     "has-tostringtag": ["has-tostringtag@1.0.2", "", { "dependencies": { "has-symbols": "^1.0.3" } }, "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw=="],
@@ -1716,7 +1849,7 @@
 
     "helmet": ["helmet@8.3.0", "", {}, "sha512-Qgpiaws3Sm30Av8Eah6sjMCZZwjlBu+E68rhpCWBshY1lb09HtLwj5GviX0OyQIn+ulUS0iX0AxN5n3tLZzz1w=="],
 
-    "hono": ["hono@4.12.33", "", {}, "sha512-+SwvkaiJtxsiPjhy9LivY/1m7UsNqCJetM1BrZl9A5DkQhlbHQDU730mMiDPWjnoCYOM8Chf3WrCJw27kNTPFQ=="],
+    "hono": ["hono@4.13.7", "", {}, "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ=="],
 
     "hookable": ["hookable@6.1.1", "", {}, "sha512-U9LYDy1CwhMCnprUfeAZWZGByVbhd54hwepegYTK7Pi5NvqEj63ifz5z+xukznehT7i6NIZRu89Ay1AZmRsLEQ=="],
 
@@ -1734,16 +1867,16 @@
 
     "iconv-lite": ["iconv-lite@0.7.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ=="],
 
+    "idn-hostname": ["idn-hostname@17.0.3", "", { "dependencies": { "punycode": "^2.3.1" } }, "sha512-jah2u3Omm11YP1ORFVTPLrlrBdRT4Wc7xWPTg1rMRquSmEhOqkNpM15bIwDb9ugtq2S5tLe5b+gLHXQeZ3RiMw=="],
+
     "ieee754": ["ieee754@1.2.1", "", {}, "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA=="],
 
     "ignore": ["ignore@5.3.2", "", {}, "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g=="],
 
-    "immer": ["immer@10.2.0", "", {}, "sha512-d/+XTN3zfODyjr89gM3mPq1WNX2B8pYsu7eORitdwyA2sBubnTl3laYlBk4sXY5FUa5qTZGBDPJICVbvqzjlbw=="],
+    "immer": ["immer@11.1.18", "", {}, "sha512-EQyQtLiYW029lyoczMl/Hh4Xu7cDecSc58JRYpHyL4tIAu3eqd1yJzQX04d2BZHDkzFFvm6qJEJWOtfDSWAXbQ=="],
 
     "import-fresh": ["import-fresh@3.3.1", "", { "dependencies": { "parent-module": "^1.0.0", "resolve-from": "^4.0.0" } }, "sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ=="],
 
-    "import-meta-resolve": ["import-meta-resolve@4.2.0", "", {}, "sha512-Iqv2fzaTQN28s/FwZAoFq0ZSs/7hMAHJVX+w8PZl3cY19Pxk6jFFalxQoIfW2826i/fDLXv8IiEZRIT0lDuWcg=="],
-
     "inflation": ["inflation@2.1.0", "", {}, "sha512-t54PPJHG1Pp7VQvxyVCJ9mBbjG3Hqryges9bXoOO6GExCPa+//i/d5GSuFtpx3ALLd7lgIAur6zrIlBQyJuMlQ=="],
 
     "inherits": ["inherits@2.0.4", "", {}, "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="],
@@ -1754,7 +1887,7 @@
 
     "internmap": ["internmap@2.0.3", "", {}, "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg=="],
 
-    "ip-address": ["ip-address@10.4.0", "", {}, "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ=="],
+    "ip-address": ["ip-address@10.7.0", "", {}, "sha512-BGFsyJd5mpXp3rK6jIdADLNgpJUK1jnjzvYF8lK+VyDab9JAmqN0YOKDdP17HlgKb2+ehPgDc8EtnRLbGCAMhA=="],
 
     "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="],
 
@@ -1774,8 +1907,6 @@
 
     "is-extglob": ["is-extglob@2.1.1", "", {}, "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ=="],
 
-    "is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
-
     "is-glob": ["is-glob@4.0.3", "", { "dependencies": { "is-extglob": "^2.1.1" } }, "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg=="],
 
     "is-hexadecimal": ["is-hexadecimal@2.0.1", "", {}, "sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg=="],
@@ -1804,7 +1935,7 @@
 
     "is-unicode-supported": ["is-unicode-supported@2.1.0", "", {}, "sha512-mE00Gnza5EEB3Ds0HfMyllZzbBrmLOX3vfWoj9A9PEnTfratQ/BcaJOuMhnkhjXvb2+FkY3VuHqtAGpTPmglFQ=="],
 
-    "is-unsafe": ["is-unsafe@2.0.0", "", {}, "sha512-2LdV822R+wmI86unXA93WCFpL6g+av8ynWk0nrHyJqGop5VoocYsSLFgN8jrfalT6iGeLNM4KXuVSsULP53kEA=="],
+    "is-unsafe": ["is-unsafe@2.0.2", "", {}, "sha512-HgbIHPBH0KHHCcjLfGsCvhtPTVxjaAZlXjwdz7/GQC40SjSe4sfQsar8J5VFo8JOSbarkpV0OLG95bbaNd9aAQ=="],
 
     "is-wsl": ["is-wsl@3.1.1", "", { "dependencies": { "is-inside-container": "^1.0.0" } }, "sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw=="],
 
@@ -1814,7 +1945,7 @@
 
     "jiti": ["jiti@2.7.0", "", { "bin": { "jiti": "lib/jiti-cli.mjs" } }, "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ=="],
 
-    "jose": ["jose@6.2.5", "", {}, "sha512-2E5L2yRp03FnwreJLJX8/r7mHiZICCf8kG7fAsTWkSQTDAcc46NIZoQLKy+EJ8sPoJlxyS4OQR5H70LjIZZlIQ=="],
+    "jose": ["jose@6.2.12", "", {}, "sha512-9NiFmJEex0sy2Dk58j2UGBSHgUs2ypF9eZSu4L6vjOX3Dp96Sw1F3uL+H+D1sx02jZZdzUT0HgvCy59CuvXcWw=="],
 
     "js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
 
@@ -1834,23 +1965,19 @@
 
     "jsonfile": ["jsonfile@6.2.1", "", { "dependencies": { "universalify": "^2.0.0" }, "optionalDependencies": { "graceful-fs": "^4.1.6" } }, "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q=="],
 
-    "just-bash": ["just-bash@3.2.0", "", { "dependencies": { "diff": "^8.0.2", "fast-xml-parser": "^5.7.3", "file-type": "^21.2.0", "ini": "^6.0.0", "minimatch": "^10.1.1", "modern-tar": "^0.7.3", "papaparse": "^5.5.3", "quickjs-emscripten": "^0.32.0", "re2js": "^1.2.1", "seek-bzip": "^2.0.0", "smol-toml": "^1.6.0", "sprintf-js": "^1.1.3", "sql.js": "^1.13.0", "turndown": "^7.2.2", "undici": "^7.25.0", "yaml": "^2.8.2" }, "optionalDependencies": { "@mongodb-js/zstd": "^7.0.0", "node-liblzma": "^2.0.3" }, "bin": { "just-bash": "dist/bin/just-bash.js", "just-bash-shell": "dist/bin/shell/shell.js" } }, "sha512-hRTLLWBXCKuosjaNFJR7uPYBza+T2vjG3NdPBz4wxlctlnxwrbLjtLQf6RtSKmy/jzNJ6/URCtvxrXjy6yFGeQ=="],
-
-    "katex": ["katex@0.16.47", "", { "dependencies": { "commander": "^8.3.0" }, "bin": { "katex": "cli.js" } }, "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg=="],
+    "just-bash": ["just-bash@3.4.2", "", { "dependencies": { "diff": "^8.0.4", "fast-xml-parser": "^5.10.1", "file-type": "^21.3.4", "ini": "^6.0.0", "minimatch": "^10.2.6", "modern-tar": "^0.7.7", "papaparse": "^5.6.0", "quickjs-emscripten": "^0.32.0", "re2js": "^1.3.3", "seek-bzip": "^2.0.0", "smol-toml": "^1.8.0", "sprintf-js": "^1.1.3", "sql.js": "^1.14.1", "turndown": "^7.2.4", "undici": "^7.29.0", "yaml": "^2.9.0" }, "optionalDependencies": { "@mongodb-js/zstd": "^7.0.0", "node-liblzma": "^2.2.0" }, "bin": { "just-bash": "dist/bin/just-bash.js", "just-bash-shell": "dist/bin/shell/shell.js" } }, "sha512-T0Vpy7YRgCjxJdqG3tkxn0ZnIDLJvVwb8hH4L+6NVdp+Te27jQxjxnszW9ODjEKbWxWujj83rP5S0GQxCSufgg=="],
 
     "keyv": ["keyv@5.6.0", "", { "dependencies": { "@keyv/serialize": "^1.1.1" } }, "sha512-CYDD3SOtsHtyXeEORYRx2qBtpDJFjRTGXUtmNEMGyzYOKj1TE3tycdlho7kA1Ufx9OYWZzg52QFBGALTirzDSw=="],
 
-    "khroma": ["khroma@2.1.0", "", {}, "sha512-Ls993zuzfayK269Svk9hzpeGUKob/sIgZzyHYdjQoAdQetRKpOLj+k/QQQ/6Qi0Yz65mlROrfd+Ev+1+7dz9Kw=="],
-
     "kleur": ["kleur@4.1.5", "", {}, "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="],
 
-    "knip": ["knip@6.32.2", "", { "dependencies": { "fdir": "^6.5.0", "formatly": "^0.3.0", "get-tsconfig": "4.14.1", "jiti": "^2.7.0", "oxc-parser": "^0.143.0", "oxc-resolver": "11.24.2", "picomatch": "^4.0.5", "smol-toml": "^1.7.1", "strip-json-comments": "5.0.3", "tinyglobby": "^0.2.17", "unbash": "^4.0.9", "yaml": "^2.9.0", "zod": "^4.4.3" }, "bin": { "knip": "bin/knip.js", "knip-bun": "bin/knip-bun.js" } }, "sha512-WXTXbmocrw7gqm1A1TQvFN0OgJ7hUSU6E1g6SPRIzzHFogUBhXByc7cYeOFVtJ2uODg7DP4VbESYBYnfbtBYsg=="],
+    "knip": ["knip@6.35.1", "", { "dependencies": { "fdir": "^6.5.0", "formatly": "^0.7.0", "get-tsconfig": "4.14.3", "jiti": "^2.7.0", "oxc-parser": "^0.148.0", "oxc-resolver": "11.24.2", "picomatch": "^4.0.7", "smol-toml": "^1.8.0", "strip-json-comments": "5.0.3", "tinyglobby": "^0.2.17", "unbash": "^4.0.11", "yaml": "^2.9.0", "zod": "^4.4.3" }, "bin": { "knip": "bin/knip.js", "knip-bun": "bin/knip-bun.js" } }, "sha512-22wnEnv4do2fvoeJsxpFCG/MBxReNxoCVBccaCl7suUJsG+F0UvxI9ycxZ9YgtLHSSjrZl5tOas0JZ/R1vJ93g=="],
 
-    "kysely": ["kysely@0.29.4", "", {}, "sha512-y5mVgQNkMbs1eK9Xyc0pmNdabN2wHhRYY/5r4W5HrUT1rYCEPeVNSj1RUJeSDKT3U0p+mXCvLgkrFuIafYI6BA=="],
+    "koa-compose": ["koa-compose@4.1.0", "", {}, "sha512-8ODW8TrDuMYvXRwra/Kh7/rJo9BtOfPc6qO8eAfC80CnCvSjSl0bkRM24X6/XBBEyj0v1nRUQ1LyOy3dbqOWXw=="],
 
-    "layout-base": ["layout-base@1.0.2", "", {}, "sha512-8h2oVEZNktL4BH2JCOI90iD1yXwL6iNW7KcCKT2QZgQJR2vbqDsldCTPRU9NifTCqHZci57XvQQ15YTu+sTYPg=="],
+    "kysely": ["kysely@0.29.5", "", {}, "sha512-ooa+eSbBNPTo3MycPEuW5jdrxQdQwdtB3LC3h43FiXQbIry5tR0C5lDG7eealK0E4D7XjrnOP5DIUg/LyjRMYQ=="],
 
-    "libphonenumber-js": ["libphonenumber-js@1.13.10", "", {}, "sha512-xJxrdqvbl2rtn2MaUJrUejz8J7/uZNC0V77oks2LxYrO/+ZtVpRmz+fEQMuu6VusnEB1fmpByiLS1WXecOnAnw=="],
+    "libphonenumber-js": ["libphonenumber-js@1.13.13", "", {}, "sha512-hV6SmWnyQ8U1QXhhqbqYBHIStNnscG7A5XbGodgdHhf/8N5PwhYpJA5U/yHDjYwPYTd8uNGXqq416XctuvK2PA=="],
 
     "lightningcss": ["lightningcss@1.32.0", "", { "dependencies": { "detect-libc": "^2.0.3" }, "optionalDependencies": { "lightningcss-android-arm64": "1.32.0", "lightningcss-darwin-arm64": "1.32.0", "lightningcss-darwin-x64": "1.32.0", "lightningcss-freebsd-x64": "1.32.0", "lightningcss-linux-arm-gnueabihf": "1.32.0", "lightningcss-linux-arm64-gnu": "1.32.0", "lightningcss-linux-arm64-musl": "1.32.0", "lightningcss-linux-x64-gnu": "1.32.0", "lightningcss-linux-x64-musl": "1.32.0", "lightningcss-win32-arm64-msvc": "1.32.0", "lightningcss-win32-x64-msvc": "1.32.0" } }, "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ=="],
 
@@ -1886,8 +2013,6 @@
 
     "lodash": ["lodash@4.18.1", "", {}, "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q=="],
 
-    "lodash-es": ["lodash-es@4.18.1", "", {}, "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A=="],
-
     "log-symbols": ["log-symbols@6.0.0", "", { "dependencies": { "chalk": "^5.3.0", "is-unicode-supported": "^1.3.0" } }, "sha512-i24m8rpwhmPIS4zscNzK6MSEhk0DUWa/8iYQWxhffV8jkI4Phvs3F+quL5xvS0gdQR0FyTCMMH33Y78dDTzzIw=="],
 
     "long": ["long@5.3.2", "", {}, "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA=="],
@@ -1898,11 +2023,13 @@
 
     "lru-cache": ["lru-cache@5.1.1", "", { "dependencies": { "yallist": "^3.0.2" } }, "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w=="],
 
-    "lru.min": ["lru.min@1.1.4", "", {}, "sha512-DqC6n3QQ77zdFpCMASA1a3Jlb64Hv2N2DciFGkO/4L9+q/IpIAuRlKOvCXabtRW6cQf8usbmM6BE/TOPysCdIA=="],
+    "lru.min": ["lru.min@1.1.5", "", {}, "sha512-5J9ysMYUpYIg9RF2vJpy9SinEmSviFSe0GyPpCQ4L5QSkLAgeLXlTAOu2ZwWUU5m+0SBl6gUU1R1ZQB3aKypfA=="],
 
     "lru_map": ["lru_map@0.4.1", "", {}, "sha512-I+lBvqMMFfqaV8CJCISjI3wbjmwVu/VyOoU7+qtu9d7ioW5klMgsTTiUOUp+DJvfTTzKXoPbyC6YfgkNcyPSOg=="],
 
-    "lucide-react": ["lucide-react@1.28.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-fARAFJULsGuDDydjp6+6blekG/sBIM29TerzLjc9bQUKAcEfrSc4ZQKb25KRz4OMKd87cZTb5dgq0w/T6KufVg=="],
+    "ltx": ["ltx@3.1.2", "", {}, "sha512-tFSKojN92FqNK6eRTmKK/ROUTUYVWKAxgohz523TPhF1G3nR3DXQS/I7/705rEPrDSloKDgMdRlh0qgMFQoVYw=="],
+
+    "lucide-react": ["lucide-react@1.43.0", "", { "peerDependencies": { "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-ubtnda1fVK5ky0PNEpOmB0wiwhpZUyJiol4K14KCm+QKvuCkfUu54Et/rIjyupJpwiJ5Hg+BLQE86/GEsS+IgQ=="],
 
     "magic-string": ["magic-string@0.30.21", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.5" } }, "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ=="],
 
@@ -1950,8 +2077,6 @@
 
     "merge2": ["merge2@1.4.1", "", {}, "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg=="],
 
-    "mermaid": ["mermaid@11.16.0", "", { "dependencies": { "@braintree/sanitize-url": "^7.1.2", "@iconify/utils": "^3.0.2", "@mermaid-js/parser": "^1.2.0", "@types/d3": "^7.4.3", "@upsetjs/venn.js": "^2.0.0", "cytoscape": "^3.33.3", "cytoscape-cose-bilkent": "^4.1.0", "cytoscape-fcose": "^2.2.0", "d3": "^7.9.0", "d3-sankey": "^0.12.3", "dagre-d3-es": "7.0.14", "dayjs": "^1.11.20", "dompurify": "^3.3.3", "es-toolkit": "^1.45.1", "katex": "^0.16.45", "khroma": "^2.1.0", "marked": "^16.3.0", "roughjs": "^4.6.6", "stylis": "^4.3.6", "ts-dedent": "^2.2.0", "uuid": "^11.1.0 || ^12 || ^13 || ^14.0.0" } }, "sha512-Zvm3kbstgdpvIJPPItlL7fppIZ3kibvc1oZIGxdvk9t6UFz6flv+Jw7FtRGKwfcI8OckmH04LqG6LlS6X4B1pA=="],
-
     "methods": ["methods@1.1.2", "", {}, "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w=="],
 
     "micromark": ["micromark@4.0.2", "", { "dependencies": { "@types/debug": "^4.0.0", "debug": "^4.0.0", "decode-named-character-reference": "^1.0.0", "devlop": "^1.0.0", "micromark-core-commonmark": "^2.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-chunked": "^2.0.0", "micromark-util-combine-extensions": "^2.0.0", "micromark-util-decode-numeric-character-reference": "^2.0.0", "micromark-util-encode": "^2.0.0", "micromark-util-normalize-identifier": "^2.0.0", "micromark-util-resolve-all": "^2.0.0", "micromark-util-sanitize-uri": "^2.0.0", "micromark-util-subtokenize": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-zpe98Q6kvavpCr1NPVSCMebCKfD7CA2NqZ+rykeNhONIJBpc1tFKt9hucLGwha3jNTNI8lHpctWJWoimVF4PfA=="],
@@ -1966,7 +2091,7 @@
 
     "micromark-extension-gfm-strikethrough": ["micromark-extension-gfm-strikethrough@2.1.0", "", { "dependencies": { "devlop": "^1.0.0", "micromark-util-chunked": "^2.0.0", "micromark-util-classify-character": "^2.0.0", "micromark-util-resolve-all": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-ADVjpOOkjz1hhkZLlBiYA9cR2Anf8F4HqZUO6e5eDcPQd0Txw5fxLzzxnEkSkfnD0wziSGiv7sYhk/ktvbf1uw=="],
 
-    "micromark-extension-gfm-table": ["micromark-extension-gfm-table@2.1.1", "", { "dependencies": { "devlop": "^1.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-t2OU/dXXioARrC6yWfJ4hqB7rct14e8f7m0cbI5hUmDyyIlwv5vEtooptH8INkbLzOatzKuVbQmAYcbWoyz6Dg=="],
+    "micromark-extension-gfm-table": ["micromark-extension-gfm-table@2.1.2", "", { "dependencies": { "devlop": "^1.0.0", "micromark-factory-space": "^2.0.0", "micromark-util-character": "^2.0.0", "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-pRzm4kDTu0MjlmBkxmS9yYhw60nncfcEwu9NNdPFSQEFXS95ZKyIIyTSHu/o3ReBUrLKYEq+7YaXCRn/bPB4MA=="],
 
     "micromark-extension-gfm-tagfilter": ["micromark-extension-gfm-tagfilter@2.0.0", "", { "dependencies": { "micromark-util-types": "^2.0.0" } }, "sha512-xHlTOmuCSotIA8TW1mDIM6X2O1SiX5P9IuDtqGonFhEK0qgRI4yeC6vMxEV2dgyr2TiD+2PQ10o+cOhdVAcwfg=="],
 
@@ -2012,7 +2137,7 @@
 
     "micromatch": ["micromatch@4.0.8", "", { "dependencies": { "braces": "^3.0.3", "picomatch": "^2.3.1" } }, "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA=="],
 
-    "microsandbox": ["microsandbox@0.6.8", "", { "optionalDependencies": { "@superradcompany/microsandbox-darwin-arm64": "0.6.8", "@superradcompany/microsandbox-linux-arm64-gnu": "0.6.8", "@superradcompany/microsandbox-linux-x64-gnu": "0.6.8", "@superradcompany/microsandbox-win32-arm64-msvc": "0.6.8", "@superradcompany/microsandbox-win32-x64-msvc": "0.6.8" }, "bin": { "microsandbox": "bin/microsandbox.cjs", "msb": "bin/microsandbox.cjs" } }, "sha512-N9sqwUFjeRisBJPyu3uV0f+BFsWQmrxogGoZw0jXuLY9+ey0cgPTzQBLhjKyCbe6rq8joGtefvyS3J4vEW7DBQ=="],
+    "microsandbox": ["microsandbox@0.6.17", "", { "optionalDependencies": { "@superradcompany/microsandbox-darwin-arm64": "0.6.17", "@superradcompany/microsandbox-linux-arm64-gnu": "0.6.17", "@superradcompany/microsandbox-linux-x64-gnu": "0.6.17", "@superradcompany/microsandbox-win32-arm64-msvc": "0.6.17", "@superradcompany/microsandbox-win32-x64-msvc": "0.6.17" }, "bin": { "microsandbox": "bin/microsandbox.cjs", "msb": "bin/microsandbox.cjs" } }, "sha512-1JpOtboSgnv2qGzwIRF2GwiMH+79RnY/I6QNriA9WCqsmoSWh5sYoeRNpAPnuUhxm9GYztWNvFST+aZ3+p8iYg=="],
 
     "mime": ["mime@2.6.0", "", { "bin": { "mime": "cli.js" } }, "sha512-USPkMeET31rOMiarsBNIHZKLGgvKc/LrjofAnBlOttf5ajRvqiRA8QsenbcooctK6d6Ts6aqZXBA+XbkKthiQg=="],
 
@@ -2034,11 +2159,11 @@
 
     "modern-tar": ["modern-tar@0.7.7", "", {}, "sha512-t9VmxaqrmANnEOBhpSDI6HD192Ge48k8vmWqQQL7hSFEqHEYwZbbsu49+aKLWZeRvFs3j1pMhXOqqF4kPlvjkQ=="],
 
-    "motion": ["motion@12.43.0", "", { "dependencies": { "framer-motion": "^12.43.0", "tslib": "^2.4.0" }, "peerDependencies": { "@emotion/is-prop-valid": "*", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["@emotion/is-prop-valid", "react", "react-dom"] }, "sha512-BQgQbSa9Hn3/mtbib0MK53y6JSANa+YKUKlaYnWzAVDH424RYQ5LVpV3pNiWH00BA2z4ojsSdMzqT7g2FQwjuQ=="],
+    "motion": ["motion@13.2.0", "", { "dependencies": { "framer-motion": "^13.2.0", "tslib": "^2.4.0" }, "peerDependencies": { "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" }, "optionalPeers": ["react", "react-dom"] }, "sha512-4Hrb5vD6HhjFstLUiCmWvtpsw+WTpP4R+QXfSDYZBz7+uxE/LrRg3aV0ReJxHrTRffHhbIE6svEqnotngXvesQ=="],
 
-    "motion-dom": ["motion-dom@12.43.0", "", { "dependencies": { "motion-utils": "^12.39.0" } }, "sha512-azKON4d9S65PEoFUiQTMTgPheEmzf2QngdRc50AKfJp9Q9mmcBVw22c8eMq9k8kxOFHdL7+WZY7N/5F/lwiDag=="],
+    "motion-dom": ["motion-dom@13.2.0", "", { "dependencies": { "motion-utils": "^13.0.0" } }, "sha512-N6gdSoWRDk0Rh/fVtlqUtLs+fEN3ELFZI3cn3IQE9Mnf3E+Mh8wjO6MstzCOPFh4Yf0L1as5m2eUyYWj8ylVSQ=="],
 
-    "motion-utils": ["motion-utils@12.39.0", "", {}, "sha512-8nadJAJjTtqRkmRF36FoJTrywK9nnFmnPwnSMyxaOCU7GDjN9RTMJIxx9De8ErM+vpPhMccr/6fo5WciyQLnMQ=="],
+    "motion-utils": ["motion-utils@13.0.0", "", {}, "sha512-7DnN7TmbLcYXcG4RVadXIihWlyuM9afoUww8Y5Agg431kGKiuL2/OMyP4mJ5wLz+pvN3t5ySClLOaVXJ+wekRQ=="],
 
     "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
 
@@ -2048,27 +2173,27 @@
 
     "named-placeholders": ["named-placeholders@1.1.6", "", { "dependencies": { "lru.min": "^1.1.0" } }, "sha512-Tz09sEL2EEuv5fFowm419c1+a/jSMiBjI9gHxVLrVdbUkkNUUfjsVYs9pVZu5oCon/kmRh9TfLEObFtkVxmY0w=="],
 
-    "nanoid": ["nanoid@3.3.16", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q=="],
+    "nanoid": ["nanoid@3.3.19", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug=="],
 
-    "nanostores": ["nanostores@1.4.2", "", {}, "sha512-Wxv8Roefr2nqtiRG0bnaFlpYqpIVtOEeJZHaH+4nGgOK1/7n6OHOuHCb/bhqrNQgZM8fyd0s1PqhdrJc9Ib44g=="],
+    "nanostores": ["nanostores@1.5.3", "", {}, "sha512-rQLB6eV4f2AW/n3L0JmwCROpaisYy9EDEADvEFSd1C/qG8hB6O5TPlh9A791JRbJr4CnMQBzptDcvD9OR1+6WA=="],
 
     "napi-build-utils": ["napi-build-utils@2.0.0", "", {}, "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA=="],
 
-    "negotiator": ["negotiator@1.0.0", "", {}, "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg=="],
+    "negotiator": ["negotiator@1.1.0", "", { "dependencies": { "content-type": "^2.1.0" } }, "sha512-NMPBRMJgiQHjbd8phG3Vebdx4kZ1H121rbl5IkMqeOsahptB9BKo/d7oJ3zTXqTgagn2bWlNSXkh0QUGM31RYg=="],
 
     "nestjs-trpc": ["nestjs-trpc@2.13.0", "", { "dependencies": { "lodash": "^4.17.21", "tslib": "^2.5.0" }, "peerDependencies": { "@nestjs/common": "^9.3.8 || ^10.0.0 || ^11.0.0", "@nestjs/core": "^9.3.8 || ^10.0.0 || ^11.0.0", "@trpc/server": "^11.0.0", "reflect-metadata": "^0.1.13 || ^0.2.0", "rxjs": "7.8.1", "zod": "^3.14.0 || ^4.0.0" }, "bin": { "nestjs-trpc": "bin/nestjs-trpc.js" } }, "sha512-kip+4dI6vnoe/wDDtCz9ITu9WJ80dHSnSQHJR5B0WNf5FIqB9Haz69msXwV/QI8GpHsBaU5Vs9nJC1dGJkroQw=="],
 
-    "next": ["next@16.2.12", "", { "dependencies": { "@next/env": "16.2.12", "@swc/helpers": "0.5.15", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", "postcss": "8.4.31", "styled-jsx": "5.1.6" }, "optionalDependencies": { "@next/swc-darwin-arm64": "16.2.12", "@next/swc-darwin-x64": "16.2.12", "@next/swc-linux-arm64-gnu": "16.2.12", "@next/swc-linux-arm64-musl": "16.2.12", "@next/swc-linux-x64-gnu": "16.2.12", "@next/swc-linux-x64-musl": "16.2.12", "@next/swc-win32-arm64-msvc": "16.2.12", "@next/swc-win32-x64-msvc": "16.2.12", "sharp": "^0.34.5" }, "peerDependencies": { "@opentelemetry/api": "^1.1.0", "@playwright/test": "^1.51.1", "babel-plugin-react-compiler": "*", "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "sass": "^1.3.0" }, "optionalPeers": ["@opentelemetry/api", "@playwright/test", "babel-plugin-react-compiler", "sass"], "bin": { "next": "dist/bin/next" } }, "sha512-iD59eYQWmbFcEbX7v/acG5DRym9iw1DdaPoD0WTA920naWsE25wShzJW4+UvAs8MK9EC2kBfIH6vtto1H1PHGw=="],
+    "next": ["next@16.3.4", "", { "dependencies": { "@next/env": "16.3.4", "@swc/helpers": "0.5.23", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", "postcss": "8.5.23", "styled-jsx": "5.1.6" }, "optionalDependencies": { "@next/swc-darwin-arm64": "16.3.4", "@next/swc-darwin-x64": "16.3.4", "@next/swc-linux-arm64-gnu": "16.3.4", "@next/swc-linux-arm64-musl": "16.3.4", "@next/swc-linux-x64-gnu": "16.3.4", "@next/swc-linux-x64-musl": "16.3.4", "@next/swc-win32-arm64-msvc": "16.3.4", "@next/swc-win32-x64-msvc": "16.3.4", "sharp": "^0.35.4" }, "peerDependencies": { "@opentelemetry/api": "^1.1.0", "@playwright/test": "^1.51.1", "babel-plugin-react-compiler": "*", "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "sass": "^1.3.0" }, "optionalPeers": ["@opentelemetry/api", "@playwright/test", "babel-plugin-react-compiler", "sass"], "bin": { "next": "dist/bin/next" } }, "sha512-/Ztf6CeRH+ejEXUrYtqI4gkS66eFIHuSwqi60RgcpWKodxFZx2/dqVCMKBwILfAHXQ+F1b1vAudgj3mnxqtoIA=="],
 
     "next-themes": ["next-themes@0.4.6", "", { "peerDependencies": { "react": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc", "react-dom": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc" } }, "sha512-pZvgD5L0IEvX5/9GWyHMf3m8BKiVQwsCMHfoFosXtXBMnaS0ZnIJ9ST4b4NqLVKDEm8QBxoNNGNaBv2JNF6XNA=="],
 
-    "nf3": ["nf3@0.3.23", "", {}, "sha512-RWVLAWozmVD3AaDmaU3qMGB3v+yNlH5d9qqStI4e/WLlNQVnJ4YErGDbYCIrGFyrHdbF6I6Baf0Ae6c7tFYmSg=="],
+    "nf3": ["nf3@0.3.24", "", {}, "sha512-HxLK4bo+5jNsEETZp4w3tJblHOA9MCBY14IN9nZJJV8JDxt9yNIYxuBuLMjTAR5GFa3HL61+8VQDUrXv3/C8fw=="],
 
-    "nitro": ["nitro@3.0.260610-beta", "", { "dependencies": { "consola": "^3.4.2", "crossws": "^0.4.6", "db0": "^0.3.4", "env-runner": "^0.1.12", "h3": "2.0.1-rc.22", "hookable": "^6.1.1", "nf3": "^0.3.17", "ocache": "^0.1.5", "ofetch": "2.0.0-alpha.3", "ohash": "^2.0.11", "rolldown": "^1.1.0", "srvx": "^0.11.16", "unenv": "2.0.0-rc.24", "unstorage": "2.0.0-alpha.7" }, "peerDependencies": { "@vercel/queue": "^0.3.0", "dotenv": "*", "giget": "*", "jiti": "^2.7.0", "rollup": "^4.61.1", "vite": "^7 || ^8", "xml2js": "^0.6.2", "zephyr-agent": "^0.2.0" }, "optionalPeers": ["@vercel/queue", "dotenv", "giget", "jiti", "rollup", "vite", "xml2js", "zephyr-agent"], "bin": { "nitro": "dist/cli/index.mjs" } }, "sha512-KPb4L5yaF/Rx/xoGMpgHRJvZhbhGiqbRKOwwPLCH9jKTKTsEUHLjnJas85AeCzaswqa8Wi52eQBtRsODC4PS0Q=="],
+    "nitro": ["nitro@3.0.260903-beta", "", { "dependencies": { "consola": "^3.4.2", "crossws": "^0.4.12", "db0": "^0.4.1", "env-runner": "^0.2.1", "h3": "^2.0.1-rc.31", "hookable": "^6.1.1", "nf3": "^0.3.24", "ocache": "^0.3.0", "rolldown": "^1.2.7", "rou3": "^0.9.2", "srvx": "^1.0.3", "unenv": "^2.0.0-rc.24", "unstorage": "^2.0.0-alpha.10" }, "bin": { "nitro": "dist/cli/index.mjs" } }, "sha512-54gANPi62O8rfMvepiJUVuIzEIinYfpeHbebywlLxvVTgIYXDwSvpaU9Id+0sJOBjBx0wC1/CVYXJkH7SY+l0g=="],
 
-    "node-abi": ["node-abi@3.94.0", "", { "dependencies": { "semver": "^7.3.5" } }, "sha512-W5ZNO5KRPB5TkYmGVD9F6YqhsglXJzE6etpbmT+f6EQElhiX/UTG551cnsRGvLG3fyZEg9HwaDmNmj5nwJ4z9g=="],
+    "node-abi": ["node-abi@3.96.0", "", { "dependencies": { "semver": "^7.3.5" } }, "sha512-rebQ/lz7i0EkoLzUVSrKRzA69zMkwLp95kKMWoMDkkM00Suxz0D7zEQPwRml5fQum24mj7bPvmlgLAmu2JCiYg=="],
 
-    "node-addon-api": ["node-addon-api@8.9.1", "", {}, "sha512-4eUQWVPCUUUiBjLnHS3cXWeC6ryoPUc0U3rP7IuzapoGbzMqd/r6KKO0clr0b+snQhsrueFEhCZDdK+LK7hxKg=="],
+    "node-addon-api": ["node-addon-api@8.9.2", "", {}, "sha512-VijLXbi3UACN69I0JVXJsX4tjACjNoQDgv2gTF6sx2wWEi8tkSg2eX8p5gSIFi8z2+DL3oHmY6OyKce38SDolg=="],
 
     "node-gyp-build": ["node-gyp-build@4.8.4", "", { "bin": { "node-gyp-build": "bin.js", "node-gyp-build-optional": "optional.js", "node-gyp-build-test": "build-test.js" } }, "sha512-LA4ZjwlnUblHVgq0oBF3Jl/6h/Nvs5fzBLwdEF4nuxnFdsfajde4WfxtJr3CaiH+F6ewcIB/q4jQ4UzPyid+CQ=="],
 
@@ -2076,13 +2201,13 @@
 
     "node-mock-http": ["node-mock-http@1.0.5", "", {}, "sha512-KQyt/wLjG3TAc7DOUhpqWzgd4ERxR80JOlTK5VE5R1S12IaPVN5qkj4klBce9HPG1Njuup4Sb5bljaT34lIyjw=="],
 
-    "node-releases": ["node-releases@2.0.51", "", {}, "sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ=="],
+    "node-releases": ["node-releases@2.0.55", "", {}, "sha512-mIrE/Cw9y+9Au6dS5vDKDhQza9YvG6w+ZrS6X+ZzA7yFW/soAeaups4Qzn1bL6g5FVy8WtP79+0j82oPIbqRjQ=="],
 
     "node-rsa": ["node-rsa@1.1.1", "", { "dependencies": { "asn1": "^0.2.4" } }, "sha512-Jd4cvbJMryN21r5HgxQOpMEqv+ooke/korixNNK3mGqfGJmy0M77WDDzo/05969+OkMy3XW1UuZsSmW9KQm7Fw=="],
 
     "npm-run-path": ["npm-run-path@6.0.0", "", { "dependencies": { "path-key": "^4.0.0", "unicorn-magic": "^0.3.0" } }, "sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA=="],
 
-    "nuqs": ["nuqs@2.9.4", "", { "dependencies": { "@standard-schema/spec": "1.1.0" }, "peerDependencies": { "@remix-run/react": ">=2", "@tanstack/react-router": "^1", "next": ">=14.2.0", "react": ">=18.2.0 || ^19.0.0-0", "react-router": "^5 || ^6 || ^7 || ^8", "react-router-dom": "^5 || ^6 || ^7" }, "optionalPeers": ["@remix-run/react", "@tanstack/react-router", "next", "react-router", "react-router-dom"] }, "sha512-lsz3NyCOKmuNAyW052i9RWqcTntoYb2Qm6FxSWnkTDwOJnGS6fzpXDAp0VcwTevw3xgnWebYpDr9rm6+o4DHbw=="],
+    "nuqs": ["nuqs@2.10.1", "", { "dependencies": { "@standard-schema/spec": "1.1.0" }, "peerDependencies": { "@remix-run/react": ">=2", "@tanstack/react-router": "^1", "next": ">=14.2.0", "react": ">=18.2.0 || ^19.0.0-0", "react-router": "^5 || ^6 || ^7 || ^8", "react-router-dom": "^5 || ^6 || ^7" }, "optionalPeers": ["@remix-run/react", "@tanstack/react-router", "next", "react-router", "react-router-dom"] }, "sha512-7lPZrPJVOsD0VvfQSKtodYBBPGPLsLzkFU8ueYIap9yMMJvSw6UC12p8luA5NW7aKe7AbPHKxcxb3OluH6iAJA=="],
 
     "object-assign": ["object-assign@4.1.1", "", {}, "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg=="],
 
@@ -2090,11 +2215,9 @@
 
     "object-treeify": ["object-treeify@1.1.33", "", {}, "sha512-EFVjAYfzWqWsBMRHPMAXLCDIJnpMhdWAqR7xG6M6a2cs6PMFpl/+Z20w9zDW4vkxOFfddegBKq9Rehd0bxWE7A=="],
 
-    "ocache": ["ocache@0.1.5", "", { "dependencies": { "ohash": "^2.0.11" } }, "sha512-kNNnkkVQup/QDvmTz8Q84wc2ntiyoVHDxa6eHWKt5qdGAmFRBIxy83rxgCYEjW0x06UJ9E3P6VgM2yY4rOBH4w=="],
-
-    "ofetch": ["ofetch@2.0.0-alpha.3", "", {}, "sha512-zpYTCs2byOuft65vI3z43Dd6iSdFbOZZLb9/d21aCpx2rGastVU9dOCv0lu4ykc1Ur1anAYjDi3SUvR0vq50JA=="],
+    "ocache": ["ocache@0.3.0", "", {}, "sha512-RS/9P0zeBb0gDJmadGERLH8lZNXK7xbufTDhclkXGvFGTsj0G4M5/cLk+mizcERH29mLXNnocfB5wjcK70wGJg=="],
 
-    "ohash": ["ohash@2.0.11", "", {}, "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ=="],
+    "ohash": ["ohash@2.0.12", "", {}, "sha512-65S/5gk9YSsaRjcyf7Nfa6h/d3E8/1gslpXfI4W7Dxn/oap8IKRuNT5VXkLQ1YFKIEg4apRY4Pj6aiwFzrDdmw=="],
 
     "on-finished": ["on-finished@2.4.1", "", { "dependencies": { "ee-first": "1.1.1" } }, "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg=="],
 
@@ -2106,7 +2229,7 @@
 
     "oniguruma-to-es": ["oniguruma-to-es@4.3.6", "", { "dependencies": { "oniguruma-parser": "^0.12.2", "regex": "^6.1.0", "regex-recursion": "^6.0.2" } }, "sha512-csuQ9x3Yr0cEIs/Zgx/OEt9iBw9vqIunAPQkx19R/fiMq2oGVTgcMqO/V3Ybqefr1TBvosI6jU539ksaBULJyA=="],
 
-    "open": ["open@10.2.0", "", { "dependencies": { "default-browser": "^5.2.1", "define-lazy-prop": "^3.0.0", "is-inside-container": "^1.0.0", "wsl-utils": "^0.1.0" } }, "sha512-YgBpdJHPyQ2UE5x+hlSXcnejzAvD0b22U2OuAP+8OnlJT+PjWPxtgmGqKKc+RgTM63U9gN0YzrYc71R2WT/hTA=="],
+    "open": ["open@11.0.3", "", { "dependencies": { "default-browser": "^5.5.1", "define-lazy-prop": "^3.0.0", "is-in-ssh": "^1.0.0", "is-inside-container": "^1.0.0", "powershell-utils": "^0.2.1", "wsl-utils": "^1.0.0" } }, "sha512-b3souUgU0VaAvMmzA4+9cRgrOgMdE0vc9H9VhQ0FYnjjcyZ8R/f9DiwMU9V8rl+vjf05On9UJhbgb06fsTs87Q=="],
 
     "openapi3-ts": ["openapi3-ts@4.4.0", "", { "dependencies": { "yaml": "^2.5.0" } }, "sha512-9asTNB9IkKEzWMcHmVZE7Ts3kC9G7AFHfs8i7caD8HbI76gEjdkId4z/AkP83xdZsH7PLAnnbl47qZkXuxpArw=="],
 
@@ -2114,11 +2237,11 @@
 
     "os-paths": ["os-paths@4.4.0", "", {}, "sha512-wrAwOeXp1RRMFfQY8Sy7VaGVmPocaLwSFOYCGKSyo8qmJ+/yaafCl5BCA1IQZWqFSRBrKDYFeR9d/VyQzfH/jg=="],
 
-    "oxc-parser": ["oxc-parser@0.143.0", "", { "dependencies": { "@oxc-project/types": "^0.143.0" }, "optionalDependencies": { "@oxc-parser/binding-android-arm-eabi": "0.143.0", "@oxc-parser/binding-android-arm64": "0.143.0", "@oxc-parser/binding-darwin-arm64": "0.143.0", "@oxc-parser/binding-darwin-x64": "0.143.0", "@oxc-parser/binding-freebsd-x64": "0.143.0", "@oxc-parser/binding-linux-arm-gnueabihf": "0.143.0", "@oxc-parser/binding-linux-arm-musleabihf": "0.143.0", "@oxc-parser/binding-linux-arm64-gnu": "0.143.0", "@oxc-parser/binding-linux-arm64-musl": "0.143.0", "@oxc-parser/binding-linux-ppc64-gnu": "0.143.0", "@oxc-parser/binding-linux-riscv64-gnu": "0.143.0", "@oxc-parser/binding-linux-riscv64-musl": "0.143.0", "@oxc-parser/binding-linux-s390x-gnu": "0.143.0", "@oxc-parser/binding-linux-x64-gnu": "0.143.0", "@oxc-parser/binding-linux-x64-musl": "0.143.0", "@oxc-parser/binding-openharmony-arm64": "0.143.0", "@oxc-parser/binding-win32-arm64-msvc": "0.143.0", "@oxc-parser/binding-win32-ia32-msvc": "0.143.0", "@oxc-parser/binding-win32-x64-msvc": "0.143.0" } }, "sha512-ov0NzaDCOInknS7mP1cwKdJERt3utPW8ldjtdUXQ8Ty0GEFD08wk422vCUN0d7pST6kqtV7dxoI9w1Zi0l/9TA=="],
+    "oxc-parser": ["oxc-parser@0.148.0", "", { "dependencies": { "@oxc-project/types": "^0.148.0" }, "optionalDependencies": { "@oxc-parser/binding-android-arm-eabi": "0.148.0", "@oxc-parser/binding-android-arm64": "0.148.0", "@oxc-parser/binding-darwin-arm64": "0.148.0", "@oxc-parser/binding-darwin-x64": "0.148.0", "@oxc-parser/binding-freebsd-x64": "0.148.0", "@oxc-parser/binding-linux-arm-gnueabihf": "0.148.0", "@oxc-parser/binding-linux-arm-musleabihf": "0.148.0", "@oxc-parser/binding-linux-arm64-gnu": "0.148.0", "@oxc-parser/binding-linux-arm64-musl": "0.148.0", "@oxc-parser/binding-linux-ppc64-gnu": "0.148.0", "@oxc-parser/binding-linux-riscv64-gnu": "0.148.0", "@oxc-parser/binding-linux-riscv64-musl": "0.148.0", "@oxc-parser/binding-linux-s390x-gnu": "0.148.0", "@oxc-parser/binding-linux-x64-gnu": "0.148.0", "@oxc-parser/binding-linux-x64-musl": "0.148.0", "@oxc-parser/binding-openharmony-arm64": "0.148.0", "@oxc-parser/binding-win32-arm64-msvc": "0.148.0", "@oxc-parser/binding-win32-ia32-msvc": "0.148.0", "@oxc-parser/binding-win32-x64-msvc": "0.148.0" } }, "sha512-syxUKHeUll89RIABQADcI7sikYrwyssvA6gj4phSSIPezKVM8yMaLAiLLSc7fmzVvrwybfFGFbW5zme9sX87rg=="],
 
     "oxc-resolver": ["oxc-resolver@11.24.2", "", { "optionalDependencies": { "@oxc-resolver/binding-android-arm-eabi": "11.24.2", "@oxc-resolver/binding-android-arm64": "11.24.2", "@oxc-resolver/binding-darwin-arm64": "11.24.2", "@oxc-resolver/binding-darwin-x64": "11.24.2", "@oxc-resolver/binding-freebsd-x64": "11.24.2", "@oxc-resolver/binding-linux-arm-gnueabihf": "11.24.2", "@oxc-resolver/binding-linux-arm-musleabihf": "11.24.2", "@oxc-resolver/binding-linux-arm64-gnu": "11.24.2", "@oxc-resolver/binding-linux-arm64-musl": "11.24.2", "@oxc-resolver/binding-linux-ppc64-gnu": "11.24.2", "@oxc-resolver/binding-linux-riscv64-gnu": "11.24.2", "@oxc-resolver/binding-linux-riscv64-musl": "11.24.2", "@oxc-resolver/binding-linux-s390x-gnu": "11.24.2", "@oxc-resolver/binding-linux-x64-gnu": "11.24.2", "@oxc-resolver/binding-linux-x64-musl": "11.24.2", "@oxc-resolver/binding-openharmony-arm64": "11.24.2", "@oxc-resolver/binding-wasm32-wasi": "11.24.2", "@oxc-resolver/binding-win32-arm64-msvc": "11.24.2", "@oxc-resolver/binding-win32-x64-msvc": "11.24.2" } }, "sha512-FY91FiDBj7ls5MsFS9jN3tjz2o0/zsdSsymlakySaBwVJZorHhkWyICLZMKxlu1R9vYo+sd3z1jwb4J8x7bNDw=="],
 
-    "oxlint": ["oxlint@1.78.0", "", { "optionalDependencies": { "@oxlint/binding-android-arm-eabi": "1.78.0", "@oxlint/binding-android-arm64": "1.78.0", "@oxlint/binding-darwin-arm64": "1.78.0", "@oxlint/binding-darwin-x64": "1.78.0", "@oxlint/binding-freebsd-x64": "1.78.0", "@oxlint/binding-linux-arm-gnueabihf": "1.78.0", "@oxlint/binding-linux-arm-musleabihf": "1.78.0", "@oxlint/binding-linux-arm64-gnu": "1.78.0", "@oxlint/binding-linux-arm64-musl": "1.78.0", "@oxlint/binding-linux-ppc64-gnu": "1.78.0", "@oxlint/binding-linux-riscv64-gnu": "1.78.0", "@oxlint/binding-linux-riscv64-musl": "1.78.0", "@oxlint/binding-linux-s390x-gnu": "1.78.0", "@oxlint/binding-linux-x64-gnu": "1.78.0", "@oxlint/binding-linux-x64-musl": "1.78.0", "@oxlint/binding-openharmony-arm64": "1.78.0", "@oxlint/binding-win32-arm64-msvc": "1.78.0", "@oxlint/binding-win32-ia32-msvc": "1.78.0", "@oxlint/binding-win32-x64-msvc": "1.78.0" }, "peerDependencies": { "oxlint-tsgolint": ">=7.0.2001", "vite-plus": "*" }, "optionalPeers": ["oxlint-tsgolint", "vite-plus"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-QgQePuxIqKOzo1KSjG2EnITEeWvWnKAm77eq8nrMtf6AGoA+zyGc4PFYtDNJSD25g/ibOwfQ851hZ4/SPkMVoA=="],
+    "oxlint": ["oxlint@1.83.0", "", { "optionalDependencies": { "@oxlint/binding-android-arm-eabi": "1.83.0", "@oxlint/binding-android-arm64": "1.83.0", "@oxlint/binding-darwin-arm64": "1.83.0", "@oxlint/binding-darwin-x64": "1.83.0", "@oxlint/binding-freebsd-x64": "1.83.0", "@oxlint/binding-linux-arm-gnueabihf": "1.83.0", "@oxlint/binding-linux-arm-musleabihf": "1.83.0", "@oxlint/binding-linux-arm64-gnu": "1.83.0", "@oxlint/binding-linux-arm64-musl": "1.83.0", "@oxlint/binding-linux-ppc64-gnu": "1.83.0", "@oxlint/binding-linux-riscv64-gnu": "1.83.0", "@oxlint/binding-linux-riscv64-musl": "1.83.0", "@oxlint/binding-linux-s390x-gnu": "1.83.0", "@oxlint/binding-linux-x64-gnu": "1.83.0", "@oxlint/binding-linux-x64-musl": "1.83.0", "@oxlint/binding-openharmony-arm64": "1.83.0", "@oxlint/binding-win32-arm64-msvc": "1.83.0", "@oxlint/binding-win32-ia32-msvc": "1.83.0", "@oxlint/binding-win32-x64-msvc": "1.83.0" }, "peerDependencies": { "oxlint-tsgolint": ">=7.0.2001", "vite-plus": "*" }, "optionalPeers": ["oxlint-tsgolint", "vite-plus"], "bin": { "oxlint": "bin/oxlint" } }, "sha512-cyDzSzaw3uzP0TeCeq3lLRPPoaUxkbB4ZOXj+kn+5r+BX9V+4bNVGk9lxer+WrgcpebH4JxLlJ3KQjveVztOLQ=="],
 
     "p-limit": ["p-limit@2.3.0", "", { "dependencies": { "p-try": "^2.0.0" } }, "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w=="],
 
@@ -2128,7 +2251,7 @@
 
     "package-manager-detector": ["package-manager-detector@1.8.0", "", {}, "sha512-yQA4H19AmPEoMUeavPMDIe1higySl/gH/yaQrkT/s07Qp+7pp2hYz30N3z2l5BkjVkF9Ow6o0wjJamm2y7Sn0A=="],
 
-    "papaparse": ["papaparse@5.5.4", "", {}, "sha512-SwzWD9gl/ElwYLCI0nUja1mFJzjq2D8ziShfNBa7zCHzkOozeOGDwHWQ+tvCzEZcewecWZ5U7kUopDnG+DFYEQ=="],
+    "papaparse": ["papaparse@5.7.0", "", {}, "sha512-qBGxg/7Q3Kl9Wfhrz2Z74UnvnHTXLNG6jmKJFeBvP2+y4lV7So+7SR62+Zd47JvdrCkX+nDcnr0ObPzek/+6RA=="],
 
     "parent-module": ["parent-module@1.0.1", "", { "dependencies": { "callsites": "^3.0.0" } }, "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g=="],
 
@@ -2144,8 +2267,6 @@
 
     "path-browserify": ["path-browserify@1.0.1", "", {}, "sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g=="],
 
-    "path-data-parser": ["path-data-parser@0.1.0", "", {}, "sha512-NOnmBpt5Y2RWbuv0LMzsayp3lVylAHLPUTut412ZA3l+C4uw4ZVkQbjShYCQ8TCpUMdPapr4YjUqLYD6v68j+w=="],
-
     "path-exists": ["path-exists@3.0.0", "", {}, "sha512-bpC7GYwiDYQ4wYLe+FA8lhRjhQCMcQGuSgGGqDkg/QerRWw9CmGRT0iSOVRSZJ29NMLZgIzqaljJ63oaL4NIJQ=="],
 
     "path-expression-matcher": ["path-expression-matcher@1.6.2", "", {}, "sha512-enSlaiat05iasnzmgNxRj8reFdj3puY2QpNgP1aPIaVfT6nn9ICuPoFlKHk8EN22HcwewshO+mN2DGbkCEOtqQ=="],
@@ -2158,7 +2279,7 @@
 
     "perfect-debounce": ["perfect-debounce@2.1.0", "", {}, "sha512-LjgdTytVFXeUgtHZr9WYViYSM/g8MkcTPYDlPa3cDqMirHjKiSZPYd6DoL7pK8AJQr+uWkQvCjHNdiMqsrJs+g=="],
 
-    "pg": ["pg@8.22.0", "", { "dependencies": { "pg-connection-string": "^2.14.0", "pg-pool": "^3.14.0", "pg-protocol": "^1.15.0", "pg-types": "2.2.0", "pgpass": "1.0.5" }, "optionalDependencies": { "pg-cloudflare": "^1.4.0" }, "peerDependencies": { "pg-native": ">=3.0.1" }, "optionalPeers": ["pg-native"] }, "sha512-8wih1vVIBMxoUM2oB4soJsD9tDnDpLv4OXBJ+EJzFsvycD+lfyIreC2gGHq78f8jbLLt+bvlPTFdFZfJkOuzAA=="],
+    "pg": ["pg@8.23.0", "", { "dependencies": { "pg-connection-string": "^2.14.0", "pg-pool": "^3.14.0", "pg-protocol": "^1.16.0", "pg-types": "2.2.0", "pgpass": "1.0.5" }, "optionalDependencies": { "pg-cloudflare": "^1.4.0" }, "peerDependencies": { "pg-native": ">=3.0.1" }, "optionalPeers": ["pg-native"] }, "sha512-Ip2EQCngowJLGOfCwkFhPXU7/ljlhn6Rxlmy4XYfL2Y+vyRM59+8uR2xqRWKdYmbXmxCFOAmKxBuSUCdF34qLg=="],
 
     "pg-cloudflare": ["pg-cloudflare@1.4.0", "", {}, "sha512-Vo7z/6rrQYxpNRylp4Tlob2elzbh+N/MOQbxFVWCxS7oEx6jF53GTJFxK2WWpKuBRkmiin4Mt+xofFDjx09R0A=="],
 
@@ -2168,7 +2289,7 @@
 
     "pg-pool": ["pg-pool@3.14.0", "", { "peerDependencies": { "pg": ">=8.0" } }, "sha512-gKtPkFdQPU3DksooVLi9LsjZxrsBUZIpa+7aVx+LV5pNh0KzP4Zleud2po+ConrxbuXGBJ6Hfer6hdgpIBpBaw=="],
 
-    "pg-protocol": ["pg-protocol@1.15.0", "", {}, "sha512-cq9sECI5s0+uPUXjbz8ioyPJni6RzsRib0US67i5IoTZKw8fNeYlVE7u8F4dG7vEJJtc5wdD1K189lCCUwqWTQ=="],
+    "pg-protocol": ["pg-protocol@1.16.0", "", {}, "sha512-sILXutLVjCLjcDuOmvhX5e2Z4cS5qG/6Bu3VkpFwdf/633ElGLpEh9bgmuI5I4sqKqkifQiGyiCcx1HdtrK7tg=="],
 
     "pg-types": ["pg-types@2.2.0", "", { "dependencies": { "pg-int8": "1.0.1", "postgres-array": "~2.0.0", "postgres-bytea": "~1.0.0", "postgres-date": "~1.0.4", "postgres-interval": "^1.1.0" } }, "sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA=="],
 
@@ -2176,21 +2297,17 @@
 
     "picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
 
-    "picomatch": ["picomatch@4.0.5", "", {}, "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A=="],
+    "picomatch": ["picomatch@4.0.7", "", {}, "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA=="],
 
     "pkce-challenge": ["pkce-challenge@5.0.1", "", {}, "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ=="],
 
-    "pkg-types": ["pkg-types@2.3.1", "", { "dependencies": { "confbox": "^0.2.4", "exsolve": "^1.0.8", "pathe": "^2.0.3" } }, "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg=="],
+    "pkg-types": ["pkg-types@2.3.3", "", { "dependencies": { "confbox": "^0.3.1", "exsolve": "^1.1.1", "pathe": "^2.0.3" } }, "sha512-j/lCFdcppV0JxWpCEITdbDltBxPP6cHT+yNJ6Go2OgoSA9518X847X9z0p6LtA4Nc16+eQzCZjRrWanTGvHJ5w=="],
 
     "pkg-up": ["pkg-up@3.1.0", "", { "dependencies": { "find-up": "^3.0.0" } }, "sha512-nDywThFk1i4BQK4twPQ6TA4RT8bDY96yeuCVBWL3ePARCiEKDRSrNGbFIgUJpLp+XeIR65v8ra7WuJOFUBtkMA=="],
 
-    "points-on-curve": ["points-on-curve@0.2.0", "", {}, "sha512-0mYKnYYe9ZcqMCWhUjItv/oHjvgEsfKvnUTg8sAtnHr3GVy7rGkXCb6d5cSyqrWqL4k81b9CPg3urd+T7aop3A=="],
+    "postcss": ["postcss@8.5.28", "", { "dependencies": { "nanoid": "^3.3.18", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A=="],
 
-    "points-on-path": ["points-on-path@0.2.1", "", { "dependencies": { "path-data-parser": "0.1.0", "points-on-curve": "0.2.0" } }, "sha512-25ClnWWuw7JbWZcgqY/gJ4FQWadKxGWk+3kR/7kD0tCaDtPPMj7oHu2ToLaVhfpnHrZzYby2w6tUA0eOIuUg8g=="],
-
-    "postcss": ["postcss@8.5.25", "", { "dependencies": { "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw=="],
-
-    "postcss-selector-parser": ["postcss-selector-parser@7.1.4", "", { "dependencies": { "cssesc": "^3.0.0", "util-deprecate": "^1.0.2" } }, "sha512-HeP7D2wyhkR+XaK6v4W8oRF62Dsz4flyuczALJp61GckGm42u1saSSJ/0auvcBqxs3jMRFEcPK34At/0JBKdOg=="],
+    "postcss-selector-parser": ["postcss-selector-parser@7.1.6", "", { "dependencies": { "cssesc": "^3.0.0", "util-deprecate": "^1.0.2" } }, "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw=="],
 
     "postgres": ["postgres@3.4.7", "", {}, "sha512-Jtc2612XINuBjIl/QTWsV5UvE8UHuNblcO3vVADSrKsrc6RqGX6lOW1cEo3CM2v0XG4Nat8nI+YM7/f26VxXLw=="],
 
@@ -2202,11 +2319,11 @@
 
     "postgres-interval": ["postgres-interval@1.2.0", "", { "dependencies": { "xtend": "^4.0.0" } }, "sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ=="],
 
-    "posthog-js": ["posthog-js@1.413.2", "", { "dependencies": { "@posthog/browser-common": "^0.4.0", "@posthog/core": "^1.46.8", "@posthog/types": "^1.402.1", "core-js": "^3.49.0", "dompurify": "^3.4.12", "fflate": "^0.4.8", "preact": "^10.29.3", "query-selector-shadow-dom": "^1.0.1", "web-vitals": "^5.3.0", "web-vitals-soft-navs": "npm:web-vitals@6.0.0" } }, "sha512-LddTVMdYFd0jB+p5h3ZHcho9mWNjgKn9QySCQt74iISKrmC3b7KzW2Q7W7aOF6m/NwK7NubIHqLujCER64gSRw=="],
+    "posthog-js": ["posthog-js@1.428.9", "", { "dependencies": { "@posthog/browser-common": "^0.8.2", "@posthog/core": "^1.51.2", "@posthog/types": "^1.409.3", "core-js": "^3.49.0", "dompurify": "^3.4.13", "fflate": "^0.4.8", "preact": "^10.29.3", "query-selector-shadow-dom": "^1.0.1", "web-vitals": "^6.2.1", "web-vitals-soft-navs": "npm:web-vitals@6.2.1" }, "peerDependencies": { "@types/react": ">=16.8.0", "react": ">=16.8.0" }, "optionalPeers": ["@types/react", "react"] }, "sha512-oFzGT+9o7JzoFqh0l/l2/85Mu5Jkjb6GXmGOdEaqK18jJhMwPLiW8ssHg8eWSe6CmddPU1fh+rj1LXi8tMsUow=="],
 
-    "posthog-node": ["posthog-node@5.48.0", "", { "dependencies": { "@posthog/core": "^1.46.8" }, "peerDependencies": { "rxjs": "^7.0.0" }, "optionalPeers": ["rxjs"] }, "sha512-YIH82XV24aa1nnVph1ndiW/vBN2QDIKlrHNEJcmAYutMGeoGC4WeEefg7O5aD3dDcO5dzociy8sVwXq4tNDYsQ=="],
+    "posthog-node": ["posthog-node@5.51.8", "", { "dependencies": { "@posthog/core": "^1.51.1" }, "peerDependencies": { "rxjs": "^7.0.0" }, "optionalPeers": ["rxjs"] }, "sha512-TCqgAYbACwb/D3VI2S861ugD+FavvowQfak8eMwS/wATS+g0Wj+YpsABrBEKi+ZP3Y5SJDcoc7bIH49rlGo1Ww=="],
 
-    "powershell-utils": ["powershell-utils@0.1.0", "", {}, "sha512-dM0jVuXJPsDN6DvRpea484tCUaMiXWjuCn++HGTqUWzGDjv5tZkEZldAJ/UMlqRYGFrD/etByo4/xOuC/snX2A=="],
+    "powershell-utils": ["powershell-utils@0.2.1", "", {}, "sha512-C+y9x90UElAddDZmV4qOx9W53B61PO7cIqWz2dQsWlwswuq4mr8NEwytdGKboYbQlGZ3awrkTeNvcZiZNHnQ8A=="],
 
     "preact": ["preact@11.0.0-beta.0", "", {}, "sha512-IcODoASASYwJ9kxz7+MJeiJhvLriwSb4y4mHIyxdgaRZp6kPUud7xytrk/6GZw8U3y6EFJaRb5wi9SrEK+8+lg=="],
 
@@ -2214,11 +2331,13 @@
 
     "prebuild-install": ["prebuild-install@7.1.3", "", { "dependencies": { "detect-libc": "^2.0.0", "expand-template": "^2.0.3", "github-from-package": "0.0.0", "minimist": "^1.2.3", "mkdirp-classic": "^0.5.3", "napi-build-utils": "^2.0.0", "node-abi": "^3.3.0", "pump": "^3.0.0", "rc": "^1.2.7", "simple-get": "^4.0.0", "tar-fs": "^2.0.0", "tunnel-agent": "^0.6.0" }, "bin": { "prebuild-install": "bin.js" } }, "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug=="],
 
+    "precis-wasm": ["precis-wasm@0.1.0", "", {}, "sha512-0DIxaIaiZRX4TJ9tMDuXBbgGGcCx93SaunKfcvrM91kbMRGW1NVbIalO0Ku4hF6H1ltl2aLKl9wDodmelL+IkQ=="],
+
     "prettier": ["prettier@3.9.6", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g=="],
 
-    "pretty-ms": ["pretty-ms@9.3.0", "", { "dependencies": { "parse-ms": "^4.0.0" } }, "sha512-gjVS5hOP+M3wMm5nmNOucbIrqudzs9v/57bWRHQWLYklXqoXKrVfYW2W9+glfGsqtPgpiz5WwyEEB+ksXIx3gQ=="],
+    "pretty-ms": ["pretty-ms@9.3.1", "", { "dependencies": { "parse-ms": "^4.0.0" } }, "sha512-HzMy3Geq23nVALD/M2LliU+F+M+gVNsvkQWWqeBZ8HDiCgzo6YPJ/Omrmtq24EFrIsk0a3EkQGEd7bDOo+IhGA=="],
 
-    "prisma": ["prisma@7.9.1", "", { "dependencies": { "@prisma/config": "7.9.1", "@prisma/dev": "0.24.17", "@prisma/engines": "7.9.1", "@prisma/studio-core": "0.33.0", "mysql2": "3.15.3", "postgres": "3.4.7" }, "peerDependencies": { "better-sqlite3": ">=9.0.0", "typescript": ">=5.4.0" }, "optionalPeers": ["better-sqlite3", "typescript"], "bin": { "prisma": "build/index.js" } }, "sha512-aPqePoZIqwlAchbgbFDO/wHqGB+7H1nj9gaM+OsL9h77S5S3TnLd9BgD3LnoeDikULo7cl2HSUrEyQ55Z7DYbg=="],
+    "prisma": ["prisma@7.10.0", "", { "dependencies": { "@prisma/config": "7.10.0", "@prisma/dev": "0.24.17", "@prisma/engines": "7.10.0", "@prisma/studio-core": "0.33.0", "mysql2": "3.15.3", "postgres": "3.4.7" }, "peerDependencies": { "better-sqlite3": ">=9.0.0", "typescript": ">=5.4.0" }, "optionalPeers": ["better-sqlite3", "typescript"], "bin": { "prisma": "build/index.js" } }, "sha512-o0ornyJOWgygVAzGCpr8PdXV8EJLHyVGDDUr/voBQt8Azzw8cYTByzzPGcA/m4tCkPcnJA8raEOv2CslsKhPEw=="],
 
     "prompts": ["prompts@2.4.2", "", { "dependencies": { "kleur": "^3.0.3", "sisteransi": "^1.0.5" } }, "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q=="],
 
@@ -2232,9 +2351,11 @@
 
     "pump": ["pump@3.0.4", "", { "dependencies": { "end-of-stream": "^1.1.0", "once": "^1.3.1" } }, "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA=="],
 
+    "punycode": ["punycode@2.3.1", "", {}, "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg=="],
+
     "pure-rand": ["pure-rand@6.1.0", "", {}, "sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA=="],
 
-    "qs": ["qs@6.15.3", "", { "dependencies": { "es-define-property": "^1.0.1", "side-channel": "^1.1.1" } }, "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A=="],
+    "qs": ["qs@6.16.0", "", { "dependencies": { "es-define-property": "^1.0.1", "side-channel": "^1.1.1" } }, "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA=="],
 
     "query-selector-shadow-dom": ["query-selector-shadow-dom@1.0.1", "", {}, "sha512-lT5yCqEBgfoMYpf3F2xQRK7zEr1rhIIZuceDK6+xRkJQ4NMbHTwXqk4NkwDwQMNqXgG9r9fyHnzwNVs6zV5KRw=="],
 
@@ -2254,7 +2375,7 @@
 
     "rc": ["rc@1.2.8", "", { "dependencies": { "deep-extend": "^0.6.0", "ini": "~1.3.0", "minimist": "^1.2.0", "strip-json-comments": "~2.0.1" }, "bin": { "rc": "./cli.js" } }, "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw=="],
 
-    "rc9": ["rc9@3.0.1", "", { "dependencies": { "defu": "^6.1.6", "destr": "^2.0.5" } }, "sha512-gMDyleLWVE+i6Sgtc0QbbY6pEKqYs97NGi6isHQPqYlLemPoO8dxQ3uGi0f4NiP98c+jMW6cG1Kx9dDwfvqARQ=="],
+    "rc9": ["rc9@3.1.0", "", { "dependencies": { "defu": "^6.1.7", "destr": "^2.0.5" } }, "sha512-ufjkNVzbRHKcCOmTahZkmVsyc3W+MSk3jY03m+a7tGHkIsdVMG9l10/3HvFbWkkKzY5VFp3pkRsIo/UYgmFL7Q=="],
 
     "re2js": ["re2js@1.4.0", "", {}, "sha512-KTOIcZTSOpOxbu3i0+T6mFQ6tkxXKlTxfcMFs1trQbsMnG84qNq+DjXr8Afu+FEFjvF1NNlldpC7roPyazFI8g=="],
 
@@ -2262,9 +2383,9 @@
 
     "react-day-picker": ["react-day-picker@10.0.1", "", { "dependencies": { "@date-fns/tz": "^1.4.1", "date-fns": "^4.1.0" }, "peerDependencies": { "@types/react": ">=16.8.0", "react": ">=16.8.0" }, "optionalPeers": ["@types/react"] }, "sha512-eNh6BlwcYInWaJtRv18mXQ06Ys/H6rdTZAnTaSdOYJuTpwP1JMCHNd1FDRadA+gbeinq+psdULN5Xnowy9mV8w=="],
 
-    "react-dom": ["react-dom@19.2.4", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.4" } }, "sha512-AXJdLo8kgMbimY95O2aKQqsz2iWi9jMgKJhRBAxECE4IFxfcazB2LmzloIoibJI3C12IlY20+KFaLv+71bUJeQ=="],
+    "react-dom": ["react-dom@19.2.8", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.8" } }, "sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ=="],
 
-    "react-is": ["react-is@19.2.8", "", {}, "sha512-s5un28nYxKJw5gvUHyW5PCC28CvBqLu9r3cWgzHT4Vo/5fqqkFcdRYsGcKf50WMPpjjFZS5d76fn3YCo2njKwQ=="],
+    "react-is": ["react-is@16.13.1", "", {}, "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ=="],
 
     "react-redux": ["react-redux@9.3.0", "", { "dependencies": { "@types/use-sync-external-store": "^0.0.6", "use-sync-external-store": "^1.4.0" }, "peerDependencies": { "@types/react": "^18.2.25 || ^19", "react": "^18.0 || ^19", "redux": "^5.0.0" }, "optionalPeers": ["@types/react", "redux"] }, "sha512-KQopgqFo/p/fgmAs5qz6p5RWaNAzq40WAu7fJIXnQpYxFPbJYtsJPWvGeF2rOBaY/kEuV77AVsX8TsQzKm+A/g=="],
 
@@ -2276,11 +2397,11 @@
 
     "readable-stream": ["readable-stream@3.6.2", "", { "dependencies": { "inherits": "^2.0.3", "string_decoder": "^1.1.1", "util-deprecate": "^1.0.1" } }, "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA=="],
 
-    "readdirp": ["readdirp@5.0.0", "", {}, "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ=="],
+    "readdirp": ["readdirp@5.1.1", "", {}, "sha512-Kko+Y5XQ6fM+Ce3dq3m9YGxnacYZYl9cA1wZjaF3Vbry2L3i1qVg8+CAgNPsXRArPMUMCaOR7oa9Nqntc43JKA=="],
 
-    "recast": ["recast@0.23.19", "", { "dependencies": { "ast-types": "^0.16.1", "esprima": "~4.0.0", "source-map": "~0.6.1", "tiny-invariant": "^1.3.3", "tslib": "^2.0.1" } }, "sha512-T98lym7kH+pnZmRaD8yDRdaNqyUbwnbEBx0MuchrzMFOEMray4AO3ZJoTUZ5r78Ao78X/OhzW0DL8GB85w/I2w=="],
+    "recast": ["recast@0.23.21", "", { "dependencies": { "ast-types": "^0.16.1", "esprima": "~4.0.0", "source-map": "~0.6.1", "tiny-invariant": "^1.3.3", "tslib": "^2.0.1" } }, "sha512-mFAyJq9vUbSTARLZUvAEf1z3YxlvAwswbmxMx2mPA/MSm4KmpwvwvhsH/NIrZhyOuwD60Lzyw2qh83uCbgTPYw=="],
 
-    "recharts": ["recharts@3.8.0", "", { "dependencies": { "@reduxjs/toolkit": "^1.9.0 || 2.x.x", "clsx": "^2.1.1", "decimal.js-light": "^2.5.1", "es-toolkit": "^1.39.3", "eventemitter3": "^5.0.1", "immer": "^10.1.1", "react-redux": "8.x.x || 9.x.x", "reselect": "5.1.1", "tiny-invariant": "^1.3.3", "use-sync-external-store": "^1.2.2", "victory-vendor": "^37.0.2" }, "peerDependencies": { "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-is": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-Z/m38DX3L73ExO4Tpc9/iZWHmHnlzWG4njQbxsF5aSjwqmHNDDIm0rdEBArkwsBvR8U6EirlEHiQNYWCVh9sGQ=="],
+    "recharts": ["recharts@3.10.1", "", { "dependencies": { "@reduxjs/toolkit": "^1.9.0 || 2.x.x", "clsx": "^2.1.1", "decimal.js-light": "^2.5.1", "es-toolkit": "^1.39.3", "eventemitter3": "^5.0.1", "immer": "^11.1.8", "react-redux": "8.x.x || 9.x.x", "reselect": "5.2.0", "tiny-invariant": "^1.3.3", "use-sync-external-store": "^1.2.2", "victory-vendor": "^37.0.2" }, "peerDependencies": { "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-dom": "^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0", "react-is": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-QXFrvt6IVcw7eeZCoyXTwkIJAX3Dv1nyVhMicXJ47GsGDDpcN8z6o644DibE9XjpBTThtsomLKnTV6lc+cVFUA=="],
 
     "redux": ["redux@5.0.1", "", {}, "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w=="],
 
@@ -2294,8 +2415,6 @@
 
     "regex-utilities": ["regex-utilities@2.3.0", "", {}, "sha512-8VhliFJAWRaUiVvREIiW2NXXTmHs4vMNnSzuJVhscgmGav3g9VDxLrQndI3dZZVVdp0ZO/5v0xmX516/7M9cng=="],
 
-    "regexp-to-ast": ["regexp-to-ast@0.5.0", "", {}, "sha512-tlbJqcMHnPKI9zSrystikWKwHkBqu2a/Sgw01h3zFjvYrMxEDYHzzoMZnUrbIfpTFEsoRnnviOXNCzFiSc54Qw=="],
-
     "rehype-harden": ["rehype-harden@1.1.8", "", { "dependencies": { "unist-util-visit": "^5.0.0" } }, "sha512-Qn7vR1xrf6fZCrkm9TDWi/AB4ylrHy+jqsNm1EHOAmbARYA6gsnVJBq/sdBh6kmT4NEZxH5vgIjrscefJAOXcw=="],
 
     "rehype-raw": ["rehype-raw@7.0.0", "", { "dependencies": { "@types/hast": "^3.0.0", "hast-util-raw": "^9.0.0", "vfile": "^6.0.0" } }, "sha512-/aE8hCfKlQeA8LmyeyQvQF3eBiLRGNlfBJEvWH7ivp9sBqs7TNqBL5X3v157rM4IFETqDnIOO+z5M/biZbo9Ww=="],
@@ -2312,13 +2431,11 @@
 
     "remeda": ["remeda@2.33.4", "", {}, "sha512-ygHswjlc/opg2VrtiYvUOPLjxjtdKvjGz1/plDhkG66hjNjFr1xmfrs2ClNFo/E6TyUFiwYNh53bKV26oBoMGQ=="],
 
-    "remend": ["remend@1.3.0", "", {}, "sha512-iIhggPkhW3hFImKtB10w0dz4EZbs28mV/dmbcYVonWEJ6UGHHpP+bFZnTh6GNWJONg5m+U56JrL+8IxZRdgWjw=="],
-
-    "require-directory": ["require-directory@2.1.1", "", {}, "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q=="],
+    "remend": ["remend@1.3.1", "", {}, "sha512-N3DiY5qbRPoa5vkxn1oDLMyXOVTeo6Hp+XOj6SIqJAYUgLS0Q587gILPMom/qm86AQ/ZrcOdwEIzCz8V3J0nxQ=="],
 
     "require-from-string": ["require-from-string@2.0.2", "", {}, "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw=="],
 
-    "reselect": ["reselect@5.1.1", "", {}, "sha512-K/BG6eIky/SBpzfHZv/dd+9JBFiS4SWV7FIujVyJRux6e45+73RaUHXLmIR1f7WOMaQ0U1km6qwklRQxpJJY0w=="],
+    "reselect": ["reselect@5.2.0", "", {}, "sha512-AgZ3UOZm3YndfrJ4OYjgrT7bmCm/1iqkjvEfH/oYjzh6PD2qw4QuT3jjnXIrpdt4MTpMXclMT3lXbmRY+XRakw=="],
 
     "resolve-from": ["resolve-from@4.0.0", "", {}, "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g=="],
 
@@ -2334,11 +2451,9 @@
 
     "robust-predicates": ["robust-predicates@3.0.3", "", {}, "sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA=="],
 
-    "rolldown": ["rolldown@1.2.1", "", { "dependencies": { "@oxc-project/types": "=0.142.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.2.1", "@rolldown/binding-darwin-arm64": "1.2.1", "@rolldown/binding-darwin-x64": "1.2.1", "@rolldown/binding-freebsd-x64": "1.2.1", "@rolldown/binding-linux-arm-gnueabihf": "1.2.1", "@rolldown/binding-linux-arm64-gnu": "1.2.1", "@rolldown/binding-linux-arm64-musl": "1.2.1", "@rolldown/binding-linux-ppc64-gnu": "1.2.1", "@rolldown/binding-linux-s390x-gnu": "1.2.1", "@rolldown/binding-linux-x64-gnu": "1.2.1", "@rolldown/binding-linux-x64-musl": "1.2.1", "@rolldown/binding-openharmony-arm64": "1.2.1", "@rolldown/binding-wasm32-wasi": "1.2.1", "@rolldown/binding-win32-arm64-msvc": "1.2.1", "@rolldown/binding-win32-x64-msvc": "1.2.1" }, "bin": { "rolldown": "./bin/cli.mjs" } }, "sha512-4FKJhg8d3OiyQOA6Q1Q0hoFFpW9/OoX+VsHzpECsdsIZoOArrAK90gl59YK/Z+gnDel45bgJZK03ozH/9bCqEw=="],
+    "rolldown": ["rolldown@1.2.8", "", { "dependencies": { "@oxc-project/types": "=0.149.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm-eabi": "1.2.8", "@rolldown/binding-android-arm64": "1.2.8", "@rolldown/binding-darwin-arm64": "1.2.8", "@rolldown/binding-darwin-x64": "1.2.8", "@rolldown/binding-freebsd-x64": "1.2.8", "@rolldown/binding-linux-arm-gnueabihf": "1.2.8", "@rolldown/binding-linux-arm64-gnu": "1.2.8", "@rolldown/binding-linux-arm64-musl": "1.2.8", "@rolldown/binding-linux-ppc64-gnu": "1.2.8", "@rolldown/binding-linux-s390x-gnu": "1.2.8", "@rolldown/binding-linux-x64-gnu": "1.2.8", "@rolldown/binding-linux-x64-musl": "1.2.8", "@rolldown/binding-openharmony-arm64": "1.2.8", "@rolldown/binding-win32-arm64-msvc": "1.2.8", "@rolldown/binding-win32-x64-msvc": "1.2.8" }, "bin": { "rolldown": "./bin/cli.mjs" } }, "sha512-Z67nTmhZe7anqnM/EjI392w5i/ANUinjip7QYsOyN37oayduxt3ksdX0hf5OOamkAd53BiIHfbfSzfUmzKFQqQ=="],
 
-    "rou3": ["rou3@0.7.12", "", {}, "sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg=="],
-
-    "roughjs": ["roughjs@4.6.6", "", { "dependencies": { "hachure-fill": "^0.5.2", "path-data-parser": "^0.1.0", "points-on-curve": "^0.2.0", "points-on-path": "^0.2.1" } }, "sha512-ZUz/69+SYpFN/g/lUlo2FXcIjRkSu3nDarreVdGGndHEBJ6cXPdKguS8JGxwj5HA5xIbVKSmLgr5b3AWxtRfvQ=="],
+    "rou3": ["rou3@0.9.2", "", {}, "sha512-3SOzvaAg8rkHrXtRjpCvCvbyO5to9oOO27Z/XqHEYXfMRVSw/qMIVdmaOk9W2lcRLtR6dlqTjo9hDeJk70QBYQ=="],
 
     "router": ["router@2.2.0", "", { "dependencies": { "debug": "^4.4.0", "depd": "^2.0.0", "is-promise": "^4.0.0", "parseurl": "^1.3.3", "path-to-regexp": "^8.0.0" } }, "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ=="],
 
@@ -2346,8 +2461,6 @@
 
     "run-parallel": ["run-parallel@1.2.0", "", { "dependencies": { "queue-microtask": "^1.2.2" } }, "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA=="],
 
-    "rw": ["rw@1.3.3", "", {}, "sha512-PdhdWy89SiZogBLaw42zdeqtRJ//zFd2PgQavcICDUgJT5oW10QCRKbJ6bg4r0/UY2M6BWd5tkxuGFRvCkgfHQ=="],
-
     "rxjs": ["rxjs@7.8.2", "", { "dependencies": { "tslib": "^2.1.0" } }, "sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA=="],
 
     "safe-buffer": ["safe-buffer@5.2.1", "", {}, "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ=="],
@@ -2358,6 +2471,14 @@
 
     "samlify": ["samlify@2.13.1", "", { "dependencies": { "@authenio/xml-encryption": "^2.0.2", "@xmldom/xmldom": "^0.8.11", "node-rsa": "^1.1.1", "xml": "^1.0.1", "xml-crypto": "^6.1.2", "xml-escape": "^1.1.0", "xpath": "^0.0.34" } }, "sha512-vdYr/zohDGBbfWNU4miEzc1jmWOtkLySPViapC6nfGkv9KxzLq4UlGkKyryzwLw4jVlZk88Rw93HaCRVpe+t+g=="],
 
+    "sasl-anonymous": ["sasl-anonymous@0.1.0", "", {}, "sha512-x+0sdsV0Gie2EexxAUsx6ZoB+X6OCthlNBvAQncQxreEWQJByAPntj0EAgTlJc2kZicoc+yFzeR6cl8VfsQGfA=="],
+
+    "sasl-plain": ["sasl-plain@0.1.0", "", {}, "sha512-X8mCSfR8y0NryTu0tuVyr4IS2jBunBgyG+3a0gEEkd0nlHGiyqJhlc4EIkzmSwaa7F8S4yo+LS6Cu5qxRkJrmg=="],
+
+    "sasl-scram-sha-1": ["sasl-scram-sha-1@1.4.0", "", {}, "sha512-kdP8uAFkak8flnmKTldWnQ98IuC15ASdKxNHWwbqexRj7szHs7y+JEtigLkPoq9gnp/SAxxU4O2huL8OLqSr9w=="],
+
+    "saslmechanisms": ["saslmechanisms@0.1.1", "", {}, "sha512-pVlvK5ysevz8MzybRnDIa2YMxn0OJ7b9lDiWhMoaKPoJ7YkAg/7YtNjUgaYzElkwHxsw8dBMhaEn7UP6zxEwPg=="],
+
     "scheduler": ["scheduler@0.27.0", "", {}, "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q=="],
 
     "seek-bzip": ["seek-bzip@2.0.0", "", { "dependencies": { "commander": "^6.0.0" }, "bin": { "seek-bunzip": "bin/seek-bunzip", "seek-table": "bin/seek-bzip-table" } }, "sha512-SMguiTnYrhpLdk3PwfzHeotrcwi8bNV4iemL9tx9poR/yeaMYwB9VzR1w7b57DuWpuqR8n6oZboi0hj3AxZxQg=="],
@@ -2374,9 +2495,9 @@
 
     "setprototypeof": ["setprototypeof@1.2.0", "", {}, "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="],
 
-    "shadcn": ["shadcn@4.16.1", "", { "dependencies": { "@babel/core": "^7.28.0", "@babel/parser": "^7.28.0", "@babel/plugin-transform-typescript": "^7.28.0", "@babel/preset-typescript": "^7.27.1", "@dotenvx/dotenvx": "^1.48.4", "@modelcontextprotocol/sdk": "^1.26.0", "@types/validate-npm-package-name": "^4.0.2", "browserslist": "^4.26.2", "commander": "^14.0.0", "cosmiconfig": "^9.0.0", "dedent": "^1.6.0", "deepmerge": "^4.3.1", "diff": "^8.0.2", "execa": "^9.6.0", "fast-glob": "^3.3.3", "fs-extra": "^11.3.1", "fuzzysort": "^3.1.0", "kleur": "^4.1.5", "open": "^11.0.0", "ora": "^8.2.0", "postcss": "^8.5.6", "postcss-selector-parser": "^7.1.0", "prompts": "^2.4.2", "recast": "^0.23.11", "stringify-object": "^5.0.0", "tailwind-merge": "^3.0.1", "ts-morph": "^26.0.0", "tsconfig-paths": "^4.2.0", "undici": "^7.27.2", "validate-npm-package-name": "^7.0.1", "zod": "^3.24.1", "zod-to-json-schema": "^3.24.6" }, "bin": { "shadcn": "dist/index.js" } }, "sha512-XLFzfNNIUPlUlyheFEzj0H4Vnhi9nI0nl3Nfgg8HYXW1FkUVhVT1X+mgmOUW8aWL5SeG0A+yJIV5fm3Hr9MVkQ=="],
+    "shadcn": ["shadcn@4.21.0", "", { "dependencies": { "@babel/core": "^7.28.0", "@babel/parser": "^7.28.0", "@babel/plugin-transform-typescript": "^7.28.0", "@babel/preset-typescript": "^7.27.1", "@dotenvx/dotenvx": "^1.48.4", "@modelcontextprotocol/sdk": "^1.26.0", "@types/validate-npm-package-name": "^4.0.2", "browserslist": "^4.26.2", "cn": "^0.2.4", "commander": "^14.0.0", "cosmiconfig": "^9.0.0", "dedent": "^1.6.0", "deepmerge": "^4.3.1", "diff": "^8.0.2", "execa": "^9.6.0", "fast-glob": "^3.3.3", "fs-extra": "^11.3.1", "fuzzysort": "^3.1.0", "kleur": "^4.1.5", "open": "^11.0.0", "ora": "^8.2.0", "postcss": "^8.5.6", "postcss-selector-parser": "^7.1.0", "prompts": "^2.4.2", "recast": "^0.23.11", "socks": "^2.8.8", "stringify-object": "^5.0.0", "ts-morph": "^26.0.0", "tsconfig-paths": "^4.2.0", "undici": "^7.27.2", "validate-npm-package-name": "^7.0.1", "zod": "^3.24.1", "zod-to-json-schema": "^3.24.6" }, "bin": { "shadcn": "dist/index.js" } }, "sha512-UU2mFNusW8C5rvadKdH69vERYZqUlOOlXBcf0MYhYLdTGP6DPti7X4qovCu+RTfCqsAgq/T+YfE0Vnttxh9aiw=="],
 
-    "sharp": ["sharp@0.34.5", "", { "dependencies": { "@img/colour": "^1.0.0", "detect-libc": "^2.1.2", "semver": "^7.7.3" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.34.5", "@img/sharp-darwin-x64": "0.34.5", "@img/sharp-libvips-darwin-arm64": "1.2.4", "@img/sharp-libvips-darwin-x64": "1.2.4", "@img/sharp-libvips-linux-arm": "1.2.4", "@img/sharp-libvips-linux-arm64": "1.2.4", "@img/sharp-libvips-linux-ppc64": "1.2.4", "@img/sharp-libvips-linux-riscv64": "1.2.4", "@img/sharp-libvips-linux-s390x": "1.2.4", "@img/sharp-libvips-linux-x64": "1.2.4", "@img/sharp-libvips-linuxmusl-arm64": "1.2.4", "@img/sharp-libvips-linuxmusl-x64": "1.2.4", "@img/sharp-linux-arm": "0.34.5", "@img/sharp-linux-arm64": "0.34.5", "@img/sharp-linux-ppc64": "0.34.5", "@img/sharp-linux-riscv64": "0.34.5", "@img/sharp-linux-s390x": "0.34.5", "@img/sharp-linux-x64": "0.34.5", "@img/sharp-linuxmusl-arm64": "0.34.5", "@img/sharp-linuxmusl-x64": "0.34.5", "@img/sharp-wasm32": "0.34.5", "@img/sharp-win32-arm64": "0.34.5", "@img/sharp-win32-ia32": "0.34.5", "@img/sharp-win32-x64": "0.34.5" } }, "sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg=="],
+    "sharp": ["sharp@0.35.4", "", { "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", "semver": "^7.8.5" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.35.4", "@img/sharp-darwin-x64": "0.35.4", "@img/sharp-freebsd-wasm32": "0.35.4", "@img/sharp-libvips-darwin-arm64": "1.3.3", "@img/sharp-libvips-darwin-x64": "1.3.3", "@img/sharp-libvips-linux-arm": "1.3.3", "@img/sharp-libvips-linux-arm64": "1.3.3", "@img/sharp-libvips-linux-ppc64": "1.3.3", "@img/sharp-libvips-linux-riscv64": "1.3.3", "@img/sharp-libvips-linux-s390x": "1.3.3", "@img/sharp-libvips-linux-x64": "1.3.3", "@img/sharp-libvips-linuxmusl-arm64": "1.3.3", "@img/sharp-libvips-linuxmusl-x64": "1.3.3", "@img/sharp-linux-arm": "0.35.4", "@img/sharp-linux-arm64": "0.35.4", "@img/sharp-linux-ppc64": "0.35.4", "@img/sharp-linux-riscv64": "0.35.4", "@img/sharp-linux-s390x": "0.35.4", "@img/sharp-linux-x64": "0.35.4", "@img/sharp-linuxmusl-arm64": "0.35.4", "@img/sharp-linuxmusl-x64": "0.35.4", "@img/sharp-webcontainers-wasm32": "0.35.4", "@img/sharp-win32-arm64": "0.35.4", "@img/sharp-win32-ia32": "0.35.4", "@img/sharp-win32-x64": "0.35.4" }, "peerDependencies": { "@types/node": "*" }, "optionalPeers": ["@types/node"] }, "sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA=="],
 
     "shebang-command": ["shebang-command@2.0.0", "", { "dependencies": { "shebang-regex": "^3.0.0" } }, "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA=="],
 
@@ -2384,7 +2505,7 @@
 
     "shell-quote": ["shell-quote@1.9.0", "", {}, "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA=="],
 
-    "shiki": ["shiki@4.4.2", "", { "dependencies": { "@shikijs/core": "4.4.2", "@shikijs/engine-javascript": "4.4.2", "@shikijs/engine-oniguruma": "4.4.2", "@shikijs/langs": "4.4.2", "@shikijs/themes": "4.4.2", "@shikijs/types": "4.4.2", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.5" } }, "sha512-P8F/dFhRevaw2uSdeIYlq/5SXZNY85DPtmXQ947gD1Zj2JqO5AkNvVVBar0Me9JkFx3uzVud/qOtP5ek9NEQGA=="],
+    "shiki": ["shiki@4.4.3", "", { "dependencies": { "@shikijs/core": "4.4.3", "@shikijs/engine-javascript": "4.4.3", "@shikijs/engine-oniguruma": "4.4.3", "@shikijs/langs": "4.4.3", "@shikijs/themes": "4.4.3", "@shikijs/types": "4.4.3", "@shikijs/vscode-textmate": "^10.0.2", "@types/hast": "^3.0.5" } }, "sha512-Mb/GvXPHBAXdgGIcnfU5L3ldpn1XcxrGkPHwqgRx17/I2XRfqlFKk2vGkHWINn1kdXvzJZeuO3is6I9KLPFm0g=="],
 
     "side-channel": ["side-channel@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.4", "side-channel-list": "^1.0.1", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ=="],
 
@@ -2402,9 +2523,13 @@
 
     "sisteransi": ["sisteransi@1.0.5", "", {}, "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg=="],
 
-    "smol-toml": ["smol-toml@1.7.1", "", {}, "sha512-PPlsspAZ4jbMBu5DMFhfUGDQLu/vrL4SyBROVS37x8ynnVmFIs1VPBz1Co8Xks3TvpIaZXmU85y4DrQ+UyVFoQ=="],
+    "smart-buffer": ["smart-buffer@4.2.0", "", {}, "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg=="],
+
+    "smol-toml": ["smol-toml@1.8.0", "", {}, "sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ=="],
+
+    "socks": ["socks@2.8.10", "", { "dependencies": { "ip-address": "^10.1.1", "smart-buffer": "^4.2.0" } }, "sha512-e0VyvkVTwVYViNovRkZ9aodhxVlyoMn7eJhVUPxZ+eK9P/7CBkxvvsBOHqFPEH416726W8tLXXXjKwqgTErrCQ=="],
 
-    "sonner": ["sonner@2.0.7", "", { "peerDependencies": { "react": "^18.0.0 || ^19.0.0 || ^19.0.0-rc", "react-dom": "^18.0.0 || ^19.0.0 || ^19.0.0-rc" } }, "sha512-W6ZN4p58k8aDKA4XPcx2hpIQXBRAgyiWVkYhT7CvK6D3iAu7xjvVyhQHg2/iaKJZ1XVJ4r7XuwGL+WGEK37i9w=="],
+    "sonner": ["sonner@2.0.8", "", { "peerDependencies": { "@types/react": "^18.0.0 || ^19.0.0", "react": "^18.0.0 || ^19.0.0 || ^19.0.0-rc", "react-dom": "^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-UM/ByIoFra8yzV75n1o0Puu0bw5U/9UNnDacrJNspekBewIfsQ3D6ez1nvlWpt7aTsO6rujQtifBpycwIivqlg=="],
 
     "source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="],
 
@@ -2416,11 +2541,11 @@
 
     "sprintf-js": ["sprintf-js@1.1.3", "", {}, "sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA=="],
 
-    "sql.js": ["sql.js@1.14.1", "", {}, "sha512-gcj8zBWU5cFsi9WUP+4bFNXAyF1iRpA3LLyS/DP5xlrNzGmPIizUeBggKa8DbDwdqaKwUcTEnChtd2grWo/x/A=="],
+    "sql.js": ["sql.js@1.14.2", "", {}, "sha512-3ZGPovObMFrdw79zrUHbfdE/DLIsy8jdNdssmMSQuRAymedU6q84asPt0kgiqrdMYlPegDItiIMfmIXzZnYFcw=="],
 
     "sqlstring": ["sqlstring@2.3.3", "", {}, "sha512-qC9iz2FlN7DQl3+wjwn3802RTyjCx7sDvfQEXchwa6CWOx07/WVfh91gBmQ9fahw8snwGEWU3xGzOt4tFyHLxg=="],
 
-    "srvx": ["srvx@0.11.22", "", { "bin": { "srvx": "bin/srvx.mjs" } }, "sha512-LqZxxBDMKuMAZzFzJnDCkFOrs9MZQZr0LvHiO/SuSZVdQaXD7xQ5UWTUxheJrQPve1qk9MG2B/yttUvJxw8egQ=="],
+    "srvx": ["srvx@1.0.4", "", { "bin": { "srvx": "./bin/srvx.mjs" } }, "sha512-eZmYaxUfZSo7/8m8UdsHRJNmTLSCTPPom9d7a60vMmuVeZvwhbvflRR+00/CxTCjMOFa5+H8tgBeNDVZ+w7AAQ=="],
 
     "statuses": ["statuses@2.0.2", "", {}, "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw=="],
 
@@ -2428,7 +2553,7 @@
 
     "stdin-discarder": ["stdin-discarder@0.2.2", "", {}, "sha512-UhDfHmA92YAlNnCfhmq0VeNL5bDbiZGg7sZ2IvPsXubGkiNa9EC+tUTsjBRsYUAz87btI6/1wf4XoVvQ3uRnmQ=="],
 
-    "streamdown": ["streamdown@2.5.0", "", { "dependencies": { "clsx": "^2.1.1", "hast-util-to-jsx-runtime": "^2.3.6", "html-url-attributes": "^3.0.1", "marked": "^17.0.1", "mermaid": "^11.12.2", "rehype-harden": "^1.1.8", "rehype-raw": "^7.0.0", "rehype-sanitize": "^6.0.0", "remark-gfm": "^4.0.1", "remark-parse": "^11.0.0", "remark-rehype": "^11.1.2", "remend": "1.3.0", "tailwind-merge": "^3.4.0", "unified": "^11.0.5", "unist-util-visit": "^5.0.0", "unist-util-visit-parents": "^6.0.0" }, "peerDependencies": { "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" } }, "sha512-/tTnURfIOxZK/pqJAxsfCvETG/XCJHoWnk3jq9xLcuz6CSpnjjuxSRBTTL4PKGhxiZQf0lqPxGhImdpwcZ2XwA=="],
+    "streamdown": ["streamdown@2.6.0", "", { "dependencies": { "clsx": "^2.1.1", "hast-util-to-jsx-runtime": "^2.3.6", "html-url-attributes": "^3.0.1", "marked": "^17.0.1", "rehype-harden": "^1.1.8", "rehype-raw": "^7.0.0", "rehype-sanitize": "^6.0.0", "remark-gfm": "^4.0.1", "remark-parse": "^11.0.0", "remark-rehype": "^11.1.2", "remend": "1.3.1", "tailwind-merge": "^3.6.0", "unified": "^11.0.5", "unist-util-visit": "^5.1.0", "unist-util-visit-parents": "^6.0.2" }, "peerDependencies": { "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0" } }, "sha512-nQZVUn4GvB2R5SAlDNph20iKZeW+RM4gv6G1H3ACypEnmQf8PgTHZ/1Ta2OACRwQ2coK7aW5AeIAa7Ls5zk+RA=="],
 
     "streamsearch": ["streamsearch@1.1.0", "", {}, "sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg=="],
 
@@ -2448,7 +2573,7 @@
 
     "strip-json-comments": ["strip-json-comments@5.0.3", "", {}, "sha512-1tB5mhVo7U+ETBKNf92xT4hrQa3pm0MZ0PQvuDnWgAAGHDsfp4lPSpiS6psrSiet87wyGPh9ft6wmhOMQ0hDiw=="],
 
-    "strnum": ["strnum@2.4.1", "", { "dependencies": { "anynum": "^1.0.1" } }, "sha512-M9eUSMT2dCB2cTNPG7UYj6KuK7RJR2SN2+yCV/fTW3xzTCS6EaGZ5pSMgDIjB7r8zSfTGk+dvvn9rTjpVS9Mwg=="],
+    "strnum": ["strnum@2.4.2", "", { "dependencies": { "anynum": "^1.0.1" } }, "sha512-rDG3Ah4TV0k1hWvLSzkZtMmLN9+eS+h3knq4MP6A42Y3Yh5qGNnOUs1jJkoSr8FG5dsL28c7KgkIBzSEykqtuw=="],
 
     "strtok3": ["strtok3@10.3.5", "", { "dependencies": { "@tokenizer/token": "^0.3.0" } }, "sha512-ki4hZQfh5rX0QDLLkOCj+h+CVNkqmp/CMf8v8kZpkNVK6jGQooMytqzLZYUVYIZcFZ6yDB70EfD8POcFXiF5oA=="],
 
@@ -2456,21 +2581,19 @@
 
     "style-to-object": ["style-to-object@1.0.14", "", { "dependencies": { "inline-style-parser": "0.2.7" } }, "sha512-LIN7rULI0jBscWQYaSswptyderlarFkjQ+t79nzty8tcIAceVomEVlLzH5VP4Cmsv6MtKhs7qaAiwlcp+Mgaxw=="],
 
-    "styled-jsx": ["styled-jsx@5.1.6", "", { "dependencies": { "client-only": "0.0.1" }, "peerDependencies": { "react": ">= 16.8.0 || 17.x.x || ^18.0.0-0 || ^19.0.0-0" } }, "sha512-qSVyDTeMotdvQYoHWLNGwRFJHC+i+ZvdBRYosOFgC+Wg1vx4frN2/RG/NA7SYqqvKNLf39P2LSRA2pu6n0XYZA=="],
-
-    "stylis": ["stylis@4.4.0", "", {}, "sha512-5Z9ZpRzfuH6l/UAvCPAPUo3665Nk2wLaZU3x+TLHKVzIz33+sbJqbtrYoC3KD4/uVOr2Zp+L0LySezP9OHV9yA=="],
+    "styled-jsx": ["styled-jsx@5.1.6", "", { "dependencies": { "client-only": "0.0.1" }, "peerDependencies": { "@babel/core": "*", "babel-plugin-macros": "*", "react": ">= 16.8.0 || 17.x.x || ^18.0.0-0 || ^19.0.0-0" }, "optionalPeers": ["@babel/core", "babel-plugin-macros"] }, "sha512-qSVyDTeMotdvQYoHWLNGwRFJHC+i+ZvdBRYosOFgC+Wg1vx4frN2/RG/NA7SYqqvKNLf39P2LSRA2pu6n0XYZA=="],
 
     "superagent": ["superagent@10.3.0", "", { "dependencies": { "component-emitter": "^1.3.1", "cookiejar": "^2.1.4", "debug": "^4.3.7", "fast-safe-stringify": "^2.1.1", "form-data": "^4.0.5", "formidable": "^3.5.4", "methods": "^1.1.2", "mime": "2.6.0", "qs": "^6.14.1" } }, "sha512-B+4Ik7ROgVKrQsXTV0Jwp2u+PXYLSlqtDAhYnkkD+zn3yg8s/zjA2MeGayPoY/KICrbitwneDHrjSotxKL+0XQ=="],
 
     "supertest": ["supertest@7.2.2", "", { "dependencies": { "cookie-signature": "^1.2.2", "methods": "^1.1.2", "superagent": "^10.3.0" } }, "sha512-oK8WG9diS3DlhdUkcFn4tkNIiIbBx9lI2ClF8K+b2/m8Eyv47LSawxUzZQSNKUrVb2KsqeTDCcjAAVPYaSLVTA=="],
 
-    "supports-color": ["supports-color@8.1.1", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q=="],
+    "supports-color": ["supports-color@10.2.2", "", {}, "sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g=="],
 
     "swagger-ui-dist": ["swagger-ui-dist@5.32.13", "", { "dependencies": { "@scarf/scarf": "=1.4.0" } }, "sha512-qQobzb3DeC2LeK0j3E8812Ef4aIq1y9flJxvZkimkqUC/w4u7wS+yCc+VakqGJLweUUBrI24effhwo8OsAvNAw=="],
 
-    "systeminformation": ["systeminformation@5.33.1", "", { "os": "!aix", "bin": { "systeminformation": "lib/cli.js" } }, "sha512-DEN6ICHk3Tk0Uf/hrAHh7xlt7iL5CJFBtPZinA0H62DrGG/KPKqq/Nzj6lCXPS4Ay/sf/14zNnk9LpqKzBIc+w=="],
+    "systeminformation": ["systeminformation@5.33.10", "", { "os": "!aix", "bin": { "systeminformation": "lib/cli.js" } }, "sha512-/NXbMVASt2UbSVgmWto4aBTIAeuYY7zOELpZybmNxqpsrbo5uYHpuEPf5nkyrPng0uG5YOb+Yv6s0FyKY4mDQg=="],
 
-    "tailwind-merge": ["tailwind-merge@3.6.0", "", {}, "sha512-uxL7qAVQriqRQPAyK3pj66VqskWqoZ37PW94jwOTwNfq/z9oyu1V+eqrZqtR2+fCiXdYOZe/Modt8GtvqNzu+w=="],
+    "tailwind-merge": ["tailwind-merge@3.7.0", "", {}, "sha512-XPPUyAc+cvspz3lHTcR/QgPfW2A0lv/xQNIjX3HGhLR+Nq2lHaLq5MtTesHn8GUr3W3DguT2KT5x3NVgRtYwmA=="],
 
     "tailwindcss": ["tailwindcss@4.3.3", "", {}, "sha512-gOhV3P7ufE62QDGg1zVaTgCR+EtPv92k2nIhVcVKcLmxT1sUBsQGhnZj175j+MqRt4zLF7ic+sCYjfhxMxj7YQ=="],
 
@@ -2484,13 +2607,11 @@
 
     "tiny-invariant": ["tiny-invariant@1.3.3", "", {}, "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg=="],
 
-    "tinyexec": ["tinyexec@1.3.0", "", {}, "sha512-QKAl9m8gWWGHV8jZcPeym6j+XULi6tOf1mT83WYJ4Lk2ytW/uwAWkrP0uFsdoYMdueVJ0qs26wZ+23xeB4ibNQ=="],
-
     "tinyglobby": ["tinyglobby@0.2.17", "", { "dependencies": { "fdir": "^6.5.0", "picomatch": "^4.0.4" } }, "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g=="],
 
-    "tldts": ["tldts@6.1.86", "", { "dependencies": { "tldts-core": "^6.1.86" }, "bin": { "tldts": "bin/cli.js" } }, "sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ=="],
+    "tldts": ["tldts@7.4.13", "", { "dependencies": { "tldts-core": "^7.4.13" }, "bin": { "tldts": "bin/cli.js" } }, "sha512-iHtaIWWIbMDkCeJdTBzZFGgbluE5J+oHlb2g7+oAz1S1gpuVpabRZdQyd471Vl8UUkcz2vXSL8xZH2kyCe8tfA=="],
 
-    "tldts-core": ["tldts-core@6.1.86", "", {}, "sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA=="],
+    "tldts-core": ["tldts-core@7.4.13", "", {}, "sha512-mbYsrih5FRtGxs3Usvl/PqwJsNpp+jsmrdFviiK02teHDG0/HebBG/pqCylje3kzgXYzuLoHJF/0mz9W53t8Xg=="],
 
     "to-regex-range": ["to-regex-range@5.0.1", "", { "dependencies": { "is-number": "^7.0.0" } }, "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ=="],
 
@@ -2506,8 +2627,6 @@
 
     "trpc-to-openapi": ["trpc-to-openapi@3.3.0", "", { "dependencies": { "co-body": "6.2.0", "h3": "^1.15.5", "openapi3-ts": "4.4.0" }, "optionalDependencies": { "@rollup/rollup-linux-x64-gnu": "4.6.1" }, "peerDependencies": { "@trpc/server": "^11.1.0", "zod": "^3.25.0 || ^4.0.0", "zod-openapi": "^5.4.4" } }, "sha512-PNMXq0K37Ott5ysNACYN1XLaM5xZGNJrx1QiQVTlk4hmgJomoyiAKhVrpwrK02JW3joSQmHYBOZ7pK6Hdioekw=="],
 
-    "ts-dedent": ["ts-dedent@2.3.0", "", {}, "sha512-JfJeIHke7y2egdGGgRAvpCwYFUsHlM2gPcrVOxFkznt/4uzQ7HFmvE63iFHVLBJNDuyDOQgijDK/tXH/f6Msjg=="],
-
     "ts-morph": ["ts-morph@26.0.0", "", { "dependencies": { "@ts-morph/common": "~0.27.0", "code-block-writer": "^13.0.3" } }, "sha512-ztMO++owQnz8c/gIENcM9XfCEzgoGphTv+nKpYNM1bgsdOVC/jRZuEBf6N+mLLDNg68Kl+GgUZfOySaRiG1/Ug=="],
 
     "tsconfig-paths": ["tsconfig-paths@4.2.0", "", { "dependencies": { "json5": "^2.2.2", "minimist": "^1.2.6", "strip-bom": "^3.0.0" } }, "sha512-NoZ4roiN7LnbKn9QqE1amc9DJfzvZXxF4xDavcOWt1BPkdx+m+0gJuPM+S0vCe7zTJMYUP0R8pO2XMr+Y8oLIg=="],
@@ -2516,7 +2635,7 @@
 
     "tunnel-agent": ["tunnel-agent@0.6.0", "", { "dependencies": { "safe-buffer": "^5.0.1" } }, "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w=="],
 
-    "turbo": ["turbo@2.10.8", "", { "optionalDependencies": { "@turbo/darwin-64": "2.10.8", "@turbo/darwin-arm64": "2.10.8", "@turbo/linux-64": "2.10.8", "@turbo/linux-arm64": "2.10.8", "@turbo/windows-64": "2.10.8", "@turbo/windows-arm64": "2.10.8" }, "bin": { "turbo": "bin/turbo" } }, "sha512-9+8YX5QOkGXzZxcIykTHgaooRHGMWO+jfdyRK0o+rN0U7hBIig2MrJ8r/aNzIPDPhdA73SGb0O+tIztaModTMg=="],
+    "turbo": ["turbo@2.10.12", "", { "optionalDependencies": { "@turbo/darwin-64": "2.10.12", "@turbo/darwin-arm64": "2.10.12", "@turbo/linux-64": "2.10.12", "@turbo/linux-arm64": "2.10.12", "@turbo/windows-64": "2.10.12", "@turbo/windows-arm64": "2.10.12" }, "bin": { "turbo": "bin/turbo" } }, "sha512-AswgMPnpOoaVZHrrSBejETzEbuIA69OVGwfkHwfrY0A23VjWXBANzgq9+OymWOHAIArB7D1+1z498WY8fGg1Jw=="],
 
     "turndown": ["turndown@7.2.4", "", { "dependencies": { "@mixmark-io/domino": "^2.2.0" } }, "sha512-I8yFsfRzmzK0WV1pNNOA4A7y4RDfFxPRxb3t+e3ui14qSGOxGtiSP6GjeX+Y6CHb7HYaFj7ECUD7VE5kQMZWGQ=="],
 
@@ -2526,7 +2645,7 @@
 
     "typedarray": ["typedarray@0.0.6", "", {}, "sha512-/aCDEGatGvZ2BIk+HmLf4ifCJFwvKFNb9/JeZPMulfgFracn9QFcAf5GO8B/mweUjSoblS5In0cWhqpfs/5PQA=="],
 
-    "typescript": ["typescript@5.9.2", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A=="],
+    "typescript": ["typescript@7.0.2", "", { "optionalDependencies": { "@typescript/typescript-aix-ppc64": "7.0.2", "@typescript/typescript-darwin-arm64": "7.0.2", "@typescript/typescript-darwin-x64": "7.0.2", "@typescript/typescript-freebsd-arm64": "7.0.2", "@typescript/typescript-freebsd-x64": "7.0.2", "@typescript/typescript-linux-arm": "7.0.2", "@typescript/typescript-linux-arm64": "7.0.2", "@typescript/typescript-linux-loong64": "7.0.2", "@typescript/typescript-linux-mips64el": "7.0.2", "@typescript/typescript-linux-ppc64": "7.0.2", "@typescript/typescript-linux-riscv64": "7.0.2", "@typescript/typescript-linux-s390x": "7.0.2", "@typescript/typescript-linux-x64": "7.0.2", "@typescript/typescript-netbsd-arm64": "7.0.2", "@typescript/typescript-netbsd-x64": "7.0.2", "@typescript/typescript-openbsd-arm64": "7.0.2", "@typescript/typescript-openbsd-x64": "7.0.2", "@typescript/typescript-sunos-x64": "7.0.2", "@typescript/typescript-win32-arm64": "7.0.2", "@typescript/typescript-win32-x64": "7.0.2" }, "bin": { "tsc": "bin/tsc" } }, "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA=="],
 
     "ufo": ["ufo@1.6.4", "", {}, "sha512-JFNbkD1Svwe0KvGi8GOeLcP4kAWQ609twvCdcHxq1oSL8svv39ZuSvajcD8B+5D0eL4+s1Is2D/O6KN3qcTeRA=="],
 
@@ -2534,13 +2653,15 @@
 
     "uint8array-extras": ["uint8array-extras@1.5.0", "", {}, "sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A=="],
 
-    "unbash": ["unbash@4.0.10", "", {}, "sha512-b7zoBQvpWp0vuN5q2vK2RRBR2SvuruQAs50DApdDveBSn3eSYd84IaHodFqQIMlvY9K2VnyBUEXgwOBuGU9GBg=="],
+    "ulid": ["ulid@3.0.2", "", { "bin": { "ulid": "dist/cli.js" } }, "sha512-yu26mwteFYzBAot7KVMqFGCVpsF6g8wXfJzQUHvu1no3+rRRSFcSV2nKeYvNPLD2J4b08jYBDhHUjeH0ygIl9w=="],
+
+    "unbash": ["unbash@4.0.11", "", {}, "sha512-FoSOKV7NEofQSkAefMVHam4ZPKYMxjAydxiV72UFEDNV/YofxjGfiZ2A9pZjdL/lRJzTjcu4PABo1JYJX8N5iQ=="],
 
     "uncrypto": ["uncrypto@0.1.3", "", {}, "sha512-Ql87qFHB3s/De2ClA9e0gsnS6zXG27SkTiSJwjCc9MebbfapQfuPzumMIUMi38ezPZVNFcHI9sUIepeQfw8J8Q=="],
 
-    "undici": ["undici@6.28.0", "", {}, "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA=="],
+    "undici": ["undici@6.28.1", "", {}, "sha512-zWpdTVD54H48CIybL0rWQ3ukpb9d23wM7eH5RtfdmeP70cWHNjtfo7P4vZX+5CoDcO53J4Pu5uXp7lNfjc6DRA=="],
 
-    "undici-types": ["undici-types@7.18.2", "", {}, "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w=="],
+    "undici-types": ["undici-types@8.9.0", "", {}, "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg=="],
 
     "unenv": ["unenv@2.0.0-rc.24", "", { "dependencies": { "pathe": "^2.0.3" } }, "sha512-i7qRCmY42zmCwnYlh9H2SvLEypEFGye5iRmEMKjcGi7zk9UquigRjFtTLz0TYqr0ZGLZhaMHl/foy1bZR+Cwlw=="],
 
@@ -2562,20 +2683,18 @@
 
     "unpipe": ["unpipe@1.0.0", "", {}, "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ=="],
 
-    "unstorage": ["unstorage@2.0.0-alpha.7", "", { "peerDependencies": { "@azure/app-configuration": "^1.11.0", "@azure/cosmos": "^4.9.1", "@azure/data-tables": "^13.3.2", "@azure/identity": "^4.13.0", "@azure/keyvault-secrets": "^4.10.0", "@azure/storage-blob": "^12.31.0", "@capacitor/preferences": "^6 || ^7 || ^8", "@deno/kv": ">=0.13.0", "@netlify/blobs": "^6.5.0 || ^7.0.0 || ^8.1.0 || ^9.0.0 || ^10.0.0", "@planetscale/database": "^1.19.0", "@upstash/redis": "^1.36.2", "@vercel/blob": ">=0.27.3", "@vercel/functions": "^2.2.12 || ^3.0.0", "@vercel/kv": "^1.0.1", "aws4fetch": "^1.0.20", "chokidar": "^4 || ^5", "db0": ">=0.3.4", "idb-keyval": "^6.2.2", "ioredis": "^5.9.3", "lru-cache": "^11.2.6", "mongodb": "^6 || ^7", "ofetch": "*", "uploadthing": "^7.7.4" }, "optionalPeers": ["@azure/app-configuration", "@azure/cosmos", "@azure/data-tables", "@azure/identity", "@azure/keyvault-secrets", "@azure/storage-blob", "@capacitor/preferences", "@deno/kv", "@netlify/blobs", "@planetscale/database", "@upstash/redis", "@vercel/blob", "@vercel/functions", "@vercel/kv", "aws4fetch", "chokidar", "db0", "idb-keyval", "ioredis", "lru-cache", "mongodb", "ofetch", "uploadthing"] }, "sha512-ELPztchk2zgFJnakyodVY3vJWGW9jy//keJ32IOJVGUMyaPydwcA1FtVvWqT0TNRch9H+cMNEGllfVFfScImog=="],
+    "unstorage": ["unstorage@2.0.0-alpha.10", "", {}, "sha512-6h1veZp8gnp4dGllf0tDijoXxDYymJu251IpKKkrSVH+QHL6tXFbwG85KM+CBHSgpkkgtPuIiZ9oLCLP5+1Evw=="],
 
-    "update-browserslist-db": ["update-browserslist-db@1.2.3", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w=="],
+    "update-browserslist-db": ["update-browserslist-db@1.3.3", "", { "dependencies": { "escalade": "^3.2.0", "picocolors": "^1.1.1" }, "peerDependencies": { "browserslist": ">= 4.21.0" }, "bin": { "update-browserslist-db": "cli.js" } }, "sha512-pJ2sYawQS0R/WI928Gj5GlPhTGzbMelq0+4INtSYNDV9ErKJcX6xjGWkoG/VnB3dpUm00zALaqkrUD77pO5TDQ=="],
 
     "use-callback-ref": ["use-callback-ref@1.3.3", "", { "dependencies": { "tslib": "^2.0.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-jQL3lRnocaFtu3V00JToYz/4QkNWswxijDaCVNZRiRTO3HQDLsdu1ZtmIUvV4yPp+rvWm5j0y0TG/S61cuijTg=="],
 
     "use-sidecar": ["use-sidecar@1.1.3", "", { "dependencies": { "detect-node-es": "^1.1.0", "tslib": "^2.0.0" }, "peerDependencies": { "@types/react": "*", "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-Fedw0aZvkhynoPYlA5WXrMCAMm+nSWdZt6lzJQ7Ok8S6Q+VsHmHpRWndVRJ8Be0ZbkfPc5LRYH+5XrzXcEeLRQ=="],
 
-    "use-sync-external-store": ["use-sync-external-store@1.6.0", "", { "peerDependencies": { "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w=="],
+    "use-sync-external-store": ["use-sync-external-store@1.7.0", "", { "peerDependencies": { "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0" } }, "sha512-6L+EeigHMQhdaIPNIFUKwfWJSwWFQ8gJbJ2DLOs5sDIegTwR9fRxvnM3uciHKjIZhFz+KAv2emhWMRvDmMcY8A=="],
 
     "util-deprecate": ["util-deprecate@1.0.2", "", {}, "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw=="],
 
-    "uuid": ["uuid@14.0.1", "", { "bin": { "uuid": "dist-node/bin/uuid" } }, "sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew=="],
-
     "valibot": ["valibot@1.4.2", "", { "peerDependencies": { "typescript": ">=5" }, "optionalPeers": ["typescript"] }, "sha512-gjdCvJ6d3RyHAneqxMYMW9QMCwYMb3jpOO0IyHZV1bnRHFBHrX3VkIILt5XYR0WhwHiH7Mty8ovuPZ/O3gamrg=="],
 
     "validate-npm-package-name": ["validate-npm-package-name@7.0.2", "", {}, "sha512-hVDIBwsRruT73PbK7uP5ebUt+ezEtCmzZz3F59BSr2F6OVFnJ/6h8liuvdLrQ88Xmnk6/+xGGuq+pG9WwTuy3A=="],
@@ -2598,17 +2717,17 @@
 
     "web-namespaces": ["web-namespaces@2.0.1", "", {}, "sha512-bKr1DkiNa2krS7qxNtdrtHAmzuYGFQLiQ13TsorsdT6ULTkPLKuu5+GsFpDlg6JFjUTwX2DyhMPG2be8uPrqsQ=="],
 
-    "web-vitals": ["web-vitals@5.3.0", "", {}, "sha512-q6LWsLatGYZp5VGBIOvbTj6JBV2nOmC8KvWztXBmwJcfFAzhwKwbOxhUH306XY3CcaZDUlSmSuNPBsCn0bFu+g=="],
+    "web-vitals": ["web-vitals@6.2.1", "", {}, "sha512-rLcLXA2sx6+9dE88NHFubwTtGxpK4yYBLj6qHPdFoCaLr0cXGb4efOqtKLlm4loGA4OEKHIQKMKzZkKyOh5ctw=="],
 
-    "web-vitals-soft-navs": ["web-vitals@6.0.0", "", {}, "sha512-Guaibvy/+uNtL6Bsu4jmMJGzuSl91oeRH5iO9pPRbYftnFUr3yqT1TUNX/OE4o9HexuEMU3Kb/Wg7iKhlffZUA=="],
+    "web-vitals-soft-navs": ["web-vitals@6.2.1", "", {}, "sha512-rLcLXA2sx6+9dE88NHFubwTtGxpK4yYBLj6qHPdFoCaLr0cXGb4efOqtKLlm4loGA4OEKHIQKMKzZkKyOh5ctw=="],
 
     "which": ["which@4.0.0", "", { "dependencies": { "isexe": "^3.1.1" }, "bin": { "node-which": "bin/which.js" } }, "sha512-GlaYyEb07DPxYCKhKzplCWBJtvxZcZMrL+4UkrTSJHHPyZU4mYYTv3qaOe77H7EODLSSopAUFAc6W8U4yqvscg=="],
 
-    "wrap-ansi": ["wrap-ansi@7.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q=="],
+    "wrap-ansi": ["wrap-ansi@9.0.2", "", { "dependencies": { "ansi-styles": "^6.2.1", "string-width": "^7.0.0", "strip-ansi": "^7.1.0" } }, "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww=="],
 
     "wrappy": ["wrappy@1.0.2", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="],
 
-    "wsl-utils": ["wsl-utils@0.1.0", "", { "dependencies": { "is-wsl": "^3.1.0" } }, "sha512-h3Fbisa2nKGPxCpm89Hk33lBLsnaGBvctQopaBSOW/uIs6FTe1ATyAnKFJrzVs9vpGdsTe73WF3V4lIsk4Gacw=="],
+    "wsl-utils": ["wsl-utils@1.0.0", "", { "dependencies": { "is-wsl": "^3.1.0", "powershell-utils": "^0.1.0" } }, "sha512-Hl0ZOAs672vg+06kfujwRhoS6/jehvULrlFkuF2dRu6pHgA8U06h3xqNIqNNU1LTXPcedxByAR4GS6pwQK0mgA=="],
 
     "xdg-app-paths": ["xdg-app-paths@5.5.1", "", { "dependencies": { "os-paths": "^4.0.1", "xdg-portable": "^7.2.0" } }, "sha512-hI3flOB4PLZIy5prbtTpirobtPE2ZtZ52szO+2mM9Efp6ErM398La+C1lIpNWDfNoQk+6Lsi6nMcCwVB7pxeMQ=="],
 
@@ -2630,19 +2749,19 @@
 
     "yallist": ["yallist@3.1.1", "", {}, "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="],
 
-    "yaml": ["yaml@2.9.0", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA=="],
+    "yaml": ["yaml@2.9.1", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw=="],
 
-    "yargs": ["yargs@17.7.2", "", { "dependencies": { "cliui": "^8.0.1", "escalade": "^3.1.1", "get-caller-file": "^2.0.5", "require-directory": "^2.1.1", "string-width": "^4.2.3", "y18n": "^5.0.5", "yargs-parser": "^21.1.1" } }, "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w=="],
+    "yargs": ["yargs@18.0.0", "", { "dependencies": { "cliui": "^9.0.1", "escalade": "^3.1.1", "get-caller-file": "^2.0.5", "string-width": "^7.2.0", "y18n": "^5.0.5", "yargs-parser": "^22.0.0" } }, "sha512-4UEqdc2RYGHZc7Doyqkrqiln3p9X2DZVxaGbwhn2pi7MrRagKaOcIKe8L3OxYcbhXLgLFUS3zAYuQjKBQgmuNg=="],
 
-    "yargs-parser": ["yargs-parser@21.1.1", "", {}, "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw=="],
+    "yargs-parser": ["yargs-parser@22.0.0", "", {}, "sha512-rwu/ClNdSMpkSrUb+d6BRsSkLUq1fmfsY6TOpYzTwvwkg1/NRG85KBy3kq++A8LKQwX6lsu+aWad+2khvuXrqw=="],
 
-    "yocto-spinner": ["yocto-spinner@0.2.3", "", { "dependencies": { "yoctocolors": "^2.1.1" } }, "sha512-sqBChb33loEnkoXte1bLg45bEBsOP9N1kzQh5JZNKj/0rik4zAPTNSAVPj3uQAdc6slYJ0Ksc403G2XgxsJQFQ=="],
+    "yocto-spinner": ["yocto-spinner@1.2.2", "", { "dependencies": { "yoctocolors": "^2.1.1" } }, "sha512-DODGl1wJjA/s5pnJFKau9lIYHT81lnhob1i3e1TjxZRxEhWRKl74nTbWE6H5KlkViQQTo/Z29YFdxzTZAMY3ng=="],
 
     "yoctocolors": ["yoctocolors@2.2.0", "", {}, "sha512-xYqdZFUK/VYazNl/oCDYN+3WloWQwMfZxBoiNt6qNyk+xfOdi598muWE42rNZFp1kNOiqW936q5RhUdnpqElSg=="],
 
     "zeptomatch": ["zeptomatch@2.1.0", "", { "dependencies": { "grammex": "^3.1.11", "graphmatch": "^1.1.0" } }, "sha512-KiGErG2J0G82LSpniV0CtIzjlJ10E04j02VOudJsPyPwNZgGnRKQy7I1R7GMyg/QswnE4l7ohSGrQbQbjXPPDA=="],
 
-    "zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
+    "zod": ["zod@4.6.5", "", {}, "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q=="],
 
     "zod-openapi": ["zod-openapi@5.4.6", "", { "peerDependencies": { "zod": "^3.25.74 || ^4.0.0" } }, "sha512-P2jsOOBAq/6hCwUsMCjUATZ8szkMsV5VAwZENfyxp2Hc/XPJQpVwAgevWZc65xZauCwWB9LAn7zYeiCJFAEL+A=="],
 
@@ -2652,7 +2771,9 @@
 
     "@ai-sdk/gateway/@vercel/oidc": ["@vercel/oidc@3.2.0", "", {}, "sha512-UycprH3T6n3jH0k44NHMa7pnFHGu/N05MjojYr+Mc6I7obkoLIJujSWwin1pCvdy/eOxrI/l3uDLQsmcrOb4ug=="],
 
-    "@ai-sdk/provider-utils/undici": ["undici@7.29.0", "", {}, "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw=="],
+    "@ai-sdk/provider-utils/undici": ["undici@7.29.1", "", {}, "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q=="],
+
+    "@authenio/xml-encryption/@xmldom/xmldom": ["@xmldom/xmldom@0.8.15", "", {}, "sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA=="],
 
     "@authenio/xml-encryption/xpath": ["xpath@0.0.32", "", {}, "sha512-rxMJhSIoiO8vXcWvSifKqhvV96GjiD5wYb8/QHdoRyQvraTpp4IEv944nhGausZZ3u7dhQXteZuZbaqfpB7uYw=="],
 
@@ -2662,83 +2783,27 @@
 
     "@babel/helper-create-class-features-plugin/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
-    "@better-auth/api-key/@better-auth/core": ["@better-auth/core@1.6.25", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.39.0", "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.3.7", "jose": "^6.1.0", "kysely": "^0.28.5 || ^0.29.0", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-lMTlhtwyK4NpY9kPF+2rQCRKYpg136d3gM2xl8esxT1PjJx5Nh5YwZvxcYCIjDuO759sx6TCloJTuwcZGG6ZBw=="],
-
-    "@better-auth/api-key/@better-auth/utils": ["@better-auth/utils@0.4.2", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A=="],
-
-    "@better-auth/cli/@prisma/client": ["@prisma/client@5.22.0", "", { "peerDependencies": { "prisma": "*" }, "optionalPeers": ["prisma"] }, "sha512-M0SVXfyHnQREBKxCgyo7sffrKttwE6R8PMq330MIUF0pTwjUhLbW84pFDlf06B27XyCR++VtjugEnIHdr07SVA=="],
-
-    "@better-auth/cli/better-auth": ["better-auth@1.4.22", "", { "dependencies": { "@better-auth/core": "1.4.22", "@better-auth/telemetry": "1.4.22", "@better-auth/utils": "0.3.0", "@better-fetch/fetch": "1.1.21", "@noble/ciphers": "^2.0.0", "@noble/hashes": "^2.0.0", "better-call": "1.1.8", "defu": "^6.1.4", "jose": "^6.1.0", "kysely": "^0.28.5", "nanostores": "^1.0.1", "zod": "^4.3.5" }, "peerDependencies": { "@lynx-js/react": "*", "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0", "@sveltejs/kit": "^2.0.0", "@tanstack/react-start": "^1.0.0", "@tanstack/solid-start": "^1.0.0", "better-sqlite3": "^12.0.0", "drizzle-kit": ">=0.31.4", "drizzle-orm": ">=0.41.0", "mongodb": "^6.0.0 || ^7.0.0", "mysql2": "^3.0.0", "next": "^14.0.0 || ^15.0.0 || ^16.0.0", "pg": "^8.0.0", "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0", "react": "^18.0.0 || ^19.0.0", "react-dom": "^18.0.0 || ^19.0.0", "solid-js": "^1.0.0", "svelte": "^4.0.0 || ^5.0.0", "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0", "vue": "^3.0.0" }, "optionalPeers": ["@lynx-js/react", "@prisma/client", "@sveltejs/kit", "@tanstack/react-start", "@tanstack/solid-start", "better-sqlite3", "drizzle-kit", "drizzle-orm", "mongodb", "mysql2", "next", "pg", "prisma", "react", "react-dom", "solid-js", "svelte", "vitest", "vue"] }, "sha512-CXQ7ZLDkf/I9iaVTNuejJ7FlWal50hRPIv1n0lqMipvthEoMx+2RQyNXUvzGRjltSe5d9rcZPI3IxdtS1A5+YA=="],
-
-    "@better-auth/core/@better-fetch/fetch": ["@better-fetch/fetch@1.1.21", "", {}, "sha512-/ImESw0sskqlVR94jB+5+Pxjf+xBwDZF/N5+y2/q4EqD7IARUTSpPfIo8uf39SYpCxyOCtbyYpUrZ3F/k0zT4A=="],
-
-    "@better-auth/core/better-call": ["better-call@1.1.8", "", { "dependencies": { "@better-auth/utils": "^0.3.0", "@better-fetch/fetch": "^1.1.4", "rou3": "^0.7.10", "set-cookie-parser": "^2.7.1" }, "peerDependencies": { "zod": "^4.0.0" }, "optionalPeers": ["zod"] }, "sha512-XMQ2rs6FNXasGNfMjzbyroSwKwYbZ/T3IxruSS6U2MJRsSYh3wYtG3o6H00ZlKZ/C/UPOAD97tqgQJNsxyeTXw=="],
-
-    "@better-auth/core/kysely": ["kysely@0.28.17", "", {}, "sha512-nbD8lB9EB3wNdMhOCdx5Li8DxnLbvKByylRLcJ1h+4SkrowVeECAyZlyiKMThF7xFdRz0jSQ2MoJr+wXux2y0Q=="],
-
-    "@better-auth/drizzle-adapter/@better-auth/core": ["@better-auth/core@1.6.25", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.39.0", "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.3.7", "jose": "^6.1.0", "kysely": "^0.28.5 || ^0.29.0", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-lMTlhtwyK4NpY9kPF+2rQCRKYpg136d3gM2xl8esxT1PjJx5Nh5YwZvxcYCIjDuO759sx6TCloJTuwcZGG6ZBw=="],
-
-    "@better-auth/drizzle-adapter/@better-auth/utils": ["@better-auth/utils@0.4.2", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A=="],
-
-    "@better-auth/kysely-adapter/@better-auth/core": ["@better-auth/core@1.6.25", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.39.0", "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.3.7", "jose": "^6.1.0", "kysely": "^0.28.5 || ^0.29.0", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-lMTlhtwyK4NpY9kPF+2rQCRKYpg136d3gM2xl8esxT1PjJx5Nh5YwZvxcYCIjDuO759sx6TCloJTuwcZGG6ZBw=="],
-
-    "@better-auth/kysely-adapter/@better-auth/utils": ["@better-auth/utils@0.4.2", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A=="],
-
-    "@better-auth/memory-adapter/@better-auth/core": ["@better-auth/core@1.6.25", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.39.0", "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.3.7", "jose": "^6.1.0", "kysely": "^0.28.5 || ^0.29.0", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-lMTlhtwyK4NpY9kPF+2rQCRKYpg136d3gM2xl8esxT1PjJx5Nh5YwZvxcYCIjDuO759sx6TCloJTuwcZGG6ZBw=="],
-
-    "@better-auth/memory-adapter/@better-auth/utils": ["@better-auth/utils@0.4.2", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A=="],
-
-    "@better-auth/mongo-adapter/@better-auth/core": ["@better-auth/core@1.6.25", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.39.0", "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.3.7", "jose": "^6.1.0", "kysely": "^0.28.5 || ^0.29.0", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-lMTlhtwyK4NpY9kPF+2rQCRKYpg136d3gM2xl8esxT1PjJx5Nh5YwZvxcYCIjDuO759sx6TCloJTuwcZGG6ZBw=="],
-
-    "@better-auth/mongo-adapter/@better-auth/utils": ["@better-auth/utils@0.4.2", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A=="],
-
-    "@better-auth/prisma-adapter/@better-auth/core": ["@better-auth/core@1.6.25", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.39.0", "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.3.7", "jose": "^6.1.0", "kysely": "^0.28.5 || ^0.29.0", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-lMTlhtwyK4NpY9kPF+2rQCRKYpg136d3gM2xl8esxT1PjJx5Nh5YwZvxcYCIjDuO759sx6TCloJTuwcZGG6ZBw=="],
-
-    "@better-auth/prisma-adapter/@better-auth/utils": ["@better-auth/utils@0.4.2", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A=="],
-
-    "@better-auth/sso/@better-auth/core": ["@better-auth/core@1.6.25", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.39.0", "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.3.7", "jose": "^6.1.0", "kysely": "^0.28.5 || ^0.29.0", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-lMTlhtwyK4NpY9kPF+2rQCRKYpg136d3gM2xl8esxT1PjJx5Nh5YwZvxcYCIjDuO759sx6TCloJTuwcZGG6ZBw=="],
-
-    "@better-auth/sso/@better-auth/utils": ["@better-auth/utils@0.4.2", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A=="],
-
-    "@better-auth/telemetry/@better-fetch/fetch": ["@better-fetch/fetch@1.1.21", "", {}, "sha512-/ImESw0sskqlVR94jB+5+Pxjf+xBwDZF/N5+y2/q4EqD7IARUTSpPfIo8uf39SYpCxyOCtbyYpUrZ3F/k0zT4A=="],
-
-    "@chevrotain/cst-dts-gen/lodash": ["lodash@4.17.21", "", {}, "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg=="],
-
-    "@chevrotain/gast/lodash": ["lodash@4.17.21", "", {}, "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg=="],
-
-    "@crm/ui/react": ["react@19.2.4", "", {}, "sha512-9nfp2hYpCwOjAN+8TZFGhtWEwgvWHXqESH8qT89AT/lWklpLON22Lc8pEtnpsZz7VmawabSU0gCjnj8aC0euHQ=="],
-
     "@dotenvx/dotenvx/commander": ["commander@11.1.0", "", {}, "sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ=="],
 
     "@dotenvx/dotenvx/execa": ["execa@5.1.1", "", { "dependencies": { "cross-spawn": "^7.0.3", "get-stream": "^6.0.0", "human-signals": "^2.1.0", "is-stream": "^2.0.0", "merge-stream": "^2.0.0", "npm-run-path": "^4.0.1", "onetime": "^5.1.2", "signal-exit": "^3.0.3", "strip-final-newline": "^2.0.0" } }, "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg=="],
 
     "@dotenvx/dotenvx/open": ["open@8.4.2", "", { "dependencies": { "define-lazy-prop": "^2.0.0", "is-docker": "^2.1.1", "is-wsl": "^2.2.0" } }, "sha512-7x81NCL719oNbsq/3mh+hVrAWmFuEYUqrq/Iw3kUzH8ReypT9QQ0BLoJS7/G9k6N81XjW4qHWtjWwe/9eLy1EQ=="],
 
-    "@dotenvx/dotenvx/picomatch": ["picomatch@4.0.4", "", {}, "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A=="],
-
-    "@dotenvx/dotenvx/undici": ["undici@7.29.0", "", {}, "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw=="],
-
-    "@dotenvx/dotenvx/yocto-spinner": ["yocto-spinner@1.2.2", "", { "dependencies": { "yoctocolors": "^2.1.1" } }, "sha512-DODGl1wJjA/s5pnJFKau9lIYHT81lnhob1i3e1TjxZRxEhWRKl74nTbWE6H5KlkViQQTo/Z29YFdxzTZAMY3ng=="],
-
-    "@img/sharp-freebsd-wasm32/@img/sharp-wasm32": ["@img/sharp-wasm32@0.35.3", "", { "dependencies": { "@emnapi/runtime": "^1.11.1" } }, "sha512-cZ0XkcYGpHZkqW6iCkqTcmUC0CD9DhD5d/qeZlZkfRBn6GnHniZXLUo5+9xw8Iv76YE6LQFN9YNBlKREcCG76w=="],
+    "@dotenvx/dotenvx/undici": ["undici@7.29.1", "", {}, "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q=="],
 
     "@img/sharp-wasm32/@emnapi/runtime": ["@emnapi/runtime@1.11.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA=="],
 
-    "@img/sharp-webcontainers-wasm32/@img/sharp-wasm32": ["@img/sharp-wasm32@0.35.3", "", { "dependencies": { "@emnapi/runtime": "^1.11.1" } }, "sha512-cZ0XkcYGpHZkqW6iCkqTcmUC0CD9DhD5d/qeZlZkfRBn6GnHniZXLUo5+9xw8Iv76YE6LQFN9YNBlKREcCG76w=="],
-
-    "@mermaid-js/parser/@chevrotain/types": ["@chevrotain/types@11.1.2", "", {}, "sha512-U+HFai5+zmJCkK86QsaJtoITlboZHBqrVketcO2ROv865xfCMSFpELQoz1GkX5GzME8pTa+3kbKrZHQtI0gdbw=="],
-
-    "@nestjs/config/dotenv": ["dotenv@17.4.1", "", {}, "sha512-k8DaKGP6r1G30Lx8V4+pCsLzKr8vLmV2paqEj1Y55GdAgJuIqpRp5FfajGF8KtwMxCz9qJc6wUIJnm053d/WCw=="],
-
-    "@paralleldrive/cuid2/@noble/hashes": ["@noble/hashes@1.8.0", "", {}, "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A=="],
+    "@nestjs/config/es-toolkit": ["es-toolkit@1.51.0", "", {}, "sha512-zC2lQGkM7QX+Gm6iM3+WIdZJzthsEd14LvRNJneSO2hzyz/zNBENR8+YXWo1cKxgPBtV6ksPYHELbcwBRzmdCw=="],
 
     "@pierre/diffs/diff": ["diff@9.0.0", "", {}, "sha512-svtcdpS8CgJyqAjEQIXdb3OjhFVVYjzGAPO8WGCmRbrml64SPw/jJD4GoE98aR7r25A0XcgrK3F02yw9R/vhQw=="],
 
     "@pierre/trees/@pierre/theming": ["@pierre/theming@1.0.0", "", { "peerDependencies": { "@pierre/theme": "^1.1.0", "@shikijs/themes": "^3.0.0 || ^4.0.0", "react": "^18.3.1 || ^19.0.0", "react-dom": "^18.3.1 || ^19.0.0", "shiki": "^3.0.0 || ^4.0.0" }, "optionalPeers": ["@pierre/theme", "@shikijs/themes", "react", "react-dom", "shiki"] }, "sha512-WsdrnhKfjeyXGDikZmN9pkpeZ5S/cl6EE72feiSc0tlynT1tMYqXqouhuv/foK+PY9OEnebOAVRQn3+rAstR8g=="],
 
-    "@prisma/engines/@prisma/get-platform": ["@prisma/get-platform@7.9.1", "", { "dependencies": { "@prisma/debug": "7.9.1" } }, "sha512-PK8R60YZRQvYxBrGG9i7l2/rFyzy+2MuI1dKtmtrCqPH8YpiJx/MfiC7LRzX5786rZDEv7BngcjfIJW4/9ADuw=="],
+    "@prisma/config/c12": ["c12@3.3.4", "", { "dependencies": { "chokidar": "^5.0.0", "confbox": "^0.2.4", "defu": "^6.1.6", "dotenv": "^17.3.1", "exsolve": "^1.0.8", "giget": "^3.2.0", "jiti": "^2.6.1", "ohash": "^2.0.11", "pathe": "^2.0.3", "perfect-debounce": "^2.1.0", "pkg-types": "^2.3.0", "rc9": "^3.0.1" }, "peerDependencies": { "magicast": "*" }, "optionalPeers": ["magicast"] }, "sha512-cM0ApFQSBXuourJejzwv/AuPRvAxordTyParRVcHjjtXirtkzM0uK2L9TTn9s0cXZbG7E55jCivRQzoxYmRAlA=="],
+
+    "@prisma/engines/@prisma/get-platform": ["@prisma/get-platform@7.10.0", "", { "dependencies": { "@prisma/debug": "7.10.0" } }, "sha512-0bra1LFYi8xNw0yqV62bHJNQk4BKleOngZiqPWIQc7a3+9q6rqsnqJ15BuepP8943PFMvtmgnP52juZsyYkA6w=="],
 
-    "@prisma/fetch-engine/@prisma/get-platform": ["@prisma/get-platform@7.9.1", "", { "dependencies": { "@prisma/debug": "7.9.1" } }, "sha512-PK8R60YZRQvYxBrGG9i7l2/rFyzy+2MuI1dKtmtrCqPH8YpiJx/MfiC7LRzX5786rZDEv7BngcjfIJW4/9ADuw=="],
+    "@prisma/fetch-engine/@prisma/get-platform": ["@prisma/get-platform@7.10.0", "", { "dependencies": { "@prisma/debug": "7.10.0" } }, "sha512-0bra1LFYi8xNw0yqV62bHJNQk4BKleOngZiqPWIQc7a3+9q6rqsnqJ15BuepP8943PFMvtmgnP52juZsyYkA6w=="],
 
     "@prisma/get-platform/@prisma/debug": ["@prisma/debug@7.2.0", "", {}, "sha512-YSGTiSlBAVJPzX4ONZmMotL+ozJwQjRmZweQNIq/ER0tQJKJynNkRB3kyvt37eOfsbMCXk3gnLF6J9OJ4QWftw=="],
 
@@ -2746,155 +2811,15 @@
 
     "@prisma/studio-core/@radix-ui/react-toggle": ["@radix-ui/react-toggle@1.1.10", "", { "dependencies": { "@radix-ui/primitive": "1.1.3", "@radix-ui/react-primitive": "2.1.3", "@radix-ui/react-use-controllable-state": "1.2.2" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-lS1odchhFTeZv3xwHH31YPObmJn8gOg7Lq12inrr0+BH/l3Tsq32VfjqH1oh80ARM3mlkfMic15n0kg4sD1poQ=="],
 
-    "@radix-ui/react-accordion/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-accordion/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-alert-dialog/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-alert-dialog/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-arrow/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-aspect-ratio/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-avatar/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-checkbox/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-checkbox/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-collapsible/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-collapsible/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-collection/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-collection/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-context-menu/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-dialog/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-dialog/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-dismissable-layer/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-dismissable-layer/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-dropdown-menu/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-dropdown-menu/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-focus-scope/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-focus-scope/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-form/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-form/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-hover-card/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-hover-card/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-label/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-menu/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-menu/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-menubar/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-menubar/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-navigation-menu/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-navigation-menu/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-one-time-password-field/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-one-time-password-field/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-password-toggle-field/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-password-toggle-field/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-popover/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-popover/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-popper/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-popper/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-portal/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
-
-    "@radix-ui/react-progress/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-radio-group/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-radio-group/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-roving-focus/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-roving-focus/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-scroll-area/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-scroll-area/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-select/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-select/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-separator/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-slider/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-slider/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
+    "@reduxjs/toolkit/reselect": ["reselect@5.3.0", "", {}, "sha512-XGoLeRAVzUTcJ1qkxPQhDJyIZ5d6zzZD9nT7AEZOaaU9UbWclhycElmhO+VD5bFeLuzhPBaOV2oXC8uG35ZSpg=="],
 
-    "@radix-ui/react-slot/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.11.2", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.2", "tslib": "^2.4.0" }, "bundled": true }, "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA=="],
 
-    "@radix-ui/react-switch/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-switch/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-tabs/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-toast/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-toast/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-toggle/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-toggle-group/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-toolbar/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-tooltip/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "@radix-ui/react-tooltip/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@radix-ui/react-visually-hidden/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
-    "@reduxjs/toolkit/immer": ["immer@11.1.15", "", {}, "sha512-VrNANlmnWQnh5COXIIOQXM9oOJw7naGKlBT74ZOOR6lpVXc3gFEu9FJLDFcpCJ2j+NWr8TIwtWD//T6ZX6TKiQ=="],
-
-    "@reduxjs/toolkit/reselect": ["reselect@5.2.0", "", {}, "sha512-AgZ3UOZm3YndfrJ4OYjgrT7bmCm/1iqkjvEfH/oYjzh6PD2qw4QuT3jjnXIrpdt4MTpMXclMT3lXbmRY+XRakw=="],
-
-    "@rolldown/binding-wasm32-wasi/@emnapi/core": ["@emnapi/core@2.0.0-alpha.3", "", { "dependencies": { "@emnapi/wasi-threads": "2.0.1", "tslib": "^2.4.0" } }, "sha512-AZypUeJ/yByuxyS7BlSNRDOMLMlROYtjYdIAuBmJssVz1UJDSeYxLrdizhXCFYhedC5bqd/ASy8EuNXbVVXp9g=="],
-
-    "@rolldown/binding-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@2.0.0-alpha.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-hFPAhMUjJD9BSyCANEISPOogeXC9Zo9ZQl7L6vKnaVsMkCtzznaW/naYypeyl0Gv5rYfWYsZbpixTMpjDJzQeA=="],
-
-    "@tailwindcss/oxide-wasm32-wasi/@emnapi/core": ["@emnapi/core@1.11.3", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.3", "tslib": "^2.4.0" }, "bundled": true }, "sha512-zLpS5asjEb7lq8jYLq37N6XKaE41DIexlY1rF/z4/tIl3wo13Sqm28fRyfIsKZD+NZ8mM5RoKkpW/rBcuoSZSg=="],
-
-    "@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.11.3", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA=="],
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.11.2", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA=="],
 
     "@tailwindcss/oxide-wasm32-wasi/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.3", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-ELEBe8PsLvvJ6QMr0zLt8ffvOHW/dc1m3CEzNMg7aJUv3bMaoDtw2TXyDAwkYBuroxxuHEwhRTLJSe5sya547g=="],
 
-    "@tailwindcss/oxide-wasm32-wasi/@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.2.2", "", { "dependencies": { "@tybys/wasm-util": "^0.10.3" }, "peerDependencies": { "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.3", "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.3" }, "bundled": true }, "sha512-JfB4kuJQjaoHuCTseIINHtHWeJnvgEcxjwA5t/Y00ZgaOO1Crz3fjT/p8kT28zA/Caz7oiUMn3d6H2yOVCVwuw=="],
+    "@tailwindcss/oxide-wasm32-wasi/@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.2.3", "", { "dependencies": { "@tybys/wasm-util": "^0.10.3" }, "peerDependencies": { "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.4", "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.4" }, "bundled": true }, "sha512-UMduMbqO5s5zF2NkNacMT/yK5Y5QiKvWr2+50bzIIxFDwVJ2h49b+oyjaCGPhJxd2/gC2x39EHv/gHVuu36x2Q=="],
 
     "@tailwindcss/oxide-wasm32-wasi/@tybys/wasm-util": ["@tybys/wasm-util@0.10.3", "", { "dependencies": { "tslib": "^2.4.0" }, "bundled": true }, "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg=="],
 
@@ -2906,89 +2831,65 @@
 
     "@vercel/oidc/jose": ["jose@5.10.0", "", {}, "sha512-s+3Al/p9g32Iq+oqXxkW//7jk2Vig6FF1CFqzVXoTUXt2qz89YWbL+OwS17NFYEvxC35n0FKeGO2LGYSxeM2Gg=="],
 
-    "@visx/vendor/d3-array": ["d3-array@3.2.1", "", { "dependencies": { "internmap": "1 - 2" } }, "sha512-gUY/qeHq/yNqqoCKNq4vtpFLdoCdvyNpWoC/KNjhGbhDuQpAM9sIQQKkXSNpXa9h5KySs/gzm7R88WkUutgwWQ=="],
-
-    "agent/typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
+    "@visx/vendor/@types/d3-array": ["@types/d3-array@3.0.3", "", {}, "sha512-Reoy+pKnvsksN0lQUlcH6dOGjRZ/3WRwXR//m+/8lt1BXeI4xyaUZoqULNjyXXRuh0Mj4LNpkCvhUpQlY3X5xQ=="],
 
-    "api/typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
+    "@visx/vendor/@types/d3-color": ["@types/d3-color@3.1.0", "", {}, "sha512-HKuicPHJuvPgCD+np6Se9MQvS6OCbJmOjGvylzMJRlDwUXjKTTXs6Pwgk79O09Vj/ho3u1ofXnhFOaEWWPrlwA=="],
 
-    "app/@types/node": ["@types/node@20.19.43", "", { "dependencies": { "undici-types": "~6.21.0" } }, "sha512-6oYBAi5ikg4Pl+kGsoYtawUMBT2zZMCvPNF7pVLnHZfd1zf38DRiWn/gT01RYCdUqkv7Fhr+C9ot4/tb+2sVvA=="],
+    "@visx/vendor/@types/d3-interpolate": ["@types/d3-interpolate@3.0.1", "", { "dependencies": { "@types/d3-color": "*" } }, "sha512-jx5leotSeac3jr0RePOH1KdR9rISG91QIE4Q2PYTu4OymLTZfA3SrnURSLzKH48HmXVUru50b8nje4E79oQSQw=="],
 
-    "app/next": ["next@16.3.0", "", { "dependencies": { "@next/env": "16.3.0", "@swc/helpers": "0.5.15", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", "postcss": "8.5.23", "styled-jsx": "5.1.6" }, "optionalDependencies": { "@next/swc-darwin-arm64": "16.3.0", "@next/swc-darwin-x64": "16.3.0", "@next/swc-linux-arm64-gnu": "16.3.0", "@next/swc-linux-arm64-musl": "16.3.0", "@next/swc-linux-x64-gnu": "16.3.0", "@next/swc-linux-x64-musl": "16.3.0", "@next/swc-win32-arm64-msvc": "16.3.0", "@next/swc-win32-x64-msvc": "16.3.0", "sharp": "^0.35.3" }, "peerDependencies": { "@opentelemetry/api": "^1.1.0", "@playwright/test": "^1.51.1", "babel-plugin-react-compiler": "*", "react": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "react-dom": "^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0", "sass": "^1.3.0" }, "optionalPeers": ["@opentelemetry/api", "@playwright/test", "babel-plugin-react-compiler", "sass"], "bin": { "next": "dist/bin/next" } }, "sha512-NEdGOzH+08eTXMUp9UYkA99Nhi5N6Thrhc1jgFOQgfgnGK/dA2hRwBpXep+exdFQrnwlRf/3Wixyp8lLBUpE2A=="],
+    "@visx/vendor/@types/d3-scale": ["@types/d3-scale@4.0.2", "", { "dependencies": { "@types/d3-time": "*" } }, "sha512-Yk4htunhPAwN0XGlIwArRomOjdoBFXC3+kCxK2Ubg7I9shQlVSJy/pG/Ht5ASN+gdMIalpk8TJ5xV74jFsetLA=="],
 
-    "app/react": ["react@19.2.4", "", {}, "sha512-9nfp2hYpCwOjAN+8TZFGhtWEwgvWHXqESH8qT89AT/lWklpLON22Lc8pEtnpsZz7VmawabSU0gCjnj8aC0euHQ=="],
+    "@visx/vendor/@types/d3-shape": ["@types/d3-shape@3.1.7", "", { "dependencies": { "@types/d3-path": "*" } }, "sha512-VLvUQ33C+3J+8p+Daf+nYSOsjB4GXp19/S/aGo60m9h1v6XaxjiT82lKVWJCfzhtuZ3yD7i/TPeC/fuKLLOSmg=="],
 
-    "app/typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="],
+    "@visx/vendor/@types/d3-time": ["@types/d3-time@3.0.0", "", {}, "sha512-sZLCdHvBUcNby1cB6Fd3ZBrABbjz3v1Vm90nysCQ6Vt7vd6e/h9Lt7SiJUoEX0l4Dzc7P5llKyhqSi1ycSf1Hg=="],
 
-    "better-auth/@better-auth/core": ["@better-auth/core@1.6.25", "", { "dependencies": { "@opentelemetry/semantic-conventions": "^1.39.0", "@standard-schema/spec": "^1.1.0", "zod": "^4.3.6" }, "peerDependencies": { "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1", "@cloudflare/workers-types": ">=4", "@opentelemetry/api": "^1.9.0", "better-call": "1.3.7", "jose": "^6.1.0", "kysely": "^0.28.5 || ^0.29.0", "nanostores": "^1.0.1" }, "optionalPeers": ["@cloudflare/workers-types", "@opentelemetry/api"] }, "sha512-lMTlhtwyK4NpY9kPF+2rQCRKYpg136d3gM2xl8esxT1PjJx5Nh5YwZvxcYCIjDuO759sx6TCloJTuwcZGG6ZBw=="],
-
-    "better-auth/@better-auth/telemetry": ["@better-auth/telemetry@1.6.25", "", { "peerDependencies": { "@better-auth/core": "^1.6.25", "@better-auth/utils": "0.4.2", "@better-fetch/fetch": "1.3.1" } }, "sha512-2ZfC9lp7tU6Jw/q2Lz/bKfQqGMdMwc/IQDTYdBhvtGi24qInYVnhp2ZCW57hHM9j+fq1ULOtxgg6M3T1LEaihw=="],
-
-    "better-auth/@better-auth/utils": ["@better-auth/utils@0.4.2", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A=="],
-
-    "better-call/@better-auth/utils": ["@better-auth/utils@0.4.2", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A=="],
+    "@visx/vendor/d3-array": ["d3-array@3.2.1", "", { "dependencies": { "internmap": "1 - 2" } }, "sha512-gUY/qeHq/yNqqoCKNq4vtpFLdoCdvyNpWoC/KNjhGbhDuQpAM9sIQQKkXSNpXa9h5KySs/gzm7R88WkUutgwWQ=="],
 
-    "body-parser/content-type": ["content-type@2.0.0", "", {}, "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ=="],
+    "@visx/vendor/d3-format": ["d3-format@3.1.0", "", {}, "sha512-YyUI6AEuY/Wpt8KWLgZHsIU86atmikuoOmCfommt0LYHiQSPjvX2AcFc38PX0CBpr2RCyZhjex+NS/LPOv6YqA=="],
 
-    "chevrotain/lodash": ["lodash@4.17.21", "", {}, "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg=="],
+    "better-call/@better-auth/utils": ["@better-auth/utils@0.5.0", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-BL8W4EfIZFwlu0r54m3v1ztjDhu6dDe/amLTm0xybmbZaNgYUqhD3SjpAsnq0q8YD6/ki4iwIgxJNLP/N3TxiA=="],
 
-    "cliui/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
+    "better-call/@better-fetch/fetch": ["@better-fetch/fetch@1.3.2", "", {}, "sha512-Gs7n99b5tqUC6cQAPbV0uED3IraHB6xQbHLQ/C3l7ZFafHScOx9pQ+DYmP5blbLFShVWLqxNUlI9wi4xU/X+ow=="],
 
-    "cliui/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+    "body-parser/content-type": ["content-type@2.1.0", "", {}, "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag=="],
 
     "co-body/raw-body": ["raw-body@2.5.3", "", { "dependencies": { "bytes": "~3.1.2", "http-errors": "~2.0.1", "iconv-lite": "~0.4.24", "unpipe": "~1.0.0" } }, "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA=="],
 
     "co-body/type-is": ["type-is@1.6.18", "", { "dependencies": { "media-typer": "0.3.0", "mime-types": "~2.1.24" } }, "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g=="],
 
-    "concurrently/chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
-
     "conf/ajv-formats": ["ajv-formats@2.1.1", "", { "dependencies": { "ajv": "^8.0.0" } }, "sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA=="],
 
     "conf/json-schema-typed": ["json-schema-typed@7.0.3", "", {}, "sha512-7DE8mpG+/fVw+dTpjbxnx47TaMnDfOI1jwft9g1VybltZCduyRQPJPvc+zzKY9WPHxhPWczyFuYa6I8Mw4iU5A=="],
 
-    "cosmiconfig/js-yaml": ["js-yaml@4.3.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q=="],
+    "cosmiconfig/js-yaml": ["js-yaml@4.3.2", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA=="],
 
     "cross-spawn/which": ["which@2.0.2", "", { "dependencies": { "isexe": "^2.0.0" }, "bin": { "node-which": "./bin/node-which" } }, "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA=="],
 
-    "cytoscape-fcose/cose-base": ["cose-base@2.2.0", "", { "dependencies": { "layout-base": "^2.0.0" } }, "sha512-AzlgcsCbUMymkADOJtQm3wO9S3ltPfYOFD5033keQn9NJzIbtnZj+UdBJe7DYml/8TdbtHJW3j58SOnKhWY/5g=="],
-
-    "d3-dsv/commander": ["commander@7.2.0", "", {}, "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw=="],
-
-    "d3-dsv/iconv-lite": ["iconv-lite@0.6.3", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw=="],
-
-    "d3-sankey/d3-array": ["d3-array@2.12.1", "", { "dependencies": { "internmap": "^1.0.0" } }, "sha512-B0ErZK/66mHtEsR1TkPEEkwdy+WDesimkM5gpZr5Dsg54BiTA5RXtYW5qTLIAcekaS9xfZrzBLF/OAkB3Qn1YQ=="],
-
-    "d3-sankey/d3-shape": ["d3-shape@1.3.7", "", { "dependencies": { "d3-path": "1" } }, "sha512-EUkvKjqPFUAZyOlhY5gzCxCeI0Aep04LwIRpsZ/mLFelJiUfnK56jo5JMDSE7yyP2kLSb6LtF+S5chMk7uqPqw=="],
-
     "dot-prop/is-obj": ["is-obj@2.0.0", "", {}, "sha512-drqDG3cbczxxEJRoOXcOjtdp1J/lyp1mNn0xaznRs8+muBhgQcrnbspox5X5fOw0HnMnbfDzvnEMEtqDEJEo8w=="],
 
-    "dotenv-expand/dotenv": ["dotenv@16.6.1", "", {}, "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow=="],
-
     "enquirer/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
 
     "eve/undici": ["undici@8.9.0", "", {}, "sha512-aWZpUj7XoGonMClx4gdDRfgBjqeA+F473aDmROQQbM9n6PRfK/u1q/a0X4wMTgcHfT8H6fpbt98PFuDUwFg2YA=="],
 
     "form-data/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
 
-    "h3/crossws": ["crossws@0.3.5", "", { "dependencies": { "uncrypto": "^0.1.3" } }, "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA=="],
+    "formidable/@paralleldrive/cuid2": ["@paralleldrive/cuid2@2.3.1", "", { "dependencies": { "@noble/hashes": "^1.1.5" } }, "sha512-XO7cAxhnTZl0Yggq6jOgjiOHhbgcO4NqFqwSmQpjK3b6TEE6Uj/jfSk6wzYyemh3+I0sHirKSetjQwn5cZktFw=="],
 
-    "just-bash/undici": ["undici@7.29.0", "", {}, "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw=="],
+    "h3/crossws": ["crossws@0.3.5", "", { "dependencies": { "uncrypto": "^0.1.3" } }, "sha512-ojKiDvcmByhwa8YYqbQI/hg7MEU0NC03+pSdEq4ZUnZR9xXpwk7E43SMNGkn+JxJGPFtNvQ48+vV2p+P1ml5PA=="],
 
-    "katex/commander": ["commander@8.3.0", "", {}, "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww=="],
+    "just-bash/undici": ["undici@7.29.1", "", {}, "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q=="],
 
     "log-symbols/is-unicode-supported": ["is-unicode-supported@1.3.0", "", {}, "sha512-43r2mRvz+8JRIKnWJ+3j8JtjRKZ6GmjzfaE/qiBJnikNnYv/6bagRJ1kUhNk8R5EX/GkobD+r+sfxCPJsiKBLQ=="],
 
-    "mermaid/marked": ["marked@16.4.2", "", { "bin": { "marked": "bin/marked.js" } }, "sha512-TI3V8YYWvkVf3KJe1dRkpnjs68JUPyEa5vjKrp1XEEJUAOaQc+Qj+L1qWbPd0SJuAdQkFU0h73sXXqwDYxsiDA=="],
-
     "micromatch/picomatch": ["picomatch@2.3.2", "", {}, "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA=="],
 
     "multer/type-is": ["type-is@1.6.18", "", { "dependencies": { "media-typer": "0.3.0", "mime-types": "~2.1.24" } }, "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g=="],
 
-    "nestjs-trpc/rxjs": ["rxjs@7.8.1", "", { "dependencies": { "tslib": "^2.1.0" } }, "sha512-AA3TVj+0A2iuIoQkWEK/tqFjBq2j+6PO6Y0zJcvzLAFhEFIO3HL0vls9hWLncZbAAbK0mar7oZ4V079I/qPMxg=="],
+    "negotiator/content-type": ["content-type@2.1.0", "", {}, "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag=="],
 
-    "next/postcss": ["postcss@8.4.31", "", { "dependencies": { "nanoid": "^3.3.6", "picocolors": "^1.0.0", "source-map-js": "^1.0.2" } }, "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ=="],
+    "next/postcss": ["postcss@8.5.23", "", { "dependencies": { "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg=="],
 
-    "nitro/h3": ["h3@2.0.1-rc.22", "", { "dependencies": { "rou3": "^0.8.1", "srvx": "^0.11.15" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"], "bin": { "h3": "bin/h3.mjs" } }, "sha512-Esv0DMIuPkCTSWCA0vO73vcTqwzH1wjSrAO1TXNu/K3up1sZHa9EKMapbmxCDYBeymC3fVTk4qxp7ogQWQ+KgA=="],
+    "nitro/h3": ["h3@2.0.1-rc.31", "", { "dependencies": { "rou3": "^0.9.2", "srvx": "^1.0.2" }, "peerDependencies": { "crossws": "^0.4.12", "ocache": ">=0.3.0" }, "optionalPeers": ["crossws", "ocache"], "bin": { "h3": "./bin/h3.mjs" } }, "sha512-AG7qZzF99a0BSYoXT3evJgIhwSIUKow7R+hwkLRZS06WJ9nbSb7QXUDgs1ByBjp6svTvl++N/GKA7I9YPz9cQQ=="],
 
     "npm-run-path/path-key": ["path-key@4.0.0", "", {}, "sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ=="],
 
@@ -3002,54 +2903,36 @@
 
     "prompts/kleur": ["kleur@3.0.3", "", {}, "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w=="],
 
-    "prop-types/react-is": ["react-is@16.13.1", "", {}, "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ=="],
-
     "proper-lockfile/retry": ["retry@0.12.0", "", {}, "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow=="],
 
     "proper-lockfile/signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
 
-    "radix-ui/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.5", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA=="],
-
-    "radix-ui/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.10", "", { "dependencies": { "@radix-ui/react-slot": "1.3.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg=="],
-
     "rc/ini": ["ini@1.3.8", "", {}, "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew=="],
 
     "rc/strip-json-comments": ["strip-json-comments@2.0.1", "", {}, "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ=="],
 
     "restore-cursor/onetime": ["onetime@7.0.0", "", { "dependencies": { "mimic-function": "^5.0.0" } }, "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ=="],
 
-    "rolldown/@oxc-project/types": ["@oxc-project/types@0.142.0", "", {}, "sha512-7W+2q5AKQVU36fkaryontrHn3YDt1RyUYXatw9i5H8ocYe2sPKSFB6eS8WNPeRKiN1qAWWZUPm7gwFzJGrccqQ=="],
+    "rolldown/@oxc-project/types": ["@oxc-project/types@0.149.0", "", {}, "sha512-Efcc+iF0j3Bf67YjEqIqWXbX5XddXoK/Mw4K1/JuXwRCZ8N16VR7iT23nlCc9XrveFVh/E5Rqs2StT0V8v9LdA=="],
+
+    "samlify/@xmldom/xmldom": ["@xmldom/xmldom@0.8.15", "", {}, "sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA=="],
 
     "seek-bzip/commander": ["commander@6.2.1", "", {}, "sha512-U7VdrJFnJgo4xjrHpTzu0yrHPGImdsmD95ZlgYSEajAn2JKzDhDTPG9kBTefmObL2w/ngeZnilk+OV9CG3d7UA=="],
 
     "shadcn/commander": ["commander@14.0.3", "", {}, "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw=="],
 
-    "shadcn/open": ["open@11.0.0", "", { "dependencies": { "default-browser": "^5.4.0", "define-lazy-prop": "^3.0.0", "is-in-ssh": "^1.0.0", "is-inside-container": "^1.0.0", "powershell-utils": "^0.1.0", "wsl-utils": "^0.3.0" } }, "sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw=="],
-
-    "shadcn/undici": ["undici@7.29.0", "", {}, "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw=="],
+    "shadcn/undici": ["undici@7.29.1", "", {}, "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q=="],
 
     "shadcn/zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="],
 
-    "type-is/content-type": ["content-type@2.0.0", "", {}, "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ=="],
+    "type-is/content-type": ["content-type@2.1.0", "", {}, "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag=="],
 
-    "wrap-ansi/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
+    "wsl-utils/powershell-utils": ["powershell-utils@0.1.0", "", {}, "sha512-dM0jVuXJPsDN6DvRpea484tCUaMiXWjuCn++HGTqUWzGDjv5tZkEZldAJ/UMlqRYGFrD/etByo4/xOuC/snX2A=="],
 
-    "wrap-ansi/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+    "xml-crypto/@xmldom/xmldom": ["@xmldom/xmldom@0.8.15", "", {}, "sha512-/5NV/vDALVFDXgLmfsy9TRCBlKwO2LNBFzpzvb9iIj+jR+eSc6DLYYvVOdivT/jm7MtU6TebYuRmzEOI7w40UA=="],
 
     "xml-crypto/xpath": ["xpath@0.0.33", "", {}, "sha512-NNXnzrkDrAzalLhIUc01jO2mOzXGXh1JwPgkihcLLzw98c0WgYDmmjSh1Kl3wzaxSVWMuA+fe0WTWOBDWCBmNA=="],
 
-    "yargs/string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
-
-    "@better-auth/cli/better-auth/@better-fetch/fetch": ["@better-fetch/fetch@1.1.21", "", {}, "sha512-/ImESw0sskqlVR94jB+5+Pxjf+xBwDZF/N5+y2/q4EqD7IARUTSpPfIo8uf39SYpCxyOCtbyYpUrZ3F/k0zT4A=="],
-
-    "@better-auth/cli/better-auth/better-call": ["better-call@1.1.8", "", { "dependencies": { "@better-auth/utils": "^0.3.0", "@better-fetch/fetch": "^1.1.4", "rou3": "^0.7.10", "set-cookie-parser": "^2.7.1" }, "peerDependencies": { "zod": "^4.0.0" }, "optionalPeers": ["zod"] }, "sha512-XMQ2rs6FNXasGNfMjzbyroSwKwYbZ/T3IxruSS6U2MJRsSYh3wYtG3o6H00ZlKZ/C/UPOAD97tqgQJNsxyeTXw=="],
-
-    "@better-auth/cli/better-auth/kysely": ["kysely@0.28.17", "", {}, "sha512-nbD8lB9EB3wNdMhOCdx5Li8DxnLbvKByylRLcJ1h+4SkrowVeECAyZlyiKMThF7xFdRz0jSQ2MoJr+wXux2y0Q=="],
-
-    "@better-auth/core/better-call/@better-fetch/fetch": ["@better-fetch/fetch@1.3.1", "", {}, "sha512-ABkD1WhyfPZprKRQI3bhATjeiFuNWC9PXhfGWqL+sg/gKrM977oFrYkdb4msM3hgUGonr7KlOsOFT5TU2rht9g=="],
-
-    "@better-auth/core/better-call/set-cookie-parser": ["set-cookie-parser@2.7.2", "", {}, "sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw=="],
-
     "@dotenvx/dotenvx/execa/get-stream": ["get-stream@6.0.1", "", {}, "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg=="],
 
     "@dotenvx/dotenvx/execa/human-signals": ["human-signals@2.1.0", "", {}, "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw=="],
@@ -3068,15 +2951,17 @@
 
     "@dotenvx/dotenvx/open/is-wsl": ["is-wsl@2.2.0", "", { "dependencies": { "is-docker": "^2.0.0" } }, "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww=="],
 
-    "@img/sharp-freebsd-wasm32/@img/sharp-wasm32/@emnapi/runtime": ["@emnapi/runtime@1.11.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA=="],
-
-    "@img/sharp-webcontainers-wasm32/@img/sharp-wasm32/@emnapi/runtime": ["@emnapi/runtime@1.11.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-Xz4Tpyki7XyrpbUK1jR1AhdAdaXyhhY4lZ3neLodmhpuWfy2PAQN5B46sAiU4liOXGLkHypn/qU+jvfWSCYYLA=="],
+    "@prisma/config/c12/confbox": ["confbox@0.2.4", "", {}, "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ=="],
 
     "@prisma/studio-core/@radix-ui/react-toggle/@radix-ui/primitive": ["@radix-ui/primitive@1.1.3", "", {}, "sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg=="],
 
+    "@prisma/studio-core/@radix-ui/react-toggle/@radix-ui/react-primitive": ["@radix-ui/react-primitive@2.1.3", "", { "dependencies": { "@radix-ui/react-slot": "1.2.3" }, "peerDependencies": { "@types/react": "*", "@types/react-dom": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc", "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react", "@types/react-dom"] }, "sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ=="],
+
     "@prisma/studio-core/@radix-ui/react-toggle/@radix-ui/react-use-controllable-state": ["@radix-ui/react-use-controllable-state@1.2.2", "", { "dependencies": { "@radix-ui/react-use-effect-event": "0.0.2", "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-BjasUjixPFdS+NKkypcyyN5Pmg83Olst0+c6vGov0diwTEo6mgdqVR6hxcEgFuh4QrAs7Rc+9KuGJ9TVCj0Zzg=="],
 
-    "@rolldown/binding-wasm32-wasi/@emnapi/core/@emnapi/wasi-threads": ["@emnapi/wasi-threads@2.0.1", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-9DsSk+o5NBX0CCJT8s0EROGSGxjR/tKu6aBTaVyq+SjAEQH4XcdcRxPBRzsBLizTTJ49MJjF+jgu3qnO9GLQcQ=="],
+    "@tailwindcss/oxide-wasm32-wasi/@emnapi/core/@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA=="],
+
+    "@tailwindcss/oxide-wasm32-wasi/@napi-rs/wasm-runtime/@tybys/wasm-util": ["@tybys/wasm-util@0.10.4", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-W3c4gRigFS0T/Ma4qIYF3GDAc5AQdHb1yL5znJT1Zv1YaD9Kitx656wBjvr19qbiosmZT8lWDM5BEMynUqX65A=="],
 
     "@vercel/cli-exec/execa/get-stream": ["get-stream@6.0.1", "", {}, "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg=="],
 
@@ -3090,33 +2975,9 @@
 
     "@vercel/cli-exec/execa/strip-final-newline": ["strip-final-newline@2.0.0", "", {}, "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA=="],
 
-    "app/@types/node/undici-types": ["undici-types@6.21.0", "", {}, "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ=="],
-
-    "app/next/@next/env": ["@next/env@16.3.0", "", {}, "sha512-o9r1S0BNiNreHP9Vs+Qnqd9kviDkJh8xIACY7UFZSmiGbbQRzPBBosvHzAU4TULHOIuOj/18RSsyz2qrREmIFw=="],
+    "@visx/vendor/@types/d3-interpolate/@types/d3-color": ["@types/d3-color@3.1.3", "", {}, "sha512-iO90scth9WAbmgv7ogoq57O9YpKmFBbmoEoCHDB2xMBY0+/KVrqAaCDyCE16dUspeOvIxFFRI+0sEtqDqy2b4A=="],
 
-    "app/next/@next/swc-darwin-arm64": ["@next/swc-darwin-arm64@16.3.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-55hpqq18bEVAlxedlTt3tFqZmKg2nUXT1kn1G/BGEy0R13h3LwtwHPVzzjG6P4LLeOHE32PFDQUVaJEWvBEZBw=="],
-
-    "app/next/@next/swc-darwin-x64": ["@next/swc-darwin-x64@16.3.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-SOi96kSaF5T+0wW4koiM1bWzSPwjzTesC1p3df+FjdOi5LIQkBK/blxh7HdoKnNuI4PURF1OO7TZqtfnbWDSgw=="],
-
-    "app/next/@next/swc-linux-arm64-gnu": ["@next/swc-linux-arm64-gnu@16.3.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-P0gZAoPMF4dyTRzhmkV4PrqVzSOB6t4mC1oI3c4dqijJ+OVEVx5clIXAKR4/uQpsqw2KKM/0D5tVumcR2r5blg=="],
-
-    "app/next/@next/swc-linux-arm64-musl": ["@next/swc-linux-arm64-musl@16.3.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-tXXGKJw0m37O0eKJARVTX/TheKPhz0QFVtVVZXmOig+9YKLQOSP6hvf2pxv5DO7CLEJyTHx3Pg043CDQkv1G4Q=="],
-
-    "app/next/@next/swc-linux-x64-gnu": ["@next/swc-linux-x64-gnu@16.3.0", "", { "os": "linux", "cpu": "x64" }, "sha512-pjGxK5EY7yWml78ALejFkWmgHsU7wbFQrISiugpH6FbUJhgEvw3xFZ/EBAtLl7QtL0WdQKiG9eWJ3mOKGTukHw=="],
-
-    "app/next/@next/swc-linux-x64-musl": ["@next/swc-linux-x64-musl@16.3.0", "", { "os": "linux", "cpu": "x64" }, "sha512-sjo++Xx+lomlPs3HRsHWhVDyGG6ms1kGW5EtHLERdII8AyG1i+f6aq68xHREO6AEMlhjTNEWBSmfJfqm9orf7g=="],
-
-    "app/next/@next/swc-win32-arm64-msvc": ["@next/swc-win32-arm64-msvc@16.3.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-C5JSgiO54wURdaxdEUIXqkz04uMqC9UmPX1gtDrV/5Tf1UowdWYI8uA5hfFbPolTlp0q4KZ60xlHePNibf0VIw=="],
-
-    "app/next/@next/swc-win32-x64-msvc": ["@next/swc-win32-x64-msvc@16.3.0", "", { "os": "win32", "cpu": "x64" }, "sha512-fDOggsweNb5SSw0ZKVk6U+gxSyGFFlIBY/LBc1r8GUj4u/6t6oArL+Pmkg0MBnsgR+KkdsURilVH4F3GXUGepA=="],
-
-    "app/next/postcss": ["postcss@8.5.23", "", { "dependencies": { "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg=="],
-
-    "app/next/sharp": ["sharp@0.35.3", "", { "dependencies": { "@img/colour": "^1.1.0", "detect-libc": "^2.1.2", "semver": "^7.8.5" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.35.3", "@img/sharp-darwin-x64": "0.35.3", "@img/sharp-freebsd-wasm32": "0.35.3", "@img/sharp-libvips-darwin-arm64": "1.3.2", "@img/sharp-libvips-darwin-x64": "1.3.2", "@img/sharp-libvips-linux-arm": "1.3.2", "@img/sharp-libvips-linux-arm64": "1.3.2", "@img/sharp-libvips-linux-ppc64": "1.3.2", "@img/sharp-libvips-linux-riscv64": "1.3.2", "@img/sharp-libvips-linux-s390x": "1.3.2", "@img/sharp-libvips-linux-x64": "1.3.2", "@img/sharp-libvips-linuxmusl-arm64": "1.3.2", "@img/sharp-libvips-linuxmusl-x64": "1.3.2", "@img/sharp-linux-arm": "0.35.3", "@img/sharp-linux-arm64": "0.35.3", "@img/sharp-linux-ppc64": "0.35.3", "@img/sharp-linux-riscv64": "0.35.3", "@img/sharp-linux-s390x": "0.35.3", "@img/sharp-linux-x64": "0.35.3", "@img/sharp-linuxmusl-arm64": "0.35.3", "@img/sharp-linuxmusl-x64": "0.35.3", "@img/sharp-webcontainers-wasm32": "0.35.3", "@img/sharp-win32-arm64": "0.35.3", "@img/sharp-win32-ia32": "0.35.3", "@img/sharp-win32-x64": "0.35.3" } }, "sha512-ej0zVHuZGHCiABXcNxeYhpRnPNPAcvbG8RMdBAhDAxLKkCRVSpK3Iyu7qbqw3JMzoj0REeM6f3tJLtVwl0023Q=="],
-
-    "cliui/string-width/emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
-
-    "cliui/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+    "@visx/vendor/@types/d3-scale/@types/d3-time": ["@types/d3-time@3.0.4", "", {}, "sha512-yuzZug1nkAAaBlBBikKZTgzCeA+k1uy4ZFwWANOfKw5z5LRhV0gNA7gNkKm7HoK+HRN0wX3EkxGk0fpbWhmB7g=="],
 
     "co-body/raw-body/iconv-lite": ["iconv-lite@0.4.24", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3" } }, "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA=="],
 
@@ -3124,94 +2985,28 @@
 
     "co-body/type-is/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
 
-    "concurrently/chalk/supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
-
     "cross-spawn/which/isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="],
 
-    "cytoscape-fcose/cose-base/layout-base": ["layout-base@2.0.1", "", {}, "sha512-dp3s92+uNI1hWIpPGH3jK2kxE2lMjdXdr+DH8ynZHpd6PUlH6x6cbuXnoMmiNumznqaNO31xu9e79F0uuZ0JFg=="],
-
-    "d3-sankey/d3-array/internmap": ["internmap@1.0.1", "", {}, "sha512-lDB5YccMydFBtasVtxnZ3MRBHuaoE8GKsppq+EchKL2U4nK/DmEpPHNH8MZe5HkMtpSiTSOZwfN0tzYjO/lJEw=="],
-
-    "d3-sankey/d3-shape/d3-path": ["d3-path@1.0.9", "", {}, "sha512-VLaYcn81dtHVTjEHd8B+pbe9yHWpXKZUC87PzoFmsFrJqgFwDe/qxfp5MlfsfM1V5E/iVt0MmEbWQ7FVIXh/bg=="],
-
     "enquirer/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
 
     "form-data/mime-types/mime-db": ["mime-db@1.52.0", "", {}, "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg=="],
 
+    "formidable/@paralleldrive/cuid2/@noble/hashes": ["@noble/hashes@1.8.0", "", {}, "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A=="],
+
     "multer/type-is/media-typer": ["media-typer@0.3.0", "", {}, "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ=="],
 
     "multer/type-is/mime-types": ["mime-types@2.1.35", "", { "dependencies": { "mime-db": "1.52.0" } }, "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw=="],
 
-    "nitro/h3/rou3": ["rou3@0.8.1", "", {}, "sha512-ePa+XGk00/3HuCqrEnK3LxJW7I0SdNg6EFzKUJG73hMAdDcOUC/i/aSz7LSDwLrGr33kal/rqOGydzwl6U7zBA=="],
-
-    "shadcn/open/wsl-utils": ["wsl-utils@0.3.1", "", { "dependencies": { "is-wsl": "^3.1.0", "powershell-utils": "^0.1.0" } }, "sha512-g/eziiSUNBSsdDJtCLB8bdYEUMj4jR7AGeUo96p/3dTafgjHhpF4RiCFPiRILwjQoDXx5MqkBr4fwWtR3Ky4Wg=="],
-
-    "wrap-ansi/string-width/emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
-
-    "wrap-ansi/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
-
-    "yargs/string-width/emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
-
-    "yargs/string-width/strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
-
-    "@better-auth/cli/better-auth/better-call/@better-fetch/fetch": ["@better-fetch/fetch@1.3.1", "", {}, "sha512-ABkD1WhyfPZprKRQI3bhATjeiFuNWC9PXhfGWqL+sg/gKrM977oFrYkdb4msM3hgUGonr7KlOsOFT5TU2rht9g=="],
-
-    "@better-auth/cli/better-auth/better-call/set-cookie-parser": ["set-cookie-parser@2.7.2", "", {}, "sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw=="],
+    "@prisma/studio-core/@radix-ui/react-toggle/@radix-ui/react-primitive/@radix-ui/react-slot": ["@radix-ui/react-slot@1.2.3", "", { "dependencies": { "@radix-ui/react-compose-refs": "1.1.2" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A=="],
 
     "@prisma/studio-core/@radix-ui/react-toggle/@radix-ui/react-use-controllable-state/@radix-ui/react-use-effect-event": ["@radix-ui/react-use-effect-event@0.0.2", "", { "dependencies": { "@radix-ui/react-use-layout-effect": "1.1.1" }, "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-Qp8WbZOBe+blgpuUT+lw2xheLP8q0oatc9UpmiemEICxGvFLYmHm9QowVZGHtJlGbS6A6yJ3iViad/2cVjnOiA=="],
 
     "@prisma/studio-core/@radix-ui/react-toggle/@radix-ui/react-use-controllable-state/@radix-ui/react-use-layout-effect": ["@radix-ui/react-use-layout-effect@1.1.1", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-RbJRS4UWQFkzHTTwVymMTUv8EqYhOp8dOOviLj2ugtTiXRaRQS7GLGxZTLL1jWhMeoSCf5zmcZkqTl9IiYfXcQ=="],
 
-    "app/next/sharp/@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.3.2" }, "os": "darwin", "cpu": "arm64" }, "sha512-RMnFX7YQsMoh7lWfcM4NEHHymBX/rLuKNPVM84XE9ONPcaSCDgE7CHIHpSgPcO2xcRthgBy1HfNO319mwhIAkg=="],
-
-    "app/next/sharp/@img/sharp-darwin-x64": ["@img/sharp-darwin-x64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-x64": "1.3.2" }, "os": "darwin", "cpu": "x64" }, "sha512-Xo+5uFBtLN0BKqieTxiFzFPQAUlBbbH5iBKyRX/z1JrbnYsHTfKJnUfL8+p2TPXr1pXqao4eeL4Rl144uDpK9w=="],
-
-    "app/next/sharp/@img/sharp-libvips-darwin-arm64": ["@img/sharp-libvips-darwin-arm64@1.3.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-9J6ypZFpQBj4YnePGoq/S38w6nz+vqg5WZLrLGY4YuSemdMq47GMLBPO42MzwdGwpg/agZ7xzZcFHa48xlywfg=="],
-
-    "app/next/sharp/@img/sharp-libvips-darwin-x64": ["@img/sharp-libvips-darwin-x64@1.3.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-m2pW1n6cns9VaubNwsZ+c3CRYjxNQWgJ5gPlnL1nbBcpkBvFm6SCFN5o0psFHI8w9n11NKhFkeEDns98tiqbEw=="],
-
-    "app/next/sharp/@img/sharp-libvips-linux-arm": ["@img/sharp-libvips-linux-arm@1.3.2", "", { "os": "linux", "cpu": "arm" }, "sha512-1eMLzy92I4J6rmi4mAT8yC3HxOtniyGELlzGbNMLLeqe052ahFQ0h6LFq+lh5DsDIdYViIDst08abvSbcEdLXQ=="],
-
-    "app/next/sharp/@img/sharp-libvips-linux-arm64": ["@img/sharp-libvips-linux-arm64@1.3.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-dqVSFynCox4C/J8kT16V7SIFAns0IjgLwkvYT7p8LQVmJ5OS5b6tI9IGflxTeuBS//zXeFIUbwt5dwxyZ17cnA=="],
-
-    "app/next/sharp/@img/sharp-libvips-linux-ppc64": ["@img/sharp-libvips-linux-ppc64@1.3.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-3z0NHDxD6n5I9gc05U1eW1AyRm+Gznzq3naMrthPNqE6oYykcogW0l/jfpJdjYnuNl8R7yI9pNbE1XiUeyq0Aw=="],
-
-    "app/next/sharp/@img/sharp-libvips-linux-riscv64": ["@img/sharp-libvips-linux-riscv64@1.3.2", "", { "os": "linux", "cpu": "none" }, "sha512-bsb4rI+NldGOsXuej2r8OdSS8+zXDVaCWxyWrcv6kneTOlgAHtZABRzBBCwdsPiD90J4myNJuHpg6kA20ImW/w=="],
-
-    "app/next/sharp/@img/sharp-libvips-linux-s390x": ["@img/sharp-libvips-linux-s390x@1.3.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-/ABshyj8gCpyIrNXnHn4LorDJ0HHm1VhXPBlxZ8zAtfVPAaSafXPGn+sUSIRiwaSBy0mmFjSjiXI5mkcwdChKQ=="],
-
-    "app/next/sharp/@img/sharp-libvips-linux-x64": ["@img/sharp-libvips-linux-x64@1.3.2", "", { "os": "linux", "cpu": "x64" }, "sha512-ITPEtgffGJ0S6G9dRyw/366tJQqFRcHWPHhC+Stpg3Z8AEMrDrTr2lhdz4f/Y/HMbRh//7Z5mBzEpVdi62Oc3w=="],
-
-    "app/next/sharp/@img/sharp-libvips-linuxmusl-arm64": ["@img/sharp-libvips-linuxmusl-arm64@1.3.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-zE9EdiUzUmg5mDT5a1rk5fYJ6GWPloTwWBYDS14naqHsL+EaMpDj1AWnpLgh3u0YCORv2Tt50wrcrpYqkP97Kw=="],
-
-    "app/next/sharp/@img/sharp-libvips-linuxmusl-x64": ["@img/sharp-libvips-linuxmusl-x64@1.3.2", "", { "os": "linux", "cpu": "x64" }, "sha512-m0lrLiUt+lBYnCFr8qV/65yMR4E/c7/wf78I5eKTdkEakFAlZ9QlzEM3QIhhAwVeUhLAHLcCq7a7Vszq/oFNZQ=="],
-
-    "app/next/sharp/@img/sharp-linux-arm": ["@img/sharp-linux-arm@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm": "1.3.2" }, "os": "linux", "cpu": "arm" }, "sha512-affVWCTLooy8TSxbDx2qkzuDeaWLNVBA+P//FNBirHsXpP2fuBhk5AuboYUnrDnzoXes8GFjpTx0SBFOCRg+FA=="],
-
-    "app/next/sharp/@img/sharp-linux-arm64": ["@img/sharp-linux-arm64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-arm64": "1.3.2" }, "os": "linux", "cpu": "arm64" }, "sha512-QgKDspHPnrU+GQ55XPhGwyhC8acLVOOSyAvo1oVfFmrIXLkDNmGWzAfDZ4xK8oSA1qBQrALcHX0G5UZni/SuFQ=="],
-
-    "app/next/sharp/@img/sharp-linux-ppc64": ["@img/sharp-linux-ppc64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-ppc64": "1.3.2" }, "os": "linux", "cpu": "ppc64" }, "sha512-sMd8rDxmpLOwv/7N44klFjOD5DUO7FLdjiXDI0hoxYaf7Ar262dQIEkosE98bps+5HPLtp/EvNqeqQtOycP/IA=="],
-
-    "app/next/sharp/@img/sharp-linux-riscv64": ["@img/sharp-linux-riscv64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-riscv64": "1.3.2" }, "os": "linux", "cpu": "none" }, "sha512-0Eob78yjlYPfL5vMNWAW55l3R9Y6BQS/gOfe0ZcP9mEz9ohhKSt4im1hayiknXgf8AWrFqMvJcKIdmLmEe7yeQ=="],
-
-    "app/next/sharp/@img/sharp-linux-s390x": ["@img/sharp-linux-s390x@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-s390x": "1.3.2" }, "os": "linux", "cpu": "s390x" }, "sha512-KgAxQ0DxpNOq1rG2t5cgTgShJFGSuU7XO45cqC+1NVOuZnP6tlgZRuSYOfNupGkHID0o3cJOsw4DVeJpMovcGw=="],
-
-    "app/next/sharp/@img/sharp-linux-x64": ["@img/sharp-linux-x64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linux-x64": "1.3.2" }, "os": "linux", "cpu": "x64" }, "sha512-8pqvxubL2PGdhlPy6GLqzDYMUjyRmKAwKHYKixpdJYBUK7PJ0C029XdsnpFIdgRZG68fZiGdHVWcKPvtiPB4cA=="],
-
-    "app/next/sharp/@img/sharp-linuxmusl-arm64": ["@img/sharp-linuxmusl-arm64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-arm64": "1.3.2" }, "os": "linux", "cpu": "arm64" }, "sha512-Vz0iQjzzcSX3HCbfwFfCSG/9SCIqyO0mH2sXyiHaAYfBk0cRsCWXRyQYX0ovCK/PAQBbTzQ0dsPQHh5MAFL59w=="],
-
-    "app/next/sharp/@img/sharp-linuxmusl-x64": ["@img/sharp-linuxmusl-x64@0.35.3", "", { "optionalDependencies": { "@img/sharp-libvips-linuxmusl-x64": "1.3.2" }, "os": "linux", "cpu": "x64" }, "sha512-6O1NPKcDVj9QEdg7Hx549EX8U0rp6yXQERqru6yRN7fGBn32UvIRJUlWnk+8xDCiG76hXVBbX82NZ/ZKr0euIg=="],
-
-    "app/next/sharp/@img/sharp-win32-arm64": ["@img/sharp-win32-arm64@0.35.3", "", { "os": "win32", "cpu": "arm64" }, "sha512-4bPwFdMbeC4JQ8L8LOyWp6nsHcboP5fxkp6iPOXz2Vg49R42TuMs2whkJ5OAP4/Ul035qOzy0AecOF9VOscn4w=="],
-
-    "app/next/sharp/@img/sharp-win32-ia32": ["@img/sharp-win32-ia32@0.35.3", "", { "os": "win32", "cpu": "ia32" }, "sha512-r53mXsBN6lFUDiST764SvgwUdHAqM4rPAiDzAmf4fLoB6X/rkfyTrLCg6+g17wJJiCmB3JYgHuUldCWUIRFSXw=="],
-
-    "app/next/sharp/@img/sharp-win32-x64": ["@img/sharp-win32-x64@0.35.3", "", { "os": "win32", "cpu": "x64" }, "sha512-D4y1vNeZrIIJCN+uHaWVtH86B+aCrdMYYjicy9pXHvbGZeGYLLSd3wdVuC37FxVXlU1ARsk84eKWfWMXGYEqvA=="],
-
     "co-body/type-is/mime-types/mime-db": ["mime-db@1.52.0", "", {}, "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg=="],
 
     "multer/type-is/mime-types/mime-db": ["mime-db@1.52.0", "", {}, "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg=="],
 
-    "yargs/string-width/strip-ansi/ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+    "@prisma/studio-core/@radix-ui/react-toggle/@radix-ui/react-primitive/@radix-ui/react-slot/@radix-ui/react-compose-refs": ["@radix-ui/react-compose-refs@1.1.2", "", { "peerDependencies": { "@types/react": "*", "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc" }, "optionalPeers": ["@types/react"] }, "sha512-z4eqJvfiNnFMHIIvXP3CY57y2WJs5g2v3X0zm9mEJkrkNv4rDxu+sg9Jh8EkXyeqBkB7SOcboo9dMVqhyrACIg=="],
   }
 }
diff --git a/docker-compose.yml b/docker-compose.yml
index 96fa7bf36..892070367 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -12,6 +12,7 @@ services:
       - "5432:5432"
     volumes:
       - crm-postgres:/var/lib/postgresql/data
+      - ./packages/db/docker/init-runtime-role.sql:/docker-entrypoint-initdb.d/10-runtime-role.sql:ro
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U postgres -d crm"]
       interval: 3s
diff --git a/docs/agent.md b/docs/agent.md
index e1fc98353..189e49c5b 100644
--- a/docs/agent.md
+++ b/docs/agent.md
@@ -105,12 +105,12 @@ task row; exists because the API may not call Context.
 
 `sweepBlankFacts` (`lib/blank-facts.ts`) applies every pending suggestion whose field is
 still empty and clears the ones that have stopped saying anything. It runs at the top of
-`schedules/dispatch.ts`, every minute, over **every contact in the workspace** — it is a
-database pass with no session, no model, no task row and no credits, so there is nothing
-to ration and nobody to scope it to.
+`schedules/dispatch.ts`, every minute, over **every organization**. The global pass reads
+the organization list, then runs each organization's reads and writes inside its tenant
+scope. It has no session, model, task row, or credits.
 
-- **Scans 2000 suggestions and fills at most 500 a pass**, and reports what it did not
-  reach (`unscanned`) rather than a clean sweep it did not make.
+- **Scans 2000 suggestions and fills at most 500 per organization**, and reports what it
+  did not reach (`unscanned`) rather than a clean sweep it did not make.
 - **Idempotent** — a second pass fills nothing, because those fields are no longer blank.
 - **The suggestions left are conflicts**, every one against a value already on the
   record. That number should stay small and reads as work for a rep.
@@ -219,6 +219,26 @@ missing key removes a place to look. **Never an error, never throws.**
 `capabilitiesFrom()`/`markdownFor()` are the pure halves. `contextDevKey()` is the only
 resolver, and `lib/context-dev.ts` memoises its client on the key string.
 
+## XMPP export tools
+
+`src/exports` contains the explicit external operation allowlist. An export uses
+`defineExportTool` and cannot expose a normal Eve tool accidentally.
+
+`src/export-tools` owns validation, manifests, execution, and the Eve adapter. The
+adapter calls the current channel's `send` function and uses native task mode.
+
+`agent/channels/xmpp.ts` is the required Eve channel location. It provides authenticated
+manifest and invocation routes for the XMPP gateway host.
+
+`src/xmpp` owns ProtoXEP routing and PostgreSQL task persistence. Every task belongs to
+one organization. The replay key includes the organization, caller, target, and request.
+
+The copied protocol, validation, and gateway runtime sources derive from Clawdike commit
+`d2386b42741410533cb302ffee1540d33192b34c`.
+
+The gateway starts only when `XMPP_COMPONENT_ENABLED=1`. Missing XMPP configuration
+removes the capability and leaves the normal agent process available.
+
 ## Budget and scheduling
 
 - `lib/focus.ts` — per-session budget in `defineState`; running out is a normal ending.
@@ -274,7 +294,7 @@ preamble; `lib/workspace.ts` is the only renderer.
 - **The profile dies with its website** — `readWorkspaceIdentity` returns it only while
   `website` matches.
 - **Not a `Company` row** — that needs excluding from every list, facet and join. One
-  `WorkspaceProfile` keyed on `WORKSPACE_ID`.
+  `WorkspaceProfile` is keyed on the current organization.
 
 The pass is a `workspace-profile` task using `web_fetch` (no credits), filed only via
 `write_workspace_profile`, queued by `WorkspaceService.update` on a website change. **A
diff --git a/docs/api.md b/docs/api.md
index 93f4df63f..a9c258a45 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -31,22 +31,24 @@ so the row survives the agent being down.
 About to add a vendor client to `apps/api`? You want `apps/agent/agent/lib`. One
 documented exception, for timing: the exchange-rate fetcher, below.
 
-## One organization, and it is not a tenancy boundary
-
-Single tenant. No org header, no org interceptor, no org-scoped cache keys, **no
-`organizationId` on any CRM record.**
-
-A **singleton workspace** exists — Better Auth's `organization` plugin, one row with
-id `WORKSPACE_ID` (the literal `workspace`, in `@crm/db`, re-exported by `@crm/auth`
-so the agent needn't depend on it). It answers only: what are we called, who works
-here, what do we sell.
-
-- **The id is a constant, never a parameter.** A function taking an `organizationId`
-  has turned the plugin into tenancy plumbing.
-- **Signing in is the join; no invite flow.** `ensureWorkspaceMembership` runs in
-  `databaseHooks.session.create.before` and **degrades, never throws** — a throw fails
-  the session create and locks everyone out. The plugin's `invitation` table is unused.
-- **First account is owner**, and the hook enrols pre-existing users, oldest first.
+## Organizations are the tenancy boundary
+
+Every CRM and agent record carries `organizationId`. The scoped Prisma client
+filters every protected query and throws without active tenant context.
+
+Better Auth's `Organization`, `Member`, and `Invitation` tables define tenant
+membership. Administrators provision organizations through
+`packages/db/scripts/provision-organization.ts`. Users cannot create organizations
+through Better Auth.
+
+- **Sessions resolve an active organization from membership.** A session stores the
+  earliest membership at creation, or `null` when no membership exists.
+- **API keys belong to one organization.** OAuth consent stores the selected
+  organization and access tokens carry its claim.
+- **A request never accepts an organization header.** The authenticated credential
+  selects the tenant, and `AuthMiddleware` validates current membership.
+- **CRM service methods do not take `organizationId`.** They use `scopedDb`, which
+  reads tenant context and applies the organization filter.
 - **Permissions come from `@crm/auth`** — `canRenameWorkspace`, `canChangeRole`,
   `canConfigureSso`, `canManageCurrency` — enforced by the service *and* used to
   disable the UI control, so the button and the 403 cannot disagree.
@@ -67,33 +69,28 @@ here, what do we sell.
 
 ### Gates in `proxy.ts`
 
-Onboarding, then `/onboarding/research` for the Context key. Asked server-side every
-request.
+Workspace onboarding is required. Context configuration is optional in Settings → General.
 
-- **`getSessionCookie()` decides signed-in**; pages still resolve the real session via
-  `requireMailboxAccess()`.
-- **Nothing is cached in a cookie** — both facts revert on a database reset while a
-  year-long marker insists the gate passed. Cache in the API if cost ever matters.
-- **Both reads run concurrently**, but order decides which is *asked* — the research
-  read is never made while onboarding is open.
-- **An unreachable API fails open** (`unknown` lets the request through).
-- **`/sign-in`, `/grant-access`, `/eve` are ungated.** `/sign-in` is the only path a
-  stranger may read; `/` joins it only when `IS_MARKETING` is set.
-- **There is no way past the key gate but to answer** — Skip stranded installs, every
-  later company sitting `PENDING` with nothing saying so.
+- `getSessionCookie()` checks for a session cookie. Pages validate the session through `requireMailboxAccess()`.
+- The proxy reads workspace state on every request. It does not read research credentials.
+- An unreachable API returns `unknown` and lets the request through.
+- `/sign-in`, `/grant-access`, `/eve`, and `/oauth` remain ungated.
+- After workspace onboarding, users enter the CRM without a Context key.
+- The old `/onboarding/research` URL redirects into the CRM.
 
-### The name is also the URL
+### The name is also the URL, and the slug is a tenancy gate
 
-Served under the workspace slug (`/comp-ai/companies`). **Cosmetic, not tenancy** —
-every query still resolves through `WORKSPACE_ID`.
+The application serves each organization under its slug, such as
+`/comp-ai/companies`. The slug layout resolves the organization and verifies
+membership before rendering tenant data.
 
 - **The slug is the plugin's column**, written by `workspaceSlug(name)`
   (`@crm/db/workspace`) on rename and create. **Never derive it on read.**
-- `ensureWorkspaceMembership` reconciles it; `RESERVED_SLUGS` prevents collision with
-  a real route (a collision gets `-crm`).
-- **The proxy is the only thing that puts the slug on.** Missing or stale slugs are
-  redirected with the query string intact, not 404'd; `[slug]/layout.tsx` is the
-  backstop.
+- `RESERVED_SLUGS` prevents collision with a real route.
+- **`[slug]/layout.tsx` is the membership backstop.** Missing organizations return
+  not found. Missing memberships return forbidden.
+- **Organization switching performs a full navigation.** The new page starts with a
+  fresh client query cache.
 - `appPath` in `proxy.ts` is the one place `/` resolves for a signed-in rep, which
   keeps every `callbackURL` correct without knowing about slugs.
 - **Renaming moves the URL**, so `workspace-form.tsx` replaces the location onto the
@@ -106,7 +103,11 @@ self-hoster's admin cannot redeploy.
 
 - **OpenID Connect only** — issuer, client id, secret; endpoints from discovery. No
   SAML UI: it needs an X.509 cert and SP signing key we have nowhere to keep.
-- `SsoService` passes `WORKSPACE_ID`, never an input.
+- `SsoService` registers providers for the active organization from tenant context.
+- The public sign-in options read `ssoProviderLocator` because no organization is
+  selected before authentication. The locator stores provider, organization, and
+  domain identifiers only. A database trigger keeps it synchronized with the
+  protected provider row. Authenticated management queries remain tenant-scoped.
 - **Management is tRPC (`sso.*`); signing in is `authClient.signIn.sso()`.**
 - **`sso.signInOptions` is the one public procedure in the app.** Every other `sso.*`
   takes `AuthMiddleware` at the *method*, which is what leaves it open. A client
@@ -123,14 +124,34 @@ self-hoster's admin cannot redeploy.
   so `/grant-access` offers the button they can actually use.
 - `ALLOWED_SIGN_IN` still decides who gets an account, in
   `databaseHooks.user.create.before`, for SSO sign-ups too.
-- `organizationProvisioning: { disabled: true }` — `ensureWorkspaceMembership` already
-  does the join.
+- `organizationProvisioning: { disabled: true }` prevents SSO from creating tenants.
+  Administrators create the organization and owner membership first.
 
-## tRPC is the data surface; REST is auth and health only
+## tRPC is the data surface; REST exposes the same procedures
+
+### Three credentials, one principal
+
+`RequestPrincipalService` resolves a session cookie, `x-api-key`, or CompCRM OAuth token.
+
+It rejects requests that contain more than one credential type.
+
+OAuth tokens require the CompCRM issuer, API audience, active client, and current user.
+
+OAuth tRPC queries require `crm.read`.
+
+OAuth tRPC mutations require `crm.write`.
+
+Nest controllers use `RequestPrincipalGuard` and the same principal.
+
+API-key management remains session-only.
+
+Better Auth publishes OAuth and OpenID Connect endpoints under `/api/auth`.
+
+The root well-known routes expose authorization-server and protected-resource metadata.
 
 - **One router per module**, `*.router.ts` (the codegen glob), with
-  `@Router({ alias })` and `@UseMiddlewares(AuthMiddleware)`. **No `AuthMiddleware`
-  means public — there is no other guard.**
+	`@Router({ alias })` and `@UseMiddlewares(AuthMiddleware)`. A router without
+	`AuthMiddleware` remains public on the tRPC transport.
 - **Routers are thin**: zod in, service call out; Prisma lives in `*.service.ts`.
 - Services throw Nest's `HttpException` family; `DomainErrorMiddleware` maps them.
 - **Filter, sort and paginate in Prisma.** List procedures take `listInput` and return
@@ -143,11 +164,31 @@ self-hoster's admin cannot redeploy.
 
 ## The OpenAPI document is built at runtime, not committed
 
-`GET /openapi.json` serves one document: Nest's own controllers plus a REST bridge
-under `/rest` generated from every tRPC procedure. Swagger UI renders it at `/`.
+Project and appointment files use the [asset API contract](./asset-api-contract.md).
+`assets.*` supplies seven REST operations under `/projects`, `/appointments`, and `/assets`.
+`appointments.*` supplies five managed appointment operations under `/projects`.
+All 171 tRPC REST operations use root resource paths.
+See the [appointment contract](./appointment-api-contract.md) for lifecycle, tenant checks, and file retention.
+The routes use the existing principal and OAuth scopes.
+Asset and appointment routes return a structured error envelope and disable response caching.
+The other REST routes retain their existing response format.
+
+`AssetStorageJob` holds deterministic file finalization and deletion work.
+`GET /internal/assets/process` uses `CRON_SECRET` and processes bounded batches.
+Project purge enqueues cleanup before database cascades remove file records.
+Successful deletion retains a cleanup record for delayed writes and stale workers.
+See [asset storage operations](./assets-storage-operations.md) before enabling R2.
+
+`GET /openapi.json` serves one document: Nest controllers and the tRPC REST bridge.
+All tRPC REST metadata uses root resource paths.
+The merged OpenAPI document contains 156 paths, including native controller paths and 171 tRPC REST operations.
+The OpenAPI document lists canonical tRPC paths only. It exposes no tRPC REST compatibility aliases.
+Swagger UI renders it at `/`.
 `createApp` builds both halves and merges them, so nothing is generated at build
 time and no file is checked in — the document is whatever the routers are.
 
+Protected operations describe cookie, API-key, and OAuth bearer alternatives.
+
 `SwaggerModule.setup` runs **before** `app.init()`, because it registers its Express
 routes synchronously and Nest's own routing would otherwise shadow them. The factory
 form defers building the document to the first request, which is what lets it read
@@ -273,6 +314,7 @@ Below is `purge`'s contract — everything that used to be `delete`'s:
   transaction**. Never automatic.
 - **Purging a company does not suppress its domain** — its people survive with no
   company, and domain suppression stays the explicit Settings → Connections control.
+- **A company with a deal cannot be purged.** Delete its deals first.
 - **Clear `AgentTask` and `AgentEvent` yourself** — they carry `contactId`/`companyId`
   with no foreign key, so nothing cascades.
 - **Recompute `lastActivityAt` on exactly the records the purge reached.**
diff --git a/docs/appointment-api-contract.md b/docs/appointment-api-contract.md
new file mode 100644
index 000000000..fc3f31e68
--- /dev/null
+++ b/docs/appointment-api-contract.md
@@ -0,0 +1,191 @@
+---
+title: Project appointments
+status: implementation
+updated: 2026-09-11
+---
+
+# Project appointments
+
+Appointments and assets belong to the project independently.
+An asset's optional `appointmentId` records the managed appointment selected by its path.
+Files can arrive after appointment completion. Transfer state and appointment state are independent.
+
+## HTTP contract
+
+Base URL: `https://api.jobsteward.ai`.
+Use the existing session, API key, or OAuth authentication.
+OAuth reads require `crm.read`. Mutations require `crm.write`.
+All successful responses use HTTP 200 and JSON.
+AP1–AP5 POST, PATCH, and DELETE require an `Idempotency-Key` of 1 to 128 printable ASCII characters.
+Retries reuse the same key and request. Distinct changes use different keys.
+GET and DELETE accept no body. POST and PATCH require JSON objects.
+Path identifiers cannot appear in request bodies or query parameters.
+Unknown fields return `400 VALIDATION_ERROR`.
+Responses include `Cache-Control: private, no-store` and `X-Request-Id`.
+AP1–AP5 errors use the [asset error envelope](./asset-api-contract.md#errors).
+AP6 and AP7 errors keep `{ code, message }` at the top level.
+
+| ID | Method | Path | Response |
+| --- | --- | --- | --- |
+| AP1 | POST | `/projects/{projectId}/appointments` | `{"appointment": <Appointment>}` |
+| AP2 | GET | `/projects/{projectId}/appointments` | Paginated appointment list |
+| AP3 | GET | `/projects/{projectId}/appointments/{appointmentId}` | `{"appointment": <Appointment>}` |
+| AP4 | PATCH | `/projects/{projectId}/appointments/{appointmentId}` | Updated or restored appointment |
+| AP5 | DELETE | `/projects/{projectId}/appointments/{appointmentId}` | `{"appointmentId": "...", "archivedAt": "...", "version": 2}` |
+| AP6 | POST | `/appointments/{appointmentId}/recordings/upload-url` | Flat upload slot |
+| AP7 | POST | `/appointments/{appointmentId}/recordings/complete` | `{"ok": true}` |
+
+Public appointment paths have no bridge prefix, version segment, or version header.
+Runtime OpenAPI at `/openapi.json` describes these canonical paths and the other root REST paths.
+It exposes no asset or appointment compatibility HTTP aliases.
+
+AP1–AP5 require an `Idempotency-Key` on POST, PATCH, and DELETE.
+AP6 and AP7 do not require that header. JobSteward never sends it.
+When present, the API uses it. Otherwise the service derives a key for replay.
+
+## Appointment fields
+
+| Field | Rule |
+| --- | --- |
+| `id` | Server-generated `Activity.id`. |
+| `projectId` | Immutable path project, stored as `Activity.dealId`. |
+| `customerId` | Derived from the project's company. |
+| `title` | Trimmed text, 1 to 255 characters. Required on create. |
+| `notes` | Optional text, maximum 20,000 characters. Null clears it. |
+| `startsAt` | Required timestamp with an explicit UTC offset. Stored in UTC. |
+| `endsAt` | Optional timestamp after the start. Null clears it. |
+| `timeZone` | Required IANA time zone. |
+| `location` | Optional text, maximum 1,000 characters. Null clears it. |
+| `ownerId` | Organization member. Defaults to the project owner. |
+| `status` | SCHEDULED, COMPLETED, or CANCELED. Defaults to SCHEDULED. |
+| `statusChangedAt` | Server time of the last status change. |
+| `version` | Positive integer, initially 1. Each change increments it. |
+| `archivedAt` | Server archive time, or null. |
+| `createdById`, `createdAt`, `updatedAt` | Server-managed audit fields. |
+
+Responses include every field. Optional nullable fields appear as null.
+Create accepts SCHEDULED or COMPLETED, not CANCELED.
+COMPLETED always requires `startsAt` at or before server time.
+Creation, completion, and date corrections enforce that invariant.
+
+```json
+{
+  "title": "Kitchen site visit",
+  "startsAt": "2026-09-15T15:00:00Z",
+  "endsAt": "2026-09-15T16:00:00Z",
+  "timeZone": "America/Chicago",
+  "notes": "Review cabinet measurements."
+}
+```
+
+## Queries and updates
+
+AP2 accepts `page`, `pageSize`, `status`, `ownerId`, `from`, `to`, and `archived`.
+Page defaults to 1. Page size defaults to 25, with a maximum of 100.
+`archived=false` is the default. `archived=true` selects archived appointments only.
+Date filters select `startsAt`, inclusive `from` and exclusive `to`.
+A supplied `to` must follow `from`.
+Sort by `startsAt ASC, id ASC`. Pagination is live, not a snapshot.
+Return `{"items": [], "page": 1, "pageSize": 25, "total": 0, "hasNextPage": false}`.
+AP3 also returns archived appointment metadata while its project exists.
+
+AP4 requires numeric `expectedVersion` and at least one writable field.
+Omitted fields stay unchanged. Validate dates against the combined stored and supplied values.
+A stale version returns `409 VERSION_CONFLICT`.
+Read the current record before submitting a correction with a new key.
+
+| Current state | Allowed next state |
+| --- | --- |
+| SCHEDULED | COMPLETED or CANCELED |
+| COMPLETED | SCHEDULED |
+| CANCELED | SCHEDULED |
+| Any active state | Same state |
+
+Other transitions return `409 INVALID_APPOINTMENT_STATE`.
+Completion sets the activity occurrence time to `startsAt`.
+Reopening clears it. Correcting a completed start updates it.
+Scheduled and canceled appointments sort after dated timeline entries using existing null-last ordering.
+Neither a past end time nor file upload completes an appointment automatically.
+
+## Archive, restore, and file retention
+
+AP5 archives the current appointment under the project transaction lock.
+It has no `expectedVersion` input. Repeated archive returns the existing timestamp and version.
+Archive preserves the meeting row, project files, and optional file references.
+Restore through AP4 with only `expectedVersion` and `archived: false`.
+Reject `archived: true` and restore combined with ordinary edits using `400 VALIDATION_ERROR`.
+Other edits to archived appointments return `409 APPOINTMENT_ARCHIVED`.
+Restore preserves status and file references.
+
+New assets through `/appointments/{appointmentId}/assets` reject archived managed appointments.
+Previously accepted transfers can complete after appointment archive while the project remains active.
+Files remain available through the project asset routes, including the archived appointment asset list.
+Archived projects allow appointment reads and archive, but reject create, edit, and restore with `409 PROJECT_ARCHIVED`.
+Permanent project purge uses existing file cleanup before related database rows disappear.
+Appointment archive does not start a new retention job.
+
+Timeline results and counts use the same active/archive filter.
+Dashboard recent activity excludes archived appointments.
+Archive and restore do not recompute activity stamps or remove retained rows from usage totals.
+
+## Identity, tenancy, and replay
+
+An appointment is a project MEETING activity with one typed `AppointmentDetails` row.
+Details use the activity ID as their primary key and carry the organization ID.
+The tenant-scoped database protects details like other CRM records.
+Validate the project, activity, details, and owner within the authenticated organization.
+The activity has no calendar-event or direct contact link.
+Calendar sync, cancellation, and disconnect do not own these appointments.
+Generic calendar meetings do not appear in appointment lists.
+Generic project MEETING activities are not managed appointments and cannot be used as appointment asset parents.
+
+Reuse `AssetMutations` and its project transaction lock for appointments and asset creation.
+Asset parentage comes from the route. The asset PATCH operation cannot relink an asset.
+The existing `AssetApiRequest` ledger stores distinct appointment operations and logical project paths.
+Authentication and access checks run before replay. Successful replay runs before stale-version checks.
+The same key with a different request returns `409 IDEMPOTENCY_CONFLICT`.
+The replay window remains 24 hours.
+A missing or inaccessible appointment path returns 404 before asset creation or replay.
+Archive alone does not invalidate a saved successful response.
+
+## Client workflow and verification boundary
+
+The deal record sheet contains the Project workspace.
+It supports appointment filters and lifecycle controls, project files, per-file uploads, metadata edits, and file deletion.
+Upload progress distinguishes transfer from verification. PUT success is not READY.
+The client retains request keys and asset IDs during the workspace session for retry and reconciliation.
+Storage requests use only the returned transfer headers, without CRM credentials.
+Repeat the original asset POST with the same key to refresh an expired transfer while its intent remains valid.
+Send `PATCH /assets/{assetId}` with `{ "uploadCompleted": true }` to queue verification, then poll the asset detail until `READY`.
+Use the [asset contract](./asset-api-contract.md) for transfer and worker behavior.
+
+## Mobile meeting recordings
+
+JobSteward uses AP6 and AP7 for onsite meeting audio.
+AP6 accepts `{ "contentType", "byteSize", "filename" }` and returns a flat slot:
+
+```json
+{
+  "uploadUrl": "https://...",
+  "method": "PUT",
+  "headers": {
+    "Content-Type": "audio/mp4",
+    "Content-Length": "1843200"
+  },
+  "objectKey": "<asset.id>",
+  "expiresAt": "2026-09-03T16:00:00.000Z"
+}
+```
+
+`objectKey` is the artifact id. The client echoes it on AP7.
+AP7 accepts `{ "objectKey", "contentType", "byteSize", "durationSeconds" }` and returns `{ "ok": true }` as soon as verification is queued.
+The client does not poll A5 after End meeting.
+One current `meeting_recording` with source `MOBILE_RECORDING` exists per appointment.
+A pending unexpired upload refreshes the signed PUT and keeps the same `objectKey`.
+Otherwise AP6 creates a new artifact and retires the previous mobile recording.
+Missing, foreign, or expired complete requests return `409`.
+Recording routes stay off the nested asset error wrapper. Errors keep `{ code, message }` at the top level.
+
+Tests use disposable local PostgreSQL and storage fixtures.
+Local verification does not prove production R2 configuration, browser CORS, or deployment.
+No calendar invitations, transcription, summaries, or estimates are included.
diff --git a/docs/asset-api-contract.md b/docs/asset-api-contract.md
new file mode 100644
index 000000000..358fc4acb
--- /dev/null
+++ b/docs/asset-api-contract.md
@@ -0,0 +1,268 @@
+---
+title: Project and appointment asset API
+status: implemented-pending-r2-verification
+updated: 2026-09-11
+---
+
+# Project and appointment asset API
+
+This contract describes the seven implemented asset operations. Production R2 configuration and live R2 checks remain release requirements. See [storage operations](./assets-storage-operations.md) for those checks.
+
+An asset belongs to exactly one project. An asset can reference one managed appointment in that project. The path supplies the parent. The request body cannot change parentage.
+
+The public API has no upload ID workflow, customer-wide asset list, upload confirmation route, URL renewal route, cancellation route, or asset download route. `AssetUpload` and `AssetStorageJob` remain internal storage records.
+
+Mobile meeting audio from JobSteward uses the appointment recordings routes in [appointment-api-contract.md](./appointment-api-contract.md), not A1–A7.
+Those routes accept AAC-LC in an MPEG-4 container (`.m4a`) with `contentType` `audio/mp4`.
+A1–A7 remain the CRM workspace file API. Polling A5 is not part of End meeting.
+
+## Common contract
+
+Base URL: `https://api.jobsteward.ai`. All paths below are relative to this base. All asset requests and responses use JSON except the direct R2 `PUT` transfer.
+
+Use the existing session, API key, or OAuth authentication. OAuth reads require `crm.read`. OAuth mutations require `crm.write`. Missing or inaccessible records return `404 RESOURCE_NOT_FOUND`.
+
+All successful REST responses use `200 OK`. Asset responses include `Cache-Control: private, no-store` and `X-Request-Id`. The caller can supply a valid `X-Request-Id`; the API generates one when absent or invalid.
+
+Public paths have no bridge prefix, version segment, or version header. The runtime OpenAPI document describes these canonical paths. It exposes no asset compatibility aliases.
+
+Path identifiers are the only parent and resource identifiers. Do not send `projectId`, `appointmentId`, `assetId`, `customerId`, or upload IDs in a request body or query string. GET and DELETE accept no body. POST and PATCH require a JSON object. Mutations accept no query parameters. Unknown fields return `400 VALIDATION_ERROR`.
+
+POST, PATCH, and DELETE require an `Idempotency-Key` with 1 to 128 printable ASCII characters. GET does not require the header.
+
+## Endpoints
+
+| ID | Method | Path | Purpose |
+| --- | --- | --- | --- |
+| A1 | POST | `/projects/{projectId}/assets` | Create a project asset and receive a direct transfer. |
+| A2 | GET | `/projects/{projectId}/assets` | List assets for one project. |
+| A3 | POST | `/appointments/{appointmentId}/assets` | Create an asset for one managed appointment. |
+| A4 | GET | `/appointments/{appointmentId}/assets` | List assets for one managed appointment. |
+| A5 | GET | `/assets/{assetId}` | Read asset metadata and a temporary download when ready. |
+| A6 | PATCH | `/assets/{assetId}` | Start verification or update file metadata. |
+| A7 | DELETE | `/assets/{assetId}` | Start durable asset deletion. |
+
+## A1 and A3: Create an asset
+
+The project route takes its required project from `{projectId}`. The appointment route resolves the appointment's project and requires a managed `MEETING` activity with `AppointmentDetails`. The appointment and project must match.
+
+Both routes accept the same JSON metadata:
+
+```json
+{
+  "fileName": "kitchen-visit.mp3",
+  "contentType": "audio/mpeg",
+  "sizeBytes": 57600000,
+  "kind": "meeting_recording",
+  "source": "MOBILE_RECORDING",
+  "durationMilliseconds": 3600000,
+  "capturedAt": "2026-07-15T15:00:00Z"
+}
+```
+
+| Field | Rule |
+| --- | --- |
+| `fileName` | Required string, 1 to 255 characters. Path separators and control characters are rejected. |
+| `contentType` | Optional string, 1 to 255 characters. Defaults to `application/octet-stream`. Control characters are rejected. |
+| `sizeBytes` | Required nonnegative integer. The single PUT limit is `5363466240` bytes. |
+| `kind` | Optional string, 1 to 64 characters. Defaults to `file`. |
+| `source` | Required: `MANUAL`, `MOBILE_RECORDING`, or `EMAIL_ATTACHMENT`. |
+| `durationMilliseconds` | Optional nonnegative integer or null. |
+| `capturedAt` | Optional RFC 3339 timestamp with an offset or null. |
+| `emailSource` | Required only for `EMAIL_ATTACHMENT`. A strict object with nonempty `messageId` and `attachmentId`, each at most 255 characters. |
+
+The body has no `activityId`. Use the appointment path to associate an asset with a managed appointment. The body cannot set the customer, project, appointment, uploader, storage bucket, storage key, or URL.
+
+Any file format is accepted. No filename extension, media type, or recording duration allowlist applies. A size above the limit returns `413 UPLOAD_TOO_LARGE` before a new asset is created.
+
+The API derives `customerId` from the project's company. It creates the asset with status `UNVERIFIED`, creates internal upload state, and returns:
+
+```json
+{
+  "asset": {
+    "id": "artifact_123",
+    "customerId": "company_alice",
+    "projectId": "project_bathroom_2026",
+    "appointmentId": null,
+    "fileName": "kitchen-visit.mp3",
+    "contentType": "audio/mpeg",
+    "sizeBytes": 57600000,
+    "kind": "meeting_recording",
+    "source": "MOBILE_RECORDING",
+    "emailSource": null,
+    "uploadedById": "user_gc",
+    "durationMilliseconds": 3600000,
+    "capturedAt": "2026-07-15T15:00:00.000Z",
+    "createdAt": "2026-09-11T15:03:00.000Z",
+    "updatedAt": "2026-09-11T15:03:00.000Z",
+    "version": 1,
+    "status": "UNVERIFIED",
+    "deletedAt": null
+  },
+  "download": null,
+  "failure": null,
+  "transfer": {
+    "method": "PUT",
+    "url": "https://example.r2.cloudflarestorage.com/private/temporary-object?signature=example",
+    "headers": {
+      "Content-Type": "audio/mpeg",
+      "Content-Length": "57600000"
+    },
+    "expiresAt": "2026-09-11T15:18:00.000Z",
+    "maxBytes": 5363466240
+  }
+}
+```
+
+For a new asset, `download` and `failure` are null. `transfer` contains the R2 upload authorization. On replay or source deduplication, `transfer` is null when the asset has no pending, unexpired transfer.
+
+Send the original bytes to the returned URL. Send every returned transfer header. Do not send CRM credentials to R2. The API does not receive the file bytes.
+
+The transfer URL expires after 15 minutes or at the internal 24-hour upload-intent deadline, whichever comes first. The URL lifetime does not define how long R2 permits an already started transfer.
+
+## A2 and A4: List assets
+
+The project route lists all visible assets for the project. The appointment route lists only assets whose appointment parent is the path appointment. A project list includes assets linked to appointments.
+
+Supported query parameters are `page`, `pageSize`, `kind`, and `source`.
+
+| Parameter | Rule |
+| --- | --- |
+| `page` | Integer, minimum 1. Defaults to 1. |
+| `pageSize` | Integer, 1 to 100. Defaults to 25. |
+| `kind` | Optional exact kind filter. |
+| `source` | Optional exact source filter. |
+
+Return:
+
+```json
+{
+  "items": [],
+  "page": 1,
+  "pageSize": 25,
+  "total": 0,
+  "hasNextPage": false
+}
+```
+
+Sort by `createdAt DESC, id DESC`. Lists include `READY` and `UNVERIFIED` assets. They exclude `DELETING` and `DELETED` assets. Unknown query parameters return `400 VALIDATION_ERROR`.
+
+Reads can inspect retained assets for archived projects or appointments while their rows exist. New asset creation requires an active project. New assets for an appointment also require an active managed appointment.
+
+## A5: Read asset detail
+
+Return `{"asset": <Asset>, "download": <Download-or-null>, "failure": <Failure-or-null>}`.
+
+The asset response contains:
+
+| Field | Rule |
+| --- | --- |
+| `id` | Server-generated asset ID. |
+| `customerId` | Derived from the asset's project company. |
+| `projectId` | Immutable project parent. |
+| `appointmentId` | Managed appointment parent or null. Immutable through this API. |
+| `fileName` | Display name. |
+| `contentType` | Stored metadata. |
+| `sizeBytes` | Expected or verified byte count, or null for an unresolved existing row. |
+| `kind` | Descriptive metadata. |
+| `source` | Source enum, or null for an unresolved existing row. |
+| `emailSource` | Source message and attachment identity, or null. |
+| `uploadedById` | User ID, or null for system and unknown historical attribution. |
+| `durationMilliseconds` | Duration or null. |
+| `capturedAt` | Capture timestamp or null. |
+| `createdAt`, `updatedAt` | Server timestamps. |
+| `version` | Positive metadata version. New and existing rows start at 1. |
+| `status` | `UNVERIFIED`, `READY`, `DELETING`, or `DELETED`. |
+| `deletedAt` | Physical deletion timestamp, or null. |
+
+`download` is null unless the asset is `READY`, has a verified size and storage bucket, and storage is configured. When available, it is an object with a temporary signed GET `url` and `expiresAt`. The URL expires after 15 minutes. There is no separate download route.
+
+`failure` is null unless an `UNVERIFIED` asset has an expired or failed internal upload. Its code is `UPLOAD_EXPIRED`, `UPLOAD_VERIFICATION_FAILED`, or `UPLOAD_FINALIZATION_FAILED`. The API does not expose internal upload IDs, object keys, provider payloads, credentials, or stack traces.
+
+## A6: Update an asset
+
+The PATCH body is strict. It accepts `fileName`, `kind`, `expectedVersion`, and `uploadCompleted: true`.
+
+Metadata edits require a positive numeric `expectedVersion` and at least one of `fileName` or `kind`. They update only the supplied metadata fields, increment `version` once, and update `updatedAt`. They do not change project or appointment parentage, source metadata, bytes, storage keys, status, or upload history.
+
+`uploadCompleted: true` can be sent alone. It marks the internal upload for verification and enqueues durable worker work. The response is immediate. The asset remains `UNVERIFIED` until the worker verifies the object. Completion and verification do not change the metadata `version`. The client polls A5 for `READY` or a failure.
+
+A PATCH can combine `uploadCompleted: true` with `fileName` or `kind`. In that case, `expectedVersion` is required. The completion request and metadata edit use one transaction. Metadata version increases once. Completion alone cannot include `expectedVersion`.
+
+Only `READY` and `UNVERIFIED` assets accept metadata edits. `DELETING` and `DELETED` assets return `409 ASSET_NOT_READY`. A stale `expectedVersion` returns `409 VERSION_CONFLICT`. A successful request replay runs before the stale-version check for the same actor, path, operation, key, and request body.
+
+The worker reads the temporary object, verifies its byte count and ETag, conditionally copies it to the final key, verifies the final object, and changes the asset from `UNVERIFIED` to `READY`. R2 and PostgreSQL do not share a transaction, so the worker reconciles durable state after timeouts.
+
+## A7: Delete an asset
+
+DELETE accepts no body and returns `{"assetId": "artifact_123", "status": "DELETING"}` after the deletion work is durably recorded. It changes the asset to `DELETING`, hides it from lists, and removes download access from A5.
+
+The deletion worker removes the stored object and then changes the asset to `DELETED` with `deletedAt`. A repeated delete does not create duplicate work. The same idempotency key returns its recorded response. Read A5 for the current deletion state. A storage failure keeps the asset `DELETING` until a later worker retry succeeds.
+
+Asset status has only these transitions:
+
+```text
+UNVERIFIED -> READY
+UNVERIFIED -> DELETING -> DELETED
+READY      -> DELETING -> DELETED
+```
+
+## Transfer retries and idempotency
+
+The original POST request is the transfer retry operation. Repeat the same POST path, exact JSON body, and `Idempotency-Key` to receive the same asset and a refreshed transfer while the internal upload remains pending. No renewal endpoint exists.
+
+The replay record is retained for 24 hours. A replayed POST does not create another asset. A different request on the same operation and path with the same key returns `409 IDEMPOTENCY_CONFLICT`. Use a new key for a distinct asset or a distinct PATCH or DELETE action.
+
+The same source email attachment is deduplicated through an internal source identity. A matching source can return an existing asset with `transfer: null` when it is already finalizing or ready. A different project or metadata hash returns `409 PROJECT_MISMATCH` or `409 SOURCE_CONFLICT`.
+
+Direct R2 transfer retries use only the transfer URL and headers. If the URL expires before the intent deadline, repeat the original POST with the same key. If the intent expires, create a replacement asset with a new key.
+
+## Errors
+
+Asset errors use this envelope:
+
+```json
+{
+  "error": {
+    "code": "UPLOAD_TOO_LARGE",
+    "message": "The file exceeds the single-upload limit.",
+    "requestId": "request_123",
+    "retryable": false,
+    "details": { "maxBytes": 5363466240 }
+  }
+}
+```
+
+`details` is optional. Validation details use `fields`, an array of field and message objects. Error responses do not include provider payloads, private email data, object keys, credentials, or stack traces.
+
+| HTTP | Code | Meaning |
+| --- | --- | --- |
+| 400 | `VALIDATION_ERROR` | Invalid JSON shape, unknown field, body identifier, query parameter, or idempotency header. |
+| 401 | `AUTH_REQUIRED` | Authentication is missing or invalid. |
+| 403 | `FORBIDDEN` | The caller lacks access or the required OAuth scope. |
+| 404 | `RESOURCE_NOT_FOUND` | The resource is absent or inaccessible. |
+| 409 | `IDEMPOTENCY_CONFLICT` | A key is reused with a different request. |
+| 409 | `PROJECT_MISMATCH` | An appointment, email source, or asset parent does not match the project. |
+| 409 | `SOURCE_CONFLICT` or `SOURCE_DELETED` | An email source conflicts with prior metadata or was deleted. |
+| 409 | `ASSET_NOT_READY` | Completion or metadata editing is unavailable in the current asset state. |
+| 409 | `PROJECT_ARCHIVED` | Restore the project before creating an asset or completing its upload. |
+| 409 | `APPOINTMENT_ARCHIVED` | Restore the managed appointment before creating an appointment asset. |
+| 409 | `VERSION_CONFLICT` | The supplied metadata version is stale. |
+| 413 | `UPLOAD_TOO_LARGE` | `sizeBytes` exceeds `5363466240`. `details.maxBytes` is included. |
+| 429 | `UPLOAD_CAPACITY_EXCEEDED` | The actor has 20 retained temporary-upload reservations. `Retry-After: 60` is included. |
+| 503 | `STORAGE_UNAVAILABLE` | R2 is unconfigured or a storage request failed. |
+| 500 | `INTERNAL_ERROR` | The backend failed. Reconcile asset state before retrying. |
+
+`retryable` is true for capacity errors and transient storage errors. Missing storage configuration is not retryable until configuration changes. Direct R2 responses use R2's response format.
+
+## Durable storage internals
+
+`AssetUpload` stores the internal pending transfer, expected metadata, temporary key, final key, intent deadline, transfer grant deadline, source ETag, and internal lifecycle status. It has no public REST route.
+
+`AssetStorageJob` stores durable `FINALIZE_UPLOAD` and `DELETE_OBJECT` work. The worker claims bounded jobs with leases, retries storage failures with exponential backoff from five seconds up to one hour, and processes at most five finalization attempts within 24 hours. Deletion jobs keep retrying until storage confirms removal and reconcile completed deletion records hourly.
+
+`AssetApiRequest` stores idempotency responses for 24 hours. `AssetEmailSource` stores attachment-level source identity and project binding. These records remain internal and do not change the seven public operations.
+
+`GET /internal/assets/process` uses `CRON_SECRET` and processes bounded storage work. It is an internal scheduler route, not an asset client workflow.
+
+The API creates temporary keys under `temporary/{organizationId}/projects/{projectId}/{uploadId}` and final keys under `{organizationId}/projects/{projectId}/assets/{objectId}`. The client receives only signed transfer URLs. See [storage operations](./assets-storage-operations.md) for bucket, lifecycle, CORS, and release checks.
diff --git a/docs/assets-storage-operations.md b/docs/assets-storage-operations.md
new file mode 100644
index 000000000..6a433a50c
--- /dev/null
+++ b/docs/assets-storage-operations.md
@@ -0,0 +1,93 @@
+# Asset storage operations
+
+CompCRM uses a private Cloudflare R2 bucket for project assets. The API signs short-lived direct transfers. The API never returns R2 credentials to a client.
+
+Set these variables together in the root `.env`:
+
+| Variable | Value |
+| --- | --- |
+| `R2_ACCOUNT_ID` | Cloudflare account ID that owns the bucket. |
+| `R2_ACCESS_KEY_ID` | R2 API token access key with object read and write access. |
+| `R2_SECRET_ACCESS_KEY` | Secret for the R2 API token. |
+| `R2_BUCKET` | Private bucket name. |
+
+All four variables are optional. When a value is missing, the API still starts. New asset creation returns `503 STORAGE_UNAVAILABLE`. The worker retains queued storage work without processing it. Asset metadata reads remain available with no download URL. Do not place these values in a package-local `.env` file.
+
+Create one private bucket for the deployment. Keep public access disabled. New temporary objects use the `temporary/` prefix. Final objects stay outside that prefix.
+
+For organization `org_123` and project `project_456`, new keys have this structure:
+
+```text
+temporary/org_123/projects/project_456/upload_abc
+org_123/projects/project_456/assets/object_789
+```
+
+The final object ID is independent of the internal upload and asset IDs. File names, content types, and appointment references stay in database metadata. Renaming a file or project does not change its key.
+
+Existing assets keep their stored bucket and keys. Finalization, signed downloads, and deletion use those stored locations. The API never reconstructs an existing key from a file name.
+
+Configure an R2 lifecycle rule for `temporary/` with a seven-day expiration. This rule removes abandoned temporary objects, including late writes through an expired transfer. Application cleanup also attempts deletion and records durable work. Lifecycle deletion is eventual. See [R2 object lifecycles](https://developers.cloudflare.com/r2/buckets/object-lifecycles/).
+
+Configure bucket CORS for every approved origin that performs direct transfers. A starting policy is:
+
+```json
+[
+  {
+    "AllowedOrigins": ["https://app.jobsteward.ai"],
+    "AllowedMethods": ["PUT", "GET", "HEAD"],
+    "AllowedHeaders": ["Content-Type", "Content-Length"],
+    "ExposeHeaders": ["ETag"],
+    "MaxAgeSeconds": 3600
+  }
+]
+```
+
+Replace the origin with every approved web origin. Add a local origin only for local development. Do not use `*` for a production bucket.
+
+## Implemented storage flow
+
+1. `POST /projects/{projectId}/assets` or `POST /appointments/{appointmentId}/assets` stores JSON metadata, creates an `UNVERIFIED` asset, and returns a signed `PUT` transfer.
+2. The client sends the original bytes to R2 with the returned `Content-Type` and `Content-Length` headers.
+3. `PATCH /assets/{assetId}` with `{ "uploadCompleted": true }` records completion and queues durable verification work. The request does not upload bytes and does not make the asset ready.
+4. The worker reads temporary-object size and ETag, performs an ETag-conditional copy to the final key, verifies the final object, and changes the asset to `READY`.
+5. `GET /assets/{assetId}` returns a temporary signed GET only for a `READY` asset. The download grant lasts 15 minutes.
+6. `DELETE /assets/{assetId}` changes the asset to `DELETING` and queues durable object deletion. The worker changes it to `DELETED` after storage confirms removal.
+
+The public API has no upload ID route, confirmation route, URL renewal route, cancellation route, or separate download route. A retry of the original POST with the same request body and `Idempotency-Key` returns the same asset and refreshes its transfer while the internal upload remains pending. No public transfer-renewal operation exists.
+
+The direct `PUT` uses no CRM credential. The API signs `Content-Type` and `Content-Length`. The maximum single request is `5363466240` bytes. This is a transport limit. The API accepts any file format and has no recording-duration limit.
+
+The transfer URL lifetime is 15 minutes or the internal 24-hour upload-intent deadline, whichever comes first. URL lifetime does not prove a maximum duration for a PUT that has already started. Verify this provider behavior against real R2.
+
+## Durable worker behavior
+
+`AssetUpload` stores expected metadata, temporary and final keys, transfer and intent deadlines, source ETag, and internal upload status. `AssetStorageJob` stores `FINALIZE_UPLOAD` and `DELETE_OBJECT` work. These tables are storage internals. They have no public asset routes.
+
+The internal `GET /internal/assets/process` route requires `Authorization: Bearer <CRON_SECRET>` and processes bounded work. The deployment schedules it once per minute.
+
+The R2 client uses one SDK attempt per request, a five-second connection timeout, and a 30-second request timeout. Durable worker retries use exponential backoff from five seconds up to one hour. Finalization stops after five attempts or 24 hours after completion was requested. It records a verification or finalization failure while the public asset remains `UNVERIFIED`.
+
+Deletion retries continue until R2 confirms that the object is absent. Completed deletion jobs run reconciliation hourly. A late temporary write or a copied final object receives another deletion attempt.
+
+The actor capacity limit is 20 retained temporary-upload reservations. Cleanup retains reservations for seven days after the latest transfer authorization expires and releases them only after it verifies object removal. This interval is a cleanup policy, not a verified R2 transfer deadline. Temporary cleanup continues after reservation release.
+
+Existing unverified artifacts retain their stored locations. Confirm the bucket, key, byte count, and media type before marking a row `READY`. Deleting an artifact with an unknown bucket creates durable work that requires operator resolution. Resolve the bucket from verified storage evidence. Never assign the configured bucket solely because its key matches.
+
+## Release checks against real R2
+
+Fake storage tests prove request construction. They do not prove R2 behavior. Run these checks after credentials, bucket privacy, and CORS are configured:
+
+1. Create assets at zero bytes and at `5363466240` bytes. Confirm the signed transfer carries the exact content type and length.
+2. Confirm `5363466241` bytes returns `413 UPLOAD_TOO_LARGE` before a new asset is created.
+3. Send a direct PUT with the returned headers. Repeat with a different content type, shorter body, longer body, and unknown-length body. Confirm invalid transfers do not become ready assets.
+4. Start a PUT before transfer expiry and finish after expiry. Record the provider result. Do not claim URL expiry limits transfer duration without this evidence.
+5. Repeat the original POST with the same key after transfer expiry. Confirm it returns the same asset and a fresh transfer while the intent remains valid.
+6. Send `PATCH /assets/{assetId}` with `uploadCompleted: true`. Confirm the asset remains `UNVERIFIED` until the worker verifies the object, then becomes `READY`.
+7. Change the temporary object's ETag after the worker records it and before copy. Confirm conditional copy fails and no ready asset is created.
+8. Delete a ready asset. Confirm the public state changes to `DELETING`, then `DELETED` only after R2 confirms removal. Test a transient storage failure and a later retry.
+9. Confirm the final key cannot be written with the temporary PUT grant. Confirm signed GET responses use attachment disposition and support range requests.
+10. Verify an unauthenticated request cannot read a final object from the private bucket.
+
+Record the date, bucket, region `auto`, SDK version, test object keys, and R2 responses. Remove test objects after verification. Do not include credentials or signed URLs in release evidence.
+
+Use the [R2 presigned URL documentation](https://developers.cloudflare.com/r2/api/s3/presigned-urls/), [R2 S3 API compatibility](https://developers.cloudflare.com/r2/api/s3/api/), and [R2 upload limits](https://developers.cloudflare.com/r2/platform/limits/) as release references.
diff --git a/docs/connections.md b/docs/connections.md
index b5d95c9bb..4bc142c32 100644
--- a/docs/connections.md
+++ b/docs/connections.md
@@ -42,20 +42,24 @@ undo it.
 
 ## Connecting Slack is refused at the OAuth endpoints, not in the UI
 
-Connecting is the same decision as disconnecting, because `replaceSlackConnection`
-deletes every other Slack account row: a second person connecting *replaces* the
-workspace's Slack, and every deployed agent then reads from and posts to whichever
-Slack they installed. Hiding the button is not enough — `authClient.oauth2.link`
-is one POST.
+Connecting is the same decision as disconnecting. A second person connecting
+replaces the active organization's Slack grant. Other organizations keep their
+own grants. Hiding the button is not enough. `authClient.linkSocial` sends one
+POST.
 
 `slackConnectGuard` (`packages/auth/src/slack-connect.ts`) is Better Auth's
 `hooks.before`, and it asks the same `canManageConnections` the API does. It
-covers all three doors: `/oauth2/link`, `/sign-in/oauth2` (Slack is a connection,
-never a sign-in method, and that endpoint needs no session) and
-`/oauth2/callback/slack`. The callback is the one that matters — refusing there
-happens **before the code is exchanged**, so a refused attempt writes no
+guards Slack account-linking starts through `/link-social`. Public Slack sign-in
+through `/sign-in/social` remains available to Better Auth. The guard also
+reads the server-generated OAuth state before `/callback/slack`. It guards the
+callback only when that state identifies an account-linking transaction. A
+normal Slack sign-in callback remains available to Better Auth. The callback
+check happens before Better Auth exchanges the code. A refused link writes no
 `SlackWorkspaceGrant` user token and deletes no bot token. Google and Microsoft
-sign in on different paths and never reach the guard.
+callbacks never reach the Slack guard.
+
+Existing Slack applications must replace `/api/auth/oauth2/callback/slack` with
+`/api/auth/callback/slack` before this upgrade reaches production.
 
 A workspace with no owner and no admin lets any member connect. There is nobody
 left to ask, and a fresh install must not be locked out of its first connection.
@@ -95,10 +99,12 @@ uses to act as the person who connected Slack.
 - **Public channel** — the bot self-joins with `conversations.join`. Bot token only.
 - **Private channel** — only a user token can invite the bot. Both tokens.
 
-The bot token lives on `Account`. The user token lives on `SlackWorkspaceGrant`,
-keyed by Slack team id, because the grant belongs to the workspace and not to the
-person who clicked Connect. `packages/auth/src/slack-grant.ts` writes it, and
-`apps/agent/agent/lib/slack-connection.ts` is the only place that reads either.
+The bot and user tokens live on `SlackWorkspaceGrant`, keyed by CRM organization
+and Slack team id. The grant belongs to one CRM organization. Better Auth's
+`Account` remains an OAuth identity record and does not select runtime Slack
+credentials.
+`packages/auth/src/slack-grant.ts` writes the grant.
+`apps/agent/agent/lib/slack-connection.ts` reads both tokens.
 
 A missing user grant is a capability that is off, not an error. The connection
 page names it, and the private-channel row falls back to asking a human.
diff --git a/docs/construction-change-map.md b/docs/construction-change-map.md
new file mode 100644
index 000000000..4295b66e9
--- /dev/null
+++ b/docs/construction-change-map.md
@@ -0,0 +1,173 @@
+# CompCRM construction change map
+
+This is the canonical Markdown map for the headless construction POC. It
+records the original CRM names, their construction meanings, and every
+retained database or parameter change.
+
+| Item | Value |
+| --- | --- |
+| Base branch | `origin/master` |
+| Base SHA | `c7fc76ee5074152f691c55a9ce5fb017521fefc4` |
+| Audited branch | `feat/construction-crm` |
+| Audited SHA before this implementation | `c505c3e1e868de74f68666a1011fe51d4d9d2856` |
+| Last updated | 2026-08-29 |
+
+## Vocabulary and boundary
+
+| Original CRM name | Construction meaning | Stored and API name |
+| --- | --- | --- |
+| `Company` | Customer or Household | `Company`, `company` |
+| `Contact` | Person | `Contact`, `contact` |
+| `Deal` | Project | `Deal`, `deal` |
+| `DealContact` | Project Contact | `DealContact`, `dealContact` |
+| `DealStage` | Project Status | `DealStage`, `stage` |
+| `Artifact` | Project File | `Artifact`, `artifact` |
+| `Document` | Estimate or Invoice | `Document`, `document` |
+| `DocumentLineItem` | Estimate or Invoice Line | `DocumentLineItem`, `documentLineItem` |
+
+The POC has one human GC role. Other operational roles are bots or agents.
+`User`, `Organization`, and `Member` remain inherited access infrastructure.
+The future middleware may translate construction terms into CRM terms. This
+branch does not implement that middleware.
+
+## DealStage mapping
+
+The stored enum and the API `stage` parameter retain the original values.
+
+| Original `DealStage` value | Construction status |
+| --- | --- |
+| `DEMO_BOOKED` | Lead |
+| `QUALIFIED_TO_BUY` | Estimating |
+| `CONTRACT_SENT` | Contracted |
+| `DECISION_MAKER_BOUGHT_IN` | In progress |
+| `CLOSED_WON` | Complete |
+| `CLOSED_LOST` | Lost |
+| `UNQUALIFIED_TO_BUY` | Disqualified |
+
+The default remains `DEMO_BOOKED`. No code mapping or enum rename is retained.
+
+## Retained database changes
+
+### Existing models
+
+| Model or field | Retained change |
+| --- | --- |
+| `Deal.leadSource` | Optional `String` for lead source. |
+| `Deal.projectType` | Optional `String` for construction type. |
+| `Deal.addressLine1` | Optional `String` for the job-site address. |
+| `Deal.addressLine2` | Optional `String` for a second address line. |
+| `Deal.city` | Optional `String` for the job-site city. |
+| `Deal.state` | Optional `String` for the job-site state or region. |
+| `Deal.postalCode` | Optional `String` for the job-site postal code. |
+| `AgentRun.dealId` | Optional `String` with a nullable `Deal` relation, `ON DELETE SET NULL`, and an index on `(dealId, createdAt)`. |
+| `Deal.agentRuns` | Reverse `AgentRun[]` relation. |
+| `Deal.artifacts` | Reverse `Artifact[]` relation. |
+| `Deal.documents` | Reverse `Document[]` relation. |
+
+`Deal.companyId` remains required. Its original Company foreign key and
+`ON DELETE CASCADE` behavior remain. `DealStage` remains the original enum.
+`Contact` has no `displayName` or `businessName`. `DealContact` has no
+`isPrimary` field or unique primary-contact index.
+
+### `Artifact`
+
+| Field | Definition |
+| --- | --- |
+| `id` | Required CUID string primary key. |
+| `dealId` | Required foreign key to `Deal.id`. |
+| `deal` | Required relation to `Deal`, cascade on delete. |
+| `type` | Required string. |
+| `fileName` | Required string. |
+| `storageKey` | Required string. |
+| `createdAt` | Timestamp with current-time default. |
+
+Index: `(dealId, createdAt)`.
+
+### `Document`
+
+| Field | Definition |
+| --- | --- |
+| `id` | Required CUID string primary key. |
+| `dealId` | Required foreign key to `Deal.id`. |
+| `deal` | Required relation to `Deal`, cascade on delete. |
+| `type` | Required string. |
+| `number` | Required string. |
+| `status` | Required string. |
+| `currency` | Required string, default `USD`. |
+| `issuedAt` | Optional timestamp. |
+| `dueAt` | Optional timestamp. |
+| `recipientSnapshot` | Required JSON. |
+| `contractorSnapshot` | Required JSON. |
+| `projectSnapshot` | Required JSON. |
+| `subtotal` | Required `Decimal(14,2)`. |
+| `tax` | Required `Decimal(14,2)`. |
+| `total` | Required `Decimal(14,2)`. |
+| `lineItems` | `DocumentLineItem[]` relation. |
+| `createdAt` | Timestamp with current-time default. |
+| `updatedAt` | Required timestamp with Prisma `@updatedAt`. |
+
+Index: `(dealId, createdAt)`.
+
+### `DocumentLineItem`
+
+| Field | Definition |
+| --- | --- |
+| `id` | Required CUID string primary key. |
+| `documentId` | Required foreign key to `Document.id`. |
+| `document` | Required relation to `Document`, cascade on delete. |
+| `description` | Required string. |
+| `quantity` | Required `Decimal(14,2)`. |
+| `unitPrice` | Required `Decimal(14,2)`. |
+| `total` | Required `Decimal(14,2)`. |
+| `position` | Required integer. |
+
+Index: `(documentId, position)`.
+
+## Additive migration
+
+`20260829120000_add_deal_metadata_documents` is the single branch migration.
+It adds the seven optional Deal text fields, the optional AgentRun Deal
+relation and index, and the Artifact, Document, and DocumentLineItem tables
+with their required indexes and delete behavior.
+
+The migration adds no data changes. It does not change DealStage, Deal.companyId,
+Contact, DealContact, Activity, or SavedView.
+
+## Retained API parameters and behavior
+
+| Surface | Retained change |
+| --- | --- |
+| Deal create | Accepts optional `leadSource`, `projectType`, `addressLine1`, `addressLine2`, `city`, `state`, and `postalCode`. Existing `name`, required `companyId`, required `ownerId`, physical `stage`, amount, currency, and expected-close inputs remain unchanged. |
+| Deal update | Accepts the same seven optional text fields. Blank strings become null. Existing physical CRM parameters remain unchanged. |
+| Deal list | Returns the seven fields on each row. Existing physical output names remain unchanged. |
+| Deal detail | Returns the seven fields. Existing physical output names remain unchanged. |
+| Company purge | Rejects deletion while a Deal references the Company, with the original CRM conflict text. Other original purge behavior remains. |
+| Agent runs | Event-triggered runs store `dealId` for physical Deal records. Retry loading and creation copy the nullable `dealId`. |
+
+No API alias, primary-contact output, cross-Company attach behavior, closed-stage
+create restriction, attached-contact search, company clearing, or construction
+wording change is retained.
+
+## Original behavior retained
+
+- Company is required for every Deal at the database and API boundary.
+- Original CRM names, routes, OpenAPI tags, error text, event text, and stage
+  values remain in application code.
+- `DealContact` keeps its composite key `(dealId, contactId)`, optional `role`,
+  same-Company attach rule, and original service behavior.
+- Contact labels remain calculated from `firstName` and optional `lastName`.
+- The web UI, landing copy, agent prompts, agent tool wording, and construction
+  status code mappings are restored to the original branch behavior.
+- No construction UI is shipped.
+
+## Retained focused tests
+
+- Deal field create, update, list, and detail behavior.
+- Required database Company relation for a Deal.
+- Document and DocumentLineItem persistence.
+- Company purge refusal while a Deal exists, including preserved project
+  activity and queued task records.
+- AgentRun Deal context on event dispatch and retry.
+- Original physical DealStage behavior in agent event fixtures.
+
+The full test commands and their results belong in the implementation report.
diff --git a/docs/environment.md b/docs/environment.md
index 22417c60e..360bf139d 100644
--- a/docs/environment.md
+++ b/docs/environment.md
@@ -32,6 +32,25 @@ metadata. The root file's comment has the whole account.
 `DATABASE_URL`, `BETTER_AUTH_SECRET`, `ALLOWED_SIGN_IN`. Everything else has a
 localhost default or is genuinely optional.
 
+The `DATABASE_URL` role must not be a superuser and must not have `BYPASSRLS`.
+Those attributes bypass tenant row-level security, including forced policies.
+
+## `AUDIT_DATABASE_URL` is only for migration rehearsal
+
+Row-level security prevents the app role from auditing all organizations.
+`packages/db/scripts/rehearse-migration.ts` therefore needs a separate role.
+Create that role on the same database with `BYPASSRLS` and read-only access.
+
+```sql
+CREATE ROLE crm_audit WITH LOGIN PASSWORD 'replace-this' BYPASSRLS;
+GRANT CONNECT ON DATABASE crm TO crm_audit;
+GRANT USAGE ON SCHEMA public TO crm_audit;
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO crm_audit;
+```
+
+Set `AUDIT_DATABASE_URL` to that role's connection string.
+Never use this role in `DATABASE_URL`, tests, seeds, or application processes.
+
 **`GOOGLE_CLIENT_ID` + `GOOGLE_CLIENT_SECRET`** are the sign-in button *and* the
 Gmail/Calendar sync — optional, so an SSO-only install needn't create a Google project,
 but **set together or not at all** (`packages/auth/src/env.ts` throws on one).
@@ -96,6 +115,15 @@ list fails closed.** Parsed on demand. `packages/auth/src/workspace.ts`.
 
 ## Typed, validated env
 
+### Optional asset storage
+
+`R2_ACCOUNT_ID`, `R2_ACCESS_KEY_ID`, `R2_SECRET_ACCESS_KEY`, and `R2_BUCKET` configure private file storage.
+All four values must be present to issue upload or download grants.
+Missing values disable storage transfers without preventing API startup.
+Metadata lists and deletion-state reads remain available.
+The existing `CRON_SECRET` also protects the asset storage worker.
+See [asset storage operations](./assets-storage-operations.md) for bucket settings and required R2 checks.
+
 `apps/api/src/config/env.validation.ts` runs via `ConfigModule.forRoot({ validate })`,
 and lists every variable the API reads and nothing else.
 
@@ -116,22 +144,21 @@ single place that knows what is set.
 | `BLOB_READ_WRITE_TOKEN` | Mirrors logos and photos into Blob |
 | `AI_GATEWAY_API_KEY` | The model. Not needed on Vercel (OIDC) |
 | `AGENT_BRIDGE_SECRET` | The rep-facing Agent panel — see `agent.md` |
+| `XMPP_COMPONENT_*`, `XMPP_*` | Optional XMPP agent gateway — see `setup.md` |
 
 `BLOB_READ_WRITE_TOKEN` is also in `env.validation.ts` and `apps/api/turbo.json`
 because the API and the seed write pictures too. The Next.js app is deliberately
 excluded — recognising our URL for the image optimizer needs no token.
 
-### The Context key is asked for, not configured
+### The Context key is optional
 
 **`CONTEXT_DEV_API_KEY` is not a variable here and must not become one.** The key lives
-in `AppSetting`, is asked for at `/onboarding/research`, and changes on Settings →
-General — an admin who cannot redeploy cannot set a variable.
+in `AppSetting`. Users add or replace it in Settings → General without a deployment.
 
 - **It buys two places to look, not one.** Company brand data by domain, and a person
   read back from a LinkedIn URL already on their record. Both capabilities in
   `agent/lib/capabilities.ts` turn on and off with this one key.
-- **An install that had the variable is asked again**: no migration, no fallback, and
-  **the gate cannot be dismissed**.
+- **CRM access does not require a Context key.** Missing credentials disable only Context company and person research.
 - **Nothing is lost while waiting.** A keyless `brand` task settles `SKIPPED` *before*
   anything marks the row `RUNNING`, and `settle` only overwrites `RUNNING` — so the
   company stays `PENDING`, which the sweep re-queues
@@ -206,6 +233,8 @@ is sent. No client is constructed, so there is no queue waiting to flush later.
 ## Not env vars
 
 - **Cache TTL** — `DEFAULT_TTL_MS` (60s) in `cache.module.ts`; `CACHE_TTL_MS` overrides.
-- **Redis** — optional; without `REDIS_URL` the cache is per-instance in-memory, which
-  is wrong for multi-instance.
+- **Redis** — optional. Tenant-specific cache entries include the organization id.
+  The automatic backfill key stays install-wide because one run sweeps every
+  organization. Without `REDIS_URL`, separate instances do not share invalidations
+  or debounce state. Multi-instance deployments need Redis for cache coherence.
 - **Sign-in method** — Google and Microsoft are in code; an IdP is a row (SSO, in `api.md`).
diff --git a/docs/eve-export-tool-subsystem-spec.md b/docs/eve-export-tool-subsystem-spec.md
new file mode 100644
index 000000000..843c2c373
--- /dev/null
+++ b/docs/eve-export-tool-subsystem-spec.md
@@ -0,0 +1,1615 @@
+# `exportTool` Subsystem Specification for Eve Agents
+
+## Status
+
+**Proposed**
+
+This document specifies an `exportTool` subsystem for an Eve agent that exposes selected agent-level operations to external callers such as an XMPP agent gateway.
+
+The key design goal is to expose **agent operations**, not raw Eve tools.
+
+An exported operation may contain:
+
+1. deterministic application logic,
+2. durable evidence/artifact creation,
+3. optional agentic reasoning through Eve,
+4. local Eve tool calls made by that agent,
+5. subagent or remote-agent delegation,
+6. a typed, machine-readable final result.
+
+The external caller sees one stable operation such as:
+
+```text
+handle_recording(url)
+```
+
+while the local implementation may internally perform a deterministic preprocessing pipeline and only invoke the LLM when judgment is actually required.
+
+---
+
+# 1. Motivation
+
+An Eve tool is primarily a capability **called by the local model**.
+
+For example:
+
+```text
+model -> crm_create_task(...)
+```
+
+An exported operation has the opposite direction:
+
+```text
+remote agent -> local Eve agent operation
+```
+
+Treating the exported operation itself as an Eve tool is awkward because the remote caller has already selected the operation, and the operation may need to invoke the local agent for reasoning.
+
+The subsystem therefore introduces a separate abstraction:
+
+```text
+exportTool
+```
+
+Despite the name, an `exportTool` is not necessarily an Eve model tool. It is an externally callable operation implemented by the application hosting the Eve agent.
+
+Its internal execution may be fully deterministic, fully agentic, or a mixture of both.
+
+---
+
+# 2. Design Goals
+
+The subsystem MUST:
+
+- expose a deliberate, allowlisted set of remotely callable operations;
+- describe each operation with a typed input schema;
+- optionally describe a typed output schema;
+- allow arbitrary deterministic TypeScript before and after LLM execution;
+- allow the operation to inject work into the already-running Eve runtime without HTTP loopback;
+- avoid creating `new Client({ host })` when the invocation already runs inside the Eve process;
+- allow the agent to use its normal instructions, tools, skills, sandbox, state, and subagents;
+- preserve cancellation;
+- support progress reporting;
+- support deterministic validation before any LLM tokens are spent;
+- allow manifest/tool metadata generation for the external gateway;
+- keep externally visible operation schemas separate from the model-facing Eve tool set;
+- make it impossible to accidentally export every Eve tool;
+- make deterministic-only operations possible without invoking an LLM.
+
+The subsystem SHOULD:
+
+- use Standard Schema-compatible schemas;
+- support Zod directly;
+- support JSON Schema export;
+- map one remote invocation to one Eve task/session by default;
+- make the Eve invocation mechanism replaceable;
+- permit future structured-output support without changing exported operation implementations.
+
+---
+
+# 3. Non-goals
+
+The subsystem does not implement:
+
+- XMPP stanza parsing;
+- XMPP discovery;
+- XMPP task persistence;
+- Deepgram itself;
+- CRM APIs;
+- Eve's runtime;
+- generic MCP transport.
+
+Those are consumers or dependencies of this subsystem.
+
+The subsystem is specifically the Eve-side execution and exported-operation layer.
+
+---
+
+# 4. Conceptual Model
+
+The primary abstraction is:
+
+```text
+External caller
+      |
+      v
+exportTool operation
+      |
+      +---- deterministic TypeScript
+      |
+      +---- services / database / evidence
+      |
+      +---- optional ctx.send(...)
+                     |
+                     v
+                Eve agent turn
+                     |
+                     +---- LLM reasoning
+                     +---- local Eve tools
+                     +---- skills
+                     +---- subagents
+                     +---- sandbox
+                     |
+                     v
+                result
+```
+
+Example:
+
+```text
+handle_recording(url)
+      |
+      +-- fetch URL
+      +-- transcode to 16 kHz mono
+      +-- call Deepgram
+      +-- persist transcript as evidence
+      |
+      +-- ctx.send("Process evidence ev_123...")
+               |
+               +-- agent reads evidence
+               +-- reasons about transcript
+               +-- updates CRM
+               +-- delegates work
+               +-- returns summary/actions
+```
+
+The deterministic steps do not consume model tokens.
+
+---
+
+# 5. Filesystem Layout
+
+Recommended layout:
+
+```text
+agent/
+├── agent.ts
+├── instructions.md
+│
+├── tools/
+│   ├── read_evidence.ts
+│   ├── crm_find_contact.ts
+│   ├── crm_add_note.ts
+│   └── crm_create_task.ts
+│
+├── channels/
+│   └── xmpp.ts
+│
+└── exports/
+    ├── handle_recording.ts
+    └── ping.ts
+
+src/
+├── export-tools/
+│   ├── define-export-tool.ts
+│   ├── registry.ts
+│   ├── executor.ts
+│   ├── schema.ts
+│   ├── context.ts
+│   └── errors.ts
+│
+├── services/
+│   ├── recordings.ts
+│   ├── audio.ts
+│   ├── deepgram.ts
+│   └── evidence.ts
+│
+└── xmpp/
+    ├── gateway-client.ts
+    └── manifest.ts
+```
+
+`agent/tools/` remains the set of capabilities callable by the local Eve model.
+
+`agent/exports/` contains the operations callable by remote agents.
+
+These two sets MUST NOT be conflated.
+
+---
+
+# 6. Public API
+
+## 6.1 `defineExportTool`
+
+The basic API:
+
+```ts
+export const handleRecording = defineExportTool({
+  description: "Handle a recording and perform appropriate follow-up work",
+
+  inputSchema: z.object({
+    url: z.string().url(),
+  }),
+
+  outputSchema: z.object({
+    evidenceId: z.string(),
+    summary: z.string(),
+    actionsTaken: z.array(
+      z.object({
+        type: z.string(),
+        description: z.string(),
+      }),
+    ),
+  }),
+
+  async execute(input, ctx) {
+    // arbitrary deterministic and/or agentic work
+  },
+});
+```
+
+The definition MUST be a plain serializable-capability description plus an executable function.
+
+Proposed types:
+
+```ts
+export interface ExportToolDefinition<I, O> {
+  readonly description: string;
+
+  readonly inputSchema: StandardSchemaV1<I>;
+
+  readonly outputSchema?: StandardSchemaV1<O>;
+
+  readonly annotations?: ExportToolAnnotations;
+
+  execute(
+    input: I,
+    ctx: ExportToolContext,
+  ): Promise<O> | O;
+}
+
+export interface ExportToolAnnotations {
+  readonly title?: string;
+  readonly idempotent?: boolean;
+  readonly readOnly?: boolean;
+  readonly destructive?: boolean;
+  readonly longRunning?: boolean;
+}
+```
+
+Helper:
+
+```ts
+export function defineExportTool<I, O>(
+  definition: ExportToolDefinition<I, O>,
+): ExportToolDefinition<I, O> {
+  return definition;
+}
+```
+
+This wrapper may later attach a symbol or metadata marker so the registry can reject arbitrary objects.
+
+---
+
+# 7. Naming
+
+The operation name SHOULD come from the filename, matching Eve's filesystem-first style.
+
+Example:
+
+```text
+agent/exports/handle_recording.ts
+```
+
+becomes:
+
+```text
+handle_recording
+```
+
+Do not duplicate the name inside the definition unless a later requirement justifies aliases.
+
+This avoids:
+
+```ts
+defineExportTool({
+  name: "handle_recording",
+  ...
+})
+```
+
+and keeps naming consistent with Eve tools.
+
+---
+
+# 8. ExportTool Context
+
+The core context type:
+
+```ts
+export interface ExportToolContext {
+  /**
+   * Abort when the external task is cancelled or the surrounding
+   * Eve runtime is shutting down.
+   */
+  readonly abortSignal: AbortSignal;
+
+  /**
+   * Identity and metadata for the remote invocation.
+   */
+  readonly invocation: ExportInvocation;
+
+  /**
+   * Deterministic application services.
+   */
+  readonly services: ApplicationServices;
+
+  /**
+   * Report progress to the external task system.
+   */
+  progress(update: ExportProgress): Promise<void>;
+
+  /**
+   * Start a turn in the already-running Eve runtime.
+   *
+   * This is intentionally an abstraction over Eve's current
+   * channel send primitive rather than an HTTP Client.
+   */
+  send<T = unknown>(
+    request: ExportAgentRequest<T>,
+  ): Promise<ExportAgentResult<T>>;
+}
+```
+
+Supporting types:
+
+```ts
+export interface ExportInvocation {
+  readonly requestId: string;
+  readonly operation: string;
+  readonly caller?: string;
+  readonly metadata?: Record<string, unknown>;
+}
+
+export interface ExportProgress {
+  readonly stage?: string;
+  readonly percent?: number;
+  readonly message?: string;
+}
+
+export interface ExportAgentRequest<T> {
+  readonly message: string | UserContent;
+
+  /**
+   * Optional structured result contract.
+   *
+   * The adapter is responsible for mapping this to the best
+   * Eve runtime mechanism available in the installed Eve version.
+   */
+  readonly outputSchema?: StandardSchemaV1<T>;
+
+  readonly title?: string;
+
+  /**
+   * For remote RPC-style invocation this should normally be true.
+   */
+  readonly taskMode?: boolean;
+
+  /**
+   * Non-durable metadata that may be injected as ephemeral
+   * context if the Eve entry path supports it.
+   */
+  readonly clientContext?: unknown;
+}
+
+export interface ExportAgentResult<T> {
+  readonly sessionId: string;
+  readonly value: T;
+}
+```
+
+The operation MUST NOT instantiate an Eve HTTP client.
+
+It receives `ctx.send()` from the integration boundary.
+
+---
+
+# 9. Why `ctx.send()` Is an Adapter
+
+Eve's public APIs distinguish several contexts.
+
+Eve custom channels can call `send()` from an inbound channel handler to start or resume a session. This runs the normal Eve runtime in-process.
+
+However, the exact set of supported options on channel-based `send()` differs across Eve entry surfaces, and structured `outputSchema` propagation is not uniformly available in every channel API at the time of writing.
+
+Therefore the exported operation SHOULD NOT depend directly on a specific Eve internal signature.
+
+Bad:
+
+```ts
+async execute(input, ctx) {
+  return internalEveRuntimePrivateFunction(...);
+}
+```
+
+Also undesirable:
+
+```ts
+const client = new Client({
+  host: process.env.EVE_URL!,
+});
+```
+
+Recommended:
+
+```ts
+async execute(input, ctx) {
+  return ctx.send({
+    message: "...",
+    outputSchema: ResultSchema,
+    taskMode: true,
+  });
+}
+```
+
+The channel/integration adapter owns the Eve-version-specific implementation.
+
+This creates a small compatibility seam.
+
+---
+
+# 10. Runtime Integration
+
+The preferred integration point is an Eve custom channel or another authored Eve runtime entrypoint that already has access to the in-process `send()` capability.
+
+Conceptually:
+
+```ts
+export default defineChannel({
+  routes: [
+    // optional HTTP routes if needed by the integration
+  ],
+
+  async receive(input, runtime) {
+    // runtime.send is Eve's in-process session dispatch primitive
+  },
+});
+```
+
+For an XMPP bridge that already runs in the same Node process, the bridge should hand an invocation to the export-tool executor while providing an adapter around the live Eve `send` function.
+
+Pseudo-code:
+
+```ts
+async function onXmppInvocation(invocation, eveRuntimeCtx) {
+  return executeExportTool(
+    invocation.tool,
+    invocation.arguments,
+    {
+      invocation,
+      abortSignal: invocation.abortSignal,
+      services,
+      progress: invocation.progress,
+
+      send: async (request) => {
+        return sendThroughEveRuntime(
+          eveRuntimeCtx,
+          request,
+        );
+      },
+    },
+  );
+}
+```
+
+The `exportTool` implementation itself remains unaware of XMPP and Eve transport details.
+
+---
+
+# 11. Registry
+
+The registry explicitly defines the public surface.
+
+Example:
+
+```ts
+import handleRecording from "../../agent/exports/handle_recording";
+import ping from "../../agent/exports/ping";
+
+export const exportTools = {
+  handle_recording: handleRecording,
+  ping,
+} as const;
+```
+
+The registry MUST be explicit.
+
+Do not recursively export everything in `agent/tools`.
+
+Automatic filesystem discovery of `agent/exports/*.ts` is acceptable if the directory itself is the allowlist.
+
+---
+
+# 12. Invocation Executor
+
+The executor performs:
+
+1. tool lookup,
+2. input validation,
+3. context creation,
+4. execution,
+5. optional output validation,
+6. normalized error conversion.
+
+Example:
+
+```ts
+export async function executeExportTool(
+  name: string,
+  rawInput: unknown,
+  ctx: ExportToolContext,
+): Promise<unknown> {
+  const definition = exportTools[name];
+
+  if (!definition) {
+    throw new ExportToolNotFoundError(name);
+  }
+
+  const inputResult =
+    await definition.inputSchema["~standard"].validate(rawInput);
+
+  if (inputResult.issues) {
+    throw new ExportToolValidationError(
+      "Invalid export tool input",
+      inputResult.issues,
+    );
+  }
+
+  const output = await definition.execute(
+    inputResult.value,
+    ctx,
+  );
+
+  if (!definition.outputSchema) {
+    return output;
+  }
+
+  const outputResult =
+    await definition.outputSchema["~standard"].validate(output);
+
+  if (outputResult.issues) {
+    throw new ExportToolValidationError(
+      "Invalid export tool output",
+      outputResult.issues,
+    );
+  }
+
+  return outputResult.value;
+}
+```
+
+Input validation MUST occur before deterministic processing and before any LLM call.
+
+Output validation SHOULD occur before sending the result back to the gateway.
+
+---
+
+# 13. Full Example: `handle_recording`
+
+## 13.1 Schema
+
+```ts
+// agent/exports/handle_recording.ts
+
+import { z } from "zod";
+import { defineExportTool } from "../../src/export-tools/define-export-tool";
+
+export const HandleRecordingInput = z.object({
+  url: z.string().url(),
+});
+
+export const HandleRecordingOutput = z.object({
+  evidenceId: z.string(),
+
+  transcript: z.object({
+    durationSeconds: z.number().nonnegative(),
+    language: z.string().optional(),
+  }),
+
+  summary: z.string(),
+
+  actionsTaken: z.array(
+    z.object({
+      type: z.string(),
+      description: z.string(),
+    }),
+  ),
+});
+```
+
+---
+
+## 13.2 Implementation
+
+```ts
+export default defineExportTool({
+  description:
+    "Fetch and transcribe a recording, preserve the transcript as evidence, " +
+    "then have the secretary agent interpret it and perform appropriate follow-up work.",
+
+  inputSchema: HandleRecordingInput,
+  outputSchema: HandleRecordingOutput,
+
+  annotations: {
+    title: "Handle recording",
+    idempotent: false,
+    readOnly: false,
+    longRunning: true,
+  },
+
+  async execute({ url }, ctx) {
+    //
+    // Deterministic phase
+    //
+
+    await ctx.progress({
+      stage: "fetch",
+      percent: 5,
+      message: "Fetching recording",
+    });
+
+    const recording = await ctx.services.recordings.fetch(url, {
+      signal: ctx.abortSignal,
+    });
+
+    await ctx.progress({
+      stage: "transcode",
+      percent: 20,
+      message: "Transcoding recording",
+    });
+
+    const audio = await ctx.services.audio.transcode(recording, {
+      sampleRate: 16_000,
+      channels: 1,
+      signal: ctx.abortSignal,
+    });
+
+    await ctx.progress({
+      stage: "transcribe",
+      percent: 40,
+      message: "Transcribing recording",
+    });
+
+    const transcription =
+      await ctx.services.deepgram.transcribe(audio, {
+        signal: ctx.abortSignal,
+      });
+
+    await ctx.progress({
+      stage: "evidence",
+      percent: 60,
+      message: "Storing transcript as evidence",
+    });
+
+    const evidence = await ctx.services.evidence.create({
+      type: "recording-transcript",
+
+      source: {
+        kind: "url",
+        url,
+      },
+
+      content: transcription.text,
+
+      metadata: {
+        durationSeconds: transcription.durationSeconds,
+        language: transcription.language,
+        provider: "deepgram",
+      },
+    });
+
+    //
+    // Agentic phase
+    //
+
+    await ctx.progress({
+      stage: "reasoning",
+      percent: 70,
+      message: "Processing transcript",
+    });
+
+    const agentResult = await ctx.send({
+      taskMode: true,
+
+      title: "Process recording",
+
+      message: `
+A new recording has been transcribed and stored as evidence.
+
+Evidence ID: ${evidence.id}
+
+Process this recording according to your secretary responsibilities.
+
+Inspect the evidence using the available evidence tools. Determine the
+important facts, commitments, requests, deadlines, follow-ups, and CRM
+implications. Perform appropriate actions using your available tools and
+agents.
+
+Do not claim an action was performed unless the corresponding tool call
+succeeded.
+
+Return:
+- a concise summary;
+- the actions actually taken.
+`.trim(),
+
+      outputSchema: z.object({
+        summary: z.string(),
+
+        actionsTaken: z.array(
+          z.object({
+            type: z.string(),
+            description: z.string(),
+          }),
+        ),
+      }),
+
+      clientContext: {
+        invocation: "handle_recording",
+        externalRequestId: ctx.invocation.requestId,
+        caller: ctx.invocation.caller,
+      },
+    });
+
+    await ctx.progress({
+      stage: "complete",
+      percent: 100,
+      message: "Recording processed",
+    });
+
+    return {
+      evidenceId: evidence.id,
+
+      transcript: {
+        durationSeconds: transcription.durationSeconds,
+        language: transcription.language,
+      },
+
+      summary: agentResult.value.summary,
+      actionsTaken: agentResult.value.actionsTaken,
+    };
+  },
+});
+```
+
+The important property is that the model sees none of the fetch/transcode/Deepgram machinery.
+
+The LLM is invoked only after the transcript has been produced.
+
+---
+
+# 14. Evidence Tool
+
+The agent needs a way to inspect the transcript.
+
+Recommended model-facing Eve tool:
+
+```ts
+// agent/tools/read_evidence.ts
+
+import { defineTool } from "eve/tools";
+import { z } from "zod";
+import { evidence } from "../../src/services/evidence";
+
+export default defineTool({
+  description:
+    "Read stored evidence such as transcripts, messages, and documents.",
+
+  inputSchema: z.object({
+    id: z.string(),
+    start: z.number().int().nonnegative().optional(),
+    limit: z.number().int().positive().max(20000).optional(),
+  }),
+
+  async execute({ id, start = 0, limit = 8000 }, ctx) {
+    const item = await evidence.get(id);
+
+    if (!item) {
+      throw new Error(`Evidence not found: ${id}`);
+    }
+
+    const chunk = item.content.slice(start, start + limit);
+
+    return {
+      id: item.id,
+      type: item.type,
+      content: chunk,
+      start,
+      end: start + chunk.length,
+      totalLength: item.content.length,
+      hasMore: start + chunk.length < item.content.length,
+    };
+  },
+});
+```
+
+For long transcripts, also expose:
+
+```text
+search_evidence(id, query)
+```
+
+so the agent does not need to inject a complete hour-long transcript into model context.
+
+---
+
+# 15. In-Process `ctx.send()` Adapter
+
+The exported-operation context SHOULD expose a stable application-level `send()` method.
+
+The integration layer maps it to Eve's current runtime API.
+
+Conceptual implementation:
+
+```ts
+function makeExportToolContext(
+  invocation: XmppInvocation,
+  eveChannelContext: EveChannelContext,
+): ExportToolContext {
+  return {
+    abortSignal: invocation.abortSignal,
+
+    invocation: {
+      requestId: invocation.requestId,
+      operation: invocation.tool,
+      caller: invocation.from,
+    },
+
+    services,
+
+    progress: async (update) => {
+      await invocation.reportProgress(update);
+    },
+
+    send: async (request) => {
+      const result = await eveChannelContext.send(
+        request.message,
+        {
+          auth: invocationAuth(invocation),
+          mode: request.taskMode ? "task" : undefined,
+          title: request.title,
+
+          // If/when the selected Eve send surface accepts these directly:
+          // outputSchema: request.outputSchema,
+          // clientContext: request.clientContext,
+        },
+      );
+
+      return await collectAgentResult(
+        result,
+        request.outputSchema,
+      );
+    },
+  };
+}
+```
+
+This snippet is intentionally adapter-level pseudocode.
+
+The installed Eve version determines the exact channel `send()` result type and which per-turn fields are directly supported.
+
+The operation API remains stable.
+
+---
+
+# 16. Structured Result Compatibility
+
+At the time of this design, Eve supports structured task results through `outputSchema` in task-mode/client-oriented surfaces, and emits `result.completed` for such turns.
+
+However, not all custom-channel/cross-channel entry surfaces currently propagate `outputSchema` uniformly.
+
+Therefore the subsystem MUST isolate this behavior behind:
+
+```ts
+ctx.send(...)
+```
+
+and:
+
+```ts
+collectAgentResult(...)
+```
+
+The preferred order of implementation is:
+
+1. use native Eve structured-output support when available on the in-process send path;
+2. otherwise use a small compatibility adapter;
+3. do not make the exported operation instantiate an HTTP `Client`;
+4. do not import private Eve runtime internals.
+
+A future Eve upgrade should require changing only the adapter.
+
+---
+
+# 17. Result Collection
+
+`ctx.send()` should resolve only when the task-mode turn reaches a terminal state.
+
+Conceptually:
+
+```ts
+async function collectAgentResult<T>(
+  session: EveSessionHandle,
+  schema?: StandardSchemaV1<T>,
+): Promise<ExportAgentResult<T>> {
+  for await (const event of session.stream()) {
+    switch (event.type) {
+      case "result.completed":
+        return {
+          sessionId: session.id,
+          value: event.data.result as T,
+        };
+
+      case "turn.failed":
+      case "session.failed":
+        throw new ExportAgentRunError(event);
+
+      case "turn.cancelled":
+        throw new ExportCancelledError();
+    }
+  }
+
+  throw new ExportAgentRunError(
+    "Eve session ended without a result",
+  );
+}
+```
+
+Exact event names/types MUST follow the installed Eve version.
+
+---
+
+# 18. Cancellation
+
+Cancellation MUST propagate end-to-end:
+
+```text
+remote cancellation
+      |
+      v
+export invocation AbortController
+      |
+      +-- fetch abort
+      +-- transcode abort/kill
+      +-- Deepgram abort
+      +-- evidence write abort where possible
+      |
+      +-- Eve turn cancellation
+```
+
+All deterministic services SHOULD accept an `AbortSignal`.
+
+Example:
+
+```ts
+await recordings.fetch(url, {
+  signal: ctx.abortSignal,
+});
+```
+
+The Eve adapter SHOULD bind the same cancellation source to the Eve task/session cancellation API.
+
+The mapping should be retained:
+
+```text
+external task id -> Eve session id / turn id
+```
+
+until completion.
+
+---
+
+# 19. Progress
+
+Progress is application-level and independent of LLM text.
+
+Recommended stages for `handle_recording`:
+
+```text
+5%   fetch
+20%  transcode
+40%  transcribe
+60%  evidence
+70%  reasoning
+100% complete
+```
+
+The percentages are advisory.
+
+The gateway should treat stage/message as more authoritative than exact percentage.
+
+Agent stream events MAY also be translated into richer progress messages, but the exported operation should not depend on model narration.
+
+---
+
+# 20. Error Model
+
+Define normalized error types:
+
+```ts
+export class ExportToolNotFoundError extends Error {}
+export class ExportToolValidationError extends Error {}
+export class ExportToolExecutionError extends Error {}
+export class ExportAgentRunError extends Error {}
+export class ExportCancelledError extends Error {}
+```
+
+Suggested externally visible error codes:
+
+```text
+EXPORT_TOOL_NOT_FOUND
+INVALID_ARGUMENTS
+DETERMINISTIC_PROCESSING_FAILED
+AGENT_RUN_FAILED
+CANCELLED
+OUTPUT_VALIDATION_FAILED
+INTERNAL_ERROR
+```
+
+Do not leak arbitrary stack traces to remote callers.
+
+Log the full cause locally.
+
+---
+
+# 21. Idempotency
+
+Some exported operations cause side effects.
+
+`handle_recording` may:
+
+- create evidence,
+- update CRM state,
+- create tasks,
+- send messages.
+
+The invocation subsystem SHOULD pass a stable `requestId`.
+
+Deterministic side effects SHOULD use it as an idempotency key where practical.
+
+Example:
+
+```ts
+const evidence = await evidence.create({
+  idempotencyKey:
+    `handle_recording:${ctx.invocation.requestId}:transcript`,
+  ...
+});
+```
+
+For an external retry of the same invocation, the subsystem SHOULD avoid creating duplicate evidence or CRM work.
+
+If the XMPP gateway already guarantees exactly-once logical task identity, use that task/request identifier.
+
+---
+
+# 22. Manifest Generation
+
+The externally visible tool manifest is generated from `agent/exports/`, not from `agent/tools/`.
+
+For each export:
+
+```ts
+interface ExportToolManifestEntry {
+  name: string;
+  description: string;
+  inputSchema: JsonSchema;
+  outputSchema?: JsonSchema;
+  annotations?: ExportToolAnnotations;
+}
+```
+
+Conceptually:
+
+```ts
+function manifestEntry(
+  name: string,
+  definition: ExportToolDefinition<any, any>,
+): ExportToolManifestEntry {
+  return {
+    name,
+    description: definition.description,
+    inputSchema: toJsonSchema(definition.inputSchema),
+    outputSchema: definition.outputSchema
+      ? toJsonSchema(definition.outputSchema)
+      : undefined,
+    annotations: definition.annotations,
+  };
+}
+```
+
+Do not maintain a second handwritten schema in the gateway.
+
+The authored schema is the source of truth.
+
+---
+
+# 23. Security Boundary
+
+Only definitions under the export registry are remotely callable.
+
+For example:
+
+```text
+agent/tools/bash.ts
+agent/tools/write_file.ts
+agent/tools/send_email.ts
+```
+
+do NOT automatically become:
+
+```text
+remote.bash(...)
+remote.write_file(...)
+remote.send_email(...)
+```
+
+The public XMPP surface might expose only:
+
+```text
+handle_recording
+prepare_followup
+process_invoice
+```
+
+The local model may internally call `send_email`, but a remote caller cannot invoke it directly unless it is intentionally exported.
+
+---
+
+# 24. Deterministic-only Export
+
+Not every exported operation needs Eve.
+
+Example:
+
+```ts
+export default defineExportTool({
+  description: "Return the current agent build information",
+
+  inputSchema: z.object({}),
+
+  outputSchema: z.object({
+    version: z.string(),
+    commit: z.string(),
+  }),
+
+  async execute(_input, ctx) {
+    return {
+      version: ctx.services.build.version,
+      commit: ctx.services.build.commit,
+    };
+  },
+});
+```
+
+No model call occurs.
+
+This is a useful property of the abstraction.
+
+---
+
+# 25. Agent-only Export
+
+At the other extreme:
+
+```ts
+export default defineExportTool({
+  description: "Review a customer situation and decide what to do",
+
+  inputSchema: z.object({
+    customerId: z.string(),
+  }),
+
+  outputSchema: ReviewResult,
+
+  async execute({ customerId }, ctx) {
+    const result = await ctx.send({
+      taskMode: true,
+      message:
+        `Review customer ${customerId} according to your normal responsibilities.`,
+      outputSchema: ReviewResult,
+    });
+
+    return result.value;
+  },
+});
+```
+
+The subsystem supports both extremes without changing the external contract.
+
+---
+
+# 26. Recommended Session Semantics
+
+For RPC-style exported operations, the default SHOULD be:
+
+```text
+one remote invocation -> one fresh Eve task/session
+```
+
+Reasons:
+
+- no accidental conversational contamination;
+- deterministic ownership;
+- straightforward cancellation;
+- straightforward task/result mapping;
+- simple retry semantics.
+
+Future exported operations MAY explicitly opt into a durable conversation/session key, but this should not be the default.
+
+---
+
+# 27. Auth and Principal Mapping
+
+The integration layer should decide which Eve principal represents the remote invocation.
+
+Possible policies:
+
+```text
+service principal:
+  xmpp-agent-gateway
+
+forwarded caller:
+  agent@example.com
+
+compound principal:
+  xmpp:agent@example.com
+```
+
+The exported operation should not construct Eve authentication manually.
+
+Provide it through the `ctx.send()` adapter.
+
+---
+
+# 28. Testing
+
+## 28.1 Unit-test deterministic processing
+
+Mock `ctx.send()`.
+
+Example:
+
+```ts
+it("transcribes before invoking the agent", async () => {
+  const calls: string[] = [];
+
+  const ctx = makeTestContext({
+    recordings: {
+      fetch: async () => {
+        calls.push("fetch");
+        return recording;
+      },
+    },
+
+    audio: {
+      transcode: async () => {
+        calls.push("transcode");
+        return wav;
+      },
+    },
+
+    deepgram: {
+      transcribe: async () => {
+        calls.push("transcribe");
+        return {
+          text: "hello",
+          durationSeconds: 2,
+        };
+      },
+    },
+
+    evidence: {
+      create: async () => {
+        calls.push("evidence");
+        return { id: "ev_1" };
+      },
+    },
+
+    send: async () => {
+      calls.push("send");
+      return {
+        sessionId: "ses_1",
+        value: {
+          summary: "hello",
+          actionsTaken: [],
+        },
+      };
+    },
+  });
+
+  await handleRecording.execute(
+    { url: "https://example.com/a.mp3" },
+    ctx,
+  );
+
+  expect(calls).toEqual([
+    "fetch",
+    "transcode",
+    "transcribe",
+    "evidence",
+    "send",
+  ]);
+});
+```
+
+This test spends zero model tokens.
+
+---
+
+## 28.2 Validation test
+
+Verify invalid URLs fail before service calls:
+
+```ts
+await expect(
+  executeExportTool(
+    "handle_recording",
+    { url: "not a URL" },
+    ctx,
+  ),
+).rejects.toThrow(ExportToolValidationError);
+```
+
+---
+
+## 28.3 Deterministic-only test
+
+Verify an export can complete without calling `ctx.send()`.
+
+---
+
+## 28.4 Eve integration test
+
+Use Eve's testing/eval facilities or a deterministic mock model to assert:
+
+- the exported operation creates an Eve task;
+- the evidence ID is in the task message;
+- the local agent calls `read_evidence`;
+- CRM tools can be called;
+- a structured result is eventually returned.
+
+---
+
+## 28.5 Cancellation test
+
+Cancel while:
+
+1. fetching,
+2. transcoding,
+3. transcribing,
+4. waiting on Eve.
+
+Each should settle as `CANCELLED`.
+
+---
+
+# 29. Observability
+
+Every export invocation SHOULD log:
+
+```text
+requestId
+operation
+caller
+startTime
+endTime
+duration
+deterministic stage timings
+Eve sessionId
+result status
+error code
+```
+
+Recommended trace structure:
+
+```text
+export.handle_recording
+├── fetch
+├── transcode
+├── deepgram
+├── evidence.create
+└── eve.send
+    ├── session
+    ├── model steps
+    └── tool calls
+```
+
+Do not log full transcripts by default.
+
+---
+
+# 30. Suggested Initial Implementation Order
+
+1. Implement `defineExportTool`.
+2. Implement explicit registry.
+3. Implement Standard Schema input/output validation.
+4. Implement `ExportToolContext`.
+5. Implement XMPP invocation -> executor wiring.
+6. Implement progress and cancellation.
+7. Implement in-process Eve `send()` adapter.
+8. Implement `handle_recording`.
+9. Implement `read_evidence`.
+10. Generate gateway manifest from export schemas.
+11. Add idempotency.
+12. Add integration tests.
+13. Add structured-result compatibility shim if the selected Eve channel entry path cannot pass `outputSchema` directly.
+
+---
+
+# 31. Minimal End-to-End Example
+
+The smallest meaningful implementation is:
+
+```ts
+// agent/exports/handle_recording.ts
+
+export default defineExportTool({
+  description: "Transcribe and process a recording",
+
+  inputSchema: z.object({
+    url: z.string().url(),
+  }),
+
+  outputSchema: z.object({
+    evidenceId: z.string(),
+    summary: z.string(),
+  }),
+
+  async execute({ url }, ctx) {
+    // deterministic
+    const input = await ctx.services.recordings.fetch(url, {
+      signal: ctx.abortSignal,
+    });
+
+    const wav = await ctx.services.audio.transcode(input, {
+      sampleRate: 16_000,
+      channels: 1,
+      signal: ctx.abortSignal,
+    });
+
+    const transcript =
+      await ctx.services.deepgram.transcribe(wav, {
+        signal: ctx.abortSignal,
+      });
+
+    const evidence = await ctx.services.evidence.create({
+      type: "transcript",
+      content: transcript.text,
+    });
+
+    // agentic
+    const run = await ctx.send({
+      taskMode: true,
+
+      message:
+        `Process transcript evidence ${evidence.id}. ` +
+        `Perform appropriate follow-up actions.`,
+
+      outputSchema: z.object({
+        summary: z.string(),
+      }),
+    });
+
+    return {
+      evidenceId: evidence.id,
+      summary: run.value.summary,
+    };
+  },
+});
+```
+
+The corresponding Eve-side evidence tool:
+
+```ts
+// agent/tools/read_evidence.ts
+
+export default defineTool({
+  description: "Read stored evidence",
+
+  inputSchema: z.object({
+    id: z.string(),
+  }),
+
+  async execute({ id }) {
+    return evidence.get(id);
+  },
+});
+```
+
+And the conceptual in-process adapter:
+
+```ts
+const ctx = {
+  ...,
+
+  send: async (request) => {
+    // Adapt the currently active Eve channel/runtime `send`
+    // primitive here. Do not instantiate `eve/client`.
+
+    const session = await eveSend(
+      request.message,
+      {
+        mode: request.taskMode ? "task" : undefined,
+        title: request.title,
+      },
+    );
+
+    return collectAgentResult(
+      session,
+      request.outputSchema,
+    );
+  },
+};
+```
+
+This is the central pattern the subsystem should preserve.
+
+---
+
+# 32. Architectural Rule of Thumb
+
+Use deterministic code when the answer is procedural and known:
+
+```text
+fetch
+decode
+transcode
+hash
+parse
+validate
+call API
+persist
+```
+
+Use Eve when the operation requires judgment:
+
+```text
+interpret
+prioritize
+classify ambiguous information
+decide whether an action is warranted
+choose among tools
+compose context-sensitive communication
+delegate to another agent
+```
+
+An `exportTool` is the orchestrator that can combine both.
+
+---
+
+# 33. Eve API Notes
+
+This design intentionally stays within Eve's public concepts.
+
+Relevant current Eve behavior:
+
+- Eve tools are typed actions called by the model and receive runtime `ctx`.
+- Custom channels normalize inbound work and use an in-process `send()` path to start or resume Eve sessions.
+- Eve task-mode runs are intended for work that runs to completion rather than interactive HITL conversation.
+- Eve emits `result.completed` for turns that use structured output.
+- Eve's public TypeScript API documentation explicitly warns that APIs not exported through the public package surface are framework internals.
+- Current Eve channel/cross-channel APIs do not expose every structured-output option uniformly; therefore this specification deliberately hides Eve send mechanics behind the local `ctx.send()` adapter.
+
+Do not import private Eve workflow/session internals to implement `exportTool`.
+
+---
+
+# 34. References
+
+Eve documentation and source:
+
+- https://github.com/vercel/eve/blob/main/docs/tools/overview.mdx
+- https://github.com/vercel/eve/blob/main/docs/channels/overview.mdx
+- https://github.com/vercel/eve/blob/main/docs/channels/slack.mdx
+- https://github.com/vercel/eve/blob/main/docs/channels/eve.mdx
+- https://github.com/vercel/eve/blob/main/docs/concepts/sessions-runs-and-streaming.md
+- https://github.com/vercel/eve/blob/main/docs/reference/typescript-api.md
+- https://github.com/vercel/eve/blob/main/docs/agent-config.md
+- https://github.com/vercel/eve/blob/main/docs/schedules.mdx
+- https://github.com/vercel/eve/issues/214
+- https://github.com/vercel/eve/issues/1270
+
+XMPP gateway client reference:
+
+- https://raw.githubusercontent.com/romanbsd/xmpp-agent-gateway/refs/heads/master/docs/xmpp-client-guide.md
diff --git a/docs/exposed-api.md b/docs/exposed-api.md
new file mode 100644
index 000000000..ecb6cc282
--- /dev/null
+++ b/docs/exposed-api.md
@@ -0,0 +1,1514 @@
+# Exposed API reference
+
+This document describes the HTTP API exposed by the CRM API process.
+
+It covers authentication, authorization, tRPC, REST, native controllers, and internal routes.
+
+Verified on 2026-09-11 against the current source and generated router.
+
+> [!WARNING]
+> The process mounts more routes than the supported CRM contract.
+> Use tRPC or the REST bridge for CRM data.
+> Use Better Auth routes only for sign-in, sessions, OAuth, and SSO callbacks.
+
+> [!WARNING]
+> Conversation sharing is not anonymous in the current implementation.
+> Both the shared conversation procedure and attachment controller require authentication.
+
+> [!CAUTION]
+> Better Auth mounts organization, invitation, SAML, and API-key routes.
+> These routes do not use the CRM service authorization paths.
+> Treat them as unsupported until their policy behavior receives a separate audit.
+
+## Surface summary
+
+| Surface | Base path | Count | Primary purpose |
+| --- | --- | ---: | --- |
+| tRPC | `/api/trpc` | 173 procedures | Type-safe application data API |
+| REST bridge | Root resource paths | 171 operations | OpenAPI transport for tRPC procedures |
+| Better Auth | `/api/auth` | Version-dependent | Sign-in, sessions, OAuth, providers, and plugin endpoints |
+| Native controllers | Various paths | 18 operations | Health, profile, tracking, attachments, and cron work |
+| Swagger UI | `/` | 1 page | Interactive REST documentation |
+| OpenAPI JSON | `/openapi.json` | 1 document | Native controllers and REST bridge |
+
+The merged OpenAPI document contains 156 paths, including native controller paths and 171 REST operations.
+
+The tRPC router contains 23 namespaces.
+
+The REST bridge exposes 171 of 173 procedures. It omits `users.me` and `workspace.gate`.
+
+The native `GET /auth/me` endpoint provides the equivalent profile operation.
+
+## Choose a transport
+
+Use tRPC from the web application or another TypeScript client.
+
+Use the REST bridge from scripts and systems that use OpenAPI.
+
+Use native controllers for health, auth status, tracking intake, files, and scheduled work.
+
+Use Better Auth endpoints for authentication protocol flows.
+
+Do not use raw Better Auth organization routes as the CRM workspace API.
+
+## Quick start
+
+The local API uses `http://localhost:3001` by default.
+
+Fetch the generated OpenAPI document:
+
+```bash
+curl --fail-with-body http://localhost:3001/openapi.json
+```
+
+Check API and database health:
+
+```bash
+curl --fail-with-body http://localhost:3001/health
+```
+
+Call an authenticated REST bridge route with an API key:
+
+```bash
+curl --fail-with-body \
+  --header 'x-api-key: crm_REPLACE_WITH_KEY' \
+  http://localhost:3001/companies/options?q=acme
+```
+
+Call a REST mutation:
+
+```bash
+curl --fail-with-body \
+  --request POST \
+  --header 'content-type: application/json' \
+  --header 'x-api-key: crm_REPLACE_WITH_KEY' \
+  --data '{"name":"Acme","domain":"acme.com"}' \
+  http://localhost:3001/companies
+```
+
+Call a tRPC query with a browser session:
+
+```typescript
+const result = await trpc.companies.byId.query({ id: companyId });
+```
+
+The OpenAPI document remains the authority for serialized REST parameters.
+
+The Zod contracts remain the authority for accepted values.
+
+## Authentication
+
+### Browser sessions
+
+Better Auth owns browser sessions under `/api/auth/*`.
+
+The session cookie name is `crm.session_token`.
+
+Production enables secure cookies.
+
+`AUTH_COOKIE_DOMAIN` enables cross-subdomain cookies when configured.
+
+Sessions expire after seven days.
+
+Active sessions refresh after one day.
+
+The signed cookie cache lasts five minutes.
+
+Better Auth uses database-backed rate limiting.
+
+Trusted origins come from `APP_URL` and configured origins.
+
+Email and password authentication is disabled.
+
+Google and Microsoft social sign-in are optional.
+
+OIDC SSO providers are stored in the database.
+
+The sign-in allow-list comes from `ALLOWED_SIGN_IN`.
+
+An empty allow-list rejects every new user.
+
+A session creation hook adds the user to the singleton workspace.
+
+The first user becomes the workspace owner.
+
+### API keys
+
+API keys use the `x-api-key` request header.
+
+Generated keys use the `crm_` prefix.
+
+A key name contains between one and 64 characters.
+
+A key can expire after one through 365 days.
+
+A null expiration creates a non-expiring key.
+
+The key plugin converts a valid key into a Better Auth session.
+
+That session lets the tRPC authorization middleware identify the key owner.
+
+Most tRPC and REST bridge operations accept sessions or API keys.
+
+The `apiKeys` namespace accepts browser sessions only.
+
+Its middleware rejects every request containing `x-api-key`.
+
+Use these supported management routes:
+
+| Operation | tRPC | REST |
+| --- | --- | --- |
+| List keys | `apiKeys.list` | `GET /api-keys` |
+| Create key | `apiKeys.create` | `POST /api-keys` |
+| Revoke key | `apiKeys.revoke` | `DELETE /api-keys/{id}` |
+
+The create response returns the complete key once.
+
+Later list responses return only key metadata and the visible prefix.
+
+### Cron bearer secret
+
+Internal scheduled routes use `Authorization: Bearer <CRON_SECRET>`.
+
+They do not use browser sessions or API keys.
+
+Each route compares the complete header with a timing-safe comparison.
+
+An absent `CRON_SECRET` returns `503 Service Unavailable`.
+
+A missing or incorrect bearer value returns `403 Forbidden`.
+
+### Anonymous access
+
+The following supported operations need no session:
+
+| Method | Path | Purpose |
+| --- | --- | --- |
+| GET | `/health` | Check API and database liveness |
+| GET | `/auth/session` | Report optional session state |
+| GET | `/sso/sign-in-options` | List configured sign-in choices |
+| GET | `/api/t/config/:siteId` | Read public tracking configuration |
+| POST | `/api/t/e` | Submit tracking events |
+| GET | `/api/auth/ok` | Check Better Auth availability |
+| POST | `/api/auth/sign-in/social` | Start social sign-in |
+| POST | `/api/auth/sign-in/sso` | Start SSO sign-in |
+| GET or POST | OAuth and SSO callbacks | Complete provider authentication |
+
+Tracking collection always returns `204 No Content`.
+
+It returns 204 for accepted, rejected, and unreadable batches.
+
+This behavior prevents the collector from exposing processing details.
+
+## Authorization
+
+### Authentication middleware
+
+Every protected tRPC router uses `AuthMiddleware`.
+
+The middleware reads the Better Auth session from the request context.
+
+It returns `UNAUTHORIZED` when no session user exists.
+
+It adds the authenticated user to the tRPC context.
+
+The same middleware runs through tRPC and the REST bridge.
+
+The REST bridge does not implement a second authorization policy.
+
+Native Nest controllers use the Better Auth module guard.
+
+`@AllowAnonymous()` disables that guard for a route.
+
+`@OptionalAuth()` allows both signed-in and signed-out requests.
+
+### Workspace roles
+
+The singleton workspace has three roles.
+
+| Role | General CRM data | Workspace settings | Member roles | Currency | Tracking | SSO | Shared Slack connection |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| `owner` | Read and write | Manage | Manage | Manage | Manage | Manage | Manage |
+| `admin` | Read and write | Manage | Manage | Manage | Manage | Manage | Manage |
+| `member` | Read and write | Read | Read | Read | Read | Read | Read |
+
+The API is single tenant.
+
+CRM records do not contain an organization authorization boundary.
+
+Every authenticated workspace user can access the general CRM data surface.
+
+Owner and admin checks occur inside services.
+
+The UI permission flags do not replace service checks.
+
+### Protected management operations
+
+| Area | Restricted operations | Required role |
+| --- | --- | --- |
+| Workspace | Update name, slug, or website | Owner or admin |
+| Workspace | Change a member role | Owner or admin |
+| Currency | Change reporting currency or rates | Owner or admin |
+| Tracking | Change flags, domains, identifiers, or verification | Owner or admin |
+| SSO | Register or remove a provider | Owner or admin |
+| Slack | Connect, reconnect, or disconnect the shared workspace | Owner or admin |
+
+The workspace role change uses a transaction.
+
+It locks owner rows before it counts them.
+
+It refuses to demote the last owner.
+
+SSO list and settings reads require authentication.
+
+SSO provider registration and removal also require owner or admin status.
+
+Tracking activity reads remain available to every authenticated user.
+
+### Agent object authorization
+
+Every agent operation requires an authenticated workspace member.
+
+A private draft is visible only to its creator.
+
+A missing private draft returns `NOT_FOUND`.
+
+This response does not reveal the draft to another user.
+
+An agent creator can manage that agent.
+
+A workspace owner or admin can manage another creator's agent.
+
+Other members can read non-private agents.
+
+Other members cannot change agents that they did not create.
+
+### Record authorization
+
+Companies, contacts, deals, activities, fields, and saved views use workspace-wide access.
+
+These records have no per-user read boundary.
+
+Owner fields support assignment and filtering.
+
+Owner fields do not restrict record access.
+
+API keys act with the identity of their owning user.
+
+Service-level role checks still apply to API-key requests.
+
+### Current authorization findings
+
+The conversation sharing procedures use the protected router middleware.
+
+The attachment controller also requires a session.
+
+A share token does not provide anonymous access by itself.
+
+Raw Better Auth organization endpoints remain mounted.
+
+Those endpoints do not call `WorkspaceService`.
+
+Raw Better Auth API-key endpoints also remain mounted.
+
+Use the supported session-only `apiKeys` namespace for key management.
+
+The general settings mutations have authentication checks only.
+
+Any authenticated member or API key can change those values.
+
+## Implementing a Dart or Flutter client
+
+Use the REST bridge for Dart and Flutter applications.
+
+The bridge exposes the same validation, services, and authorization as tRPC.
+
+Do not implement the tRPC wire format in Dart.
+
+TypeScript router types do not provide Dart runtime validation.
+
+Generate Dart models from the runtime OpenAPI document instead.
+
+### Select an authentication model
+
+The API supports browser sessions, API keys, and OAuth access tokens.
+
+The OAuth server supports native Authorization Code Flow with PKCE.
+
+Choose the model from this table.
+
+| Client | Recommended credential | Current support | Main restriction |
+| --- | --- | --- | --- |
+| Flutter mobile | OAuth with PKCE | Supported | The mobile application still needs AppAuth integration |
+| Flutter desktop | OAuth with PKCE | Supported | Register an exact desktop redirect URI |
+| Flutter web | Better Auth cookie | Supported | Deployment must satisfy origin and cookie rules |
+| Public mobile distribution | Native PKCE flow | Supported | Use the registered `compcrm-flutter` client |
+| Server-side Dart | API key | Supported | The server must protect and rotate the key |
+
+Do not ship one shared API key inside the application bundle.
+
+Every installed application can extract a bundled secret.
+
+Provision a separate key for each user or managed device.
+
+Revoke only the affected key after loss or compromise.
+
+### Recommended client structure
+
+Keep transport, credentials, generated models, and application state separate.
+
+```text
+lib/
+├── api/
+│   ├── generated/
+│   ├── crm_api_client.dart
+│   ├── crm_api_error.dart
+│   └── crm_auth_interceptor.dart
+├── auth/
+│   ├── credential_store.dart
+│   ├── secure_api_key_store.dart
+│   └── session_controller.dart
+├── workspace/
+│   ├── workspace_capabilities.dart
+│   └── workspace_repository.dart
+└── features/
+```
+
+The generated package owns wire models and endpoint methods.
+
+Repositories convert wire models into application domain models.
+
+Widgets consume application state and never read credentials.
+
+One client instance must target one configured CRM origin.
+
+Never forward CRM credentials during redirects to another origin.
+
+### Generate the Dart client
+
+Fetch `/openapi.json` from the same release that the client targets.
+
+Store the document as a reviewed build input.
+
+Generate a `dart-dio` client with a pinned OpenAPI Generator release.
+
+```bash
+curl --fail-with-body \
+  https://crm.example.com/openapi.json \
+  --output api/openapi.json
+
+openapi-generator-cli generate \
+  --input-spec api/openapi.json \
+  --generator-name dart-dio \
+  --output packages/compcrm_api
+```
+
+Do not edit generated files manually.
+
+Regenerate them when `/openapi.json` changes.
+
+Review model nullability, date values, enums, and operation names after generation.
+
+Fail continuous integration when regeneration changes committed output.
+
+The runtime document can change without a committed OpenAPI artifact.
+
+Capture the document from the deployed version before releasing the client.
+
+Use an injected `http.Client` for a small prototype.
+
+Use generated code for a maintained application.
+
+### Store an API key
+
+Use platform secure storage for native Flutter applications.
+
+Do not use `SharedPreferences`, source constants, assets, logs, or analytics properties.
+
+The `flutter_secure_storage` package provides a common Keychain and Keystore interface.
+
+Wrap the package behind a small application interface.
+
+```dart
+abstract interface class CredentialStore {
+  Future<String?> readApiKey();
+  Future<void> writeApiKey(String value);
+  Future<void> deleteApiKey();
+}
+```
+
+```dart
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+
+final class SecureApiKeyStore implements CredentialStore {
+  SecureApiKeyStore(this._storage);
+
+  static const _key = 'compcrm_api_key';
+  final FlutterSecureStorage _storage;
+
+  @override
+  Future<String?> readApiKey() => _storage.read(key: _key);
+
+  @override
+  Future<void> writeApiKey(String value) {
+    return _storage.write(key: _key, value: value);
+  }
+
+  @override
+  Future<void> deleteApiKey() => _storage.delete(key: _key);
+}
+```
+
+Disable Android backup for storage that contains the wrapped key.
+
+Configure iOS Keychain accessibility for the required background behavior.
+
+Require device authentication before high-risk operations when the product needs that control.
+
+Flutter web must not treat browser storage as a secure secret vault.
+
+Use the Better Auth cookie model for Flutter web.
+
+### Attach the API key
+
+Add `x-api-key` only to requests for the configured CRM origin.
+
+Do not add the key to Better Auth sign-in requests.
+
+Do not add the key to image URLs or external attachment redirects.
+
+```dart
+import 'package:dio/dio.dart';
+
+abstract interface class ApiKeyProvider {
+  String? get apiKey;
+}
+
+final class CrmApiKeyInterceptor extends Interceptor {
+  CrmApiKeyInterceptor({
+    required this.apiKeys,
+    required this.crmOrigin,
+  });
+
+  final ApiKeyProvider apiKeys;
+  final Uri crmOrigin;
+
+  @override
+  void onRequest(
+    RequestOptions options,
+    RequestInterceptorHandler handler,
+  ) {
+    final request = options.uri;
+    final sameOrigin = request.origin == crmOrigin.origin;
+
+    if (sameOrigin) {
+      final apiKey = apiKeys.apiKey;
+      if (apiKey != null && apiKey.isNotEmpty) {
+        options.headers['x-api-key'] = apiKey;
+      }
+    }
+
+    handler.next(options);
+  }
+}
+```
+
+Load the secure value before constructing authenticated repositories.
+
+Keep the loaded value only inside the authentication controller.
+
+Construct `Dio` with a fixed HTTPS base URL in production.
+
+Reject cleartext production URLs during application configuration.
+
+Disable request-header logging for authenticated requests.
+
+Redact `x-api-key`, `cookie`, and `set-cookie` in every diagnostic sink.
+
+### Bootstrap identity and capabilities
+
+Call `GET /workspace` after loading a credential.
+
+This operation accepts a browser session or API key.
+
+It returns the workspace and the viewer's role.
+
+It also returns `canRename` and `canChangeRoles` capabilities.
+
+```dart
+enum WorkspaceRole { owner, admin, member }
+
+final class WorkspaceCapabilities {
+  const WorkspaceCapabilities({
+    required this.role,
+    required this.canRename,
+    required this.canChangeRoles,
+  });
+
+  final WorkspaceRole? role;
+  final bool canRename;
+  final bool canChangeRoles;
+
+  bool get canManageWorkspace =>
+      role == WorkspaceRole.owner || role == WorkspaceRole.admin;
+}
+```
+
+Use server capability fields when the response provides them.
+
+Centralize any temporary role mapping in one domain module.
+
+Do not repeat role comparisons inside widgets.
+
+The server remains the authorization authority.
+
+Local capability checks control presentation only.
+
+Every mutation must still handle `403 Forbidden`.
+
+Do not send an organization identifier or tenant header.
+
+The API resolves the fixed singleton workspace internally.
+
+### Handle authentication state
+
+Model authentication as explicit states.
+
+| State | Meaning | Allowed action |
+| --- | --- | --- |
+| `unknown` | Secure storage has not completed | Show startup progress |
+| `signedOut` | No credential exists | Show provisioning instructions |
+| `checking` | The client validates a credential | Block protected mutations |
+| `signedIn` | Workspace bootstrap succeeded | Load protected data |
+| `forbidden` | Authentication succeeded without required permission | Keep the credential and explain access |
+| `expired` | The server rejected the credential | Delete the credential and sign out |
+| `offline` | The server is unreachable | Show cached data under local policy |
+
+Do not treat every network failure as a sign-out.
+
+Only an authentication response invalidates the local credential.
+
+A `403` response does not invalidate authentication.
+
+A timeout does not prove credential failure.
+
+Validate the stored key through a protected REST request at startup.
+
+Use `GET /workspace` for this check.
+
+### Map API failures
+
+Convert transport failures into one sealed application error hierarchy.
+
+| HTTP result | Client meaning | Recommended action |
+| ---: | --- | --- |
+| 400 | Invalid client input | Display field or request feedback |
+| 401 | Missing, revoked, or invalid credential | Delete the key and require provisioning |
+| 403 | Authenticated user lacks permission | Preserve the key and disable that action |
+| 404 | Resource is absent or unavailable | Close stale detail state and refresh its list |
+| 409 | A domain conflict exists | Refresh the record and show the conflict |
+| 429 | The server rate limit applies | Respect `Retry-After` and delay further calls |
+| 500–599 | The server failed | Preserve state and offer a bounded retry |
+| Network failure | Connectivity failed | Preserve credentials and expose offline state |
+
+Do not display raw server stacks or database messages.
+
+Keep a request identifier when the response exposes one.
+
+Never include credentials or full response bodies in crash reports.
+
+### Retry safely
+
+Retry idempotent reads after transient network failures.
+
+Use capped exponential backoff with random jitter.
+
+Respect `Retry-After` for rate-limit responses.
+
+Do not retry create, update, archive, purge, or bulk mutations automatically.
+
+A retry can repeat a completed mutation after a lost response.
+
+Require an explicit user retry for those operations.
+
+Cancel in-flight list requests when a newer filter replaces them.
+
+Use server pagination instead of downloading complete collections.
+
+### Cache without weakening authorization
+
+Partition cached records by API origin and authenticated identity.
+
+Do not reuse one user's cache after credential replacement.
+
+Clear sensitive cached records during sign-out.
+
+Encrypt sensitive offline data when the product retains it.
+
+Do not infer authorization from previously cached roles.
+
+Refresh workspace capabilities after sign-in and role-related `403` responses.
+
+Keep optimistic updates reversible.
+
+Restore previous state when the server rejects a mutation.
+
+### Support Flutter web
+
+Use same-origin deployment when possible.
+
+The browser then manages the Better Auth cookie.
+
+Cross-origin deployments require correct trusted origins, CORS, HTTPS, and credentialed requests.
+
+Never copy the session cookie into Dart application storage.
+
+Do not expose `crm.session_token` to application JavaScript.
+
+Use `/auth/session` to check optional browser authentication.
+
+Use `/auth/me` to read the signed-in profile.
+
+Call `/workspace` to load role and capability data.
+
+### Recommended authentication target
+
+OAuth with PKCE is the supported native credential for public applications.
+
+The CRM already authenticates browser users through Better Auth.
+
+It also accepts Google, Microsoft, and stored OIDC SSO providers.
+
+These integrations make CRM an OAuth client.
+
+They do not make CRM an OAuth authorization server.
+
+Add Better Auth's OAuth 2.1 Provider plugin for native and third-party clients.
+
+Do not build custom authorization and token endpoints.
+
+The provider supports OAuth discovery, OIDC, PKCE, refresh tokens, revocation, audiences, and JWKS.
+
+Keep browser sessions for the web application.
+
+Keep API keys for scripts and controlled server integrations.
+
+Use OAuth access tokens for public Flutter applications.
+
+Do not use Better Auth's bearer-session plugin as the final mobile protocol.
+
+That plugin transports a session token but does not create an OAuth authorization contract.
+
+Do not accept upstream provider tokens directly.
+
+Google, Microsoft, and enterprise tokens target their own audiences and policies.
+
+CompCRM must issue one consistent access token after upstream authentication.
+
+### OAuth implementation status
+
+The CRM now provides these capabilities.
+
+| Capability | Current implementation |
+| --- | --- |
+| OAuth authorization server | Better Auth OAuth Provider runs under `/api/auth` |
+| OIDC discovery | The issuer publishes OpenID Connect metadata and JWKS |
+| Official mobile client | Startup reconciles public client `compcrm-flutter` |
+| PKCE authorization | The native client requires Authorization Code and PKCE |
+| CRM access tokens | Tokens use the `${API_URL}/api` audience |
+| Bearer validation | One request-principal service verifies access tokens |
+| Scope enforcement | Queries require `crm.read`; mutations require `crm.write` |
+| Refresh lifecycle | Refresh tokens rotate with a 30-second reuse interval |
+| OpenAPI security | Cookie, API-key, and bearer alternatives are documented |
+| OAuth integration tests | Tests cover discovery, challenges, mixed credentials, and OpenAPI |
+
+The Better Auth runtime and plugins use version `1.7.2`.
+
+The Better Auth CLI package `auth` uses version `1.7.2`.
+
+Device-session management remains future work.
+
+### Recommended server design
+
+Use CompCRM's Better Auth installation as the authorization server.
+
+Add the Better Auth JWT and OAuth 2.1 Provider plugins.
+
+Disable the standalone JWT token endpoint when OAuth Provider owns token issuance.
+
+Disable automatic JWT response headers for the same reason.
+
+Apply the required Better Auth schema migration.
+
+Review the generated migration before applying it.
+
+Register Flutter as a public client.
+
+Set its token authentication method to `none`.
+
+Do not assign a client secret to Flutter.
+
+Require Authorization Code with S256 PKCE.
+
+Disable dynamic client registration.
+
+Register each production redirect URI exactly.
+
+Use claimed HTTPS links instead of custom schemes when platform support permits them.
+
+Configure one protected resource identifier for the CRM REST API.
+
+Use that resource identifier as the access-token audience.
+
+Define these initial scopes.
+
+| Scope | Purpose |
+| --- | --- |
+| `openid` | Request OIDC identity |
+| `profile` | Request basic profile claims |
+| `email` | Request the signed-in email claim |
+| `offline_access` | Request refresh-token issuance |
+| `crm.read` | Read CRM resources |
+| `crm.write` | Change CRM resources |
+
+Keep scopes coarse and client-focused.
+
+Keep workspace roles fine-grained and user-focused.
+
+An access token must satisfy both checks.
+
+For example, `crm.write` allows a write-capable client.
+
+The user's current workspace role still decides administrative access.
+
+Do not encode owner or admin authority as a durable token claim.
+
+A role can change before the token expires.
+
+Resolve workspace membership and role from current server data.
+
+Keep API-key management browser-session-only.
+
+Do not enable client credentials during the first OAuth phase.
+
+Client credentials need a service-principal model that does not exist today.
+
+Never represent a machine client as a synthetic user.
+
+### Verify bearer tokens in the API
+
+Create one OAuth verification boundary before controller or tRPC authorization.
+
+Use Better Auth's `verifyAccessTokenRequest` resource-server API.
+
+Validate these values for every bearer request.
+
+| Value | Required check |
+| --- | --- |
+| Signature | Verify against the provider JWKS |
+| `iss` | Match the configured CompCRM issuer exactly |
+| `aud` | Match the CRM resource identifier exactly |
+| `exp` | Reject expired access tokens |
+| `nbf` | Reject tokens that are not active |
+| `sub` | Resolve an existing CompCRM user |
+| `scope` | Require the procedure's read or write scope |
+
+Reject opaque bearer values during the first implementation.
+
+JWT validation avoids an introspection request for every API call.
+
+Map the verified subject into the existing authenticated context.
+
+Then run the existing service and role authorization.
+
+Do not create a second authorization policy inside the verifier.
+
+Return a standards-compliant bearer challenge for invalid tokens.
+
+Preserve current cookie and API-key behavior during migration.
+
+The three credential types must converge on one authenticated user context.
+
+```mermaid
+sequenceDiagram
+    participant Flutter
+    participant Browser
+    participant Auth as Better Auth OAuth Provider
+    participant API as CRM REST API
+    participant Services as CRM Services
+
+    Flutter->>Browser: Authorization request with state and PKCE
+    Browser->>Auth: Google, Microsoft, or enterprise sign-in
+    Auth-->>Flutter: Authorization code through claimed link
+    Flutter->>Auth: Code exchange with PKCE verifier
+    Auth-->>Flutter: Access, ID, and refresh tokens
+    Flutter->>API: Bearer access token
+    API->>API: Verify signature, issuer, audience, and scope
+    API->>Services: User identity and current workspace context
+    Services-->>Flutter: Role-authorized response
+```
+
+### Implement the Flutter OIDC flow
+
+Use `flutter_appauth` for Android, iOS, and macOS.
+
+It uses the system browser and supports discovery, Authorization Code, and PKCE.
+
+Configure the CRM issuer, public client identifier, redirect URI, resource, and scopes.
+
+Read authorization and token endpoints from OIDC discovery.
+
+Do not hardcode provider-specific Google or Microsoft endpoints.
+
+Request `openid`, `profile`, `email`, `offline_access`, `crm.read`, and `crm.write`.
+
+Use the access token in `Authorization: Bearer <token>`.
+
+Never send the ID token to the REST API.
+
+Keep the current access token in memory.
+
+Store the rotated refresh token in platform secure storage.
+
+Store only the minimum identity data required for startup presentation.
+
+Serialize refresh operations through one in-flight operation.
+
+Retry one failed request after a successful refresh.
+
+Do not create a refresh loop after another `401` response.
+
+Delete tokens after `invalid_grant`, explicit sign-out, or device revocation.
+
+Treat user cancellation as a normal signed-out result.
+
+Do not use an embedded web view for sign-in.
+
+Do not send tokens through application links.
+
+Only the short-lived authorization code returns through the link.
+
+### Roll out OAuth safely
+
+Implement the work in bounded phases.
+
+1. The CRM aligns Better Auth runtime packages.
+2. The CRM adds provider plugins, migrations, discovery, and the public client.
+3. The CRM adds bearer verification and OpenAPI bearer security.
+4. The CRM enforces `crm.read` and `crm.write` before service authorization.
+5. The Flutter application adds AppAuth sign-in, secure refresh, and sign-out.
+6. A later CRM change adds device-session management and revocation.
+7. API keys remain available for automation.
+
+Do not remove cookie sessions or API keys during the first release.
+
+Run old and new authentication paths through the same authorization tests.
+
+### OAuth and OIDC references
+
+- [Better Auth OAuth 2.1 Provider](https://better-auth.com/docs/plugins/oauth-provider)
+- [Better Auth resource-server verification](https://better-auth.com/docs/plugins/oauth-provider#api-server)
+- [Better Auth JWT plugin](https://better-auth.com/docs/plugins/jwt)
+- [Better Auth bearer-session plugin](https://better-auth.com/docs/plugins/bearer)
+- [Flutter AppAuth package](https://pub.dev/packages/flutter_appauth)
+
+### Test the Flutter integration
+
+Use an injected HTTP client in unit tests.
+
+Test these cases before release.
+
+| Test | Expected result |
+| --- | --- |
+| Request targets the CRM origin | The client adds `x-api-key` |
+| Request targets another origin | The client omits `x-api-key` |
+| Credential storage returns null | The client enters `signedOut` |
+| Workspace bootstrap returns 401 | The client deletes the stored key |
+| Workspace bootstrap returns 403 | The client preserves the stored key |
+| A member opens management UI | Restricted controls stay disabled |
+| The server returns 429 | The client respects `Retry-After` |
+| A mutation loses its response | The client does not retry automatically |
+| The OpenAPI document changes | Generated client drift fails continuous integration |
+| Logging captures a request | Credential headers remain redacted |
+| Discovery reports the wrong issuer | The authentication test fails |
+| A public client omits PKCE | The authorization request fails |
+| An access token has another audience | The REST request returns 401 |
+| An access token lacks `crm.read` | A protected read returns 403 |
+| A refresh token is reused | The token family follows the configured reuse policy |
+| A device session is revoked | Its next refresh fails |
+
+Run an integration test against the current API release.
+
+Use a dedicated test user and a short-lived API key.
+
+Revoke that key after the test suite.
+
+Never use a production owner key in automated tests.
+
+### Platform requirements
+
+Android applications need the `INTERNET` permission.
+
+macOS applications need the network client entitlement.
+
+iOS and Android builds need secure storage configuration.
+
+Production applications must use HTTPS.
+
+Development cleartext exceptions must target local development hosts only.
+
+### Flutter implementation references
+
+- [Flutter networking guidance](https://docs.flutter.dev/data-and-backend/networking)
+- [Flutter authenticated request example](https://docs.flutter.dev/cookbook/networking/authenticated-requests)
+- [OpenAPI Generator Dart Dio documentation](https://openapi-generator.tech/docs/generators/dart-dio/)
+- [Flutter secure storage package](https://pub.dev/packages/flutter_secure_storage)
+
+## Request validation and errors
+
+tRPC inputs use Zod schemas.
+
+The REST bridge uses the same schemas and services.
+
+Native DTO validation removes unknown properties.
+
+Native DTO validation also rejects non-whitelisted properties.
+
+The global pipe enables implicit type conversion.
+
+List procedures filter, sort, and paginate inside Prisma.
+
+Typical list responses use this shape:
+
+```json
+{
+  "rows": [],
+  "total": 0,
+  "facetCounts": {}
+}
+```
+
+Domain services throw Nest HTTP exceptions.
+
+The tRPC domain middleware maps selected statuses.
+
+| HTTP status | tRPC code |
+| ---: | --- |
+| 400 | `BAD_REQUEST` |
+| 401 | `UNAUTHORIZED` |
+| 403 | `FORBIDDEN` |
+| 404 | `NOT_FOUND` |
+| 409 | `CONFLICT` |
+| 429 | `TOO_MANY_REQUESTS` |
+| Other | `INTERNAL_SERVER_ERROR` |
+
+Zod errors receive readable messages.
+
+Do not depend on internal stack traces or database error text.
+
+## OpenAPI behavior
+
+Swagger UI is available at `/`.
+
+The JSON document is available at `/openapi.json`.
+
+The document is built at runtime.
+
+It merges Nest controller metadata with the tRPC REST bridge.
+
+The document does not come from a committed artifact.
+
+Router changes therefore change the runtime document.
+
+Every `restMeta` call defaults to protected.
+
+Only `sso.signInOptions` sets `protect: false`.
+
+All tRPC REST metadata uses root resource paths.
+
+The document contains no tRPC REST compatibility aliases.
+
+The document declares three security schemes.
+
+| Scheme | Location | Name |
+| --- | --- | --- |
+| Cookie | Cookie header | `crm.session_token` |
+| API key | Header | `x-api-key` |
+| OAuth bearer | Authorization header | `Bearer <access_token>` |
+
+Better Auth owns its routes independently.
+
+Its full mounted route set is larger than the Swagger-supported CRM contract.
+
+## Native controller inventory
+
+| Method | Path | Access | Purpose | OpenAPI |
+| --- | --- | --- | --- | --- |
+| GET | `/auth/me` | Session | Read the current user profile | Included |
+| GET | `/auth/session` | Optional session | Read session state | Included |
+| GET | `/health` | Public | Check API and database | Included |
+| GET | `/api/conversations/attachments/:id` | Session | Download an attachment | Included |
+| GET | `/api/t/config/:siteId` | Public | Read tracking configuration | Included |
+| POST | `/api/t/e` | Public | Collect tracking events | Included |
+| GET | `/internal/sync/mailboxes` | Cron bearer | Run due mailbox work | Included |
+| POST | `/internal/sync/mailboxes` | Cron bearer | Legacy scheduler method | Excluded |
+| GET | `/internal/sync/google` | Cron bearer | Mailbox alias | Included |
+| POST | `/internal/sync/google` | Cron bearer | Legacy mailbox alias | Excluded |
+| GET | `/internal/sync/rates` | Cron bearer | Refresh exchange rates | Included |
+| POST | `/internal/sync/rates` | Cron bearer | Legacy scheduler method | Excluded |
+| GET | `/internal/telemetry/rollup` | Cron bearer | Roll up telemetry | Included |
+| POST | `/internal/telemetry/rollup` | Cron bearer | Legacy scheduler method | Excluded |
+| GET | `/internal/archive/prune` | Cron bearer | Purge expired archives | Included |
+| POST | `/internal/archive/prune` | Cron bearer | Legacy scheduler method | Excluded |
+| GET | `/internal/tracking/retention` | Cron bearer | Sweep tracking data | Included |
+| POST | `/internal/tracking/retention` | Cron bearer | Legacy scheduler method | Excluded |
+
+The attachment endpoint accepts an optional `share` query parameter.
+
+The global session guard still runs before the controller method.
+
+## Better Auth mounted route inventory
+
+This table reports the Better Auth paths that CompCRM uses or exposes intentionally.
+
+A mounted path is not always enabled or supported.
+
+Email-password operations remain mounted but reject their disabled flow.
+
+Organization creation and deletion are disabled by configuration.
+
+The CRM product supports OIDC SSO configuration through `sso.*`.
+
+The SAML protocol routes come from the Better Auth SSO plugin.
+
+| Method | Path | Better Auth operation |
+| --- | --- | --- |
+| POST | `/api/auth/sign-in/social` | `signInSocial` |
+| GET / POST | `/api/auth/callback/:id` | `callbackOAuth` |
+| GET / POST | `/api/auth/get-session` | `getSession` |
+| POST | `/api/auth/sign-out` | `signOut` |
+| POST | `/api/auth/sign-up/email` | `signUpEmail` |
+| POST | `/api/auth/sign-in/email` | `signInEmail` |
+| POST | `/api/auth/reset-password` | `resetPassword` |
+| POST | `/api/auth/verify-password` | `verifyPassword` |
+| GET | `/api/auth/verify-email` | `verifyEmail` |
+| POST | `/api/auth/send-verification-email` | `sendVerificationEmail` |
+| POST | `/api/auth/change-email` | `changeEmail` |
+| POST | `/api/auth/change-password` | `changePassword` |
+| POST | `/api/auth/update-session` | `updateSession` |
+| POST | `/api/auth/update-user` | `updateUser` |
+| POST | `/api/auth/delete-user` | `deleteUser` |
+| POST | `/api/auth/request-password-reset` | `requestPasswordReset` |
+| GET | `/api/auth/reset-password/:token` | `requestPasswordResetCallback` |
+| GET | `/api/auth/list-sessions` | `listSessions` |
+| POST | `/api/auth/revoke-session` | `revokeSession` |
+| POST | `/api/auth/revoke-sessions` | `revokeSessions` |
+| POST | `/api/auth/revoke-other-sessions` | `revokeOtherSessions` |
+| POST | `/api/auth/link-social` | `linkSocialAccount` |
+| GET | `/api/auth/list-accounts` | `listUserAccounts` |
+| GET | `/api/auth/delete-user/callback` | `deleteUserCallback` |
+| POST | `/api/auth/unlink-account` | `unlinkAccount` |
+| POST | `/api/auth/refresh-token` | `refreshToken` |
+| POST | `/api/auth/get-access-token` | `getAccessToken` |
+| GET | `/api/auth/account-info` | `accountInfo` |
+| POST | `/api/auth/organization/create` | `createOrganization` |
+| POST | `/api/auth/organization/update` | `updateOrganization` |
+| POST | `/api/auth/organization/delete` | `deleteOrganization` |
+| POST | `/api/auth/organization/set-active` | `setActiveOrganization` |
+| GET | `/api/auth/organization/get-full-organization` | `getFullOrganization` |
+| GET | `/api/auth/organization/list` | `listOrganizations` |
+| POST | `/api/auth/organization/invite-member` | `createInvitation` |
+| POST | `/api/auth/organization/cancel-invitation` | `cancelInvitation` |
+| POST | `/api/auth/organization/accept-invitation` | `acceptInvitation` |
+| GET | `/api/auth/organization/get-invitation` | `getInvitation` |
+| POST | `/api/auth/organization/reject-invitation` | `rejectInvitation` |
+| GET | `/api/auth/organization/list-invitations` | `listInvitations` |
+| GET | `/api/auth/organization/get-active-member` | `getActiveMember` |
+| POST | `/api/auth/organization/check-slug` | `checkOrganizationSlug` |
+| POST | `/api/auth/organization/remove-member` | `removeMember` |
+| POST | `/api/auth/organization/update-member-role` | `updateMemberRole` |
+| POST | `/api/auth/organization/leave` | `leaveOrganization` |
+| GET | `/api/auth/organization/list-user-invitations` | `listUserInvitations` |
+| GET | `/api/auth/organization/list-members` | `listMembers` |
+| GET | `/api/auth/organization/get-active-member-role` | `getActiveMemberRole` |
+| POST | `/api/auth/organization/has-permission` | `hasPermission` |
+| GET | `/api/auth/sso/saml2/sp/metadata` | `spMetadata` |
+| POST | `/api/auth/sso/register` | `registerSSOProvider` |
+| POST | `/api/auth/sign-in/sso` | `signInSSO` |
+| GET | `/api/auth/sso/callback/:providerId` | `callbackSSO` |
+| GET | `/api/auth/sso/callback` | `callbackSSOShared` |
+| GET / POST | `/api/auth/sso/saml2/callback/:providerId` | `callbackSSOSAML` |
+| POST | `/api/auth/sso/saml2/sp/acs/:providerId` | `acsEndpoint` |
+| GET / POST | `/api/auth/sso/saml2/sp/slo/:providerId` | `sloEndpoint` |
+| POST | `/api/auth/sso/saml2/logout/:providerId` | `initiateSLO` |
+| GET | `/api/auth/sso/providers` | `listSSOProviders` |
+| GET | `/api/auth/sso/get-provider` | `getSSOProvider` |
+| POST | `/api/auth/sso/update-provider` | `updateSSOProvider` |
+| POST | `/api/auth/sso/delete-provider` | `deleteSSOProvider` |
+| POST | `/api/auth/api-key/create` | `createApiKey` |
+| GET | `/api/auth/api-key/get` | `getApiKey` |
+| POST | `/api/auth/api-key/update` | `updateApiKey` |
+| POST | `/api/auth/api-key/delete` | `deleteApiKey` |
+| GET | `/api/auth/api-key/list` | `listApiKeys` |
+| GET | `/api/auth/oauth2/authorize` | `oauth2Authorize` |
+| POST | `/api/auth/oauth2/token` | `oauth2Token` |
+| POST | `/api/auth/oauth2/consent` | `oauth2Consent` |
+| POST | `/api/auth/oauth2/continue` | `oauth2Continue` |
+| GET / POST | `/api/auth/oauth2/userinfo` | `oauth2UserInfo` |
+| POST | `/api/auth/oauth2/introspect` | `oauth2Introspect` |
+| POST | `/api/auth/oauth2/revoke` | `oauth2Revoke` |
+| GET / POST | `/api/auth/oauth2/end-session` | `oauth2EndSession` |
+| GET / POST | `/api/auth/oauth2/end-session/confirm` | `oauth2EndSessionConfirmation` |
+| GET | `/api/auth/.well-known/openid-configuration` | `getOpenIdConfig` |
+| GET | `/api/auth/.well-known/oauth-authorization-server` | `getOAuthServerConfig` |
+| GET | `/api/auth/jwks` | `getJwks` |
+| GET | `/api/auth/ok` | `ok` |
+| GET | `/api/auth/error` | `error` |
+
+## tRPC and REST bridge inventory
+
+The access values use these meanings.
+
+| Access value | Meaning |
+| --- | --- |
+| `public` | No session or API key |
+| `session-only` | Browser session required |
+| `session-or-api-key` | Browser session, valid `x-api-key`, or OAuth access token |
+
+The input and output names refer to Zod schemas in router contract modules.
+
+
+### `activities`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `activities.timeline` | query | `GET /activities` | `timelineInput` | `timelineOutput` | session-or-api-key |
+| `activities.timelineCounts` | query | `GET /activities/counts` | `timelineCountsInput` | `timelineCountsOutput` | session-or-api-key |
+| `activities.myTasks` | query | `GET /activities/my-tasks` | `myTasksInput` | `myTasksOutput` | session-or-api-key |
+| `activities.create` | mutation | `POST /activities` | `activityCreateInput` | `activityCreateOutput` | session-or-api-key |
+| `activities.complete` | mutation | `PATCH /activities/{id}/complete` | `completeInput` | `completeOutput` | session-or-api-key |
+
+### `agents`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `agents.list` | query | `GET /agents` | `none` | `agentListOutput` | session-or-api-key |
+| `agents.revise` | mutation | `POST /agents/{id}/revise` | `agentReviseInput` | `agentReviseOutput` | session-or-api-key |
+| `agents.files` | query | `GET /agents/{id}/files` | `agentIdInput` | `agentFilesOutput` | session-or-api-key |
+| `agents.saveFile` | mutation | `POST /agents/{id}/save-file` | `agentSaveFileInput` | `agentSaveFileOutput` | session-or-api-key |
+| `agents.byId` | query | `GET /agents/{id}` | `agentIdInput` | `agentByIdOutput` | session-or-api-key |
+| `agents.history` | query | `GET /agents/{id}/history` | `agentHistoryInput` | `agentHistoryOutput` | session-or-api-key |
+| `agents.activity` | query | `GET /agents/{id}/activity` | `agentHistoryInput` | `agentActivityOutput` | session-or-api-key |
+| `agents.update` | mutation | `PATCH /agents/{id}` | `agentUpdateInput` | `agentUpdateOutput` | session-or-api-key |
+| `agents.deploy` | mutation | `POST /agents/{id}/deploy` | `agentDeployInput` | `agentDeployOutput` | session-or-api-key |
+| `agents.pause` | mutation | `POST /agents/{id}/pause` | `agentIdInput` | `agentPauseOutput` | session-or-api-key |
+| `agents.resume` | mutation | `POST /agents/{id}/resume` | `agentIdInput` | `agentResumeOutput` | session-or-api-key |
+| `agents.archive` | mutation | `POST /agents/{id}/archive` | `agentIdInput` | `agentArchiveOutput` | session-or-api-key |
+| `agents.restore` | mutation | `POST /agents/{id}/restore` | `agentIdInput` | `agentRestoreOutput` | session-or-api-key |
+| `agents.remove` | mutation | `DELETE /agents/{id}` | `agentIdInput` | `agentRemoveOutput` | session-or-api-key |
+| `agents.runNow` | mutation | `POST /agents/{id}/run` | `agentRunNowInput` | `agentRunNowOutput` | session-or-api-key |
+| `agents.retryRun` | mutation | `POST /agents/{id}/runs/{runId}/retry` | `agentRetryRunInput` | `agentRetryRunOutput` | session-or-api-key |
+| `agents.cancelRun` | mutation | `POST /agents/{id}/runs/{runId}/cancel` | `agentCancelRunInput` | `agentCancelRunOutput` | session-or-api-key |
+
+### `apiKeys`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `apiKeys.list` | query | `GET /api-keys` | `apiKeyListInput` | `apiKeyListOutput` | session-only |
+| `apiKeys.create` | mutation | `POST /api-keys` | `createApiKeyInput` | `createApiKeyOutput` | session-only |
+| `apiKeys.revoke` | mutation | `DELETE /api-keys/{id}` | `revokeApiKeyInput` | `revokeApiKeyOutput` | session-only |
+
+### `appointments`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `appointments.createAppointment` | mutation | `POST /projects/{projectId}/appointments` | `projectAppointmentCreateInput` | `appointmentDetailSchema` | session-or-api-key |
+| `appointments.listAppointments` | query | `GET /projects/{projectId}/appointments` | `projectAppointmentListInput` | `appointmentListSchema` | session-or-api-key |
+| `appointments.getAppointment` | query | `GET /projects/{projectId}/appointments/{appointmentId}` | `projectAppointmentInput` | `appointmentDetailSchema` | session-or-api-key |
+| `appointments.updateAppointment` | mutation | `PATCH /projects/{projectId}/appointments/{appointmentId}` | `projectAppointmentUpdateInput` | `appointmentDetailSchema` | session-or-api-key |
+| `appointments.archiveAppointment` | mutation | `DELETE /projects/{projectId}/appointments/{appointmentId}` | `projectAppointmentInput` | `appointmentArchiveSchema` | session-or-api-key |
+
+### `assets`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `assets.createProjectAsset` | mutation | `POST /projects/{projectId}/assets` | `projectAssetCreateInput` | `assetCreationSchema` | session-or-api-key |
+| `assets.createAppointmentAsset` | mutation | `POST /appointments/{appointmentId}/assets` | `appointmentAssetCreateInput` | `assetCreationSchema` | session-or-api-key |
+| `assets.listProjectAssets` | query | `GET /projects/{projectId}/assets` | `projectAssetListInput` | `assetListSchema` | session-or-api-key |
+| `assets.listAppointmentAssets` | query | `GET /appointments/{appointmentId}/assets` | `appointmentAssetListInput` | `assetListSchema` | session-or-api-key |
+| `assets.getAsset` | query | `GET /assets/{assetId}` | `assetMemberInput` | `assetDetailSchema` | session-or-api-key |
+| `assets.updateAsset` | mutation | `PATCH /assets/{assetId}` | `assetUpdateInput` | `assetDetailSchema` | session-or-api-key |
+| `assets.deleteAsset` | mutation | `DELETE /assets/{assetId}` | `assetMemberInput` | `assetDeletionSchema` | session-or-api-key |
+
+### `companies`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `companies.list` | query | `POST /companies/search` | `companyListInput` | `companyListOutput` | session-or-api-key |
+| `companies.byId` | query | `GET /companies/{id}` | `companyIdInput` | `companyDetailOutput` | session-or-api-key |
+| `companies.options` | query | `GET /companies/options` | `companyOptionsInput` | `companyOptionOutput` | session-or-api-key |
+| `companies.create` | mutation | `POST /companies` | `companyCreateInput` | `companySummaryOutput` | session-or-api-key |
+| `companies.update` | mutation | `PATCH /companies/{id}` | `companyUpdateArgs` | `companySummaryOutput` | session-or-api-key |
+| `companies.archive` | mutation | `POST /companies/{id}/archive` | `companyIdInput` | `companyArchiveResultOutput` | session-or-api-key |
+| `companies.restore` | mutation | `POST /companies/{id}/restore` | `companyIdInput` | `companyArchiveResultOutput` | session-or-api-key |
+| `companies.purge` | mutation | `DELETE /companies/{id}` | `companyIdInput` | `companyArchiveResultOutput` | session-or-api-key |
+| `companies.bulkAssignOwner` | mutation | `POST /companies/bulk-assign-owner` | `companyBulkOwnerInput` | `companyBulkResultOutput` | session-or-api-key |
+| `companies.bulkEnrich` | mutation | `POST /companies/bulk-enrich` | `companyBulkInput` | `companyBulkResultOutput` | session-or-api-key |
+| `companies.bulkArchive` | mutation | `POST /companies/bulk-archive` | `companyBulkInput` | `companyBulkResultOutput` | session-or-api-key |
+| `companies.bulkRestore` | mutation | `POST /companies/bulk-restore` | `companyBulkInput` | `companyBulkResultOutput` | session-or-api-key |
+| `companies.bulkPurge` | mutation | `POST /companies/bulk-purge` | `companyBulkInput` | `companyBulkResultOutput` | session-or-api-key |
+| `companies.enrich` | mutation | `POST /companies/{id}/enrich` | `companyIdInput` | `companyEnrichOutput` | session-or-api-key |
+| `companies.research` | mutation | `POST /companies/{id}/research` | `companyIdInput` | `companyResearchOutput` | session-or-api-key |
+| `companies.setPrimaryContact` | mutation | `POST /companies/{companyId}/set-primary-contact` | `setPrimaryContactInput` | `companySetPrimaryContactOutput` | session-or-api-key |
+
+### `contacts`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `contacts.list` | query | `POST /contacts/search` | `contactListInput` | `contactListOutput` | session-or-api-key |
+| `contacts.byId` | query | `GET /contacts/{id}` | `contactIdInput` | `contactByIdOutput` | session-or-api-key |
+| `contacts.create` | mutation | `POST /contacts` | `contactCreateInput` | `contactBasicOutput` | session-or-api-key |
+| `contacts.update` | mutation | `PATCH /contacts/{id}` | `contactUpdateArgs` | `contactBasicOutput` | session-or-api-key |
+| `contacts.archive` | mutation | `POST /contacts/{id}/archive` | `contactIdInput` | `contactNameOutput` | session-or-api-key |
+| `contacts.restore` | mutation | `POST /contacts/{id}/restore` | `contactIdInput` | `contactNameOutput` | session-or-api-key |
+| `contacts.purge` | mutation | `DELETE /contacts/{id}` | `contactIdInput` | `contactNameOutput` | session-or-api-key |
+| `contacts.enrich` | mutation | `POST /contacts/{id}/enrich` | `contactIdInput` | `contactEnrichOutput` | session-or-api-key |
+| `contacts.bulkAssignOwner` | mutation | `POST /contacts/bulk-assign-owner` | `contactBulkOwnerInput` | `bulkResultOutput` | session-or-api-key |
+| `contacts.bulkSetCompany` | mutation | `POST /contacts/bulk-set-company` | `contactBulkCompanyInput` | `bulkResultOutput` | session-or-api-key |
+| `contacts.bulkEnrich` | mutation | `POST /contacts/bulk-enrich` | `contactBulkInput` | `bulkResultOutput` | session-or-api-key |
+| `contacts.bulkArchive` | mutation | `POST /contacts/bulk-archive` | `contactBulkInput` | `bulkResultOutput` | session-or-api-key |
+| `contacts.bulkRestore` | mutation | `POST /contacts/bulk-restore` | `contactBulkInput` | `bulkResultOutput` | session-or-api-key |
+| `contacts.bulkPurge` | mutation | `POST /contacts/bulk-purge` | `contactBulkInput` | `bulkResultOutput` | session-or-api-key |
+| `contacts.decideFact` | mutation | `POST /contacts/decide-fact` | `factDecisionInput` | `decideFactOutput` | session-or-api-key |
+
+### `conversations`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `conversations.list` | query | `GET /conversations` | `conversationListInput` | `conversationListOutput` | session-or-api-key |
+| `conversations.builderList` | query | `GET /conversations/builder` | `none` | `builderListOutput` | session-or-api-key |
+| `conversations.builderResources` | query | `GET /conversations/builder-resources` | `builderResourceSearchInput` | `builderResourcesOutput` | session-or-api-key |
+| `conversations.builderById` | query | `GET /conversations/builder/{id}` | `conversationIdInput` | `builderConversationDetailOutput` | session-or-api-key |
+| `conversations.events` | query | `GET /conversations/{id}/events` | `conversationEventsInput` | `conversationEventsOutput` | session-or-api-key |
+| `conversations.save` | mutation | `POST /conversations` | `conversationSaveInput` | `conversationIdOutput` | session-or-api-key |
+| `conversations.createBuilder` | mutation | `POST /conversations/builder` | `builderConversationCreateInput` | `conversationIdOutput` | session-or-api-key |
+| `conversations.submitBuilder` | mutation | `POST /conversations/{id}/submit-builder` | `builderConversationSubmitInput` | `conversationIdOutput` | session-or-api-key |
+| `conversations.answerBuilderQuestion` | mutation | `POST /conversations/{id}/answer-builder-question` | `builderQuestionResponseInput` | `conversationIdOutput` | session-or-api-key |
+| `conversations.rateBuilderResponse` | mutation | `POST /conversations/{id}/rate-builder-response` | `builderResponseRatingInput` | `builderResponseRatingOutput` | session-or-api-key |
+| `conversations.markRead` | mutation | `PATCH /conversations/{id}/read` | `conversationIdInput` | `conversationIdOutput` | session-or-api-key |
+| `conversations.shareStatus` | query | `GET /conversations/{id}/share` | `conversationIdInput` | `conversationShareStatusOutput` | session-or-api-key |
+| `conversations.createShare` | mutation | `POST /conversations/{id}/share` | `conversationIdInput` | `conversationShareTokenOutput` | session-or-api-key |
+| `conversations.revokeShare` | mutation | `DELETE /conversations/{id}/share` | `conversationIdInput` | `conversationIdOutput` | session-or-api-key |
+| `conversations.shared` | query | `GET /conversations/shared/{token}` | `sharedConversationInput` | `sharedConversationOutput` | session-or-api-key |
+| `conversations.remove` | mutation | `DELETE /conversations/{id}` | `conversationIdInput` | `conversationIdOutput` | session-or-api-key |
+
+### `currency`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `currency.settings` | query | `GET /currency/settings` | `none` | `currencySettingsOutput` | session-or-api-key |
+| `currency.setReportingCurrency` | mutation | `PATCH /currency/reporting-currency` | `setReportingCurrencyInput` | `currencySettingsOutput` | session-or-api-key |
+| `currency.setManualRate` | mutation | `PUT /currency/rates/{currency}` | `setManualRateInput` | `currencySettingsOutput` | session-or-api-key |
+| `currency.removeManualRate` | mutation | `DELETE /currency/rates/{currency}` | `removeManualRateInput` | `currencySettingsOutput` | session-or-api-key |
+| `currency.refreshRates` | mutation | `POST /currency/rates/refresh` | `none` | `currencySettingsOutput` | session-or-api-key |
+
+### `dashboard`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `dashboard.summary` | query | `GET /dashboard/summary` | `dashboardSummaryInput` | `dashboardSummaryOutput` | session-or-api-key |
+
+### `deals`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `deals.list` | query | `POST /deals/search` | `dealListInput` | `dealListOutput` | session-or-api-key |
+| `deals.byId` | query | `GET /deals/{id}` | `dealIdInput` | `dealDetailOutput` | session-or-api-key |
+| `deals.create` | mutation | `POST /deals` | `dealCreateInput` | `dealCreateOutput` | session-or-api-key |
+| `deals.update` | mutation | `PATCH /deals/{id}` | `dealUpdateArgs` | `dealMutateOutput` | session-or-api-key |
+| `deals.archive` | mutation | `POST /deals/{id}/archive` | `dealIdInput` | `dealMutateOutput` | session-or-api-key |
+| `deals.restore` | mutation | `POST /deals/{id}/restore` | `dealIdInput` | `dealMutateOutput` | session-or-api-key |
+| `deals.purge` | mutation | `DELETE /deals/{id}` | `dealIdInput` | `dealMutateOutput` | session-or-api-key |
+| `deals.setStage` | mutation | `PATCH /deals/{id}/stage` | `setStageInput` | `dealSetStageOutput` | session-or-api-key |
+| `deals.contactOptions` | query | `GET /deals/{dealId}/contact-options` | `dealContactsInput` | `dealContactOptionsOutput` | session-or-api-key |
+| `deals.attachContact` | mutation | `POST /deals/{dealId}/contacts` | `dealAttachContactInput` | `dealContactLinkOutput` | session-or-api-key |
+| `deals.detachContact` | mutation | `DELETE /deals/{dealId}/contacts/{contactId}` | `dealDetachContactInput` | `dealContactLinkOutput` | session-or-api-key |
+| `deals.setContactRole` | mutation | `PATCH /deals/{dealId}/contacts/{contactId}/role` | `dealContactRoleInput` | `dealContactRoleOutput` | session-or-api-key |
+| `deals.bulkAssignOwner` | mutation | `POST /deals/bulk-assign-owner` | `dealBulkOwnerInput` | `dealBulkResultOutput` | session-or-api-key |
+| `deals.bulkSetStage` | mutation | `POST /deals/bulk-set-stage` | `dealBulkStageInput` | `dealBulkResultOutput` | session-or-api-key |
+| `deals.bulkArchive` | mutation | `POST /deals/bulk-archive` | `dealBulkInput` | `dealBulkResultOutput` | session-or-api-key |
+| `deals.bulkRestore` | mutation | `POST /deals/bulk-restore` | `dealBulkInput` | `dealBulkResultOutput` | session-or-api-key |
+| `deals.bulkPurge` | mutation | `POST /deals/bulk-purge` | `dealBulkInput` | `dealBulkResultOutput` | session-or-api-key |
+
+### `enrichment`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `enrichment.queue` | query | `GET /enrichment/queue` | `enrichmentQueueInput` | `enrichmentQueueOutput` | session-or-api-key |
+
+### `fields`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `fields.list` | query | `GET /fields` | `fieldListInput` | `fieldListOutput` | session-or-api-key |
+| `fields.byKey` | query | `GET /fields/{entity}/{key}` | `fieldByKeyInput` | `serializedFieldOutput` | session-or-api-key |
+| `fields.filters` | query | `GET /fields/{entity}/filterable` | `fieldEntityInput` | `fieldFiltersOutput` | session-or-api-key |
+| `fields.coverage` | query | `GET /fields/{id}/coverage` | `fieldIdInput` | `fieldCoverageOutput` | session-or-api-key |
+| `fields.create` | mutation | `POST /fields` | `fieldCreateInput` | `serializedFieldOutput` | session-or-api-key |
+| `fields.update` | mutation | `PATCH /fields/{id}` | `fieldUpdateArgs` | `serializedFieldOutput` | session-or-api-key |
+| `fields.reorder` | mutation | `POST /fields/reorder` | `fieldReorderInput` | `fieldReorderOutput` | session-or-api-key |
+| `fields.archive` | mutation | `POST /fields/{id}/archive` | `fieldIdInput` | `serializedFieldOutput` | session-or-api-key |
+| `fields.restore` | mutation | `POST /fields/{id}/restore` | `fieldIdInput` | `serializedFieldOutput` | session-or-api-key |
+| `fields.delete` | mutation | `DELETE /fields/{id}` | `fieldIdInput` | `fieldDeleteOutput` | session-or-api-key |
+| `fields.backfill` | mutation | `POST /fields/{id}/backfill` | `fieldIdInput` | `fieldBackfillOutput` | session-or-api-key |
+
+### `google`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `google.status` | query | `GET /google/status` | `none` | `googleConnectionStatusOutput` | session-or-api-key |
+| `google.purgeSyncedData` | mutation | `POST /google/purge-synced-data` | `none` | `purgeSyncedDataOutput` | session-or-api-key |
+| `google.revokeAccess` | mutation | `POST /google/revoke` | `none` | `revokeAccessOutput` | session-or-api-key |
+| `google.syncNow` | mutation | `POST /google/sync` | `none` | `googleConnectionStatusOutput` | session-or-api-key |
+| `google.setAutoCreate` | mutation | `PATCH /google/auto-create` | `setAutoCreateInput` | `googleConnectionStatusOutput` | session-or-api-key |
+| `google.suppressDomain` | mutation | `POST /google/suppress-domain` | `suppressDomainInput` | `suppressDomainOutput` | session-or-api-key |
+| `google.thread` | query | `GET /google/threads/{threadId}` | `threadInput` | `emailThreadOutput` | session-or-api-key |
+| `google.event` | query | `GET /google/events/{eventId}` | `calendarEventInput` | `calendarEventOutput` | session-or-api-key |
+
+### `microsoft`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `microsoft.status` | query | `GET /microsoft/status` | `none` | `microsoftConnectionStatusOutput` | session-or-api-key |
+| `microsoft.purgeSyncedData` | mutation | `POST /microsoft/purge-synced-data` | `none` | `purgeSyncedDataOutput` | session-or-api-key |
+| `microsoft.revokeAccess` | mutation | `POST /microsoft/revoke` | `none` | `revokeAccessOutput` | session-or-api-key |
+| `microsoft.syncNow` | mutation | `POST /microsoft/sync` | `none` | `microsoftConnectionStatusOutput` | session-or-api-key |
+| `microsoft.setAutoCreate` | mutation | `PATCH /microsoft/auto-create` | `setOutlookAutoCreateInput` | `microsoftConnectionStatusOutput` | session-or-api-key |
+
+### `savedViews`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `savedViews.list` | query | `GET /saved-views` | `savedViewListInput` | `savedViewListOutput` | session-or-api-key |
+| `savedViews.create` | mutation | `POST /saved-views` | `savedViewCreateInput` | `savedViewOutput` | session-or-api-key |
+| `savedViews.update` | mutation | `PATCH /saved-views/{id}` | `savedViewUpdateArgs` | `savedViewOutput` | session-or-api-key |
+| `savedViews.delete` | mutation | `DELETE /saved-views/{id}` | `savedViewIdInput` | `savedViewDeleteOutput` | session-or-api-key |
+
+### `search`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `search.quick` | query | `GET /search` | `quickInput` | `quickOutput` | session-or-api-key |
+
+### `settings`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `settings.agentModel` | query | `GET /settings/agent-model` | `none` | `agentModelOutput` | session-or-api-key |
+| `settings.modelCatalog` | query | `GET /settings/model-catalog` | `none` | `modelCatalogOutput` | session-or-api-key |
+| `settings.setAgentModel` | mutation | `PATCH /settings/agent-model` | `setAgentModelInput` | `agentModelOutput` | session-or-api-key |
+| `settings.researchKey` | query | `GET /settings/research-key` | `none` | `researchKeyOutput` | session-or-api-key |
+| `settings.setResearchKey` | mutation | `PATCH /settings/research-key` | `setResearchKeyInput` | `researchKeyOutput` | session-or-api-key |
+| `settings.archiveRetention` | query | `GET /settings/archive-retention` | `none` | `archiveRetentionOutput` | session-or-api-key |
+| `settings.setArchiveRetention` | mutation | `PATCH /settings/archive-retention` | `setArchiveRetentionDaysInput` | `archiveRetentionOutput` | session-or-api-key |
+
+### `slack`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `slack.status` | query | `GET /slack/status` | `none` | `slackStatusOutput` | session-or-api-key |
+| `slack.matches` | query | `GET /slack/matches` | `none` | `slackMatchesOutput` | session-or-api-key |
+| `slack.channels` | query | `GET /slack/channels` | `slackChannelsInput` | `slackChannelsOutput` | session-or-api-key |
+| `slack.joinChannel` | mutation | `POST /slack/channels/{channelId}/join` | `slackJoinChannelInput` | `slackJoinChannelOutput` | session-or-api-key |
+| `slack.refreshPeople` | mutation | `POST /slack/people/refresh` | `none` | `slackRefreshPeopleOutput` | session-or-api-key |
+| `slack.createChannel` | mutation | `POST /slack/channels` | `slackCreateChannelInput` | `slackCreateChannelOutput` | session-or-api-key |
+| `slack.disconnect` | mutation | `DELETE /slack/connection` | `none` | `slackDisconnectOutput` | session-or-api-key |
+
+### `sso`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `sso.signInOptions` | query | `GET /sso/sign-in-options` | `none` | `ssoSignInOptionsOutput` | public |
+| `sso.settings` | query | `GET /sso/settings` | `none` | `ssoSettingsOutput` | session-or-api-key |
+| `sso.list` | query | `GET /sso` | `ssoProviderListInput` | `ssoProviderListOutput` | session-or-api-key |
+| `sso.register` | mutation | `POST /sso` | `registerSsoProviderInput` | `ssoProviderOutput` | session-or-api-key |
+| `sso.remove` | mutation | `DELETE /sso/{providerId}` | `deleteSsoProviderInput` | `deleteSsoProviderOutput` | session-or-api-key |
+
+### `tracking`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `tracking.settings` | query | `GET /tracking/settings` | `none` | `trackingSettingsOutput` | session-or-api-key |
+| `tracking.setFlag` | mutation | `PATCH /tracking/flags` | `trackingFlagInput` | `z.void()` | session-or-api-key |
+| `tracking.setCookieLifetime` | mutation | `PATCH /tracking/cookie-lifetime` | `cookieLifetimeInput` | `z.void()` | session-or-api-key |
+| `tracking.addDomain` | mutation | `POST /tracking/domains` | `addDomainInput` | `trackedDomainOutput` | session-or-api-key |
+| `tracking.removeDomain` | mutation | `DELETE /tracking/domains/{id}` | `removeDomainInput` | `z.void()` | session-or-api-key |
+| `tracking.rotateSiteId` | mutation | `POST /tracking/site-id/rotate` | `none` | `rotateSiteIdOutput` | session-or-api-key |
+| `tracking.verify` | mutation | `POST /tracking/verify` | `verifyInput` | `verifyOutput` | session-or-api-key |
+| `tracking.sources` | query | `GET /tracking/sources` | `none` | `sourcesOutput` | session-or-api-key |
+| `tracking.companyActivity` | query | `GET /tracking/companies/{companyId}/activity` | `companyActivityInput` | `websiteActivityOutput` | session-or-api-key |
+| `tracking.contactActivity` | query | `GET /tracking/contacts/{contactId}/activity` | `contactActivityInput` | `websiteActivityOutput` | session-or-api-key |
+
+### `users`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `users.me` | query | Not exposed over REST | `none` | `inferred` | session-or-api-key |
+| `users.list` | query | `GET /users` | `none` | `usersListOutput` | session-or-api-key |
+
+### `workspace`
+
+| tRPC procedure | Type | REST bridge | Input schema | Output schema | Access |
+| --- | --- | --- | --- | --- | --- |
+| `workspace.get` | query | `GET /workspace` | `none` | `workspaceOutput` | session-or-api-key |
+| `workspace.gate` | query | Not exposed over REST | `none` | `workspaceGate` | session-or-api-key |
+| `workspace.members` | query | `POST /workspace/members/search` | `memberListInput` | `memberListOutput` | session-or-api-key |
+| `workspace.update` | mutation | `PATCH /workspace` | `updateWorkspaceInput` | `workspaceOutput` | session-or-api-key |
+| `workspace.setMemberRole` | mutation | `PATCH /workspace/members/{memberId}/role` | `setMemberRoleInput` | `workspaceMemberOutput` | session-or-api-key |
+
+
+## Evidence, findings, and source paths
+
+| Evidence | Finding | Source path |
+| --- | --- | --- |
+| tRPC router AST contains 173 decorated procedures | The application exposes 173 tRPC procedures | `apps/api/src/**/*.router.ts` |
+| Generated router contains 173 procedure definitions | Generated client types match the router count | `apps/api/src/generated/server.ts` |
+| 159 procedures use `restMeta`, 7 asset procedures, and 5 appointment procedures carry REST metadata | The REST bridge exposes 171 root-path operations | `apps/api/src/**/*.router.ts`, `apps/api/src/assets/asset-openapi.ts`, `apps/api/src/appointments/appointment-openapi.ts` |
+| Merged runtime OpenAPI contains 156 paths | The document includes native controller paths and 171 REST operations | `/openapi.json` |
+| Better Auth installs session, OAuth, SSO, and API-key plugins | Better Auth mounts a larger protocol surface | `packages/auth/src/auth.ts` |
+| `AuthMiddleware` requires a request principal | Protected tRPC routes reject anonymous access | `apps/api/src/trpc/middlewares/auth.middleware.ts` |
+| `SessionOnlyMiddleware` requires a session principal | API-key management requires browser sessions | `apps/api/src/trpc/middlewares/session-only.middleware.ts` |
+| Role helpers accept owner and admin | Management permissions share one role boundary | `packages/auth/src/organization.ts` |
+| Shared conversation routes use `AuthMiddleware` | Share tokens do not create anonymous access | `apps/api/src/conversations/conversations.router.ts` |
+| Native attachment controller requires `@Principal` | Attachments accept every supported user credential | `apps/api/src/conversations/conversation-attachments.controller.ts` |
+| Better Auth configures `jwt` and `oauthProvider` | CRM issues OAuth and OIDC tokens | `packages/auth/src/auth.ts` |
+| tRPC context resolves one request principal | REST bearer tokens share the authentication boundary | `apps/api/src/trpc/trpc.context.ts` |
+| OAuth scope middleware checks procedure type | Queries and mutations require distinct CRM scopes | `apps/api/src/trpc/middlewares/oauth-scope.middleware.ts` |
+| OpenAPI declares three credential alternatives | Generated clients receive bearer configuration | `apps/api/src/create-app.ts` |
+| Better Auth runtime packages use 1.7.2 | Runtime auth dependencies share one version | `packages/auth/package.json` |
+
+## Maintenance checklist
+
+Run tRPC generation after adding or changing a procedure.
+
+Commit `apps/api/src/generated/server.ts` with router changes.
+
+Keep REST metadata on every supported REST bridge procedure.
+
+Set `protect: false` only for intentionally public procedures.
+
+Apply `AuthMiddleware` at the router or procedure boundary.
+
+Add service-level permission checks for restricted writes.
+
+Keep API-key management behind `SessionOnlyMiddleware`.
+
+Update this inventory when controllers, routers, or Better Auth plugins change.
+
+Verify `/openapi.json` after starting the current API process.
+
+Keep Better Auth runtime packages on one tested version.
+
+Register OAuth clients administratively and keep dynamic registration disabled.
+
+Verify issuer, audience, scope, PKCE, refresh rotation, and revocation before mobile release.
diff --git a/docs/kaneo-integration.md b/docs/kaneo-integration.md
new file mode 100644
index 000000000..8774a09a7
--- /dev/null
+++ b/docs/kaneo-integration.md
@@ -0,0 +1,117 @@
+# Kaneo integration
+
+How Kaneo's project management is bundled into the CRM: one database, kaneo's own
+controllers and web UI served as-is, one session, and the agent calling kaneo's
+controller functions directly.
+
+Read `vendor/FORK-DELTA.md` for the fork changes that make this work, and
+`docs/api.md` for the CRM's own rules. The strategy decision is in
+`adrs/kaneo.md`.
+
+## The kaneo source
+
+Kaneo lives at `vendor/kaneo` as a git submodule pointing at the
+`crm-integration` branch of the `romanbsd/kaneo` fork. The CRM-specific
+deltas (column names, renames, cookie prefix, migration gate) are committed
+in that branch, not copied into this repository. Updating kaneo means
+rebasing the fork branch on upstream and bumping the submodule pointer — see
+`vendor/FORK-DELTA.md`.
+
+A fresh checkout must initialize the submodule and install kaneo's
+dependencies before `dev:kaneo` runs:
+
+```sh
+git submodule update --init vendor/kaneo
+cd vendor/kaneo && bun install
+```
+
+## The one database
+
+Kaneo and the CRM share one Postgres schema, owned by Prisma in
+`packages/db/prisma/schema.prisma`. Prisma runs every migration; kaneo's own
+migrator is disabled (`KANEO_SKIP_DRIZZLE_MIGRATIONS`, fork delta).
+
+- The 32 kaneo tables are generated from the abstract model in
+  `packages/kaneo-domain` (`bun run generate:prisma` regenerates
+  `kaneo.prisma`, appended into `schema.prisma`). The Drizzle binding and the
+  parity test in that package prove the generated schema matches what kaneo's
+  code expects.
+- **Kaneo tables keep snake_case physical columns** (`project_id`, `created_at`),
+  matching kaneo's Drizzle schema. The Prisma fragment emits a column `@map`
+  for each.
+- **The shared auth tables keep the CRM's camelCase physical columns**
+  (`emailVerified`, `createdAt`). Kaneo's `schema.ts` is patched to read those
+  names, so both ORMs see the same rows.
+- Two physical renames avoid collisions with the CRM's live tables:
+  `activity` → `task_activity`, `invitation` → `workspace_invitation`.
+- Migrations: `kaneo_domain` (the 32 tables), `kaneo_auth_columns` (kaneo's
+  nullable user/session columns), `kaneo_comment_user_nullable` (agent-authored
+  comments without a user).
+
+## The mount
+
+`bun run dev:kaneo` serves the whole stack:
+
+1. Builds the `@kaneo/*` workspace packages if their `dist` is missing.
+2. Boots kaneo's own Hono API (`vendor/kaneo/apps/api`) against the shared
+   database, with the migration gate on.
+3. Serves kaneo's built web SPA (`vendor/kaneo/apps/web/dist`) at root,
+   proxies `/api/*` to the API, and bridges `/ws` websockets.
+
+`tools/kaneo-dev.ts` is the dev server. Production hosting is not wired yet:
+kaneo's websockets and scheduler need a long-lived process, so Vercel serverless
+cannot host the API; the API runs as its own service.
+
+## Authentication
+
+One session cookie, one identity.
+
+- Both apps run Better Auth over the same `user`/`session`/`account`/
+  `verification` tables and the same secret (`BETTER_AUTH_SECRET` mapped to
+  kaneo's `AUTH_SECRET`).
+- Kaneo's Better Auth uses `cookiePrefix: "crm"` (fork delta), so
+  `crm.session_token` is valid at both apps. Both use the same cookie cache
+  format.
+- The CRM owns sign-in. Its `ensureWorkspaceMembership` hook (packages/auth)
+  also mirrors the single workspace and each signing-in user into kaneo's
+  `workspace`/`workspace_member` tables, mapping CRM roles onto kaneo's
+  (`owner`/`admin` → `admin`, `member` → `member`). The sync degrades
+  independently: a kaneo-table failure never blocks sign-in.
+- Kaneo's boot seeds its default `workspace_role` rows (viewer/member/admin)
+  against the shared workspace.
+
+## The agent surface
+
+The eve agent reads projects and tasks through Prisma and writes through
+kaneo's own controller functions.
+
+- **Reads (native Prisma, free):** `project_list`, `task_list`, `task_read`
+  (`apps/agent/agent/lib/kaneo.ts`). No kaneo runtime needed for reads.
+- **Writes (kaneo's controllers, direct):** `task_create`, `task_update`,
+  `task_comment` call kaneo's extracted controller functions in-process
+  (`apps/agent/agent/lib/kaneo-writes.ts`), with no HTTP, no MCP, no Hono
+  context. This reuses kaneo's exact behavior: status validation against the
+  project's columns, atomic task numbering, assignable-user checks, and
+  comment rows in the activity feed (`task_activity`, type `comment`) that
+  kaneo's UI actually renders.
+- **The principal:** a dispatched agent has no user, but kaneo's controllers
+  require `currentUserId`. The agent acts as the workspace owner (the first
+  `owner` member of the workspace). Decide once; this is the whole permission
+  model for agent writes.
+
+Why not MCP: kaneo's MCP server is a thin HTTP client over kaneo's REST API,
+and it is user-OAuth-scoped. Eve can consume MCP natively, but the agent has no
+user principal for dispatched runs, and an HTTP hop adds a runtime dependency
+for the same tables. The direct-controller path removes the transport entirely.
+
+## Open decisions
+
+- **Production hosting:** kaneo's API needs a long-lived process (websockets,
+  scheduler). Not wired.
+- **`/api/auth` co-serving:** both apps serve auth at `/api/auth`; fine on
+  separate ports in dev, one must move when co-served under one origin.
+- **Inline routes:** a minority of kaneo's routes are inline Hono handlers, not
+  extracted controllers; those stay HTTP-only.
+- **Activity events:** kaneo's controllers publish events; the agent process
+  registers no event listeners, so event-driven side effects (notifications)
+  do not fire for agent writes.
\ No newline at end of file
diff --git a/docs/oauth-oidc-crm-implementation.md b/docs/oauth-oidc-crm-implementation.md
new file mode 100644
index 000000000..a3ccb8018
--- /dev/null
+++ b/docs/oauth-oidc-crm-implementation.md
@@ -0,0 +1,1188 @@
+# CRM OAuth 2.1 and OpenID Connect Changes
+
+This document specifies CRM changes for secure Flutter access.
+
+It preserves browser sessions and API keys.
+
+It adds standards-based OAuth 2.1 and OpenID Connect support.
+
+The CRM remains a single-tenant system.
+
+> [!IMPORTANT]
+> The CRM implementation in this document is complete.
+> The Flutter client work remains a separate application change.
+
+## Implementation status
+
+Implemented on `feat/oauth`:
+
+- Better Auth runtime packages use version 1.7.2.
+- Better Auth CLI package `auth` uses version 1.7.2.
+- OAuth Provider and JWT plugins issue CompCRM tokens.
+- Prisma migration `20260829113915_add_oauth_provider` adds OAuth storage.
+- Startup reconciles the official `compcrm-flutter` public client.
+- One request-principal resolver accepts cookies, API keys, and bearer tokens.
+- tRPC queries require `crm.read` for OAuth callers.
+- tRPC mutations require `crm.write` for OAuth callers.
+- Native protected controllers use the same principal and scope guard.
+- OAuth, OpenID Connect, protected-resource, and JWKS metadata are public.
+- OpenAPI describes cookie, API-key, and bearer alternatives.
+- The web application preserves signed authorization state through sign-in.
+- The web application provides a custom-client consent page.
+
+## 1. Executive decision
+
+CompCRM must become an OAuth 2.1 authorization server for first-party mobile clients.
+
+The server must also expose OpenID Connect discovery and identity tokens.
+
+The Flutter application must use Authorization Code Flow with PKCE.
+
+The CRM API must accept short-lived OAuth access tokens.
+
+The browser application must continue to use Better Auth session cookies.
+
+Existing integrations must continue to use API keys.
+
+The three credential types must resolve into one request principal.
+
+Current role checks must remain the final authorization boundary.
+
+OAuth scopes must restrict each client before role checks run.
+
+The implementation must not accept access tokens from upstream identity providers.
+
+The implementation must not add tenant headers or organization parameters.
+
+### 1.1 Recommendation summary
+
+| Decision | Recommendation |
+| --- | --- |
+| Authorization server | Use the Better Auth OAuth Provider plugin. |
+| Identity protocol | Enable OpenID Connect through the `openid` scope. |
+| Mobile flow | Use Authorization Code Flow with PKCE and a system browser. |
+| Mobile client | Register one public native client for the official Flutter application. |
+| Client secret | Do not issue a secret to the Flutter application. |
+| Access tokens | Use signed JWT access tokens with a ten-minute lifetime. |
+| Refresh tokens | Rotate refresh tokens and expire them after 30 days. |
+| Refresh retry | Allow a 30-second reuse interval for lost mobile responses. |
+| API authorization | Require OAuth scopes and current CRM roles. |
+| Browser access | Keep existing session-cookie behavior. |
+| Automation access | Keep existing API-key behavior. |
+| Multi-tenancy | Do not add tenant selection or tenant claims. |
+| Dynamic registration | Keep dynamic client registration disabled. |
+| Token exchange | Do not add token exchange in the first release. |
+| Client credentials | Do not add machine OAuth grants in the first release. |
+| Proof of possession | Do not add DPoP in the first release. |
+
+## 2. Starting state
+
+CompCRM currently uses Better Auth as an authentication client and session manager.
+
+The API mounts Better Auth routes under `/api/auth/*`.
+
+The web application authenticates with Better Auth cookies.
+
+The API also accepts Better Auth API keys.
+
+The API does not accept OAuth bearer access tokens.
+
+The API does not publish OAuth authorization-server metadata.
+
+The database does not contain OAuth client, consent, token, or signing-key tables.
+
+The OpenAPI documents contain cookie and API-key schemes only.
+
+The tRPC context loads a Better Auth session from request headers.
+
+The current authorization middleware requires a session user.
+
+The current SSO feature connects CompCRM to an external OIDC provider.
+
+That feature makes CompCRM an OIDC client.
+
+It does not make CompCRM an authorization server.
+
+### 2.1 Existing authentication paths
+
+| Caller | Credential | Authentication path | Current result |
+| --- | --- | --- | --- |
+| Web browser | Session cookie | Better Auth session lookup | Supported |
+| Integration | `x-api-key` | Better Auth API-key session | Supported |
+| Flutter application | Bearer access token | No verifier exists | Not supported |
+| External OIDC provider | Authorization response | Better Auth SSO | Supported for web sign-in |
+
+### 2.2 Existing authorization model
+
+CompCRM uses one fixed workspace.
+
+`WORKSPACE_ID` identifies this workspace.
+
+Sign-in adds the user to this workspace.
+
+Workspace membership uses the existing organization records.
+
+Owner, administrator, and member roles control CRM actions.
+
+Service procedures enforce those permissions.
+
+The OAuth implementation must reuse these checks.
+
+### 2.3 Verified source findings
+
+| Evidence | Finding | Implementation path |
+| --- | --- | --- |
+| `packages/auth/src/auth.ts` | Better Auth has SSO, organization, API-key, and generic OAuth plugins. | Add OAuth Provider and JWT plugins here. |
+| `apps/api/src/trpc/trpc.context.ts` | The context only requests a Better Auth session. | Resolve one typed request principal here. |
+| `apps/api/src/trpc/middlewares/auth.middleware.ts` | Protected procedures require `ctx.session.user`. | Require `ctx.principal.user` instead. |
+| `apps/api/src/trpc/middlewares/session-only.middleware.ts` | Session-only access checks the API-key header. | Check the resolved credential kind instead. |
+| `apps/api/src/create-app.ts` | OpenAPI defines cookie and API-key security. | Add an OAuth bearer scheme. |
+| `apps/app/proxy.ts` | The proxy gates routes with a session cookie. | Permit authenticated OAuth consent routes. |
+| `packages/db/prisma/schema.prisma` | OAuth Provider tables were absent. | The migration adds the generated models. |
+| `packages/auth/package.json` | Runtime packages used version 1.6.25. | Runtime packages now use version 1.7.2. |
+
+## 3. Target architecture
+
+The CRM owns authorization, token issuance, and token verification.
+
+An upstream SSO provider still owns optional workforce authentication.
+
+The Flutter client never handles the upstream provider token directly.
+
+The Flutter client receives only CompCRM tokens.
+
+```mermaid
+flowchart LR
+    Flutter[Flutter application] -->|Authorization Code and PKCE| Auth[CompCRM authorization server]
+    Browser[Web browser] -->|Session cookie| API[CompCRM API]
+    Integration[Integration] -->|API key| API
+    Auth -->|Login redirect| SSO[Optional upstream OIDC provider]
+    SSO -->|CompCRM session| Auth
+    Auth -->|ID token and access token| Flutter
+    Flutter -->|Bearer access token| API
+    API --> Principal[Request principal resolver]
+    Principal --> Scope[OAuth scope check]
+    Scope --> Role[Current workspace role check]
+    Role --> Service[Existing CRM services]
+```
+
+### 3.1 Trust boundaries
+
+The Flutter application is a public client.
+
+It cannot protect a client secret.
+
+PKCE protects the authorization code.
+
+The system browser protects the user authentication session.
+
+The API validates every bearer token locally or through the provider verifier.
+
+The API never trusts mobile claims without signature validation.
+
+The database protects refresh tokens, client records, consent records, and signing keys.
+
+### 3.2 Protocol endpoints
+
+Better Auth must provide the applicable OAuth and OpenID Connect endpoints.
+
+The final paths depend on the mounted Better Auth base path.
+
+Integration tests must verify the public paths before release.
+
+The public surface must include these capabilities:
+
+| Capability | Standard endpoint purpose |
+| --- | --- |
+| Authorization | Starts user authorization and returns a code. |
+| Token | Exchanges codes and refresh tokens. |
+| User information | Returns identity claims for valid access tokens. |
+| Revocation | Revokes supported tokens. |
+| Introspection | Reports token state for authorized callers. |
+| End session | Ends the related login session. |
+| Authorization metadata | Publishes OAuth server capabilities. |
+| OpenID metadata | Publishes OIDC issuer and endpoint metadata. |
+| JWKS | Publishes public signing keys. |
+
+The issuer must use the public `API_URL` origin.
+
+The login and consent pages must use the public `APP_URL` origin.
+
+Discovery documents must report the exact public endpoints.
+
+Proxy or load-balancer rewrites must not change the reported issuer.
+
+## 4. Required CRM changes
+
+### 4.1 Align authentication dependencies
+
+Align `better-auth` and every runtime plugin first.
+
+Use version 1.7.2 for all runtime packages.
+
+Use CLI version 1.4.22.
+
+The CLI uses an independent release sequence.
+
+Commit the package-lock changes with the implementation.
+
+Run existing authentication tests before schema generation.
+
+Run them again after dependency alignment.
+
+Do not combine a version upgrade with unrelated authentication refactoring.
+
+### 4.2 Add the OAuth Provider plugin
+
+Add `@better-auth/oauth-provider` to `packages/auth`.
+
+Add the Better Auth JWT plugin from the aligned release.
+
+Keep existing SSO, organization, API-key, and generic OAuth plugins.
+
+Disable the standalone JWT `/token` endpoint.
+
+Disable JWT headers on normal session responses.
+
+Only the OAuth Provider must issue API access tokens.
+
+Create `packages/auth/src/oauth-config.ts` for tunable OAuth values.
+
+Group every duration and scope in one exported constant.
+
+Do not place token durations beside individual consumers.
+
+The configuration should contain these values:
+
+```ts
+const MINUTE_SECONDS = 60;
+const DAY_SECONDS = 24 * 60 * MINUTE_SECONDS;
+
+export const OAUTH = {
+  accessTokenTtlSeconds: 10 * MINUTE_SECONDS,
+  authorizationCodeTtlSeconds: 10 * MINUTE_SECONDS,
+  refreshTokenTtlSeconds: 30 * DAY_SECONDS,
+  refreshTokenReuseIntervalSeconds: 30,
+  scopes: {
+    identity: ["openid", "profile", "email", "offline_access"],
+    crm: ["crm.read", "crm.write"],
+  },
+  resource: new URL("/api", apiUrl).toString(),
+} as const;
+```
+
+Do not duplicate these values in the API or Flutter application.
+
+### 4.3 Register the official Flutter client
+
+Register one public native OAuth client.
+
+Use a stable identifier such as `compcrm-flutter`.
+
+Do not assign a client secret.
+
+Set the token endpoint authentication method to `none`.
+
+Permit only authorization-code and refresh-token grants.
+
+Permit only the code response type.
+
+Require PKCE with `S256`.
+
+Use exact redirect URIs.
+
+Reject wildcard redirect URIs.
+
+Use an application-owned HTTPS link where platform support is complete.
+
+Use a reverse-domain private scheme only as a controlled fallback.
+
+Use loopback redirects only for desktop development.
+
+Enable `skipConsent` only for the bundled first-party client.
+
+Keep consent for every custom client.
+
+Do not enable dynamic client registration.
+
+Create an idempotent client reconciliation command.
+
+The command must create or update only the official client record.
+
+The command must reject unsafe redirect URI changes.
+
+Custom self-hosted clients require an administrator registration command.
+
+Reconcile the bundled client from the repository root:
+
+```bash
+bun run --filter=@crm/auth oauth:reconcile-client
+```
+
+Register a custom public native client from the repository root:
+
+```bash
+bun run --filter=@crm/auth oauth:register-client --client-id example-native --name "Example Native" --redirect-uri com.example.app:/oauth/callback --post-logout-redirect-uri com.example.app:/oauth/logout
+```
+
+Repeat `--redirect-uri` or `--post-logout-redirect-uri` for each exact address.
+
+The registration command rejects duplicates, fragments, wildcards, and unsafe transport schemes.
+
+### 4.4 Generate the database schema
+
+Run the Better Auth CLI against the final plugin configuration.
+
+Inspect the generated Prisma changes before creating a migration.
+
+Expected records include OAuth clients, consents, access tokens, and refresh tokens.
+
+Expected records also include client assertions and signing keys.
+
+Exact model names depend on the aligned Better Auth release.
+
+The CLI parser rejects the existing valid Prisma filtered indexes.
+
+Generate the OAuth schema into an isolated Prisma file.
+
+Merge the exact generated models into the repository schema.
+
+Create one reviewed Prisma migration.
+
+Run the migration against a disposable test database first.
+
+The test database name must end with `_test`.
+
+Verify migration rollback behavior through a database snapshot.
+
+Do not delete OAuth tables during an application rollback.
+
+### 4.5 Create a unified request principal
+
+Create a domain type at the authentication boundary.
+
+Do not pass untyped authentication data through the API.
+
+The type should represent these fields:
+
+```ts
+type CredentialKind = "session" | "apiKey" | "oauth";
+
+type RequestPrincipal = {
+  credentialKind: CredentialKind;
+  user: SessionUser;
+  clientId: string | null;
+  scopes: ReadonlySet<string>;
+};
+```
+
+Derive the real type from validated provider output where available.
+
+Do not trust arbitrary token claim objects.
+
+Create a request-principal service in `apps/api/src/auth`.
+
+The service must inspect the request once.
+
+It must reject requests containing multiple credential types.
+
+This rule prevents credential confusion attacks.
+
+The resolver must use this order:
+
+1. Detect cookie, API-key, and bearer credentials.
+2. Reject an ambiguous request with HTTP 400.
+3. Verify OAuth bearer credentials with the provider verifier.
+4. Resolve session and API-key credentials through Better Auth.
+5. Return one typed principal.
+6. Return no principal for an anonymous request.
+
+The bearer verifier must validate these properties:
+
+| Property | Required validation |
+| --- | --- |
+| Signature | A current trusted JWKS key signs the token. |
+| Issuer | The issuer exactly matches the public CompCRM issuer. |
+| Audience | The audience includes the CompCRM API resource. |
+| Expiry | The current time precedes `exp`. |
+| Activation | The current time follows `nbf`, when present. |
+| Subject | The subject maps to a current CompCRM user. |
+| Client | The client identifier names an enabled OAuth client. |
+| Scope | The token contains every required OAuth scope. |
+
+Reject malformed bearer values with HTTP 401.
+
+Reject expired or invalid tokens with HTTP 401.
+
+Reject insufficient scopes with HTTP 403.
+
+Return a standards-compatible `WWW-Authenticate` header.
+
+Never convert a verification failure into an anonymous request silently.
+
+### 4.6 Update tRPC context and middleware
+
+Add `principal` to `BaseTrpcContext`.
+
+Keep `session` temporarily when existing call sites still need it.
+
+Remove the duplicate session field after migration.
+
+Change `AuthMiddleware` to require `ctx.principal.user`.
+
+Build `AuthedTrpcContext` from the typed principal.
+
+Change session-only checks to inspect `credentialKind`.
+
+Do not inspect raw credential headers in downstream middleware.
+
+The API-key management router must accept browser sessions only.
+
+OAuth tokens must not create, list, or revoke API keys.
+
+API keys must not manage other API keys.
+
+### 4.7 Enforce OAuth scopes
+
+Define the first CRM resource scopes as follows:
+
+| Scope | Meaning |
+| --- | --- |
+| `openid` | Request an OpenID Connect identity token. |
+| `profile` | Request standard profile claims. |
+| `email` | Request standard email claims. |
+| `offline_access` | Request refresh-token access. |
+| `crm.read` | Read CRM resources. |
+| `crm.write` | Create, update, or delete CRM resources. |
+
+OAuth scopes restrict the client.
+
+Workspace roles restrict the user.
+
+Both checks must pass.
+
+Do not place owner or administrator status in durable access-token claims.
+
+Role changes must take effect without waiting for token expiry.
+
+Existing service authorization must load current membership and role data.
+
+Use `crm.read` for tRPC queries.
+
+Use `crm.write` for tRPC mutations.
+
+Apply equivalent policies to native REST controllers.
+
+Public procedures must remain public.
+
+Session and API-key behavior must remain unchanged during the first release.
+
+Add finer scopes only after a real client needs them.
+
+Avoid entity-specific scopes during the first release.
+
+### 4.8 Update Nest controller authentication
+
+The Better Auth Nest integration currently protects controller routes.
+
+Bearer support must use the same request-principal resolver.
+
+Create one shared guard or decorator for authenticated controllers.
+
+Do not create a second authorization policy for controllers.
+
+Public controllers must use an explicit public marker.
+
+Protected controllers must require the unified principal.
+
+Controller scope failures must match tRPC failures.
+
+### 4.9 Add OAuth security to OpenAPI
+
+Add an HTTP bearer scheme with JWT format.
+
+Keep the cookie scheme.
+
+Keep the API-key scheme.
+
+Describe protected operations with alternative security requirements.
+
+The alternatives must mean cookie OR API key OR bearer token.
+
+They must not mean all three credentials together.
+
+Add the bearer scheme to the REST bridge document.
+
+Keep public operations without security requirements.
+
+Document `crm.read` and `crm.write` for OAuth clients.
+
+Regenerate any committed client artifacts after the document changes.
+
+### 4.10 Add login and consent routing
+
+Reuse the existing `/sign-in` page for user authentication.
+
+Add an OAuth consent page for custom clients.
+
+Place the page under the existing landing route group.
+
+Add the OAuth route prefix to the proxy ungated list.
+
+Anonymous users must still redirect to `/sign-in`.
+
+Authenticated users must bypass onboarding gates during authorization.
+
+The server page must load client, scope, and consent data.
+
+The client component must render finished plain data.
+
+The client component must not import `@crm/auth` or `@crm/db`.
+
+Shared controls must come from `packages/ui`.
+
+The page must show these values:
+
+- Application name.
+- Requested CRM permissions.
+- Signed-in account.
+- Approve action.
+- Deny action.
+
+The official client normally skips this page.
+
+The page remains necessary for custom clients.
+
+### 4.11 Verify discovery routing
+
+Better Auth is mounted under `/api/auth/*`.
+
+OAuth discovery uses standard well-known locations.
+
+The Nest adapter and proxy must expose the locations correctly.
+
+Add end-to-end tests for authorization metadata.
+
+Add end-to-end tests for OpenID configuration.
+
+Add an explicit Nest route adapter when automatic routing fails.
+
+Do not ship a discovery document with unreachable endpoints.
+
+### 4.12 Add bounded authentication logs
+
+Log the authentication method and result.
+
+Log a bounded OAuth error code.
+
+Log the client identifier after validation.
+
+Log the request identifier and user identifier.
+
+Never log access tokens.
+
+Never log refresh tokens.
+
+Never log authorization codes.
+
+Never log request headers, bodies, or query strings.
+
+Do not add product telemetry for this change.
+
+Use operational logs and security metrics only.
+
+## 5. Flutter integration contract
+
+The Flutter application must use a system authentication browser.
+
+Embedded web views must not handle user authentication.
+
+Use `flutter_appauth` for discovery, PKCE, authorization, and refresh.
+
+Use `flutter_secure_storage` for refresh-token storage.
+
+Keep access tokens in memory when practical.
+
+Never store a client secret in the application.
+
+### 5.1 Mobile authorization sequence
+
+```mermaid
+sequenceDiagram
+    participant App as Flutter application
+    participant Browser as System browser
+    participant Auth as CompCRM authorization server
+    participant API as CompCRM API
+
+    App->>App: Create verifier, challenge, state, and nonce
+    App->>Browser: Open authorization request
+    Browser->>Auth: Send authorization request and challenge
+    Auth->>Browser: Authenticate the user
+    Auth->>Browser: Approve the trusted client
+    Auth->>Browser: Redirect with code and state
+    Browser->>App: Deliver redirect URI
+    App->>App: Validate state
+    App->>Auth: Exchange code and verifier
+    Auth->>App: Return ID, access, and refresh tokens
+    App->>App: Validate ID token nonce and claims
+    App->>API: Send bearer access token
+    API->>App: Return CRM data
+```
+
+### 5.2 Authorization request
+
+The client must request these scopes:
+
+```text
+openid profile email offline_access crm.read crm.write
+```
+
+The client must send these values:
+
+- Exact registered client identifier.
+- Exact registered redirect URI.
+- Exact `${API_URL}/api` resource in authorization and token requests.
+- Response type `code`.
+- PKCE challenge method `S256`.
+- Cryptographically random state.
+- Cryptographically random nonce.
+
+The client must validate returned state before code exchange.
+
+The client must validate the ID token nonce.
+
+The client must validate issuer, audience, signature, and expiry.
+
+### 5.3 Token storage
+
+Store the refresh token in platform secure storage.
+
+Store the current access token in process memory.
+
+Store token expiry beside the access token.
+
+Do not store tokens in shared preferences.
+
+Do not print tokens during development.
+
+Do not send tokens to crash reporting systems.
+
+Delete all tokens after logout or unrecoverable refresh failure.
+
+Use the strictest available platform storage configuration.
+
+### 5.4 Refresh behavior
+
+Refresh shortly before access-token expiry.
+
+Allow only one refresh operation at a time.
+
+Queue concurrent API requests behind that operation.
+
+Replace the stored refresh token after every successful refresh.
+
+Retry one lost refresh response within the reuse interval.
+
+Stop retrying after `invalid_grant`.
+
+Clear local credentials after terminal refresh failure.
+
+Return the user to sign-in.
+
+Do not loop refresh attempts.
+
+### 5.5 API client behavior
+
+Send the access token in the `Authorization` header.
+
+Use the `Bearer` scheme.
+
+Never place tokens in query parameters.
+
+Use the tRPC client for full CRM feature coverage.
+
+Use generated REST clients only for the documented REST bridge.
+
+The OpenAPI schema cannot describe every tRPC procedure.
+
+Regenerate REST models from the public `/openapi.json` document.
+
+Prefer the OpenAPI Generator `dart-dio` target for REST clients.
+
+Keep authentication and retry behavior in one Dio interceptor.
+
+Do not retry mutations after uncertain transport failures automatically.
+
+### 5.6 Logout behavior
+
+Revoke the refresh token when supported.
+
+Call the end-session endpoint when the user requests full logout.
+
+Delete local tokens even when remote revocation fails.
+
+Close the local authenticated application state.
+
+Do not treat local deletion as server revocation.
+
+## 6. Security requirements
+
+### 6.1 Token lifetime and revocation
+
+Use a ten-minute access-token lifetime.
+
+Use a 30-day refresh-token lifetime.
+
+Rotate refresh tokens on every use.
+
+Use a 30-second refresh reuse interval.
+
+Revoke the refresh chain after detected reuse outside that interval.
+
+JWT access tokens remain valid until expiry.
+
+Session revocation must stop future refresh operations.
+
+Client disablement must stop authorization and refresh operations.
+
+Signing-key rotation must preserve active public keys during overlap.
+
+### 6.2 Redirect security
+
+Match redirect URIs exactly.
+
+Require HTTPS for claimed web redirects.
+
+Allow loopback HTTP only for local native clients.
+
+Reject fragments in registered redirect URIs.
+
+Reject wildcard hosts and paths.
+
+Review private scheme ownership for Android and iOS.
+
+Use universal links or app links where practical.
+
+### 6.3 Request security
+
+Reject multiple credential types.
+
+Reject bearer tokens on session-only routes.
+
+Reject missing required resource audiences.
+
+Reject missing required scopes.
+
+Apply rate limits to authorization, token, refresh, and revocation endpoints.
+
+Keep Better Auth database rate limiting enabled.
+
+Use generic public error messages.
+
+Log bounded internal reason codes.
+
+### 6.4 Authorization security
+
+Never authorize from an ID token.
+
+Never authorize from email claims alone.
+
+Map the access-token subject to the current user.
+
+Load current workspace membership before sensitive actions.
+
+Load current role state before sensitive actions.
+
+Keep service-level ownership and permission checks.
+
+Scopes must never grant a role the user lacks.
+
+### 6.5 Key protection
+
+Protect the OAuth signing-key database records.
+
+Restrict production database access.
+
+Protect `BETTER_AUTH_SECRET` through the existing secret process.
+
+Never export private JWKS values to application logs.
+
+Back up signing keys with the database.
+
+Define a documented emergency rotation process.
+
+## 7. Database and deployment plan
+
+### 7.1 Migration order
+
+1. Align Better Auth package versions.
+2. Add provider and JWT plugin configuration.
+3. Generate the Prisma schema.
+4. Review every generated model and index.
+5. Create the database migration.
+6. Run migration tests against a `_test` database.
+7. Deploy database changes before API changes.
+8. Deploy authorization endpoints and bearer verification.
+9. Reconcile the official Flutter client.
+10. Release the Flutter application.
+
+### 7.2 Compatibility deployment
+
+The first API deployment must retain cookies and API keys.
+
+The new bearer path must be additive.
+
+Existing tRPC callers must continue without changes.
+
+Existing integration keys must continue without changes.
+
+Existing browser sessions must survive the deployment.
+
+The Flutter client must launch after discovery tests pass.
+
+### 7.3 Rollback
+
+Disable the official OAuth client first.
+
+Stop new authorization and refresh operations.
+
+Keep the OAuth database tables.
+
+Keep signing keys until every issued token expires.
+
+Roll back the API implementation after token expiry.
+
+Continue browser and API-key access throughout rollback.
+
+Do not drop OAuth tables during an emergency rollback.
+
+## 8. File change map
+
+| Path | Implemented change |
+| --- | --- |
+| `packages/auth/package.json` | Align Better Auth versions and add OAuth Provider. |
+| `packages/auth/src/auth.ts` | Configure OAuth Provider and JWT plugins. |
+| `packages/auth/src/oauth-config.ts` | Define resources, scopes, durations, and client policy. |
+| `packages/auth/src/env.ts` | No change. Existing public URLs provide every value. |
+| `packages/db/prisma/schema.prisma` | Add generated OAuth Provider and JWKS models. |
+| `packages/db/prisma/migrations/<timestamp>_add_oauth_provider` | Add the reviewed database migration. |
+| `apps/api/src/auth/request-principal.ts` | Define the validated principal type. |
+| `apps/api/src/auth/request-principal.service.ts` | Resolve session, API-key, or OAuth credentials. |
+| `apps/api/src/trpc/context.types.ts` | Add the principal to API contexts. |
+| `apps/api/src/trpc/trpc.context.ts` | Resolve the principal once per request. |
+| `apps/api/src/trpc/middlewares/auth.middleware.ts` | Authenticate through the principal. |
+| `apps/api/src/trpc/middlewares/session-only.middleware.ts` | Require the session credential kind. |
+| `apps/api/src/trpc/middlewares/oauth-scope.middleware.ts` | Enforce OAuth query and mutation scopes. |
+| `apps/api/src/trpc/trpc.module.ts` | Register shared authentication and scope middleware. |
+| `apps/api/src/create-app.ts` | Add bearer security to both OpenAPI documents. |
+| `apps/api/src/app.module.ts` | Register any required auth services and route adapters. |
+| `apps/app/proxy.ts` | Permit authenticated OAuth flow pages. |
+| `apps/app/app/(landing)/oauth/consent/page.tsx` | Render the server-owned consent page. |
+| `packages/ui` | No change. Existing buttons and spinners render consent actions. |
+| `apps/api/test/auth.e2e.spec.ts` | Cover discovery, PKCE issuance, refresh, validation, and compatibility. |
+| `apps/api/test/oauth-openapi.e2e.spec.ts` | Cover security schemes and OR alternatives. |
+| `.env.example` | No change. OAuth requires no new environment value. |
+| `apps/api/src/config/env.validation.ts` | No change. OAuth requires no new environment value. |
+| `turbo.json` | No change. OAuth requires no new environment value. |
+| `docs/api.md` | Document the final authentication architecture. |
+| `docs/environment.md` | Document final environment decisions. |
+| `docs/exposed-api.md` | Link the implemented bearer flow and scopes. |
+
+No new environment value is required for the recommended first-party client.
+
+Use `API_URL` for issuer and API resource origins.
+
+Use `APP_URL` for login and consent page origins.
+
+Add no per-package `.env` file.
+
+## 9. Verification plan
+
+### 9.1 Unit tests
+
+Test request-principal resolution for each credential type.
+
+Test anonymous requests.
+
+Test duplicate credential rejection.
+
+Test malformed bearer headers.
+
+Test invalid signatures.
+
+Test incorrect issuers.
+
+Test incorrect audiences.
+
+Test expired tokens.
+
+Test future `nbf` values.
+
+Test disabled clients.
+
+Test deleted users.
+
+Test missing read scopes.
+
+Test missing write scopes.
+
+Test standards-compatible authentication errors.
+
+### 9.2 OAuth end-to-end tests
+
+Test authorization-server metadata.
+
+Test OpenID configuration metadata.
+
+Test JWKS publication.
+
+Test authorization with PKCE `S256`.
+
+Test rejection without PKCE.
+
+Test rejection for a wrong verifier.
+
+Test rejection for a wrong redirect URI.
+
+Test authorization-code reuse rejection.
+
+Test ID token issuer, audience, nonce, and expiry.
+
+Test read access with `crm.read`.
+
+Test mutation rejection without `crm.write`.
+
+Test mutation access with `crm.write`.
+
+Test refresh rotation.
+
+Test bounded refresh-response reuse.
+
+Test refresh reuse detection outside the interval.
+
+Test token revocation.
+
+Test end-session behavior.
+
+Test client disablement.
+
+### 9.3 Compatibility tests
+
+Run every existing authentication test.
+
+Confirm browser session authentication.
+
+Confirm API-key authentication.
+
+Confirm session-only API-key management.
+
+Confirm public sign-in options.
+
+Confirm upstream SSO sign-in.
+
+Confirm fixed workspace membership.
+
+Confirm member, administrator, and owner permissions.
+
+Confirm public tRPC procedures remain public.
+
+Confirm native controller protection.
+
+### 9.4 Documentation tests
+
+Validate both OpenAPI documents.
+
+Confirm each security requirement uses OR alternatives.
+
+Generate the Dart REST client.
+
+Compile the generated Dart client.
+
+Compare documented discovery endpoints with live responses.
+
+Confirm every published endpoint is reachable externally.
+
+### 9.5 Required commands
+
+Use repository scripts when available.
+
+Run these checks from the repository root:
+
+```bash
+bun run test
+bun run lint
+bun run build
+git diff --check
+```
+
+Run the focused API authentication suite before the full suite.
+
+Use the repository database commands from `docs/setup.md`.
+
+Do not run production migrations from a development checkout.
+
+## 10. Acceptance criteria
+
+The change is complete only after every criterion passes.
+
+- The official Flutter client uses Authorization Code Flow with PKCE.
+- The Flutter package contains no client secret.
+- The authorization server publishes valid OAuth metadata.
+- The authorization server publishes valid OIDC metadata.
+- The server publishes a valid JWKS document.
+- The API accepts valid CompCRM bearer access tokens.
+- The API rejects upstream provider tokens.
+- The API validates issuer, audience, signature, expiry, and activation.
+- OAuth queries require `crm.read`.
+- OAuth mutations require `crm.write`.
+- Current workspace roles still control every protected action.
+- Session-only routes reject OAuth and API-key credentials.
+- Requests with multiple credential types fail.
+- Browser sessions continue to work.
+- Existing API keys continue to work.
+- OpenAPI describes cookie, API-key, and bearer alternatives.
+- Refresh tokens rotate successfully.
+- Logout deletes local tokens and attempts server revocation.
+- Logs contain no tokens, codes, headers, bodies, or query strings.
+- Existing authentication and SSO tests pass.
+- New OAuth end-to-end tests pass.
+- The generated Dart REST client compiles.
+- `git diff --check` passes.
+
+## 11. Non-goals
+
+This release does not add multi-tenancy.
+
+It does not add organization selection.
+
+It does not add tenant headers.
+
+It does not expose upstream identity-provider tokens.
+
+It does not replace browser session cookies.
+
+It does not replace existing API keys.
+
+It does not add client-credentials grants.
+
+It does not add dynamic client registration.
+
+It does not add token exchange.
+
+It does not add DPoP.
+
+It does not encode current roles in long-lived token claims.
+
+It does not move domain authorization into the authentication package.
+
+## 12. Delivery phases
+
+### 12.1 Phase A: dependency and schema foundation — complete
+
+Align Better Auth packages.
+
+Add the provider configuration.
+
+Generate and migrate the database schema.
+
+Reconcile the official mobile client at startup.
+
+### 12.2 Phase B: API bearer support — complete
+
+Add the request-principal resolver.
+
+Update tRPC and controller authentication.
+
+Add OAuth scope enforcement.
+
+Add OpenAPI bearer alternatives.
+
+Verify existing clients remain compatible.
+
+### 12.3 Phase C: authorization user experience — complete
+
+Verify discovery routing.
+
+Add the custom-client consent page.
+
+Add exact first-party redirect URIs.
+
+Reconcile the official Flutter client.
+
+### 12.4 Phase D: Flutter release — separate application work
+
+Implement system-browser sign-in.
+
+Implement secure token storage.
+
+Implement serialized refresh behavior.
+
+Implement logout and revocation.
+
+Run mobile platform security tests.
+
+### 12.5 Phase E: controlled enablement — pending deployment
+
+Enable the official OAuth client.
+
+Release to internal testers first.
+
+Monitor authorization and refresh failure rates.
+
+Expand the release after stable results.
+
+## 13. Operational metrics
+
+Track authorization requests by bounded outcome.
+
+Track token exchanges by bounded outcome.
+
+Track refresh attempts by bounded outcome.
+
+Track invalid audience and invalid issuer counts.
+
+Track insufficient-scope counts.
+
+Track client disablement events.
+
+Track signing-key rotation events.
+
+Do not attach tokens or authorization codes to metrics.
+
+Alert on repeated refresh reuse detection.
+
+Alert on sudden invalid-signature increases.
+
+Alert on sustained token endpoint failures.
+
+## 14. References
+
+- [CompCRM exposed API](./exposed-api.md)
+- [CompCRM API architecture](./api.md)
+- [CompCRM environment rules](./environment.md)
+- [CompCRM design rules](./design.md)
+- [Better Auth OAuth Provider](https://better-auth.com/docs/plugins/oauth-provider)
+- [Better Auth 1.7 upgrade guide](https://better-auth.com/docs/guides/1-7-upgrade-guide)
+- [Flutter AppAuth](https://pub.dev/packages/flutter_appauth)
+- [Flutter Secure Storage](https://pub.dev/packages/flutter_secure_storage)
+- [OpenAPI Generator Dart Dio](https://openapi-generator.tech/docs/generators/dart-dio/)
+- [OAuth 2.0 for Native Apps](https://www.rfc-editor.org/rfc/rfc8252)
+- [OAuth 2.0 Authorization Server Metadata](https://www.rfc-editor.org/rfc/rfc8414)
+- [OAuth 2.0 Security Best Current Practice](https://www.rfc-editor.org/rfc/rfc9700)
+- [Proof Key for Code Exchange](https://www.rfc-editor.org/rfc/rfc7636)
+
+## 15. Final recommendation
+
+CompCRM needs server changes before Flutter can use proper OIDC.
+
+The recommended solution uses Better Auth as the CompCRM authorization server.
+
+It issues CompCRM tokens through Authorization Code Flow with PKCE.
+
+It validates those tokens through one typed API principal.
+
+It combines OAuth scopes with current workspace role checks.
+
+It preserves browser cookies and integration API keys.
+
+This design adds mobile authentication without changing CRM tenancy or business authorization.
diff --git a/docs/setup.md b/docs/setup.md
index 03b8912f7..d9a15cc6c 100644
--- a/docs/setup.md
+++ b/docs/setup.md
@@ -13,6 +13,11 @@ bun run db:migrate && bun run db:seed
 bun run dev                 # app :3000, api :3001, agent :2000
 ```
 
+The container creates the `crm` runtime role on a new volume. This role owns the
+database and does not have `SUPERUSER` or `BYPASSRLS`. Both attributes bypass
+tenant row-level security. A volume created before this role existed needs a
+backup and a clean restore into a new volume before it can run this release.
+
 Prisma from the repo root: `db:generate`, `db:migrate`, `db:push`, `db:reset`,
 `db:seed`, `db:studio`, `db:deploy`.
 
@@ -113,6 +118,18 @@ builds, and the pages that touch them fail. Test schema changes locally, where
 worse: every preview applied its own migrations to the production database, so on
 2026-08-07 the live schema ran six migrations ahead of the live code all day.
 
+### Better Auth 1.7 account identities
+
+Migration `20260830221000_better_auth_account_identity` adds issuer-scoped account identities.
+Back up the `account` and `user` tables before production deployment.
+The migration preserves provider-scoped identities and checks for collisions.
+Microsoft changes its account subject from `sub` to `oid` in Better Auth 1.7.
+The migration reads `oid` from each stored Microsoft ID token.
+The migration stops when a Microsoft row lacks that trusted mapping.
+Repair that row from a verified Entra export before retrying deployment.
+Do not infer the mapping from email addresses.
+The migration removes account rows whose deleted SSO provider cannot supply an issuer.
+
 ### `migrate deploy` is not proof the schema is right
 
 The build follows the deploy with `prisma migrate diff --exit-code` against
@@ -142,6 +159,40 @@ DATABASE_URL="…" bunx prisma migrate diff \
 strings, asserted by `packages/env/test/root.spec.ts`. **Generate your own secret**;
 never reuse one from an example, a tutorial, or another environment.
 
+## XMPP agent gateway
+
+The gateway starts with the agent when `XMPP_COMPONENT_ENABLED=1`.
+It uses the root `.env` and the same PostgreSQL database.
+
+Set these required values:
+
+```sh
+XMPP_COMPONENT_ENABLED="1"
+XMPP_COMPONENT_JID="gateway.agents.example.com"
+XMPP_COMPONENT_SECRET="..."
+XMPP_ORGANIZATION_ID="..."
+AGENT_BRIDGE_SECRET="..."
+```
+
+The XMPP server must contain the component account.
+The gateway connects through `XMPP_COMPONENT_SERVICE`.
+The default address is `xmpp://127.0.0.1:5275`.
+
+`XMPP_ALLOWED_CALLER_DOMAINS` limits discovery and invocation.
+`XMPP_ALLOW_DESTRUCTIVE_CALLERS` lists bare JIDs that can run destructive exports.
+An empty destructive caller list denies every destructive export.
+
+The gateway exposes only `apps/agent/src/exports` registry entries.
+It stores task state in PostgreSQL for recovery and replay protection.
+
+Run the live invocation check against a configured test server:
+
+```sh
+XMPP_E2E_ALLOW_SELF_SIGNED=1 bun run --filter=agent e2e:xmpp
+```
+
+Use `XMPP_E2E_ALLOW_SELF_SIGNED` only with an isolated server certificate.
+
 ## Tests
 
 ```sh
@@ -155,6 +206,9 @@ bun run --filter=agent test    # integration specs need DATABASE_URL + real Post
 name must end in `_test`; the suite deletes rows it expects to put back, so it
 refuses anything else.
 
+The local `crm` role has `CREATEDB` only so this command can create `crm_test`.
+Production runtime roles do not need that attribute.
+
 **`migrate deploy` only applies migrations that are missing. It never removes a
 table, a column or a constraint the database has and the schema does not.** A
 `crm_test` built on a branch that was later abandoned therefore keeps that branch's
diff --git a/docs/telemetry.md b/docs/telemetry.md
index 6e1ed36aa..d49669f31 100644
--- a/docs/telemetry.md
+++ b/docs/telemetry.md
@@ -49,6 +49,12 @@ a fork somewhere else by editing that file. Nothing is sent while `NODE_ENV` is
 Once per install per day, from the API itself. Counts and distributions from grouped queries.
 Never a value from a row.
 
+The rollup combines every workspace in the installation. It adds raw counts before computing
+bands, rates, means, and distributions. `members_bucket` counts distinct users across all
+workspace memberships. Capability booleans are true when any workspace enables the capability.
+The model fields report the shared model when every workspace uses one model. They report
+`mixed` and a null context window when workspace model settings differ.
+
 **It runs in-process and needs no cron.** `TelemetryService` rolls up on boot and then hourly,
 and the day claim below makes all but the first of those a no-op. That covers both shapes an
 install comes in: a serverless deployment rolls up on a cold start, a long-running container on
@@ -139,7 +145,6 @@ and the tool name only. `AgentEvent.data` itself is never sent.
 | `facts_by_method` | Counts by the `method` label a tool recorded |
 | `facts_by_evidence_kind` | Counts by evidence kind, from the `WEIGHTS` map in `lib/evidence.ts` |
 | `fact_dismissal_rate` | The share of decided facts a human rejected |
-| `fact_decision_median_hours` | Median hours from `observedAt` to `decidedAt` |
 | `facts_superseded_within_7_days` | Facts the agent changed its mind about |
 
 Evidence kinds are matched against the eleven in `lib/evidence.ts`; anything else is `other`.
diff --git a/docs/tracking.md b/docs/tracking.md
index f4e8ecb77..4bbf05b35 100644
--- a/docs/tracking.md
+++ b/docs/tracking.md
@@ -4,9 +4,9 @@ A first-party script on the customer's own marketing site, a collector in the AP
 and one rule about what it is for: **a form submission becomes a contact.** Page
 views exist to give that contact a story, not to be a web-analytics product.
 
-Everything here is one install's own website. There is no second tenant, no shared
-pixel, and no vendor: the script is served from the same origin as the app, the
-cookie is first-party, and the only thing that ever leaves the browser is a POST to
+Each workspace tracks its own marketing sites with a separate site id and tenant
+storage. Workspaces share no pixel identity, and there is no vendor. The script is
+served from the app origin, the cookie is first-party, and the browser only posts to
 `/api/t/e` on the install's own API.
 
 ## Two scripts, and why
@@ -75,6 +75,10 @@ stays with the route that needs it.
 
 The gauntlet, in order, in `TrackingIngestService.accept`:
 
+The anonymous endpoints resolve the opaque site id through `trackingSiteLocator`.
+This global table stores only the site id and organization id. Minting or rotating
+a site id updates the locator and tenant settings in one transaction.
+
 1. **User agent** — the `BOT` pattern.
 2. **Site id** — must be a live `cmp_` id, and `forSite` refuses a rotated one.
 3. **Origin** — `originAllowed`. A missing `Origin` header is refused **even with
@@ -178,6 +182,10 @@ deleted* comes to be true of email and not of forms.
 `POST /internal/tracking/retention`, nightly at 04:00 via `apps/api/vercel.json`,
 `CRON_SECRET` or nothing.
 
+The job discovers organizations globally. It then rolls up and removes each
+organization's records inside transaction-local tenant context. Expired tracking
+counters use the same tenant boundary.
+
 - **The cutoff is a whole UTC day**, `EVENT_RETENTION_DAYS` back and then truncated.
   A mid-day cutoff splits one calendar day across two nightly runs, and
   `trackedPageDaily` keeps the larger half of a day it saw twice — so the boundary
diff --git a/package.json b/package.json
index 534ec9d00..7bcf146c7 100644
--- a/package.json
+++ b/package.json
@@ -7,6 +7,7 @@
 		"prepare": "git config core.hooksPath .githooks 2>/dev/null || true",
 		"build": "turbo run build",
 		"dev": "turbo run dev",
+		"dev:kaneo": "bun tools/kaneo-dev.ts",
 		"lint": "turbo run lint",
 		"lint:slop": "oxlint",
 		"lint:dead": "knip --no-progress",
@@ -18,31 +19,38 @@
 		"db:generate": "turbo run db:generate",
 		"db:migrate": "turbo run db:migrate",
 		"db:push": "turbo run db:push",
+		"db:rehearse": "bun run --filter=@crm/db db:rehearse",
 		"db:reset": "turbo run db:reset",
 		"db:seed": "turbo run db:seed",
 		"db:studio": "turbo run db:studio",
 		"db:test": "bun run --filter=@crm/db db:test"
 	},
 	"devDependencies": {
-		"@biomejs/biome": "^2.4.10",
-		"@oxlint/plugins": "1.78.0",
-		"knip": "6.32.2",
-		"oxlint": "1.78.0",
-		"turbo": "^2.10.8",
-		"typescript": "5.9.2"
+		"@biomejs/biome": "^2.5.13",
+		"@oxlint/plugins": "^1.83.0",
+		"@paralleldrive/cuid2": "^3.3.0",
+		"drizzle-orm": "^0.45.2",
+		"knip": "^6.35.1",
+		"oxlint": "^1.83.0",
+		"turbo": "^2.10.12",
+		"typescript": "^7.0.2"
 	},
 	"engines": {
 		"node": ">=22"
 	},
-	"packageManager": "bun@1.3.12",
+	"packageManager": "bun@1.4.2",
 	"devEngines": {
 		"packageManager": {
 			"name": "bun",
-			"version": "1.3.12"
+			"version": "1.4.2"
 		}
 	},
 	"workspaces": [
 		"apps/*",
-		"packages/*"
-	]
+		"packages/*",
+		"packages/agent-xmpp/*"
+	],
+	"patchedDependencies": {
+		"@better-auth/oauth-provider@1.7.3": "patches/@better-auth%2Foauth-provider@1.7.3.patch"
+	}
 }
diff --git a/packages/agent-xmpp/core/package.json b/packages/agent-xmpp/core/package.json
new file mode 100644
index 000000000..6abed437a
--- /dev/null
+++ b/packages/agent-xmpp/core/package.json
@@ -0,0 +1,27 @@
+{
+	"name": "@agent-xmpp/core",
+	"version": "0.1.0",
+	"description": "ProtoXEP schema validation and canonicalization",
+	"type": "module",
+	"main": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"import": "./dist/index.js"
+		}
+	},
+	"scripts": {
+		"build": "rm -rf dist && node ../../../node_modules/typescript/bin/tsc",
+		"test": "bun test src",
+		"typecheck": "tsc --noEmit"
+	},
+	"dependencies": {
+		"@agent-xmpp/protocol": "workspace:*",
+		"ajv": "8.20.0"
+	},
+	"devDependencies": {
+		"@types/node": "^26.5.0",
+		"typescript": "^7.0.2"
+	}
+}
diff --git a/packages/agent-xmpp/core/src/index.ts b/packages/agent-xmpp/core/src/index.ts
new file mode 100644
index 000000000..20cdc26e1
--- /dev/null
+++ b/packages/agent-xmpp/core/src/index.ts
@@ -0,0 +1 @@
+export * from "./schema.js";
diff --git a/packages/agent-xmpp/core/src/schema-worker-lineage.test.ts b/packages/agent-xmpp/core/src/schema-worker-lineage.test.ts
new file mode 100644
index 000000000..eea640fc3
--- /dev/null
+++ b/packages/agent-xmpp/core/src/schema-worker-lineage.test.ts
@@ -0,0 +1,79 @@
+import { afterAll, describe, expect, it } from "bun:test";
+import { EventEmitter } from "node:events";
+
+interface WorkerRequest {
+	id: number;
+}
+
+class FakeWorker extends EventEmitter {
+	static instances: FakeWorker[] = [];
+	request?: WorkerRequest;
+
+	constructor() {
+		super();
+		FakeWorker.instances.push(this);
+	}
+
+	unref(): void {}
+
+	postMessage(request: WorkerRequest): void {
+		this.request = request;
+	}
+
+	terminate(): Promise<number> {
+		return Promise.resolve(0);
+	}
+}
+
+function workerAt(index: number): FakeWorker {
+	const worker = FakeWorker.instances[index];
+	if (!worker) throw new Error(`missing worker ${index}`);
+	return worker;
+}
+
+const {
+	closeSchemaWorkers,
+	SCHEMA_WORKER_FAILURE_LIMIT,
+	setWorkerFactory,
+	validateJsonBounded,
+} = await import("./schema.ts?worker-lineage");
+
+setWorkerFactory(
+	() => new FakeWorker() as unknown as import("node:worker_threads").Worker,
+);
+
+afterAll(async () => {
+	await closeSchemaWorkers();
+});
+
+describe("schema worker replacement lineages", () => {
+	it("stops one worker lineage after three interleaved failures", async () => {
+		const schema = { type: "string" } as const;
+
+		for (
+			let generation = 0;
+			generation < SCHEMA_WORKER_FAILURE_LIMIT;
+			generation++
+		) {
+			const unaffectedValidation = validateJsonBounded(schema, "valid");
+			const failedValidation = validateJsonBounded(schema, "failed");
+			const unaffectedWorker = workerAt(0);
+			const failingWorker = workerAt(generation + 1);
+			const unaffectedRequest = unaffectedWorker.request;
+			if (!unaffectedRequest) throw new Error("missing unaffected request");
+
+			unaffectedWorker.emit("message", {
+				id: unaffectedRequest.id,
+				errors: [],
+			});
+			failingWorker.emit("error", new Error(`failure ${generation + 1}`));
+
+			await expect(unaffectedValidation).resolves.toEqual([]);
+			await expect(failedValidation).rejects.toThrow(
+				`failure ${generation + 1}`,
+			);
+		}
+
+		expect(FakeWorker.instances).toHaveLength(SCHEMA_WORKER_FAILURE_LIMIT + 1);
+	});
+});
diff --git a/packages/agent-xmpp/core/src/schema-worker.ts b/packages/agent-xmpp/core/src/schema-worker.ts
new file mode 100644
index 000000000..34bccb6d9
--- /dev/null
+++ b/packages/agent-xmpp/core/src/schema-worker.ts
@@ -0,0 +1,63 @@
+import { parentPort } from "node:worker_threads";
+
+import {
+	Ajv2020,
+	type ErrorObject,
+	type ValidateFunction,
+} from "ajv/dist/2020.js";
+import { isXep0082DateTime } from "@agent-xmpp/protocol";
+
+interface ValidationRequest {
+	id: number;
+	schemaHash: string;
+	schema: Record<string, unknown>;
+	value: unknown;
+}
+
+interface ValidationResponse {
+	id: number;
+	errors?: string[];
+	failure?: string;
+}
+
+const ajv = new Ajv2020({
+	strict: true,
+	allErrors: true,
+	validateSchema: true,
+	unicodeRegExp: true,
+	ownProperties: true,
+});
+ajv.addFormat("uri", {
+	type: "string",
+	validate(value: string): boolean {
+		try {
+			return new URL(value).protocol.length > 1;
+		} catch {
+			return false;
+		}
+	},
+});
+ajv.addFormat("date-time", isXep0082DateTime);
+
+const validators = new Map<string, ValidateFunction>();
+
+parentPort?.on("message", (request: ValidationRequest) => {
+	const response: ValidationResponse = { id: request.id };
+	try {
+		let validate = validators.get(request.schemaHash);
+		if (!validate) {
+			validate = ajv.compile(request.schema);
+			validators.set(request.schemaHash, validate);
+		}
+		response.errors = validate(request.value)
+			? []
+			: (validate.errors ?? []).map(formatError);
+	} catch (error) {
+		response.failure = error instanceof Error ? error.message : String(error);
+	}
+	parentPort?.postMessage(response);
+});
+
+function formatError(error: ErrorObject): string {
+	return `${error.instancePath || "$"} ${error.message ?? error.keyword}`;
+}
diff --git a/packages/agent-xmpp/core/src/schema.test.ts b/packages/agent-xmpp/core/src/schema.test.ts
new file mode 100644
index 000000000..18fde5c38
--- /dev/null
+++ b/packages/agent-xmpp/core/src/schema.test.ts
@@ -0,0 +1,23 @@
+import { afterAll, describe, expect, it } from "bun:test";
+
+import { closeSchemaWorkers, validateJsonBounded } from "./schema.js";
+
+afterAll(async () => {
+	await closeSchemaWorkers();
+});
+
+describe("bounded schema validation", () => {
+	it("starts source workers with the declared loader", async () => {
+		await expect(
+			validateJsonBounded(
+				{
+					type: "object",
+					properties: { value: { type: "string" } },
+					required: ["value"],
+					additionalProperties: false,
+				},
+				{ value: "ok" },
+			),
+		).resolves.toEqual([]);
+	});
+});
diff --git a/packages/agent-xmpp/core/src/schema.ts b/packages/agent-xmpp/core/src/schema.ts
new file mode 100644
index 000000000..ac0324505
--- /dev/null
+++ b/packages/agent-xmpp/core/src/schema.ts
@@ -0,0 +1,571 @@
+import { createHash } from "node:crypto";
+import { Worker } from "node:worker_threads";
+import {
+	type AgentApiManifest,
+	assertUnicodeScalarString,
+	DEFAULT_JSON_LIMITS,
+	isApiVersion,
+	isNormalizedEndpointJid,
+	isToolName,
+	isXep0082DateTime,
+	type JsonSchema,
+	parseStrictJson,
+	type RegisteredTool,
+	XMPP_TOOL_EXTENSION_KEY,
+} from "@agent-xmpp/protocol";
+import EVENT_SCHEMA_DOCUMENT from "@agent-xmpp/protocol/schema/event.schema.json" with {
+	type: "json",
+};
+import MANIFEST_SCHEMA_DOCUMENT from "@agent-xmpp/protocol/schema/manifest.schema.json" with {
+	type: "json",
+};
+import {
+	Ajv2020,
+	type ErrorObject,
+	type ValidateFunction,
+} from "ajv/dist/2020.js";
+
+export const MANIFEST_MAX_BYTES = 1_048_576;
+export const SCHEMA_MAX_BYTES = 262_144;
+export const SCHEMA_MAX_DEPTH = 64;
+export const SCHEMA_MAX_NODES = 10_000;
+export const SCHEMA_MAX_PATTERN_BYTES = 4_096;
+export const SCHEMA_MAX_PENDING_VALIDATIONS = 64;
+
+export class SchemaResourceLimitError extends Error {}
+
+const MANIFEST_SCHEMA = MANIFEST_SCHEMA_DOCUMENT as JsonSchema;
+const EVENT_SCHEMA = EVENT_SCHEMA_DOCUMENT as JsonSchema;
+
+const ajv = new Ajv2020({
+	strict: true,
+	allErrors: true,
+	validateSchema: true,
+	unicodeRegExp: true,
+	ownProperties: true,
+});
+ajv.addFormat("uri", {
+	type: "string",
+	validate(value: string): boolean {
+		try {
+			return new URL(value).protocol.length > 1;
+		} catch {
+			return false;
+		}
+	},
+});
+ajv.addFormat("date-time", isXep0082DateTime);
+const manifestValidator = ajv.compile(MANIFEST_SCHEMA);
+const validatorCache = new Map<string, ValidateFunction>();
+const SCHEMA_WORKER_COUNT = 2;
+export const SCHEMA_WORKER_FAILURE_LIMIT = 3;
+const DEFAULT_SCHEMA_TIMEOUT_MS = 500;
+
+interface WorkerRequest {
+	id: number;
+	schemaHash: string;
+	schema: JsonSchema;
+	value: unknown;
+}
+
+interface WorkerResponse {
+	id: number;
+	errors?: string[];
+	failure?: string;
+}
+
+interface PendingValidation {
+	request: WorkerRequest;
+	timeoutMs: number;
+	resolve: (errors: string[]) => void;
+	reject: (error: Error) => void;
+}
+
+interface SchemaWorkerSlot {
+	worker: Worker;
+	consecutiveFailures: number;
+	pending?: PendingValidation;
+	timer?: ReturnType<typeof setTimeout>;
+}
+
+let nextValidationId = 1;
+const validationQueue: PendingValidation[] = [];
+const schemaWorkers: SchemaWorkerSlot[] = [];
+
+/** RFC 8785 JSON Canonicalization Scheme serialization. */
+export function canonicalJson(value: unknown): string {
+	if (value === null) return "null";
+	if (typeof value === "string") {
+		assertUnicodeScalarString(value);
+		return JSON.stringify(value);
+	}
+	if (typeof value === "boolean") return value ? "true" : "false";
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) throw new Error("non-finite JSON number");
+		return Object.is(value, -0) ? "0" : JSON.stringify(value);
+	}
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	if (value && typeof value === "object") {
+		const object = value as Record<string, unknown>;
+		return `{${Object.keys(object)
+			.sort()
+			.map((key) => `${canonicalJson(key)}:${canonicalJson(object[key])}`)
+			.join(",")}}`;
+	}
+	throw new Error(`unsupported JSON value: ${typeof value}`);
+}
+
+/** XEP-0300 SHA-256 value: standard padded Base64, without an algorithm prefix. */
+export function digestJson(value: unknown): string {
+	return createHash("sha256")
+		.update(canonicalJson(value), "utf8")
+		.digest("base64");
+}
+
+export function assertJsonValueBounded(
+	value: unknown,
+	maxBytes: number,
+	label = "JSON value",
+): void {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0)
+		throw new Error("JSON byte limit must be a positive integer");
+	const pending: Array<{ value: unknown; depth: number }> = [
+		{ value, depth: 0 },
+	];
+	const visited = new WeakSet<object>();
+	let members = 0;
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (!current) break;
+		if (current.depth > DEFAULT_JSON_LIMITS.maxDepth) {
+			throw new SchemaResourceLimitError(
+				`${label} exceeds JSON depth ${DEFAULT_JSON_LIMITS.maxDepth}`,
+			);
+		}
+		if (typeof current.value === "string") {
+			if (
+				Buffer.byteLength(current.value, "utf8") >
+				DEFAULT_JSON_LIMITS.maxStringBytes
+			) {
+				throw new SchemaResourceLimitError(
+					`${label} contains an oversized JSON string`,
+				);
+			}
+			continue;
+		}
+		if (current.value === null || typeof current.value !== "object") continue;
+		if (visited.has(current.value))
+			throw new Error(`${label} contains a cyclic value`);
+		visited.add(current.value);
+		const entries = Array.isArray(current.value)
+			? current.value.map((item) => [undefined, item] as const)
+			: Object.entries(current.value as Record<string, unknown>);
+		members += entries.length;
+		if (members > DEFAULT_JSON_LIMITS.maxMembers) {
+			throw new SchemaResourceLimitError(`${label} exceeds JSON member limit`);
+		}
+		for (const [key, child] of entries) {
+			if (
+				key !== undefined &&
+				Buffer.byteLength(key, "utf8") > DEFAULT_JSON_LIMITS.maxStringBytes
+			) {
+				throw new SchemaResourceLimitError(
+					`${label} contains an oversized JSON member name`,
+				);
+			}
+			pending.push({ value: child, depth: current.depth + 1 });
+		}
+	}
+	const encoded = JSON.stringify(value);
+	if (encoded === undefined) throw new Error(`${label} is not a JSON value`);
+	if (Buffer.byteLength(encoded, "utf8") > maxBytes) {
+		throw new SchemaResourceLimitError(`${label} exceeds ${maxBytes} bytes`);
+	}
+}
+
+export function parseManifestJson(text: string): AgentApiManifest {
+	return validateManifest(
+		parseStrictJson(text, { maxBytes: MANIFEST_MAX_BYTES }),
+	);
+}
+
+export function validateManifest(value: unknown): AgentApiManifest {
+	const canonical = canonicalJson(value);
+	if (Buffer.byteLength(canonical, "utf8") > MANIFEST_MAX_BYTES) {
+		throw new SchemaResourceLimitError("manifest exceeds 1 MiB");
+	}
+	if (!manifestValidator(value))
+		throw new Error(
+			`invalid manifest: ${formatErrors(manifestValidator.errors)}`,
+		);
+	const manifest = value as AgentApiManifest;
+	if (!isNormalizedEndpointJid(manifest.agent.jid)) {
+		throw new Error("agent.jid must be a normalized endpoint bare JID");
+	}
+	if (!isApiVersion(manifest.agent.version))
+		throw new Error("agent.version must be a valid API version");
+	for (const [member, uri] of [
+		["agent.homepage", manifest.agent.homepage],
+		["agent.avatarUrl", manifest.agent.avatarUrl],
+	] as const) {
+		if (uri !== undefined && !isPublicProfileHttpsUri(uri)) {
+			throw new Error(
+				`${member} must be an absolute lowercase HTTPS URI with a non-empty host and no userinfo`,
+			);
+		}
+	}
+	const names = new Set<string>();
+	for (const tool of manifest.tools) {
+		assertUnicodeScalarString(tool.name);
+		if (!isToolName(tool.name)) throw new Error("invalid XML tool name");
+		if (names.has(tool.name)) throw new Error(`duplicate tool: ${tool.name}`);
+		names.add(tool.name);
+		preflightSchema(tool.inputSchema, `tool ${tool.name} inputSchema`);
+		if (tool.outputSchema)
+			preflightSchema(tool.outputSchema, `tool ${tool.name} outputSchema`);
+		const extension = tool[XMPP_TOOL_EXTENSION_KEY] as
+			| Record<string, unknown>
+			| undefined;
+		const defaultTimeout = extension?.defaultTimeoutSeconds;
+		const maximumTimeout = extension?.maximumTimeoutSeconds;
+		if (
+			typeof defaultTimeout === "number" &&
+			typeof maximumTimeout === "number" &&
+			defaultTimeout > maximumTimeout
+		) {
+			throw new Error(
+				`tool ${tool.name} default timeout exceeds maximum timeout`,
+			);
+		}
+	}
+	return manifest;
+}
+
+function isPublicProfileHttpsUri(value: string): boolean {
+	if (
+		!value.startsWith("https://") ||
+		!/^[A-Za-z0-9\-._~:/?[\]@!$&'()*+,;=%]+$/.test(value) ||
+		/%(?![0-9A-Fa-f]{2})/.test(value) ||
+		!URL.canParse(value)
+	) {
+		return false;
+	}
+	const authority = value.slice("https://".length).split(/[/?]/, 1)[0] ?? "";
+	if (authority.endsWith(":")) return false;
+	const uri = new URL(value);
+	return (
+		uri.protocol === "https:" &&
+		uri.hostname.length > 0 &&
+		uri.username === "" &&
+		uri.password === "" &&
+		uri.hash === ""
+	);
+}
+
+export function registeredTools(manifest: AgentApiManifest): RegisteredTool[] {
+	return manifest.tools.map((tool) => ({
+		...tool,
+		inputSchemaHash: digestJson(tool.inputSchema),
+		outputSchemaHash: tool.outputSchema
+			? digestJson(tool.outputSchema)
+			: undefined,
+		xmpp: tool[XMPP_TOOL_EXTENSION_KEY] as RegisteredTool["xmpp"],
+	}));
+}
+
+export function validateJson(schema: JsonSchema, value: unknown): string[] {
+	preflightSchema(schema, "schema");
+	const hash = digestJson(schema);
+	let validate = validatorCache.get(hash);
+	if (!validate) {
+		const compiled = ajv.compile(schema);
+		validatorCache.set(hash, compiled);
+		validate = compiled;
+	}
+	return validate(value) ? [] : (validate.errors ?? []).map(formatError);
+}
+
+/**
+ * Evaluate caller-controlled schemas away from the host event loop. Workers are
+ * bounded and replaced after a timeout; each worker caches validators by the
+ * canonical schema hash.
+ */
+export function validateJsonBounded(
+	schema: JsonSchema,
+	value: unknown,
+	timeoutMs = DEFAULT_SCHEMA_TIMEOUT_MS,
+): Promise<string[]> {
+	preflightSchema(schema, "schema");
+	if (!Number.isInteger(timeoutMs) || timeoutMs <= 0) {
+		return Promise.reject(
+			new Error("schema timeout must be a positive integer"),
+		);
+	}
+	const pendingCount =
+		validationQueue.length +
+		schemaWorkers.filter((slot) => slot.pending).length;
+	if (pendingCount >= SCHEMA_MAX_PENDING_VALIDATIONS) {
+		return Promise.reject(
+			new SchemaResourceLimitError("schema validation queue is full"),
+		);
+	}
+	return new Promise<string[]>((resolve, reject) => {
+		validationQueue.push({
+			request: {
+				id: nextValidationId++,
+				schemaHash: digestJson(schema),
+				schema,
+				value,
+			},
+			timeoutMs,
+			resolve,
+			reject,
+		});
+		ensureSchemaWorkers();
+		dispatchValidationQueue();
+	});
+}
+
+export function validateTaskEventPayload(
+	type:
+		| "status"
+		| "progress"
+		| "input_required"
+		| "completed"
+		| "failed"
+		| "cancelled",
+	payload: unknown,
+): Promise<string[]> {
+	const schema: JsonSchema = { ...EVENT_SCHEMA, $ref: `#/$defs/${type}` };
+	delete schema.$id;
+	return validateJsonBounded(schema, payload);
+}
+
+export async function closeSchemaWorkers(): Promise<void> {
+	const workers = schemaWorkers.splice(0);
+	for (const slot of workers) {
+		if (slot.timer) clearTimeout(slot.timer);
+		slot.pending?.reject(new Error("schema validator worker closed"));
+		await slot.worker.terminate();
+	}
+	while (validationQueue.length)
+		validationQueue
+			.shift()
+			?.reject(new Error("schema validator worker closed"));
+}
+
+function ensureSchemaWorkers(): void {
+	while (schemaWorkers.length < SCHEMA_WORKER_COUNT) {
+		const slot = createSchemaWorkerLineage();
+		if (!slot) return;
+		schemaWorkers.push(slot);
+	}
+}
+
+function createSchemaWorkerLineage(
+	consecutiveFailures = 0,
+): SchemaWorkerSlot | undefined {
+	let failures = consecutiveFailures;
+	let lastError = new Error("schema validator worker failed");
+	while (failures < SCHEMA_WORKER_FAILURE_LIMIT) {
+		try {
+			return createSchemaWorker(failures);
+		} catch (error) {
+			lastError = error instanceof Error ? error : lastError;
+			failures++;
+		}
+	}
+	rejectValidationQueue(lastError);
+	return undefined;
+}
+
+let createWorkerInstance: (url: URL) => Worker = (url) => new Worker(url);
+
+export function setWorkerFactory(factory: (url: URL) => Worker): void {
+	createWorkerInstance = factory;
+}
+
+function createSchemaWorker(consecutiveFailures: number): SchemaWorkerSlot {
+	const sourceMode = import.meta.url.endsWith(".ts");
+	const worker = createWorkerInstance(
+		new URL(
+			sourceMode ? "./schema-worker.ts" : "./schema-worker.js",
+			import.meta.url,
+		),
+	);
+	worker.unref();
+	const slot: SchemaWorkerSlot = { worker, consecutiveFailures };
+	worker.on("message", (response: WorkerResponse) =>
+		settleWorker(slot, response),
+	);
+	worker.on("error", (error) => {
+		console.error("[schema] validator worker error:", error);
+		replaceWorker(
+			slot,
+			error instanceof Error ? error : new Error(String(error)),
+		);
+	});
+	worker.on("exit", (code) => {
+		if (schemaWorkers.includes(slot) && code !== 0) {
+			console.error(`[schema] validator worker exited with code ${code}`);
+			replaceWorker(
+				slot,
+				new Error(`schema validator worker exited with code ${code}`),
+			);
+		}
+	});
+	return slot;
+}
+
+function dispatchValidationQueue(): void {
+	for (const slot of schemaWorkers) {
+		if (slot.pending) continue;
+		const pending = validationQueue.shift();
+		if (!pending) return;
+		slot.pending = pending;
+		slot.timer = setTimeout(() => {
+			replaceWorker(
+				slot,
+				new SchemaResourceLimitError(
+					`schema validation timed out after ${pending.timeoutMs}ms`,
+				),
+			);
+		}, pending.timeoutMs);
+		slot.timer.unref?.();
+		slot.worker.postMessage(pending.request);
+	}
+}
+
+function settleWorker(slot: SchemaWorkerSlot, response: WorkerResponse): void {
+	const pending = slot.pending;
+	if (!pending || pending.request.id !== response.id) return;
+	if (slot.timer) clearTimeout(slot.timer);
+	slot.timer = undefined;
+	slot.pending = undefined;
+	if (response.failure)
+		pending.reject(new Error(`schema validation failed: ${response.failure}`));
+	else {
+		slot.consecutiveFailures = 0;
+		pending.resolve(response.errors ?? []);
+	}
+	dispatchValidationQueue();
+}
+
+function replaceWorker(slot: SchemaWorkerSlot, error: Error): void {
+	const index = schemaWorkers.indexOf(slot);
+	if (index < 0) return;
+	if (slot.timer) clearTimeout(slot.timer);
+	slot.pending?.reject(error);
+	slot.pending = undefined;
+	void slot.worker.terminate();
+	schemaWorkers.splice(index, 1);
+	const consecutiveFailures = slot.consecutiveFailures + 1;
+	if (consecutiveFailures >= SCHEMA_WORKER_FAILURE_LIMIT) {
+		rejectValidationQueue(error);
+		return;
+	}
+	const replacement = createSchemaWorkerLineage(consecutiveFailures);
+	if (!replacement) return;
+	schemaWorkers.splice(index, 0, replacement);
+	dispatchValidationQueue();
+}
+
+function rejectValidationQueue(error: Error): void {
+	while (validationQueue.length) validationQueue.shift()?.reject(error);
+}
+
+export function preflightSchema(schema: JsonSchema, label: string): void {
+	assertSchemaComplexity(schema, label);
+	const encoded = canonicalJson(schema);
+	if (Buffer.byteLength(encoded, "utf8") > SCHEMA_MAX_BYTES) {
+		throw new SchemaResourceLimitError(`${label} exceeds 256 KiB`);
+	}
+	if (!ajv.validateSchema(schema))
+		throw new Error(
+			`${label} is not a valid JSON Schema: ${formatErrors(ajv.errors)}`,
+		);
+}
+
+function assertSchemaComplexity(schema: JsonSchema, label: string): void {
+	const pending: Array<{ value: unknown; depth: number }> = [
+		{ value: schema, depth: 0 },
+	];
+	let nodes = 0;
+	while (pending.length > 0) {
+		const current = pending.pop();
+		if (!current) break;
+		const { value, depth } = current;
+		if (++nodes > SCHEMA_MAX_NODES) {
+			throw new SchemaResourceLimitError(
+				`${label} exceeds ${SCHEMA_MAX_NODES} nodes`,
+			);
+		}
+		if (depth > SCHEMA_MAX_DEPTH) {
+			throw new SchemaResourceLimitError(
+				`${label} exceeds depth ${SCHEMA_MAX_DEPTH}`,
+			);
+		}
+		if (!value || typeof value !== "object") continue;
+		const object = value as Record<string, unknown>;
+		for (const keyword of ["$ref", "$dynamicRef"] as const) {
+			const reference = object[keyword];
+			if (typeof reference === "string" && !reference.startsWith("#")) {
+				throw new Error(`${label} contains forbidden external ${keyword}`);
+			}
+		}
+		if (object.$vocabulary && typeof object.$vocabulary === "object") {
+			for (const [vocabulary, required] of Object.entries(
+				object.$vocabulary as Record<string, unknown>,
+			)) {
+				if (
+					required === true &&
+					!vocabulary.startsWith("https://json-schema.org/draft/2020-12/vocab/")
+				) {
+					throw new Error(
+						`${label} requires unsupported vocabulary ${vocabulary}`,
+					);
+				}
+			}
+		}
+		if (typeof object.pattern === "string")
+			assertPattern(object.pattern, label);
+		if (
+			object.patternProperties &&
+			typeof object.patternProperties === "object"
+		) {
+			for (const pattern of Object.keys(
+				object.patternProperties as Record<string, unknown>,
+			)) {
+				assertPattern(pattern, label);
+			}
+		}
+		const children = Array.isArray(value) ? value : Object.values(object);
+		for (const child of children)
+			pending.push({ value: child, depth: depth + 1 });
+	}
+}
+
+function assertPattern(pattern: string, label: string): void {
+	if (Buffer.byteLength(pattern, "utf8") > SCHEMA_MAX_PATTERN_BYTES) {
+		throw new SchemaResourceLimitError(
+			`${label} contains a pattern exceeding ${SCHEMA_MAX_PATTERN_BYTES} bytes`,
+		);
+	}
+	try {
+		new RegExp(pattern, "u");
+	} catch (error) {
+		throw new Error(`${label} contains an invalid ECMA-262 pattern`, {
+			cause: error,
+		});
+	}
+}
+
+function formatError(error: ErrorObject): string {
+	return `${error.instancePath || "$"} ${error.message ?? error.keyword}`;
+}
+
+function formatErrors(errors: ErrorObject[] | null | undefined): string {
+	return (
+		(errors ?? []).map(formatError).join("; ") || "schema validation failed"
+	);
+}
diff --git a/packages/agent-xmpp/core/tsconfig.json b/packages/agent-xmpp/core/tsconfig.json
new file mode 100644
index 000000000..055dc08e3
--- /dev/null
+++ b/packages/agent-xmpp/core/tsconfig.json
@@ -0,0 +1,19 @@
+{
+	"compilerOptions": {
+		"target": "ES2022",
+		"module": "NodeNext",
+		"moduleResolution": "NodeNext",
+		"lib": ["ES2022"],
+		"outDir": "dist",
+		"rootDir": "src",
+		"strict": true,
+		"esModuleInterop": true,
+		"skipLibCheck": true,
+		"declaration": true,
+		"declarationMap": true,
+		"sourceMap": true,
+		"types": ["node"]
+	},
+	"include": ["src/**/*"],
+	"exclude": ["node_modules", "dist", "src/**/*.test.ts"]
+}
diff --git a/packages/agent-xmpp/gateway/package.json b/packages/agent-xmpp/gateway/package.json
new file mode 100644
index 000000000..75cb6c6fe
--- /dev/null
+++ b/packages/agent-xmpp/gateway/package.json
@@ -0,0 +1,30 @@
+{
+	"name": "@agent-xmpp/gateway",
+	"version": "0.1.0",
+	"description": "XMPP component and ProtoXEP wire codecs for agent gateways",
+	"type": "module",
+	"main": "./dist/embedded-gateway.js",
+	"types": "./dist/embedded-gateway.d.ts",
+	"exports": {
+		".": {
+			"types": "./dist/embedded-gateway.d.ts",
+			"import": "./dist/embedded-gateway.js"
+		}
+	},
+	"scripts": {
+		"build": "rm -rf dist && node ../../../node_modules/typescript/bin/tsc",
+		"test": "bun test src",
+		"typecheck": "tsc --noEmit"
+	},
+	"dependencies": {
+		"@agent-xmpp/core": "workspace:*",
+		"@agent-xmpp/protocol": "workspace:*",
+		"@xmpp/component": "0.14.0",
+		"@xmpp/xml": "0.14.0",
+		"ulid": "3.0.2"
+	},
+	"devDependencies": {
+		"@types/node": "^26.5.0",
+		"typescript": "^7.0.2"
+	}
+}
diff --git a/packages/agent-xmpp/gateway/src/agent-api-disco.ts b/packages/agent-xmpp/gateway/src/agent-api-disco.ts
new file mode 100644
index 000000000..67b592d0a
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/agent-api-disco.ts
@@ -0,0 +1,580 @@
+import {
+	AGENT_API_NS,
+	AGENT_DIRECTORY_NS,
+	AGENT_ENDPOINT_NS,
+	AGENT_TASK_NS,
+	AGENT_TOOL_NS,
+	DEFAULT_PROTOCOL_NAMESPACES,
+	JSON_MEDIA_TYPE,
+	JSON_SCHEMA_MEDIA_TYPE,
+	isApiVersion,
+	isToolName,
+	type AgentApiManifest,
+	type AgentXmppNamespaces,
+	type RegisteredAgent,
+	type RegisteredTool,
+	parseStrictJson,
+} from "@agent-xmpp/protocol";
+import { canonicalJson, validateManifest } from "@agent-xmpp/core";
+import { xml, type Element } from "@xmpp/xml";
+
+import { buildHash, parseHash } from "./hash-codec.js";
+import { ProtocolError } from "./protocol-error.js";
+import { buildRsm, pageRsm, parseRsm } from "./rsm-codec.js";
+import { VCARD_TEMP_NS } from "./xep-plugins/vcard.js";
+
+export const DISCO_INFO_NS = "http://jabber.org/protocol/disco#info";
+export const DISCO_ITEMS_NS = "http://jabber.org/protocol/disco#items";
+export const DATA_FORMS_NS = "jabber:x:data";
+export const SEARCH_NS = "jabber:iq:search";
+export {
+	AGENT_DIRECTORY_NS,
+	AGENT_API_NS,
+	AGENT_TOOL_NS,
+	AGENT_ENDPOINT_NS,
+	AGENT_TASK_NS,
+};
+
+export interface ManifestRequest {
+	version?: string;
+}
+
+export interface SchemaRequest {
+	tool: string;
+	version: string;
+	direction: "input" | "output";
+	manifestHash: string;
+}
+
+interface PayloadShape {
+	requiredAttributes?: readonly string[];
+	optionalAttributes?: readonly string[];
+	children?: readonly { name: string; xmlns?: string }[];
+}
+
+function assertPayloadShape(payload: Element, shape: PayloadShape): void {
+	const required = shape.requiredAttributes ?? [];
+	const allowed = new Set([
+		"xmlns",
+		...required,
+		...(shape.optionalAttributes ?? []),
+	]);
+	if (
+		required.some(
+			(name) => payload.attrs[name] === undefined || payload.attrs[name] === "",
+		) ||
+		Object.keys(payload.attrs).some((name) => !allowed.has(name))
+	) {
+		throw new Error(`${payload.name} has invalid attributes`);
+	}
+
+	const expectedChildren = shape.children ?? [];
+	const actualChildren = payload.getChildElements();
+	if (
+		payload.children.some(
+			(child) => typeof child === "string" && child.trim() !== "",
+		) ||
+		actualChildren.length !== expectedChildren.length ||
+		actualChildren.some(
+			(child, index) =>
+				child.name !== expectedChildren[index]!.name ||
+				(expectedChildren[index]!.xmlns !== undefined &&
+					child.attrs.xmlns !== expectedChildren[index]!.xmlns),
+		)
+	) {
+		throw new Error(`${payload.name} has invalid children`);
+	}
+}
+
+function requestPayload(
+	request: Element,
+	name: string,
+	namespace: string,
+	expectedIqType: "get" | "set",
+): Element | null {
+	if (request.name !== "iq") return null;
+	const payload = request.getChild(name, namespace);
+	if (!payload) return null;
+	if (request.attrs.type !== expectedIqType)
+		throw new Error(`${name} requires an IQ of type ${expectedIqType}`);
+	return payload;
+}
+
+export function parseManifestRequest(
+	request: Element,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): ManifestRequest | null {
+	const payload = requestPayload(
+		request,
+		"manifest-request",
+		namespaces.api,
+		"get",
+	);
+	if (!payload) return null;
+	assertPayloadShape(payload, { optionalAttributes: ["version"] });
+	const version =
+		payload.attrs.version === undefined
+			? undefined
+			: String(payload.attrs.version);
+	if (version !== undefined && !isApiVersion(version))
+		throw new Error("manifest-request has an invalid version");
+	return version === undefined ? {} : { version };
+}
+
+export function parseSchemaRequest(
+	request: Element,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): SchemaRequest | null {
+	const payload = requestPayload(
+		request,
+		"schema-request",
+		namespaces.api,
+		"get",
+	);
+	if (!payload) return null;
+	assertPayloadShape(payload, {
+		requiredAttributes: ["tool", "version", "direction"],
+		children: [{ name: "hash", xmlns: namespaces.hashes }],
+	});
+	const tool = String(payload.attrs.tool);
+	const version = String(payload.attrs.version);
+	const direction = String(payload.attrs.direction);
+	if (
+		!isToolName(tool) ||
+		!isApiVersion(version) ||
+		(direction !== "input" && direction !== "output")
+	) {
+		throw new Error("schema-request has invalid attributes");
+	}
+	return {
+		tool,
+		version,
+		direction,
+		manifestHash: parseHash(payload).value,
+	};
+}
+
+function resultIq(request: Element, from: string, child: Element): Element {
+	return xml(
+		"iq",
+		{ type: "result", id: request.attrs.id, from, to: request.attrs.from },
+		child,
+	);
+}
+
+function field(name: string, value: string, type?: string): Element {
+	return xml(
+		"field",
+		{ var: name, ...(type ? { type } : {}) },
+		xml("value", {}, value),
+	);
+}
+
+function resultForm(formType: string, fields: Element[]): Element {
+	return xml(
+		"x",
+		{ xmlns: DATA_FORMS_NS, type: "result" },
+		field("FORM_TYPE", formType, "hidden"),
+		...fields,
+	);
+}
+
+function features(...values: string[]): Element[] {
+	return values.map((value) => xml("feature", { var: value }));
+}
+
+const HUMAN_FEATURES = [
+	"urn:xmpp:ping",
+	"urn:xmpp:receipts",
+	"http://jabber.org/protocol/chatstates",
+	"urn:xmpp:reply:0",
+	"urn:xmpp:sid:0",
+	"urn:xmpp:hints",
+];
+
+export function buildGatewayInfo(
+	request: Element,
+	componentJid: string,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): Element {
+	return resultIq(
+		request,
+		componentJid,
+		xml(
+			"query",
+			{ xmlns: DISCO_INFO_NS },
+			xml("identity", {
+				category: "automation",
+				type: "agent-gateway",
+				name: "NanoClaw XMPP Agent Gateway",
+			}),
+			...features(
+				DISCO_INFO_NS,
+				DISCO_ITEMS_NS,
+				SEARCH_NS,
+				DATA_FORMS_NS,
+				namespaces.directory,
+				namespaces.admin,
+				...HUMAN_FEATURES,
+			),
+		),
+	);
+}
+
+export function buildDirectoryInfo(
+	request: Element,
+	componentJid: string,
+): Element {
+	return resultIq(
+		request,
+		componentJid,
+		xml(
+			"query",
+			{ xmlns: DISCO_INFO_NS, node: AGENT_DIRECTORY_NS },
+			xml("identity", {
+				category: "automation",
+				type: "agent-directory",
+				name: "NanoClaw Agent Directory",
+			}),
+			...features(DISCO_INFO_NS, DISCO_ITEMS_NS),
+		),
+	);
+}
+
+export function buildAgentDirectory(
+	request: Element,
+	componentJid: string,
+	agents: RegisteredAgent[],
+	_namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): Element {
+	const query = request.getChild("query", DISCO_ITEMS_NS)!;
+	const page = pageRsm(
+		agents,
+		(agent) => agent.manifest.agent.jid,
+		parseRsm(query),
+	);
+	return resultIq(
+		request,
+		componentJid,
+		xml(
+			"query",
+			{
+				xmlns: DISCO_ITEMS_NS,
+				...(query.attrs.node ? { node: query.attrs.node } : {}),
+			},
+			...page.items.map((agent) =>
+				xml("item", {
+					jid: agent.manifest.agent.jid,
+					name: agent.manifest.agent.title ?? agent.manifest.agent.name,
+				}),
+			),
+			buildRsm(page),
+		),
+	);
+}
+
+export function buildAgentInfo(
+	request: Element,
+	agent: RegisteredAgent,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): Element {
+	const identity = agent.manifest.agent;
+	const taskFeatures = new Set<string>([namespaces.task]);
+	for (const tool of agent.tools) {
+		if (tool.xmpp?.supportsProgress) taskFeatures.add(namespaces.progress);
+		if (tool.xmpp?.supportsCancellation) taskFeatures.add(namespaces.cancel);
+		if (tool.xmpp?.supportsInput) taskFeatures.add(namespaces.input);
+	}
+	return resultIq(
+		request,
+		identity.jid,
+		xml(
+			"query",
+			{ xmlns: DISCO_INFO_NS },
+			xml("identity", {
+				category: "automation",
+				type: "agent-endpoint",
+				name: identity.title ?? identity.name,
+			}),
+			...features(
+				DISCO_INFO_NS,
+				DISCO_ITEMS_NS,
+				namespaces.endpoint,
+				namespaces.manifest,
+				namespaces.schema,
+				...taskFeatures,
+				VCARD_TEMP_NS,
+				...HUMAN_FEATURES,
+			),
+			resultForm(namespaces.endpointInfo, [
+				field("server_name", identity.name),
+				field("server_title", identity.title ?? identity.name),
+				...(identity.description
+					? [field("description", identity.description)]
+					: []),
+				field("version", identity.version),
+				field("manifest_hash_algo", "sha-256"),
+				field("manifest_hash_value", agent.manifestHash),
+				field("cold_start_supported", "1"),
+				field("request_replay_seconds", "86400"),
+			]),
+		),
+	);
+}
+
+export function buildToolItems(
+	request: Element,
+	agent: RegisteredAgent,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): Element {
+	const query = request.getChild("query", DISCO_ITEMS_NS)!;
+	const page = pageRsm(
+		agent.tools,
+		(tool) => toolNode(agent.manifest.agent.version, tool.name, namespaces),
+		parseRsm(query),
+		(tool) => tool.name,
+	);
+	return resultIq(
+		request,
+		agent.manifest.agent.jid,
+		xml(
+			"query",
+			{
+				xmlns: DISCO_ITEMS_NS,
+				node: toolsNode(agent.manifest.agent.version, namespaces),
+			},
+			...page.items.map((tool) =>
+				xml("item", {
+					jid: agent.manifest.agent.jid,
+					node: toolNode(agent.manifest.agent.version, tool.name, namespaces),
+					name: tool.title ?? tool.name,
+				}),
+			),
+			buildRsm(page),
+		),
+	);
+}
+
+export function buildToolCollectionInfo(
+	request: Element,
+	agent: RegisteredAgent,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): Element {
+	return resultIq(
+		request,
+		agent.manifest.agent.jid,
+		xml(
+			"query",
+			{
+				xmlns: DISCO_INFO_NS,
+				node: toolsNode(agent.manifest.agent.version, namespaces),
+			},
+			xml("identity", {
+				category: "automation",
+				type: "agent-tool-collection",
+			}),
+			...features(DISCO_INFO_NS, DISCO_ITEMS_NS),
+		),
+	);
+}
+
+export function buildToolInfo(
+	request: Element,
+	agent: RegisteredAgent,
+	tool: RegisteredTool,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): Element {
+	const taskFeatures: string[] = [namespaces.task];
+	if (tool.xmpp?.supportsProgress) taskFeatures.push(namespaces.progress);
+	if (tool.xmpp?.supportsCancellation) taskFeatures.push(namespaces.cancel);
+	if (tool.xmpp?.supportsInput) taskFeatures.push(namespaces.input);
+	const optionalBoolean = (
+		name: string,
+		value: boolean | undefined,
+	): Element[] => (value === undefined ? [] : [field(name, value ? "1" : "0")]);
+	return resultIq(
+		request,
+		agent.manifest.agent.jid,
+		xml(
+			"query",
+			{
+				xmlns: DISCO_INFO_NS,
+				node: toolNode(agent.manifest.agent.version, tool.name, namespaces),
+			},
+			xml("identity", {
+				category: "automation",
+				type: "agent-tool",
+				name: tool.title ?? tool.name,
+			}),
+			...features(DISCO_INFO_NS, namespaces.tool, ...taskFeatures),
+			resultForm(namespaces.toolInfo, [
+				field("name", tool.name),
+				...(tool.title ? [field("title", tool.title)] : []),
+				...(tool.description ? [field("description", tool.description)] : []),
+				field("api_version", agent.manifest.agent.version),
+				field("input_schema_hash_algo", "sha-256"),
+				field("input_schema_hash_value", tool.inputSchemaHash),
+				...(tool.outputSchemaHash
+					? [
+							field("output_schema_hash_algo", "sha-256"),
+							field("output_schema_hash_value", tool.outputSchemaHash),
+						]
+					: []),
+				...optionalBoolean("read_only", tool.annotations?.readOnlyHint),
+				...optionalBoolean("destructive", tool.annotations?.destructiveHint),
+				...optionalBoolean("idempotent", tool.annotations?.idempotentHint),
+				...optionalBoolean("open_world", tool.annotations?.openWorldHint),
+			]),
+		),
+	);
+}
+
+export function buildSchemaResult(
+	request: Element,
+	agent: RegisteredAgent,
+	tool: RegisteredTool,
+	direction: "input" | "output",
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): Element {
+	const schema = direction === "input" ? tool.inputSchema : tool.outputSchema;
+	const schemaHash =
+		direction === "input" ? tool.inputSchemaHash : tool.outputSchemaHash;
+	if (!schema || !schemaHash) throw new Error("schema not found");
+	const canonicalSchema = canonicalJson(schema);
+	return resultIq(
+		request,
+		agent.manifest.agent.jid,
+		xml(
+			"schema",
+			{
+				xmlns: namespaces.api,
+				tool: tool.name,
+				version: agent.manifest.agent.version,
+				direction,
+				"media-type": JSON_SCHEMA_MEDIA_TYPE,
+			},
+			xml("manifest-hash", {}, buildHash(agent.manifestHash)),
+			xml("schema-hash", {}, buildHash(schemaHash)),
+			xml("json", {}, canonicalSchema),
+		),
+	);
+}
+
+export function buildManifestResult(
+	request: Element,
+	agent: RegisteredAgent,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): Element {
+	return resultIq(
+		request,
+		agent.manifest.agent.jid,
+		xml(
+			"manifest",
+			{
+				xmlns: namespaces.api,
+				version: agent.manifest.agent.version,
+				"media-type": JSON_MEDIA_TYPE,
+			},
+			buildHash(agent.manifestHash),
+			xml("json", {}, agent.canonicalManifest),
+		),
+	);
+}
+
+export function toolsNode(
+	version: string,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): string {
+	if (!isApiVersion(version)) throw new Error("invalid API version");
+	return `${namespaces.tools}#${version}`;
+}
+
+export function toolsVersionFromNode(
+	node: string,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): string | null {
+	const prefix = `${namespaces.tools}#`;
+	if (!node.startsWith(prefix)) return null;
+	const version = node.slice(prefix.length);
+	return isApiVersion(version) ? version : null;
+}
+
+export function toolNode(
+	version: string,
+	name: string,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): string {
+	if (!isApiVersion(version)) throw new Error("invalid API version");
+	if (!isToolName(name)) throw new Error("invalid tool name");
+	return `${namespaces.tool}#${version}#${Buffer.from(name, "utf8").toString("base64url")}`;
+}
+
+export function toolFromNode(
+	node: string,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): { version: string; name: string } | null {
+	const prefix = `${namespaces.tool}#`;
+	if (!node.startsWith(prefix)) return null;
+	const separator = node.indexOf("#", prefix.length);
+	if (separator < 0) return null;
+	const version = node.slice(prefix.length, separator);
+	const encoded = node.slice(separator + 1);
+	if (
+		!isApiVersion(version) ||
+		!encoded ||
+		encoded.includes("=") ||
+		!/^[A-Za-z0-9_-]+$/.test(encoded)
+	)
+		return null;
+	try {
+		const bytes = Buffer.from(encoded, "base64url");
+		if (bytes.toString("base64url") !== encoded) return null;
+		const name = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+		if (!isToolName(name)) return null;
+		return { version, name };
+	} catch {
+		return null;
+	}
+}
+
+export function parseManifestRegistration(
+	request: Element,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): AgentApiManifest | null {
+	if (request.name !== "iq" || request.attrs.type !== "set") return null;
+	const manifest = request
+		.getChild("register", namespaces.api)
+		?.getChild("manifest", namespaces.api);
+	if (!manifest || manifest.attrs["media-type"] !== JSON_MEDIA_TYPE)
+		return null;
+	try {
+		return validateManifest(
+			parseStrictJson(manifest.getText(), { maxBytes: 1_048_576 }),
+		);
+	} catch (error) {
+		throw new ProtocolError(
+			"bad-request",
+			error instanceof Error ? error.message : "Invalid manifest",
+		);
+	}
+}
+
+export function buildManifestRegistrationResult(
+	request: Element,
+	agent: RegisteredAgent,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): Element {
+	return resultIq(
+		request,
+		request.attrs.to ? String(request.attrs.to) : agent.manifest.agent.jid,
+		xml(
+			"registered",
+			{
+				xmlns: namespaces.api,
+				jid: agent.manifest.agent.jid,
+				version: agent.manifest.agent.version,
+			},
+			buildHash(agent.manifestHash),
+		),
+	);
+}
diff --git a/packages/agent-xmpp/gateway/src/agent-send.ts b/packages/agent-xmpp/gateway/src/agent-send.ts
new file mode 100644
index 000000000..6bfee1053
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/agent-send.ts
@@ -0,0 +1,61 @@
+/**
+ * Emits XEP-0085 Chat State Notifications on the agent's behalf (composing while
+ * the agent works, paused/inactive when it stops). States are directed to the same
+ * 1:1 resource or MUC room the inbound message came from.
+ *
+ * @see https://xmpp.org/extensions/xep-0085.html
+ */
+import type { Element } from "@xmpp/xml";
+
+import type { InboundChatTargets } from "./delivery.js";
+import {
+	buildComposingStanza,
+	buildInactiveStanza,
+	buildPausedStanza,
+} from "./xep-plugins/chatstate.js";
+
+async function sendChatStateForAgent(
+	sendOutbound: (stanza: Element) => Promise<void>,
+	agentJid: string,
+	targets: Pick<InboundChatTargets, "to" | "threadId" | "groupchat">,
+	state: "composing" | "paused" | "inactive",
+): Promise<void> {
+	const build =
+		state === "composing"
+			? buildComposingStanza
+			: state === "paused"
+				? buildPausedStanza
+				: buildInactiveStanza;
+	await sendOutbound(
+		build({
+			from: agentJid,
+			to: targets.to,
+			threadId: targets.threadId,
+			groupchat: targets.groupchat,
+		}),
+	);
+}
+
+export async function sendComposingForAgent(
+	sendOutbound: (stanza: Element) => Promise<void>,
+	agentJid: string,
+	targets: Pick<InboundChatTargets, "to" | "threadId" | "groupchat">,
+): Promise<void> {
+	await sendChatStateForAgent(sendOutbound, agentJid, targets, "composing");
+}
+
+export async function sendPausedForAgent(
+	sendOutbound: (stanza: Element) => Promise<void>,
+	agentJid: string,
+	targets: Pick<InboundChatTargets, "to" | "threadId" | "groupchat">,
+): Promise<void> {
+	await sendChatStateForAgent(sendOutbound, agentJid, targets, "paused");
+}
+
+export async function sendInactiveForAgent(
+	sendOutbound: (stanza: Element) => Promise<void>,
+	agentJid: string,
+	targets: Pick<InboundChatTargets, "to" | "threadId" | "groupchat">,
+): Promise<void> {
+	await sendChatStateForAgent(sendOutbound, agentJid, targets, "inactive");
+}
diff --git a/packages/agent-xmpp/gateway/src/config.ts b/packages/agent-xmpp/gateway/src/config.ts
new file mode 100644
index 000000000..dec8cc8b5
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/config.ts
@@ -0,0 +1,112 @@
+import {
+	DEFAULT_PROTOCOL_NAMESPACES,
+	type AgentXmppNamespaces,
+} from "@agent-xmpp/protocol";
+
+export interface GatewayConfig {
+	gatewayId: string;
+	/** Component JID, e.g. gateway.agents.example */
+	componentJid: string;
+	/** Delegated domain for virtual agent JIDs, e.g. agents.example */
+	agentDomain: string;
+	/** XMPP server domain used as the XEP-0199 keepalive target. */
+	serverDomain: string;
+	/** xmpp://host:5275 or xmpps://host:5347 */
+	componentService: string;
+	componentSecret: string;
+	defaultAgentJid: string;
+	/** Default inherited language for human-readable XML text. */
+	xmlLang?: string;
+	/** XEP-0184: how long to wait for a <received/> before a resend is due (ms). */
+	receiptTimeoutMs: number;
+	/**
+	 * XEP-0184: max resends of an un-acked message before giving up.
+	 * Default 0 (observe-only): absence of a receipt is NOT evidence of failure — many
+	 * clients/servers don't implement receipts and XMPP doesn't guarantee dedup of equal
+	 * stanza/origin ids, so resending would duplicate ordinary messages. Only raise this
+	 * for a deployment where every peer is known to support XEP-0184 and dedups.
+	 */
+	receiptMaxResends: number;
+	/** How often the resend sweep runs (ms). */
+	receiptSweepMs: number;
+	/** Initial reconnect delay; subsequent failures back off exponentially. */
+	reconnectInitialMs: number;
+	/** Maximum reconnect delay. */
+	reconnectMaxMs: number;
+	/** Send XEP-0199 after this much connection inactivity. */
+	pingIntervalMs: number;
+	/** Time allowed for an XEP-0199 response. */
+	pingTimeoutMs: number;
+	/** Consecutive ping failures before forcing a reconnect. */
+	pingFailureThreshold: number;
+	/** Maximum concurrent inbound or outbound IQ requests held by the component. */
+	maxPendingIqRequests?: number;
+	protocolNamespaces?: AgentXmppNamespaces;
+}
+
+/** Non-negative integer (0 is meaningful, e.g. observe-only resends). */
+function envNonNegInt(name: string, fallback: number): number {
+	const raw = process.env[name];
+	if (raw === undefined || raw === "") return fallback;
+	const n = Number(raw);
+	return Number.isInteger(n) && n >= 0 ? n : fallback;
+}
+
+/** Strictly-positive integer — for interval/timeout values where 0 would busy-loop. */
+function envPosInt(name: string, fallback: number): number {
+	const raw = process.env[name];
+	if (raw === undefined || raw === "") return fallback;
+	const n = Number(raw);
+	return Number.isInteger(n) && n > 0 ? n : fallback;
+}
+
+function env(name: string, fallback?: string): string {
+	const v = process.env[name];
+	if (v !== undefined && v !== "") return v;
+	if (fallback !== undefined) return fallback;
+	throw new Error(`Missing required env: ${name}`);
+}
+
+function envLanguageTag(name: string): string | undefined {
+	const value = process.env[name]?.trim();
+	if (!value) return undefined;
+	return value.length <= 64 && /^[A-Za-z0-9]+(?:-[A-Za-z0-9]+)*$/.test(value)
+		? value
+		: undefined;
+}
+
+export function loadConfig(): GatewayConfig {
+	const componentJid = env("XMPP_COMPONENT_JID");
+	const agentDomain =
+		process.env.XMPP_AGENT_DOMAIN ||
+		componentJid.split(".").slice(1).join(".") ||
+		componentJid;
+	const inferredServerDomain =
+		componentJid.split(".").slice(1).join(".") || componentJid;
+	const reconnectInitialMs = envPosInt("XMPP_RECONNECT_INITIAL_MS", 1_000);
+	const reconnectMaxMs = Math.max(
+		reconnectInitialMs,
+		envPosInt("XMPP_RECONNECT_MAX_MS", 60_000),
+	);
+	return {
+		gatewayId: process.env.XMPP_GATEWAY_ID || "gw-1",
+		componentJid,
+		agentDomain,
+		serverDomain: process.env.XMPP_SERVER_DOMAIN || inferredServerDomain,
+		componentService: env("XMPP_COMPONENT_SERVICE", "xmpp://127.0.0.1:5275"),
+		componentSecret: env("XMPP_COMPONENT_SECRET"),
+		defaultAgentJid:
+			process.env.XMPP_DEFAULT_AGENT_JID || `assistant@${agentDomain}`,
+		xmlLang: envLanguageTag("XMPP_XML_LANG"),
+		receiptTimeoutMs: envPosInt("XMPP_RECEIPT_TIMEOUT_MS", 30_000),
+		receiptMaxResends: envNonNegInt("XMPP_RECEIPT_MAX_RESENDS", 0),
+		receiptSweepMs: envPosInt("XMPP_RECEIPT_SWEEP_MS", 10_000),
+		reconnectInitialMs,
+		reconnectMaxMs,
+		pingIntervalMs: envPosInt("XMPP_PING_INTERVAL_MS", 60_000),
+		pingTimeoutMs: envPosInt("XMPP_PING_TIMEOUT_MS", 10_000),
+		pingFailureThreshold: envPosInt("XMPP_PING_FAILURE_THRESHOLD", 2),
+		maxPendingIqRequests: envPosInt("XMPP_MAX_PENDING_IQ_REQUESTS", 256),
+		protocolNamespaces: DEFAULT_PROTOCOL_NAMESPACES,
+	};
+}
diff --git a/packages/agent-xmpp/gateway/src/delivery.ts b/packages/agent-xmpp/gateway/src/delivery.ts
new file mode 100644
index 000000000..4fa1836f5
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/delivery.ts
@@ -0,0 +1,156 @@
+/**
+ * Inbound delivery gating and routing. 1:1 (XMPP `chat`) messages always pass;
+ * groupchat (XEP-0045) messages are delivered only when the agent is mentioned —
+ * via XEP-0513 explicit mentions or the plaintext `@nick` fallback in routing.ts.
+ *
+ * @see https://xmpp.org/extensions/xep-0045.html
+ * @see https://xmpp.org/extensions/xep-0513.html
+ */
+import type {
+	AgentMessage,
+	BridgeFormResponsePayload,
+	BridgeInboundPayload,
+} from "@agent-xmpp/protocol";
+import { agentMessageText } from "@agent-xmpp/protocol";
+
+import type { GatewayConfig } from "./config.js";
+import type { GatewayRuntimeMailbox } from "./runtime-mailbox.js";
+import { buildInboundEnvelope } from "./xep-plugins/message.js";
+import { bareJid } from "./xep-plugins/jid.js";
+import { mucRoomFromStanza } from "./xep-plugins/muc.js";
+import {
+	isMentionForAgent,
+	shouldDeliverInbound,
+} from "./xep-plugins/routing.js";
+
+export interface InboundDeliveryContext {
+	agentMsg: AgentMessage;
+	agentJid: string;
+	deliveryId: string;
+	stanzaType: string;
+	from: string;
+	redelivered?: boolean;
+}
+
+export function shouldAcceptStanza(
+	stanzaType: string,
+	from: string,
+	bodyText: string,
+	agentNick: string,
+): boolean {
+	const room = mucRoomFromStanza(from);
+	const isGroup = stanzaType === "groupchat" || !!room;
+	const isMention = isMentionForAgent(stanzaType, bodyText, agentNick);
+	return shouldDeliverInbound(stanzaType, isGroup, isMention);
+}
+
+export interface InboundChatTargets {
+	/** Reply/typing destination and host router session key: MUC room JID or bare sender JID. */
+	to: string;
+	threadId: string | null;
+	/** True for MUC/groupchat traffic. */
+	groupchat: boolean;
+}
+
+/** Resolve where replies and typing notifications for an inbound stanza should go. */
+export function resolveInboundChatTargets(
+	from: string,
+	stanzaType: string,
+	agentMsg: Pick<AgentMessage, "from" | "threadId">,
+): InboundChatTargets {
+	const room = mucRoomFromStanza(from);
+	const groupchat = stanzaType === "groupchat" || !!room;
+	const to = groupchat && room ? room : bareJid(agentMsg.from);
+	const threadId = agentMsg.threadId || (groupchat ? room || null : null);
+	return { to, threadId, groupchat };
+}
+
+export function buildBridgePayload(
+	config: GatewayConfig,
+	ctx: InboundDeliveryContext,
+): BridgeInboundPayload {
+	const { agentMsg, agentJid, deliveryId, stanzaType, from, redelivered } = ctx;
+	const {
+		to: platformId,
+		threadId,
+		groupchat: isGroup,
+	} = resolveInboundChatTargets(from, stanzaType, agentMsg);
+	const bodyText = agentMessageText(agentMsg);
+	const agentNick = agentJid.split("@")[0];
+	const isMention = isMentionForAgent(stanzaType, bodyText, agentNick);
+
+	const envelope = buildInboundEnvelope(
+		agentMsg,
+		config.gatewayId,
+		deliveryId,
+		{
+			stanzaId: agentMsg.id,
+			stableId: agentMsg.id,
+			stanzaType: stanzaType as "chat" | "groupchat",
+		},
+		redelivered,
+	);
+
+	return {
+		platformId,
+		// RFC 6121 section 8.5.2.1: reply to the originating resource. Keeping
+		// routing on the bare JID avoids creating one NanoClaw session per client.
+		replyTo: isGroup ? undefined : from,
+		threadId,
+		agentJid,
+		isMention,
+		isGroup,
+		envelope,
+	};
+}
+
+export async function pushInboundToBridge(
+	config: GatewayConfig,
+	mailbox: GatewayRuntimeMailbox,
+	ctx: InboundDeliveryContext,
+): Promise<void> {
+	await mailbox.deliverInbound(buildBridgePayload(config, ctx));
+}
+
+export interface FormResponseContext {
+	agentJid: string;
+	from: string;
+	stanzaType: string;
+	questionId: string;
+	selectedIndex: number;
+}
+
+export function buildFormResponsePayload(
+	_config: GatewayConfig,
+	ctx: FormResponseContext,
+): BridgeFormResponsePayload {
+	const {
+		to: platformId,
+		threadId,
+		groupchat: isGroup,
+	} = resolveInboundChatTargets(ctx.from, ctx.stanzaType, {
+		from: ctx.from,
+		threadId: undefined,
+	});
+
+	return {
+		type: "form_response",
+		agentJid: ctx.agentJid,
+		platformId,
+		threadId,
+		questionId: ctx.questionId,
+		selectedIndex: ctx.selectedIndex,
+		// In a MUC the occupant identity is the resource (room@muc/nick); keep the full JID so
+		// the answer is attributed to the responder, not to the room.
+		userId: isGroup ? ctx.from : platformId,
+		timestamp: new Date().toISOString(),
+	};
+}
+
+export async function pushFormResponseToBridge(
+	config: GatewayConfig,
+	mailbox: GatewayRuntimeMailbox,
+	ctx: FormResponseContext,
+): Promise<void> {
+	await mailbox.deliverFormResponse(buildFormResponsePayload(config, ctx));
+}
diff --git a/packages/agent-xmpp/gateway/src/embedded-gateway.ts b/packages/agent-xmpp/gateway/src/embedded-gateway.ts
new file mode 100644
index 000000000..5daf9e964
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/embedded-gateway.ts
@@ -0,0 +1,427 @@
+import {
+	DEFAULT_PROTOCOL_NAMESPACES,
+	bareJid,
+	type AgentXmppNamespaces,
+	type OutboundDeliverRequest,
+} from "@agent-xmpp/protocol";
+import { xml, type Element } from "@xmpp/xml";
+
+import { buildGatewayInfo, DISCO_INFO_NS } from "./agent-api-disco.js";
+import type { GatewayConfig } from "./config.js";
+export { loadConfig } from "./config.js";
+export type { GatewayConfig } from "./config.js";
+import {
+	sendComposingForAgent,
+	sendInactiveForAgent,
+	sendPausedForAgent,
+} from "./agent-send.js";
+import { StanzaRouter, type ResolveVirtualAgentFn } from "./stanza-router.js";
+import type { GatewayRuntimeMailbox } from "./runtime-mailbox.js";
+import { applyStoreHints, buildOutboundStanza } from "./xep-plugins/message.js";
+import { isMucJid } from "./xep-plugins/muc.js";
+import { buildTaskEvent, type TaskWireEvent } from "./task-stanza-codec.js";
+import {
+	createComponentSession,
+	type IqGetHandler,
+	type IqRequestOptions,
+	type XmppComponentSession,
+} from "./xmpp-component.js";
+import { RECEIPTS_NS } from "./xep-plugins/receipts.js";
+import { ReceiptTracker } from "./receipt-tracker.js";
+import { PING_NS } from "./xep-plugins/ping.js";
+import { XmppKeepalive } from "./xmpp-keepalive.js";
+import {
+	buildAvailablePresence,
+	buildUnavailablePresence,
+	type VirtualAgentIdentity,
+} from "./xep-plugins/presence.js";
+
+export interface EmbeddedIqHandlerOptions {
+	componentJid: string;
+	protocolNamespaces?: AgentXmppNamespaces;
+}
+
+export interface PresenceSubscription {
+	agentJid: string;
+	subscriberJid: string;
+}
+
+export interface PresenceSubscriptionStore {
+	listPresenceSubscriptions(): PresenceSubscription[];
+	setPresenceSubscription(
+		agentJid: string,
+		subscriberJid: string,
+		subscribed: boolean,
+	): void;
+}
+
+export type XmppComponentSessionFactory = (
+	config: GatewayConfig,
+	onIqGet?: IqGetHandler,
+) => XmppComponentSession;
+
+export interface EmbeddedXmppGatewayDependencies {
+	onIqGet?: IqGetHandler;
+	resolveVirtualAgent?: ResolveVirtualAgentFn;
+	presenceStore?: PresenceSubscriptionStore;
+	componentSessionFactory?: XmppComponentSessionFactory;
+}
+
+function presenceRouteKey(route: PresenceSubscription): string {
+	return `${bareJid(route.agentJid).toLowerCase()}\u0000${bareJid(route.subscriberJid).toLowerCase()}`;
+}
+
+class InMemoryPresenceSubscriptionStore implements PresenceSubscriptionStore {
+	private readonly subscriptions = new Map<string, PresenceSubscription>();
+
+	listPresenceSubscriptions(): PresenceSubscription[] {
+		return [...this.subscriptions.values()];
+	}
+
+	setPresenceSubscription(
+		agentJid: string,
+		subscriberJid: string,
+		subscribed: boolean,
+	): void {
+		const route = {
+			agentJid: bareJid(agentJid),
+			subscriberJid: bareJid(subscriberJid),
+		};
+		const key = presenceRouteKey(route);
+		if (subscribed) this.subscriptions.set(key, route);
+		else this.subscriptions.delete(key);
+	}
+}
+
+/**
+ * Root service identity belongs to the reusable gateway itself. Host handlers
+ * extend this surface with directory, endpoint, task, and administrative IQs.
+ */
+export function createEmbeddedIqHandler(
+	options: EmbeddedIqHandlerOptions,
+	downstream?: IqGetHandler,
+): IqGetHandler {
+	return async (stanza) => {
+		const to = bareJid(String(stanza.attrs.to ?? ""));
+		const info = stanza.getChild("query", DISCO_INFO_NS);
+		if (
+			stanza.attrs.type === "get" &&
+			to === bareJid(options.componentJid) &&
+			info &&
+			!info.attrs.node
+		) {
+			return buildGatewayInfo(
+				stanza,
+				options.componentJid,
+				options.protocolNamespaces ?? DEFAULT_PROTOCOL_NAMESPACES,
+			);
+		}
+		return (await downstream?.(stanza)) ?? null;
+	};
+}
+
+/** In-process XMPP channel runtime. All agent IO crosses GatewayRuntimeMailbox. */
+export class EmbeddedXmppGateway {
+	private session: XmppComponentSession | null = null;
+	private router: StanzaRouter | null = null;
+	private readonly receipts: ReceiptTracker;
+	private sweepTimer: ReturnType<typeof setInterval> | null = null;
+	private keepalive: XmppKeepalive | null = null;
+	private connectionState: ReturnType<XmppComponentSession["getState"]> =
+		"offline";
+	private readonly presenceStore: PresenceSubscriptionStore;
+	private readonly publishedPresence = new Map<
+		string,
+		{ agent: VirtualAgentIdentity; subscriberJid: string }
+	>();
+	private presenceSync: Promise<void> = Promise.resolve();
+
+	constructor(
+		private readonly config: GatewayConfig,
+		private readonly mailbox: GatewayRuntimeMailbox,
+		private readonly dependencies: EmbeddedXmppGatewayDependencies = {},
+	) {
+		this.presenceStore =
+			dependencies.presenceStore ?? new InMemoryPresenceSubscriptionStore();
+		this.receipts = new ReceiptTracker({
+			timeoutMs: config.receiptTimeoutMs,
+			maxResends: config.receiptMaxResends,
+		});
+	}
+
+	async start(): Promise<void> {
+		if (this.session) return;
+		const createSession =
+			this.dependencies.componentSessionFactory ?? createComponentSession;
+		const session = createSession(
+			this.config,
+			createEmbeddedIqHandler(this.config, this.dependencies.onIqGet),
+		);
+		const sendForAgent = async (_agentJid: string, stanza: Element) =>
+			session.send(stanza);
+		const router = new StanzaRouter(
+			this.config,
+			this.mailbox,
+			sendForAgent,
+			this.dependencies.resolveVirtualAgent,
+			(id) => this.receipts.ack(id),
+			(agent, subscriberJid, subscribed) =>
+				this.updatePresenceSubscription(agent, subscriberJid, subscribed),
+		);
+		session.onStanza((stanza) => void router.handleIncoming(stanza));
+		session.onStateChange((state) => {
+			const wasOnline = this.connectionState === "online";
+			this.connectionState = state;
+			if (state === "online" && !wasOnline) {
+				this.publishedPresence.clear();
+				void this.syncPresence(session);
+			}
+		});
+		this.session = session;
+		this.router = router;
+		await session.start();
+		this.connectionState = session.getState();
+		this.keepalive = new XmppKeepalive(
+			{
+				intervalMs: this.config.pingIntervalMs,
+				failureThreshold: this.config.pingFailureThreshold,
+			},
+			{
+				getState: () => session.getState(),
+				getLastActivityAt: () => session.getLastActivityAt(),
+				ping: async () => {
+					await session.requestIq(
+						xml(
+							"iq",
+							{
+								type: "get",
+								from: this.config.componentJid,
+								to: this.config.serverDomain,
+							},
+							xml("ping", { xmlns: PING_NS }),
+						),
+						{ timeoutMs: this.config.pingTimeoutMs },
+					);
+				},
+				forceReconnect: (reason) => session.forceReconnect(reason),
+			},
+		);
+		this.keepalive.start();
+		this.sweepTimer = setInterval(
+			() => this.resendUnacked(),
+			this.config.receiptSweepMs,
+		);
+		this.sweepTimer.unref?.();
+	}
+
+	async stop(): Promise<void> {
+		const session = this.session;
+		this.connectionState = "stopping";
+		if (session) await this.publishUnavailablePresence(session);
+		this.session = null;
+		this.router = null;
+		this.keepalive?.stop();
+		this.keepalive = null;
+		if (this.sweepTimer) {
+			clearInterval(this.sweepTimer);
+			this.sweepTimer = null;
+		}
+		// Drop pending receipts so a restart's sweep can't resend this session's stanzas.
+		this.receipts.clear();
+		if (session) await session.stop();
+		this.publishedPresence.clear();
+		this.connectionState = "offline";
+	}
+
+	private updatePresenceSubscription(
+		agent: VirtualAgentIdentity,
+		subscriberJid: string,
+		subscribed: boolean,
+	): void {
+		const route = {
+			agentJid: bareJid(agent.jid),
+			subscriberJid: bareJid(subscriberJid),
+		};
+		this.presenceStore.setPresenceSubscription(
+			route.agentJid,
+			route.subscriberJid,
+			subscribed,
+		);
+		void this.syncPresence();
+	}
+
+	syncPresence(session = this.session): Promise<void> {
+		if (!session || session.getState() !== "online") return Promise.resolve();
+		const run = this.presenceSync
+			.catch(() => undefined)
+			.then(() => this.reconcilePresence(session))
+			.catch((err) => {
+				console.error("[xmpp-gateway] presence synchronization failed:", err);
+			});
+		this.presenceSync = run;
+		return run;
+	}
+
+	private async reconcilePresence(
+		session: XmppComponentSession,
+	): Promise<void> {
+		const desired = new Map<
+			string,
+			{ agent: VirtualAgentIdentity; subscriberJid: string }
+		>();
+		for (const subscription of this.presenceStore.listPresenceSubscriptions()) {
+			const agent = this.dependencies.resolveVirtualAgent?.(
+				bareJid(subscription.agentJid),
+			);
+			if (!agent) continue;
+			const route = {
+				agent,
+				subscriberJid: bareJid(subscription.subscriberJid),
+			};
+			desired.set(presenceRouteKey(subscription), route);
+		}
+
+		for (const [key, route] of this.publishedPresence) {
+			if (desired.has(key)) continue;
+			await session.send(
+				buildUnavailablePresence(route.agent, route.subscriberJid),
+			);
+			this.publishedPresence.delete(key);
+		}
+		for (const [key, route] of desired) {
+			if (this.publishedPresence.has(key)) continue;
+			await session.send(
+				buildAvailablePresence(route.agent, route.subscriberJid),
+			);
+			this.publishedPresence.set(key, route);
+		}
+	}
+
+	private async publishUnavailablePresence(
+		session: XmppComponentSession,
+	): Promise<void> {
+		for (const route of this.publishedPresence.values()) {
+			await session
+				.send(buildUnavailablePresence(route.agent, route.subscriberJid))
+				.catch((err) => {
+					console.error(
+						"[xmpp-gateway] unavailable presence send failed:",
+						err,
+					);
+				});
+		}
+	}
+
+	/**
+	 * XEP-0184 sweep. Default is observe-only (receiptMaxResends=0): un-acked messages
+	 * simply expire from tracking, since a missing receipt does not mean the message failed
+	 * and blind resends would duplicate ordinary messages. When an operator opts into
+	 * resends, we retry up to the cap and log the ones that still go unconfirmed.
+	 */
+	private resendUnacked(): void {
+		const session = this.session;
+		if (!session || !this.isConnected()) return;
+		const { resend, gaveUp } = this.receipts.due(Date.now());
+		for (const stanza of resend) {
+			void session.send(stanza).catch((err) => {
+				console.error("[xmpp-gateway] receipt resend failed:", err);
+			});
+		}
+		// Only noteworthy when resends were actually attempted; observe-only expiry is normal.
+		if (this.config.receiptMaxResends > 0) {
+			for (const id of gaveUp) {
+				console.error(
+					`[xmpp-gateway] no delivery receipt for ${id} after ${this.config.receiptMaxResends} resends; giving up`,
+				);
+			}
+		}
+	}
+
+	isConnected(): boolean {
+		return this.session !== null && this.connectionState === "online";
+	}
+
+	/** Send an IQ get/set and await its correlated result or error response. */
+	requestIq(stanza: Element, options?: IqRequestOptions): Promise<Element> {
+		return this.requiredSession().requestIq(stanza, options);
+	}
+
+	/**
+	 * The single outbound send path. Any stanza carrying an XEP-0184 <request/> is
+	 * registered for receipt tracking *before* the send resolves — otherwise a fast peer's
+	 * <received/> could arrive before registration and be dropped, leaving a delivered
+	 * message pending (and, with resends enabled, later duplicated). If the send itself
+	 * fails, the entry is removed.
+	 */
+	private async sendTracked(stanza: Element): Promise<string> {
+		const session = this.requiredSession();
+		const id = String(stanza.attrs.id ?? "");
+		const track = id !== "" && stanza.getChild("request", RECEIPTS_NS) != null;
+		if (track) this.receipts.register(id, stanza);
+		try {
+			await session.send(stanza);
+		} catch (err) {
+			if (track) this.receipts.ack(id);
+			throw err;
+		}
+		return id;
+	}
+
+	async deliver(
+		input: OutboundDeliverRequest & { from: string },
+	): Promise<string> {
+		const built = buildOutboundStanza(
+			{ ...input, lang: input.lang ?? this.config.xmlLang },
+			input.from,
+		);
+		// XEP-0334 <store/> so an offline 1:1 peer still gets it; MUC messages aren't stored.
+		const stanza = applyStoreHints(
+			built,
+			built.attrs.type === "chat" ? { store: true } : undefined,
+		);
+		return this.sendTracked(stanza);
+	}
+
+	async deliverTaskEvent(event: TaskWireEvent): Promise<string> {
+		return this.sendTracked(
+			buildTaskEvent(
+				event,
+				this.config.protocolNamespaces ?? DEFAULT_PROTOCOL_NAMESPACES,
+			),
+		);
+	}
+
+	async setTyping(
+		from: string,
+		to: string,
+		threadId: string | null,
+		state: "composing" | "paused" | "inactive",
+	): Promise<void> {
+		const session = this.requiredSession();
+		const targets = { to, threadId, groupchat: isMucJid(to) };
+		const send = (stanza: Element) => session.send(stanza);
+		if (state === "inactive") await sendInactiveForAgent(send, from, targets);
+		else if (state === "paused") await sendPausedForAgent(send, from, targets);
+		else await sendComposingForAgent(send, from, targets);
+	}
+
+	private requiredSession(): XmppComponentSession {
+		if (!this.session) throw new Error("XMPP gateway is not connected");
+		return this.session;
+	}
+}
+
+export type { GatewayRuntimeMailbox } from "./runtime-mailbox.js";
+export { xml, type Element } from "@xmpp/xml";
+export { IqResponseError } from "./xmpp-component.js";
+export type { IqRequestOptions } from "./xmpp-component.js";
+export * from "./agent-api-disco.js";
+export * from "./task-stanza-codec.js";
+export * from "./hash-codec.js";
+export * from "./json-codec.js";
+export * from "./rsm-codec.js";
+export * from "./protocol-error.js";
+export * from "./xep-plugins/ping.js";
+export * from "./xep-plugins/presence.js";
+export * from "./xep-plugins/search.js";
+export * from "./xep-plugins/vcard.js";
diff --git a/packages/agent-xmpp/gateway/src/hash-codec.ts b/packages/agent-xmpp/gateway/src/hash-codec.ts
new file mode 100644
index 000000000..505de73f8
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/hash-codec.ts
@@ -0,0 +1,23 @@
+import { HASHES_NS } from "@agent-xmpp/protocol";
+import { xml, type Element } from "@xmpp/xml";
+
+export interface Sha256Hash {
+	algorithm: "sha-256";
+	value: string;
+}
+
+export function buildHash(value: string): Element {
+	return xml("hash", { xmlns: HASHES_NS, algo: "sha-256" }, value);
+}
+
+export function parseHash(parent: Element, wrapper?: string): Sha256Hash {
+	const container = wrapper ? parent.getChild(wrapper) : parent;
+	const hash = container?.getChild("hash", HASHES_NS);
+	if (!hash || hash.attrs.algo !== "sha-256")
+		throw new Error("a sha-256 XEP-0300 hash is required");
+	const value = hash.getText();
+	if (!/^(?:[A-Za-z0-9+/]{4}){10}[A-Za-z0-9+/]{3}=$/.test(value)) {
+		throw new Error("invalid SHA-256 Base64 hash");
+	}
+	return { algorithm: "sha-256", value };
+}
diff --git a/packages/agent-xmpp/gateway/src/json-codec.ts b/packages/agent-xmpp/gateway/src/json-codec.ts
new file mode 100644
index 000000000..826443fd0
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/json-codec.ts
@@ -0,0 +1,24 @@
+import { JSON_MEDIA_TYPE, parseStrictJson } from "@agent-xmpp/protocol";
+import { xml, type Element } from "@xmpp/xml";
+
+export function parseJsonElement(
+	element: Element,
+	maxBytes = 1_048_576,
+): unknown {
+	const mediaType = String(element.attrs["media-type"] ?? "");
+	if (mediaType && mediaType !== JSON_MEDIA_TYPE)
+		throw new Error(`unsupported JSON media type: ${mediaType}`);
+	return parseStrictJson(element.getText(), { maxBytes });
+}
+
+export function jsonElement(
+	name: string,
+	namespace: string,
+	canonicalJson: string,
+): Element {
+	return xml(
+		name,
+		{ xmlns: namespace, "media-type": JSON_MEDIA_TYPE },
+		canonicalJson,
+	);
+}
diff --git a/packages/agent-xmpp/gateway/src/protocol-error.ts b/packages/agent-xmpp/gateway/src/protocol-error.ts
new file mode 100644
index 000000000..dfe8c9dbe
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/protocol-error.ts
@@ -0,0 +1,82 @@
+import { xml, type Element } from "@xmpp/xml";
+
+export type StanzaErrorCondition =
+	| "bad-request"
+	| "forbidden"
+	| "item-not-found"
+	| "not-acceptable"
+	| "conflict"
+	| "resource-constraint"
+	| "service-unavailable"
+	| "unexpected-request"
+	| "internal-server-error";
+
+const STANZA_ERRORS_NS = "urn:ietf:params:xml:ns:xmpp-stanzas";
+
+export class ProtocolError extends Error {
+	constructor(
+		readonly condition: StanzaErrorCondition,
+		message: string,
+		readonly type: "cancel" | "modify" | "auth" | "wait" = stanzaErrorType(
+			condition,
+		),
+	) {
+		super(message);
+	}
+}
+
+export function protocolErrorIq(request: Element, error: unknown): Element {
+	const protocolError =
+		error instanceof ProtocolError
+			? error
+			: new ProtocolError("internal-server-error", "Request processing failed");
+	const echoRequestPayload =
+		protocolError.condition !== "bad-request" &&
+		protocolError.condition !== "resource-constraint" &&
+		protocolError.condition !== "internal-server-error";
+	return xml(
+		"iq",
+		{
+			type: "error",
+			id: request.attrs.id,
+			from: request.attrs.to,
+			to: request.attrs.from,
+		},
+		...(echoRequestPayload ? request.children : []),
+		xml(
+			"error",
+			{ type: protocolError.type },
+			xml(protocolError.condition, { xmlns: STANZA_ERRORS_NS }),
+			xml("text", { xmlns: STANZA_ERRORS_NS }, safeMessage(protocolError)),
+		),
+	);
+}
+
+export function hiddenObjectError(): ProtocolError {
+	return new ProtocolError(
+		"item-not-found",
+		"The requested object was not found",
+	);
+}
+
+function safeMessage(error: ProtocolError): string {
+	if (error.condition === "item-not-found")
+		return "The requested object was not found";
+	if (error.condition === "internal-server-error")
+		return "Request processing failed";
+	return error.message.slice(0, 512);
+}
+
+function stanzaErrorType(
+	condition: StanzaErrorCondition,
+): "cancel" | "modify" | "auth" | "wait" {
+	if (condition === "bad-request" || condition === "not-acceptable")
+		return "modify";
+	if (condition === "forbidden") return "auth";
+	if (
+		condition === "resource-constraint" ||
+		condition === "service-unavailable"
+	)
+		return "wait";
+	return "cancel";
+}
diff --git a/packages/agent-xmpp/gateway/src/receipt-tracker.ts b/packages/agent-xmpp/gateway/src/receipt-tracker.ts
new file mode 100644
index 000000000..093b6c574
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/receipt-tracker.ts
@@ -0,0 +1,79 @@
+/**
+ * XEP-0184 outbound delivery-receipt tracking.
+ *
+ * A component send only tells us the server accepted the stanza, not that the peer
+ * received it. For 1:1 messages that carry a <request/>, we register the stanza here;
+ * when the peer returns <received/> we `ack` it, and messages left un-acked past the
+ * timeout are handed back by `due` for a bounded number of resends. Resends reuse the
+ * same stanza (same id + origin-id), so conformant peers dedup per XEP-0184 §8.
+ *
+ * Pure and synchronous — no timers, no IO — so it unit-tests without a live connection.
+ *
+ * @see https://xmpp.org/extensions/xep-0184.html
+ */
+import type { Element } from "@xmpp/xml";
+
+interface PendingReceipt {
+	stanza: Element;
+	sentAt: number;
+	attempts: number;
+}
+
+export interface ReceiptTrackerOptions {
+	timeoutMs: number;
+	maxResends: number;
+}
+
+/** What a sweep produced: stanzas to resend now, and ids we've given up on. */
+export interface ReceiptSweep {
+	resend: Element[];
+	gaveUp: string[];
+}
+
+export class ReceiptTracker {
+	private readonly pending = new Map<string, PendingReceipt>();
+
+	constructor(private readonly options: ReceiptTrackerOptions) {}
+
+	/** Record a receipt-requested send keyed by its stanza id. */
+	register(id: string, stanza: Element, now: number = Date.now()): void {
+		if (!id) return;
+		this.pending.set(id, { stanza, sentAt: now, attempts: 0 });
+	}
+
+	/** Peer confirmed delivery of `id`; stop tracking it. */
+	ack(id: string): void {
+		this.pending.delete(id);
+	}
+
+	/** Drop all pending state — called on gateway stop so a restart can't resend a prior session's stanzas. */
+	clear(): void {
+		this.pending.clear();
+	}
+
+	/**
+	 * Entries whose timeout has elapsed: each still under the resend cap is re-armed and
+	 * returned in `resend`; each at the cap is dropped and returned in `gaveUp`.
+	 */
+	due(now: number = Date.now()): ReceiptSweep {
+		const resend: Element[] = [];
+		const gaveUp: string[] = [];
+		for (const [id, entry] of this.pending) {
+			if (now - entry.sentAt < this.options.timeoutMs) continue;
+			if (entry.attempts >= this.options.maxResends) {
+				this.pending.delete(id);
+				gaveUp.push(id);
+				continue;
+			}
+			entry.attempts += 1;
+			entry.sentAt = now;
+			resend.push(entry.stanza);
+		}
+		return { resend, gaveUp };
+	}
+
+	/** Number of messages still awaiting a receipt (for tests / diagnostics). */
+	get size(): number {
+		return this.pending.size;
+	}
+}
diff --git a/packages/agent-xmpp/gateway/src/review-fixes.test.ts b/packages/agent-xmpp/gateway/src/review-fixes.test.ts
new file mode 100644
index 000000000..4126e9998
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/review-fixes.test.ts
@@ -0,0 +1,113 @@
+import { describe, expect, it } from "bun:test";
+import { AGENT_API_NS, AGENT_TASK_NS } from "@agent-xmpp/protocol";
+import { xml } from "@xmpp/xml";
+
+import { parseManifestRegistration } from "./agent-api-disco.js";
+import { ProtocolError } from "./protocol-error.js";
+import {
+	buildAcceptedResult,
+	parseAcceptedResult,
+	parseTaskEvent,
+	parseTaskResult,
+} from "./task-stanza-codec.js";
+
+const requestId = "request-identifier-0001";
+const taskId = "task-identifier-000001";
+const eventId = "event-identifier-00001";
+
+describe("review regressions", () => {
+	it("preserves the current revision in replay acceptance results", () => {
+		const request = xml("iq", {
+			type: "set",
+			id: "invoke",
+			from: "caller@example.test",
+		});
+		const response = buildAcceptedResult(
+			request,
+			{
+				requestId,
+				taskId,
+				revision: 4,
+				created: "2026-08-27T18:00:00.000Z",
+				retainUntil: "2026-08-28T18:00:00.000Z",
+			},
+			"assistant@agents.example.test",
+		);
+
+		expect(parseAcceptedResult(response)?.revision).toBe(4);
+	});
+
+	it("rejects invalid and foreign registration manifests", () => {
+		const invalid = xml(
+			"iq",
+			{ type: "set" },
+			xml(
+				"register",
+				{ xmlns: AGENT_API_NS },
+				xml(
+					"manifest",
+					{ xmlns: AGENT_API_NS, "media-type": "application/json" },
+					"{}",
+				),
+			),
+		);
+		const foreign = xml(
+			"iq",
+			{ type: "set" },
+			xml(
+				"register",
+				{ xmlns: AGENT_API_NS },
+				xml(
+					"manifest",
+					{ xmlns: "urn:example:foreign", "media-type": "application/json" },
+					"{}",
+				),
+			),
+		);
+
+		expect(() => parseManifestRegistration(invalid)).toThrow(ProtocolError);
+		expect(parseManifestRegistration(foreign)).toBeNull();
+	});
+
+	it("rejects non-object task result and event payloads", () => {
+		const result = xml(
+			"iq",
+			{ type: "result" },
+			xml(
+				"task-result",
+				{
+					xmlns: AGENT_TASK_NS,
+					"task-id": taskId,
+					state: "completed",
+					revision: "1",
+					"media-type": "application/json",
+				},
+				"null",
+			),
+		);
+		const event = xml(
+			"message",
+			{
+				type: "normal",
+				from: "assistant@agents.example.test",
+				to: "caller@example.test",
+			},
+			xml(
+				"event",
+				{
+					xmlns: AGENT_TASK_NS,
+					"task-id": taskId,
+					"event-id": eventId,
+					revision: "1",
+					type: "status",
+				},
+				"[]",
+			),
+		);
+
+		expect(() => parseTaskResult(result)).toThrow(
+			"invalid task-result payload",
+		);
+		expect(() => parseTaskEvent(event)).toThrow("invalid task event payload");
+	});
+});
diff --git a/packages/agent-xmpp/gateway/src/rsm-codec.ts b/packages/agent-xmpp/gateway/src/rsm-codec.ts
new file mode 100644
index 000000000..32c9b3dca
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/rsm-codec.ts
@@ -0,0 +1,78 @@
+import { RSM_NS } from "@agent-xmpp/protocol";
+import { xml, type Element } from "@xmpp/xml";
+
+export interface RsmRequest {
+	max: number;
+	after?: string;
+	before?: string;
+}
+
+export interface RsmPage<T> {
+	items: T[];
+	first?: string;
+	last?: string;
+	count: number;
+}
+
+type RsmOrderKey = string | Uint8Array;
+
+export function parseRsm(
+	parent: Element,
+	defaultMax = 100,
+	maximum = 100,
+): RsmRequest {
+	const set = parent.getChild("set", RSM_NS);
+	const requested = Number(set?.getChildText("max") ?? defaultMax);
+	const max =
+		Number.isInteger(requested) && requested >= 0
+			? Math.min(requested, maximum)
+			: defaultMax;
+	return {
+		max,
+		after: set?.getChildText("after") ?? undefined,
+		before: set?.getChildText("before") ?? undefined,
+	};
+}
+
+export function pageRsm<T>(
+	items: T[],
+	id: (item: T) => string,
+	request: RsmRequest,
+	orderKey: (item: T) => RsmOrderKey = id,
+): RsmPage<T> {
+	const ordered = [...items].sort((left, right) =>
+		Buffer.compare(Buffer.from(orderKey(left)), Buffer.from(orderKey(right))),
+	);
+	let start = request.after
+		? ordered.findIndex((item) => id(item) === request.after) + 1
+		: 0;
+	if (request.after && start === 0) start = ordered.length;
+	let end = ordered.length;
+	if (request.before !== undefined) {
+		const before =
+			request.before === ""
+				? ordered.length
+				: ordered.findIndex((item) => id(item) === request.before);
+		end = before < 0 ? 0 : before;
+		start = Math.max(0, end - request.max);
+	} else {
+		end = Math.min(end, start + request.max);
+	}
+	const page = ordered.slice(start, end);
+	return {
+		items: page,
+		first: page[0] ? id(page[0]) : undefined,
+		last: page.at(-1) ? id(page.at(-1)!) : undefined,
+		count: ordered.length,
+	};
+}
+
+export function buildRsm(page: RsmPage<unknown>): Element {
+	return xml(
+		"set",
+		{ xmlns: RSM_NS },
+		...(page.first ? [xml("first", {}, page.first)] : []),
+		...(page.last ? [xml("last", {}, page.last)] : []),
+		xml("count", {}, String(page.count)),
+	);
+}
diff --git a/packages/agent-xmpp/gateway/src/runtime-mailbox.ts b/packages/agent-xmpp/gateway/src/runtime-mailbox.ts
new file mode 100644
index 000000000..2143e9a75
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/runtime-mailbox.ts
@@ -0,0 +1,18 @@
+import type {
+	BridgeFormResponsePayload,
+	BridgeInboundPayload,
+} from "@agent-xmpp/protocol";
+import type { TaskWireEvent } from "./task-stanza-codec.js";
+
+/**
+ * Last-mile transport between the XMPP gateway and an agent runtime.
+ *
+ * NanoClaw implements this with per-session inbound.db writes. The interface
+ * intentionally contains no HTTP or provider concepts so another mailbox can
+ * replace it later without changing XMPP routing.
+ */
+export interface GatewayRuntimeMailbox {
+	deliverInbound(payload: BridgeInboundPayload): Promise<void>;
+	deliverFormResponse(payload: BridgeFormResponsePayload): Promise<void>;
+	deliverTaskEvent(event: TaskWireEvent): Promise<void>;
+}
diff --git a/packages/agent-xmpp/gateway/src/stanza-router.ts b/packages/agent-xmpp/gateway/src/stanza-router.ts
new file mode 100644
index 000000000..0551d9468
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/stanza-router.ts
@@ -0,0 +1,203 @@
+/**
+ * Central inbound stanza dispatch for the component. Routes by stanza kind and spec:
+ *   presence            -> RFC 6121 §3 roster/probe handling (presence.ts)
+ *   ask-question submit -> XEP-0004 Data Forms (data-form.ts)
+ *   agent-task payloads -> configured gateway-private task namespace (task-stanza-codec.ts)
+ *   XEP-0085/0184/0333  -> chat states & receipts are swallowed, not delivered (receipts.ts)
+ *   message             -> normalized to AgentMessage (message.ts), then delivery-gated
+ *
+ * On accepted 1:1 messages the router emits an XEP-0085 composing state and, when the
+ * sender opted in with an XEP-0184 <request/>, a delivery receipt.
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc6121#section-3
+ * @see https://xmpp.org/extensions/xep-0085.html
+ * @see https://xmpp.org/extensions/xep-0184.html
+ */
+import type { Element } from "@xmpp/xml";
+
+import {
+	DEFAULT_PROTOCOL_NAMESPACES,
+	type AgentMessage,
+} from "@agent-xmpp/protocol";
+
+import { sendComposingForAgent } from "./agent-send.js";
+import { bareJid } from "./xep-plugins/jid.js";
+import type { GatewayConfig } from "./config.js";
+import {
+	pushFormResponseToBridge,
+	pushInboundToBridge,
+	resolveInboundChatTargets,
+	shouldAcceptStanza,
+	type InboundDeliveryContext,
+} from "./delivery.js";
+import type { GatewayRuntimeMailbox } from "./runtime-mailbox.js";
+import {
+	isAgentJid,
+	resolveTargetAgentJid,
+	stanzaToAgentMessage,
+} from "./xep-plugins/message.js";
+import { parseAskQuestionSubmit } from "./xep-plugins/data-form.js";
+import {
+	buildReceivedReceipt,
+	isAckOrReceiptStanza,
+	receivedReceiptId,
+	requestsReceipt,
+} from "./xep-plugins/receipts.js";
+import { parseTaskEvent } from "./task-stanza-codec.js";
+import {
+	handleVirtualAgentPresence,
+	type VirtualAgentIdentity,
+} from "./xep-plugins/presence.js";
+
+export type SendStanzaFn = (stanza: Element) => Promise<void>;
+export type SendForAgentFn = (
+	agentJid: string,
+	stanza: Element,
+) => Promise<void>;
+export type ResolveVirtualAgentFn = (
+	jid: string,
+) => VirtualAgentIdentity | null;
+export type UpdatePresenceSubscriptionFn = (
+	agent: VirtualAgentIdentity,
+	subscriberJid: string,
+	subscribed: boolean,
+) => void;
+
+export class StanzaRouter {
+	constructor(
+		private config: GatewayConfig,
+		private mailbox: GatewayRuntimeMailbox,
+		private sendForAgent: SendForAgentFn,
+		private resolveVirtualAgent?: ResolveVirtualAgentFn,
+		private onReceipt?: (ackedId: string) => void,
+		private updatePresenceSubscription?: UpdatePresenceSubscriptionFn,
+	) {}
+
+	async handleIncoming(stanza: Element): Promise<void> {
+		if (stanza.name === "presence") {
+			const to = bareJid(String(stanza.attrs.to ?? ""));
+			const agent = this.resolveVirtualAgent?.(to);
+			if (agent) {
+				const result = handleVirtualAgentPresence(stanza, agent);
+				const change = result.subscriptionChange;
+				if (change)
+					this.updatePresenceSubscription?.(
+						agent,
+						change.subscriberJid,
+						change.subscribed,
+					);
+				for (const response of result.responses) {
+					await this.sendForAgent(agent.jid, response);
+				}
+			}
+			return;
+		}
+		if (stanza.name !== "message") return;
+
+		const toBare = bareJid(String(stanza.attrs.to ?? ""));
+		// Stanzas arrive on the component JID; resolve which registered agent they target.
+		const agentJid = resolveTargetAgentJid(
+			toBare,
+			this.config.agentDomain,
+			this.config.defaultAgentJid,
+		);
+
+		if (
+			!isAgentJid(agentJid, this.config.agentDomain) &&
+			agentJid !== this.config.defaultAgentJid
+		) {
+			return;
+		}
+
+		const from = stanza.attrs.from as string;
+		const fromBare = bareJid(from);
+		const agentBare = bareJid(agentJid);
+		// C2S inbox receives agent self-sent stanzas (outbound loopback) — drop them.
+		if (fromBare && agentBare && fromBare === agentBare) return;
+		const namespaces =
+			this.config.protocolNamespaces ?? DEFAULT_PROTOCOL_NAMESPACES;
+		if (stanza.getChildren("event", namespaces.task).length > 0) {
+			try {
+				const taskEvent = parseTaskEvent(stanza, namespaces);
+				if (taskEvent) await this.mailbox.deliverTaskEvent(taskEvent);
+			} catch (err) {
+				console.error(
+					"[xmpp-gateway] invalid task lifecycle event:",
+					err instanceof Error ? err.message : err,
+				);
+			}
+			return;
+		}
+
+		const formSubmit = parseAskQuestionSubmit(stanza);
+		if (formSubmit) {
+			const type = (stanza.attrs.type as string) || "chat";
+			await pushFormResponseToBridge(this.config, this.mailbox, {
+				agentJid,
+				from,
+				stanzaType: type,
+				questionId: formSubmit.questionId,
+				selectedIndex: formSubmit.selectedIndex,
+			});
+			return;
+		}
+
+		if (isAckOrReceiptStanza(stanza)) {
+			// XEP-0184: a peer's <received/> confirms one of our outbound messages.
+			const acked = receivedReceiptId(stanza);
+			if (acked) this.onReceipt?.(acked);
+			return;
+		}
+		const agentMsg = stanzaToAgentMessage(stanza, this.config.agentDomain);
+		if (!agentMsg) return;
+
+		const type = (stanza.attrs.type as string) || "chat";
+		const agentNick = agentJid.split("@")[0];
+		const bodyText =
+			typeof agentMsg.body === "string"
+				? agentMsg.body
+				: JSON.stringify(agentMsg.body);
+
+		if (!shouldAcceptStanza(type, from, bodyText, agentNick)) return;
+
+		const stanzaId = agentMsg.id;
+
+		const ctx: InboundDeliveryContext = {
+			agentMsg,
+			agentJid,
+			deliveryId: stanzaId,
+			stanzaType: type,
+			from,
+			redelivered: false,
+		};
+
+		void sendComposingForAgent(
+			(stanza) => this.sendForAgent(agentJid, stanza),
+			agentJid,
+			resolveInboundChatTargets(from, type, agentMsg),
+		).catch((err) => {
+			console.error("[xmpp-gateway] composing notification send failed:", err);
+		});
+
+		try {
+			await pushInboundToBridge(this.config, this.mailbox, ctx);
+		} catch (err) {
+			console.error(
+				"[xmpp-gateway] inbound delivery failed:",
+				err instanceof Error ? err.message : err,
+			);
+			return;
+		}
+
+		// XEP-0184: ack only 1:1 messages that explicitly requested a receipt.
+		// Groupchat receipts are not used (§5.5) and unsolicited ones spam the sender.
+		if (from && type === "chat" && requestsReceipt(stanza)) {
+			await this.sendForAgent(
+				agentJid,
+				buildReceivedReceipt(from, agentJid, stanzaId),
+			).catch((err) => {
+				console.error("[xmpp-gateway] received receipt send failed:", err);
+			});
+		}
+	}
+}
diff --git a/packages/agent-xmpp/gateway/src/task-stanza-codec.ts b/packages/agent-xmpp/gateway/src/task-stanza-codec.ts
new file mode 100644
index 000000000..d8d74fcb1
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/task-stanza-codec.ts
@@ -0,0 +1,772 @@
+import {
+	DEFAULT_PROTOCOL_NAMESPACES,
+	JSON_MEDIA_TYPE,
+	bareJid,
+	isApiVersion,
+	isNormalizedEndpointJid,
+	isOpaqueIdentifier,
+	isToolName,
+	isXep0082DateTime,
+	parseStrictJson,
+	taskEventTypes,
+	taskStates,
+	terminalTaskStates,
+	type AgentTaskEventType,
+	type AgentTaskRecord,
+	type AgentTaskState,
+	type AgentXmppNamespaces,
+	type McpToolResult,
+	type PendingTaskInput,
+} from "@agent-xmpp/protocol";
+import { xml, type Element } from "@xmpp/xml";
+
+import { buildHash, parseHash } from "./hash-codec.js";
+
+export interface ParsedTaskInvocation {
+	requestId: string;
+	tool: string;
+	apiVersion: string;
+	manifestHash: string;
+	callerJid: string;
+	notificationJid: string;
+	toJid: string;
+	arguments: unknown;
+	deadline?: string;
+}
+
+export interface ParsedTaskRecoveryRequest {
+	kind: "state" | "result";
+	taskId: string;
+}
+
+export interface ParsedTaskCancellation {
+	taskId: string;
+	expectedRevision: number;
+	reason?: string;
+}
+
+export interface ParsedTaskInput {
+	taskId: string;
+	requestId: string;
+	expectedRevision: number;
+	input: unknown;
+}
+
+export interface TaskWireEvent {
+	taskId: string;
+	eventId: string;
+	revision: number;
+	type: AgentTaskEventType;
+	from: string;
+	to: string;
+	payload: Record<string, unknown>;
+}
+
+export interface AcceptedTask {
+	requestId: string;
+	taskId: string;
+	revision: number;
+	created: string;
+	retainUntil: string;
+}
+
+export interface TaskStateSnapshot {
+	taskId: string;
+	endpoint: string;
+	state: AgentTaskState;
+	revision: number;
+	apiVersion: string;
+	manifestHash: string;
+	created: string;
+	updated: string;
+	retainUntil: string;
+	deadline?: string;
+	resultAvailable: boolean;
+	pendingInput?: PendingTaskInput;
+}
+
+export interface TaskResultSnapshot {
+	taskId: string;
+	state: Extract<AgentTaskState, "cancelled" | "failed" | "completed">;
+	revision: number;
+	result?: McpToolResult;
+	error?: {
+		code: string;
+		message: string;
+		retryable: boolean;
+		details?: Record<string, unknown>;
+	};
+	summary?: string;
+}
+
+export function parseTaskInvocation(
+	stanza: Element,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): ParsedTaskInvocation | null {
+	if (stanza.name !== "iq" || stanza.attrs.type !== "set") return null;
+	const payloads = stanza.getChildElements();
+	const invoke = stanza.getChild("invoke", namespaces.task);
+	if (!invoke) return null;
+	if (payloads.length !== 1 || payloads[0] !== invoke) {
+		throw new Error("invoke must be the only IQ payload");
+	}
+	assertOnlyAttributes(invoke, ["xmlns", "request-id", "tool", "api-version"]);
+	const children = invoke.getChildElements();
+	const expectedNames =
+		children.length === 3
+			? ["manifest-hash", "arguments", "deadline"]
+			: ["manifest-hash", "arguments"];
+	if (
+		children.length < 2 ||
+		children.length > 3 ||
+		children.some(
+			(child, index) =>
+				child.name !== expectedNames[index] ||
+				child.getNS() !== namespaces.task,
+		)
+	) {
+		throw new Error(
+			"invoke children must be manifest-hash, arguments, then optional deadline",
+		);
+	}
+	const [manifestHashElement, argumentsElement, deadlineElement] = children;
+	assertOnlyAttributes(manifestHashElement!, ["xmlns"]);
+	assertOnlyAttributes(argumentsElement!, ["xmlns", "media-type"]);
+	if (deadlineElement) assertOnlyAttributes(deadlineElement, ["xmlns"]);
+	const hashChildren = manifestHashElement!.getChildElements();
+	if (
+		hashChildren.length !== 1 ||
+		hashChildren[0]!.name !== "hash" ||
+		hashChildren[0]!.getNS() !== namespaces.hashes
+	) {
+		throw new Error("manifest-hash must contain exactly one XEP-0300 hash");
+	}
+	assertOnlyAttributes(hashChildren[0]!, ["xmlns", "algo"]);
+	if (
+		argumentsElement!.getChildElements().length > 0 ||
+		(deadlineElement?.getChildElements().length ?? 0) > 0
+	) {
+		throw new Error("arguments and deadline must contain character data only");
+	}
+	const requestId = String(invoke.attrs["request-id"] ?? "");
+	const tool = String(invoke.attrs.tool ?? "");
+	const apiVersion = String(invoke.attrs["api-version"] ?? "");
+	const targetJid = String(stanza.attrs.to ?? "");
+	const deadline = deadlineElement?.getText();
+	if (
+		!isOpaqueIdentifier(requestId) ||
+		!isToolName(tool) ||
+		!isApiVersion(apiVersion) ||
+		!isNormalizedEndpointJid(targetJid) ||
+		(deadline !== undefined && !isXep0082DateTime(deadline)) ||
+		argumentsElement!.attrs["media-type"] !== JSON_MEDIA_TYPE
+	) {
+		throw new Error("invoke is missing required attributes or JSON arguments");
+	}
+	return {
+		requestId,
+		tool,
+		apiVersion,
+		manifestHash: parseHash(invoke, "manifest-hash").value,
+		callerJid: bareJid(String(stanza.attrs.from ?? "")),
+		notificationJid: String(stanza.attrs.from ?? ""),
+		toJid: targetJid,
+		arguments: parseStrictJson(argumentsElement!.getText()),
+		deadline,
+	};
+}
+
+export function parseTaskRecoveryRequest(
+	stanza: Element,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): ParsedTaskRecoveryRequest | null {
+	const state = stanza.getChild("task-state-request", namespaces.task);
+	const result = stanza.getChild("task-result-request", namespaces.task);
+	const payload = state ?? result;
+	if (!payload) return null;
+	assertIqRequest(stanza, payload, "get");
+	assertOnlyAttributes(payload, ["xmlns", "task-id"]);
+	assertEmptyElement(payload);
+	const taskId = String(payload.attrs["task-id"] ?? "");
+	if (!isOpaqueId(taskId)) throw new Error("invalid task recovery identifier");
+	return { kind: state ? "state" : "result", taskId };
+}
+
+export function parseTaskCancellation(
+	stanza: Element,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): ParsedTaskCancellation | null {
+	const cancel = stanza.getChild("cancel", namespaces.task);
+	if (!cancel) return null;
+	assertIqRequest(stanza, cancel, "set");
+	assertOnlyAttributes(cancel, ["xmlns", "task-id", "expected-revision"]);
+	const children = cancel.getChildElements();
+	if (
+		children.length > 1 ||
+		children.some(
+			(child) => child.name !== "reason" || child.getNS() !== namespaces.task,
+		)
+	) {
+		throw new Error("cancel may contain only one reason");
+	}
+	if (
+		cancel.children.some(
+			(child) => typeof child === "string" && child.trim() !== "",
+		)
+	) {
+		throw new Error("cancel may not contain direct character data");
+	}
+	const reason = children[0];
+	if (reason) {
+		assertOnlyAttributes(reason, ["xmlns"]);
+		if (reason.getChildElements().length > 0)
+			throw new Error("reason must contain character data only");
+	}
+	const taskId = String(cancel.attrs["task-id"] ?? "");
+	const expectedRevision = parseNonNegativeInteger(
+		cancel.attrs["expected-revision"],
+	);
+	if (!isOpaqueId(taskId)) throw new Error("invalid cancellation identifier");
+	return {
+		taskId,
+		expectedRevision,
+		...(reason ? { reason: reason.getText() } : {}),
+	};
+}
+
+export function parseTaskInput(
+	stanza: Element,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): ParsedTaskInput | null {
+	const provide = stanza.getChild("provide-input", namespaces.task);
+	if (!provide) return null;
+	assertIqRequest(stanza, provide, "set");
+	assertOnlyAttributes(provide, [
+		"xmlns",
+		"task-id",
+		"request-id",
+		"expected-revision",
+	]);
+	const children = provide.getChildElements();
+	if (
+		children.length !== 1 ||
+		children[0]!.name !== "input" ||
+		children[0]!.getNS() !== namespaces.task ||
+		provide.children.some(
+			(child) => typeof child === "string" && child.trim() !== "",
+		)
+	) {
+		throw new Error("provide-input must contain exactly one input");
+	}
+	const input = children[0]!;
+	assertOnlyAttributes(input, ["xmlns", "media-type"]);
+	if (
+		input.attrs["media-type"] !== JSON_MEDIA_TYPE ||
+		input.getChildElements().length > 0
+	) {
+		throw new Error("input must contain JSON character data");
+	}
+	const taskId = String(provide.attrs["task-id"] ?? "");
+	const requestId = String(provide.attrs["request-id"] ?? "");
+	const expectedRevision = parseNonNegativeInteger(
+		provide.attrs["expected-revision"],
+	);
+	if (!isOpaqueId(taskId) || !isOpaqueId(requestId))
+		throw new Error("invalid task input identifier");
+	return {
+		taskId,
+		requestId,
+		expectedRevision,
+		input: parseStrictJson(input.getText()),
+	};
+}
+
+export function buildTaskInvocation(
+	task: AgentTaskRecord,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): Element {
+	return xml(
+		"iq",
+		{
+			from: task.callerJid,
+			to: task.targetJid,
+			type: "set",
+			id: `invoke-${task.requestId}`,
+		},
+		xml(
+			"invoke",
+			{
+				xmlns: namespaces.task,
+				"request-id": task.requestId,
+				tool: task.tool,
+				"api-version": task.apiVersion,
+			},
+			xml("manifest-hash", {}, buildHash(task.manifestHash)),
+			xml(
+				"arguments",
+				{ "media-type": JSON_MEDIA_TYPE },
+				JSON.stringify(task.arguments),
+			),
+			...(task.deadline ? [xml("deadline", {}, task.deadline)] : []),
+		),
+	);
+}
+
+export function buildAcceptedResult(
+	request: Element,
+	accepted: AcceptedTask,
+	from: string,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): Element {
+	return xml(
+		"iq",
+		{ type: "result", id: request.attrs.id, from, to: request.attrs.from },
+		xml("accepted", {
+			xmlns: namespaces.task,
+			"request-id": accepted.requestId,
+			"task-id": accepted.taskId,
+			revision: String(accepted.revision),
+			created: accepted.created,
+			"retain-until": accepted.retainUntil,
+		}),
+	);
+}
+
+export function parseAcceptedResult(
+	stanza: Element,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): AcceptedTask | null {
+	if (stanza.name !== "iq" || stanza.attrs.type !== "result") return null;
+	const accepted = stanza.getChild("accepted", namespaces.task);
+	if (!accepted) return null;
+	const revision = Number(accepted.attrs.revision);
+	if (!Number.isSafeInteger(revision) || revision < 0)
+		throw new Error("accepted task has invalid revision");
+	const parsed: AcceptedTask = {
+		requestId: String(accepted.attrs["request-id"] ?? ""),
+		taskId: String(accepted.attrs["task-id"] ?? ""),
+		revision,
+		created: String(accepted.attrs.created ?? ""),
+		retainUntil: String(accepted.attrs["retain-until"] ?? ""),
+	};
+	if (
+		!parsed.requestId ||
+		!parsed.taskId ||
+		!isXep0082DateTime(parsed.created) ||
+		!isXep0082DateTime(parsed.retainUntil)
+	) {
+		throw new Error("accepted task is missing required attributes");
+	}
+	if (!isOpaqueId(parsed.requestId) || !isOpaqueId(parsed.taskId)) {
+		throw new Error("accepted task contains an invalid opaque identifier");
+	}
+	return parsed;
+}
+
+export function buildTaskStateResponse(
+	request: Element,
+	task: AgentTaskRecord,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): Element {
+	return xml(
+		"iq",
+		{
+			type: "result",
+			id: request.attrs.id,
+			from: task.targetJid,
+			to: request.attrs.from,
+		},
+		xml(
+			"task-state",
+			{
+				xmlns: namespaces.task,
+				"task-id": task.taskId,
+				endpoint: task.targetJid,
+				state: task.state,
+				revision: String(task.revision),
+				"api-version": task.apiVersion,
+				created: task.createdAt,
+				updated: task.updatedAt,
+				"retain-until": task.retainUntil,
+				"result-available": terminalTaskStates.has(task.state)
+					? "true"
+					: "false",
+				...(task.deadline ? { deadline: task.deadline } : {}),
+			},
+			xml(
+				"manifest-hash",
+				{},
+				xml(
+					"hash",
+					{ xmlns: namespaces.hashes, algo: "sha-256" },
+					task.manifestHash,
+				),
+			),
+			...(task.pendingInput
+				? [
+						xml(
+							"pending-input",
+							{ "media-type": JSON_MEDIA_TYPE },
+							JSON.stringify(task.pendingInput),
+						),
+					]
+				: []),
+		),
+	);
+}
+
+export function buildTaskResultResponse(
+	request: Element,
+	task: AgentTaskRecord,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): Element {
+	const payload =
+		task.state === "completed"
+			? {
+					result: task.result,
+					...(task.summary ? { summary: task.summary } : {}),
+				}
+			: task.state === "failed"
+				? { error: task.error }
+				: {};
+	return xml(
+		"iq",
+		{
+			type: "result",
+			id: request.attrs.id,
+			from: task.targetJid,
+			to: request.attrs.from,
+		},
+		xml(
+			"task-result",
+			{
+				xmlns: namespaces.task,
+				"task-id": task.taskId,
+				state: task.state,
+				revision: String(task.revision),
+				"media-type": JSON_MEDIA_TYPE,
+			},
+			JSON.stringify(payload),
+		),
+	);
+}
+
+export function buildTaskStateRequest(
+	task: AgentTaskRecord,
+	remoteTaskId: string,
+): Element {
+	return xml(
+		"iq",
+		{
+			from: task.callerJid,
+			to: task.targetJid,
+			type: "get",
+			id: `state-${task.taskId}-${task.revision}`,
+		},
+		xml("task-state-request", {
+			xmlns: DEFAULT_PROTOCOL_NAMESPACES.task,
+			"task-id": remoteTaskId,
+		}),
+	);
+}
+
+export function buildTaskResultRequest(
+	task: AgentTaskRecord,
+	remoteTaskId: string,
+): Element {
+	return xml(
+		"iq",
+		{
+			from: task.callerJid,
+			to: task.targetJid,
+			type: "get",
+			id: `result-${task.taskId}-${task.revision}`,
+		},
+		xml("task-result-request", {
+			xmlns: DEFAULT_PROTOCOL_NAMESPACES.task,
+			"task-id": remoteTaskId,
+		}),
+	);
+}
+
+export function buildTaskCancellation(
+	task: AgentTaskRecord,
+	remoteTaskId: string,
+	expectedRevision: number,
+	reason?: string,
+): Element {
+	return xml(
+		"iq",
+		{
+			from: task.callerJid,
+			to: task.targetJid,
+			type: "set",
+			id: `cancel-${task.taskId}-${expectedRevision}`,
+		},
+		xml(
+			"cancel",
+			{
+				xmlns: DEFAULT_PROTOCOL_NAMESPACES.task,
+				"task-id": remoteTaskId,
+				"expected-revision": String(expectedRevision),
+			},
+			...(reason !== undefined ? [xml("reason", {}, reason)] : []),
+		),
+	);
+}
+
+export function buildTaskInput(
+	task: AgentTaskRecord,
+	remoteTaskId: string,
+	requestId: string,
+	expectedRevision: number,
+	input: unknown,
+): Element {
+	return xml(
+		"iq",
+		{
+			from: task.callerJid,
+			to: task.targetJid,
+			type: "set",
+			id: `input-${task.taskId}-${expectedRevision}`,
+		},
+		xml(
+			"provide-input",
+			{
+				xmlns: DEFAULT_PROTOCOL_NAMESPACES.task,
+				"task-id": remoteTaskId,
+				"request-id": requestId,
+				"expected-revision": String(expectedRevision),
+			},
+			xml("input", { "media-type": JSON_MEDIA_TYPE }, JSON.stringify(input)),
+		),
+	);
+}
+
+export function parseTaskActionResult(
+	stanza: Element,
+	name: "cancel-accepted" | "input-accepted",
+): { taskId: string; revision: number } | null {
+	if (stanza.name !== "iq" || stanza.attrs.type !== "result") return null;
+	const accepted = stanza.getChild(name, DEFAULT_PROTOCOL_NAMESPACES.task);
+	if (!accepted) return null;
+	const taskId = String(accepted.attrs["task-id"] ?? "");
+	const revision = Number(accepted.attrs.revision);
+	if (!isOpaqueId(taskId) || !Number.isSafeInteger(revision) || revision < 1) {
+		throw new Error(`invalid ${name} result`);
+	}
+	return { taskId, revision };
+}
+
+export function parseTaskStateResult(
+	stanza: Element,
+): TaskStateSnapshot | null {
+	if (stanza.name !== "iq" || stanza.attrs.type !== "result") return null;
+	const state = stanza.getChild("task-state", DEFAULT_PROTOCOL_NAMESPACES.task);
+	if (!state) return null;
+	const taskState = String(state.attrs.state ?? "") as AgentTaskState;
+	const taskId = String(state.attrs["task-id"] ?? "");
+	const revision = Number(state.attrs.revision);
+	const endpoint = String(state.attrs.endpoint ?? "");
+	const apiVersion = String(state.attrs["api-version"] ?? "");
+	const created = String(state.attrs.created ?? "");
+	const updated = String(state.attrs.updated ?? "");
+	const retainUntil = String(state.attrs["retain-until"] ?? "");
+	if (
+		!isOpaqueId(taskId) ||
+		!taskStates.includes(taskState) ||
+		!Number.isSafeInteger(revision) ||
+		revision < 0 ||
+		!isNormalizedEndpointJid(endpoint) ||
+		!isApiVersion(apiVersion) ||
+		!isXep0082DateTime(created) ||
+		!isXep0082DateTime(updated) ||
+		!isXep0082DateTime(retainUntil) ||
+		(state.attrs.deadline !== undefined &&
+			!isXep0082DateTime(String(state.attrs.deadline)))
+	) {
+		throw new Error("invalid task-state result");
+	}
+	const pending = state.getChild("pending-input");
+	if (pending && pending.attrs["media-type"] !== JSON_MEDIA_TYPE) {
+		throw new Error("pending task input must use application/json");
+	}
+	return {
+		taskId,
+		endpoint,
+		state: taskState,
+		revision,
+		apiVersion,
+		manifestHash: parseHash(state, "manifest-hash").value,
+		created,
+		updated,
+		retainUntil,
+		deadline: state.attrs.deadline ? String(state.attrs.deadline) : undefined,
+		resultAvailable: state.attrs["result-available"] === "true",
+		pendingInput: pending
+			? (parseStrictJson(pending.getText()) as PendingTaskInput)
+			: undefined,
+	};
+}
+
+export function parseTaskResult(stanza: Element): TaskResultSnapshot | null {
+	if (stanza.name !== "iq" || stanza.attrs.type !== "result") return null;
+	const result = stanza.getChild(
+		"task-result",
+		DEFAULT_PROTOCOL_NAMESPACES.task,
+	);
+	if (!result) return null;
+	const taskId = String(result.attrs["task-id"] ?? "");
+	const state = String(result.attrs.state ?? "") as TaskResultSnapshot["state"];
+	const revision = Number(result.attrs.revision);
+	if (
+		!isOpaqueId(taskId) ||
+		!terminalTaskStates.has(state) ||
+		!Number.isSafeInteger(revision) ||
+		revision < 1 ||
+		result.attrs["media-type"] !== JSON_MEDIA_TYPE
+	) {
+		throw new Error("invalid task-result");
+	}
+	const payload = parseTaskPayload(
+		result.getText() || "{}",
+		"invalid task-result payload",
+	);
+	return {
+		taskId,
+		state,
+		revision,
+		result: payload.result as McpToolResult | undefined,
+		error: payload.error as TaskResultSnapshot["error"],
+		summary: typeof payload.summary === "string" ? payload.summary : undefined,
+	};
+}
+
+export function parseTaskEvent(
+	stanza: Element,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): TaskWireEvent | null {
+	if (stanza.name !== "message") return null;
+	const events = stanza.getChildren("event", namespaces.task);
+	if (events.length === 0) return null;
+	if (events.length !== 1)
+		throw new Error("task event message must contain exactly one event");
+	const messageType = String(stanza.attrs.type ?? "normal");
+	if (messageType !== "normal")
+		throw new Error("invalid task event message type");
+	const event = events[0]!;
+	assertOnlyAttributes(event, [
+		"xmlns",
+		"task-id",
+		"event-id",
+		"revision",
+		"type",
+	]);
+	if (event.getChildElements().length > 0)
+		throw new Error("task event payload must contain character data only");
+	const type = String(event.attrs.type ?? "") as AgentTaskEventType;
+	if (!taskEventTypes.includes(type)) {
+		throw new Error("unknown task event type");
+	}
+	const revision = Number(event.attrs.revision);
+	if (!Number.isSafeInteger(revision) || revision < 1)
+		throw new Error("invalid task event revision");
+	const taskId = String(event.attrs["task-id"] ?? "");
+	const eventId = String(event.attrs["event-id"] ?? "");
+	if (!isOpaqueId(taskId) || !isOpaqueId(eventId))
+		throw new Error("invalid task event identifier");
+	return {
+		taskId,
+		eventId,
+		revision,
+		type,
+		from: String(stanza.attrs.from ?? ""),
+		to: String(stanza.attrs.to ?? ""),
+		payload: parseTaskPayload(
+			event.getText() || "{}",
+			"invalid task event payload",
+		),
+	};
+}
+
+export function buildTaskEvent(
+	event: TaskWireEvent,
+	namespaces: AgentXmppNamespaces = DEFAULT_PROTOCOL_NAMESPACES,
+): Element {
+	return xml(
+		"message",
+		{ from: event.from, to: event.to, type: "normal", id: event.eventId },
+		xml(
+			"event",
+			{
+				xmlns: namespaces.task,
+				"task-id": event.taskId,
+				"event-id": event.eventId,
+				revision: String(event.revision),
+				type: event.type,
+			},
+			JSON.stringify(event.payload),
+		),
+	);
+}
+
+export function isOpaqueId(value: string): boolean {
+	return isOpaqueIdentifier(value);
+}
+
+function assertIqRequest(
+	stanza: Element,
+	payload: Element,
+	type: "get" | "set",
+): void {
+	if (
+		stanza.name !== "iq" ||
+		stanza.attrs.type !== type ||
+		stanza.getChildElements().length !== 1 ||
+		stanza.getChildElements()[0] !== payload
+	) {
+		throw new Error(
+			`${payload.name} must be the only payload of an IQ ${type}`,
+		);
+	}
+}
+
+function assertEmptyElement(element: Element): void {
+	if (
+		element.getChildElements().length > 0 ||
+		element.children.some(
+			(child) => typeof child === "string" && child.trim() !== "",
+		)
+	) {
+		throw new Error(`${element.name} must be empty`);
+	}
+}
+
+function parseNonNegativeInteger(value: unknown): number {
+	if (typeof value !== "string" || !/^\+?\d+$/.test(value))
+		throw new Error("missing non-negative integer");
+	const parsed = Number(value);
+	if (!Number.isSafeInteger(parsed) || parsed < 0)
+		throw new Error("invalid non-negative integer");
+	return parsed;
+}
+
+function assertOnlyAttributes(
+	element: Element,
+	allowed: readonly string[],
+): void {
+	const allowedNames = new Set(allowed);
+	if (Object.keys(element.attrs).some((name) => !allowedNames.has(name))) {
+		throw new Error(`${element.name} has unsupported attributes`);
+	}
+}
+
+function parseTaskPayload(
+	text: string,
+	errorMessage: string,
+): Record<string, unknown> {
+	const value = parseStrictJson(text);
+	if (value === null || Array.isArray(value) || typeof value !== "object")
+		throw new Error(errorMessage);
+	return value as Record<string, unknown>;
+}
diff --git a/packages/agent-xmpp/gateway/src/xep-plugins/chatstate.ts b/packages/agent-xmpp/gateway/src/xep-plugins/chatstate.ts
new file mode 100644
index 000000000..6684e78df
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/xep-plugins/chatstate.ts
@@ -0,0 +1,65 @@
+/**
+ * XEP-0085 Chat State Notifications.
+ * @see https://xmpp.org/extensions/xep-0085.html
+ */
+
+import { xml, type Element } from "@xmpp/xml";
+
+import { bareJid } from "./jid.js";
+
+const CHATSTATES_NS = "http://jabber.org/protocol/chatstates";
+
+export function isChatStateStanza(stanza: Element): boolean {
+	if (stanza.name !== "message") return false;
+	const body = stanza.getChildText("body");
+	if (body?.trim()) return false;
+	for (const child of stanza.children) {
+		if (typeof child !== "object" || child === null) continue;
+		if (child.attrs?.xmlns === CHATSTATES_NS) return true;
+	}
+	return false;
+}
+
+export function buildComposingStanza(opts: {
+	from: string;
+	to: string;
+	threadId?: string | null;
+	groupchat?: boolean;
+}): Element {
+	return buildChatStateStanza({ ...opts, state: "composing" });
+}
+
+export function buildPausedStanza(opts: {
+	from: string;
+	to: string;
+	threadId?: string | null;
+	groupchat?: boolean;
+}): Element {
+	return buildChatStateStanza({ ...opts, state: "paused" });
+}
+
+export function buildInactiveStanza(opts: {
+	from: string;
+	to: string;
+	threadId?: string | null;
+	groupchat?: boolean;
+}): Element {
+	return buildChatStateStanza({ ...opts, state: "inactive" });
+}
+
+function buildChatStateStanza(opts: {
+	from: string;
+	to: string;
+	threadId?: string | null;
+	groupchat?: boolean;
+	state: "composing" | "paused" | "inactive";
+}): Element {
+	// XEP-0085 states belong to the same 1:1 resource as the chat response.
+	const to = opts.groupchat ? bareJid(opts.to) : opts.to;
+	const type = opts.groupchat ? "groupchat" : "chat";
+	const children: Element[] = [xml(opts.state, { xmlns: CHATSTATES_NS })];
+	if (opts.threadId) {
+		children.unshift(xml("thread", {}, opts.threadId));
+	}
+	return xml("message", { type, to, from: bareJid(opts.from) }, ...children);
+}
diff --git a/packages/agent-xmpp/gateway/src/xep-plugins/data-form.ts b/packages/agent-xmpp/gateway/src/xep-plugins/data-form.ts
new file mode 100644
index 000000000..bd2cb0e02
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/xep-plugins/data-form.ts
@@ -0,0 +1,166 @@
+/**
+ * XEP-0004 Data Forms — ask_user_question multiple-choice via list-single fields.
+ * Outbound forms also carry XEP-0359 origin IDs. The optional reply marker uses
+ * the XEP-0461 namespace including `to`; it always uses `req.inReplyTo` as the
+ * id regardless of 1:1 vs groupchat context (see message.ts header for detail).
+ *
+ * @see https://xmpp.org/extensions/xep-0004.html
+ * @see https://xmpp.org/extensions/xep-0359.html
+ * @see https://xmpp.org/extensions/xep-0461.html
+ */
+
+import { xml, type Element } from "@xmpp/xml";
+import { ulid } from "ulid";
+
+import type {
+	AskQuestionPayload,
+	OutboundDeliverRequest,
+} from "@agent-xmpp/protocol";
+
+import { bareJid, isMucJid } from "./jid.js";
+import { RECEIPTS_NS } from "./receipts.js";
+
+export const DATA_FORM_NS = "jabber:x:data";
+export const ASK_QUESTION_FORM_TYPE = "urn:xmpp:nanoclaw:ask-question:0";
+
+const ORIGIN_ID_NS = "urn:xmpp:sid:0";
+const REPLY_NS = "urn:xmpp:reply:0";
+
+export interface AskQuestionSubmit {
+	questionId: string;
+	selectedIndex: number;
+}
+
+function optionLabel(raw: AskQuestionPayload["options"][number]): string {
+	return typeof raw === "string" ? raw : raw.label;
+}
+
+function buildBodyFallback(payload: AskQuestionPayload): string {
+	const labels = payload.options.map(optionLabel);
+	return `${payload.title}\n\n${payload.question}\n\nOptions: ${labels.join(", ")}`;
+}
+
+function hiddenField(varName: string, value: string): Element {
+	return xml(
+		"field",
+		{ var: varName, type: "hidden" },
+		xml("value", {}, value),
+	);
+}
+
+function listSingleField(payload: AskQuestionPayload): Element {
+	const options = payload.options.map((raw, idx) =>
+		xml("option", { label: optionLabel(raw) }, xml("value", {}, String(idx))),
+	);
+	return xml(
+		"field",
+		{ var: "response", type: "list-single", label: "Choose one" },
+		...options,
+	);
+}
+
+export function isAskQuestionContent(
+	content: unknown,
+): content is AskQuestionPayload {
+	if (!content || typeof content !== "object") return false;
+	const c = content as Record<string, unknown>;
+	return (
+		c.type === "ask_question" &&
+		typeof c.questionId === "string" &&
+		typeof c.title === "string" &&
+		typeof c.question === "string" &&
+		Array.isArray(c.options) &&
+		c.options.length > 0
+	);
+}
+
+export function buildAskQuestionFormStanza(
+	req: OutboundDeliverRequest,
+	fromJid: string,
+	payload: AskQuestionPayload,
+): Element {
+	const id = ulid();
+	const children: Element[] = [
+		xml("body", {}, buildBodyFallback(payload)),
+		xml(
+			"x",
+			{ xmlns: DATA_FORM_NS, type: "form" },
+			xml("title", {}, payload.title),
+			xml("instructions", {}, payload.question),
+			hiddenField("FORM_TYPE", ASK_QUESTION_FORM_TYPE),
+			hiddenField("questionId", payload.questionId),
+			listSingleField(payload),
+		),
+		xml("origin-id", { xmlns: ORIGIN_ID_NS, id }),
+	];
+
+	if (req.threadId) {
+		children.unshift(xml("thread", {}, req.threadId));
+	}
+
+	if (req.inReplyTo) {
+		// XEP-0461: bare JID is only a MAY for 1:1; groupchat wants the full JID.
+		const isMuc = isMucJid(req.to);
+		children.push(
+			xml("reply", {
+				xmlns: REPLY_NS,
+				id: req.inReplyTo,
+				to: isMuc ? req.to : bareJid(req.to),
+			}),
+		);
+	}
+
+	const isMuc = isMucJid(req.to);
+	// XEP-0184 §5.1/§5.5: request a delivery receipt on 1:1 forms only (never MUC), so the
+	// form is tracked and resent like any other chat message sent through deliver().
+	if (!isMuc) {
+		children.push(xml("request", { xmlns: RECEIPTS_NS }));
+	}
+
+	// RFC 6121 section 8.5.2.1: preserve the initiating resource for 1:1 replies.
+	const to = req.threadId && isMuc ? req.to : isMuc ? bareJid(req.to) : req.to;
+	const type = isMuc ? "groupchat" : "chat";
+
+	return xml(
+		"message",
+		{
+			type,
+			id,
+			to,
+			from: fromJid,
+			...(req.lang ? { "xml:lang": req.lang } : {}),
+		},
+		...children,
+	);
+}
+
+function dataFormFieldValue(form: Element, varName: string): string | null {
+	for (const child of form.children) {
+		if (typeof child === "string") continue;
+		if (child.name !== "field" || child.attrs.var !== varName) continue;
+		const value = child.getChildText("value");
+		return value ?? null;
+	}
+	return null;
+}
+
+export function parseAskQuestionSubmit(
+	stanza: Element,
+): AskQuestionSubmit | null {
+	if (stanza.name !== "message") return null;
+
+	const form = stanza.getChild("x", DATA_FORM_NS);
+	if (!form || form.attrs.type !== "submit") return null;
+
+	const formType = dataFormFieldValue(form, "FORM_TYPE");
+	if (formType !== ASK_QUESTION_FORM_TYPE) return null;
+
+	const questionId = dataFormFieldValue(form, "questionId");
+	const responseRaw = dataFormFieldValue(form, "response");
+	if (!questionId || responseRaw === null) return null;
+
+	const selectedIndex = Number(responseRaw);
+	if (!Number.isInteger(selectedIndex) || selectedIndex < 0) return null;
+
+	return { questionId, selectedIndex };
+}
diff --git a/packages/agent-xmpp/gateway/src/xep-plugins/jid.ts b/packages/agent-xmpp/gateway/src/xep-plugins/jid.ts
new file mode 100644
index 000000000..102790df6
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/xep-plugins/jid.ts
@@ -0,0 +1,9 @@
+/** Shared JID helpers (kept cycle-free so both message.ts and muc.ts can import it). */
+
+/** Bare JID (localpart@domain) — strips any /resource. */
+export { bareJid } from "@agent-xmpp/protocol";
+
+/** True for MUC room JIDs on the conventional `conference.` / `groups.` service domains. */
+export function isMucJid(jid: string): boolean {
+	return jid.includes("@conference.") || jid.includes("@groups.");
+}
diff --git a/packages/agent-xmpp/gateway/src/xep-plugins/message.ts b/packages/agent-xmpp/gateway/src/xep-plugins/message.ts
new file mode 100644
index 000000000..b21d82c78
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/xep-plugins/message.ts
@@ -0,0 +1,307 @@
+/**
+ * Message normalization and construction.
+ *
+ * The JSON payload nests its content in a <json xmlns='urn:xmpp:json:0'>
+ * child per XEP-0335; `datatype` still carries a MIME type rather than a
+ * schema namespace, and the JSON body is the gateway's own
+ * kind/contentType/body envelope, not caller-defined XEP-0432 content —
+ * both are deliberate gateway conventions, not spec violations. The reply
+ * marker carries `to` per XEP-0461, but always uses `req.inReplyTo` as the
+ * id regardless of 1:1 vs groupchat context; the spec's groupchat-specific
+ * stanza-id-selection rule is not implemented. The content-type marker,
+ * XEP-0334 processing hints, and XEP-0359 origin IDs use their standard
+ * namespaces.
+ *
+ * @see https://xmpp.org/extensions/xep-0432.html
+ * @see https://xmpp.org/extensions/xep-0481.html
+ * @see https://xmpp.org/extensions/xep-0461.html
+ * @see https://xmpp.org/extensions/xep-0334.html
+ * @see https://xmpp.org/extensions/xep-0359.html
+ * @see https://xmpp.org/extensions/xep-0335.html
+ */
+
+import { createHash } from "crypto";
+
+import { xml, type Element } from "@xmpp/xml";
+import { ulid } from "ulid";
+
+import { bareJid, isMucJid } from "./jid.js";
+
+import type {
+	AgentMessage,
+	InboundMessage,
+	MessageKind,
+	MessagePolicy,
+	OutboundDeliverRequest,
+	XmppSourceMetadata,
+} from "@agent-xmpp/protocol";
+
+import {
+	buildAskQuestionFormStanza,
+	isAskQuestionContent,
+} from "./data-form.js";
+import { RECEIPTS_NS } from "./receipts.js";
+
+const JSON_NS = "urn:xmpp:json-msg:0";
+const ORIGIN_ID_NS = "urn:xmpp:sid:0";
+const REPLY_NS = "urn:xmpp:reply:0";
+const STORE_NS = "urn:xmpp:hints";
+const CONTENT_TYPE_NS = "urn:xmpp:content";
+
+export function extractStableId(stanza: Element): string {
+	const attrId = stanza.attrs.id as string | undefined;
+	if (attrId) return attrId;
+	const origin = stanza.getChild("origin-id", ORIGIN_ID_NS);
+	if (origin?.attrs.id) return origin.attrs.id as string;
+	// No stanza id: derive a deterministic id from content so a redelivered stanza
+	// dedups instead of being processed twice. ponytail: content hash — two identical
+	// id-less messages collide; acceptable since servers virtually always stamp `id`.
+	const from = (stanza.attrs.from as string) || "";
+	const to = (stanza.attrs.to as string) || "";
+	const body = stanza.getChildText("body") || "";
+	const thread = stanza.getChild("thread")?.getText() || "";
+	const digest = createHash("sha256")
+		.update(`${from}\n${to}\n${thread}\n${body}`)
+		.digest("hex");
+	return `derived-${digest.slice(0, 26)}`;
+}
+
+function payloadText(stanza: Element): string | null {
+	const payload = stanza.getChild("payload", JSON_NS);
+	if (!payload) return null;
+	return payload.getChildText("json", "urn:xmpp:json:0") || null;
+}
+
+function parseJsonPayload(
+	stanza: Element,
+): { kind: MessageKind; contentType: string; body: unknown } | null {
+	const payload = stanza.getChild("payload", JSON_NS);
+	if (!payload) return null;
+	const datatype = (payload.attrs.datatype as string) || "application/json";
+	const raw = payloadText(stanza);
+	if (!raw) return null;
+	try {
+		const parsed = JSON.parse(raw) as {
+			kind?: MessageKind;
+			contentType?: string;
+			body?: unknown;
+		};
+		return {
+			kind: parsed.kind || "text",
+			contentType: parsed.contentType || datatype,
+			body: parsed.body ?? parsed,
+		};
+		// eslint-disable-next-line no-catch-all/no-catch-all -- malformed JSON payload falls back to raw text
+	} catch {
+		return { kind: "text", contentType: datatype, body: raw };
+	}
+}
+
+function bodyText(stanza: Element): string {
+	return stanza.getChildText("body") || "";
+}
+
+export function stanzaToAgentMessage(
+	stanza: Element,
+	agentDomain: string,
+): AgentMessage | null {
+	if (stanza.name !== "message") return null;
+	const type = (stanza.attrs.type as string) || "chat";
+	if (type === "error" || type === "headline") return null;
+
+	const from = stanza.attrs.from as string;
+	const to = stanza.attrs.to as string;
+	if (!from || !to) return null;
+
+	const id = extractStableId(stanza);
+	const threadEl = stanza.getChild("thread");
+	// XEP-0201: the thread id is the element's text content, not a child or attribute.
+	const threadId =
+		threadEl?.getText()?.trim() || (threadEl?.attrs as { id?: string })?.id;
+
+	const replyEl = stanza.getChild("reply", REPLY_NS);
+	const replyTo = replyEl?.attrs.id as string | undefined;
+
+	const json = parseJsonPayload(stanza);
+	const text = bodyText(stanza);
+	const isMuc = type === "groupchat";
+	const roomId = isMuc ? bareJid(from) : undefined;
+	const fromBare = bareJid(from);
+
+	let kind: MessageKind = json?.kind || "text";
+	let contentType = json?.contentType || "text/plain";
+	let body: unknown = json?.body ?? text;
+
+	const ctEl = stanza.getChild("content", CONTENT_TYPE_NS);
+	if (ctEl?.attrs.type) contentType = ctEl.attrs.type as string;
+
+	if (!json && text.startsWith("{")) {
+		try {
+			const parsed = JSON.parse(text);
+			if (parsed.kind) kind = parsed.kind;
+			if (parsed.contentType) contentType = parsed.contentType;
+			body = parsed.body ?? parsed;
+			// eslint-disable-next-line no-catch-all/no-catch-all -- body looks like JSON but isn't; keep as plain text
+		} catch {
+			/* plain text */
+		}
+	}
+
+	// XEP-0513: MUC mentions MUST address by `occupantid` (XEP-0421) when the room
+	// supports it; only outside MUC (or in occupant-id-less rooms) is `jid` used.
+	// Accept either so occupant-id-addressed mentions aren't silently dropped.
+	const mentions = stanza
+		.getChildren("mention", "urn:xmpp:mentions:0")
+		.map((el) => (el.attrs.jid ?? el.attrs.occupantid) as string)
+		.filter(Boolean);
+	const extensions: Record<string, unknown> = {};
+	if (mentions.length) extensions.mentions = mentions;
+
+	return {
+		id,
+		from: isMuc ? from : fromBare,
+		to: bareJid(to),
+		threadId: threadId || undefined,
+		roomId,
+		kind,
+		contentType,
+		body,
+		replyTo,
+		extensions: Object.keys(extensions).length ? extensions : undefined,
+	};
+}
+
+export function buildInboundEnvelope(
+	msg: AgentMessage,
+	gatewayId: string,
+	deliveryId: string,
+	xmppMeta: XmppSourceMetadata,
+	redelivered?: boolean,
+): InboundMessage {
+	return {
+		type: "inbound.message",
+		message: msg,
+		delivery: {
+			receivedAt: new Date().toISOString(),
+			gatewayId,
+			deliveryId,
+			redelivered,
+		},
+		xmpp: xmppMeta,
+	};
+}
+
+export function isAgentJid(jid: string, agentDomain: string): boolean {
+	const bare = bareJid(jid);
+	return bare.endsWith(`@${agentDomain}`);
+}
+
+export function resolveTargetAgentJid(
+	to: string,
+	agentDomain: string,
+	defaultAgent: string,
+): string {
+	const bare = bareJid(to);
+	if (isAgentJid(bare, agentDomain)) return bare;
+	// Traffic to the bare component address is attributed to the default agent for this gateway.
+	return defaultAgent;
+}
+
+export function buildOutboundStanza(
+	req: OutboundDeliverRequest,
+	fromJid: string,
+): Element {
+	if (isAskQuestionContent(req.content)) {
+		return buildAskQuestionFormStanza(req, fromJid, req.content);
+	}
+
+	const id = req.id ?? ulid();
+	const text =
+		typeof req.content === "string"
+			? req.content
+			: (req.content as { text?: string })?.text ||
+				(typeof req.content === "object" && req.content !== null
+					? JSON.stringify(req.content)
+					: String(req.content));
+
+	const contentType = "text/plain";
+	const payload = {
+		kind: "text",
+		contentType,
+		body: req.content,
+	};
+
+	const children: Element[] = [xml("body", {}, text)];
+	const isMuc = isMucJid(req.to);
+
+	if (req.threadId) {
+		children.push(xml("thread", {}, req.threadId));
+	}
+
+	if (req.inReplyTo) {
+		// XEP-0461: bare JID is only a MAY for 1:1; groupchat wants the full JID.
+		children.push(
+			xml("reply", {
+				xmlns: REPLY_NS,
+				id: req.inReplyTo,
+				to: isMuc ? req.to : bareJid(req.to),
+			}),
+		);
+	}
+
+	children.push(
+		xml("origin-id", { xmlns: ORIGIN_ID_NS, id: id }),
+		xml("content", { xmlns: CONTENT_TYPE_NS, type: contentType }),
+		xml(
+			"payload",
+			{ xmlns: JSON_NS, datatype: contentType },
+			xml("json", { xmlns: "urn:xmpp:json:0" }, JSON.stringify(payload)),
+		),
+	);
+
+	// XEP-0184 §5.1/§5.5: request a delivery receipt on 1:1 messages only (never MUC),
+	// so the gateway can confirm the peer received it and resend otherwise.
+	if (!isMuc) {
+		children.push(xml("request", { xmlns: RECEIPTS_NS }));
+	}
+
+	// RFC 6121 section 8.5.2.1: preserve a full JID when replying to the
+	// resource that originated a 1:1 chat. Proactive sends can still use bare JIDs.
+	const to = req.threadId && isMuc ? req.to : isMuc ? bareJid(req.to) : req.to;
+	const type = isMuc ? "groupchat" : "chat";
+
+	return xml(
+		"message",
+		{
+			type,
+			id,
+			to,
+			from: fromJid,
+			...(req.lang ? { "xml:lang": req.lang } : {}),
+		},
+		...children,
+	);
+}
+
+export function applyStoreHints(
+	stanza: Element,
+	policy?: MessagePolicy,
+): Element {
+	if (policy?.store === false) {
+		return xml(
+			"message",
+			stanza.attrs,
+			...stanza.children,
+			xml("no-store", { xmlns: STORE_NS }),
+		);
+	}
+	if (policy?.store === true) {
+		return xml(
+			"message",
+			stanza.attrs,
+			...stanza.children,
+			xml("store", { xmlns: STORE_NS }),
+		);
+	}
+	return stanza;
+}
diff --git a/packages/agent-xmpp/gateway/src/xep-plugins/muc.ts b/packages/agent-xmpp/gateway/src/xep-plugins/muc.ts
new file mode 100644
index 000000000..2f2597273
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/xep-plugins/muc.ts
@@ -0,0 +1,95 @@
+/**
+ * XEP-0045 Multi-User Chat presence and groupchat messages.
+ * Mentions use XEP-0513 wire format. Outbound uses the `jid` address form (the
+ * spec's non-anonymous fallback) — the gateway does not yet track XEP-0421
+ * occupant-ids, which XEP-0513 mandates for rooms that support them. No begin/end
+ * offsets, since the gateway doesn't track where in the body a mention occurs.
+ *
+ * @see https://xmpp.org/extensions/xep-0045.html
+ * @see https://xmpp.org/extensions/xep-0513.html
+ */
+
+import { xml, type Element } from "@xmpp/xml";
+
+import { isMucJid } from "./jid.js";
+import { buildOutboundStanza } from "./message.js";
+
+export { isMucJid };
+
+const MUC_NS = "http://jabber.org/protocol/muc";
+
+export interface XmppJoinRoomInput {
+	roomJid: string;
+	nickname?: string;
+	password?: string;
+}
+export interface XmppLeaveRoomInput {
+	roomJid: string;
+	nickname?: string;
+}
+export interface XmppSendRoomMessageInput {
+	roomJid: string;
+	body: string;
+	threadId?: string;
+	mentions?: string[];
+}
+
+export function buildJoinPresence(
+	input: XmppJoinRoomInput,
+	agentJid: string,
+): Element {
+	const nick = input.nickname || agentJid.split("@")[0];
+	const roomWithNick = `${input.roomJid}/${nick}`;
+	// XEP-0045 §7.2.2: request zero history so joining doesn't flood the agent
+	// with the room's backlog as fresh inbound messages.
+	const mucChildren: Element[] = [xml("history", { maxstanzas: "0" })];
+	if (input.password) {
+		mucChildren.unshift(xml("password", {}, input.password));
+	}
+	return xml(
+		"presence",
+		{ to: roomWithNick, from: agentJid },
+		xml("x", { xmlns: MUC_NS }, ...mucChildren),
+	);
+}
+
+export function buildLeavePresence(
+	input: XmppLeaveRoomInput,
+	agentJid: string,
+	nickname?: string,
+): Element {
+	const nick = nickname || input.nickname || agentJid.split("@")[0];
+	return xml("presence", {
+		to: `${input.roomJid}/${nick}`,
+		from: agentJid,
+		type: "unavailable",
+	});
+}
+
+export function buildRoomMessage(
+	input: XmppSendRoomMessageInput,
+	fromJid: string,
+): Element {
+	const stanza = buildOutboundStanza(
+		{
+			from: fromJid,
+			to: input.roomJid,
+			threadId: input.threadId,
+			content: input.body,
+		},
+		fromJid,
+	);
+	stanza.attrs.type = "groupchat";
+
+	for (const m of input.mentions ?? []) {
+		stanza.append(xml("mention", { xmlns: "urn:xmpp:mentions:0", jid: m }));
+	}
+
+	return stanza;
+}
+
+export function mucRoomFromStanza(from: string): string | null {
+	if (!from.includes("/")) return null;
+	const [room] = from.split("/");
+	return isMucJid(room) ? room : null;
+}
diff --git a/packages/agent-xmpp/gateway/src/xep-plugins/ping.ts b/packages/agent-xmpp/gateway/src/xep-plugins/ping.ts
new file mode 100644
index 000000000..a267cd168
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/xep-plugins/ping.ts
@@ -0,0 +1,24 @@
+/**
+ * XEP-0199 XMPP Ping.
+ * @see https://xmpp.org/extensions/xep-0199.html
+ */
+import { xml, type Element } from "@xmpp/xml";
+
+export const PING_NS = "urn:xmpp:ping";
+
+export function isPingRequest(stanza: Element): boolean {
+	return (
+		stanza.name === "iq" &&
+		stanza.attrs.type === "get" &&
+		stanza.getChild("ping", PING_NS) != null
+	);
+}
+
+export function buildPingResponse(stanza: Element): Element {
+	return xml("iq", {
+		type: "result",
+		id: stanza.attrs.id,
+		from: stanza.attrs.to,
+		to: stanza.attrs.from,
+	});
+}
diff --git a/packages/agent-xmpp/gateway/src/xep-plugins/presence.ts b/packages/agent-xmpp/gateway/src/xep-plugins/presence.ts
new file mode 100644
index 000000000..642ed6b6a
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/xep-plugins/presence.ts
@@ -0,0 +1,113 @@
+/**
+ * Virtual-agent presence for an XEP-0114 component.
+ *
+ * Openfire cannot publish presence for virtual JIDs because they are not C2S
+ * accounts. The component therefore completes roster subscriptions and
+ * answers server probes itself.
+ *
+ * State mapping (RFC 6121):
+ *   subscribe   -> subscribed + available   (§3.1.4 approving an inbound request)
+ *   probe / ''  -> available                (§4.3 responding to a presence probe)
+ *   unsubscribe -> unsubscribed             (§3.3.2 canceling a subscription)
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc6121#section-3
+ */
+import { xml, type Element } from "@xmpp/xml";
+
+import { bareJid } from "./jid.js";
+
+export interface VirtualAgentIdentity {
+	jid: string;
+	name: string;
+}
+
+export interface PresenceSubscriptionChange {
+	subscriberJid: string;
+	subscribed: boolean;
+}
+
+export interface VirtualAgentPresenceResult {
+	responses: Element[];
+	subscriptionChange?: PresenceSubscriptionChange;
+}
+
+export const VIRTUAL_AGENT_RESOURCE = "gateway";
+
+export function virtualAgentPresenceJid(agent: VirtualAgentIdentity): string {
+	return `${bareJid(agent.jid)}/${VIRTUAL_AGENT_RESOURCE}`;
+}
+
+export function buildAvailablePresence(
+	agent: VirtualAgentIdentity,
+	to: string,
+): Element {
+	return xml(
+		"presence",
+		{ from: virtualAgentPresenceJid(agent), to },
+		xml("show", {}, "chat"),
+		xml("status", {}, `${agent.name} is available`),
+	);
+}
+
+export function buildUnavailablePresence(
+	agent: VirtualAgentIdentity,
+	to: string,
+): Element {
+	return xml("presence", {
+		type: "unavailable",
+		from: virtualAgentPresenceJid(agent),
+		to,
+	});
+}
+
+export function buildSubscriptionAccepted(
+	agent: VirtualAgentIdentity,
+	to: string,
+): Element {
+	return xml("presence", { type: "subscribed", from: bareJid(agent.jid), to });
+}
+
+export function buildSubscriptionRemoved(
+	agent: VirtualAgentIdentity,
+	to: string,
+): Element {
+	return xml("presence", {
+		type: "unsubscribed",
+		from: bareJid(agent.jid),
+		to,
+	});
+}
+
+export function handleVirtualAgentPresence(
+	stanza: Element,
+	agent: VirtualAgentIdentity,
+): VirtualAgentPresenceResult {
+	if (stanza.name !== "presence") return { responses: [] };
+	const to = String(stanza.attrs.from ?? "");
+	if (!to) return { responses: [] };
+	const type = String(stanza.attrs.type ?? "");
+	const subscriberJid = bareJid(to);
+	if (type === "subscribe") {
+		return {
+			responses: [
+				buildSubscriptionAccepted(agent, to),
+				buildAvailablePresence(agent, to),
+			],
+			subscriptionChange: { subscriberJid, subscribed: true },
+		};
+	}
+	if (type === "probe") {
+		return {
+			responses: [buildAvailablePresence(agent, to)],
+			subscriptionChange: { subscriberJid, subscribed: true },
+		};
+	}
+	if (type === "") return { responses: [buildAvailablePresence(agent, to)] };
+	if (type === "unsubscribe") {
+		return {
+			responses: [buildSubscriptionRemoved(agent, to)],
+			subscriptionChange: { subscriberJid, subscribed: false },
+		};
+	}
+	return { responses: [] };
+}
diff --git a/packages/agent-xmpp/gateway/src/xep-plugins/receipts.ts b/packages/agent-xmpp/gateway/src/xep-plugins/receipts.ts
new file mode 100644
index 000000000..b2f9074ca
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/xep-plugins/receipts.ts
@@ -0,0 +1,53 @@
+/**
+ * XEP-0184 Message Delivery Receipts.
+ * Bodyless XEP-0085 chat states are filtered by the same routing guard.
+ *
+ * @see https://xmpp.org/extensions/xep-0184.html
+ * @see https://xmpp.org/extensions/xep-0085.html
+ */
+
+import { xml, type Element } from "@xmpp/xml";
+
+import { isChatStateStanza } from "./chatstate.js";
+
+export const RECEIPTS_NS = "urn:xmpp:receipts";
+
+/** The id a peer's <received/> acknowledges, or null if the stanza isn't a receipt. */
+export function receivedReceiptId(stanza: Element): string | null {
+	if (stanza.name !== "message") return null;
+	return (
+		(stanza.getChild("received", RECEIPTS_NS)?.attrs.id as
+			| string
+			| undefined) ?? null
+	);
+}
+
+/** True for XEP-0085 chat states and XEP-0184 receipt stanzas with no conversational body. */
+export function isAckOrReceiptStanza(stanza: Element): boolean {
+	if (isChatStateStanza(stanza)) return true;
+	if (stanza.name !== "message") return false;
+	const body = stanza.getChildText("body");
+	if (body?.trim()) return false;
+	if (stanza.getChild("received", RECEIPTS_NS)) return true;
+	if (stanza.getChild("request", RECEIPTS_NS)) return true;
+	return false;
+}
+
+/** XEP-0184: only ack when the sender opted in with <request/>. */
+export function requestsReceipt(stanza: Element): boolean {
+	return (
+		stanza.name === "message" && stanza.getChild("request", RECEIPTS_NS) != null
+	);
+}
+
+export function buildReceivedReceipt(
+	to: string,
+	from: string,
+	messageId: string,
+): Element {
+	return xml(
+		"message",
+		{ to, from, id: `receipt-${messageId}` },
+		xml("received", { xmlns: RECEIPTS_NS, id: messageId }),
+	);
+}
diff --git a/packages/agent-xmpp/gateway/src/xep-plugins/routing.ts b/packages/agent-xmpp/gateway/src/xep-plugins/routing.ts
new file mode 100644
index 000000000..a351873cd
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/xep-plugins/routing.ts
@@ -0,0 +1,33 @@
+/**
+ * Plain-text @nick matching is the compatibility fallback for clients that do
+ * not send XEP-0513 Explicit Mentions.
+ * @see https://xmpp.org/extensions/xep-0513.html
+ */
+export function shouldDeliverInbound(
+	stanzaType: string,
+	isGroup: boolean,
+	isMention: boolean,
+): boolean {
+	if (!isGroup) return true;
+	return isMention;
+}
+
+function escapeRegExp(s: string): string {
+	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function detectMention(body: string, agentNick?: string): boolean {
+	if (!agentNick) return false;
+	// Escape metachars: a JID localpart can contain '.', '(', etc. Unescaped, they
+	// either false-match or make new RegExp throw and drop the stanza.
+	return new RegExp(`@${escapeRegExp(agentNick)}\\b`, "i").test(body);
+}
+
+export function isMentionForAgent(
+	stanzaType: string,
+	body: string,
+	agentNick: string,
+): boolean {
+	if (stanzaType === "chat") return true;
+	return detectMention(body, agentNick);
+}
diff --git a/packages/agent-xmpp/gateway/src/xep-plugins/search.ts b/packages/agent-xmpp/gateway/src/xep-plugins/search.ts
new file mode 100644
index 000000000..ca302d0ea
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/xep-plugins/search.ts
@@ -0,0 +1,174 @@
+/**
+ * Agent-directory search via XEP-0055, with legacy fields for widely deployed
+ * clients and the recommended XEP-0004 form extension.
+ *
+ * @see https://xmpp.org/extensions/xep-0055.html
+ */
+import type { RegisteredAgent } from "@agent-xmpp/protocol";
+import { xml, type Element } from "@xmpp/xml";
+
+import { DATA_FORMS_NS, SEARCH_NS } from "../agent-api-disco.js";
+import { buildRsm, pageRsm, parseRsm } from "../rsm-codec.js";
+
+const INSTRUCTIONS =
+	"Enter a nickname to search for matching agents. Leave it empty to list up to 100 agents.";
+const MAX_SEARCH_RESULTS = 100;
+
+function resultIq(
+	request: Element,
+	componentJid: string,
+	query: Element,
+): Element {
+	return xml(
+		"iq",
+		{
+			type: "result",
+			id: request.attrs.id,
+			from: componentJid,
+			to: request.attrs.from,
+			...(request.attrs["xml:lang"]
+				? { "xml:lang": request.attrs["xml:lang"] }
+				: {}),
+		},
+		query,
+	);
+}
+
+function dataFormFieldValue(form: Element, name: string): string {
+	return (
+		form
+			.getChildren("field")
+			.find((field) => field.attrs.var === name)
+			?.getChildText("value")
+			?.trim() ?? ""
+	);
+}
+
+function nickname(agent: RegisteredAgent): string {
+	return agent.manifest.agent.title ?? agent.manifest.agent.name;
+}
+
+export function buildSearchFields(
+	request: Element,
+	componentJid: string,
+): Element {
+	return resultIq(
+		request,
+		componentJid,
+		xml(
+			"query",
+			{ xmlns: SEARCH_NS },
+			xml("instructions", {}, INSTRUCTIONS),
+			xml("nick"),
+			xml(
+				"x",
+				{ xmlns: DATA_FORMS_NS, type: "form" },
+				xml("title", {}, "Agent Directory Search"),
+				xml("instructions", {}, INSTRUCTIONS),
+				xml(
+					"field",
+					{ type: "hidden", var: "FORM_TYPE" },
+					xml("value", {}, SEARCH_NS),
+				),
+				xml("field", { type: "text-single", label: "Nickname", var: "nick" }),
+			),
+		),
+	);
+}
+
+export function buildSearchResults(
+	request: Element,
+	componentJid: string,
+	agents: RegisteredAgent[],
+): Element {
+	const query = request.getChild("query", SEARCH_NS);
+	const dataForm = query?.getChild("x", DATA_FORMS_NS);
+	if (dataForm && dataForm.attrs.type !== "submit") {
+		return resultIq(request, componentJid, xml("query", { xmlns: SEARCH_NS }));
+	}
+	const submittedForm = dataForm;
+	const needle = (
+		submittedForm
+			? dataFormFieldValue(submittedForm, "nick")
+			: (query?.getChildText("nick") ?? "")
+	)
+		.trim()
+		.toLowerCase();
+	const matches = agents.filter((agent) => {
+		if (!needle) return true;
+		const identity = agent.manifest.agent;
+		const localpart = identity.jid.split("@", 1)[0] ?? "";
+		return [localpart, identity.name, identity.title ?? ""].some((value) =>
+			value.toLowerCase().includes(needle),
+		);
+	});
+	const page = pageRsm(
+		matches,
+		(agent) => agent.manifest.agent.jid,
+		parseRsm(query!, MAX_SEARCH_RESULTS),
+	);
+
+	if (submittedForm) {
+		return resultIq(
+			request,
+			componentJid,
+			xml(
+				"query",
+				{ xmlns: SEARCH_NS },
+				xml(
+					"x",
+					{ xmlns: DATA_FORMS_NS, type: "result" },
+					xml(
+						"field",
+						{ type: "hidden", var: "FORM_TYPE" },
+						xml("value", {}, SEARCH_NS),
+					),
+					xml(
+						"reported",
+						{},
+						xml("field", {
+							var: "jid",
+							label: "Jabber ID",
+							type: "jid-single",
+						}),
+						xml("field", {
+							var: "nick",
+							label: "Nickname",
+							type: "text-single",
+						}),
+					),
+					...page.items.map((agent) =>
+						xml(
+							"item",
+							{},
+							xml(
+								"field",
+								{ var: "jid" },
+								xml("value", {}, agent.manifest.agent.jid),
+							),
+							xml("field", { var: "nick" }, xml("value", {}, nickname(agent))),
+						),
+					),
+				),
+				buildRsm(page),
+			),
+		);
+	}
+
+	return resultIq(
+		request,
+		componentJid,
+		xml(
+			"query",
+			{ xmlns: SEARCH_NS },
+			...page.items.map((agent) =>
+				xml(
+					"item",
+					{ jid: agent.manifest.agent.jid },
+					xml("nick", {}, nickname(agent)),
+				),
+			),
+			buildRsm(page),
+		),
+	);
+}
diff --git a/packages/agent-xmpp/gateway/src/xep-plugins/vcard.ts b/packages/agent-xmpp/gateway/src/xep-plugins/vcard.ts
new file mode 100644
index 000000000..3607f5fd1
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/xep-plugins/vcard.ts
@@ -0,0 +1,32 @@
+/** vCard-temp identity for virtual agents. @see https://xmpp.org/extensions/xep-0054.html */
+import type { RegisteredAgent } from "@agent-xmpp/protocol";
+import { xml, type Element } from "@xmpp/xml";
+
+export const VCARD_TEMP_NS = "vcard-temp";
+
+export function buildAgentVcard(
+	request: Element,
+	agent: RegisteredAgent,
+): Element {
+	const identity = agent.manifest.agent;
+	const children = [
+		xml("FN", {}, identity.title ?? identity.name),
+		xml("NICKNAME", {}, identity.name),
+		xml("JABBERID", {}, identity.jid),
+		...(identity.description ? [xml("DESC", {}, identity.description)] : []),
+		...(identity.homepage ? [xml("URL", {}, identity.homepage)] : []),
+		...(identity.avatarUrl
+			? [xml("PHOTO", {}, xml("EXTVAL", {}, identity.avatarUrl))]
+			: []),
+	];
+	return xml(
+		"iq",
+		{
+			type: "result",
+			id: request.attrs.id,
+			from: identity.jid,
+			to: request.attrs.from,
+		},
+		xml("vCard", { xmlns: VCARD_TEMP_NS }, ...children),
+	);
+}
diff --git a/packages/agent-xmpp/gateway/src/xmpp-component.ts b/packages/agent-xmpp/gateway/src/xmpp-component.ts
new file mode 100644
index 000000000..c0d19b07c
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/xmpp-component.ts
@@ -0,0 +1,551 @@
+/**
+ * External-component session using XEP-0114 Jabber Component Protocol.
+ * @see https://xmpp.org/extensions/xep-0114.html
+ */
+import { component } from "@xmpp/component";
+import { xml, type Element } from "@xmpp/xml";
+import { ulid } from "ulid";
+import { bareJid } from "@agent-xmpp/protocol";
+
+import type { GatewayConfig } from "./config.js";
+
+export interface XmppComponentSession {
+	send: (stanza: Element) => Promise<void>;
+	requestIq: (stanza: Element, options?: IqRequestOptions) => Promise<Element>;
+	start: () => Promise<void>;
+	stop: () => Promise<void>;
+	forceReconnect: (reason: string) => Promise<void>;
+	getState: () => XmppConnectionState;
+	getLastActivityAt: () => number;
+	onStateChange: (handler: (state: XmppConnectionState) => void) => void;
+	onStanza: (handler: (stanza: Element) => void) => void;
+}
+
+export type XmppConnectionState =
+	| "offline"
+	| "connecting"
+	| "online"
+	| "stopping";
+
+export interface IqRequestOptions {
+	timeoutMs?: number;
+	signal?: AbortSignal;
+}
+
+export class IqResponseError extends Error {
+	constructor(public readonly response: Element) {
+		const id = String(response.attrs.id ?? "unknown");
+		const stanzaError = response.getChild("error");
+		const condition = stanzaError?.children.find(
+			(child): child is Element =>
+				typeof child !== "string" && child.name !== "text",
+		);
+		super(`IQ request ${id} failed${condition ? `: ${condition.name}` : ""}`);
+		this.name = "IqResponseError";
+	}
+}
+
+export type IqGetHandler = (
+	stanza: Element,
+) => Element | null | Promise<Element | null>;
+
+const STANZA_ERROR_NS = "urn:ietf:params:xml:ns:xmpp-stanzas";
+const DEFAULT_IQ_TIMEOUT_MS = 30_000;
+const DEFAULT_MAX_PENDING_IQ_REQUESTS = 256;
+
+interface PendingIqRequest {
+	resolve: (stanza: Element) => void;
+	reject: (error: Error) => void;
+	timer: ReturnType<typeof setTimeout>;
+	signal?: AbortSignal;
+	onAbort?: () => void;
+	expectedFrom: string;
+	expectedTo: string;
+}
+
+function abortError(id: string): Error {
+	const error = new Error(`IQ request ${id} aborted`);
+	error.name = "AbortError";
+	return error;
+}
+
+/**
+ * RFC 6120 §8.3 stanza error for an IQ get/set the gateway does not handle.
+ * `service-unavailable` (type cancel) is the standard "no such handler" reply;
+ * the original request payload is echoed back per the SHOULD in §8.3.1.
+ */
+export function buildIqError(request: Element): Element {
+	return xml(
+		"iq",
+		{
+			type: "error",
+			id: request.attrs.id,
+			from: request.attrs.to,
+			to: request.attrs.from,
+		},
+		...request.children.filter((c): c is Element => typeof c !== "string"),
+		xml(
+			"error",
+			{ type: "cancel" },
+			xml("service-unavailable", { xmlns: STANZA_ERROR_NS }),
+		),
+	);
+}
+
+function iqMiddlewareReply(response: Element): Element | true {
+	if (response.attrs.type === "error") {
+		return (
+			response.getChild("error") ??
+			xml(
+				"error",
+				{ type: "cancel" },
+				xml("service-unavailable", { xmlns: STANZA_ERROR_NS }),
+			)
+		);
+	}
+	return response.getChildElements()[0] ?? true;
+}
+
+export type IqDisposition =
+	| { kind: "respond"; stanza: Element }
+	| { kind: "error" }
+	| { kind: "dispatch" };
+
+/**
+ * Decide how an inbound stanza is handled by the component:
+ *  - IQ get/set the gateway answers    -> `respond` with the built reply
+ *  - IQ get/set nothing handled        -> `error` (RFC 6120 §8.2.3 requires a reply)
+ *  - everything else, incl. IQ result/error responses to our own outbound requests
+ *    and all message/presence stanzas  -> `dispatch` to the registered stanza handlers
+ */
+export async function dispositionForStanza(
+	stanza: Element,
+	onIqGet?: IqGetHandler,
+): Promise<IqDisposition> {
+	if (stanza.name === "iq") {
+		const type = String(stanza.attrs.type ?? "");
+		if (type === "get" || type === "set") {
+			const response = (await onIqGet?.(stanza)) ?? null;
+			return response
+				? { kind: "respond", stanza: response }
+				: { kind: "error" };
+		}
+	}
+	return { kind: "dispatch" };
+}
+
+export function reconnectDelayMs(
+	attempt: number,
+	initialMs: number,
+	maxMs: number,
+	random = Math.random,
+): number {
+	const exponential = Math.min(
+		maxMs,
+		initialMs * 2 ** Math.min(Math.max(attempt - 1, 0), 30),
+	);
+	return Math.max(1, Math.round(exponential * (0.8 + random() * 0.4)));
+}
+
+export function createComponentSession(
+	config: GatewayConfig,
+	onIqGet?: IqGetHandler,
+): XmppComponentSession {
+	const maxPendingIqRequests =
+		config.maxPendingIqRequests ?? DEFAULT_MAX_PENDING_IQ_REQUESTS;
+	if (
+		!Number.isSafeInteger(maxPendingIqRequests) ||
+		maxPendingIqRequests <= 0
+	) {
+		throw new Error("maxPendingIqRequests must be a positive integer");
+	}
+	const stanzaHandlers: Array<(stanza: Element) => void> = [];
+	const stateHandlers: Array<(state: XmppConnectionState) => void> = [];
+	const pendingIqRequests = new Map<string, PendingIqRequest>();
+	let activeInboundIq = 0;
+	let activeClient: ReturnType<typeof component> | null = null;
+	let state: XmppConnectionState = "offline";
+	let stopped = true;
+	let reconnectAttempt = 0;
+	let reconnectTimer: ReturnType<typeof setTimeout> | null = null;
+	let lastActivityAt = Date.now();
+	let onlineAttempt: {
+		client: ReturnType<typeof component>;
+		resolve: () => void;
+		reject: (error: Error) => void;
+	} | null = null;
+
+	const transition = (next: XmppConnectionState): void => {
+		if (state === next) return;
+		state = next;
+		for (const handler of stateHandlers) handler(next);
+	};
+
+	const settleIqRequest = (
+		id: string,
+		responseOrError: Element | Error,
+	): boolean => {
+		const pending = pendingIqRequests.get(id);
+		if (!pending) return false;
+		if (!(responseOrError instanceof Error)) {
+			const responseFrom = bareJid(String(responseOrError.attrs.from ?? ""));
+			const responseTo = bareJid(String(responseOrError.attrs.to ?? ""));
+			if (
+				(pending.expectedFrom && responseFrom !== pending.expectedFrom) ||
+				(pending.expectedTo && responseTo !== pending.expectedTo)
+			) {
+				return false;
+			}
+		}
+
+		pendingIqRequests.delete(id);
+		clearTimeout(pending.timer);
+		if (pending.signal && pending.onAbort)
+			pending.signal.removeEventListener("abort", pending.onAbort);
+
+		if (responseOrError instanceof Error) pending.reject(responseOrError);
+		else if (responseOrError.attrs.type === "error")
+			pending.reject(new IqResponseError(responseOrError));
+		else pending.resolve(responseOrError);
+		return true;
+	};
+
+	const rejectPendingIqRequests = (reason: string): void => {
+		for (const id of [...pendingIqRequests.keys()]) {
+			settleIqRequest(id, new Error(`IQ request ${id} failed: ${reason}`));
+		}
+	};
+
+	const rejectOnlineAttempt = (
+		client: ReturnType<typeof component>,
+		reason: Error,
+	): void => {
+		if (onlineAttempt?.client !== client) return;
+		const attempt = onlineAttempt;
+		onlineAttempt = null;
+		attempt.reject(reason);
+	};
+
+	const clearReconnectTimer = (): void => {
+		if (!reconnectTimer) return;
+		clearTimeout(reconnectTimer);
+		reconnectTimer = null;
+	};
+
+	const scheduleReconnect = (): void => {
+		if (stopped || reconnectTimer) return;
+		reconnectAttempt += 1;
+		const delay = reconnectDelayMs(
+			reconnectAttempt,
+			config.reconnectInitialMs,
+			config.reconnectMaxMs,
+		);
+		console.error(
+			`[xmpp-gateway] reconnect attempt ${reconnectAttempt} scheduled in ${delay}ms`,
+		);
+		reconnectTimer = setTimeout(() => {
+			reconnectTimer = null;
+			void connectClient();
+		}, delay);
+		reconnectTimer.unref?.();
+	};
+
+	const handleConnectionLoss = (
+		client: ReturnType<typeof component>,
+		reason: string,
+	): void => {
+		if (activeClient !== client || stopped || state === "stopping") return;
+		activeClient = null;
+		transition("offline");
+		rejectOnlineAttempt(client, new Error(reason));
+		rejectPendingIqRequests(reason);
+		scheduleReconnect();
+	};
+
+	const createClient = (): ReturnType<typeof component> => {
+		const client = component({
+			service: config.componentService,
+			domain: config.componentJid,
+			password: config.componentSecret,
+		});
+		// The package helper makes only one fixed-delay attempt. The gateway owns a
+		// capped, jittered supervisor and creates a clean client for every attempt.
+		client.reconnect.stop();
+
+		// @xmpp/component installs its IQ callee as middleware. Handling IQs only
+		// from the raw `stanza` event races that callee: it immediately emits
+		// service-unavailable while our listener later emits the valid result.
+		// Participate in the middleware chain so every request gets exactly one
+		// response.
+		const middlewareClient = client as typeof client & {
+			middleware: {
+				use(
+					handler: (
+						context: { stanza: Element },
+						next: () => Promise<unknown>,
+					) => Promise<unknown>,
+				): unknown;
+			};
+		};
+		middlewareClient.middleware.use(async (context, next) => {
+			const stanza = context.stanza as Element;
+			const type = String(stanza.attrs.type ?? "");
+			if (stanza.name !== "iq" || (type !== "get" && type !== "set"))
+				return next();
+			if (activeInboundIq >= maxPendingIqRequests) {
+				return xml(
+					"error",
+					{ type: "wait" },
+					xml("resource-constraint", { xmlns: STANZA_ERROR_NS }),
+				);
+			}
+			activeInboundIq++;
+			try {
+				const disposition = await dispositionForStanza(stanza, onIqGet);
+				const response =
+					disposition.kind === "respond"
+						? disposition.stanza
+						: buildIqError(stanza);
+				return iqMiddlewareReply(response);
+			} catch (err) {
+				console.error("[xmpp-gateway] inbound IQ handling failed:", err);
+				return iqMiddlewareReply(buildIqError(stanza));
+			} finally {
+				activeInboundIq--;
+			}
+		});
+
+		client.on("stanza", (stanza: Element) => {
+			if (activeClient !== client) return;
+			lastActivityAt = Date.now();
+			const type = String(stanza.attrs.type ?? "");
+			const id = String(stanza.attrs.id ?? "");
+			// Correlate outbound requests before any inbound protocol routing.
+			if (
+				stanza.name === "iq" &&
+				id &&
+				(type === "result" || type === "error") &&
+				settleIqRequest(id, stanza)
+			) {
+				return;
+			}
+
+			if (stanza.name === "iq" && (type === "get" || type === "set")) {
+				// The @xmpp/component IQ middleware above owns the response.
+				return;
+			}
+			for (const handler of stanzaHandlers) handler(stanza);
+		});
+
+		client.on("error", (err: Error) => {
+			if (activeClient === client) {
+				console.error("[xmpp-gateway] component error:", err.message);
+				rejectOnlineAttempt(client, err);
+			}
+		});
+		client.on("online", () => {
+			if (activeClient !== client || stopped) return;
+			reconnectAttempt = 0;
+			clearReconnectTimer();
+			lastActivityAt = Date.now();
+			transition("online");
+			if (onlineAttempt?.client === client) {
+				const attempt = onlineAttempt;
+				onlineAttempt = null;
+				attempt.resolve();
+			}
+		});
+		client.on("disconnect", () =>
+			handleConnectionLoss(client, "component disconnected"),
+		);
+		client.on("offline", () =>
+			handleConnectionLoss(client, "component went offline"),
+		);
+		return client;
+	};
+
+	async function connectClient(): Promise<void> {
+		if (stopped || state === "connecting" || state === "online") return;
+		transition("connecting");
+		const client = createClient();
+		activeClient = client;
+		try {
+			// Avoid Component.start(): @xmpp/connection creates an internal
+			// `online` promise before `open()`, and both promises reject on a
+			// connection error. Only one is awaited upstream, producing an
+			// unhandled rejection during ordinary reconnect failures.
+			await client.connect(config.componentService);
+			const onlinePromise = new Promise<void>((resolve, reject) => {
+				onlineAttempt = { client, resolve, reject };
+			});
+			// A disconnect can reject this while client.open() is still pending.
+			// Handle that timing window immediately; awaiting the original promise
+			// below still propagates the rejection.
+			void onlinePromise.catch(() => undefined);
+			try {
+				await client.open({ domain: config.componentJid });
+				await onlinePromise;
+			} catch (error: unknown) {
+				rejectOnlineAttempt(
+					client,
+					error instanceof Error ? error : new Error(String(error)),
+				);
+				await onlinePromise.catch(() => undefined);
+				throw error;
+			}
+			if (activeClient === client && !stopped) {
+				reconnectAttempt = 0;
+				lastActivityAt = Date.now();
+				transition("online");
+				console.error(
+					`[xmpp-gateway] component online: ${config.componentJid}`,
+				);
+			}
+		} catch (error: unknown) {
+			if (activeClient === client) activeClient = null;
+			client.reconnect.stop();
+			transition("offline");
+			const message = error instanceof Error ? error.message : String(error);
+			console.error(`[xmpp-gateway] component connection failed: ${message}`);
+			scheduleReconnect();
+			await client.stop().catch(() => undefined);
+		}
+	}
+
+	const send = async (stanza: Element): Promise<void> => {
+		const client = activeClient;
+		if (state !== "online" || !client)
+			throw new Error("XMPP component is offline");
+		await client.send(stanza);
+		lastActivityAt = Date.now();
+	};
+
+	const requestIq = (
+		stanza: Element,
+		options: IqRequestOptions = {},
+	): Promise<Element> => {
+		if (state !== "online")
+			return Promise.reject(
+				new Error("Cannot send IQ request while component is offline"),
+			);
+
+		const type = String(stanza.attrs.type ?? "");
+		if (stanza.name !== "iq" || (type !== "get" && type !== "set")) {
+			return Promise.reject(
+				new Error(
+					'Outbound IQ request must be an <iq type="get"> or <iq type="set"> stanza',
+				),
+			);
+		}
+
+		const timeoutMs = options.timeoutMs ?? DEFAULT_IQ_TIMEOUT_MS;
+		if (
+			!Number.isFinite(timeoutMs) ||
+			!Number.isInteger(timeoutMs) ||
+			timeoutMs <= 0
+		) {
+			return Promise.reject(
+				new Error("IQ request timeoutMs must be a positive integer"),
+			);
+		}
+		if (pendingIqRequests.size >= maxPendingIqRequests) {
+			return Promise.reject(
+				new Error(
+					`Too many pending IQ requests (limit ${maxPendingIqRequests})`,
+				),
+			);
+		}
+
+		const id = String(stanza.attrs.id ?? "") || ulid();
+		if (pendingIqRequests.has(id)) {
+			return Promise.reject(
+				new Error(`IQ request id is already pending: ${id}`),
+			);
+		}
+		stanza.attrs.id = id;
+
+		if (options.signal?.aborted) return Promise.reject(abortError(id));
+
+		return new Promise<Element>((resolve, reject) => {
+			const timer = setTimeout(() => {
+				settleIqRequest(
+					id,
+					new Error(`IQ request ${id} timed out after ${timeoutMs}ms`),
+				);
+			}, timeoutMs);
+			timer.unref?.();
+
+			const pending: PendingIqRequest = {
+				resolve,
+				reject,
+				timer,
+				signal: options.signal,
+				expectedFrom: bareJid(String(stanza.attrs.to ?? "")),
+				expectedTo: bareJid(String(stanza.attrs.from ?? "")),
+			};
+			if (options.signal) {
+				pending.onAbort = () => settleIqRequest(id, abortError(id));
+				options.signal.addEventListener("abort", pending.onAbort, {
+					once: true,
+				});
+			}
+			pendingIqRequests.set(id, pending);
+
+			try {
+				send(stanza).catch((error: unknown) => {
+					const sendError =
+						error instanceof Error ? error : new Error(String(error));
+					settleIqRequest(id, sendError);
+				});
+			} catch (error: unknown) {
+				const sendError =
+					error instanceof Error ? error : new Error(String(error));
+				settleIqRequest(id, sendError);
+			}
+		});
+	};
+
+	return {
+		send,
+		requestIq,
+		start: async () => {
+			if (!stopped) return;
+			stopped = false;
+			reconnectAttempt = 0;
+			clearReconnectTimer();
+			await connectClient();
+		},
+		stop: async () => {
+			if (stopped && state === "offline") return;
+			stopped = true;
+			clearReconnectTimer();
+			transition("stopping");
+			rejectPendingIqRequests("component stopped");
+			const client = activeClient;
+			activeClient = null;
+			if (client) rejectOnlineAttempt(client, new Error("component stopped"));
+			client?.reconnect.stop();
+			if (client) await client.stop().catch(() => undefined);
+			transition("offline");
+		},
+		forceReconnect: async (reason) => {
+			if (stopped || state === "stopping") return;
+			const client = activeClient;
+			activeClient = null;
+			transition("offline");
+			if (client) rejectOnlineAttempt(client, new Error(reason));
+			rejectPendingIqRequests(reason);
+			client?.reconnect.stop();
+			if (client) await client.stop().catch(() => undefined);
+			scheduleReconnect();
+		},
+		getState: () => state,
+		getLastActivityAt: () => lastActivityAt,
+		onStateChange: (handler) => stateHandlers.push(handler),
+		onStanza: (handler) => {
+			stanzaHandlers.push(handler);
+		},
+	};
+}
+
+export { xml };
diff --git a/packages/agent-xmpp/gateway/src/xmpp-keepalive.ts b/packages/agent-xmpp/gateway/src/xmpp-keepalive.ts
new file mode 100644
index 000000000..c25de3e99
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/xmpp-keepalive.ts
@@ -0,0 +1,66 @@
+import type { XmppConnectionState } from "./xmpp-component.js";
+
+export interface XmppKeepaliveOptions {
+	intervalMs: number;
+	failureThreshold: number;
+}
+
+export interface XmppKeepaliveCallbacks {
+	getState: () => XmppConnectionState;
+	getLastActivityAt: () => number;
+	ping: () => Promise<void>;
+	forceReconnect: (reason: string) => Promise<void>;
+	now?: () => number;
+}
+
+/** Idle XEP-0199 probe loop. Connection recovery remains owned by the session supervisor. */
+export class XmppKeepalive {
+	private timer: ReturnType<typeof setInterval> | null = null;
+	private inFlight = false;
+	private consecutiveFailures = 0;
+
+	constructor(
+		private readonly options: XmppKeepaliveOptions,
+		private readonly callbacks: XmppKeepaliveCallbacks,
+	) {}
+
+	start(): void {
+		if (this.timer) return;
+		this.timer = setInterval(() => void this.check(), this.options.intervalMs);
+		this.timer.unref?.();
+	}
+
+	stop(): void {
+		if (this.timer) clearInterval(this.timer);
+		this.timer = null;
+		this.inFlight = false;
+		this.consecutiveFailures = 0;
+	}
+
+	private async check(): Promise<void> {
+		if (this.inFlight || this.callbacks.getState() !== "online") return;
+		const now = this.callbacks.now?.() ?? Date.now();
+		if (now - this.callbacks.getLastActivityAt() < this.options.intervalMs)
+			return;
+
+		this.inFlight = true;
+		try {
+			await this.callbacks.ping();
+			this.consecutiveFailures = 0;
+		} catch (error: unknown) {
+			this.consecutiveFailures += 1;
+			const message = error instanceof Error ? error.message : String(error);
+			console.error(
+				`[xmpp-gateway] keepalive failed (${this.consecutiveFailures}/${this.options.failureThreshold}): ${message}`,
+			);
+			if (this.consecutiveFailures >= this.options.failureThreshold) {
+				this.consecutiveFailures = 0;
+				await this.callbacks.forceReconnect(
+					"XEP-0199 keepalive failure threshold reached",
+				);
+			}
+		} finally {
+			this.inFlight = false;
+		}
+	}
+}
diff --git a/packages/agent-xmpp/gateway/src/xmpp-shims.d.ts b/packages/agent-xmpp/gateway/src/xmpp-shims.d.ts
new file mode 100644
index 000000000..47ce2de66
--- /dev/null
+++ b/packages/agent-xmpp/gateway/src/xmpp-shims.d.ts
@@ -0,0 +1,60 @@
+declare module "@xmpp/xml" {
+	export class Element {
+		name: string;
+		attrs: Record<string, unknown>;
+		children: Array<Element | string>;
+
+		getChild(name: string, xmlns?: string): Element | undefined;
+		getChildElements(): Element[];
+		getChildren(name: string, xmlns?: string): Element[];
+		getChildText(name: string, xmlns?: string): string | null;
+		getNS(): string;
+		getText(): string;
+		append(child: Element | string): this;
+		toString(): string;
+	}
+
+	export class Parser {
+		on(
+			event: "start" | "element" | "end",
+			handler: (element: Element) => void,
+		): this;
+		on(event: "error", handler: (error: Error) => void): this;
+		write(data: string): void;
+		end(data?: string): void;
+	}
+
+	export function xml(
+		name: string,
+		attrs?: Record<string, unknown>,
+		...children: Array<Element | string | undefined | null>
+	): Element;
+
+	export default xml;
+}
+
+declare module "@xmpp/component" {
+	import type { Element } from "@xmpp/xml";
+
+	interface ComponentClient {
+		on(event: "stanza", handler: (stanza: Element) => void): this;
+		on(event: "error", handler: (error: Error) => void): this;
+		on(event: "offline", handler: () => void): this;
+		on(event: "online", handler: () => void): this;
+		on(event: "disconnect", handler: () => void): this;
+		reconnect: {
+			stop(): void;
+		};
+		connect(service: string): Promise<void>;
+		open(options: { domain: string }): Promise<void>;
+		send(stanza: Element): Promise<void>;
+		start(): Promise<void>;
+		stop(): Promise<void>;
+	}
+
+	export function component(options: {
+		service: string;
+		domain: string;
+		password: string;
+	}): ComponentClient;
+}
diff --git a/packages/agent-xmpp/gateway/tsconfig.json b/packages/agent-xmpp/gateway/tsconfig.json
new file mode 100644
index 000000000..5d0f16ada
--- /dev/null
+++ b/packages/agent-xmpp/gateway/tsconfig.json
@@ -0,0 +1,19 @@
+{
+	"compilerOptions": {
+		"target": "ES2022",
+		"module": "NodeNext",
+		"moduleResolution": "NodeNext",
+		"lib": ["ES2022"],
+		"outDir": "./dist",
+		"rootDir": "./src",
+		"strict": true,
+		"esModuleInterop": true,
+		"skipLibCheck": true,
+		"declaration": true,
+		"declarationMap": true,
+		"sourceMap": true,
+		"types": ["node"]
+	},
+	"include": ["src/**/*"],
+	"exclude": ["node_modules", "dist", "src/**/*.test.ts"]
+}
diff --git a/packages/agent-xmpp/protocol/package.json b/packages/agent-xmpp/protocol/package.json
new file mode 100644
index 000000000..71099d4bb
--- /dev/null
+++ b/packages/agent-xmpp/protocol/package.json
@@ -0,0 +1,29 @@
+{
+	"name": "@agent-xmpp/protocol",
+	"version": "0.1.0",
+	"description": "Shared XMPP agent gateway protocol types",
+	"type": "module",
+	"main": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"import": "./dist/index.js"
+		},
+		"./schema/event.schema.json": "./schema/event.schema.json",
+		"./schema/manifest.schema.json": "./schema/manifest.schema.json"
+	},
+	"scripts": {
+		"build": "rm -rf dist && node ../../../node_modules/typescript/bin/tsc",
+		"test": "bun test src",
+		"typecheck": "tsc --noEmit"
+	},
+	"devDependencies": {
+		"@types/node": "^26.5.0",
+		"typescript": "^7.0.2"
+	},
+	"dependencies": {
+		"idn-hostname": "17.0.3",
+		"precis-wasm": "0.1.0"
+	}
+}
diff --git a/packages/agent-xmpp/protocol/schema/agent-api.xsd b/packages/agent-xmpp/protocol/schema/agent-api.xsd
new file mode 100644
index 000000000..794ff611d
--- /dev/null
+++ b/packages/agent-xmpp/protocol/schema/agent-api.xsd
@@ -0,0 +1,166 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<xs:schema xmlns='urn:xmpp:agent-api:0'
+           xmlns:xs='http://www.w3.org/2001/XMLSchema'
+           elementFormDefault='qualified'
+           targetNamespace='urn:xmpp:agent-api:0'>
+
+  <xs:simpleType name='version'>
+    <xs:restriction base='xs:string'>
+      <xs:pattern value='[A-Za-z0-9._~-]{1,64}'/>
+    </xs:restriction>
+  </xs:simpleType>
+
+  <xs:simpleType name='toolName'>
+    <xs:restriction base='xs:string'>
+      <xs:minLength value='1'/>
+    </xs:restriction>
+  </xs:simpleType>
+
+  <xs:simpleType name='direction'>
+    <xs:restriction base='xs:string'>
+      <xs:enumeration value='input'/>
+      <xs:enumeration value='output'/>
+    </xs:restriction>
+  </xs:simpleType>
+
+  <xs:complexType name='hashContainer'>
+    <xs:sequence>
+      <xs:any maxOccurs='1'
+              minOccurs='1' namespace='urn:xmpp:hashes:2' processContents='lax'/>
+    </xs:sequence>
+  </xs:complexType>
+
+  <xs:element name='register'>
+    <xs:complexType>
+      <xs:sequence>
+        <xs:element name='manifest'>
+          <xs:complexType>
+            <xs:simpleContent>
+              <xs:extension base='xs:string'>
+                <xs:attribute fixed='application/json' name='media-type'
+                              type='xs:string' use='required'/>
+              </xs:extension>
+            </xs:simpleContent>
+          </xs:complexType>
+        </xs:element>
+      </xs:sequence>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='registered'>
+    <xs:complexType>
+      <xs:sequence>
+        <xs:any maxOccurs='1'
+                minOccurs='1' namespace='urn:xmpp:hashes:2' processContents='lax'/>
+      </xs:sequence>
+      <xs:attribute name='jid' type='xs:string' use='required'/>
+      <xs:attribute name='version' type='version' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='activate'>
+    <xs:complexType>
+      <xs:sequence>
+        <xs:any maxOccurs='1'
+                minOccurs='1' namespace='urn:xmpp:hashes:2' processContents='lax'/>
+      </xs:sequence>
+      <xs:attribute name='jid' type='xs:string' use='required'/>
+      <xs:attribute name='version' type='version' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='active'>
+    <xs:complexType>
+      <xs:attribute name='jid' type='xs:string' use='required'/>
+      <xs:attribute name='version' type='version' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:complexType name='endpointOperation'>
+    <xs:attribute name='jid' type='xs:string' use='required'/>
+  </xs:complexType>
+
+  <xs:element name='deactivate' type='endpointOperation'/>
+  <xs:element name='deactivated' type='endpointOperation'/>
+  <xs:element name='registration-status' type='endpointOperation'/>
+  <xs:element name='remove-endpoint' type='endpointOperation'/>
+
+  <xs:element name='remove-version'>
+    <xs:complexType>
+      <xs:attribute name='jid' type='xs:string' use='required'/>
+      <xs:attribute name='version' type='version' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='removed'>
+    <xs:complexType>
+      <xs:attribute name='jid' type='xs:string' use='required'/>
+      <xs:attribute name='version' type='version' use='optional'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='registration'>
+    <xs:complexType>
+      <xs:sequence>
+        <xs:element maxOccurs='unbounded' minOccurs='0' name='version'>
+          <xs:complexType>
+            <xs:sequence>
+              <xs:any maxOccurs='1'
+                      minOccurs='1' namespace='urn:xmpp:hashes:2' processContents='lax'/>
+            </xs:sequence>
+            <xs:attribute name='id' type='version' use='required'/>
+            <xs:attribute name='active' type='xs:boolean' use='required'/>
+            <xs:attribute name='removable' type='xs:boolean' use='required'/>
+          </xs:complexType>
+        </xs:element>
+      </xs:sequence>
+      <xs:attribute name='jid' type='xs:string' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='manifest-request'>
+    <xs:complexType>
+      <xs:attribute name='version' type='version' use='optional'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='manifest'>
+    <xs:complexType>
+      <xs:sequence>
+        <xs:any maxOccurs='1'
+                minOccurs='1' namespace='urn:xmpp:hashes:2' processContents='lax'/>
+        <xs:element name='json' type='xs:string'/>
+      </xs:sequence>
+      <xs:attribute name='version' type='version' use='required'/>
+      <xs:attribute fixed='application/json' name='media-type'
+                    type='xs:string' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='schema-request'>
+    <xs:complexType>
+      <xs:sequence>
+        <xs:any maxOccurs='1'
+                minOccurs='1' namespace='urn:xmpp:hashes:2' processContents='lax'/>
+      </xs:sequence>
+      <xs:attribute name='tool' type='toolName' use='required'/>
+      <xs:attribute name='version' type='version' use='required'/>
+      <xs:attribute name='direction' type='direction' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='schema'>
+    <xs:complexType>
+      <xs:sequence>
+        <xs:element name='manifest-hash' type='hashContainer'/>
+        <xs:element name='schema-hash' type='hashContainer'/>
+        <xs:element name='json' type='xs:string'/>
+      </xs:sequence>
+      <xs:attribute name='tool' type='toolName' use='required'/>
+      <xs:attribute name='version' type='version' use='required'/>
+      <xs:attribute name='direction' type='direction' use='required'/>
+      <xs:attribute fixed='application/schema+json' name='media-type'
+                    type='xs:string' use='required'/>
+    </xs:complexType>
+  </xs:element>
+</xs:schema>
diff --git a/packages/agent-xmpp/protocol/schema/agent-task.xsd b/packages/agent-xmpp/protocol/schema/agent-task.xsd
new file mode 100644
index 000000000..ecb7107a7
--- /dev/null
+++ b/packages/agent-xmpp/protocol/schema/agent-task.xsd
@@ -0,0 +1,205 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<xs:schema xmlns='urn:xmpp:agent-task:0'
+           xmlns:xs='http://www.w3.org/2001/XMLSchema'
+           elementFormDefault='qualified'
+           targetNamespace='urn:xmpp:agent-task:0'>
+
+  <xs:simpleType name='eventType'>
+    <xs:restriction base='xs:string'>
+      <xs:enumeration value='status'/>
+      <xs:enumeration value='progress'/>
+      <xs:enumeration value='input_required'/>
+      <xs:enumeration value='completed'/>
+      <xs:enumeration value='failed'/>
+      <xs:enumeration value='cancelled'/>
+    </xs:restriction>
+  </xs:simpleType>
+
+  <xs:simpleType name='executionState'>
+    <xs:restriction base='xs:string'>
+      <xs:enumeration value='accepted'/>
+      <xs:enumeration value='running'/>
+      <xs:enumeration value='input_required'/>
+      <xs:enumeration value='cancelling'/>
+      <xs:enumeration value='cancelled'/>
+      <xs:enumeration value='failed'/>
+      <xs:enumeration value='completed'/>
+    </xs:restriction>
+  </xs:simpleType>
+
+  <xs:simpleType name='terminalState'>
+    <xs:restriction base='xs:string'>
+      <xs:enumeration value='cancelled'/>
+      <xs:enumeration value='failed'/>
+      <xs:enumeration value='completed'/>
+    </xs:restriction>
+  </xs:simpleType>
+
+  <xs:simpleType name='identifier'>
+    <xs:restriction base='xs:string'>
+      <xs:pattern value='[A-Za-z0-9._~-]{22,128}'/>
+    </xs:restriction>
+  </xs:simpleType>
+
+  <xs:simpleType name='version'>
+    <xs:restriction base='xs:string'>
+      <xs:pattern value='[A-Za-z0-9._~-]{1,64}'/>
+    </xs:restriction>
+  </xs:simpleType>
+
+  <xs:simpleType name='toolName'>
+    <xs:restriction base='xs:string'>
+      <xs:minLength value='1'/>
+    </xs:restriction>
+  </xs:simpleType>
+
+  <xs:complexType name='hashContainer'>
+    <xs:sequence>
+      <xs:any maxOccurs='1'
+              minOccurs='1' namespace='urn:xmpp:hashes:2' processContents='lax'/>
+    </xs:sequence>
+  </xs:complexType>
+
+  <xs:element name='invoke'>
+    <xs:complexType>
+      <xs:sequence>
+        <xs:element name='manifest-hash' type='hashContainer'/>
+        <xs:element name='arguments'>
+          <xs:complexType>
+            <xs:simpleContent>
+              <xs:extension base='xs:string'>
+                <xs:attribute fixed='application/json' name='media-type'
+                              type='xs:string' use='required'/>
+              </xs:extension>
+            </xs:simpleContent>
+          </xs:complexType>
+        </xs:element>
+        <xs:element minOccurs='0' name='deadline' type='xs:dateTime'/>
+      </xs:sequence>
+      <xs:attribute name='request-id' type='identifier' use='required'/>
+      <xs:attribute name='tool' type='toolName' use='required'/>
+      <xs:attribute name='api-version' type='version' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='accepted'>
+    <xs:complexType>
+      <xs:attribute name='request-id' type='identifier' use='required'/>
+      <xs:attribute name='task-id' type='identifier' use='required'/>
+      <xs:attribute name='revision' type='xs:nonNegativeInteger' use='required'/>
+      <xs:attribute name='created' type='xs:dateTime' use='required'/>
+      <xs:attribute name='retain-until' type='xs:dateTime' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='provide-input'>
+    <xs:complexType>
+      <xs:sequence>
+        <xs:element name='input'>
+          <xs:complexType>
+            <xs:simpleContent>
+              <xs:extension base='xs:string'>
+                <xs:attribute fixed='application/json' name='media-type'
+                              type='xs:string' use='required'/>
+              </xs:extension>
+            </xs:simpleContent>
+          </xs:complexType>
+        </xs:element>
+      </xs:sequence>
+      <xs:attribute name='task-id' type='identifier' use='required'/>
+      <xs:attribute name='request-id' type='identifier' use='required'/>
+      <xs:attribute name='expected-revision' type='xs:nonNegativeInteger' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='input-accepted'>
+    <xs:complexType>
+      <xs:attribute name='task-id' type='identifier' use='required'/>
+      <xs:attribute name='revision' type='xs:nonNegativeInteger' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='cancel'>
+    <xs:complexType>
+      <xs:sequence>
+        <xs:element minOccurs='0' name='reason' type='xs:string'/>
+      </xs:sequence>
+      <xs:attribute name='task-id' type='identifier' use='required'/>
+      <xs:attribute name='expected-revision' type='xs:nonNegativeInteger' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='cancel-accepted'>
+    <xs:complexType>
+      <xs:attribute name='task-id' type='identifier' use='required'/>
+      <xs:attribute name='revision' type='xs:nonNegativeInteger' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='event'>
+    <xs:complexType>
+      <xs:simpleContent>
+        <xs:extension base='xs:string'>
+          <xs:attribute name='task-id' type='identifier' use='required'/>
+          <xs:attribute name='event-id' type='identifier' use='required'/>
+          <xs:attribute name='revision' type='xs:nonNegativeInteger' use='required'/>
+          <xs:attribute name='type' type='eventType' use='required'/>
+        </xs:extension>
+      </xs:simpleContent>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='task-state-request'>
+    <xs:complexType>
+      <xs:attribute name='task-id' type='identifier' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='task-state'>
+    <xs:complexType>
+      <xs:sequence>
+        <xs:element name='manifest-hash' type='hashContainer'/>
+        <xs:element minOccurs='0' name='pending-input'>
+          <xs:complexType>
+            <xs:simpleContent>
+              <xs:extension base='xs:string'>
+                <xs:attribute fixed='application/json' name='media-type'
+                              type='xs:string' use='required'/>
+              </xs:extension>
+            </xs:simpleContent>
+          </xs:complexType>
+        </xs:element>
+      </xs:sequence>
+      <xs:attribute name='task-id' type='identifier' use='required'/>
+      <xs:attribute name='endpoint' type='xs:string' use='required'/>
+      <xs:attribute name='state' type='executionState' use='required'/>
+      <xs:attribute name='revision' type='xs:nonNegativeInteger' use='required'/>
+      <xs:attribute name='api-version' type='version' use='required'/>
+      <xs:attribute name='created' type='xs:dateTime' use='required'/>
+      <xs:attribute name='updated' type='xs:dateTime' use='required'/>
+      <xs:attribute name='deadline' type='xs:dateTime' use='optional'/>
+      <xs:attribute name='retain-until' type='xs:dateTime' use='required'/>
+      <xs:attribute name='result-available' type='xs:boolean' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='task-result-request'>
+    <xs:complexType>
+      <xs:attribute name='task-id' type='identifier' use='required'/>
+    </xs:complexType>
+  </xs:element>
+
+  <xs:element name='task-result'>
+    <xs:complexType>
+      <xs:simpleContent>
+        <xs:extension base='xs:string'>
+          <xs:attribute name='task-id' type='identifier' use='required'/>
+          <xs:attribute name='state' type='terminalState' use='required'/>
+          <xs:attribute name='revision' type='xs:nonNegativeInteger' use='required'/>
+          <xs:attribute fixed='application/json' name='media-type'
+                        type='xs:string' use='required'/>
+        </xs:extension>
+      </xs:simpleContent>
+    </xs:complexType>
+  </xs:element>
+</xs:schema>
diff --git a/packages/agent-xmpp/protocol/schema/event.schema.json b/packages/agent-xmpp/protocol/schema/event.schema.json
new file mode 100644
index 000000000..f8ed8e042
--- /dev/null
+++ b/packages/agent-xmpp/protocol/schema/event.schema.json
@@ -0,0 +1,140 @@
+{
+	"$schema": "https://json-schema.org/draft/2020-12/schema",
+	"$id": "urn:xmpp:agent-task:0:event-json",
+	"$defs": {
+		"status": {
+			"type": "object",
+			"required": ["state", "updatedAt"],
+			"properties": {
+				"state": {
+					"enum": ["running", "input_required", "cancelling"]
+				},
+				"updatedAt": {
+					"type": "string",
+					"format": "date-time"
+				}
+			},
+			"additionalProperties": false
+		},
+		"progress": {
+			"type": "object",
+			"minProperties": 1,
+			"properties": {
+				"percent": {
+					"type": "number",
+					"minimum": 0,
+					"maximum": 100
+				},
+				"stage": {
+					"type": "string",
+					"maxLength": 256
+				},
+				"message": {
+					"type": "string",
+					"maxLength": 4096
+				}
+			},
+			"additionalProperties": false
+		},
+		"input_required": {
+			"type": "object",
+			"required": ["requestId", "question", "inputSchema", "createdAt"],
+			"properties": {
+				"requestId": {
+					"type": "string",
+					"pattern": "^[A-Za-z0-9._~-]{22,128}$"
+				},
+				"question": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 4096
+				},
+				"inputSchema": {
+					"type": "object"
+				},
+				"createdAt": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"expiresAt": {
+					"type": "string",
+					"format": "date-time"
+				}
+			},
+			"additionalProperties": false
+		},
+		"toolResult": {
+			"type": "object",
+			"required": ["content"],
+			"properties": {
+				"content": {
+					"type": "array",
+					"items": {
+						"type": "object"
+					}
+				},
+				"structuredContent": {},
+				"isError": {
+					"type": "boolean"
+				},
+				"_meta": {
+					"type": "object"
+				}
+			},
+			"additionalProperties": false
+		},
+		"completed": {
+			"type": "object",
+			"required": ["result"],
+			"properties": {
+				"result": {
+					"$ref": "#/$defs/toolResult"
+				},
+				"summary": {
+					"type": "string",
+					"maxLength": 4096
+				}
+			},
+			"additionalProperties": false
+		},
+		"failed": {
+			"type": "object",
+			"required": ["error"],
+			"properties": {
+				"error": {
+					"type": "object",
+					"required": ["code", "message", "retryable"],
+					"properties": {
+						"code": {
+							"type": "string",
+							"pattern": "^[A-Za-z0-9_.:-]{1,128}$"
+						},
+						"message": {
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 4096
+						},
+						"retryable": {
+							"type": "boolean"
+						},
+						"details": {
+							"type": "object"
+						}
+					},
+					"additionalProperties": false
+				}
+			},
+			"additionalProperties": false
+		},
+		"cancelled": {
+			"type": "object",
+			"properties": {
+				"reason": {
+					"type": "string",
+					"maxLength": 4096
+				}
+			},
+			"additionalProperties": false
+		}
+	}
+}
diff --git a/packages/agent-xmpp/protocol/schema/manifest.schema.json b/packages/agent-xmpp/protocol/schema/manifest.schema.json
new file mode 100644
index 000000000..7690e1656
--- /dev/null
+++ b/packages/agent-xmpp/protocol/schema/manifest.schema.json
@@ -0,0 +1,163 @@
+{
+	"$schema": "https://json-schema.org/draft/2020-12/schema",
+	"$id": "urn:xmpp:agent-api:0:manifest-json",
+	"type": "object",
+	"required": ["manifestSpecVersion", "agent", "tools"],
+	"properties": {
+		"manifestSpecVersion": {
+			"const": "0"
+		},
+		"agent": {
+			"type": "object",
+			"required": ["jid", "name", "version"],
+			"properties": {
+				"jid": {
+					"type": "string",
+					"minLength": 3,
+					"maxLength": 3071
+				},
+				"name": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 128
+				},
+				"title": {
+					"type": "string",
+					"maxLength": 256
+				},
+				"description": {
+					"type": "string",
+					"maxLength": 4096
+				},
+				"version": {
+					"type": "string",
+					"pattern": "^[A-Za-z0-9._~-]{1,64}$"
+				},
+				"vendor": {
+					"type": "string",
+					"maxLength": 256
+				},
+				"homepage": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^https://",
+					"maxLength": 2048
+				},
+				"avatarUrl": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^https://",
+					"maxLength": 2048
+				}
+			},
+			"additionalProperties": false
+		},
+		"implementation": {
+			"type": "object",
+			"required": ["name", "version"],
+			"properties": {
+				"name": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 128
+				},
+				"version": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 128
+				}
+			},
+			"additionalProperties": false
+		},
+		"mcpProtocolVersion": {
+			"type": "string",
+			"pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$"
+		},
+		"tools": {
+			"type": "array",
+			"maxItems": 4096,
+			"items": {
+				"type": "object",
+				"required": ["name", "inputSchema"],
+				"properties": {
+					"name": {
+						"type": "string",
+						"minLength": 1
+					},
+					"title": {
+						"type": "string",
+						"maxLength": 256
+					},
+					"description": {
+						"type": "string",
+						"maxLength": 8192
+					},
+					"inputSchema": {
+						"type": "object"
+					},
+					"outputSchema": {
+						"type": "object"
+					},
+					"annotations": {
+						"type": "object"
+					},
+					"execution": {
+						"type": "object"
+					},
+					"_meta": {
+						"type": "object"
+					},
+					"urn:xmpp:agent-api:0": {
+						"type": "object",
+						"properties": {
+							"supportsProgress": {
+								"type": "boolean"
+							},
+							"supportsCancellation": {
+								"type": "boolean"
+							},
+							"supportsInput": {
+								"type": "boolean"
+							},
+							"defaultTimeoutSeconds": {
+								"type": "integer",
+								"minimum": 1
+							},
+							"maximumTimeoutSeconds": {
+								"type": "integer",
+								"minimum": 1
+							},
+							"requiredPermissions": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"minLength": 1,
+									"maxLength": 256
+								},
+								"uniqueItems": true
+							},
+							"approvalRequired": {
+								"type": "boolean"
+							},
+							"tags": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"minLength": 1,
+									"maxLength": 128
+								},
+								"uniqueItems": true
+							}
+						},
+						"additionalProperties": false
+					}
+				},
+				"patternProperties": {
+					"^[a-z][a-z0-9+.-]*:": {}
+				},
+				"additionalProperties": false
+			}
+		}
+	},
+	"additionalProperties": false
+}
diff --git a/packages/agent-xmpp/protocol/schema/namespaces.json b/packages/agent-xmpp/protocol/schema/namespaces.json
new file mode 100644
index 000000000..0d9dc197e
--- /dev/null
+++ b/packages/agent-xmpp/protocol/schema/namespaces.json
@@ -0,0 +1,10 @@
+[
+	"urn:xmpp:agent-directory:0",
+	"urn:xmpp:agent-api:0",
+	"urn:xmpp:agent-tools:0",
+	"urn:xmpp:agent-tool:0",
+	"urn:xmpp:agent-endpoint:0",
+	"urn:xmpp:agent-endpoint-info:0",
+	"urn:xmpp:agent-tool-info:0",
+	"urn:xmpp:agent-task:0"
+]
diff --git a/packages/agent-xmpp/protocol/src/agent-api.ts b/packages/agent-xmpp/protocol/src/agent-api.ts
new file mode 100644
index 000000000..5ebff25d5
--- /dev/null
+++ b/packages/agent-xmpp/protocol/src/agent-api.ts
@@ -0,0 +1,92 @@
+import type { AGENT_API_NS } from "./namespaces.js";
+
+export type JsonSchema = Record<string, unknown>;
+
+/** MCP Tool annotations are preserved exactly; absence is distinct from false. */
+export interface McpToolAnnotations {
+	title?: string;
+	readOnlyHint?: boolean;
+	destructiveHint?: boolean;
+	idempotentHint?: boolean;
+	openWorldHint?: boolean;
+}
+
+export interface McpTool {
+	name: string;
+	title?: string;
+	description?: string;
+	inputSchema: JsonSchema;
+	outputSchema?: JsonSchema;
+	annotations?: McpToolAnnotations;
+	execution?: Record<string, unknown>;
+	_meta?: Record<string, unknown>;
+	[extension: `${string}:${string}`]: unknown;
+}
+
+export interface XmppToolExtension {
+	supportsProgress?: boolean;
+	supportsCancellation?: boolean;
+	supportsInput?: boolean;
+	defaultTimeoutSeconds?: number;
+	maximumTimeoutSeconds?: number;
+	requiredPermissions?: string[];
+	approvalRequired?: boolean;
+	tags?: string[];
+}
+
+export interface AgentApiManifest {
+	manifestSpecVersion: "0";
+	agent: {
+		jid: string;
+		name: string;
+		title?: string;
+		description?: string;
+		version: string;
+		vendor?: string;
+		homepage?: string;
+		/** Public avatar URI served via XEP-0054 PHOTO/EXTVAL. */
+		avatarUrl?: string;
+	};
+	implementation?: { name: string; version: string };
+	mcpProtocolVersion?: string;
+	tools: McpTool[];
+}
+
+export interface RegisteredTool extends McpTool {
+	inputSchemaHash: string;
+	outputSchemaHash?: string;
+	xmpp?: XmppToolExtension;
+}
+
+export interface RegisteredAgent {
+	manifest: AgentApiManifest;
+	manifestHash: string;
+	canonicalManifest: string;
+	tools: RegisteredTool[];
+	tenantId: string;
+	active: boolean;
+	registeredAt: string;
+}
+
+export interface VirtualMcpEndpoint {
+	endpointId: string;
+	manifestSpecVersion: AgentApiManifest["manifestSpecVersion"];
+	implementation?: AgentApiManifest["implementation"];
+	mcpProtocolVersion?: AgentApiManifest["mcpProtocolVersion"];
+	server: {
+		name: string;
+		title?: string;
+		description?: string;
+		version: string;
+	};
+	xmpp: {
+		jid: string;
+		toolsNode: string;
+		features: string[];
+	};
+	authorization: { visible: boolean; invocable: boolean };
+	tools: RegisteredTool[];
+}
+
+export const XMPP_TOOL_EXTENSION_KEY: typeof AGENT_API_NS =
+	"urn:xmpp:agent-api:0";
diff --git a/packages/agent-xmpp/protocol/src/agent-message.ts b/packages/agent-xmpp/protocol/src/agent-message.ts
new file mode 100644
index 000000000..c274e1ac3
--- /dev/null
+++ b/packages/agent-xmpp/protocol/src/agent-message.ts
@@ -0,0 +1,174 @@
+/** Normative types from Agent XMPP Adapter API Surface v0.1 */
+
+export type MessageKind =
+	| "text"
+	| "task"
+	| "result"
+	| "error"
+	| "file"
+	| "command"
+	| "event";
+
+export type Sensitivity = "public" | "internal" | "confidential" | "secret";
+
+export interface TraceContext {
+	tenantId?: string;
+	workflowId?: string;
+	runId?: string;
+	spanId?: string;
+	correlationId?: string;
+}
+
+export interface MessagePolicy {
+	store?: boolean;
+	ttlSeconds?: number | null;
+	trainingAllowed?: boolean;
+	containsPii?: boolean;
+	sensitivity?: Sensitivity;
+}
+
+export interface FileRef {
+	id?: string;
+	name?: string;
+	url: string;
+	mediaType?: string;
+	sizeBytes?: number;
+	sha256?: string;
+	description?: string;
+	expiresAt?: string;
+	encrypted?: boolean;
+	metadata?: Record<string, unknown>;
+}
+
+export interface AgentMessage {
+	id: string;
+	from: string;
+	to: string;
+	threadId?: string;
+	roomId?: string;
+	kind: MessageKind;
+	contentType: string;
+	body: unknown;
+	replyTo?: string;
+	attachments?: FileRef[];
+	trace?: TraceContext;
+	policy?: MessagePolicy;
+	extensions?: Record<string, unknown>;
+}
+
+export interface XmppSourceMetadata {
+	stanzaId?: string;
+	stableId?: string;
+	stanzaType?: "chat" | "groupchat" | "normal" | "headline" | "error";
+	fromResource?: string;
+	toResource?: string;
+	mucOccupantId?: string;
+	delayed?: {
+		stamp: string;
+		from?: string;
+	};
+	rawNamespaces?: string[];
+}
+
+export interface DeliveryMeta {
+	receivedAt: string;
+	gatewayId: string;
+	deliveryId: string;
+	redelivered?: boolean;
+}
+
+export interface InboundMessage {
+	type: "inbound.message";
+	message: AgentMessage;
+	delivery: DeliveryMeta;
+	xmpp?: XmppSourceMetadata;
+}
+
+export interface InboundEvent {
+	type: "inbound.event";
+	event: Record<string, unknown>;
+	delivery: DeliveryMeta;
+}
+
+export interface InboundCommand {
+	type: "inbound.command";
+	command: string;
+	args?: Record<string, unknown>;
+	delivery: DeliveryMeta;
+}
+
+export interface InboundLifecycleEvent {
+	type: "inbound.lifecycle";
+	lifecycle: Record<string, unknown>;
+	delivery: DeliveryMeta;
+}
+
+export type InboundEnvelope =
+	| InboundMessage
+	| InboundEvent
+	| InboundCommand
+	| InboundLifecycleEvent;
+
+/** ask_user_question payload — shared between host delivery and XMPP form rendering. */
+export interface AskQuestionOption {
+	label: string;
+	selectedLabel?: string;
+	value?: string;
+}
+
+export type AskQuestionOptionInput = string | AskQuestionOption;
+
+export interface AskQuestionPayload {
+	type: "ask_question";
+	questionId: string;
+	title: string;
+	question: string;
+	options: AskQuestionOptionInput[];
+}
+
+/** Bridge webhook payload: routing + normalized message for NanoClaw. */
+export interface BridgeInboundPayload {
+	platformId: string;
+	/** Full sender JID used for replies and chat states; routing still uses platformId. */
+	replyTo?: string;
+	threadId: string | null;
+	isMention?: boolean;
+	isGroup?: boolean;
+	agentJid: string;
+	envelope: InboundMessage;
+}
+
+/** XEP-0004 form submit for ask_user_question — routed to host onAction, not the agent. */
+export interface BridgeFormResponsePayload {
+	type: "form_response";
+	agentJid: string;
+	platformId: string;
+	threadId: string | null;
+	questionId: string;
+	selectedIndex: number;
+	userId: string;
+	timestamp: string;
+}
+
+export type BridgeWebhookPayload =
+	| BridgeInboundPayload
+	| BridgeFormResponsePayload;
+
+export function isBridgeFormResponsePayload(
+	payload: BridgeWebhookPayload,
+): payload is BridgeFormResponsePayload {
+	return "type" in payload && payload.type === "form_response";
+}
+
+/** Gateway outbound deliver request from NanoClaw bridge. */
+export interface OutboundDeliverRequest {
+	id?: string;
+	from: string;
+	to: string;
+	/** BCP 47 language tag used as the stanza's inherited xml:lang. */
+	lang?: string;
+	threadId?: string | null;
+	content: unknown;
+	inReplyTo?: string;
+	files?: Array<{ filename: string; dataBase64: string; mediaType?: string }>;
+}
diff --git a/packages/agent-xmpp/protocol/src/agent-task.ts b/packages/agent-xmpp/protocol/src/agent-task.ts
new file mode 100644
index 000000000..3c3bb50bc
--- /dev/null
+++ b/packages/agent-xmpp/protocol/src/agent-task.ts
@@ -0,0 +1,82 @@
+export const taskStates = [
+	"accepted",
+	"running",
+	"input_required",
+	"cancelling",
+	"cancelled",
+	"failed",
+	"completed",
+] as const;
+export type AgentTaskState = (typeof taskStates)[number];
+
+export const terminalTaskStates = new Set<AgentTaskState>([
+	"cancelled",
+	"failed",
+	"completed",
+]);
+
+export interface AgentTaskError {
+	code: string;
+	message: string;
+	retryable: boolean;
+	details?: Record<string, unknown>;
+}
+
+export interface McpToolResult {
+	content: Array<Record<string, unknown>>;
+	structuredContent?: unknown;
+	isError?: boolean;
+	_meta?: Record<string, unknown>;
+}
+
+export interface PendingTaskInput {
+	requestId: string;
+	question: string;
+	inputSchema: Record<string, unknown>;
+	createdAt: string;
+	expiresAt?: string;
+}
+
+export interface AgentTaskRecord {
+	taskId: string;
+	requestId: string;
+	callerJid: string;
+	notificationJid: string;
+	targetJid: string;
+	tenantId: string;
+	tool: string;
+	apiVersion: string;
+	manifestHash: string;
+	arguments: unknown;
+	state: AgentTaskState;
+	revision: number;
+	fingerprint: string;
+	callerSessionId?: string;
+	createdAt: string;
+	updatedAt: string;
+	deadline?: string;
+	retainUntil: string;
+	result?: McpToolResult;
+	error?: AgentTaskError;
+	summary?: string;
+	pendingInput?: PendingTaskInput;
+}
+
+export const taskEventTypes = [
+	"status",
+	"progress",
+	"input_required",
+	"completed",
+	"failed",
+	"cancelled",
+] as const;
+export type AgentTaskEventType = (typeof taskEventTypes)[number];
+
+export interface AgentTaskEvent {
+	taskId: string;
+	eventId: string;
+	revision: number;
+	type: AgentTaskEventType;
+	payload: Record<string, unknown>;
+	createdAt: string;
+}
diff --git a/packages/agent-xmpp/protocol/src/bridge.ts b/packages/agent-xmpp/protocol/src/bridge.ts
new file mode 100644
index 000000000..9e3b8ae37
--- /dev/null
+++ b/packages/agent-xmpp/protocol/src/bridge.ts
@@ -0,0 +1,67 @@
+import type {
+	AgentMessage,
+	BridgeInboundPayload,
+	InboundMessage,
+} from "./agent-message.js";
+
+/**
+ * True when the gateway normalized a XEP-0432-inspired JSON payload (agent-to-agent),
+ * as opposed to a plain human `<body>` stanza (kind=text, contentType=text/plain, string body).
+ */
+export function isXmppAgentEnvelope(msg: AgentMessage): boolean {
+	if (msg.kind !== "text") return true;
+	if (msg.contentType !== "text/plain") return true;
+	return typeof msg.body !== "string";
+}
+
+/** Extract the normative AgentMessage from a NanoClaw XMPP inbound content JSON blob. */
+export function agentMessageFromNanoclawContent(
+	raw: string,
+): AgentMessage | null {
+	try {
+		const parsed = JSON.parse(raw) as { envelope?: InboundMessage };
+		if (parsed.envelope?.type !== "inbound.message") return null;
+		return parsed.envelope.message;
+		// eslint-disable-next-line no-catch-all/no-catch-all -- malformed inbound content returns null
+	} catch {
+		return null;
+	}
+}
+
+/** Human-readable text from a normative AgentMessage. */
+export function agentMessageText(msg: AgentMessage): string {
+	if (typeof msg.body === "string") return msg.body;
+	if (msg.body && typeof msg.body === "object" && "text" in msg.body) {
+		return String((msg.body as { text?: unknown }).text ?? "");
+	}
+	return JSON.stringify(msg.body);
+}
+
+/** NanoClaw channel adapter inbound shape — preserves normative envelope. */
+export interface NanoclawXmppInbound {
+	id: string;
+	kind: "chat";
+	content: { text: string; envelope: InboundMessage };
+	timestamp: string;
+	isMention?: boolean;
+	isGroup?: boolean;
+}
+
+export function nanoclawInboundFromBridge(
+	payload: BridgeInboundPayload,
+): NanoclawXmppInbound {
+	const { envelope } = payload;
+	const text = agentMessageText(envelope.message);
+	return {
+		id: envelope.message.id,
+		// Generic AgentMessage(kind="task") is structured conversation content,
+		// not a durable gateway task. Only the agent-task stanza codec creates a
+		// task record and exposes lifecycle tools, so an arbitrary message id can
+		// never be mistaken for a registered task id.
+		kind: "chat",
+		content: { text, envelope },
+		timestamp: envelope.delivery.receivedAt,
+		isMention: payload.isMention,
+		isGroup: payload.isGroup,
+	};
+}
diff --git a/packages/agent-xmpp/protocol/src/identifiers.ts b/packages/agent-xmpp/protocol/src/identifiers.ts
new file mode 100644
index 000000000..a0042f5ee
--- /dev/null
+++ b/packages/agent-xmpp/protocol/src/identifiers.ts
@@ -0,0 +1,165 @@
+const API_VERSION = /^[A-Za-z0-9._~-]{1,64}$/;
+const OPAQUE_IDENTIFIER = /^[A-Za-z0-9._~-]{22,128}$/;
+const XEP_0082_DATE_TIME =
+	/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?(?:Z|([+-])(\d{2}):(\d{2}))$/;
+
+interface Xep0082Instant {
+	epochSecond: bigint;
+	fraction: string;
+}
+
+export function isApiVersion(value: string): boolean {
+	return API_VERSION.test(value);
+}
+
+export function isOpaqueIdentifier(value: string): boolean {
+	return OPAQUE_IDENTIFIER.test(value);
+}
+
+export function isXep0082DateTime(value: string): boolean {
+	const match = XEP_0082_DATE_TIME.exec(value);
+	if (!match) return false;
+	const [
+		,
+		yearText,
+		monthText,
+		dayText,
+		hourText,
+		minuteText,
+		secondText,
+		,
+		,
+		offsetHourText,
+		offsetMinuteText,
+	] = match;
+	const year = Number(yearText);
+	const month = Number(monthText);
+	const day = Number(dayText);
+	const hour = Number(hourText);
+	const minute = Number(minuteText);
+	const second = Number(secondText);
+	if (
+		year === 0 ||
+		month < 1 ||
+		month > 12 ||
+		hour > 23 ||
+		minute > 59 ||
+		second > 59
+	)
+		return false;
+	const daysInMonth = [
+		31,
+		isLeapYear(year) ? 29 : 28,
+		31,
+		30,
+		31,
+		30,
+		31,
+		31,
+		30,
+		31,
+		30,
+		31,
+	][month - 1]!;
+	if (day < 1 || day > daysInMonth) return false;
+	if (offsetHourText) {
+		const offsetHour = Number(offsetHourText);
+		const offsetMinute = Number(offsetMinuteText);
+		if (
+			offsetHour > 14 ||
+			offsetMinute > 59 ||
+			(offsetHour === 14 && offsetMinute !== 0)
+		)
+			return false;
+	}
+	return true;
+}
+
+/**
+ * Compare represented XEP-0082 instants without truncating fractional seconds.
+ * Both inputs must already satisfy isXep0082DateTime().
+ */
+export function compareXep0082DateTimes(left: string, right: string): number {
+	const a = parseXep0082Instant(left);
+	const b = parseXep0082Instant(right);
+	if (!a || !b) throw new Error("invalid XEP-0082 date-time");
+	if (a.epochSecond < b.epochSecond) return -1;
+	if (a.epochSecond > b.epochSecond) return 1;
+	const width = Math.max(a.fraction.length, b.fraction.length);
+	const aFraction = a.fraction.padEnd(width, "0");
+	const bFraction = b.fraction.padEnd(width, "0");
+	return aFraction < bFraction ? -1 : aFraction > bFraction ? 1 : 0;
+}
+
+export function compareXep0082DateTimeToDate(
+	value: string,
+	date: Date,
+): number {
+	return compareXep0082DateTimes(value, date.toISOString());
+}
+
+/** Smallest integral epoch millisecond that is not before the represented instant. */
+export function xep0082DateTimeToEpochMillisecondsCeil(value: string): number {
+	const instant = parseXep0082Instant(value);
+	if (!instant) throw new Error("invalid XEP-0082 date-time");
+	const milliseconds = Number(instant.epochSecond) * 1_000;
+	const firstThreeDigits = Number(instant.fraction.padEnd(3, "0").slice(0, 3));
+	const hasSubMillisecondRemainder = /[1-9]/.test(instant.fraction.slice(3));
+	return milliseconds + firstThreeDigits + (hasSubMillisecondRemainder ? 1 : 0);
+}
+
+export function isXml10Text(value: string): boolean {
+	for (const character of value) {
+		const codePoint = character.codePointAt(0)!;
+		if (
+			codePoint !== 0x09 &&
+			codePoint !== 0x0a &&
+			codePoint !== 0x0d &&
+			(codePoint < 0x20 ||
+				(codePoint >= 0xd800 && codePoint <= 0xdfff) ||
+				codePoint === 0xfffe ||
+				codePoint === 0xffff ||
+				codePoint > 0x10ffff)
+		) {
+			return false;
+		}
+	}
+	return true;
+}
+
+export function isToolName(value: string): boolean {
+	return value.length > 0 && isXml10Text(value);
+}
+
+function isLeapYear(year: number): boolean {
+	return year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+}
+
+function parseXep0082Instant(value: string): Xep0082Instant | null {
+	if (!isXep0082DateTime(value)) return null;
+	const match = XEP_0082_DATE_TIME.exec(value)!;
+	const [
+		,
+		year,
+		month,
+		day,
+		hour,
+		minute,
+		second,
+		fraction = "",
+		offsetSign,
+		offsetHour = "0",
+		offsetMinute = "0",
+	] = match;
+	const date = new Date(0);
+	date.setUTCFullYear(Number(year), Number(month) - 1, Number(day));
+	date.setUTCHours(Number(hour), Number(minute), Number(second), 0);
+	const signedOffsetSeconds =
+		(offsetSign === "-" ? -1 : 1) *
+		(Number(offsetHour) * 60 + Number(offsetMinute)) *
+		60;
+	return {
+		epochSecond: BigInt(date.getTime() / 1_000 - signedOffsetSeconds),
+		fraction,
+	};
+}
diff --git a/packages/agent-xmpp/protocol/src/index.ts b/packages/agent-xmpp/protocol/src/index.ts
new file mode 100644
index 000000000..87afed84b
--- /dev/null
+++ b/packages/agent-xmpp/protocol/src/index.ts
@@ -0,0 +1,8 @@
+export * from "./namespaces.js";
+export * from "./agent-message.js";
+export * from "./agent-api.js";
+export * from "./agent-task.js";
+export * from "./bridge.js";
+export * from "./identifiers.js";
+export * from "./jid.js";
+export * from "./strict-json.js";
diff --git a/packages/agent-xmpp/protocol/src/jid.ts b/packages/agent-xmpp/protocol/src/jid.ts
new file mode 100644
index 000000000..a3eef47cb
--- /dev/null
+++ b/packages/agent-xmpp/protocol/src/jid.ts
@@ -0,0 +1,124 @@
+import { createRequire } from "node:module";
+import { isIP } from "node:net";
+import { readFileSync } from "node:fs";
+import IdnHostname from "idn-hostname";
+import {
+	initSync,
+	usernamecasemapped_enforce,
+} from "precis-wasm/precis_wasm.js";
+
+/** Return the addressable bare JID, stripping any resource suffix. */
+export function bareJid(jid: string): string {
+	return jid.split("/")[0] ?? jid;
+}
+
+const LOCALPART_EXCLUDED = /["&'/:<>@]/u;
+const DOMAINPART_EXCLUDED = /[/@]/u;
+const DNS_LABEL_SEPARATOR_AT_END = /[.\u3002\uff0e\uff61]$/u;
+const IPV6_ZONE = /^(?:[A-Za-z0-9._~-]|%[0-9A-Fa-f]{2})+$/u;
+const require = createRequire(import.meta.url);
+const { idnHostname, punycode } = IdnHostname;
+let precisInitialized = false;
+
+/**
+ * Prepare the RFC 7622 bare-JID shape used for ProtoXEP endpoints.
+ * Endpoint identities require a localpart and deliberately reject resources.
+ */
+export function normalizeEndpointJid(value: string): string | null {
+	if (
+		value.includes("/") ||
+		value.indexOf("@") <= 0 ||
+		value.indexOf("@") !== value.lastIndexOf("@")
+	)
+		return null;
+	const [rawLocal, rawDomain] = value.split("@");
+	const local = normalizeLocalpart(rawLocal!);
+	const domain = normalizeDomain(rawDomain!);
+	if (
+		!local ||
+		!domain ||
+		LOCALPART_EXCLUDED.test(local) ||
+		utf8Length(local) > 1023 ||
+		utf8Length(domain) > 1023
+	) {
+		return null;
+	}
+	return `${local}@${domain}`;
+}
+
+export function isNormalizedEndpointJid(value: string): boolean {
+	return normalizeEndpointJid(value) === value;
+}
+
+export function sameEndpointJid(left: string, right: string): boolean {
+	const preparedLeft = normalizeEndpointJid(left);
+	return preparedLeft !== null && preparedLeft === normalizeEndpointJid(right);
+}
+
+function utf8Length(value: string): number {
+	return new TextEncoder().encode(value).length;
+}
+
+function normalizeLocalpart(value: string): string | null {
+	initializePrecis();
+	try {
+		return usernamecasemapped_enforce(value) as string;
+	} catch (error) {
+		if (error instanceof Error || typeof error === "string") return null;
+		throw error;
+	}
+}
+
+function initializePrecis(): void {
+	if (precisInitialized) return;
+	const wasmPath = require.resolve("precis-wasm/precis_wasm_bg.wasm");
+	initSync({ module: readFileSync(wasmPath) });
+	precisInitialized = true;
+}
+
+function normalizeDomain(value: string): string | null {
+	const withoutFinalSeparator = value.replace(DNS_LABEL_SEPARATOR_AT_END, "");
+	if (
+		!withoutFinalSeparator ||
+		DOMAINPART_EXCLUDED.test(withoutFinalSeparator)
+	) {
+		return null;
+	}
+
+	const ipLiteral = normalizeIpLiteral(withoutFinalSeparator);
+	if (ipLiteral !== undefined) return ipLiteral;
+
+	try {
+		const ascii = idnHostname(withoutFinalSeparator);
+		const unicode = punycode
+			.toUnicode(ascii)
+			.normalize("NFC")
+			.toLowerCase()
+			.normalize("NFC");
+		return idnHostname(unicode) === ascii ? unicode : null;
+	} catch (error) {
+		if (error instanceof Error) return null;
+		throw error;
+	}
+}
+
+function normalizeIpLiteral(value: string): string | null | undefined {
+	if (!value.startsWith("[") && !value.endsWith("]")) return undefined;
+	if (!value.startsWith("[") || !value.endsWith("]")) return null;
+
+	const content = value.slice(1, -1);
+	const zoneDelimiter = content.indexOf("%25");
+	const address =
+		zoneDelimiter === -1 ? content : content.slice(0, zoneDelimiter);
+	const zone =
+		zoneDelimiter === -1 ? undefined : content.slice(zoneDelimiter + 3);
+	if (isIP(address) !== 6 || (zone !== undefined && !IPV6_ZONE.test(zone)))
+		return null;
+
+	const hostname = new URL(`http://[${address}]/`).hostname.toLowerCase();
+	if (zone === undefined) return hostname;
+	const normalizedZone = zone.replace(/%[0-9A-Fa-f]{2}/gu, (encoded) =>
+		encoded.toUpperCase(),
+	);
+	return `${hostname.slice(0, -1)}%25${normalizedZone}]`;
+}
diff --git a/packages/agent-xmpp/protocol/src/namespaces.ts b/packages/agent-xmpp/protocol/src/namespaces.ts
new file mode 100644
index 000000000..4fbf6218b
--- /dev/null
+++ b/packages/agent-xmpp/protocol/src/namespaces.ts
@@ -0,0 +1,65 @@
+/** ProtoXEP XMPP Agent Gateway 0.0.3 protocol constants. */
+export interface AgentXmppNamespaces {
+	directory: typeof AGENT_DIRECTORY_NS;
+	api: typeof AGENT_API_NS;
+	manifest: typeof AGENT_MANIFEST_FEATURE;
+	schema: typeof AGENT_SCHEMA_FEATURE;
+	selfRegister: typeof AGENT_SELF_REGISTER_FEATURE;
+	admin: typeof AGENT_ADMIN_FEATURE;
+	tools: typeof AGENT_TOOLS_NS;
+	tool: typeof AGENT_TOOL_NS;
+	endpoint: typeof AGENT_ENDPOINT_NS;
+	endpointInfo: typeof AGENT_ENDPOINT_INFO_FORM;
+	toolInfo: typeof AGENT_TOOL_INFO_FORM;
+	task: typeof AGENT_TASK_NS;
+	progress: typeof AGENT_TASK_PROGRESS_FEATURE;
+	cancel: typeof AGENT_TASK_CANCEL_FEATURE;
+	input: typeof AGENT_TASK_INPUT_FEATURE;
+	hashes: typeof HASHES_NS;
+	rsm: typeof RSM_NS;
+}
+
+export const AGENT_DIRECTORY_NS = "urn:xmpp:agent-directory:0";
+export const AGENT_API_NS = "urn:xmpp:agent-api:0";
+export const AGENT_MANIFEST_FEATURE = `${AGENT_API_NS}#manifest` as const;
+export const AGENT_SCHEMA_FEATURE = `${AGENT_API_NS}#schema` as const;
+export const AGENT_SELF_REGISTER_FEATURE =
+	`${AGENT_API_NS}#self-register` as const;
+export const AGENT_ADMIN_FEATURE = `${AGENT_API_NS}#admin` as const;
+export const AGENT_TOOLS_NS = "urn:xmpp:agent-tools:0";
+export const AGENT_TOOL_NS = "urn:xmpp:agent-tool:0";
+export const AGENT_ENDPOINT_NS = "urn:xmpp:agent-endpoint:0";
+export const AGENT_ENDPOINT_INFO_FORM = "urn:xmpp:agent-endpoint-info:0";
+export const AGENT_TOOL_INFO_FORM = "urn:xmpp:agent-tool-info:0";
+export const AGENT_TASK_NS = "urn:xmpp:agent-task:0";
+export const AGENT_TASK_PROGRESS_FEATURE = `${AGENT_TASK_NS}#progress` as const;
+export const AGENT_TASK_CANCEL_FEATURE = `${AGENT_TASK_NS}#cancel` as const;
+export const AGENT_TASK_INPUT_FEATURE = `${AGENT_TASK_NS}#input` as const;
+export const HASHES_NS = "urn:xmpp:hashes:2";
+export const RSM_NS = "http://jabber.org/protocol/rsm";
+
+export const DEFAULT_PROTOCOL_NAMESPACES: Readonly<AgentXmppNamespaces> =
+	Object.freeze({
+		directory: AGENT_DIRECTORY_NS,
+		api: AGENT_API_NS,
+		manifest: AGENT_MANIFEST_FEATURE,
+		schema: AGENT_SCHEMA_FEATURE,
+		selfRegister: AGENT_SELF_REGISTER_FEATURE,
+		admin: AGENT_ADMIN_FEATURE,
+		tools: AGENT_TOOLS_NS,
+		tool: AGENT_TOOL_NS,
+		endpoint: AGENT_ENDPOINT_NS,
+		endpointInfo: AGENT_ENDPOINT_INFO_FORM,
+		toolInfo: AGENT_TOOL_INFO_FORM,
+		task: AGENT_TASK_NS,
+		progress: AGENT_TASK_PROGRESS_FEATURE,
+		cancel: AGENT_TASK_CANCEL_FEATURE,
+		input: AGENT_TASK_INPUT_FEATURE,
+		hashes: HASHES_NS,
+		rsm: RSM_NS,
+	});
+
+export const AGENT_MANIFEST_SPEC_VERSION = "0";
+export const AGENT_API_SPEC_VERSION = AGENT_MANIFEST_SPEC_VERSION;
+export const JSON_MEDIA_TYPE = "application/json";
+export const JSON_SCHEMA_MEDIA_TYPE = "application/schema+json";
diff --git a/packages/agent-xmpp/protocol/src/strict-json.test.ts b/packages/agent-xmpp/protocol/src/strict-json.test.ts
new file mode 100644
index 000000000..3bb513132
--- /dev/null
+++ b/packages/agent-xmpp/protocol/src/strict-json.test.ts
@@ -0,0 +1,10 @@
+import { describe, expect, it } from "bun:test";
+
+import { parseStrictJson } from "./strict-json.js";
+
+describe("parseStrictJson", () => {
+	it("parses many numeric tokens without copying each remaining suffix", () => {
+		const values = Array.from({ length: 20_000 }, (_, index) => index % 10);
+		expect(parseStrictJson(JSON.stringify(values))).toEqual(values);
+	});
+});
diff --git a/packages/agent-xmpp/protocol/src/strict-json.ts b/packages/agent-xmpp/protocol/src/strict-json.ts
new file mode 100644
index 000000000..a69151a5a
--- /dev/null
+++ b/packages/agent-xmpp/protocol/src/strict-json.ts
@@ -0,0 +1,204 @@
+export interface StrictJsonLimits {
+	maxBytes: number;
+	maxDepth: number;
+	maxStringBytes: number;
+	maxMembers: number;
+}
+
+export const DEFAULT_JSON_LIMITS: Readonly<StrictJsonLimits> = Object.freeze({
+	maxBytes: 1_048_576,
+	maxDepth: 64,
+	maxStringBytes: 1_048_576,
+	maxMembers: 100_000,
+});
+
+export class JsonResourceLimitError extends Error {}
+
+const utf8Length = (value: string): number =>
+	new TextEncoder().encode(value).length;
+const NUMBER_PATTERN = /-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/y;
+
+/** A bounded JSON parser that detects duplicate object names before information is lost. */
+export function parseStrictJson(
+	text: string,
+	limits: Partial<StrictJsonLimits> = {},
+): unknown {
+	const resolved = { ...DEFAULT_JSON_LIMITS, ...limits };
+	assertJsonLimits(resolved);
+	if (utf8Length(text) > resolved.maxBytes)
+		throw new JsonResourceLimitError("JSON payload exceeds byte limit");
+	let offset = 0;
+	let members = 0;
+	const fail = (message: string): never => {
+		throw new Error(`${message} at JSON offset ${offset}`);
+	};
+	const whitespace = (): void => {
+		while (offset < text.length && /[\t\n\r ]/.test(text[offset]!)) offset++;
+	};
+	const parseString = (): string => {
+		if (text[offset++] !== '"') return fail("expected string");
+		let result = "";
+		while (offset < text.length) {
+			const character = text[offset++]!;
+			if (character === '"') {
+				if (utf8Length(result) > resolved.maxStringBytes) {
+					throw new JsonResourceLimitError(
+						`JSON string exceeds byte limit at JSON offset ${offset}`,
+					);
+				}
+				assertUnicodeScalarString(result);
+				return result;
+			}
+			if (character === "\\") {
+				const escape = text[offset++]!;
+				const simple: Record<string, string> = {
+					'"': '"',
+					"\\": "\\",
+					"/": "/",
+					b: "\b",
+					f: "\f",
+					n: "\n",
+					r: "\r",
+					t: "\t",
+				};
+				if (escape in simple) result += simple[escape];
+				else if (escape === "u") {
+					const hex = text.slice(offset, offset + 4);
+					if (!/^[0-9a-fA-F]{4}$/.test(hex)) fail("invalid Unicode escape");
+					result += String.fromCharCode(Number.parseInt(hex, 16));
+					offset += 4;
+				} else fail("invalid string escape");
+			} else {
+				if (character.charCodeAt(0) < 0x20) fail("unescaped control character");
+				result += character;
+			}
+		}
+		return fail("unterminated string");
+	};
+	const parseNumber = (): number => {
+		NUMBER_PATTERN.lastIndex = offset;
+		const match = NUMBER_PATTERN.exec(text);
+		if (!match) return fail("invalid number");
+		offset = NUMBER_PATTERN.lastIndex;
+		const number = Number(match[0]);
+		if (!Number.isFinite(number)) fail("number is not finite");
+		if (/^-?[0-9]+$/.test(match[0])) {
+			const integer = BigInt(match[0]);
+			if (
+				integer > BigInt(Number.MAX_SAFE_INTEGER) ||
+				integer < BigInt(Number.MIN_SAFE_INTEGER)
+			) {
+				fail("integer is outside the lossless range");
+			}
+		}
+		return number;
+	};
+	const parseValue = (depth: number): unknown => {
+		if (depth > resolved.maxDepth) {
+			throw new JsonResourceLimitError(
+				`JSON nesting exceeds depth limit at JSON offset ${offset}`,
+			);
+		}
+		whitespace();
+		const character = text[offset];
+		if (character === '"') return parseString();
+		if (character === "{") {
+			offset++;
+			const result: Record<string, unknown> = {};
+			const names = new Set<string>();
+			whitespace();
+			if (text[offset] === "}") {
+				offset++;
+				return result;
+			}
+			while (true) {
+				whitespace();
+				if (text[offset] !== '"') fail("expected object member name");
+				const name = parseString();
+				if (names.has(name))
+					fail(`duplicate object member ${JSON.stringify(name)}`);
+				names.add(name);
+				if (++members > resolved.maxMembers) {
+					throw new JsonResourceLimitError(
+						`JSON member count exceeds limit at JSON offset ${offset}`,
+					);
+				}
+				whitespace();
+				if (text[offset++] !== ":") fail("expected colon");
+				result[name] = parseValue(depth + 1);
+				whitespace();
+				const separator = text[offset++];
+				if (separator === "}") return result;
+				if (separator !== ",") fail("expected comma or object end");
+			}
+		}
+		if (character === "[") {
+			offset++;
+			const result: unknown[] = [];
+			whitespace();
+			if (text[offset] === "]") {
+				offset++;
+				return result;
+			}
+			while (true) {
+				if (++members > resolved.maxMembers) {
+					throw new JsonResourceLimitError(
+						`JSON member count exceeds limit at JSON offset ${offset}`,
+					);
+				}
+				result.push(parseValue(depth + 1));
+				whitespace();
+				const separator = text[offset++];
+				if (separator === "]") return result;
+				if (separator !== ",") fail("expected comma or array end");
+			}
+		}
+		if (text.startsWith("true", offset)) {
+			offset += 4;
+			return true;
+		}
+		if (text.startsWith("false", offset)) {
+			offset += 5;
+			return false;
+		}
+		if (text.startsWith("null", offset)) {
+			offset += 4;
+			return null;
+		}
+		if (
+			character === "-" ||
+			(character !== undefined && /[0-9]/.test(character))
+		)
+			return parseNumber();
+		return fail("expected JSON value");
+	};
+	const value = parseValue(0);
+	whitespace();
+	if (offset !== text.length) fail("trailing data");
+	return value;
+}
+
+function assertJsonLimits(limits: StrictJsonLimits): void {
+	for (const [name, value] of Object.entries(limits)) {
+		if (!Number.isSafeInteger(value) || value < (name === "maxDepth" ? 0 : 1)) {
+			throw new Error(
+				`${name} must be a ${name === "maxDepth" ? "non-negative" : "positive"} safe integer`,
+			);
+		}
+	}
+}
+
+export function assertUnicodeScalarString(value: string): void {
+	for (let index = 0; index < value.length; index++) {
+		const code = value.charCodeAt(index);
+		if (code >= 0xd800 && code <= 0xdbff) {
+			const low = value.charCodeAt(index + 1);
+			if (!Number.isInteger(low) || low < 0xdc00 || low > 0xdfff) {
+				throw new Error("lone high surrogate is not permitted");
+			}
+			index++;
+		} else if (code >= 0xdc00 && code <= 0xdfff) {
+			throw new Error("lone low surrogate is not permitted");
+		}
+	}
+}
diff --git a/packages/agent-xmpp/protocol/tsconfig.json b/packages/agent-xmpp/protocol/tsconfig.json
new file mode 100644
index 000000000..5d0f16ada
--- /dev/null
+++ b/packages/agent-xmpp/protocol/tsconfig.json
@@ -0,0 +1,19 @@
+{
+	"compilerOptions": {
+		"target": "ES2022",
+		"module": "NodeNext",
+		"moduleResolution": "NodeNext",
+		"lib": ["ES2022"],
+		"outDir": "./dist",
+		"rootDir": "./src",
+		"strict": true,
+		"esModuleInterop": true,
+		"skipLibCheck": true,
+		"declaration": true,
+		"declarationMap": true,
+		"sourceMap": true,
+		"types": ["node"]
+	},
+	"include": ["src/**/*"],
+	"exclude": ["node_modules", "dist", "src/**/*.test.ts"]
+}
diff --git a/packages/auth/package.json b/packages/auth/package.json
index ea671ffcd..a1950ebe8 100644
--- a/packages/auth/package.json
+++ b/packages/auth/package.json
@@ -11,23 +11,27 @@
 		"./workspace": "./src/workspace.ts"
 	},
 	"scripts": {
-		"auth:generate": "better-auth generate --config src/auth.ts --output ../db/prisma/schema.prisma --y",
+		"auth:generate": "auth generate --config src/auth.ts --output ../db/prisma/schema.prisma --y",
 		"check-types": "tsc --noEmit",
+		"oauth:reconcile-client": "bun scripts/reconcile-oauth-client.ts",
+		"oauth:register-client": "bun scripts/register-oauth-client.ts",
 		"lint": "biome check .",
 		"test": "bun test",
 		"clean": "rm -rf .turbo node_modules"
 	},
 	"dependencies": {
-		"@better-auth/api-key": "1.6.25",
-		"@better-auth/sso": "1.6.25",
+		"@better-auth/api-key": "1.7.3",
+		"@better-auth/core": "1.7.3",
+		"@better-auth/oauth-provider": "1.7.3",
+		"@better-auth/sso": "1.7.3",
 		"@crm/db": "workspace:*",
 		"@crm/env": "workspace:*",
 		"@crm/validation": "workspace:*",
-		"better-auth": "^1.6.25",
-		"zod": "^4.4.3"
+		"better-auth": "1.7.3",
+		"zod": "^4.5.4"
 	},
 	"peerDependencies": {
-		"react": "^19.2.0"
+		"react": "^19.2.8"
 	},
 	"peerDependenciesMeta": {
 		"react": {
@@ -35,11 +39,11 @@
 		}
 	},
 	"devDependencies": {
-		"@better-auth/cli": "^1.4.22",
 		"@crm/typescript-config": "workspace:*",
-		"@types/node": "^24.10.1",
+		"@types/node": "^26.5.0",
 		"@types/react": "^19.2.18",
+		"auth": "1.7.3",
 		"react": "^19.2.8",
-		"typescript": "5.9.2"
+		"typescript": "7.0.2"
 	}
 }
diff --git a/packages/auth/scripts/reconcile-oauth-client.ts b/packages/auth/scripts/reconcile-oauth-client.ts
new file mode 100644
index 000000000..1a0dd8ebe
--- /dev/null
+++ b/packages/auth/scripts/reconcile-oauth-client.ts
@@ -0,0 +1,7 @@
+import { db } from "@crm/db";
+import { ensureOfficialOAuthClient } from "../src/oauth-client";
+
+await ensureOfficialOAuthClient();
+await db.$disconnect();
+
+process.stdout.write("Official OAuth client reconciled.\n");
diff --git a/packages/auth/scripts/register-oauth-client.ts b/packages/auth/scripts/register-oauth-client.ts
new file mode 100644
index 000000000..b1f8382ec
--- /dev/null
+++ b/packages/auth/scripts/register-oauth-client.ts
@@ -0,0 +1,153 @@
+import { db } from "@crm/db";
+import { z } from "zod";
+import { auth } from "../src/auth";
+import { OAUTH, oauthClientFields } from "../src/oauth-config";
+
+function parseOptions(args: string[]) {
+	const values = new Map<string, string[]>();
+	const allowed = new Set([
+		"--client-id",
+		"--name",
+		"--redirect-uri",
+		"--post-logout-redirect-uri",
+	]);
+
+	for (let index = 0; index < args.length; index += 2) {
+		const key = args[index];
+		const value = args[index + 1];
+		if (!key || !allowed.has(key) || !value) throw usageError();
+		const entries = values.get(key) ?? [];
+		entries.push(value);
+		values.set(key, entries);
+	}
+
+	return z
+		.object({
+			clientId: z
+				.string()
+				.trim()
+				.min(1)
+				.max(200)
+				.regex(/^[A-Za-z0-9._~-]+$/),
+			name: z.string().trim().min(1).max(255),
+			redirectUris: z.array(redirectUri).min(1),
+			postLogoutRedirectUris: z.array(redirectUri),
+		})
+		.parse({
+			clientId: singleValue(values, "--client-id"),
+			name: singleValue(values, "--name"),
+			redirectUris: values.get("--redirect-uri") ?? [],
+			postLogoutRedirectUris: values.get("--post-logout-redirect-uri") ?? [],
+		});
+}
+
+const redirectUri = z.string().superRefine((value, context) => {
+	let uri: URL;
+
+	try {
+		uri = new URL(value);
+	} catch {
+		context.addIssue({ code: "custom", message: "Redirect URI is invalid." });
+		return;
+	}
+
+	if (uri.hash) {
+		context.addIssue({
+			code: "custom",
+			message: "Redirect URI contains a fragment.",
+		});
+	}
+
+	if (value.includes("*")) {
+		context.addIssue({
+			code: "custom",
+			message: "Redirect URI contains a wildcard.",
+		});
+	}
+
+	if (uri.username || uri.password) {
+		context.addIssue({
+			code: "custom",
+			message: "Redirect URI contains user information.",
+		});
+	}
+
+	if (uri.protocol === "https:" && uri.hostname) return;
+
+	if (
+		uri.protocol === "http:" &&
+		["127.0.0.1", "[::1]", "localhost"].includes(uri.hostname)
+	) {
+		return;
+	}
+
+	if (uri.protocol.slice(0, -1).includes(".") && !uri.host) return;
+
+	context.addIssue({
+		code: "custom",
+		message:
+			"Redirect URI must use HTTPS, loopback HTTP, or a reverse-domain private scheme.",
+	});
+});
+
+function singleValue(values: Map<string, string[]>, key: string) {
+	const entries = values.get(key);
+	if (entries?.length !== 1) throw usageError();
+	return entries[0];
+}
+
+function usageError() {
+	return new Error(
+		"Usage: bun run oauth:register-client --client-id <id> --name <name> --redirect-uri <uri> [--redirect-uri <uri>] [--post-logout-redirect-uri <uri>]",
+	);
+}
+
+const options = parseOptions(process.argv.slice(2));
+
+await auth.$context;
+
+if (options.clientId === OAUTH.officialClient.id) {
+	throw new Error(
+		"The official OAuth client is managed by the reconciliation command.",
+	);
+}
+
+const existing = await db.oauthClient.findUnique({
+	where: { clientId: options.clientId },
+	select: { clientId: true },
+});
+
+if (existing)
+	throw new Error(`OAuth client ${options.clientId} already exists.`);
+
+const now = new Date();
+
+await db.$transaction(async (transaction) => {
+	await transaction.oauthClient.create({
+		data: {
+			id: options.clientId,
+			...oauthClientFields({
+				clientId: options.clientId,
+				name: options.name,
+				redirectUris: options.redirectUris,
+				postLogoutRedirectUris: options.postLogoutRedirectUris,
+				skipConsent: false,
+			}),
+			createdAt: now,
+			updatedAt: now,
+		},
+	});
+
+	await transaction.oauthClientResource.create({
+		data: {
+			id: `oauth-client-resource:${options.clientId}`,
+			clientId: options.clientId,
+			resourceId: OAUTH.resource,
+			createdAt: now,
+		},
+	});
+});
+
+await db.$disconnect();
+
+process.stdout.write(`Registered OAuth client ${options.clientId}.\n`);
diff --git a/packages/auth/src/auth.ts b/packages/auth/src/auth.ts
index c59c98254..6be0d02a1 100644
--- a/packages/auth/src/auth.ts
+++ b/packages/auth/src/auth.ts
@@ -1,16 +1,21 @@
 import { apiKey } from "@better-auth/api-key";
+import { oauthProvider } from "@better-auth/oauth-provider";
 import { sso } from "@better-auth/sso";
 import { db } from "@crm/db";
+import { scopedDb } from "@crm/db/tenant-scope";
 import { schemas } from "@crm/validation";
+import { parseActiveOrganizationClaim } from "@crm/validation/active-organization-claim";
 import { type BetterAuthOptions, betterAuth } from "better-auth";
 import { prismaAdapter } from "better-auth/adapters/prisma";
 import { APIError } from "better-auth/api";
 import { genericOAuth } from "better-auth/plugins/generic-oauth";
+import { jwt } from "better-auth/plugins/jwt";
 import { organization } from "better-auth/plugins/organization";
 import { API_KEY_EXPIRATION, API_KEY_HEADER, API_KEY_PREFIX } from "./api-keys";
 import { AUTH_COOKIE_PREFIX } from "./cookies";
 import { env } from "./env";
-import { ensureWorkspaceMembership } from "./organization";
+import { OAUTH, OAUTH_ORGANIZATION_CLAIM, OAUTH_SCOPES } from "./oauth-config";
+import { resolveActiveOrganization, workspaceRoleOf } from "./organization";
 import {
 	GOOGLE_PROVIDER_ID,
 	MICROSOFT_PROVIDER_ID,
@@ -24,6 +29,7 @@ import { rememberSlackInstall, replaceSlackConnection } from "./slack-grant";
 import { SLACK_REQUESTED_SCOPES, SLACK_USER_SCOPES } from "./slack-scopes";
 import { queueSlackInventorySync } from "./slack-sync";
 import {
+	googleHostedDomain,
 	hasSignInAllowList,
 	isWorkspaceEmail,
 	primaryWorkspaceDomain,
@@ -32,7 +38,7 @@ import {
 const socialProviders: NonNullable<BetterAuthOptions["socialProviders"]> = {};
 const slackOAuth = env.slack;
 const slackRedirectUri = new URL(
-	"/api/auth/oauth2/callback/slack",
+	"/api/auth/callback/slack",
 	env.apiUrl,
 ).toString();
 
@@ -45,7 +51,7 @@ if (env.google) {
 		accessType: "offline",
 	};
 
-	const hostedDomain = primaryWorkspaceDomain();
+	const hostedDomain = googleHostedDomain();
 	if (hostedDomain) google.hd = hostedDomain;
 
 	socialProviders.google = google;
@@ -72,8 +78,9 @@ if (env.microsoft) {
 export const auth = betterAuth({
 	appName: "CRM",
 	baseURL: env.apiUrl,
+	disabledPaths: ["/token"],
 
-	database: prismaAdapter(db, {
+	database: prismaAdapter(scopedDb, {
 		provider: "postgresql",
 	}),
 
@@ -122,6 +129,60 @@ export const auth = betterAuth({
 	},
 
 	plugins: [
+		jwt({
+			disableSettingJwtHeader: true,
+			jwt: {
+				issuer: OAUTH.issuer,
+				audience: OAUTH.resource,
+				expirationTime: `${OAUTH.accessTokenTtlSeconds}s`,
+			},
+		}),
+		oauthProvider({
+			loginPage: OAUTH.loginPage,
+			consentPage: OAUTH.consentPage,
+			postLogin: {
+				page: OAUTH.consentPage,
+				shouldRedirect: async ({ user, session }) => {
+					await oauthOrganizationId(
+						user.id,
+						parseActiveOrganizationClaim(session.activeOrganizationId),
+					);
+					return false;
+				},
+				consentReferenceId: ({ user, session }) =>
+					oauthOrganizationId(
+						user.id,
+						parseActiveOrganizationClaim(session.activeOrganizationId),
+					),
+			},
+			customAccessTokenClaims: ({ referenceId }) =>
+				referenceId ? { [OAUTH_ORGANIZATION_CLAIM]: referenceId } : {},
+			scopes: [...OAUTH_SCOPES],
+			resources: [
+				{
+					identifier: OAUTH.resource,
+					name: "CompCRM API",
+					accessTokenTtl: OAUTH.accessTokenTtlSeconds,
+					refreshTokenTtl: OAUTH.refreshTokenTtlSeconds,
+					allowedScopes: [...OAUTH_SCOPES],
+				},
+			],
+			resourceSeedMode: "overwrite",
+			cachedResources: new Set([OAUTH.resource]),
+			enforcePerClientResources: true,
+			clientRegistrationDefaultResources: [OAUTH.resource],
+			cachedTrustedClients: new Set([OAUTH.officialClient.id]),
+			accessTokenExpiresIn: OAUTH.accessTokenTtlSeconds,
+			idTokenExpiresIn: OAUTH.idTokenTtlSeconds,
+			refreshTokenExpiresIn: OAUTH.refreshTokenTtlSeconds,
+			refreshTokenReuseInterval: OAUTH.refreshTokenReuseIntervalSeconds,
+			codeExpiresIn: OAUTH.authorizationCodeTtlSeconds,
+			grantTypes: ["authorization_code", "refresh_token"],
+			allowDynamicClientRegistration: false,
+			allowUnauthenticatedClientRegistration: false,
+			clientPrivileges: () => false,
+			resourcePrivileges: () => false,
+		}),
 		...(slackOAuth
 			? [
 					genericOAuth({
@@ -234,7 +295,8 @@ export const auth = betterAuth({
 		apiKey({
 			apiKeyHeaders: API_KEY_HEADER,
 			defaultPrefix: API_KEY_PREFIX,
-			enableSessionForAPIKeys: true,
+			enableMetadata: true,
+			references: "organization",
 			requireName: true,
 			defaultKeyLength: 32,
 			maximumNameLength: 64,
@@ -283,10 +345,12 @@ export const auth = betterAuth({
 		session: {
 			create: {
 				before: async (session) => {
-					const workspaceId = await ensureWorkspaceMembership(session.userId);
+					const activeOrganizationId = await resolveActiveOrganization(
+						session.userId,
+					);
 
 					return {
-						data: { ...session, activeOrganizationId: workspaceId ?? null },
+						data: { ...session, activeOrganizationId },
 					};
 				},
 
@@ -304,7 +368,32 @@ export const auth = betterAuth({
 });
 
 export type Auth = typeof auth;
-export type Session = typeof auth.$Infer.Session;
+type BetterAuthSession = typeof auth.$Infer.Session;
+
+async function oauthOrganizationId(
+	userId: string,
+	activeOrganizationId: string | null,
+): Promise<string> {
+	if (!activeOrganizationId) {
+		throw new APIError("FORBIDDEN", {
+			message: "Select an organization before authorizing this application.",
+		});
+	}
+
+	if (!(await workspaceRoleOf(userId, activeOrganizationId))) {
+		throw new APIError("FORBIDDEN", {
+			message: "You are not a member of the selected organization.",
+		});
+	}
+
+	return activeOrganizationId;
+}
+
+export type Session = Omit<BetterAuthSession, "session"> & {
+	session: BetterAuthSession["session"] & {
+		activeOrganizationId: string | null;
+	};
+};
 export type SessionUser = Session["user"];
 
 async function replaceSlackAccount(account: {
diff --git a/packages/auth/src/client.ts b/packages/auth/src/client.ts
index 980a37b67..59c499687 100644
--- a/packages/auth/src/client.ts
+++ b/packages/auth/src/client.ts
@@ -1,11 +1,17 @@
 import { apiKeyClient } from "@better-auth/api-key/client";
+import { oauthProviderClient } from "@better-auth/oauth-provider/client";
 import { ssoClient } from "@better-auth/sso/client";
-import { genericOAuthClient } from "better-auth/client/plugins";
+import { organizationClient } from "better-auth/client/plugins";
 import { createAuthClient } from "better-auth/react";
 
 export const authClient = createAuthClient({
 	baseURL: globalThis.window?.location.origin,
-	plugins: [ssoClient(), genericOAuthClient(), apiKeyClient()],
+	plugins: [
+		ssoClient(),
+		apiKeyClient(),
+		oauthProviderClient(),
+		organizationClient(),
+	],
 });
 
 export const { getSession, signIn, signOut, useSession } = authClient;
diff --git a/packages/auth/src/index.ts b/packages/auth/src/index.ts
index 31fbcbaad..3128dbea7 100644
--- a/packages/auth/src/index.ts
+++ b/packages/auth/src/index.ts
@@ -13,18 +13,36 @@ export {
 	isMicrosoftConfigured,
 	isSlackConfigured,
 } from "./env";
+export { ensureOfficialOAuthClient } from "./oauth-client";
 export {
+	isOAuthScope,
+	OAUTH,
+	OAUTH_ORGANIZATION_CLAIM,
+	OAUTH_SCOPES,
+	type OAuthScope,
+	oauthClientFields,
+} from "./oauth-config";
+export {
+	getProtectedResourceMetadata,
+	verifyAccessTokenRequest,
+} from "./oauth-resource";
+export {
+	bearerChallenge,
+	oauthScopeFailure,
+	requiredCrmScope,
+} from "./oauth-scope";
+export {
+	activeOrganizationIdOf,
+	activeWorkspaceRoleOf,
 	canChangeRole,
 	canManageConnections,
 	canManageCurrency,
 	canManageTracking,
 	canRenameWorkspace,
-	DEFAULT_WORKSPACE_NAME,
-	ensureWorkspaceMembership,
 	isWorkspaceAdmin,
 	isWorkspaceRole,
+	resolveActiveOrganization,
 	toWorkspaceRole,
-	WORKSPACE_ID,
 	WORKSPACE_ROLES,
 	type WorkspaceRole,
 	workspaceRoleOf,
@@ -72,6 +90,11 @@ export {
 	ssoCallbackURL,
 	ssoProviderName,
 } from "./sso";
+export {
+	resolveSsoRequestOrganizationId,
+	runSsoRequestInTenant,
+	type SsoTenantRequest,
+} from "./sso-tenant-context";
 export {
 	hasSignInAllowList,
 	isWorkspaceEmail,
diff --git a/packages/auth/src/oauth-client.ts b/packages/auth/src/oauth-client.ts
new file mode 100644
index 000000000..4fc16183e
--- /dev/null
+++ b/packages/auth/src/oauth-client.ts
@@ -0,0 +1,48 @@
+import { db } from "@crm/db";
+import { auth } from "./auth";
+import { OAUTH, oauthClientFields } from "./oauth-config";
+
+const OFFICIAL_CLIENT_RESOURCE_ID = "compcrm-flutter-resource";
+
+export async function ensureOfficialOAuthClient(): Promise<void> {
+	await auth.$context;
+	const now = new Date();
+	const clientId = OAUTH.officialClient.id;
+	const clientFields = oauthClientFields({
+		clientId,
+		name: OAUTH.officialClient.name,
+		redirectUris: OAUTH.officialClient.redirectUris,
+		postLogoutRedirectUris: OAUTH.officialClient.postLogoutRedirectUris,
+		skipConsent: true,
+	});
+
+	await db.$transaction(async (transaction) => {
+		await transaction.oauthClient.upsert({
+			where: { clientId },
+			create: {
+				id: clientId,
+				...clientFields,
+				createdAt: now,
+				updatedAt: now,
+			},
+			update: {
+				...clientFields,
+				updatedAt: now,
+			},
+		});
+
+		await transaction.oauthClientResource.upsert({
+			where: { id: OFFICIAL_CLIENT_RESOURCE_ID },
+			create: {
+				id: OFFICIAL_CLIENT_RESOURCE_ID,
+				clientId,
+				resourceId: OAUTH.resource,
+				createdAt: now,
+			},
+			update: {
+				clientId,
+				resourceId: OAUTH.resource,
+			},
+		});
+	});
+}
diff --git a/packages/auth/src/oauth-config.ts b/packages/auth/src/oauth-config.ts
new file mode 100644
index 000000000..ab16c3d85
--- /dev/null
+++ b/packages/auth/src/oauth-config.ts
@@ -0,0 +1,72 @@
+import { DAY_SECONDS } from "./api-keys";
+import { apiUrl, appUrl } from "./env";
+
+const MINUTE_SECONDS = 60;
+const OAUTH_RESOURCE = new URL("/api", apiUrl).toString();
+
+export const OAUTH_ORGANIZATION_CLAIM = `${OAUTH_RESOURCE}/claims/organization_id`;
+
+export const OAUTH = {
+	issuer: new URL("/api/auth", apiUrl).toString(),
+	resource: OAUTH_RESOURCE,
+	loginPage: new URL("/sign-in", appUrl).toString(),
+	consentPage: new URL("/oauth/consent", appUrl).toString(),
+	accessTokenTtlSeconds: 10 * MINUTE_SECONDS,
+	idTokenTtlSeconds: 10 * MINUTE_SECONDS,
+	authorizationCodeTtlSeconds: 10 * MINUTE_SECONDS,
+	refreshTokenTtlSeconds: 30 * DAY_SECONDS,
+	refreshTokenReuseIntervalSeconds: 30,
+	scopes: {
+		identity: ["openid", "profile", "email", "offline_access"],
+		crm: {
+			read: "crm.read",
+			write: "crm.write",
+		},
+	},
+	officialClient: {
+		id: "compcrm-flutter",
+		name: "CompCRM for Flutter",
+		redirectUris: ["ai.trycrm.app:/oauth/callback"],
+		postLogoutRedirectUris: ["ai.trycrm.app:/oauth/logout"],
+	},
+} as const;
+
+export const OAUTH_SCOPES = [
+	...OAUTH.scopes.identity,
+	OAUTH.scopes.crm.read,
+	OAUTH.scopes.crm.write,
+] as const;
+
+export type OAuthScope = (typeof OAUTH_SCOPES)[number];
+
+export function isOAuthScope(value: string): value is OAuthScope {
+	return (OAUTH_SCOPES as readonly string[]).includes(value);
+}
+
+export function oauthClientFields(input: {
+	clientId: string;
+	name: string;
+	redirectUris: readonly string[];
+	postLogoutRedirectUris: readonly string[];
+	skipConsent: boolean;
+}) {
+	return {
+		clientId: input.clientId,
+		clientSecret: null,
+		disabled: false,
+		skipConsent: input.skipConsent,
+		enableEndSession: true,
+		scopes: [...OAUTH_SCOPES],
+		clientCredentialsScopes: [],
+		name: input.name,
+		contacts: [],
+		redirectUris: [...input.redirectUris],
+		postLogoutRedirectUris: [...input.postLogoutRedirectUris],
+		tokenEndpointAuthMethod: "none",
+		applicationType: "native",
+		grantTypes: ["authorization_code", "refresh_token"],
+		responseTypes: ["code"],
+		requirePKCE: true,
+		dpopBoundAccessTokens: false,
+	};
+}
diff --git a/packages/auth/src/oauth-resource.ts b/packages/auth/src/oauth-resource.ts
new file mode 100644
index 000000000..3611b76d6
--- /dev/null
+++ b/packages/auth/src/oauth-resource.ts
@@ -0,0 +1,45 @@
+import { oauthProviderResourceClient } from "@better-auth/oauth-provider/resource-client";
+import { APIError } from "better-auth/api";
+import type { ResourceRequestInput } from "better-auth/oauth2";
+import { verifyJwsAccessToken } from "better-auth/oauth2";
+import { auth } from "./auth";
+import { OAUTH } from "./oauth-config";
+
+const oauthResource = oauthProviderResourceClient(auth).getActions();
+const jwksCacheKey = {};
+
+type VerifyAccessTokenRequestOptions = {
+	verifyOptions?: {
+		issuer?: string | string[];
+		audience?: string | string[];
+	};
+};
+
+export const getProtectedResourceMetadata =
+	oauthResource.getProtectedResourceMetadata;
+
+export async function verifyAccessTokenRequest(
+	request: Request | ResourceRequestInput,
+	opts?: VerifyAccessTokenRequestOptions,
+) {
+	const authorization =
+		request instanceof Request
+			? request.headers.get("authorization")
+			: request.authorizationHeader;
+	const match = authorization?.match(/^Bearer\s+(.+)$/i);
+	if (!match?.[1]) {
+		throw new APIError("UNAUTHORIZED", {
+			message: "A bearer access token is required.",
+		});
+	}
+
+	return verifyJwsAccessToken(match[1], {
+		jwksFetch: () => auth.api.getJwks(),
+		jwksCacheKey,
+		verifyOptions: {
+			issuer: OAUTH.issuer,
+			audience: OAUTH.resource,
+			...opts?.verifyOptions,
+		},
+	});
+}
diff --git a/packages/auth/src/oauth-scope.ts b/packages/auth/src/oauth-scope.ts
new file mode 100644
index 000000000..3fbb8366f
--- /dev/null
+++ b/packages/auth/src/oauth-scope.ts
@@ -0,0 +1,22 @@
+import { OAUTH } from "./oauth-config";
+
+export function requiredCrmScope(write: boolean): string {
+	return write ? OAUTH.scopes.crm.write : OAUTH.scopes.crm.read;
+}
+
+export function bearerChallenge(error?: string, scope?: string): string {
+	const errorPart = error ? `, error="${error}"` : "";
+	const scopePart = scope ? `, scope="${scope}"` : "";
+	return `Bearer realm="compcrm"${errorPart}${scopePart}`;
+}
+
+export function oauthScopeFailure(
+	scopes: ReadonlySet<string>,
+	requiredScope: string,
+): { challenge: string; message: string } | null {
+	if (scopes.has(requiredScope)) return null;
+	return {
+		challenge: bearerChallenge("insufficient_scope", requiredScope),
+		message: `The token requires ${requiredScope}.`,
+	};
+}
diff --git a/packages/auth/src/organization.ts b/packages/auth/src/organization.ts
index df863e2f3..6342ecaa4 100644
--- a/packages/auth/src/organization.ts
+++ b/packages/auth/src/organization.ts
@@ -1,9 +1,6 @@
 import { type Db, db } from "@crm/db";
-import { WORKSPACE_ID, workspaceSlug } from "@crm/db/workspace";
-
-export { WORKSPACE_ID };
-
-export const DEFAULT_WORKSPACE_NAME = "CRM";
+import { currentOrganizationId } from "@crm/db/tenant-context";
+import { parseActiveOrganizationClaim } from "@crm/validation/active-organization-claim";
 
 export const WORKSPACE_ROLES = ["owner", "admin", "member"] as const;
 
@@ -37,79 +34,99 @@ export function canManageTracking(role: WorkspaceRole | null): boolean {
 	return isWorkspaceAdmin(role);
 }
 
-export async function ensureWorkspaceMembership(
+export function activeOrganizationIdOf(
+	session: {
+		session: { activeOrganizationId: unknown };
+	} | null,
+): string | null {
+	return parseActiveOrganizationClaim(session?.session.activeOrganizationId);
+}
+
+export async function resolveActiveOrganization(
 	userId: string,
-): Promise<string | undefined> {
-	try {
-		return await db.$transaction(async (tx) => {
-			const workspace = await tx.organization.upsert({
-				where: { id: WORKSPACE_ID },
-				create: {
-					id: WORKSPACE_ID,
-					name: DEFAULT_WORKSPACE_NAME,
-					slug: workspaceSlug(DEFAULT_WORKSPACE_NAME),
-					createdAt: new Date(),
-				},
-				update: {},
-				select: { id: true, name: true, slug: true },
-			});
+): Promise<string | null> {
+	const membership = await db.member.findFirst({
+		where: { userId },
+		orderBy: { createdAt: "asc" },
+		select: { organizationId: true },
+	});
 
-			const slug = workspaceSlug(workspace.name);
+	if (!membership) return null;
+	await syncKaneoMembership(userId, membership.organizationId);
+	return membership.organizationId;
+}
 
-			if (workspace.slug !== slug) {
-				await tx.organization.update({
-					where: { id: workspace.id },
-					data: { slug },
-				});
+async function syncKaneoMembership(
+	userId: string,
+	organizationId: string,
+): Promise<void> {
+	try {
+		await db.$transaction(async (tx) => {
+			const workspace = await tx.organization.findUnique({
+				where: { id: organizationId },
+				select: { name: true, slug: true, createdAt: true },
+			});
+			if (!workspace) {
+				return;
 			}
 
-			const enrolled = await tx.member.count({
-				where: { organizationId: workspace.id },
+			await tx.workspace.upsert({
+				where: { id: organizationId },
+				create: {
+					id: organizationId,
+					name: workspace.name,
+					slug: workspace.slug,
+					createdAt: workspace.createdAt,
+				},
+				update: { name: workspace.name, slug: workspace.slug },
 			});
 
-			if (enrolled === 0) {
-				const existing = await tx.user.findMany({
-					select: { id: true },
-					orderBy: [{ createdAt: "asc" }, { id: "asc" }],
-				});
-
-				await tx.member.createMany({
-					data: existing.map((user, index) => ({
-						id: crypto.randomUUID(),
-						organizationId: workspace.id,
-						userId: user.id,
-						role: index === 0 ? "owner" : "member",
-						createdAt: new Date(),
-					})),
-					skipDuplicates: true,
-				});
-			}
-
-			await tx.member.upsert({
+			const membership = await tx.member.findUnique({
 				where: {
-					organizationId_userId: { organizationId: workspace.id, userId },
+					organizationId_userId: { organizationId, userId },
 				},
-				create: {
+				select: { role: true },
+			});
+			const role = toKaneoRole(toWorkspaceRole(membership?.role ?? "member"));
+
+			const existing = await tx.workspaceMember.findFirst({
+				where: { workspaceId: organizationId, userId },
+				select: { id: true, role: true },
+			});
+			if (existing) {
+				if (existing.role !== role) {
+					await tx.workspaceMember.update({
+						where: { id: existing.id },
+						data: { role },
+					});
+				}
+				return;
+			}
+			await tx.workspaceMember.create({
+				data: {
 					id: crypto.randomUUID(),
-					organizationId: workspace.id,
+					workspaceId: organizationId,
 					userId,
-					role: "member",
-					createdAt: new Date(),
+					role,
+					joinedAt: new Date(),
 				},
-				update: {},
 			});
-
-			return workspace.id;
 		});
 	} catch (error) {
 		console.error(
-			`[auth] could not enrol user ${userId} in workspace ${WORKSPACE_ID}; the next sign-in will retry`,
+			`[auth] could not sync user ${userId} into the kaneo workspace ${organizationId}; the next sign-in will retry`,
 			error,
 		);
-		return undefined;
 	}
 }
 
+function toKaneoRole(role: WorkspaceRole): string {
+	if (role === "owner" || role === "admin") {
+		return "admin";
+	}
+	return "member";
+}
+
 export function toWorkspaceRole(value: string): WorkspaceRole {
 	return isWorkspaceRole(value) ? value : "member";
 }
@@ -118,12 +135,20 @@ export type WorkspaceMemberReader = Pick<Db, "member">;
 
 export async function workspaceRoleOf(
 	userId: string,
+	organizationId: string,
 	client: WorkspaceMemberReader = db,
 ): Promise<WorkspaceRole | null> {
 	const member = await client.member.findUnique({
-		where: { organizationId_userId: { organizationId: WORKSPACE_ID, userId } },
+		where: { organizationId_userId: { organizationId, userId } },
 		select: { role: true },
 	});
 
 	return member ? toWorkspaceRole(member.role) : null;
 }
+
+export async function activeWorkspaceRoleOf(
+	userId: string,
+	client: WorkspaceMemberReader = db,
+): Promise<WorkspaceRole | null> {
+	return workspaceRoleOf(userId, currentOrganizationId(), client);
+}
diff --git a/packages/auth/src/slack-connect.ts b/packages/auth/src/slack-connect.ts
index f8fa9a692..d3eb9e2b4 100644
--- a/packages/auth/src/slack-connect.ts
+++ b/packages/auth/src/slack-connect.ts
@@ -8,7 +8,6 @@ import {
 import * as z from "zod";
 import {
 	canManageConnections,
-	WORKSPACE_ID,
 	WORKSPACE_ROLES,
 	workspaceRoleOf,
 } from "./organization";
@@ -18,16 +17,25 @@ const CONNECT_MANAGER_ROLES = WORKSPACE_ROLES.filter((role) =>
 	canManageConnections(role),
 );
 
-const SLACK_CONNECT_START_PATHS = ["/oauth2/link", "/sign-in/oauth2"];
-const OAUTH_CALLBACK_PATH = "/oauth2/callback";
+const SLACK_CONNECT_START_PATH = "/link-social";
+const OAUTH_CALLBACK_PATH = "/callback";
 
-const connectStartBody = z.object({ providerId: z.string() });
-const callbackParams = z.object({ providerId: z.string() });
+const connectStartBody = z.object({ provider: z.string() });
+const callbackParams = z.object({ id: z.string() });
+const callbackQuery = z.object({ state: z.string() });
+const oauthState = z.object({
+	link: z
+		.object({
+			email: z.string(),
+			userId: z.string(),
+		})
+		.optional(),
+});
 
 export const slackConnectGuard = createAuthMiddleware(async (ctx) => {
 	const guarded =
 		startsSlackConnect(ctx.path, ctx.body) ||
-		completesSlackConnect(ctx.path, ctx.params);
+		(await completesSlackConnect(ctx.path, ctx.params, ctx.query));
 	if (!guarded) return;
 
 	const session = await getSessionFromCtx(ctx, { disableCookieCache: true });
@@ -36,12 +44,18 @@ export const slackConnectGuard = createAuthMiddleware(async (ctx) => {
 			message: "Sign in to the CRM before you connect Slack.",
 		});
 	}
+	const organizationId = session.session.activeOrganizationId;
+	if (!organizationId) {
+		throw new APIError("FORBIDDEN", {
+			message: "Join an organization before you connect Slack.",
+		});
+	}
 
 	const [role, managers] = await Promise.all([
-		workspaceRoleOf(session.user.id),
+		workspaceRoleOf(session.user.id, organizationId),
 		db.member.count({
 			where: {
-				organizationId: WORKSPACE_ID,
+				organizationId,
 				role: { in: [...CONNECT_MANAGER_ROLES] },
 			},
 		}),
@@ -62,14 +76,36 @@ export const slackConnectGuard = createAuthMiddleware(async (ctx) => {
 	}
 });
 
-function startsSlackConnect(path: string, body: JsonValue): boolean {
-	if (!SLACK_CONNECT_START_PATHS.includes(path)) return false;
+function startsSlackConnect(
+	path: string,
+	body: JsonValue | undefined,
+): boolean {
+	if (path !== SLACK_CONNECT_START_PATH) return false;
 	const parsed = connectStartBody.safeParse(body);
-	return parsed.success && parsed.data.providerId === SLACK_PROVIDER_ID;
+	return parsed.success && parsed.data.provider === SLACK_PROVIDER_ID;
 }
 
-function completesSlackConnect(path: string, params: JsonValue): boolean {
+async function completesSlackConnect(
+	path: string,
+	params: JsonValue | undefined,
+	query: JsonValue | undefined,
+): Promise<boolean> {
 	if (!path.startsWith(OAUTH_CALLBACK_PATH)) return false;
-	const parsed = callbackParams.safeParse(params);
-	return parsed.success && parsed.data.providerId === SLACK_PROVIDER_ID;
+	const parsedParams = callbackParams.safeParse(params);
+	if (!parsedParams.success || parsedParams.data.id !== SLACK_PROVIDER_ID) {
+		return false;
+	}
+	const parsedQuery = callbackQuery.safeParse(query);
+	if (!parsedQuery.success) return false;
+	const verification = await db.verification.findFirst({
+		where: { identifier: parsedQuery.data.state },
+		select: { value: true },
+	});
+	if (!verification) return false;
+	try {
+		const parsedState = oauthState.safeParse(JSON.parse(verification.value));
+		return parsedState.success && parsedState.data.link !== undefined;
+	} catch {
+		return false;
+	}
 }
diff --git a/packages/auth/src/slack-grant.ts b/packages/auth/src/slack-grant.ts
index c1e3f0338..41aa099cf 100644
--- a/packages/auth/src/slack-grant.ts
+++ b/packages/auth/src/slack-grant.ts
@@ -1,72 +1,114 @@
-import { db } from "@crm/db";
+import { getCurrentAuthContext } from "@better-auth/core/context";
+import type { Prisma } from "@crm/db";
 import { lockIdempotencyKey } from "@crm/db/idempotency";
+import {
+	runInTenant,
+	TenantContextError,
+	tryCurrentOrganizationId,
+} from "@crm/db/tenant-context";
+import { scopedTransaction } from "@crm/db/tenant-scope";
 import type { OauthAccess } from "@crm/validation";
-import { SLACK_PROVIDER_ID } from "./scopes";
+import { parseActiveOrganizationClaim } from "@crm/validation/active-organization-claim";
+import { getSessionFromCtx } from "better-auth/api";
 import { SLACK_CONNECTION } from "./slack-config";
 
 export async function rememberSlackInstall(grant: OauthAccess): Promise<void> {
 	const { team, authed_user: installer } = grant;
 	if (!team || !installer) return;
 
+	const organizationId = await currentSlackOrganizationId();
+
 	const install = {
 		teamId: team.id,
 		teamName: team.name ?? null,
+		botToken: grant.access_token ?? null,
+		botScopes: grant.scope ?? "",
 		userToken: installer.access_token ?? null,
 		userScopes: installer.scope ?? "",
 		createdAt: new Date(),
 	};
 
-	await db.slackInstallation.upsert({
-		where: { installerId: installer.id },
-		create: { installerId: installer.id, ...install },
-		update: install,
-	});
+	await runInTenant(organizationId, () =>
+		scopedTransaction(async (tx) => {
+			await tx.slackInstallation.upsert({
+				where: {
+					organizationId_installerId: {
+						organizationId,
+						installerId: installer.id,
+					},
+				},
+				create: { installerId: installer.id, ...install },
+				update: install,
+			});
 
-	await forgetStaleInstalls();
+			await forgetStaleInstalls(tx);
+		}),
+	);
 }
 
 export async function replaceSlackConnection(account: {
-	id: string;
 	accountId: string;
 }): Promise<void> {
-	await db.$transaction(async (tx) => {
-		await lockIdempotencyKey(tx, SLACK_CONNECTION.locks.connection);
-
-		await tx.account.deleteMany({
-			where: { providerId: SLACK_PROVIDER_ID, id: { not: account.id } },
-		});
-
-		const install = await tx.slackInstallation.findUnique({
-			where: { installerId: account.accountId },
-		});
-		if (!install) return;
-
-		await tx.slackInstallation.delete({
-			where: { installerId: account.accountId },
-		});
-
-		await tx.slackWorkspaceGrant.deleteMany({
-			where: { teamId: { not: install.teamId } },
-		});
-
-		if (!install.userToken) return;
-
-		const grant = {
-			teamName: install.teamName,
-			userToken: install.userToken,
-			userScopes: install.userScopes,
-		};
-
-		await tx.slackWorkspaceGrant.upsert({
-			where: { teamId: install.teamId },
-			create: { teamId: install.teamId, ...grant },
-			update: grant,
-		});
-	});
+	const organizationId = await currentSlackOrganizationId();
+
+	await runInTenant(organizationId, () =>
+		scopedTransaction(async (tx) => {
+			await lockIdempotencyKey(
+				tx,
+				`${SLACK_CONNECTION.locks.connection}:${organizationId}`,
+			);
+
+			const install = await tx.slackInstallation.findUnique({
+				where: {
+					organizationId_installerId: {
+						organizationId,
+						installerId: account.accountId,
+					},
+				},
+			});
+			if (!install) return;
+
+			await tx.slackInstallation.delete({
+				where: {
+					organizationId_installerId: {
+						organizationId,
+						installerId: account.accountId,
+					},
+				},
+			});
+
+			await tx.slackWorkspaceGrant.deleteMany({
+				where: { teamId: { not: install.teamId } },
+			});
+
+			if (!install.userToken) return;
+
+			const grant = {
+				teamName: install.teamName,
+				botToken: install.botToken,
+				botScopes: install.botScopes,
+				userToken: install.userToken,
+				userScopes: install.userScopes,
+			};
+
+			await tx.slackWorkspaceGrant.upsert({
+				where: {
+					organizationId_teamId: {
+						organizationId,
+						teamId: install.teamId,
+					},
+				},
+				create: { teamId: install.teamId, ...grant },
+				update: grant,
+			});
+		}),
+	);
 }
 
-async function forgetStaleInstalls(): Promise<void> {
-	await db.slackInstallation.deleteMany({
+async function forgetStaleInstalls(
+	tx: Prisma.TransactionClient,
+): Promise<void> {
+	await tx.slackInstallation.deleteMany({
 		where: {
 			createdAt: {
 				lt: new Date(Date.now() - SLACK_CONNECTION.install.staleMs),
@@ -74,3 +116,24 @@ async function forgetStaleInstalls(): Promise<void> {
 		},
 	});
 }
+
+async function currentSlackOrganizationId(): Promise<string> {
+	const organizationId = tryCurrentOrganizationId();
+	if (organizationId) return organizationId;
+
+	const context = await getCurrentAuthContext().catch(() => {
+		throw new TenantContextError();
+	});
+	const session = await getSessionFromCtx(
+		context as Parameters<typeof getSessionFromCtx>[0],
+		{
+			disableCookieCache: true,
+		},
+	);
+	const activeOrganizationId = parseActiveOrganizationClaim(
+		session?.session.activeOrganizationId,
+	);
+
+	if (!activeOrganizationId) throw new TenantContextError();
+	return activeOrganizationId;
+}
diff --git a/packages/auth/src/sso-tenant-context.ts b/packages/auth/src/sso-tenant-context.ts
new file mode 100644
index 000000000..475562658
--- /dev/null
+++ b/packages/auth/src/sso-tenant-context.ts
@@ -0,0 +1,128 @@
+import { db } from "@crm/db";
+import { runInTenant } from "@crm/db/tenant-context";
+import { z } from "zod";
+
+const ssoRoutingBody = z
+	.object({
+		domain: z.string().optional(),
+		email: z.string().optional(),
+		organizationId: z.string().optional(),
+		organizationSlug: z.string().optional(),
+		providerId: z.string().optional(),
+	})
+	.loose();
+
+export interface SsoTenantRequest {
+	body?: unknown;
+	originalUrl?: string;
+	url?: string;
+}
+
+export async function runSsoRequestInTenant<T>(
+	request: SsoTenantRequest,
+	next: () => T | PromiseLike<T>,
+): Promise<T> {
+	const organizationId = await resolveSsoRequestOrganizationId(request);
+
+	if (!organizationId) {
+		return Promise.resolve(next());
+	}
+
+	return runInTenant(organizationId, next);
+}
+
+export async function resolveSsoRequestOrganizationId(
+	request: SsoTenantRequest,
+): Promise<string | undefined> {
+	const url = requestUrl(request);
+	const path = url.pathname;
+
+	if (!isSsoPath(path)) {
+		return undefined;
+	}
+
+	const pathProviderId = providerIdFromPath(path);
+	if (pathProviderId) {
+		return organizationForProvider(pathProviderId);
+	}
+
+	const parsedBody = ssoRoutingBody.safeParse(request.body);
+	const body = parsedBody.success ? parsedBody.data : undefined;
+	const providerId = body?.providerId ?? url.searchParams.get("providerId");
+	if (providerId) {
+		return organizationForProvider(providerId);
+	}
+
+	if (path.endsWith("/sso/register") && body?.organizationId) {
+		return body.organizationId;
+	}
+
+	if (!path.endsWith("/sign-in/sso")) {
+		return undefined;
+	}
+
+	if (body?.organizationSlug) {
+		const organization = await db.organization.findUnique({
+			where: { slug: body.organizationSlug },
+			select: { id: true },
+		});
+		return organization?.id;
+	}
+
+	const domain = body?.domain ?? body?.email?.split("@")[1];
+	if (!domain) {
+		return undefined;
+	}
+
+	const locators = await db.ssoProviderLocator.findMany({
+		select: { organizationId: true, domain: true },
+	});
+	return locators.find((locator) => domainMatches(domain, locator.domain))
+		?.organizationId;
+}
+
+function requestUrl(request: SsoTenantRequest): URL {
+	return new URL(request.originalUrl ?? request.url ?? "/", "http://localhost");
+}
+
+function isSsoPath(path: string): boolean {
+	return path.includes("/sso/") || path.endsWith("/sign-in/sso");
+}
+
+function providerIdFromPath(path: string): string | undefined {
+	const match = path.match(
+		/\/sso\/(?:callback|saml2\/sp\/(?:acs|slo)|saml2\/logout)\/([^/]+)\/?$/,
+	);
+	if (!match?.[1]) {
+		return undefined;
+	}
+
+	try {
+		return decodeURIComponent(match[1]);
+	} catch {
+		return undefined;
+	}
+}
+
+async function organizationForProvider(
+	providerId: string,
+): Promise<string | undefined> {
+	const locator = await db.ssoProviderLocator.findUnique({
+		where: { providerId },
+		select: { organizationId: true },
+	});
+	return locator?.organizationId;
+}
+
+function domainMatches(searchDomain: string, domainList: string): boolean {
+	const search = searchDomain.trim().toLowerCase();
+	if (!search) {
+		return false;
+	}
+
+	return domainList
+		.split(",")
+		.map((domain) => domain.trim().toLowerCase())
+		.filter(Boolean)
+		.some((domain) => search === domain || search.endsWith(`.${domain}`));
+}
diff --git a/packages/auth/src/workspace.ts b/packages/auth/src/workspace.ts
index d94bc1c20..d464da136 100644
--- a/packages/auth/src/workspace.ts
+++ b/packages/auth/src/workspace.ts
@@ -36,6 +36,12 @@ export function primaryWorkspaceDomain(): string | undefined {
 	return allowList().domains[0];
 }
 
+export function googleHostedDomain(): string | undefined {
+	const { domains, addresses } = allowList();
+	if (domains.length !== 1 || addresses.length > 0) return undefined;
+	return domains[0];
+}
+
 export function hasSignInAllowList(): boolean {
 	const { domains, addresses } = allowList();
 	return domains.length > 0 || addresses.length > 0;
diff --git a/packages/auth/test/oauth-client-fields.spec.ts b/packages/auth/test/oauth-client-fields.spec.ts
new file mode 100644
index 000000000..a3e374802
--- /dev/null
+++ b/packages/auth/test/oauth-client-fields.spec.ts
@@ -0,0 +1,34 @@
+import { describe, expect, it } from "bun:test";
+
+process.env.API_URL = "https://crm.example.test";
+process.env.APP_URL = "https://crm.example.app";
+
+const { oauthClientFields, OAUTH_SCOPES } = await import("../src/oauth-config");
+
+describe("oauthClientFields", () => {
+	const fields = oauthClientFields({
+		clientId: "custom-client",
+		name: "Custom client",
+		redirectUris: ["https://app.example/callback"],
+		postLogoutRedirectUris: ["https://app.example/logout"],
+		skipConsent: false,
+	});
+
+	it("identifies the client by its clientId", () => {
+		expect(fields.clientId).toBe("custom-client");
+	});
+
+	it("grants every declared scope", () => {
+		expect(fields.scopes).toEqual([...OAUTH_SCOPES]);
+	});
+
+	it("demands PKCE for the native flow", () => {
+		expect(fields.requirePKCE).toBe(true);
+		expect(fields.tokenEndpointAuthMethod).toBe("none");
+	});
+
+	it("supports only the authorization-code grant", () => {
+		expect(fields.grantTypes).toEqual(["authorization_code", "refresh_token"]);
+		expect(fields.responseTypes).toEqual(["code"]);
+	});
+});
diff --git a/packages/auth/test/oauth-scope.spec.ts b/packages/auth/test/oauth-scope.spec.ts
new file mode 100644
index 000000000..fcc7cb8d3
--- /dev/null
+++ b/packages/auth/test/oauth-scope.spec.ts
@@ -0,0 +1,52 @@
+import { describe, expect, it } from "bun:test";
+
+process.env.API_URL = "https://crm.example.test";
+process.env.APP_URL = "https://crm.example.app";
+
+const { bearerChallenge, oauthScopeFailure, requiredCrmScope } = await import(
+	"../src/oauth-scope"
+);
+
+describe("requiredCrmScope", () => {
+	it("returns the read scope for reads", () => {
+		expect(requiredCrmScope(false)).toBe("crm.read");
+	});
+
+	it("returns the write scope for writes", () => {
+		expect(requiredCrmScope(true)).toBe("crm.write");
+	});
+});
+
+describe("bearerChallenge", () => {
+	it("names only the realm when there is no error", () => {
+		expect(bearerChallenge()).toBe('Bearer realm="compcrm"');
+	});
+
+	it("adds the error code when given one", () => {
+		expect(bearerChallenge("invalid_token")).toBe(
+			'Bearer realm="compcrm", error="invalid_token"',
+		);
+	});
+
+	it("adds the scope alongside the error", () => {
+		expect(bearerChallenge("insufficient_scope", "crm.write")).toBe(
+			'Bearer realm="compcrm", error="insufficient_scope", scope="crm.write"',
+		);
+	});
+});
+
+describe("oauthScopeFailure", () => {
+	it("returns null when the scope is granted", () => {
+		expect(oauthScopeFailure(new Set(["crm.read"]), "crm.read")).toBeNull();
+	});
+
+	it("returns the challenge and message when the scope is missing", () => {
+		const failure = oauthScopeFailure(new Set(["crm.read"]), "crm.write");
+
+		expect(failure).toEqual({
+			challenge:
+				'Bearer realm="compcrm", error="insufficient_scope", scope="crm.write"',
+			message: "The token requires crm.write.",
+		});
+	});
+});
diff --git a/packages/auth/test/oauth-startup.spec.ts b/packages/auth/test/oauth-startup.spec.ts
new file mode 100644
index 000000000..dce67e197
--- /dev/null
+++ b/packages/auth/test/oauth-startup.spec.ts
@@ -0,0 +1,78 @@
+import { describe, expect, it } from "bun:test";
+import { oauthProvider } from "@better-auth/oauth-provider";
+import { betterAuth } from "better-auth";
+import { memoryAdapter } from "better-auth/adapters/memory";
+
+function startup(errorCode: string, persistent = false) {
+	const resource = "https://api.example.test";
+	const memory = memoryAdapter({
+		oauthResource: [],
+		oauthClient: [],
+		oauthClientResource: [],
+	});
+	let attempts = 0;
+	const auth = betterAuth({
+		baseURL: "https://auth.example.test",
+		secret: "oauth-startup-test-secret-with-at-least-32-characters",
+		database: (options) => {
+			const adapter = memory(options);
+			return {
+				...adapter,
+				findOne: async (input) => {
+					if (input.model === "oauthResource") {
+						attempts += 1;
+						if (attempts === 1 || persistent) {
+							throw Object.assign(new Error("Database unavailable"), {
+								code: errorCode,
+							});
+						}
+					}
+					return adapter.findOne(input);
+				},
+			};
+		},
+		plugins: [
+			oauthProvider({
+				loginPage: "/sign-in",
+				consentPage: "/consent",
+				disableJwtPlugin: true,
+				resources: [{ identifier: resource, name: "Test API" }],
+				resourceSeedMode: "overwrite",
+				clientRegistrationDefaultResources: [resource],
+				allowDynamicClientRegistration: true,
+				allowUnauthenticatedClientRegistration: true,
+			}),
+		],
+	});
+	const register = () =>
+		auth.api.registerOAuthClient({
+			body: {
+				client_name: "Startup regression",
+				redirect_uris: ["https://client.example.test/callback"],
+				token_endpoint_auth_method: "none",
+			},
+		});
+	return { auth, register, attempts: () => attempts };
+}
+
+describe("OAuth startup database recovery", () => {
+	it("serves sessions and retries resource setup after a connection reset", async () => {
+		const { auth, register, attempts } = startup("ECONNRESET");
+		expect(await auth.api.getSession({ headers: new Headers() })).toBeNull();
+		expect(await register()).toHaveProperty("client_id");
+		expect(attempts()).toBeGreaterThan(1);
+	});
+
+	it("keeps resource requests blocked while the database remains unavailable", async () => {
+		const { auth, register, attempts } = startup("ECONNRESET", true);
+		await auth.$context;
+		await expect(register()).rejects.toThrow("Database unavailable");
+		await expect(register()).rejects.toThrow("Database unavailable");
+		expect(attempts()).toBe(3);
+	});
+
+	it("preserves initialization failures for schema errors", async () => {
+		const { auth } = startup("P2022");
+		await expect(auth.$context).rejects.toThrow("Database unavailable");
+	});
+});
diff --git a/packages/auth/test/oauth-tenant.integration.spec.ts b/packages/auth/test/oauth-tenant.integration.spec.ts
new file mode 100644
index 000000000..adcec662d
--- /dev/null
+++ b/packages/auth/test/oauth-tenant.integration.spec.ts
@@ -0,0 +1,165 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { z } from "zod";
+
+const tokenResponseSchema = z.object({
+	access_token: z.string(),
+	refresh_token: z.string(),
+});
+
+const suffix = `oauth-tenant-${crypto.randomUUID()}`;
+const userId = `${suffix}-user`;
+const organizationId = `${suffix}-organization`;
+const sessionToken = `${suffix}-session`;
+let cookie = "";
+let verifier = "";
+
+const {
+	auth,
+	ensureOfficialOAuthClient,
+	OAUTH,
+	OAUTH_ORGANIZATION_CLAIM,
+	SESSION_COOKIE_NAME,
+} = await import("../src/index");
+
+beforeAll(async () => {
+	await db.jwks.deleteMany();
+	await ensureOfficialOAuthClient();
+	await db.user.create({
+		data: {
+			id: userId,
+			email: `${userId}@example.com`,
+			name: "OAuth tenant user",
+			emailVerified: true,
+			updatedAt: new Date(),
+		},
+	});
+	await db.organization.create({
+		data: {
+			id: organizationId,
+			name: "OAuth tenant organization",
+			slug: organizationId,
+			createdAt: new Date(),
+		},
+	});
+	await db.member.create({
+		data: {
+			id: `${suffix}-member`,
+			userId,
+			organizationId,
+			role: "owner",
+			createdAt: new Date(),
+		},
+	});
+	await db.session.create({
+		data: {
+			id: sessionToken,
+			token: sessionToken,
+			userId,
+			activeOrganizationId: organizationId,
+			expiresAt: new Date(Date.now() + 60_000),
+			updatedAt: new Date(),
+		},
+	});
+	cookie = `${SESSION_COOKIE_NAME}=${await signCookieValue(sessionToken)}`;
+	verifier = `${crypto.randomUUID()}${crypto.randomUUID()}`.replaceAll("-", "");
+});
+
+afterAll(async () => {
+	await db.user.delete({ where: { id: userId } });
+	await db.organization.delete({ where: { id: organizationId } });
+	await db.jwks.deleteMany();
+});
+
+describe("OAuth tenant binding", () => {
+	it("preserves the selected organization through token refresh", async () => {
+		const challenge = Buffer.from(
+			await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)),
+		).toString("base64url");
+		const authorizeUrl = new URL(`${OAUTH.issuer}/oauth2/authorize`);
+		authorizeUrl.search = new URLSearchParams({
+			client_id: OAUTH.officialClient.id,
+			redirect_uri: OAUTH.officialClient.redirectUris[0],
+			response_type: "code",
+			scope: "openid profile email offline_access crm.read",
+			code_challenge: challenge,
+			code_challenge_method: "S256",
+			state: suffix,
+			resource: OAUTH.resource,
+		}).toString();
+
+		const authorization = await auth.handler(
+			new Request(authorizeUrl, { headers: { cookie }, redirect: "manual" }),
+		);
+		expect(authorization.status).toBe(302);
+		const location = authorization.headers.get("location");
+		if (!location) throw new Error("OAuth authorization returned no redirect.");
+		const code = new URL(location).searchParams.get("code");
+		if (!code) throw new Error("OAuth authorization returned no code.");
+
+		const tokens = await tokenRequest({
+			grant_type: "authorization_code",
+			client_id: OAUTH.officialClient.id,
+			redirect_uri: OAUTH.officialClient.redirectUris[0],
+			resource: OAUTH.resource,
+			code,
+			code_verifier: verifier,
+		});
+		expect(
+			accessTokenClaims(tokens.access_token)[OAUTH_ORGANIZATION_CLAIM],
+		).toBe(organizationId);
+
+		const refreshed = await tokenRequest({
+			grant_type: "refresh_token",
+			client_id: OAUTH.officialClient.id,
+			refresh_token: tokens.refresh_token,
+			resource: OAUTH.resource,
+		});
+		expect(
+			accessTokenClaims(refreshed.access_token)[OAUTH_ORGANIZATION_CLAIM],
+		).toBe(organizationId);
+	});
+});
+
+async function tokenRequest(
+	body: Record<string, string>,
+): Promise<{ access_token: string; refresh_token: string }> {
+	const response = await auth.handler(
+		new Request(`${OAUTH.issuer}/oauth2/token`, {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams(body),
+		}),
+	);
+	const payload = await response.json();
+	if (!response.ok) throw new Error(JSON.stringify(payload));
+	return tokenResponseSchema.parse(payload);
+}
+
+function accessTokenClaims(accessToken: string): Record<string, string> {
+	const encoded = accessToken.split(".")[1];
+	if (!encoded) throw new Error("Access token has no payload.");
+	return JSON.parse(
+		Buffer.from(encoded, "base64url").toString("utf8"),
+	) as Record<string, string>;
+}
+
+async function signCookieValue(value: string): Promise<string> {
+	const secret = process.env.BETTER_AUTH_SECRET;
+	if (!secret) throw new Error("BETTER_AUTH_SECRET is required.");
+	const key = await crypto.subtle.importKey(
+		"raw",
+		new TextEncoder().encode(secret),
+		{ name: "HMAC", hash: "SHA-256" },
+		false,
+		["sign"],
+	);
+	const signature = await crypto.subtle.sign(
+		"HMAC",
+		key,
+		new TextEncoder().encode(value),
+	);
+	return encodeURIComponent(
+		`${value}.${Buffer.from(signature).toString("base64")}`,
+	);
+}
diff --git a/packages/auth/test/organization.integration.spec.ts b/packages/auth/test/organization.integration.spec.ts
index 9f5f3a015..618188eda 100644
--- a/packages/auth/test/organization.integration.spec.ts
+++ b/packages/auth/test/organization.integration.spec.ts
@@ -1,122 +1,137 @@
 import { afterAll, beforeEach, describe, expect, it } from "bun:test";
 import { db } from "@crm/db";
-import { ensureWorkspaceMembership, WORKSPACE_ID } from "../src/organization";
+import { runInTenant } from "@crm/db/tenant-context";
+import {
+	activeWorkspaceRoleOf,
+	resolveActiveOrganization,
+	workspaceRoleOf,
+} from "../src/organization";
 
 const suffix = process.env.TEST_RUN_ID ?? "organization-spec";
 
 const emailOf = (label: string) => `${label}.${suffix}@example.test`;
 
-let firstId: string;
-let secondId: string;
+let userId: string;
+let orgAId: string;
+let orgBId: string;
 
-const seedUser = async (label: string, createdAt: Date): Promise<string> => {
+const seedUser = async (label: string): Promise<string> => {
 	const user = await db.user.create({
+		data: { id: `${suffix}-${label}`, name: label, email: emailOf(label) },
+		select: { id: true },
+	});
+	return user.id;
+};
+
+const seedOrg = async (label: string): Promise<string> => {
+	const org = await db.organization.create({
 		data: {
 			id: `${suffix}-${label}`,
 			name: label,
-			email: emailOf(label),
-			createdAt,
-			updatedAt: createdAt,
+			slug: `${suffix}-${label}`,
+			createdAt: new Date(),
 		},
 		select: { id: true },
 	});
-
-	return user.id;
+	return org.id;
 };
 
-const roleOf = async (userId: string): Promise<string | null> => {
-	const member = await db.member.findUnique({
-		where: { organizationId_userId: { organizationId: WORKSPACE_ID, userId } },
-		select: { role: true },
+const addMember = async (
+	organizationId: string,
+	memberUserId: string,
+	role: string,
+	createdAt: Date,
+) => {
+	await db.member.create({
+		data: {
+			id: `${suffix}-${organizationId}-${memberUserId}`,
+			organizationId,
+			userId: memberUserId,
+			role,
+			createdAt,
+		},
 	});
-
-	return member?.role ?? null;
 };
 
 const clear = async () => {
 	await db.member.deleteMany({
 		where: { userId: { startsWith: `${suffix}-` } },
 	});
+	await db.organization.deleteMany({
+		where: { id: { startsWith: `${suffix}-` } },
+	});
 	await db.user.deleteMany({
 		where: { email: { endsWith: `.${suffix}@example.test` } },
 	});
-
-	const strangers = await db.member.count({
-		where: { organizationId: WORKSPACE_ID },
-	});
-
-	if (strangers > 0) {
-		throw new Error(
-			`${strangers} member row(s) this spec did not create are in the workspace, and it needs an empty one to test the owner backfill. It will not delete them: that is somebody's access. Point TEST_DATABASE_URL at a database of your own, or find the spec that leaked them.`,
-		);
-	}
 };
 
 beforeEach(async () => {
 	await clear();
-
-	firstId = await seedUser("first", new Date("2020-01-01T00:00:00Z"));
-	secondId = await seedUser("second", new Date("2021-01-01T00:00:00Z"));
+	userId = await seedUser("user");
+	orgAId = await seedOrg("org-a");
+	orgBId = await seedOrg("org-b");
 });
 
 afterAll(clear);
 
-describe("ensureWorkspaceMembership", () => {
-	it("creates the one workspace and enrols everyone who already had an account", async () => {
-		const workspaceId = await ensureWorkspaceMembership(secondId);
-
-		expect(workspaceId).toBe(WORKSPACE_ID);
-		expect(await roleOf(firstId)).toBe("owner");
-		expect(await roleOf(secondId)).toBe("member");
+describe("resolveActiveOrganization", () => {
+	it("returns null for a user with no membership anywhere", async () => {
+		expect(await resolveActiveOrganization(userId)).toBeNull();
 	});
 
-	it("is idempotent, so signing in again neither duplicates nor re-roles", async () => {
-		await ensureWorkspaceMembership(secondId);
-
-		await db.member.update({
-			where: {
-				organizationId_userId: {
-					organizationId: WORKSPACE_ID,
-					userId: secondId,
-				},
-			},
-			data: { role: "admin" },
-		});
+	it("returns the user's sole organization", async () => {
+		await addMember(orgAId, userId, "member", new Date("2026-01-01T00:00:00Z"));
 
-		await ensureWorkspaceMembership(secondId);
-		await ensureWorkspaceMembership(secondId);
+		expect(await resolveActiveOrganization(userId)).toBe(orgAId);
+	});
 
-		const rows = await db.member.findMany({
-			where: { organizationId: WORKSPACE_ID, userId: secondId },
-		});
+	it("returns the earliest-joined organization when the user belongs to several", async () => {
+		await addMember(orgBId, userId, "member", new Date("2026-02-01T00:00:00Z"));
+		await addMember(orgAId, userId, "member", new Date("2026-01-01T00:00:00Z"));
 
-		expect(rows).toHaveLength(1);
-		expect(rows[0]?.role).toBe("admin");
+		expect(await resolveActiveOrganization(userId)).toBe(orgAId);
 	});
 
-	it("joins someone who signs up later as a member", async () => {
-		await ensureWorkspaceMembership(secondId);
+	it("does not create any organization or membership as a side effect", async () => {
+		await resolveActiveOrganization(userId);
 
-		const laterId = await seedUser("later", new Date("2026-01-01T00:00:00Z"));
+		const memberCount = await db.member.count({ where: { userId } });
+		expect(memberCount).toBe(0);
+	});
+});
 
-		await ensureWorkspaceMembership(laterId);
+describe("workspaceRoleOf", () => {
+	it("returns the role for the given user in the given organization", async () => {
+		await addMember(orgAId, userId, "admin", new Date());
 
-		expect(await roleOf(laterId)).toBe("member");
+		expect(await workspaceRoleOf(userId, orgAId)).toBe("admin");
 	});
 
-	it("leaves the owner alone when a later arrival signs in", async () => {
-		await ensureWorkspaceMembership(secondId);
+	it("returns null when the user is not a member of that organization", async () => {
+		await addMember(orgAId, userId, "admin", new Date());
 
-		const laterId = await seedUser("later", new Date("2026-01-01T00:00:00Z"));
+		expect(await workspaceRoleOf(userId, orgBId)).toBeNull();
+	});
 
-		await ensureWorkspaceMembership(laterId);
+	it("keeps roles isolated across a user's two organizations", async () => {
+		await addMember(orgAId, userId, "owner", new Date());
+		await addMember(orgBId, userId, "member", new Date());
 
-		expect(await roleOf(firstId)).toBe("owner");
+		expect(await workspaceRoleOf(userId, orgAId)).toBe("owner");
+		expect(await workspaceRoleOf(userId, orgBId)).toBe("member");
+	});
+});
 
-		const owners = await db.member.count({
-			where: { organizationId: WORKSPACE_ID, role: "owner" },
-		});
+describe("activeWorkspaceRoleOf", () => {
+	it("reads the role from the active organization", async () => {
+		await addMember(orgAId, userId, "admin", new Date());
+		await addMember(orgBId, userId, "member", new Date());
 
-		expect(owners).toBe(1);
+		expect(await runInTenant(orgAId, () => activeWorkspaceRoleOf(userId))).toBe(
+			"admin",
+		);
+		expect(await runInTenant(orgBId, () => activeWorkspaceRoleOf(userId))).toBe(
+			"member",
+		);
 	});
 });
diff --git a/packages/auth/test/session-active-organization.integration.spec.ts b/packages/auth/test/session-active-organization.integration.spec.ts
new file mode 100644
index 000000000..d04489f9a
--- /dev/null
+++ b/packages/auth/test/session-active-organization.integration.spec.ts
@@ -0,0 +1,67 @@
+import { afterAll, beforeEach, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { auth } from "../src/auth";
+
+const suffix = process.env.TEST_RUN_ID ?? "session-active-org-spec";
+
+let userId: string;
+let orgId: string;
+
+const clear = async () => {
+	await db.session.deleteMany({
+		where: { userId: { startsWith: `${suffix}-` } },
+	});
+	await db.member.deleteMany({
+		where: { userId: { startsWith: `${suffix}-` } },
+	});
+	await db.organization.deleteMany({
+		where: { id: { startsWith: `${suffix}-` } },
+	});
+	await db.user.deleteMany({ where: { id: { startsWith: `${suffix}-` } } });
+};
+
+beforeEach(async () => {
+	await clear();
+
+	const user = await db.user.create({
+		data: {
+			id: `${suffix}-user`,
+			name: "Test",
+			email: `${suffix}@example.test`,
+		},
+		select: { id: true },
+	});
+	userId = user.id;
+
+	const org = await db.organization.create({
+		data: {
+			id: `${suffix}-org`,
+			name: "Org",
+			slug: `${suffix}-org`,
+			createdAt: new Date(),
+		},
+		select: { id: true },
+	});
+	orgId = org.id;
+
+	await db.member.create({
+		data: {
+			id: `${suffix}-member`,
+			organizationId: orgId,
+			userId,
+			role: "owner",
+			createdAt: new Date(),
+		},
+	});
+});
+
+afterAll(clear);
+
+describe("session create hook", () => {
+	it("sets activeOrganizationId to the user's membership via the internal adapter", async () => {
+		const context = await auth.$context;
+		const created = await context.internalAdapter.createSession(userId);
+
+		expect(created.activeOrganizationId).toBe(orgId);
+	});
+});
diff --git a/packages/auth/test/slack-connect.integration.spec.ts b/packages/auth/test/slack-connect.integration.spec.ts
index c5b7e9207..98f6a928a 100644
--- a/packages/auth/test/slack-connect.integration.spec.ts
+++ b/packages/auth/test/slack-connect.integration.spec.ts
@@ -7,59 +7,55 @@ import {
 	it,
 } from "bun:test";
 import { db } from "@crm/db";
-import { workspaceSlug } from "@crm/db/workspace";
-import { type BetterAuthPlugin, betterAuth } from "better-auth";
+import { betterAuth } from "better-auth";
 import { prismaAdapter } from "better-auth/adapters/prisma";
-import { createAuthEndpoint, createAuthMiddleware } from "better-auth/api";
+import { APIError, createAuthMiddleware } from "better-auth/api";
 import { applySetCookies } from "better-auth/cookies";
 import { genericOAuth } from "better-auth/plugins/generic-oauth";
+import { organization } from "better-auth/plugins/organization";
 import * as z from "zod";
-import {
-	DEFAULT_WORKSPACE_NAME,
-	WORKSPACE_ID,
-	type WorkspaceRole,
-} from "../src/organization";
+import type { WorkspaceRole } from "../src/organization";
 import { GOOGLE_PROVIDER_ID, SLACK_PROVIDER_ID } from "../src/scopes";
 import { slackConnectGuard } from "../src/slack-connect";
 
 const suffix = process.env.TEST_RUN_ID ?? "slack-connect-spec";
+const ORGANIZATION_ID = `${suffix}-organization`;
+const CALLBACK_INSTALLER = `slack-connect-${suffix}-installer`;
 
 const EMAIL_SUFFIX = `.slack-connect.${suffix}@example.test`;
 const SESSION_MS = 7 * 24 * 60 * 60 * 1000;
 const BASE_URL = "http://localhost:3001";
 const JSON_HEADERS = { "content-type": "application/json" };
 
-const reached = { reached: true };
-
-const probe = {
-	id: "slack-connect-probe",
-	endpoints: {
-		link: createAuthEndpoint("/oauth2/link", { method: "POST" }, async (ctx) =>
-			ctx.json(reached),
-		),
-		signIn: createAuthEndpoint(
-			"/sign-in/oauth2",
-			{ method: "POST" },
-			async (ctx) => ctx.json(reached),
-		),
-		callback: createAuthEndpoint(
-			"/oauth2/callback/:providerId",
-			{ method: "GET" },
-			async (ctx) => ctx.json(reached),
-		),
+const provider = (providerId: string) => ({
+	providerId,
+	accountIssuer: `https://${providerId}.example.test`,
+	authorizationUrl: `https://${providerId}.example.test/authorize`,
+	tokenUrl: `https://${providerId}.example.test/token`,
+	userInfoUrl: `https://${providerId}.example.test/userinfo`,
+	clientId: `${providerId}-client`,
+	clientSecret: `${providerId}-secret`,
+	getToken: async () => {
+		throw new APIError("BAD_REQUEST", { message: "Token exchange reached." });
 	},
-} satisfies BetterAuthPlugin;
+});
 
 const guarded = betterAuth({
 	baseURL: BASE_URL,
 	secret: "slack-connect-spec-secret",
 	database: prismaAdapter(db, { provider: "postgresql" }),
 	emailAndPassword: { enabled: false },
+	account: { skipStateCookieCheck: true },
 	hooks: { before: slackConnectGuard },
-	plugins: [probe],
+	plugins: [
+		genericOAuth({
+			config: [provider(SLACK_PROVIDER_ID), provider(GOOGLE_PROVIDER_ID)],
+		}),
+		organization({ allowUserToCreateOrganization: false }),
+	],
 });
 
-const arrival = z.object({ reached: z.literal(true) });
+const authorization = z.object({ url: z.string().url() });
 const refusal = z.object({ message: z.string() });
 
 type Snapshot = {
@@ -76,7 +72,10 @@ let snapshot: Snapshot;
 
 const idOf = (label: string) => `slack-connect-${suffix}-${label}`;
 
-const sessionCookie = async (userId: string): Promise<string> => {
+const sessionCookie = async (
+	userId: string,
+	activeOrganizationId: string | null,
+): Promise<string> => {
 	const context = await guarded.$context;
 	const token = idOf(`${userId}-token`);
 
@@ -88,6 +87,7 @@ const sessionCookie = async (userId: string): Promise<string> => {
 			expiresAt: new Date(Date.now() + SESSION_MS),
 			createdAt: new Date(),
 			updatedAt: new Date(),
+			activeOrganizationId,
 		},
 	});
 
@@ -123,7 +123,7 @@ const seat = async (
 		await db.member.create({
 			data: {
 				id: idOf(`${label}-member`),
-				organizationId: WORKSPACE_ID,
+				organizationId: ORGANIZATION_ID,
 				userId: user.id,
 				role,
 				createdAt: now,
@@ -131,7 +131,7 @@ const seat = async (
 		});
 	}
 
-	return sessionCookie(user.id);
+	return sessionCookie(user.id, role ? ORGANIZATION_ID : null);
 };
 
 const startConnect = (
@@ -143,45 +143,83 @@ const startConnect = (
 		new Request(`${BASE_URL}/api/auth${path}`, {
 			method: "POST",
 			headers: cookie ? { ...JSON_HEADERS, cookie } : JSON_HEADERS,
-			body: JSON.stringify({ providerId, callbackURL: "/" }),
+			body: JSON.stringify({ provider: providerId, callbackURL: "/" }),
 		}),
 	);
 
-const linkSlack = (cookie?: string) => startConnect("/oauth2/link", cookie);
+const linkSlack = (cookie?: string) => startConnect("/link-social", cookie);
 
-const completeConnect = (
+const completeCallback = (
+	state: string,
 	cookie?: string,
 	providerId: string = SLACK_PROVIDER_ID,
 ) =>
 	guarded.handler(
 		new Request(
-			`${BASE_URL}/api/auth/oauth2/callback/${providerId}?code=test-code&state=test-state`,
+			`${BASE_URL}/api/auth/callback/${providerId}?code=test-code&state=${state}`,
 			{ headers: cookie ? { cookie } : undefined },
 		),
 	);
 
+const linkTransaction = async (
+	cookie: string,
+	providerId: string = SLACK_PROVIDER_ID,
+): Promise<{ state: string; cookie: string }> => {
+	const state = `slack-connect-state-${crypto.randomUUID()}`;
+	await db.verification.create({
+		data: {
+			id: state,
+			identifier: state,
+			value: JSON.stringify({
+				callbackURL: "/",
+				codeVerifier: "slack-connect-code-verifier",
+				expiresAt: Date.now() + 60_000,
+				link: { email: `${providerId}@example.test`, userId: providerId },
+			}),
+			expiresAt: new Date(Date.now() + 60_000),
+			createdAt: new Date(),
+			updatedAt: new Date(),
+		},
+	});
+	return { state, cookie };
+};
+
+const completeLink = async (startCookie: string, keepCallbackCookie = true) => {
+	const transaction = await linkTransaction(startCookie);
+	return completeCallback(
+		transaction.state,
+		keepCallbackCookie ? transaction.cookie : undefined,
+	);
+};
+
 const messageOf = async (response: Response): Promise<string> =>
 	refusal.parse(await response.json()).message;
 
 const arrived = async (response: Response): Promise<boolean> =>
-	arrival.safeParse(await response.json()).success;
+	authorization.safeParse(await response.json()).success;
 
 const clear = async () => {
-	await db.member.deleteMany({ where: { organizationId: WORKSPACE_ID } });
-	await db.organization.deleteMany({ where: { id: WORKSPACE_ID } });
+	await db.verification.deleteMany({
+		where: { identifier: { startsWith: "slack-connect-state-" } },
+	});
+	await db.slackInstallation.deleteMany({
+		where: { installerId: CALLBACK_INSTALLER },
+	});
+	await db.member.deleteMany({ where: { organizationId: ORGANIZATION_ID } });
+	await db.organization.deleteMany({ where: { id: ORGANIZATION_ID } });
 	await db.user.deleteMany({ where: { email: { endsWith: EMAIL_SUFFIX } } });
 };
 
 beforeAll(async () => {
 	const organization = await db.organization.findUnique({
-		where: { id: WORKSPACE_ID },
+		where: { id: ORGANIZATION_ID },
 		select: { name: true, slug: true, website: true, metadata: true },
 	});
 
 	snapshot = {
 		organization,
 		members: await db.member.findMany({
-			where: { organizationId: WORKSPACE_ID },
+			where: { organizationId: ORGANIZATION_ID },
 			select: { id: true, userId: true, role: true, createdAt: true },
 		}),
 	};
@@ -192,9 +230,9 @@ beforeEach(async () => {
 
 	await db.organization.create({
 		data: {
-			id: WORKSPACE_ID,
-			name: DEFAULT_WORKSPACE_NAME,
-			slug: workspaceSlug(DEFAULT_WORKSPACE_NAME),
+			id: ORGANIZATION_ID,
+			name: "CRM",
+			slug: ORGANIZATION_ID,
 			createdAt: new Date(),
 		},
 	});
@@ -206,7 +244,7 @@ afterAll(async () => {
 	if (snapshot.organization) {
 		await db.organization.create({
 			data: {
-				id: WORKSPACE_ID,
+				id: ORGANIZATION_ID,
 				createdAt: new Date(),
 				...snapshot.organization,
 			},
@@ -215,62 +253,81 @@ afterAll(async () => {
 		await db.member.createMany({
 			data: snapshot.members.map((member) => ({
 				...member,
-				organizationId: WORKSPACE_ID,
+				organizationId: ORGANIZATION_ID,
 			})),
 		});
 	}
 });
 
-describe("the Slack callback that writes the connection", () => {
-	it("turns away a browser with no session", async () => {
-		const response = await completeConnect();
+describe("Slack linking callback authorization", () => {
+	it("turns away a linking browser after its session ends", async () => {
+		const cookie = await seat("lead", "admin");
+		const response = await completeLink(cookie, false);
 
 		expect(response.status).toBe(401);
 		expect(await messageOf(response)).toContain("Sign in to the CRM");
 	});
 
-	it("turns away a member", async () => {
+	it("turns away an admin who became a member", async () => {
+		const cookie = await seat("lead", "admin");
+		const transaction = await linkTransaction(cookie);
+		await db.member.update({
+			where: { id: idOf("lead-member") },
+			data: { role: "member" },
+		});
 		await seat("owner", "owner");
-		const response = await completeConnect(await seat("rep", "member"));
+		const response = await completeCallback(
+			transaction.state,
+			transaction.cookie,
+		);
 
 		expect(response.status).toBe(403);
 		expect(await messageOf(response)).toContain("Only an owner or an admin");
 	});
 
-	it("turns away someone signed in who is not in this workspace", async () => {
-		await seat("owner", "owner");
-		const response = await completeConnect(await seat("stranger", null));
+	it("turns away an admin removed from the workspace", async () => {
+		const cookie = await seat("lead", "admin");
+		const transaction = await linkTransaction(cookie);
+		await db.member.delete({ where: { id: idOf("lead-member") } });
+		const response = await completeCallback(
+			transaction.state,
+			transaction.cookie,
+		);
 
 		expect(response.status).toBe(403);
-		expect(await messageOf(response)).toContain("member of this workspace");
+		expect(await messageOf(response)).toContain(
+			"Only a member of this workspace",
+		);
 	});
 
-	it("lets an admin finish", async () => {
-		const response = await completeConnect(await seat("lead", "admin"));
+	it("lets an admin reach token exchange", async () => {
+		const cookie = await seat("lead", "admin");
+		const response = await completeLink(cookie);
 
-		expect(response.status).toBe(200);
-		expect(await arrived(response)).toBe(true);
+		expect(response.status).toBe(302);
+		expect(response.headers.get("location")).toContain("error=invalid_code");
 	});
 
-	it("lets an owner finish", async () => {
-		const response = await completeConnect(await seat("founder", "owner"));
+	it("lets an owner reach token exchange", async () => {
+		const cookie = await seat("founder", "owner");
+		const response = await completeLink(cookie);
 
-		expect(response.status).toBe(200);
-		expect(await arrived(response)).toBe(true);
+		expect(response.status).toBe(302);
+		expect(response.headers.get("location")).toContain("error=invalid_code");
 	});
 
-	it("lets a member finish when the workspace has no owner and no admin", async () => {
+	it("lets a member reach token exchange without a workspace manager", async () => {
 		const cookie = await seat("rep", "member");
 		await seat("other", "member");
 
-		const response = await completeConnect(cookie);
+		const response = await completeLink(cookie);
 
-		expect(response.status).toBe(200);
-		expect(await arrived(response)).toBe(true);
+		expect(response.status).toBe(302);
+		expect(response.headers.get("location")).toContain("error=invalid_code");
 	});
 });
 
-describe("the two paths that start a Slack connection", () => {
+describe("Slack connection starts", () => {
 	it("turns away a member who asks to link Slack", async () => {
 		await seat("owner", "owner");
 		const response = await linkSlack(await seat("rep", "member"));
@@ -278,14 +335,12 @@ describe("the two paths that start a Slack connection", () => {
 		expect(response.status).toBe(403);
 	});
 
-	it("turns away a member who asks to sign in with Slack", async () => {
+	it("lets a browser with no session ask to sign in with Slack", async () => {
 		await seat("owner", "owner");
-		const response = await startConnect(
-			"/sign-in/oauth2",
-			await seat("rep", "member"),
-		);
+		const response = await startConnect("/sign-in/social");
 
-		expect(response.status).toBe(403);
+		expect(response.status).toBe(200);
+		expect(await arrived(response)).toBe(true);
 	});
 
 	it("turns away a browser with no session", async () => {
@@ -307,7 +362,7 @@ describe("every provider that is not Slack", () => {
 	it("lets a member link Google", async () => {
 		await seat("owner", "owner");
 		const response = await startConnect(
-			"/oauth2/link",
+			"/link-social",
 			await seat("rep", "member"),
 			GOOGLE_PROVIDER_ID,
 		);
@@ -317,23 +372,34 @@ describe("every provider that is not Slack", () => {
 	});
 
 	it("lets the Google callback through with no session at all", async () => {
-		const response = await completeConnect(undefined, GOOGLE_PROVIDER_ID);
+		const response = await completeCallback(
+			"test-state",
+			undefined,
+			GOOGLE_PROVIDER_ID,
+		);
 
-		expect(response.status).toBe(200);
-		expect(await arrived(response)).toBe(true);
+		expect(response.status).toBe(302);
 	});
-});
 
-describe("the paths the guard has to know about", () => {
-	it("is every path the generic OAuth plugin mounts", () => {
-		const paths = Object.values(genericOAuth({ config: [] }).endpoints)
-			.map((endpoint) => endpoint.path)
-			.sort();
-
-		expect(paths).toEqual([
-			"/oauth2/callback/:providerId",
-			"/oauth2/link",
-			"/sign-in/oauth2",
-		]);
+	it("lets a Slack sign-in callback through with no session", async () => {
+		const state = `slack-connect-state-${crypto.randomUUID()}`;
+		await db.verification.create({
+			data: {
+				id: state,
+				identifier: state,
+				value: JSON.stringify({
+					callbackURL: "/",
+					codeVerifier: "slack-sign-in-code-verifier",
+					expiresAt: Date.now() + 60_000,
+				}),
+				expiresAt: new Date(Date.now() + 60_000),
+				createdAt: new Date(),
+				updatedAt: new Date(),
+			},
+		});
+		const response = await completeCallback(state);
+
+		expect(response.status).toBe(302);
+		expect(response.headers.get("location")).toContain("error=invalid_code");
 	});
 });
diff --git a/packages/auth/test/slack-grant.integration.spec.ts b/packages/auth/test/slack-grant.integration.spec.ts
new file mode 100644
index 000000000..9fba9bdb9
--- /dev/null
+++ b/packages/auth/test/slack-grant.integration.spec.ts
@@ -0,0 +1,360 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db, type Prisma } from "@crm/db";
+import { runInTenant, TenantContextError } from "@crm/db/tenant-context";
+import { scopedTransaction } from "@crm/db/tenant-scope";
+import type { OauthAccess } from "@crm/validation";
+import { SLACK_PROVIDER_ID } from "../src/scopes";
+import { SLACK_CONNECTION } from "../src/slack-config";
+import {
+	rememberSlackInstall,
+	replaceSlackConnection,
+} from "../src/slack-grant";
+
+const suffix =
+	process.env.TEST_RUN_ID ??
+	`slack-grant-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+const ORGANIZATION_A = `slack-grant-${suffix}-organization-a`;
+const ORGANIZATION_B = `slack-grant-${suffix}-organization-b`;
+const INSTALLER_ID = `slack-grant-${suffix}-installer`;
+const EXTERNAL_INSTALLER_ID = `${INSTALLER_ID}-other-org`;
+const USER_ID = `slack-grant-${suffix}-user`;
+const ACCOUNT_ID = `slack-grant-${suffix}-account`;
+const STALE_TEAM_ID_B = `${suffix}-stale-org-b`;
+
+const grant: OauthAccess = {
+	ok: true,
+	access_token: "xoxb-test-token",
+	scope: "chat:write,channels:read",
+	team: { id: `slack-grant-${suffix}-team`, name: "Test Team" },
+	authed_user: {
+		id: INSTALLER_ID,
+		access_token: "xoxp-test-token",
+		scope: "channels:read",
+	},
+};
+
+async function inTenant<T>(
+	organizationId: string,
+	fn: (tx: Prisma.TransactionClient) => Promise<T>,
+): Promise<T> {
+	return runInTenant(organizationId, () => scopedTransaction(fn));
+}
+
+async function clearSlackRows(): Promise<void> {
+	for (const organizationId of [ORGANIZATION_A, ORGANIZATION_B]) {
+		await inTenant(organizationId, async (tx) => {
+			await tx.slackWorkspaceGrant.deleteMany({
+				where: {
+					teamId: {
+						in: [
+							grant.team.id,
+							`${grant.team.id}-stale-a`,
+							`${grant.team.id}-stale-b`,
+							STALE_TEAM_ID_B,
+						],
+					},
+				},
+			});
+			await tx.slackInstallation.deleteMany({
+				where: {
+					installerId: {
+						in: [
+							INSTALLER_ID,
+							EXTERNAL_INSTALLER_ID,
+							`${INSTALLER_ID}-stale-a`,
+						],
+					},
+				},
+			});
+		});
+	}
+}
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: [
+			{
+				id: ORGANIZATION_A,
+				name: "Organization A",
+				slug: ORGANIZATION_A,
+				createdAt: new Date(),
+			},
+			{
+				id: ORGANIZATION_B,
+				name: "Organization B",
+				slug: ORGANIZATION_B,
+				createdAt: new Date(),
+			},
+		],
+		skipDuplicates: true,
+	});
+
+	await db.user.upsert({
+		where: { id: USER_ID },
+		update: {},
+		create: {
+			id: USER_ID,
+			name: "Slack grant owner",
+			email: `${USER_ID}@example.test`,
+		},
+	});
+
+	await db.account.deleteMany({ where: { id: ACCOUNT_ID } });
+	await clearSlackRows();
+});
+
+afterAll(async () => {
+	await db.account.deleteMany({ where: { id: ACCOUNT_ID } });
+	await clearSlackRows();
+	await db.user.deleteMany({ where: { id: USER_ID } });
+	await db.organization.deleteMany({
+		where: { id: { in: [ORGANIZATION_A, ORGANIZATION_B] } },
+	});
+});
+
+describe("rememberSlackInstall", () => {
+	it("requires tenant context", async () => {
+		await expect(rememberSlackInstall(grant)).rejects.toThrow(
+			TenantContextError,
+		);
+	});
+
+	it("stores the active organization", async () => {
+		await runInTenant(ORGANIZATION_A, () => rememberSlackInstall(grant));
+
+		const installation = await inTenant(ORGANIZATION_A, (tx) =>
+			tx.slackInstallation.findUnique({
+				where: {
+					organizationId_installerId: {
+						organizationId: ORGANIZATION_A,
+						installerId: INSTALLER_ID,
+					},
+				},
+				select: { organizationId: true, botToken: true, botScopes: true },
+			}),
+		);
+
+		expect(installation).toMatchObject({
+			organizationId: ORGANIZATION_A,
+			botToken: "xoxb-test-token",
+			botScopes: "chat:write,channels:read",
+		});
+	});
+
+	it("keeps each organization's installation separate", async () => {
+		await runInTenant(ORGANIZATION_A, () => rememberSlackInstall(grant));
+		await runInTenant(ORGANIZATION_B, () => rememberSlackInstall(grant));
+
+		const [installationA, installationB] = await Promise.all([
+			inTenant(ORGANIZATION_A, (tx) =>
+				tx.slackInstallation.findUnique({
+					where: {
+						organizationId_installerId: {
+							organizationId: ORGANIZATION_A,
+							installerId: INSTALLER_ID,
+						},
+					},
+				}),
+			),
+			inTenant(ORGANIZATION_B, (tx) =>
+				tx.slackInstallation.findUnique({
+					where: {
+						organizationId_installerId: {
+							organizationId: ORGANIZATION_B,
+							installerId: INSTALLER_ID,
+						},
+					},
+				}),
+			),
+		]);
+
+		expect(installationA?.organizationId).toBe(ORGANIZATION_A);
+		expect(installationB?.organizationId).toBe(ORGANIZATION_B);
+	});
+
+	it("does not clear stale installations outside the active tenant", async () => {
+		await inTenant(ORGANIZATION_A, (tx) =>
+			tx.slackInstallation.create({
+				data: {
+					installerId: `${INSTALLER_ID}-stale-a`,
+					organizationId: ORGANIZATION_A,
+					teamId: `${suffix}-stale-team-a`,
+					teamName: "Old Team A",
+					userToken: null,
+					userScopes: "channels:read",
+					createdAt: new Date(
+						Date.now() - SLACK_CONNECTION.install.staleMs - 60_000,
+					),
+				},
+			}),
+		);
+
+		await inTenant(ORGANIZATION_B, (tx) =>
+			tx.slackInstallation.create({
+				data: {
+					installerId: EXTERNAL_INSTALLER_ID,
+					organizationId: ORGANIZATION_B,
+					teamId: STALE_TEAM_ID_B,
+					teamName: "Old Team B",
+					userToken: null,
+					userScopes: "channels:read",
+					createdAt: new Date(
+						Date.now() - SLACK_CONNECTION.install.staleMs - 60_000,
+					),
+				},
+			}),
+		);
+
+		await runInTenant(ORGANIZATION_A, () => rememberSlackInstall(grant));
+
+		const staleA = await inTenant(ORGANIZATION_A, (tx) =>
+			tx.slackInstallation.findUnique({
+				where: {
+					organizationId_installerId: {
+						organizationId: ORGANIZATION_A,
+						installerId: `${INSTALLER_ID}-stale-a`,
+					},
+				},
+			}),
+		);
+		const staleB = await inTenant(ORGANIZATION_B, (tx) =>
+			tx.slackInstallation.findUnique({
+				where: {
+					organizationId_installerId: {
+						organizationId: ORGANIZATION_B,
+						installerId: EXTERNAL_INSTALLER_ID,
+					},
+				},
+			}),
+		);
+
+		expect(staleA).toBeNull();
+		expect(staleB?.organizationId).toBe(ORGANIZATION_B);
+	});
+
+	it("replaces only the active organization's workspace grant", async () => {
+		await runInTenant(ORGANIZATION_A, () => rememberSlackInstall(grant));
+
+		await db.account.create({
+			data: {
+				id: ACCOUNT_ID,
+				accountId: INSTALLER_ID,
+				issuer: "local:oauth:slack",
+				providerId: SLACK_PROVIDER_ID,
+				userId: USER_ID,
+			},
+		});
+
+		await inTenant(ORGANIZATION_A, (tx) =>
+			tx.slackWorkspaceGrant.create({
+				data: {
+					id: `slack-grant-${suffix}-stale-a`,
+					organizationId: ORGANIZATION_A,
+					teamId: `${grant.team.id}-stale-a`,
+					userToken: "stale-token-a",
+					userScopes: "channels:read",
+				},
+			}),
+		);
+
+		await inTenant(ORGANIZATION_B, (tx) =>
+			tx.slackWorkspaceGrant.create({
+				data: {
+					id: `slack-grant-${suffix}-stale-b`,
+					organizationId: ORGANIZATION_B,
+					teamId: `${grant.team.id}-stale-b`,
+					userToken: "stale-token-b",
+					userScopes: "channels:read",
+				},
+			}),
+		);
+
+		await runInTenant(ORGANIZATION_A, () =>
+			replaceSlackConnection({ accountId: INSTALLER_ID }),
+		);
+
+		const replaced = await inTenant(ORGANIZATION_A, (tx) =>
+			tx.slackWorkspaceGrant.findUnique({
+				where: {
+					organizationId_teamId: {
+						organizationId: ORGANIZATION_A,
+						teamId: grant.team.id,
+					},
+				},
+			}),
+		);
+		const staleA = await inTenant(ORGANIZATION_A, (tx) =>
+			tx.slackWorkspaceGrant.findUnique({
+				where: {
+					organizationId_teamId: {
+						organizationId: ORGANIZATION_A,
+						teamId: `${grant.team.id}-stale-a`,
+					},
+				},
+			}),
+		);
+		const staleB = await inTenant(ORGANIZATION_B, (tx) =>
+			tx.slackWorkspaceGrant.findUnique({
+				where: {
+					organizationId_teamId: {
+						organizationId: ORGANIZATION_B,
+						teamId: `${grant.team.id}-stale-b`,
+					},
+				},
+			}),
+		);
+
+		expect(replaced?.organizationId).toBe(ORGANIZATION_A);
+		expect(replaced?.botToken).toBe("xoxb-test-token");
+		expect(replaced?.botScopes).toBe("chat:write,channels:read");
+		expect(replaced?.userToken).toBe("xoxp-test-token");
+		expect(staleA).toBeNull();
+		expect(staleB?.organizationId).toBe(ORGANIZATION_B);
+		expect(
+			await inTenant(ORGANIZATION_A, (tx) =>
+				tx.slackInstallation.findUnique({
+					where: {
+						organizationId_installerId: {
+							organizationId: ORGANIZATION_A,
+							installerId: INSTALLER_ID,
+						},
+					},
+				}),
+			),
+		).toBeNull();
+
+		await runInTenant(ORGANIZATION_B, () => rememberSlackInstall(grant));
+		await runInTenant(ORGANIZATION_B, () =>
+			replaceSlackConnection({ accountId: INSTALLER_ID }),
+		);
+
+		const [grantA, grantB] = await Promise.all([
+			inTenant(ORGANIZATION_A, (tx) =>
+				tx.slackWorkspaceGrant.findUnique({
+					where: {
+						organizationId_teamId: {
+							organizationId: ORGANIZATION_A,
+							teamId: grant.team.id,
+						},
+					},
+				}),
+			),
+			inTenant(ORGANIZATION_B, (tx) =>
+				tx.slackWorkspaceGrant.findUnique({
+					where: {
+						organizationId_teamId: {
+							organizationId: ORGANIZATION_B,
+							teamId: grant.team.id,
+						},
+					},
+				}),
+			),
+		]);
+
+		expect(grantA?.organizationId).toBe(ORGANIZATION_A);
+		expect(grantB?.organizationId).toBe(ORGANIZATION_B);
+		expect(
+			await db.account.findUnique({ where: { id: ACCOUNT_ID } }),
+		).not.toBeNull();
+	});
+});
diff --git a/packages/auth/test/sso-tenant-context.integration.spec.ts b/packages/auth/test/sso-tenant-context.integration.spec.ts
new file mode 100644
index 000000000..052d56a07
--- /dev/null
+++ b/packages/auth/test/sso-tenant-context.integration.spec.ts
@@ -0,0 +1,178 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "@crm/db";
+import { runInTenant, tryCurrentOrganizationId } from "@crm/db/tenant-context";
+import { scopedDb } from "@crm/db/tenant-scope";
+import { auth } from "../src/auth";
+import {
+	resolveSsoRequestOrganizationId,
+	runSsoRequestInTenant,
+} from "../src/sso-tenant-context";
+
+const suffix = `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+const organizationA = `sso-request-org-a-${suffix}`;
+const organizationB = `sso-request-org-b-${suffix}`;
+const providerA = `sso-request-provider-a-${suffix}`;
+const providerB = `sso-request-provider-b-${suffix}`;
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: [
+			{
+				id: organizationA,
+				name: `SSO Request A ${suffix}`,
+				slug: organizationA,
+				createdAt: new Date(),
+			},
+			{
+				id: organizationB,
+				name: `SSO Request B ${suffix}`,
+				slug: organizationB,
+				createdAt: new Date(),
+			},
+		],
+	});
+	await runInTenant(organizationA, () =>
+		scopedDb.ssoProvider.create({
+			data: {
+				id: `sso-request-row-a-${suffix}`,
+				providerId: providerA,
+				issuer: "https://a.example.com",
+				domain: "a.example.com, parent.example.com",
+			},
+		}),
+	);
+	await runInTenant(organizationB, () =>
+		scopedDb.ssoProvider.create({
+			data: {
+				id: `sso-request-row-b-${suffix}`,
+				providerId: providerB,
+				issuer: "https://b.example.com",
+				domain: "b.example.com",
+			},
+		}),
+	);
+});
+
+afterAll(async () => {
+	await db.organization.deleteMany({
+		where: { id: { in: [organizationA, organizationB] } },
+	});
+});
+
+describe("SSO request tenant routing", () => {
+	it("scopes the Better Auth SSO adapter", async () => {
+		const adapter = (await auth.$context).adapter;
+
+		await expect(
+			Promise.resolve(
+				adapter.findOne({
+					model: "ssoProvider",
+					where: [{ field: "providerId", value: providerA }],
+				}),
+			),
+		).rejects.toThrow("No active tenant context");
+
+		const provider = await runSsoRequestInTenant(
+			{
+				url: "/api/auth/sign-in/sso",
+				body: { providerId: providerA },
+			},
+			() =>
+				adapter.findOne({
+					model: "ssoProvider",
+					where: [{ field: "providerId", value: providerA }],
+				}),
+		);
+
+		expect(provider?.organizationId).toBe(organizationA);
+	});
+
+	it("routes provider sign-in and callback requests", async () => {
+		expect(
+			await resolveSsoRequestOrganizationId({
+				originalUrl: "/api/auth/sign-in/sso",
+				body: { providerId: providerA },
+			}),
+		).toBe(organizationA);
+
+		expect(
+			await resolveSsoRequestOrganizationId({
+				originalUrl: `/api/auth/sso/callback/${providerB}?code=ok`,
+			}),
+		).toBe(organizationB);
+	});
+
+	it("routes domain, email, and organization sign-in requests", async () => {
+		expect(
+			await resolveSsoRequestOrganizationId({
+				url: "/api/auth/sign-in/sso",
+				body: { domain: "child.parent.example.com" },
+			}),
+		).toBe(organizationA);
+
+		expect(
+			await resolveSsoRequestOrganizationId({
+				url: "/api/auth/sign-in/sso",
+				body: { email: "person@b.example.com" },
+			}),
+		).toBe(organizationB);
+
+		expect(
+			await resolveSsoRequestOrganizationId({
+				url: "/api/auth/sign-in/sso",
+				body: { organizationSlug: organizationA },
+			}),
+		).toBe(organizationA);
+	});
+
+	it("routes provider management requests", async () => {
+		expect(
+			await resolveSsoRequestOrganizationId({
+				url: `/api/auth/sso/get-provider?providerId=${providerA}`,
+			}),
+		).toBe(organizationA);
+
+		expect(
+			await resolveSsoRequestOrganizationId({
+				url: "/api/auth/sso/register",
+				body: { organizationId: organizationB },
+			}),
+		).toBe(organizationB);
+	});
+
+	it("does not create context for unrelated or unresolved requests", async () => {
+		await runSsoRequestInTenant({ url: "/api/auth/session" }, async () => {
+			expect(tryCurrentOrganizationId()).toBeUndefined();
+		});
+
+		await runSsoRequestInTenant(
+			{
+				url: "/api/auth/sign-in/sso",
+				body: { providerId: `missing-${suffix}` },
+			},
+			async () => {
+				expect(tryCurrentOrganizationId()).toBeUndefined();
+			},
+		);
+	});
+
+	it("keeps concurrent tenant contexts separate", async () => {
+		const seen = await Promise.all(
+			[providerA, providerB].map((providerId) =>
+				runSsoRequestInTenant(
+					{
+						url: "/api/auth/sign-in/sso",
+						body: { providerId },
+					},
+					async () => {
+						await Promise.resolve();
+						return tryCurrentOrganizationId();
+					},
+				),
+			),
+		);
+
+		expect(seen).toEqual([organizationA, organizationB]);
+		expect(tryCurrentOrganizationId()).toBeUndefined();
+	});
+});
diff --git a/packages/auth/test/sso.spec.ts b/packages/auth/test/sso.spec.ts
index a69d6e115..ddfa3fa10 100644
--- a/packages/auth/test/sso.spec.ts
+++ b/packages/auth/test/sso.spec.ts
@@ -1,9 +1,8 @@
 import { describe, expect, it } from "bun:test";
 
-process.env.API_URL = "https://crm.example.test";
-
 const { canConfigureSso, ssoCallbackBase, ssoCallbackURL, ssoProviderName } =
 	await import("../src/sso");
+const { apiUrl } = await import("../src/env");
 
 describe("canConfigureSso", () => {
 	it("is the same answer as renaming the workspace", () => {
@@ -16,15 +15,11 @@ describe("canConfigureSso", () => {
 
 describe("ssoCallbackURL", () => {
 	it("is the API origin plus the path better-auth mounts the callback on", () => {
-		expect(ssoCallbackURL("okta")).toBe(
-			"https://crm.example.test/api/auth/sso/callback/okta",
-		);
+		expect(ssoCallbackURL("okta")).toBe(`${apiUrl}/api/auth/sso/callback/okta`);
 	});
 
 	it("hangs off the base the settings page shows", () => {
-		expect(ssoCallbackBase()).toBe(
-			"https://crm.example.test/api/auth/sso/callback",
-		);
+		expect(ssoCallbackBase()).toBe(`${apiUrl}/api/auth/sso/callback`);
 	});
 });
 
diff --git a/packages/auth/test/workspace.spec.ts b/packages/auth/test/workspace.spec.ts
new file mode 100644
index 000000000..d047c111e
--- /dev/null
+++ b/packages/auth/test/workspace.spec.ts
@@ -0,0 +1,29 @@
+import { afterAll, describe, expect, it } from "bun:test";
+import { googleHostedDomain } from "../src/workspace";
+
+const originalAllowList = process.env.ALLOWED_SIGN_IN;
+
+afterAll(() => {
+	if (originalAllowList === undefined) {
+		delete process.env.ALLOWED_SIGN_IN;
+		return;
+	}
+	process.env.ALLOWED_SIGN_IN = originalAllowList;
+});
+
+describe("googleHostedDomain", () => {
+	it("uses the only allowed domain", () => {
+		process.env.ALLOWED_SIGN_IN = "majesticlabs.dev";
+		expect(googleHostedDomain()).toBe("majesticlabs.dev");
+	});
+
+	it("does not restrict Google when an address is allowed", () => {
+		process.env.ALLOWED_SIGN_IN = "david@paluy.org, majesticlabs.dev";
+		expect(googleHostedDomain()).toBeUndefined();
+	});
+
+	it("does not restrict Google when multiple domains are allowed", () => {
+		process.env.ALLOWED_SIGN_IN = "majesticlabs.dev, altertx.com";
+		expect(googleHostedDomain()).toBeUndefined();
+	});
+});
diff --git a/packages/auth/tsconfig.json b/packages/auth/tsconfig.json
index 3c44722d2..954d8582e 100644
--- a/packages/auth/tsconfig.json
+++ b/packages/auth/tsconfig.json
@@ -7,6 +7,6 @@
 		"declaration": false,
 		"declarationMap": false
 	},
-	"include": ["src/**/*.ts", "src/**/*.tsx"],
+	"include": ["scripts/**/*.ts", "src/**/*.ts", "src/**/*.tsx"],
 	"exclude": ["node_modules"]
 }
diff --git a/packages/auth/turbo.json b/packages/auth/turbo.json
index 7160b71b9..db3cf95d4 100644
--- a/packages/auth/turbo.json
+++ b/packages/auth/turbo.json
@@ -1,5 +1,5 @@
 {
-	"$schema": "https://turborepo.dev/schema.json",
+	"$schema": "https://v2-10-12.turborepo.dev/schema.json",
 	"extends": ["//"],
 	"tasks": {
 		"auth:generate": {
diff --git a/packages/db/README.md b/packages/db/README.md
index e4be5ff76..1aefb0bcf 100644
--- a/packages/db/README.md
+++ b/packages/db/README.md
@@ -65,7 +65,7 @@ generated model map.
   needs no `transpilePackages` entry. Non-bundler consumers need a TypeScript
   runtime — the NestJS API runs on Bun for exactly this reason.
 - **Auth models are generated.** `User`, `Session`, `Account`, `Verification`
-  and `RateLimit` come from `@better-auth/cli`. Do not hand-edit them — change
+  and `RateLimit` come from `auth`. Do not hand-edit them — change
   the Better Auth config in `@crm/auth` and re-run `bun run auth:generate`.
   The generator is additive: it adds models and fields a plugin needs but never
   removes the ones a dropped plugin left behind, so removing a plugin means
diff --git a/packages/db/docker/init-runtime-role.sql b/packages/db/docker/init-runtime-role.sql
new file mode 100644
index 000000000..c9c0f14e9
--- /dev/null
+++ b/packages/db/docker/init-runtime-role.sql
@@ -0,0 +1,5 @@
+CREATE ROLE crm
+	WITH LOGIN PASSWORD 'crm'
+	NOSUPERUSER CREATEDB NOCREATEROLE NOINHERIT NOBYPASSRLS;
+
+ALTER DATABASE crm OWNER TO crm;
diff --git a/packages/db/package.json b/packages/db/package.json
index 4935913b1..690b6c408 100644
--- a/packages/db/package.json
+++ b/packages/db/package.json
@@ -20,11 +20,17 @@
 		"./images": "./src/images.ts",
 		"./idempotency": "./src/idempotency.ts",
 		"./json": "./src/json.ts",
+		"./pool": "./src/pool.ts",
 		"./safe-fetch": "./src/safe-fetch.ts",
 		"./settings": "./src/settings.ts",
 		"./slack-inventory": "./src/slack-inventory.ts",
 		"./tracking": "./src/tracking.ts",
-		"./workspace": "./src/workspace.ts"
+		"./tenant-context": "./src/tenant-context.ts",
+		"./tenant-scope": "./src/tenant-scope.ts",
+		"./tenants": "./src/tenants.ts",
+		"./test-support": "./src/test-support.ts",
+		"./workspace": "./src/workspace.ts",
+		"./workspace-slug": "./src/workspace-slug.ts"
 	},
 	"scripts": {
 		"build": "prisma generate",
@@ -33,6 +39,8 @@
 		"db:generate": "prisma generate",
 		"db:migrate": "bun scripts/require-local-db.ts db:migrate && prisma migrate dev",
 		"db:push": "bun scripts/require-local-db.ts db:push && prisma db push",
+		"db:rehearse": "bun scripts/rehearse-migration.ts",
+		"db:provision": "bun scripts/provision-organization.ts",
 		"db:reset": "bun scripts/require-local-db.ts db:reset && prisma migrate reset",
 		"db:seed": "bun scripts/require-local-db.ts db:seed && prisma db seed",
 		"db:studio": "prisma studio",
@@ -45,15 +53,16 @@
 	},
 	"dependencies": {
 		"@crm/env": "workspace:*",
-		"@prisma/adapter-pg": "^7.9.1",
-		"@prisma/client": "^7.9.1",
-		"@vercel/blob": "^2.6.1"
+		"@prisma/adapter-pg": "^7.10.0",
+		"@prisma/client": "^7.10.0",
+		"@vercel/blob": "^2.8.0"
 	},
 	"devDependencies": {
 		"@crm/typescript-config": "workspace:*",
-		"@types/node": "^24.10.1",
-		"pg": "^8.22.0",
-		"prisma": "^7.9.1",
-		"typescript": "5.9.2"
+		"@types/bun": "^1.4.2",
+		"@types/node": "^26.5.0",
+		"pg": "^8.23.0",
+		"prisma": "^7.10.0",
+		"typescript": "7.0.2"
 	}
 }
diff --git a/packages/db/prisma/migrations/20260826190000_xmpp_agent_tasks/migration.sql b/packages/db/prisma/migrations/20260826190000_xmpp_agent_tasks/migration.sql
new file mode 100644
index 000000000..e5b37b192
--- /dev/null
+++ b/packages/db/prisma/migrations/20260826190000_xmpp_agent_tasks/migration.sql
@@ -0,0 +1,33 @@
+CREATE TYPE "XmppAgentTaskState" AS ENUM ('ACCEPTED', 'RUNNING', 'CANCELLING', 'COMPLETED', 'FAILED', 'CANCELLED');
+
+CREATE TABLE "xmppAgentTask" (
+    "id" TEXT NOT NULL,
+    "organizationId" TEXT NOT NULL,
+    "requestId" TEXT NOT NULL,
+    "callerJid" TEXT NOT NULL,
+    "notificationJid" TEXT NOT NULL,
+    "targetJid" TEXT NOT NULL,
+    "tool" TEXT NOT NULL,
+    "apiVersion" TEXT NOT NULL,
+    "manifestHash" TEXT NOT NULL,
+    "fingerprint" TEXT NOT NULL,
+    "arguments" JSONB NOT NULL,
+    "state" "XmppAgentTaskState" NOT NULL DEFAULT 'ACCEPTED',
+    "revision" INTEGER NOT NULL DEFAULT 0,
+    "progress" JSONB,
+    "result" JSONB,
+    "error" JSONB,
+    "summary" TEXT,
+    "eveSessionId" TEXT,
+    "deadline" TIMESTAMP(3),
+    "retainUntil" TIMESTAMP(3) NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "xmppAgentTask_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "xmppAgentTask_organizationId_callerJid_targetJid_requestId_key" ON "xmppAgentTask"("organizationId", "callerJid", "targetJid", "requestId");
+CREATE INDEX "xmppAgentTask_organizationId_state_updatedAt_idx" ON "xmppAgentTask"("organizationId", "state", "updatedAt");
+CREATE INDEX "xmppAgentTask_retainUntil_idx" ON "xmppAgentTask"("retainUntil");
+
+ALTER TABLE "xmppAgentTask" ADD CONSTRAINT "xmppAgentTask_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/packages/db/prisma/migrations/20260827180000_xmpp_task_leases/migration.sql b/packages/db/prisma/migrations/20260827180000_xmpp_task_leases/migration.sql
new file mode 100644
index 000000000..79e4a56f8
--- /dev/null
+++ b/packages/db/prisma/migrations/20260827180000_xmpp_task_leases/migration.sql
@@ -0,0 +1,6 @@
+ALTER TABLE "xmppAgentTask"
+ADD COLUMN "ownerId" TEXT,
+ADD COLUMN "leaseUntil" TIMESTAMP(3);
+
+CREATE INDEX "xmppAgentTask_organizationId_state_leaseUntil_idx"
+ON "xmppAgentTask"("organizationId", "state", "leaseUntil");
diff --git a/packages/db/prisma/migrations/20260829113915_add_oauth_provider/migration.sql b/packages/db/prisma/migrations/20260829113915_add_oauth_provider/migration.sql
new file mode 100644
index 000000000..3b44eb6ed
--- /dev/null
+++ b/packages/db/prisma/migrations/20260829113915_add_oauth_provider/migration.sql
@@ -0,0 +1,206 @@
+CREATE TABLE "jwks" (
+    "id" TEXT NOT NULL,
+    "publicKey" TEXT NOT NULL,
+    "privateKey" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL,
+    "expiresAt" TIMESTAMP(3),
+    "alg" TEXT,
+    "crv" TEXT,
+
+    CONSTRAINT "jwks_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "oauthClient" (
+    "id" TEXT NOT NULL,
+    "clientId" TEXT NOT NULL,
+    "clientSecret" TEXT,
+    "clientDiscoveryId" TEXT,
+    "disabled" BOOLEAN DEFAULT false,
+    "skipConsent" BOOLEAN,
+    "enableEndSession" BOOLEAN,
+    "subjectType" TEXT,
+    "scopes" TEXT[] NOT NULL,
+    "clientCredentialsScopes" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
+    "userId" TEXT,
+    "createdAt" TIMESTAMP(3),
+    "updatedAt" TIMESTAMP(3),
+    "name" TEXT,
+    "uri" TEXT,
+    "icon" TEXT,
+    "contacts" TEXT[] NOT NULL,
+    "tos" TEXT,
+    "policy" TEXT,
+    "softwareId" TEXT,
+    "softwareVersion" TEXT,
+    "softwareStatement" TEXT,
+    "redirectUris" TEXT[] NOT NULL,
+    "postLogoutRedirectUris" TEXT[] NOT NULL,
+    "backchannelLogoutUri" TEXT,
+    "backchannelLogoutSessionRequired" BOOLEAN,
+    "tokenEndpointAuthMethod" TEXT,
+    "applicationType" TEXT,
+    "jwks" TEXT,
+    "jwksUri" TEXT,
+    "grantTypes" TEXT[] NOT NULL,
+    "responseTypes" TEXT[] NOT NULL,
+    "requirePKCE" BOOLEAN,
+    "dpopBoundAccessTokens" BOOLEAN DEFAULT false,
+    "referenceId" TEXT,
+    "metadata" JSONB,
+
+    CONSTRAINT "oauthClient_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "oauthResource" (
+    "id" TEXT NOT NULL,
+    "identifier" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "accessTokenTtl" INTEGER,
+    "refreshTokenTtl" INTEGER,
+    "signingAlgorithm" TEXT,
+    "signingKeyId" TEXT,
+    "allowedScopes" TEXT[] NOT NULL,
+    "customClaims" JSONB,
+    "dpopBoundAccessTokensRequired" BOOLEAN DEFAULT false,
+    "disabled" BOOLEAN DEFAULT false,
+    "createdAt" TIMESTAMP(3),
+    "updatedAt" TIMESTAMP(3),
+    "policyVersion" INTEGER DEFAULT 1,
+    "metadata" JSONB,
+
+    CONSTRAINT "oauthResource_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "oauthClientResource" (
+    "id" TEXT NOT NULL,
+    "clientId" TEXT NOT NULL,
+    "resourceId" TEXT NOT NULL,
+    "metadata" JSONB,
+    "createdAt" TIMESTAMP(3),
+
+    CONSTRAINT "oauthClientResource_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "oauthRefreshToken" (
+    "id" TEXT NOT NULL,
+    "token" TEXT NOT NULL,
+    "clientId" TEXT NOT NULL,
+    "sessionId" TEXT,
+    "userId" TEXT NOT NULL,
+    "referenceId" TEXT,
+    "authorizationCodeId" TEXT,
+    "resources" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
+    "requestedUserInfoClaims" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
+    "expiresAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3),
+    "revoked" TIMESTAMP(3),
+    "rotatedAt" TIMESTAMP(3),
+    "rotationReplayResponse" TEXT,
+    "rotationReplayExpiresAt" TIMESTAMP(3),
+    "authTime" TIMESTAMP(3),
+    "confirmation" JSONB,
+    "scopes" TEXT[] NOT NULL,
+
+    CONSTRAINT "oauthRefreshToken_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "oauthAccessToken" (
+    "id" TEXT NOT NULL,
+    "token" TEXT,
+    "clientId" TEXT NOT NULL,
+    "sessionId" TEXT,
+    "userId" TEXT,
+    "referenceId" TEXT,
+    "authorizationCodeId" TEXT,
+    "resources" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
+    "requestedUserInfoClaims" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
+    "refreshId" TEXT,
+    "expiresAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3),
+    "revoked" TIMESTAMP(3),
+    "confirmation" JSONB,
+    "scopes" TEXT[] NOT NULL,
+
+    CONSTRAINT "oauthAccessToken_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "oauthConsent" (
+    "id" TEXT NOT NULL,
+    "clientId" TEXT NOT NULL,
+    "userId" TEXT,
+    "referenceId" TEXT,
+    "resources" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
+    "requestedUserInfoClaims" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
+    "scopes" TEXT[] NOT NULL,
+    "createdAt" TIMESTAMP(3),
+    "updatedAt" TIMESTAMP(3),
+
+    CONSTRAINT "oauthConsent_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "oauthClientAssertion" (
+    "id" TEXT NOT NULL,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "oauthClientAssertion_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX "oauthClient_userId_idx" ON "oauthClient"("userId");
+
+CREATE UNIQUE INDEX "oauthClient_clientId_key" ON "oauthClient"("clientId");
+
+CREATE UNIQUE INDEX "oauthResource_identifier_key" ON "oauthResource"("identifier");
+
+CREATE INDEX "oauthClientResource_clientId_idx" ON "oauthClientResource"("clientId");
+
+CREATE INDEX "oauthClientResource_resourceId_idx" ON "oauthClientResource"("resourceId");
+
+CREATE INDEX "oauthRefreshToken_clientId_idx" ON "oauthRefreshToken"("clientId");
+
+CREATE INDEX "oauthRefreshToken_sessionId_idx" ON "oauthRefreshToken"("sessionId");
+
+CREATE INDEX "oauthRefreshToken_userId_idx" ON "oauthRefreshToken"("userId");
+
+CREATE INDEX "oauthRefreshToken_authorizationCodeId_idx" ON "oauthRefreshToken"("authorizationCodeId");
+
+CREATE UNIQUE INDEX "oauthRefreshToken_token_key" ON "oauthRefreshToken"("token");
+
+CREATE INDEX "oauthAccessToken_clientId_idx" ON "oauthAccessToken"("clientId");
+
+CREATE INDEX "oauthAccessToken_sessionId_idx" ON "oauthAccessToken"("sessionId");
+
+CREATE INDEX "oauthAccessToken_userId_idx" ON "oauthAccessToken"("userId");
+
+CREATE INDEX "oauthAccessToken_authorizationCodeId_idx" ON "oauthAccessToken"("authorizationCodeId");
+
+CREATE INDEX "oauthAccessToken_refreshId_idx" ON "oauthAccessToken"("refreshId");
+
+CREATE UNIQUE INDEX "oauthAccessToken_token_key" ON "oauthAccessToken"("token");
+
+CREATE INDEX "oauthConsent_clientId_idx" ON "oauthConsent"("clientId");
+
+CREATE INDEX "oauthConsent_userId_idx" ON "oauthConsent"("userId");
+
+ALTER TABLE "oauthClient" ADD CONSTRAINT "oauthClient_userId_fkey" FOREIGN KEY ("userId") REFERENCES "user"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "oauthClientResource" ADD CONSTRAINT "oauthClientResource_clientId_fkey" FOREIGN KEY ("clientId") REFERENCES "oauthClient"("clientId") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "oauthClientResource" ADD CONSTRAINT "oauthClientResource_resourceId_fkey" FOREIGN KEY ("resourceId") REFERENCES "oauthResource"("identifier") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "oauthRefreshToken" ADD CONSTRAINT "oauthRefreshToken_clientId_fkey" FOREIGN KEY ("clientId") REFERENCES "oauthClient"("clientId") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "oauthRefreshToken" ADD CONSTRAINT "oauthRefreshToken_sessionId_fkey" FOREIGN KEY ("sessionId") REFERENCES "session"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+ALTER TABLE "oauthRefreshToken" ADD CONSTRAINT "oauthRefreshToken_userId_fkey" FOREIGN KEY ("userId") REFERENCES "user"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "oauthAccessToken" ADD CONSTRAINT "oauthAccessToken_clientId_fkey" FOREIGN KEY ("clientId") REFERENCES "oauthClient"("clientId") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "oauthAccessToken" ADD CONSTRAINT "oauthAccessToken_sessionId_fkey" FOREIGN KEY ("sessionId") REFERENCES "session"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+ALTER TABLE "oauthAccessToken" ADD CONSTRAINT "oauthAccessToken_userId_fkey" FOREIGN KEY ("userId") REFERENCES "user"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "oauthAccessToken" ADD CONSTRAINT "oauthAccessToken_refreshId_fkey" FOREIGN KEY ("refreshId") REFERENCES "oauthRefreshToken"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "oauthConsent" ADD CONSTRAINT "oauthConsent_clientId_fkey" FOREIGN KEY ("clientId") REFERENCES "oauthClient"("clientId") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "oauthConsent" ADD CONSTRAINT "oauthConsent_userId_fkey" FOREIGN KEY ("userId") REFERENCES "user"("id") ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/packages/db/prisma/migrations/20260829120000_add_deal_metadata_documents/migration.sql b/packages/db/prisma/migrations/20260829120000_add_deal_metadata_documents/migration.sql
new file mode 100644
index 000000000..f8b5bf7fd
--- /dev/null
+++ b/packages/db/prisma/migrations/20260829120000_add_deal_metadata_documents/migration.sql
@@ -0,0 +1,72 @@
+BEGIN;
+
+ALTER TABLE "deal"
+  ADD COLUMN "leadSource" TEXT,
+  ADD COLUMN "projectType" TEXT,
+  ADD COLUMN "addressLine1" TEXT,
+  ADD COLUMN "addressLine2" TEXT,
+  ADD COLUMN "city" TEXT,
+  ADD COLUMN "state" TEXT,
+  ADD COLUMN "postalCode" TEXT;
+
+ALTER TABLE "agentRun" ADD COLUMN "dealId" TEXT;
+CREATE INDEX "agentRun_dealId_createdAt_idx" ON "agentRun" ("dealId", "createdAt");
+ALTER TABLE "agentRun"
+  ADD CONSTRAINT "agentRun_dealId_fkey"
+  FOREIGN KEY ("dealId") REFERENCES "deal"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+CREATE TABLE "artifact" (
+  "id" TEXT NOT NULL,
+  "dealId" TEXT NOT NULL,
+  "type" TEXT NOT NULL,
+  "fileName" TEXT NOT NULL,
+  "storageKey" TEXT NOT NULL,
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "artifact_pkey" PRIMARY KEY ("id")
+);
+CREATE INDEX "artifact_dealId_createdAt_idx" ON "artifact" ("dealId", "createdAt");
+ALTER TABLE "artifact"
+  ADD CONSTRAINT "artifact_dealId_fkey"
+  FOREIGN KEY ("dealId") REFERENCES "deal"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+CREATE TABLE "document" (
+  "id" TEXT NOT NULL,
+  "dealId" TEXT NOT NULL,
+  "type" TEXT NOT NULL,
+  "number" TEXT NOT NULL,
+  "status" TEXT NOT NULL,
+  "currency" TEXT NOT NULL DEFAULT 'USD',
+  "issuedAt" TIMESTAMP(3),
+  "dueAt" TIMESTAMP(3),
+  "recipientSnapshot" JSONB NOT NULL,
+  "contractorSnapshot" JSONB NOT NULL,
+  "projectSnapshot" JSONB NOT NULL,
+  "subtotal" DECIMAL(14,2) NOT NULL,
+  "tax" DECIMAL(14,2) NOT NULL,
+  "total" DECIMAL(14,2) NOT NULL,
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "updatedAt" TIMESTAMP(3) NOT NULL,
+  CONSTRAINT "document_pkey" PRIMARY KEY ("id")
+);
+CREATE INDEX "document_dealId_createdAt_idx" ON "document" ("dealId", "createdAt");
+ALTER TABLE "document"
+  ADD CONSTRAINT "document_dealId_fkey"
+  FOREIGN KEY ("dealId") REFERENCES "deal"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+CREATE TABLE "documentLineItem" (
+  "id" TEXT NOT NULL,
+  "documentId" TEXT NOT NULL,
+  "description" TEXT NOT NULL,
+  "quantity" DECIMAL(14,2) NOT NULL,
+  "unitPrice" DECIMAL(14,2) NOT NULL,
+  "total" DECIMAL(14,2) NOT NULL,
+  "position" INTEGER NOT NULL,
+  CONSTRAINT "documentLineItem_pkey" PRIMARY KEY ("id")
+);
+CREATE INDEX "documentLineItem_documentId_position_idx"
+  ON "documentLineItem" ("documentId", "position");
+ALTER TABLE "documentLineItem"
+  ADD CONSTRAINT "documentLineItem_documentId_fkey"
+  FOREIGN KEY ("documentId") REFERENCES "document"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+COMMIT;
diff --git a/packages/db/prisma/migrations/20260830221000_better_auth_account_identity/migration.sql b/packages/db/prisma/migrations/20260830221000_better_auth_account_identity/migration.sql
new file mode 100644
index 000000000..524048ced
--- /dev/null
+++ b/packages/db/prisma/migrations/20260830221000_better_auth_account_identity/migration.sql
@@ -0,0 +1,107 @@
+CREATE FUNCTION "better_auth_jwt_payload"(token TEXT) RETURNS JSONB
+LANGUAGE plpgsql IMMUTABLE STRICT AS $$
+DECLARE
+    payload TEXT;
+BEGIN
+    payload := translate(split_part(token, '.', 2), '-_', '+/');
+    payload := payload || repeat('=', (4 - length(payload) % 4) % 4);
+    RETURN convert_from(decode(payload, 'base64'), 'UTF8')::JSONB;
+EXCEPTION WHEN OTHERS THEN
+    RETURN NULL;
+END;
+$$;
+
+ALTER TABLE "account" ADD COLUMN "issuer" TEXT;
+
+UPDATE "account"
+SET "issuer" = 'local:credential',
+    "accountId" = "userId"
+WHERE "providerId" = 'credential';
+
+UPDATE "account"
+SET "issuer" = 'https://accounts.google.com'
+WHERE "providerId" = 'google';
+
+UPDATE "account"
+SET "issuer" = 'local:oauth:slack'
+WHERE "providerId" = 'slack';
+
+WITH "microsoftIdentity" AS MATERIALIZED (
+    SELECT "id", "better_auth_jwt_payload"("idToken") AS "payload"
+    FROM "account"
+    WHERE "providerId" = 'microsoft'
+      AND "idToken" IS NOT NULL
+)
+UPDATE "account" AS account
+SET "issuer" = identity."payload"->>'iss',
+    "accountId" = identity."payload"->>'oid'
+FROM "microsoftIdentity" AS identity
+WHERE account."id" = identity."id"
+  AND jsonb_typeof(identity."payload"->'iss') = 'string'
+  AND length(identity."payload"->>'iss') > 0
+  AND jsonb_typeof(identity."payload"->'oid') = 'string'
+  AND length(identity."payload"->>'oid') > 0;
+
+UPDATE "account" AS account
+SET "issuer" = provider."issuer"
+FROM "ssoProvider" AS provider
+WHERE account."providerId" = provider."providerId"
+  AND account."issuer" IS NULL
+  AND length(provider."issuer") > 0;
+
+DELETE FROM "account" AS account
+WHERE account."issuer" IS NULL
+  AND account."providerId" NOT IN ('credential', 'google', 'microsoft', 'slack')
+  AND NOT EXISTS (
+      SELECT 1
+      FROM "ssoProvider" AS provider
+      WHERE provider."providerId" = account."providerId"
+  );
+
+DO $$
+BEGIN
+    IF EXISTS (
+        SELECT 1 FROM "account"
+        WHERE "issuer" IS NULL OR length("issuer") = 0
+    ) THEN
+        RAISE EXCEPTION 'Better Auth account issuer backfill is incomplete';
+    END IF;
+    IF EXISTS (
+        SELECT 1 FROM "account"
+        WHERE "providerId" = 'microsoft'
+          AND (
+              "idToken" IS NULL
+              OR "issuer" IS DISTINCT FROM "better_auth_jwt_payload"("idToken")->>'iss'
+              OR "accountId" IS DISTINCT FROM "better_auth_jwt_payload"("idToken")->>'oid'
+          )
+    ) THEN
+        RAISE EXCEPTION 'Microsoft account identity needs a verified oid mapping before Better Auth 1.7';
+    END IF;
+    IF EXISTS (
+        SELECT 1
+        FROM "account"
+        GROUP BY "issuer", "accountId"
+        HAVING count(*) > 1
+    ) THEN
+        RAISE EXCEPTION 'Better Auth account identity backfill found duplicate issuer and accountId pairs';
+    END IF;
+    IF EXISTS (
+        SELECT 1
+        FROM "account"
+        GROUP BY "userId", "providerId"
+        HAVING count(*) > 1
+    ) THEN
+        RAISE EXCEPTION 'Mailbox account identity backfill found duplicate userId and providerId pairs';
+    END IF;
+END;
+$$;
+
+ALTER TABLE "account" ALTER COLUMN "issuer" SET NOT NULL;
+
+CREATE UNIQUE INDEX "account_issuer_accountId_uidx"
+ON "account"("issuer", "accountId");
+
+CREATE UNIQUE INDEX "account_userId_providerId_uidx"
+ON "account"("userId", "providerId");
+
+DROP FUNCTION "better_auth_jwt_payload"(TEXT);
diff --git a/packages/db/prisma/migrations/20260902181324_kaneo_domain/migration.sql b/packages/db/prisma/migrations/20260902181324_kaneo_domain/migration.sql
new file mode 100644
index 000000000..67fa56adc
--- /dev/null
+++ b/packages/db/prisma/migrations/20260902181324_kaneo_domain/migration.sql
@@ -0,0 +1,769 @@
+-- CreateSchema
+CREATE SCHEMA IF NOT EXISTS "public";
+
+-- CreateTable
+CREATE TABLE "user_avatar" (
+    "id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "mime_type" TEXT NOT NULL,
+    "size" INTEGER NOT NULL,
+    "data" BYTEA NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "user_avatar_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "workspace" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "logo" TEXT,
+    "metadata" TEXT,
+    "description" TEXT,
+    "created_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "workspace_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "workspace_member" (
+    "id" TEXT NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "role" TEXT NOT NULL DEFAULT 'member',
+    "joined_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "workspace_member_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "workspace_billing" (
+    "id" TEXT NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "founding_free" BOOLEAN NOT NULL DEFAULT false,
+    "trial_ends_at" TIMESTAMP(3),
+    "creem_customer_id" TEXT,
+    "creem_subscription_id" TEXT,
+    "creem_product_id" TEXT,
+    "plan" TEXT,
+    "billing_interval" TEXT,
+    "status" TEXT,
+    "seats" INTEGER NOT NULL DEFAULT 1,
+    "current_period_end" TIMESTAMP(3),
+    "canceled_at" TIMESTAMP(3),
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "workspace_billing_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "trial_grant" (
+    "email_hash" TEXT NOT NULL,
+    "trial_ends_at" TIMESTAMP(3) NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "trial_grant_pkey" PRIMARY KEY ("email_hash")
+);
+
+-- CreateTable
+CREATE TABLE "billing_event" (
+    "id" TEXT NOT NULL,
+    "event_type" TEXT NOT NULL,
+    "processed_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "billing_event_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "team" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL,
+    "updated_at" TIMESTAMP(3),
+
+    CONSTRAINT "team_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "team_member" (
+    "id" TEXT NOT NULL,
+    "team_id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3),
+
+    CONSTRAINT "team_member_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "workspace_invitation" (
+    "id" TEXT NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "email" TEXT NOT NULL,
+    "role" TEXT,
+    "team_id" TEXT,
+    "status" TEXT NOT NULL DEFAULT 'pending',
+    "expires_at" TIMESTAMP(3) NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "inviter_id" TEXT NOT NULL,
+
+    CONSTRAINT "workspace_invitation_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "workspace_role" (
+    "id" TEXT NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "role" TEXT NOT NULL,
+    "permission" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "workspace_role_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "project" (
+    "id" TEXT NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "icon" TEXT DEFAULT 'Layout',
+    "name" TEXT NOT NULL,
+    "description" TEXT,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "is_public" BOOLEAN DEFAULT false,
+    "archived_at" TIMESTAMP(3),
+    "last_task_number" INTEGER NOT NULL DEFAULT 0,
+    "position" INTEGER NOT NULL DEFAULT 0,
+
+    CONSTRAINT "project_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "column" (
+    "id" TEXT NOT NULL,
+    "project_id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "position" INTEGER NOT NULL DEFAULT 0,
+    "icon" TEXT,
+    "color" TEXT,
+    "is_final" BOOLEAN NOT NULL DEFAULT false,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "column_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "workflow_rule" (
+    "id" TEXT NOT NULL,
+    "project_id" TEXT NOT NULL,
+    "integration_type" TEXT NOT NULL,
+    "event_type" TEXT NOT NULL,
+    "column_id" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "workflow_rule_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "task" (
+    "id" TEXT NOT NULL,
+    "project_id" TEXT NOT NULL,
+    "position" INTEGER DEFAULT 0,
+    "number" INTEGER DEFAULT 1,
+    "assignee_id" TEXT,
+    "title" TEXT NOT NULL,
+    "description" TEXT,
+    "status" TEXT NOT NULL DEFAULT 'to-do',
+    "column_id" TEXT,
+    "priority" TEXT NOT NULL DEFAULT 'low',
+    "start_date" TIMESTAMP(3),
+    "due_date" TIMESTAMP(3),
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "task_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "billing_reminder_sent" (
+    "id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "reminder_type" TEXT NOT NULL,
+    "trial_ends_at" TIMESTAMP(3),
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "billing_reminder_sent_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "job_lease" (
+    "name" TEXT NOT NULL,
+    "owner" TEXT NOT NULL,
+    "expires_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "job_lease_pkey" PRIMARY KEY ("name")
+);
+
+-- CreateTable
+CREATE TABLE "task_reminder_sent" (
+    "id" TEXT NOT NULL,
+    "task_id" TEXT NOT NULL,
+    "reminder_type" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "task_reminder_sent_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "time_entry" (
+    "id" TEXT NOT NULL,
+    "task_id" TEXT NOT NULL,
+    "user_id" TEXT,
+    "description" TEXT,
+    "start_time" TIMESTAMP(3) NOT NULL,
+    "end_time" TIMESTAMP(3),
+    "duration" INTEGER DEFAULT 0,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "time_entry_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "task_activity" (
+    "id" TEXT NOT NULL,
+    "task_id" TEXT NOT NULL,
+    "type" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "user_id" TEXT,
+    "content" TEXT,
+    "event_data" JSONB,
+    "external_user_name" TEXT,
+    "external_user_avatar" TEXT,
+    "external_source" TEXT,
+    "external_url" TEXT,
+
+    CONSTRAINT "task_activity_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "asset" (
+    "id" TEXT NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "project_id" TEXT NOT NULL,
+    "task_id" TEXT,
+    "activity_id" TEXT,
+    "object_key" TEXT NOT NULL,
+    "filename" TEXT NOT NULL,
+    "mime_type" TEXT NOT NULL,
+    "size" INTEGER NOT NULL,
+    "kind" TEXT NOT NULL DEFAULT 'image',
+    "surface" TEXT NOT NULL DEFAULT 'description',
+    "created_by" TEXT,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "asset_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "label" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "color" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "task_id" TEXT,
+    "workspace_id" TEXT,
+
+    CONSTRAINT "label_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "notification" (
+    "id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "title" TEXT,
+    "content" TEXT,
+    "type" TEXT NOT NULL DEFAULT 'info',
+    "event_data" JSONB,
+    "is_read" BOOLEAN DEFAULT false,
+    "resource_id" TEXT,
+    "resource_type" TEXT,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "notification_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "user_notification_preference" (
+    "id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "email_enabled" BOOLEAN NOT NULL DEFAULT false,
+    "ntfy_enabled" BOOLEAN NOT NULL DEFAULT false,
+    "ntfy_server_url" TEXT,
+    "ntfy_topic" TEXT,
+    "ntfy_token" TEXT,
+    "gotify_enabled" BOOLEAN NOT NULL DEFAULT false,
+    "gotify_server_url" TEXT,
+    "gotify_token" TEXT,
+    "webhook_enabled" BOOLEAN NOT NULL DEFAULT false,
+    "webhook_url" TEXT,
+    "webhook_secret" TEXT,
+    "task_assignment_enabled" BOOLEAN NOT NULL DEFAULT true,
+    "task_comment_enabled" BOOLEAN NOT NULL DEFAULT true,
+    "task_status_change_enabled" BOOLEAN NOT NULL DEFAULT true,
+    "due_date_reminder_enabled" BOOLEAN NOT NULL DEFAULT true,
+    "due_date_reminder_lead_time_minutes" INTEGER NOT NULL DEFAULT 1440,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "user_notification_preference_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "user_notification_workspace_rule" (
+    "id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "is_active" BOOLEAN NOT NULL DEFAULT true,
+    "email_enabled" BOOLEAN NOT NULL DEFAULT false,
+    "ntfy_enabled" BOOLEAN NOT NULL DEFAULT false,
+    "gotify_enabled" BOOLEAN NOT NULL DEFAULT false,
+    "webhook_enabled" BOOLEAN NOT NULL DEFAULT false,
+    "project_mode" TEXT NOT NULL DEFAULT 'all',
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "user_notification_workspace_rule_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "user_notification_workspace_project" (
+    "id" TEXT NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "workspace_rule_id" TEXT NOT NULL,
+    "project_id" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "user_notification_workspace_project_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "github_integration" (
+    "id" TEXT NOT NULL,
+    "project_id" TEXT NOT NULL,
+    "repository_owner" TEXT NOT NULL,
+    "repository_name" TEXT NOT NULL,
+    "installation_id" INTEGER,
+    "is_active" BOOLEAN DEFAULT true,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "github_integration_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "integration" (
+    "id" TEXT NOT NULL,
+    "project_id" TEXT NOT NULL,
+    "type" TEXT NOT NULL,
+    "config" TEXT NOT NULL,
+    "is_active" BOOLEAN DEFAULT true,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "integration_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "external_link" (
+    "id" TEXT NOT NULL,
+    "task_id" TEXT NOT NULL,
+    "integration_id" TEXT NOT NULL,
+    "resource_type" TEXT NOT NULL,
+    "external_id" TEXT NOT NULL,
+    "url" TEXT NOT NULL,
+    "title" TEXT,
+    "metadata" TEXT,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "external_link_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "comment" (
+    "id" TEXT NOT NULL,
+    "task_id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "content" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "comment_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "task_relation" (
+    "id" TEXT NOT NULL,
+    "source_task_id" TEXT NOT NULL,
+    "target_task_id" TEXT NOT NULL,
+    "relation_type" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "task_relation_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "device_code" (
+    "id" TEXT NOT NULL,
+    "device_code" TEXT NOT NULL,
+    "user_code" TEXT NOT NULL,
+    "user_id" TEXT,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "expires_at" TIMESTAMP(3) NOT NULL,
+    "status" TEXT NOT NULL,
+    "last_polled_at" TIMESTAMP(3),
+    "polling_interval" INTEGER,
+    "client_id" TEXT,
+    "scope" TEXT,
+
+    CONSTRAINT "device_code_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "mcp_oauth_state" (
+    "id" TEXT NOT NULL,
+    "kind" TEXT NOT NULL,
+    "key" TEXT NOT NULL,
+    "payload" JSONB NOT NULL,
+    "expires_at" TIMESTAMP(3) NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "mcp_oauth_state_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "user_avatar_user_id_unique" ON "user_avatar"("user_id");
+
+-- CreateIndex
+CREATE INDEX "user_avatar_userId_idx" ON "user_avatar"("user_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "workspace_slug_key" ON "workspace"("slug");
+
+-- CreateIndex
+CREATE INDEX "workspace_member_workspaceId_idx" ON "workspace_member"("workspace_id");
+
+-- CreateIndex
+CREATE INDEX "workspace_member_userId_idx" ON "workspace_member"("user_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "workspace_billing_workspace_id_unique" ON "workspace_billing"("workspace_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "workspace_billing_creem_subscription_id_key" ON "workspace_billing"("creem_subscription_id");
+
+-- CreateIndex
+CREATE INDEX "workspace_billing_workspaceId_idx" ON "workspace_billing"("workspace_id");
+
+-- CreateIndex
+CREATE INDEX "team_workspaceId_idx" ON "team"("workspace_id");
+
+-- CreateIndex
+CREATE INDEX "teamMember_teamId_idx" ON "team_member"("team_id");
+
+-- CreateIndex
+CREATE INDEX "teamMember_userId_idx" ON "team_member"("user_id");
+
+-- CreateIndex
+CREATE INDEX "workspace_invitation_workspaceId_idx" ON "workspace_invitation"("workspace_id");
+
+-- CreateIndex
+CREATE INDEX "workspace_invitation_email_idx" ON "workspace_invitation"("email");
+
+-- CreateIndex
+CREATE INDEX "workspace_invitation_inviterId_idx" ON "workspace_invitation"("inviter_id");
+
+-- CreateIndex
+CREATE INDEX "workspace_role_workspaceId_idx" ON "workspace_role"("workspace_id");
+
+-- CreateIndex
+CREATE INDEX "workspace_role_role_idx" ON "workspace_role"("role");
+
+-- CreateIndex
+CREATE INDEX "project_workspaceId_position_idx" ON "project"("workspace_id", "position");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "project_workspace_id_id_unique" ON "project"("workspace_id", "id");
+
+-- CreateIndex
+CREATE INDEX "column_projectId_idx" ON "column"("project_id");
+
+-- CreateIndex
+CREATE INDEX "workflow_rule_projectId_idx" ON "workflow_rule"("project_id");
+
+-- CreateIndex
+CREATE INDEX "workflow_rule_columnId_idx" ON "workflow_rule"("column_id");
+
+-- CreateIndex
+CREATE INDEX "task_projectId_idx" ON "task"("project_id");
+
+-- CreateIndex
+CREATE INDEX "task_dueDate_idx" ON "task"("due_date");
+
+-- CreateIndex
+CREATE INDEX "task_assigneeId_idx" ON "task"("assignee_id");
+
+-- CreateIndex
+CREATE INDEX "task_columnId_idx" ON "task"("column_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "task_project_number_unique" ON "task"("project_id", "number");
+
+-- CreateIndex
+CREATE INDEX "billing_reminder_sent_workspaceId_idx" ON "billing_reminder_sent"("workspace_id");
+
+-- CreateIndex
+CREATE INDEX "billing_reminder_sent_userId_idx" ON "billing_reminder_sent"("user_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "billing_reminder_sent_user_type_unique" ON "billing_reminder_sent"("user_id", "reminder_type");
+
+-- CreateIndex
+CREATE INDEX "task_reminder_sent_taskId_idx" ON "task_reminder_sent"("task_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "task_reminder_sent_task_type_unique" ON "task_reminder_sent"("task_id", "reminder_type");
+
+-- CreateIndex
+CREATE INDEX "time_entry_taskId_idx" ON "time_entry"("task_id");
+
+-- CreateIndex
+CREATE INDEX "time_entry_userId_idx" ON "time_entry"("user_id");
+
+-- CreateIndex
+CREATE INDEX "activity_task_id_idx" ON "task_activity"("task_id");
+
+-- CreateIndex
+CREATE INDEX "activity_userId_idx" ON "task_activity"("user_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "activity_task_external_source_external_url_unique" ON "task_activity"("task_id", "external_source", "external_url");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "asset_object_key_key" ON "asset"("object_key");
+
+-- CreateIndex
+CREATE INDEX "asset_workspaceId_idx" ON "asset"("workspace_id");
+
+-- CreateIndex
+CREATE INDEX "asset_projectId_idx" ON "asset"("project_id");
+
+-- CreateIndex
+CREATE INDEX "asset_taskId_idx" ON "asset"("task_id");
+
+-- CreateIndex
+CREATE INDEX "asset_activityId_idx" ON "asset"("activity_id");
+
+-- CreateIndex
+CREATE INDEX "asset_createdBy_idx" ON "asset"("created_by");
+
+-- CreateIndex
+CREATE INDEX "label_task_id_idx" ON "label"("task_id");
+
+-- CreateIndex
+CREATE INDEX "label_workspace_id_idx" ON "label"("workspace_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "label_task_name_unique" ON "label"("task_id", "name");
+
+-- CreateIndex
+CREATE INDEX "notification_userId_idx" ON "notification"("user_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "user_notification_preference_user_id_key" ON "user_notification_preference"("user_id");
+
+-- CreateIndex
+CREATE INDEX "user_notification_workspace_rule_userId_idx" ON "user_notification_workspace_rule"("user_id");
+
+-- CreateIndex
+CREATE INDEX "user_notification_workspace_rule_workspaceId_idx" ON "user_notification_workspace_rule"("workspace_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "user_notification_workspace_rule_user_workspace_unique" ON "user_notification_workspace_rule"("user_id", "workspace_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "user_notification_workspace_rule_workspace_id_id_unique" ON "user_notification_workspace_rule"("workspace_id", "id");
+
+-- CreateIndex
+CREATE INDEX "user_notification_workspace_project_ruleId_idx" ON "user_notification_workspace_project"("workspace_rule_id");
+
+-- CreateIndex
+CREATE INDEX "user_notification_workspace_project_projectId_idx" ON "user_notification_workspace_project"("project_id");
+
+-- CreateIndex
+CREATE INDEX "user_notification_workspace_project_workspaceId_projectId_idx" ON "user_notification_workspace_project"("workspace_id", "project_id");
+
+-- CreateIndex
+CREATE INDEX "unwp_workspaceId_workspaceRuleId_idx" ON "user_notification_workspace_project"("workspace_id", "workspace_rule_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "user_notification_workspace_project_rule_project_unique" ON "user_notification_workspace_project"("workspace_rule_id", "project_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "github_integration_project_id_key" ON "github_integration"("project_id");
+
+-- CreateIndex
+CREATE INDEX "integration_projectId_idx" ON "integration"("project_id");
+
+-- CreateIndex
+CREATE INDEX "integration_type_idx" ON "integration"("type");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "integration_project_type_unique" ON "integration"("project_id", "type");
+
+-- CreateIndex
+CREATE INDEX "external_link_taskId_idx" ON "external_link"("task_id");
+
+-- CreateIndex
+CREATE INDEX "external_link_integrationId_idx" ON "external_link"("integration_id");
+
+-- CreateIndex
+CREATE INDEX "external_link_externalId_idx" ON "external_link"("external_id");
+
+-- CreateIndex
+CREATE INDEX "external_link_resourceType_idx" ON "external_link"("resource_type");
+
+-- CreateIndex
+CREATE INDEX "comment_task_idx" ON "comment"("task_id");
+
+-- CreateIndex
+CREATE INDEX "comment_user_idx" ON "comment"("user_id");
+
+-- CreateIndex
+CREATE INDEX "task_relation_source_idx" ON "task_relation"("source_task_id");
+
+-- CreateIndex
+CREATE INDEX "task_relation_target_idx" ON "task_relation"("target_task_id");
+
+-- CreateIndex
+CREATE INDEX "device_code_user_id_idx" ON "device_code"("user_id");
+
+-- CreateIndex
+CREATE INDEX "mcp_oauth_state_expiresAt_idx" ON "mcp_oauth_state"("expires_at");
+
+-- AddForeignKey
+ALTER TABLE "workspace_member" ADD CONSTRAINT "workspace_member_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspace"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "workspace_billing" ADD CONSTRAINT "workspace_billing_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspace"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "team" ADD CONSTRAINT "team_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspace"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "team_member" ADD CONSTRAINT "team_member_team_id_fkey" FOREIGN KEY ("team_id") REFERENCES "team"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "workspace_invitation" ADD CONSTRAINT "workspace_invitation_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspace"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "workspace_role" ADD CONSTRAINT "workspace_role_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspace"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "project" ADD CONSTRAINT "project_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspace"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "column" ADD CONSTRAINT "column_project_id_fkey" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "workflow_rule" ADD CONSTRAINT "workflow_rule_project_id_fkey" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "workflow_rule" ADD CONSTRAINT "workflow_rule_column_id_fkey" FOREIGN KEY ("column_id") REFERENCES "column"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "task" ADD CONSTRAINT "task_project_id_fkey" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "task" ADD CONSTRAINT "task_column_id_fkey" FOREIGN KEY ("column_id") REFERENCES "column"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "billing_reminder_sent" ADD CONSTRAINT "billing_reminder_sent_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspace"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "task_reminder_sent" ADD CONSTRAINT "task_reminder_sent_task_id_fkey" FOREIGN KEY ("task_id") REFERENCES "task"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "time_entry" ADD CONSTRAINT "time_entry_task_id_fkey" FOREIGN KEY ("task_id") REFERENCES "task"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "task_activity" ADD CONSTRAINT "task_activity_task_id_fkey" FOREIGN KEY ("task_id") REFERENCES "task"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "asset" ADD CONSTRAINT "asset_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspace"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "asset" ADD CONSTRAINT "asset_project_id_fkey" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "asset" ADD CONSTRAINT "asset_task_id_fkey" FOREIGN KEY ("task_id") REFERENCES "task"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "asset" ADD CONSTRAINT "asset_activity_id_fkey" FOREIGN KEY ("activity_id") REFERENCES "task_activity"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "label" ADD CONSTRAINT "label_task_id_fkey" FOREIGN KEY ("task_id") REFERENCES "task"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "label" ADD CONSTRAINT "label_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspace"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "user_notification_workspace_rule" ADD CONSTRAINT "user_notification_workspace_rule_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspace"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "user_notification_workspace_project" ADD CONSTRAINT "user_notification_workspace_project_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspace"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "user_notification_workspace_project" ADD CONSTRAINT "user_notification_workspace_project_workspace_id_workspace_fkey" FOREIGN KEY ("workspace_id", "workspace_rule_id") REFERENCES "user_notification_workspace_rule"("workspace_id", "id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "user_notification_workspace_project" ADD CONSTRAINT "user_notification_workspace_project_workspace_id_project_i_fkey" FOREIGN KEY ("workspace_id", "project_id") REFERENCES "project"("workspace_id", "id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "github_integration" ADD CONSTRAINT "github_integration_project_id_fkey" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "integration" ADD CONSTRAINT "integration_project_id_fkey" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "external_link" ADD CONSTRAINT "external_link_task_id_fkey" FOREIGN KEY ("task_id") REFERENCES "task"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "external_link" ADD CONSTRAINT "external_link_integration_id_fkey" FOREIGN KEY ("integration_id") REFERENCES "integration"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "comment" ADD CONSTRAINT "comment_task_id_fkey" FOREIGN KEY ("task_id") REFERENCES "task"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "task_relation" ADD CONSTRAINT "task_relation_source_task_id_fkey" FOREIGN KEY ("source_task_id") REFERENCES "task"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "task_relation" ADD CONSTRAINT "task_relation_target_task_id_fkey" FOREIGN KEY ("target_task_id") REFERENCES "task"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
diff --git a/packages/db/prisma/migrations/20260902182231_kaneo_auth_columns/migration.sql b/packages/db/prisma/migrations/20260902182231_kaneo_auth_columns/migration.sql
new file mode 100644
index 000000000..074da25c9
--- /dev/null
+++ b/packages/db/prisma/migrations/20260902182231_kaneo_auth_columns/migration.sql
@@ -0,0 +1,8 @@
+ALTER TABLE "user" ADD COLUMN "locale" TEXT;
+ALTER TABLE "user" ADD COLUMN "role" TEXT;
+ALTER TABLE "user" ADD COLUMN "isAnonymous" BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE "user" ADD COLUMN "banned" BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE "user" ADD COLUMN "banReason" TEXT;
+ALTER TABLE "user" ADD COLUMN "banExpires" TIMESTAMP(3);
+ALTER TABLE "session" ADD COLUMN "activeTeamId" TEXT;
+ALTER TABLE "session" ADD COLUMN "impersonatedBy" TEXT;
diff --git a/packages/db/prisma/migrations/20260902213708_kaneo_comment_user_nullable/migration.sql b/packages/db/prisma/migrations/20260902213708_kaneo_comment_user_nullable/migration.sql
new file mode 100644
index 000000000..b6677bd8c
--- /dev/null
+++ b/packages/db/prisma/migrations/20260902213708_kaneo_comment_user_nullable/migration.sql
@@ -0,0 +1 @@
+ALTER TABLE "comment" ALTER COLUMN "user_id" DROP NOT NULL;
diff --git a/packages/db/prisma/migrations/20260903120000_push_tokens/migration.sql b/packages/db/prisma/migrations/20260903120000_push_tokens/migration.sql
new file mode 100644
index 000000000..e8a516a8e
--- /dev/null
+++ b/packages/db/prisma/migrations/20260903120000_push_tokens/migration.sql
@@ -0,0 +1,20 @@
+-- CreateTable
+CREATE TABLE "push_token" (
+    "id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "token" TEXT NOT NULL,
+    "platform" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "push_token_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "push_token_token_unique" ON "push_token"("token");
+
+-- CreateIndex
+CREATE INDEX "push_token_userId_idx" ON "push_token"("user_id");
+
+-- AddForeignKey
+ALTER TABLE "push_token" ADD CONSTRAINT "push_token_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "user"("id") ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/packages/db/prisma/migrations/20260905120000_multi_tenant_schema/migration.sql b/packages/db/prisma/migrations/20260905120000_multi_tenant_schema/migration.sql
new file mode 100644
index 000000000..c0e196206
--- /dev/null
+++ b/packages/db/prisma/migrations/20260905120000_multi_tenant_schema/migration.sql
@@ -0,0 +1,330 @@
+INSERT INTO "organization" ("id", "name", "slug", "createdAt")
+VALUES ('workspace', 'Workspace', 'workspace', CURRENT_TIMESTAMP)
+ON CONFLICT ("id") DO NOTHING;
+
+ALTER TABLE "company" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "contact" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "deal" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "dealContact" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "activity" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "fieldDefinition" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "fieldOption" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "fieldValue" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "companyEnrichment" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "contactFact" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "contactBrief" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "agentTask" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "agentEvent" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "agentConversation" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "agentConversationFeedback" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "agentConversationShare" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "agentConversationSubmission" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "agentConversationAttachment" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "agentDefinition" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "agentVersion" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "agentBuilderArtifact" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "agentTrigger" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "agentRun" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "agentRunEvent" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "agentAction" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "agentAuditEvent" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "mailboxSync" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "emailThread" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "emailMessage" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "calendarEvent" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "calendarAttendee" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "slackInstallation" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "slackWorkspaceGrant" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "slackChannel" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "slackMemberMatch" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "trackedDomain" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "trackedVisitor" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "trackedEvent" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "trackingCounter" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "trackedPageDaily" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "formSubmission" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "savedView" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "suppressedDomain" DROP CONSTRAINT "suppressedDomain_pkey";
+ALTER TABLE "suppressedDomain" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "suppressedDomain" ADD CONSTRAINT "suppressedDomain_pkey" PRIMARY KEY ("organizationId", "domain");
+ALTER TABLE "suppressedContact" DROP CONSTRAINT "suppressedContact_pkey";
+ALTER TABLE "suppressedContact" ADD COLUMN "organizationId" TEXT NOT NULL DEFAULT 'workspace';
+ALTER TABLE "suppressedContact" ADD CONSTRAINT "suppressedContact_pkey" PRIMARY KEY ("organizationId", "email");
+ALTER TABLE "trackedPageDaily" DROP CONSTRAINT "trackedPageDaily_pkey";
+ALTER TABLE "trackedPageDaily" ADD CONSTRAINT "trackedPageDaily_pkey" PRIMARY KEY ("organizationId", "day", "host", "path");
+ALTER TABLE "appSetting" RENAME COLUMN "id" TO "organizationId";
+UPDATE "appSetting" SET "organizationId" = 'workspace' WHERE "organizationId" = 'app';
+ALTER TABLE "workspaceProfile" RENAME COLUMN "id" TO "organizationId";
+UPDATE "workspaceProfile" SET "organizationId" = 'workspace';
+DROP INDEX "company_domain_active_key";
+DROP INDEX "contact_email_active_key";
+DROP INDEX "fieldDefinition_entity_key_key";
+DROP INDEX "trackedDomain_host_key";
+DROP INDEX "savedView_entity_ownerId_name_key";
+CREATE UNIQUE INDEX "company_organization_domain_active_key" ON "company"("organizationId", "domain") WHERE ("archivedAt" IS NULL);
+CREATE UNIQUE INDEX "contact_organization_email_active_key" ON "contact"("organizationId", "email") WHERE ("archivedAt" IS NULL);
+CREATE UNIQUE INDEX "fieldDefinition_organizationId_entity_key_key" ON "fieldDefinition"("organizationId", "entity", "key");
+CREATE UNIQUE INDEX "trackedDomain_organizationId_host_key" ON "trackedDomain"("organizationId", "host");
+CREATE UNIQUE INDEX "savedView_organizationId_entity_ownerId_name_key" ON "savedView"("organizationId", "entity", "ownerId", "name");
+
+DO $$
+DECLARE
+  table_name TEXT;
+BEGIN
+  FOREACH table_name IN ARRAY ARRAY[
+    'company', 'contact', 'deal', 'dealContact', 'activity', 'fieldDefinition', 'fieldOption', 'fieldValue',
+    'companyEnrichment', 'contactFact', 'contactBrief', 'agentTask', 'agentEvent', 'agentConversation',
+    'agentConversationFeedback', 'agentConversationShare', 'agentConversationSubmission', 'agentConversationAttachment',
+    'agentDefinition', 'agentVersion', 'agentBuilderArtifact', 'agentTrigger', 'agentRun', 'agentRunEvent',
+    'agentAction', 'agentAuditEvent', 'mailboxSync', 'emailThread', 'emailMessage', 'calendarEvent',
+    'calendarAttendee', 'slackInstallation', 'slackWorkspaceGrant', 'slackChannel', 'slackMemberMatch',
+    'trackedDomain', 'trackedVisitor', 'trackedEvent', 'trackingCounter', 'trackedPageDaily', 'formSubmission', 'savedView',
+    'suppressedDomain', 'suppressedContact'
+  ]
+  LOOP
+    EXECUTE format('ALTER TABLE %I ALTER COLUMN "organizationId" DROP DEFAULT', table_name);
+    EXECUTE format('ALTER TABLE %I ADD CONSTRAINT %I FOREIGN KEY ("organizationId") REFERENCES "organization"("id") ON DELETE CASCADE ON UPDATE CASCADE', table_name, table_name || '_organizationId_fkey');
+  END LOOP;
+END $$;
+
+ALTER TABLE "appSetting" ADD CONSTRAINT "appSetting_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "workspaceProfile" ADD CONSTRAINT "workspaceProfile_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+DO $$
+DECLARE
+  table_name TEXT;
+BEGIN
+  FOREACH table_name IN ARRAY ARRAY[
+    'company', 'contact', 'deal', 'dealContact', 'activity', 'fieldDefinition', 'fieldOption', 'fieldValue',
+    'companyEnrichment', 'contactFact', 'contactBrief', 'agentTask', 'agentEvent', 'agentConversation',
+    'agentConversationFeedback', 'agentConversationShare', 'agentConversationSubmission', 'agentConversationAttachment',
+    'agentDefinition', 'agentVersion', 'agentBuilderArtifact', 'agentTrigger', 'agentRun', 'agentRunEvent',
+    'agentAction', 'agentAuditEvent', 'mailboxSync', 'emailThread', 'emailMessage', 'calendarEvent',
+    'calendarAttendee', 'slackChannel', 'slackMemberMatch', 'trackedDomain', 'trackedVisitor',
+    'trackedEvent', 'formSubmission', 'savedView'
+  ]
+  LOOP
+    EXECUTE format('CREATE INDEX %I ON %I ("organizationId")', table_name || '_organizationId_idx', table_name);
+  END LOOP;
+END $$;
+
+ALTER TABLE "trackingCounter" DROP CONSTRAINT "trackingCounter_pkey";
+ALTER TABLE "trackingCounter" ADD CONSTRAINT "trackingCounter_pkey" PRIMARY KEY ("organizationId", "key");
+
+DROP INDEX "mailboxSync_userId_source_key";
+CREATE UNIQUE INDEX "mailboxSync_organizationId_userId_source_key" ON "mailboxSync"("organizationId", "userId", "source");
+
+ALTER TABLE "ssoProvider" ALTER COLUMN "organizationId" SET DEFAULT 'workspace';
+UPDATE "ssoProvider" SET "organizationId" = 'workspace' WHERE "organizationId" IS NULL;
+ALTER TABLE "ssoProvider" ALTER COLUMN "organizationId" SET NOT NULL;
+ALTER TABLE "ssoProvider" ALTER COLUMN "organizationId" DROP DEFAULT;
+
+CREATE INDEX "ssoProvider_organizationId_idx" ON "ssoProvider"("organizationId");
+
+ALTER TABLE "ssoProvider" ADD CONSTRAINT "ssoProvider_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "apikey" DROP CONSTRAINT "apikey_referenceId_fkey";
+
+WITH "resolved" AS (
+  SELECT
+    "apikey"."id",
+    "apikey"."referenceId" AS "userId",
+    (
+      SELECT "member"."organizationId"
+      FROM "member"
+      WHERE "member"."userId" = "apikey"."referenceId"
+      ORDER BY "member"."createdAt" ASC, "member"."id" ASC
+      LIMIT 1
+    ) AS "organizationId"
+  FROM "apikey"
+)
+UPDATE "apikey"
+SET
+  "referenceId" = "resolved"."organizationId",
+  "metadata" = jsonb_build_object(
+    'createdByUserId',
+    "resolved"."userId"
+  )::text
+FROM "resolved"
+WHERE "apikey"."id" = "resolved"."id"
+  AND "resolved"."organizationId" IS NOT NULL;
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM "apikey"
+    LEFT JOIN "organization"
+      ON "organization"."id" = "apikey"."referenceId"
+    WHERE "organization"."id" IS NULL
+  ) THEN
+    RAISE EXCEPTION 'Every API key creator must belong to an organization';
+  END IF;
+END $$;
+
+ALTER TABLE "apikey"
+ADD CONSTRAINT "apikey_referenceId_fkey"
+FOREIGN KEY ("referenceId") REFERENCES "organization"("id")
+ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "slackInstallation"
+ADD COLUMN "botToken" TEXT,
+ADD COLUMN "botScopes" TEXT NOT NULL DEFAULT '';
+
+ALTER TABLE "slackWorkspaceGrant"
+ADD COLUMN "botToken" TEXT,
+ADD COLUMN "botScopes" TEXT NOT NULL DEFAULT '';
+
+WITH "latestSlackAccount" AS (
+  SELECT "accessToken", COALESCE("scope", '') AS "scope"
+  FROM "account"
+  WHERE "providerId" = 'slack' AND "accessToken" IS NOT NULL
+  ORDER BY "updatedAt" DESC
+  LIMIT 1
+)
+UPDATE "slackWorkspaceGrant"
+SET
+  "botToken" = "latestSlackAccount"."accessToken",
+  "botScopes" = "latestSlackAccount"."scope"
+FROM "latestSlackAccount"
+WHERE "slackWorkspaceGrant"."botToken" IS NULL;
+
+DO $$
+DECLARE
+	tbl text;
+BEGIN
+	FOREACH tbl IN ARRAY ARRAY[
+		'company',
+		'contact',
+		'deal',
+		'dealContact',
+		'activity',
+		'fieldDefinition',
+		'fieldOption',
+		'fieldValue',
+		'companyEnrichment',
+		'contactFact',
+		'contactBrief',
+		'agentTask',
+		'agentEvent',
+		'agentConversation',
+		'agentConversationFeedback',
+		'agentConversationShare',
+		'agentConversationSubmission',
+		'agentConversationAttachment',
+		'agentDefinition',
+		'agentVersion',
+		'agentBuilderArtifact',
+		'agentTrigger',
+		'agentRun',
+		'agentRunEvent',
+		'agentAction',
+		'agentAuditEvent',
+		'mailboxSync',
+		'emailThread',
+		'emailMessage',
+		'calendarEvent',
+		'calendarAttendee',
+		'appSetting',
+		'workspaceProfile',
+		'ssoProvider',
+		'slackInstallation',
+		'slackWorkspaceGrant',
+		'slackChannel',
+		'slackMemberMatch',
+		'trackedDomain',
+		'trackedVisitor',
+		'trackedEvent',
+		'trackedPageDaily',
+		'formSubmission',
+		'trackingCounter',
+		'suppressedDomain',
+		'suppressedContact',
+		'savedView'
+	]
+	LOOP
+		EXECUTE format(
+			'ALTER TABLE %I ALTER COLUMN "organizationId" SET DEFAULT current_setting(''app.current_organization_id''::text, true)',
+			tbl
+		);
+		EXECUTE format(
+			'CREATE POLICY tenant_isolation ON %I USING ("organizationId" = current_setting(''app.current_organization_id''::text, true)) WITH CHECK ("organizationId" = current_setting(''app.current_organization_id''::text, true))',
+			tbl
+		);
+		EXECUTE format('ALTER TABLE %I ENABLE ROW LEVEL SECURITY', tbl);
+		EXECUTE format('ALTER TABLE %I FORCE ROW LEVEL SECURITY', tbl);
+	END LOOP;
+END $$;
+
+DROP INDEX "slackWorkspaceGrant_teamId_key";
+
+ALTER TABLE "slackInstallation"
+DROP CONSTRAINT "slackInstallation_pkey",
+ADD CONSTRAINT "slackInstallation_pkey" PRIMARY KEY ("organizationId", "installerId");
+
+CREATE UNIQUE INDEX "slackWorkspaceGrant_organizationId_teamId_key"
+ON "slackWorkspaceGrant"("organizationId", "teamId");
+
+CREATE TABLE "trackingSiteLocator" (
+    "siteId" TEXT NOT NULL,
+    "organizationId" TEXT NOT NULL,
+
+    CONSTRAINT "trackingSiteLocator_pkey" PRIMARY KEY ("siteId")
+);
+
+CREATE UNIQUE INDEX "trackingSiteLocator_organizationId_key"
+ON "trackingSiteLocator"("organizationId");
+
+ALTER TABLE "trackingSiteLocator"
+ADD CONSTRAINT "trackingSiteLocator_organizationId_fkey"
+FOREIGN KEY ("organizationId") REFERENCES "organization"("id")
+ON DELETE CASCADE ON UPDATE CASCADE;
+
+INSERT INTO "trackingSiteLocator" ("siteId", "organizationId")
+SELECT "trackingSiteId", "organizationId"
+FROM "appSetting"
+WHERE "trackingSiteId" IS NOT NULL;
+
+CREATE TABLE "ssoProviderLocator" (
+    "providerId" TEXT NOT NULL,
+    "organizationId" TEXT NOT NULL,
+    "domain" TEXT NOT NULL,
+
+    CONSTRAINT "ssoProviderLocator_pkey" PRIMARY KEY ("providerId")
+);
+
+CREATE INDEX "ssoProviderLocator_organizationId_idx"
+ON "ssoProviderLocator"("organizationId");
+
+ALTER TABLE "ssoProviderLocator"
+ADD CONSTRAINT "ssoProviderLocator_providerId_fkey"
+FOREIGN KEY ("providerId") REFERENCES "ssoProvider"("providerId")
+ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "ssoProviderLocator"
+ADD CONSTRAINT "ssoProviderLocator_organizationId_fkey"
+FOREIGN KEY ("organizationId") REFERENCES "organization"("id")
+ON DELETE CASCADE ON UPDATE CASCADE;
+
+INSERT INTO "ssoProviderLocator" ("providerId", "organizationId", "domain")
+SELECT "providerId", "organizationId", "domain"
+FROM "ssoProvider";
+
+CREATE FUNCTION "syncSsoProviderLocator"() RETURNS TRIGGER
+LANGUAGE plpgsql
+AS $$
+BEGIN
+    INSERT INTO "ssoProviderLocator" ("providerId", "organizationId", "domain")
+    VALUES (NEW."providerId", NEW."organizationId", NEW."domain")
+    ON CONFLICT ("providerId") DO UPDATE
+    SET "organizationId" = EXCLUDED."organizationId",
+        "domain" = EXCLUDED."domain";
+    RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER "ssoProviderLocatorSync"
+AFTER INSERT OR UPDATE OF "providerId", "organizationId", "domain"
+ON "ssoProvider"
+FOR EACH ROW
+EXECUTE FUNCTION "syncSsoProviderLocator"();
diff --git a/packages/db/prisma/migrations/20260907160000_customer_project_assets/migration.sql b/packages/db/prisma/migrations/20260907160000_customer_project_assets/migration.sql
new file mode 100644
index 000000000..17cfb2ffb
--- /dev/null
+++ b/packages/db/prisma/migrations/20260907160000_customer_project_assets/migration.sql
@@ -0,0 +1,148 @@
+CREATE TYPE "AssetSource" AS ENUM ('MANUAL', 'MOBILE_RECORDING', 'EMAIL_ATTACHMENT');
+
+CREATE TYPE "AssetStatus" AS ENUM ('UNVERIFIED', 'READY', 'DELETING', 'DELETED');
+
+CREATE TYPE "AssetUploadStatus" AS ENUM ('PENDING', 'FINALIZING', 'READY', 'FAILED', 'CANCELED', 'EXPIRED');
+
+CREATE TYPE "AssetJobOperation" AS ENUM ('FINALIZE_UPLOAD', 'DELETE_OBJECT');
+
+CREATE TYPE "AssetJobState" AS ENUM ('PENDING', 'RUNNING', 'COMPLETE');
+
+ALTER TABLE "artifact" ADD COLUMN     "activityId" TEXT,
+ADD COLUMN     "capturedAt" TIMESTAMP(3),
+ADD COLUMN     "contentType" TEXT NOT NULL DEFAULT 'application/octet-stream',
+ADD COLUMN     "deletedAt" TIMESTAMP(3),
+ADD COLUMN     "durationMilliseconds" BIGINT,
+ADD COLUMN     "emailAttachmentId" TEXT,
+ADD COLUMN     "emailMessageId" TEXT,
+ADD COLUMN     "kind" TEXT NOT NULL DEFAULT 'file',
+ADD COLUMN     "sizeBytes" BIGINT,
+ADD COLUMN     "source" "AssetSource",
+ADD COLUMN     "status" "AssetStatus" NOT NULL DEFAULT 'UNVERIFIED',
+ADD COLUMN     "storageBucket" TEXT,
+ADD COLUMN     "uploadedById" TEXT;
+
+CREATE TABLE "assetUpload" (
+    "id" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "customerId" TEXT NOT NULL,
+    "actorKey" TEXT NOT NULL,
+    "uploadedById" TEXT,
+    "mailboxOwnerId" TEXT,
+    "fileName" TEXT NOT NULL,
+    "contentType" TEXT NOT NULL,
+    "sizeBytes" BIGINT NOT NULL,
+    "kind" TEXT NOT NULL,
+    "source" "AssetSource" NOT NULL,
+    "activityId" TEXT,
+    "durationMilliseconds" BIGINT,
+    "capturedAt" TIMESTAMP(3),
+    "emailMessageId" TEXT,
+    "emailAttachmentId" TEXT,
+    "metadataHash" TEXT NOT NULL,
+    "bucket" TEXT NOT NULL,
+    "temporaryKey" TEXT NOT NULL,
+    "finalKey" TEXT NOT NULL,
+    "sourceEtag" TEXT,
+    "status" "AssetUploadStatus" NOT NULL DEFAULT 'PENDING',
+    "assetId" TEXT,
+    "failureCode" TEXT,
+    "failureMessage" TEXT,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "grantExpiresAt" TIMESTAMP(3) NOT NULL,
+    "reservationUntil" TIMESTAMP(3) NOT NULL,
+    "reservationReleasedAt" TIMESTAMP(3),
+    "confirmedAt" TIMESTAMP(3),
+    "completedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "assetUpload_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "assetEmailSource" (
+    "id" TEXT NOT NULL,
+    "messageId" TEXT NOT NULL,
+    "attachmentId" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "metadataHash" TEXT NOT NULL,
+    "uploadId" TEXT NOT NULL,
+    "assetId" TEXT,
+    "deletedAt" TIMESTAMP(3),
+    "mailboxOwnerId" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "assetEmailSource_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "assetStorageJob" (
+    "id" TEXT NOT NULL,
+    "operationKey" TEXT NOT NULL,
+    "operation" "AssetJobOperation" NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "uploadId" TEXT,
+    "artifactId" TEXT,
+    "bucket" TEXT,
+    "objectKey" TEXT NOT NULL,
+    "finalKey" TEXT,
+    "temporary" BOOLEAN NOT NULL DEFAULT false,
+    "state" "AssetJobState" NOT NULL DEFAULT 'PENDING',
+    "attempts" INTEGER NOT NULL DEFAULT 0,
+    "nextAttemptAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "leaseUntil" TIMESTAMP(3),
+    "leaseToken" TEXT,
+    "lastError" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "assetStorageJob_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "assetApiRequest" (
+    "id" TEXT NOT NULL,
+    "actorKey" TEXT NOT NULL,
+    "operation" TEXT NOT NULL,
+    "path" TEXT NOT NULL,
+    "idempotencyKey" TEXT NOT NULL,
+    "requestHash" TEXT NOT NULL,
+    "responseStatus" INTEGER NOT NULL,
+    "responseBody" JSONB NOT NULL,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "assetApiRequest_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "assetUpload_temporaryKey_key" ON "assetUpload"("temporaryKey");
+
+CREATE UNIQUE INDEX "assetUpload_finalKey_key" ON "assetUpload"("finalKey");
+
+CREATE UNIQUE INDEX "assetUpload_assetId_key" ON "assetUpload"("assetId");
+
+CREATE INDEX "assetUpload_actorKey_reservationReleasedAt_idx" ON "assetUpload"("actorKey", "reservationReleasedAt");
+
+CREATE INDEX "assetUpload_projectId_idx" ON "assetUpload"("projectId");
+
+CREATE INDEX "assetUpload_status_expiresAt_idx" ON "assetUpload"("status", "expiresAt");
+
+CREATE INDEX "assetEmailSource_projectId_idx" ON "assetEmailSource"("projectId");
+
+CREATE UNIQUE INDEX "assetEmailSource_messageId_attachmentId_key" ON "assetEmailSource"("messageId", "attachmentId");
+
+CREATE UNIQUE INDEX "assetStorageJob_operationKey_key" ON "assetStorageJob"("operationKey");
+
+CREATE INDEX "assetStorageJob_state_nextAttemptAt_leaseUntil_idx" ON "assetStorageJob"("state", "nextAttemptAt", "leaseUntil");
+
+CREATE INDEX "assetStorageJob_projectId_idx" ON "assetStorageJob"("projectId");
+
+CREATE INDEX "assetApiRequest_expiresAt_idx" ON "assetApiRequest"("expiresAt");
+
+CREATE UNIQUE INDEX "assetApiRequest_actorKey_operation_path_idempotencyKey_key" ON "assetApiRequest"("actorKey", "operation", "path", "idempotencyKey");
+
+CREATE INDEX "artifact_dealId_status_createdAt_id_idx" ON "artifact"("dealId", "status", "createdAt", "id");
+
+CREATE UNIQUE INDEX "artifact_storageBucket_storageKey_key" ON "artifact"("storageBucket", "storageKey");
+
+
+UPDATE "artifact" SET "kind" = CASE WHEN length("type") BETWEEN 1 AND 64 THEN "type" ELSE 'file' END;
diff --git a/packages/db/prisma/migrations/20260909120000_tenant_scope_assets/migration.sql b/packages/db/prisma/migrations/20260909120000_tenant_scope_assets/migration.sql
new file mode 100644
index 000000000..ebd78896f
--- /dev/null
+++ b/packages/db/prisma/migrations/20260909120000_tenant_scope_assets/migration.sql
@@ -0,0 +1,79 @@
+ALTER TABLE "artifact" ADD COLUMN "organizationId" TEXT;
+ALTER TABLE "assetUpload" ADD COLUMN "organizationId" TEXT;
+ALTER TABLE "assetEmailSource" ADD COLUMN "organizationId" TEXT;
+ALTER TABLE "assetStorageJob" ADD COLUMN "organizationId" TEXT;
+ALTER TABLE "assetApiRequest" ADD COLUMN "organizationId" TEXT;
+
+UPDATE "artifact"
+SET "organizationId" = "deal"."organizationId"
+FROM "deal"
+WHERE "artifact"."dealId" = "deal"."id";
+
+UPDATE "assetUpload"
+SET "organizationId" = "deal"."organizationId"
+FROM "deal"
+WHERE "assetUpload"."projectId" = "deal"."id";
+
+UPDATE "assetEmailSource"
+SET "organizationId" = "deal"."organizationId"
+FROM "deal"
+WHERE "assetEmailSource"."projectId" = "deal"."id";
+
+UPDATE "assetStorageJob"
+SET "organizationId" = "deal"."organizationId"
+FROM "deal"
+WHERE "assetStorageJob"."projectId" = "deal"."id";
+
+UPDATE "assetApiRequest"
+SET "organizationId" = "deal"."organizationId"
+FROM "deal"
+WHERE "deal"."id" = substring("assetApiRequest"."path" FROM '^/projects/([^/]+)');
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM "artifact" WHERE "organizationId" IS NULL
+    UNION ALL
+    SELECT 1 FROM "assetUpload" WHERE "organizationId" IS NULL
+    UNION ALL
+    SELECT 1 FROM "assetEmailSource" WHERE "organizationId" IS NULL
+    UNION ALL
+    SELECT 1 FROM "assetStorageJob" WHERE "organizationId" IS NULL
+    UNION ALL
+    SELECT 1 FROM "assetApiRequest" WHERE "organizationId" IS NULL
+  ) THEN
+    RAISE EXCEPTION 'Asset tenant backfill failed';
+  END IF;
+END $$;
+
+DO $$
+DECLARE
+  tbl text;
+BEGIN
+  FOREACH tbl IN ARRAY ARRAY[
+    'artifact',
+    'assetUpload',
+    'assetEmailSource',
+    'assetStorageJob',
+    'assetApiRequest'
+  ]
+  LOOP
+    EXECUTE format('ALTER TABLE %I ALTER COLUMN "organizationId" SET NOT NULL', tbl);
+    EXECUTE format(
+      'ALTER TABLE %I ALTER COLUMN "organizationId" SET DEFAULT current_setting(''app.current_organization_id''::text, true)',
+      tbl
+    );
+    EXECUTE format(
+      'ALTER TABLE %I ADD CONSTRAINT %I FOREIGN KEY ("organizationId") REFERENCES "organization"("id") ON DELETE CASCADE ON UPDATE CASCADE',
+      tbl,
+      tbl || '_organizationId_fkey'
+    );
+    EXECUTE format('CREATE INDEX %I ON %I ("organizationId")', tbl || '_organizationId_idx', tbl);
+    EXECUTE format(
+      'CREATE POLICY "tenantIsolation" ON %I USING ("organizationId" = current_setting(''app.current_organization_id''::text, true)) WITH CHECK ("organizationId" = current_setting(''app.current_organization_id''::text, true))',
+      tbl
+    );
+    EXECUTE format('ALTER TABLE %I ENABLE ROW LEVEL SECURITY', tbl);
+    EXECUTE format('ALTER TABLE %I FORCE ROW LEVEL SECURITY', tbl);
+  END LOOP;
+END $$;
diff --git a/packages/db/prisma/migrations/20260910160000_managed_appointments/migration.sql b/packages/db/prisma/migrations/20260910160000_managed_appointments/migration.sql
new file mode 100644
index 000000000..734d12a44
--- /dev/null
+++ b/packages/db/prisma/migrations/20260910160000_managed_appointments/migration.sql
@@ -0,0 +1,41 @@
+CREATE TYPE "AppointmentStatus" AS ENUM ('SCHEDULED', 'COMPLETED', 'CANCELED');
+
+ALTER TABLE "activity" ADD COLUMN "archivedAt" TIMESTAMP(3);
+CREATE INDEX "activity_archivedAt_idx" ON "activity"("archivedAt");
+
+CREATE TABLE "appointmentDetails" (
+  "activityId" TEXT NOT NULL,
+  "organizationId" TEXT NOT NULL DEFAULT current_setting('app.current_organization_id'::text, true),
+  "startsAt" TIMESTAMP(3) NOT NULL,
+  "endsAt" TIMESTAMP(3),
+  "timeZone" TEXT NOT NULL,
+  "location" TEXT,
+  "ownerId" TEXT NOT NULL,
+  "status" "AppointmentStatus" NOT NULL DEFAULT 'SCHEDULED',
+  "statusChangedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "version" INTEGER NOT NULL DEFAULT 1,
+  CONSTRAINT "appointmentDetails_pkey" PRIMARY KEY ("activityId"),
+  CONSTRAINT "appointmentDetails_activityId_fkey" FOREIGN KEY ("activityId") REFERENCES "activity"("id") ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT "appointmentDetails_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "organization"("id") ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT "appointmentDetails_ownerId_fkey" FOREIGN KEY ("ownerId") REFERENCES "user"("id") ON DELETE RESTRICT ON UPDATE CASCADE
+);
+CREATE INDEX "appointmentDetails_organizationId_startsAt_activityId_idx" ON "appointmentDetails"("organizationId", "startsAt", "activityId");
+CREATE POLICY tenant_isolation ON "appointmentDetails"
+  USING ("organizationId" = current_setting('app.current_organization_id'::text, true))
+  WITH CHECK ("organizationId" = current_setting('app.current_organization_id'::text, true));
+ALTER TABLE "appointmentDetails" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "appointmentDetails" FORCE ROW LEVEL SECURITY;
+
+ALTER TABLE "artifact" ADD COLUMN "version" INTEGER NOT NULL DEFAULT 1;
+ALTER TABLE "artifact" ADD COLUMN "updatedAt" TIMESTAMP(3);
+DO $$
+DECLARE tenant_id TEXT;
+BEGIN
+  FOR tenant_id IN SELECT "id" FROM "organization" LOOP
+    PERFORM set_config('app.current_organization_id', tenant_id, true);
+    UPDATE "artifact" SET "updatedAt" = "createdAt";
+  END LOOP;
+END $$;
+ALTER TABLE "artifact" ALTER COLUMN "updatedAt" SET NOT NULL;
+ALTER TABLE "artifact" ALTER COLUMN "updatedAt" SET DEFAULT CURRENT_TIMESTAMP;
+CREATE INDEX "artifact_dealId_activityId_status_createdAt_id_idx" ON "artifact"("dealId", "activityId", "status", "createdAt", "id");
diff --git a/packages/db/prisma/schema.prisma b/packages/db/prisma/schema.prisma
index 82bc1f368..bcf7662c9 100644
--- a/packages/db/prisma/schema.prisma
+++ b/packages/db/prisma/schema.prisma
@@ -18,6 +18,12 @@ model User {
   email         String
   emailVerified Boolean   @default(false)
   image         String?
+  locale        String?
+  role          String?
+  isAnonymous   Boolean   @default(false)
+  banned        Boolean   @default(false)
+  banReason     String?
+  banExpires    DateTime?
   createdAt     DateTime  @default(now())
   updatedAt     DateTime  @updatedAt
   sessions      Session[]
@@ -27,6 +33,7 @@ model User {
   ownedContacts  Contact[]           @relation("ContactOwner")
   ownedDeals     Deal[]              @relation("DealOwner")
   activities     Activity[]          @relation("ActivityAuthor")
+  ownedAppointments AppointmentDetails[] @relation("AppointmentOwner")
   mailboxSyncs   MailboxSync[]
   factDecisions  ContactFact[]       @relation("FactDecider")
   conversations  AgentConversation[] @relation("ConversationOwner")
@@ -48,28 +55,52 @@ model User {
 
   ssoproviders SsoProvider[]
 
-  apiKeys Apikey[]
+  pushTokens PushToken[]
+
+  oauthclients       OauthClient[]
+  oauthrefreshtokens OauthRefreshToken[]
+  oauthaccesstokens  OauthAccessToken[]
+  oauthconsents      OauthConsent[]
 
   @@unique([email])
   @@map("user")
 }
 
+model PushToken {
+  id        String   @id @default(cuid())
+  userId    String   @map("user_id")
+  token     String
+  platform  String
+  createdAt DateTime @default(now()) @map("created_at")
+  updatedAt DateTime @updatedAt @map("updated_at")
+  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([token], map: "push_token_token_unique")
+  @@index([userId], map: "push_token_userId_idx")
+  @@map("push_token")
+}
+
 model SlackMemberMatch {
-  id          String   @id @default(cuid())
-  crmUserId   String   @unique
-  crmUser     User     @relation(fields: [crmUserId], references: [id], onDelete: Cascade)
-  slackUserId String?
-  slackHandle String?
-  slackEmail  String?
-  createdAt   DateTime @default(now())
-  updatedAt   DateTime @updatedAt
+  id             String       @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  crmUserId      String       @unique
+  crmUser        User         @relation(fields: [crmUserId], references: [id], onDelete: Cascade)
+  slackUserId    String?
+  slackHandle    String?
+  slackEmail     String?
+  createdAt      DateTime     @default(now())
+  updatedAt      DateTime     @updatedAt
 
+  @@index([organizationId])
   @@index([slackUserId])
   @@map("slackMemberMatch")
 }
 
 model SlackChannel {
   id                String    @id
+  organizationId    String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization      Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   name              String
   memberCount       Int?
   available         Boolean   @default(true)
@@ -80,31 +111,42 @@ model SlackChannel {
   createdAt         DateTime  @default(now())
   updatedAt         DateTime  @updatedAt
 
+  @@index([organizationId])
   @@index([available, name])
   @@index([updatedAt])
   @@map("slackChannel")
 }
 
 model SlackInstallation {
-  installerId String   @id
+  installerId String
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   teamId      String
   teamName    String?
+  botToken    String?
+  botScopes   String   @default("")
   userToken   String?
   userScopes  String
   createdAt   DateTime @default(now())
 
+  @@id([organizationId, installerId])
   @@map("slackInstallation")
 }
 
 model SlackWorkspaceGrant {
   id         String   @id @default(cuid())
-  teamId     String   @unique
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  teamId     String
   teamName   String?
+  botToken   String?
+  botScopes  String   @default("")
   userToken  String
   userScopes String
   createdAt  DateTime @default(now())
   updatedAt  DateTime @updatedAt
 
+  @@unique([organizationId, teamId])
   @@map("slackWorkspaceGrant")
 }
 
@@ -120,6 +162,10 @@ model Session {
   user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
 
   activeOrganizationId String?
+  activeTeamId         String?
+  impersonatedBy       String?
+  oauthrefreshtokens   OauthRefreshToken[]
+  oauthaccesstokens    OauthAccessToken[]
 
   @@unique([token])
   @@index([userId])
@@ -128,6 +174,7 @@ model Session {
 
 model Account {
   id                    String    @id
+  issuer                String
   accountId             String
   providerId            String
   userId                String
@@ -142,6 +189,8 @@ model Account {
   createdAt             DateTime  @default(now())
   updatedAt             DateTime  @updatedAt
 
+  @@unique([issuer, accountId], map: "account_issuer_accountId_uidx")
+  @@unique([userId, providerId], map: "account_userId_providerId_uidx")
   @@index([userId])
   @@map("account")
 }
@@ -168,6 +217,189 @@ model RateLimit {
   @@map("rateLimit")
 }
 
+model Jwks {
+  id         String    @id
+  publicKey  String
+  privateKey String
+  createdAt  DateTime
+  expiresAt  DateTime?
+  alg        String?
+  crv        String?
+
+  @@map("jwks")
+}
+
+model OauthClient {
+  id                               String                @id
+  clientId                         String
+  clientSecret                     String?
+  clientDiscoveryId                String?
+  disabled                         Boolean?              @default(false)
+  skipConsent                      Boolean?
+  enableEndSession                 Boolean?
+  subjectType                      String?
+  scopes                           String[]
+  clientCredentialsScopes          String[]              @default([])
+  userId                           String?
+  user                             User?                 @relation(fields: [userId], references: [id], onDelete: Cascade)
+  createdAt                        DateTime?
+  updatedAt                        DateTime?
+  name                             String?
+  uri                              String?
+  icon                             String?
+  contacts                         String[]
+  tos                              String?
+  policy                           String?
+  softwareId                       String?
+  softwareVersion                  String?
+  softwareStatement                String?
+  redirectUris                     String[]
+  postLogoutRedirectUris           String[]
+  backchannelLogoutUri             String?
+  backchannelLogoutSessionRequired Boolean?
+  tokenEndpointAuthMethod          String?
+  applicationType                  String?
+  jwks                             String?
+  jwksUri                          String?
+  grantTypes                       String[]
+  responseTypes                    String[]
+  requirePKCE                      Boolean?
+  dpopBoundAccessTokens            Boolean?              @default(false)
+  referenceId                      String?
+  metadata                         Json?
+  oauthclientresources             OauthClientResource[]
+  oauthrefreshtokens               OauthRefreshToken[]
+  oauthaccesstokens                OauthAccessToken[]
+  oauthconsents                    OauthConsent[]
+
+  @@unique([clientId])
+  @@index([userId])
+  @@map("oauthClient")
+}
+
+model OauthResource {
+  id                            String                @id
+  identifier                    String
+  name                          String
+  accessTokenTtl                Int?
+  refreshTokenTtl               Int?
+  signingAlgorithm              String?
+  signingKeyId                  String?
+  allowedScopes                 String[]
+  customClaims                  Json?
+  dpopBoundAccessTokensRequired Boolean?              @default(false)
+  disabled                      Boolean?              @default(false)
+  createdAt                     DateTime?
+  updatedAt                     DateTime?
+  policyVersion                 Int?                  @default(1)
+  metadata                      Json?
+  oauthclientresources          OauthClientResource[]
+
+  @@unique([identifier])
+  @@map("oauthResource")
+}
+
+model OauthClientResource {
+  id            String        @id
+  clientId      String
+  oauthclient   OauthClient   @relation(fields: [clientId], references: [clientId], onDelete: Cascade)
+  resourceId    String
+  oauthresource OauthResource @relation(fields: [resourceId], references: [identifier], onDelete: Cascade)
+  metadata      Json?
+  createdAt     DateTime?
+
+  @@index([clientId])
+  @@index([resourceId])
+  @@map("oauthClientResource")
+}
+
+model OauthRefreshToken {
+  id                      String             @id
+  token                   String
+  clientId                String
+  oauthclient             OauthClient        @relation(fields: [clientId], references: [clientId], onDelete: Cascade)
+  sessionId               String?
+  session                 Session?           @relation(fields: [sessionId], references: [id], onDelete: SetNull)
+  userId                  String
+  user                    User               @relation(fields: [userId], references: [id], onDelete: Cascade)
+  referenceId             String?
+  authorizationCodeId     String?
+  resources               String[]           @default([])
+  requestedUserInfoClaims String[]           @default([])
+  expiresAt               DateTime?
+  createdAt               DateTime?
+  revoked                 DateTime?
+  rotatedAt               DateTime?
+  rotationReplayResponse  String?
+  rotationReplayExpiresAt DateTime?
+  authTime                DateTime?
+  confirmation            Json?
+  scopes                  String[]
+  oauthaccesstokens       OauthAccessToken[]
+
+  @@unique([token])
+  @@index([clientId])
+  @@index([sessionId])
+  @@index([userId])
+  @@index([authorizationCodeId])
+  @@map("oauthRefreshToken")
+}
+
+model OauthAccessToken {
+  id                      String             @id
+  token                   String?
+  clientId                String
+  oauthclient             OauthClient        @relation(fields: [clientId], references: [clientId], onDelete: Cascade)
+  sessionId               String?
+  session                 Session?           @relation(fields: [sessionId], references: [id], onDelete: SetNull)
+  userId                  String?
+  user                    User?              @relation(fields: [userId], references: [id], onDelete: Cascade)
+  referenceId             String?
+  authorizationCodeId     String?
+  resources               String[]           @default([])
+  requestedUserInfoClaims String[]           @default([])
+  refreshId               String?
+  oauthrefreshtoken       OauthRefreshToken? @relation(fields: [refreshId], references: [id], onDelete: Cascade)
+  expiresAt               DateTime?
+  createdAt               DateTime?
+  revoked                 DateTime?
+  confirmation            Json?
+  scopes                  String[]
+
+  @@unique([token])
+  @@index([clientId])
+  @@index([sessionId])
+  @@index([userId])
+  @@index([authorizationCodeId])
+  @@index([refreshId])
+  @@map("oauthAccessToken")
+}
+
+model OauthConsent {
+  id                      String      @id
+  clientId                String
+  oauthclient             OauthClient @relation(fields: [clientId], references: [clientId], onDelete: Cascade)
+  userId                  String?
+  user                    User?       @relation(fields: [userId], references: [id], onDelete: Cascade)
+  referenceId             String?
+  resources               String[]     @default([])
+  requestedUserInfoClaims String[]     @default([])
+  scopes                  String[]
+  createdAt               DateTime?
+  updatedAt               DateTime?
+
+  @@index([clientId])
+  @@index([userId])
+  @@map("oauthConsent")
+}
+
+model OauthClientAssertion {
+  id        String   @id
+  expiresAt DateTime
+
+  @@map("oauthClientAssertion")
+}
+
 enum DealStage {
   DEMO_BOOKED
   QUALIFIED_TO_BUY
@@ -209,6 +441,15 @@ enum AgentConversationKind {
   BUILDER
 }
 
+enum XmppAgentTaskState {
+  ACCEPTED
+  RUNNING
+  CANCELLING
+  COMPLETED
+  FAILED
+  CANCELLED
+}
+
 enum AgentDefinitionStatus {
   DRAFT
   DEPLOYING
@@ -279,6 +520,8 @@ enum AgentResponseRating {
 
 model Company {
   id          String  @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   name        String
   domain      String?
   website     String?
@@ -331,7 +574,8 @@ model Company {
   createdAt      DateTime            @default(now())
   updatedAt      DateTime            @updatedAt
 
-  @@unique([domain], map: "company_domain_active_key", where: { archivedAt: null })
+  @@unique([organizationId, domain], map: "company_organization_domain_active_key", where: { archivedAt: null })
+  @@index([organizationId])
   @@index([ownerId])
   @@index([name])
   @@index([lastActivityAt])
@@ -342,15 +586,20 @@ model Company {
 model CompanyEnrichment {
   companyId String   @id
   company   Company  @relation(fields: [companyId], references: [id], onDelete: Cascade)
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   source    String   @default("context.dev")
   raw       Json
   fetchedAt DateTime @default(now())
 
+  @@index([organizationId])
   @@map("companyEnrichment")
 }
 
 model Contact {
   id          String  @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   firstName   String
   lastName    String?
   email       String?
@@ -395,7 +644,8 @@ model Contact {
   createdAt       DateTime           @default(now())
   updatedAt       DateTime           @updatedAt
 
-  @@unique([email], map: "contact_email_active_key", where: { archivedAt: null })
+  @@unique([organizationId, email], map: "contact_organization_email_active_key", where: { archivedAt: null })
+  @@index([organizationId])
   @@index([companyId])
   @@index([ownerId])
   @@index([lastActivityAt])
@@ -420,6 +670,8 @@ model ContactFact {
   id        String  @id @default(cuid())
   contactId String
   contact   Contact @relation(fields: [contactId], references: [id], onDelete: Cascade)
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   field String
   value String
@@ -442,6 +694,7 @@ model ContactFact {
   observedAt   DateTime  @default(now())
   supersededAt DateTime?
 
+  @@index([organizationId])
   @@index([contactId, field, status])
   @@index([status, observedAt])
   @@map("contactFact")
@@ -450,6 +703,8 @@ model ContactFact {
 model ContactBrief {
   contactId String  @id
   contact   Contact @relation(fields: [contactId], references: [id], onDelete: Cascade)
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   narrative String
   sections  Json
@@ -460,11 +715,14 @@ model ContactBrief {
 
   refreshedAt DateTime @default(now())
 
+  @@index([organizationId])
   @@map("contactBrief")
 }
 
 model AgentTask {
   id        String  @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   contactId String?
   companyId String?
   dealId    String?
@@ -489,6 +747,7 @@ model AgentTask {
 
   createdAt DateTime @default(now())
 
+  @@index([organizationId])
   @@index([dueAt, leasedUntil])
   @@index([contactId])
   @@index([dealId])
@@ -496,8 +755,44 @@ model AgentTask {
   @@map("agentTask")
 }
 
+model XmppAgentTask {
+  id              String             @id
+  organizationId  String
+  organization    Organization       @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  requestId       String
+  callerJid       String
+  notificationJid String
+  targetJid       String
+  tool            String
+  apiVersion      String
+  manifestHash    String
+  fingerprint     String
+  arguments       Json
+  state           XmppAgentTaskState @default(ACCEPTED)
+  revision        Int                @default(0)
+  progress        Json?
+  result          Json?
+  error           Json?
+  summary         String?
+  eveSessionId    String?
+  ownerId         String?
+  leaseUntil      DateTime?
+  deadline        DateTime?
+  retainUntil     DateTime
+  createdAt       DateTime           @default(now())
+  updatedAt       DateTime           @updatedAt
+
+  @@unique([organizationId, callerJid, targetJid, requestId])
+  @@index([organizationId, state, updatedAt])
+  @@index([organizationId, state, leaseUntil])
+  @@index([retainUntil])
+  @@map("xmppAgentTask")
+}
+
 model AgentEvent {
   id             String             @id
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   sessionId      String
   contactId      String?
   conversationId String?
@@ -507,6 +802,7 @@ model AgentEvent {
 
   emittedAt DateTime
 
+  @@index([organizationId])
   @@index([sessionId, emittedAt])
   @@index([contactId, emittedAt])
   @@index([conversationId, emittedAt])
@@ -515,6 +811,8 @@ model AgentEvent {
 
 model AgentConversation {
   id String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   kind AgentConversationKind @default(RECORD)
 
@@ -552,6 +850,7 @@ model AgentConversation {
   createdVersions  AgentVersion[]                @relation("AgentVersionSourceConversation")
   builderArtifacts AgentBuilderArtifact[]
 
+  @@index([organizationId])
   @@index([contactId, lastMessageAt])
   @@index([companyId, lastMessageAt])
   @@index([dealId, lastMessageAt])
@@ -562,6 +861,8 @@ model AgentConversation {
 
 model AgentConversationFeedback {
   id String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   conversationId String
   conversation   AgentConversation @relation(fields: [conversationId], references: [id], onDelete: Cascade)
@@ -576,12 +877,15 @@ model AgentConversationFeedback {
   updatedAt DateTime @updatedAt
 
   @@unique([conversationId, userId, messageId])
+  @@index([organizationId])
   @@index([conversationId, createdAt])
   @@map("agentConversationFeedback")
 }
 
 model AgentConversationShare {
   id String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   conversationId String
   conversation   AgentConversation @relation(fields: [conversationId], references: [id], onDelete: Cascade)
@@ -597,12 +901,15 @@ model AgentConversationShare {
   revokedAt DateTime?
 
   @@unique([conversationId], map: "agentConversationShare_one_active_per_conversation", where: { revokedAt: null })
+  @@index([organizationId])
   @@index([conversationId, revokedAt])
   @@map("agentConversationShare")
 }
 
 model AgentConversationSubmission {
   id String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   conversationId String
   conversation   AgentConversation @relation(fields: [conversationId], references: [id], onDelete: Cascade)
@@ -627,6 +934,7 @@ model AgentConversationSubmission {
   attachments AgentConversationAttachment[]
 
   @@unique([conversationId, inputRequestId])
+  @@index([organizationId])
   @@index([conversationId, createdAt])
   @@index([status, createdAt])
   @@map("agentConversationSubmission")
@@ -634,6 +942,8 @@ model AgentConversationSubmission {
 
 model AgentConversationAttachment {
   id String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   submissionId String
   submission   AgentConversationSubmission @relation(fields: [submissionId], references: [id], onDelete: Cascade)
@@ -646,12 +956,15 @@ model AgentConversationAttachment {
 
   createdAt DateTime @default(now())
 
+  @@index([organizationId])
   @@index([submissionId, position])
   @@map("agentConversationAttachment")
 }
 
 model AgentDefinition {
   id String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   name        String
   description String?
@@ -676,6 +989,7 @@ model AgentDefinition {
   deletedAt  DateTime?
 
   @@unique([currentVersionId, id])
+  @@index([organizationId])
   @@index([status, updatedAt])
   @@index([createdById, createdAt])
   @@map("agentDefinition")
@@ -683,6 +997,8 @@ model AgentDefinition {
 
 model AgentVersion {
   id String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   agentId String
   agent   AgentDefinition @relation("AgentVersions", fields: [agentId], references: [id], onDelete: Restrict)
@@ -715,6 +1031,7 @@ model AgentVersion {
   builderArtifacts AgentBuilderArtifact[]
 
   @@unique([agentId, number])
+  @@index([organizationId])
   @@unique([id, agentId])
   @@index([agentId, createdAt])
   @@index([status, createdAt])
@@ -723,6 +1040,8 @@ model AgentVersion {
 
 model AgentBuilderArtifact {
   id String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   conversationId String?
   conversation   AgentConversation? @relation(fields: [conversationId], references: [id], onDelete: SetNull)
@@ -739,6 +1058,7 @@ model AgentBuilderArtifact {
   createdAt       DateTime                   @default(now())
 
   @@unique([conversationId, path, revision], map: "agentBuilderArtifact_conversation_path_revision_key", where: { conversationId: { not: null } })
+  @@index([organizationId])
   @@unique([versionId, path, revision], map: "agentBuilderArtifact_version_path_revision_key", where: { versionId: { not: null } })
   @@index([conversationId, createdAt])
   @@index([versionId, path])
@@ -747,6 +1067,8 @@ model AgentBuilderArtifact {
 
 model AgentTrigger {
   id String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   agentId String
   agent   AgentDefinition @relation(fields: [agentId], references: [id], onDelete: Restrict)
@@ -770,6 +1092,7 @@ model AgentTrigger {
   runs AgentRun[]
 
   @@unique([id, agentId])
+  @@index([organizationId])
   @@index([agentId, enabled])
   @@index([enabled, nextRunAt])
   @@index([versionId])
@@ -778,6 +1101,8 @@ model AgentTrigger {
 
 model AgentRun {
   id String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   agentId String
   agent   AgentDefinition @relation(fields: [agentId], references: [id], onDelete: Restrict)
@@ -791,6 +1116,9 @@ model AgentRun {
   initiatedById String?
   initiatedBy   User?   @relation("AgentRunInitiator", fields: [initiatedById], references: [id], onDelete: SetNull)
 
+  dealId String?
+  deal   Deal?   @relation(fields: [dealId], references: [id], onDelete: SetNull)
+
   triggerType    AgentTriggerType
   status         AgentRunStatus   @default(QUEUED)
   principalId    String?
@@ -823,15 +1151,19 @@ model AgentRun {
   actions AgentAction[]
 
   @@unique([id, agentId])
+  @@index([organizationId])
   @@index([agentId, createdAt])
   @@index([versionId, createdAt])
   @@index([status, createdAt])
   @@index([triggerId, createdAt])
+  @@index([dealId, createdAt])
   @@map("agentRun")
 }
 
 model AgentRunEvent {
   id String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   runId String
   run   AgentRun @relation(fields: [runId], references: [id], onDelete: Restrict)
@@ -842,12 +1174,15 @@ model AgentRunEvent {
   emittedAt DateTime @default(now())
 
   @@unique([runId, sequence])
+  @@index([organizationId])
   @@index([runId, emittedAt])
   @@map("agentRunEvent")
 }
 
 model AgentAction {
   id String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   agentId String
   agent   AgentDefinition @relation(fields: [agentId], references: [id], onDelete: Restrict)
@@ -877,6 +1212,7 @@ model AgentAction {
   completedAt DateTime?
   updatedAt   DateTime  @updatedAt
 
+  @@index([organizationId])
   @@index([agentId, plannedAt])
   @@index([runId, plannedAt])
   @@index([provider, externalId])
@@ -886,6 +1222,8 @@ model AgentAction {
 
 model AgentAuditEvent {
   id String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   agentId String
   agent   AgentDefinition @relation(fields: [agentId], references: [id], onDelete: Restrict)
@@ -906,6 +1244,7 @@ model AgentAuditEvent {
   emittedAt DateTime @default(now())
 
   @@unique([agentId, type, requestId])
+  @@index([organizationId])
   @@index([agentId, emittedAt])
   @@index([versionId, emittedAt])
   @@index([actorUserId, emittedAt])
@@ -915,7 +1254,10 @@ model AgentAuditEvent {
 
 model Deal {
   id            String              @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   conversations AgentConversation[]
+  agentRuns     AgentRun[]
   name          String
   description   String?
   companyId     String
@@ -936,15 +1278,26 @@ model Deal {
   fxRate       Decimal?  @db.Decimal(20, 10)
   fxRateAt     DateTime?
 
+  leadSource   String?
+  projectType  String?
+  addressLine1 String?
+  addressLine2 String?
+  city         String?
+  state        String?
+  postalCode   String?
+
   lastActivityAt DateTime?
   archivedAt     DateTime?
 
   contacts    DealContact[]
   activities  Activity[]
   fieldValues FieldValue[]
+  artifacts   Artifact[]
+  documents   Document[]
   createdAt   DateTime      @default(now())
   updatedAt   DateTime      @updatedAt
 
+  @@index([organizationId])
   @@index([companyId])
   @@index([ownerId])
   @@index([stage])
@@ -980,15 +1333,236 @@ model ExchangeRate {
 model DealContact {
   dealId    String
   deal      Deal    @relation(fields: [dealId], references: [id], onDelete: Cascade)
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   contactId String
   contact   Contact @relation(fields: [contactId], references: [id], onDelete: Cascade)
   role      String?
 
   @@id([dealId, contactId])
+  @@index([organizationId])
   @@index([contactId])
   @@map("dealContact")
 }
 
+enum AssetSource {
+  MANUAL
+  MOBILE_RECORDING
+  EMAIL_ATTACHMENT
+}
+
+enum AssetStatus {
+  UNVERIFIED
+  READY
+  DELETING
+  DELETED
+}
+
+enum AssetUploadStatus {
+  PENDING
+  FINALIZING
+  READY
+  FAILED
+  CANCELED
+  EXPIRED
+}
+
+enum AssetJobOperation {
+  FINALIZE_UPLOAD
+  DELETE_OBJECT
+}
+
+enum AssetJobState {
+  PENDING
+  RUNNING
+  COMPLETE
+}
+
+model Artifact {
+  organizationId       String       @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization         Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  id                   String       @id @default(cuid())
+  dealId               String
+  deal                 Deal         @relation(fields: [dealId], references: [id], onDelete: Cascade)
+  type                 String
+  fileName             String
+  storageKey           String
+  storageBucket        String?
+  kind                 String       @default("file")
+  contentType          String       @default("application/octet-stream")
+  sizeBytes            BigInt?
+  source               AssetSource?
+  activityId           String?
+  uploadedById         String?
+  durationMilliseconds BigInt?
+  capturedAt           DateTime?
+  emailMessageId       String?
+  emailAttachmentId    String?
+  status               AssetStatus  @default(UNVERIFIED)
+  deletedAt            DateTime?
+  createdAt            DateTime     @default(now())
+  updatedAt            DateTime     @default(now())
+  version              Int          @default(1)
+
+  @@unique([storageBucket, storageKey])
+  @@index([dealId, createdAt])
+  @@index([dealId, status, createdAt, id])
+  @@index([dealId, activityId, status, createdAt, id])
+  @@index([organizationId])
+  @@map("artifact")
+}
+
+model AssetUpload {
+  organizationId       String       @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization         Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  id                    String            @id @default(cuid())
+  projectId             String
+  customerId            String
+  actorKey              String
+  uploadedById          String?
+  mailboxOwnerId        String?
+  fileName              String
+  contentType           String
+  sizeBytes             BigInt
+  kind                  String
+  source                AssetSource
+  activityId            String?
+  durationMilliseconds  BigInt?
+  capturedAt            DateTime?
+  emailMessageId        String?
+  emailAttachmentId     String?
+  metadataHash          String
+  bucket                String
+  temporaryKey          String            @unique
+  finalKey              String            @unique
+  sourceEtag            String?
+  status                AssetUploadStatus @default(PENDING)
+  assetId               String?           @unique
+  failureCode           String?
+  failureMessage        String?
+  expiresAt             DateTime
+  grantExpiresAt        DateTime
+  reservationUntil      DateTime
+  reservationReleasedAt DateTime?
+  confirmedAt           DateTime?
+  completedAt           DateTime?
+  createdAt             DateTime          @default(now())
+  updatedAt             DateTime          @updatedAt
+
+  @@index([actorKey, reservationReleasedAt])
+  @@index([projectId])
+  @@index([status, expiresAt])
+  @@index([organizationId])
+  @@map("assetUpload")
+}
+
+model AssetEmailSource {
+  organizationId String       @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  id             String    @id @default(cuid())
+  messageId      String
+  attachmentId   String
+  projectId      String
+  metadataHash   String
+  uploadId       String
+  assetId        String?
+  deletedAt      DateTime?
+  mailboxOwnerId String?
+  createdAt      DateTime  @default(now())
+  updatedAt      DateTime  @updatedAt
+
+  @@unique([messageId, attachmentId])
+  @@index([projectId])
+  @@index([organizationId])
+  @@map("assetEmailSource")
+}
+
+model AssetStorageJob {
+  organizationId String       @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  id            String            @id @default(cuid())
+  operationKey  String            @unique
+  operation     AssetJobOperation
+  projectId     String
+  uploadId      String?
+  artifactId    String?
+  bucket        String?
+  objectKey     String
+  finalKey      String?
+  temporary     Boolean           @default(false)
+  state         AssetJobState     @default(PENDING)
+  attempts      Int               @default(0)
+  nextAttemptAt DateTime          @default(now())
+  leaseUntil    DateTime?
+  leaseToken    String?
+  lastError     String?
+  createdAt     DateTime          @default(now())
+  updatedAt     DateTime          @updatedAt
+
+  @@index([state, nextAttemptAt, leaseUntil])
+  @@index([projectId])
+  @@index([organizationId])
+  @@map("assetStorageJob")
+}
+
+model AssetApiRequest {
+  organizationId String       @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  id             String   @id @default(cuid())
+  actorKey       String
+  operation      String
+  path           String
+  idempotencyKey String
+  requestHash    String
+  responseStatus Int
+  responseBody   Json
+  expiresAt      DateTime
+  createdAt      DateTime @default(now())
+
+  @@unique([actorKey, operation, path, idempotencyKey])
+  @@index([expiresAt])
+  @@index([organizationId])
+  @@map("assetApiRequest")
+}
+
+model Document {
+  id                 String             @id @default(cuid())
+  dealId             String
+  deal               Deal               @relation(fields: [dealId], references: [id], onDelete: Cascade)
+  type               String
+  number             String
+  status             String
+  currency           String             @default("USD")
+  issuedAt           DateTime?
+  dueAt              DateTime?
+  recipientSnapshot  Json
+  contractorSnapshot Json
+  projectSnapshot    Json
+  subtotal           Decimal            @db.Decimal(14, 2)
+  tax                Decimal            @db.Decimal(14, 2)
+  total              Decimal            @db.Decimal(14, 2)
+  lineItems          DocumentLineItem[]
+  createdAt          DateTime           @default(now())
+  updatedAt          DateTime           @updatedAt
+
+  @@index([dealId, createdAt])
+  @@map("document")
+}
+
+model DocumentLineItem {
+  id          String   @id @default(cuid())
+  documentId  String
+  document    Document @relation(fields: [documentId], references: [id], onDelete: Cascade)
+  description String
+  quantity    Decimal  @db.Decimal(14, 2)
+  unitPrice   Decimal  @db.Decimal(14, 2)
+  total       Decimal  @db.Decimal(14, 2)
+  position    Int
+
+  @@index([documentId, position])
+  @@map("documentLineItem")
+}
+
 enum FieldEntity {
   COMPANY
   CONTACT
@@ -1010,6 +1584,8 @@ enum FieldType {
 
 model FieldDefinition {
   id     String      @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   entity FieldEntity
   key    String
   label  String
@@ -1032,13 +1608,16 @@ model FieldDefinition {
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
 
-  @@unique([entity, key])
+  @@unique([organizationId, entity, key])
+  @@index([organizationId])
   @@index([entity, position])
   @@map("fieldDefinition")
 }
 
 model FieldOption {
   id       String          @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   fieldId  String
   field    FieldDefinition @relation(fields: [fieldId], references: [id], onDelete: Cascade)
   label    String
@@ -1047,12 +1626,15 @@ model FieldOption {
   archivedAt DateTime?
   values     FieldValue[]
 
+  @@index([organizationId])
   @@index([fieldId, position])
   @@map("fieldOption")
 }
 
 model FieldValue {
   id      String          @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   fieldId String
   field   FieldDefinition @relation(fields: [fieldId], references: [id], onDelete: Cascade)
 
@@ -1074,6 +1656,7 @@ model FieldValue {
 
   updatedAt DateTime @updatedAt
 
+  @@index([organizationId])
   @@unique([fieldId, companyId])
   @@unique([fieldId, contactId])
   @@unique([fieldId, dealId])
@@ -1089,11 +1672,13 @@ model FieldValue {
 }
 
 model SavedView {
-  id      String      @id @default(cuid())
-  entity  FieldEntity
-  name    String
-  shared  Boolean     @default(false)
-  filters Json
+  id             String       @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  entity         FieldEntity
+  name           String
+  shared         Boolean      @default(false)
+  filters        Json
 
   ownerId String
   owner   User   @relation("SavedViewOwner", fields: [ownerId], references: [id], onDelete: Cascade)
@@ -1101,13 +1686,16 @@ model SavedView {
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
 
-  @@unique([entity, ownerId, name])
+  @@unique([organizationId, entity, ownerId, name])
+  @@index([organizationId])
   @@index([entity, shared])
   @@map("savedView")
 }
 
 model Activity {
   id      String       @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   type    ActivityType
   subject String?
   body    String?
@@ -1115,6 +1703,8 @@ model Activity {
   occurredAt  DateTime?
   dueAt       DateTime?
   completedAt DateTime?
+  archivedAt  DateTime?
+  appointmentDetails AppointmentDetails?
 
   companyId String?
   company   Company? @relation(fields: [companyId], references: [id], onDelete: Cascade)
@@ -1135,14 +1725,41 @@ model Activity {
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
 
+  @@index([organizationId])
   @@index([companyId, createdAt])
   @@index([dealId, createdAt])
   @@index([contactId, createdAt])
   @@index([dueAt])
+  @@index([archivedAt])
   @@index([createdById])
   @@map("activity")
 }
 
+enum AppointmentStatus {
+  SCHEDULED
+  COMPLETED
+  CANCELED
+}
+
+model AppointmentDetails {
+  activityId      String @id
+  activity        Activity @relation(fields: [activityId], references: [id], onDelete: Cascade)
+  organizationId  String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization    Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  startsAt        DateTime
+  endsAt          DateTime?
+  timeZone        String
+  location        String?
+  ownerId         String
+  owner           User @relation("AppointmentOwner", fields: [ownerId], references: [id])
+  status          AppointmentStatus @default(SCHEDULED)
+  statusChangedAt DateTime @default(now())
+  version         Int @default(1)
+
+  @@index([organizationId, startsAt, activityId])
+  @@map("appointmentDetails")
+}
+
 enum GoogleSyncStatus {
   IDLE
   RUNNING
@@ -1157,6 +1774,8 @@ enum EmailDirection {
 
 model MailboxSync {
   id     String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   userId String
   user   User   @relation(fields: [userId], references: [id], onDelete: Cascade)
   source String
@@ -1171,13 +1790,16 @@ model MailboxSync {
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
 
-  @@unique([userId, source])
+  @@index([organizationId])
+  @@unique([organizationId, userId, source])
   @@index([status])
   @@map("mailboxSync")
 }
 
 model EmailThread {
   id            String  @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   rootMessageId String  @unique
   subject       String?
 
@@ -1196,6 +1818,7 @@ model EmailThread {
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
 
+  @@index([organizationId])
   @@index([companyId, lastMessageAt])
   @@index([contactId, lastMessageAt])
   @@map("emailThread")
@@ -1203,6 +1826,8 @@ model EmailThread {
 
 model EmailMessage {
   id       String      @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   threadId String
   thread   EmailThread @relation(fields: [threadId], references: [id], onDelete: Cascade)
 
@@ -1223,12 +1848,15 @@ model EmailMessage {
 
   createdAt DateTime @default(now())
 
+  @@index([organizationId])
   @@index([threadId, sentAt])
   @@map("emailMessage")
 }
 
 model CalendarEvent {
   id                String   @id @default(cuid())
+  organizationId    String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization      Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   iCalUid           String
   originalStartTime DateTime
   recurringEventId  String?
@@ -1257,6 +1885,7 @@ model CalendarEvent {
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
 
+  @@index([organizationId])
   @@unique([iCalUid, originalStartTime])
   @@index([companyId, startsAt])
   @@index([contactId, startsAt])
@@ -1265,6 +1894,8 @@ model CalendarEvent {
 
 model CalendarAttendee {
   id      String        @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   eventId String
   event   CalendarEvent @relation(fields: [eventId], references: [id], onDelete: Cascade)
 
@@ -1275,29 +1906,37 @@ model CalendarAttendee {
   contactId      String?
   contact        Contact? @relation(fields: [contactId], references: [id], onDelete: SetNull)
 
+  @@index([organizationId])
   @@unique([eventId, email])
   @@index([contactId])
   @@map("calendarAttendee")
 }
 
 model SuppressedDomain {
-  domain    String   @id
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  domain    String
   reason    String?
   createdAt DateTime @default(now())
 
+  @@id([organizationId, domain])
   @@map("suppressedDomain")
 }
 
 model SuppressedContact {
-  email     String   @id
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  email     String
   reason    String?
   createdAt DateTime @default(now())
 
+  @@id([organizationId, email])
   @@map("suppressedContact")
 }
 
 model AppSetting {
-  id String @id
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)")) @id
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   agentModelId String?
 
@@ -1326,6 +1965,14 @@ model AppSetting {
   @@map("appSetting")
 }
 
+model TrackingSiteLocator {
+  siteId         String       @id
+  organizationId String       @unique
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  @@map("trackingSiteLocator")
+}
+
 enum DomainScope {
   SITE_AND_SUBDOMAINS
   EXACT_HOST
@@ -1333,7 +1980,9 @@ enum DomainScope {
 
 model TrackedDomain {
   id    String      @id @default(cuid())
-  host  String      @unique
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  host  String
   scope DomainScope @default(EXACT_HOST)
 
   pageViews  Int       @default(0)
@@ -1341,11 +1990,15 @@ model TrackedDomain {
 
   createdAt DateTime @default(now())
 
+  @@unique([organizationId, host])
+  @@index([organizationId])
   @@map("trackedDomain")
 }
 
 model TrackedVisitor {
   id String @id
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   contactId String?
   contact   Contact? @relation("VisitorContact", fields: [contactId], references: [id], onDelete: SetNull)
@@ -1371,6 +2024,7 @@ model TrackedVisitor {
   firstSeen DateTime @default(now())
   lastSeen  DateTime @updatedAt
 
+  @@index([organizationId])
   @@index([contactId])
   @@index([firstSource])
   @@map("trackedVisitor")
@@ -1378,6 +2032,8 @@ model TrackedVisitor {
 
 model TrackedEvent {
   id String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   visitorId String
   type      String
@@ -1392,6 +2048,7 @@ model TrackedEvent {
 
   occurredAt DateTime
 
+  @@index([organizationId])
   @@index([visitorId, occurredAt])
   @@index([occurredAt])
   @@index([host, occurredAt])
@@ -1400,28 +2057,35 @@ model TrackedEvent {
 }
 
 model TrackingCounter {
-  key       String   @id
+  key       String
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   value     Int      @default(0)
   expiresAt DateTime
 
+  @@id([organizationId, key])
   @@index([expiresAt])
   @@map("trackingCounter")
 }
 
 model TrackedPageDaily {
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   day      DateTime
   host     String
   path     String
   views    Int      @default(0)
   visitors Int      @default(0)
 
-  @@id([day, host, path])
+  @@id([organizationId, day, host, path])
   @@index([host, day])
   @@map("trackedPageDaily")
 }
 
 model FormSubmission {
   id String @id @default(cuid())
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   visitorId String?
   contactId String?
@@ -1442,6 +2106,7 @@ model FormSubmission {
 
   createdAt DateTime @default(now())
 
+  @@index([organizationId])
   @@index([contactId])
   @@index([createdAt])
   @@map("formSubmission")
@@ -1477,22 +2142,81 @@ model TelemetryCounter {
 }
 
 model Organization {
-  id          String       @id
-  name        String
-  slug        String
-  logo        String?
-  createdAt   DateTime
-  metadata    String?
-  website     String?
-  members     Member[]
-  invitations Invitation[]
+  id             String          @id
+  name           String
+  slug           String
+  logo           String?
+  createdAt      DateTime
+  metadata       String?
+  website        String?
+  members        Member[]
+  invitations    Invitation[]
+  xmppAgentTasks XmppAgentTask[]
+
+  slackMemberMatches             SlackMemberMatch[]
+  slackChannels                  SlackChannel[]
+  slackInstallations             SlackInstallation[]
+  slackWorkspaceGrants           SlackWorkspaceGrant[]
+  companies                      Company[]
+  companyEnrichments             CompanyEnrichment[]
+  contacts                       Contact[]
+  contactFacts                   ContactFact[]
+  contactBriefs                  ContactBrief[]
+  agentTasks                     AgentTask[]
+  agentEvents                    AgentEvent[]
+  agentConversations             AgentConversation[]
+  agentConversationFeedback      AgentConversationFeedback[]
+  agentConversationShares        AgentConversationShare[]
+  agentConversationSubmissions   AgentConversationSubmission[]
+  agentConversationAttachments   AgentConversationAttachment[]
+  agentDefinitions               AgentDefinition[]
+  agentVersions                  AgentVersion[]
+  agentBuilderArtifacts          AgentBuilderArtifact[]
+  agentTriggers                  AgentTrigger[]
+  agentRuns                      AgentRun[]
+  agentRunEvents                 AgentRunEvent[]
+  agentActions                   AgentAction[]
+  agentAuditEvents               AgentAuditEvent[]
+  artifacts                      Artifact[]
+  assetUploads                   AssetUpload[]
+  assetEmailSources              AssetEmailSource[]
+  assetStorageJobs               AssetStorageJob[]
+  assetApiRequests               AssetApiRequest[]
+  deals                          Deal[]
+  dealContacts                   DealContact[]
+  fieldDefinitions               FieldDefinition[]
+  fieldOptions                   FieldOption[]
+  fieldValues                    FieldValue[]
+  savedViews                     SavedView[]
+  activities                     Activity[]
+  appointmentDetails             AppointmentDetails[]
+  mailboxSyncs                   MailboxSync[]
+  emailThreads                   EmailThread[]
+  emailMessages                  EmailMessage[]
+  calendarEvents                 CalendarEvent[]
+  calendarAttendees              CalendarAttendee[]
+  suppressedDomains              SuppressedDomain[]
+  suppressedContacts             SuppressedContact[]
+  appSetting                     AppSetting?
+  trackingSiteLocator            TrackingSiteLocator?
+  trackedDomains                 TrackedDomain[]
+  trackedVisitors                TrackedVisitor[]
+  trackedEvents                  TrackedEvent[]
+  trackingCounters               TrackingCounter[]
+  trackedPageDailies             TrackedPageDaily[]
+  formSubmissions                FormSubmission[]
+  workspaceProfile               WorkspaceProfile?
+  ssoProviders                   SsoProvider[]
+  ssoProviderLocators            SsoProviderLocator[]
+  apiKeys                        Apikey[]
 
   @@unique([slug])
   @@map("organization")
 }
 
 model WorkspaceProfile {
-  id String @id
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)")) @id
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
 
   website   String
   narrative String
@@ -1546,20 +2270,34 @@ model SsoProvider {
   userId         String?
   user           User?   @relation(fields: [userId], references: [id], onDelete: Cascade)
   providerId     String
-  organizationId String?
+  organizationId String @default(dbgenerated("current_setting('app.current_organization_id'::text, true)"))
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   domain         String
+  locator        SsoProviderLocator?
 
   @@unique([providerId])
+  @@index([organizationId])
   @@map("ssoProvider")
 }
 
+model SsoProviderLocator {
+  providerId      String       @id
+  organizationId String
+  domain          String
+  provider        SsoProvider  @relation(fields: [providerId], references: [providerId], onDelete: Cascade, onUpdate: Cascade)
+  organization    Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  @@index([organizationId])
+  @@map("ssoProviderLocator")
+}
+
 model Apikey {
   id                  String    @id
   configId            String    @default("default")
   name                String?
   start               String?
   referenceId         String
-  user                User      @relation(fields: [referenceId], references: [id], onDelete: Cascade)
+  organization        Organization @relation(fields: [referenceId], references: [id], onDelete: Cascade)
   prefix              String?
   key                 String
   refillInterval      Int?
@@ -1583,3 +2321,524 @@ model Apikey {
   @@index([key])
   @@map("apikey")
 }
+model UserAvatar {
+  id String @id @default(cuid())
+  userId String @map("user_id") @unique(map: "user_avatar_user_id_unique")
+  mimeType String @map("mime_type")
+  size Int
+  data Bytes
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  @@index([userId], map: "user_avatar_userId_idx")
+  @@map("user_avatar")
+}
+
+model Workspace {
+  id String @id @default(cuid())
+  name String
+  slug String @unique
+  logo String?
+  metadata String?
+  description String?
+  createdAt DateTime @map("created_at")
+  workspaceMembers WorkspaceMember[]
+  workspaceBillings WorkspaceBilling[]
+  teams Team[]
+  workspaceInvitations WorkspaceInvitation[]
+  workspaceRoles WorkspaceRole[]
+  projects Project[]
+  billingReminderSents BillingReminderSent[]
+  assets Asset[]
+  labels Label[]
+  userNotificationWorkspaceRules UserNotificationWorkspaceRule[]
+  userNotificationWorkspaceProjects UserNotificationWorkspaceProject[]
+  @@map("workspace")
+}
+
+model WorkspaceMember {
+  id String @id @default(cuid())
+  workspaceId String @map("workspace_id")
+  userId String @map("user_id")
+  role String @default("member")
+  joinedAt DateTime @map("joined_at")
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+  @@index([workspaceId], map: "workspace_member_workspaceId_idx")
+  @@index([userId], map: "workspace_member_userId_idx")
+  @@map("workspace_member")
+}
+
+model WorkspaceBilling {
+  id String @id @default(cuid())
+  workspaceId String @map("workspace_id") @unique(map: "workspace_billing_workspace_id_unique")
+  foundingFree Boolean @map("founding_free") @default(false)
+  trialEndsAt DateTime? @map("trial_ends_at")
+  creemCustomerId String? @map("creem_customer_id")
+  creemSubscriptionId String? @map("creem_subscription_id") @unique
+  creemProductId String? @map("creem_product_id")
+  plan String?
+  billingInterval String? @map("billing_interval")
+  status String?
+  seats Int @default(1)
+  currentPeriodEnd DateTime? @map("current_period_end")
+  canceledAt DateTime? @map("canceled_at")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([workspaceId], map: "workspace_billing_workspaceId_idx")
+  @@map("workspace_billing")
+}
+
+model TrialGrant {
+  emailHash String @map("email_hash") @id
+  trialEndsAt DateTime @map("trial_ends_at")
+  createdAt DateTime @map("created_at") @default(now())
+  @@map("trial_grant")
+}
+
+model BillingEvent {
+  id String @id
+  eventType String @map("event_type")
+  processedAt DateTime @map("processed_at") @default(now())
+  @@map("billing_event")
+}
+
+model Team {
+  id String @id
+  name String
+  workspaceId String @map("workspace_id")
+  createdAt DateTime @map("created_at")
+  updatedAt DateTime? @map("updated_at") @updatedAt
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+  teamMembers TeamMember[]
+  @@index([workspaceId], map: "team_workspaceId_idx")
+  @@map("team")
+}
+
+model TeamMember {
+  id String @id
+  teamId String @map("team_id")
+  userId String @map("user_id")
+  createdAt DateTime? @map("created_at")
+  team Team @relation(fields: [teamId], references: [id], onDelete: Cascade)
+  @@index([teamId], map: "teamMember_teamId_idx")
+  @@index([userId], map: "teamMember_userId_idx")
+  @@map("team_member")
+}
+
+model WorkspaceInvitation {
+  id String @id @default(cuid())
+  workspaceId String @map("workspace_id")
+  email String
+  role String?
+  teamId String? @map("team_id")
+  status String @default("pending")
+  expiresAt DateTime @map("expires_at")
+  createdAt DateTime @map("created_at") @default(now())
+  inviterId String @map("inviter_id")
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+  @@index([workspaceId], map: "workspace_invitation_workspaceId_idx")
+  @@index([email], map: "workspace_invitation_email_idx")
+  @@index([inviterId], map: "workspace_invitation_inviterId_idx")
+  @@map("workspace_invitation")
+}
+
+model WorkspaceRole {
+  id String @id @default(cuid())
+  workspaceId String @map("workspace_id")
+  role String
+  permission String
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([workspaceId], map: "workspace_role_workspaceId_idx")
+  @@index([role], map: "workspace_role_role_idx")
+  @@map("workspace_role")
+}
+
+model Project {
+  id String @id @default(cuid())
+  workspaceId String @map("workspace_id")
+  slug String
+  icon String? @default("Layout")
+  name String
+  description String?
+  createdAt DateTime @map("created_at") @default(now())
+  isPublic Boolean? @map("is_public") @default(false)
+  archivedAt DateTime? @map("archived_at")
+  lastTaskNumber Int @map("last_task_number") @default(0)
+  position Int @default(0)
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  projectColumns ProjectColumn[]
+  workflowRules WorkflowRule[]
+  projectTasks ProjectTask[]
+  assets Asset[]
+  userNotificationWorkspaceProjects UserNotificationWorkspaceProject[]
+  githubIntegrations GithubIntegration[]
+  integrations Integration[]
+  @@unique([workspaceId, id], map: "project_workspace_id_id_unique")
+  @@index([workspaceId, position], map: "project_workspaceId_position_idx")
+  @@map("project")
+}
+
+model ProjectColumn {
+  id String @id @default(cuid())
+  projectId String @map("project_id")
+  name String
+  slug String
+  position Int @default(0)
+  icon String?
+  color String?
+  isFinal Boolean @map("is_final") @default(false)
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  project Project @relation(fields: [projectId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  workflowRules WorkflowRule[]
+  projectTasks ProjectTask[]
+  @@index([projectId], map: "column_projectId_idx")
+  @@map("column")
+}
+
+model WorkflowRule {
+  id String @id @default(cuid())
+  projectId String @map("project_id")
+  integrationType String @map("integration_type")
+  eventType String @map("event_type")
+  columnId String @map("column_id")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  project Project @relation(fields: [projectId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  column ProjectColumn @relation(fields: [columnId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([projectId], map: "workflow_rule_projectId_idx")
+  @@index([columnId], map: "workflow_rule_columnId_idx")
+  @@map("workflow_rule")
+}
+
+model ProjectTask {
+  id String @id @default(cuid())
+  projectId String @map("project_id")
+  position Int? @default(0)
+  number Int? @default(1)
+  userId String? @map("assignee_id")
+  title String
+  description String?
+  status String @default("to-do")
+  columnId String? @map("column_id")
+  priority String @default("low")
+  startDate DateTime? @map("start_date")
+  dueDate DateTime? @map("due_date")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  project Project @relation(fields: [projectId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  column ProjectColumn? @relation(fields: [columnId], references: [id], onDelete: SetNull, onUpdate: Cascade)
+  taskReminderSents TaskReminderSent[]
+  timeEntries TimeEntry[]
+  taskActivities TaskActivity[]
+  assets Asset[]
+  labels Label[]
+  externalLinks ExternalLink[]
+  taskComments TaskComment[]
+  taskRelations TaskRelation[]
+  taskRelations2 TaskRelation[] @relation("TaskRelationToProjectTask_1")
+  @@unique([projectId, number], map: "task_project_number_unique")
+  @@index([projectId], map: "task_projectId_idx")
+  @@index([dueDate], map: "task_dueDate_idx")
+  @@index([userId], map: "task_assigneeId_idx")
+  @@index([columnId], map: "task_columnId_idx")
+  @@map("task")
+}
+
+model BillingReminderSent {
+  id String @id @default(cuid())
+  userId String @map("user_id")
+  workspaceId String @map("workspace_id")
+  reminderType String @map("reminder_type")
+  trialEndsAt DateTime? @map("trial_ends_at")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@unique([userId, reminderType], map: "billing_reminder_sent_user_type_unique")
+  @@index([workspaceId], map: "billing_reminder_sent_workspaceId_idx")
+  @@index([userId], map: "billing_reminder_sent_userId_idx")
+  @@map("billing_reminder_sent")
+}
+
+model JobLease {
+  name String @id
+  owner String
+  expiresAt DateTime @map("expires_at")
+  @@map("job_lease")
+}
+
+model TaskReminderSent {
+  id String @id @default(cuid())
+  taskId String @map("task_id")
+  reminderType String @map("reminder_type")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  task ProjectTask @relation(fields: [taskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@unique([taskId, reminderType], map: "task_reminder_sent_task_type_unique")
+  @@index([taskId], map: "task_reminder_sent_taskId_idx")
+  @@map("task_reminder_sent")
+}
+
+model TimeEntry {
+  id String @id @default(cuid())
+  taskId String @map("task_id")
+  userId String? @map("user_id")
+  description String?
+  startTime DateTime @map("start_time")
+  endTime DateTime? @map("end_time")
+  duration Int? @default(0)
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  task ProjectTask @relation(fields: [taskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([taskId], map: "time_entry_taskId_idx")
+  @@index([userId], map: "time_entry_userId_idx")
+  @@map("time_entry")
+}
+
+model TaskActivity {
+  id String @id @default(cuid())
+  taskId String @map("task_id")
+  type String
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  userId String? @map("user_id")
+  content String?
+  eventData Json? @map("event_data")
+  externalUserName String? @map("external_user_name")
+  externalUserAvatar String? @map("external_user_avatar")
+  externalSource String? @map("external_source")
+  externalUrl String? @map("external_url")
+  task ProjectTask @relation(fields: [taskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  assets Asset[]
+  @@unique([taskId, externalSource, externalUrl], map: "activity_task_external_source_external_url_unique")
+  @@index([taskId], map: "activity_task_id_idx")
+  @@index([userId], map: "activity_userId_idx")
+  @@map("task_activity")
+}
+
+model Asset {
+  id String @id @default(cuid())
+  workspaceId String @map("workspace_id")
+  projectId String @map("project_id")
+  taskId String? @map("task_id")
+  activityId String? @map("activity_id")
+  objectKey String @map("object_key") @unique
+  filename String
+  mimeType String @map("mime_type")
+  size Int
+  kind String @default("image")
+  surface String @default("description")
+  createdBy String? @map("created_by")
+  createdAt DateTime @map("created_at") @default(now())
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  project Project @relation(fields: [projectId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  task ProjectTask? @relation(fields: [taskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  activity TaskActivity? @relation(fields: [activityId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([workspaceId], map: "asset_workspaceId_idx")
+  @@index([projectId], map: "asset_projectId_idx")
+  @@index([taskId], map: "asset_taskId_idx")
+  @@index([activityId], map: "asset_activityId_idx")
+  @@index([createdBy], map: "asset_createdBy_idx")
+  @@map("asset")
+}
+
+model Label {
+  id String @id @default(cuid())
+  name String
+  color String
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  taskId String? @map("task_id")
+  workspaceId String? @map("workspace_id")
+  task ProjectTask? @relation(fields: [taskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  workspace Workspace? @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@unique([taskId, name], map: "label_task_name_unique")
+  @@index([taskId], map: "label_task_id_idx")
+  @@index([workspaceId], map: "label_workspace_id_idx")
+  @@map("label")
+}
+
+model Notification {
+  id String @id @default(cuid())
+  userId String @map("user_id")
+  title String?
+  content String?
+  type String @default("info")
+  eventData Json? @map("event_data")
+  isRead Boolean? @map("is_read") @default(false)
+  resourceId String? @map("resource_id")
+  resourceType String? @map("resource_type")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  @@index([userId], map: "notification_userId_idx")
+  @@map("notification")
+}
+
+model UserNotificationPreference {
+  id String @id @default(cuid())
+  userId String @map("user_id") @unique
+  emailEnabled Boolean @map("email_enabled") @default(false)
+  ntfyEnabled Boolean @map("ntfy_enabled") @default(false)
+  ntfyServerUrl String? @map("ntfy_server_url")
+  ntfyTopic String? @map("ntfy_topic")
+  ntfyToken String? @map("ntfy_token")
+  gotifyEnabled Boolean @map("gotify_enabled") @default(false)
+  gotifyServerUrl String? @map("gotify_server_url")
+  gotifyToken String? @map("gotify_token")
+  webhookEnabled Boolean @map("webhook_enabled") @default(false)
+  webhookUrl String? @map("webhook_url")
+  webhookSecret String? @map("webhook_secret")
+  taskAssignmentEnabled Boolean @map("task_assignment_enabled") @default(true)
+  taskCommentEnabled Boolean @map("task_comment_enabled") @default(true)
+  taskStatusChangeEnabled Boolean @map("task_status_change_enabled") @default(true)
+  dueDateReminderEnabled Boolean @map("due_date_reminder_enabled") @default(true)
+  dueDateReminderLeadTimeMinutes Int @map("due_date_reminder_lead_time_minutes") @default(1440)
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  @@map("user_notification_preference")
+}
+
+model UserNotificationWorkspaceRule {
+  id String @id @default(cuid())
+  userId String @map("user_id")
+  workspaceId String @map("workspace_id")
+  isActive Boolean @map("is_active") @default(true)
+  emailEnabled Boolean @map("email_enabled") @default(false)
+  ntfyEnabled Boolean @map("ntfy_enabled") @default(false)
+  gotifyEnabled Boolean @map("gotify_enabled") @default(false)
+  webhookEnabled Boolean @map("webhook_enabled") @default(false)
+  projectMode String @map("project_mode") @default("all")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  userNotificationWorkspaceProjects UserNotificationWorkspaceProject[]
+  @@unique([userId, workspaceId], map: "user_notification_workspace_rule_user_workspace_unique")
+  @@unique([workspaceId, id], map: "user_notification_workspace_rule_workspace_id_id_unique")
+  @@index([userId], map: "user_notification_workspace_rule_userId_idx")
+  @@index([workspaceId], map: "user_notification_workspace_rule_workspaceId_idx")
+  @@map("user_notification_workspace_rule")
+}
+
+model UserNotificationWorkspaceProject {
+  id String @id @default(cuid())
+  workspaceId String @map("workspace_id")
+  workspaceRuleId String @map("workspace_rule_id")
+  projectId String @map("project_id")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  userNotificationWorkspaceRule UserNotificationWorkspaceRule @relation(fields: [workspaceId, workspaceRuleId], references: [workspaceId, id], onDelete: Cascade, onUpdate: Cascade)
+  project Project @relation(fields: [workspaceId, projectId], references: [workspaceId, id], onDelete: Cascade, onUpdate: Cascade)
+  @@unique([workspaceRuleId, projectId], map: "user_notification_workspace_project_rule_project_unique")
+  @@index([workspaceRuleId], map: "user_notification_workspace_project_ruleId_idx")
+  @@index([projectId], map: "user_notification_workspace_project_projectId_idx")
+  @@index([workspaceId, projectId], map: "user_notification_workspace_project_workspaceId_projectId_idx")
+  @@index([workspaceId, workspaceRuleId], map: "unwp_workspaceId_workspaceRuleId_idx")
+  @@map("user_notification_workspace_project")
+}
+
+model GithubIntegration {
+  id String @id @default(cuid())
+  projectId String @map("project_id") @unique
+  repositoryOwner String @map("repository_owner")
+  repositoryName String @map("repository_name")
+  installationId Int? @map("installation_id")
+  isActive Boolean? @map("is_active") @default(true)
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  project Project @relation(fields: [projectId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@map("github_integration")
+}
+
+model Integration {
+  id String @id @default(cuid())
+  projectId String @map("project_id")
+  type String
+  config String
+  isActive Boolean? @map("is_active") @default(true)
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  project Project @relation(fields: [projectId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  externalLinks ExternalLink[]
+  @@unique([projectId, type], map: "integration_project_type_unique")
+  @@index([projectId], map: "integration_projectId_idx")
+  @@index([type], map: "integration_type_idx")
+  @@map("integration")
+}
+
+model ExternalLink {
+  id String @id @default(cuid())
+  taskId String @map("task_id")
+  integrationId String @map("integration_id")
+  resourceType String @map("resource_type")
+  externalId String @map("external_id")
+  url String
+  title String?
+  metadata String?
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  task ProjectTask @relation(fields: [taskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  integration Integration @relation(fields: [integrationId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([taskId], map: "external_link_taskId_idx")
+  @@index([integrationId], map: "external_link_integrationId_idx")
+  @@index([externalId], map: "external_link_externalId_idx")
+  @@index([resourceType], map: "external_link_resourceType_idx")
+  @@map("external_link")
+}
+
+model TaskComment {
+  id String @id @default(cuid())
+  taskId String @map("task_id")
+  userId String? @map("user_id")
+  content String
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  task ProjectTask @relation(fields: [taskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([taskId], map: "comment_task_idx")
+  @@index([userId], map: "comment_user_idx")
+  @@map("comment")
+}
+
+model TaskRelation {
+  id String @id @default(cuid())
+  sourceTaskId String @map("source_task_id")
+  targetTaskId String @map("target_task_id")
+  relationType String @map("relation_type")
+  createdAt DateTime @map("created_at") @default(now())
+  sourceTask ProjectTask @relation(fields: [sourceTaskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  targetTask ProjectTask @relation("TaskRelationToProjectTask_1", fields: [targetTaskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([sourceTaskId], map: "task_relation_source_idx")
+  @@index([targetTaskId], map: "task_relation_target_idx")
+  @@map("task_relation")
+}
+
+model DeviceCode {
+  id String @id @default(cuid())
+  deviceCode String @map("device_code")
+  userCode String @map("user_code")
+  userId String? @map("user_id")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  expiresAt DateTime @map("expires_at")
+  status String
+  lastPolledAt DateTime? @map("last_polled_at")
+  pollingInterval Int? @map("polling_interval")
+  clientId String? @map("client_id")
+  scope String?
+  @@index([userId], map: "device_code_user_id_idx")
+  @@map("device_code")
+}
+
+model McpOauthState {
+  id String @id @default(cuid())
+  kind String
+  key String
+  payload Json
+  expiresAt DateTime @map("expires_at")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  @@index([expiresAt], map: "mcp_oauth_state_expiresAt_idx")
+  @@map("mcp_oauth_state")
+}
diff --git a/packages/db/prisma/seed.ts b/packages/db/prisma/seed.ts
index 556f2e2eb..551bd7bcc 100644
--- a/packages/db/prisma/seed.ts
+++ b/packages/db/prisma/seed.ts
@@ -10,7 +10,8 @@ import {
 	FieldType,
 	RateSource,
 } from "../src/generated/prisma/enums";
-import { readReportingCurrency, SETTINGS_ID } from "../src/settings";
+import { runInTenant } from "../src/tenant-context";
+import { scopedDb } from "../src/tenant-scope";
 
 function makeRandom(seed: number): () => number {
 	let a = seed;
@@ -375,9 +376,15 @@ async function seedCompanies(
 	const companies = [];
 
 	for (const company of COMPANIES) {
-		const row = await db.company.upsert({
-			where: { domain: company.domain },
+		const row = await scopedDb.company.upsert({
+			where: {
+				organizationId_domain: {
+					organizationId: SEED_ORGANIZATION_ID,
+					domain: company.domain,
+				},
+			},
 			create: {
+				organizationId: SEED_ORGANIZATION_ID,
 				name: company.name,
 				domain: company.domain,
 				website: `https://${company.domain}`,
@@ -415,7 +422,7 @@ async function seedIcons(
 		const iconUrl =
 			(await mirror(source, `companies/${company.id}/icon`)) ?? source;
 
-		await db.company.updateMany({
+		await scopedDb.company.updateMany({
 			where: { id: company.id, iconUrl: null },
 			data: { iconUrl },
 		});
@@ -461,9 +468,16 @@ async function upsertField(
 	options: readonly string[] = [],
 ): Promise<SeededField> {
 	const key = fieldKeyFromLabel(label);
-	const definition = await db.fieldDefinition.upsert({
-		where: { entity_key: { entity, key } },
+	const definition = await scopedDb.fieldDefinition.upsert({
+		where: {
+			organizationId_entity_key: {
+				organizationId: SEED_ORGANIZATION_ID,
+				entity,
+				key,
+			},
+		},
 		create: {
+			organizationId: SEED_ORGANIZATION_ID,
 			entity,
 			key,
 			label,
@@ -474,6 +488,7 @@ async function upsertField(
 			position,
 			options: {
 				create: options.map((optionLabel, index) => ({
+					organizationId: SEED_ORGANIZATION_ID,
 					label: optionLabel,
 					position: index,
 				})),
@@ -542,7 +557,7 @@ async function seedCompanyFieldValues(
 		const accountType = pick(ACCOUNT_TYPES);
 
 		await Promise.all([
-			db.fieldValue.upsert({
+			scopedDb.fieldValue.upsert({
 				where: {
 					fieldId_companyId: {
 						fieldId: fields.accountType.id,
@@ -550,13 +565,14 @@ async function seedCompanyFieldValues(
 					},
 				},
 				create: {
+					organizationId: SEED_ORGANIZATION_ID,
 					fieldId: fields.accountType.id,
 					companyId: company.id,
 					optionId: optionIdFor(fields.accountType, accountType),
 				},
 				update: {},
 			}),
-			db.fieldValue.upsert({
+			scopedDb.fieldValue.upsert({
 				where: {
 					fieldId_companyId: {
 						fieldId: fields.segment.id,
@@ -564,13 +580,14 @@ async function seedCompanyFieldValues(
 					},
 				},
 				create: {
+					organizationId: SEED_ORGANIZATION_ID,
 					fieldId: fields.segment.id,
 					companyId: company.id,
 					optionId: optionIdFor(fields.segment, pick(SEGMENT_TIERS)),
 				},
 				update: {},
 			}),
-			db.fieldValue.upsert({
+			scopedDb.fieldValue.upsert({
 				where: {
 					fieldId_companyId: {
 						fieldId: fields.territory.id,
@@ -578,13 +595,14 @@ async function seedCompanyFieldValues(
 					},
 				},
 				create: {
+					organizationId: SEED_ORGANIZATION_ID,
 					fieldId: fields.territory.id,
 					companyId: company.id,
 					optionId: optionIdFor(fields.territory, pick(TERRITORIES)),
 				},
 				update: {},
 			}),
-			db.fieldValue.upsert({
+			scopedDb.fieldValue.upsert({
 				where: {
 					fieldId_companyId: {
 						fieldId: fields.lifecycleStage.id,
@@ -592,6 +610,7 @@ async function seedCompanyFieldValues(
 					},
 				},
 				create: {
+					organizationId: SEED_ORGANIZATION_ID,
 					fieldId: fields.lifecycleStage.id,
 					companyId: company.id,
 					optionId: optionIdFor(
@@ -601,7 +620,7 @@ async function seedCompanyFieldValues(
 				},
 				update: {},
 			}),
-			db.fieldValue.upsert({
+			scopedDb.fieldValue.upsert({
 				where: {
 					fieldId_companyId: {
 						fieldId: fields.leadSource.id,
@@ -609,13 +628,14 @@ async function seedCompanyFieldValues(
 					},
 				},
 				create: {
+					organizationId: SEED_ORGANIZATION_ID,
 					fieldId: fields.leadSource.id,
 					companyId: company.id,
 					optionId: optionIdFor(fields.leadSource, pick(LEAD_SOURCES)),
 				},
 				update: {},
 			}),
-			db.fieldValue.upsert({
+			scopedDb.fieldValue.upsert({
 				where: {
 					fieldId_companyId: {
 						fieldId: fields.icpFitScore.id,
@@ -623,13 +643,14 @@ async function seedCompanyFieldValues(
 					},
 				},
 				create: {
+					organizationId: SEED_ORGANIZATION_ID,
 					fieldId: fields.icpFitScore.id,
 					companyId: company.id,
 					number: integer(40, 95),
 				},
 				update: {},
 			}),
-			db.fieldValue.upsert({
+			scopedDb.fieldValue.upsert({
 				where: {
 					fieldId_companyId: {
 						fieldId: fields.bdrOwner.id,
@@ -637,6 +658,7 @@ async function seedCompanyFieldValues(
 					},
 				},
 				create: {
+					organizationId: SEED_ORGANIZATION_ID,
 					fieldId: fields.bdrOwner.id,
 					companyId: company.id,
 					userId: pick(ownerIds),
@@ -664,9 +686,15 @@ async function seedContacts(
 			if (used.has(email)) continue;
 			used.add(email);
 
-			const contact = await db.contact.upsert({
-				where: { email },
+			const contact = await scopedDb.contact.upsert({
+				where: {
+					organizationId_email: {
+						organizationId: SEED_ORGANIZATION_ID,
+						email,
+					},
+				},
 				create: {
+					organizationId: SEED_ORGANIZATION_ID,
 					firstName,
 					lastName,
 					email,
@@ -687,7 +715,7 @@ async function seedContacts(
 	for (const company of companies) {
 		const first = contacts.find((contact) => contact.companyId === company.id);
 		if (!first) continue;
-		await db.company.update({
+		await scopedDb.company.update({
 			where: { id: company.id },
 			data: { primaryContactId: first.id },
 		});
@@ -714,23 +742,24 @@ const SEED_RATES: SeedRates = {
 };
 
 const DEAL_CURRENCIES = ["USD", "USD", "USD", "EUR", "GBP", "JPY", "CAD"];
+const SEED_ORGANIZATION_ID = "workspace";
 
 let seedBase = "USD";
 
 async function seedRates(): Promise<number> {
 	const asOf = daysFromNow(-1);
 
-	await db.appSetting.upsert({
-		where: { id: SETTINGS_ID },
+	await scopedDb.appSetting.upsert({
+		where: { organizationId: SEED_ORGANIZATION_ID },
 		create: {
-			id: SETTINGS_ID,
+			organizationId: SEED_ORGANIZATION_ID,
 			reportingCurrency: DEFAULT_REPORTING_CURRENCY,
 		},
 		update: {},
-		select: { id: true },
+		select: { organizationId: true },
 	});
 
-	seedBase = await readReportingCurrency(db);
+	seedBase = DEFAULT_REPORTING_CURRENCY;
 
 	if (seedBase !== "USD") {
 		console.log(
@@ -809,9 +838,10 @@ async function seedDeals(
 				12,
 			);
 
-			await db.deal.upsert({
+			await scopedDb.deal.upsert({
 				where: { id },
 				create: {
+					organizationId: SEED_ORGANIZATION_ID,
 					id,
 					name:
 						n === 0
@@ -854,9 +884,10 @@ async function seedDeals(
 				(contact) => contact.companyId === company.id,
 			);
 			for (const contact of companyContacts.slice(0, integer(1, 2))) {
-				await db.dealContact.upsert({
+				await scopedDb.dealContact.upsert({
 					where: { dealId_contactId: { dealId: id, contactId: contact.id } },
 					create: {
+						organizationId: SEED_ORGANIZATION_ID,
 						dealId: id,
 						contactId: contact.id,
 						role: chance(0.5) ? "Champion" : "Decision maker",
@@ -878,13 +909,14 @@ async function seedActivities(
 	deals: SeededDeal[],
 	ownerIds: string[],
 ): Promise<number> {
-	const existing = await db.activity.count();
+	const existing = await scopedDb.activity.count();
 	if (existing > 0) {
 		console.log(`Activities already seeded (${existing}) — skipping.`);
 		return existing;
 	}
 
 	type ActivityRow = {
+		organizationId: string;
 		type: ActivityType;
 		subject: string | null;
 		body: string | null;
@@ -902,6 +934,7 @@ async function seedActivities(
 	const rows: ActivityRow[] = [];
 
 	const base = (companyId: string, createdById: string, createdAt: Date) => ({
+		organizationId: SEED_ORGANIZATION_ID,
 		companyId,
 		contactId: null,
 		dealId: null,
@@ -987,19 +1020,40 @@ async function seedActivities(
 		});
 	}
 
-	await db.activity.createMany({ data: rows });
+	await scopedDb.activity.createMany({ data: rows });
 	return rows.length;
 }
 
 async function main() {
-	const rates = await seedRates();
-	const ownerIds = await seedOwners();
-	const companies = await seedCompanies(ownerIds);
-	const contacts = await seedContacts(companies, ownerIds);
-	const deals = await seedDeals(companies, contacts, ownerIds);
-	const activities = await seedActivities(companies, contacts, deals, ownerIds);
-	const companyFields = await seedCompanyFields();
-	await seedCompanyFieldValues(companyFields, companies, ownerIds);
+	await db.organization.upsert({
+		where: { id: SEED_ORGANIZATION_ID },
+		create: {
+			id: SEED_ORGANIZATION_ID,
+			name: "Workspace",
+			slug: "workspace",
+			createdAt: new Date(),
+		},
+		update: {},
+	});
+	const { activities, companies, contacts, deals, rates } = await runInTenant(
+		SEED_ORGANIZATION_ID,
+		async () => {
+			const rates = await seedRates();
+			const ownerIds = await seedOwners();
+			const companies = await seedCompanies(ownerIds);
+			const contacts = await seedContacts(companies, ownerIds);
+			const deals = await seedDeals(companies, contacts, ownerIds);
+			const activities = await seedActivities(
+				companies,
+				contacts,
+				deals,
+				ownerIds,
+			);
+			const companyFields = await seedCompanyFields();
+			await seedCompanyFieldValues(companyFields, companies, ownerIds);
+			return { activities, companies, contacts, deals, rates };
+		},
+	);
 
 	console.log(
 		`Seeded ${companies.length} companies, ${contacts.length} contacts, ` +
diff --git a/packages/db/scripts/provision-organization.ts b/packages/db/scripts/provision-organization.ts
new file mode 100644
index 000000000..64339d1f4
--- /dev/null
+++ b/packages/db/scripts/provision-organization.ts
@@ -0,0 +1,134 @@
+import { db } from "../src/client";
+import type { Prisma } from "../src/generated/prisma/client";
+import { lockIdempotencyKey } from "../src/idempotency";
+import { workspaceSlug } from "../src/workspace-slug";
+
+function readArg(flag: string): string | undefined {
+	const index = process.argv.indexOf(flag);
+	if (index === -1) return undefined;
+	const value = process.argv[index + 1];
+	return value?.startsWith("--") ? undefined : value;
+}
+
+function usage(message?: string): never {
+	console.error(
+		[
+			message ? `\n  ${message}` : "",
+			"",
+			'  Usage: bun run db:provision -- --name "Acme Inc" --owner-email owner@acme.com [--slug acme]',
+			"",
+			"  Creates an organization and makes the existing user its owner.",
+			"  The user must sign in before you run this command.",
+			"",
+		].join("\n"),
+	);
+	process.exit(1);
+}
+
+function validateEmail(value: string): boolean {
+	return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value);
+}
+
+async function uniqueSlug(
+	transaction: Pick<Prisma.TransactionClient, "organization">,
+	base: string,
+): Promise<string> {
+	let candidate = base;
+	let attempt = 2;
+
+	while (
+		await transaction.organization.findUnique({
+			where: { slug: candidate },
+			select: { id: true },
+		})
+	) {
+		candidate = `${base}-${attempt}`;
+		attempt += 1;
+	}
+
+	return candidate;
+}
+
+type ProvisionResult = {
+	organizationId: string;
+	name: string;
+	slug: string;
+	ownerEmail: string;
+};
+
+async function provision(
+	name: string,
+	ownerEmail: string,
+	baseSlug: string,
+): Promise<ProvisionResult | null> {
+	const owner = await db.user.findUnique({
+		where: { email: ownerEmail },
+		select: { id: true, email: true },
+	});
+
+	if (!owner) return null;
+
+	return db.$transaction(async (transaction) => {
+		await lockIdempotencyKey(transaction, `provision-organization:${baseSlug}`);
+
+		const slug = await uniqueSlug(transaction, baseSlug);
+		const organizationId = crypto.randomUUID();
+		const organization = await transaction.organization.create({
+			data: {
+				id: organizationId,
+				name,
+				slug,
+				createdAt: new Date(),
+			},
+			select: { id: true, name: true, slug: true },
+		});
+
+		await transaction.member.create({
+			data: {
+				id: crypto.randomUUID(),
+				organizationId: organization.id,
+				userId: owner.id,
+				role: "owner",
+				createdAt: new Date(),
+			},
+		});
+
+		return {
+			organizationId: organization.id,
+			name: organization.name,
+			slug: organization.slug,
+			ownerEmail: owner.email,
+		};
+	});
+}
+
+async function main(): Promise<ProvisionResult | null> {
+	const name = readArg("--name")?.trim();
+	const ownerEmail = readArg("--owner-email")?.trim().toLowerCase();
+	const slugOverride = readArg("--slug")?.trim();
+
+	if (!name || !ownerEmail) usage("name and owner-email are required.");
+	if (!validateEmail(ownerEmail)) usage(`Invalid owner email "${ownerEmail}".`);
+
+	return provision(name, ownerEmail, workspaceSlug(slugOverride || name));
+}
+
+main()
+	.then((result) => {
+		if (!result) {
+			console.error("No matching user exists. The owner must sign in first.");
+			process.exitCode = 1;
+			return;
+		}
+
+		console.log(
+			`Created organization "${result.name}" (${result.organizationId}), slug "${result.slug}", owned by ${result.ownerEmail}.`,
+		);
+	})
+	.catch((error) => {
+		console.error(error instanceof Error ? error.message : String(error));
+		process.exitCode = 1;
+	})
+	.finally(async () => {
+		await db.$disconnect();
+	});
diff --git a/packages/db/scripts/rehearse-migration.ts b/packages/db/scripts/rehearse-migration.ts
new file mode 100644
index 000000000..f08ec16d6
--- /dev/null
+++ b/packages/db/scripts/rehearse-migration.ts
@@ -0,0 +1,220 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { PrismaPg } from "@prisma/adapter-pg";
+import { PrismaClient } from "../src/generated/prisma/client";
+import { WORKSPACE_ID } from "../src/workspace";
+
+const MIGRATION = join(
+	dirname(import.meta.dirname),
+	"prisma",
+	"migrations",
+	"20260905120000_multi_tenant_schema",
+	"migration.sql",
+);
+
+const ORGANIZATION_DEFAULT =
+	"current_setting('app.current_organization_id'::text, true)";
+
+const SEEDED_MINIMUMS = {
+	company: 15,
+	contact: 25,
+	deal: 20,
+	dealContact: 20,
+	activity: 80,
+	fieldDefinition: 7,
+	fieldOption: 18,
+	fieldValue: 100,
+	appSetting: 1,
+} as const;
+
+type CountRow = {
+	total: bigint;
+	wrongOrganization: bigint;
+};
+
+type ColumnRow = {
+	isNullable: "YES" | "NO";
+	columnDefault: string | null;
+};
+
+type ForeignKeyRow = {
+	count: bigint;
+};
+
+type RlsRow = {
+	policyCount: bigint;
+	rowSecurity: boolean;
+	forceRowSecurity: boolean;
+};
+
+function tenantTables(): string[] {
+	const sql = readFileSync(MIGRATION, "utf8");
+	const added = Array.from(
+		sql.matchAll(/ALTER TABLE "([^"]+)" ADD COLUMN "organizationId"/g),
+		(match) => match[1],
+	);
+	const renamed = Array.from(
+		sql.matchAll(
+			/ALTER TABLE "([^"]+)" RENAME COLUMN "id" TO "organizationId"/g,
+		),
+		(match) => match[1],
+	);
+
+	return [...new Set([...added, ...renamed])].sort();
+}
+
+function rlsTables(): string[] {
+	const sql = readFileSync(MIGRATION, "utf8");
+	const array = sql.match(/FOREACH tbl IN ARRAY ARRAY\[(.*?)\]\s*LOOP/s)?.[1];
+
+	if (!array) throw new Error("RLS migration table list does not exist.");
+
+	return Array.from(array.matchAll(/'([^']+)'/g), (match) => match[1]).sort();
+}
+
+function quotedIdentifier(value: string): string {
+	return `"${value.replaceAll('"', '""')}"`;
+}
+
+async function counts(audit: PrismaClient, table: string): Promise<CountRow> {
+	const rows = await audit.$queryRawUnsafe<CountRow[]>(
+		`SELECT COUNT(*)::bigint AS "total", COUNT(*) FILTER (WHERE "organizationId" IS DISTINCT FROM $1)::bigint AS "wrongOrganization" FROM ${quotedIdentifier(table)}`,
+		WORKSPACE_ID,
+	);
+	const row = rows[0];
+
+	if (!row) throw new Error(`No count result returned for ${table}.`);
+
+	return row;
+}
+
+async function column(audit: PrismaClient, table: string): Promise<ColumnRow> {
+	const rows = await audit.$queryRawUnsafe<ColumnRow[]>(
+		`SELECT "is_nullable" AS "isNullable", "column_default" AS "columnDefault" FROM information_schema.columns WHERE table_schema = current_schema() AND table_name = $1 AND column_name = 'organizationId'`,
+		table,
+	);
+	const row = rows[0];
+
+	if (!row) throw new Error(`${table}.organizationId does not exist.`);
+
+	return row;
+}
+
+async function foreignKey(audit: PrismaClient, table: string): Promise<number> {
+	const rows = await audit.$queryRawUnsafe<ForeignKeyRow[]>(
+		`SELECT COUNT(*)::bigint AS "count" FROM pg_constraint c JOIN pg_class source ON source.oid = c.conrelid JOIN pg_namespace n ON n.oid = source.relnamespace JOIN unnest(c.conkey) AS key(attnum) ON true JOIN pg_attribute a ON a.attrelid = source.oid AND a.attnum = key.attnum WHERE c.contype = 'f' AND n.nspname = current_schema() AND source.relname = $1 AND a.attname = 'organizationId' AND c.confrelid = 'organization'::regclass`,
+		table,
+	);
+
+	return Number(rows[0]?.count ?? 0n);
+}
+
+async function checkRlsCoverage(audit: PrismaClient): Promise<number> {
+	const tables = rlsTables();
+	let failures = 0;
+
+	console.log(`Checking RLS coverage on ${tables.length} tenant tables.`);
+
+	for (const table of tables) {
+		const rows = await audit.$queryRawUnsafe<RlsRow[]>(
+			`SELECT c.relrowsecurity AS "rowSecurity", c.relforcerowsecurity AS "forceRowSecurity", COUNT(p.policyname)::bigint AS "policyCount" FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace LEFT JOIN pg_policies p ON p.schemaname = n.nspname AND p.tablename = c.relname AND p.policyname = 'tenant_isolation' WHERE n.nspname = current_schema() AND c.relname = $1 GROUP BY c.relrowsecurity, c.relforcerowsecurity`,
+			table,
+		);
+		const row = rows[0];
+		const problems: string[] = [];
+
+		if (!row?.rowSecurity) problems.push("row-level security is disabled");
+		if (!row?.forceRowSecurity)
+			problems.push("row-level security is not forced");
+		if (row?.policyCount !== 1n)
+			problems.push("tenant_isolation policy count is not one");
+
+		if (problems.length > 0) {
+			console.error(`FAIL ${table}: ${problems.join("; ")}`);
+			failures += 1;
+			continue;
+		}
+
+		console.log(`ok   ${table}: RLS enabled and forced`);
+	}
+
+	return failures;
+}
+
+async function rehearse(audit: PrismaClient): Promise<void> {
+	const tables = tenantTables();
+	let failures = 0;
+
+	console.log(
+		`Checking ${tables.length} tables changed by the tenant backfill migration.`,
+	);
+
+	for (const table of tables) {
+		const organizationColumn = await column(audit, table);
+		const [rowCounts, organizationForeignKeys] = await Promise.all([
+			counts(audit, table),
+			foreignKey(audit, table),
+		]);
+		const minimum = SEEDED_MINIMUMS[table as keyof typeof SEEDED_MINIMUMS];
+		const problems: string[] = [];
+
+		if (rowCounts.wrongOrganization > 0n) {
+			problems.push(`${rowCounts.wrongOrganization} row(s) use another tenant`);
+		}
+		if (organizationColumn.isNullable !== "NO") {
+			problems.push("organizationId accepts null");
+		}
+		if (organizationColumn.columnDefault !== ORGANIZATION_DEFAULT) {
+			problems.push("organizationId has the wrong tenant default");
+		}
+		if (organizationForeignKeys !== 1) {
+			problems.push("organizationId lacks one organization foreign key");
+		}
+		if (minimum !== undefined && rowCounts.total < BigInt(minimum)) {
+			problems.push(`seeded volume is below ${minimum}`);
+		}
+
+		if (problems.length > 0) {
+			console.error(
+				`FAIL ${table}: ${rowCounts.total} row(s); ${problems.join("; ")}`,
+			);
+			failures += 1;
+			continue;
+		}
+
+		console.log(`ok   ${table}: ${rowCounts.total} row(s)`);
+	}
+
+	failures += await checkRlsCoverage(audit);
+
+	if (failures > 0) {
+		throw new Error(`${failures} tenant migration check(s) failed.`);
+	}
+
+	console.log("Tenant migration rehearsal passed.");
+}
+
+async function main(): Promise<void> {
+	const auditUrl = process.env.AUDIT_DATABASE_URL;
+
+	if (!auditUrl) {
+		throw new Error(
+			"AUDIT_DATABASE_URL is required for the migration rehearsal. See docs/environment.md.",
+		);
+	}
+
+	const audit = new PrismaClient({
+		adapter: new PrismaPg({ connectionString: auditUrl }),
+	});
+
+	try {
+		await rehearse(audit);
+	} finally {
+		await audit.$disconnect();
+	}
+}
+
+main().catch((error) => {
+	console.error(error);
+	process.exitCode = 1;
+});
diff --git a/packages/db/scripts/test-db-create.ts b/packages/db/scripts/test-db-create.ts
new file mode 100644
index 000000000..43ad0e9ce
--- /dev/null
+++ b/packages/db/scripts/test-db-create.ts
@@ -0,0 +1,127 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import pg from "pg";
+
+import { fail } from "./test-db-url";
+
+const SCHEMA = join(dirname(import.meta.dirname), "prisma", "schema.prisma");
+const MIGRATIONS = join(dirname(import.meta.dirname), "prisma", "migrations");
+
+export async function createTestDatabase(
+	target: string,
+	database: string,
+	forced: boolean,
+): Promise<void> {
+	const maintenance = new URL(target);
+	maintenance.pathname = "/postgres";
+	maintenance.search = "";
+
+	const client = new pg.Client({ connectionString: maintenance.toString() });
+
+	try {
+		await client.connect();
+	} catch (error) {
+		fail([
+			`Could not reach the server at ${new URL(target).host}.`,
+			"Is Postgres running?  docker compose up -d",
+			"",
+			error instanceof Error ? error.message : String(error),
+		]);
+	}
+
+	try {
+		const existing = await client.query(
+			"SELECT 1 FROM pg_database WHERE datname = $1",
+			[database],
+		);
+
+		if (existing.rowCount) {
+			const reason = forced
+				? "you asked for --reset"
+				: await stale(target, database);
+
+			if (!reason) {
+				console.log(`  ${database} already exists`);
+				return;
+			}
+
+			console.log(`  rebuilding ${database}: ${reason}`);
+			await drop(client, database);
+		}
+
+		await client.query(`CREATE DATABASE "${database}"`);
+		console.log(`  created ${database}`);
+	} finally {
+		await client.end();
+	}
+}
+
+async function drop(client: pg.Client, database: string): Promise<void> {
+	await client.query(
+		`SELECT pg_terminate_backend(pid) FROM pg_stat_activity
+		 WHERE datname = $1 AND pid <> pg_backend_pid()`,
+		[database],
+	);
+	await client.query(`DROP DATABASE IF EXISTS "${database}"`);
+}
+
+async function stale(target: string, database: string): Promise<string | null> {
+	const applied = await appliedMigrations(target);
+
+	if (applied === null) return null;
+
+	const onDisk = new Set(
+		existsSync(MIGRATIONS)
+			? readdirSync(MIGRATIONS, { withFileTypes: true })
+					.filter((entry) => entry.isDirectory())
+					.map((entry) => entry.name)
+			: [],
+	);
+
+	const foreign = applied.filter((migration) => !onDisk.has(migration));
+
+	if (foreign.length > 0) {
+		return `${database} holds ${foreign.length} migration(s) this branch does not have, starting with ${foreign[0]}`;
+	}
+
+	return drifted(target) ? `${database} no longer matches schema.prisma` : null;
+}
+
+async function appliedMigrations(target: string): Promise<string[] | null> {
+	const client = new pg.Client({ connectionString: target });
+
+	try {
+		await client.connect();
+	} catch {
+		return null;
+	}
+
+	try {
+		const rows = await client.query<{ migration_name: string }>(
+			`SELECT migration_name FROM _prisma_migrations WHERE finished_at IS NOT NULL`,
+		);
+		return rows.rows.map((row) => row.migration_name);
+	} catch {
+		return null;
+	} finally {
+		await client.end();
+	}
+}
+
+function drifted(target: string): boolean {
+	const result = spawnSync(
+		"prisma",
+		[
+			"migrate",
+			"diff",
+			"--from-config-datasource",
+			"--to-schema",
+			SCHEMA,
+			"--exit-code",
+		],
+		{ stdio: "ignore", env: { ...process.env, DATABASE_URL: target } },
+	);
+
+	return result.status === 2;
+}
diff --git a/packages/db/scripts/test-db-url.ts b/packages/db/scripts/test-db-url.ts
new file mode 100644
index 000000000..026ca277f
--- /dev/null
+++ b/packages/db/scripts/test-db-url.ts
@@ -0,0 +1,32 @@
+export function resolveTestDatabaseUrl(): string | null {
+	const explicit = process.env.TEST_DATABASE_URL;
+	if (explicit) return explicit;
+
+	const live = process.env.DATABASE_URL;
+	if (!live) return null;
+
+	try {
+		const parsed = new URL(live);
+		const database = parsed.pathname.replace(/^\//, "");
+		if (!database) return null;
+
+		parsed.pathname = `/${database.endsWith("_test") ? database : `${database}_test`}`;
+
+		return parsed.toString();
+	} catch {
+		return null;
+	}
+}
+
+export function databaseName(value: string): string {
+	try {
+		return new URL(value).pathname.replace(/^\//, "");
+	} catch {
+		return value;
+	}
+}
+
+export function fail(lines: string[]): never {
+	console.error(["", ...lines.map((line) => `  ${line}`), ""].join("\n"));
+	process.exit(1);
+}
diff --git a/packages/db/scripts/test-db.ts b/packages/db/scripts/test-db.ts
index 7deb36e5f..9d8e5c633 100644
--- a/packages/db/scripts/test-db.ts
+++ b/packages/db/scripts/test-db.ts
@@ -1,12 +1,11 @@
+import "@crm/env/load";
+
 import { spawnSync } from "node:child_process";
-import { existsSync, readdirSync } from "node:fs";
-import { dirname, join } from "node:path";
-import pg from "pg";
 
-const SCHEMA = join(dirname(import.meta.dirname), "prisma", "schema.prisma");
-const MIGRATIONS = join(dirname(import.meta.dirname), "prisma", "migrations");
+import { createTestDatabase } from "./test-db-create";
+import { databaseName, fail, resolveTestDatabaseUrl } from "./test-db-url";
 
-const url = resolve();
+const url = resolveTestDatabaseUrl();
 
 if (!url) {
 	fail([
@@ -25,7 +24,7 @@ if (!name.endsWith("_test")) {
 	]);
 }
 
-await create(url, name, process.argv.includes("--reset"));
+await createTestDatabase(url, name, process.argv.includes("--reset"));
 migrate(url);
 
 if (!process.env.TEST_DATABASE_URL) {
@@ -40,124 +39,6 @@ if (!process.env.TEST_DATABASE_URL) {
 	);
 }
 
-async function create(
-	target: string,
-	database: string,
-	forced: boolean,
-): Promise<void> {
-	const maintenance = new URL(target);
-	maintenance.pathname = "/postgres";
-	maintenance.search = "";
-
-	const client = new pg.Client({ connectionString: maintenance.toString() });
-
-	try {
-		await client.connect();
-	} catch (error) {
-		fail([
-			`Could not reach the server at ${new URL(target).host}.`,
-			"Is Postgres running?  docker compose up -d",
-			"",
-			error instanceof Error ? error.message : String(error),
-		]);
-	}
-
-	try {
-		const existing = await client.query(
-			"SELECT 1 FROM pg_database WHERE datname = $1",
-			[database],
-		);
-
-		if (existing.rowCount) {
-			const reason = forced
-				? "you asked for --reset"
-				: await stale(target, database);
-
-			if (!reason) {
-				console.log(`  ${database} already exists`);
-				return;
-			}
-
-			console.log(`  rebuilding ${database}: ${reason}`);
-			await drop(client, database);
-		}
-
-		await client.query(`CREATE DATABASE "${database}"`);
-		console.log(`  created ${database}`);
-	} finally {
-		await client.end();
-	}
-}
-
-async function drop(client: pg.Client, database: string): Promise<void> {
-	await client.query(
-		`SELECT pg_terminate_backend(pid) FROM pg_stat_activity
-		 WHERE datname = $1 AND pid <> pg_backend_pid()`,
-		[database],
-	);
-	await client.query(`DROP DATABASE IF EXISTS "${database}"`);
-}
-
-async function stale(target: string, database: string): Promise<string | null> {
-	const applied = await appliedMigrations(target);
-
-	if (applied === null) return null;
-
-	const onDisk = new Set(
-		existsSync(MIGRATIONS)
-			? readdirSync(MIGRATIONS, { withFileTypes: true })
-					.filter((entry) => entry.isDirectory())
-					.map((entry) => entry.name)
-			: [],
-	);
-
-	const foreign = applied.filter((migration) => !onDisk.has(migration));
-
-	if (foreign.length > 0) {
-		return `${database} holds ${foreign.length} migration(s) this branch does not have, starting with ${foreign[0]}`;
-	}
-
-	return drifted(target) ? `${database} no longer matches schema.prisma` : null;
-}
-
-async function appliedMigrations(target: string): Promise<string[] | null> {
-	const client = new pg.Client({ connectionString: target });
-
-	try {
-		await client.connect();
-	} catch {
-		return null;
-	}
-
-	try {
-		const rows = await client.query<{ migration_name: string }>(
-			`SELECT migration_name FROM _prisma_migrations WHERE finished_at IS NOT NULL`,
-		);
-		return rows.rows.map((row) => row.migration_name);
-	} catch {
-		return null;
-	} finally {
-		await client.end();
-	}
-}
-
-function drifted(target: string): boolean {
-	const result = spawnSync(
-		"prisma",
-		[
-			"migrate",
-			"diff",
-			"--from-config-datasource",
-			"--to-schema",
-			SCHEMA,
-			"--exit-code",
-		],
-		{ stdio: "ignore", env: { ...process.env, DATABASE_URL: target } },
-	);
-
-	return result.status === 2;
-}
-
 function migrate(target: string): void {
 	const result = spawnSync("prisma", ["migrate", "deploy"], {
 		stdio: "inherit",
@@ -177,36 +58,3 @@ function migrate(target: string): void {
 
 	if (result.status !== 0) process.exit(result.status ?? 1);
 }
-
-function resolve(): string | null {
-	const explicit = process.env.TEST_DATABASE_URL;
-	if (explicit) return explicit;
-
-	const live = process.env.DATABASE_URL;
-	if (!live) return null;
-
-	try {
-		const parsed = new URL(live);
-		const database = parsed.pathname.replace(/^\//, "");
-		if (!database) return null;
-
-		parsed.pathname = `/${database.endsWith("_test") ? database : `${database}_test`}`;
-
-		return parsed.toString();
-	} catch {
-		return null;
-	}
-}
-
-function databaseName(value: string): string {
-	try {
-		return new URL(value).pathname.replace(/^\//, "");
-	} catch {
-		return value;
-	}
-}
-
-function fail(lines: string[]): never {
-	console.error(["", ...lines.map((line) => `  ${line}`), ""].join("\n"));
-	process.exit(1);
-}
diff --git a/packages/db/src/fields.ts b/packages/db/src/fields.ts
index 4c34ad0b8..b20c0284f 100644
--- a/packages/db/src/fields.ts
+++ b/packages/db/src/fields.ts
@@ -291,7 +291,11 @@ export async function writeValues(
 			where: {
 				[`fieldId_${column}`]: { fieldId: definition.id, [column]: recordId },
 			},
-			create: { fieldId: definition.id, [column]: recordId, ...data },
+			create: {
+				fieldId: definition.id,
+				[column]: recordId,
+				...data,
+			},
 			update: data,
 		});
 	}
diff --git a/packages/db/src/idempotency.ts b/packages/db/src/idempotency.ts
index 4c7ac99ca..0e9fe1f74 100644
--- a/packages/db/src/idempotency.ts
+++ b/packages/db/src/idempotency.ts
@@ -1,7 +1,14 @@
 import type { Prisma } from "./generated/prisma/client";
 
+type IdempotencyTransaction = {
+	$queryRaw<T>(
+		query: TemplateStringsArray | Prisma.Sql,
+		...values: unknown[]
+	): Promise<T>;
+};
+
 export async function lockIdempotencyKey(
-	tx: Prisma.TransactionClient,
+	tx: IdempotencyTransaction,
 	key: string,
 ): Promise<void> {
 	await tx.$queryRaw<Array<{ locked: boolean }>>`
diff --git a/apps/agent/test/pool.spec.ts b/packages/db/src/pool.test.ts
similarity index 97%
rename from apps/agent/test/pool.spec.ts
rename to packages/db/src/pool.test.ts
index 534070e56..8bb5cae2c 100644
--- a/apps/agent/test/pool.spec.ts
+++ b/packages/db/src/pool.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "bun:test";
-import { collapsing, runLimited } from "../agent/lib/pool";
+import { collapsing, runLimited } from "./pool";
 
 describe("runLimited", () => {
 	it("runs every item", async () => {
diff --git a/apps/agent/agent/lib/pool.ts b/packages/db/src/pool.ts
similarity index 100%
rename from apps/agent/agent/lib/pool.ts
rename to packages/db/src/pool.ts
diff --git a/packages/db/src/row-level-security.test.ts b/packages/db/src/row-level-security.test.ts
new file mode 100644
index 000000000..1d62710d8
--- /dev/null
+++ b/packages/db/src/row-level-security.test.ts
@@ -0,0 +1,125 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "./client";
+import type { Prisma } from "./generated/prisma/client";
+
+const suffix = `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+const ORG_A = `test-rls-org-a-${suffix}`;
+const ORG_B = `test-rls-org-b-${suffix}`;
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: [
+			{ id: ORG_A, name: "RLS Org A", slug: ORG_A, createdAt: new Date() },
+			{ id: ORG_B, name: "RLS Org B", slug: ORG_B, createdAt: new Date() },
+		],
+	});
+});
+
+afterAll(async () => {
+	await db.company.deleteMany({
+		where: { organizationId: { in: [ORG_A, ORG_B] } },
+	});
+	await db.organization.deleteMany({ where: { id: { in: [ORG_A, ORG_B] } } });
+});
+
+function asTenant<T>(
+	organizationId: string | null,
+	work: (tx: Prisma.TransactionClient) => Promise<T>,
+): Promise<T> {
+	return db.$transaction(async (tx) => {
+		if (organizationId !== null) {
+			await tx.$executeRaw`
+				SELECT set_config('app.current_organization_id', ${organizationId}, true)
+			`;
+		}
+		return work(tx);
+	});
+}
+
+describe("Postgres row-level security", () => {
+	it("uses a non-bypass application database role", async () => {
+		const [role] = await db.$queryRaw<
+			{ bypassRls: boolean; superuser: boolean }[]
+		>`
+			SELECT rolbypassrls AS "bypassRls", rolsuper AS superuser
+			FROM pg_roles
+			WHERE rolname = current_user
+		`;
+
+		expect(role).toEqual({ bypassRls: false, superuser: false });
+	});
+
+	it("hides another organization's row from a raw select", async () => {
+		const inA = await asTenant(ORG_A, (tx) =>
+			tx.company.create({ data: { name: "Visible to A" } }),
+		);
+
+		const seenFromB = await asTenant(
+			ORG_B,
+			(tx) =>
+				tx.$queryRaw<{ id: string }[]>`
+					SELECT id FROM "company" WHERE id = ${inA.id}
+				`,
+		);
+
+		expect(seenFromB).toHaveLength(0);
+	});
+
+	it("refuses an insert for another organization", async () => {
+		await expect(
+			asTenant(
+				ORG_A,
+				(tx) =>
+					tx.$executeRaw`
+						INSERT INTO "company" (id, "organizationId", name, "createdAt", "updatedAt")
+						VALUES (${`${ORG_B}-sneak`}, ${ORG_B}, 'Sneak', now(), now())
+					`,
+			),
+		).rejects.toThrow();
+	});
+
+	it("forces policies for the table owner", async () => {
+		const [company] = await db.$queryRaw<
+			{ currentUser: string; forceRowSecurity: boolean; tableOwner: string }[]
+		>`
+			SELECT
+				current_user AS "currentUser",
+				pg_get_userbyid(c.relowner) AS "tableOwner",
+				c.relforcerowsecurity AS "forceRowSecurity"
+			FROM pg_class c
+			JOIN pg_namespace n ON n.oid = c.relnamespace
+			WHERE n.nspname = current_schema() AND c.relname = 'company'
+		`;
+
+		expect(company?.currentUser).toBe(company?.tableOwner);
+		expect(company?.forceRowSecurity).toBe(true);
+
+		const rows = await asTenant(
+			ORG_A,
+			(tx) =>
+				tx.$queryRaw<{ organizationId: string }[]>`
+					SELECT "organizationId"
+					FROM "company"
+					WHERE "organizationId" = ${ORG_B}
+				`,
+		);
+
+		expect(rows).toHaveLength(0);
+	});
+
+	it("defaults organizationId from the transaction tenant", async () => {
+		const created = await asTenant(ORG_A, (tx) =>
+			tx.company.create({ data: { name: "Defaulted" } }),
+		);
+
+		expect(created.organizationId).toBe(ORG_A);
+	});
+
+	it("fails closed without a tenant transaction", async () => {
+		await expect(
+			asTenant(null, (tx) =>
+				tx.company.create({ data: { name: "No tenant context" } }),
+			),
+		).rejects.toThrow();
+	});
+});
diff --git a/packages/db/src/settings.test.ts b/packages/db/src/settings.test.ts
new file mode 100644
index 000000000..6b519fd7d
--- /dev/null
+++ b/packages/db/src/settings.test.ts
@@ -0,0 +1,107 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "./client";
+import { DEFAULT_REPORTING_CURRENCY } from "./currency";
+import type { Prisma } from "./generated/prisma/client";
+import {
+	DEFAULT_AGENT_MODEL,
+	readAgentModel,
+	readContextDevKey,
+	readRatesRefreshedAt,
+	readReportingCurrency,
+	writeAgentModel,
+	writeContextDevKey,
+	writeRatesRefreshedAt,
+	writeReportingCurrency,
+} from "./settings";
+import { runInTenant, TenantContextError } from "./tenant-context";
+import { scopedTransaction } from "./tenant-scope";
+
+const testPrefix = `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+const ORG_A = `settingsfn-org-a-${testPrefix}`;
+const ORG_B = `settingsfn-org-b-${testPrefix}`;
+
+const inTenant = <T>(
+	organizationId: string,
+	work: (tx: Prisma.TransactionClient) => Promise<T>,
+) => runInTenant(organizationId, () => scopedTransaction(work));
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: [
+			{
+				id: ORG_A,
+				name: `Org A ${testPrefix}`,
+				slug: `settingsfn-org-a-${testPrefix}`,
+				createdAt: new Date(),
+			},
+			{
+				id: ORG_B,
+				name: `Org B ${testPrefix}`,
+				slug: `settingsfn-org-b-${testPrefix}`,
+				createdAt: new Date(),
+			},
+		],
+		skipDuplicates: true,
+	});
+});
+
+afterAll(async () => {
+	for (const organizationId of [ORG_A, ORG_B]) {
+		await inTenant(organizationId, (tx) => tx.appSetting.deleteMany());
+	}
+	await db.organization.deleteMany({ where: { id: { in: [ORG_A, ORG_B] } } });
+});
+
+describe("settings readers/writers outside any tenant context", () => {
+	it("throw TenantContextError rather than reading anyone's row", async () => {
+		await expect(readAgentModel(db)).rejects.toThrow(TenantContextError);
+		await expect(readContextDevKey(db)).rejects.toThrow(TenantContextError);
+		await expect(readReportingCurrency(db)).rejects.toThrow(TenantContextError);
+		await expect(readRatesRefreshedAt(db)).rejects.toThrow(TenantContextError);
+	});
+});
+
+describe("settings readers/writers inside tenant context", () => {
+	it("keeps the agent model choice isolated per organization", async () => {
+		await inTenant(ORG_A, (tx) =>
+			writeAgentModel(tx, {
+				id: "openai/gpt-5.5",
+				contextWindowTokens: 1,
+			}),
+		);
+
+		const inA = await inTenant(ORG_A, (tx) => readAgentModel(tx));
+		const inB = await inTenant(ORG_B, (tx) => readAgentModel(tx));
+
+		expect(inA.id).toBe("openai/gpt-5.5");
+		expect(inA.isDefault).toBe(false);
+		expect(inB.isDefault).toBe(true);
+		expect(inB.id).toBe(DEFAULT_AGENT_MODEL.id);
+	});
+
+	it("keeps the Context.dev key isolated per organization", async () => {
+		await inTenant(ORG_A, (tx) => writeContextDevKey(tx, "key-a"));
+
+		expect(await inTenant(ORG_A, (tx) => readContextDevKey(tx))).toBe("key-a");
+		expect(await inTenant(ORG_B, (tx) => readContextDevKey(tx))).toBeNull();
+	});
+
+	it("keeps the reporting currency isolated per organization", async () => {
+		await inTenant(ORG_A, (tx) => writeReportingCurrency(tx, "EUR"));
+
+		expect(await inTenant(ORG_A, (tx) => readReportingCurrency(tx))).toBe(
+			"EUR",
+		);
+		expect(await inTenant(ORG_B, (tx) => readReportingCurrency(tx))).toBe(
+			DEFAULT_REPORTING_CURRENCY,
+		);
+	});
+
+	it("keeps the rates-refreshed timestamp isolated per organization", async () => {
+		const at = new Date("2026-08-01T00:00:00.000Z");
+		await inTenant(ORG_A, (tx) => writeRatesRefreshedAt(tx, at));
+
+		expect(await inTenant(ORG_A, (tx) => readRatesRefreshedAt(tx))).toEqual(at);
+		expect(await inTenant(ORG_B, (tx) => readRatesRefreshedAt(tx))).toBeNull();
+	});
+});
diff --git a/packages/db/src/settings.ts b/packages/db/src/settings.ts
index 2959bf05b..001235a32 100644
--- a/packages/db/src/settings.ts
+++ b/packages/db/src/settings.ts
@@ -4,23 +4,49 @@ import {
 	isCurrencyCode,
 	normalizeCurrency,
 } from "./currency";
+import type { Prisma } from "./generated/prisma/client";
+import { currentOrganizationId } from "./tenant-context";
 
-export const SETTINGS_ID = "app";
+type SettingsDb = Pick<Db, "appSetting">;
 
 export const DEFAULT_AGENT_MODEL = {
 	id: "zai/glm-5.2-fast",
 	contextWindowTokens: 1_000_000,
 } as const;
 
+export function defaultAgentModelResult() {
+	return {
+		model: DEFAULT_AGENT_MODEL.id,
+		modelContextWindowTokens: DEFAULT_AGENT_MODEL.contextWindowTokens,
+	};
+}
+
 export interface AgentModelSetting {
 	id: string;
 	contextWindowTokens: number;
 	isDefault: boolean;
 }
 
-export async function readAgentModel(db: Db): Promise<AgentModelSetting> {
+type AgentModelReader = {
+	appSetting: {
+		findUnique(args: {
+			where: { organizationId: string };
+			select: {
+				agentModelId: true;
+				agentModelContextWindow: true;
+			};
+		}): PromiseLike<{
+			agentModelId: string | null;
+			agentModelContextWindow: number | null;
+		} | null>;
+	};
+};
+
+export async function readAgentModel(
+	db: AgentModelReader,
+): Promise<AgentModelSetting> {
 	const row = await db.appSetting.findUnique({
-		where: { id: SETTINGS_ID },
+		where: { organizationId: currentOrganizationId() },
 		select: { agentModelId: true, agentModelContextWindow: true },
 	});
 
@@ -37,18 +63,12 @@ export async function readAgentModel(db: Db): Promise<AgentModelSetting> {
 }
 
 export async function writeAgentModel(
-	db: Db,
+	db: SettingsDb,
 	model: { id: string; contextWindowTokens: number } | null,
 ): Promise<void> {
-	const fields = {
+	await writeAppSetting(db, {
 		agentModelId: model?.id ?? null,
 		agentModelContextWindow: model?.contextWindowTokens ?? null,
-	};
-
-	await db.appSetting.upsert({
-		where: { id: SETTINGS_ID },
-		create: { id: SETTINGS_ID, ...fields },
-		update: fields,
 	});
 }
 
@@ -56,28 +76,27 @@ export const CONTEXT_DEV_SIGNUP_URL = "https://link.context.dev/crm";
 
 export const CONTEXT_DEV_DISCOUNT_CODE = "CRM";
 
-export async function readContextDevKey(db: Db): Promise<string | null> {
+export async function readContextDevKey(
+	db: SettingsDb,
+): Promise<string | null> {
 	const row = await db.appSetting.findUnique({
-		where: { id: SETTINGS_ID },
+		where: { organizationId: currentOrganizationId() },
 		select: { contextDevApiKey: true },
 	});
 
 	return row?.contextDevApiKey?.trim() || null;
 }
 
-export async function writeContextDevKey(db: Db, key: string): Promise<void> {
-	const contextDevApiKey = key.trim();
-
-	await db.appSetting.upsert({
-		where: { id: SETTINGS_ID },
-		create: { id: SETTINGS_ID, contextDevApiKey },
-		update: { contextDevApiKey },
-	});
+export async function writeContextDevKey(
+	db: SettingsDb,
+	key: string,
+): Promise<void> {
+	await writeAppSetting(db, { contextDevApiKey: key.trim() });
 }
 
-export async function readReportingCurrency(db: Db): Promise<string> {
+export async function readReportingCurrency(db: SettingsDb): Promise<string> {
 	const row = await db.appSetting.findUnique({
-		where: { id: SETTINGS_ID },
+		where: { organizationId: currentOrganizationId() },
 		select: { reportingCurrency: true },
 	});
 
@@ -87,23 +106,21 @@ export async function readReportingCurrency(db: Db): Promise<string> {
 }
 
 export async function writeReportingCurrency(
-	db: Db,
+	db: SettingsDb,
 	code: string,
 ): Promise<string> {
 	const reportingCurrency = normalizeCurrency(code);
 
-	await db.appSetting.upsert({
-		where: { id: SETTINGS_ID },
-		create: { id: SETTINGS_ID, reportingCurrency },
-		update: { reportingCurrency },
-	});
+	await writeAppSetting(db, { reportingCurrency });
 
 	return reportingCurrency;
 }
 
-export async function readRatesRefreshedAt(db: Db): Promise<Date | null> {
+export async function readRatesRefreshedAt(
+	db: SettingsDb,
+): Promise<Date | null> {
 	const row = await db.appSetting.findUnique({
-		where: { id: SETTINGS_ID },
+		where: { organizationId: currentOrganizationId() },
 		select: { ratesRefreshedAt: true },
 	});
 
@@ -111,14 +128,10 @@ export async function readRatesRefreshedAt(db: Db): Promise<Date | null> {
 }
 
 export async function writeRatesRefreshedAt(
-	db: Db,
+	db: SettingsDb,
 	ratesRefreshedAt: Date,
 ): Promise<void> {
-	await db.appSetting.upsert({
-		where: { id: SETTINGS_ID },
-		create: { id: SETTINGS_ID, ratesRefreshedAt },
-		update: { ratesRefreshedAt },
-	});
+	await writeAppSetting(db, { ratesRefreshedAt });
 }
 
 export const DEFAULT_ARCHIVE_RETENTION_DAYS = 180;
@@ -127,9 +140,12 @@ export const MIN_ARCHIVE_RETENTION_DAYS = 1;
 
 export const MAX_ARCHIVE_RETENTION_DAYS = 3650;
 
-export async function readArchiveRetentionDays(db: Db): Promise<number> {
+export async function readArchiveRetentionDays(
+	db: SettingsDb,
+): Promise<number> {
+	const organizationId = currentOrganizationId();
 	const row = await db.appSetting.findUnique({
-		where: { id: SETTINGS_ID },
+		where: { organizationId },
 		select: { archiveRetentionDays: true },
 	});
 
@@ -137,7 +153,7 @@ export async function readArchiveRetentionDays(db: Db): Promise<number> {
 }
 
 export async function writeArchiveRetentionDays(
-	db: Db,
+	db: SettingsDb,
 	days: number,
 ): Promise<number> {
 	const archiveRetentionDays = Math.min(
@@ -145,11 +161,7 @@ export async function writeArchiveRetentionDays(
 		MAX_ARCHIVE_RETENTION_DAYS,
 	);
 
-	await db.appSetting.upsert({
-		where: { id: SETTINGS_ID },
-		create: { id: SETTINGS_ID, archiveRetentionDays },
-		update: { archiveRetentionDays },
-	});
+	await writeAppSetting(db, { archiveRetentionDays });
 
 	return archiveRetentionDays;
 }
@@ -158,3 +170,21 @@ export function maskKey(key: string): string {
 	const trimmed = key.trim();
 	return trimmed.length > 4 ? `••••${trimmed.slice(-4)}` : "••••";
 }
+
+type AppSettingFields = Omit<
+	Prisma.AppSettingUncheckedCreateInput,
+	"organizationId"
+>;
+
+async function writeAppSetting(
+	db: SettingsDb,
+	fields: AppSettingFields,
+): Promise<void> {
+	const organizationId = currentOrganizationId();
+
+	await db.appSetting.upsert({
+		where: { organizationId },
+		create: fields,
+		update: fields,
+	});
+}
diff --git a/packages/db/src/slack-inventory.test.ts b/packages/db/src/slack-inventory.test.ts
new file mode 100644
index 000000000..f4cf053a6
--- /dev/null
+++ b/packages/db/src/slack-inventory.test.ts
@@ -0,0 +1,61 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "./client";
+import { queueSlackInventorySync, SLACK_INVENTORY } from "./slack-inventory";
+import { runInTenant } from "./tenant-context";
+import { scopedTransaction } from "./tenant-scope";
+
+const suffix = `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+const organizationId = `slack-inventory-${suffix}`;
+
+beforeAll(async () => {
+	await db.organization.create({
+		data: {
+			id: organizationId,
+			name: `Slack inventory ${suffix}`,
+			slug: organizationId,
+			createdAt: new Date(),
+		},
+	});
+});
+
+afterAll(async () => {
+	await runInTenant(organizationId, () =>
+		scopedTransaction((tx) =>
+			tx.agentTask.deleteMany({ where: { organizationId } }),
+		),
+	);
+	await db.organization.delete({ where: { id: organizationId } });
+});
+
+describe("Slack inventory queue", () => {
+	it("enters the organization tenant before creating work", async () => {
+		const reason = `Refresh Slack inventory ${suffix}`;
+
+		await queueSlackInventorySync(reason, organizationId);
+
+		const task = await runInTenant(organizationId, () =>
+			scopedTransaction((tx) =>
+				tx.agentTask.findFirst({
+					where: { organizationId, kind: SLACK_INVENTORY.kind },
+				}),
+			),
+		);
+
+		expect(task?.organizationId).toBe(organizationId);
+		expect(task?.reason).toBe(reason);
+	});
+
+	it("keeps one recent task for the organization", async () => {
+		await queueSlackInventorySync(`Duplicate ${suffix}`, organizationId);
+
+		const count = await runInTenant(organizationId, () =>
+			scopedTransaction((tx) =>
+				tx.agentTask.count({
+					where: { organizationId, kind: SLACK_INVENTORY.kind },
+				}),
+			),
+		);
+
+		expect(count).toBe(1);
+	});
+});
diff --git a/packages/db/src/slack-inventory.ts b/packages/db/src/slack-inventory.ts
index ae4aaa0cb..29891a119 100644
--- a/packages/db/src/slack-inventory.ts
+++ b/packages/db/src/slack-inventory.ts
@@ -1,6 +1,8 @@
 import { PRIORITY } from "./agent-tasks";
-import { db } from "./client";
 import { lockIdempotencyKey } from "./idempotency";
+import { runInTenant } from "./tenant-context";
+import { scopedTransaction } from "./tenant-scope";
+import { organizationIds } from "./tenants";
 
 const MINUTE_MS = 60_000;
 
@@ -12,33 +14,44 @@ export const SLACK_INVENTORY = {
 	throttleMs: 15 * MINUTE_MS,
 } as const;
 
-export async function queueSlackInventorySync(reason: string): Promise<void> {
+export async function queueSlackInventorySync(
+	reason: string,
+	organizationId?: string,
+): Promise<void> {
 	const since = new Date(Date.now() - SLACK_INVENTORY.throttleMs);
+	const organizations = organizationId
+		? [organizationId]
+		: await organizationIds();
 
-	try {
-		await db.$transaction(async (tx) => {
-			await lockIdempotencyKey(tx, SLACK_INVENTORY.lock);
+	for (const organizationId of organizations) {
+		try {
+			await runInTenant(organizationId, () =>
+				scopedTransaction(async (tx) => {
+					await lockIdempotencyKey(
+						tx,
+						`${SLACK_INVENTORY.lock}:${organizationId}`,
+					);
 
-			const recent = await tx.agentTask.findFirst({
-				where: {
-					kind: SLACK_INVENTORY.kind,
-					OR: [{ finishedAt: null }, { createdAt: { gt: since } }],
-				},
-				select: { id: true },
-			});
-			if (recent) return;
+					const recent = await tx.agentTask.findFirst({
+						where: {
+							kind: SLACK_INVENTORY.kind,
+							OR: [{ finishedAt: null }, { createdAt: { gt: since } }],
+						},
+						select: { id: true },
+					});
+					if (recent) return;
 
-			await tx.agentTask.create({
-				data: {
-					kind: SLACK_INVENTORY.kind,
-					reason,
-					priority: SLACK_INVENTORY.priority,
-					budget: SLACK_INVENTORY.budget,
-					dueAt: new Date(),
-				},
-			});
-		});
-	} catch {
-		return;
+					await tx.agentTask.create({
+						data: {
+							kind: SLACK_INVENTORY.kind,
+							reason,
+							priority: SLACK_INVENTORY.priority,
+							budget: SLACK_INVENTORY.budget,
+							dueAt: new Date(),
+						},
+					});
+				}),
+			);
+		} catch {}
 	}
 }
diff --git a/packages/db/src/sso-provider-tenant-scope.test.ts b/packages/db/src/sso-provider-tenant-scope.test.ts
new file mode 100644
index 000000000..3432f5bb7
--- /dev/null
+++ b/packages/db/src/sso-provider-tenant-scope.test.ts
@@ -0,0 +1,89 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "./client";
+import { Prisma } from "./generated/prisma/client";
+import { runInTenant, TenantContextError } from "./tenant-context";
+import { scopedDb, scopedTransaction } from "./tenant-scope";
+
+const suffix = `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+const ORG_A = `sso-scope-org-a-${suffix}`;
+const ORG_B = `sso-scope-org-b-${suffix}`;
+const PROVIDER_A = `sso-scope-provider-a-${suffix}`;
+const PROVIDER_B = `sso-scope-provider-b-${suffix}`;
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: [
+			{
+				id: ORG_A,
+				name: `SSO Scope A ${suffix}`,
+				slug: ORG_A,
+				createdAt: new Date(),
+			},
+			{
+				id: ORG_B,
+				name: `SSO Scope B ${suffix}`,
+				slug: ORG_B,
+				createdAt: new Date(),
+			},
+		],
+	});
+});
+
+afterAll(async () => {
+	for (const organizationId of [ORG_A, ORG_B]) {
+		await runInTenant(organizationId, () =>
+			scopedTransaction((tx) => tx.ssoProvider.deleteMany()),
+		);
+	}
+	await db.organization.deleteMany({
+		where: { id: { in: [ORG_A, ORG_B] } },
+	});
+});
+
+describe("SsoProvider tenant scoping", () => {
+	it("requires organizationId at the database level", async () => {
+		await expect(
+			Promise.resolve(
+				db.$executeRaw(
+					Prisma.sql`INSERT INTO "ssoProvider" ("id", "issuer", "providerId", "domain") VALUES (${`sso-scope-no-org-${suffix}`}, ${"https://issuer.example.com"}, ${`sso-scope-no-org-${suffix}`}, ${"example.com"})`,
+				),
+			),
+		).rejects.toThrow();
+	});
+
+	it("throws outside tenant context", async () => {
+		await expect(
+			Promise.resolve(scopedDb.ssoProvider.findMany()),
+		).rejects.toThrow(TenantContextError);
+	});
+
+	it("defaults and isolates providers", async () => {
+		await runInTenant(ORG_A, () =>
+			scopedDb.ssoProvider.create({
+				data: {
+					id: `sso-scope-row-a-${suffix}`,
+					providerId: PROVIDER_A,
+					issuer: "https://issuer-a.example.com",
+					domain: "a.example.com",
+				},
+			}),
+		);
+		await runInTenant(ORG_B, () =>
+			scopedDb.ssoProvider.create({
+				data: {
+					id: `sso-scope-row-b-${suffix}`,
+					providerId: PROVIDER_B,
+					issuer: "https://issuer-b.example.com",
+					domain: "b.example.com",
+				},
+			}),
+		);
+
+		const seenFromA = await runInTenant(ORG_A, () =>
+			scopedDb.ssoProvider.findMany({ orderBy: { providerId: "asc" } }),
+		);
+
+		expect(seenFromA.map((row) => row.providerId)).toEqual([PROVIDER_A]);
+		expect(seenFromA[0]?.organizationId).toBe(ORG_A);
+	});
+});
diff --git a/packages/db/src/tenant-context.test.ts b/packages/db/src/tenant-context.test.ts
new file mode 100644
index 000000000..a2cacc8ae
--- /dev/null
+++ b/packages/db/src/tenant-context.test.ts
@@ -0,0 +1,92 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import {
+	currentOrganizationId,
+	runInTenant,
+	TenantContextError,
+	tryCurrentOrganizationId,
+} from "./tenant-context";
+
+describe("tenant context", () => {
+	afterEach(() => {
+		expect.hasAssertions();
+	});
+
+	it("has no context outside runInTenant", () => {
+		expect(tryCurrentOrganizationId()).toBeUndefined();
+	});
+
+	it("throws TenantContextError when currentOrganizationId is used outside context", () => {
+		expect(() => {
+			currentOrganizationId();
+		}).toThrow(TenantContextError);
+	});
+
+	it("makes the organization ID available inside runInTenant", () => {
+		const organizationId = runInTenant("org-1", () => {
+			return currentOrganizationId();
+		});
+
+		expect(organizationId).toBe("org-1");
+	});
+
+	it("returns the callback result from runInTenant", () => {
+		const result = runInTenant("org-2", () => {
+			return {
+				ok: true,
+				organizationId: currentOrganizationId(),
+			};
+		});
+
+		expect(result).toEqual({
+			ok: true,
+			organizationId: "org-2",
+		});
+	});
+
+	it("does not leak context between sibling runs", async () => {
+		const [a, b] = await Promise.all([
+			runInTenant("org-1", async () => {
+				await Promise.resolve();
+				return currentOrganizationId();
+			}),
+			runInTenant("org-2", async () => {
+				await Promise.resolve();
+				return currentOrganizationId();
+			}),
+		]);
+
+		expect(a).toBe("org-1");
+		expect(b).toBe("org-2");
+		expect(tryCurrentOrganizationId()).toBeUndefined();
+		expect(() => {
+			currentOrganizationId();
+		}).toThrow(TenantContextError);
+	});
+
+	it("restores outer context when nested runInTenant calls", () => {
+		const result = runInTenant("outer", () => {
+			expect(currentOrganizationId()).toBe("outer");
+
+			const inner = runInTenant("inner", () => {
+				expect(currentOrganizationId()).toBe("inner");
+				return currentOrganizationId();
+			});
+
+			expect(currentOrganizationId()).toBe("outer");
+			expect(inner).toBe("inner");
+
+			return currentOrganizationId();
+		});
+
+		expect(result).toBe("outer");
+	});
+
+	it("propagates context across Promise boundaries", async () => {
+		const result = await runInTenant("org-async", async () => {
+			await Promise.resolve("step");
+			return currentOrganizationId();
+		});
+
+		expect(result).toBe("org-async");
+	});
+});
diff --git a/packages/db/src/tenant-context.ts b/packages/db/src/tenant-context.ts
new file mode 100644
index 000000000..194bbc0da
--- /dev/null
+++ b/packages/db/src/tenant-context.ts
@@ -0,0 +1,53 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+
+export class TenantContextError extends Error {
+	constructor() {
+		super(
+			"No active tenant context. Every call into scopedDb must run inside runInTenant(organizationId, fn).",
+		);
+		this.name = "TenantContextError";
+	}
+}
+
+interface TenantStore {
+	organizationId: string;
+}
+
+const storage = new AsyncLocalStorage<TenantStore>();
+
+export function runInTenant<T>(
+	organizationId: string,
+	fn: () => PromiseLike<T>,
+): Promise<T>;
+export function runInTenant<T>(organizationId: string, fn: () => T): T;
+export function runInTenant<T>(
+	organizationId: string,
+	fn: () => T | PromiseLike<T>,
+): T | Promise<T> {
+	return storage.run({ organizationId }, () => {
+		const result = fn();
+		return isPromiseLike(result) ? Promise.resolve(result) : result;
+	});
+}
+
+export function tryCurrentOrganizationId(): string | undefined {
+	return storage.getStore()?.organizationId;
+}
+
+export function currentOrganizationId(): string {
+	const organizationId = tryCurrentOrganizationId();
+
+	if (!organizationId) {
+		throw new TenantContextError();
+	}
+
+	return organizationId;
+}
+
+function isPromiseLike<T>(value: T | PromiseLike<T>): value is PromiseLike<T> {
+	return (
+		value instanceof Object &&
+		"then" in value &&
+		(value as { then: unknown }).then instanceof Function
+	);
+}
diff --git a/packages/db/src/tenant-policy-foundation.test.ts b/packages/db/src/tenant-policy-foundation.test.ts
new file mode 100644
index 000000000..cc5079d38
--- /dev/null
+++ b/packages/db/src/tenant-policy-foundation.test.ts
@@ -0,0 +1,144 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "./client";
+import { Prisma } from "./generated/prisma/client";
+import { runInTenant } from "./tenant-context";
+import { scopedTransaction } from "./tenant-scope";
+
+const TABLES = [
+	"company",
+	"contact",
+	"deal",
+	"dealContact",
+	"activity",
+	"appointmentDetails",
+	"fieldDefinition",
+	"fieldOption",
+	"fieldValue",
+	"companyEnrichment",
+	"contactFact",
+	"contactBrief",
+	"agentTask",
+	"agentEvent",
+	"agentConversation",
+	"agentConversationFeedback",
+	"agentConversationShare",
+	"agentConversationSubmission",
+	"agentConversationAttachment",
+	"agentDefinition",
+	"agentVersion",
+	"agentBuilderArtifact",
+	"agentTrigger",
+	"agentRun",
+	"agentRunEvent",
+	"agentAction",
+	"agentAuditEvent",
+	"mailboxSync",
+	"emailThread",
+	"emailMessage",
+	"calendarEvent",
+	"calendarAttendee",
+	"appSetting",
+	"workspaceProfile",
+	"ssoProvider",
+	"slackInstallation",
+	"slackWorkspaceGrant",
+	"slackChannel",
+	"slackMemberMatch",
+	"trackedDomain",
+	"trackedVisitor",
+	"trackedEvent",
+	"trackedPageDaily",
+	"formSubmission",
+	"trackingCounter",
+	"suppressedDomain",
+	"suppressedContact",
+	"savedView",
+] as const;
+
+type PolicyState = {
+	tableName: string;
+	rowSecurity: boolean;
+	forceRowSecurity: boolean;
+	defaultExpression: string;
+	policyName: string;
+	policyCommand: string;
+	usingExpression: string;
+	checkExpression: string;
+};
+
+const suffix = `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+const organizationId = `tenant-policy-org-${suffix}`;
+
+beforeAll(async () => {
+	await db.organization.create({
+		data: {
+			id: organizationId,
+			name: `Tenant Policy ${suffix}`,
+			slug: organizationId,
+			createdAt: new Date(),
+		},
+	});
+});
+
+afterAll(async () => {
+	await runInTenant(organizationId, () =>
+		scopedTransaction((tx) => tx.company.deleteMany()),
+	);
+	await db.organization.deleteMany({ where: { id: organizationId } });
+});
+
+describe("tenant policy foundation", () => {
+	it("creates one active tenant policy and one tenant default on every scoped table", async () => {
+		const rows = await db.$queryRaw<PolicyState[]>(Prisma.sql`
+			SELECT
+				c.relname AS "tableName",
+				c.relrowsecurity AS "rowSecurity",
+				c.relforcerowsecurity AS "forceRowSecurity",
+				pg_get_expr(d.adbin, d.adrelid) AS "defaultExpression",
+				p.polname AS "policyName",
+				p.polcmd::text AS "policyCommand",
+				pg_get_expr(p.polqual, p.polrelid) AS "usingExpression",
+				pg_get_expr(p.polwithcheck, p.polrelid) AS "checkExpression"
+			FROM pg_class c
+			JOIN pg_namespace n ON n.oid = c.relnamespace
+			JOIN pg_attribute a ON a.attrelid = c.oid AND a.attname = 'organizationId'
+			JOIN pg_attrdef d ON d.adrelid = c.oid AND d.adnum = a.attnum
+			JOIN pg_policy p ON p.polrelid = c.oid
+			WHERE n.nspname = current_schema()
+				AND c.relname IN (${Prisma.join(TABLES)})
+			ORDER BY c.relname
+		`);
+
+		expect(rows.map((row) => row.tableName)).toEqual([...TABLES].sort());
+
+		for (const row of rows) {
+			expect(row.rowSecurity).toBe(true);
+			expect(row.forceRowSecurity).toBe(true);
+			expect(row.defaultExpression).toBe(
+				"current_setting('app.current_organization_id'::text, true)",
+			);
+			expect(row.policyName).toBe("tenant_isolation");
+			expect(row.policyCommand).toBe("*");
+			expect(row.usingExpression).toContain(
+				"current_setting('app.current_organization_id'::text, true)",
+			);
+			expect(row.checkExpression).toContain(
+				"current_setting('app.current_organization_id'::text, true)",
+			);
+		}
+	});
+
+	it("fills organizationId from the transaction-local tenant value", async () => {
+		const created = await db.$transaction(async (tx) => {
+			await tx.$executeRaw`
+				SELECT set_config('app.current_organization_id', ${organizationId}, true)
+			`;
+
+			return tx.company.create({
+				data: { name: `Defaulted Company ${suffix}` },
+			});
+		});
+
+		expect(created.organizationId).toBe(organizationId);
+	});
+});
diff --git a/packages/db/src/tenant-scope.test.ts b/packages/db/src/tenant-scope.test.ts
new file mode 100644
index 000000000..4a8fb8075
--- /dev/null
+++ b/packages/db/src/tenant-scope.test.ts
@@ -0,0 +1,493 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "./client";
+import { runInTenant, TenantContextError } from "./tenant-context";
+import { type ScopedDb, scopedDb, scopedTransaction } from "./tenant-scope";
+
+const testPrefix = `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+const ORG_A = `tenant-scope-org-a-${testPrefix}`;
+const ORG_B = `tenant-scope-org-b-${testPrefix}`;
+let userId: string;
+
+const makeName = (label: string) =>
+	`${testPrefix}-${label}-${Math.random().toString(16).slice(2)}`;
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: [
+			{
+				id: ORG_A,
+				name: `Org A ${testPrefix}`,
+				slug: `org-a-${testPrefix}`,
+				createdAt: new Date(),
+			},
+			{
+				id: ORG_B,
+				name: `Org B ${testPrefix}`,
+				slug: `org-b-${testPrefix}`,
+				createdAt: new Date(),
+			},
+		],
+		skipDuplicates: true,
+	});
+	const user = await db.user.create({
+		data: {
+			id: `tenant-scope-user-${testPrefix}`,
+			name: "Tenant Scope User",
+			email: `tenant-scope-${testPrefix}@example.com`,
+		},
+	});
+	userId = user.id;
+});
+
+afterAll(async () => {
+	for (const organizationId of [ORG_A, ORG_B]) {
+		await runInTenant(organizationId, () =>
+			scopedTransaction(async (tx) => {
+				await tx.agentConversation.deleteMany();
+				await tx.agentDefinition.deleteMany();
+				await tx.agentTask.deleteMany();
+				await tx.mailboxSync.deleteMany();
+				await tx.suppressedContact.deleteMany();
+				await tx.appSetting.deleteMany();
+				await tx.contact.deleteMany();
+				await tx.company.deleteMany();
+			}),
+		);
+	}
+	await db.user.delete({ where: { id: userId } });
+	await db.organization.deleteMany({
+		where: { id: { in: [ORG_A, ORG_B] } },
+	});
+});
+
+describe("tenant scoping", () => {
+	it("throws TenantContextError for read and create when no tenant context is active", async () => {
+		await expect(Promise.resolve(scopedDb.company.findMany())).rejects.toThrow(
+			TenantContextError,
+		);
+		await expect(
+			Promise.resolve(
+				scopedDb.company.create({
+					data: {
+						name: makeName("outside-create"),
+						organizationId: ORG_A,
+					},
+				}),
+			),
+		).rejects.toThrow(TenantContextError);
+	});
+
+	it("defaults organizationId on create", async () => {
+		const name = makeName("stamp");
+		const created = await runInTenant(ORG_A, () =>
+			scopedDb.company.create({ data: { name } }),
+		);
+
+		expect(created.organizationId).toBe(ORG_A);
+	});
+
+	it("rejects a supplied organizationId from another tenant", async () => {
+		const name = makeName("overwrite");
+
+		await expect(
+			runInTenant(ORG_A, () =>
+				scopedDb.company.create({
+					data: { name, organizationId: ORG_B },
+				}),
+			),
+		).rejects.toThrow();
+	});
+
+	it("keeps organizationId during update and upsert", async () => {
+		const company = await runInTenant(ORG_A, () =>
+			scopedDb.company.create({ data: { name: makeName("update-source") } }),
+		);
+		const updatedName = makeName("update-result");
+		const upsertedName = makeName("upsert-result");
+
+		const updated = await runInTenant(ORG_A, () =>
+			scopedDb.company.update({
+				where: { id: company.id },
+				data: { name: updatedName },
+			}),
+		);
+		const upserted = await runInTenant(ORG_A, () =>
+			scopedDb.company.upsert({
+				where: { id: company.id },
+				create: {
+					name: makeName("upsert-create"),
+				},
+				update: { name: upsertedName },
+			}),
+		);
+
+		expect(updated.organizationId).toBe(ORG_A);
+		expect(updated.name).toBe(updatedName);
+		expect(upserted.organizationId).toBe(ORG_A);
+		expect(upserted.name).toBe(upsertedName);
+	});
+
+	it("findMany returns only active tenant rows", async () => {
+		const aName = makeName("findmany-a");
+		const bName = makeName("findmany-b");
+
+		await runInTenant(ORG_A, () =>
+			scopedDb.company.create({ data: { name: aName } }),
+		);
+		await runInTenant(ORG_B, () =>
+			scopedDb.company.create({ data: { name: bName } }),
+		);
+
+		const scopedRows = await runInTenant(ORG_A, () =>
+			scopedDb.company.findMany({
+				where: {
+					name: {
+						in: [aName, bName],
+					},
+				},
+			}),
+		);
+
+		expect(scopedRows).toHaveLength(1);
+		expect(scopedRows[0]?.name).toBe(aName);
+		expect(scopedRows[0]?.organizationId).toBe(ORG_A);
+	});
+
+	it("findUnique cannot access another tenant row", async () => {
+		const bName = makeName("findunique-b");
+		const bCompany = await runInTenant(ORG_B, () =>
+			scopedDb.company.create({ data: { name: bName } }),
+		);
+
+		const tenantRow = await runInTenant(ORG_A, () =>
+			scopedDb.company.findUnique({
+				where: { id: bCompany.id },
+			}),
+		);
+
+		expect(tenantRow).toBeNull();
+	});
+
+	it("isolates count by tenant", async () => {
+		const sharedName = makeName("count");
+
+		const createdA = await runInTenant(ORG_A, () =>
+			scopedDb.company.create({ data: { name: `${sharedName}-a` } }),
+		);
+		const createdB = await runInTenant(ORG_B, () =>
+			scopedDb.company.create({ data: { name: `${sharedName}-b` } }),
+		);
+
+		const aCount = await runInTenant(ORG_A, () =>
+			scopedDb.company.count({
+				where: { name: { in: [createdA.name, createdB.name] } },
+			}),
+		);
+		const bCount = await runInTenant(ORG_B, () =>
+			scopedDb.company.count({
+				where: { name: { in: [createdA.name, createdB.name] } },
+			}),
+		);
+
+		expect(aCount).toBe(1);
+		expect(bCount).toBe(1);
+	});
+
+	it("rejects update and delete for rows outside the active tenant and keeps source rows unchanged", async () => {
+		const targetName = makeName("cross");
+		const victim = await runInTenant(ORG_B, () =>
+			scopedDb.company.create({ data: { name: targetName } }),
+		);
+
+		await expect(
+			Promise.resolve(
+				runInTenant(ORG_A, () =>
+					scopedDb.company.update({
+						where: { id: victim.id },
+						data: { name: makeName("updated") },
+					}),
+				),
+			),
+		).rejects.toThrow();
+
+		await expect(
+			Promise.resolve(
+				runInTenant(ORG_A, () =>
+					scopedDb.company.delete({ where: { id: victim.id } }),
+				),
+			),
+		).rejects.toThrow();
+
+		const unchanged = await runInTenant(ORG_B, () =>
+			scopedDb.company.findUnique({ where: { id: victim.id } }),
+		);
+
+		expect(unchanged?.organizationId).toBe(ORG_B);
+		expect(unchanged?.name).toBe(targetName);
+	});
+
+	it("defaults every row in createMany", async () => {
+		const base = makeName("createMany");
+		const names = [`${base}-a`, `${base}-b`];
+
+		await runInTenant(ORG_A, () =>
+			scopedDb.company.createMany({
+				data: names.map((name) => ({ name })),
+			}),
+		);
+
+		const rows = await runInTenant(ORG_A, () =>
+			scopedDb.company.findMany({ where: { name: { in: names } } }),
+		);
+
+		expect(rows).toHaveLength(2);
+		expect(rows.every((row) => row.organizationId === ORG_A)).toBe(true);
+	});
+
+	it("reads organization without tenant context", async () => {
+		const orgA = await scopedDb.organization.findUnique({
+			where: { id: ORG_A },
+		});
+		const orgB = await scopedDb.organization.findUnique({
+			where: { id: ORG_B },
+		});
+
+		expect(orgA?.id).toBe(ORG_A);
+		expect(orgB?.id).toBe(ORG_B);
+	});
+
+	it("lets organizations reuse contact emails and company domains", async () => {
+		const email = `shared-${testPrefix}@example.com`;
+		const domain = `${testPrefix}.example.com`;
+		const [contactA, contactB, companyA, companyB] = await Promise.all([
+			runInTenant(ORG_A, () =>
+				scopedDb.contact.create({ data: { firstName: "A", email } }),
+			),
+			runInTenant(ORG_B, () =>
+				scopedDb.contact.create({ data: { firstName: "B", email } }),
+			),
+			runInTenant(ORG_A, () =>
+				scopedDb.company.create({ data: { name: "Acme A", domain } }),
+			),
+			runInTenant(ORG_B, () =>
+				scopedDb.company.create({ data: { name: "Acme B", domain } }),
+			),
+		]);
+
+		expect(contactA.email).toBe(email);
+		expect(contactB.email).toBe(email);
+		expect(companyA.domain).toBe(domain);
+		expect(companyB.domain).toBe(domain);
+	});
+
+	it("refuses a duplicate contact email inside one organization", async () => {
+		const email = `duplicate-${testPrefix}@example.com`;
+
+		await runInTenant(ORG_A, () =>
+			scopedDb.contact.create({ data: { firstName: "First", email } }),
+		);
+
+		await expect(
+			runInTenant(ORG_A, () =>
+				scopedDb.contact.create({ data: { firstName: "Second", email } }),
+			),
+		).rejects.toThrow();
+	});
+
+	it("isolates representative tenant models", async () => {
+		const created = await runInTenant(ORG_A, async () => ({
+			conversation: await scopedDb.agentConversation.create({
+				data: { userId },
+			}),
+			definition: await scopedDb.agentDefinition.create({
+				data: { name: "Agent A", createdById: userId },
+			}),
+			task: await scopedDb.agentTask.create({
+				data: { kind: "brand", reason: "test", dueAt: new Date() },
+			}),
+			mailbox: await scopedDb.mailboxSync.create({
+				data: { userId, source: "gmail" },
+			}),
+		}));
+
+		await runInTenant(ORG_B, async () => {
+			await scopedDb.agentConversation.create({ data: { userId } });
+			await scopedDb.agentDefinition.create({
+				data: { name: "Agent B", createdById: userId },
+			});
+			await scopedDb.agentTask.create({
+				data: { kind: "brand", reason: "test", dueAt: new Date() },
+			});
+			await scopedDb.mailboxSync.create({ data: { userId, source: "gmail" } });
+		});
+
+		const seen = await runInTenant(ORG_A, async () => ({
+			conversations: await scopedDb.agentConversation.findMany(),
+			definitions: await scopedDb.agentDefinition.findMany(),
+			tasks: await scopedDb.agentTask.findMany(),
+			mailboxes: await scopedDb.mailboxSync.findMany(),
+		}));
+
+		expect(seen.conversations.map(({ id }) => id)).toContain(
+			created.conversation.id,
+		);
+		expect(seen.definitions.map(({ id }) => id)).toContain(
+			created.definition.id,
+		);
+		expect(seen.tasks.map(({ id }) => id)).toContain(created.task.id);
+		expect(seen.mailboxes.map(({ id }) => id)).toContain(created.mailbox.id);
+		expect(seen.conversations).toHaveLength(1);
+		expect(seen.definitions).toHaveLength(1);
+		expect(seen.tasks).toHaveLength(1);
+		expect(seen.mailboxes).toHaveLength(1);
+	});
+
+	it("isolates suppression and settings values", async () => {
+		const email = `suppressed-${testPrefix}@example.com`;
+		await Promise.all([
+			runInTenant(ORG_A, () =>
+				scopedDb.suppressedContact.create({ data: { email } }),
+			),
+			runInTenant(ORG_A, () =>
+				scopedDb.appSetting.create({ data: { contextDevApiKey: "key-a" } }),
+			),
+			runInTenant(ORG_B, () =>
+				scopedDb.appSetting.create({ data: { contextDevApiKey: "key-b" } }),
+			),
+		]);
+
+		const [suppressedInA, suppressedInB, settingA, settingB] =
+			await Promise.all([
+				runInTenant(ORG_A, () =>
+					scopedDb.suppressedContact.findUnique({
+						where: { organizationId_email: { organizationId: ORG_A, email } },
+					}),
+				),
+				runInTenant(ORG_B, () =>
+					scopedDb.suppressedContact.findUnique({
+						where: { organizationId_email: { organizationId: ORG_B, email } },
+					}),
+				),
+				runInTenant(ORG_A, () =>
+					scopedDb.appSetting.findUnique({ where: { organizationId: ORG_A } }),
+				),
+				runInTenant(ORG_B, () =>
+					scopedDb.appSetting.findUnique({ where: { organizationId: ORG_B } }),
+				),
+			]);
+
+		expect(suppressedInA).not.toBeNull();
+		expect(suppressedInB).toBeNull();
+		expect(settingA?.contextDevApiKey).toBe("key-a");
+		expect(settingB?.contextDevApiKey).toBe("key-b");
+	});
+});
+
+describe("scoped transactions", () => {
+	it("throws TenantContextError without tenant context", async () => {
+		await expect(scopedTransaction(async () => undefined)).rejects.toThrow(
+			TenantContextError,
+		);
+	});
+
+	it("sets the tenant before the callback starts", async () => {
+		const setting = await runInTenant(ORG_A, () =>
+			scopedTransaction(async (tx) => {
+				const rows = await tx.$queryRaw<Array<{ organizationId: string }>>`
+					SELECT current_setting('app.current_organization_id', true) AS "organizationId"
+				`;
+
+				return rows[0]?.organizationId;
+			}),
+		);
+
+		expect(setting).toBe(ORG_A);
+	});
+
+	it("uses an injected client and transaction options", async () => {
+		const result = await runInTenant(ORG_A, () =>
+			scopedTransaction(
+				scopedDb as ScopedDb,
+				async (tx) => {
+					const rows = await tx.$queryRaw<
+						Array<{ organizationId: string }>
+					>`SELECT current_setting('app.current_organization_id', true) AS "organizationId"`;
+					const count = await tx.company.count();
+					return { organizationId: rows[0]?.organizationId, count };
+				},
+				{ timeout: 5_000 },
+			),
+		);
+
+		expect(result.organizationId).toBe(ORG_A);
+		expect(result.count).toBeGreaterThanOrEqual(0);
+	});
+
+	it("applies tenant defaults to every write", async () => {
+		const names = [
+			makeName("transaction-first"),
+			makeName("transaction-second"),
+		];
+
+		const rows = await runInTenant(ORG_A, () =>
+			scopedTransaction(async (tx) =>
+				Promise.all(names.map((name) => tx.company.create({ data: { name } }))),
+			),
+		);
+
+		expect(rows).toHaveLength(2);
+		expect(rows.every((row) => row.organizationId === ORG_A)).toBe(true);
+	});
+
+	it("rolls back writes after a callback failure", async () => {
+		const name = makeName("transaction-rollback");
+
+		await expect(
+			runInTenant(ORG_A, () =>
+				scopedTransaction(async (tx) => {
+					await tx.company.create({ data: { name } });
+					throw new Error("rollback requested");
+				}),
+			),
+		).rejects.toThrow("rollback requested");
+
+		const count = await runInTenant(ORG_A, () =>
+			scopedDb.company.count({ where: { name } }),
+		);
+
+		expect(count).toBe(0);
+	});
+
+	it("reuses the active transaction for scopedDb calls", async () => {
+		const name = makeName("active-transaction");
+
+		await expect(
+			runInTenant(ORG_A, () =>
+				scopedTransaction(async () => {
+					await scopedDb.company.create({ data: { name } });
+					throw new Error("active transaction rollback");
+				}),
+			),
+		).rejects.toThrow("active transaction rollback");
+
+		const count = await runInTenant(ORG_A, () =>
+			scopedDb.company.count({ where: { name } }),
+		);
+
+		expect(count).toBe(0);
+	});
+
+	it("clears the tenant setting after commit", async () => {
+		await runInTenant(ORG_A, () => scopedTransaction(async () => undefined));
+
+		const setting = await db.$transaction(async (tx) => {
+			const rows = await tx.$queryRaw<Array<{ organizationId: string | null }>>`
+				SELECT current_setting('app.current_organization_id', true) AS "organizationId"
+			`;
+
+			return rows[0]?.organizationId;
+		});
+
+		expect(setting).not.toBe(ORG_A);
+	});
+});
diff --git a/packages/db/src/tenant-scope.ts b/packages/db/src/tenant-scope.ts
new file mode 100644
index 000000000..65a0907a7
--- /dev/null
+++ b/packages/db/src/tenant-scope.ts
@@ -0,0 +1,156 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import type { Db } from "./client";
+import { db } from "./client";
+import type { Prisma } from "./generated/prisma/client";
+import { currentOrganizationId, runInTenant } from "./tenant-context";
+
+const tenantScopedModels = new Set<Prisma.ModelName>([
+	"SlackMemberMatch",
+	"SlackChannel",
+	"SlackInstallation",
+	"SlackWorkspaceGrant",
+	"Company",
+	"CompanyEnrichment",
+	"Contact",
+	"ContactFact",
+	"ContactBrief",
+	"AgentTask",
+	"AgentEvent",
+	"AgentConversation",
+	"AgentConversationFeedback",
+	"AgentConversationShare",
+	"AgentConversationSubmission",
+	"AgentConversationAttachment",
+	"AgentDefinition",
+	"AgentVersion",
+	"AgentBuilderArtifact",
+	"AgentTrigger",
+	"AgentRun",
+	"AgentRunEvent",
+	"AgentAction",
+	"AgentAuditEvent",
+	"Deal",
+	"DealContact",
+	"FieldDefinition",
+	"FieldOption",
+	"FieldValue",
+	"SavedView",
+	"Activity",
+	"AppointmentDetails",
+	"MailboxSync",
+	"EmailThread",
+	"EmailMessage",
+	"CalendarEvent",
+	"CalendarAttendee",
+	"SuppressedDomain",
+	"SuppressedContact",
+	"AppSetting",
+	"TrackedDomain",
+	"TrackedVisitor",
+	"TrackedEvent",
+	"TrackingCounter",
+	"TrackedPageDaily",
+	"FormSubmission",
+	"WorkspaceProfile",
+	"SsoProvider",
+	"Artifact",
+	"AssetUpload",
+	"AssetEmailSource",
+	"AssetStorageJob",
+	"AssetApiRequest",
+]);
+
+const activeTransactionStorage =
+	new AsyncLocalStorage<Prisma.TransactionClient>();
+
+export const scopedDb = db.$extends({
+	name: "tenant-scope",
+	query: {
+		$allModels: {
+			async $allOperations({ model, operation, args, query }) {
+				if (!model || !tenantScopedModels.has(model as Prisma.ModelName)) {
+					return query(args);
+				}
+
+				const activeTransaction = activeTransactionStorage.getStore();
+				const executeOperation = (client: Prisma.TransactionClient) => {
+					const key = model.charAt(0).toLowerCase() + model.slice(1);
+					const delegate = Reflect.get(client, key);
+					const action = Reflect.get(delegate, operation);
+					return Reflect.apply(action, delegate, [args]);
+				};
+
+				if (activeTransaction) {
+					return executeOperation(activeTransaction);
+				}
+
+				return scopedTransaction(async (tx) => executeOperation(tx));
+			},
+		},
+	},
+});
+
+export type ScopedDb = Db;
+
+export interface ScopedTransactionOptions {
+	isolationLevel?: Prisma.TransactionIsolationLevel;
+	maxWait?: number;
+	timeout?: number;
+}
+
+type ScopedTransactionWork<T> = (tx: Prisma.TransactionClient) => Promise<T>;
+interface TransactionRunner {
+	$transaction<T>(
+		work: ScopedTransactionWork<T>,
+		options?: ScopedTransactionOptions,
+	): Promise<T>;
+}
+type TransactionClientProvider = Db;
+
+export function scopedTransaction<T>(
+	fn: ScopedTransactionWork<T>,
+	options?: ScopedTransactionOptions,
+): Promise<T>;
+export function scopedTransaction<T>(
+	client: TransactionClientProvider,
+	fn: ScopedTransactionWork<T>,
+	options?: ScopedTransactionOptions,
+): Promise<T>;
+export async function scopedTransaction<T>(
+	clientOrWork: TransactionClientProvider | ScopedTransactionWork<T>,
+	workOrOptions?: ScopedTransactionWork<T> | ScopedTransactionOptions,
+	transactionOptions?: ScopedTransactionOptions,
+): Promise<T> {
+	const client = clientOrWork instanceof Function ? db : clientOrWork;
+	const work =
+		clientOrWork instanceof Function
+			? clientOrWork
+			: (workOrOptions as ScopedTransactionWork<T>);
+	const options =
+		clientOrWork instanceof Function
+			? (workOrOptions as ScopedTransactionOptions | undefined)
+			: transactionOptions;
+	const organizationId = currentOrganizationId();
+	const transactionRunner = client === scopedDb ? db : client;
+
+	return (transactionRunner as TransactionRunner).$transaction(async (tx) => {
+		await setTenant(tx, organizationId);
+		return activeTransactionStorage.run(tx, () => work(tx));
+	}, options);
+}
+
+export function tenantTransaction<T>(
+	organizationId: string,
+	action: (tx: Prisma.TransactionClient) => Promise<T>,
+): Promise<T> {
+	return runInTenant(organizationId, () => scopedTransaction(action));
+}
+
+function setTenant(
+	tx: Prisma.TransactionClient,
+	organizationId: string,
+): Promise<unknown> {
+	return tx.$queryRaw`
+		SELECT set_config('app.current_organization_id', ${organizationId}, true)
+	`;
+}
diff --git a/packages/db/src/tenants.ts b/packages/db/src/tenants.ts
new file mode 100644
index 000000000..02313c9dc
--- /dev/null
+++ b/packages/db/src/tenants.ts
@@ -0,0 +1,57 @@
+import type { Db } from "./client";
+import { db } from "./client";
+import type { Prisma } from "./generated/prisma/client";
+import { runLimited } from "./pool";
+import { runInTenant } from "./tenant-context";
+import { tenantTransaction } from "./tenant-scope";
+
+type OrganizationReader = Pick<Db, "organization">;
+
+export async function organizationIds(
+	client: OrganizationReader = db,
+): Promise<string[]> {
+	const organizations = await client.organization.findMany({
+		orderBy: { id: "asc" },
+		select: { id: true },
+	});
+	return organizations.map(({ id }) => id);
+}
+
+export interface ForEachTenantOptions {
+	concurrency?: number;
+	organizations?: readonly string[];
+}
+
+export async function forEachTenant(
+	work: (organizationId: string, tx: Prisma.TransactionClient) => Promise<void>,
+	options: ForEachTenantOptions = {},
+): Promise<void> {
+	const organizations = options.organizations ?? (await organizationIds());
+	await runLimited(
+		options.concurrency ?? organizations.length,
+		organizations,
+		(organizationId) =>
+			tenantTransaction(organizationId, (tx) => work(organizationId, tx)),
+	);
+}
+
+export async function collectAcrossTenants<T>(
+	query: (organizationId: string) => Promise<T[]>,
+	options: ForEachTenantOptions = {},
+): Promise<T[]> {
+	const rows: T[] = [];
+	await forEachTenant(async (organizationId) => {
+		rows.push(...(await query(organizationId)));
+	}, options);
+	return rows;
+}
+
+export async function locateTenantRow<T>(
+	query: (organizationId: string) => Promise<T | null>,
+): Promise<{ organizationId: string; row: T } | null> {
+	for (const organizationId of await organizationIds()) {
+		const row = await runInTenant(organizationId, () => query(organizationId));
+		if (row) return { organizationId, row };
+	}
+	return null;
+}
diff --git a/packages/db/src/test-support.ts b/packages/db/src/test-support.ts
new file mode 100644
index 000000000..16cd49b28
--- /dev/null
+++ b/packages/db/src/test-support.ts
@@ -0,0 +1,56 @@
+import {
+	afterAll as bunAfterAll,
+	afterEach as bunAfterEach,
+	beforeAll as bunBeforeAll,
+	beforeEach as bunBeforeEach,
+	it as bunIt,
+} from "bun:test";
+import { runInTenant } from "./tenant-context";
+
+type TestBody = () => void | Promise<void>;
+
+export function tenantTest(organizationId: string) {
+	return (name: string, test: TestBody): void => {
+		bunIt(name, () => runInTenant(organizationId, test));
+	};
+}
+
+function tenantHook(register: (hook: TestBody) => void) {
+	return (organizationId: string) =>
+		(hook: TestBody): void => {
+			register(() => runInTenant(organizationId, hook));
+		};
+}
+
+export const tenantBeforeAll = tenantHook(bunBeforeAll);
+export const tenantBeforeEach = tenantHook(bunBeforeEach);
+export const tenantAfterEach = tenantHook(bunAfterEach);
+export const tenantAfterAll = tenantHook(bunAfterAll);
+
+export function tenantContext(organizationId: string) {
+	return async <T>(work: () => T | PromiseLike<T>): Promise<T> =>
+		await runInTenant(organizationId, work);
+}
+
+export async function createTenantRows<T extends { organizationId: string }>(
+	rows: T[],
+	create: (row: T) => PromiseLike<unknown>,
+): Promise<void> {
+	await Promise.all(
+		rows.map((row) => runInTenant(row.organizationId, () => create(row))),
+	);
+}
+
+export function tenantBound<T extends object>(
+	organizationId: string,
+	service: T,
+): T {
+	return new Proxy(service, {
+		get(target, property, receiver) {
+			const value = Reflect.get(target, property, receiver);
+			if (!(value instanceof Function)) return value;
+			return (...args: unknown[]) =>
+				runInTenant(organizationId, () => value.apply(target, args));
+		},
+	});
+}
diff --git a/packages/db/src/tracking-tenant-scope.test.ts b/packages/db/src/tracking-tenant-scope.test.ts
new file mode 100644
index 000000000..d9023c993
--- /dev/null
+++ b/packages/db/src/tracking-tenant-scope.test.ts
@@ -0,0 +1,44 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "./client";
+import { runInTenant } from "./tenant-context";
+import { scopedDb } from "./tenant-scope";
+
+const ORG_A = "test-track-org-a";
+const ORG_B = "test-track-org-b";
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: [
+			{ id: ORG_A, name: "Org A", slug: "track-org-a", createdAt: new Date() },
+			{ id: ORG_B, name: "Org B", slug: "track-org-b", createdAt: new Date() },
+		],
+		skipDuplicates: true,
+	});
+});
+
+afterAll(async () => {
+	for (const organizationId of [ORG_A, ORG_B]) {
+		await runInTenant(organizationId, () =>
+			scopedDb.trackedDomain.deleteMany(),
+		);
+	}
+	await db.organization.deleteMany({
+		where: { id: { in: [ORG_A, ORG_B] } },
+	});
+});
+
+describe("tracking tenant scoping", () => {
+	it("lets two tenants each track the same host", async () => {
+		const host = "shared-client-site.com";
+
+		const a = await runInTenant(ORG_A, () =>
+			scopedDb.trackedDomain.create({ data: { host } }),
+		);
+		const b = await runInTenant(ORG_B, () =>
+			scopedDb.trackedDomain.create({ data: { host } }),
+		);
+
+		expect(a.host).toBe(host);
+		expect(b.host).toBe(host);
+	});
+});
diff --git a/packages/db/src/tracking.ts b/packages/db/src/tracking.ts
index dc3c6fea2..adb8b42ca 100644
--- a/packages/db/src/tracking.ts
+++ b/packages/db/src/tracking.ts
@@ -1,6 +1,6 @@
 import { createHash, randomBytes } from "node:crypto";
 import type { Db } from "./client";
-import { SETTINGS_ID } from "./settings";
+import { currentOrganizationId } from "./tenant-context";
 
 export const SITE_ID_PREFIX = "cmp_";
 
@@ -256,7 +256,7 @@ export async function readTrackingConfig(
 ): Promise<TrackingConfig | null> {
 	const [settings, domains] = await Promise.all([
 		db.appSetting.findUnique({
-			where: { id: SETTINGS_ID },
+			where: { organizationId: currentOrganizationId() },
 			select: {
 				trackingSiteId: true,
 				trackingCrossDomain: true,
diff --git a/packages/db/src/workspace-slug.ts b/packages/db/src/workspace-slug.ts
new file mode 100644
index 000000000..63a93e42c
--- /dev/null
+++ b/packages/db/src/workspace-slug.ts
@@ -0,0 +1,33 @@
+export const DEFAULT_WORKSPACE_SLUG = "workspace";
+
+export const MAX_SLUG = 48;
+
+export const RESERVED_SLUGS: readonly string[] = [
+	"_next",
+	"api",
+	"agent",
+	"agents",
+	"chat",
+	"companies",
+	"contacts",
+	"deals",
+	"eve",
+	"grant-access",
+	"onboarding",
+	"settings",
+	"sign-in",
+];
+
+export function workspaceSlug(name: string): string {
+	const base = name
+		.normalize("NFKD")
+		.replace(/\p{M}/gu, "")
+		.toLowerCase()
+		.replace(/[^a-z0-9]+/g, "-")
+		.slice(0, MAX_SLUG)
+		.replace(/^-+|-+$/g, "");
+
+	if (!base) return DEFAULT_WORKSPACE_SLUG;
+
+	return RESERVED_SLUGS.includes(base) ? `${base}-crm` : base;
+}
diff --git a/packages/db/src/workspace.test.ts b/packages/db/src/workspace.test.ts
new file mode 100644
index 000000000..b28268e81
--- /dev/null
+++ b/packages/db/src/workspace.test.ts
@@ -0,0 +1,119 @@
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { db } from "./client";
+import type { Prisma } from "./generated/prisma/client";
+import { runInTenant, TenantContextError } from "./tenant-context";
+import { scopedTransaction } from "./tenant-scope";
+import {
+	readWorkspaceIdentity,
+	readWorkspaceProfile,
+	writeWorkspaceProfile,
+} from "./workspace";
+
+const testPrefix = `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+const ORG_A = `workspacefn-org-a-${testPrefix}`;
+const ORG_B = `workspacefn-org-b-${testPrefix}`;
+
+const inTenant = <T>(
+	organizationId: string,
+	work: (tx: Prisma.TransactionClient) => Promise<T>,
+) => runInTenant(organizationId, () => scopedTransaction(work));
+
+beforeAll(async () => {
+	await db.organization.createMany({
+		data: [
+			{
+				id: ORG_A,
+				name: `Org A ${testPrefix}`,
+				slug: `workspacefn-org-a-${testPrefix}`,
+				website: "https://a.example.com",
+				createdAt: new Date(),
+			},
+			{
+				id: ORG_B,
+				name: `Org B ${testPrefix}`,
+				slug: `workspacefn-org-b-${testPrefix}`,
+				website: "https://b.example.com",
+				createdAt: new Date(),
+			},
+		],
+		skipDuplicates: true,
+	});
+});
+
+afterAll(async () => {
+	for (const organizationId of [ORG_A, ORG_B]) {
+		await inTenant(organizationId, (tx) => tx.workspaceProfile.deleteMany());
+	}
+	await db.organization.deleteMany({
+		where: { id: { in: [ORG_A, ORG_B] } },
+	});
+});
+
+describe("workspace readers/writers outside any tenant context", () => {
+	it("throw TenantContextError rather than reading anyone's profile", async () => {
+		await expect(readWorkspaceProfile(db)).rejects.toThrow(TenantContextError);
+		await expect(readWorkspaceIdentity(db)).rejects.toThrow(TenantContextError);
+	});
+});
+
+describe("workspace readers/writers inside tenant context", () => {
+	it("keeps the workspace profile isolated per organization", async () => {
+		await inTenant(ORG_A, (tx) =>
+			writeWorkspaceProfile(tx, {
+				website: "https://a.example.com",
+				narrative: "Sells compliance automation to mid-market SaaS.",
+				sections: {
+					sells: "Compliance automation",
+					sellsTo: "Mid-market SaaS",
+				},
+			}),
+		);
+
+		const inA = await inTenant(ORG_A, (tx) => readWorkspaceProfile(tx));
+		const inB = await inTenant(ORG_B, (tx) => readWorkspaceProfile(tx));
+
+		expect(inA?.narrative).toBe(
+			"Sells compliance automation to mid-market SaaS.",
+		);
+		expect(inB).toBeNull();
+	});
+
+	it("resolves readWorkspaceIdentity to the active organization, not a fixed one", async () => {
+		const identityA = await inTenant(ORG_A, (tx) => readWorkspaceIdentity(tx));
+		const identityB = await inTenant(ORG_B, (tx) => readWorkspaceIdentity(tx));
+
+		expect(identityA?.name).toBe(`Org A ${testPrefix}`);
+		expect(identityA?.website).toBe("https://a.example.com");
+		expect(identityB?.name).toBe(`Org B ${testPrefix}`);
+		expect(identityB?.website).toBe("https://b.example.com");
+	});
+
+	it("keeps stale profile handling tenant-local", async () => {
+		await inTenant(ORG_A, (tx) =>
+			writeWorkspaceProfile(tx, {
+				website: "https://stale-a.example.com",
+				narrative: "Legacy profile URL",
+				sections: { sells: "Legacy sells", sellsTo: "Legacy sells-to" },
+			}),
+		);
+		await inTenant(ORG_B, (tx) =>
+			writeWorkspaceProfile(tx, {
+				website: "https://b.example.com",
+				narrative: "Active profile URL",
+				sections: { sells: "Compliance", sellsTo: "Small teams" },
+			}),
+		);
+
+		await db.organization.update({
+			where: { id: ORG_A },
+			data: { website: "https://renamed-a.example.com" },
+		});
+
+		const inA = await inTenant(ORG_A, (tx) => readWorkspaceIdentity(tx));
+		const inB = await inTenant(ORG_B, (tx) => readWorkspaceIdentity(tx));
+
+		expect(inA?.profile).toBeNull();
+		expect(inB?.profile).not.toBeNull();
+		expect(inB?.profile?.website).toBe("https://b.example.com");
+	});
+});
diff --git a/packages/db/src/workspace.ts b/packages/db/src/workspace.ts
index b49c748c3..323765242 100644
--- a/packages/db/src/workspace.ts
+++ b/packages/db/src/workspace.ts
@@ -6,42 +6,11 @@ import {
 	jsonText,
 	type WorkspaceProfileSections,
 } from "./json";
+import { currentOrganizationId } from "./tenant-context";
 
-export const WORKSPACE_ID = "workspace";
+type WorkspaceDb = Pick<Db, "organization" | "workspaceProfile">;
 
-export const DEFAULT_WORKSPACE_SLUG = "workspace";
-
-export const MAX_SLUG = 48;
-
-export const RESERVED_SLUGS: readonly string[] = [
-	"_next",
-	"api",
-	"agent",
-	"agents",
-	"chat",
-	"companies",
-	"contacts",
-	"deals",
-	"eve",
-	"grant-access",
-	"onboarding",
-	"settings",
-	"sign-in",
-];
-
-export function workspaceSlug(name: string): string {
-	const base = name
-		.normalize("NFKD")
-		.replace(/\p{M}/gu, "")
-		.toLowerCase()
-		.replace(/[^a-z0-9]+/g, "-")
-		.slice(0, MAX_SLUG)
-		.replace(/^-+|-+$/g, "");
-
-	if (!base) return DEFAULT_WORKSPACE_SLUG;
-
-	return RESERVED_SLUGS.includes(base) ? `${base}-crm` : base;
-}
+export const WORKSPACE_ID = "workspace";
 
 export const MAX_NARRATIVE = 320;
 
@@ -88,10 +57,10 @@ export type WorkspaceIdentity = {
 };
 
 export async function readWorkspaceProfile(
-	db: Db,
+	db: WorkspaceDb,
 ): Promise<WorkspaceProfile | null> {
 	const row = await db.workspaceProfile.findUnique({
-		where: { id: WORKSPACE_ID },
+		where: { organizationId: currentOrganizationId() },
 		select: {
 			website: true,
 			narrative: true,
@@ -137,11 +106,12 @@ export function profileOf(
 }
 
 export async function readWorkspaceIdentity(
-	db: Db,
+	db: WorkspaceDb,
 ): Promise<WorkspaceIdentity | null> {
+	const organizationId = currentOrganizationId();
 	const [workspace, profile] = await Promise.all([
 		db.organization.findUnique({
-			where: { id: WORKSPACE_ID },
+			where: { id: organizationId },
 			select: { name: true, website: true },
 		}),
 		readWorkspaceProfile(db),
@@ -157,7 +127,7 @@ export async function readWorkspaceIdentity(
 }
 
 export async function writeWorkspaceProfile(
-	db: Db,
+	db: WorkspaceDb,
 	input: {
 		website: string;
 		narrative: string;
@@ -166,6 +136,7 @@ export async function writeWorkspaceProfile(
 		sessionId?: string | null;
 	},
 ): Promise<WorkspaceProfile> {
+	const organizationId = currentOrganizationId();
 	const fields = {
 		website: input.website,
 		narrative: clamp(input.narrative, MAX_NARRATIVE) ?? "",
@@ -176,8 +147,8 @@ export async function writeWorkspaceProfile(
 	};
 
 	const row = await db.workspaceProfile.upsert({
-		where: { id: WORKSPACE_ID },
-		create: { id: WORKSPACE_ID, ...fields },
+		where: { organizationId },
+		create: fields,
 		update: fields,
 		select: {
 			website: true,
diff --git a/packages/db/test/workspace-slug.spec.ts b/packages/db/test/workspace-slug.spec.ts
index 941e10405..34d5ff3a3 100644
--- a/packages/db/test/workspace-slug.spec.ts
+++ b/packages/db/test/workspace-slug.spec.ts
@@ -4,7 +4,7 @@ import {
 	MAX_SLUG,
 	RESERVED_SLUGS,
 	workspaceSlug,
-} from "../src/workspace";
+} from "../src/workspace-slug";
 
 describe("workspaceSlug", () => {
 	it("is the company name a rep can read in the address bar", () => {
diff --git a/packages/db/tsconfig.json b/packages/db/tsconfig.json
index df18351ab..8d23b8a8a 100644
--- a/packages/db/tsconfig.json
+++ b/packages/db/tsconfig.json
@@ -2,7 +2,7 @@
 	"$schema": "https://json.schemastore.org/tsconfig",
 	"extends": "@crm/typescript-config/internal-package.json",
 	"compilerOptions": {
-		"types": ["node"]
+		"types": ["node", "bun"]
 	},
 	"include": ["src/**/*.ts", "prisma/**/*.ts", "prisma.config.ts"],
 	"exclude": ["node_modules"]
diff --git a/packages/db/turbo.json b/packages/db/turbo.json
index 76cf20afe..6211c5c43 100644
--- a/packages/db/turbo.json
+++ b/packages/db/turbo.json
@@ -1,5 +1,5 @@
 {
-	"$schema": "https://turborepo.dev/schema.json",
+	"$schema": "https://v2-10-12.turborepo.dev/schema.json",
 	"extends": ["//"],
 	"tasks": {
 		"build": {
diff --git a/packages/env/package.json b/packages/env/package.json
index 9bf9c77f0..9347e63de 100644
--- a/packages/env/package.json
+++ b/packages/env/package.json
@@ -15,7 +15,7 @@
 	},
 	"devDependencies": {
 		"@crm/typescript-config": "workspace:*",
-		"@types/node": "^24.10.1",
-		"typescript": "5.9.2"
+		"@types/node": "^26.5.0",
+		"typescript": "7.0.2"
 	}
 }
diff --git a/packages/env/test/root.spec.ts b/packages/env/test/root.spec.ts
index 460903046..092e7b76c 100644
--- a/packages/env/test/root.spec.ts
+++ b/packages/env/test/root.spec.ts
@@ -80,3 +80,13 @@ describe("the committed .env.example", () => {
 		}
 	});
 });
+
+describe("the app build environment", () => {
+	it("inherits the root build variables", () => {
+		const config = JSON.parse(
+			readFileSync(join(repoRoot, "apps", "app", "turbo.json"), "utf8"),
+		);
+
+		expect(config.tasks.build.env).toContain("$TURBO_EXTENDS$");
+	});
+});
diff --git a/packages/kaneo-domain/kaneo.prisma b/packages/kaneo-domain/kaneo.prisma
new file mode 100644
index 000000000..efc435b74
--- /dev/null
+++ b/packages/kaneo-domain/kaneo.prisma
@@ -0,0 +1,521 @@
+model UserAvatar {
+  id String @id @default(cuid())
+  userId String @map("user_id") @unique(map: "user_avatar_user_id_unique")
+  mimeType String @map("mime_type")
+  size Int
+  data Bytes
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  @@index([userId], map: "user_avatar_userId_idx")
+  @@map("user_avatar")
+}
+
+model Workspace {
+  id String @id @default(cuid())
+  name String
+  slug String @unique
+  logo String?
+  metadata String?
+  description String?
+  createdAt DateTime @map("created_at")
+  workspaceMembers WorkspaceMember[]
+  workspaceBillings WorkspaceBilling[]
+  teams Team[]
+  workspaceInvitations WorkspaceInvitation[]
+  workspaceRoles WorkspaceRole[]
+  projects Project[]
+  billingReminderSents BillingReminderSent[]
+  assets Asset[]
+  labels Label[]
+  userNotificationWorkspaceRules UserNotificationWorkspaceRule[]
+  userNotificationWorkspaceProjects UserNotificationWorkspaceProject[]
+  @@map("workspace")
+}
+
+model WorkspaceMember {
+  id String @id @default(cuid())
+  workspaceId String @map("workspace_id")
+  userId String @map("user_id")
+  role String @default("member")
+  joinedAt DateTime @map("joined_at")
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+  @@index([workspaceId], map: "workspace_member_workspaceId_idx")
+  @@index([userId], map: "workspace_member_userId_idx")
+  @@map("workspace_member")
+}
+
+model WorkspaceBilling {
+  id String @id @default(cuid())
+  workspaceId String @map("workspace_id") @unique(map: "workspace_billing_workspace_id_unique")
+  foundingFree Boolean @map("founding_free") @default(false)
+  trialEndsAt DateTime? @map("trial_ends_at")
+  creemCustomerId String? @map("creem_customer_id")
+  creemSubscriptionId String? @map("creem_subscription_id") @unique
+  creemProductId String? @map("creem_product_id")
+  plan String?
+  billingInterval String? @map("billing_interval")
+  status String?
+  seats Int @default(1)
+  currentPeriodEnd DateTime? @map("current_period_end")
+  canceledAt DateTime? @map("canceled_at")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([workspaceId], map: "workspace_billing_workspaceId_idx")
+  @@map("workspace_billing")
+}
+
+model TrialGrant {
+  emailHash String @map("email_hash") @id
+  trialEndsAt DateTime @map("trial_ends_at")
+  createdAt DateTime @map("created_at") @default(now())
+  @@map("trial_grant")
+}
+
+model BillingEvent {
+  id String @id
+  eventType String @map("event_type")
+  processedAt DateTime @map("processed_at") @default(now())
+  @@map("billing_event")
+}
+
+model Team {
+  id String @id
+  name String
+  workspaceId String @map("workspace_id")
+  createdAt DateTime @map("created_at")
+  updatedAt DateTime? @map("updated_at") @updatedAt
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+  teamMembers TeamMember[]
+  @@index([workspaceId], map: "team_workspaceId_idx")
+  @@map("team")
+}
+
+model TeamMember {
+  id String @id
+  teamId String @map("team_id")
+  userId String @map("user_id")
+  createdAt DateTime? @map("created_at")
+  team Team @relation(fields: [teamId], references: [id], onDelete: Cascade)
+  @@index([teamId], map: "teamMember_teamId_idx")
+  @@index([userId], map: "teamMember_userId_idx")
+  @@map("team_member")
+}
+
+model WorkspaceInvitation {
+  id String @id @default(cuid())
+  workspaceId String @map("workspace_id")
+  email String
+  role String?
+  teamId String? @map("team_id")
+  status String @default("pending")
+  expiresAt DateTime @map("expires_at")
+  createdAt DateTime @map("created_at") @default(now())
+  inviterId String @map("inviter_id")
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
+  @@index([workspaceId], map: "workspace_invitation_workspaceId_idx")
+  @@index([email], map: "workspace_invitation_email_idx")
+  @@index([inviterId], map: "workspace_invitation_inviterId_idx")
+  @@map("workspace_invitation")
+}
+
+model WorkspaceRole {
+  id String @id @default(cuid())
+  workspaceId String @map("workspace_id")
+  role String
+  permission String
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([workspaceId], map: "workspace_role_workspaceId_idx")
+  @@index([role], map: "workspace_role_role_idx")
+  @@map("workspace_role")
+}
+
+model Project {
+  id String @id @default(cuid())
+  workspaceId String @map("workspace_id")
+  slug String
+  icon String? @default("Layout")
+  name String
+  description String?
+  createdAt DateTime @map("created_at") @default(now())
+  isPublic Boolean? @map("is_public") @default(false)
+  archivedAt DateTime? @map("archived_at")
+  lastTaskNumber Int @map("last_task_number") @default(0)
+  position Int @default(0)
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  projectColumns ProjectColumn[]
+  workflowRules WorkflowRule[]
+  projectTasks ProjectTask[]
+  assets Asset[]
+  userNotificationWorkspaceProjects UserNotificationWorkspaceProject[]
+  githubIntegrations GithubIntegration[]
+  integrations Integration[]
+  @@unique([workspaceId, id], map: "project_workspace_id_id_unique")
+  @@index([workspaceId, position], map: "project_workspaceId_position_idx")
+  @@map("project")
+}
+
+model ProjectColumn {
+  id String @id @default(cuid())
+  projectId String @map("project_id")
+  name String
+  slug String
+  position Int @default(0)
+  icon String?
+  color String?
+  isFinal Boolean @map("is_final") @default(false)
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  project Project @relation(fields: [projectId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  workflowRules WorkflowRule[]
+  projectTasks ProjectTask[]
+  @@index([projectId], map: "column_projectId_idx")
+  @@map("column")
+}
+
+model WorkflowRule {
+  id String @id @default(cuid())
+  projectId String @map("project_id")
+  integrationType String @map("integration_type")
+  eventType String @map("event_type")
+  columnId String @map("column_id")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  project Project @relation(fields: [projectId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  column ProjectColumn @relation(fields: [columnId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([projectId], map: "workflow_rule_projectId_idx")
+  @@index([columnId], map: "workflow_rule_columnId_idx")
+  @@map("workflow_rule")
+}
+
+model ProjectTask {
+  id String @id @default(cuid())
+  projectId String @map("project_id")
+  position Int? @default(0)
+  number Int? @default(1)
+  userId String? @map("assignee_id")
+  title String
+  description String?
+  status String @default("to-do")
+  columnId String? @map("column_id")
+  priority String @default("low")
+  startDate DateTime? @map("start_date")
+  dueDate DateTime? @map("due_date")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  project Project @relation(fields: [projectId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  column ProjectColumn? @relation(fields: [columnId], references: [id], onDelete: SetNull, onUpdate: Cascade)
+  taskReminderSents TaskReminderSent[]
+  timeEntries TimeEntry[]
+  taskActivities TaskActivity[]
+  assets Asset[]
+  labels Label[]
+  externalLinks ExternalLink[]
+  taskComments TaskComment[]
+  taskRelations TaskRelation[]
+  taskRelations2 TaskRelation[] @relation("TaskRelationToProjectTask_1")
+  @@unique([projectId, number], map: "task_project_number_unique")
+  @@index([projectId], map: "task_projectId_idx")
+  @@index([dueDate], map: "task_dueDate_idx")
+  @@index([userId], map: "task_assigneeId_idx")
+  @@index([columnId], map: "task_columnId_idx")
+  @@map("task")
+}
+
+model BillingReminderSent {
+  id String @id @default(cuid())
+  userId String @map("user_id")
+  workspaceId String @map("workspace_id")
+  reminderType String @map("reminder_type")
+  trialEndsAt DateTime? @map("trial_ends_at")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@unique([userId, reminderType], map: "billing_reminder_sent_user_type_unique")
+  @@index([workspaceId], map: "billing_reminder_sent_workspaceId_idx")
+  @@index([userId], map: "billing_reminder_sent_userId_idx")
+  @@map("billing_reminder_sent")
+}
+
+model JobLease {
+  name String @id
+  owner String
+  expiresAt DateTime @map("expires_at")
+  @@map("job_lease")
+}
+
+model TaskReminderSent {
+  id String @id @default(cuid())
+  taskId String @map("task_id")
+  reminderType String @map("reminder_type")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  task ProjectTask @relation(fields: [taskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@unique([taskId, reminderType], map: "task_reminder_sent_task_type_unique")
+  @@index([taskId], map: "task_reminder_sent_taskId_idx")
+  @@map("task_reminder_sent")
+}
+
+model TimeEntry {
+  id String @id @default(cuid())
+  taskId String @map("task_id")
+  userId String? @map("user_id")
+  description String?
+  startTime DateTime @map("start_time")
+  endTime DateTime? @map("end_time")
+  duration Int? @default(0)
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  task ProjectTask @relation(fields: [taskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([taskId], map: "time_entry_taskId_idx")
+  @@index([userId], map: "time_entry_userId_idx")
+  @@map("time_entry")
+}
+
+model TaskActivity {
+  id String @id @default(cuid())
+  taskId String @map("task_id")
+  type String
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  userId String? @map("user_id")
+  content String?
+  eventData Json? @map("event_data")
+  externalUserName String? @map("external_user_name")
+  externalUserAvatar String? @map("external_user_avatar")
+  externalSource String? @map("external_source")
+  externalUrl String? @map("external_url")
+  task ProjectTask @relation(fields: [taskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  assets Asset[]
+  @@unique([taskId, externalSource, externalUrl], map: "activity_task_external_source_external_url_unique")
+  @@index([taskId], map: "activity_task_id_idx")
+  @@index([userId], map: "activity_userId_idx")
+  @@map("task_activity")
+}
+
+model Asset {
+  id String @id @default(cuid())
+  workspaceId String @map("workspace_id")
+  projectId String @map("project_id")
+  taskId String? @map("task_id")
+  activityId String? @map("activity_id")
+  objectKey String @map("object_key") @unique
+  filename String
+  mimeType String @map("mime_type")
+  size Int
+  kind String @default("image")
+  surface String @default("description")
+  createdBy String? @map("created_by")
+  createdAt DateTime @map("created_at") @default(now())
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  project Project @relation(fields: [projectId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  task ProjectTask? @relation(fields: [taskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  activity TaskActivity? @relation(fields: [activityId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([workspaceId], map: "asset_workspaceId_idx")
+  @@index([projectId], map: "asset_projectId_idx")
+  @@index([taskId], map: "asset_taskId_idx")
+  @@index([activityId], map: "asset_activityId_idx")
+  @@index([createdBy], map: "asset_createdBy_idx")
+  @@map("asset")
+}
+
+model Label {
+  id String @id @default(cuid())
+  name String
+  color String
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  taskId String? @map("task_id")
+  workspaceId String? @map("workspace_id")
+  task ProjectTask? @relation(fields: [taskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  workspace Workspace? @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@unique([taskId, name], map: "label_task_name_unique")
+  @@index([taskId], map: "label_task_id_idx")
+  @@index([workspaceId], map: "label_workspace_id_idx")
+  @@map("label")
+}
+
+model Notification {
+  id String @id @default(cuid())
+  userId String @map("user_id")
+  title String?
+  content String?
+  type String @default("info")
+  eventData Json? @map("event_data")
+  isRead Boolean? @map("is_read") @default(false)
+  resourceId String? @map("resource_id")
+  resourceType String? @map("resource_type")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  @@index([userId], map: "notification_userId_idx")
+  @@map("notification")
+}
+
+model UserNotificationPreference {
+  id String @id @default(cuid())
+  userId String @map("user_id") @unique
+  emailEnabled Boolean @map("email_enabled") @default(false)
+  ntfyEnabled Boolean @map("ntfy_enabled") @default(false)
+  ntfyServerUrl String? @map("ntfy_server_url")
+  ntfyTopic String? @map("ntfy_topic")
+  ntfyToken String? @map("ntfy_token")
+  gotifyEnabled Boolean @map("gotify_enabled") @default(false)
+  gotifyServerUrl String? @map("gotify_server_url")
+  gotifyToken String? @map("gotify_token")
+  webhookEnabled Boolean @map("webhook_enabled") @default(false)
+  webhookUrl String? @map("webhook_url")
+  webhookSecret String? @map("webhook_secret")
+  taskAssignmentEnabled Boolean @map("task_assignment_enabled") @default(true)
+  taskCommentEnabled Boolean @map("task_comment_enabled") @default(true)
+  taskStatusChangeEnabled Boolean @map("task_status_change_enabled") @default(true)
+  dueDateReminderEnabled Boolean @map("due_date_reminder_enabled") @default(true)
+  dueDateReminderLeadTimeMinutes Int @map("due_date_reminder_lead_time_minutes") @default(1440)
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  @@map("user_notification_preference")
+}
+
+model UserNotificationWorkspaceRule {
+  id String @id @default(cuid())
+  userId String @map("user_id")
+  workspaceId String @map("workspace_id")
+  isActive Boolean @map("is_active") @default(true)
+  emailEnabled Boolean @map("email_enabled") @default(false)
+  ntfyEnabled Boolean @map("ntfy_enabled") @default(false)
+  gotifyEnabled Boolean @map("gotify_enabled") @default(false)
+  webhookEnabled Boolean @map("webhook_enabled") @default(false)
+  projectMode String @map("project_mode") @default("all")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  userNotificationWorkspaceProjects UserNotificationWorkspaceProject[]
+  @@unique([userId, workspaceId], map: "user_notification_workspace_rule_user_workspace_unique")
+  @@unique([workspaceId, id], map: "user_notification_workspace_rule_workspace_id_id_unique")
+  @@index([userId], map: "user_notification_workspace_rule_userId_idx")
+  @@index([workspaceId], map: "user_notification_workspace_rule_workspaceId_idx")
+  @@map("user_notification_workspace_rule")
+}
+
+model UserNotificationWorkspaceProject {
+  id String @id @default(cuid())
+  workspaceId String @map("workspace_id")
+  workspaceRuleId String @map("workspace_rule_id")
+  projectId String @map("project_id")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  userNotificationWorkspaceRule UserNotificationWorkspaceRule @relation(fields: [workspaceId, workspaceRuleId], references: [workspaceId, id], onDelete: Cascade, onUpdate: Cascade)
+  project Project @relation(fields: [workspaceId, projectId], references: [workspaceId, id], onDelete: Cascade, onUpdate: Cascade)
+  @@unique([workspaceRuleId, projectId], map: "user_notification_workspace_project_rule_project_unique")
+  @@index([workspaceRuleId], map: "user_notification_workspace_project_ruleId_idx")
+  @@index([projectId], map: "user_notification_workspace_project_projectId_idx")
+  @@index([workspaceId, projectId], map: "user_notification_workspace_project_workspaceId_projectId_idx")
+  @@index([workspaceId, workspaceRuleId], map: "unwp_workspaceId_workspaceRuleId_idx")
+  @@map("user_notification_workspace_project")
+}
+
+model GithubIntegration {
+  id String @id @default(cuid())
+  projectId String @map("project_id") @unique
+  repositoryOwner String @map("repository_owner")
+  repositoryName String @map("repository_name")
+  installationId Int? @map("installation_id")
+  isActive Boolean? @map("is_active") @default(true)
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  project Project @relation(fields: [projectId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@map("github_integration")
+}
+
+model Integration {
+  id String @id @default(cuid())
+  projectId String @map("project_id")
+  type String
+  config String
+  isActive Boolean? @map("is_active") @default(true)
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  project Project @relation(fields: [projectId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  externalLinks ExternalLink[]
+  @@unique([projectId, type], map: "integration_project_type_unique")
+  @@index([projectId], map: "integration_projectId_idx")
+  @@index([type], map: "integration_type_idx")
+  @@map("integration")
+}
+
+model ExternalLink {
+  id String @id @default(cuid())
+  taskId String @map("task_id")
+  integrationId String @map("integration_id")
+  resourceType String @map("resource_type")
+  externalId String @map("external_id")
+  url String
+  title String?
+  metadata String?
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  task ProjectTask @relation(fields: [taskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  integration Integration @relation(fields: [integrationId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([taskId], map: "external_link_taskId_idx")
+  @@index([integrationId], map: "external_link_integrationId_idx")
+  @@index([externalId], map: "external_link_externalId_idx")
+  @@index([resourceType], map: "external_link_resourceType_idx")
+  @@map("external_link")
+}
+
+model TaskComment {
+  id String @id @default(cuid())
+  taskId String @map("task_id")
+  userId String @map("user_id")
+  content String
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  task ProjectTask @relation(fields: [taskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([taskId], map: "comment_task_idx")
+  @@index([userId], map: "comment_user_idx")
+  @@map("comment")
+}
+
+model TaskRelation {
+  id String @id @default(cuid())
+  sourceTaskId String @map("source_task_id")
+  targetTaskId String @map("target_task_id")
+  relationType String @map("relation_type")
+  createdAt DateTime @map("created_at") @default(now())
+  sourceTask ProjectTask @relation(fields: [sourceTaskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  targetTask ProjectTask @relation("TaskRelationToProjectTask_1", fields: [targetTaskId], references: [id], onDelete: Cascade, onUpdate: Cascade)
+  @@index([sourceTaskId], map: "task_relation_source_idx")
+  @@index([targetTaskId], map: "task_relation_target_idx")
+  @@map("task_relation")
+}
+
+model DeviceCode {
+  id String @id @default(cuid())
+  deviceCode String @map("device_code")
+  userCode String @map("user_code")
+  userId String? @map("user_id")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  expiresAt DateTime @map("expires_at")
+  status String
+  lastPolledAt DateTime? @map("last_polled_at")
+  pollingInterval Int? @map("polling_interval")
+  clientId String? @map("client_id")
+  scope String?
+  @@index([userId], map: "device_code_user_id_idx")
+  @@map("device_code")
+}
+
+model McpOauthState {
+  id String @id @default(cuid())
+  kind String
+  key String
+  payload Json
+  expiresAt DateTime @map("expires_at")
+  createdAt DateTime @map("created_at") @default(now())
+  updatedAt DateTime @map("updated_at") @default(now()) @updatedAt
+  @@index([expiresAt], map: "mcp_oauth_state_expiresAt_idx")
+  @@map("mcp_oauth_state")
+}
\ No newline at end of file
diff --git a/packages/kaneo-domain/package.json b/packages/kaneo-domain/package.json
new file mode 100644
index 000000000..977b56079
--- /dev/null
+++ b/packages/kaneo-domain/package.json
@@ -0,0 +1,24 @@
+{
+	"name": "@crm/kaneo-domain",
+	"version": "0.0.0",
+	"private": true,
+	"type": "module",
+	"exports": {
+		".": "./src/index.ts",
+		"./drizzle": "./src/drizzle.ts"
+	},
+	"scripts": {
+		"check-types": "tsc --noEmit",
+		"lint": "biome check .",
+		"test": "bun test",
+		"generate:prisma": "bun scripts/generate-prisma.ts",
+		"clean": "rm -rf .turbo node_modules"
+	},
+	"devDependencies": {
+		"@crm/typescript-config": "workspace:*",
+		"@paralleldrive/cuid2": "^3.3.0",
+		"@types/node": "^26.5.0",
+		"drizzle-orm": "^0.45.2",
+		"typescript": "7.0.2"
+	}
+}
diff --git a/packages/kaneo-domain/scripts/generate-prisma.ts b/packages/kaneo-domain/scripts/generate-prisma.ts
new file mode 100644
index 000000000..8f64cd999
--- /dev/null
+++ b/packages/kaneo-domain/scripts/generate-prisma.ts
@@ -0,0 +1,15 @@
+import { writeFileSync } from "node:fs";
+import path from "node:path";
+import {
+	DEFAULT_EXCLUDE,
+	DEFAULT_RENAME,
+	kaneoSchema,
+	toPrismaFragment,
+} from "../src/index";
+
+const fragment = toPrismaFragment(kaneoSchema, {
+	exclude: DEFAULT_EXCLUDE,
+	rename: DEFAULT_RENAME,
+});
+writeFileSync(path.join(import.meta.dir, "..", "kaneo.prisma"), fragment);
+console.log(`wrote kaneo.prisma (${fragment.split("\n").length} lines)`);
diff --git a/packages/kaneo-domain/src/drizzle.ts b/packages/kaneo-domain/src/drizzle.ts
new file mode 100644
index 000000000..9b0f3488e
--- /dev/null
+++ b/packages/kaneo-domain/src/drizzle.ts
@@ -0,0 +1,220 @@
+import { createId } from "@paralleldrive/cuid2";
+import { sql, Table } from "drizzle-orm";
+import {
+	boolean,
+	customType,
+	foreignKey,
+	index,
+	integer,
+	jsonb,
+	pgTable,
+	text,
+	timestamp,
+	unique,
+	uniqueIndex,
+} from "drizzle-orm/pg-core";
+import type {
+	ColumnDef,
+	ColumnRef,
+	ForeignKeyDef,
+	IndexDef,
+	SchemaDef,
+	TableDef,
+} from "./dsl";
+
+const bytea = customType<{ data: Buffer; driverData: Buffer }>({
+	dataType() {
+		return "bytea";
+	},
+});
+
+type PgTable = ReturnType<typeof pgTable>;
+type Column = ReturnType<typeof text>;
+
+const tableNameSymbol = (
+	Table as unknown as { Symbol: { Name: symbol; Columns: symbol } }
+).Symbol;
+
+export interface DrizzleSchema {
+	tables: Record<string, PgTable>;
+	columns: Record<string, Record<string, Column>>;
+}
+
+function buildColumn(
+	def: ColumnDef,
+	resolveRef: (ref: ColumnRef) => Column,
+): any {
+	let col: any;
+	switch (def.type) {
+		case "text":
+			col = text(def.name);
+			break;
+		case "boolean":
+			col = boolean(def.name);
+			break;
+		case "integer":
+			col = integer(def.name);
+			break;
+		case "timestamp":
+			col = timestamp(def.name, {
+				mode: "date",
+				withTimezone: def.withTimezone,
+			});
+			break;
+		case "jsonb":
+			col = jsonb(def.name);
+			break;
+		case "bytea":
+			col = bytea(def.name);
+			break;
+	}
+
+	if (def.primary) {
+		col = col.primaryKey();
+	}
+	if (def.notNull) {
+		col = col.notNull();
+	}
+	if (def.unique !== null) {
+		col = def.unique === "" ? col.unique() : col.unique(def.unique);
+	}
+	const defaultValue = def.default;
+	if (defaultValue) {
+		switch (defaultValue.kind) {
+			case "literal":
+				col = col.default(defaultValue.value);
+				break;
+			case "now":
+				col = col.defaultNow();
+				break;
+			case "cuid":
+				col = col.$defaultFn(() => createId());
+				break;
+			case "client":
+				col =
+					defaultValue.value === false
+						? col.$defaultFn(() => false)
+						: defaultValue.value === true
+							? col.$defaultFn(() => true)
+							: col.$defaultFn(() => defaultValue.value);
+				break;
+		}
+	}
+	if (def.onUpdateNow) {
+		col = col.$onUpdate(() => new Date());
+	}
+	const ref = def.ref;
+	if (ref) {
+		col = col.references(() => resolveRef(ref), {
+			onDelete: ref.onDelete,
+			onUpdate: ref.onUpdate,
+		});
+	}
+	return col;
+}
+
+function buildIndexes(def: TableDef, t: Record<string, any>) {
+	const build = (idx: IndexDef) => {
+		const cols = idx.columns.map((c) => t[c]) as [any, ...any[]];
+		switch (idx.kind) {
+			case "unique":
+				return unique(idx.name).on(...cols);
+			case "uniqueIndex":
+				return idx.where
+					? uniqueIndex(idx.name)
+							.on(...cols)
+							.where(sql.raw(idx.where))
+					: uniqueIndex(idx.name).on(...cols);
+			case "index":
+				return index(idx.name).on(...cols);
+		}
+	};
+	return (def.indexes ?? []).map(build);
+}
+
+function buildForeignKeys(
+	def: TableDef,
+	t: Record<string, any>,
+	resolveTargetColumn: (table: string, column: string) => Column,
+) {
+	const build = (fk: ForeignKeyDef) => {
+		const localColumns: any = fk.columns.map((c) => t[c]);
+		const foreignColumns: any = fk.refColumns.map((c) =>
+			resolveTargetColumn(fk.refTable, c),
+		);
+		const fkBuilder = foreignKey({ columns: localColumns, foreignColumns });
+		if (fk.onDelete) {
+			fkBuilder.onDelete(fk.onDelete);
+		}
+		if (fk.onUpdate) {
+			fkBuilder.onUpdate(fk.onUpdate);
+		}
+		return fkBuilder;
+	};
+	return (def.foreignKeys ?? []).map(build);
+}
+
+export function toDrizzleSchema(schema: SchemaDef): DrizzleSchema {
+	const built: Record<string, PgTable> = {};
+	const columns: Record<string, Record<string, Column>> = {};
+
+	const resolveRef = (ref: ColumnRef): Column => {
+		const tableColumns = columns[ref.table];
+		if (!tableColumns) {
+			throw new Error(
+				`kaneo domain: ref target table ${ref.table} is not built`,
+			);
+		}
+		const refColumn = ref.columns[0];
+		if (!refColumn) {
+			throw new Error(
+				`kaneo domain: ref target column ${ref.table} has no columns`,
+			);
+		}
+		const col = tableColumns[refColumn];
+		if (!col) {
+			throw new Error(
+				`kaneo domain: ref target column ${ref.table}.${refColumn} is not built`,
+			);
+		}
+		return col;
+	};
+
+	const attachedColumns = (table: unknown) =>
+		(table as Record<PropertyKey, unknown>)[tableNameSymbol.Columns] as
+			| Record<string, Column>
+			| undefined;
+
+	for (const def of schema.tables) {
+		const columnBuilders: Record<string, Column> = {};
+		for (const column of def.columns) {
+			columnBuilders[column.key] = buildColumn(column, resolveRef);
+		}
+		const table = pgTable(def.name, columnBuilders, (t) => [
+			...buildIndexes(def, t),
+			...buildForeignKeys(def, t, (tableName, columnName) => {
+				const targetColumns = columns[tableName];
+				const column = targetColumns?.[columnName];
+				if (!column) {
+					throw new Error(
+						`kaneo domain: fk target column ${tableName}.${columnName} is not built`,
+					);
+				}
+				return column;
+			}),
+		]);
+		built[def.name] = table;
+		const tableColumnsMap: Record<string, Column> = {};
+		columns[def.name] = tableColumnsMap;
+		for (const column of Object.values(attachedColumns(table) ?? {})) {
+			const loose = column as unknown as {
+				config?: { name?: string };
+				name?: string;
+			};
+			const physical = loose.config?.name ?? loose.name ?? "";
+			tableColumnsMap[physical] = column;
+		}
+	}
+
+	return { tables: built, columns };
+}
diff --git a/packages/kaneo-domain/src/dsl.ts b/packages/kaneo-domain/src/dsl.ts
new file mode 100644
index 000000000..d0ab9c186
--- /dev/null
+++ b/packages/kaneo-domain/src/dsl.ts
@@ -0,0 +1,207 @@
+export type ColumnType =
+	| "text"
+	| "boolean"
+	| "integer"
+	| "timestamp"
+	| "jsonb"
+	| "bytea";
+
+export type RefAction = "cascade" | "set null" | "restrict";
+
+export interface ColumnRef {
+	table: string;
+	columns: string[];
+	onDelete?: RefAction;
+	onUpdate?: RefAction;
+}
+
+export type ColumnDefault =
+	| { kind: "literal"; value: string | number | boolean }
+	| { kind: "now" }
+	| { kind: "cuid" }
+	| { kind: "client"; value: string | number | boolean };
+
+export interface ColumnDef {
+	key: string;
+	name: string;
+	type: ColumnType;
+	withTimezone: boolean;
+	notNull: boolean;
+	primary: boolean;
+	unique: string | null;
+	default: ColumnDefault | null;
+	onUpdateNow: boolean;
+	ref: ColumnRef | null;
+}
+
+export interface IndexDef {
+	name: string;
+	columns: string[];
+	kind: "index" | "unique" | "uniqueIndex";
+	where?: string;
+}
+
+export interface ForeignKeyDef {
+	name?: string;
+	columns: string[];
+	refTable: string;
+	refColumns: string[];
+	onDelete?: RefAction;
+	onUpdate?: RefAction;
+}
+
+export interface TableDef {
+	name: string;
+	columns: ColumnDef[];
+	indexes?: IndexDef[];
+	foreignKeys?: ForeignKeyDef[];
+}
+
+export class ColumnBuilder {
+	private readonly def: ColumnDef;
+
+	constructor(key: string, name: string, type: ColumnType) {
+		this.def = {
+			key,
+			name,
+			type,
+			withTimezone: false,
+			notNull: false,
+			primary: false,
+			unique: null,
+			default: null,
+			onUpdateNow: false,
+			ref: null,
+		};
+	}
+
+	pk(): this {
+		this.def.primary = true;
+		return this;
+	}
+
+	notNull(): this {
+		this.def.notNull = true;
+		return this;
+	}
+
+	unique(name?: string): this {
+		this.def.unique = name ?? "";
+		return this;
+	}
+
+	default(value: string | number | boolean): this {
+		this.def.default = { kind: "literal", value };
+		return this;
+	}
+
+	defaultNow(): this {
+		this.def.default = { kind: "now" };
+		return this;
+	}
+
+	defaultCuid(): this {
+		this.def.default = { kind: "cuid" };
+		return this;
+	}
+
+	clientDefault(value: string | number | boolean): this {
+		this.def.default = { kind: "client", value };
+		return this;
+	}
+
+	onUpdateNow(): this {
+		this.def.onUpdateNow = true;
+		return this;
+	}
+
+	withTimezone(): this {
+		this.def.withTimezone = true;
+		return this;
+	}
+
+	ref(
+		table: string,
+		opts?: { columns?: string[]; onDelete?: RefAction; onUpdate?: RefAction },
+	): this {
+		this.def.ref = {
+			table,
+			columns: opts?.columns ?? ["id"],
+			onDelete: opts?.onDelete,
+			onUpdate: opts?.onUpdate,
+		};
+		return this;
+	}
+
+	toDef(): ColumnDef {
+		return this.def;
+	}
+}
+
+export const t = {
+	text: (key: string, name: string) => new ColumnBuilder(key, name, "text"),
+	boolean: (key: string, name: string) =>
+		new ColumnBuilder(key, name, "boolean"),
+	integer: (key: string, name: string) =>
+		new ColumnBuilder(key, name, "integer"),
+	timestamp: (key: string, name: string) =>
+		new ColumnBuilder(key, name, "timestamp"),
+	jsonb: (key: string, name: string) => new ColumnBuilder(key, name, "jsonb"),
+	bytea: (key: string, name: string) => new ColumnBuilder(key, name, "bytea"),
+};
+
+export function table(
+	name: string,
+	columns: Record<string, ColumnBuilder>,
+	opts?: { indexes?: IndexDef[]; foreignKeys?: ForeignKeyDef[] },
+): TableDef {
+	return {
+		name,
+		columns: Object.entries(columns).map(([key, builder]) => builder.toDef()),
+		indexes: opts?.indexes,
+		foreignKeys: opts?.foreignKeys,
+	};
+}
+
+export function index(name: string, columns: string[]): IndexDef {
+	return { name, columns, kind: "index" };
+}
+
+export function unique(name: string, columns: string[]): IndexDef {
+	return { name, columns, kind: "unique" };
+}
+
+export function uniqueIndex(
+	name: string,
+	columns: string[],
+	where?: string,
+): IndexDef {
+	return { name, columns, kind: "uniqueIndex", where };
+}
+
+export function foreignKey(def: {
+	name?: string;
+	columns: string[];
+	refTable: string;
+	refColumns: string[];
+	onDelete?: RefAction;
+	onUpdate?: RefAction;
+}): ForeignKeyDef {
+	return def;
+}
+
+export interface SchemaDef {
+	tables: TableDef[];
+}
+
+export function defineSchema(tables: TableDef[]): SchemaDef {
+	return { tables };
+}
+
+export function schemaTable(schema: SchemaDef, name: string): TableDef {
+	const found = schema.tables.find((t) => t.name === name);
+	if (!found) {
+		throw new Error(`kaneo domain: no table named ${name}`);
+	}
+	return found;
+}
diff --git a/packages/kaneo-domain/src/index.ts b/packages/kaneo-domain/src/index.ts
new file mode 100644
index 000000000..2d957632d
--- /dev/null
+++ b/packages/kaneo-domain/src/index.ts
@@ -0,0 +1,4 @@
+export { toDrizzleSchema } from "./drizzle";
+export * from "./dsl";
+export { kaneoSchema } from "./kaneo";
+export { DEFAULT_EXCLUDE, DEFAULT_RENAME, toPrismaFragment } from "./prisma";
diff --git a/packages/kaneo-domain/src/kaneo.ts b/packages/kaneo-domain/src/kaneo.ts
new file mode 100644
index 000000000..dafb363f8
--- /dev/null
+++ b/packages/kaneo-domain/src/kaneo.ts
@@ -0,0 +1,1043 @@
+import {
+	defineSchema,
+	foreignKey,
+	index,
+	t,
+	table,
+	unique,
+	uniqueIndex,
+} from "./dsl";
+
+export const kaneoSchema = defineSchema([
+	table("user", {
+		id: t.text("id", "id").pk().defaultCuid(),
+		name: t.text("name", "name").notNull(),
+		email: t.text("email", "email").notNull().unique(),
+		emailVerified: t
+			.boolean("emailVerified", "emailVerified")
+			.notNull()
+			.clientDefault(false),
+		image: t.text("image", "image"),
+		locale: t.text("locale", "locale"),
+		createdAt: t.timestamp("createdAt", "createdAt").defaultNow().notNull(),
+		updatedAt: t
+			.timestamp("updatedAt", "updatedAt")
+			.defaultNow()
+			.onUpdateNow()
+			.notNull(),
+		isAnonymous: t.boolean("isAnonymous", "isAnonymous").default(false),
+		role: t.text("role", "role"),
+		banned: t.boolean("banned", "banned").default(false),
+		banReason: t.text("banReason", "banReason"),
+		banExpires: t.timestamp("banExpires", "banExpires"),
+	}),
+	table(
+		"session",
+		{
+			id: t.text("id", "id").pk(),
+			expiresAt: t.timestamp("expiresAt", "expiresAt").notNull(),
+			token: t.text("token", "token").notNull().unique(),
+			createdAt: t.timestamp("createdAt", "createdAt").defaultNow().notNull(),
+			updatedAt: t.timestamp("updatedAt", "updatedAt").onUpdateNow().notNull(),
+			ipAddress: t.text("ipAddress", "ipAddress"),
+			userAgent: t.text("userAgent", "userAgent"),
+			userId: t
+				.text("userId", "userId")
+				.notNull()
+				.ref("user", { onDelete: "cascade" }),
+			activeOrganizationId: t.text(
+				"activeOrganizationId",
+				"activeOrganizationId",
+			),
+			activeTeamId: t.text("activeTeamId", "activeTeamId"),
+			impersonatedBy: t.text("impersonatedBy", "impersonatedBy"),
+		},
+		{
+			indexes: [index("session_userId_idx", ["userId"])],
+		},
+	),
+	table(
+		"account",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			accountId: t.text("accountId", "accountId").notNull(),
+			providerId: t.text("providerId", "providerId").notNull(),
+			userId: t
+				.text("userId", "userId")
+				.notNull()
+				.ref("user", { onDelete: "cascade" }),
+			accessToken: t.text("accessToken", "accessToken"),
+			refreshToken: t.text("refreshToken", "refreshToken"),
+			idToken: t.text("idToken", "idToken"),
+			accessTokenExpiresAt: t.timestamp(
+				"accessTokenExpiresAt",
+				"accessToken_expires_at",
+			),
+			refreshTokenExpiresAt: t.timestamp(
+				"refreshTokenExpiresAt",
+				"refreshToken_expires_at",
+			),
+			scope: t.text("scope", "scope"),
+			password: t.text("password", "password"),
+			createdAt: t.timestamp("createdAt", "createdAt").defaultNow().notNull(),
+			updatedAt: t.timestamp("updatedAt", "updatedAt").onUpdateNow().notNull(),
+		},
+		{
+			indexes: [index("account_userId_idx", ["userId"])],
+		},
+	),
+	table(
+		"user_avatar",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			userId: t
+				.text("userId", "user_id")
+				.notNull()
+				.unique("user_avatar_user_id_unique")
+				.ref("user", { onDelete: "cascade", onUpdate: "cascade" }),
+			mimeType: t.text("mimeType", "mime_type").notNull(),
+			size: t.integer("size", "size").notNull(),
+			data: t.bytea("data", "data").notNull(),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [index("user_avatar_userId_idx", ["userId"])],
+		},
+	),
+	table(
+		"verification",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			identifier: t.text("identifier", "identifier").notNull(),
+			value: t.text("value", "value").notNull(),
+			expiresAt: t.timestamp("expiresAt", "expiresAt").notNull(),
+			createdAt: t.timestamp("createdAt", "createdAt").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updatedAt")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [index("verification_identifier_idx", ["identifier"])],
+		},
+	),
+	table("workspace", {
+		id: t.text("id", "id").pk().defaultCuid(),
+		name: t.text("name", "name").notNull(),
+		slug: t.text("slug", "slug").notNull().unique(),
+		logo: t.text("logo", "logo"),
+		metadata: t.text("metadata", "metadata"),
+		description: t.text("description", "description"),
+		createdAt: t.timestamp("createdAt", "created_at").notNull(),
+	}),
+	table(
+		"workspace_member",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			workspaceId: t
+				.text("workspaceId", "workspace_id")
+				.notNull()
+				.ref("workspace", { onDelete: "cascade" }),
+			userId: t
+				.text("userId", "user_id")
+				.notNull()
+				.ref("user", { onDelete: "cascade" }),
+			role: t.text("role", "role").notNull().default("member"),
+			joinedAt: t.timestamp("joinedAt", "joined_at").notNull(),
+		},
+		{
+			indexes: [
+				index("workspace_member_workspaceId_idx", ["workspaceId"]),
+				index("workspace_member_userId_idx", ["userId"]),
+			],
+		},
+	),
+	table(
+		"workspace_billing",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			workspaceId: t
+				.text("workspaceId", "workspace_id")
+				.notNull()
+				.unique("workspace_billing_workspace_id_unique")
+				.ref("workspace", { onDelete: "cascade", onUpdate: "cascade" }),
+			foundingFree: t
+				.boolean("foundingFree", "founding_free")
+				.notNull()
+				.default(false),
+			trialEndsAt: t.timestamp("trialEndsAt", "trial_ends_at"),
+			creemCustomerId: t.text("creemCustomerId", "creem_customer_id"),
+			creemSubscriptionId: t
+				.text("creemSubscriptionId", "creem_subscription_id")
+				.unique(),
+			creemProductId: t.text("creemProductId", "creem_product_id"),
+			plan: t.text("plan", "plan"),
+			billingInterval: t.text("billingInterval", "billing_interval"),
+			status: t.text("status", "status"),
+			seats: t.integer("seats", "seats").notNull().default(1),
+			currentPeriodEnd: t.timestamp("currentPeriodEnd", "current_period_end"),
+			canceledAt: t.timestamp("canceledAt", "canceled_at"),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [index("workspace_billing_workspaceId_idx", ["workspaceId"])],
+		},
+	),
+	table("trial_grant", {
+		emailHash: t.text("emailHash", "email_hash").pk(),
+		trialEndsAt: t.timestamp("trialEndsAt", "trial_ends_at").notNull(),
+		createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+	}),
+	table("billing_event", {
+		id: t.text("id", "id").pk(),
+		eventType: t.text("eventType", "event_type").notNull(),
+		processedAt: t
+			.timestamp("processedAt", "processed_at")
+			.defaultNow()
+			.notNull(),
+	}),
+	table(
+		"team",
+		{
+			id: t.text("id", "id").pk(),
+			name: t.text("name", "name").notNull(),
+			workspaceId: t
+				.text("workspaceId", "workspace_id")
+				.notNull()
+				.ref("workspace", { onDelete: "cascade" }),
+			createdAt: t.timestamp("createdAt", "created_at").notNull(),
+			updatedAt: t.timestamp("updatedAt", "updated_at").onUpdateNow(),
+		},
+		{
+			indexes: [index("team_workspaceId_idx", ["workspaceId"])],
+		},
+	),
+	table(
+		"team_member",
+		{
+			id: t.text("id", "id").pk(),
+			teamId: t
+				.text("teamId", "team_id")
+				.notNull()
+				.ref("team", { onDelete: "cascade" }),
+			userId: t
+				.text("userId", "user_id")
+				.notNull()
+				.ref("user", { onDelete: "cascade" }),
+			createdAt: t.timestamp("createdAt", "created_at"),
+		},
+		{
+			indexes: [
+				index("teamMember_teamId_idx", ["teamId"]),
+				index("teamMember_userId_idx", ["userId"]),
+			],
+		},
+	),
+	table(
+		"workspace_invitation",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			workspaceId: t
+				.text("workspaceId", "workspace_id")
+				.notNull()
+				.ref("workspace", { onDelete: "cascade" }),
+			email: t.text("email", "email").notNull(),
+			role: t.text("role", "role"),
+			teamId: t.text("teamId", "team_id"),
+			status: t.text("status", "status").notNull().default("pending"),
+			expiresAt: t.timestamp("expiresAt", "expires_at").notNull(),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			inviterId: t
+				.text("inviterId", "inviter_id")
+				.notNull()
+				.ref("user", { onDelete: "cascade" }),
+		},
+		{
+			indexes: [
+				index("workspace_invitation_workspaceId_idx", ["workspaceId"]),
+				index("workspace_invitation_email_idx", ["email"]),
+				index("workspace_invitation_inviterId_idx", ["inviterId"]),
+			],
+		},
+	),
+	table(
+		"workspace_role",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			workspaceId: t
+				.text("workspaceId", "workspace_id")
+				.notNull()
+				.ref("workspace", { onDelete: "cascade", onUpdate: "cascade" }),
+			role: t.text("role", "role").notNull(),
+			permission: t.text("permission", "permission").notNull(),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [
+				index("workspace_role_workspaceId_idx", ["workspaceId"]),
+				index("workspace_role_role_idx", ["role"]),
+			],
+		},
+	),
+	table(
+		"project",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			workspaceId: t
+				.text("workspaceId", "workspace_id")
+				.notNull()
+				.ref("workspace", { onDelete: "cascade", onUpdate: "cascade" }),
+			slug: t.text("slug", "slug").notNull(),
+			icon: t.text("icon", "icon").default("Layout"),
+			name: t.text("name", "name").notNull(),
+			description: t.text("description", "description"),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			isPublic: t.boolean("isPublic", "is_public").default(false),
+			archivedAt: t.timestamp("archivedAt", "archived_at"),
+			lastTaskNumber: t
+				.integer("lastTaskNumber", "last_task_number")
+				.notNull()
+				.default(0),
+			position: t.integer("position", "position").notNull().default(0),
+		},
+		{
+			indexes: [
+				unique("project_workspace_id_id_unique", ["workspaceId", "id"]),
+				index("project_workspaceId_position_idx", ["workspaceId", "position"]),
+			],
+		},
+	),
+	table(
+		"column",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			projectId: t
+				.text("projectId", "project_id")
+				.notNull()
+				.ref("project", { onDelete: "cascade", onUpdate: "cascade" }),
+			name: t.text("name", "name").notNull(),
+			slug: t.text("slug", "slug").notNull(),
+			position: t.integer("position", "position").notNull().default(0),
+			icon: t.text("icon", "icon"),
+			color: t.text("color", "color"),
+			isFinal: t.boolean("isFinal", "is_final").notNull().default(false),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [index("column_projectId_idx", ["projectId"])],
+		},
+	),
+	table(
+		"workflow_rule",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			projectId: t
+				.text("projectId", "project_id")
+				.notNull()
+				.ref("project", { onDelete: "cascade", onUpdate: "cascade" }),
+			integrationType: t.text("integrationType", "integration_type").notNull(),
+			eventType: t.text("eventType", "event_type").notNull(),
+			columnId: t
+				.text("columnId", "column_id")
+				.notNull()
+				.ref("column", { onDelete: "cascade", onUpdate: "cascade" }),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [
+				index("workflow_rule_projectId_idx", ["projectId"]),
+				index("workflow_rule_columnId_idx", ["columnId"]),
+			],
+		},
+	),
+	table(
+		"task",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			projectId: t
+				.text("projectId", "project_id")
+				.notNull()
+				.ref("project", { onDelete: "cascade", onUpdate: "cascade" }),
+			position: t.integer("position", "position").default(0),
+			number: t.integer("number", "number").default(1),
+			userId: t
+				.text("userId", "assignee_id")
+				.ref("user", { onDelete: "set null", onUpdate: "cascade" }),
+			title: t.text("title", "title").notNull(),
+			description: t.text("description", "description"),
+			status: t.text("status", "status").notNull().default("to-do"),
+			columnId: t
+				.text("columnId", "column_id")
+				.ref("column", { onDelete: "set null", onUpdate: "cascade" }),
+			priority: t.text("priority", "priority").notNull().default("low"),
+			startDate: t.timestamp("startDate", "start_date"),
+			dueDate: t.timestamp("dueDate", "due_date"),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [
+				index("task_projectId_idx", ["projectId"]),
+				index("task_dueDate_idx", ["dueDate"]),
+				index("task_assigneeId_idx", ["userId"]),
+				index("task_columnId_idx", ["columnId"]),
+				unique("task_project_number_unique", ["projectId", "number"]),
+			],
+		},
+	),
+	table(
+		"billing_reminder_sent",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			userId: t
+				.text("userId", "user_id")
+				.notNull()
+				.ref("user", { onDelete: "cascade", onUpdate: "cascade" }),
+			workspaceId: t
+				.text("workspaceId", "workspace_id")
+				.notNull()
+				.ref("workspace", { onDelete: "cascade", onUpdate: "cascade" }),
+			reminderType: t.text("reminderType", "reminder_type").notNull(),
+			trialEndsAt: t.timestamp("trialEndsAt", "trial_ends_at"),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [
+				index("billing_reminder_sent_workspaceId_idx", ["workspaceId"]),
+				index("billing_reminder_sent_userId_idx", ["userId"]),
+				unique("billing_reminder_sent_user_type_unique", [
+					"userId",
+					"reminderType",
+				]),
+			],
+		},
+	),
+	table("job_lease", {
+		name: t.text("name", "name").pk(),
+		owner: t.text("owner", "owner").notNull(),
+		expiresAt: t.timestamp("expiresAt", "expires_at").notNull(),
+	}),
+	table(
+		"task_reminder_sent",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			taskId: t
+				.text("taskId", "task_id")
+				.notNull()
+				.ref("task", { onDelete: "cascade", onUpdate: "cascade" }),
+			reminderType: t.text("reminderType", "reminder_type").notNull(),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [
+				index("task_reminder_sent_taskId_idx", ["taskId"]),
+				unique("task_reminder_sent_task_type_unique", [
+					"taskId",
+					"reminderType",
+				]),
+			],
+		},
+	),
+	table(
+		"time_entry",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			taskId: t
+				.text("taskId", "task_id")
+				.notNull()
+				.ref("task", { onDelete: "cascade", onUpdate: "cascade" }),
+			userId: t
+				.text("userId", "user_id")
+				.ref("user", { onDelete: "set null", onUpdate: "cascade" }),
+			description: t.text("description", "description"),
+			startTime: t.timestamp("startTime", "start_time").notNull(),
+			endTime: t.timestamp("endTime", "end_time"),
+			duration: t.integer("duration", "duration").default(0),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [
+				index("time_entry_taskId_idx", ["taskId"]),
+				index("time_entry_userId_idx", ["userId"]),
+			],
+		},
+	),
+	table(
+		"task_activity",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			taskId: t
+				.text("taskId", "task_id")
+				.notNull()
+				.ref("task", { onDelete: "cascade", onUpdate: "cascade" }),
+			type: t.text("type", "type").notNull(),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+			userId: t
+				.text("userId", "user_id")
+				.ref("user", { onDelete: "set null", onUpdate: "cascade" }),
+			content: t.text("content", "content"),
+			eventData: t.jsonb("eventData", "event_data"),
+			externalUserName: t.text("externalUserName", "external_user_name"),
+			externalUserAvatar: t.text("externalUserAvatar", "external_user_avatar"),
+			externalSource: t.text("externalSource", "external_source"),
+			externalUrl: t.text("externalUrl", "external_url"),
+		},
+		{
+			indexes: [
+				index("activity_task_id_idx", ["taskId"]),
+				index("activity_userId_idx", ["userId"]),
+				unique("activity_task_external_source_external_url_unique", [
+					"taskId",
+					"externalSource",
+					"externalUrl",
+				]),
+			],
+		},
+	),
+	table(
+		"asset",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			workspaceId: t
+				.text("workspaceId", "workspace_id")
+				.notNull()
+				.ref("workspace", { onDelete: "cascade", onUpdate: "cascade" }),
+			projectId: t
+				.text("projectId", "project_id")
+				.notNull()
+				.ref("project", { onDelete: "cascade", onUpdate: "cascade" }),
+			taskId: t
+				.text("taskId", "task_id")
+				.ref("task", { onDelete: "cascade", onUpdate: "cascade" }),
+			activityId: t
+				.text("activityId", "activity_id")
+				.ref("task_activity", { onDelete: "cascade", onUpdate: "cascade" }),
+			objectKey: t.text("objectKey", "object_key").notNull().unique(),
+			filename: t.text("filename", "filename").notNull(),
+			mimeType: t.text("mimeType", "mime_type").notNull(),
+			size: t.integer("size", "size").notNull(),
+			kind: t.text("kind", "kind").notNull().default("image"),
+			surface: t.text("surface", "surface").notNull().default("description"),
+			createdBy: t
+				.text("createdBy", "created_by")
+				.ref("user", { onDelete: "set null", onUpdate: "cascade" }),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+		},
+		{
+			indexes: [
+				index("asset_workspaceId_idx", ["workspaceId"]),
+				index("asset_projectId_idx", ["projectId"]),
+				index("asset_taskId_idx", ["taskId"]),
+				index("asset_activityId_idx", ["activityId"]),
+				index("asset_createdBy_idx", ["createdBy"]),
+			],
+		},
+	),
+	table(
+		"label",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			name: t.text("name", "name").notNull(),
+			color: t.text("color", "color").notNull(),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+			taskId: t
+				.text("taskId", "task_id")
+				.ref("task", { onDelete: "cascade", onUpdate: "cascade" }),
+			workspaceId: t
+				.text("workspaceId", "workspace_id")
+				.ref("workspace", { onDelete: "cascade", onUpdate: "cascade" }),
+		},
+		{
+			indexes: [
+				index("label_task_id_idx", ["taskId"]),
+				index("label_workspace_id_idx", ["workspaceId"]),
+				unique("label_task_name_unique", ["taskId", "name"]),
+				uniqueIndex(
+					"label_workspace_name_unique",
+					["workspaceId", "name"],
+					"task_id is null",
+				),
+			],
+		},
+	),
+	table(
+		"notification",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			userId: t
+				.text("userId", "user_id")
+				.notNull()
+				.ref("user", { onDelete: "cascade", onUpdate: "cascade" }),
+			title: t.text("title", "title"),
+			content: t.text("content", "content"),
+			type: t.text("type", "type").notNull().default("info"),
+			eventData: t.jsonb("eventData", "event_data"),
+			isRead: t.boolean("isRead", "is_read").default(false),
+			resourceId: t.text("resourceId", "resource_id"),
+			resourceType: t.text("resourceType", "resource_type"),
+			createdAt: t
+				.timestamp("createdAt", "created_at")
+				.withTimezone()
+				.defaultNow()
+				.notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.withTimezone()
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [index("notification_userId_idx", ["userId"])],
+		},
+	),
+	table("user_notification_preference", {
+		id: t.text("id", "id").pk().defaultCuid(),
+		userId: t
+			.text("userId", "user_id")
+			.notNull()
+			.unique()
+			.ref("user", { onDelete: "cascade", onUpdate: "cascade" }),
+		emailEnabled: t
+			.boolean("emailEnabled", "email_enabled")
+			.notNull()
+			.default(false),
+		ntfyEnabled: t
+			.boolean("ntfyEnabled", "ntfy_enabled")
+			.notNull()
+			.default(false),
+		ntfyServerUrl: t.text("ntfyServerUrl", "ntfy_server_url"),
+		ntfyTopic: t.text("ntfyTopic", "ntfy_topic"),
+		ntfyToken: t.text("ntfyToken", "ntfy_token"),
+		gotifyEnabled: t
+			.boolean("gotifyEnabled", "gotify_enabled")
+			.notNull()
+			.default(false),
+		gotifyServerUrl: t.text("gotifyServerUrl", "gotify_server_url"),
+		gotifyToken: t.text("gotifyToken", "gotify_token"),
+		webhookEnabled: t
+			.boolean("webhookEnabled", "webhook_enabled")
+			.notNull()
+			.default(false),
+		webhookUrl: t.text("webhookUrl", "webhook_url"),
+		webhookSecret: t.text("webhookSecret", "webhook_secret"),
+		taskAssignmentEnabled: t
+			.boolean("taskAssignmentEnabled", "task_assignment_enabled")
+			.notNull()
+			.default(true),
+		taskCommentEnabled: t
+			.boolean("taskCommentEnabled", "task_comment_enabled")
+			.notNull()
+			.default(true),
+		taskStatusChangeEnabled: t
+			.boolean("taskStatusChangeEnabled", "task_status_change_enabled")
+			.notNull()
+			.default(true),
+		dueDateReminderEnabled: t
+			.boolean("dueDateReminderEnabled", "due_date_reminder_enabled")
+			.notNull()
+			.default(true),
+		dueDateReminderLeadTimeMinutes: t
+			.integer(
+				"dueDateReminderLeadTimeMinutes",
+				"due_date_reminder_lead_time_minutes",
+			)
+			.notNull()
+			.default(1440),
+		createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+		updatedAt: t
+			.timestamp("updatedAt", "updated_at")
+			.defaultNow()
+			.onUpdateNow()
+			.notNull(),
+	}),
+	table(
+		"user_notification_workspace_rule",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			userId: t
+				.text("userId", "user_id")
+				.notNull()
+				.ref("user", { onDelete: "cascade", onUpdate: "cascade" }),
+			workspaceId: t
+				.text("workspaceId", "workspace_id")
+				.notNull()
+				.ref("workspace", { onDelete: "cascade", onUpdate: "cascade" }),
+			isActive: t.boolean("isActive", "is_active").notNull().default(true),
+			emailEnabled: t
+				.boolean("emailEnabled", "email_enabled")
+				.notNull()
+				.default(false),
+			ntfyEnabled: t
+				.boolean("ntfyEnabled", "ntfy_enabled")
+				.notNull()
+				.default(false),
+			gotifyEnabled: t
+				.boolean("gotifyEnabled", "gotify_enabled")
+				.notNull()
+				.default(false),
+			webhookEnabled: t
+				.boolean("webhookEnabled", "webhook_enabled")
+				.notNull()
+				.default(false),
+			projectMode: t
+				.text("projectMode", "project_mode")
+				.notNull()
+				.default("all"),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [
+				index("user_notification_workspace_rule_userId_idx", ["userId"]),
+				index("user_notification_workspace_rule_workspaceId_idx", [
+					"workspaceId",
+				]),
+				unique("user_notification_workspace_rule_user_workspace_unique", [
+					"userId",
+					"workspaceId",
+				]),
+				unique("user_notification_workspace_rule_workspace_id_id_unique", [
+					"workspaceId",
+					"id",
+				]),
+			],
+		},
+	),
+	table(
+		"user_notification_workspace_project",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			workspaceId: t
+				.text("workspaceId", "workspace_id")
+				.notNull()
+				.ref("workspace", { onDelete: "cascade", onUpdate: "cascade" }),
+			workspaceRuleId: t.text("workspaceRuleId", "workspace_rule_id").notNull(),
+			projectId: t.text("projectId", "project_id").notNull(),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [
+				index("user_notification_workspace_project_ruleId_idx", [
+					"workspaceRuleId",
+				]),
+				index("user_notification_workspace_project_projectId_idx", [
+					"projectId",
+				]),
+				index("user_notification_workspace_project_workspaceId_projectId_idx", [
+					"workspaceId",
+					"projectId",
+				]),
+				index("unwp_workspaceId_workspaceRuleId_idx", [
+					"workspaceId",
+					"workspaceRuleId",
+				]),
+				unique("user_notification_workspace_project_rule_project_unique", [
+					"workspaceRuleId",
+					"projectId",
+				]),
+			],
+			foreignKeys: [
+				foreignKey({
+					columns: ["workspaceId", "workspaceRuleId"],
+					refTable: "user_notification_workspace_rule",
+					refColumns: ["workspace_id", "id"],
+					onDelete: "cascade",
+					onUpdate: "cascade",
+				}),
+				foreignKey({
+					columns: ["workspaceId", "projectId"],
+					refTable: "project",
+					refColumns: ["workspace_id", "id"],
+					onDelete: "cascade",
+					onUpdate: "cascade",
+				}),
+			],
+		},
+	),
+	table("github_integration", {
+		id: t.text("id", "id").pk().defaultCuid(),
+		projectId: t
+			.text("projectId", "project_id")
+			.notNull()
+			.unique()
+			.ref("project", { onDelete: "cascade", onUpdate: "cascade" }),
+		repositoryOwner: t.text("repositoryOwner", "repository_owner").notNull(),
+		repositoryName: t.text("repositoryName", "repository_name").notNull(),
+		installationId: t.integer("installationId", "installation_id"),
+		isActive: t.boolean("isActive", "is_active").default(true),
+		createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+		updatedAt: t
+			.timestamp("updatedAt", "updated_at")
+			.defaultNow()
+			.onUpdateNow()
+			.notNull(),
+	}),
+	table(
+		"integration",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			projectId: t
+				.text("projectId", "project_id")
+				.notNull()
+				.ref("project", { onDelete: "cascade", onUpdate: "cascade" }),
+			type: t.text("type", "type").notNull(),
+			config: t.text("config", "config").notNull(),
+			isActive: t.boolean("isActive", "is_active").default(true),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [
+				index("integration_projectId_idx", ["projectId"]),
+				index("integration_type_idx", ["type"]),
+				unique("integration_project_type_unique", ["projectId", "type"]),
+			],
+		},
+	),
+	table(
+		"external_link",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			taskId: t
+				.text("taskId", "task_id")
+				.notNull()
+				.ref("task", { onDelete: "cascade", onUpdate: "cascade" }),
+			integrationId: t
+				.text("integrationId", "integration_id")
+				.notNull()
+				.ref("integration", { onDelete: "cascade", onUpdate: "cascade" }),
+			resourceType: t.text("resourceType", "resource_type").notNull(),
+			externalId: t.text("externalId", "external_id").notNull(),
+			url: t.text("url", "url").notNull(),
+			title: t.text("title", "title"),
+			metadata: t.text("metadata", "metadata"),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [
+				index("external_link_taskId_idx", ["taskId"]),
+				index("external_link_integrationId_idx", ["integrationId"]),
+				index("external_link_externalId_idx", ["externalId"]),
+				index("external_link_resourceType_idx", ["resourceType"]),
+			],
+		},
+	),
+	table(
+		"comment",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			taskId: t
+				.text("taskId", "task_id")
+				.notNull()
+				.ref("task", { onDelete: "cascade", onUpdate: "cascade" }),
+			userId: t
+				.text("userId", "user_id")
+				.notNull()
+				.ref("user", { onDelete: "cascade", onUpdate: "cascade" }),
+			content: t.text("content", "content").notNull(),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [
+				index("comment_task_idx", ["taskId"]),
+				index("comment_user_idx", ["userId"]),
+			],
+		},
+	),
+	table(
+		"task_relation",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			sourceTaskId: t
+				.text("sourceTaskId", "source_task_id")
+				.notNull()
+				.ref("task", { onDelete: "cascade", onUpdate: "cascade" }),
+			targetTaskId: t
+				.text("targetTaskId", "target_task_id")
+				.notNull()
+				.ref("task", { onDelete: "cascade", onUpdate: "cascade" }),
+			relationType: t.text("relationType", "relation_type").notNull(),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+		},
+		{
+			indexes: [
+				index("task_relation_source_idx", ["sourceTaskId"]),
+				index("task_relation_target_idx", ["targetTaskId"]),
+			],
+		},
+	),
+	table(
+		"apikey",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			configId: t.text("configId", "configId").notNull().default("default"),
+			name: t.text("name", "name"),
+			start: t.text("start", "start"),
+			referenceId: t
+				.text("referenceId", "referenceId")
+				.notNull()
+				.ref("user", { onDelete: "cascade" }),
+			prefix: t.text("prefix", "prefix"),
+			key: t.text("key", "key").notNull(),
+			userId: t.text("userId", "userId").ref("user", { onDelete: "cascade" }),
+			refillInterval: t.integer("refillInterval", "refillInterval"),
+			refillAmount: t.integer("refillAmount", "refillAmount"),
+			lastRefillAt: t.timestamp("lastRefillAt", "lastRefillAt"),
+			enabled: t.boolean("enabled", "enabled").default(true),
+			rateLimitEnabled: t
+				.boolean("rateLimitEnabled", "rateLimitEnabled")
+				.default(true),
+			rateLimitTimeWindow: t
+				.integer("rateLimitTimeWindow", "rateLimitTimeWindow")
+				.default(86400000),
+			rateLimitMax: t.integer("rateLimitMax", "rateLimitMax").default(10),
+			requestCount: t.integer("requestCount", "requestCount").default(0),
+			remaining: t.integer("remaining", "remaining"),
+			lastRequest: t.timestamp("lastRequest", "lastRequest"),
+			expiresAt: t.timestamp("expiresAt", "expiresAt"),
+			createdAt: t.timestamp("createdAt", "createdAt").notNull(),
+			updatedAt: t.timestamp("updatedAt", "updatedAt").notNull(),
+			permissions: t.text("permissions", "permissions"),
+			metadata: t.text("metadata", "metadata"),
+		},
+		{
+			indexes: [
+				index("apikey_configId_idx", ["configId"]),
+				index("apikey_key_idx", ["key"]),
+				index("apikey_referenceId_idx", ["referenceId"]),
+				index("apikey_userId_idx", ["userId"]),
+			],
+		},
+	),
+	table(
+		"device_code",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			deviceCode: t.text("deviceCode", "device_code").notNull(),
+			userCode: t.text("userCode", "user_code").notNull(),
+			userId: t
+				.text("userId", "user_id")
+				.ref("user", { onDelete: "cascade", onUpdate: "cascade" }),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+			expiresAt: t.timestamp("expiresAt", "expires_at").notNull(),
+			status: t.text("status", "status").notNull(),
+			lastPolledAt: t.timestamp("lastPolledAt", "last_polled_at"),
+			pollingInterval: t.integer("pollingInterval", "polling_interval"),
+			clientId: t.text("clientId", "client_id"),
+			scope: t.text("scope", "scope"),
+		},
+		{
+			indexes: [
+				uniqueIndex("device_code_device_code_uidx", ["deviceCode"]),
+				uniqueIndex("device_code_user_code_uidx", ["userCode"]),
+				index("device_code_user_id_idx", ["userId"]),
+			],
+		},
+	),
+	table(
+		"mcp_oauth_state",
+		{
+			id: t.text("id", "id").pk().defaultCuid(),
+			kind: t.text("kind", "kind").notNull(),
+			key: t.text("key", "key").notNull(),
+			payload: t.jsonb("payload", "payload").notNull(),
+			expiresAt: t.timestamp("expiresAt", "expires_at").notNull(),
+			createdAt: t.timestamp("createdAt", "created_at").defaultNow().notNull(),
+			updatedAt: t
+				.timestamp("updatedAt", "updated_at")
+				.defaultNow()
+				.onUpdateNow()
+				.notNull(),
+		},
+		{
+			indexes: [
+				uniqueIndex("mcp_oauth_state_kind_key_uidx", ["kind", "key"]),
+				index("mcp_oauth_state_expiresAt_idx", ["expiresAt"]),
+			],
+		},
+	),
+]);
diff --git a/packages/kaneo-domain/src/parity.test.ts b/packages/kaneo-domain/src/parity.test.ts
new file mode 100644
index 000000000..bc87f1325
--- /dev/null
+++ b/packages/kaneo-domain/src/parity.test.ts
@@ -0,0 +1,67 @@
+import { describe, expect, it } from "bun:test";
+import * as vendored from "../../../vendor/kaneo/apps/api/src/database/schema.ts";
+import { toDrizzleSchema } from "./drizzle";
+import { kaneoSchema } from "./kaneo";
+import { renderTable } from "./parity";
+
+const PHYSICAL_TO_VENDORED = {
+	user: "userTable",
+	session: "sessionTable",
+	account: "accountTable",
+	user_avatar: "userAvatarTable",
+	verification: "verificationTable",
+	workspace: "workspaceTable",
+	workspace_member: "workspaceUserTable",
+	workspace_billing: "workspaceBillingTable",
+	trial_grant: "trialGrantTable",
+	billing_event: "billingEventTable",
+	team: "teamTable",
+	team_member: "teamMemberTable",
+	workspace_invitation: "invitationTable",
+	workspace_role: "workspaceRoleTable",
+	project: "projectTable",
+	column: "columnTable",
+	workflow_rule: "workflowRuleTable",
+	task: "taskTable",
+	billing_reminder_sent: "billingReminderSentTable",
+	job_lease: "jobLeaseTable",
+	task_reminder_sent: "taskReminderSentTable",
+	time_entry: "timeEntryTable",
+	task_activity: "activityTable",
+	asset: "assetTable",
+	label: "labelTable",
+	notification: "notificationTable",
+	user_notification_preference: "userNotificationPreferenceTable",
+	user_notification_workspace_rule: "userNotificationWorkspaceRuleTable",
+	user_notification_workspace_project: "userNotificationWorkspaceProjectTable",
+	github_integration: "githubIntegrationTable",
+	integration: "integrationTable",
+	external_link: "externalLinkTable",
+	comment: "commentTable",
+	task_relation: "taskRelationTable",
+	apikey: "apikeyTable",
+	device_code: "deviceCodeTable",
+	mcp_oauth_state: "mcpOauthStateTable",
+};
+
+describe("kaneo drizzle parity", () => {
+	const generated = toDrizzleSchema(kaneoSchema);
+
+	it("exposes every vendored table", () => {
+		for (const [physical, exportName] of Object.entries(PHYSICAL_TO_VENDORED)) {
+			expect(
+				vendored[exportName as keyof typeof vendored],
+				`${exportName} exists`,
+			).toBeDefined();
+			expect(generated.tables[physical], `generated ${physical}`).toBeDefined();
+		}
+	});
+
+	for (const [physical, exportName] of Object.entries(PHYSICAL_TO_VENDORED)) {
+		it(`${physical} (${exportName}) matches the vendored schema`, () => {
+			const original = vendored[exportName as keyof typeof vendored];
+			const generatedTable = generated.tables[physical];
+			expect(renderTable(generatedTable)).toBe(renderTable(original));
+		});
+	}
+});
diff --git a/packages/kaneo-domain/src/parity.ts b/packages/kaneo-domain/src/parity.ts
new file mode 100644
index 000000000..82d853eb8
--- /dev/null
+++ b/packages/kaneo-domain/src/parity.ts
@@ -0,0 +1,152 @@
+import { Table } from "drizzle-orm";
+import { getTableConfig } from "drizzle-orm/pg-core";
+
+const tableNameSymbol = (Table as unknown as { Symbol: { Name: symbol } })
+	.Symbol.Name;
+
+function sqlText(chunk: unknown, out: string[]): void {
+	if (Array.isArray(chunk)) {
+		if (typeof chunk[0] === "string") {
+			out.push(chunk[0]);
+		} else {
+			for (const inner of chunk) {
+				sqlText(inner, out);
+			}
+		}
+		return;
+	}
+	if (chunk !== null && typeof chunk === "object") {
+		const obj = chunk as Record<string, unknown>;
+		if (Array.isArray(obj.queryChunks)) {
+			for (const inner of obj.queryChunks as unknown[]) {
+				sqlText(inner, out);
+			}
+			return;
+		}
+		if (Array.isArray(obj.value)) {
+			for (const inner of obj.value as unknown[]) {
+				sqlText(inner, out);
+			}
+			return;
+		}
+		if (
+			typeof obj.getSQL === "function" &&
+			typeof obj.name === "string" &&
+			obj.table
+		) {
+			out.push(obj.name as string);
+			return;
+		}
+		if (typeof obj.isTable === "boolean" && obj.isTable) {
+			out.push(obj.name as string);
+			return;
+		}
+		out.push(String(obj.name ?? chunk));
+		return;
+	}
+	out.push(String(chunk));
+}
+
+function normalizeSql(sql: unknown): string {
+	const out: string[] = [];
+	sqlText(sql, out);
+	return out.join("").replaceAll('"', "").replace(/\s+/g, " ").trim();
+}
+
+function tableName(table: unknown): string {
+	if (table === null || typeof table !== "object") {
+		return String(table);
+	}
+	const t = table as Record<PropertyKey, unknown>;
+	const name = t[tableNameSymbol];
+	if (typeof name === "string") {
+		return name;
+	}
+	const config = t.config as { name?: string } | undefined;
+	if (config?.name) {
+		return config.name;
+	}
+	return String(t.name);
+}
+
+function tokenizeDefault(column: {
+	defaultFn?: unknown;
+	default?: unknown;
+}): string {
+	if (column.defaultFn) {
+		const src = String(column.defaultFn)
+			.replaceAll("!1", "false")
+			.replaceAll("!0", "true");
+		if (src.includes("createId")) {
+			return "cuid";
+		}
+		return `fn:${src.slice(0, 60)}`;
+	}
+	if (column.default === undefined || column.default === null) {
+		return "-";
+	}
+	if (typeof column.default === "object") {
+		return `sql:${normalizeSql(column.default)}`;
+	}
+	return `lit:${String(column.default)}`;
+}
+
+interface DrizzleColumn {
+	name: string;
+	notNull: boolean;
+	primary: boolean;
+	isUnique: boolean;
+	uniqueName?: string;
+	default?: unknown;
+	defaultFn?: unknown;
+	onUpdateFn?: unknown;
+	getSQLType(): string;
+}
+
+export function renderTable(table: unknown): string {
+	const cfg = getTableConfig(table as Parameters<typeof getTableConfig>[0]);
+	const lines: string[] = [];
+	lines.push(`TABLE ${cfg.name}`);
+	for (const col of cfg.columns as DrizzleColumn[]) {
+		const uniqueName = col.isUnique ? (col.uniqueName ?? "auto") : "-";
+		lines.push(
+			`COL ${col.name} type=${col.getSQLType()} nn=${col.notNull} pk=${col.primary} uq=${uniqueName} def=${tokenizeDefault(col)} upd=${col.onUpdateFn ? 1 : 0}`,
+		);
+	}
+	for (const idx of cfg.indexes ?? []) {
+		const c = (
+			idx as unknown as {
+				config: {
+					name: string;
+					unique: boolean;
+					columns: { name: string }[];
+					where?: unknown;
+				};
+			}
+		).config;
+		const where = c.where ? normalizeSql(c.where) : "-";
+		lines.push(
+			`IDX ${c.name} unique=${c.unique} cols=[${c.columns.map((x) => x.name).join(",")}] where=${where}`,
+		);
+	}
+	for (const uc of cfg.uniqueConstraints ?? []) {
+		const columns = (uc.columns as unknown[]).map(
+			(c) => (c as { name?: string }).name ?? String(c),
+		);
+		lines.push(`UC ${uc.name} cols=[${columns.join(",")}]`);
+	}
+	for (const fk of cfg.foreignKeys ?? []) {
+		const ref = fk.reference() as {
+			name?: string;
+			columns: DrizzleColumn[];
+			foreignTable: unknown;
+			foreignColumns: DrizzleColumn[];
+		};
+		const local = ref.columns.map((c) => c.name).join(",");
+		const foreign = ref.foreignColumns.map((c) => c.name).join(",");
+		lines.push(
+			`FK ${ref.name ?? "-"} local=[${local}] -> ${tableName(ref.foreignTable)}(${foreign}) del=${fk.onDelete ?? "-"} upd=${fk.onUpdate ?? "-"}`,
+		);
+	}
+	return lines.join("\n");
+}
diff --git a/packages/kaneo-domain/src/prisma.test.ts b/packages/kaneo-domain/src/prisma.test.ts
new file mode 100644
index 000000000..30476c7c4
--- /dev/null
+++ b/packages/kaneo-domain/src/prisma.test.ts
@@ -0,0 +1,47 @@
+import { describe, expect, it } from "bun:test";
+import { kaneoSchema } from "./kaneo";
+import { DEFAULT_EXCLUDE, DEFAULT_RENAME, toPrismaFragment } from "./prisma";
+
+const fragment = toPrismaFragment(kaneoSchema, {
+	exclude: DEFAULT_EXCLUDE,
+	rename: DEFAULT_RENAME,
+});
+
+describe("kaneo prisma fragment", () => {
+	it("emits every non-excluded kaneo table", () => {
+		const kept = kaneoSchema.tables.filter(
+			(t) => !DEFAULT_EXCLUDE.includes(t.name),
+		);
+		for (const def of kept) {
+			expect(fragment).toContain(`@@map("${def.name}")`);
+		}
+		expect(fragment.match(/^model /gm)).toHaveLength(kept.length);
+	});
+
+	it("skips the excluded tables", () => {
+		for (const table of DEFAULT_EXCLUDE) {
+			expect(fragment).not.toContain(`@@map("${table}")`);
+		}
+	});
+
+	it("renames the collisions", () => {
+		expect(fragment).toContain("model ProjectTask");
+		expect(fragment).toContain("model ProjectColumn");
+		expect(fragment).toContain("model TaskActivity");
+		expect(fragment).toContain("model TaskComment");
+	});
+
+	it("never combines a scalar and a relation on one line", () => {
+		for (const line of fragment.split("\n")) {
+			expect(line).not.toMatch(
+				/^ {2}\w+ (String|Int|Boolean|DateTime|Json|Bytes)\?* \w+ [A-Z]\w* @relation/,
+			);
+		}
+	});
+
+	it("maps columns to kaneo's snake_case physical names", () => {
+		expect(fragment).toContain('@map("project_id")');
+		expect(fragment).toContain('@map("created_at")');
+		expect(fragment).toContain('@map("joined_at")');
+	});
+});
diff --git a/packages/kaneo-domain/src/prisma.ts b/packages/kaneo-domain/src/prisma.ts
new file mode 100644
index 000000000..c9dd36154
--- /dev/null
+++ b/packages/kaneo-domain/src/prisma.ts
@@ -0,0 +1,299 @@
+import type {
+	ColumnDef,
+	ColumnRef,
+	ForeignKeyDef,
+	IndexDef,
+	RefAction,
+	SchemaDef,
+	TableDef,
+} from "./dsl";
+
+export interface PrismaBindingOptions {
+	exclude: string[];
+	rename: Record<string, string>;
+}
+
+export const DEFAULT_EXCLUDE = [
+	"user",
+	"session",
+	"account",
+	"verification",
+	"apikey",
+];
+
+export const DEFAULT_RENAME = {
+	task: "ProjectTask",
+	column: "ProjectColumn",
+	comment: "TaskComment",
+	activity: "TaskActivity",
+	workspace_invitation: "WorkspaceInvitation",
+} as const satisfies Record<string, string>;
+
+const REF_ACTIONS = {
+	cascade: "Cascade",
+	"set null": "SetNull",
+	restrict: "Restrict",
+} as const satisfies Record<string, string>;
+
+interface Edge {
+	localColumns: string[];
+	refColumns: string[];
+	target: string;
+	onDelete?: RefAction;
+	onUpdate?: RefAction;
+}
+
+interface PrismaRelation {
+	model: string;
+	field: string;
+	target: string;
+	localKeys: string[];
+	refKeys: string[];
+	onDelete?: RefAction;
+	onUpdate?: RefAction;
+	named?: string;
+	backField: string;
+}
+
+function pascalCase(name: string): string {
+	return name
+		.split("_")
+		.map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+		.join("");
+}
+
+function camelCase(name: string): string {
+	return name.charAt(0).toLowerCase() + name.slice(1);
+}
+
+function pluralize(name: string): string {
+	if (/[^aeiou]y$/i.test(name)) {
+		return `${name.slice(0, -1)}ies`;
+	}
+	return `${name}s`;
+}
+
+function prismaType(column: ColumnDef): string {
+	switch (column.type) {
+		case "text":
+			return "String";
+		case "boolean":
+			return "Boolean";
+		case "integer":
+			return "Int";
+		case "timestamp":
+			return "DateTime";
+		case "jsonb":
+			return "Json";
+		case "bytea":
+			return "Bytes";
+	}
+}
+
+function defaultAttribute(column: ColumnDef): string | null {
+	const value = column.default;
+	if (!value) {
+		return null;
+	}
+	switch (value.kind) {
+		case "cuid":
+			return "@default(cuid())";
+		case "now":
+			return "@default(now())";
+		case "literal":
+			if (typeof value.value === "string") {
+				return `@default("${value.value}")`;
+			}
+			return `@default(${value.value})`;
+		case "client":
+			return null;
+	}
+}
+
+function scalarAttributes(column: ColumnDef): string {
+	const parts: string[] = [];
+	if (column.primary) {
+		parts.push("@id");
+	}
+	if (column.unique !== null) {
+		parts.push(
+			column.unique === "" ? "@unique" : `@unique(map: "${column.unique}")`,
+		);
+	}
+	const def = defaultAttribute(column);
+	if (def) {
+		parts.push(def);
+	}
+	if (column.onUpdateNow) {
+		parts.push("@updatedAt");
+	}
+	return parts.join(" ");
+}
+
+function relationName(
+	model: string,
+	target: string,
+	index: number,
+): string | undefined {
+	if (index === 0) {
+		return undefined;
+	}
+	return `${model}To${target}_${index}`;
+}
+
+function relationFieldName(localKeys: string[], target: string): string {
+	if (localKeys.length === 1) {
+		const key = localKeys[0];
+		if (key) {
+			const stripped = key.replace(/Id$/, "");
+			if (stripped) {
+				return stripped;
+			}
+		}
+	}
+	return camelCase(target);
+}
+
+function keyMap(def: TableDef): Map<string, string> {
+	return new Map(def.columns.map((c) => [c.name, c.key]));
+}
+
+function collectEdges(def: TableDef): Edge[] {
+	const fromColumn = (column: ColumnDef, ref: ColumnRef): Edge => ({
+		localColumns: [column.name],
+		refColumns: ref.columns,
+		target: ref.table,
+		onDelete: ref.onDelete,
+		onUpdate: ref.onUpdate,
+	});
+	const fromFk = (fk: ForeignKeyDef): Edge => ({
+		localColumns: fk.columns,
+		refColumns: fk.refColumns,
+		target: fk.refTable,
+		onDelete: fk.onDelete,
+		onUpdate: fk.onUpdate,
+	});
+	const columnEdges = def.columns
+		.filter((c) => c.ref)
+		.map((c) => fromColumn(c, c.ref!));
+	return [...columnEdges, ...(def.foreignKeys ?? []).map(fromFk)];
+}
+
+export function toPrismaFragment(
+	schema: SchemaDef,
+	options: PrismaBindingOptions,
+): string {
+	const tables = schema.tables.filter((t) => !options.exclude.includes(t.name));
+	const modelName = (physical: string) =>
+		options.rename[physical] ?? pascalCase(physical);
+	const keyMaps = new Map(tables.map((t) => [t.name, keyMap(t)]));
+
+	const relations: PrismaRelation[] = [];
+	for (const def of tables) {
+		const edges = collectEdges(def);
+		const seen = new Map<string, number>();
+		for (const edge of edges) {
+			const pairKey = `${def.name}>${edge.target}`;
+			const index = seen.get(pairKey) ?? 0;
+			seen.set(pairKey, index + 1);
+			const targetMap = keyMaps.get(edge.target);
+			if (!targetMap) {
+				continue;
+			}
+			const localMap = keyMaps.get(def.name)!;
+			const localKeys = edge.localColumns.map((c) => localMap.get(c) ?? c);
+			const refKeys = edge.refColumns.map((c) => targetMap.get(c) ?? c);
+			const named = relationName(
+				modelName(def.name),
+				modelName(edge.target),
+				index,
+			);
+			relations.push({
+				model: modelName(def.name),
+				field: relationFieldName(localKeys, modelName(edge.target)),
+				target: modelName(edge.target),
+				localKeys,
+				refKeys,
+				onDelete: edge.onDelete,
+				onUpdate: edge.onUpdate,
+				named,
+				backField: pluralize(camelCase(modelName(def.name))),
+			});
+		}
+	}
+
+	const blocks: string[] = [];
+	for (const def of tables) {
+		const name = modelName(def.name);
+		const modelRelations = relations.filter((r) => r.model === name);
+		const backRelations = relations.filter((r) => r.target === name);
+		const usedBackFields = new Set<string>();
+
+		const lines: string[] = [];
+		for (const column of def.columns) {
+			const base = `${column.key} ${prismaType(column)}${column.notNull || column.primary ? "" : "?"}`;
+			const columnMap =
+				column.key === column.name ? "" : ` @map("${column.name}")`;
+			const attrs = scalarAttributes(column);
+			lines.push(`${base}${columnMap}${attrs ? ` ${attrs}` : ""}`);
+		}
+
+		for (const relation of modelRelations) {
+			const optional = relation.localKeys.some((key) => {
+				const column = def.columns.find((c) => c.key === key);
+				return column ? !column.notNull && !column.primary : false;
+			});
+			lines.push(
+				`${relation.field} ${relation.target}${optional ? "?" : ""} @relation(${relationArgs(relation)})`,
+			);
+		}
+
+		for (const relation of backRelations) {
+			let backField = relation.backField;
+			let suffix = 2;
+			while (usedBackFields.has(backField)) {
+				backField = `${relation.backField}${suffix}`;
+				suffix += 1;
+			}
+			usedBackFields.add(backField);
+			const relName = relation.named ? `"${relation.named}"` : "";
+			lines.push(
+				`${backField} ${relation.model}[]${relName ? ` @relation(${relName})` : ""}`,
+			);
+		}
+
+		for (const idx of def.indexes ?? []) {
+			if (idx.kind === "unique") {
+				lines.push(`@@unique([${idx.columns.join(", ")}], map: "${idx.name}")`);
+			}
+		}
+		for (const idx of def.indexes ?? []) {
+			if (idx.kind === "index") {
+				lines.push(`@@index([${idx.columns.join(", ")}], map: "${idx.name}")`);
+			}
+		}
+
+		blocks.push(
+			`model ${name} {\n${lines.map((l) => `  ${l}`).join("\n")}\n  @@map("${def.name}")\n}`,
+		);
+	}
+
+	return blocks.join("\n\n");
+
+	function relationArgs(relation: PrismaRelation): string {
+		const parts = [
+			`fields: [${relation.localKeys.join(", ")}]`,
+			`references: [${relation.refKeys.join(", ")}]`,
+		];
+		if (relation.named) {
+			parts.unshift(`"${relation.named}"`);
+		}
+		if (relation.onDelete) {
+			parts.push(`onDelete: ${REF_ACTIONS[relation.onDelete]}`);
+		}
+		if (relation.onUpdate) {
+			parts.push(`onUpdate: ${REF_ACTIONS[relation.onUpdate]}`);
+		}
+		return parts.join(", ");
+	}
+}
diff --git a/packages/kaneo-domain/tsconfig.json b/packages/kaneo-domain/tsconfig.json
new file mode 100644
index 000000000..d427aa526
--- /dev/null
+++ b/packages/kaneo-domain/tsconfig.json
@@ -0,0 +1,9 @@
+{
+	"$schema": "https://json.schemastore.org/tsconfig",
+	"extends": "@crm/typescript-config/internal-package.json",
+	"compilerOptions": {
+		"types": ["node"]
+	},
+	"include": ["src/**/*.ts"],
+	"exclude": ["node_modules", "src/**/*.test.ts"]
+}
diff --git a/packages/telemetry/package.json b/packages/telemetry/package.json
index 149906cf8..b1f60809f 100644
--- a/packages/telemetry/package.json
+++ b/packages/telemetry/package.json
@@ -18,11 +18,11 @@
 	"dependencies": {
 		"@crm/db": "workspace:*",
 		"@crm/env": "workspace:*",
-		"posthog-node": "^5.48.0"
+		"posthog-node": "^5.51.8"
 	},
 	"devDependencies": {
 		"@crm/typescript-config": "workspace:*",
-		"@types/node": "^24.10.1",
-		"typescript": "5.9.2"
+		"@types/node": "^26.5.0",
+		"typescript": "7.0.2"
 	}
 }
diff --git a/packages/telemetry/src/allowlist.ts b/packages/telemetry/src/allowlist.ts
index 5880dc2bd..1b9ec9aec 100644
--- a/packages/telemetry/src/allowlist.ts
+++ b/packages/telemetry/src/allowlist.ts
@@ -48,7 +48,6 @@ export const ALLOWED_PROPERTIES = [
 	"facts_by_method",
 	"facts_by_evidence_kind",
 	"fact_dismissal_rate",
-	"fact_decision_median_hours",
 	"facts_superseded_within_7_days",
 
 	"contacts_bucket",
@@ -126,6 +125,7 @@ export const AGENT_TOOLS = [
 	"list_fields",
 	"list_outstanding_work",
 	"manage_fields",
+	"project_list",
 	"read_company_history",
 	"read_crm_history",
 	"read_deal_history",
@@ -139,6 +139,11 @@ export const AGENT_TOOLS = [
 	"set_chat_title",
 	"set_contact_socials",
 	"set_field_value",
+	"task_comment",
+	"task_create",
+	"task_list",
+	"task_read",
+	"kaneo_task_update",
 	"write_brief",
 	"write_workspace_profile",
 ] as const;
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 504419a28..5e63847a6 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -17,45 +17,45 @@
 		"clean": "rm -rf .turbo node_modules"
 	},
 	"dependencies": {
-		"@carbon/icons-react": "^11.82.0",
+		"@carbon/icons-react": "^11.88.0",
 		"@crm/db": "workspace:*",
 		"@dnd-kit/core": "^6.3.1",
 		"@dnd-kit/modifiers": "^9.0.0",
 		"@dnd-kit/sortable": "^10.0.0",
 		"@dnd-kit/utilities": "^3.2.2",
-		"@shadcn/react": "^0.3.0",
+		"@shadcn/react": "^0.3.1",
 		"class-variance-authority": "^0.7.1",
 		"clsx": "^2.1.1",
 		"cmdk": "^1.1.1",
-		"lucide-react": "^1.28.0",
-		"motion": "^12.42.2",
+		"lucide-react": "^1.43.0",
+		"motion": "^13.2.0",
 		"next-themes": "^0.4.6",
-		"nuqs": "^2.8.9",
-		"radix-ui": "^1.6.0",
+		"nuqs": "^2.10.1",
+		"radix-ui": "^1.6.7",
 		"react-day-picker": "^10.0.1",
-		"recharts": "3.8.0",
-		"sonner": "^2.0.7",
-		"streamdown": "^2.5.0",
+		"recharts": "3.10.1",
+		"sonner": "^2.0.8",
+		"streamdown": "^2.6.0",
 		"tailwind-merge": "^3.6.0",
 		"tw-animate-css": "^1.4.0",
 		"vaul": "^1.1.2"
 	},
 	"peerDependencies": {
-		"next": "^16.0.0",
-		"react": "^19.2.0",
-		"react-dom": "^19.2.0"
+		"next": "^16.3.4",
+		"react": "^19.2.8",
+		"react-dom": "^19.2.8"
 	},
 	"devDependencies": {
 		"@crm/typescript-config": "workspace:*",
-		"@tailwindcss/postcss": "^4",
-		"@types/node": "^24.10.1",
+		"@tailwindcss/postcss": "^4.3.3",
+		"@types/node": "^26.5.0",
 		"@types/react": "^19.2.18",
 		"@types/react-dom": "^19",
-		"next": "16.2.12",
-		"react": "19.2.4",
-		"react-dom": "19.2.4",
-		"shadcn": "^4.16.1",
-		"tailwindcss": "^4",
-		"typescript": "5.9.2"
+		"next": "16.3.4",
+		"react": "19.2.8",
+		"react-dom": "19.2.8",
+		"shadcn": "^4.21.0",
+		"tailwindcss": "^4.3.3",
+		"typescript": "7.0.2"
 	}
 }
diff --git a/packages/validation/package.json b/packages/validation/package.json
index d6fb2c36a..2921268a2 100644
--- a/packages/validation/package.json
+++ b/packages/validation/package.json
@@ -5,16 +5,19 @@
 	"type": "module",
 	"exports": {
 		".": "./src/index.ts",
+		"./active-organization-claim": "./src/active-organization-claim.ts",
 		"./activity-meta": "./src/activity-meta.ts",
 		"./agent-events": "./src/agent-events.ts",
 		"./agent-manifest": "./src/agent-manifest.ts",
+		"./api-key-principal": "./src/api-key-principal.ts",
 		"./builder-question": "./src/builder-question.ts",
 		"./enrichment-queue": "./src/enrichment-queue.ts",
 		"./eve-stream": "./src/eve-stream.ts",
 		"./eve-tool": "./src/eve-tool.ts",
 		"./field-backfill": "./src/field-backfill.ts",
 		"./field-templates": "./src/field-templates.ts",
-		"./saved-view": "./src/saved-view.ts"
+		"./saved-view": "./src/saved-view.ts",
+		"./workspace-gate": "./src/workspace-gate.ts"
 	},
 	"scripts": {
 		"check-types": "tsc --noEmit",
@@ -24,11 +27,11 @@
 	},
 	"dependencies": {
 		"@crm/db": "workspace:*",
-		"zod": "^4.4.3"
+		"zod": "^4.5.4"
 	},
 	"devDependencies": {
 		"@crm/typescript-config": "workspace:*",
-		"@types/node": "^24.10.1",
-		"typescript": "5.9.2"
+		"@types/node": "^26.5.0",
+		"typescript": "7.0.2"
 	}
 }
diff --git a/packages/validation/src/active-organization-claim.ts b/packages/validation/src/active-organization-claim.ts
new file mode 100644
index 000000000..7f3eca07a
--- /dev/null
+++ b/packages/validation/src/active-organization-claim.ts
@@ -0,0 +1,8 @@
+import { z } from "zod";
+
+const activeOrganizationClaim = z.string().trim().min(1);
+
+export function parseActiveOrganizationClaim(value: unknown): string | null {
+	const parsed = activeOrganizationClaim.safeParse(value);
+	return parsed.success ? parsed.data : null;
+}
diff --git a/packages/validation/src/api-key-principal.ts b/packages/validation/src/api-key-principal.ts
new file mode 100644
index 000000000..f8586da99
--- /dev/null
+++ b/packages/validation/src/api-key-principal.ts
@@ -0,0 +1,13 @@
+import { z } from "zod";
+
+const apiKeyPrincipalMetadata = z.object({
+	createdByUserId: z.string().trim().min(1),
+});
+
+export type ApiKeyPrincipalMetadata = z.infer<typeof apiKeyPrincipalMetadata>;
+
+export function parseApiKeyPrincipalMetadata(
+	value: unknown,
+): ApiKeyPrincipalMetadata {
+	return apiKeyPrincipalMetadata.parse(value);
+}
diff --git a/packages/validation/src/index.ts b/packages/validation/src/index.ts
index 0cf43c9ca..50f40bdc9 100644
--- a/packages/validation/src/index.ts
+++ b/packages/validation/src/index.ts
@@ -7,6 +7,7 @@ import * as builderQuestion from "./builder-question";
 import * as eveStream from "./eve-stream";
 import * as eveTool from "./eve-tool";
 import * as slack from "./slack";
+import * as workspaceGate from "./workspace-gate";
 
 export const schemas = {
 	activityMeta,
@@ -17,6 +18,7 @@ export const schemas = {
 	eveStream,
 	eveTool,
 	slack,
+	workspaceGate,
 } as const;
 
 export type { ActivityMeta, ActivityMetaFields } from "./activity-meta";
@@ -57,6 +59,7 @@ export type {
 	EveToolOutput,
 } from "./eve-tool";
 export type { AuthTest, JoinPayload, OauthAccess, Reply } from "./slack";
+export type { WorkspaceGate } from "./workspace-gate";
 
 export class InvalidInput extends Error {
 	override readonly name = "InvalidInput";
diff --git a/packages/validation/src/slack.ts b/packages/validation/src/slack.ts
index 7d276a21b..df7ba2283 100644
--- a/packages/validation/src/slack.ts
+++ b/packages/validation/src/slack.ts
@@ -15,6 +15,7 @@ export const createPayload = z.object({
 		.max(80)
 		.regex(/^[a-z0-9-_]+$/, "Use lowercase letters, numbers and dashes."),
 	isPrivate: z.boolean(),
+	organizationId: z.string().trim().min(1).max(120),
 });
 
 export const createReply = z.object({
diff --git a/packages/validation/src/workspace-gate.ts b/packages/validation/src/workspace-gate.ts
new file mode 100644
index 000000000..602cfb2dd
--- /dev/null
+++ b/packages/validation/src/workspace-gate.ts
@@ -0,0 +1,10 @@
+import { z } from "zod";
+
+export const workspaceGate = z.object({
+	organizationId: z.string().min(1).nullable(),
+	slug: z.string().min(1).nullable(),
+	onboarded: z.boolean().nullable(),
+	canRename: z.boolean().nullable(),
+});
+
+export type WorkspaceGate = z.infer<typeof workspaceGate>;
diff --git a/packages/validation/test/api-key-principal.spec.ts b/packages/validation/test/api-key-principal.spec.ts
new file mode 100644
index 000000000..091aa53b7
--- /dev/null
+++ b/packages/validation/test/api-key-principal.spec.ts
@@ -0,0 +1,15 @@
+import { describe, expect, it } from "bun:test";
+import { z } from "zod";
+import { parseApiKeyPrincipalMetadata } from "../src/api-key-principal";
+
+describe("parseApiKeyPrincipalMetadata", () => {
+	it("returns the API key creator", () => {
+		expect(parseApiKeyPrincipalMetadata({ createdByUserId: "user-1" })).toEqual(
+			{ createdByUserId: "user-1" },
+		);
+	});
+
+	it("rejects missing creator metadata", () => {
+		expect(() => parseApiKeyPrincipalMetadata({})).toThrow(z.ZodError);
+	});
+});
diff --git a/packages/validation/test/parse.spec.ts b/packages/validation/test/parse.spec.ts
index 6b61a48eb..0ff2ac137 100644
--- a/packages/validation/test/parse.spec.ts
+++ b/packages/validation/test/parse.spec.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from "bun:test";
 import * as z from "zod";
 import { InvalidInput, parse, schemas } from "../src/index";
+import { workspaceGate } from "../src/workspace-gate";
 
 const person = z.object({
 	name: z.string().trim().min(1),
@@ -64,3 +65,16 @@ describe("the input request schema", () => {
 		).toBe(false);
 	});
 });
+
+describe("the workspace gate schema", () => {
+	it("accepts an explicit no-organization result", () => {
+		expect(
+			workspaceGate.safeParse({
+				organizationId: null,
+				slug: null,
+				onboarded: null,
+				canRename: null,
+			}).success,
+		).toBe(true);
+	});
+});
diff --git a/patches/@better-auth%2Foauth-provider@1.7.3.patch b/patches/@better-auth%2Foauth-provider@1.7.3.patch
new file mode 100644
index 000000000..2a1ac4a20
--- /dev/null
+++ b/patches/@better-auth%2Foauth-provider@1.7.3.patch
@@ -0,0 +1,18 @@
+diff --git a/dist/authorize-9whjxVLJ.mjs b/dist/authorize-9whjxVLJ.mjs
+index 6c1d5c51c..47c085e76 100644
+--- a/dist/authorize-9whjxVLJ.mjs
++++ b/dist/authorize-9whjxVLJ.mjs
+@@ -4404,7 +4404,12 @@ const oauthProvider = (options) => {
+ 		onRequest: handleIssuerMetadataRequest,
+ 		init: async (ctx) => {
+ 			if (ctx.options.secondaryStorage && ctx.options.session?.storeSessionInDatabase !== true) throw new BetterAuthError("OAuth Provider requires `session.storeSessionInDatabase: true` when using secondaryStorage");
+-			await seedResources(ctx, opts);
++			try {
++				await seedResources(ctx, opts);
++			} catch (error) {
++				if (error?.code !== "ECONNRESET") throw error;
++				logger.warn("oauth-provider: database connection reset during startup; resource setup will retry on access.");
++			}
+ 			logEnforcePerClientResourcesResolution(opts);
+ 			if (!opts.disableJwtPlugin) {
+ 				const jwtPluginOptions = getJwtPlugin(ctx)?.options;
diff --git a/skills-lock.json b/skills-lock.json
deleted file mode 100644
index 7a4093828..000000000
--- a/skills-lock.json
+++ /dev/null
@@ -1,155 +0,0 @@
-{
-  "version": 1,
-  "skills": {
-    "ai-elements": {
-      "source": "vercel/ai-elements",
-      "sourceType": "github",
-      "skillPath": "skills/ai-elements/SKILL.md",
-      "computedHash": "6d7ccc65b98adb04d6c47632746dbfea55528903de9b027f6b39b80983d5aa55"
-    },
-    "ai-sdk": {
-      "source": "vercel/ai",
-      "sourceType": "github",
-      "skillPath": "skills/use-ai-sdk/SKILL.md",
-      "computedHash": "dfce60b0f2749991e000123526e298d5ede1c8353d837e71886fb3c8e5f8b730"
-    },
-    "better-accessibility": {
-      "source": "jakubkrehel/skills",
-      "sourceType": "github",
-      "skillPath": "skills/better-accessibility/SKILL.md",
-      "computedHash": "a7b0b70403af4625052410d239a8683b35221efbf6b61b396110ce000da05e26"
-    },
-    "better-auth-best-practices": {
-      "source": "better-auth/skills",
-      "sourceType": "github",
-      "skillPath": "better-auth/best-practices/SKILL.md",
-      "computedHash": "61ba0ef64ed2e7c424401cc848ca33dd6d790a720c44727717dc0c5cba5fc122"
-    },
-    "better-colors": {
-      "source": "jakubkrehel/skills",
-      "sourceType": "github",
-      "skillPath": "skills/better-colors/SKILL.md",
-      "computedHash": "094fbf1d8e31d225179f5d3ca80246b08b3dd9154f4058d7ee86a95e1139e563"
-    },
-    "better-interface": {
-      "source": "jakubkrehel/skills",
-      "sourceType": "github",
-      "skillPath": "skills/better-interface/SKILL.md",
-      "computedHash": "90e23bcfdea67e937a17ce43d91467f67ab71120803161ba0c2dabeb47066cd7"
-    },
-    "better-layout": {
-      "source": "jakubkrehel/skills",
-      "sourceType": "github",
-      "skillPath": "skills/better-layout/SKILL.md",
-      "computedHash": "e4eda446af4127a9b0ea97f0cc1e7c77cc1120b91fce25e3947af5e0884b74e5"
-    },
-    "better-typography": {
-      "source": "jakubkrehel/skills",
-      "sourceType": "github",
-      "skillPath": "skills/better-typography/SKILL.md",
-      "computedHash": "bbe024b4a78a56cd08b6d2e90d53bf268b559262c20665a440931645ed1861d4"
-    },
-    "better-ui": {
-      "source": "jakubkrehel/skills",
-      "sourceType": "github",
-      "skillPath": "skills/better-ui/SKILL.md",
-      "computedHash": "3d745409bc2de890c04c110ea9d43a305b33abb500a5c664f26d44774a02c79f"
-    },
-    "better-writing": {
-      "source": "jakubkrehel/skills",
-      "sourceType": "github",
-      "skillPath": "skills/better-writing/SKILL.md",
-      "computedHash": "450dc38b88fc7207044bf918e52a29422ad7a3de71517119cfd12fb65c7b05ee"
-    },
-    "eve": {
-      "source": "vercel/eve",
-      "sourceType": "github",
-      "skillPath": "skills/eve/SKILL.md",
-      "computedHash": "4833349453c45c606f79202e495b7bbc42ea380f329f3beee36b9927763f19ef"
-    },
-    "install-anti-slop": {
-      "source": "dmmulroy/anti-slop",
-      "sourceType": "github",
-      "skillPath": "skills/install-anti-slop/SKILL.md",
-      "computedHash": "b9c3852b1a4895ca33f92dd5015502bb75e36848e66f8767e125d37ea02e4b58"
-    },
-    "nestjs-best-practices": {
-      "source": "kadajett/agent-nestjs-skills",
-      "sourceType": "github",
-      "skillPath": "skills/nestjs-best-practices/SKILL.md",
-      "computedHash": "58f8a630637be3acce1f118c747d68160346ada8a43d76cb52a5b4c4edaa2d37"
-    },
-    "no-use-effect": {
-      "source": "factory-ai/factory-plugins",
-      "sourceType": "github",
-      "skillPath": "plugins/typescript/skills/no-use-effect/SKILL.md",
-      "computedHash": "3c4d9c9a65312482569bf3ad27d149c5c339567b52009f90ac29d212beee3766"
-    },
-    "nuqs": {
-      "source": "pproenca/dot-skills",
-      "sourceType": "github",
-      "skillPath": "skills/.curated/nuqs/SKILL.md",
-      "computedHash": "5811f3b4c6f981aa75647ffb879d6e98429535ff830df219a04f4c9a884658a6"
-    },
-    "posthog-instrumentation": {
-      "source": "posthog/posthog-for-claude",
-      "sourceType": "github",
-      "skillPath": "skills/posthog-instrumentation/SKILL.md",
-      "computedHash": "a9a30a63accd756ef41009f987ac75812ab1e855b30ea5d6153e0fed16ebf22d"
-    },
-    "prisma-database-setup": {
-      "source": "prisma/skills",
-      "sourceType": "github",
-      "skillPath": "prisma-database-setup/SKILL.md",
-      "computedHash": "6a991a2530a6da7131e3fc71c353e8278702d0146b8b6e1d2fdfc2d3d0a21bd2"
-    },
-    "seo-audit": {
-      "source": "coreyhaines31/marketingskills",
-      "sourceType": "github",
-      "skillPath": "skills/seo-audit/SKILL.md",
-      "computedHash": "f2dc52130189068981f21e1c0bdc4471ac7cd9b08d8a1320604411aa0f950385"
-    },
-    "shadcn": {
-      "source": "shadcn/ui",
-      "sourceType": "github",
-      "skillPath": "skills/shadcn/SKILL.md",
-      "computedHash": "c1a68ee06a668aced9ab2b5fbdea5f989864123794eb2e056b339a072dbb7f10"
-    },
-    "skill-creator": {
-      "source": "anthropics/skills",
-      "sourceType": "github",
-      "skillPath": "skills/skill-creator/SKILL.md",
-      "computedHash": "5ea13a6d9f0d4bb694405d79acd00cadec0d21bb138c4dd10fcf3c500cb835c2"
-    },
-    "turborepo": {
-      "source": "vercel/turborepo",
-      "sourceType": "github",
-      "skillPath": "skills/turborepo/SKILL.md",
-      "computedHash": "f4b990564b013482af64f72ba2dd28f2e244283a1fdcf23e469b9bcf942c1212"
-    },
-    "typescript-advanced-types": {
-      "source": "wshobson/agents",
-      "sourceType": "github",
-      "skillPath": "plugins/javascript-typescript/skills/typescript-advanced-types/SKILL.md",
-      "computedHash": "8cbf2bf600f392d7260e476e3202932a876e2281cda3b15a8b6a5a43f383252d"
-    },
-    "vercel-composition-patterns": {
-      "source": "vercel-labs/agent-skills",
-      "sourceType": "github",
-      "skillPath": "skills/composition-patterns/SKILL.md",
-      "computedHash": "575757e3e25761c8c562d6e395d29f0b76c98b1273c0bd72d88e6ab1bc9c7d42"
-    },
-    "vercel-react-best-practices": {
-      "source": "vercel-labs/agent-skills",
-      "sourceType": "github",
-      "skillPath": "skills/react-best-practices/SKILL.md",
-      "computedHash": "ca7b0c0c6e5f2750043f7f0cd72d16ac4e2abc48f9b5500d047a4b77a2506212"
-    },
-    "web-design-guidelines": {
-      "source": "vercel-labs/agent-skills",
-      "sourceType": "github",
-      "skillPath": "skills/web-design-guidelines/SKILL.md",
-      "computedHash": "f3bc47f890f42a44db1007ab390709ec368e4b8c089baee6b0007182236ac474"
-    }
-  }
-}
diff --git a/tools/kaneo-dev.ts b/tools/kaneo-dev.ts
new file mode 100644
index 000000000..b3fc8e682
--- /dev/null
+++ b/tools/kaneo-dev.ts
@@ -0,0 +1,175 @@
+import { existsSync, statSync } from "node:fs";
+import path from "node:path";
+
+const DIST = path.join(
+	import.meta.dir,
+	"..",
+	"vendor",
+	"kaneo",
+	"apps",
+	"web",
+	"dist",
+);
+const API_DIR = path.join(
+	import.meta.dir,
+	"..",
+	"vendor",
+	"kaneo",
+	"apps",
+	"api",
+);
+const KANEO_PACKAGES = path.join(
+	import.meta.dir,
+	"..",
+	"vendor",
+	"kaneo",
+	"packages",
+);
+const API_ORIGIN = "http://127.0.0.1:1337";
+const PORT = 5173;
+
+function indexResponse(): Response {
+	return new Response(Bun.file(path.join(DIST, "index.html")));
+}
+
+function fileResponse(relativePath: string): Response {
+	const filePath = path.join(DIST, relativePath);
+	if (
+		relativePath === "/" ||
+		!existsSync(filePath) ||
+		statSync(filePath).isDirectory()
+	) {
+		return indexResponse();
+	}
+	return new Response(Bun.file(filePath));
+}
+
+async function proxyRequest(req: Request): Promise<Response> {
+	const url = new URL(req.url);
+	const headers = new Headers(req.headers);
+	headers.delete("host");
+	const body = ["GET", "HEAD"].includes(req.method)
+		? undefined
+		: await req.arrayBuffer();
+	const upstream = await fetch(`${API_ORIGIN}${url.pathname}${url.search}`, {
+		method: req.method,
+		headers,
+		body,
+		redirect: "manual",
+	});
+	const responseHeaders = new Headers(upstream.headers);
+	responseHeaders.delete("content-encoding");
+	return new Response(upstream.body, {
+		status: upstream.status,
+		headers: responseHeaders,
+	});
+}
+
+export function startKaneoDevServer() {
+	return Bun.serve({
+		port: PORT,
+		websocket: {
+			open(ws) {
+				const { upstream } = ws.data as { upstream: WebSocket };
+				upstream.addEventListener("message", (event) => {
+					ws.send(event.data);
+				});
+				upstream.addEventListener("close", () => {
+					ws.close();
+				});
+				upstream.addEventListener("error", () => {
+					ws.close();
+				});
+			},
+			message(ws, message) {
+				(ws.data as { upstream: WebSocket }).upstream.send(message);
+			},
+			close(ws) {
+				(ws.data as { upstream: WebSocket }).upstream.close();
+			},
+		},
+		async fetch(req, server) {
+			const url = new URL(req.url);
+
+			if (url.pathname.startsWith("/ws")) {
+				const upstream = new WebSocket(
+					`ws://127.0.0.1:1337${url.pathname}${url.search}`,
+				);
+				if (server.upgrade(req, { data: { upstream } })) {
+					return undefined;
+				}
+				upstream.close();
+				return new Response("upgrade failed", { status: 500 });
+			}
+
+			if (url.pathname.startsWith("/api/")) {
+				return proxyRequest(req);
+			}
+
+			return fileResponse(url.pathname);
+		},
+	});
+}
+
+if (import.meta.main) {
+	const packagesWithDist = ["email", "permissions", "mcp", "planka-import"];
+	for (const pkg of packagesWithDist) {
+		if (!existsSync(path.join(KANEO_PACKAGES, pkg, "dist", "index.js"))) {
+			console.log(`building @kaneo/${pkg}...`);
+			const built = Bun.spawnSync(["bunx", "tsc"], {
+				cwd: path.join(KANEO_PACKAGES, pkg),
+				env: process.env,
+			});
+			if (built.exitCode !== 0) {
+				console.error(`failed to build @kaneo/${pkg}`);
+				process.exit(1);
+			}
+		}
+	}
+
+	if (!existsSync(path.join(DIST, "index.html"))) {
+		console.log("building kaneo web...");
+		const webBuild = Bun.spawnSync(["bun", "run", "build"], {
+			cwd: path.join(import.meta.dir, "..", "vendor", "kaneo", "apps", "web"),
+			env: {
+				...process.env,
+				VITE_API_URL: "http://localhost:5173",
+				VITE_CLIENT_URL: "http://localhost:5173",
+			},
+		});
+		if (webBuild.exitCode !== 0) {
+			console.error("failed to build kaneo web");
+			process.exit(1);
+		}
+	}
+
+	const apiEnv: Record<string, string> = {};
+	for (const key of Object.keys(process.env)) {
+		apiEnv[key] = process.env[key] ?? "";
+	}
+	const authSecret = process.env.BETTER_AUTH_SECRET;
+	if (authSecret && !apiEnv.AUTH_SECRET) {
+		apiEnv.AUTH_SECRET = authSecret;
+	}
+	apiEnv.KANEO_SKIP_DRIZZLE_MIGRATIONS = "1";
+	apiEnv.KANEO_CLIENT_URL = "http://localhost:5173";
+	apiEnv.CORS_ORIGINS = "http://localhost:5173";
+
+	const api = Bun.spawn(["bunx", "tsx", "src/index.ts"], {
+		cwd: API_DIR,
+		env: apiEnv,
+		stdout: "inherit",
+		stderr: "inherit",
+	});
+
+	const server = startKaneoDevServer();
+	console.log(`kaneo dev web: http://localhost:${server.port} → ${API_ORIGIN}`);
+
+	const shutdown = () => {
+		api.kill();
+		server.stop(true);
+		process.exit(0);
+	};
+	process.on("SIGINT", shutdown);
+	process.on("SIGTERM", shutdown);
+}
diff --git a/turbo.json b/turbo.json
index 110f9bd94..ee963ebbc 100644
--- a/turbo.json
+++ b/turbo.json
@@ -1,5 +1,5 @@
 {
-	"$schema": "https://turborepo.dev/schema.json",
+	"$schema": "https://v2-10-12.turborepo.dev/schema.json",
 	"ui": "tui",
 	"globalEnv": ["NODE_ENV"],
 	"globalPassThroughEnv": [
@@ -26,10 +26,36 @@
 		"PERPLEXITY_API_KEY",
 		"GITHUB_TOKEN",
 		"BLOB_READ_WRITE_TOKEN",
+		"R2_ACCOUNT_ID",
+		"R2_ACCESS_KEY_ID",
+		"R2_SECRET_ACCESS_KEY",
+		"R2_BUCKET",
 		"AI_GATEWAY_API_KEY",
 		"VERCEL_OIDC_TOKEN",
 		"AGENT_URL",
 		"AGENT_BRIDGE_SECRET",
+		"XMPP_COMPONENT_ENABLED",
+		"XMPP_COMPONENT_JID",
+		"XMPP_COMPONENT_SECRET",
+		"XMPP_COMPONENT_SERVICE",
+		"XMPP_ORGANIZATION_ID",
+		"XMPP_DEFAULT_AGENT_JID",
+		"XMPP_AGENT_DOMAIN",
+		"XMPP_SERVER_DOMAIN",
+		"XMPP_GATEWAY_ID",
+		"XMPP_AGENT_VERSION",
+		"XMPP_ALLOWED_CALLER_DOMAINS",
+		"XMPP_ALLOW_DESTRUCTIVE_CALLERS",
+		"XMPP_XML_LANG",
+		"XMPP_RECEIPT_TIMEOUT_MS",
+		"XMPP_RECEIPT_MAX_RESENDS",
+		"XMPP_RECEIPT_SWEEP_MS",
+		"XMPP_RECONNECT_INITIAL_MS",
+		"XMPP_RECONNECT_MAX_MS",
+		"XMPP_PING_INTERVAL_MS",
+		"XMPP_PING_TIMEOUT_MS",
+		"XMPP_PING_FAILURE_THRESHOLD",
+		"XMPP_MAX_PENDING_IQ_REQUESTS",
 		"CRM_TELEMETRY_DISABLED",
 		"DO_NOT_TRACK",
 		"VERCEL",
diff --git a/vendor/FORK-DELTA.md b/vendor/FORK-DELTA.md
new file mode 100644
index 000000000..84b38be98
--- /dev/null
+++ b/vendor/FORK-DELTA.md
@@ -0,0 +1,65 @@
+# Kaneo fork delta
+
+The fork is the trunk. Upstream is a drain. All work lands here first, and generic
+improvements are donated upstream as separate pull requests so that upstream merges
+shrink this delta instead of growing it. Nothing waits on upstream.
+
+## Source
+
+Kaneo is a git **submodule** at `vendor/kaneo`, pointing at a branch on the fork.
+The deltas below live in that branch, not in this repository.
+
+- Fork: https://github.com/romanbsd/kaneo
+- Branch: `crm-integration`
+- Pinned commit: `bfa867bba54d8f2ec0a8e376fe4f4b81969dd97c`
+- Based on upstream: `46539164c68669cec15b1528835c10ad0a66355e`
+
+## Updating the submodule
+
+Rebase the fork branch on upstream main, then bump the pointer here:
+
+```sh
+git -C vendor/kaneo fetch origin
+git -C vendor/kaneo checkout crm-integration
+git -C vendor/kaneo merge origin/main     # resolve deltas, if any
+git -C vendor/kaneo push origin crm-integration
+git -C vendor/kaneo log --oneline -1
+git add vendor/kaneo                     # records the new commit
+```
+
+A fresh checkout needs the submodule initialized and kaneo's dependencies
+installed before `dev:kaneo` runs:
+
+```sh
+git submodule update --init vendor/kaneo
+cd vendor/kaneo && bun install
+```
+
+## Rules
+
+- `vendor/` is outside the bun workspaces on purpose. The root `turbo.json` and
+  `package.json` do not see it, so a broken Kaneo build cannot take down the CRM's.
+  When a piece of Kaneo is brought into the CRM build, it is extracted first and wired
+  into `packages/*` or `apps/*` on its own.
+- Generic packages (the domain model, any binding) never import `@crm/*`, never read a
+  constant from the CRM, never assume a single tenant. A change that trips that rule is
+  fork-specific and stays here.
+- One root `.env`. No per-package `.env`.
+- A bundled Kaneo feature is an optional capability: a missing key removes the feature,
+  never throws.
+
+## Delta log
+
+A change in this file, with its reason. Generic improvements are tracked as upstream
+pull requests; only fork-specific or unmerged changes are listed.
+
+| Change | Reason | Upstream PR |
+| --- | --- | --- |
+| Removed `apps/web/.env.development` and `.env.production` | One root `.env` rule; per-app env files are placeholders that invite confusion | — |
+| Renamed `activity` table to `task_activity` in `apps/api/src/database/schema.ts` | Collides with the CRM's live `activity` timeline table in the one shared schema; the CRM's keeps the name | — |
+| Renamed `invitation` table and its indexes to `workspace_invitation*` in `apps/api/src/database/schema.ts` | Collides with the CRM's better-auth org-plugin `invitation` table and its auto-named indexes | — |
+| Renamed shared auth table columns (`user`, `session`, `account`, `verification`, `apikey`) to camelCase in `apps/api/src/database/schema.ts` | The CRM owns these tables with camelCase physical names; kaneo's auth reads them | — |
+| Gated the startup Drizzle migrations and schema utilities behind `KANEO_SKIP_DRIZZLE_MIGRATIONS` in `apps/api/src/index.ts` | Prisma owns the schema; kaneo's own migrator must not run against the shared database | — |
+| Set `advanced.cookiePrefix: "crm"` in `apps/api/src/auth.ts` | Shares the CRM's session cookie; one session token valid at both apps (same secret and session table) | — |
+| Dropped `team.member_count` and `team_member.membership_key` from drizzle | Prisma `Team`/`TeamMember` never stored them; drizzle now matches the shared schema | — |
+| `resolve-database-url` prefers `TEST_DATABASE_URL` | Kaneo's Drizzle and the CRM's Prisma share the test database under the repo test convention | — |
diff --git a/vendor/kaneo b/vendor/kaneo
new file mode 160000
index 000000000..ec78c8b69
--- /dev/null
+++ b/vendor/kaneo
@@ -0,0 +1 @@
+Subproject commit ec78c8b695d565aa1dba71859ccb6173861ce3de